update vcs version

Fix file token expiry

.env

@@ -103,6 +103,7 @@ _APP_MAINTENANCE_RETENTION_USAGE_HOURLY=8640000
 _APP_MAINTENANCE_RETENTION_SCHEDULES=86400
 _APP_USAGE_STATS=enabled
 _APP_LOGGING_CONFIG=
+_APP_LOGGING_CONFIG_REALTIME=
 _APP_GRAPHQL_MAX_BATCH_SIZE=10
 _APP_GRAPHQL_MAX_COMPLEXITY=250
 _APP_GRAPHQL_MAX_DEPTH=4

app/cli.php

@@ -9,6 +9,7 @@ use Appwrite\Event\StatsResources;
 use Appwrite\Event\StatsUsage;
 use Appwrite\Platform\Appwrite;
 use Appwrite\Runtimes\Runtimes;
+use Appwrite\Utopia\Database\Documents\User;
 use Executor\Executor;
 use Swoole\Runtime;
 use Swoole\Timer;
@@ -40,6 +41,8 @@ Config::setParam('runtimes', (new Runtimes('v5'))->getAll(supported: false));
 // require controllers after overwriting runtimes
 require_once __DIR__ . '/controllers/general.php';
 
+Authorization::disable();
+
 CLI::setResource('register', fn () => $register);
 
 CLI::setResource('cache', function ($pools) {
@@ -57,13 +60,7 @@ CLI::setResource('pools', function (Registry $register) {
     return $register->get('pools');
 }, ['register']);
 
-CLI::setResource('authorization', function () {
-    $authorization = new Authorization();
-    $authorization->disable();
-    return $authorization;
-}, []);
-
-CLI::setResource('dbForPlatform', function ($pools, $cache, $authorization) {
+CLI::setResource('dbForPlatform', function ($pools, $cache) {
     $sleep = 3;
     $maxAttempts = 5;
     $attempts = 0;
@@ -77,10 +74,10 @@ CLI::setResource('dbForPlatform', function ($pools, $cache, $authorization) {
             $dbForPlatform = new Database($adapter, $cache);
 
             $dbForPlatform
-                ->setAuthorization($authorization)
                 ->setNamespace('_console')
                 ->setMetadata('host', \gethostname())
                 ->setMetadata('project', 'console');
+            $dbForPlatform->setDocumentType('users', User::class);
 
             // Ensure tables exist
             $collections = Config::getParam('collections', [])['console'];
@@ -102,7 +99,7 @@ CLI::setResource('dbForPlatform', function ($pools, $cache, $authorization) {
     }
 
     return $dbForPlatform;
-}, ['pools', 'cache', 'authorization']);
+}, ['pools', 'cache']);
 
 CLI::setResource('console', function () {
     return new Document(Config::getParam('console'));
@@ -113,10 +110,10 @@ CLI::setResource(
     fn () => fn (Document $project, string $resourceType, ?string $resourceId) => false
 );
 
-CLI::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache, $authorization) {
+CLI::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache) {
     $databases = []; // TODO: @Meldiron This should probably be responsibility of utopia-php/pools
 
-    return function (Document $project) use ($pools, $dbForPlatform, $cache, $authorization, &$databases) {
+    return function (Document $project) use ($pools, $dbForPlatform, $cache, &$databases) {
         if ($project->isEmpty() || $project->getId() === 'console') {
             return $dbForPlatform;
         }
@@ -149,7 +146,6 @@ CLI::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform
 
         $adapter = new DatabasePool($pools->get($dsn->getHost()));
         $database = new Database($adapter, $cache);
-
         $databases[$dsn->getHost()] = $database;
         $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
 
@@ -166,18 +162,17 @@ CLI::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform
         }
 
         $database
-            ->setAuthorization($authorization)
             ->setMetadata('host', \gethostname())
             ->setMetadata('project', $project->getId());
 
         return $database;
     };
-}, ['pools', 'dbForPlatform', 'cache', 'authorization']);
+}, ['pools', 'dbForPlatform', 'cache']);
 
-CLI::setResource('getLogsDB', function (Group $pools, Cache $cache, Authorization $authorization) {
+CLI::setResource('getLogsDB', function (Group $pools, Cache $cache) {
     $database = null;
 
-    return function (?Document $project = null) use ($pools, $cache, $database, $authorization) {
+    return function (?Document $project = null) use ($pools, $cache, $database) {
         if ($database !== null && $project !== null && !$project->isEmpty() && $project->getId() !== 'console') {
             $database->setTenant((int)$project->getSequence());
             return $database;
@@ -187,7 +182,6 @@ CLI::setResource('getLogsDB', function (Group $pools, Cache $cache, Authorizatio
         $database = new Database($adapter, $cache);
 
         $database
-            ->setAuthorization($authorization)
             ->setSharedTables(true)
             ->setNamespace('logsV1')
             ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_TASK)
@@ -200,7 +194,7 @@ CLI::setResource('getLogsDB', function (Group $pools, Cache $cache, Authorizatio
 
         return $database;
     };
-}, ['pools', 'cache', 'authorization']);
+}, ['pools', 'cache']);
 CLI::setResource('publisher', function (Group $pools) {
     return new BrokerPool(publisher: $pools->get('publisher'));
 }, ['pools']);

app/config/collections/common.php

@@ -1,6 +1,6 @@
 <?php
 
-use Appwrite\Auth\Auth;
+use Utopia\Auth\Hashes\Argon2;
 use Utopia\Database\Database;
 use Utopia\Database\Helpers\ID;
 
@@ -173,7 +173,7 @@ return [
                 'size' => 256,
                 'signed' => true,
                 'required' => false,
-                'default' => Auth::DEFAULT_ALGO,
+                'default' => (new Argon2())->getName(),
                 'array' => false,
                 'filters' => [],
             ],
@@ -184,7 +184,7 @@ return [
                 'size' => 65535,
                 'signed' => true,
                 'required' => false,
-                'default' => Auth::DEFAULT_ALGO_OPTIONS,
+                'default' => (new Argon2())->getOptions(),
                 'array' => false,
                 'filters' => ['json'],
             ],

app/config/console.php

@@ -4,7 +4,6 @@
  * Initializes console project document.
  */
 
-use Appwrite\Auth\Auth;
 use Appwrite\Network\Platform;
 use Utopia\Database\Helpers\ID;
 use Utopia\System\System;
@@ -38,7 +37,7 @@ $console = [
         'mockNumbers' => [],
         'invites' => System::getEnv('_APP_CONSOLE_INVITES', 'enabled') === 'enabled',
         'limit' => (System::getEnv('_APP_CONSOLE_WHITELIST_ROOT', 'enabled') === 'enabled') ? 1 : 0, // limit signup to 1 user
-        'duration' => Auth::TOKEN_EXPIRATION_LOGIN_LONG, // 1 Year in seconds
+        'duration' => TOKEN_EXPIRATION_LOGIN_LONG, // 1 Year in seconds
         'sessionAlerts' => System::getEnv('_APP_CONSOLE_SESSION_ALERTS', 'disabled') === 'enabled',
         'invalidateSessions' => true
     ],

app/config/frameworks.php

@@ -215,7 +215,7 @@ return [
                 'key' => 'ssr',
                 'buildCommand' => 'npm run build',
                 'installCommand' => 'npm install',
-                'outputDirectory' => './dist',
+                'outputDirectory' => './.output',
                 'startCommand' => 'bash helpers/tanstack-start/server.sh',
             ],
             'static' => [

app/config/platforms.php

@@ -60,7 +60,7 @@ return [
             [
                 'key' => 'flutter',
                 'name' => 'Flutter',
-                'version' => '20.3.1',
+                'version' => '20.3.2',
                 'url' => 'https://github.com/appwrite/sdk-for-flutter',
                 'package' => 'https://pub.dev/packages/appwrite',
                 'enabled' => true,
@@ -226,7 +226,7 @@ return [
             [
                 'key' => 'cli',
                 'name' => 'Command Line',
-                'version' => '11.1.1',
+                'version' => '12.0.0',
                 'url' => 'https://github.com/appwrite/sdk-for-cli',
                 'package' => 'https://www.npmjs.com/package/appwrite-cli',
                 'enabled' => true,

app/config/roles.php

@@ -1,6 +1,6 @@
 <?php
 
-use Appwrite\Auth\Auth;
+use Appwrite\Utopia\Database\Documents\User;
 
 $member = [
     'global',
@@ -92,7 +92,7 @@ $admins = [
 ];
 
 return [
-    Auth::USER_ROLE_GUESTS => [
+    User::ROLE_GUESTS => [
         'label' => 'Guests',
         'scopes' => [
             'global',
@@ -112,23 +112,23 @@ return [
             'execution.write',
         ],
     ],
-    Auth::USER_ROLE_USERS => [
+    User::ROLE_USERS => [
         'label' => 'Users',
         'scopes' => \array_merge($member),
     ],
-    Auth::USER_ROLE_ADMIN => [
+    User::ROLE_ADMIN => [
         'label' => 'Admin',
         'scopes' => \array_merge($admins),
     ],
-    Auth::USER_ROLE_DEVELOPER => [
+    User::ROLE_DEVELOPER => [
         'label' => 'Developer',
         'scopes' => \array_merge($admins),
     ],
-    Auth::USER_ROLE_OWNER => [
+    User::ROLE_OWNER => [
         'label' => 'Owner',
         'scopes' => \array_merge($member, $admins),
     ],
-    Auth::USER_ROLE_APPS => [
+    User::ROLE_APPS => [
         'label' => 'Applications',
         'scopes' => ['global', 'health.read', 'graphql'],
     ],

app/config/scopes.php

@@ -47,10 +47,10 @@ return [ // List of publicly visible scopes
         'description' => 'Access to create, update, and delete your project\'s database table\'s columns',
     ],
     'indexes.read' => [
-        'description' => 'Access to read your project\'s database collection\'s indexes',
+        'description' => 'Access to read your project\'s database table\'s indexes',
     ],
     'indexes.write' => [
-        'description' => 'Access to create, update, and delete your project\'s database collection\'s indexes',
+        'description' => 'Access to create, update, and delete your project\'s database table\'s indexes',
     ],
     'documents.read'  => [
         'description' => 'Access to read your project\'s database documents',

app/config/specs/open-api3-1.8.x-console.json

@@ -14424,7 +14424,7 @@
                                             "branch",
                                             "tag"
                                         ],
-                                        "x-enum-name": null,
+                                        "x-enum-name": "TemplateReferenceType",
                                         "x-enum-keys": []
                                     },
                                     "reference": {
@@ -14524,7 +14524,7 @@
                                             "branch",
                                             "commit"
                                         ],
-                                        "x-enum-name": "VCSDeploymentType",
+                                        "x-enum-name": "VCSReferenceType",
                                         "x-enum-keys": []
                                     },
                                     "reference": {
@@ -32337,7 +32337,7 @@
                                             "commit",
                                             "tag"
                                         ],
-                                        "x-enum-name": null,
+                                        "x-enum-name": "TemplateReferenceType",
                                         "x-enum-keys": []
                                     },
                                     "reference": {
@@ -32438,7 +32438,7 @@
                                             "commit",
                                             "tag"
                                         ],
-                                        "x-enum-name": "VCSDeploymentType",
+                                        "x-enum-name": "VCSReferenceType",
                                         "x-enum-keys": []
                                     },
                                     "reference": {

app/config/specs/open-api3-1.8.x-server.json

@@ -13213,7 +13213,7 @@
                                             "branch",
                                             "tag"
                                         ],
-                                        "x-enum-name": null,
+                                        "x-enum-name": "TemplateReferenceType",
                                         "x-enum-keys": []
                                     },
                                     "reference": {
@@ -13314,7 +13314,7 @@
                                             "branch",
                                             "commit"
                                         ],
-                                        "x-enum-name": "VCSDeploymentType",
+                                        "x-enum-name": "VCSReferenceType",
                                         "x-enum-keys": []
                                     },
                                     "reference": {
@@ -22861,7 +22861,7 @@
                                             "commit",
                                             "tag"
                                         ],
-                                        "x-enum-name": null,
+                                        "x-enum-name": "TemplateReferenceType",
                                         "x-enum-keys": []
                                     },
                                     "reference": {
@@ -22963,7 +22963,7 @@
                                             "commit",
                                             "tag"
                                         ],
-                                        "x-enum-name": "VCSDeploymentType",
+                                        "x-enum-name": "VCSReferenceType",
                                         "x-enum-keys": []
                                     },
                                     "reference": {

app/config/specs/open-api3-latest-console.json

@@ -14424,7 +14424,7 @@
                                             "branch",
                                             "tag"
                                         ],
-                                        "x-enum-name": null,
+                                        "x-enum-name": "TemplateReferenceType",
                                         "x-enum-keys": []
                                     },
                                     "reference": {
@@ -14524,7 +14524,7 @@
                                             "branch",
                                             "commit"
                                         ],
-                                        "x-enum-name": "VCSDeploymentType",
+                                        "x-enum-name": "VCSReferenceType",
                                         "x-enum-keys": []
                                     },
                                     "reference": {
@@ -32337,7 +32337,7 @@
                                             "commit",
                                             "tag"
                                         ],
-                                        "x-enum-name": null,
+                                        "x-enum-name": "TemplateReferenceType",
                                         "x-enum-keys": []
                                     },
                                     "reference": {
@@ -32438,7 +32438,7 @@
                                             "commit",
                                             "tag"
                                         ],
-                                        "x-enum-name": "VCSDeploymentType",
+                                        "x-enum-name": "VCSReferenceType",
                                         "x-enum-keys": []
                                     },
                                     "reference": {

app/config/specs/open-api3-latest-server.json

@@ -13213,7 +13213,7 @@
                                             "branch",
                                             "tag"
                                         ],
-                                        "x-enum-name": null,
+                                        "x-enum-name": "TemplateReferenceType",
                                         "x-enum-keys": []
                                     },
                                     "reference": {
@@ -13314,7 +13314,7 @@
                                             "branch",
                                             "commit"
                                         ],
-                                        "x-enum-name": "VCSDeploymentType",
+                                        "x-enum-name": "VCSReferenceType",
                                         "x-enum-keys": []
                                     },
                                     "reference": {
@@ -22861,7 +22861,7 @@
                                             "commit",
                                             "tag"
                                         ],
-                                        "x-enum-name": null,
+                                        "x-enum-name": "TemplateReferenceType",
                                         "x-enum-keys": []
                                     },
                                     "reference": {
@@ -22963,7 +22963,7 @@
                                             "commit",
                                             "tag"
                                         ],
-                                        "x-enum-name": "VCSDeploymentType",
+                                        "x-enum-name": "VCSReferenceType",
                                         "x-enum-keys": []
                                     },
                                     "reference": {

app/config/specs/swagger2-1.8.x-console.json

@@ -14366,7 +14366,7 @@
                                         "branch",
                                         "tag"
                                     ],
-                                    "x-enum-name": null,
+                                    "x-enum-name": "TemplateReferenceType",
                                     "x-enum-keys": []
                                 },
                                 "reference": {
@@ -14467,7 +14467,7 @@
                                         "branch",
                                         "commit"
                                     ],
-                                    "x-enum-name": "VCSDeploymentType",
+                                    "x-enum-name": "VCSReferenceType",
                                     "x-enum-keys": []
                                 },
                                 "reference": {
@@ -32441,7 +32441,7 @@
                                         "commit",
                                         "tag"
                                     ],
-                                    "x-enum-name": null,
+                                    "x-enum-name": "TemplateReferenceType",
                                     "x-enum-keys": []
                                 },
                                 "reference": {
@@ -32543,7 +32543,7 @@
                                         "commit",
                                         "tag"
                                     ],
-                                    "x-enum-name": "VCSDeploymentType",
+                                    "x-enum-name": "VCSReferenceType",
                                     "x-enum-keys": []
                                 },
                                 "reference": {

app/config/specs/swagger2-1.8.x-server.json

@@ -13182,7 +13182,7 @@
                                         "branch",
                                         "tag"
                                     ],
-                                    "x-enum-name": null,
+                                    "x-enum-name": "TemplateReferenceType",
                                     "x-enum-keys": []
                                 },
                                 "reference": {
@@ -13284,7 +13284,7 @@
                                         "branch",
                                         "commit"
                                     ],
-                                    "x-enum-name": "VCSDeploymentType",
+                                    "x-enum-name": "VCSReferenceType",
                                     "x-enum-keys": []
                                 },
                                 "reference": {
@@ -23014,7 +23014,7 @@
                                         "commit",
                                         "tag"
                                     ],
-                                    "x-enum-name": null,
+                                    "x-enum-name": "TemplateReferenceType",
                                     "x-enum-keys": []
                                 },
                                 "reference": {
@@ -23117,7 +23117,7 @@
                                         "commit",
                                         "tag"
                                     ],
-                                    "x-enum-name": "VCSDeploymentType",
+                                    "x-enum-name": "VCSReferenceType",
                                     "x-enum-keys": []
                                 },
                                 "reference": {

app/config/specs/swagger2-latest-console.json

@@ -14366,7 +14366,7 @@
                                         "branch",
                                         "tag"
                                     ],
-                                    "x-enum-name": null,
+                                    "x-enum-name": "TemplateReferenceType",
                                     "x-enum-keys": []
                                 },
                                 "reference": {
@@ -14467,7 +14467,7 @@
                                         "branch",
                                         "commit"
                                     ],
-                                    "x-enum-name": "VCSDeploymentType",
+                                    "x-enum-name": "VCSReferenceType",
                                     "x-enum-keys": []
                                 },
                                 "reference": {
@@ -32441,7 +32441,7 @@
                                         "commit",
                                         "tag"
                                     ],
-                                    "x-enum-name": null,
+                                    "x-enum-name": "TemplateReferenceType",
                                     "x-enum-keys": []
                                 },
                                 "reference": {
@@ -32543,7 +32543,7 @@
                                         "commit",
                                         "tag"
                                     ],
-                                    "x-enum-name": "VCSDeploymentType",
+                                    "x-enum-name": "VCSReferenceType",
                                     "x-enum-keys": []
                                 },
                                 "reference": {

app/config/specs/swagger2-latest-server.json

@@ -13182,7 +13182,7 @@
                                         "branch",
                                         "tag"
                                     ],
-                                    "x-enum-name": null,
+                                    "x-enum-name": "TemplateReferenceType",
                                     "x-enum-keys": []
                                 },
                                 "reference": {
@@ -13284,7 +13284,7 @@
                                         "branch",
                                         "commit"
                                     ],
-                                    "x-enum-name": "VCSDeploymentType",
+                                    "x-enum-name": "VCSReferenceType",
                                     "x-enum-keys": []
                                 },
                                 "reference": {
@@ -23014,7 +23014,7 @@
                                         "commit",
                                         "tag"
                                     ],
-                                    "x-enum-name": null,
+                                    "x-enum-name": "TemplateReferenceType",
                                     "x-enum-keys": []
                                 },
                                 "reference": {
@@ -23117,7 +23117,7 @@
                                         "commit",
                                         "tag"
                                     ],
-                                    "x-enum-name": "VCSDeploymentType",
+                                    "x-enum-name": "VCSReferenceType",
                                     "x-enum-keys": []
                                 },
                                 "reference": {

app/config/storage/resource_limits.php

@@ -3,6 +3,4 @@
 use Utopia\Image\Image;
 use Utopia\System\System;
 
-if (\class_exists('Imagick')) {
-    Image::setResourceLimit('memory', intval(System::getEnv('_APP_IMAGES_RESOURCE_LIMIT_MEMORY', 1024*1024*64)));
-}
+Image::setResourceLimit('memory', intval(System::getEnv('_APP_IMAGES_RESOURCE_LIMIT_MEMORY', 1024*1024*64)));

app/controllers/api/avatars.php

@@ -70,9 +70,9 @@ $avatarCallback = function (string $type, string $code, int $width, int $height,
     unset($image);
 };
 
-$getUserGitHub = function (string $userId, Document $project, Database $dbForProject, Database $dbForPlatform, Authorization $authorization, ?Logger $logger) {
+$getUserGitHub = function (string $userId, Document $project, Database $dbForProject, Database $dbForPlatform, ?Logger $logger) {
     try {
-        $user = $authorization->skip(fn () => $dbForPlatform->getDocument('users', $userId));
+        $user = Authorization::skip(fn () => $dbForPlatform->getDocument('users', $userId));
 
         $sessions = $user->getAttribute('sessions', []);
 
@@ -123,7 +123,7 @@ $getUserGitHub = function (string $userId, Document $project, Database $dbForPro
                     ->setAttribute('providerRefreshToken', $refreshToken)
                     ->setAttribute('providerAccessTokenExpiry', DateTime::addSeconds(new \DateTime(), (int)$oauth2->getAccessTokenExpiry('')));
 
-                $authorization->skip(fn () => $dbForProject->updateDocument('sessions', $gitHubSession->getId(), $gitHubSession));
+                Authorization::skip(fn () => $dbForProject->updateDocument('sessions', $gitHubSession->getId(), $gitHubSession));
 
                 $dbForProject->purgeCachedDocument('users', $user->getId());
             } catch (Throwable $err) {
@@ -131,7 +131,7 @@ $getUserGitHub = function (string $userId, Document $project, Database $dbForPro
                 do {
                     $previousAccessToken = $gitHubSession->getAttribute('providerAccessToken');
 
-                    $user = $authorization->skip(fn () => $dbForPlatform->getDocument('users', $userId));
+                    $user = Authorization::skip(fn () => $dbForPlatform->getDocument('users', $userId));
                     $sessions = $user->getAttribute('sessions', []);
 
                     $gitHubSession = new Document();
@@ -841,9 +841,8 @@ App::get('/v1/cards/cloud')
     ->inject('contributors')
     ->inject('employees')
     ->inject('logger')
-    ->inject('authorization')
-    ->action(function (string $userId, string $mock, int $width, int $height, Document $user, Document $project, Database $dbForProject, Database $dbForPlatform, Response $response, array $heroes, array $contributors, array $employees, ?Logger $logger, Authorization $authorization) use ($getUserGitHub) {
-        $user = $authorization->skip(fn () => $dbForPlatform->getDocument('users', $userId));
+    ->action(function (string $userId, string $mock, int $width, int $height, Document $user, Document $project, Database $dbForProject, Database $dbForPlatform, Response $response, array $heroes, array $contributors, array $employees, ?Logger $logger) use ($getUserGitHub) {
+        $user = Authorization::skip(fn () => $dbForPlatform->getDocument('users', $userId));
 
         if ($user->isEmpty() && empty($mock)) {
             throw new Exception(Exception::USER_NOT_FOUND);
@@ -854,7 +853,7 @@ App::get('/v1/cards/cloud')
             $email = $user->getAttribute('email', '');
             $createdAt = new \DateTime($user->getCreatedAt());
 
-            $gitHub = $getUserGitHub($user->getId(), $project, $dbForProject, $dbForPlatform, $logger, $authorization);
+            $gitHub = $getUserGitHub($user->getId(), $project, $dbForProject, $dbForPlatform, $logger);
             $githubName = $gitHub['name'] ?? '';
             $githubId = $gitHub['id'] ?? '';
 
@@ -1049,9 +1048,8 @@ App::get('/v1/cards/cloud-back')
     ->inject('contributors')
     ->inject('employees')
     ->inject('logger')
-    ->inject('authorization')
-    ->action(function (string $userId, string $mock, int $width, int $height, Document $user, Document $project, Database $dbForProject, Database $dbForPlatform, Response $response, array $heroes, array $contributors, array $employees, ?Logger $logger, Authorization $authorization) use ($getUserGitHub) {
-        $user = $authorization->skip(fn () => $dbForPlatform->getDocument('users', $userId));
+    ->action(function (string $userId, string $mock, int $width, int $height, Document $user, Document $project, Database $dbForProject, Database $dbForPlatform, Response $response, array $heroes, array $contributors, array $employees, ?Logger $logger) use ($getUserGitHub) {
+        $user = Authorization::skip(fn () => $dbForPlatform->getDocument('users', $userId));
 
         if ($user->isEmpty() && empty($mock)) {
             throw new Exception(Exception::USER_NOT_FOUND);
@@ -1061,7 +1059,7 @@ App::get('/v1/cards/cloud-back')
             $userId = $user->getId();
             $email = $user->getAttribute('email', '');
 
-            $gitHub = $getUserGitHub($user->getId(), $project, $dbForProject, $dbForPlatform, $logger, $authorization);
+            $gitHub = $getUserGitHub($user->getId(), $project, $dbForProject, $dbForPlatform, $logger);
             $githubId = $gitHub['id'] ?? '';
 
             $isHero = \array_key_exists($email, $heroes);
@@ -1128,9 +1126,8 @@ App::get('/v1/cards/cloud-og')
     ->inject('contributors')
     ->inject('employees')
     ->inject('logger')
-    ->inject('authorization')
-    ->action(function (string $userId, string $mock, int $width, int $height, Document $user, Document $project, Database $dbForProject, Database $dbForPlatform, Response $response, array $heroes, array $contributors, array $employees, ?Logger $logger, Authorization $authorization) use ($getUserGitHub) {
-        $user = $authorization->skip(fn () => $dbForPlatform->getDocument('users', $userId));
+    ->action(function (string $userId, string $mock, int $width, int $height, Document $user, Document $project, Database $dbForProject, Database $dbForPlatform, Response $response, array $heroes, array $contributors, array $employees, ?Logger $logger) use ($getUserGitHub) {
+        $user = Authorization::skip(fn () => $dbForPlatform->getDocument('users', $userId));
 
         if ($user->isEmpty() && empty($mock)) {
             throw new Exception(Exception::USER_NOT_FOUND);
@@ -1145,7 +1142,7 @@ App::get('/v1/cards/cloud-og')
             $email = $user->getAttribute('email', '');
             $createdAt = new \DateTime($user->getCreatedAt());
 
-            $gitHub = $getUserGitHub($user->getId(), $project, $dbForProject, $dbForPlatform, $logger, $authorization);
+            $gitHub = $getUserGitHub($user->getId(), $project, $dbForProject, $dbForPlatform, $logger);
             $githubName = $gitHub['name'] ?? '';
             $githubId = $gitHub['id'] ?? '';
 

app/controllers/api/graphql.php

@@ -1,6 +1,5 @@
 <?php
 
-use Appwrite\Auth\Auth;
 use Appwrite\Extend\Exception;
 use Appwrite\Extend\Exception as AppwriteException;
 use Appwrite\GraphQL\Promises\Adapter;
@@ -9,6 +8,7 @@ use Appwrite\SDK\AuthType;
 use Appwrite\SDK\Method;
 use Appwrite\SDK\MethodType;
 use Appwrite\SDK\Response as SDKResponse;
+use Appwrite\Utopia\Database\Documents\User;
 use Appwrite\Utopia\Request;
 use Appwrite\Utopia\Response;
 use GraphQL\Error\DebugFlag;
@@ -28,12 +28,11 @@ use Utopia\Validator\Text;
 App::init()
     ->groups(['graphql'])
     ->inject('project')
-    ->inject('authorization')
-    ->action(function (Document $project, Authorization $authorization) {
+    ->action(function (Document $project) {
         if (
             array_key_exists('graphql', $project->getAttribute('apis', []))
             && !$project->getAttribute('apis', [])['graphql']
-            && !(Auth::isPrivilegedUser($authorization->getRoles()) || Auth::isAppUser($authorization->getRoles()))
+            && !(User::isPrivileged(Authorization::getRoles()) || User::isApp(Authorization::getRoles()))
         ) {
             throw new AppwriteException(AppwriteException::GENERAL_API_DISABLED);
         }

app/controllers/api/messaging.php

@@ -36,7 +36,6 @@ use Utopia\Database\Exception\Query as QueryException;
 use Utopia\Database\Helpers\ID;
 use Utopia\Database\Query;
 use Utopia\Database\Validator\Authorization;
-use Utopia\Database\Validator\Authorization\Input;
 use Utopia\Database\Validator\Datetime as DatetimeValidator;
 use Utopia\Database\Validator\Queries;
 use Utopia\Database\Validator\Query\Cursor;
@@ -1071,9 +1070,8 @@ App::get('/v1/messaging/providers')
     ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
     ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
     ->inject('dbForProject')
-    ->inject('authorization')
     ->inject('response')
-    ->action(function (array $queries, string $search, bool $includeTotal, Database $dbForProject, Authorization $authorization, Response $response) {
+    ->action(function (array $queries, string $search, bool $includeTotal, Database $dbForProject, Response $response) {
         try {
             $queries = Query::parseQueries($queries);
         } catch (QueryException $e) {
@@ -1099,7 +1097,7 @@ App::get('/v1/messaging/providers')
             }
 
             $providerId = $cursor->getValue();
-            $cursorDocument = $authorization->skip(fn () => $dbForProject->getDocument('providers', $providerId));
+            $cursorDocument = Authorization::skip(fn () => $dbForProject->getDocument('providers', $providerId));
 
             if ($cursorDocument->isEmpty()) {
                 throw new Exception(Exception::GENERAL_CURSOR_NOT_FOUND, "Provider '{$providerId}' for the 'cursor' value not found.");
@@ -2479,9 +2477,8 @@ App::get('/v1/messaging/topics')
     ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
     ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
     ->inject('dbForProject')
-    ->inject('authorization')
     ->inject('response')
-    ->action(function (array $queries, string $search, bool $includeTotal, Database $dbForProject, Authorization $authorization, Response $response) {
+    ->action(function (array $queries, string $search, bool $includeTotal, Database $dbForProject, Response $response) {
         try {
             $queries = Query::parseQueries($queries);
         } catch (QueryException $e) {
@@ -2507,7 +2504,7 @@ App::get('/v1/messaging/topics')
             }
 
             $topicId = $cursor->getValue();
-            $cursorDocument = $authorization->skip(fn () => $dbForProject->getDocument('topics', $topicId));
+            $cursorDocument = Authorization::skip(fn () => $dbForProject->getDocument('topics', $topicId));
 
             if ($cursorDocument->isEmpty()) {
                 throw new Exception(Exception::GENERAL_CURSOR_NOT_FOUND, "Topic '{$topicId}' for the 'cursor' value not found.");
@@ -2783,27 +2780,29 @@ App::post('/v1/messaging/topics/:topicId/subscribers')
     ->param('targetId', '', new UID(), 'Target ID. The target ID to link to the specified Topic ID.')
     ->inject('queueForEvents')
     ->inject('dbForProject')
-    ->inject('authorization')
     ->inject('response')
-    ->action(function (string $subscriberId, string $topicId, string $targetId, Event $queueForEvents, Database $dbForProject, Authorization $authorization, Response $response) {
+    ->action(function (string $subscriberId, string $topicId, string $targetId, Event $queueForEvents, Database $dbForProject, Response $response) {
         $subscriberId = $subscriberId == 'unique()' ? ID::unique() : $subscriberId;
 
-        $topic = $authorization->skip(fn () => $dbForProject->getDocument('topics', $topicId));
+        $topic = Authorization::skip(fn () => $dbForProject->getDocument('topics', $topicId));
 
         if ($topic->isEmpty()) {
             throw new Exception(Exception::TOPIC_NOT_FOUND);
         }
-        if (!$authorization->isValid(new Input('subscribe', $topic->getAttribute('subscribe')))) {
-            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+
+        $validator = new Authorization('subscribe');
+
+        if (!$validator->isValid($topic->getAttribute('subscribe'))) {
+            throw new Exception(Exception::USER_UNAUTHORIZED, $validator->getDescription());
         }
 
-        $target = $authorization->skip(fn () => $dbForProject->getDocument('targets', $targetId));
+        $target = Authorization::skip(fn () => $dbForProject->getDocument('targets', $targetId));
 
         if ($target->isEmpty()) {
             throw new Exception(Exception::USER_TARGET_NOT_FOUND);
         }
 
-        $user = $authorization->skip(fn () => $dbForProject->getDocument('users', $target->getAttribute('userId')));
+        $user = Authorization::skip(fn () => $dbForProject->getDocument('users', $target->getAttribute('userId')));
 
         $subscriber = new Document([
             '$id' => $subscriberId,
@@ -2836,7 +2835,7 @@ App::post('/v1/messaging/topics/:topicId/subscribers')
                 default => throw new Exception(Exception::TARGET_PROVIDER_INVALID_TYPE),
             };
 
-            $authorization->skip(fn () => $dbForProject->increaseDocumentAttribute(
+            Authorization::skip(fn () => $dbForProject->increaseDocumentAttribute(
                 'topics',
                 $topicId,
                 $totalAttribute,
@@ -2881,9 +2880,8 @@ App::get('/v1/messaging/topics/:topicId/subscribers')
     ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
     ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
     ->inject('dbForProject')
-    ->inject('authorization')
     ->inject('response')
-    ->action(function (string $topicId, array $queries, string $search, bool $includeTotal, Database $dbForProject, Authorization $authorization, Response $response) {
+    ->action(function (string $topicId, array $queries, string $search, bool $includeTotal, Database $dbForProject, Response $response) {
         try {
             $queries = Query::parseQueries($queries);
         } catch (QueryException $e) {
@@ -2894,7 +2892,7 @@ App::get('/v1/messaging/topics/:topicId/subscribers')
             $queries[] = Query::search('search', $search);
         }
 
