(feat): add migration host vars entry

[codex] Fix PHPStan baseline cleanup issues (part 2)

.github/workflows/ci.yml

@@ -150,8 +150,16 @@ jobs:
       - name: Install dependencies
         run: composer install --prefer-dist --no-progress --ignore-platform-reqs
 
+      - name: Cache PHPStan result cache
+        uses: actions/cache@v4
+        with:
+          path: .phpstan-cache
+          key: phpstan-${{ github.sha }}
+          restore-keys: |
+            phpstan-
+
       - name: Run PHPStan
-        run: composer analyze
+        run: composer analyze -- --no-progress
 
   locale:
     name: Checks / Locale

.gitignore

@@ -21,6 +21,7 @@ appwrite.config.json
 /app/config/specs/
 /docs/examples/
 .phpunit.cache
+.phpstan-cache
 playwright-report
 test-results
 docker-compose.web-installer.yml

AGENTS.md

@@ -1,107 +1,120 @@
-# AGENTS.md
+# Appwrite
 
-Appwrite is an end-to-end backend server for web, mobile, native, and backend apps. This guide provides context and instructions for AI coding agents working on the Appwrite codebase.
+Self-hosted Backend-as-a-Service platform. Hybrid monolithic-microservice architecture built with PHP 8.3+ on Swoole, delivered as Docker containers.
 
-## Project Overview
+## Commands
 
-Appwrite is a self-hosted Backend-as-a-Service (BaaS) platform that provides developers with a set of APIs and tools to build secure, scalable applications. The project uses a hybrid monolithic-microservice architecture built with PHP, running on Swoole for high performance.
+| Command | Purpose |
+|---------|---------|
+| `docker compose up -d --force-recreate --build` | Build and start all services |
+| `docker compose exec appwrite test tests/e2e/Services/[Service]` | Run E2E tests for a service |
+| `docker compose exec appwrite test tests/e2e/Services/[Service] --filter=[Method]` | Run a single test method |
+| `docker compose exec appwrite test tests/unit/` | Run unit tests |
+| `composer format` | Auto-format code (Pint, PSR-12) |
+| `composer format <file>` | Format a specific file |
+| `composer lint <file>` | Check formatting of a file |
+| `composer analyze` | Static analysis (PHPStan level 3) |
+| `composer check` | Same as `analyze` |
 
-**Key Technologies:**
-- **Backend:** PHP 8.3+, Swoole
-- **Libraries:** Utopia PHP
-- **Database:** MariaDB, Redis
-- **Cache:** Redis
-- **Queue:** Redis
-- **Containers:** Docker
+## Stack
 
-## Development Commands
+- PHP 8.3+, Swoole 6.x (async runtime, replaces PHP-FPM)
+- Utopia PHP framework (HTTP routing, CLI, DI, queue)
+- MongoDB (default), MariaDB, MySQL, PostgreSQL (adapters via utopia-php/database)
+- Redis (cache, queue, pub/sub)
+- Docker + Traefik (reverse proxy)
+- PHPUnit 12, Pint (PSR-12), PHPStan level 3
 
-```bash
-# Run Appwrite
-docker compose up -d --force-recreate --build
+## Project layout
 
-# Run specific test
-docker compose exec appwrite test /usr/src/code/tests/e2e/Services/[ServiceName] --filter=[FunctionName]
+- **src/Appwrite/Platform/Modules/** -- feature modules (Account, Avatars, Compute, Console, Databases, Functions, Health, Project, Projects, Proxy, Sites, Storage, Teams, Tokens, VCS, Webhooks)
+- **src/Appwrite/Platform/Workers/** -- background job workers
+- **src/Appwrite/Platform/Tasks/** -- CLI tasks
+- **app/init.php** -- bootstrap (registers services, resources, listeners)
+- **app/init/** -- configs, constants, locales, models, registers, resources, span, database filters/formats
+- **bin/** -- CLI entry points: `worker-*` (14 workers), `schedule-*`, `queue-*`, plus `doctor`, `install`, `migrate`, `realtime`, `upgrade`, `ssl`, `vars`, `maintenance`, `interval`, `specs`, `sdks`, etc.
+- **tests/e2e/** -- end-to-end tests per service
+- **tests/unit/** -- unit tests
+- **public/** -- static assets and generated SDKs
 
-# Format code
-composer format
+## Module structure
+
+Each module under `src/Appwrite/Platform/Modules/{Name}/` contains:
+
+```
+Module.php           -- registers all services for the module
+Services/Http.php    -- registers HTTP endpoints
+Services/Workers.php -- registers background workers
+Services/Tasks.php   -- registers CLI tasks
+Http/{Service}/      -- endpoint actions (Create.php, Get.php, Update.php, Delete.php, XList.php)
+Workers/             -- worker implementations
+Tasks/               -- CLI task implementations
 ```
 
-## Code Style Guidelines
+HTTP endpoint nesting reflects the URL path. Sub-resources get subdirectories. For example, within the Functions module:
+`Http/Deployments/Template/Create.php` -> `POST /v1/functions/:functionId/deployments/template`
 
-- Follow [PSR-12](https://www.php-fig.org/psr/psr-12/) coding standard
-- Use PSR-4 autoloading
-- Strict type declarations where applicable
-- Comprehensive PHPDoc comments
+File names in Http directories must only be `Get.php`, `Create.php`, `Update.php`, `Delete.php`, or `XList.php`. For non-CRUD operations, model the endpoint as a property update. For example, updating a team membership status lives at `Teams/Http/Memberships/Status/Update.php` (`PATCH /v1/teams/:teamId/memberships/:membershipId/status`).
 
-### Naming Conventions
+Register new modules in `src/Appwrite/Platform/Appwrite.php`. Detailed module guide: `src/Appwrite/Platform/AGENTS.md`.
 
-#### `resourceType` Naming Rule
+## Action pattern (HTTP endpoints)
 
-When a collection has a combination of `resourceType`, `resourceId`, and/or `resourceInternalId`, the value of `resourceType` MUST always be **plural** - for example: `functions`, `sites`, `deployments`.
-
-Examples:
 ```php
-'resourceType' => 'functions'
-'resourceType' => 'sites'
-'resourceType' => 'deployments'
+class Create extends Action
+{
+    public static function getName(): string { return 'createTeam'; }
+
+    public function __construct()
+    {
+        $this
+            ->setHttpMethod(Action::HTTP_REQUEST_METHOD_POST)
+            ->setHttpPath('/v1/teams')
+            ->desc('Create team')
+            ->groups(['api', 'teams'])
+            ->label('event', 'teams.[teamId].create')
+            ->label('scope', 'teams.write')
+            ->param('teamId', '', new CustomId(), 'Team ID.')
+            ->param('name', null, new Text(128), 'Team name.')
+            ->inject('response')
+            ->inject('dbForProject')
+            ->inject('queueForEvents')
+            ->callback($this->action(...));
+    }
+
+    public function action(
+        string $teamId,
+        string $name,
+        Response $response,
+        Database $dbForProject,
+        Event $queueForEvents,
+    ): void {
+        // implementation
+    }
+}
 ```
 
-## Performance Patterns
+Common injections: `$response`, `$request`, `$dbForProject`, `$dbForPlatform`, `$user`, `$project`, `$queueForEvents`, `$queueForMails`, `$queueForDeletes`.
 
-### Document Update Optimization
+## Conventions
 
-When updating documents, always pass only the changed attributes as a sparse `Document` rather than the full document. This is more efficient because `updateDocument()` internally performs `array_merge($old, $new)`.
+- PSR-12 formatting enforced by Pint. PSR-4 autoloading.
+- `resourceType` values are always **plural**: `'functions'`, `'sites'`, `'deployments'`.
+- When updating documents, pass only changed attributes as a sparse Document:
+  ```php
+  // correct
+  $dbForProject->updateDocument('users', $user->getId(), new Document([
+      'name' => $name,
+  ]));
+  // incorrect -- passing full document is inefficient
+  $user->setAttribute('name', $name);
+  $dbForProject->updateDocument('users', $user->getId(), $user);
+  ```
+  Exceptions: migrations, `array_merge()` with `getArrayCopy()`, updates where nearly all attributes change, complex nested relationship logic requiring full document state.
+- Avoid introducing dependencies outside the `utopia-php` ecosystem.
+- Never hardcode credentials -- use environment variables.
+- Code changes may require container restart. No central log location -- check relevant containers.
 
-**Correct Pattern:**
-```php
-// Good: Pass only changed attributes directly
-$user = $dbForProject->updateDocument('users', $user->getId(), new Document([
-    'name' => $name,
-    'email' => $email,
-]));
-```
+## Cross-repo context
 
-**Incorrect Pattern:**
-```php
-$user->setAttribute('name', $name);
-$user->setAttribute('email', $email);
-
-// Bad: Passing full document is inefficient
-$user = $dbForProject->updateDocument('users', $user->getId(), $user);
-```
-
-**Exceptions:**
-- Migration files (need full document updates by design)
-- Cases already using `array_merge()` with `getArrayCopy()`
-- Updates where almost all attributes of the document change at once (sparse update provides little benefit compared to passing the full document)
-- Complex nested relationship logic where full document state is required
-
-## Security Considerations
-
-### Critical Security Practices
-
-- **Never hardcode credentials** - Use environment variables
-- **Rate limiting** - Respect abuse prevention mechanisms
-
-## Dependencies
-
-Avoid introducing new dependencies other than utopia-php.
-
-## Adding new endpoints
-
-When adding new endpoints, make sure to use modules and follow its patterns. Find instruction in [Modules AGENTS.md](src/Appwrite/Platform/AGENTS.md) file.
-
-## Pull Request Guidelines
-### Before Submitting
-
--  Run `composer format`
-- Update documentation if adding features
-- Add/update tests for your changes
-- Check that Docker build succeeds
-`docs/specs/authentication.drawio.svg`
-
-## Known Issues and Gotchas
-
-- **Hot Reload:** Code changes require container restart in some cases
-- **Logging:** There is no central place for logs, so when debugging, ensure to check all possibly relevant containers
+Appwrite is the base server for `appwrite/cloud`. Changes to the Action pattern, module structure, DI system, or response models affect cloud. The `feat-dedicated-db` feature spans cloud, edge, and console.

README.md

@@ -72,6 +72,7 @@ Before running the installation command, make sure you have [Docker](https://www
 
 ```bash
 docker run -it --rm \
+    --publish 20080:20080 \
     --volume /var/run/docker.sock:/var/run/docker.sock \
     --volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \
     --entrypoint="install" \
@@ -84,6 +85,7 @@ docker run -it --rm \
 
 ```cmd
 docker run -it --rm ^
+    --publish 20080:20080 ^
     --volume //var/run/docker.sock:/var/run/docker.sock ^
     --volume "%cd%"/appwrite:/usr/src/code/appwrite:rw ^
     --entrypoint="install" ^
@@ -94,6 +96,7 @@ docker run -it --rm ^
 
 ```powershell
 docker run -it --rm `
+    --publish 20080:20080 `
     --volume /var/run/docker.sock:/var/run/docker.sock `
     --volume ${pwd}/appwrite:/usr/src/code/appwrite:rw `
     --entrypoint="install" `

app/config/collections/projects.php

@@ -64,7 +64,7 @@ return [
             [
                 '$id' => ID::custom('database'),
                 'type' => Database::VAR_STRING,
-                'size' => 128,
+                'size' => 2000,
                 'required' => false,
                 'signed' => true,
                 'array' => false,

app/config/locale/translations/en.json

@@ -57,21 +57,21 @@
     "emails.recovery.thanks": "Thanks,",
     "emails.recovery.buttonText": "Reset password",
     "emails.recovery.signature": "{{project}} team",
-    "emails.csvExport.success.subject": "Your CSV export is ready",
-    "emails.csvExport.success.preview": "Your data export has been completed successfully.",
-    "emails.csvExport.success.hello": "Hello {{user}},",
-    "emails.csvExport.success.body": "Your CSV export is ready to download. Click the button below to download your data export.",
-    "emails.csvExport.success.footer": "This download link will expire in 1 hour.",
-    "emails.csvExport.success.thanks": "Thanks,",
-    "emails.csvExport.success.buttonText": "Download CSV",
-    "emails.csvExport.success.signature": "Appwrite team",
-    "emails.csvExport.failure.subject": "Your CSV export failed - file too large",
-    "emails.csvExport.failure.preview": "Your data export failed because the file size exceeds your plan limit.",
-    "emails.csvExport.failure.hello": "Hello {{user}},",
-    "emails.csvExport.failure.body": "Your CSV export could not be completed because the export file size ({{size}}MB) exceeds your plan limit. Please consider upgrading your plan or exporting a smaller dataset.",
-    "emails.csvExport.failure.footer": "If you have any questions, please contact our support team.",
-    "emails.csvExport.failure.thanks": "Thanks,",
-    "emails.csvExport.failure.signature": "{{project}} team",
+    "emails.dataExport.success.subject": "Your {{type}} export is ready",
+    "emails.dataExport.success.preview": "Your data export has been completed successfully.",
+    "emails.dataExport.success.hello": "Hello {{user}},",
+    "emails.dataExport.success.body": "Your {{type}} export is ready to download. Click the button below to download your data export.",
+    "emails.dataExport.success.footer": "This download link will expire in 1 hour.",
+    "emails.dataExport.success.thanks": "Thanks,",
+    "emails.dataExport.success.buttonText": "Download {{type}}",
+    "emails.dataExport.success.signature": "Appwrite team",
+    "emails.dataExport.failure.subject": "Your {{type}} export failed - file too large",
+    "emails.dataExport.failure.preview": "Your data export failed because the file size exceeds your plan limit.",
+    "emails.dataExport.failure.hello": "Hello {{user}},",
+    "emails.dataExport.failure.body": "Your {{type}} export could not be completed because the export file size ({{size}}MB) exceeds your plan limit. Please consider upgrading your plan or exporting a smaller dataset.",
+    "emails.dataExport.failure.footer": "If you have any questions, please contact our support team.",
+    "emails.dataExport.failure.thanks": "Thanks,",
+    "emails.dataExport.failure.signature": "{{project}} team",
     "emails.invitation.subject": "Invitation to {{team}} Team at {{project}}",
     "emails.invitation.preview": "{{owner}} invited you to join {{team}} at {{project}}",
     "emails.invitation.hello": "Hello {{user}},",

app/config/platform.php

@@ -22,7 +22,7 @@ return [
     'hostnames' => array_filter(array_unique([
         System::getEnv('_APP_DOMAIN', 'localhost'),
         System::getEnv('_APP_CONSOLE_DOMAIN', 'localhost'),
-        System::getEnv('_APP_MIGRATION_HOST'),
+        System::getEnv('_APP_MIGRATION_HOST', 'appwrite'),
     ])),
     'schemas' => \array_filter(\explode(',', System::getEnv('_APP_CONSOLE_SCHEMA', ''))),
     'platformName' => APP_EMAIL_PLATFORM_NAME,

app/config/variables.php

@@ -1336,6 +1336,15 @@ return [
         'category' => 'Migrations',
         'description' => '',
         'variables' => [
+            [
+                'name' => '_APP_MIGRATION_HOST',
+                'description' => 'The hostname of the Appwrite server used for self-referencing during migrations. This is used to construct the API endpoint for Appwrite-to-Appwrite migrations.',
+                'introduction' => '1.9.0',
+                'default' => 'appwrite',
+                'required' => false,
+                'question' => '',
+                'filter' => ''
+            ],
             [
                 'name' => '_APP_MIGRATIONS_FIREBASE_CLIENT_ID',
                 'description' => 'Google OAuth client ID. You can find it in your GCP application settings.',

app/controllers/api/graphql.php

@@ -28,12 +28,18 @@ use Utopia\Validator\Text;
 Http::init()
     ->groups(['graphql'])
     ->inject('project')
+    ->inject('user')
+    ->inject('request')
+    ->inject('response')
     ->inject('authorization')
-    ->action(function (Document $project, Authorization $authorization) {
+    ->action(function (Document $project, User $user, Request $request, Response $response, Authorization $authorization) {
+        $response->setUser($user);
+        $request->setUser($user);
+
         if (
             array_key_exists('graphql', $project->getAttribute('apis', []))
             && !$project->getAttribute('apis', [])['graphql']
-            && !(User::isPrivileged($authorization->getRoles()) || User::isApp($authorization->getRoles()))
+            && !($user->isPrivileged($authorization->getRoles()) || $user->isApp($authorization->getRoles()))
         ) {
             throw new AppwriteException(AppwriteException::GENERAL_API_DISABLED);
         }

app/controllers/api/migrations.php

@@ -29,6 +29,7 @@ use Utopia\Migration\Resource;
 use Utopia\Migration\Sources\Appwrite;
 use Utopia\Migration\Sources\CSV;
 use Utopia\Migration\Sources\Firebase;
+use Utopia\Migration\Sources\JSON;
 use Utopia\Migration\Sources\NHost;
 use Utopia\Migration\Sources\Supabase;
 use Utopia\Migration\Transfer;
@@ -53,6 +54,15 @@ function getDatabaseTransferResourceServices(string $databaseType)
     };
 }
 
+function getDatabaseResourceType(string $databaseType): string
+{
+    return match($databaseType) {
+        DATABASE_TYPE_VECTORSDB => Resource::TYPE_DATABASE_VECTORSDB,
+        DATABASE_TYPE_DOCUMENTSDB => Resource::TYPE_DATABASE_DOCUMENTSDB,
+        default => Resource::TYPE_DATABASE,
+    };
+}
+
 Http::post('/v1/migrations/appwrite')
     ->groups(['api', 'migrations'])
     ->desc('Create Appwrite migration')
@@ -447,6 +457,7 @@ Http::post('/v1/migrations/csv/imports')
         }
         $fileSize = $deviceForMigrations->getFileSize($newPath);
         $resources = Transfer::extractServices([getDatabaseTransferResourceServices($databaseType)]);
+        $resourceType = getDatabaseResourceType($databaseType);
 
         $migration = $dbForProject->createDocument('migrations', new Document([
             '$id' => $migrationId,
@@ -456,7 +467,7 @@ Http::post('/v1/migrations/csv/imports')
             'destination' => Appwrite::getName(),
             'resources' => $resources,
             'resourceId' => $resourceId,
-            'resourceType' => Resource::TYPE_DATABASE,
+            'resourceType' => $resourceType,
             'statusCounters' => '{}',
             'resourceData' => '{}',
             'errors' => [],
@@ -565,16 +576,6 @@ Http::post('/v1/migrations/csv/exports')
             throw new Exception(Exception::COLLECTION_NOT_FOUND);
         }
 
-        $validator = new Documents(
-            attributes: $collection->getAttribute('attributes', []),
-            indexes: $collection->getAttribute('indexes', []),
-            idAttributeType: $dbForProject->getAdapter()->getIdAttributeType(),
-        );
-
-        if (!$validator->isValid($parsedQueries)) {
-            throw new Exception(Exception::GENERAL_QUERY_INVALID, $validator->getDescription());
-        }
-
         // getting databasetype
         $resources = explode(':', $resourceId);
         $databaseId = $resources[0];
@@ -583,7 +584,23 @@ Http::post('/v1/migrations/csv/exports')
         if (!in_array($databaseType, CSV_ALLOWED_DATABASE_TYPES)) {
             throw new Exception(Exception::MIGRATION_DATABASE_TYPE_UNSUPPORTED, 'Database type not supported for csv');
         }
+
+        // Schemaless databases (DocumentsDB, VectorsDB) allow queries on dynamic fields
+        $isSchemaless = in_array($databaseType, [DATABASE_TYPE_DOCUMENTSDB, DATABASE_TYPE_VECTORSDB]);
+
+        $validator = new Documents(
+            attributes: $collection->getAttribute('attributes', []),
+            indexes: $collection->getAttribute('indexes', []),
+            idAttributeType: $dbForProject->getAdapter()->getIdAttributeType(),
+            supportForAttributes: !$isSchemaless,
+        );
+
+        if (!$validator->isValid($parsedQueries)) {
+            throw new Exception(Exception::GENERAL_QUERY_INVALID, $validator->getDescription());
+        }
+
         $resources = Transfer::extractServices([getDatabaseTransferResourceServices($databaseType)]);
+        $resourceType = getDatabaseResourceType($databaseType);
 
         $migration = $dbForProject->createDocument('migrations', new Document([
             '$id' => ID::unique(),
@@ -593,7 +610,7 @@ Http::post('/v1/migrations/csv/exports')
             'destination' => CSV::getName(),
             'resources' => $resources,
             'resourceId' => $resourceId,
-            'resourceType' => Resource::TYPE_DATABASE,
+            'resourceType' => $resourceType,
             'statusCounters' => '{}',
             'resourceData' => '{}',
             'errors' => [],
@@ -624,6 +641,291 @@ Http::post('/v1/migrations/csv/exports')
             ->dynamic($migration, Response::MODEL_MIGRATION);
     });
 
+Http::post('/v1/migrations/json/imports')
+    ->groups(['api', 'migrations'])
+    ->desc('Import documents from a JSON')
+    ->label('scope', 'migrations.write')
+    ->label('event', 'migrations.[migrationId].create')
+    ->label('audits.event', 'migration.create')
+    ->label('sdk', new Method(
+        namespace: 'migrations',
+        group: null,
+        name: 'createJSONImport',
+        description: '/docs/references/migrations/migration-json-import.md',
+        auth: [AuthType::ADMIN],
+        responses: [
+            new SDKResponse(
+                code: Response::STATUS_CODE_ACCEPTED,
+                model: Response::MODEL_MIGRATION,
+            )
+        ]
+    ))
+    ->param('bucketId', '', new UID(), 'Storage bucket unique ID. You can create a new storage bucket using the Storage service [server integration](https://appwrite.io/docs/server/storage#createBucket).')
+    ->param('fileId', '', new UID(), 'File ID.')
+    ->param('resourceId', null, new CompoundUID(), 'Composite ID in the format {databaseId:collectionId}, identifying a collection within a database.')
+    ->param('internalFile', false, new Boolean(), 'Is the file stored in an internal bucket?', true)
+    ->inject('response')
+    ->inject('dbForProject')
+    ->inject('dbForPlatform')
+    ->inject('authorization')
+    ->inject('project')
+    ->inject('platform')
+    ->inject('deviceForFiles')
+    ->inject('deviceForMigrations')
+    ->inject('queueForEvents')
+    ->inject('queueForMigrations')
+    ->action(function (
+        string $bucketId,
+        string $fileId,
+        string $resourceId,
+        bool $internalFile,
+        Response $response,
+        Database $dbForProject,
+        Database $dbForPlatform,
+        Authorization $authorization,
+        Document $project,
+        array $platform,
+        Device $deviceForFiles,
+        Device $deviceForMigrations,
+        Event $queueForEvents,
+        Migration $queueForMigrations
+    ) {
+        $bucket = $authorization->skip(function () use ($internalFile, $dbForPlatform, $dbForProject, $bucketId) {
+            if ($internalFile) {
+                return $dbForPlatform->getDocument('buckets', 'default');
+            }
+            return $dbForProject->getDocument('buckets', $bucketId);
+        });
+
+        if ($bucket->isEmpty()) {
+            throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
+        }
+
+        $file = $authorization->skip(fn () => $internalFile ? $dbForPlatform->getDocument('bucket_' . $bucket->getSequence(), $fileId) : $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+        if ($file->isEmpty()) {
+            throw new Exception(Exception::STORAGE_FILE_NOT_FOUND);
+        }
+
+        $path = $file->getAttribute('path', '');
+        if (!$deviceForFiles->exists($path)) {
+            throw new Exception(Exception::STORAGE_FILE_NOT_FOUND, 'File not found in ' . $path);
+        }
+
+        // No encryption or compression on files above 20MB.
+        $hasEncryption = !empty($file->getAttribute('openSSLCipher'));
+        $compression = $file->getAttribute('algorithm', Compression::NONE);
+        $hasCompression = $compression !== Compression::NONE;
+
+        $migrationId = ID::unique();
+        $newPath = $deviceForMigrations->getPath($migrationId . '_' . $fileId . '.json');
+
+        if ($hasEncryption || $hasCompression) {
+            $source = $deviceForFiles->read($path);
+
+            if ($hasEncryption) {
+                $source = OpenSSL::decrypt(
+                    $source,
+                    $file->getAttribute('openSSLCipher'),
+                    System::getEnv('_APP_OPENSSL_KEY_V' . $file->getAttribute('openSSLVersion')),
+                    0,
+                    hex2bin($file->getAttribute('openSSLIV')),
+                    hex2bin($file->getAttribute('openSSLTag'))
+                );
+            }
+
+            if ($hasCompression) {
+                switch ($compression) {
+                    case Compression::ZSTD:
+                        $source = (new Zstd())->decompress($source);
+                        break;
+                    case Compression::GZIP:
+                        $source = (new GZIP())->decompress($source);
+                        break;
+                }
+            }
+
+            // Manual write after decryption and/or decompression
+            if (!$deviceForMigrations->write($newPath, $source, 'application/json')) {
+                throw new \Exception('Unable to copy file');
+            }
+        } elseif (!$deviceForFiles->transfer($path, $newPath, $deviceForMigrations)) {
+            throw new \Exception('Unable to copy file');
+        }
+
+        $fileSize = $deviceForMigrations->getFileSize($newPath);
+
+        [$databaseId] = \explode(':', $resourceId, 2);
+        $database = $authorization->skip(fn () => $dbForProject->getDocument('databases', $databaseId));
+        if ($database->isEmpty()) {
+            throw new Exception(Exception::DATABASE_NOT_FOUND);
+        }
+        $databaseType = $database->getAttribute('type');
+        $resources = Transfer::extractServices([getDatabaseTransferResourceServices($databaseType)]);
+        $resourceType = getDatabaseResourceType($databaseType);
+
+        $migration = $dbForProject->createDocument('migrations', new Document([
+            '$id' => $migrationId,
+            'status' => 'pending',
+            'stage' => 'init',
+            'source' => JSON::getName(),
+            'destination' => Appwrite::getName(),
+            'resources' => $resources,
+            'resourceId' => $resourceId,
+            'resourceType' => $resourceType,
+            'statusCounters' => '{}',
+            'resourceData' => '{}',
+            'errors' => [],
+            'options' => [
+                'path' => $newPath,
+                'size' => $fileSize,
+            ],
+        ]));
+
+        $queueForEvents->setParam('migrationId', $migration->getId());
+
+        $queueForMigrations
+            ->setMigration($migration)
+            ->setProject($project)
+            ->setPlatform($platform)
+            ->trigger();
+
+        $response
+            ->setStatusCode(Response::STATUS_CODE_ACCEPTED)
+            ->dynamic($migration, Response::MODEL_MIGRATION);
+    });
+
+Http::post('/v1/migrations/json/exports')
+    ->groups(['api', 'migrations'])
+    ->desc('Export documents to JSON')
+    ->label('scope', 'migrations.write')
+    ->label('event', 'migrations.[migrationId].create')
+    ->label('audits.event', 'migration.create')
+    ->label('sdk', new Method(
+        namespace: 'migrations',
+        group: null,
+        name: 'createJSONExport',
+        description: '/docs/references/migrations/migration-json-export.md',
+        auth: [AuthType::ADMIN],
+        responses: [
+            new SDKResponse(
+                code: Response::STATUS_CODE_ACCEPTED,
+                model: Response::MODEL_MIGRATION,
+            )
+        ]
+    ))
+    ->param('resourceId', null, new CompoundUID(), 'Composite ID in the format {databaseId:collectionId}, identifying a collection within a database to export.')
+    ->param('filename', '', new Text(255), 'The name of the file to be created for the export, excluding the .json extension.')
+    ->param('columns', [], new ArrayList(new Text(Database::LENGTH_KEY)), 'List of attributes to export. If empty, all attributes will be exported. You can use the `*` wildcard to export all attributes from the collection.', true)
+    ->param('queries', [], new ArrayList(new Text(0)), 'Array of query strings generated using the Query class provided by the SDK to filter documents to export. [Learn more about queries](https://appwrite.io/docs/databases#querying-documents). Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' queries are allowed, each ' . APP_LIMIT_ARRAY_ELEMENT_SIZE . ' characters long.', true)
+    ->param('notify', true, new Boolean(), 'Set to true to receive an email when the export is complete. Default is true.', true)
+    ->inject('user')
+    ->inject('response')
+    ->inject('dbForProject')
+    ->inject('dbForPlatform')
+    ->inject('authorization')
+    ->inject('project')
+    ->inject('platform')
+    ->inject('queueForEvents')
+    ->inject('queueForMigrations')
+    ->action(function (
+        string $resourceId,
+        string $filename,
+        array $columns,
+        array $queries,
+        bool $notify,
+        Document $user,
+        Response $response,
+        Database $dbForProject,
+        Database $dbForPlatform,
+        Authorization $authorization,
+        Document $project,
+        array $platform,
+        Event $queueForEvents,
+        Migration $queueForMigrations
+    ) {
+        try {
+            $parsedQueries = Query::parseQueries($queries);
+        } catch (QueryException $e) {
+            throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
+        }
+
+        $bucket = $authorization->skip(fn () => $dbForPlatform->getDocument('buckets', 'default'));
+        if ($bucket->isEmpty()) {
+            throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
+        }
+
+        [$databaseId, $collectionId] = \explode(':', $resourceId, 2);
+        if (empty($databaseId)) {
+            throw new Exception(Exception::DATABASE_NOT_FOUND);
+        }
+        if (empty($collectionId)) {
+            throw new Exception(Exception::COLLECTION_NOT_FOUND);
+        }
+
+        $database = $authorization->skip(fn () => $dbForProject->getDocument('databases', $databaseId));
+        if ($database->isEmpty()) {
+            throw new Exception(Exception::DATABASE_NOT_FOUND);
+        }
+
+        $collection = $authorization->skip(fn () => $dbForProject->getDocument('database_' . $database->getSequence(), $collectionId));
+        if ($collection->isEmpty()) {
+            throw new Exception(Exception::COLLECTION_NOT_FOUND);
+        }
+
+        $databaseType = $database->getAttribute('type');
+
+        // Schemaless databases (DocumentsDB, VectorsDB) allow queries on dynamic fields
+        $isSchemaless = in_array($databaseType, [DATABASE_TYPE_DOCUMENTSDB, DATABASE_TYPE_VECTORSDB]);
+
+        $validator = new Documents(
+            attributes: $collection->getAttribute('attributes', []),
+            indexes: $collection->getAttribute('indexes', []),
+            idAttributeType: $dbForProject->getAdapter()->getIdAttributeType(),
+            supportForAttributes: !$isSchemaless,
+        );
+
+        if (!$validator->isValid($parsedQueries)) {
+            throw new Exception(Exception::GENERAL_QUERY_INVALID, $validator->getDescription());
+        }
+
+        $resources = Transfer::extractServices([getDatabaseTransferResourceServices($databaseType)]);
+        $resourceType = getDatabaseResourceType($databaseType);
+
+        $migration = $dbForProject->createDocument('migrations', new Document([
+            '$id' => ID::unique(),
+            'status' => 'pending',
+            'stage' => 'init',
+            'source' => Appwrite::getName(),
+            'destination' => JSON::getName(),
+            'resources' => $resources,
+            'resourceId' => $resourceId,
+            'resourceType' => $resourceType,
+            'statusCounters' => '{}',
+            'resourceData' => '{}',
+            'errors' => [],
+            'options' => [
+                'bucketId' => 'default', // Always use internal bucket
+                'filename' => $filename,
+                'columns' => $columns,
+                'queries' => $queries,
+                'notify' => $notify,
+                'userInternalId' => $user->getSequence(),
+            ],
+        ]));
+
+        $queueForEvents->setParam('migrationId', $migration->getId());
+
+        $queueForMigrations
+            ->setMigration($migration)
+            ->setProject($project)
+            ->setPlatform($platform)
+            ->trigger();
+
+        $response
+            ->setStatusCode(Response::STATUS_CODE_ACCEPTED)
+            ->dynamic($migration, Response::MODEL_MIGRATION);
+    });
+
 Http::get('/v1/migrations')
     ->groups(['api', 'migrations'])
     ->desc('List migrations')