-        $topic = $authorization->skip(fn () => $dbForProject->getDocument('topics', $topicId));
+        $topic = Authorization::skip(fn () => $dbForProject->getDocument('topics', $topicId));
 
         if ($topic->isEmpty()) {
             throw new Exception(Exception::TOPIC_NOT_FOUND);
@@ -2917,7 +2915,7 @@ App::get('/v1/messaging/topics/:topicId/subscribers')
             }
 
             $subscriberId = $cursor->getValue();
-            $cursorDocument = $authorization->skip(fn () => $dbForProject->getDocument('subscribers', $subscriberId));
+            $cursorDocument = Authorization::skip(fn () => $dbForProject->getDocument('subscribers', $subscriberId));
 
             if ($cursorDocument->isEmpty()) {
                 throw new Exception(Exception::GENERAL_CURSOR_NOT_FOUND, "Subscriber '{$subscriberId}' for the 'cursor' value not found.");
@@ -2931,10 +2929,10 @@ App::get('/v1/messaging/topics/:topicId/subscribers')
             throw new Exception(Exception::DATABASE_QUERY_ORDER_NULL, "The order attribute '{$e->getAttribute()}' had a null value. Cursor pagination requires all documents order attribute values are non-null.");
         }
 
-        $subscribers = batch(\array_map(function (Document $subscriber) use ($dbForProject, $authorization) {
-            return function () use ($subscriber, $dbForProject, $authorization) {
-                $target = $authorization->skip(fn () => $dbForProject->getDocument('targets', $subscriber->getAttribute('targetId')));
-                $user = $authorization->skip(fn () => $dbForProject->getDocument('users', $target->getAttribute('userId')));
+        $subscribers = batch(\array_map(function (Document $subscriber) use ($dbForProject) {
+            return function () use ($subscriber, $dbForProject) {
+                $target = Authorization::skip(fn () => $dbForProject->getDocument('targets', $subscriber->getAttribute('targetId')));
+                $user = Authorization::skip(fn () => $dbForProject->getDocument('users', $target->getAttribute('userId')));
 
                 return $subscriber
                     ->setAttribute('target', $target)
@@ -3069,10 +3067,9 @@ App::get('/v1/messaging/topics/:topicId/subscribers/:subscriberId')
     ->param('topicId', '', new UID(), 'Topic ID. The topic ID subscribed to.')
     ->param('subscriberId', '', new UID(), 'Subscriber ID.')
     ->inject('dbForProject')
-    ->inject('authorization')
     ->inject('response')
-    ->action(function (string $topicId, string $subscriberId, Database $dbForProject, Authorization $authorization, Response $response) {
-        $topic = $authorization->skip(fn () => $dbForProject->getDocument('topics', $topicId));
+    ->action(function (string $topicId, string $subscriberId, Database $dbForProject, Response $response) {
+        $topic = Authorization::skip(fn () => $dbForProject->getDocument('topics', $topicId));
 
         if ($topic->isEmpty()) {
             throw new Exception(Exception::TOPIC_NOT_FOUND);
@@ -3084,8 +3081,8 @@ App::get('/v1/messaging/topics/:topicId/subscribers/:subscriberId')
             throw new Exception(Exception::SUBSCRIBER_NOT_FOUND);
         }
 
-        $target = $authorization->skip(fn () => $dbForProject->getDocument('targets', $subscriber->getAttribute('targetId')));
-        $user = $authorization->skip(fn () => $dbForProject->getDocument('users', $target->getAttribute('userId')));
+        $target = Authorization::skip(fn () => $dbForProject->getDocument('targets', $subscriber->getAttribute('targetId')));
+        $user = Authorization::skip(fn () => $dbForProject->getDocument('users', $target->getAttribute('userId')));
 
         $subscriber
             ->setAttribute('target', $target)
@@ -3121,10 +3118,9 @@ App::delete('/v1/messaging/topics/:topicId/subscribers/:subscriberId')
     ->param('subscriberId', '', new UID(), 'Subscriber ID.')
     ->inject('queueForEvents')
     ->inject('dbForProject')
-    ->inject('authorization')
     ->inject('response')
-    ->action(function (string $topicId, string $subscriberId, Event $queueForEvents, Database $dbForProject, Authorization $authorization, Response $response) {
-        $topic = $authorization->skip(fn () => $dbForProject->getDocument('topics', $topicId));
+    ->action(function (string $topicId, string $subscriberId, Event $queueForEvents, Database $dbForProject, Response $response) {
+        $topic = Authorization::skip(fn () => $dbForProject->getDocument('topics', $topicId));
 
         if ($topic->isEmpty()) {
             throw new Exception(Exception::TOPIC_NOT_FOUND);
@@ -3147,7 +3143,7 @@ App::delete('/v1/messaging/topics/:topicId/subscribers/:subscriberId')
             default => throw new Exception(Exception::TARGET_PROVIDER_INVALID_TYPE),
         };
 
-        $authorization->skip(fn () => $dbForProject->decreaseDocumentAttribute(
+        Authorization::skip(fn () => $dbForProject->decreaseDocumentAttribute(
             'topics',
             $topicId,
             $totalAttribute,
@@ -3704,9 +3700,8 @@ App::get('/v1/messaging/messages')
     ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
     ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
     ->inject('dbForProject')
-    ->inject('authorization')
     ->inject('response')
-    ->action(function (array $queries, string $search, bool $includeTotal, Database $dbForProject, Authorization $authorization, Response $response) {
+    ->action(function (array $queries, string $search, bool $includeTotal, Database $dbForProject, Response $response) {
         try {
             $queries = Query::parseQueries($queries);
         } catch (QueryException $e) {
@@ -3732,7 +3727,7 @@ App::get('/v1/messaging/messages')
             }
 
             $messageId = $cursor->getValue();
-            $cursorDocument = $authorization->skip(fn () => $dbForProject->getDocument('messages', $messageId));
+            $cursorDocument = Authorization::skip(fn () => $dbForProject->getDocument('messages', $messageId));
 
             if ($cursorDocument->isEmpty()) {
                 throw new Exception(Exception::GENERAL_CURSOR_NOT_FOUND, "Message '{$messageId}' for the 'cursor' value not found.");

app/controllers/api/migrations.php

@@ -1,6 +1,5 @@
 <?php
 
-use Appwrite\Auth\Auth;
 use Appwrite\Event\Event;
 use Appwrite\Event\Migration;
 use Appwrite\Extend\Exception;
@@ -335,19 +334,26 @@ App::post('/v1/migrations/csv/imports')
     ->inject('response')
     ->inject('dbForProject')
     ->inject('dbForPlatform')
-    ->inject('authorization')
     ->inject('project')
     ->inject('deviceForFiles')
     ->inject('deviceForMigrations')
     ->inject('queueForEvents')
     ->inject('queueForMigrations')
-    ->action(function (string $bucketId, string $fileId, string $resourceId, bool $internalFile, Response $response, Database $dbForProject, Database $dbForPlatform, Authorization $authorization, Document $project, Device $deviceForFiles, Device $deviceForMigrations, Event $queueForEvents, Migration $queueForMigrations) {
-        $isAPIKey = Auth::isAppUser($authorization->getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser($authorization->getRoles());
-        if ($internalFile && !$isPrivilegedUser) {
-            throw new Exception(Exception::USER_UNAUTHORIZED);
-        }
-        $bucket = $authorization->skip(function () use ($internalFile, $dbForPlatform, $dbForProject, $bucketId) {
+    ->action(function (
+        string $bucketId,
+        string $fileId,
+        string $resourceId,
+        bool $internalFile,
+        Response $response,
+        Database $dbForProject,
+        Database $dbForPlatform,
+        Document $project,
+        Device $deviceForFiles,
+        Device $deviceForMigrations,
+        Event $queueForEvents,
+        Migration $queueForMigrations
+    ) {
+        $bucket = Authorization::skip(function () use ($internalFile, $dbForPlatform, $dbForProject, $bucketId) {
             if ($internalFile) {
                 return $dbForPlatform->getDocument('buckets', 'default');
             }
@@ -358,7 +364,7 @@ App::post('/v1/migrations/csv/imports')
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
         }
 
-        $file = $authorization->skip(fn () => $internalFile ? $dbForPlatform->getDocument('bucket_' . $bucket->getSequence(), $fileId) : $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+        $file = Authorization::skip(fn () => $internalFile ? $dbForPlatform->getDocument('bucket_' . $bucket->getSequence(), $fileId) : $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
         if ($file->isEmpty()) {
             throw new Exception(Exception::STORAGE_FILE_NOT_FOUND);
         }
@@ -474,7 +480,6 @@ App::post('/v1/migrations/csv/exports')
     ->inject('response')
     ->inject('dbForProject')
     ->inject('dbForPlatform')
-    ->inject('authorization')
     ->inject('project')
     ->inject('queueForEvents')
     ->inject('queueForMigrations')
@@ -492,7 +497,6 @@ App::post('/v1/migrations/csv/exports')
         Response $response,
         Database $dbForProject,
         Database $dbForPlatform,
-        Authorization $authorization,
         Document $project,
         Event $queueForEvents,
         Migration $queueForMigrations
@@ -503,7 +507,7 @@ App::post('/v1/migrations/csv/exports')
             throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
         }
 
-        $bucket = $authorization->skip(fn () => $dbForPlatform->getDocument('buckets', 'default'));
+        $bucket = Authorization::skip(fn () => $dbForPlatform->getDocument('buckets', 'default'));
         if ($bucket->isEmpty()) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
         }
@@ -516,12 +520,12 @@ App::post('/v1/migrations/csv/exports')
             throw new Exception(Exception::COLLECTION_NOT_FOUND);
         }
 
-        $database = $authorization->skip(fn () => $dbForProject->getDocument('databases', $databaseId));
+        $database = Authorization::skip(fn () => $dbForProject->getDocument('databases', $databaseId));
         if ($database->isEmpty()) {
             throw new Exception(Exception::DATABASE_NOT_FOUND);
         }
 
-        $collection = $authorization->skip(fn () => $dbForProject->getDocument('database_' . $database->getSequence(), $collectionId));
+        $collection = Authorization::skip(fn () => $dbForProject->getDocument('database_' . $database->getSequence(), $collectionId));
         if ($collection->isEmpty()) {
             throw new Exception(Exception::COLLECTION_NOT_FOUND);
         }

app/controllers/api/project.php

@@ -45,10 +45,9 @@ App::get('/v1/project/usage')
     ->inject('response')
     ->inject('project')
     ->inject('dbForProject')
-    ->inject('authorization')
     ->inject('getLogsDB')
     ->inject('smsRates')
-    ->action(function (string $startDate, string $endDate, string $period, Response $response, Document $project, Database $dbForProject, Authorization $authorization, callable $getLogsDB, array $smsRates) {
+    ->action(function (string $startDate, string $endDate, string $period, Response $response, Document $project, Database $dbForProject, callable $getLogsDB, array $smsRates) {
         $stats = $total = $usage = [];
         $format = 'Y-m-d 00:00:00';
         $firstDay = (new DateTime($startDate))->format($format);
@@ -103,7 +102,7 @@ App::get('/v1/project/usage')
             '1d' => 'Y-m-d\T00:00:00.000P',
         };
 
-        $authorization->skip(function () use ($dbForProject, $dbForLogs, $firstDay, $lastDay, $period, $metrics, $limit, &$total, &$stats) {
+        Authorization::skip(function () use ($dbForProject, $dbForLogs, $firstDay, $lastDay, $period, $metrics, $limit, &$total, &$stats) {
             foreach ($metrics['total'] as $metric) {
                 $db = ($metric === METRIC_FILES_IMAGES_TRANSFORMED) ? $dbForLogs : $dbForProject;
 
@@ -287,7 +286,7 @@ App::get('/v1/project/usage')
         }, $dbForProject->find('functions'));
 
         // This total is includes free and paid SMS usage
-        $authPhoneTotal = $authorization->skip(fn () => $dbForProject->sum('stats', 'value', [
+        $authPhoneTotal = Authorization::skip(fn () => $dbForProject->sum('stats', 'value', [
             Query::equal('metric', [METRIC_AUTH_METHOD_PHONE]),
             Query::equal('period', ['1d']),
             Query::greaterThanEqual('time', $firstDay),
@@ -295,7 +294,7 @@ App::get('/v1/project/usage')
         ]));
 
         // This estimate is only for paid SMS usage
-        $authPhoneMetrics = $authorization->skip(fn () => $dbForProject->find('stats', [
+        $authPhoneMetrics = Authorization::skip(fn () => $dbForProject->find('stats', [
             Query::startsWith('metric', METRIC_AUTH_METHOD_PHONE . '.'),
             Query::equal('period', ['1d']),
             Query::greaterThanEqual('time', $firstDay),

app/controllers/api/projects.php

@@ -1,7 +1,6 @@
 <?php
 
 use Ahc\Jwt\JWT;
-use Appwrite\Auth\Auth;
 use Appwrite\Auth\Validator\MockNumber;
 use Appwrite\Event\Delete;
 use Appwrite\Event\Mail;
@@ -119,7 +118,7 @@ App::post('/v1/projects')
             'maxSessions' => APP_LIMIT_USER_SESSIONS_DEFAULT,
             'passwordHistory' => 0,
             'passwordDictionary' => false,
-            'duration' => Auth::TOKEN_EXPIRATION_LOGIN_LONG,
+            'duration' => TOKEN_EXPIRATION_LOGIN_LONG,
             'personalDataCheck' => false,
             'mockNumbers' => [],
             'sessionAlerts' => false,

app/controllers/api/storage.php

@@ -2,7 +2,6 @@
 
 use Ahc\Jwt\JWT;
 use Ahc\Jwt\JWTException;
-use Appwrite\Auth\Auth;
 use Appwrite\ClamAV\Network;
 use Appwrite\Event\Delete;
 use Appwrite\Event\Event;
@@ -13,6 +12,7 @@ use Appwrite\SDK\ContentType;
 use Appwrite\SDK\Method;
 use Appwrite\SDK\MethodType;
 use Appwrite\SDK\Response as SDKResponse;
+use Appwrite\Utopia\Database\Documents\User;
 use Appwrite\Utopia\Database\Validator\CustomId;
 use Appwrite\Utopia\Database\Validator\Queries\Buckets;
 use Appwrite\Utopia\Database\Validator\Queries\Files;
@@ -32,7 +32,6 @@ use Utopia\Database\Helpers\Permission;
 use Utopia\Database\Helpers\Role;
 use Utopia\Database\Query;
 use Utopia\Database\Validator\Authorization;
-use Utopia\Database\Validator\Authorization\Input;
 use Utopia\Database\Validator\Permissions;
 use Utopia\Database\Validator\Query\Cursor;
 use Utopia\Database\Validator\UID;
@@ -434,20 +433,20 @@ App::post('/v1/storage/buckets/:bucketId/files')
     ->inject('mode')
     ->inject('deviceForFiles')
     ->inject('deviceForLocal')
-    ->inject('authorization')
-    ->action(function (string $bucketId, string $fileId, mixed $file, ?array $permissions, Request $request, Response $response, Database $dbForProject, Document $user, Event $queueForEvents, string $mode, Device $deviceForFiles, Device $deviceForLocal, Authorization $authorization) {
+    ->action(function (string $bucketId, string $fileId, mixed $file, ?array $permissions, Request $request, Response $response, Database $dbForProject, Document $user, Event $queueForEvents, string $mode, Device $deviceForFiles, Device $deviceForLocal) {
 
-        $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+        $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = Auth::isAppUser($authorization->getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser($authorization->getRoles());
+        $isAPIKey = User::isApp(Authorization::getRoles());
+        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
         }
 
-        if (!$authorization->isValid(new Input(Database::PERMISSION_CREATE, $bucket->getCreate()))) {
-            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+        $validator = new Authorization(Database::PERMISSION_CREATE);
+        if (!$validator->isValid($bucket->getCreate())) {
+            throw new Exception(Exception::USER_UNAUTHORIZED);
         }
 
         $allowedPermissions = [
@@ -470,8 +469,8 @@ App::post('/v1/storage/buckets/:bucketId/files')
         }
 
         // Users can only manage their own roles, API keys and Admin users can manage any
-        $roles = $authorization->getRoles();
-        if (!Auth::isAppUser($roles) && !Auth::isPrivilegedUser($roles)) {
+        $roles = Authorization::getRoles();
+        if (!User::isApp($roles) && !User::isPrivileged($roles)) {
             foreach (Database::PERMISSIONS as $type) {
                 foreach ($permissions as $permission) {
                     $permission = Permission::parse($permission);
@@ -483,7 +482,7 @@ App::post('/v1/storage/buckets/:bucketId/files')
                         $permission->getIdentifier(),
                         $permission->getDimension()
                     ))->toString();
-                    if (!$authorization->hasRole($role)) {
+                    if (!Authorization::isRole($role)) {
                         throw new Exception(Exception::USER_UNAUTHORIZED, 'Permissions must be one of: (' . \implode(', ', $roles) . ')');
                     }
                 }
@@ -703,10 +702,11 @@ App::post('/v1/storage/buckets/:bucketId/files')
                  * However as with chunk upload even if we are updating, we are essentially creating a file
                  * adding it's new chunk so we validate create permission instead of update
                  */
-                if (!$authorization->isValid(new Input(Database::PERMISSION_CREATE, $bucket->getCreate()))) {
-                    throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+                $validator = new Authorization(Database::PERMISSION_CREATE);
+                if (!$validator->isValid($bucket->getCreate())) {
+                    throw new Exception(Exception::USER_UNAUTHORIZED);
                 }
-                $file = $authorization->skip(fn () => $dbForProject->updateDocument('bucket_' . $bucket->getSequence(), $fileId, $file));
+                $file = Authorization::skip(fn () => $dbForProject->updateDocument('bucket_' . $bucket->getSequence(), $fileId, $file));
             }
         } else {
             if ($file->isEmpty()) {
@@ -745,12 +745,13 @@ App::post('/v1/storage/buckets/:bucketId/files')
                  * However as with chunk upload even if we are updating, we are essentially creating a file
                  * adding it's new chunk so we validate create permission instead of update
                  */
-                if (!$authorization->isValid(new Input(Database::PERMISSION_CREATE, $bucket->getCreate()))) {
-                    throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+                $validator = new Authorization(Database::PERMISSION_CREATE);
+                if (!$validator->isValid($bucket->getCreate())) {
+                    throw new Exception(Exception::USER_UNAUTHORIZED);
                 }
 
                 try {
-                    $file = $authorization->skip(fn () => $dbForProject->updateDocument('bucket_' . $bucket->getSequence(), $fileId, $file));
+                    $file = Authorization::skip(fn () => $dbForProject->updateDocument('bucket_' . $bucket->getSequence(), $fileId, $file));
                 } catch (NotFoundException) {
                     throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
                 }
@@ -794,22 +795,22 @@ App::get('/v1/storage/buckets/:bucketId/files')
     ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
     ->inject('response')
     ->inject('dbForProject')
-    ->inject('authorization')
     ->inject('mode')
-    ->action(function (string $bucketId, array $queries, string $search, bool $includeTotal, Response $response, Database $dbForProject, Authorization $authorization, string $mode) {
-        $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+    ->action(function (string $bucketId, array $queries, string $search, bool $includeTotal, Response $response, Database $dbForProject, string $mode) {
+        $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = Auth::isAppUser($authorization->getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser($authorization->getRoles());
+        $isAPIKey = User::isApp(Authorization::getRoles());
+        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
         }
 
         $fileSecurity = $bucket->getAttribute('fileSecurity', false);
-        $valid = $authorization->isValid(new Input(Database::PERMISSION_READ, $bucket->getRead()));
+        $validator = new Authorization(Database::PERMISSION_READ);
+        $valid = $validator->isValid($bucket->getRead());
         if (!$fileSecurity && !$valid) {
-            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+            throw new Exception(Exception::USER_UNAUTHORIZED);
         }
 
         $queries = Query::parseQueries($queries);
@@ -838,7 +839,7 @@ App::get('/v1/storage/buckets/:bucketId/files')
             if ($fileSecurity && !$valid) {
                 $cursorDocument = $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId);
             } else {
-                $cursorDocument = $authorization->skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+                $cursorDocument = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
             }
 
             if ($cursorDocument->isEmpty()) {
@@ -848,13 +849,15 @@ App::get('/v1/storage/buckets/:bucketId/files')
             $cursor->setValue($cursorDocument);
         }
 
+        $filterQueries = Query::groupByType($queries)['filters'];
+
         try {
             if ($fileSecurity && !$valid) {
                 $files = $dbForProject->find('bucket_' . $bucket->getSequence(), $queries);
-                $total = $includeTotal ? $dbForProject->count('bucket_' . $bucket->getSequence(), $queries, APP_LIMIT_COUNT) : 0;
+                $total = $includeTotal ? $dbForProject->count('bucket_' . $bucket->getSequence(), $filterQueries, APP_LIMIT_COUNT) : 0;
             } else {
-                $files = $authorization->skip(fn () => $dbForProject->find('bucket_' . $bucket->getSequence(), $queries));
-                $total = $includeTotal ? $authorization->skip(fn () => $dbForProject->count('bucket_' . $bucket->getSequence(), $queries, APP_LIMIT_COUNT)) : 0;
+                $files = Authorization::skip(fn () => $dbForProject->find('bucket_' . $bucket->getSequence(), $queries));
+                $total = $includeTotal ? Authorization::skip(fn () => $dbForProject->count('bucket_' . $bucket->getSequence(), $filterQueries, APP_LIMIT_COUNT)) : 0;
             }
         } catch (NotFoundException) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
@@ -893,28 +896,28 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId')
     ->param('fileId', '', new UID(), 'File ID.')
     ->inject('response')
     ->inject('dbForProject')
-    ->inject('authorization')
     ->inject('mode')
-    ->action(function (string $bucketId, string $fileId, Response $response, Database $dbForProject, Authorization $authorization, string $mode) {
-        $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+    ->action(function (string $bucketId, string $fileId, Response $response, Database $dbForProject, string $mode) {
+        $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = Auth::isAppUser($authorization->getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser($authorization->getRoles());
+        $isAPIKey = User::isApp(Authorization::getRoles());
+        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
         }
 
         $fileSecurity = $bucket->getAttribute('fileSecurity', false);
-        $valid = $authorization->isValid(new Input(Database::PERMISSION_READ, $bucket->getRead()));
+        $validator = new Authorization(Database::PERMISSION_READ);
+        $valid = $validator->isValid($bucket->getRead());
         if (!$fileSecurity && !$valid) {
-            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+            throw new Exception(Exception::USER_UNAUTHORIZED);
         }
 
         if ($fileSecurity && !$valid) {
             $file = $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId);
         } else {
-            $file = $authorization->skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+            $file = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
         }
 
         if ($file->isEmpty()) {
@@ -970,18 +973,17 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/preview')
     ->inject('deviceForFiles')
     ->inject('deviceForLocal')
     ->inject('project')
-    ->inject('authorization')
-    ->action(function (string $bucketId, string $fileId, int $width, int $height, string $gravity, int $quality, int $borderWidth, string $borderColor, int $borderRadius, float $opacity, int $rotation, string $background, string $output, ?string $token, Request $request, Response $response, Database $dbForProject, Document $resourceToken, Device $deviceForFiles, Device $deviceForLocal, Document $project, Authorization $authorization) {
+    ->action(function (string $bucketId, string $fileId, int $width, int $height, string $gravity, int $quality, int $borderWidth, string $borderColor, int $borderRadius, float $opacity, int $rotation, string $background, string $output, ?string $token, Request $request, Response $response, Database $dbForProject, Document $resourceToken, Device $deviceForFiles, Device $deviceForLocal, Document $project) {
 
         if (!\extension_loaded('imagick')) {
             throw new Exception(Exception::GENERAL_SERVER_ERROR, 'Imagick extension is missing');
         }
 
         /* @type Document $bucket */
-        $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+        $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = Auth::isAppUser($authorization->getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser($authorization->getRoles());
+        $isAPIKey = User::isApp(Authorization::getRoles());
+        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
@@ -993,20 +995,21 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/preview')
 
         $isToken = !$resourceToken->isEmpty() && $resourceToken->getAttribute('bucketInternalId') === $bucket->getSequence();
         $fileSecurity = $bucket->getAttribute('fileSecurity', false);
-        $valid = $authorization->isValid(new Input(Database::PERMISSION_READ, $bucket->getRead()));
+        $validator = new Authorization(Database::PERMISSION_READ);
+        $valid = $validator->isValid($bucket->getRead());
         if (!$fileSecurity && !$valid && !$isToken) {
-            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+            throw new Exception(Exception::USER_UNAUTHORIZED);
         }
 
         if ($fileSecurity && !$valid && !$isToken) {
             $file = $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId);
         } else {
             /* @type Document $file */
-            $file = $authorization->skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+            $file = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
         }
 
         if (!$resourceToken->isEmpty() && $resourceToken->getAttribute('fileInternalId') !== $file->getSequence()) {
-            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+            throw new Exception(Exception::USER_UNAUTHORIZED);
         }
 
         if ($file->isEmpty()) {
@@ -1124,11 +1127,11 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/preview')
         $contentType = (\array_key_exists($output, $outputs)) ? $outputs[$output] : $outputs['jpg'];
 
         //Do not update transformedAt if it's a console user
-        if (!Auth::isPrivilegedUser($authorization->getRoles())) {
+        if (!User::isPrivileged(Authorization::getRoles())) {
             $transformedAt = $file->getAttribute('transformedAt', '');
             if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_PROJECT_ACCESS)) > $transformedAt) {
                 $file->setAttribute('transformedAt', DateTime::now());
-                $authorization->skip(fn () => $dbForProject->updateDocument('bucket_' . $file->getAttribute('bucketInternalId'), $file->getId(), $file));
+                Authorization::skip(fn () => $dbForProject->updateDocument('bucket_' . $file->getAttribute('bucketInternalId'), $file->getId(), $file));
             }
         }
 
@@ -1168,16 +1171,15 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/download')
     ->inject('request')
     ->inject('response')
     ->inject('dbForProject')
-    ->inject('authorization')
     ->inject('mode')
     ->inject('resourceToken')
     ->inject('deviceForFiles')
-    ->action(function (string $bucketId, string $fileId, ?string $token, Request $request, Response $response, Database $dbForProject, Authorization $authorization, string $mode, Document $resourceToken, Device $deviceForFiles) {
+    ->action(function (string $bucketId, string $fileId, ?string $token, Request $request, Response $response, Database $dbForProject, string $mode, Document $resourceToken, Device $deviceForFiles) {
         /* @type Document $bucket */
-        $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+        $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = Auth::isAppUser($authorization->getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser($authorization->getRoles());
+        $isAPIKey = User::isApp(Authorization::getRoles());
+        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
@@ -1185,20 +1187,21 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/download')
 
         $isToken = !$resourceToken->isEmpty() && $resourceToken->getAttribute('bucketInternalId') === $bucket->getSequence();
         $fileSecurity = $bucket->getAttribute('fileSecurity', false);
-        $valid = $authorization->isValid(new Input(Database::PERMISSION_READ, $bucket->getRead()));
+        $validator = new Authorization(Database::PERMISSION_READ);
+        $valid = $validator->isValid($bucket->getRead());
         if (!$fileSecurity && !$valid && !$isToken) {
-            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+            throw new Exception(Exception::USER_UNAUTHORIZED);
         }
 
         if ($fileSecurity && !$valid && !$isToken) {
             $file = $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId);
         } else {
             /* @type Document $file */
-            $file = $authorization->skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+            $file = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
         }
 
         if (!$resourceToken->isEmpty() && $resourceToken->getAttribute('fileInternalId') !== $file->getSequence()) {
-            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+            throw new Exception(Exception::USER_UNAUTHORIZED);
         }
 
         if ($file->isEmpty()) {
@@ -1332,13 +1335,12 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/view')
     ->inject('mode')
     ->inject('resourceToken')
     ->inject('deviceForFiles')
-    ->inject('authorization')
-    ->action(function (string $bucketId, string $fileId, ?string $token, Response $response, Request $request, Database $dbForProject, string $mode, Document $resourceToken, Device $deviceForFiles, Authorization $authorization) {
+    ->action(function (string $bucketId, string $fileId, ?string $token, Response $response, Request $request, Database $dbForProject, string $mode, Document $resourceToken, Device $deviceForFiles) {
         /* @type Document $bucket */
-        $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+        $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = Auth::isAppUser($authorization->getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser($authorization->getRoles());
+        $isAPIKey = User::isApp(Authorization::getRoles());
+        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
@@ -1346,20 +1348,21 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/view')
 
         $isToken = !$resourceToken->isEmpty() && $resourceToken->getAttribute('bucketInternalId') === $bucket->getSequence();
         $fileSecurity = $bucket->getAttribute('fileSecurity', false);
-        $valid = $authorization->isValid(new Input(Database::PERMISSION_READ, $bucket->getRead()));
+        $validator = new Authorization(Database::PERMISSION_READ);
+        $valid = $validator->isValid($bucket->getRead());
         if (!$fileSecurity && !$valid && !$isToken) {
-            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+            throw new Exception(Exception::USER_UNAUTHORIZED);
         }
 
         if ($fileSecurity && !$valid && !$isToken) {
             $file = $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId);
         } else {
             /* @type Document $file */
-            $file = $authorization->skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+            $file = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
         }
 
         if (!$resourceToken->isEmpty() && $resourceToken->getAttribute('fileInternalId') !== $file->getSequence()) {
-            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+            throw new Exception(Exception::USER_UNAUTHORIZED);
         }
 
         if ($file->isEmpty()) {
@@ -1488,14 +1491,13 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/push')
     ->inject('project')
     ->inject('mode')
     ->inject('deviceForFiles')
-    ->inject('authorization')
-    ->action(function (string $bucketId, string $fileId, string $jwt, Response $response, Request $request, Database $dbForProject, Database $dbForPlatform, Document $project, string $mode, Device $deviceForFiles, Authorization $authorization) {
+    ->action(function (string $bucketId, string $fileId, string $jwt, Response $response, Request $request, Database $dbForProject, Database $dbForPlatform, Document $project, string $mode, Device $deviceForFiles) {
         $decoder = new JWT(System::getEnv('_APP_OPENSSL_KEY_V1'), 'HS256', 3600, 0);
 
         try {
             $decoded = $decoder->decode($jwt);
         } catch (JWTException) {
-            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+            throw new Exception(Exception::USER_UNAUTHORIZED);
         }
 
         if (
@@ -1503,21 +1505,22 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/push')
             $decoded['bucketId'] !== $bucketId ||
             $decoded['fileId'] !== $fileId
         ) {
-            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+            throw new Exception(Exception::USER_UNAUTHORIZED);
         }
 
         $isInternal = $decoded['internal'] ?? false;
+        $disposition = $decoded['disposition'] ?? 'inline';
         $dbForProject = $isInternal ? $dbForPlatform : $dbForProject;
 
-        $isAPIKey = Auth::isAppUser($authorization->getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser($authorization->getRoles());
+        $isAPIKey = User::isApp(Authorization::getRoles());
+        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
 
-        $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+        $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
         }
 
-        $file = $authorization->skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+        $file = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
         if ($file->isEmpty()) {
             throw new Exception(Exception::STORAGE_FILE_NOT_FOUND);
         }
@@ -1525,6 +1528,7 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/push')
         $mimes = Config::getParam('storage-mimes');
 
         $path = $file->getAttribute('path', '');
+
         if (!$deviceForFiles->exists($path)) {
             throw new Exception(Exception::STORAGE_FILE_NOT_FOUND, 'File not found in ' . $path);
         }
@@ -1562,7 +1566,7 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/push')
             ->setContentType($contentType)
             ->addHeader('Content-Security-Policy', 'script-src none;')
             ->addHeader('X-Content-Type-Options', 'nosniff')
-            ->addHeader('Content-Disposition', 'inline; filename="' . $file->getAttribute('name', '') . '"')
+            ->addHeader('Content-Disposition', $disposition . '; filename="' . $file->getAttribute('name', '') . '"')
             ->addHeader('Cache-Control', 'private, max-age=3888000') // 45 days
             ->addHeader('X-Peak', \memory_get_peak_usage());
 
@@ -1661,26 +1665,26 @@ App::put('/v1/storage/buckets/:bucketId/files/:fileId')
     ->inject('user')
     ->inject('mode')
     ->inject('queueForEvents')
-    ->inject('authorization')
-    ->action(function (string $bucketId, string $fileId, ?string $name, ?array $permissions, Response $response, Database $dbForProject, Document $user, string $mode, Event $queueForEvents, Authorization $authorization) {
+    ->action(function (string $bucketId, string $fileId, ?string $name, ?array $permissions, Response $response, Database $dbForProject, Document $user, string $mode, Event $queueForEvents) {
 
-        $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+        $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = Auth::isAppUser($authorization->getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser($authorization->getRoles());
+        $isAPIKey = User::isApp(Authorization::getRoles());
+        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
         }
 
         $fileSecurity = $bucket->getAttribute('fileSecurity', false);
-        $valid = $authorization->isValid(new Input(Database::PERMISSION_UPDATE, $bucket->getUpdate()));
+        $validator = new Authorization(Database::PERMISSION_UPDATE);
+        $valid = $validator->isValid($bucket->getUpdate());
         if (!$fileSecurity && !$valid) {
-            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+            throw new Exception(Exception::USER_UNAUTHORIZED);
         }
 
         // Read permission should not be required for update
-        $file = $authorization->skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+        $file = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
 
         if ($file->isEmpty()) {
             throw new Exception(Exception::STORAGE_FILE_NOT_FOUND);
@@ -1694,8 +1698,8 @@ App::put('/v1/storage/buckets/:bucketId/files/:fileId')
         ]);
 
         // Users can only manage their own roles, API keys and Admin users can manage any
-        $roles = $authorization->getRoles();
-        if (!Auth::isAppUser($roles) && !Auth::isPrivilegedUser($roles) && !\is_null($permissions)) {
+        $roles = Authorization::getRoles();
+        if (!User::isApp($roles) && !User::isPrivileged($roles) && !\is_null($permissions)) {
             foreach (Database::PERMISSIONS as $type) {
                 foreach ($permissions as $permission) {
                     $permission = Permission::parse($permission);
@@ -1707,7 +1711,7 @@ App::put('/v1/storage/buckets/:bucketId/files/:fileId')
                         $permission->getIdentifier(),
                         $permission->getDimension()
                     ))->toString();
-                    if (!$authorization->hasRole($role)) {
+                    if (!Authorization::isRole($role)) {
                         throw new Exception(Exception::USER_UNAUTHORIZED, 'Permissions must be one of: (' . \implode(', ', $roles) . ')');
                     }
                 }
@@ -1728,7 +1732,7 @@ App::put('/v1/storage/buckets/:bucketId/files/:fileId')
             if ($fileSecurity && !$valid) {
                 $file = $dbForProject->updateDocument('bucket_' . $bucket->getSequence(), $fileId, $file);
             } else {
-                $file = $authorization->skip(fn () => $dbForProject->updateDocument('bucket_' . $bucket->getSequence(), $fileId, $file));
+                $file = Authorization::skip(fn () => $dbForProject->updateDocument('bucket_' . $bucket->getSequence(), $fileId, $file));
             }
         } catch (NotFoundException) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
@@ -1776,34 +1780,33 @@ App::delete('/v1/storage/buckets/:bucketId/files/:fileId')
     ->inject('mode')
     ->inject('deviceForFiles')
     ->inject('queueForDeletes')
-    ->inject('authorization')
-    ->action(function (string $bucketId, string $fileId, Response $response, Database $dbForProject, Event $queueForEvents, string $mode, Device $deviceForFiles, Delete $queueForDeletes, Authorization $authorization) {
-        $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+    ->action(function (string $bucketId, string $fileId, Response $response, Database $dbForProject, Event $queueForEvents, string $mode, Device $deviceForFiles, Delete $queueForDeletes) {
+        $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = Auth::isAppUser($authorization->getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser($authorization->getRoles());
+        $isAPIKey = User::isApp(Authorization::getRoles());
+        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
         }
 
         $fileSecurity = $bucket->getAttribute('fileSecurity', false);
-        $valid = $authorization->isValid(new Input(Database::PERMISSION_DELETE, $bucket->getDelete()));
+        $validator = new Authorization(Database::PERMISSION_DELETE);
+        $valid = $validator->isValid($bucket->getDelete());
         if (!$fileSecurity && !$valid) {
-            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+            throw new Exception(Exception::USER_UNAUTHORIZED);
         }
 
         // Read permission should not be required for delete
-        $file = $authorization->skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+        $file = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
 
         if ($file->isEmpty()) {
             throw new Exception(Exception::STORAGE_FILE_NOT_FOUND);
         }
 
         // Make sure we don't delete the file before the document permission check occurs
-        $validFile = $authorization->isValid(new Input(Database::PERMISSION_DELETE, $file->getDelete()));
-        if ($fileSecurity && !$valid && !$validFile) {
-            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+        if ($fileSecurity && !$valid && !$validator->isValid($file->getDelete())) {
+            throw new Exception(Exception::USER_UNAUTHORIZED);
         }
 
         $deviceDeleted = false;
@@ -1827,7 +1830,7 @@ App::delete('/v1/storage/buckets/:bucketId/files/:fileId')
                 if ($fileSecurity && !$valid) {
                     $deleted = $dbForProject->deleteDocument('bucket_' . $bucket->getSequence(), $fileId);
                 } else {
-                    $deleted = $authorization->skip(fn () => $dbForProject->deleteDocument('bucket_' . $bucket->getSequence(), $fileId));
+                    $deleted = Authorization::skip(fn () => $dbForProject->deleteDocument('bucket_' . $bucket->getSequence(), $fileId));
                 }
             } catch (NotFoundException) {
                 throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
@@ -1872,8 +1875,7 @@ App::get('/v1/storage/usage')
     ->param('range', '30d', new WhiteList(['24h', '30d', '90d'], true), 'Date range.', true)
     ->inject('response')
     ->inject('dbForProject')
-    ->inject('authorization')
-    ->action(function (string $range, Response $response, Database $dbForProject, Authorization $authorization) {
+    ->action(function (string $range, Response $response, Database $dbForProject) {
 
         $periods = Config::getParam('usage', []);
         $stats = $usage = [];
@@ -1885,7 +1887,7 @@ App::get('/v1/storage/usage')
         ];
 
         $total = [];
-        $authorization->skip(function () use ($dbForProject, $days, $metrics, &$stats, &$total) {
+        Authorization::skip(function () use ($dbForProject, $days, $metrics, &$stats, &$total) {
             foreach ($metrics as $metric) {
                 $result = $dbForProject->findOne('stats', [
                     Query::equal('metric', [$metric]),
@@ -1963,8 +1965,7 @@ App::get('/v1/storage/:bucketId/usage')
     ->inject('project')
     ->inject('dbForProject')
     ->inject('getLogsDB')
-    ->inject('authorization')
-    ->action(function (string $bucketId, string $range, Response $response, Document $project, Database $dbForProject, callable $getLogsDB, Authorization $authorization) {
+    ->action(function (string $bucketId, string $range, Response $response, Document $project, Database $dbForProject, callable $getLogsDB) {
 
         $dbForLogs = call_user_func($getLogsDB, $project);
         $bucket = $dbForProject->getDocument('buckets', $bucketId);
@@ -1982,7 +1983,7 @@ App::get('/v1/storage/:bucketId/usage')
             str_replace('{bucketInternalId}', $bucket->getSequence(), METRIC_BUCKET_ID_FILES_IMAGES_TRANSFORMED),
         ];
 
-        $authorization->skip(function () use ($dbForProject, $dbForLogs, $bucket, $days, $metrics, &$stats) {
+        Authorization::skip(function () use ($dbForProject, $dbForLogs, $bucket, $days, $metrics, &$stats) {
             foreach ($metrics as $metric) {
                 $db = ($metric === str_replace('{bucketInternalId}', $bucket->getSequence(), METRIC_BUCKET_ID_FILES_IMAGES_TRANSFORMED))
                     ? $dbForLogs

app/controllers/api/teams.php

@@ -1,6 +1,5 @@
 <?php
 
-use Appwrite\Auth\Auth;
 use Appwrite\Auth\MFA\Type\TOTP;
 use Appwrite\Auth\Validator\Phone;
 use Appwrite\Detector\Detector;
@@ -18,6 +17,7 @@ use Appwrite\SDK\ContentType;
 use Appwrite\SDK\Method;
 use Appwrite\SDK\Response as SDKResponse;
 use Appwrite\Template\Template;
+use Appwrite\Utopia\Database\Documents\User;
 use Appwrite\Utopia\Database\Validator\CustomId;
 use Appwrite\Utopia\Database\Validator\Queries\Memberships;
 use Appwrite\Utopia\Database\Validator\Queries\Teams;
@@ -28,6 +28,9 @@ use MaxMind\Db\Reader;
 use Utopia\Abuse\Abuse;
 use Utopia\App;
 use Utopia\Audit\Audit;
+use Utopia\Auth\Proofs\Password;
+use Utopia\Auth\Proofs\Token;
+use Utopia\Auth\Store;
 use Utopia\Config\Config;
 use Utopia\Database\Database;
 use Utopia\Database\DateTime;
@@ -84,17 +87,16 @@ App::post('/v1/teams')
     ->inject('response')
     ->inject('user')
     ->inject('dbForProject')
-    ->inject('authorization')
     ->inject('queueForEvents')
-    ->action(function (string $teamId, string $name, array $roles, Response $response, Document $user, Database $dbForProject, Authorization $authorization, Event $queueForEvents) {
+    ->action(function (string $teamId, string $name, array $roles, Response $response, Document $user, Database $dbForProject, Event $queueForEvents) {
 
-        $isPrivilegedUser = Auth::isPrivilegedUser($authorization->getRoles());
-        $isAppUser = Auth::isAppUser($authorization->getRoles());
+        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
+        $isAppUser = User::isApp(Authorization::getRoles());
 
         $teamId = $teamId == 'unique()' ? ID::unique() : $teamId;
 
         try {
-            $team = $authorization->skip(fn () => $dbForProject->createDocument('teams', new Document([
+            $team = Authorization::skip(fn () => $dbForProject->createDocument('teams', new Document([
                 '$id' => $teamId,
                 '$permissions' => [
                     Permission::read(Role::team($teamId)),
@@ -177,6 +179,7 @@ App::get('/v1/teams')
     ->inject('dbForProject')
     ->action(function (array $queries, string $search, bool $includeTotal, Response $response, Database $dbForProject) {
 
+
         try {
             $queries = Query::parseQueries($queries);
         } catch (QueryException $e) {
@@ -475,10 +478,9 @@ App::post('/v1/teams/:teamId/memberships')
     ->param('phone', '', new Phone(), 'Phone number. Format this number with a leading \'+\' and a country code, e.g., +16175551212.', true)
     ->param('roles', [], function (Document $project) {
         if ($project->getId() === 'console') {
-            ;
             $roles = array_keys(Config::getParam('roles', []));
-            array_filter($roles, function ($role) {
-                return !in_array($role, [Auth::USER_ROLE_APPS, Auth::USER_ROLE_GUESTS, Auth::USER_ROLE_USERS]);
+            $roles = array_filter($roles, function ($role) {
+                return !in_array($role, [User::ROLE_APPS, User::ROLE_GUESTS, User::ROLE_USERS]);
             });
             return new ArrayList(new WhiteList($roles), APP_LIMIT_ARRAY_PARAMS_SIZE);
         }
@@ -490,7 +492,6 @@ App::post('/v1/teams/:teamId/memberships')
     ->inject('project')
     ->inject('user')
     ->inject('dbForProject')
-    ->inject('authorization')
     ->inject('locale')
     ->inject('queueForMails')
     ->inject('queueForMessaging')
@@ -498,9 +499,11 @@ App::post('/v1/teams/:teamId/memberships')
     ->inject('timelimit')
     ->inject('queueForStatsUsage')
     ->inject('plan')
-    ->action(function (string $teamId, string $email, string $userId, string $phone, array $roles, string $url, string $name, Response $response, Document $project, Document $user, Database $dbForProject, Authorization $authorization, Locale $locale, Mail $queueForMails, Messaging $queueForMessaging, Event $queueForEvents, callable $timelimit, StatsUsage $queueForStatsUsage, array $plan) {
-        $isAppUser = Auth::isAppUser($authorization->getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser($authorization->getRoles());
+    ->inject('proofForPassword')
+    ->inject('proofForToken')
+    ->action(function (string $teamId, string $email, string $userId, string $phone, array $roles, string $url, string $name, Response $response, Document $project, Document $user, Database $dbForProject, Locale $locale, Mail $queueForMails, Messaging $queueForMessaging, Event $queueForEvents, callable $timelimit, StatsUsage $queueForStatsUsage, array $plan, Password $proofForPassword, Token $proofForToken) {
+        $isAppUser = User::isApp(Authorization::getRoles());
+        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
 
         $url = htmlentities($url);
         if (empty($url)) {
@@ -570,55 +573,60 @@ App::post('/v1/teams/:teamId/memberships')
             }
 
             try {
+                $userId = ID::unique();
+                $hash = $proofForPassword->hash($proofForPassword->generate());
                 $emailCanonical = new Email($email);
             } catch (Throwable) {
                 $emailCanonical = null;
             }
 
+            $userId = ID::unique();
+
+            $userDocument = new Document([
+                '$id' => $userId,
+                '$permissions' => [
+                    Permission::read(Role::any()),
+                    Permission::read(Role::user($userId)),
+                    Permission::update(Role::user($userId)),
+                    Permission::delete(Role::user($userId)),
+                ],
+                'email' => empty($email) ? null : $email,
+                'phone' => empty($phone) ? null : $phone,
+                'emailVerification' => false,
+                'status' => true,
+                // TODO: Set password empty?
+                'password' => $hash,
+                'hash' => $proofForPassword->getHash()->getName(),
+                'hashOptions' => $proofForPassword->getHash()->getOptions(),
+                /**
+                 * Set the password update time to 0 for users created using
+                 * team invite and OAuth to allow password updates without an
+                 * old password
+                 */
+                'passwordUpdate' => null,
+                'registration' => DateTime::now(),
+                'reset' => false,
+                'name' => $name,
+                'prefs' => new \stdClass(),
+                'sessions' => null,
+                'tokens' => null,
+                'memberships' => null,
+                'search' => implode(' ', [$userId, $email, $name]),
+                'emailCanonical' => $emailCanonical?->getCanonical(),
+                'emailIsCanonical' => $emailCanonical?->isCanonicalSupported(),
+                'emailIsCorporate' => $emailCanonical?->isCorporate(),
+                'emailIsDisposable' => $emailCanonical?->isDisposable(),
+                'emailIsFree' => $emailCanonical?->isFree(),
+            ]);
+
             try {
-                $userId = ID::unique();
-                $invitee = $authorization->skip(fn () => $dbForProject->createDocument('users', new Document([
-                    '$id' => $userId,
-                    '$permissions' => [
-                        Permission::read(Role::any()),
-                        Permission::read(Role::user($userId)),
-                        Permission::update(Role::user($userId)),
-                        Permission::delete(Role::user($userId)),
-                    ],
-                    'email' => empty($email) ? null : $email,
-                    'phone' => empty($phone) ? null : $phone,
-                    'emailVerification' => false,
-                    'status' => true,
-                    // TODO: Set password empty?
-                    'password' => Auth::passwordHash(Auth::passwordGenerator(), Auth::DEFAULT_ALGO, Auth::DEFAULT_ALGO_OPTIONS),
-                    'hash' => Auth::DEFAULT_ALGO,
-                    'hashOptions' => Auth::DEFAULT_ALGO_OPTIONS,
-                    /**
-                     * Set the password update time to 0 for users created using
-                     * team invite and OAuth to allow password updates without an
-                     * old password
-                     */
-                    'passwordUpdate' => null,
-                    'registration' => DateTime::now(),
-                    'reset' => false,
-                    'name' => $name,
-                    'prefs' => new \stdClass(),
-                    'sessions' => null,
-                    'tokens' => null,
-                    'memberships' => null,
-                    'search' => implode(' ', [$userId, $email, $name]),
-                    'emailCanonical' => $emailCanonical?->getCanonical(),
-                    'emailIsCanonical' => $emailCanonical?->isCanonicalSupported(),
-                    'emailIsCorporate' => $emailCanonical?->isCorporate(),
-                    'emailIsDisposable' => $emailCanonical?->isDisposable(),
-                    'emailIsFree' => $emailCanonical?->isFree(),
-                ])));
+                $invitee = Authorization::skip(fn () => $dbForProject->createDocument('users', $userDocument));
             } catch (Duplicate $th) {
                 throw new Exception(Exception::USER_ALREADY_EXISTS);
             }
         }
 
-        $isOwner = $authorization->hasRole('team:' . $team->getId() . '/owner');
+        $isOwner = Authorization::isRole('team:' . $team->getId() . '/owner');
 
         if (!$isOwner && !$isPrivilegedUser && !$isAppUser) { // Not owner, not admin, not app (server)
             throw new Exception(Exception::USER_UNAUTHORIZED, 'User is not allowed to send invitations for this team');
@@ -629,7 +637,7 @@ App::post('/v1/teams/:teamId/memberships')
             Query::equal('teamInternalId', [$team->getSequence()]),
         ]);
 
-        $secret = Auth::tokenGenerator();
+        $secret = $proofForToken->generate();
         if ($membership->isEmpty()) {
             $membershipId = ID::unique();
             $membership = new Document([
@@ -649,20 +657,19 @@ App::post('/v1/teams/:teamId/memberships')
                 'invited' => DateTime::now(),
                 'joined' => ($isPrivilegedUser || $isAppUser) ? DateTime::now() : null,
                 'confirm' => ($isPrivilegedUser || $isAppUser),
-                'secret' => Auth::hash($secret),
+                'secret' => $proofForToken->hash($secret),
                 'search' => implode(' ', [$membershipId, $invitee->getId()])
             ]);
 
             $membership = ($isPrivilegedUser || $isAppUser) ?
-                $authorization->skip(fn () => $dbForProject->createDocument('memberships', $membership)) :
+                Authorization::skip(fn () => $dbForProject->createDocument('memberships', $membership)) :
                 $dbForProject->createDocument('memberships', $membership);
 
             if ($isPrivilegedUser || $isAppUser) {
-                $authorization->skip(fn () => $dbForProject->increaseDocumentAttribute('teams', $team->getId(), 'total', 1));
+                Authorization::skip(fn () => $dbForProject->increaseDocumentAttribute('teams', $team->getId(), 'total', 1));
             }
-
         } elseif ($membership->getAttribute('confirm') === false) {
-            $membership->setAttribute('secret', Auth::hash($secret));
+            $membership->setAttribute('secret', $proofForToken->hash($secret));
             $membership->setAttribute('invited', DateTime::now());
 
             if ($isPrivilegedUser || $isAppUser) {
@@ -671,7 +678,7 @@ App::post('/v1/teams/:teamId/memberships')
             }
 
             $membership = ($isPrivilegedUser || $isAppUser) ?
-                $authorization->skip(fn () => $dbForProject->updateDocument('memberships', $membership->getId(), $membership)) :
+                Authorization::skip(fn () => $dbForProject->updateDocument('memberships', $membership->getId(), $membership)) :
                 $dbForProject->updateDocument('memberships', $membership->getId(), $membership);
         } else {
             throw new Exception(Exception::MEMBERSHIP_ALREADY_CONFIRMED);
@@ -765,7 +772,6 @@ App::post('/v1/teams/:teamId/memberships')
                     ->setName($invitee->getAttribute('name', ''))
                     ->setVariables($emailVariables)
                     ->trigger();
-
             } elseif (!empty($phone)) {
                 if (empty(System::getEnv('_APP_SMS_PROVIDER'))) {
                     throw new Exception(Exception::GENERAL_PHONE_DISABLED, 'Phone provider not configured');
@@ -858,8 +864,7 @@ App::get('/v1/teams/:teamId/memberships')
     ->inject('response')
     ->inject('project')
     ->inject('dbForProject')
-    ->inject('authorization')
-    ->action(function (string $teamId, array $queries, string $search, bool $includeTotal, Response $response, Document $project, Database $dbForProject, Authorization $authorization) {
+    ->action(function (string $teamId, array $queries, string $search, bool $includeTotal, Response $response, Document $project, Database $dbForProject) {
         $team = $dbForProject->getDocument('teams', $teamId);
 
         if ($team->isEmpty()) {
@@ -929,9 +934,9 @@ App::get('/v1/teams/:teamId/memberships')
             'mfa' => $project->getAttribute('auths', [])['membershipsMfa'] ?? true,
         ];
 
-        $roles = $authorization->getRoles();
-        $isPrivilegedUser = Auth::isPrivilegedUser($roles);
-        $isAppUser = Auth::isAppUser($roles);
+        $roles = Authorization::getRoles();
+        $isPrivilegedUser = User::isPrivileged($roles);
+        $isAppUser = User::isApp($roles);
 
         $membershipsPrivacy = array_map(function ($privacy) use ($isPrivilegedUser, $isAppUser) {
             return $privacy || $isPrivilegedUser || $isAppUser;
@@ -1000,8 +1005,7 @@ App::get('/v1/teams/:teamId/memberships/:membershipId')
     ->inject('response')
     ->inject('project')
     ->inject('dbForProject')
-    ->inject('authorization')
-    ->action(function (string $teamId, string $membershipId, Response $response, Document $project, Database $dbForProject, Authorization $authorization) {
+    ->action(function (string $teamId, string $membershipId, Response $response, Document $project, Database $dbForProject) {
 
         $team = $dbForProject->getDocument('teams', $teamId);
 
@@ -1021,9 +1025,9 @@ App::get('/v1/teams/:teamId/memberships/:membershipId')
             'mfa' => $project->getAttribute('auths', [])['membershipsMfa'] ?? true,
         ];
 
-        $roles = $authorization->getRoles();
-        $isPrivilegedUser = Auth::isPrivilegedUser($roles);
-        $isAppUser = Auth::isAppUser($roles);
+        $roles = Authorization::getRoles();
+        $isPrivilegedUser = User::isPrivileged($roles);
+        $isAppUser = User::isApp($roles);
 
         $membershipsPrivacy = array_map(function ($privacy) use ($isPrivilegedUser, $isAppUser) {
             return $privacy || $isPrivilegedUser || $isAppUser;
@@ -1088,8 +1092,8 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId')
     ->param('roles', [], function (Document $project) {
         if ($project->getId() === 'console') {
             $roles = array_keys(Config::getParam('roles', []));
-            array_filter($roles, function ($role) {
-                return !in_array($role, [Auth::USER_ROLE_APPS, Auth::USER_ROLE_GUESTS, Auth::USER_ROLE_USERS]);
+            $roles = array_filter($roles, function ($role) {
+                return !in_array($role, [User::ROLE_APPS, User::ROLE_GUESTS, User::ROLE_USERS]);
             });
             return new ArrayList(new WhiteList($roles), APP_LIMIT_ARRAY_PARAMS_SIZE);
         }
@@ -1100,9 +1104,8 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId')
     ->inject('user')
     ->inject('project')
     ->inject('dbForProject')
-    ->inject('authorization')
     ->inject('queueForEvents')
-    ->action(function (string $teamId, string $membershipId, array $roles, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Authorization $authorization, Event $queueForEvents) {
+    ->action(function (string $teamId, string $membershipId, array $roles, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Event $queueForEvents) {
 
         $team = $dbForProject->getDocument('teams', $teamId);
         if ($team->isEmpty()) {
@@ -1119,9 +1122,9 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId')
             throw new Exception(Exception::USER_NOT_FOUND);
         }
 
-        $isPrivilegedUser = Auth::isPrivilegedUser($authorization->getRoles());
-        $isAppUser = Auth::isAppUser($authorization->getRoles());
-        $isOwner = $authorization->hasRole('team:' . $team->getId() . '/owner');
+        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
+        $isAppUser = User::isApp(Authorization::getRoles());
+        $isOwner = Authorization::isRole('team:' . $team->getId() . '/owner');
 
         if ($project->getId() === 'console') {
             // Quick check: fetch up to 2 owners to determine if only one exists
@@ -1202,11 +1205,12 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
     ->inject('response')
     ->inject('user')
     ->inject('dbForProject')
-    ->inject('authorization')
     ->inject('project')
     ->inject('geodb')
     ->inject('queueForEvents')
-    ->action(function (string $teamId, string $membershipId, string $userId, string $secret, Request $request, Response $response, Document $user, Database $dbForProject, Authorization $authorization, Document $project, Reader $geodb, Event $queueForEvents) {
+    ->inject('store')
+    ->inject('proofForToken')
+    ->action(function (string $teamId, string $membershipId, string $userId, string $secret, Request $request, Response $response, Document $user, Database $dbForProject, Document $project, Reader $geodb, Event $queueForEvents, Store $store, Token $proofForToken) {
         $protocol = $request->getProtocol();
 
         $membership = $dbForProject->getDocument('memberships', $membershipId);
@@ -1215,7 +1219,7 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
             throw new Exception(Exception::MEMBERSHIP_NOT_FOUND);
         }
 
-        $team = $authorization->skip(fn () => $dbForProject->getDocument('teams', $teamId));
+        $team = Authorization::skip(fn () => $dbForProject->getDocument('teams', $teamId));
 
         if ($team->isEmpty()) {
             throw new Exception(Exception::TEAM_NOT_FOUND);
@@ -1225,7 +1229,7 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
             throw new Exception(Exception::TEAM_MEMBERSHIP_MISMATCH);
         }
 
-        if (Auth::hash($secret) !== $membership->getAttribute('secret')) {
+        if (!$proofForToken->verify($secret, $membership->getAttribute('secret'))) {
             throw new Exception(Exception::TEAM_INVALID_SECRET);
         }
 
@@ -1251,17 +1255,17 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
             ->setAttribute('confirm', true)
         ;
 
-        $authorization->skip(fn () => $dbForProject->updateDocument('users', $user->getId(), $user->setAttribute('emailVerification', true)));
+        Authorization::skip(fn () => $dbForProject->updateDocument('users', $user->getId(), $user->setAttribute('emailVerification', true)));
 
         // Create session for the user if not logged in
         if (!$hasSession) {
-            $authorization->addRole(Role::user($user->getId())->toString());
+            Authorization::setRole(Role::user($user->getId())->toString());
 
             $detector = new Detector($request->getUserAgent('UNKNOWN'));
             $record = $geodb->get($request->getIP());
-            $authDuration = $project->getAttribute('auths', [])['duration'] ?? Auth::TOKEN_EXPIRATION_LOGIN_LONG;
+            $authDuration = $project->getAttribute('auths', [])['duration'] ?? TOKEN_EXPIRATION_LOGIN_LONG;
             $expire = DateTime::addSeconds(new \DateTime(), $authDuration);
-            $secret = Auth::tokenGenerator();
+            $secret = $proofForToken->generate();
             $session = new Document(array_merge([
                 '$id' => ID::unique(),
                 '$permissions' => [
@@ -1271,9 +1275,9 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
                 ],
                 'userId' => $user->getId(),
                 'userInternalId' => $user->getSequence(),
-                'provider' => Auth::SESSION_PROVIDER_EMAIL,
+                'provider' => SESSION_PROVIDER_EMAIL,
                 'providerUid' => $user->getAttribute('email'),
-                'secret' => Auth::hash($secret), // One way hash encryption to protect DB leak
+                'secret' => $proofForToken->hash($secret), // One way hash encryption to protect DB leak
                 'userAgent' => $request->getUserAgent('UNKNOWN'),
                 'ip' => $request->getIP(),
                 'factors' => ['email'],
@@ -1283,16 +1287,21 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
 
             $session = $dbForProject->createDocument('sessions', $session);
 
-            $authorization->addRole(Role::user($userId)->toString());
+            Authorization::setRole(Role::user($userId)->toString());
+
+            $encoded = $store
+                ->setProperty('id', $user->getId())
+                ->setProperty('secret', $secret)
+                ->encode();
 
             if (!Config::getParam('domainVerification')) {
-                $response->addHeader('X-Fallback-Cookies', \json_encode([Auth::$cookieName => Auth::encodeSession($user->getId(), $secret)]));
+                $response->addHeader('X-Fallback-Cookies', \json_encode([$store->getKey() => $encoded]));
             }
 
             $response
                 ->addCookie(
-                    name: Auth::$cookieName . '_legacy',
-                    value: Auth::encodeSession($user->getId(), $secret),
+                    name: $store->getKey() . '_legacy',
+                    value: $encoded,
                     expire: (new \DateTime($expire))->getTimestamp(),
                     path: '/',
                     domain: Config::getParam('cookieDomain'),
@@ -1300,8 +1309,8 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
                     httponly: true
                 )
                 ->addCookie(
-                    name: Auth::$cookieName,
-                    value: Auth::encodeSession($user->getId(), $secret),
+                    name: $store->getKey(),
+                    value: $encoded,
                     expire: (new \DateTime($expire))->getTimestamp(),
                     path: '/',
                     domain: Config::getParam('cookieDomain'),
@@ -1316,7 +1325,7 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
 
         $dbForProject->purgeCachedDocument('users', $user->getId());
 
-        $authorization->skip(fn () => $dbForProject->increaseDocumentAttribute('teams', $team->getId(), 'total', 1));
+        Authorization::skip(fn () => $dbForProject->increaseDocumentAttribute('teams', $team->getId(), 'total', 1));
 
         $queueForEvents
             ->setParam('userId', $user->getId())
@@ -1360,9 +1369,8 @@ App::delete('/v1/teams/:teamId/memberships/:membershipId')
     ->inject('project')
     ->inject('response')
     ->inject('dbForProject')
-    ->inject('authorization')
     ->inject('queueForEvents')
-    ->action(function (string $teamId, string $membershipId, Document $user, Document $project, Response $response, Database $dbForProject, Authorization $authorization, Event $queueForEvents) {
+    ->action(function (string $teamId, string $membershipId, Document $user, Document $project, Response $response, Database $dbForProject, Event $queueForEvents) {
 
         $membership = $dbForProject->getDocument('memberships', $membershipId);
 
@@ -1420,7 +1428,7 @@ App::delete('/v1/teams/:teamId/memberships/:membershipId')
         $dbForProject->purgeCachedDocument('users', $profile->getId());
 
         if ($membership->getAttribute('confirm')) { // Count only confirmed members
-            $authorization->skip(fn () => $dbForProject->decreaseDocumentAttribute('teams', $team->getId(), 'total', 1, 0));
+            Authorization::skip(fn () => $dbForProject->decreaseDocumentAttribute('teams', $team->getId(), 'total', 1, 0));
         }
 
         $queueForEvents

app/controllers/api/users.php

@@ -1,7 +1,6 @@
 <?php
 
 use Ahc\Jwt\JWT;
-use Appwrite\Auth\Auth;
 use Appwrite\Auth\MFA\Type;
 use Appwrite\Auth\MFA\Type\TOTP;
 use Appwrite\Auth\Validator\Password;
@@ -32,6 +31,18 @@ use Appwrite\Utopia\Response;
 use MaxMind\Db\Reader;
 use Utopia\App;
 use Utopia\Audit\Audit;
+use Utopia\Auth\Hash;
+use Utopia\Auth\Hashes\Argon2;
+use Utopia\Auth\Hashes\Bcrypt;
+use Utopia\Auth\Hashes\MD5;
+use Utopia\Auth\Hashes\PHPass;
+use Utopia\Auth\Hashes\Plaintext;
+use Utopia\Auth\Hashes\Scrypt;
+use Utopia\Auth\Hashes\ScryptModified;
+use Utopia\Auth\Hashes\Sha;
+use Utopia\Auth\Proofs\Password as ProofsPassword;
+use Utopia\Auth\Proofs\Token;
+use Utopia\Auth\Store;
 use Utopia\Config\Config;
 use Utopia\Database\Database;
 use Utopia\Database\DateTime;
@@ -62,10 +73,9 @@ use Utopia\Validator\Text;
 use Utopia\Validator\WhiteList;
 
 /** TODO: Remove function when we move to using utopia/platform */
-function createUser(string $hash, mixed $hashOptions, string $userId, ?string $email, ?string $password, ?string $phone, string $name, Document $project, Database $dbForProject, Hooks $hooks): Document
+function createUser(Hash $hash, string $userId, ?string $email, ?string $password, ?string $phone, string $name, Document $project, Database $dbForProject, Hooks $hooks): Document
 {
     $plaintextPassword = $password;
-    $hashOptionsObject = (\is_string($hashOptions)) ? \json_decode($hashOptions, true) : $hashOptions; // Cast to JSON array
     $passwordHistory = $project->getAttribute('auths', [])['passwordHistory'] ?? 0;
 
     if (!empty($email)) {
@@ -104,8 +114,19 @@ function createUser(string $hash, mixed $hashOptions, string $userId, ?string $e
         } catch (Throwable) {
             $emailCanonical = null;
         }
+        $hashedPassword = null;
+
+        $isHashed = !$hash instanceof Plaintext;
+        if (!empty($password)) {
+            if (!$isHashed) { // Password was never hashed, hash it with the default hash
+                $defaultHash = new ProofsPassword();
+                $hashedPassword = $defaultHash->hash($password);
+                $hash = $defaultHash->getHash();
+            } else {
+                $hashedPassword = $password;
+            }
+        }
 