app/controllers/general.php

@@ -1270,7 +1270,16 @@ Http::error()
          * If not a publishable error, track usage stats. Publishable errors are >= 500 or those explicitly marked as publish=true in errors.php
          */
         if (!$publish && $project->getId() !== 'console') {
-            if (!DBUser::isPrivileged($authorization->getRoles())) {
+            $errorUser = new DBUser();
+            try {
+                $resolvedUser = $utopia->getResource('user');
+                if ($resolvedUser instanceof DBUser) {
+                    $errorUser = $resolvedUser;
+                }
+            } catch (\Throwable) {
+                // User resource may not be available in error context
+            }
+            if (!$errorUser->isPrivileged($authorization->getRoles())) {
                 $bus->dispatch(new RequestCompleted(
                     project: $project->getArrayCopy(),
                     request: $request,

app/controllers/shared/api.php

@@ -96,7 +96,7 @@ Http::init()
     ->inject('team')
     ->inject('apiKey')
     ->inject('authorization')
-    ->action(function (Http $utopia, Request $request, Database $dbForPlatform, Database $dbForProject, Audit $queueForAudits, Document $project, Document $user, ?Document $session, array $servers, string $mode, Document $team, ?Key $apiKey, Authorization $authorization) {
+    ->action(function (Http $utopia, Request $request, Database $dbForPlatform, Database $dbForProject, Audit $queueForAudits, Document $project, User $user, ?Document $session, array $servers, string $mode, Document $team, ?Key $apiKey, Authorization $authorization) {
         $route = $utopia->getRoute();
 
         /**
@@ -419,7 +419,7 @@ Http::init()
             if (
                 array_key_exists($namespace, $project->getAttribute('services', []))
                 && ! $project->getAttribute('services', [])[$namespace]
-                && ! (User::isPrivileged($authorization->getRoles()) || User::isApp($authorization->getRoles()))
+                && ! ($user->isPrivileged($authorization->getRoles()) || $user->isApp($authorization->getRoles()))
             ) {
                 throw new Exception(Exception::GENERAL_SERVICE_DISABLED);
             }
@@ -483,7 +483,10 @@ Http::init()
     ->inject('telemetry')
     ->inject('platform')
     ->inject('authorization')
-    ->action(function (Http $utopia, Request $request, Response $response, Document $project, Document $user, Event $queueForEvents, Messaging $queueForMessaging, Audit $queueForAudits, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, Context $usage, Func $queueForFunctions, Mail $queueForMails, Database $dbForProject, callable $timelimit, Document $resourceToken, string $mode, ?Key $apiKey, array $plan, Document $devKey, Telemetry $telemetry, array $platform, Authorization $authorization) {
+    ->action(function (Http $utopia, Request $request, Response $response, Document $project, User $user, Event $queueForEvents, Messaging $queueForMessaging, Audit $queueForAudits, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, Context $usage, Func $queueForFunctions, Mail $queueForMails, Database $dbForProject, callable $timelimit, Document $resourceToken, string $mode, ?Key $apiKey, array $plan, Document $devKey, Telemetry $telemetry, array $platform, Authorization $authorization) {
+
+        $response->setUser($user);
+        $request->setUser($user);
 
         $route = $utopia->getRoute();
         $path = $route->getMatchedPath();
@@ -496,7 +499,7 @@ Http::init()
         if (
             array_key_exists('rest', $project->getAttribute('apis', []))
             && ! $project->getAttribute('apis', [])['rest']
-            && ! (User::isPrivileged($authorization->getRoles()) || User::isApp($authorization->getRoles()))
+            && ! ($user->isPrivileged($authorization->getRoles()) || $user->isApp($authorization->getRoles()))
         ) {
             throw new AppwriteException(AppwriteException::GENERAL_API_DISABLED);
         }
@@ -528,8 +531,8 @@ Http::init()
         $closestLimit = null;
 
         $roles = $authorization->getRoles();
-        $isPrivilegedUser = User::isPrivileged($roles);
-        $isAppUser = User::isApp($roles);
+        $isPrivilegedUser = $user->isPrivileged($roles);
+        $isAppUser = $user->isApp($roles);
 
         foreach ($timeLimitArray as $timeLimit) {
             foreach ($request->getParams() as $key => $value) { // Set request params as potential abuse keys
@@ -611,7 +614,7 @@ Http::init()
         if ($useCache) {
             $route = $utopia->match($request);
             $isImageTransformation = $route->getPath() === '/v1/storage/buckets/:bucketId/files/:fileId/preview';
-            $isDisabled = isset($plan['imageTransformations']) && $plan['imageTransformations'] === -1 && ! User::isPrivileged($authorization->getRoles());
+            $isDisabled = isset($plan['imageTransformations']) && $plan['imageTransformations'] === -1 && ! $user->isPrivileged($authorization->getRoles());
 
             $key = $request->cacheIdentifier();
             $cacheLog = $authorization->skip(fn () => $dbForProject->getDocument('cache', $key));
@@ -630,7 +633,7 @@ Http::init()
                     $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
                     $isToken = ! $resourceToken->isEmpty() && $resourceToken->getAttribute('bucketInternalId') === $bucket->getSequence();
-                    $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+                    $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
                     if ($bucket->isEmpty() || (! $bucket->getAttribute('enabled') && ! $isAppUser && ! $isPrivilegedUser)) {
                         throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
@@ -663,7 +666,7 @@ Http::init()
                         throw new Exception(Exception::STORAGE_FILE_NOT_FOUND);
                     }
                     // Do not update transformedAt if it's a console user
-                    if (! User::isPrivileged($authorization->getRoles())) {
+                    if (! $user->isPrivileged($authorization->getRoles())) {
                         $transformedAt = $file->getAttribute('transformedAt', '');
                         if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_PROJECT_ACCESS)) > $transformedAt) {
                             $file->setAttribute('transformedAt', DateTime::now());
@@ -697,7 +700,7 @@ Http::init()
     ->groups(['session'])
     ->inject('user')
     ->inject('request')
-    ->action(function (Document $user, Request $request) {
+    ->action(function (User $user, Request $request) {
         if (\str_contains($request->getURI(), 'oauth2')) {
             return;
         }
@@ -984,7 +987,7 @@ Http::shutdown()
         }
 
         if ($project->getId() !== 'console') {
-            if (! User::isPrivileged($authorization->getRoles())) {
+            if (! $user->isPrivileged($authorization->getRoles())) {
                 $bus->dispatch(new RequestCompleted(
                     project: $project->getArrayCopy(),
                     request: $request,

app/controllers/shared/api/auth.php

@@ -36,8 +36,9 @@ Http::init()
     ->inject('request')
     ->inject('project')
     ->inject('geodb')
+    ->inject('user')
     ->inject('authorization')
-    ->action(function (Http $utopia, Request $request, Document $project, Reader $geodb, Authorization $authorization) {
+    ->action(function (Http $utopia, Request $request, Document $project, Reader $geodb, User $user, Authorization $authorization) {
         $denylist = System::getEnv('_APP_CONSOLE_COUNTRIES_DENYLIST', '');
         if (!empty($denylist && $project->getId() === 'console')) {
             $countries = explode(',', $denylist);
@@ -50,8 +51,8 @@ Http::init()
 
         $route = $utopia->match($request);
 
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
-        $isAppUser = User::isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
+        $isAppUser = $user->isApp($authorization->getRoles());
 
         if ($isAppUser || $isPrivilegedUser) { // Skip limits for app and console devs
             return;

app/http.php

@@ -103,7 +103,7 @@ function dispatch(Server $server, int $fd, int $type, $data = null): int
         $lines = explode("\n", $data, 3);
         $request = $lines[0];
         if (count($lines) > 1) {
-            $domain = trim(explode('Host: ', $lines[1])[1]);
+            $domain = trim(explode('Host: ', $lines[1])[1] ?? '');
         }
 
         // Sync executions are considered risky

app/init/resources.php

@@ -432,8 +432,10 @@ Http::setResource('user', function (string $mode, Document $project, Document $c
         $jwtUserId = $payload['userId'] ?? '';
         if (! empty($jwtUserId)) {
             if ($mode === APP_MODE_ADMIN) {
+                /** @var User $user */
                 $user = $dbForPlatform->getDocument('users', $jwtUserId);
             } else {
+                /** @var User $user */
                 $user = $dbForProject->getDocument('users', $jwtUserId);
             }
         }
@@ -453,6 +455,7 @@ Http::setResource('user', function (string $mode, Document $project, Document $c
             throw new Exception(Exception::USER_API_KEY_AND_SESSION_SET);
         }
 
+        /** @var User $accountKeyUser */
         $accountKeyUser = $dbForPlatform->getAuthorization()->skip(fn () => $dbForPlatform->getDocument('users', $accountKeyUserId));
         if (! $accountKeyUser->isEmpty()) {
             $key = $accountKeyUser->find(

app/realtime.php

@@ -518,7 +518,7 @@ $server->onWorkerStart(function (int $workerId) use ($server, $register, $stats,
                         $project = $consoleDatabase->getAuthorization()->skip(fn () => $consoleDatabase->getDocument('projects', $projectId));
                         $database = getProjectDB($project);
 
-                        /** @var Appwrite\Utopia\Database\Documents\User $user */
+                        /** @var User $user */
                         $user = $database->getDocument('users', $userId);
 
                         $roles = $user->getRoles($database->getAuthorization());
@@ -642,10 +642,14 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
             throw new Exception(Exception::REALTIME_POLICY_VIOLATION, 'Missing or unknown project ID');
         }
 
+        $timelimit = $app->getResource('timelimit');
+        $user = $app->getResource('user'); /** @var User $user */
+        $logUser = $user;
+
         if (
             array_key_exists('realtime', $project->getAttribute('apis', []))
             && !$project->getAttribute('apis', [])['realtime']
-            && !(User::isPrivileged($authorization->getRoles()) || User::isApp($authorization->getRoles()))
+            && !($user->isPrivileged($authorization->getRoles()) || $user->isApp($authorization->getRoles()))
         ) {
             throw new AppwriteException(AppwriteException::GENERAL_API_DISABLED);
         }
@@ -656,10 +660,6 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
             throw new AppwriteException(AppwriteException::GENERAL_ACCESS_FORBIDDEN, 'Project is not accessible in this region. Please make sure you are using the correct endpoint');
         }
 
-        $timelimit = $app->getResource('timelimit');
-        $user = $app->getResource('user'); /** @var User $user */
-        $logUser = $user;
-
         /*
          * Abuse Check
          *

app/views/install/installer.phtml

@@ -13,7 +13,7 @@ $enabledDatabases = $enabledDatabases ?? ['mongodb', 'mariadb', 'postgresql'];
 $isLocalInstall = $isLocalInstall ?? false;
 
 
-$cardStep = min(4, $step);
+$cardStep = ($step === 5) ? 4 : $step;
 $stepFile = __DIR__ . "/installer/templates/steps/step-{$cardStep}.phtml";
 if (!is_file($stepFile)) {
     $stepFile = __DIR__ . "/installer/templates/steps/step-1.phtml";

app/views/install/installer/css/styles.css

@@ -478,6 +478,10 @@ body {
     overflow: hidden;
 }
 
+.installer-page[data-upgrade='true'] .installer-step {
+    min-height: 0;
+}
+
 .action-shell {
     display: flex;
     flex-direction: column;
@@ -1808,3 +1812,92 @@ body {
         gap: var(--gap-s);
     }
 }
+
+.migration-option {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: var(--gap-l);
+    padding: var(--space-6);
+    background: var(--bgcolor-neutral-default);
+    border-radius: var(--border-radius-m);
+    outline: var(--border-width-s) solid var(--border-neutral);
+    outline-offset: calc(var(--border-width-s) * -1);
+    cursor: pointer;
+    transition: outline-color 0.15s ease-in-out;
+}
+
+.migration-option:hover {
+    outline-color: var(--border-neutral-stronger);
+}
+
+.migration-option-content {
+    display: flex;
+    flex-direction: column;
+    gap: 2px;
+}
+
+.migration-switch {
+    flex-shrink: 0;
+}
+
+.migration-switch-track {
+    position: relative;
+    display: block;
+    width: 32px;
+    height: 20px;
+    border-radius: 10px;
+    background: var(--bgcolor-neutral-invert-weaker);
+    transition: background 0.15s ease-in-out;
+}
+
+.migration-switch-thumb {
+    position: absolute;
+    top: 2px;
+    left: 2px;
+    width: 16px;
+    height: 16px;
+    border-radius: 50%;
+    background: var(--bgcolor-neutral-primary);
+    transition: transform 0.15s ease-in-out;
+}
+
+#run-migration:checked ~ .migration-switch-track {
+    background: var(--bgcolor-neutral-invert-weak);
+}
+
+#run-migration:checked ~ .migration-switch-track .migration-switch-thumb {
+    transform: translateX(12px);
+}
+
+#run-migration:focus-visible ~ .migration-switch-track {
+    box-shadow: 0 0 0 var(--border-width-l) var(--border-focus);
+}
+
+.migration-hint {
+    display: flex;
+    align-items: flex-start;
+    gap: var(--gap-s);
+    padding: 0 var(--space-2);
+}
+
+.migration-hint-icon {
+    flex-shrink: 0;
+    width: 16px;
+    height: 16px;
+    color: var(--fgcolor-neutral-tertiary);
+    margin-top: 1px;
+}
+
+.migration-hint-icon svg {
+    width: 100%;
+    height: 100%;
+}
+
+.migration-code {
+    padding: 1px 4px;
+    border-radius: var(--border-radius-xs, 4px);
+    background: var(--bgcolor-neutral-secondary);
+    font-family: monospace;
+    font-size: inherit;
+}

app/views/install/installer/js/installer.js

@@ -12,7 +12,7 @@
     const { validateInstallRequest } = window.InstallerStepsProgress || {};
 
     const isUpgrade = document.body?.dataset.upgrade === 'true';
-    const stepFlow = isUpgrade ? [1, 4, 5] : [1, 2, 3, 4, 5];
+    const stepFlow = isUpgrade ? [1, 6, 4, 5] : [1, 2, 3, 4, 5];
     const cardSteps = stepFlow.filter((step) => step !== 5);
 
     const normalizeStep = (step) => {
@@ -53,7 +53,7 @@
     let pendingStep = null;
     let pendingPushState = false;
 
-    const clampStep = (step) => Math.max(1, Math.min(5, step));
+    const clampStep = (step) => Math.max(1, Math.min(6, step));
     const isInstallLocked = () => Boolean(window.InstallerSteps?.isInstallLocked?.());
 
     const scrollToFirstError = (panel) => {
@@ -399,11 +399,18 @@
                 }
             }
         }
-        if (action === 'next' && String(target) === '5' && typeof validateInstallRequest === 'function') {
-            const isValid = await validateInstallRequest();
-            if (!isValid) {
-                return;
+        if (action === 'next' && String(target) === '5') {
+            if (typeof validateInstallRequest === 'function') {
+                const isValid = await validateInstallRequest();
+                if (!isValid) {
+                    return;
+                }
             }
+            // Clear stale install data from previous runs so initStep5
+            // starts a fresh install instead of trying to resume.
+            const { clearInstallLock, clearInstallId } = window.InstallerStepsState || {};
+            clearInstallLock?.();
+            clearInstallId?.();
         }
         if (isInstallLocked() && Number(target) !== 5) {
             requestStep(5, true);

app/views/install/installer/js/modules/context.js

@@ -14,6 +14,7 @@
         ENV_VARS: 'env-vars',
         DOCKER_CONTAINERS: 'docker-containers',
         ACCOUNT_SETUP: 'account-setup',
+        MIGRATION: 'migration',
         SSL_CERTIFICATE: 'ssl-certificate',
         REDIRECT: 'redirect'
     });
@@ -52,6 +53,11 @@
             id: STEP_IDS.DOCKER_CONTAINERS,
             inProgress: 'Restarting Docker containers...',
             done: 'Docker containers restarted'
+        },
+        {
+            id: STEP_IDS.MIGRATION,
+            inProgress: 'Running database migration...',
+            done: 'Database migration completed'
         }
     ] : [
         {
@@ -95,7 +101,7 @@
     const clampStep = (step) => {
         const numeric = Number(step);
         if (Number.isNaN(numeric)) return 1;
-        return Math.max(1, Math.min(5, numeric));
+        return Math.max(1, Math.min(6, numeric));
     };
 
     window.InstallerStepsContext = Object.freeze({

app/views/install/installer/js/modules/progress.js

@@ -373,7 +373,8 @@
             opensslKey: (formState?.opensslKey || '').trim(),
             assistantOpenAIKey: normalizedAssistantKey,
             accountEmail: normalizedAccountEmail,
-            accountPassword: normalizedAccountPassword
+            accountPassword: normalizedAccountPassword,
+            migrate: formState?.migrate ?? false
         };
     };
 
@@ -721,7 +722,8 @@
             });
             startSyncedSpinnerRotation(list);
 
-            notifyInstallComplete(activeInstall?.installId, sessionDetails).finally(() => {
+            const completeId = activeInstall?.installId || getStoredInstallId?.();
+            notifyInstallComplete(completeId, sessionDetails).finally(() => {
                 setTimeout(() => redirectToApp(protocol), TIMINGS?.redirectDelay ?? 0);
             });
         };
@@ -911,21 +913,28 @@
         };
 
         const isSnapshotTerminal = (snapshot) => {
-            if (!snapshot?.steps) return true;
+            if (!snapshot?.steps) return 'empty';
             const stepEntries = Object.values(snapshot.steps);
-            if (stepEntries.length === 0) return true;
+            if (stepEntries.length === 0) return 'empty';
             const hasError = stepEntries.some((s) => s.status === STATUS.ERROR);
-            if (hasError) return true;
+            if (hasError) return 'error';
             const allCompleted = INSTALLATION_STEPS.every((step) => {
                 const detail = snapshot.steps[step.id];
                 return detail && detail.status === STATUS.COMPLETED;
             });
-            return allCompleted;
+            if (allCompleted) return 'completed';
+            return false;
         };
 
         const resumeInstall = async (installId) => {
             const snapshot = await fetchInstallStatus(installId);
-            if (!snapshot || isSnapshotTerminal(snapshot)) return false;
+            const terminal = isSnapshotTerminal(snapshot);
+            if (!snapshot || terminal) {
+                if (terminal === 'completed') {
+                    return 'completed';
+                }
+                return false;
+            }
             activeInstall = {
                 installId,
                 controller: new AbortController(),
@@ -1069,14 +1078,33 @@
             startInstallStream(newInstallId);
         };
 
+        const recoverToLastStep = () => {
+            clearInstallId?.();
+            clearInstallLock?.();
+            const url = new URL(window.location.href);
+            const lastStep = url.searchParams.get('step');
+            // Stay on the current URL so the user keeps their place;
+            // only navigate away if we're already on step 5 (the
+            // progress screen) since there's nothing to show.
+            if (!lastStep || String(lastStep) === '5') {
+                window.location.href = '/?step=1';
+            }
+        };
+
         const lock = getInstallLock?.();
         const existingInstallId = lock?.installId || getStoredInstallId?.();
         if (existingInstallId) {
-            resumeInstall(existingInstallId).then((resumed) => {
-                if (!resumed) {
-                    clearInstallId?.();
+            resumeInstall(existingInstallId).then((result) => {
+                if (result === 'completed') {
+                    // Install already finished — redirect to console
+                    // instead of bouncing back to step 1.
+                    stopSyncedSpinnerRotation();
+                    setUnloadGuard(false);
                     clearInstallLock?.();
-                    window.location.href = '/?step=1';
+                    clearInstallId?.();
+                    startSslCheck(null);
+                } else if (!result) {
+                    recoverToLastStep();
                 }
             });
         } else {

app/views/install/installer/js/steps.js

@@ -329,6 +329,30 @@
         }
     };
 
+    const initStep6 = (root) => {
+        if (!root) return;
+        syncInstallLockFlag?.();
+        applyLockPayload?.();
+        applyBodyDefaults?.();
+
+        const checkbox = root.querySelector('#run-migration');
+        if (checkbox) {
+            if (formState.migrate !== undefined) {
+                checkbox.checked = formState.migrate;
+            } else {
+                formState.migrate = checkbox.checked;
+            }
+            checkbox.addEventListener('change', () => {
+                formState.migrate = checkbox.checked;
+                dispatchStateChange?.('migrate');
+            });
+        }
+
+        if (isInstallLocked?.()) {
+            disableControls?.(root);
+        }
+    };
+
     const initStep = (step, container) => {
         if (!container) return;
         const root = container.querySelector('.step-layout') || container;
@@ -346,6 +370,7 @@
         if (normalized === 3) initStep3(root);
         if (normalized === 4) initStep4(root);
         if (normalized === 5) Progress.initStep5?.(root);
+        if (normalized === 6) initStep6(root);
     };
 
     window.InstallerSteps = {

app/views/install/installer/templates/steps/step-4.phtml

@@ -62,12 +62,14 @@ $badgeClass = $defaultSecretKey !== '' ? 'badge-success' : 'badge-warning';
                         <span class="badge badge-neutral typography-text-xs-400" data-review-assistant-badge>Disabled</span>
                         <div class="review-label typography-text-xs-400 text-neutral-tertiary">Appwrite Assistant</div>
                     </div>
+                    <?php if (!$isUpgrade) { ?>
                     <div class="review-row">
                         <span class="badge <?php echo $badgeClass; ?> typography-text-xs-400" data-review-badge>
                             <?php echo htmlspecialchars((string) $badgeLabel, ENT_QUOTES, 'UTF-8'); ?>
                         </span>
                         <div class="review-label typography-text-xs-400 text-neutral-tertiary">Secret API key</div>
                     </div>
+                    <?php } ?>
                 </div>
             </div>
         </div>

app/views/install/installer/templates/steps/step-5.phtml

@@ -6,7 +6,7 @@ $isUpgrade = $isUpgrade ?? false;
         <div class="install-panel">
             <div class="install-header">
                 <div class="typography-text-m-400 text-neutral-primary">
-                    <?php echo $isUpgrade ? 'Updating your app…' : 'Installing your app…'; ?>
+                    <?php echo $isUpgrade ? 'Updating Appwrite…' : 'Installing Appwrite…'; ?>
                 </div>
             </div>
             <div class="install-list" data-install-list></div>