-        $password = (!empty($password)) ? ($hash === 'plaintext' ? Auth::passwordHash($password, $hash, $hashOptionsObject) : $password) : null;
         $user = new Document([
             '$id' => $userId,
             '$permissions' => [
@@ -119,11 +140,11 @@ function createUser(string $hash, mixed $hashOptions, string $userId, ?string $e
             'phoneVerification' => false,
             'status' => true,
             'labels' => [],
-            'password' => $password,
-            'passwordHistory' => is_null($password) || $passwordHistory === 0 ? [] : [$password],
-            'passwordUpdate' => (!empty($password)) ? DateTime::now() : null,
-            'hash' => $hash === 'plaintext' ? Auth::DEFAULT_ALGO : $hash,
-            'hashOptions' => $hash === 'plaintext' ? Auth::DEFAULT_ALGO_OPTIONS : $hashOptionsObject + ['type' => $hash],
+            'password' => $hashedPassword,
+            'passwordHistory' => is_null($hashedPassword) || $passwordHistory === 0 ? [] : [$hashedPassword],
+            'passwordUpdate' => (!empty($hashedPassword)) ? DateTime::now() : null,
+            'hash' => $hash->getName(),
+            'hashOptions' => $hash->getOptions(),
             'registration' => DateTime::now(),
             'reset' => false,
             'name' => $name,
@@ -139,7 +160,7 @@ function createUser(string $hash, mixed $hashOptions, string $userId, ?string $e
             'emailIsFree' => $emailCanonical?->isFree(),
         ]);
 
-        if ($hash === 'plaintext') {
+        if (!$isHashed) {
             $hooks->trigger('passwordValidator', [$dbForProject, $project, $plaintextPassword, &$user, true]);
         }
 
@@ -230,7 +251,9 @@ App::post('/v1/users')
     ->inject('dbForProject')
     ->inject('hooks')
     ->action(function (string $userId, ?string $email, ?string $phone, ?string $password, string $name, Response $response, Document $project, Database $dbForProject, Hooks $hooks) {
-        $user = createUser('plaintext', '{}', $userId, $email, $password, $phone, $name, $project, $dbForProject, $hooks);
+        $plaintext = new Plaintext();
+
+        $user = createUser($plaintext, $userId, $email, $password, $phone, $name, $project, $dbForProject, $hooks);
         $response
             ->setStatusCode(Response::STATUS_CODE_CREATED)
             ->dynamic($user, Response::MODEL_USER);
@@ -264,7 +287,10 @@ App::post('/v1/users/bcrypt')
     ->inject('dbForProject')
     ->inject('hooks')
     ->action(function (string $userId, string $email, string $password, string $name, Response $response, Document $project, Database $dbForProject, Hooks $hooks) {
-        $user = createUser('bcrypt', '{}', $userId, $email, $password, null, $name, $project, $dbForProject, $hooks);
+        $bcrypt = new Bcrypt();
+        $bcrypt->setCost(8); // Default cost
+
+        $user = createUser($bcrypt, $userId, $email, $password, null, $name, $project, $dbForProject, $hooks);
 
         $response
             ->setStatusCode(Response::STATUS_CODE_CREATED)
@@ -299,7 +325,9 @@ App::post('/v1/users/md5')
     ->inject('dbForProject')
     ->inject('hooks')
     ->action(function (string $userId, string $email, string $password, string $name, Response $response, Document $project, Database $dbForProject, Hooks $hooks) {
-        $user = createUser('md5', '{}', $userId, $email, $password, null, $name, $project, $dbForProject, $hooks);
+        $md5 = new MD5();
+
+        $user = createUser($md5, $userId, $email, $password, null, $name, $project, $dbForProject, $hooks);
 
         $response
             ->setStatusCode(Response::STATUS_CODE_CREATED)
@@ -334,7 +362,9 @@ App::post('/v1/users/argon2')
     ->inject('dbForProject')
     ->inject('hooks')
     ->action(function (string $userId, string $email, string $password, string $name, Response $response, Document $project, Database $dbForProject, Hooks $hooks) {
-        $user = createUser('argon2', '{}', $userId, $email, $password, null, $name, $project, $dbForProject, $hooks);
+        $argon2 = new Argon2();
+
+        $user = createUser($argon2, $userId, $email, $password, null, $name, $project, $dbForProject, $hooks);
 
         $response
             ->setStatusCode(Response::STATUS_CODE_CREATED)
@@ -370,13 +400,12 @@ App::post('/v1/users/sha')
     ->inject('dbForProject')
     ->inject('hooks')
     ->action(function (string $userId, string $email, string $password, string $passwordVersion, string $name, Response $response, Document $project, Database $dbForProject, Hooks $hooks) {
-        $options = '{}';
-
+        $sha = new Sha();
         if (!empty($passwordVersion)) {
-            $options = '{"version":"' . $passwordVersion . '"}';
+            $sha->setVersion($passwordVersion);
         }
 
-        $user = createUser('sha', $options, $userId, $email, $password, null, $name, $project, $dbForProject, $hooks);
+        $user = createUser($sha, $userId, $email, $password, null, $name, $project, $dbForProject, $hooks);
 
         $response
             ->setStatusCode(Response::STATUS_CODE_CREATED)
@@ -411,7 +440,9 @@ App::post('/v1/users/phpass')
     ->inject('dbForProject')
     ->inject('hooks')
     ->action(function (string $userId, string $email, string $password, string $name, Response $response, Document $project, Database $dbForProject, Hooks $hooks) {
-        $user = createUser('phpass', '{}', $userId, $email, $password, null, $name, $project, $dbForProject, $hooks);
+        $phpass = new PHPass();
+
+        $user = createUser($phpass, $userId, $email, $password, null, $name, $project, $dbForProject, $hooks);
 
         $response
             ->setStatusCode(Response::STATUS_CODE_CREATED)
@@ -451,15 +482,15 @@ App::post('/v1/users/scrypt')
     ->inject('dbForProject')
     ->inject('hooks')
     ->action(function (string $userId, string $email, string $password, string $passwordSalt, int $passwordCpu, int $passwordMemory, int $passwordParallel, int $passwordLength, string $name, Response $response, Document $project, Database $dbForProject, Hooks $hooks) {
-        $options = [
-            'salt' => $passwordSalt,
-            'costCpu' => $passwordCpu,
-            'costMemory' => $passwordMemory,
-            'costParallel' => $passwordParallel,
-            'length' => $passwordLength
-        ];
+        $scrypt = new Scrypt();
+        $scrypt
+            ->setSalt($passwordSalt)
+            ->setCpuCost($passwordCpu)
+            ->setMemoryCost($passwordMemory)
+            ->setParallelCost($passwordParallel)
+            ->setLength($passwordLength);
 
-        $user = createUser('scrypt', \json_encode($options), $userId, $email, $password, null, $name, $project, $dbForProject, $hooks);
+        $user = createUser($scrypt, $userId, $email, $password, null, $name, $project, $dbForProject, $hooks);
 
         $response
             ->setStatusCode(Response::STATUS_CODE_CREATED)
@@ -497,7 +528,13 @@ App::post('/v1/users/scrypt-modified')
     ->inject('dbForProject')
     ->inject('hooks')
     ->action(function (string $userId, string $email, string $password, string $passwordSalt, string $passwordSaltSeparator, string $passwordSignerKey, string $name, Response $response, Document $project, Database $dbForProject, Hooks $hooks) {
-        $user = createUser('scryptMod', '{"signerKey":"' . $passwordSignerKey . '","saltSeparator":"' . $passwordSaltSeparator . '","salt":"' . $passwordSalt . '"}', $userId, $email, $password, null, $name, $project, $dbForProject, $hooks);
+        $scryptModified = new ScryptModified();
+        $scryptModified
+            ->setSalt($passwordSalt)
+            ->setSaltSeparator($passwordSaltSeparator)
+            ->setSignerKey($passwordSignerKey);
+
+        $user = createUser($scryptModified, $userId, $email, $password, null, $name, $project, $dbForProject, $hooks);
 
         $response
             ->setStatusCode(Response::STATUS_CODE_CREATED)
@@ -809,16 +846,12 @@ App::get('/v1/users/:userId/sessions')
         if ($user->isEmpty()) {
             throw new Exception(Exception::USER_NOT_FOUND);
         }
-
         $sessions = $user->getAttribute('sessions', []);
-
         foreach ($sessions as $key => $session) {
             /** @var Document $session */
-
             $countryName = $locale->getText('countries.' . strtolower($session->getAttribute('countryCode')), $locale->getText('locale.country.unknown'));
             $session->setAttribute('countryName', $countryName);
             $session->setAttribute('current', false);
-
             $sessions[$key] = $session;
         }
 
@@ -858,28 +891,22 @@ App::get('/v1/users/:userId/memberships')
         if ($user->isEmpty()) {
             throw new Exception(Exception::USER_NOT_FOUND);
         }
-
         try {
             $queries = Query::parseQueries($queries);
         } catch (QueryException $e) {
             throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
         }
-
         if (!empty($search)) {
             $queries[] = Query::search('search', $search);
         }
-
         // Set internal queries
         $queries[] = Query::equal('userInternalId', [$user->getSequence()]);
-
         $memberships = array_map(function ($membership) use ($dbForProject, $user) {
             $team = $dbForProject->getDocument('teams', $membership->getAttribute('teamId'));
-
             $membership
                 ->setAttribute('teamName', $team->getAttribute('name'))
                 ->setAttribute('userName', $user->getAttribute('name'))
                 ->setAttribute('userEmail', $user->getAttribute('email'));
-
             return $membership;
         }, $dbForProject->find('memberships', $queries));
 
@@ -920,35 +947,26 @@ App::get('/v1/users/:userId/logs')
         if ($user->isEmpty()) {
             throw new Exception(Exception::USER_NOT_FOUND);
         }
-
         try {
             $queries = Query::parseQueries($queries);
         } catch (QueryException $e) {
             throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
         }
-
         // Temp fix for logs
         $queries[] = Query::or([
             Query::greaterThan('$createdAt', DateTime::format(new \DateTime('2025-02-26T01:30+00:00'))),
             Query::lessThan('$createdAt', DateTime::format(new \DateTime('2025-02-13T00:00+00:00'))),
         ]);
-
         $audit = new Audit($dbForProject);
-
         $logs = $audit->getLogsByUser($user->getSequence(), $queries);
-
         $output = [];
-
         foreach ($logs as $i => &$log) {
             $log['userAgent'] = (!empty($log['userAgent'])) ? $log['userAgent'] : 'UNKNOWN';
-
             $detector = new Detector($log['userAgent']);
             $detector->skipBotDetection(); // OPTIONAL: If called, bot detection will completely be skipped (bots will be detected as regular devices then)
-
             $os = $detector->getOS();
             $client = $detector->getClient();
             $device = $detector->getDevice();
-
             $output[$i] = new Document([
                 'event' => $log['event'],
                 'userId' => ID::custom($log['data']['userId']),
@@ -969,9 +987,7 @@ App::get('/v1/users/:userId/logs')
                 'deviceBrand' => $device['deviceBrand'],
                 'deviceModel' => $device['deviceModel']
             ]);
-
             $record = $geodb->get($log['ip']);
-
             if ($record) {
                 $output[$i]['countryCode'] = $locale->getText('countries.' . strtolower($record['country']['iso_code']), false) ? \strtolower($record['country']['iso_code']) : '--';
                 $output[$i]['countryName'] = $locale->getText('countries.' . strtolower($record['country']['iso_code']), $locale->getText('locale.country.unknown'));
@@ -1015,15 +1031,12 @@ App::get('/v1/users/:userId/targets')
         if ($user->isEmpty()) {
             throw new Exception(Exception::USER_NOT_FOUND);
         }
-
         try {
             $queries = Query::parseQueries($queries);
         } catch (QueryException $e) {
             throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
         }
-
         $queries[] = Query::equal('userId', [$userId]);
-
         /**
          * Get cursor document if there was a cursor query, we use array_filter and reset for reference $cursor to $queries
          */
@@ -1031,20 +1044,16 @@ App::get('/v1/users/:userId/targets')
             return \in_array($query->getMethod(), [Query::TYPE_CURSOR_AFTER, Query::TYPE_CURSOR_BEFORE]);
         });
         $cursor = reset($cursor);
-
         if ($cursor) {
             $validator = new Cursor();
             if (!$validator->isValid($cursor)) {
                 throw new Exception(Exception::GENERAL_QUERY_INVALID, $validator->getDescription());
             }
-
             $targetId = $cursor->getValue();
             $cursorDocument = $dbForProject->getDocument('targets', $targetId);
-
             if ($cursorDocument->isEmpty()) {
                 throw new Exception(Exception::GENERAL_CURSOR_NOT_FOUND, "Target '{$targetId}' for the 'cursor' value not found.");
             }
-
             $cursor->setValue($cursorDocument);
         }
         try {
@@ -1092,7 +1101,6 @@ App::get('/v1/users/identities')
         if (!empty($search)) {
             $queries[] = Query::search('search', $search);
         }
-
         /**
          * Get cursor document if there was a cursor query, we use array_filter and reset for reference $cursor to $queries
          */
@@ -1102,19 +1110,15 @@ App::get('/v1/users/identities')
         $cursor = reset($cursor);
         if ($cursor) {
             /** @var Query $cursor */
-
             $validator = new Cursor();
             if (!$validator->isValid($cursor)) {
                 throw new Exception(Exception::GENERAL_QUERY_INVALID, $validator->getDescription());
             }
-
             $identityId = $cursor->getValue();
             $cursorDocument = $dbForProject->getDocument('identities', $identityId);
-
             if ($cursorDocument->isEmpty()) {
                 throw new Exception(Exception::GENERAL_CURSOR_NOT_FOUND, "User '{$identityId}' for the 'cursor' value not found.");
             }
-
             $cursor->setValue($cursorDocument);
         }
 
@@ -1354,12 +1358,17 @@ App::patch('/v1/users/:userId/password')
 
         $hooks->trigger('passwordValidator', [$dbForProject, $project, $password, &$user, true]);
 
-        $newPassword = Auth::passwordHash($password, Auth::DEFAULT_ALGO, Auth::DEFAULT_ALGO_OPTIONS);
+        // Create Argon2 hasher with default settings
+        $hasher = new Argon2();
 
+        $newPassword = $hasher->hash($password);
+
+        $hash = ProofsPassword::createHash($user->getAttribute('hash'), $user->getAttribute('hashOptions'));
         $historyLimit = $project->getAttribute('auths', [])['passwordHistory'] ?? 0;
         $history = $user->getAttribute('passwordHistory', []);
+
         if ($historyLimit > 0) {
-            $validator = new PasswordHistory($history, $user->getAttribute('hash'), $user->getAttribute('hashOptions'));
+            $validator = new PasswordHistory($history, $hash);
             if (!$validator->isValid($password)) {
                 throw new Exception(Exception::USER_PASSWORD_RECENTLY_USED);
             }
@@ -1372,8 +1381,8 @@ App::patch('/v1/users/:userId/password')
             ->setAttribute('password', $newPassword)
             ->setAttribute('passwordHistory', $history)
             ->setAttribute('passwordUpdate', DateTime::now())
-            ->setAttribute('hash', Auth::DEFAULT_ALGO)
-            ->setAttribute('hashOptions', Auth::DEFAULT_ALGO_OPTIONS);
+            ->setAttribute('hash', $hasher->getName())
+            ->setAttribute('hashOptions', $hasher->getOptions());
 
         $user = $dbForProject->updateDocument('users', $user->getId(), $user);
 
@@ -2197,17 +2206,19 @@ App::post('/v1/users/:userId/sessions')
     ->inject('locale')
     ->inject('geodb')
     ->inject('queueForEvents')
-    ->action(function (string $userId, Request $request, Response $response, Database $dbForProject, Document $project, Locale $locale, Reader $geodb, Event $queueForEvents) {
+    ->inject('store')
+    ->inject('proofForToken')
+    ->action(function (string $userId, Request $request, Response $response, Database $dbForProject, Document $project, Locale $locale, Reader $geodb, Event $queueForEvents, Store $store, Token $proofForToken) {
         $user = $dbForProject->getDocument('users', $userId);
         if ($user->isEmpty()) {
             throw new Exception(Exception::USER_NOT_FOUND);
         }
 
-        $secret = Auth::tokenGenerator(Auth::TOKEN_LENGTH_SESSION);
+        $secret = $proofForToken->generate();
         $detector = new Detector($request->getUserAgent('UNKNOWN'));
         $record = $geodb->get($request->getIP());
 
-        $duration = $project->getAttribute('auths', [])['duration'] ?? Auth::TOKEN_EXPIRATION_LOGIN_LONG;
+        $duration = $project->getAttribute('auths', [])['duration'] ?? TOKEN_EXPIRATION_LOGIN_LONG;
         $expire = DateTime::formatTz(DateTime::addSeconds(new \DateTime(), $duration));
 
         $session = new Document(array_merge(
@@ -2215,8 +2226,8 @@ App::post('/v1/users/:userId/sessions')
                 '$id' => ID::unique(),
                 'userId' => $user->getId(),
                 'userInternalId' => $user->getSequence(),
-                'provider' => Auth::SESSION_PROVIDER_SERVER,
-                'secret' => Auth::hash($secret), // One way hash encryption to protect DB leak
+                'provider' => SESSION_PROVIDER_SERVER,
+                'secret' => $proofForToken->hash($secret), // One way hash encryption to protect DB leak
                 'userAgent' => $request->getUserAgent('UNKNOWN'),
                 'factors' => ['server'],
                 'ip' => $request->getIP(),
@@ -2240,8 +2251,13 @@ App::post('/v1/users/:userId/sessions')
 
         $dbForProject->purgeCachedDocument('users', $user->getId());
 
+        $encoded = $store
+            ->setProperty('id', $user->getId())
+            ->setProperty('secret', $secret)
+            ->encode();
+
         $session
-            ->setAttribute('secret', Auth::encodeSession($user->getId(), $secret))
+            ->setAttribute('secret', $encoded)
             ->setAttribute('countryName', $countryName);
 
         $queueForEvents
@@ -2276,7 +2292,7 @@ App::post('/v1/users/:userId/tokens')
     ))
     ->param('userId', '', new UID(), 'User ID.')
     ->param('length', 6, new Range(4, 128), 'Token length in characters. The default length is 6 characters', true)
-    ->param('expire', Auth::TOKEN_EXPIRATION_GENERIC, new Range(60, Auth::TOKEN_EXPIRATION_LOGIN_LONG), 'Token expiration period in seconds. The default expiration is 15 minutes.', true)
+    ->param('expire', TOKEN_EXPIRATION_GENERIC, new Range(60, TOKEN_EXPIRATION_LOGIN_LONG), 'Token expiration period in seconds. The default expiration is 15 minutes.', true)
     ->inject('request')
     ->inject('response')
     ->inject('dbForProject')
@@ -2288,15 +2304,17 @@ App::post('/v1/users/:userId/tokens')
             throw new Exception(Exception::USER_NOT_FOUND);
         }
 
-        $secret = Auth::tokenGenerator($length);
+        $proofForToken = new Token($length);
+        $proofForToken->setHash(new Sha());
+        $secret = $proofForToken->generate();
         $expire = DateTime::formatTz(DateTime::addSeconds(new \DateTime(), $expire));
 
         $token = new Document([
             '$id' => ID::unique(),
             'userId' => $user->getId(),
             'userInternalId' => $user->getSequence(),
-            'type' => Auth::TOKEN_TYPE_GENERIC,
-            'secret' => Auth::hash($secret),
+            'type' => TOKEN_TYPE_GENERIC,
+            'secret' => $proofForToken->hash($secret),
             'expire' => $expire,
             'userAgent' => $request->getUserAgent('UNKNOWN'),
             'ip' => $request->getIP()
@@ -2647,8 +2665,8 @@ App::get('/v1/users/usage')
     ->param('range', '30d', new WhiteList(['24h', '30d', '90d'], true), 'Date range.', true)
     ->inject('response')
     ->inject('dbForProject')
-    ->inject('authorization')
-    ->action(function (string $range, Response $response, Database $dbForProject, Authorization $authorization) {
+    ->inject('register')
+    ->action(function (string $range, Response $response, Database $dbForProject) {
 
         $periods = Config::getParam('usage', []);
         $stats = $usage = [];
@@ -2658,7 +2676,7 @@ App::get('/v1/users/usage')
             METRIC_SESSIONS,
         ];
 
-        $authorization->skip(function () use ($dbForProject, $days, $metrics, &$stats) {
+        Authorization::skip(function () use ($dbForProject, $days, $metrics, &$stats) {
             foreach ($metrics as $count => $metric) {
                 $result =  $dbForProject->findOne('stats', [
                     Query::equal('metric', [$metric]),

app/controllers/api/vcs.php

@@ -17,7 +17,9 @@ use Appwrite\Vcs\Comment;
 use Swoole\Coroutine\WaitGroup;
 use Utopia\App;
 use Utopia\CLI\Console;
+use Utopia\Config\Adapters\Dotenv as ConfigDotenv;
 use Utopia\Config\Config;
+use Utopia\Config\Exceptions\Parse;
 use Utopia\Database\Database;
 use Utopia\Database\DateTime;
 use Utopia\Database\Document;
@@ -29,7 +31,10 @@ use Utopia\Database\Helpers\Permission;
 use Utopia\Database\Helpers\Role;
 use Utopia\Database\Query;
 use Utopia\Database\Validator\Authorization;
+use Utopia\Database\Validator\Queries;
 use Utopia\Database\Validator\Query\Cursor;
+use Utopia\Database\Validator\Query\Limit;
+use Utopia\Database\Validator\Query\Offset;
 use Utopia\Detector\Detection\Framework\Analog;
 use Utopia\Detector\Detection\Framework\Angular;
 use Utopia\Detector\Detection\Framework\Astro;
@@ -72,7 +77,7 @@ use Utopia\VCS\Exception\RepositoryNotFound;
 
 use function Swoole\Coroutine\batch;
 
-$createGitDeployments = function (GitHub $github, string $providerInstallationId, array $repositories, string $providerBranch, string $providerBranchUrl, string $providerRepositoryName, string $providerRepositoryUrl, string $providerRepositoryOwner, string $providerCommitHash, string $providerCommitAuthor, string $providerCommitAuthorUrl, string $providerCommitMessage, string $providerCommitUrl, string $providerPullRequestId, bool $external, Database $dbForPlatform, Authorization $authorization, Build $queueForBuilds, callable $getProjectDB, Request $request) {
+$createGitDeployments = function (GitHub $github, string $providerInstallationId, array $repositories, string $providerBranch, string $providerBranchUrl, string $providerRepositoryName, string $providerRepositoryUrl, string $providerRepositoryOwner, string $providerCommitHash, string $providerCommitAuthor, string $providerCommitAuthorUrl, string $providerCommitMessage, string $providerCommitUrl, string $providerPullRequestId, bool $external, Database $dbForPlatform, Build $queueForBuilds, callable $getProjectDB, Request $request) {
     $errors = [];
     foreach ($repositories as $repository) {
         try {
@@ -83,12 +88,12 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
             }
 
             $projectId = $repository->getAttribute('projectId');
-            $project = $authorization->skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
+            $project = Authorization::skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
             $dbForProject = $getProjectDB($project);
 
             $resourceCollection = $resourceType === "function" ? 'functions' : 'sites';
             $resourceId = $repository->getAttribute('resourceId');
-            $resource = $authorization->skip(fn () => $dbForProject->getDocument($resourceCollection, $resourceId));
+            $resource = Authorization::skip(fn () => $dbForProject->getDocument($resourceCollection, $resourceId));
             $resourceInternalId = $resource->getSequence();
 
             $deploymentId = ID::unique();
@@ -137,7 +142,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
             $latestCommentId = '';
 
             if (!empty($providerPullRequestId) && $resource->getAttribute('providerSilentMode', false) === false) {
-                $latestComment = $authorization->skip(fn () => $dbForPlatform->findOne('vcsComments', [
+                $latestComment = Authorization::skip(fn () => $dbForPlatform->findOne('vcsComments', [
                     Query::equal('providerRepositoryId', [$providerRepositoryId]),
                     Query::equal('providerPullRequestId', [$providerPullRequestId]),
                     Query::orderDesc('$createdAt'),
@@ -176,7 +181,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
 
                             $latestCommentId = \strval($github->updateComment($owner, $repositoryName, $latestCommentId, $comment->generateComment()));
                         } finally {
-                            $authorization->skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
+                            Authorization::skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
                         }
                     }
                 } else {
@@ -187,7 +192,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                     if (!empty($latestCommentId)) {
                         $teamId = $project->getAttribute('teamId', '');
 
-                        $latestComment = $authorization->skip(fn () => $dbForPlatform->createDocument('vcsComments', new Document([
+                        $latestComment = Authorization::skip(fn () => $dbForPlatform->createDocument('vcsComments', new Document([
                             '$id' => ID::unique(),
                             '$permissions' => [
                                 Permission::read(Role::team(ID::custom($teamId))),
@@ -208,7 +213,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                     }
                 }
             } elseif (!empty($providerBranch)) {
-                $latestComments = $authorization->skip(fn () => $dbForPlatform->find('vcsComments', [
+                $latestComments = Authorization::skip(fn () => $dbForPlatform->find('vcsComments', [
                     Query::equal('providerRepositoryId', [$providerRepositoryId]),
                     Query::equal('providerBranch', [$providerBranch]),
                     Query::orderDesc('$createdAt'),
@@ -247,7 +252,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
 
                             $latestCommentId = \strval($github->updateComment($owner, $repositoryName, $latestCommentId, $comment->generateComment()));
                         } finally {
-                            $authorization->skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
+                            Authorization::skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
                         }
                     }
                 }
@@ -290,7 +295,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                 $commands[] = $resource->getAttribute('commands', '');
             }
 
-            $deployment = $authorization->skip(fn () => $dbForProject->createDocument('deployments', new Document([
+            $deployment = Authorization::skip(fn () => $dbForProject->createDocument('deployments', new Document([
                 '$id' => $deploymentId,
                 '$permissions' => [
                     Permission::read(Role::any()),
@@ -330,7 +335,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                 ->setAttribute('latestDeploymentInternalId', $deployment->getSequence())
                 ->setAttribute('latestDeploymentCreatedAt', $deployment->getCreatedAt())
                 ->setAttribute('latestDeploymentStatus', $deployment->getAttribute('status', ''));
-            $authorization->skip(fn () => $dbForProject->updateDocument($resource->getCollection(), $resource->getId(), $resource));
+            Authorization::skip(fn () => $dbForProject->updateDocument($resource->getCollection(), $resource->getId(), $resource));
 
             if ($resource->getCollection() === 'sites') {
                 $projectId = $project->getId();
@@ -340,7 +345,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                 $domain = ID::unique() . "." . $sitesDomain;
                 $ruleId = md5($domain);
                 $previewRuleId = $ruleId;
-                $authorization->skip(
+                Authorization::skip(
                     fn () => $dbForPlatform->createDocument('rules', new Document([
                         '$id' => $ruleId,
                         'projectId' => $project->getId(),
@@ -373,7 +378,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                     $domain = "branch-{$branchPrefix}-{$resourceProjectHash}.{$sitesDomain}";
                     $ruleId = md5($domain);
                     try {
-                        $authorization->skip(
+                        Authorization::skip(
                             fn () => $dbForPlatform->createDocument('rules', new Document([
                                 '$id' => $ruleId,
                                 'projectId' => $project->getId(),
@@ -404,7 +409,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                     $domain = "commit-" . substr($providerCommitHash, 0, 16) . ".{$sitesDomain}";
                     $ruleId = md5($domain);
                     try {
-                        $authorization->skip(
+                        Authorization::skip(
                             fn () => $dbForPlatform->createDocument('rules', new Document([
                                 '$id' => $ruleId,
                                 'projectId' => $project->getId(),
@@ -456,7 +461,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                 if ($lockAcquired) {
                     // Wrap in try/finally to ensure lock file gets deleted
                     try {
-                        $rule = $authorization->skip(fn () => $dbForPlatform->getDocument('rules', $previewRuleId));
+                        $rule = Authorization::skip(fn () => $dbForPlatform->getDocument('rules', $previewRuleId));
 
                         $protocol = System::getEnv('_APP_OPTIONS_FORCE_HTTPS') === 'disabled' ? 'http' : 'https';
                         $previewUrl = !empty($rule) ? ("{$protocol}://" . $rule->getAttribute('domain', '')) : '';
@@ -468,7 +473,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                             $github->updateComment($owner, $repositoryName, $latestCommentId, $comment->generateComment());
                         }
                     } finally {
-                        $authorization->skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
+                        Authorization::skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
                     }
                 }
             }
@@ -978,14 +983,14 @@ App::post('/v1/vcs/github/installations/:installationId/detections')
                     $contentResponse = $github->getRepositoryContent($owner, $repositoryName, \rtrim($providerRootDirectory, '/') . '/' . $file);
                     $envFile = $contentResponse['content'] ?? '';
 
-                    $envLines = \explode("\n", $envFile);
-                    foreach ($envLines as $line) {
-                        $parts = \explode('=', $line, 2);
-                        $envName = \trim($parts[0] ?? '');
-                        $envValue = \trim($parts[1] ?? '');
-                        if (!empty($envName)) {
+                    $configAdapter = new ConfigDotenv();
+                    try {
+                        $envObject = $configAdapter->parse($envFile);
+                        foreach ($envObject as $envName => $envValue) {
                             $envs[$envName] = $envValue;
                         }
+                    } catch (Parse $err) {
+                        // Silence error, so rest of endpoint can return
                     }
                 } finally {
                     $wg->done();
@@ -1031,10 +1036,11 @@ App::get('/v1/vcs/github/installations/:installationId/providerRepositories')
     ->param('installationId', '', new Text(256), 'Installation Id')
     ->param('type', '', new WhiteList(['runtime', 'framework']), 'Detector type. Must be one of the following: runtime, framework')
     ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
+    ->param('queries', [], new Queries([new Limit(), new Offset()]), 'Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/queries). Only supported methods are limit and offset', true)
     ->inject('gitHub')
     ->inject('response')
     ->inject('dbForPlatform')
-    ->action(function (string $installationId, string $type, string $search, GitHub $github, Response $response, Database $dbForPlatform) {
+    ->action(function (string $installationId, string $type, string $search, array $queries, GitHub $github, Response $response, Database $dbForPlatform) {
         if (empty($search)) {
             $search = "";
         }
@@ -1050,11 +1056,20 @@ App::get('/v1/vcs/github/installations/:installationId/providerRepositories')
         $githubAppId = System::getEnv('_APP_VCS_GITHUB_APP_ID');
         $github->initializeVariables($providerInstallationId, $privateKey, $githubAppId);
 
-        $page = 1;
-        $perPage = 4;
+        $queries = Query::parseQueries($queries);
+        $limitQuery = current(array_filter($queries, fn ($query) => $query->getMethod() === Query::TYPE_LIMIT));
+        $offsetQuery = current(array_filter($queries, fn ($query) => $query->getMethod() === Query::TYPE_OFFSET));
 
+        $limit = !empty($limitQuery) ? $limitQuery->getValue() : 4;
+        $offset = !empty($offsetQuery) ? $offsetQuery->getValue() : 0;
+
+        if ($offset % $limit !== 0) {
+            throw new Exception(Exception::GENERAL_ARGUMENT_INVALID, 'offset must be a multiple of the limit');
+        }
+
+        $page = ($offset / $limit) + 1;
         $owner = $github->getOwnerName($providerInstallationId);
-        $repos = $github->searchRepositories($owner, $page, $perPage, $search);
+        ['items' => $repos, 'total' => $total] = $github->searchRepositories($owner, $page, $limit, $search);
 
         $repos = \array_map(function ($repo) use ($installation) {
             $repo['id'] = \strval($repo['id'] ?? '');
@@ -1192,14 +1207,14 @@ App::get('/v1/vcs/github/installations/:installationId/providerRepositories')
                             $contentResponse = $github->getRepositoryContent($repo['organization'], $repo['name'], $file);
                             $envFile = $contentResponse['content'] ?? '';
 
-                            $envLines = \explode("\n", $envFile);
-                            foreach ($envLines as $line) {
-                                $parts = \explode('=', $line, 2);
-                                $envName = \trim($parts[0] ?? '');
-                                $envValue = \trim($parts[1] ?? '');
-                                if (!empty($envName)) {
+                            $configAdapter = new ConfigDotenv();
+                            try {
+                                $envObject = $configAdapter->parse($envFile);
+                                foreach ($envObject as $envName => $envValue) {
                                     $envs[$envName] = $envValue;
                                 }
+                            } catch (Parse) {
+                                // Silence error, so rest of endpoint can return
                             }
                         } finally {
                             $wg->done();
@@ -1226,7 +1241,7 @@ App::get('/v1/vcs/github/installations/:installationId/providerRepositories')
 
         $response->dynamic(new Document([
             $type === 'framework' ? 'frameworkProviderRepositories' : 'runtimeProviderRepositories' => $repos,
-            'total' => \count($repos),
+            'total' => $total,
         ]), ($type === 'framework') ? Response::MODEL_PROVIDER_REPOSITORY_FRAMEWORK_LIST : Response::MODEL_PROVIDER_REPOSITORY_RUNTIME_LIST);
     });
 