app/views/install/installer/templates/steps/step-6.phtml

@@ -0,0 +1,37 @@
+<?php
+$isUpgrade = $isUpgrade ?? false;
+?>
+<div class="step-layout" data-step="6">
+    <div class="stack-xl">
+        <div class="stack-xxxs">
+            <h1 class="typography-title-s text-neutral-primary">Database migration</h1>
+            <p class="typography-text-m-400 text-neutral-secondary">
+                Run database migration after the update to apply schema changes.
+            </p>
+        </div>
+
+        <div class="stack-xl">
+            <label class="migration-option" for="run-migration">
+                <span class="migration-option-content">
+                    <span class="typography-text-m-500 text-neutral-primary">Run migration automatically</span>
+                    <span class="typography-text-xs-400 text-neutral-tertiary">Recommended when upgrading to a new version</span>
+                </span>
+                <span class="migration-switch">
+                    <input type="checkbox" id="run-migration" name="migrate" class="sr-only" checked>
+                    <span class="migration-switch-track" aria-hidden="true">
+                        <span class="migration-switch-thumb"></span>
+                    </span>
+                </span>
+            </label>
+
+            <div class="migration-hint">
+                <span class="migration-hint-icon">
+                    <?php include __DIR__ . '/../../icons/info.svg'; ?>
+                </span>
+                <span class="typography-text-xs-400 text-neutral-tertiary">
+                    To run manually later: <code class="migration-code">docker compose exec appwrite migrate</code>
+                </span>
+            </div>
+        </div>
+    </div>
+</div>

composer.json

@@ -73,7 +73,7 @@
         "utopia-php/locale": "0.8.*",
         "utopia-php/logger": "0.6.*",
         "utopia-php/messaging": "0.20.*",
-        "utopia-php/migration": "1.8.*",
+        "utopia-php/migration": "1.9.*",
         "utopia-php/platform": "0.7.*",
         "utopia-php/pools": "1.*",
         "utopia-php/span": "1.1.*",

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "f9225f2b580de0ccb796b2fb8c881384",
+    "content-hash": "b5261855586680e467168f527e0634ae",
     "packages": [
         {
             "name": "adhocore/jwt",
@@ -161,16 +161,16 @@
         },
         {
             "name": "appwrite/php-runtimes",
-            "version": "0.19.4",
+            "version": "0.19.5",
             "source": {
                 "type": "git",
                 "url": "https://github.com/appwrite/runtimes.git",
-                "reference": "eea9d1b3ca2540eab623b419c8afde09ef406c0b"
+                "reference": "aa2f7760cd0493c0880209b92df812c9386b3546"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/appwrite/runtimes/zipball/eea9d1b3ca2540eab623b419c8afde09ef406c0b",
-                "reference": "eea9d1b3ca2540eab623b419c8afde09ef406c0b",
+                "url": "https://api.github.com/repos/appwrite/runtimes/zipball/aa2f7760cd0493c0880209b92df812c9386b3546",
+                "reference": "aa2f7760cd0493c0880209b92df812c9386b3546",
                 "shasum": ""
             },
             "require": {
@@ -210,9 +210,9 @@
             ],
             "support": {
                 "issues": "https://github.com/appwrite/runtimes/issues",
-                "source": "https://github.com/appwrite/runtimes/tree/0.19.4"
+                "source": "https://github.com/appwrite/runtimes/tree/0.19.5"
             },
-            "time": "2026-02-17T10:04:39+00:00"
+            "time": "2026-04-01T01:39:23+00:00"
         },
         {
             "name": "brick/math",
@@ -4518,16 +4518,16 @@
         },
         {
             "name": "utopia-php/migration",
-            "version": "1.8.3",
+            "version": "1.9.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/utopia-php/migration.git",
-                "reference": "8633523b3343d492427331b6eec53f020f6ab7a7"
+                "reference": "7a86aeadf182b63a9f4ceba7e137588b31c5d2e2"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/utopia-php/migration/zipball/8633523b3343d492427331b6eec53f020f6ab7a7",
-                "reference": "8633523b3343d492427331b6eec53f020f6ab7a7",
+                "url": "https://api.github.com/repos/utopia-php/migration/zipball/7a86aeadf182b63a9f4ceba7e137588b31c5d2e2",
+                "reference": "7a86aeadf182b63a9f4ceba7e137588b31c5d2e2",
                 "shasum": ""
             },
             "require": {
@@ -4567,9 +4567,9 @@
             ],
             "support": {
                 "issues": "https://github.com/utopia-php/migration/issues",
-                "source": "https://github.com/utopia-php/migration/tree/1.8.3"
+                "source": "https://github.com/utopia-php/migration/tree/1.9.1"
             },
-            "time": "2026-03-19T09:18:47+00:00"
+            "time": "2026-03-25T07:05:27+00:00"
         },
         {
             "name": "utopia-php/mongo",

docs/references/health/get-queue-audits.md

@@ -1 +1 @@
-Get the number of audit logs that are waiting to be processed in the Appwrite internal queue server.
+Get the number of audit logs that are waiting to be processed in the Appwrite internal queue server.

phpstan.neon

@@ -3,6 +3,7 @@ includes:
 
 parameters:
   level: 3
+  tmpDir: .phpstan-cache
   paths:
     - src
     - app

src/Appwrite/Auth/OAuth2.php

@@ -155,7 +155,7 @@ abstract class OAuth2
     /**
      * @param string $code
      *
-     * @return string
+     * @return int
      */
     public function getAccessTokenExpiry(string $code): int
     {

src/Appwrite/Auth/OAuth2/Disqus.php

@@ -108,7 +108,7 @@ class Disqus extends OAuth2
     }
 
     /**
-     * @param string $token
+     * @param string $accessToken
      *
      * @return string
      */

src/Appwrite/Auth/Validator/PersonalData.php

@@ -33,7 +33,7 @@ class PersonalData extends Password
     /**
      * Is valid.
      *
-     * @param mixed $value
+     * @param mixed $password
      *
      * @return bool
      */

src/Appwrite/Detector/Detector.php

@@ -6,14 +6,8 @@ use DeviceDetector\DeviceDetector;
 
 class Detector
 {
-    /**
-     * @param string
-     */
     protected $userAgent = '';
 
-    /**
-     * @param DeviceDetector
-     */
     protected $detctor;
 
     /**

src/Appwrite/Docker/Compose.php

@@ -12,9 +12,6 @@ class Compose
      */
     protected $compose = [];
 
-    /**
-     * @var string $data
-     */
     public function __construct(string $data)
     {
         $this->compose = yaml_parse($data);

src/Appwrite/Docker/Compose/Service.php

@@ -11,9 +11,6 @@ class Service
      */
     protected $service = [];
 
-    /**
-     * @var string $path
-     */
     public function __construct(array $service)
     {
         $this->service = $service;

src/Appwrite/Docker/Env.php

@@ -9,9 +9,6 @@ class Env
      */
     protected $vars = [];
 
-    /**
-     * @var string $data
-     */
     public function __construct(string $data)
     {
         $data = explode("\n", $data);

src/Appwrite/Event/Mail.php

@@ -101,7 +101,8 @@ class Mail extends Event
     /**
      * Sets preview for the mail event.
      *
-     * @return string
+     * @param string $preview
+     * @return self
      */
     public function setPreview(string $preview): self
     {
@@ -115,7 +116,7 @@ class Mail extends Event
      *
      * @return string
      */
-    public function getPreview(string $preview): string
+    public function getPreview(): string
     {
         return $this->preview;
     }
@@ -181,7 +182,7 @@ class Mail extends Event
     /**
      * Set SMTP port
      *
-     * @param int port
+     * @param int $port
      * @return self
      */
     public function setSmtpPort(int $port): self
@@ -217,7 +218,7 @@ class Mail extends Event
     /**
      * Set SMTP secure
      *
-     * @param string $password
+     * @param string $secure
      * @return self
      */
     public function setSmtpSecure(string $secure): self

src/Appwrite/Event/Message/Usage.php

@@ -4,7 +4,7 @@ namespace Appwrite\Event\Message;
 
 use Utopia\Database\Document;
 
-class Usage extends Base
+final class Usage extends Base
 {
     /**
      * @param Document $project

src/Appwrite/Event/Messaging.php

@@ -86,7 +86,7 @@ class Messaging extends Event
     /**
      * Returns message document for the messaging event.
      *
-     * @return string
+     * @return Document
      */
     public function getMessage(): Document
     {
@@ -96,7 +96,7 @@ class Messaging extends Event
     /**
      * Sets message ID for the messaging event.
      *
-     * @param string $message
+     * @param string $messageId
      * @return self
      */
     public function setMessageId(string $messageId): self

src/Appwrite/Functions/EventProcessor.php

@@ -8,6 +8,18 @@ use Utopia\Database\Query;
 
 class EventProcessor
 {
+    /**
+     * @param array<mixed> $events
+     * @return array<string, bool>
+     */
+    private function getEventMap(array $events): array
+    {
+        return \array_fill_keys(
+            \array_map('strval', \array_unique($events)),
+            true
+        );
+    }
+
     /**
      * Get function events for a project, using Redis cache
      * @param Document|null $project
@@ -26,7 +38,7 @@ class EventProcessor
         $cacheKey = \sprintf(
             '%s-cache-%s:%s:%s:project:%s:functions:events',
             $dbForProject->getCacheName(),
-            $hostname ?? '',
+            $hostname,
             $dbForProject->getNamespace(),
             $dbForProject->getTenant(),
             $project->getId()
@@ -36,7 +48,9 @@ class EventProcessor
         $cachedFunctionEvents = $dbForProject->getCache()->load($cacheKey, $ttl);
 
         if ($cachedFunctionEvents !== false) {
-            return \json_decode($cachedFunctionEvents, true) ?? [];
+            $decoded = \json_decode($cachedFunctionEvents, true);
+
+            return \is_array($decoded) ? $this->getEventMap(\array_keys($decoded)) : [];
         }
 
         $events = [];
@@ -63,7 +77,7 @@ class EventProcessor
             }
         }
 
-        $uniqueEvents = \array_flip(\array_unique($events));
+        $uniqueEvents = $this->getEventMap($events);
         $dbForProject->getCache()->save($cacheKey, \json_encode($uniqueEvents));
 
         return $uniqueEvents;
@@ -97,6 +111,6 @@ class EventProcessor
             }
         }
 
-        return \array_flip(\array_unique($events));
+        return $this->getEventMap($events);
     }
 }

src/Appwrite/GraphQL/Schema.php

@@ -98,10 +98,9 @@ class Schema
             foreach ($routes as $route) {
                 /** @var Route $route */
 
-                /** @var \Appwrite\SDK\Method $sdk  */
                 $sdk = $route->getLabel('sdk', false);
 
-                if (empty($sdk)) {
+                if ($sdk === false) {
                     continue;
                 }
 
@@ -177,7 +176,7 @@ class Schema
                 $required = $attr['required'];
                 $default = $attr['default'];
                 $escapedKey = str_replace('$', '', $key);
-                $collections[$collectionId][$escapedKey] = [
+                $collections[$databaseId][$collectionId][$escapedKey] = [
                     'type' => Mapper::attribute(
                         $type,
                         $array,
@@ -187,80 +186,82 @@ class Schema
                 ];
             }
 
-            foreach ($collections as $collectionId => $attributes) {
-                $objectType = new ObjectType([
-                    'name' => $collectionId,
-                    'fields' => \array_merge(
-                        ["_id" => ['type' => Type::string()]],
-                        $attributes
-                    ),
-                ]);
-                $attributes = \array_merge(
-                    $attributes,
-                    Mapper::args('mutate')
-                );
-
-                $queryFields[$collectionId . 'Get'] = [
-                    'type' => $objectType,
-                    'args' => Mapper::args('id'),
-                    'resolve' => Resolvers::documentGet(
-                        $utopia,
-                        $databaseId,
-                        $collectionId,
-                        $urls['get'],
-                    )
-                ];
-                $queryFields[$collectionId . 'List'] = [
-                    'type' => Type::listOf($objectType),
-                    'args' => Mapper::args('list'),
-                    'resolve' => Resolvers::documentList(
-                        $utopia,
-                        $databaseId,
-                        $collectionId,
-                        $urls['list'],
-                        $params['list'],
-                    ),
-                    'complexity' => $complexity,
-                ];
-
-                $mutationFields[$collectionId . 'Create'] = [
-                    'type' => $objectType,
-                    'args' => $attributes,
-                    'resolve' => Resolvers::documentCreate(
-                        $utopia,
-                        $databaseId,
-                        $collectionId,
-                        $urls['create'],
-                        $params['create'],
-                    )
-                ];
-                $mutationFields[$collectionId . 'Update'] = [
-                    'type' => $objectType,
-                    'args' => \array_merge(
-                        Mapper::args('id'),
-                        \array_map(
-                            fn ($attr) => $attr['type'] = Type::getNullableType($attr['type']),
+            foreach ($collections as $databaseId => $databaseCollections) {
+                foreach ($databaseCollections as $collectionId => $attributes) {
+                    $objectType = new ObjectType([
+                        'name' => $collectionId,
+                        'fields' => \array_merge(
+                            ["_id" => ['type' => Type::string()]],
                             $attributes
+                        ),
+                    ]);
+                    $attributes = \array_merge(
+                        $attributes,
+                        Mapper::args('mutate')
+                    );
+
+                    $queryFields[$collectionId . 'Get'] = [
+                        'type' => $objectType,
+                        'args' => Mapper::args('id'),
+                        'resolve' => Resolvers::documentGet(
+                            $utopia,
+                            $databaseId,
+                            $collectionId,
+                            $urls['get'],
                         )
-                    ),
-                    'resolve' => Resolvers::documentUpdate(
-                        $utopia,
-                        $databaseId,
-                        $collectionId,
-                        $urls['update'],
-                        $params['update'],
-                    )
-                ];
-                $mutationFields[$collectionId . 'Delete'] = [
-                    'type' => Mapper::model('none'),
-                    'args' => Mapper::args('id'),
-                    'resolve' => Resolvers::documentDelete(
-                        $utopia,
-                        $databaseId,
-                        $collectionId,
-                        $urls['delete'],
-                    )
-                ];
+                    ];
+                    $queryFields[$collectionId . 'List'] = [
+                        'type' => Type::listOf($objectType),
+                        'args' => Mapper::args('list'),
+                        'resolve' => Resolvers::documentList(
+                            $utopia,
+                            $databaseId,
+                            $collectionId,
+                            $urls['list'],
+                            $params['list'],
+                        ),
+                        'complexity' => $complexity,
+                    ];
+
+                    $mutationFields[$collectionId . 'Create'] = [
+                        'type' => $objectType,
+                        'args' => $attributes,
+                        'resolve' => Resolvers::documentCreate(
+                            $utopia,
+                            $databaseId,
+                            $collectionId,
+                            $urls['create'],
+                            $params['create'],
+                        )
+                    ];
+                    $mutationFields[$collectionId . 'Update'] = [
+                        'type' => $objectType,
+                        'args' => \array_merge(
+                            Mapper::args('id'),
+                            \array_map(
+                                fn ($attr) => $attr['type'] = Type::getNullableType($attr['type']),
+                                $attributes
+                            )
+                        ),
+                        'resolve' => Resolvers::documentUpdate(
+                            $utopia,
+                            $databaseId,
+                            $collectionId,
+                            $urls['update'],
+                            $params['update'],
+                        )
+                    ];
+                    $mutationFields[$collectionId . 'Delete'] = [
+                        'type' => Mapper::model('none'),
+                        'args' => Mapper::args('id'),
+                        'resolve' => Resolvers::documentDelete(
+                            $utopia,
+                            $databaseId,
+                            $collectionId,
+                            $urls['delete'],
+                        )
+                    ];
+                }
             }
             $offset += $limit;
         }

src/Appwrite/GraphQL/Types.php

@@ -15,10 +15,13 @@ class Types
      *
      * @return Json
      */
-    public static function json(): Type
+    public static function json(): Json
     {
         if (Registry::has(Json::class)) {
-            return Registry::get(Json::class);
+            $type = Registry::get(Json::class);
+            if ($type instanceof Json) {
+                return $type;
+            }
         }
         $type = new Json();
         Registry::set(Json::class, $type);
@@ -28,12 +31,15 @@ class Types
     /**
      * Get the JSON type.
      *
-     * @return Json
+     * @return Assoc
      */
-    public static function assoc(): Type
+    public static function assoc(): Assoc
     {
         if (Registry::has(Assoc::class)) {
-            return Registry::get(Assoc::class);
+            $type = Registry::get(Assoc::class);
+            if ($type instanceof Assoc) {
+                return $type;
+            }
         }
         $type = new Assoc();
         Registry::set(Assoc::class, $type);
@@ -45,10 +51,13 @@ class Types
      *
      * @return InputFile
      */
-    public static function inputFile(): Type
+    public static function inputFile(): InputFile
     {
         if (Registry::has(InputFile::class)) {
-            return Registry::get(InputFile::class);
+            $type = Registry::get(InputFile::class);
+            if ($type instanceof InputFile) {
+                return $type;
+            }
         }
         $type = new InputFile();
         Registry::set(InputFile::class, $type);

src/Appwrite/GraphQL/Types/Mapper.php

@@ -101,16 +101,16 @@ class Mapper
 
                 if (\is_array($modelName)) {
                     foreach ($modelName as $name) {
-                        $models[] = static::$models[$name];
+                        $models[] = self::$models[$name];
                     }
                 } else {
-                    $models[] = static::$models[$modelName];
+                    $models[] = self::$models[$modelName];
                 }
             }
         } else {
             // If single response, get its model and wrap in array
             $modelName = $responses->getModel();
-            $models = [static::$models[$modelName]];
+            $models = [self::$models[$modelName]];
         }
 
         foreach ($models as $model) {
@@ -273,11 +273,9 @@ class Mapper
             case \Appwrite\Auth\Validator\Password::class:
             case \Appwrite\Event\Validator\Event::class:
             case \Appwrite\Event\Validator\FunctionEvent::class:
-            case \Appwrite\Network\Validator\CNAME::class:
             case \Utopia\Emails\Validator\Email::class:
             case \Appwrite\Network\Validator\Redirect::class:
             case \Appwrite\Network\Validator\DNS::class:
-            case \Appwrite\Network\Validator\Origin::class:
             case \Appwrite\Task\Validator\Cron::class:
             case \Appwrite\Utopia\Database\Validator\CustomId::class:
             case \Utopia\Database\Validator\Key::class:
@@ -286,7 +284,7 @@ class Mapper
             case \Utopia\Validator\HexColor::class:
             case \Utopia\Validator\Host::class:
             case \Utopia\Validator\IP::class:
-            case \Utopia\Validator\Origin::class:
+            case \Appwrite\Network\Validator\Origin::class:
             case \Utopia\Validator\Text::class:
             case \Utopia\Validator\URL::class:
             case \Utopia\Validator\WhiteList::class:
@@ -425,7 +423,7 @@ class Mapper
             'name' => $unionName,
             'types' => $types,
             'resolveType' => static function ($object) use ($unionName) {
-                return static::getUnionImplementation($unionName, $object);
+                return self::getUnionImplementation($unionName, $object);
             },
         ]);
 
@@ -440,11 +438,11 @@ class Mapper
 
         switch ($name) {
             case 'Attributes':
-                return static::getColumnImplementation($object);
+                return self::getColumnImplementation($object);
             case 'Columns':
-                return static::getColumnImplementation($object, true);
+                return self::getColumnImplementation($object, true);
             case 'HashOptions':
-                return static::getHashOptionsImplementation($object);
+                return self::getHashOptionsImplementation($object);
         }
 
         throw new Exception('Unknown union type: ' . $name);

src/Appwrite/Migration/Migration.php

@@ -13,6 +13,7 @@ use Utopia\Database\Exception\Limit;
 use Utopia\Database\Exception\Structure;
 use Utopia\Database\Helpers\ID;
 use Utopia\Database\PDO;
+use Utopia\Database\Query;
 use Utopia\Database\Validator\Authorization;
 
 abstract class Migration
@@ -204,6 +205,30 @@ abstract class Migration
         }
     }
 
+    /**
+     * @param array<Query> $queries
+     * @return \Generator<int, Document>
+     * @throws Exception
+     */
+    protected function documentsIterator(string $collection, array $queries = []): \Generator
+    {
+        $offset = 0;
+
+        do {
+            $documents = $this->dbForProject->find($collection, [
+                ...$queries,
+                Query::limit($this->limit),
+                Query::offset($offset),
+            ]);
+
+            foreach ($documents as $document) {
+                yield $document;
+            }
+
+            $offset += \count($documents);
+        } while (\count($documents) === $this->limit);
+    }
+
     /**
      * Creates collection from the config collection.
      *

src/Appwrite/Migration/Version/V15.php

@@ -1224,7 +1224,7 @@ class V15 extends Migration
      * @param \Utopia\Database\Document $document
      * @return \Utopia\Database\Document
      */
-    protected function fixDocument(Document $document)
+    protected function fixDocument(Document $document): Document
     {
         switch ($document->getCollection()) {
             case 'cache':
@@ -1234,7 +1234,7 @@ class V15 extends Migration
                  * skipping migration for 'cache' and 'variables'.
                  * 'users' already migrated.
                  */
-                return;
+                return $document;
 
             case '_metadata':
                 /**
@@ -1480,7 +1480,6 @@ class V15 extends Migration
      * Filter from the 'encrypt' filter.
      *
      * @param string $value
-     * @return string|false
      */
     protected function encryptFilter(string $value): string
     {
@@ -1492,8 +1491,8 @@ class V15 extends Migration
             'data' => OpenSSL::encrypt($value, OpenSSL::CIPHER_AES_128_GCM, $key, 0, $iv, $tag),
             'method' => OpenSSL::CIPHER_AES_128_GCM,
             'iv' => \bin2hex($iv),
-            'tag' => \bin2hex($tag ?? ''),
+            'tag' => \bin2hex($tag),
             'version' => '1',
-        ]);
+        ]) ?: '';
     }
 }

src/Appwrite/Migration/Version/V20.php

@@ -452,7 +452,7 @@ class V20 extends Migration
                 Query::equal('period', ['1d']),
             ]);
 
-            $value = $query ?? 0;
+            $value = $query;
             $this->createInfMetric($to, $value);
         }
 

src/Appwrite/Migration/Version/V24.php

@@ -187,6 +187,20 @@ class V24 extends Migration
                     $this->dbForProject->purgeCachedCollection($id);
                     break;
 
+                case 'users':
+                    try {
+                        $this->createAttributeFromCollection($this->dbForProject, $id, 'impersonator');
+                    } catch (Throwable $th) {
+                        Console::warning("Failed to create attribute \"impersonator\" in collection {$id}: {$th->getMessage()}");
+                    }
+                    try {
+                        $this->createIndexFromCollection($this->dbForProject, $id, 'impersonator');
+                    } catch (Throwable $th) {
+                        Console::warning("Failed to create index \"impersonator\" from {$id}: {$th->getMessage()}");
+                    }
+                    $this->dbForProject->purgeCachedCollection($id);
+                    break;
+
                 case 'teams':
                     try {
                         $this->createAttributeFromCollection($this->dbForProject, $id, 'labels');

src/Appwrite/Platform/Action.php

@@ -37,7 +37,7 @@ class Action extends UtopiaAction
      * Foreach Document
      * Call provided callback for each document in the collection
      *
-     * @param string $projectId
+     * @param Database $database
      * @param string $collection
      * @param array $queries
      * @param callable $callback

src/Appwrite/Platform/Installer/Http/Installer/Install.php

@@ -43,6 +43,7 @@ class Install extends Action
             ->param('database', '', new WhiteList(['mongodb', 'mariadb', 'postgresql']), 'Database adapter', true)
             ->param('installId', '', new Text(64, 0), 'Installation ID', true)
             ->param('retryStep', null, new Nullable(new WhiteList([Server::STEP_DOCKER_COMPOSE, Server::STEP_ENV_VARS, Server::STEP_DOCKER_CONTAINERS], true)), 'Retry from step', true)
+            ->param('migrate', false, new \Utopia\Validator\Boolean(true), 'Run database migration after upgrade', true)
             ->inject('request')
             ->inject('response')
             ->inject('swooleResponse')
@@ -64,6 +65,7 @@ class Install extends Action
         string $database,
         string $installId,
         ?string $retryStep,
+        bool $migrate,
         Request $request,
         Response $response,
         SwooleResponse $swooleResponse,
@@ -321,6 +323,28 @@ class Install extends Action
                 }
             };
 
+            $responseSent = false;
+            $onComplete = function () use ($wantsStream, $swooleResponse, $response, $installId, $state, &$responseSent) {
+                if ($responseSent) {
+                    return;
+                }
+                $responseSent = true;
+                $state->updateGlobalLock($installId, Server::STATUS_COMPLETED);
+                if ($wantsStream) {
+                    $this->writeSseEvent($swooleResponse, 'done', ['installId' => $installId, 'success' => true]);
+                    usleep(self::SSE_KEEPALIVE_DELAY_MICROSECONDS);
+                    $swooleResponse->write(": keepalive\n\n");
+                    usleep(self::SSE_KEEPALIVE_DELAY_MICROSECONDS);
+                    $swooleResponse->end();
+                } else {
+                    $response->json([
+                        'success' => true,
+                        'installId' => $installId,
+                        'message' => 'Installation completed successfully',
+                    ]);
+                }
+            };
+
             $installer->performInstallation(
                 $httpPort ?: $config->getDefaultHttpPort(),
                 $httpsPort ?: $config->getDefaultHttpsPort(),
@@ -331,23 +355,12 @@ class Install extends Action
                 $progress,
                 $retryStep,
                 $config->isUpgrade(),
-                $account
+                $account,
+                $onComplete,
+                $migrate,
             );
 
-            if ($wantsStream) {
-                $this->writeSseEvent($swooleResponse, 'done', ['installId' => $installId, 'success' => true]);
-                usleep(self::SSE_KEEPALIVE_DELAY_MICROSECONDS);
-                $swooleResponse->write(": keepalive\n\n");
-                usleep(self::SSE_KEEPALIVE_DELAY_MICROSECONDS);
-                $swooleResponse->end();
-            } else {
-                $response->json([
-                    'success' => true,
-                    'installId' => $installId,
-                    'message' => 'Installation completed successfully',
-                ]);
-            }
-            $state->updateGlobalLock($installId, Server::STATUS_COMPLETED);
+            $onComplete();
         } catch (\Throwable $e) {
             $this->handleInstallationError($e, $installId, $wantsStream, $response, $swooleResponse, $state);
         }

src/Appwrite/Platform/Installer/Http/Installer/View.php

@@ -24,7 +24,7 @@ class View extends Action
             ->setHttpMethod(Action::HTTP_REQUEST_METHOD_GET)
             ->setHttpPath('/')
             ->desc('Serve installer UI')
-            ->param('step', 1, new Integer(true), 'Step number (1-5)', true)
+            ->param('step', 1, new Integer(true), 'Step number (1-6)', true)
             ->param('partial', null, new Nullable(new Text(1, 0)), 'Render partial step only', true)
             ->inject('request')
             ->inject('response')
@@ -52,10 +52,13 @@ class View extends Action
             $defaultEmailCertificates = 'walterobrien@example.com';
         }
 