@@ -1462,11 +1477,10 @@ App::post('/v1/vcs/github/events')
     ->inject('request')
     ->inject('response')
     ->inject('dbForPlatform')
-    ->inject('authorization')
     ->inject('getProjectDB')
     ->inject('queueForBuilds')
     ->action(
-        function (GitHub $github, Request $request, Response $response, Database $dbForPlatform, Authorization $authorization, callable $getProjectDB, Build $queueForBuilds) use ($createGitDeployments) {
+        function (GitHub $github, Request $request, Response $response, Database $dbForPlatform, callable $getProjectDB, Build $queueForBuilds) use ($createGitDeployments) {
             $payload = $request->getRawPayload();
             $signatureRemote = $request->getHeader('x-hub-signature-256', '');
             $signatureLocal = System::getEnv('_APP_VCS_GITHUB_WEBHOOK_SECRET', '');
@@ -1502,14 +1516,14 @@ App::post('/v1/vcs/github/events')
                 $github->initializeVariables($providerInstallationId, $privateKey, $githubAppId);
 
                 //find resourceId from relevant resources table
-                $repositories = $authorization->skip(fn () => $dbForPlatform->find('repositories', [
+                $repositories = Authorization::skip(fn () => $dbForPlatform->find('repositories', [
                     Query::equal('providerRepositoryId', [$providerRepositoryId]),
                     Query::limit(100),
                 ]));
 
                 // create new deployment only on push (not committed by us) and not when branch is created or deleted
                 if ($providerCommitAuthorEmail !== APP_VCS_GITHUB_EMAIL && !$providerBranchCreated && !$providerBranchDeleted) {
-                    $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, $providerBranchUrl, $providerRepositoryName, $providerRepositoryUrl, $providerRepositoryOwner, $providerCommitHash, $providerCommitAuthorName, $providerCommitAuthorUrl, $providerCommitMessage, $providerCommitUrl, '', false, $dbForPlatform, $authorization, $queueForBuilds, $getProjectDB, $request);
+                    $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, $providerBranchUrl, $providerRepositoryName, $providerRepositoryUrl, $providerRepositoryOwner, $providerCommitHash, $providerCommitAuthorName, $providerCommitAuthorUrl, $providerCommitMessage, $providerCommitUrl, '', false, $dbForPlatform, $queueForBuilds, $getProjectDB, $request);
                 }
             } elseif ($event == $github::EVENT_INSTALLATION) {
                 if ($parsedPayload["action"] == "deleted") {
@@ -1522,16 +1536,16 @@ App::post('/v1/vcs/github/events')
                     ]);
 
                     foreach ($installations as $installation) {
-                        $repositories = $authorization->skip(fn () => $dbForPlatform->find('repositories', [
+                        $repositories = Authorization::skip(fn () => $dbForPlatform->find('repositories', [
                             Query::equal('installationInternalId', [$installation->getSequence()]),
                             Query::limit(1000)
                         ]));
 
                         foreach ($repositories as $repository) {
-                            $authorization->skip(fn () => $dbForPlatform->deleteDocument('repositories', $repository->getId()));
+                            Authorization::skip(fn () => $dbForPlatform->deleteDocument('repositories', $repository->getId()));
                         }
 
-                        $authorization->skip(fn () => $dbForPlatform->deleteDocument('installations', $installation->getId()));
+                        Authorization::skip(fn () => $dbForPlatform->deleteDocument('installations', $installation->getId()));
                     }
                 }
             } elseif ($event == $github::EVENT_PULL_REQUEST) {
@@ -1560,12 +1574,12 @@ App::post('/v1/vcs/github/events')
                     $providerCommitAuthor = $commitDetails["commitAuthor"] ?? '';
                     $providerCommitMessage = $commitDetails["commitMessage"] ?? '';
 
-                    $repositories = $authorization->skip(fn () => $dbForPlatform->find('repositories', [
+                    $repositories = Authorization::skip(fn () => $dbForPlatform->find('repositories', [
                         Query::equal('providerRepositoryId', [$providerRepositoryId]),
                         Query::orderDesc('$createdAt')
                     ]));
 
-                    $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, $providerBranchUrl, $providerRepositoryName, $providerRepositoryUrl, $providerRepositoryOwner, $providerCommitHash, $providerCommitAuthor, $providerCommitAuthorUrl, $providerCommitMessage, $providerCommitUrl, $providerPullRequestId, $external, $dbForPlatform, $authorization, $queueForBuilds, $getProjectDB, $request);
+                    $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, $providerBranchUrl, $providerRepositoryName, $providerRepositoryUrl, $providerRepositoryOwner, $providerCommitHash, $providerCommitAuthor, $providerCommitAuthorUrl, $providerCommitMessage, $providerCommitUrl, $providerPullRequestId, $external, $dbForPlatform, $queueForBuilds, $getProjectDB, $request);
                 } elseif ($parsedPayload["action"] == "closed") {
                     // Allowed external contributions cleanup
 
@@ -1574,7 +1588,7 @@ App::post('/v1/vcs/github/events')
                     $external = $parsedPayload["external"] ?? true;
 
                     if ($external) {
-                        $repositories = $authorization->skip(fn () => $dbForPlatform->find('repositories', [
+                        $repositories = Authorization::skip(fn () => $dbForPlatform->find('repositories', [
                             Query::equal('providerRepositoryId', [$providerRepositoryId]),
                             Query::orderDesc('$createdAt')
                         ]));
@@ -1585,7 +1599,7 @@ App::post('/v1/vcs/github/events')
                             if (\in_array($providerPullRequestId, $providerPullRequestIds)) {
                                 $providerPullRequestIds = \array_diff($providerPullRequestIds, [$providerPullRequestId]);
                                 $repository = $repository->setAttribute('providerPullRequestIds', $providerPullRequestIds);
-                                $repository = $authorization->skip(fn () => $dbForPlatform->updateDocument('repositories', $repository->getId(), $repository));
+                                $repository = Authorization::skip(fn () => $dbForPlatform->updateDocument('repositories', $repository->getId(), $repository));
                             }
                         }
                     }
@@ -1773,17 +1787,16 @@ App::patch('/v1/vcs/github/installations/:installationId/repositories/:repositor
     ->inject('response')
     ->inject('project')
     ->inject('dbForPlatform')
-    ->inject('authorization')
     ->inject('getProjectDB')
     ->inject('queueForBuilds')
-    ->action(function (string $installationId, string $repositoryId, string $providerPullRequestId, GitHub $github, Request $request, Response $response, Document $project, Database $dbForPlatform, Authorization $authorization, callable $getProjectDB, Build $queueForBuilds) use ($createGitDeployments) {
+    ->action(function (string $installationId, string $repositoryId, string $providerPullRequestId, GitHub $github, Request $request, Response $response, Document $project, Database $dbForPlatform, callable $getProjectDB, Build $queueForBuilds) use ($createGitDeployments) {
         $installation = $dbForPlatform->getDocument('installations', $installationId);
 
         if ($installation->isEmpty()) {
             throw new Exception(Exception::INSTALLATION_NOT_FOUND);
         }
 
-        $repository = $authorization->skip(fn () => $dbForPlatform->getDocument('repositories', $repositoryId, [
+        $repository = Authorization::skip(fn () => $dbForPlatform->getDocument('repositories', $repositoryId, [
             Query::equal('projectInternalId', [$project->getSequence()])
         ]));
 
@@ -1800,7 +1813,7 @@ App::patch('/v1/vcs/github/installations/:installationId/repositories/:repositor
 
         // TODO: Delete from array when PR is closed
 
-        $repository = $authorization->skip(fn () => $dbForPlatform->updateDocument('repositories', $repository->getId(), $repository));
+        $repository = Authorization::skip(fn () => $dbForPlatform->updateDocument('repositories', $repository->getId(), $repository));
 
         $privateKey = System::getEnv('_APP_VCS_GITHUB_PRIVATE_KEY');
         $githubAppId = System::getEnv('_APP_VCS_GITHUB_APP_ID');
@@ -1824,7 +1837,7 @@ App::patch('/v1/vcs/github/installations/:installationId/repositories/:repositor
         $providerBranch = \explode(':', $pullRequestResponse['head']['label'])[1] ?? '';
         $providerCommitHash = $pullRequestResponse['head']['sha'] ?? '';
 
-        $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, '', '', '', '', $providerCommitHash, '', '', '', '', $providerPullRequestId, true, $dbForPlatform, $authorization, $queueForBuilds, $getProjectDB, $request);
+        $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, $providerCommitHash, $providerPullRequestId, true, $dbForPlatform, $queueForBuilds, $getProjectDB, $request);
 
         $response->noContent();
     });

app/controllers/general.php

@@ -4,7 +4,6 @@ require_once __DIR__ . '/../init.php';
 
 use Ahc\Jwt\JWT;
 use Ahc\Jwt\JWTException;
-use Appwrite\Auth\Auth;
 use Appwrite\Auth\Key;
 use Appwrite\Event\Certificate;
 use Appwrite\Event\Event;
@@ -17,6 +16,7 @@ use Appwrite\SDK\Method;
 use Appwrite\SDK\Response as SDKResponse;
 use Appwrite\Transformation\Adapter\Preview;
 use Appwrite\Transformation\Transformation;
+use Appwrite\Utopia\Database\Documents\User as DBUser;
 use Appwrite\Utopia\Request;
 use Appwrite\Utopia\Request\Filters\V16 as RequestV16;
 use Appwrite\Utopia\Request\Filters\V17 as RequestV17;
@@ -57,7 +57,7 @@ Config::setParam('domainVerification', false);
 Config::setParam('cookieDomain', 'localhost');
 Config::setParam('cookieSamesite', Response::COOKIE_SAMESITE_NONE);
 
-function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, string $previewHostname, Authorization $authorization, ?Key $apiKey)
+function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, string $previewHostname, ?Key $apiKey)
 {
     $host = $request->getHostname() ?? '';
     if (!empty($previewHostname)) {
@@ -66,9 +66,9 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
 
     // TODO: @christyjacob remove once we migrate the rules in 1.7.x
     if (System::getEnv('_APP_RULES_FORMAT') === 'md5') {
-        $rule = $authorization->skip(fn () => $dbForPlatform->getDocument('rules', md5($host)));
+        $rule = Authorization::skip(fn () => $dbForPlatform->getDocument('rules', md5($host)));
     } else {
-        $rule = $authorization->skip(
+        $rule = Authorization::skip(
             fn () => $dbForPlatform->find('rules', [
                 Query::equal('domain', [$host]),
                 Query::limit(1)
@@ -109,7 +109,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
     }
 
     $projectId = $rule->getAttribute('projectId');
-    $project = $authorization->skip(
+    $project = Authorization::skip(
         fn () => $dbForPlatform->getDocument('projects', $projectId)
     );
 
@@ -117,7 +117,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
         $accessedAt = $project->getAttribute('accessedAt', 0);
         if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_PROJECT_ACCESS)) > $accessedAt) {
             $project->setAttribute('accessedAt', DateTime::now());
-            $authorization->skip(fn () => $dbForPlatform->updateDocument('projects', $project->getId(), $project));
+            Authorization::skip(fn () => $dbForPlatform->updateDocument('projects', $project->getId(), $project));
         }
 
         /**
@@ -156,7 +156,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
 
         /** @var Document $deployment */
         if (!empty($rule->getAttribute('deploymentId', ''))) {
-            $deployment = $authorization->skip(fn () => $dbForProject->getDocument('deployments', $rule->getAttribute('deploymentId')));
+            $deployment = Authorization::skip(fn () => $dbForProject->getDocument('deployments', $rule->getAttribute('deploymentId')));
         } else {
             // 1.6.x DB schema compatibility
             // TODO: Make sure deploymentId is never empty, and remove this code
@@ -170,15 +170,15 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
 
             // Document of site or function
             $resource = $resourceType === 'function' ?
-                $authorization->skip(fn () => $dbForProject->getDocument('functions', $resourceId)) :
-                $authorization->skip(fn () => $dbForProject->getDocument('sites', $resourceId));
+                Authorization::skip(fn () => $dbForProject->getDocument('functions', $resourceId)) :
+                Authorization::skip(fn () => $dbForProject->getDocument('sites', $resourceId));
 
             // ID of active deployments
             // Attempts to use attribute from both schemas (1.6 and 1.7)
             $activeDeploymentId = $resource->getAttribute('deploymentId', $resource->getAttribute('deployment', ''));
 
             // Get deployment document, as intended originally
-            $deployment = $authorization->skip(fn () => $dbForProject->getDocument('deployments', $activeDeploymentId));
+            $deployment = Authorization::skip(fn () => $dbForProject->getDocument('deployments', $activeDeploymentId));
         }
 
         if ($deployment->getAttribute('resourceType', '') === 'functions') {
@@ -197,8 +197,8 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
         }
 
         $resource = $type === 'function' ?
-            $authorization->skip(fn () => $dbForProject->getDocument('functions', $deployment->getAttribute('resourceId', ''))) :
-            $authorization->skip(fn () => $dbForProject->getDocument('sites', $deployment->getAttribute('resourceId', '')));
+            Authorization::skip(fn () => $dbForProject->getDocument('functions', $deployment->getAttribute('resourceId', ''))) :
+            Authorization::skip(fn () => $dbForProject->getDocument('sites', $deployment->getAttribute('resourceId', '')));
 
         $isPreview = $type === 'function' ? false : ($rule->getAttribute('trigger', '') !== 'manual');
 
@@ -223,7 +223,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
         */
         $requirePreview = \is_null($apiKey) || !$apiKey->isPreviewAuthDisabled();
         if ($isPreview && $requirePreview) {
-            $cookie = $request->getCookie(Auth::$cookieNamePreview, '');
+            $cookie = $request->getCookie(COOKIE_NAME_PREVIEW, '');
             $authorized = false;
 
             // Security checks to mark authorized true
@@ -240,7 +240,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
                 $userExists = false;
                 $userId = $payload['userId'] ?? '';
                 if (!empty($userId)) {
-                    $user = $authorization->skip(fn () => $dbForPlatform->getDocument('users', $userId));
+                    $user = Authorization::skip(fn () => $dbForPlatform->getDocument('users', $userId));
                     if (!$user->isEmpty() && $user->getAttribute('status', false)) {
                         $userExists = true;
                     }
@@ -253,7 +253,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
                 }
 
                 $membershipExists = false;
-                $project = $authorization->skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
+                $project = Authorization::skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
                 if (!$project->isEmpty() && isset($user)) {
                     $teamId = $project->getAttribute('teamId', '');
                     $membership = $user->find('teamId', $teamId, 'memberships');
@@ -864,8 +864,7 @@ App::init()
     ->inject('apiKey')
     ->inject('httpReferrer')
     ->inject('httpReferrerSafe')
-    ->inject('authorization')
-    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Document $console, Document $project, Database $dbForPlatform, callable $getProjectDB, Locale $locale, array $localeCodes, array $platforms, Reader $geodb, StatsUsage $queueForStatsUsage, Event $queueForEvents, Certificate $queueForCertificates, Func $queueForFunctions, Executor $executor, callable $isResourceBlocked, string $previewHostname, Document $devKey, ?Key $apiKey, string $httpReferrer, string $httpReferrerSafe, Authorization $authorization) {
+    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Document $console, Document $project, Database $dbForPlatform, callable $getProjectDB, Locale $locale, array $localeCodes, array $platforms, Reader $geodb, StatsUsage $queueForStatsUsage, Event $queueForEvents, Certificate $queueForCertificates, Func $queueForFunctions, Executor $executor, callable $isResourceBlocked, string $previewHostname, Document $devKey, ?Key $apiKey, string $httpReferrer, string $httpReferrerSafe) {
         /*
         * Appwrite Router
         */
@@ -873,7 +872,7 @@ App::init()
         $mainDomain = System::getEnv('_APP_DOMAIN', '');
         // Only run Router when external domain
         if ($host !== $mainDomain || !empty($previewHostname)) {
-            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $previewHostname, $authorization, $apiKey)) {
+            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $previewHostname, $apiKey)) {
                 $utopia->getRoute()?->label('router', true);
             }
         }
@@ -924,7 +923,7 @@ App::init()
             } elseif (str_starts_with($request->getURI(), '/.well-known/acme-challenge')) {
                 Console::warning('Skipping SSL certificates generation on ACME challenge.');
             } else {
-                $authorization->disable();
+                Authorization::disable();
 
                 $envDomain = System::getEnv('_APP_DOMAIN', '');
                 $mainDomain = null;
@@ -994,7 +993,7 @@ App::init()
                 }
                 $domains[$domain->get()] = true;
 
-                $authorization->reset(); // ensure authorization is re-enabled
+                Authorization::reset(); // ensure authorization is re-enabled
             }
             Config::setParam('domains', $domains);
         }
@@ -1130,8 +1129,7 @@ App::options()
     ->inject('project')
     ->inject('devKey')
     ->inject('apiKey')
-    ->inject('authorization')
-    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, string $previewHostname, Document $project, Document $devKey, ?Key $apiKey, Authorization $authorization) {
+    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, string $previewHostname, Document $project, Document $devKey, ?Key $apiKey) {
         /*
         * Appwrite Router
         */
@@ -1139,7 +1137,7 @@ App::options()
         $mainDomain = System::getEnv('_APP_DOMAIN', '');
         // Only run Router when external domain
         if ($host !== $mainDomain || !empty($previewHostname)) {
-            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $previewHostname, $authorization, $apiKey)) {
+            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $previewHostname, $apiKey)) {
                 $utopia->getRoute()?->label('router', true);
             }
         }
@@ -1180,8 +1178,7 @@ App::error()
     ->inject('log')
     ->inject('queueForStatsUsage')
     ->inject('devKey')
-    ->inject('authorization')
-    ->action(function (Throwable $error, App $utopia, Request $request, Response $response, Document $project, ?Logger $logger, Log $log, StatsUsage $queueForStatsUsage, Document $devKey, Authorization $authorization) {
+    ->action(function (Throwable $error, App $utopia, Request $request, Response $response, Document $project, ?Logger $logger, Log $log, StatsUsage $queueForStatsUsage) {
         $version = System::getEnv('_APP_VERSION', 'UNKNOWN');
         $route = $utopia->getRoute();
         $class = \get_class($error);
@@ -1263,7 +1260,7 @@ App::error()
          * If not a publishable error, track usage stats. Publishable errors are >= 500 or those explicitly marked as publish=true in errors.php
          */
         if (!$publish && $project->getId() !== 'console') {
-            if (!Auth::isPrivilegedUser($authorization->getRoles())) {
+            if (!DBUser::isPrivileged(Authorization::getRoles())) {
                 $fileSize = 0;
                 $file = $request->getFiles('file');
                 if (!empty($file)) {
@@ -1325,7 +1322,7 @@ App::error()
             $log->addExtra('file', $error->getFile());
             $log->addExtra('line', $error->getLine());
             $log->addExtra('trace', $error->getTraceAsString());
-            $log->addExtra('roles', $authorization->getRoles());
+            $log->addExtra('roles', Authorization::getRoles());
 
             $action = 'UNKNOWN_NAMESPACE.UNKNOWN.METHOD';
             if (!empty($sdk)) {
@@ -1448,8 +1445,7 @@ App::get('/robots.txt')
     ->inject('isResourceBlocked')
     ->inject('previewHostname')
     ->inject('apiKey')
-    ->inject('authorization')
-    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, string $previewHostname, ?Key $apiKey, Authorization $authorization) {
+    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, string $previewHostname, ?Key $apiKey) {
         $host = $request->getHostname() ?? '';
         $consoleDomain = System::getEnv('_APP_CONSOLE_DOMAIN', '');
         $mainDomain = System::getEnv('_APP_DOMAIN', '');
@@ -1458,7 +1454,7 @@ App::get('/robots.txt')
             $template = new View(__DIR__ . '/../views/general/robots.phtml');
             $response->text($template->render(false));
         } else {
-            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $previewHostname, $authorization, $apiKey)) {
+            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $previewHostname, $apiKey)) {
                 $utopia->getRoute()?->label('router', true);
             }
         }
@@ -1483,8 +1479,7 @@ App::get('/humans.txt')
     ->inject('isResourceBlocked')
     ->inject('previewHostname')
     ->inject('apiKey')
-    ->inject('authorization')
-    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, string $previewHostname, ?Key $apiKey, Authorization $authorization) {
+    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, string $previewHostname, ?Key $apiKey) {
         $host = $request->getHostname() ?? '';
         $consoleDomain = System::getEnv('_APP_CONSOLE_DOMAIN', '');
         $mainDomain = System::getEnv('_APP_DOMAIN', '');
@@ -1493,7 +1488,7 @@ App::get('/humans.txt')
             $template = new View(__DIR__ . '/../views/general/humans.phtml');
             $response->text($template->render(false));
         } else {
-            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $previewHostname, $authorization, $apiKey)) {
+            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $previewHostname, $apiKey)) {
                 $utopia->getRoute()?->label('router', true);
             }
         }
@@ -1577,8 +1572,7 @@ App::get('/v1/ping')
     ->inject('project')
     ->inject('dbForPlatform')
     ->inject('queueForEvents')
-    ->inject('authorization')
-    ->action(function (Response $response, Document $project, Database $dbForPlatform, Event $queueForEvents, Authorization $authorization) {
+    ->action(function (Response $response, Document $project, Database $dbForPlatform, Event $queueForEvents) {
         if ($project->isEmpty() || $project->getId() === 'console') {
             throw new AppwriteException(AppwriteException::PROJECT_NOT_FOUND);
         }
@@ -1590,7 +1584,7 @@ App::get('/v1/ping')
             ->setAttribute('pingCount', $pingCount)
             ->setAttribute('pingedAt', $pingedAt);
 
-        $authorization->skip(function () use ($dbForPlatform, $project) {
+        Authorization::skip(function () use ($dbForPlatform, $project) {
             $dbForPlatform->updateDocument('projects', $project->getId(), $project);
         });
 
@@ -1623,7 +1617,7 @@ App::get('/_appwrite/authorize')
         $expire = DateTime::formatTz(DateTime::addSeconds(new \DateTime(), $duration));
 
         $response
-            ->addCookie(Auth::$cookieNamePreview, $jwt, (new \DateTime($expire))->getTimestamp(), '/', $host, ('https' === $protocol), true, null)
+            ->addCookie(COOKIE_NAME_PREVIEW, $jwt, (new \DateTime($expire))->getTimestamp(), '/', $host, ('https' === $protocol), true, null)
             ->addHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0')
             ->addHeader('Pragma', 'no-cache')
             ->redirect($protocol . '://' . $host . $path);

app/controllers/shared/api.php

@@ -1,6 +1,5 @@
 <?php
 
-use Appwrite\Auth\Auth;
 use Appwrite\Auth\Key;
 use Appwrite\Auth\MFA\Type\TOTP;
 use Appwrite\Event\Audit;
@@ -16,26 +15,25 @@ use Appwrite\Event\Webhook;
 use Appwrite\Extend\Exception;
 use Appwrite\Extend\Exception as AppwriteException;
 use Appwrite\SDK\Method;
+use Appwrite\Utopia\Database\Documents\User;
 use Appwrite\Utopia\Request;
 use Appwrite\Utopia\Response;
 use Utopia\Abuse\Abuse;
 use Utopia\App;
 use Utopia\Cache\Adapter\Filesystem;
 use Utopia\Cache\Cache;
-use Utopia\CLI\Console;
 use Utopia\Config\Config;
 use Utopia\Database\Database;
 use Utopia\Database\DateTime;
 use Utopia\Database\Document;
 use Utopia\Database\Helpers\Role;
 use Utopia\Database\Validator\Authorization;
-use Utopia\Database\Validator\Authorization\Input;
 use Utopia\Queue\Publisher;
 use Utopia\System\System;
 use Utopia\Telemetry\Adapter as Telemetry;
 use Utopia\Validator\WhiteList;
 
-$parseLabel = function (string $label, array $responsePayload, array $requestParams, Document $user) {
+$parseLabel = function (string $label, array $responsePayload, array $requestParams, User $user) {
     preg_match_all('/{(.*?)}/', $label, $matches);
     foreach ($matches[1] ?? [] as $pos => $match) {
         $find = $matches[0][$pos];
@@ -233,45 +231,97 @@ App::init()
     ->inject('mode')
     ->inject('team')
     ->inject('apiKey')
-    ->inject('authorization')
-    ->action(function (App $utopia, Request $request, Database $dbForPlatform, Database $dbForProject, Audit $queueForAudits, Document $project, Document $user, ?Document $session, array $servers, string $mode, Document $team, ?Key $apiKey, Authorization $authorization) {
+    ->action(function (App $utopia, Request $request, Database $dbForPlatform, Database $dbForProject, Audit $queueForAudits, Document $project, User $user, ?Document $session, array $servers, string $mode, Document $team, ?Key $apiKey) {
         $route = $utopia->getRoute();
-        if (System::getEnv('_APP_EDITION', 'self-hosted') === 'self-hosted' && str_starts_with($route->getPath(), '/v1/backups')) {
-            throw new Exception(Exception::GENERAL_BAD_REQUEST, 'Database Backups are available on Appwrite Cloud');
-        }
+
+        /**
+         * Handle user authentication and session validation.
+         *
+         * This function follows a series of steps to determine the appropriate user session
+         * based on cookies, headers, and JWT tokens.
+         *
+         * Process:
+         *
+         * Project & Role Validation:
+         * 1. Check if the project is empty. If so, throw an exception.
+         * 2. Get the roles configuration.
+         * 3. Determine the role for the user based on the user document.
+         * 4. Get the scopes for the role.
+         *
+         * API Key Authentication:
+         * 5. If there is an API key:
+         *    - Verify no user session exists simultaneously
+         *    - Check if key is expired
+         *    - Set role and scopes from API key
+         *    - Handle special app role case
+         *    - For standard keys, update last accessed time
+         *
+         * User Activity:
+         * 6. If the project is not the console and user is not admin:
+         *    - Update user's last activity timestamp
+         *
+         * Access Control:
+         * 7. Get the method from the route
+         * 8. Validate namespace permissions
+         * 9. Validate scope permissions
+         * 10. Check if user is blocked
+         *
+         * Security Checks:
+         * 11. Verify password status (check if reset required)
+         * 12. Validate MFA requirements:
+         *     - Check if MFA is enabled
+         *     - Verify email status
+         *     - Verify phone status
+         *     - Verify authenticator status
+         * 13. Handle Multi-Factor Authentication:
+         *     - Check remaining required factors
+         *     - Validate factor completion
+         *     - Throw exception if factors incomplete
+         */
+
+        // Step 1: Check if project is empty
         if ($project->isEmpty()) {
             throw new Exception(Exception::PROJECT_NOT_FOUND);
         }
 
+        // Step 2: Get roles configuration
         $roles = Config::getParam('roles', []);
 
+        // Step 3: Determine role for user
+        // TODO get scopes from the identity instead of the user roles config. The identity will containn the scopes the user authorized for the access token.
+
         $role = $user->isEmpty()
             ? Role::guests()->toString()
             : Role::users()->toString();
 
+        // Step 4: Get scopes for the role
         $scopes = $roles[$role]['scopes'];
 
-        // API Key authentication
+        // Step 5: API Key Authentication
         if (!empty($apiKey)) {
+            // Verify no user session exists simultaneously
             if (!$user->isEmpty()) {
                 throw new Exception(Exception::USER_API_KEY_AND_SESSION_SET);
             }
+            // Check if key is expired
             if ($apiKey->isExpired()) {
                 throw new Exception(Exception::PROJECT_KEY_EXPIRED);
             }
 
+            // Set role and scopes from API key
             $role = $apiKey->getRole();
             $scopes = $apiKey->getScopes();
 
 
-            if ($apiKey->getRole() === Auth::USER_ROLE_APPS) {
+            // Handle special app role case
+            if ($apiKey->getRole() === User::ROLE_APPS) {
                 // Disable authorization checks for API keys
-                $authorization->setDefaultStatus(false);
+                Authorization::setDefaultStatus(false);
 
-                $user = new Document([
+                $user = new User([
                     '$id' => '',
                     'status' => true,
-                    'type' => Auth::ACTIVITY_TYPE_APP,
+                    'type' => ACTIVITY_TYPE_APP,
                     'email' => 'app.' . $project->getId() . '@service.' . $request->getHostname(),
                     'password' => '',
                     'name' => $apiKey->getName(),
@@ -280,6 +330,7 @@ App::init()
                 $queueForAudits->setUser($user);
             }
 
+            // For standard keys, update last accessed time
             if ($apiKey->getType() === API_KEY_STANDARD) {
                 $dbKey = $project->find(
                     key: 'secret',
@@ -339,26 +390,25 @@ App::init()
                 $scopes = \array_merge($scopes, $roles[$role]['scopes']);
             }
 
-            $authorization->setDefaultStatus(false);  // Cancel security segmentation for admin users.
+            Authorization::setDefaultStatus(false);  // Cancel security segmentation for admin users.
         }
 
         $scopes = \array_unique($scopes);
 
-        $authorization->addRole($role);
-        foreach (Auth::getRoles($user, $authorization) as $authRole) {
-            $authorization->addRole($authRole);
+        Authorization::setRole($role);
+        foreach ($user->getRoles() as $authRole) {
+            Authorization::setRole($authRole);
         }
 
-        // Update project last activity
+        // Step 6: Update project and user last activity
         if (!$project->isEmpty() && $project->getId() !== 'console') {
             $accessedAt = $project->getAttribute('accessedAt', 0);
             if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_PROJECT_ACCESS)) > $accessedAt) {
                 $project->setAttribute('accessedAt', DateTime::now());
-                $authorization->skip(fn () => $dbForPlatform->updateDocument('projects', $project->getId(), $project));
+                Authorization::skip(fn () => $dbForPlatform->updateDocument('projects', $project->getId(), $project));
             }
         }
 
-        // Update user last activity
         if (!empty($user->getId())) {
             $accessedAt = $user->getAttribute('accessedAt', 0);
             if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_USER_ACCESS)) > $accessedAt) {
@@ -372,6 +422,7 @@ App::init()
             }
         }
 
+        // Steps 7-9: Access Control - Method, Namespace and Scope Validation
         /**
          * @var ?Method $method
          */
@@ -389,27 +440,29 @@ App::init()
             if (
                 array_key_exists($namespace, $project->getAttribute('services', []))
                 && !$project->getAttribute('services', [])[$namespace]
-                && !(Auth::isPrivilegedUser($authorization->getRoles()) || Auth::isAppUser($authorization->getRoles()))
+                && !(User::isPrivileged(Authorization::getRoles()) || User::isApp(Authorization::getRoles()))
             ) {
                 throw new Exception(Exception::GENERAL_SERVICE_DISABLED);
             }
         }
 
-        // Do now allow access if scope is not allowed
+        // Step 9: Validate scope permissions
         $allowed = (array)$route->getLabel('scope', 'none');
         if (empty(\array_intersect($allowed, $scopes))) {
             throw new Exception(Exception::GENERAL_UNAUTHORIZED_SCOPE, $user->getAttribute('email', 'User') . ' (role: ' . \strtolower($roles[$role]['label']) . ') missing scopes (' . \json_encode($allowed) . ')');
         }
 
-        // Do not allow access to blocked accounts
+        // Step 10: Check if user is blocked
         if (false === $user->getAttribute('status')) { // Account is blocked
             throw new Exception(Exception::USER_BLOCKED);
         }
 
+        // Step 11: Verify password status
         if ($user->getAttribute('reset')) {
             throw new Exception(Exception::USER_PASSWORD_RESET_REQUIRED);
         }
 
+        // Step 12: Validate MFA requirements
         $mfaEnabled = $user->getAttribute('mfa', false);
         $hasVerifiedEmail = $user->getAttribute('emailVerification', false);
         $hasVerifiedPhone = $user->getAttribute('phoneVerification', false);
@@ -417,6 +470,7 @@ App::init()
         $hasMoreFactors = $hasVerifiedEmail || $hasVerifiedPhone || $hasVerifiedAuthenticator;
         $minimumFactors = ($mfaEnabled && $hasMoreFactors) ? 2 : 1;
 
+        // Step 13: Handle Multi-Factor Authentication
         if (!in_array('mfa', $route->getGroups())) {
             if ($session && \count($session->getAttribute('factors', [])) < $minimumFactors) {
                 throw new Exception(Exception::USER_MORE_FACTORS_REQUIRED);
@@ -449,15 +503,14 @@ App::init()
     ->inject('plan')
     ->inject('devKey')
     ->inject('telemetry')
-    ->inject('authorization')
-    ->action(function (App $utopia, Request $request, Response $response, Document $project, Document $user, Publisher $publisher, Publisher $publisherFunctions, Publisher $publisherWebhooks, Event $queueForEvents, Messaging $queueForMessaging, Audit $queueForAudits, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, StatsUsage $queueForStatsUsage, Database $dbForProject, callable $timelimit, Document $resourceToken, string $mode, ?Key $apiKey, array $plan, Document $devKey, Telemetry $telemetry, Authorization $authorization) use ($usageDatabaseListener, $eventDatabaseListener) {
+    ->action(function (App $utopia, Request $request, Response $response, Document $project, Document $user, Publisher $publisher, Publisher $publisherFunctions, Publisher $publisherWebhooks, Event $queueForEvents, Messaging $queueForMessaging, Audit $queueForAudits, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, StatsUsage $queueForStatsUsage, Database $dbForProject, callable $timelimit, Document $resourceToken, string $mode, ?Key $apiKey, array $plan, Document $devKey, Telemetry $telemetry) use ($usageDatabaseListener, $eventDatabaseListener) {
 
         $route = $utopia->getRoute();
 
         if (
             array_key_exists('rest', $project->getAttribute('apis', []))
             && !$project->getAttribute('apis', [])['rest']
-            && !(Auth::isPrivilegedUser($authorization->getRoles()) || Auth::isAppUser($authorization->getRoles()))
+            && !(User::isPrivileged(Authorization::getRoles()) || User::isApp(Authorization::getRoles()))
         ) {
             throw new AppwriteException(AppwriteException::GENERAL_API_DISABLED);
         }
@@ -487,9 +540,9 @@ App::init()
 
         $closestLimit = null;
 
-        $roles = $authorization->getRoles();
-        $isPrivilegedUser = Auth::isPrivilegedUser($roles);
-        $isAppUser = Auth::isAppUser($roles);
+        $roles = Authorization::getRoles();
+        $isPrivilegedUser = User::isPrivileged($roles);
+        $isAppUser = User::isApp($roles);
 
         foreach ($timeLimitArray as $timeLimit) {
             foreach ($request->getParams() as $key => $value) { // Set request params as potential abuse keys
@@ -544,7 +597,7 @@ App::init()
         if (!$user->isEmpty()) {
             $userClone = clone $user;
             // $user doesn't support `type` and can cause unintended effects.
-            $userClone->setAttribute('type', Auth::ACTIVITY_TYPE_USER);
+            $userClone->setAttribute('type', ACTIVITY_TYPE_USER);
             $queueForAudits->setUser($userClone);
         }
 
@@ -587,10 +640,10 @@ App::init()
         if ($useCache) {
             $route = $utopia->match($request);
             $isImageTransformation = $route->getPath() === '/v1/storage/buckets/:bucketId/files/:fileId/preview';
-            $isDisabled = isset($plan['imageTransformations']) && $plan['imageTransformations'] === -1 && !Auth::isPrivilegedUser($authorization->getRoles());
+            $isDisabled = isset($plan['imageTransformations']) && $plan['imageTransformations'] === -1 && !User::isPrivileged(Authorization::getRoles());
 
             $key = $request->cacheIdentifier();
-            $cacheLog  = $authorization->skip(fn () => $dbForProject->getDocument('cache', $key));
+            $cacheLog  = Authorization::skip(fn () => $dbForProject->getDocument('cache', $key));
             $cache = new Cache(
                 new Filesystem(APP_STORAGE_CACHE . DIRECTORY_SEPARATOR . 'app-' . $project->getId())
             );
@@ -607,10 +660,10 @@ App::init()
 
                 if ($type === 'bucket' && (!$isImageTransformation || !$isDisabled)) {
                     $bucketId = $parts[1] ?? null;
-                    $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+                    $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
                     $isToken = !$resourceToken->isEmpty() && $resourceToken->getAttribute('bucketInternalId') === $bucket->getSequence();
-                    $isPrivilegedUser = Auth::isPrivilegedUser($authorization->getRoles());
+                    $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
 
                     if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAppUser && !$isPrivilegedUser)) {
                         throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
@@ -621,7 +674,8 @@ App::init()
                     }
 
                     $fileSecurity = $bucket->getAttribute('fileSecurity', false);
-                    $valid = $authorization->isValid(new Input(Database::PERMISSION_READ, $bucket->getRead()));
+                    $validator = new Authorization(Database::PERMISSION_READ);
+                    $valid = $validator->isValid($bucket->getRead());
                     if (!$fileSecurity && !$valid && !$isToken) {
                         throw new Exception(Exception::USER_UNAUTHORIZED);
                     }
@@ -632,7 +686,7 @@ App::init()
                     if ($fileSecurity && !$valid && !$isToken) {
                         $file = $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId);
                     } else {
-                        $file = $authorization->skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+                        $file = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
                     }
 
                     if (!$resourceToken->isEmpty() && $resourceToken->getAttribute('fileInternalId') !== $file->getSequence()) {
@@ -643,11 +697,11 @@ App::init()
                         throw new Exception(Exception::STORAGE_FILE_NOT_FOUND);
                     }
                     //Do not update transformedAt if it's a console user
-                    if (!Auth::isPrivilegedUser($authorization->getRoles())) {
+                    if (!User::isPrivileged(Authorization::getRoles())) {
                         $transformedAt = $file->getAttribute('transformedAt', '');
                         if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_PROJECT_ACCESS)) > $transformedAt) {
                             $file->setAttribute('transformedAt', DateTime::now());
-                            $authorization->skip(fn () => $dbForProject->updateDocument('bucket_' . $file->getAttribute('bucketInternalId'), $file->getId(), $file));
+                            Authorization::skip(fn () => $dbForProject->updateDocument('bucket_' . $file->getAttribute('bucketInternalId'), $file->getId(), $file));
                         }
                     }
                 }
@@ -743,8 +797,7 @@ App::shutdown()
     ->inject('queueForWebhooks')
     ->inject('queueForRealtime')
     ->inject('dbForProject')
-    ->inject('authorization')
-    ->action(function (App $utopia, Request $request, Response $response, Document $project, Document $user, Event $queueForEvents, Audit $queueForAudits, StatsUsage $queueForStatsUsage, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, Messaging $queueForMessaging, Func $queueForFunctions, Event $queueForWebhooks, Realtime $queueForRealtime, Database $dbForProject, Authorization $authorization) use ($parseLabel) {
+    ->action(function (App $utopia, Request $request, Response $response, Document $project, User $user, Event $queueForEvents, Audit $queueForAudits, StatsUsage $queueForStatsUsage, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, Messaging $queueForMessaging, Func $queueForFunctions, Event $queueForWebhooks, Realtime $queueForRealtime, Database $dbForProject) use ($parseLabel) {
 
         $responsePayload = $response->getPayload();
 
@@ -792,7 +845,7 @@ App::shutdown()
         if (!$user->isEmpty()) {
             $userClone = clone $user;
             // $user doesn't support `type` and can cause unintended effects.
-            $userClone->setAttribute('type', Auth::ACTIVITY_TYPE_USER);
+            $userClone->setAttribute('type', ACTIVITY_TYPE_USER);
             $queueForAudits->setUser($userClone);
         } elseif ($queueForAudits->getUser() === null || $queueForAudits->getUser()->isEmpty()) {
             /**
@@ -803,10 +856,10 @@ App::shutdown()
              *
              * Therefore, we consider this an anonymous request and create a relevant user.
              */
-            $user = new Document([
+            $user = new User([
                 '$id' => '',
                 'status' => true,
-                'type' => Auth::ACTIVITY_TYPE_GUEST,
+                'type' => ACTIVITY_TYPE_GUEST,
                 'email' => 'guest.' . $project->getId() . '@service.' . $request->getHostname(),
                 'password' => '',
                 'name' => 'Guest',
@@ -870,11 +923,11 @@ App::shutdown()
 
                 $key = $request->cacheIdentifier();
                 $signature = md5($data['payload']);
-                $cacheLog  =  $authorization->skip(fn () => $dbForProject->getDocument('cache', $key));
+                $cacheLog  =  Authorization::skip(fn () => $dbForProject->getDocument('cache', $key));
                 $accessedAt = $cacheLog->getAttribute('accessedAt', 0);
                 $now = DateTime::now();
                 if ($cacheLog->isEmpty()) {
-                    $authorization->skip(fn () => $dbForProject->createDocument('cache', new Document([
+                    Authorization::skip(fn () => $dbForProject->createDocument('cache', new Document([
                         '$id' => $key,
                         'resource' => $resource,
                         'resourceType' => $resourceType,
@@ -884,7 +937,7 @@ App::shutdown()
                     ])));
                 } elseif (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_CACHE_UPDATE)) > $accessedAt) {
                     $cacheLog->setAttribute('accessedAt', $now);
-                    $authorization->skip(fn () => $dbForProject->updateDocument('cache', $cacheLog->getId(), $cacheLog));
+                    Authorization::skip(fn () => $dbForProject->updateDocument('cache', $cacheLog->getId(), $cacheLog));
                     // Overwrite the file every APP_CACHE_UPDATE seconds to update the file modified time that is used in the TTL checks in cache->load()
                     $cache->save($key, $data['payload']);
                 }
@@ -896,7 +949,7 @@ App::shutdown()
         }
 
         if ($project->getId() !== 'console') {
-            if (!Auth::isPrivilegedUser($authorization->getRoles())) {
+            if (!User::isPrivileged(Authorization::getRoles())) {
                 $fileSize = 0;
                 $file = $request->getFiles('file');
                 if (!empty($file)) {

app/controllers/shared/api/auth.php

@@ -1,7 +1,7 @@
 <?php
 
-use Appwrite\Auth\Auth;
 use Appwrite\Extend\Exception;
+use Appwrite\Utopia\Database\Documents\User;
 use Appwrite\Utopia\Request;
 use MaxMind\Db\Reader;
 use Utopia\App;
@@ -20,7 +20,7 @@ App::init()
         $lastUpdate = $session->getAttribute('mfaUpdatedAt');
         if (!empty($lastUpdate)) {
             $now = DateTime::now();
-            $maxAllowedDate = DateTime::addSeconds(new \DateTime($lastUpdate), Auth::MFA_RECENT_DURATION); // Maximum date until session is considered safe before asking for another challenge
+            $maxAllowedDate = DateTime::addSeconds(new \DateTime($lastUpdate), MFA_RECENT_DURATION); // Maximum date until session is considered safe before asking for another challenge
 
             $isSessionFresh = DateTime::formatTz($maxAllowedDate) >= DateTime::formatTz($now);
         }
@@ -36,8 +36,7 @@ App::init()
     ->inject('request')
     ->inject('project')
     ->inject('geodb')
-    ->inject('authorization')
-    ->action(function (App $utopia, Request $request, Document $project, Reader $geodb, Authorization $authorization) {
+    ->action(function (App $utopia, Request $request, Document $project, Reader $geodb) {
         $denylist = System::getEnv('_APP_CONSOLE_COUNTRIES_DENYLIST', '');
         if (!empty($denylist && $project->getId() === 'console')) {
             $countries = explode(',', $denylist);
@@ -50,8 +49,8 @@ App::init()
 
         $route = $utopia->match($request);
 
-        $isPrivilegedUser = Auth::isPrivilegedUser($authorization->getRoles());
-        $isAppUser = Auth::isAppUser($authorization->getRoles());
+        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
+        $isAppUser = User::isApp(Authorization::getRoles());
 
         if ($isAppUser || $isPrivilegedUser) { // Skip limits for app and console devs
             return;

app/http.php

@@ -25,6 +25,7 @@ use Utopia\Database\Helpers\ID;
 use Utopia\Database\Helpers\Permission;
 use Utopia\Database\Helpers\Role;
 use Utopia\Database\Query;
+use Utopia\Database\Validator\Authorization;
 use Utopia\Logger\Log;
 use Utopia\Logger\Log\User;
 use Utopia\Pools\Group;
@@ -258,9 +259,7 @@ $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $reg
         createDatabase($app, 'getLogsDB', 'logs', $collections['logs'], $pools);
 
         // create appwrite database, `dbForPlatform` is a direct access call.
-        createDatabase($app, 'dbForPlatform', 'appwrite', $collections['console'], $pools, function (Database $dbForPlatform) use ($collections, $app) {
-            $authorization = $app->getResource('authorization');
-
+        createDatabase($app, 'dbForPlatform', 'appwrite', $collections['console'], $pools, function (Database $dbForPlatform) use ($collections) {
             if ($dbForPlatform->getCollection(Audit::COLLECTION)->isEmpty()) {
                 $audit = new Audit($dbForPlatform);
                 $audit->setup();
@@ -319,9 +318,9 @@ $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $reg
                 $dbForPlatform->createCollection('bucket_' . $bucket->getSequence(), $attributes, $indexes);
             }
 
-            if ($authorization->skip(fn () => $dbForPlatform->getDocument('buckets', 'screenshots')->isEmpty())) {
+            if (Authorization::skip(fn () => $dbForPlatform->getDocument('buckets', 'screenshots')->isEmpty())) {
                 Console::info("    └── Creating screenshots bucket...");
-                $authorization->skip(fn () => $dbForPlatform->createDocument('buckets', new Document([
+                Authorization::skip(fn () => $dbForPlatform->createDocument('buckets', new Document([
                     '$id' => ID::custom('screenshots'),
                     '$collection' => ID::custom('buckets'),
                     'name' => 'Screenshots',
@@ -336,7 +335,7 @@ $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $reg
                     'search' => 'buckets Screenshots',
                 ])));
 
-                $bucket = $authorization->skip(fn () => $dbForPlatform->getDocument('buckets', 'screenshots'));
+                $bucket = Authorization::skip(fn () => $dbForPlatform->getDocument('buckets', 'screenshots'));
 
                 Console::info("    └── Creating files collection for screenshots bucket...");
                 $files = $collections['buckets']['files'] ?? [];
@@ -364,7 +363,7 @@ $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $reg
                     'orders' => $index['orders'],
                 ]), $files['indexes']);
 
-                $authorization->skip(fn () => $dbForPlatform->createCollection('bucket_' . $bucket->getSequence(), $attributes, $indexes));
+                Authorization::skip(fn () => $dbForPlatform->createCollection('bucket_' . $bucket->getSequence(), $attributes, $indexes));
             }
         });
 
@@ -455,12 +454,8 @@ $http->on(Constant::EVENT_REQUEST, function (SwooleRequest $swooleRequest, Swool
     App::setResource('pools', fn () => $pools);
 
     try {
-        $authorization = $app->getResource('authorization');
-
-        $request->setAuthorization($authorization);
-        $response->setAuthorization($authorization);
-        $authorization->cleanRoles();
-        $authorization->addRole(Role::any()->toString());
+        Authorization::cleanRoles();
+        Authorization::setRole(Role::any()->toString());
 
         $app->run($request, $response);
     } catch (\Throwable $th) {
@@ -502,7 +497,7 @@ $http->on(Constant::EVENT_REQUEST, function (SwooleRequest $swooleRequest, Swool
             $log->addExtra('file', $th->getFile());
             $log->addExtra('line', $th->getLine());
             $log->addExtra('trace', $th->getTraceAsString());
-            $log->addExtra('roles', isset($authorization) ? $authorization->getRoles() : []);
+            $log->addExtra('roles', Authorization::getRoles());
 
             $sdk = $route->getLabel("sdk", false);
 
@@ -561,7 +556,7 @@ $http->on(Constant::EVENT_TASK, function () use ($register, $domains) {
     /** @var Utopia\Database\Database $dbForPlatform */
     $dbForPlatform = $app->getResource('dbForPlatform');
 
-    Timer::tick(DOMAIN_SYNC_TIMER * 1000, function () use ($dbForPlatform, $domains, &$lastSyncUpdate, $app) {
+    Timer::tick(DOMAIN_SYNC_TIMER * 1000, function () use ($dbForPlatform, $domains, &$lastSyncUpdate) {
         try {
             $time = DateTime::now();
             $limit = 1000;
@@ -578,8 +573,7 @@ $http->on(Constant::EVENT_TASK, function () use ($register, $domains) {
                 }
                 $results = [];
                 try {
-                    $authorization = $app->getResource('authorization');
-                    $results = $authorization->skip(fn () =>  $dbForPlatform->find('rules', $queries));
+                    $results = Authorization::skip(fn () =>  $dbForPlatform->find('rules', $queries));
                 } catch (Throwable $th) {
                     Console::error($th->getMessage());
                 }

app/init/configs.php

@@ -1,42 +1,45 @@
 <?php
 
+use Utopia\Config\Adapters\PHP;
 use Utopia\Config\Config;
 
 require_once __DIR__ . '/../config/storage/resource_limits.php';
 
-Config::load('template-runtimes', __DIR__ . '/../config/template-runtimes.php');
-Config::load('events', __DIR__ . '/../config/events.php');
-Config::load('auth', __DIR__ . '/../config/auth.php');
-Config::load('apis', __DIR__ . '/../config/apis.php');  // List of APIs
-Config::load('errors', __DIR__ . '/../config/errors.php');
-Config::load('oAuthProviders', __DIR__ . '/../config/oAuthProviders.php');
-Config::load('platforms', __DIR__ . '/../config/platforms.php');
-Config::load('console', __DIR__ . '/../config/console.php');
-Config::load('collections', __DIR__ . '/../config/collections.php');
-Config::load('frameworks', __DIR__ . '/../config/frameworks.php');
-Config::load('runtimes', __DIR__ . '/../config/runtimes.php');
-Config::load('runtimes-v2', __DIR__ . '/../config/runtimes-v2.php');
-Config::load('usage', __DIR__ . '/../config/usage.php');
-Config::load('roles', __DIR__ . '/../config/roles.php');  // User roles and scopes
-Config::load('scopes', __DIR__ . '/../config/scopes.php');  // User roles and scopes
-Config::load('services', __DIR__ . '/../config/services.php');  // List of services
-Config::load('variables', __DIR__ . '/../config/variables.php');  // List of env variables
-Config::load('regions', __DIR__ . '/../config/regions.php'); // List of available regions
-Config::load('avatar-browsers', __DIR__ . '/../config/avatars/browsers.php');
-Config::load('avatar-credit-cards', __DIR__ . '/../config/avatars/credit-cards.php');
-Config::load('avatar-flags', __DIR__ . '/../config/avatars/flags.php');
-Config::load('locale-codes', __DIR__ . '/../config/locale/codes.php');
-Config::load('locale-currencies', __DIR__ . '/../config/locale/currencies.php');
-Config::load('locale-eu', __DIR__ . '/../config/locale/eu.php');
-Config::load('locale-languages', __DIR__ . '/../config/locale/languages.php');
-Config::load('locale-phones', __DIR__ . '/../config/locale/phones.php');
-Config::load('locale-countries', __DIR__ . '/../config/locale/countries.php');
-Config::load('locale-continents', __DIR__ . '/../config/locale/continents.php');
-Config::load('locale-templates', __DIR__ . '/../config/locale/templates.php');
-Config::load('storage-logos', __DIR__ . '/../config/storage/logos.php');
-Config::load('storage-mimes', __DIR__ . '/../config/storage/mimes.php');
-Config::load('storage-inputs', __DIR__ . '/../config/storage/inputs.php');
-Config::load('storage-outputs', __DIR__ . '/../config/storage/outputs.php');
-Config::load('specifications', __DIR__ . '/../config/specifications.php');
-Config::load('templates-function', __DIR__ . '/../config/templates/function.php');
-Config::load('templates-site', __DIR__ . '/../config/templates/site.php');
+$configAdapter = new PHP();
+
+Config::load('template-runtimes', __DIR__ . '/../config/template-runtimes.php', $configAdapter);
+Config::load('events', __DIR__ . '/../config/events.php', $configAdapter);
+Config::load('auth', __DIR__ . '/../config/auth.php', $configAdapter);
+Config::load('apis', __DIR__ . '/../config/apis.php', $configAdapter);  // List of APIs
+Config::load('errors', __DIR__ . '/../config/errors.php', $configAdapter);
+Config::load('oAuthProviders', __DIR__ . '/../config/oAuthProviders.php', $configAdapter);
+Config::load('platforms', __DIR__ . '/../config/platforms.php', $configAdapter);
+Config::load('console', __DIR__ . '/../config/console.php', $configAdapter);
+Config::load('collections', __DIR__ . '/../config/collections.php', $configAdapter);
+Config::load('frameworks', __DIR__ . '/../config/frameworks.php', $configAdapter);
+Config::load('runtimes', __DIR__ . '/../config/runtimes.php', $configAdapter);
+Config::load('runtimes-v2', __DIR__ . '/../config/runtimes-v2.php', $configAdapter);
+Config::load('usage', __DIR__ . '/../config/usage.php', $configAdapter);
+Config::load('roles', __DIR__ . '/../config/roles.php', $configAdapter);  // User roles and scopes
+Config::load('scopes', __DIR__ . '/../config/scopes.php', $configAdapter);  // User roles and scopes
+Config::load('services', __DIR__ . '/../config/services.php', $configAdapter);  // List of services
+Config::load('variables', __DIR__ . '/../config/variables.php', $configAdapter);  // List of env variables
+Config::load('regions', __DIR__ . '/../config/regions.php', $configAdapter); // List of available regions
+Config::load('avatar-browsers', __DIR__ . '/../config/avatars/browsers.php', $configAdapter);
+Config::load('avatar-credit-cards', __DIR__ . '/../config/avatars/credit-cards.php', $configAdapter);
+Config::load('avatar-flags', __DIR__ . '/../config/avatars/flags.php', $configAdapter);
+Config::load('locale-codes', __DIR__ . '/../config/locale/codes.php', $configAdapter);
+Config::load('locale-currencies', __DIR__ . '/../config/locale/currencies.php', $configAdapter);
+Config::load('locale-eu', __DIR__ . '/../config/locale/eu.php', $configAdapter);
+Config::load('locale-languages', __DIR__ . '/../config/locale/languages.php', $configAdapter);
+Config::load('locale-phones', __DIR__ . '/../config/locale/phones.php', $configAdapter);
+Config::load('locale-countries', __DIR__ . '/../config/locale/countries.php', $configAdapter);
+Config::load('locale-continents', __DIR__ . '/../config/locale/continents.php', $configAdapter);
+Config::load('locale-templates', __DIR__ . '/../config/locale/templates.php', $configAdapter);
+Config::load('storage-logos', __DIR__ . '/../config/storage/logos.php', $configAdapter);
+Config::load('storage-mimes', __DIR__ . '/../config/storage/mimes.php', $configAdapter);
+Config::load('storage-inputs', __DIR__ . '/../config/storage/inputs.php', $configAdapter);
+Config::load('storage-outputs', __DIR__ . '/../config/storage/outputs.php', $configAdapter);
+Config::load('specifications', __DIR__ . '/../config/specifications.php', $configAdapter);
+Config::load('templates-function', __DIR__ . '/../config/templates/function.php', $configAdapter);
+Config::load('templates-site', __DIR__ . '/../config/templates/site.php', $configAdapter);

app/init/constants.php

@@ -93,6 +93,69 @@ const APP_VCS_GITHUB_EMAIL = 'team@appwrite.io';
 const APP_VCS_GITHUB_URL = 'https://github.com/TeamAppwrite';
 const APP_BRANDED_EMAIL_BASE_TEMPLATE = 'email-base-styled';
 
+/**
+ * JWT for Resource Tokens.
+ */
+const RESOURCE_TOKEN_ALGORITHM = 'HS256';
+const RESOURCE_TOKEN_MAX_AGE = 86400 * 365 * 10; /* 10 years */
+const RESOURCE_TOKEN_LEEWAY = 10; // 10 seconds
+
+/**
+ * Token Expiration times.
+ */
+const TOKEN_EXPIRATION_LOGIN_LONG = 31536000;      /* 1 year */
+const TOKEN_EXPIRATION_LOGIN_SHORT = 3600;         /* 1 hour */
+const TOKEN_EXPIRATION_RECOVERY = 3600;            /* 1 hour */
+const TOKEN_EXPIRATION_CONFIRM = 3600 * 1;         /* 1 hour */
+const TOKEN_EXPIRATION_OTP = 60 * 15;            /* 15 minutes */
+const TOKEN_EXPIRATION_GENERIC = 60 * 15;        /* 15 minutes */
+
+/**
+ * Token Lengths.
+ */
+const TOKEN_LENGTH_MAGIC_URL = 64;
+const TOKEN_LENGTH_VERIFICATION = 256;
+const TOKEN_LENGTH_RECOVERY = 256;
+const TOKEN_LENGTH_OAUTH2 = 64;
+const TOKEN_LENGTH_SESSION = 256;
+
+/**
+ * Token Types.
+ */
+const TOKEN_TYPE_LOGIN = 1; // Deprecated
+const TOKEN_TYPE_VERIFICATION = 2;
+const TOKEN_TYPE_RECOVERY = 3;
+const TOKEN_TYPE_INVITE = 4;
+const TOKEN_TYPE_MAGIC_URL = 5;
+const TOKEN_TYPE_PHONE = 6;
+const TOKEN_TYPE_OAUTH2 = 7;
+const TOKEN_TYPE_GENERIC = 8;
+const TOKEN_TYPE_EMAIL = 9; // OTP
+
+/**
+ * Session Providers.
+ */
+const SESSION_PROVIDER_EMAIL = 'email';
+const SESSION_PROVIDER_ANONYMOUS = 'anonymous';
+const SESSION_PROVIDER_MAGIC_URL = 'magic-url';
+const SESSION_PROVIDER_PHONE = 'phone';
+const SESSION_PROVIDER_OAUTH2 = 'oauth2';
+const SESSION_PROVIDER_TOKEN = 'token';
+const SESSION_PROVIDER_SERVER = 'server';
+
+/**
+ * Activity associated with user or the app.
+ */
+const ACTIVITY_TYPE_APP = 'app';
+const ACTIVITY_TYPE_USER = 'user';
+const ACTIVITY_TYPE_GUEST = 'guest';
+
+/**
+ * MFA
+ */
+const MFA_RECENT_DURATION = 1800; // 30 mins
+
+
 // Database Reconnect
 const DATABASE_RECONNECT_SLEEP = 2;
 const DATABASE_RECONNECT_MAX_ATTEMPTS = 10;
@@ -297,3 +360,6 @@ const TOKENS_RESOURCE_TYPE_DATABASES = 'databases';
 const SCHEDULE_RESOURCE_TYPE_EXECUTION = 'execution';
 const SCHEDULE_RESOURCE_TYPE_FUNCTION = 'function';
 const SCHEDULE_RESOURCE_TYPE_MESSAGE = 'message';
+
+/** Preview cookie */
+const COOKIE_NAME_PREVIEW = 'a_jwt_console';

app/init/database/filters.php

@@ -4,6 +4,7 @@ use Appwrite\OpenSSL\OpenSSL;
 use Utopia\Database\Database;
 use Utopia\Database\Document;
 use Utopia\Database\Query;
+use Utopia\Database\Validator\Authorization;
 use Utopia\System\System;
 
 Database::addFilter(
@@ -175,7 +176,7 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        return  $database->getAuthorization()->skip(fn () => $database->find('sessions', [
+        return Authorization::skip(fn () => $database->find('sessions', [
             Query::equal('userInternalId', [$document->getSequence()]),
             Query::limit(APP_LIMIT_SUBQUERY),
         ]));
@@ -188,7 +189,7 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        return  $database->getAuthorization()->skip(fn () => $database
+        return Authorization::skip(fn () => $database
             ->find('tokens', [
                 Query::equal('userInternalId', [$document->getSequence()]),
                 Query::limit(APP_LIMIT_SUBQUERY),
@@ -202,7 +203,7 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        return  $database->getAuthorization()->skip(fn () => $database
+        return Authorization::skip(fn () => $database
             ->find('challenges', [
                 Query::equal('userInternalId', [$document->getSequence()]),
                 Query::limit(APP_LIMIT_SUBQUERY),
@@ -216,7 +217,7 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        return $database->getAuthorization()->skip(fn () => $database
+        return Authorization::skip(fn () => $database
             ->find('authenticators', [
                 Query::equal('userInternalId', [$document->getSequence()]),
                 Query::limit(APP_LIMIT_SUBQUERY),
@@ -230,7 +231,7 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        return  $database->getAuthorization()->skip(fn () => $database
+        return Authorization::skip(fn () => $database
             ->find('memberships', [
                 Query::equal('userInternalId', [$document->getSequence()]),
                 Query::limit(APP_LIMIT_SUBQUERY),
@@ -330,7 +331,7 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        return  $database->getAuthorization()->skip(fn () => $database
+        return Authorization::skip(fn () => $database
             ->find('targets', [
                 Query::equal('userInternalId', [$document->getSequence()]),
                 Query::limit(APP_LIMIT_SUBQUERY)
@@ -344,7 +345,7 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        $targetIds =  $database->getAuthorization()->skip(fn () => \array_map(
+        $targetIds = Authorization::skip(fn () => \array_map(
             fn ($document) => $document->getAttribute('targetInternalId'),
             $database->find('subscribers', [
                 Query::equal('topicInternalId', [$document->getSequence()]),

app/init/registers.php

@@ -39,6 +39,7 @@ if (!App::isProduction()) {
     PublicDomain::allow(['request-catcher-sms']);
     PublicDomain::allow(['request-catcher-webhook']);
 }
+
 $register->set('logger', function () {
     // Register error logger
     $providerName = System::getEnv('_APP_LOGGING_PROVIDER', '');
@@ -97,6 +98,51 @@ $register->set('logger', function () {
     return new Logger($adapter);
 });
 
+$register->set('realtimeLogger', function () {
+    // Register error logger for realtime, falls back to default logging config
+    $providerConfig = System::getEnv('_APP_LOGGING_CONFIG_REALTIME', '')
+        ?: System::getEnv('_APP_LOGGING_CONFIG', '');
+
+    if (empty($providerConfig)) {
+        return;
+    }
+
+    $loggingProvider = new DSN($providerConfig);
+    $providerName = $loggingProvider->getScheme();
+    $providerConfig = match ($providerName) {
+        'sentry' => ['key' => $loggingProvider->getPassword(), 'projectId' => $loggingProvider->getUser() ?? '', 'host' => 'https://' . $loggingProvider->getHost()],
+        'logowl' => ['ticket' => $loggingProvider->getUser() ?? '', 'host' => $loggingProvider->getHost()],
+        default => ['key' => $loggingProvider->getHost()],
+    };
+
+    if (empty($providerName) || empty($providerConfig)) {
+        return;
+    }
+
+    if (!Logger::hasProvider($providerName)) {
+        throw new Exception(Exception::GENERAL_SERVER_ERROR, "Logging provider not supported. Logging is disabled");
+    }
+
+    try {
+        $adapter = match ($providerName) {
+            'sentry' => new Sentry($providerConfig['projectId'], $providerConfig['key'], $providerConfig['host']),
+            'logowl' => new LogOwl($providerConfig['ticket'], $providerConfig['host']),
+            'raygun' => new Raygun($providerConfig['key']),
+            'appsignal' => new AppSignal($providerConfig['key']),
+            default => null
+        };
+    } catch (Throwable $th) {
+        $adapter = null;
+    }
+
+    if ($adapter === null) {
+        Console::error("Logging provider not supported. Logging is disabled");
+        return;
+    }
+
+    return new Logger($adapter);
+});
+
 $register->set('pools', function () {
     $group = new Group();
 

app/init/resources.php

@@ -2,7 +2,6 @@
 
 use Ahc\Jwt\JWT;
 use Ahc\Jwt\JWTException;
-use Appwrite\Auth\Auth;
 use Appwrite\Auth\Key;
 use Appwrite\Databases\TransactionState;
 use Appwrite\Event\Audit;
@@ -23,10 +22,18 @@ use Appwrite\Extend\Exception;
 use Appwrite\GraphQL\Schema;
 use Appwrite\Network\Platform;
 use Appwrite\Network\Validator\Origin;
+use Appwrite\Utopia\Database\Documents\User;
 use Appwrite\Utopia\Request;
+use Appwrite\Utopia\Response;
 use Executor\Executor;
 use Utopia\Abuse\Adapters\TimeLimit\Redis as TimeLimitRedis;
 use Utopia\App;
+use Utopia\Auth\Hashes\Argon2;
+use Utopia\Auth\Hashes\Sha;
+use Utopia\Auth\Proofs\Code;
+use Utopia\Auth\Proofs\Password;
+use Utopia\Auth\Proofs\Token;
+use Utopia\Auth\Store;
 use Utopia\Cache\Adapter\Pool as CachePool;
 use Utopia\Cache\Adapter\Sharding;
 use Utopia\Cache\Cache;
@@ -152,7 +159,7 @@ App::setResource('queueForMigrations', function (Publisher $publisher) {
 App::setResource('queueForStatsResources', function (Publisher $publisher) {
     return new StatsResources($publisher);
 }, ['publisher']);
-App::setResource('platforms', function (Request $request, Document $console, Document $project, Database $dbForPlatform, Authorization $authorization) {
+App::setResource('platforms', function (Request $request, Document $console, Document $project, Database $dbForPlatform) {
     $console->setAttribute('platforms', [ // Always allow current host
         '$collection' => ID::custom('platforms'),
         'name' => 'Current Host',
@@ -200,9 +207,9 @@ App::setResource('platforms', function (Request $request, Document $console, Doc
     // Safe if rule with same project ID exists
     if (!empty($origin)) {
         if (System::getEnv('_APP_RULES_FORMAT') === 'md5') {
-            $rule = $authorization->skip(fn () => $dbForPlatform->getDocument('rules', md5($origin ?? '')));
+            $rule = Authorization::skip(fn () => $dbForPlatform->getDocument('rules', md5($origin ?? '')));
         } else {
-            $rule = $authorization->skip(
+            $rule = Authorization::skip(
                 fn () => $dbForPlatform->find('rules', [
                     Query::equal('domain', [$origin]),
                     Query::limit(1)
@@ -224,98 +231,108 @@ App::setResource('platforms', function (Request $request, Document $console, Doc
         ...$console->getAttribute('platforms', []),
         ...$project->getAttribute('platforms', []),
     ];
-}, ['request', 'console', 'project', 'dbForPlatform', 'authorization']);
+}, ['request', 'console', 'project', 'dbForPlatform']);
 