-        $step = max(1, min(5, $step));
+        $step = max(1, min(6, $step));
         if ($isUpgrade && ($step === 2 || $step === 3)) {
             $step = 4;
         }
+        if (!$isUpgrade && $step === 6) {
+            $step = 4;
+        }
 
         $partialFile = $paths['views'] . "/installer/templates/steps/step-{$step}.phtml";
         if (!is_file($partialFile)) {

src/Appwrite/Platform/Installer/Server.php

@@ -6,6 +6,7 @@ use Appwrite\Platform\Installer\Http\Installer\Error;
 use Appwrite\Platform\Installer\Runtime\Config;
 use Appwrite\Platform\Installer\Runtime\State;
 use Swoole\Http\Server as SwooleServer;
+use Swoole\Runtime;
 use Utopia\Http\Adapter\Swoole\Request;
 use Utopia\Http\Adapter\Swoole\Response;
 use Utopia\Http\Adapter\Swoole\Server as SwooleAdapter;
@@ -28,6 +29,7 @@ class Server
     public const string STEP_DOCKER_COMPOSE = 'docker-compose';
     public const string STEP_DOCKER_CONTAINERS = 'docker-containers';
     public const string STEP_ACCOUNT_SETUP = 'account-setup';
+    public const string STEP_MIGRATION = 'migration';
     public const string STEP_SSL_CERTIFICATE = 'ssl-certificate';
 
     public const string STATUS_IN_PROGRESS = 'in-progress';
@@ -129,6 +131,8 @@ class Server
 
     private function startSwooleServer(string $host, int $port, ?string $readyFile = null): void
     {
+        Runtime::enableCoroutine(SWOOLE_HOOK_ALL);
+
         $this->state->clearStaleLock();
 
         // Preload static files into memory

src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Attribute/Decrement.php

@@ -87,13 +87,14 @@ class Decrement extends Action
             ->inject('usage')
             ->inject('plan')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 
-    public function action(string $databaseId, string $collectionId, string $documentId, string $attribute, int|float $value, int|float|null $min, ?string $transactionId, UtopiaResponse $response, Database $dbForProject, callable $getDatabasesDB, Event $queueForEvents, Context $usage, array $plan, Authorization $authorization): void
+    public function action(string $databaseId, string $collectionId, string $documentId, string $attribute, int|float $value, int|float|null $min, ?string $transactionId, UtopiaResponse $response, Database $dbForProject, callable $getDatabasesDB, Event $queueForEvents, Context $usage, array $plan, Authorization $authorization, User $user): void
     {
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         $database = $authorization->skip(fn () => $dbForProject->getDocument('databases', $databaseId));
         if ($database->isEmpty()) {

src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Attribute/Increment.php

@@ -87,13 +87,14 @@ class Increment extends Action
             ->inject('usage')
             ->inject('plan')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 
-    public function action(string $databaseId, string $collectionId, string $documentId, string $attribute, int|float $value, int|float|null $max, ?string $transactionId, UtopiaResponse $response, Database $dbForProject, callable $getDatabasesDB, Event $queueForEvents, Context $usage, array $plan, Authorization $authorization): void
+    public function action(string $databaseId, string $collectionId, string $documentId, string $attribute, int|float $value, int|float|null $max, ?string $transactionId, UtopiaResponse $response, Database $dbForProject, callable $getDatabasesDB, Event $queueForEvents, Context $usage, array $plan, Authorization $authorization, User $user): void
     {
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         $database = $authorization->skip(fn () => $dbForProject->getDocument('databases', $databaseId));
         if ($database->isEmpty()) {

src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Create.php

@@ -139,7 +139,7 @@ class Create extends Action
             ->inject('eventProcessor')
             ->callback($this->action(...));
     }
-    public function action(string $databaseId, string $documentId, string $collectionId, string|array $data, ?array $permissions, ?array $documents, ?string $transactionId, UtopiaResponse $response, Database $dbForProject, callable $getDatabasesDB, Document $user, Event $queueForEvents, Context $usage, Event $queueForRealtime, Event $queueForFunctions, Event $queueForWebhooks, array $plan, Authorization $authorization, EventProcessor $eventProcessor): void
+    public function action(string $databaseId, string $documentId, string $collectionId, string|array $data, ?array $permissions, ?array $documents, ?string $transactionId, UtopiaResponse $response, Database $dbForProject, callable $getDatabasesDB, User $user, Event $queueForEvents, Context $usage, Event $queueForRealtime, Event $queueForFunctions, Event $queueForWebhooks, array $plan, Authorization $authorization, EventProcessor $eventProcessor): void
     {
         $data = \is_string($data)
             ? \json_decode($data, true)
@@ -183,8 +183,8 @@ class Create extends Action
             $documents = [$data];
         }
 
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         if ($isBulk && !$isAPIKey && !$isPrivilegedUser) {
             throw new Exception(Exception::GENERAL_UNAUTHORIZED_SCOPE);

src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Delete.php

@@ -85,6 +85,7 @@ class Delete extends Action
             ->inject('transactionState')
             ->inject('plan')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 
@@ -101,12 +102,13 @@ class Delete extends Action
         Context $usage,
         TransactionState $transactionState,
         array $plan,
-        Authorization $authorization
+        Authorization $authorization,
+        User $user
     ): void {
         $database = $authorization->skip(fn () => $dbForProject->getDocument('databases', $databaseId));
 
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         if ($database->isEmpty() || (!$database->getAttribute('enabled', false) && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::DATABASE_NOT_FOUND, params: [$databaseId]);

src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Get.php

@@ -72,13 +72,14 @@ class Get extends Action
             ->inject('usage')
             ->inject('transactionState')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 
-    public function action(string $databaseId, string $collectionId, string $documentId, array $queries, ?string $transactionId, UtopiaResponse $response, Database $dbForProject, callable $getDatabasesDB, Context $usage, TransactionState $transactionState, Authorization $authorization): void
+    public function action(string $databaseId, string $collectionId, string $documentId, array $queries, ?string $transactionId, UtopiaResponse $response, Database $dbForProject, callable $getDatabasesDB, Context $usage, TransactionState $transactionState, Authorization $authorization, User $user): void
     {
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         $database = $authorization->skip(fn () => $dbForProject->getDocument('databases', $databaseId));
         if ($database->isEmpty() || (!$database->getAttribute('enabled', false) && !$isAPIKey && !$isPrivilegedUser)) {

src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Update.php

@@ -89,10 +89,11 @@ class Update extends Action
             ->inject('transactionState')
             ->inject('plan')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 
-    public function action(string $databaseId, string $collectionId, string $documentId, string|array $data, ?array $permissions, ?string $transactionId, ?\DateTime $requestTimestamp, UtopiaResponse $response, Database $dbForProject, callable $getDatabasesDB, Event $queueForEvents, Context $usage, TransactionState $transactionState, array $plan, Authorization $authorization): void
+    public function action(string $databaseId, string $collectionId, string $documentId, string|array $data, ?array $permissions, ?string $transactionId, ?\DateTime $requestTimestamp, UtopiaResponse $response, Database $dbForProject, callable $getDatabasesDB, Event $queueForEvents, Context $usage, TransactionState $transactionState, array $plan, Authorization $authorization, User $user): void
     {
         $data = (\is_string($data)) ? \json_decode($data, true) : $data; // Cast to JSON array
 
@@ -102,8 +103,8 @@ class Update extends Action
 
         $database = $authorization->skip(fn () => $dbForProject->getDocument('databases', $databaseId));
 
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         if ($database->isEmpty() || (!$database->getAttribute('enabled', false) && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::DATABASE_NOT_FOUND, params: [$databaseId]);

src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/Upsert.php

@@ -96,7 +96,7 @@ class Upsert extends Action
             ->callback($this->action(...));
     }
 
-    public function action(string $databaseId, string $collectionId, string $documentId, string|array $data, ?array $permissions, ?string $transactionId, ?\DateTime $requestTimestamp, UtopiaResponse $response, Document $user, Database $dbForProject, callable $getDatabasesDB, Event $queueForEvents, Context $usage, TransactionState $transactionState, array $plan, Authorization $authorization): void
+    public function action(string $databaseId, string $collectionId, string $documentId, string|array $data, ?array $permissions, ?string $transactionId, ?\DateTime $requestTimestamp, UtopiaResponse $response, User $user, Database $dbForProject, callable $getDatabasesDB, Event $queueForEvents, Context $usage, TransactionState $transactionState, array $plan, Authorization $authorization): void
     {
         $data = (\is_string($data)) ? \json_decode($data, true) : $data; // Cast to JSON array
 
@@ -108,8 +108,8 @@ class Upsert extends Action
             throw new Exception($this->getMissingPayloadException());
         }
 
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         $database = $authorization->skip(fn () => $dbForProject->getDocument('databases', $databaseId));
         if ($database->isEmpty() || (!$database->getAttribute('enabled', false) && !$isAPIKey && !$isPrivilegedUser)) {

src/Appwrite/Platform/Modules/Databases/Http/Databases/Collections/Documents/XList.php

@@ -83,10 +83,10 @@ class XList extends Action
             ->callback($this->action(...));
     }
 
-    public function action(string $databaseId, string $collectionId, array $queries, ?string $transactionId, bool $includeTotal, int $ttl, UtopiaResponse $response, Database $dbForProject, Document $user, callable $getDatabasesDB, Context $usage, TransactionState $transactionState, Authorization $authorization): void
+    public function action(string $databaseId, string $collectionId, array $queries, ?string $transactionId, bool $includeTotal, int $ttl, UtopiaResponse $response, Database $dbForProject, User $user, callable $getDatabasesDB, Context $usage, TransactionState $transactionState, Authorization $authorization): void
     {
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         $database = $authorization->skip(fn () => $dbForProject->getDocument('databases', $databaseId));
         if ($database->isEmpty() || (!$database->getAttribute('enabled', false) && !$isAPIKey && !$isPrivilegedUser)) {

src/Appwrite/Platform/Modules/Databases/Http/Databases/Transactions/Operations/Create.php

@@ -65,17 +65,18 @@ class Create extends Action
             ->inject('transactionState')
             ->inject('plan')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 
-    public function action(string $transactionId, array $operations, UtopiaResponse $response, Database $dbForProject, TransactionState $transactionState, array $plan, Authorization $authorization): void
+    public function action(string $transactionId, array $operations, UtopiaResponse $response, Database $dbForProject, TransactionState $transactionState, array $plan, Authorization $authorization, User $user): void
     {
         if (empty($operations)) {
             throw new Exception(Exception::GENERAL_BAD_REQUEST, 'Operations array cannot be empty');
         }
 
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         // API keys and admins can read any transaction, regular users need permissions
         $transaction = ($isAPIKey || $isPrivilegedUser)

src/Appwrite/Platform/Modules/Databases/Http/Databases/Transactions/Update.php

@@ -91,7 +91,7 @@ class Update extends Action
      * @param UtopiaResponse $response
      * @param Database $dbForProject
      * @param callable $getDatabasesDB
-     * @param Document $user
+     * @param User $user
      * @param TransactionState $transactionState
      * @param Delete $queueForDeletes
      * @param Event $queueForEvents
@@ -109,7 +109,7 @@ class Update extends Action
      * @throws Structure
      * @throws \Utopia\Http\Exception
      */
-    public function action(string $transactionId, bool $commit, bool $rollback, Document $project, UtopiaResponse $response, Database $dbForProject, callable $getDatabasesDB, Document $user, TransactionState $transactionState, Delete $queueForDeletes, Event $queueForEvents, Context $usage, Event $queueForRealtime, Event $queueForFunctions, Event $queueForWebhooks, Authorization $authorization, EventProcessor $eventProcessor): void
+    public function action(string $transactionId, bool $commit, bool $rollback, Document $project, UtopiaResponse $response, Database $dbForProject, callable $getDatabasesDB, User $user, TransactionState $transactionState, Delete $queueForDeletes, Event $queueForEvents, Context $usage, Event $queueForRealtime, Event $queueForFunctions, Event $queueForWebhooks, Authorization $authorization, EventProcessor $eventProcessor): void
     {
         if (!$commit && !$rollback) {
             throw new Exception(Exception::GENERAL_BAD_REQUEST, 'Either commit or rollback must be true');
@@ -118,8 +118,8 @@ class Update extends Action
             throw new Exception(Exception::GENERAL_BAD_REQUEST, 'Cannot commit and rollback at the same time');
         }
 
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         $transaction = ($isAPIKey || $isPrivilegedUser)
             ? $authorization->skip(fn () => $dbForProject->getDocument('transactions', $transactionId))

src/Appwrite/Platform/Modules/Databases/Http/DocumentsDB/Collections/Documents/Attribute/Decrement.php

@@ -68,6 +68,7 @@ class Decrement extends DecrementDocumentAttribute
             ->inject('usage')
             ->inject('plan')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 }

src/Appwrite/Platform/Modules/Databases/Http/DocumentsDB/Collections/Documents/Attribute/Increment.php

@@ -68,6 +68,7 @@ class Increment extends IncrementDocumentAttribute
             ->inject('usage')
             ->inject('plan')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 }

src/Appwrite/Platform/Modules/Databases/Http/DocumentsDB/Collections/Documents/Delete.php