-App::setResource('user', function ($mode, $project, $console, $request, $response, $dbForProject, $dbForPlatform, $authorization) {
-    /** @var Appwrite\Utopia\Request $request */
-    /** @var Appwrite\Utopia\Response $response */
-    /** @var Utopia\Database\Document $project */
-    /** @var Utopia\Database\Database $dbForProject */
-    /** @var Utopia\Database\Database $dbForPlatform */
-    /** @var Utopia\Database\Authorization $authorization */
-    /** @var string $mode */
+App::setResource('user', function (string $mode, Document $project, Document $console, Request $request, Response $response, Database $dbForProject, Database $dbForPlatform, Store $store, Token $proofForToken) {
+    /**
+     * Handles user authentication and session validation.
+     *
+     * This function follows a series of steps to determine the appropriate user session
+     * based on cookies, headers, and JWT tokens.
+     *
+     * Process:
+     * 1. Checks the cookie based on mode:
+     *    - If in admin mode, uses console project id for key.
+     *    - Otherwise, sets the key using the project ID
+     * 2. If no cookie is found, attempts to retrieve the fallback header `x-fallback-cookies`.
+     *    - If this method is used, returns the header: `X-Debug-Fallback: true`.
+     * 3. Fetches the user document from the appropriate database based on the mode.
+     * 4. If the user document is empty or the session key cannot be verified, sets an empty user document.
+     * 5. Regardless of the results from steps 1-4, attempts to fetch the JWT token.
+     * 6. If the JWT user has a valid session ID, updates the user variable with the user from `projectDB`,
+     *    overwriting the previous value.
+     */
 
-    $authorization->setDefaultStatus(true);
+    Authorization::setDefaultStatus(true);
 
-    Auth::setCookieName('a_session_' . $project->getId());
+    $store->setKey('a_session_' . $project->getId());
 
     if (APP_MODE_ADMIN === $mode) {
-        Auth::setCookieName('a_session_' . $console->getId());
+        $store->setKey('a_session_' . $console->getId());
     }
 
-    $session = Auth::decodeSession(
+    $store->decode(
         $request->getCookie(
-            Auth::$cookieName, // Get sessions
-            $request->getCookie(Auth::$cookieName . '_legacy', '')
+            $store->getKey(), // Get sessions
+            $request->getCookie($store->getKey() . '_legacy', '')
         )
     );
 
     // Get session from header for SSR clients
-    if (empty($session['id']) && empty($session['secret'])) {
+    if (empty($store->getProperty('id', '')) && empty($store->getProperty('secret', ''))) {
         $sessionHeader = $request->getHeader('x-appwrite-session', '');
 
         if (!empty($sessionHeader)) {
-            $session = Auth::decodeSession($sessionHeader);
+            $store->decode($sessionHeader);
         }
     }
 
     // Get fallback session from old clients (no SameSite support) or clients who block 3rd-party cookies
-    if ($response) {
+    if ($response) { // if in http context - add debug header
         $response->addHeader('X-Debug-Fallback', 'false');
     }
 
-    if (empty($session['id']) && empty($session['secret'])) {
+    if (empty($store->getProperty('id', '')) && empty($store->getProperty('secret', ''))) {
         if ($response) {
             $response->addHeader('X-Debug-Fallback', 'true');
         }
         $fallback = $request->getHeader('x-fallback-cookies', '');
         $fallback = \json_decode($fallback, true);
-        $session = Auth::decodeSession(((isset($fallback[Auth::$cookieName])) ? $fallback[Auth::$cookieName] : ''));
+        $store->decode(((is_array($fallback) && isset($fallback[$store->getKey()])) ? $fallback[$store->getKey()] : ''));
     }
 
-    Auth::$unique = $session['id'] ?? '';
-    Auth::$secret = $session['secret'] ?? '';
-
-    $user = new Document([]);
-
-    if (!empty(Auth::$unique)) {
-        if ($mode === APP_MODE_ADMIN) {
-            $user = $dbForPlatform->getDocument('users', Auth::$unique);
-        } elseif (!$project->isEmpty()) {
-            if ($project->getId() === 'console') {
-                $user = $dbForPlatform->getDocument('users', Auth::$unique);
-            } else {
-                $user = $dbForProject->getDocument('users', Auth::$unique);
+    $user = null;
+    if (APP_MODE_ADMIN === $mode) {
+        /** @var User $user */
+        $user = $dbForPlatform->getDocument('users', $store->getProperty('id', ''));
+    } else {
+        if ($project->isEmpty()) {
+            $user = new User([]);
+        } else {
+            if (!empty($store->getProperty('id', ''))) {
+                if ($project->getId() === 'console') {
+                    /** @var User $user */
+                    $user = $dbForPlatform->getDocument('users', $store->getProperty('id', ''));
+                } else {
+                    /** @var User $user */
+                    $user = $dbForProject->getDocument('users', $store->getProperty('id', ''));
+                }
             }
         }
     }
 
     if (
+        !$user ||
         $user->isEmpty() // Check a document has been found in the DB
-        || !Auth::sessionVerify($user->getAttribute('sessions', []), Auth::$secret)
+        || !$user->sessionVerify($store->getProperty('secret', ''), $proofForToken)
     ) { // Validate user has valid login token
-        $user = new Document([]);
+        $user = new User([]);
     }
-
     // if (APP_MODE_ADMIN === $mode) {
     //     if ($user->find('teamInternalId', $project->getAttribute('teamInternalId'), 'memberships')) {
-    //         $authorization->setDefaultStatus(false);  // Cancel security segmentation for admin users.
+    //         Authorization::setDefaultStatus(false);  // Cancel security segmentation for admin users.
     //     } else {
     //         $user = new Document([]);
     //     }
     // }
-
     $authJWT = $request->getHeader('x-appwrite-jwt', '');
-
     if (!empty($authJWT) && !$project->isEmpty()) { // JWT authentication
         $jwt = new JWT(System::getEnv('_APP_OPENSSL_KEY_V1'), 'HS256', 3600, 0);
-
         try {
             $payload = $jwt->decode($authJWT);
         } catch (JWTException $error) {
             throw new Exception(Exception::USER_JWT_INVALID, 'Failed to verify JWT. ' . $error->getMessage());
         }
-
         $jwtUserId = $payload['userId'] ?? '';
         if (!empty($jwtUserId)) {
             if ($mode === APP_MODE_ADMIN) {
@@ -324,22 +341,20 @@ App::setResource('user', function ($mode, $project, $console, $request, $respons
                 $user = $dbForProject->getDocument('users', $jwtUserId);
             }
         }
-
         $jwtSessionId = $payload['sessionId'] ?? '';
         if (!empty($jwtSessionId)) {
             if (empty($user->find('$id', $jwtSessionId, 'sessions'))) { // Match JWT to active token
-                $user = new Document([]);
+                $user = new User([]);
             }
         }
     }
-
     $dbForProject->setMetadata('user', $user->getId());
     $dbForPlatform->setMetadata('user', $user->getId());
 
     return $user;
-}, ['mode', 'project', 'console', 'request', 'response', 'dbForProject', 'dbForPlatform', 'authorization']);
+}, ['mode', 'project', 'console', 'request', 'response', 'dbForProject', 'dbForPlatform', 'store', 'proofForToken']);
 
-App::setResource('project', function ($dbForPlatform, $request, $console, $authorization) {
+App::setResource('project', function ($dbForPlatform, $request, $console) {
     /** @var Appwrite\Utopia\Request $request */
     /** @var Utopia\Database\Database $dbForPlatform */
     /** @var Utopia\Database\Document $console */
@@ -350,41 +365,67 @@ App::setResource('project', function ($dbForPlatform, $request, $console, $autho
         return $console;
     }
 
-    $project = $authorization->skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
+    $project = Authorization::skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
 
     return $project;
-}, ['dbForPlatform', 'request', 'console', 'authorization']);
+}, ['dbForPlatform', 'request', 'console']);
 
-App::setResource('session', function (Document $user) {
+App::setResource('session', function (User $user, Store $store, Token $proofForToken) {
     if ($user->isEmpty()) {
         return;
     }
 
     $sessions = $user->getAttribute('sessions', []);
-    $sessionId = Auth::sessionVerify($user->getAttribute('sessions'), Auth::$secret);
+    $sessionId = $user->sessionVerify($store->getProperty('secret', ''), $proofForToken);
 
     if (!$sessionId) {
         return;
     }
-
-    foreach ($sessions as $session) {/** @var Document $session */
+    foreach ($sessions as $session) {
+        /** @var Document $session */
         if ($sessionId === $session->getId()) {
             return $session;
         }
     }
 
     return;
-}, ['user']);
+}, ['user', 'store', 'proofForToken']);
 
 App::setResource('console', function () {
     return new Document(Config::getParam('console'));
 }, []);
 
-App::setResource('authorization', function () {
-    return new Authorization();
-}, []);
+App::setResource('store', function (): Store {
+    return new Store();
+});
 
-App::setResource('dbForProject', function (Group $pools, Database $dbForPlatform, Cache $cache, Document $project, Authorization $authorization) {
+App::setResource('proofForPassword', function (): Password {
+    $hash = new Argon2();
+    $hash
+        ->setMemoryCost(7168)
+        ->setTimeCost(5)
+        ->setThreads(1);
+
+    $password = new Password();
+    $password
+        ->setHash($hash);
+
+    return $password;
+});
+
+App::setResource('proofForToken', function (): Token {
+    $token = new Token();
+    $token->setHash(new Sha());
+    return $token;
+});
+
+App::setResource('proofForCode', function (): Code {
+    $code = new Code();
+    $code->setHash(new Sha());
+    return $code;
+});
+
+App::setResource('dbForProject', function (Group $pools, Database $dbForPlatform, Cache $cache, Document $project) {
     if ($project->isEmpty() || $project->getId() === 'console') {
         return $dbForPlatform;
     }
@@ -400,11 +441,11 @@ App::setResource('dbForProject', function (Group $pools, Database $dbForPlatform
     $database = new Database($adapter, $cache);
 
     $database
-        ->setAuthorization($authorization)
         ->setMetadata('host', \gethostname())
         ->setMetadata('project', $project->getId())
         ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_API)
         ->setMaxQueryValues(APP_DATABASE_QUERY_MAX_VALUES);
+    $database->setDocumentType('users', User::class);
 
     $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
 
@@ -421,28 +462,28 @@ App::setResource('dbForProject', function (Group $pools, Database $dbForPlatform
     }
 
     return $database;
-}, ['pools', 'dbForPlatform', 'cache', 'project', 'authorization']);
-
-App::setResource('dbForPlatform', function (Group $pools, Cache $cache, Authorization $authorization) {
+}, ['pools', 'dbForPlatform', 'cache', 'project']);
 
+App::setResource('dbForPlatform', function (Group $pools, Cache $cache) {
     $adapter = new DatabasePool($pools->get('console'));
     $database = new Database($adapter, $cache);
 
     $database
-        ->setAuthorization($authorization)
         ->setNamespace('_console')
         ->setMetadata('host', \gethostname())
         ->setMetadata('project', 'console')
         ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_API)
         ->setMaxQueryValues(APP_DATABASE_QUERY_MAX_VALUES);
 
-    return $database;
-}, ['pools', 'cache', 'authorization']);
+    $database->setDocumentType('users', User::class);
 
-App::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache, Authorization $authorization) {
+    return $database;
+}, ['pools', 'cache']);
+
+App::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache) {
     $databases = [];
 
-    return function (Document $project) use ($pools, $dbForPlatform, $cache, $authorization, &$databases) {
+    return function (Document $project) use ($pools, $dbForPlatform, $cache, &$databases) {
         if ($project->isEmpty() || $project->getId() === 'console') {
             return $dbForPlatform;
         }
@@ -454,13 +495,13 @@ App::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform
             $dsn = new DSN('mysql://' . $project->getAttribute('database'));
         }
 
-        $configure = (function (Database $database) use ($project, $dsn, $authorization) {
+        $configure = (function (Database $database) use ($project, $dsn) {
             $database
-                ->setAuthorization($authorization)
                 ->setMetadata('host', \gethostname())
                 ->setMetadata('project', $project->getId())
                 ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_API)
                 ->setMaxQueryValues(APP_DATABASE_QUERY_MAX_VALUES);
+            $database->setDocumentType('users', User::class);
 
             $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
 
@@ -490,12 +531,12 @@ App::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform
 
         return $database;
     };
-}, ['pools', 'dbForPlatform', 'cache', 'authorization']);
+}, ['pools', 'dbForPlatform', 'cache']);
 
-App::setResource('getLogsDB', function (Group $pools, Cache $cache, Authorization $authorization) {
+App::setResource('getLogsDB', function (Group $pools, Cache $cache) {
     $database = null;
 
-    return function (?Document $project = null) use ($pools, $cache, $authorization, &$database) {
+    return function (?Document $project = null) use ($pools, $cache, &$database) {
         if ($database !== null && $project !== null && !$project->isEmpty() && $project->getId() !== 'console') {
             $database->setTenant((int) $project->getSequence());
             return $database;
@@ -505,7 +546,6 @@ App::setResource('getLogsDB', function (Group $pools, Cache $cache, Authorizatio
         $database = new Database($adapter, $cache);
 
         $database
-            ->setAuthorization($authorization)
             ->setSharedTables(true)
             ->setNamespace('logsV1')
             ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_API)
@@ -518,7 +558,7 @@ App::setResource('getLogsDB', function (Group $pools, Cache $cache, Authorizatio
 
         return $database;
     };
-}, ['pools', 'cache', 'authorization']);
+}, ['pools', 'cache']);
 
 App::setResource('telemetry', fn () => new NoTelemetry());
 
@@ -712,7 +752,7 @@ App::setResource('promiseAdapter', function ($register) {
     return $register->get('promiseAdapter');
 }, ['register']);
 
-App::setResource('schema', function ($utopia, $dbForProject, $authorization) {
+App::setResource('schema', function ($utopia, $dbForProject) {
 
     $complexity = function (int $complexity, array $args) {
         $queries = Query::parseQueries($args['queries'] ?? []);
@@ -722,8 +762,8 @@ App::setResource('schema', function ($utopia, $dbForProject, $authorization) {
         return $complexity * $limit;
     };
 
-    $attributes = function (int $limit, int $offset) use ($dbForProject, $authorization) {
-        $attrs = $authorization->skip(fn () => $dbForProject->find('attributes', [
+    $attributes = function (int $limit, int $offset) use ($dbForProject) {
+        $attrs = Authorization::skip(fn () => $dbForProject->find('attributes', [
             Query::limit($limit),
             Query::offset($offset),
         ]));
@@ -797,7 +837,7 @@ App::setResource('schema', function ($utopia, $dbForProject, $authorization) {
         $urls,
         $params,
     );
-}, ['utopia', 'dbForProject', 'authorization']);
+}, ['utopia', 'dbForProject']);
 
 App::setResource('contributors', function () {
     $path = 'app/config/contributors.json';
@@ -843,7 +883,7 @@ App::setResource('smsRates', function () {
     return [];
 });
 
-App::setResource('devKey', function (Request $request, Document $project, array $servers, Database $dbForPlatform, Authorization $authorization) {
+App::setResource('devKey', function (Request $request, Document $project, array $servers, Database $dbForPlatform) {
     $devKey = $request->getHeader('x-appwrite-dev-key', $request->getParam('devKey', ''));
 
     // Check if given key match project's development keys
@@ -862,7 +902,7 @@ App::setResource('devKey', function (Request $request, Document $project, array
     $accessedAt = $key->getAttribute('accessedAt', 0);
     if (empty($accessedAt) || DatabaseDateTime::formatTz(DatabaseDateTime::addSeconds(new \DateTime(), -APP_KEY_ACCESS)) > $accessedAt) {
         $key->setAttribute('accessedAt', DatabaseDateTime::now());
-        $authorization->skip(fn () => $dbForPlatform->updateDocument('devKeys', $key->getId(), $key));
+        Authorization::skip(fn () => $dbForPlatform->updateDocument('devKeys', $key->getId(), $key));
         $dbForPlatform->purgeCachedDocument('projects', $project->getId());
     }
 
@@ -879,14 +919,14 @@ App::setResource('devKey', function (Request $request, Document $project, array
 
             /** Update access time as well */
             $key->setAttribute('accessedAt', DatabaseDateTime::now());
-            $key = $authorization->skip(fn () => $dbForPlatform->updateDocument('devKeys', $key->getId(), $key));
+            $key = Authorization::skip(fn () => $dbForPlatform->updateDocument('devKeys', $key->getId(), $key));
             $dbForPlatform->purgeCachedDocument('projects', $project->getId());
         }
     }
     return $key;
-}, ['request', 'project', 'servers', 'dbForPlatform', 'authorization']);
+}, ['request', 'project', 'servers', 'dbForPlatform']);
 
-App::setResource('team', function (Document $project, Database $dbForPlatform, App $utopia, Request $request, Authorization $authorization) {
+App::setResource('team', function (Document $project, Database $dbForPlatform, App $utopia, Request $request) {
     $teamInternalId = '';
     if ($project->getId() !== 'console') {
         $teamInternalId = $project->getAttribute('teamInternalId', '');
@@ -896,7 +936,7 @@ App::setResource('team', function (Document $project, Database $dbForPlatform, A
         if (str_starts_with($path, '/v1/projects/:projectId')) {
             $uri = $request->getURI();
             $pid = explode('/', $uri)[3];
-            $p = $authorization->skip(fn () => $dbForPlatform->getDocument('projects', $pid));
+            $p = Authorization::skip(fn () => $dbForPlatform->getDocument('projects', $pid));
             $teamInternalId = $p->getAttribute('teamInternalId', '');
         } elseif ($path === '/v1/projects') {
             $teamId = $request->getParam('teamId', '');
@@ -905,7 +945,7 @@ App::setResource('team', function (Document $project, Database $dbForPlatform, A
                 return new Document([]);
             }
 
-            $team = $authorization->skip(fn () => $dbForPlatform->getDocument('teams', $teamId));
+            $team = Authorization::skip(fn () => $dbForPlatform->getDocument('teams', $teamId));
             return $team;
         }
     }
@@ -914,14 +954,14 @@ App::setResource('team', function (Document $project, Database $dbForPlatform, A
         return new Document([]);
     }
 
-    $team = $authorization->skip(function () use ($dbForPlatform, $teamInternalId) {
+    $team = Authorization::skip(function () use ($dbForPlatform, $teamInternalId) {
         return $dbForPlatform->findOne('teams', [
             Query::equal('$sequence', [$teamInternalId]),
         ]);
     });
 
     return $team;
-}, ['project', 'dbForPlatform', 'utopia', 'request', 'authorization']);
+}, ['project', 'dbForPlatform', 'utopia', 'request']);
 
 App::setResource(
     'isResourceBlocked',
@@ -959,11 +999,12 @@ App::setResource('apiKey', function (Request $request, Document $project): ?Key
 
 App::setResource('executor', fn () => new Executor());
 
-App::setResource('resourceToken', function ($project, $dbForProject, $request, Authorization $authorization) {
+App::setResource('resourceToken', function ($project, $dbForProject, $request) {
     $tokenJWT = $request->getParam('token');
 
     if (!empty($tokenJWT) && !$project->isEmpty()) { // JWT authentication
-        $jwt = new JWT(System::getEnv('_APP_OPENSSL_KEY_V1'), 'HS256', 900, 10); // Instantiate with key, algo, maxAge and leeway.
+        // Use a large but reasonable maxAge to avoid auto-exp when token has no expiry
+        $jwt = new JWT(System::getEnv('_APP_OPENSSL_KEY_V1'), RESOURCE_TOKEN_ALGORITHM, RESOURCE_TOKEN_MAX_AGE, RESOURCE_TOKEN_LEEWAY); // Instantiate with key, algo, maxAge and leeway.
 
         try {
             $payload = $jwt->decode($tokenJWT);
@@ -976,7 +1017,7 @@ App::setResource('resourceToken', function ($project, $dbForProject, $request, A
             return new Document([]);
         }
 
-        $token = $authorization->skip(fn () => $dbForProject->getDocument('resourceTokens', $tokenId));
+        $token = Authorization::skip(fn () => $dbForProject->getDocument('resourceTokens', $tokenId));
 
         if ($token->isEmpty()) {
             return new Document([]);
@@ -994,7 +1035,7 @@ App::setResource('resourceToken', function ($project, $dbForProject, $request, A
         }
 
         return match ($token->getAttribute('resourceType')) {
-            TOKENS_RESOURCE_TYPE_FILES => (function () use ($token, $dbForProject, $authorization) {
+            TOKENS_RESOURCE_TYPE_FILES => (function () use ($token, $dbForProject) {
                 $sequences = explode(':', $token->getAttribute('resourceInternalId'));
                 $ids = explode(':', $token->getAttribute('resourceId'));
 
@@ -1005,7 +1046,7 @@ App::setResource('resourceToken', function ($project, $dbForProject, $request, A
                 $accessedAt = $token->getAttribute('accessedAt', 0);
                 if (empty($accessedAt) || DatabaseDateTime::formatTz(DatabaseDateTime::addSeconds(new \DateTime(), -APP_RESOURCE_TOKEN_ACCESS)) > $accessedAt) {
                     $token->setAttribute('accessedAt', DatabaseDateTime::now());
-                    $authorization->skip(fn () => $dbForProject->updateDocument('resourceTokens', $token->getId(), $token));
+                    Authorization::skip(fn () => $dbForProject->updateDocument('resourceTokens', $token->getId(), $token));
                 }
 
                 return new Document([
@@ -1020,7 +1061,7 @@ App::setResource('resourceToken', function ($project, $dbForProject, $request, A
         };
     }
     return new Document([]);
-}, ['project', 'dbForProject', 'request', 'authorization']);
+}, ['project', 'dbForProject', 'request']);
 
 App::setResource('httpReferrer', function (Request $request): string {
     $referrer = $request->getReferer();
@@ -1053,6 +1094,6 @@ App::setResource('httpReferrerSafe', function (Request $request, string $httpRef
     return $referrer;
 }, ['request', 'httpReferrer', 'platforms', 'dbForPlatform', 'project', 'utopia']);
 
-App::setResource('transactionState', function (Database $dbForProject, Authorization $authorization) {
-    return new TransactionState($dbForProject, $authorization);
-}, ['dbForProject', 'authorization']);
+App::setResource('transactionState', function (Database $dbForProject) {
+    return new TransactionState($dbForProject);
+}, ['dbForProject']);

app/realtime.php

@@ -1,11 +1,11 @@
 <?php
 
-use Appwrite\Auth\Auth;
 use Appwrite\Extend\Exception;
 use Appwrite\Extend\Exception as AppwriteException;
 use Appwrite\Messaging\Adapter\Realtime;
 use Appwrite\Network\Validator\Origin;
 use Appwrite\PubSub\Adapter\Pool as PubSubPool;
+use Appwrite\Utopia\Database\Documents\User;
 use Appwrite\Utopia\Request;
 use Appwrite\Utopia\Response;
 use Swoole\Http\Request as SwooleRequest;
@@ -16,6 +16,9 @@ use Swoole\Timer;
 use Utopia\Abuse\Abuse;
 use Utopia\Abuse\Adapters\TimeLimit\Redis as TimeLimitRedis;
 use Utopia\App;
+use Utopia\Auth\Hashes\Sha;
+use Utopia\Auth\Proofs\Token;
+use Utopia\Auth\Store;
 use Utopia\Cache\Adapter\Pool as CachePool;
 use Utopia\Cache\Adapter\Sharding;
 use Utopia\Cache\Cache;
@@ -28,6 +31,7 @@ use Utopia\Database\Document;
 use Utopia\Database\Helpers\ID;
 use Utopia\Database\Helpers\Role;
 use Utopia\Database\Query;
+use Utopia\Database\Validator\Authorization;
 use Utopia\DSN\DSN;
 use Utopia\Logger\Log;
 use Utopia\Pools\Group;
@@ -66,6 +70,8 @@ if (!function_exists('getConsoleDB')) {
             ->setMetadata('host', \gethostname())
             ->setMetadata('project', '_console');
 
+        $database->setDocumentType('users', User::class);
+
         return $database;
     }
 }
@@ -117,6 +123,8 @@ if (!function_exists('getProjectDB')) {
             ->setMetadata('host', \gethostname())
             ->setMetadata('project', $project->getId());
 
+        $database->setDocumentType('users', User::class);
+
         return $databases[$project->getSequence()] = $database;
     }
 }
@@ -235,7 +243,7 @@ $adapter
 $server = new Server($adapter);
 
 $logError = function (Throwable $error, string $action) use ($register) {
-    $logger = $register->get('logger');
+    $logger = $register->get('realtimeLogger');
 
     if ($logger && !$error instanceof Exception) {
         $version = System::getEnv('_APP_VERSION', 'UNKNOWN');
@@ -298,7 +306,7 @@ $server->onStart(function () use ($stats, $register, $containerId, &$statsDocume
                     'value' => '{}'
                 ]);
 
-                $statsDocument = $database->getAuthorization()->skip(fn () => $database->createDocument('realtime', $document));
+                $statsDocument = Authorization::skip(fn () => $database->createDocument('realtime', $document));
                 break;
             } catch (Throwable) {
                 Console::warning("Collection not ready. Retrying connection ({$attempts})...");
@@ -328,7 +336,7 @@ $server->onStart(function () use ($stats, $register, $containerId, &$statsDocume
                     ->setAttribute('timestamp', DateTime::now())
                     ->setAttribute('value', json_encode($payload));
 
-                $database->getAuthorization()->skip(fn () => $database->updateDocument('realtime', $statsDocument->getId(), $statsDocument));
+                Authorization::skip(fn () => $database->updateDocument('realtime', $statsDocument->getId(), $statsDocument));
             } catch (Throwable $th) {
                 $logError($th, "updateWorkerDocument");
             }
@@ -359,7 +367,7 @@ $server->onWorkerStart(function (int $workerId) use ($server, $register, $stats,
 
                 $payload = [];
 
-                $list = $database->getAuthorization()->skip(fn () => $database->find('realtime', [
+                $list = Authorization::skip(fn () => $database->find('realtime', [
                     Query::greaterThan('timestamp', DateTime::addSeconds(new \DateTime(), -15)),
                 ]));
 
@@ -453,11 +461,13 @@ $server->onWorkerStart(function (int $workerId) use ($server, $register, $stats,
                     if ($realtime->hasSubscriber($projectId, 'user:' . $userId)) {
                         $connection = array_key_first(reset($realtime->subscriptions[$projectId]['user:' . $userId]));
                         $consoleDatabase = getConsoleDB();
-                        $project = $consoleDatabase->getAuthorization()->skip(fn () => $consoleDatabase->getDocument('projects', $projectId));
+                        $project = Authorization::skip(fn () => $consoleDatabase->getDocument('projects', $projectId));
                         $database = getProjectDB($project);
 
+                        /** @var Appwrite\Utopia\Database\Documents\User $user */
                         $user = $database->getDocument('users', $userId);
-                        $roles = Auth::getRoles($user, $database->getAuthorization());
+
+                        $roles = $user->getRoles();
                         $channels = $realtime->connections[$connection]['channels'];
 
                         $realtime->unsubscribe($connection);
@@ -513,7 +523,6 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
     try {
         /** @var Document $project */
         $project = $app->getResource('project');
-        $authorization = $app->getResource('authorization');
 
         /*
          *  Project Check
@@ -525,14 +534,14 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
         if (
             array_key_exists('realtime', $project->getAttribute('apis', []))
             && !$project->getAttribute('apis', [])['realtime']
-            && !(Auth::isPrivilegedUser($authorization->getRoles()) || Auth::isAppUser($authorization->getRoles()))
+            && !(User::isPrivileged(Authorization::getRoles()) || User::isApp(Authorization::getRoles()))
         ) {
             throw new AppwriteException(AppwriteException::GENERAL_API_DISABLED);
         }
 
         $timelimit = $app->getResource('timelimit');
         $platforms = $app->getResource('platforms');
-        $user = $app->getResource('user'); /** @var Document $user */
+        $user = $app->getResource('user'); /** @var User $user */
 
         /*
          * Abuse Check
@@ -562,7 +571,7 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
             throw new Exception(Exception::REALTIME_POLICY_VIOLATION, $originValidator->getDescription());
         }
 
-        $roles = Auth::getRoles($user, $authorization);
+        $roles = $user->getRoles();
 
         $channels = Realtime::convertChannels($request->getQuery('channels', []), $user->getId());
 
@@ -636,8 +645,8 @@ $server->onMessage(function (int $connection, string $message) use ($server, $re
         $database = getConsoleDB();
 
         if ($projectId !== 'console') {
-            $project = $database->getAuthorization()->skip(fn () => $database->getDocument('projects', $projectId));
-            $database = getProjectDB($project, $database->getAuthorization());
+            $project = Authorization::skip(fn () => $database->getDocument('projects', $projectId));
+            $database = getProjectDB($project);
         } else {
             $project = null;
         }
@@ -677,21 +686,31 @@ $server->onMessage(function (int $connection, string $message) use ($server, $re
                     throw new Exception(Exception::REALTIME_MESSAGE_FORMAT_INVALID, 'Payload is not valid.');
                 }
 
-                $session = Auth::decodeSession($message['data']['session']);
-                Auth::$unique = $session['id'] ?? '';
-                Auth::$secret = $session['secret'] ?? '';
+                $store = new Store();
 
-                $user = $database->getDocument('users', Auth::$unique);
+                $store->decode($message['data']['session']);
+
+                /** @var User $user */
+                $user = $database->getDocument('users', $store->getProperty('id', ''));
+
+                /**
+                 * TODO:
+                 * Moving forward, we should try to use our dependency injection container
+                 * to inject the proof for token.
+                 * This way we will have one source of truth for the proof for token.
+                 */
+                $proofForToken = new Token();
+                $proofForToken->setHash(new Sha());
 
                 if (
                     empty($user->getId()) // Check a document has been found in the DB
-                    || !Auth::sessionVerify($user->getAttribute('sessions', []), Auth::$secret) // Validate user has valid login token
+                    || !$user->sessionVerify($store->getProperty('secret', ''), $proofForToken) // Validate user has valid login token
                 ) {
                     // cookie not valid
                     throw new Exception(Exception::REALTIME_MESSAGE_FORMAT_INVALID, 'Session is not valid.');
                 }
 
-                $roles = Auth::getRoles($user, $database->getAuthorization());
+                $roles = $user->getRoles();
                 $channels = Realtime::convertChannels(array_flip($realtime->connections[$connection]['channels']), $user->getId());
                 $realtime->subscribe($realtime->connections[$connection]['projectId'], $connection, $roles, $channels);
 

app/views/install/compose.phtml

@@ -859,7 +859,7 @@ $image = $this->getParam('image', '');
       - _APP_ASSISTANT_OPENAI_API_KEY
       
   appwrite-browser:
-    image: appwrite/browser:0.3.1
+    image: appwrite/browser:0.3.2
     container_name: appwrite-browser
     <<: *x-logging
     restart: unless-stopped

app/worker.php

@@ -17,6 +17,7 @@ use Appwrite\Event\Realtime;
 use Appwrite\Event\StatsUsage;
 use Appwrite\Event\Webhook;
 use Appwrite\Platform\Appwrite;
+use Appwrite\Utopia\Database\Documents\User;
 use Executor\Executor;
 use Swoole\Runtime;
 use Utopia\Abuse\Adapters\TimeLimit\Redis as TimeLimitRedis;
@@ -45,28 +46,19 @@ use Utopia\System\System;
 use Utopia\Telemetry\Adapter as Telemetry;
 use Utopia\Telemetry\Adapter\None as NoTelemetry;
 
+Authorization::disable();
 Runtime::enableCoroutine();
 
 Server::setResource('register', fn () => $register);
 
-Server::setResource('authorization', function () {
-    $authorization = new Authorization();
-    $authorization->disable();
-    return  $authorization;
-}, []);
-
-Server::setResource('dbForPlatform', function (Cache $cache, Registry $register, Authorization $authorization) {
+Server::setResource('dbForPlatform', function (Cache $cache, Registry $register) {
     $pools = $register->get('pools');
     $adapter = new DatabasePool($pools->get('console'));
     $dbForPlatform = new Database($adapter, $cache);
-
-    $dbForPlatform
-        ->setAuthorization($authorization)
-        ->setNamespace('_console');
-
-
+    $dbForPlatform->setNamespace('_console');
+    $dbForPlatform->setDocumentType('users', User::class);
     return $dbForPlatform;
-}, ['cache', 'register', 'authorization']);
+}, ['cache', 'register']);
 
 Server::setResource('project', function (Message $message, Database $dbForPlatform) {
     $payload = $message->getPayload() ?? [];
@@ -79,7 +71,7 @@ Server::setResource('project', function (Message $message, Database $dbForPlatfo
     return $dbForPlatform->getDocument('projects', $project->getId());
 }, ['message', 'dbForPlatform']);
 
-Server::setResource('dbForProject', function (Cache $cache, Registry $register, Message $message, Document $project, Database $dbForPlatform, Authorization $authorization) {
+Server::setResource('dbForProject', function (Cache $cache, Registry $register, Message $message, Document $project, Database $dbForPlatform) {
     if ($project->isEmpty() || $project->getId() === 'console') {
         return $dbForPlatform;
     }
@@ -95,6 +87,7 @@ Server::setResource('dbForProject', function (Cache $cache, Registry $register,
 
     $adapter = new DatabasePool($pools->get($dsn->getHost()));
     $database = new Database($adapter, $cache);
+    $database->setDocumentType('users', User::class);
 
     $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
 
@@ -110,17 +103,15 @@ Server::setResource('dbForProject', function (Cache $cache, Registry $register,
             ->setNamespace('_' . $project->getSequence());
     }
 
-    $database
-        ->setAuthorization($authorization)
-        ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER);
+    $database->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER);
 
     return $database;
-}, ['cache', 'register', 'message', 'project', 'dbForPlatform', 'authorization']);
+}, ['cache', 'register', 'message', 'project', 'dbForPlatform']);
 
-Server::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache, Authorization $authorization) {
+Server::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache) {
     $databases = []; // TODO: @Meldiron This should probably be responsibility of utopia-php/pools
 
-    return function (Document $project) use ($pools, $dbForPlatform, $cache, $authorization, &$databases): Database {
+    return function (Document $project) use ($pools, $dbForPlatform, $cache, &$databases): Database {
         if ($project->isEmpty() || $project->getId() === 'console') {
             return $dbForPlatform;
         }
@@ -134,7 +125,7 @@ Server::setResource('getProjectDB', function (Group $pools, Database $dbForPlatf
 
         if (isset($databases[$dsn->getHost()])) {
             $database = $databases[$dsn->getHost()];
-            $database->setAuthorization($authorization);
+
             $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
 
             if (\in_array($dsn->getHost(), $sharedTables)) {
@@ -171,17 +162,15 @@ Server::setResource('getProjectDB', function (Group $pools, Database $dbForPlatf
                 ->setNamespace('_' . $project->getSequence());
         }
 
-        $database
-            ->setAuthorization($authorization)
-            ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER);
+        $database->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER);
 
         return $database;
     };
-}, ['pools', 'dbForPlatform', 'cache', 'authorization']);
+}, ['pools', 'dbForPlatform', 'cache']);
 
-Server::setResource('getLogsDB', function (Group $pools, Cache $cache, Authorization $authorization) {
+Server::setResource('getLogsDB', function (Group $pools, Cache $cache) {
     $database = null;
-    return function (?Document $project = null) use ($pools, $cache, $database, $authorization) {
+    return function (?Document $project = null) use ($pools, $cache, $database) {
         if ($database !== null && $project !== null && !$project->isEmpty() && $project->getId() !== 'console') {
             $database->setTenant((int)$project->getSequence());
             return $database;
@@ -191,7 +180,6 @@ Server::setResource('getLogsDB', function (Group $pools, Cache $cache, Authoriza
         $database = new Database($adapter, $cache);
 
         $database
-            ->setAuthorization($authorization)
             ->setSharedTables(true)
             ->setNamespace('logsV1')
             ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER)
@@ -204,7 +192,7 @@ Server::setResource('getLogsDB', function (Group $pools, Cache $cache, Authoriza
 
         return $database;
     };
-}, ['pools', 'cache', 'authorization']);
+}, ['pools', 'cache']);
 
 Server::setResource('abuseRetention', function () {
     return time() - (int) System::getEnv('_APP_MAINTENANCE_RETENTION_ABUSE', 86400); // 1 day
@@ -492,8 +480,7 @@ $worker
     ->inject('log')
     ->inject('pools')
     ->inject('project')
-    ->inject('authorization')
-    ->action(function (Throwable $error, ?Logger $logger, Log $log, Group $pools, Document $project, Authorization $authorization) use ($worker, $queueName) {
+    ->action(function (Throwable $error, ?Logger $logger, Log $log, Group $pools, Document $project) use ($worker, $queueName) {
         $version = System::getEnv('_APP_VERSION', 'UNKNOWN');
 
         if ($logger) {
@@ -509,7 +496,7 @@ $worker
             $log->addExtra('file', $error->getFile());
             $log->addExtra('line', $error->getLine());
             $log->addExtra('trace', $error->getTraceAsString());
-            $log->addExtra('roles', $authorization->getRoles());
+            $log->addExtra('roles', Authorization::getRoles());
 
             $isProduction = System::getEnv('_APP_ENV', 'development') === 'production';
             $log->setEnvironment($isProduction ? Log::ENVIRONMENT_PRODUCTION : Log::ENVIRONMENT_STAGING);

composer.json

@@ -48,10 +48,11 @@
         "utopia-php/abuse": "1.*",
         "utopia-php/analytics": "0.10.*",
         "utopia-php/audit": "1.*",
+        "utopia-php/auth": "0.5.*",
         "utopia-php/cache": "0.13.*",
         "utopia-php/cli": "0.15.*",
-        "utopia-php/config": "0.2.*",
-        "utopia-php/database": "4.*",
+        "utopia-php/config": "1.*.*",
+        "utopia-php/database": "3.*",
         "utopia-php/detector": "0.2.*",
         "utopia-php/domains": "0.9.*",
         "utopia-php/emails": "0.6.*",
@@ -63,7 +64,7 @@
         "utopia-php/locale": "0.8.*",
         "utopia-php/logger": "0.6.*",
         "utopia-php/messaging": "0.20.*",
-        "utopia-php/migration": "1.*",
+        "utopia-php/migration": "1.3.*",
         "utopia-php/orchestration": "0.9.*",
         "utopia-php/platform": "0.7.*",
         "utopia-php/pools": "0.8.*",
@@ -74,7 +75,7 @@
         "utopia-php/swoole": "0.8.*",
         "utopia-php/system": "0.9.*",
         "utopia-php/telemetry": "0.1.*",
-        "utopia-php/vcs": "0.12.*",
+        "utopia-php/vcs": "0.13.*",
         "utopia-php/websocket": "0.3.*",
         "matomo/device-detector": "6.4.*",
         "dragonmantank/cron-expression": "3.4.*",

docker-compose.override.yml

@@ -1,7 +0,0 @@
-services:
-  appwrite:
-    # volumes:
-    #   - ~/.ssh:/root/.ssh
-    environment:
-      - GH_TOKEN=
-      - GIT_EMAIL=

docker-compose.yml

@@ -285,6 +285,7 @@ services:
       - _APP_DB_PASS
       - _APP_USAGE_STATS
       - _APP_LOGGING_CONFIG
+      - _APP_LOGGING_CONFIG_REALTIME
       - _APP_DATABASE_SHARED_TABLES
 
   appwrite-worker-audits:
@@ -958,7 +959,7 @@ services:
 
   appwrite-browser:
     container_name: appwrite-browser
-    image: appwrite/browser:0.3.1
+    image: appwrite/browser:0.3.2
     networks:
       - appwrite
 

docs/examples/1.5.x/client-rest/examples/account/create-challenge.md

@@ -1,4 +1,4 @@
-POST /v1/account/mfa/challenge HTTP/1.1
+POST /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.5.0

docs/examples/1.5.x/client-rest/examples/account/create-mfa-challenge.md

@@ -1,4 +1,4 @@
-POST /v1/account/mfa/challenge HTTP/1.1
+POST /v1/account/mfa/challenges HTTP/1.1
 Host: <REGION>.cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.6.0

docs/examples/1.5.x/client-rest/examples/account/create2f-a-challenge.md

@@ -1,4 +1,4 @@
-POST /v1/account/mfa/challenge HTTP/1.1
+POST /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.5.0

docs/examples/1.5.x/client-rest/examples/account/update-challenge.md

@@ -1,4 +1,4 @@
-PUT /v1/account/mfa/challenge HTTP/1.1
+PUT /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.5.0

docs/examples/1.5.x/client-rest/examples/account/update-mfa-challenge.md

@@ -1,4 +1,4 @@
-PUT /v1/account/mfa/challenge HTTP/1.1
+PUT /v1/account/mfa/challenges HTTP/1.1
 Host: <REGION>.cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.6.0

docs/examples/1.5.x/server-rest/examples/account/create-challenge.md

@@ -1,4 +1,4 @@
-POST /v1/account/mfa/challenge HTTP/1.1
+POST /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.5.0

docs/examples/1.5.x/server-rest/examples/account/create-mfa-challenge.md

@@ -1,4 +1,4 @@
-POST /v1/account/mfa/challenge HTTP/1.1
+POST /v1/account/mfa/challenges HTTP/1.1
 Host: <REGION>.cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.6.0

docs/examples/1.5.x/server-rest/examples/account/create2f-a-challenge.md

@@ -1,4 +1,4 @@
-POST /v1/account/mfa/challenge HTTP/1.1
+POST /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.5.0

docs/examples/1.5.x/server-rest/examples/account/update-challenge.md

@@ -1,4 +1,4 @@
-PUT /v1/account/mfa/challenge HTTP/1.1
+PUT /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.5.0

docs/examples/1.5.x/server-rest/examples/account/update-mfa-challenge.md

@@ -1,4 +1,4 @@
-PUT /v1/account/mfa/challenge HTTP/1.1
+PUT /v1/account/mfa/challenges HTTP/1.1
 Host: <REGION>.cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.6.0

docs/examples/1.6.x/client-rest/examples/account/create-mfa-challenge.md

@@ -1,4 +1,4 @@
-POST /v1/account/mfa/challenge HTTP/1.1
+POST /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.6.0

docs/examples/1.6.x/client-rest/examples/account/update-mfa-challenge.md

@@ -1,4 +1,4 @@
-PUT /v1/account/mfa/challenge HTTP/1.1
+PUT /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.6.0

docs/examples/1.6.x/server-rest/examples/account/create-mfa-challenge.md

@@ -1,4 +1,4 @@
-POST /v1/account/mfa/challenge HTTP/1.1
+POST /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.6.0

docs/examples/1.6.x/server-rest/examples/account/update-mfa-challenge.md

@@ -1,4 +1,4 @@
-PUT /v1/account/mfa/challenge HTTP/1.1
+PUT /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.6.0

docs/examples/1.7.x/client-rest/examples/account/create-mfa-challenge.md

@@ -1,4 +1,4 @@
-POST /v1/account/mfa/challenge HTTP/1.1
+POST /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.7.0

docs/examples/1.7.x/client-rest/examples/account/update-mfa-challenge.md

@@ -1,4 +1,4 @@
-PUT /v1/account/mfa/challenge HTTP/1.1
+PUT /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.7.0

docs/examples/1.7.x/server-rest/examples/account/create-mfa-challenge.md

@@ -1,4 +1,4 @@
-POST /v1/account/mfa/challenge HTTP/1.1
+POST /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.7.0

docs/examples/1.7.x/server-rest/examples/account/update-mfa-challenge.md

@@ -1,4 +1,4 @@
-PUT /v1/account/mfa/challenge HTTP/1.1
+PUT /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.7.0

docs/examples/1.8.x/client-android/java/account/create-o-auth-2-session.md

@@ -13,7 +13,7 @@ account.createOAuth2Session(
     OAuthProvider.AMAZON, // provider 
     "https://example.com", // success (optional)
     "https://example.com", // failure (optional)
-    listOf(), // scopes (optional)
+    List.of(), // scopes (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {
             error.printStackTrace();

docs/examples/1.8.x/client-android/java/account/create-o-auth-2-token.md

@@ -13,7 +13,7 @@ account.createOAuth2Token(
     OAuthProvider.AMAZON, // provider 
     "https://example.com", // success (optional)
     "https://example.com", // failure (optional)
-    listOf(), // scopes (optional)
+    List.of(), // scopes (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {
             error.printStackTrace();

docs/examples/1.8.x/client-android/java/account/list-identities.md

@@ -9,7 +9,7 @@ Client client = new Client(context)
 Account account = new Account(client);
 
 account.listIdentities(
-    listOf(), // queries (optional)
+    List.of(), // queries (optional)
     false, // total (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {

docs/examples/1.8.x/client-android/java/account/list-logs.md

@@ -9,7 +9,7 @@ Client client = new Client(context)
 Account account = new Account(client);
 
 account.listLogs(
-    listOf(), // queries (optional)
+    List.of(), // queries (optional)
     false, // total (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {

docs/examples/1.8.x/client-android/java/account/update-prefs.md

@@ -9,10 +9,10 @@ Client client = new Client(context)
 Account account = new Account(client);
 
 account.updatePrefs(
-    mapOf(
-        "language" to "en",
-        "timezone" to "UTC",
-        "darkTheme" to true
+    Map.of(
+        "language", "en",
+        "timezone", "UTC",
+        "darkTheme", true
     ), // prefs 
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {

docs/examples/1.8.x/client-android/java/avatars/get-screenshot.md

@@ -13,7 +13,7 @@ Avatars avatars = new Avatars(client);
 
 avatars.getScreenshot(
     "https://example.com", // url 
-    mapOf( "a" to "b" ), // headers (optional)
+    Map.of("a", "b"), // headers (optional)
     1, // viewportWidth (optional)
     1, // viewportHeight (optional)
     0.1, // scale (optional)
@@ -26,7 +26,7 @@ avatars.getScreenshot(
     -180, // longitude (optional)
     0, // accuracy (optional)
     false, // touch (optional)
-    listOf(), // permissions (optional)
+    List.of(), // permissions (optional)
     0, // sleep (optional)
     0, // width (optional)
     0, // height (optional)

docs/examples/1.8.x/client-android/java/databases/create-document.md

@@ -1,8 +1,8 @@
 import io.appwrite.Client;
 import io.appwrite.coroutines.CoroutineCallback;
-import io.appwrite.services.Databases;
 import io.appwrite.Permission;
 import io.appwrite.Role;
+import io.appwrite.services.Databases;
 
 Client client = new Client(context)
     .setEndpoint("https://<REGION>.cloud.appwrite.io/v1") // Your API Endpoint
@@ -14,14 +14,14 @@ databases.createDocument(
     "<DATABASE_ID>", // databaseId 
     "<COLLECTION_ID>", // collectionId 
     "<DOCUMENT_ID>", // documentId 
-    mapOf(
-        "username" to "walter.obrien",
-        "email" to "walter.obrien@example.com",
-        "fullName" to "Walter O'Brien",
-        "age" to 30,
-        "isAdmin" to false
+    Map.of(
+        "username", "walter.obrien",
+        "email", "walter.obrien@example.com",
+        "fullName", "Walter O'Brien",
+        "age", 30,
+        "isAdmin", false
     ), // data 
-    listOf(Permission.read(Role.any())), // permissions (optional)
+    List.of(Permission.read(Role.any())), // permissions (optional)
     "<TRANSACTION_ID>", // transactionId (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {

docs/examples/1.8.x/client-android/java/databases/create-operations.md

@@ -10,17 +10,15 @@ Databases databases = new Databases(client);
 
 databases.createOperations(
     "<TRANSACTION_ID>", // transactionId 
-    listOf(
-	    {
-	        "action": "create",
-	        "databaseId": "<DATABASE_ID>",
-	        "collectionId": "<COLLECTION_ID>",
-	        "documentId": "<DOCUMENT_ID>",
-	        "data": {
-	            "name": "Walter O'Brien"
-	        }
-	    }
-	), // operations (optional)
+    List.of(Map.of(
+        "action", "create",
+        "databaseId", "<DATABASE_ID>",
+        "collectionId", "<COLLECTION_ID>",
+        "documentId", "<DOCUMENT_ID>",
+        "data", Map.of(
+            "name", "Walter O'Brien"
+        )
+    )), // operations (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {
             error.printStackTrace();

docs/examples/1.8.x/client-android/java/databases/get-document.md

@@ -12,7 +12,7 @@ databases.getDocument(
     "<DATABASE_ID>", // databaseId 
     "<COLLECTION_ID>", // collectionId 
     "<DOCUMENT_ID>", // documentId 
-    listOf(), // queries (optional)
+    List.of(), // queries (optional)
     "<TRANSACTION_ID>", // transactionId (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {

docs/examples/1.8.x/client-android/java/databases/list-documents.md

@@ -11,7 +11,7 @@ Databases databases = new Databases(client);
 databases.listDocuments(
     "<DATABASE_ID>", // databaseId 
     "<COLLECTION_ID>", // collectionId 
-    listOf(), // queries (optional)
+    List.of(), // queries (optional)
     "<TRANSACTION_ID>", // transactionId (optional)
     false, // total (optional)
     new CoroutineCallback<>((result, error) -> {

docs/examples/1.8.x/client-android/java/databases/list-transactions.md

@@ -9,7 +9,7 @@ Client client = new Client(context)
 Databases databases = new Databases(client);
 
 databases.listTransactions(
-    listOf(), // queries (optional)
+    List.of(), // queries (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {
             error.printStackTrace();

docs/examples/1.8.x/client-android/java/databases/update-document.md

@@ -1,8 +1,8 @@
 import io.appwrite.Client;
 import io.appwrite.coroutines.CoroutineCallback;
-import io.appwrite.services.Databases;
 import io.appwrite.Permission;
 import io.appwrite.Role;
+import io.appwrite.services.Databases;
 
 Client client = new Client(context)
     .setEndpoint("https://<REGION>.cloud.appwrite.io/v1") // Your API Endpoint
@@ -14,8 +14,8 @@ databases.updateDocument(
     "<DATABASE_ID>", // databaseId 
     "<COLLECTION_ID>", // collectionId 
     "<DOCUMENT_ID>", // documentId 
-    mapOf( "a" to "b" ), // data (optional)
-    listOf(Permission.read(Role.any())), // permissions (optional)
+    Map.of("a", "b"), // data (optional)
+    List.of(Permission.read(Role.any())), // permissions (optional)
     "<TRANSACTION_ID>", // transactionId (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {

docs/examples/1.8.x/client-android/java/databases/upsert-document.md

@@ -1,8 +1,8 @@
 import io.appwrite.Client;
 import io.appwrite.coroutines.CoroutineCallback;
-import io.appwrite.services.Databases;
 import io.appwrite.Permission;
 import io.appwrite.Role;
+import io.appwrite.services.Databases;
 
 Client client = new Client(context)
     .setEndpoint("https://<REGION>.cloud.appwrite.io/v1") // Your API Endpoint
@@ -14,8 +14,8 @@ databases.upsertDocument(
     "<DATABASE_ID>", // databaseId 
     "<COLLECTION_ID>", // collectionId 
     "<DOCUMENT_ID>", // documentId 
-    mapOf( "a" to "b" ), // data 
-    listOf(Permission.read(Role.any())), // permissions (optional)
+    Map.of("a", "b"), // data 
+    List.of(Permission.read(Role.any())), // permissions (optional)
     "<TRANSACTION_ID>", // transactionId (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {

docs/examples/1.8.x/client-android/java/functions/create-execution.md

@@ -15,7 +15,7 @@ functions.createExecution(
     false, // async (optional)
     "<PATH>", // path (optional)
     ExecutionMethod.GET, // method (optional)
-    mapOf( "a" to "b" ), // headers (optional)
+    Map.of("a", "b"), // headers (optional)
     "<SCHEDULED_AT>", // scheduledAt (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {

docs/examples/1.8.x/client-android/java/functions/list-executions.md

@@ -10,7 +10,7 @@ Functions functions = new Functions(client);
 
 functions.listExecutions(
     "<FUNCTION_ID>", // functionId 
-    listOf(), // queries (optional)
+    List.of(), // queries (optional)
     false, // total (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {

docs/examples/1.8.x/client-android/java/graphql/mutation.md

@@ -9,7 +9,7 @@ Client client = new Client(context)
 Graphql graphql = new Graphql(client);
 
 graphql.mutation(
-    mapOf( "a" to "b" ), // query 
+    Map.of("a", "b"), // query 
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {
             error.printStackTrace();

docs/examples/1.8.x/client-android/java/graphql/query.md

@@ -9,7 +9,7 @@ Client client = new Client(context)
 Graphql graphql = new Graphql(client);
 
 graphql.query(
-    mapOf( "a" to "b" ), // query 
+    Map.of("a", "b"), // query 
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {
             error.printStackTrace();

docs/examples/1.8.x/client-android/java/storage/create-file.md

@@ -1,9 +1,9 @@
 import io.appwrite.Client;
 import io.appwrite.coroutines.CoroutineCallback;
 import io.appwrite.models.InputFile;
-import io.appwrite.services.Storage;
 import io.appwrite.Permission;
 import io.appwrite.Role;
+import io.appwrite.services.Storage;
 
 Client client = new Client(context)
     .setEndpoint("https://<REGION>.cloud.appwrite.io/v1") // Your API Endpoint
@@ -15,7 +15,7 @@ storage.createFile(
     "<BUCKET_ID>", // bucketId 
     "<FILE_ID>", // fileId 
     InputFile.fromPath("file.png"), // file 
-    listOf(Permission.read(Role.any())), // permissions (optional)
+    List.of(Permission.read(Role.any())), // permissions (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {
             error.printStackTrace();

docs/examples/1.8.x/client-android/java/storage/list-files.md

@@ -10,7 +10,7 @@ Storage storage = new Storage(client);
 
 storage.listFiles(
     "<BUCKET_ID>", // bucketId 
-    listOf(), // queries (optional)
+    List.of(), // queries (optional)
     "<SEARCH>", // search (optional)
     false, // total (optional)
     new CoroutineCallback<>((result, error) -> {

docs/examples/1.8.x/client-android/java/storage/update-file.md

@@ -1,8 +1,8 @@
 import io.appwrite.Client;
 import io.appwrite.coroutines.CoroutineCallback;
-import io.appwrite.services.Storage;
 import io.appwrite.Permission;
 import io.appwrite.Role;
+import io.appwrite.services.Storage;
 
 Client client = new Client(context)
     .setEndpoint("https://<REGION>.cloud.appwrite.io/v1") // Your API Endpoint
@@ -14,7 +14,7 @@ storage.updateFile(
     "<BUCKET_ID>", // bucketId 
     "<FILE_ID>", // fileId 
     "<NAME>", // name (optional)
-    listOf(Permission.read(Role.any())), // permissions (optional)
+    List.of(Permission.read(Role.any())), // permissions (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {
             error.printStackTrace();

docs/examples/1.8.x/client-android/java/tablesdb/create-operations.md

@@ -10,17 +10,15 @@ TablesDB tablesDB = new TablesDB(client);
 
 tablesDB.createOperations(
     "<TRANSACTION_ID>", // transactionId 
-    listOf(
-	    {
-	        "action": "create",
-	        "databaseId": "<DATABASE_ID>",
-	        "tableId": "<TABLE_ID>",
-	        "rowId": "<ROW_ID>",
-	        "data": {
-	            "name": "Walter O'Brien"
-	        }
-	    }
-	), // operations (optional)
+    List.of(Map.of(
+        "action", "create",
+        "databaseId", "<DATABASE_ID>",
+        "tableId", "<TABLE_ID>",
+        "rowId", "<ROW_ID>",
+        "data", Map.of(
+            "name", "Walter O'Brien"
+        )
+    )), // operations (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {
             error.printStackTrace();

docs/examples/1.8.x/client-android/java/tablesdb/create-row.md

@@ -1,8 +1,8 @@
 import io.appwrite.Client;
 import io.appwrite.coroutines.CoroutineCallback;
-import io.appwrite.services.TablesDB;
 import io.appwrite.Permission;
 import io.appwrite.Role;
+import io.appwrite.services.TablesDB;
 
 Client client = new Client(context)
     .setEndpoint("https://<REGION>.cloud.appwrite.io/v1") // Your API Endpoint
@@ -14,14 +14,14 @@ tablesDB.createRow(
     "<DATABASE_ID>", // databaseId 
     "<TABLE_ID>", // tableId 
     "<ROW_ID>", // rowId 
-    mapOf(
-        "username" to "walter.obrien",
-        "email" to "walter.obrien@example.com",
-        "fullName" to "Walter O'Brien",
-        "age" to 30,
-        "isAdmin" to false
+    Map.of(
+        "username", "walter.obrien",
+        "email", "walter.obrien@example.com",
+        "fullName", "Walter O'Brien",
+        "age", 30,
+        "isAdmin", false
     ), // data 
-    listOf(Permission.read(Role.any())), // permissions (optional)
+    List.of(Permission.read(Role.any())), // permissions (optional)
     "<TRANSACTION_ID>", // transactionId (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {

docs/examples/1.8.x/client-android/java/tablesdb/get-row.md

@@ -12,7 +12,7 @@ tablesDB.getRow(
     "<DATABASE_ID>", // databaseId 
     "<TABLE_ID>", // tableId 
     "<ROW_ID>", // rowId 
-    listOf(), // queries (optional)
+    List.of(), // queries (optional)
     "<TRANSACTION_ID>", // transactionId (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {

docs/examples/1.8.x/client-android/java/tablesdb/list-rows.md

@@ -11,7 +11,7 @@ TablesDB tablesDB = new TablesDB(client);
 tablesDB.listRows(
     "<DATABASE_ID>", // databaseId 
     "<TABLE_ID>", // tableId 
-    listOf(), // queries (optional)
+    List.of(), // queries (optional)
     "<TRANSACTION_ID>", // transactionId (optional)
     false, // total (optional)
     new CoroutineCallback<>((result, error) -> {

docs/examples/1.8.x/client-android/java/tablesdb/list-transactions.md

@@ -9,7 +9,7 @@ Client client = new Client(context)
 TablesDB tablesDB = new TablesDB(client);
 
 tablesDB.listTransactions(
-    listOf(), // queries (optional)
+    List.of(), // queries (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {
             error.printStackTrace();

docs/examples/1.8.x/client-android/java/tablesdb/update-row.md

@@ -1,8 +1,8 @@
 import io.appwrite.Client;
 import io.appwrite.coroutines.CoroutineCallback;
-import io.appwrite.services.TablesDB;
 import io.appwrite.Permission;
 import io.appwrite.Role;
+import io.appwrite.services.TablesDB;
 
 Client client = new Client(context)
     .setEndpoint("https://<REGION>.cloud.appwrite.io/v1") // Your API Endpoint
@@ -14,8 +14,8 @@ tablesDB.updateRow(
     "<DATABASE_ID>", // databaseId 
     "<TABLE_ID>", // tableId 
     "<ROW_ID>", // rowId 
-    mapOf( "a" to "b" ), // data (optional)
-    listOf(Permission.read(Role.any())), // permissions (optional)
+    Map.of("a", "b"), // data (optional)
+    List.of(Permission.read(Role.any())), // permissions (optional)
     "<TRANSACTION_ID>", // transactionId (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {

docs/examples/1.8.x/client-android/java/tablesdb/upsert-row.md

@@ -1,8 +1,8 @@
 import io.appwrite.Client;
 import io.appwrite.coroutines.CoroutineCallback;
-import io.appwrite.services.TablesDB;
 import io.appwrite.Permission;
 import io.appwrite.Role;
+import io.appwrite.services.TablesDB;
 
 Client client = new Client(context)
     .setEndpoint("https://<REGION>.cloud.appwrite.io/v1") // Your API Endpoint
@@ -14,8 +14,8 @@ tablesDB.upsertRow(
     "<DATABASE_ID>", // databaseId 
     "<TABLE_ID>", // tableId 
     "<ROW_ID>", // rowId 
-    mapOf( "a" to "b" ), // data (optional)
-    listOf(Permission.read(Role.any())), // permissions (optional)
+    Map.of("a", "b"), // data (optional)
+    List.of(Permission.read(Role.any())), // permissions (optional)
     "<TRANSACTION_ID>", // transactionId (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {

docs/examples/1.8.x/client-android/java/teams/create-membership.md

@@ -10,7 +10,7 @@ Teams teams = new Teams(client);
 
 teams.createMembership(
     "<TEAM_ID>", // teamId 
-    listOf(), // roles 
+    List.of(), // roles 
     "email@example.com", // email (optional)
     "<USER_ID>", // userId (optional)
     "+12065550100", // phone (optional)

docs/examples/1.8.x/client-android/java/teams/create.md

@@ -11,7 +11,7 @@ Teams teams = new Teams(client);
 teams.create(
     "<TEAM_ID>", // teamId 
     "<NAME>", // name 
-    listOf(), // roles (optional)
+    List.of(), // roles (optional)
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {
             error.printStackTrace();

docs/examples/1.8.x/client-android/java/teams/list-memberships.md

@@ -10,7 +10,7 @@ Teams teams = new Teams(client);
 
 teams.listMemberships(
     "<TEAM_ID>", // teamId 
-    listOf(), // queries (optional)
+    List.of(), // queries (optional)
     "<SEARCH>", // search (optional)
     false, // total (optional)
     new CoroutineCallback<>((result, error) -> {

docs/examples/1.8.x/client-android/java/teams/list.md

@@ -9,7 +9,7 @@ Client client = new Client(context)
 Teams teams = new Teams(client);
 
 teams.list(
-    listOf(), // queries (optional)
+    List.of(), // queries (optional)
     "<SEARCH>", // search (optional)
     false, // total (optional)
     new CoroutineCallback<>((result, error) -> {

docs/examples/1.8.x/client-android/java/teams/update-membership.md

@@ -11,7 +11,7 @@ Teams teams = new Teams(client);
 teams.updateMembership(
     "<TEAM_ID>", // teamId 
     "<MEMBERSHIP_ID>", // membershipId 
-    listOf(), // roles 
+    List.of(), // roles 
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {
             error.printStackTrace();

docs/examples/1.8.x/client-android/java/teams/update-prefs.md

@@ -10,7 +10,7 @@ Teams teams = new Teams(client);
 
 teams.updatePrefs(
     "<TEAM_ID>", // teamId 
-    mapOf( "a" to "b" ), // prefs 
+    Map.of("a", "b"), // prefs 
     new CoroutineCallback<>((result, error) -> {
         if (error != null) {
             error.printStackTrace();

docs/examples/1.8.x/client-android/kotlin/databases/create-operations.md

@@ -10,15 +10,13 @@ val databases = Databases(client)
 
 val result = databases.createOperations(
     transactionId = "<TRANSACTION_ID>", 
-    operations = listOf(
-	    {
-	        "action": "create",
-	        "databaseId": "<DATABASE_ID>",
-	        "collectionId": "<COLLECTION_ID>",
-	        "documentId": "<DOCUMENT_ID>",
-	        "data": {
-	            "name": "Walter O'Brien"
-	        }
-	    }
-	), // (optional)
+    operations = listOf(mapOf(
+        "action" to "create",
+        "databaseId" to "<DATABASE_ID>",
+        "collectionId" to "<COLLECTION_ID>",
+        "documentId" to "<DOCUMENT_ID>",
+        "data" to mapOf(
+            "name" to "Walter O'Brien"
+        )
+    )), // (optional)
 )

docs/examples/1.8.x/client-android/kotlin/tablesdb/create-operations.md

@@ -10,15 +10,13 @@ val tablesDB = TablesDB(client)
 
 val result = tablesDB.createOperations(
     transactionId = "<TRANSACTION_ID>", 
-    operations = listOf(
-	    {
-	        "action": "create",
-	        "databaseId": "<DATABASE_ID>",
-	        "tableId": "<TABLE_ID>",
-	        "rowId": "<ROW_ID>",
-	        "data": {
-	            "name": "Walter O'Brien"
-	        }
-	    }
-	), // (optional)
+    operations = listOf(mapOf(
+        "action" to "create",
+        "databaseId" to "<DATABASE_ID>",
+        "tableId" to "<TABLE_ID>",
+        "rowId" to "<ROW_ID>",
+        "data" to mapOf(
+            "name" to "Walter O'Brien"
+        )
+    )), // (optional)
 )

docs/examples/1.8.x/client-rest/examples/account/create-mfa-challenge.md

@@ -1,4 +1,4 @@
-POST /v1/account/mfa/challenge HTTP/1.1
+POST /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.8.0

docs/examples/1.8.x/client-rest/examples/account/update-mfa-challenge.md

@@ -1,4 +1,4 @@
-PUT /v1/account/mfa/challenge HTTP/1.1
+PUT /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.8.0

docs/examples/1.8.x/console-web/examples/functions/create-template-deployment.md

@@ -1,4 +1,4 @@
-import { Client, Functions,  } from "@appwrite.io/console";
+import { Client, Functions, TemplateReferenceType } from "@appwrite.io/console";
 
 const client = new Client()
     .setEndpoint('https://<REGION>.cloud.appwrite.io/v1') // Your API Endpoint
@@ -11,7 +11,7 @@ const result = await functions.createTemplateDeployment({
     repository: '<REPOSITORY>',
     owner: '<OWNER>',
     rootDirectory: '<ROOT_DIRECTORY>',
-    type: .Commit,
+    type: TemplateReferenceType.Commit,
     reference: '<REFERENCE>',
     activate: false // optional
 });