@@ -71,6 +71,7 @@ class Delete extends DocumentDelete
             ->inject('transactionState')
             ->inject('plan')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 }

src/Appwrite/Platform/Modules/Databases/Http/DocumentsDB/Collections/Documents/Get.php

@@ -59,6 +59,7 @@ class Get extends DocumentGet
             ->inject('usage')
             ->inject('transactionState')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 }

src/Appwrite/Platform/Modules/Databases/Http/DocumentsDB/Collections/Documents/Update.php

@@ -70,6 +70,7 @@ class Update extends DocumentUpdate
             ->inject('transactionState')
             ->inject('plan')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 }

src/Appwrite/Platform/Modules/Databases/Http/DocumentsDB/Collections/Indexes/Create.php

@@ -58,7 +58,7 @@ class Create extends IndexCreate
             ->param('databaseId', '', fn (Database $dbForProject) => new UID($dbForProject->getAdapter()->getMaxUIDLength()), 'Database ID.', false, ['dbForProject'])
             ->param('collectionId', '', fn (Database $dbForProject) => new UID($dbForProject->getAdapter()->getMaxUIDLength()), 'Collection ID. You can create a new collection using the Database service [server integration](https://appwrite.io/docs/server/databases#databasesCreateCollection).', false, ['dbForProject'])
             ->param('key', null, fn (Database $dbForProject) => new Key(false, $dbForProject->getAdapter()->getMaxUIDLength()), 'Index Key.', false, ['dbForProject'])
-            ->param('type', null, new WhiteList([Database::INDEX_KEY, Database::INDEX_FULLTEXT, Database::INDEX_UNIQUE, Database::INDEX_SPATIAL]), 'Index type.')
+            ->param('type', null, new WhiteList([Database::INDEX_KEY, Database::INDEX_FULLTEXT, Database::INDEX_UNIQUE]), 'Index type.')
             ->param('attributes', null, fn (Database $dbForProject) => new ArrayList(new Key(true, $dbForProject->getAdapter()->getMaxUIDLength()), APP_LIMIT_ARRAY_PARAMS_SIZE), 'Array of attributes to index. Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' attributes are allowed, each 32 characters long.', false, ['dbForProject'])
             ->param('orders', [], new ArrayList(new WhiteList(['ASC', 'DESC'], false, Database::VAR_STRING), APP_LIMIT_ARRAY_PARAMS_SIZE), 'Array of index orders. Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' orders are allowed.', true)
             ->param('lengths', [], new ArrayList(new Nullable(new Integer()), APP_LIMIT_ARRAY_PARAMS_SIZE), 'Length of index. Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE, optional: true)

src/Appwrite/Platform/Modules/Databases/Http/DocumentsDB/Transactions/Operations/Create.php

@@ -55,6 +55,7 @@ class Create extends OperationsCreate
             ->inject('transactionState')
             ->inject('plan')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 }

src/Appwrite/Platform/Modules/Databases/Http/TablesDB/Tables/Rows/Column/Decrement.php

@@ -70,6 +70,7 @@ class Decrement extends DecrementDocumentAttribute
             ->inject('usage')
             ->inject('plan')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 }

src/Appwrite/Platform/Modules/Databases/Http/TablesDB/Tables/Rows/Column/Increment.php

@@ -70,6 +70,7 @@ class Increment extends IncrementDocumentAttribute
             ->inject('usage')
             ->inject('plan')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 }

src/Appwrite/Platform/Modules/Databases/Http/TablesDB/Tables/Rows/Delete.php

@@ -73,6 +73,7 @@ class Delete extends DocumentDelete
             ->inject('transactionState')
             ->inject('plan')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 }

src/Appwrite/Platform/Modules/Databases/Http/TablesDB/Tables/Rows/Get.php

@@ -61,6 +61,7 @@ class Get extends DocumentGet
             ->inject('usage')
             ->inject('transactionState')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 }

src/Appwrite/Platform/Modules/Databases/Http/TablesDB/Tables/Rows/Update.php

@@ -71,6 +71,7 @@ class Update extends DocumentUpdate
             ->inject('transactionState')
             ->inject('plan')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 }

src/Appwrite/Platform/Modules/Databases/Http/TablesDB/Transactions/Operations/Create.php

@@ -56,6 +56,7 @@ class Create extends OperationsCreate
             ->inject('transactionState')
             ->inject('plan')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 }

src/Appwrite/Platform/Modules/Databases/Http/VectorsDB/Collections/Documents/Delete.php

@@ -71,6 +71,7 @@ class Delete extends DocumentDelete
             ->inject('transactionState')
             ->inject('plan')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 }

src/Appwrite/Platform/Modules/Databases/Http/VectorsDB/Collections/Documents/Get.php

@@ -59,6 +59,7 @@ class Get extends DocumentGet
             ->inject('usage')
             ->inject('transactionState')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 }

src/Appwrite/Platform/Modules/Databases/Http/VectorsDB/Collections/Documents/Update.php

@@ -70,6 +70,7 @@ class Update extends DocumentUpdate
             ->inject('transactionState')
             ->inject('plan')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 }

src/Appwrite/Platform/Modules/Databases/Http/VectorsDB/Transactions/Operations/Create.php

@@ -55,6 +55,7 @@ class Create extends OperationsCreate
             ->inject('transactionState')
             ->inject('plan')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 }

src/Appwrite/Platform/Modules/Functions/Http/Deployments/Download/Get.php

@@ -88,16 +88,11 @@ class Get extends Action
             throw new Exception(Exception::DEPLOYMENT_NOT_FOUND);
         }
 
-        switch ($type) {
-            case 'output':
-                $path = $deployment->getAttribute('buildPath', '');
-                $device = $deviceForBuilds;
-                break;
-            case 'source':
-                $path = $deployment->getAttribute('sourcePath', '');
-                $device = $deviceForFunctions;
-                break;
-        }
+        [$path, $device] = match ($type) {
+            'output' => [$deployment->getAttribute('buildPath', ''), $deviceForBuilds],
+            'source' => [$deployment->getAttribute('sourcePath', ''), $deviceForFunctions],
+            default => throw new Exception(Exception::GENERAL_ARGUMENT_INVALID, 'Invalid deployment download type.'),
+        };
 
         if (!$device->exists($path)) {
             throw new Exception(Exception::DEPLOYMENT_NOT_FOUND);

src/Appwrite/Platform/Modules/Functions/Http/Executions/Create.php

@@ -119,7 +119,7 @@ class Create extends Base
         Document $project,
         Database $dbForProject,
         Database $dbForPlatform,
-        Document $user,
+        User $user,
         Event $queueForEvents,
         Context $usage,
         Func $queueForFunctions,
@@ -171,8 +171,8 @@ class Create extends Base
         /* @var Document $function */
         $function = $authorization->skip(fn () => $dbForProject->getDocument('functions', $functionId));
 
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         if ($function->isEmpty() || (!$function->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::FUNCTION_NOT_FOUND);

src/Appwrite/Platform/Modules/Functions/Http/Executions/Get.php

@@ -53,6 +53,7 @@ class Get extends Base
             ->inject('response')
             ->inject('dbForProject')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 
@@ -61,12 +62,13 @@ class Get extends Base
         string $executionId,
         Response $response,
         Database $dbForProject,
-        Authorization $authorization
+        Authorization $authorization,
+        User $user
     ) {
         $function = $authorization->skip(fn () => $dbForProject->getDocument('functions', $functionId));
 
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         if ($function->isEmpty() || (!$function->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::FUNCTION_NOT_FOUND);

src/Appwrite/Platform/Modules/Functions/Http/Executions/XList.php

@@ -62,6 +62,7 @@ class XList extends Base
             ->inject('response')
             ->inject('dbForProject')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 
@@ -71,12 +72,13 @@ class XList extends Base
         bool $includeTotal,
         Response $response,
         Database $dbForProject,
-        Authorization $authorization
+        Authorization $authorization,
+        User $user
     ) {
         $function = $authorization->skip(fn () => $dbForProject->getDocument('functions', $functionId));
 
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         if ($function->isEmpty() || (!$function->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::FUNCTION_NOT_FOUND);

src/Appwrite/Platform/Modules/Functions/Http/Functions/Update.php

@@ -170,8 +170,6 @@ class Update extends Base
             $runtime = $function->getAttribute('runtime');
         }
 
-        $enabled ??= $function->getAttribute('enabled', true);
-
         $repositoryId = $function->getAttribute('repositoryId', '');
         $repositoryInternalId = $function->getAttribute('repositoryInternalId', '');
 

src/Appwrite/Platform/Modules/Sites/Http/Deployments/Download/Get.php

@@ -87,16 +87,11 @@ class Get extends Action
             throw new Exception(Exception::DEPLOYMENT_NOT_FOUND);
         }
 
-        switch ($type) {
-            case 'output':
-                $path = $deployment->getAttribute('buildPath', '');
-                $device = $deviceForBuilds;
-                break;
-            case 'source':
-                $path = $deployment->getAttribute('sourcePath', '');
-                $device = $deviceForSites;
-                break;
-        }
+        [$path, $device] = match ($type) {
+            'output' => [$deployment->getAttribute('buildPath', ''), $deviceForBuilds],
+            'source' => [$deployment->getAttribute('sourcePath', ''), $deviceForSites],
+            default => throw new Exception(Exception::GENERAL_ARGUMENT_INVALID, 'Invalid deployment download type.'),
+        };
 
         if (!$device->exists($path)) {
             throw new Exception(Exception::DEPLOYMENT_NOT_FOUND);

src/Appwrite/Platform/Modules/Sites/Http/Sites/Update.php

@@ -172,8 +172,6 @@ class Update extends Base
             $framework = $site->getAttribute('framework');
         }
 
-        $enabled ??= $site->getAttribute('enabled', true);
-
         $repositoryId = $site->getAttribute('repositoryId', '');
         $repositoryInternalId = $site->getAttribute('repositoryInternalId', '');
 

src/Appwrite/Platform/Modules/Storage/Http/Buckets/Files/Create.php

@@ -103,7 +103,7 @@ class Create extends Action
         Request $request,
         Response $response,
         Database $dbForProject,
-        Document $user,
+        User $user,
         Event $queueForEvents,
         string $mode,
         Device $deviceForFiles,
@@ -112,8 +112,8 @@ class Create extends Action
     ) {
         $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);

src/Appwrite/Platform/Modules/Storage/Http/Buckets/Files/Delete.php

@@ -66,6 +66,7 @@ class Delete extends Action
             ->inject('deviceForFiles')
             ->inject('queueForDeletes')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 
@@ -77,12 +78,13 @@ class Delete extends Action
         Event $queueForEvents,
         Device $deviceForFiles,
         DeleteEvent $queueForDeletes,
-        Authorization $authorization
+        Authorization $authorization,
+        User $user
     ) {
         $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);

src/Appwrite/Platform/Modules/Storage/Http/Buckets/Files/Download/Get.php

@@ -70,6 +70,7 @@ class Get extends Action
             ->inject('resourceToken')
             ->inject('deviceForFiles')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 
@@ -84,12 +85,13 @@ class Get extends Action
         Document $resourceToken,
         Device $deviceForFiles,
         Authorization $authorization,
+        User $user,
     ) {
         /* @type Document $bucket */
         $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);

src/Appwrite/Platform/Modules/Storage/Http/Buckets/Files/Get.php

@@ -51,6 +51,7 @@ class Get extends Action
             ->inject('response')
             ->inject('dbForProject')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 
@@ -59,12 +60,13 @@ class Get extends Action
         string $fileId,
         Response $response,
         Database $dbForProject,
-        Authorization $authorization
+        Authorization $authorization,
+        User $user
     ) {
         $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);

src/Appwrite/Platform/Modules/Storage/Http/Buckets/Files/Preview/Get.php

@@ -92,6 +92,7 @@ class Get extends Action
             ->inject('deviceForLocal')
             ->inject('project')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 
@@ -117,7 +118,8 @@ class Get extends Action
         Device $deviceForFiles,
         Device $deviceForLocal,
         Document $project,
-        Authorization $authorization
+        Authorization $authorization,
+        User $user
     ) {
 
         if (!\extension_loaded('imagick')) {
@@ -127,8 +129,8 @@ class Get extends Action
         /* @type Document $bucket */
         $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
@@ -271,7 +273,7 @@ class Get extends Action
         $contentType = (\array_key_exists($output, $outputs)) ? $outputs[$output] : $outputs['jpg'];
 
         //Do not update transformedAt if it's a console user
-        if (!User::isPrivileged($authorization->getRoles())) {
+        if (!$user->isPrivileged($authorization->getRoles())) {
             $transformedAt = $file->getAttribute('transformedAt', '');
             if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_PROJECT_ACCESS)) > $transformedAt) {
                 $file->setAttribute('transformedAt', DateTime::now());

src/Appwrite/Platform/Modules/Storage/Http/Buckets/Files/Push/Get.php

@@ -52,6 +52,7 @@ class Get extends Action
             ->inject('mode')
             ->inject('deviceForFiles')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 
@@ -66,7 +67,8 @@ class Get extends Action
         Document $project,
         string $mode,
         Device $deviceForFiles,
-        Authorization $authorization
+        Authorization $authorization,
+        User $user
     ) {
         $decoder = new JWT(System::getEnv('_APP_OPENSSL_KEY_V1'), 'HS256', 3600, 0);
 
@@ -88,8 +90,8 @@ class Get extends Action
         $disposition = $decoded['disposition'] ?? 'inline';
         $dbForProject = $isInternal ? $dbForPlatform : $dbForProject;
 
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {

src/Appwrite/Platform/Modules/Storage/Http/Buckets/Files/Update.php

@@ -64,6 +64,7 @@ class Update extends Action
             ->inject('dbForProject')
             ->inject('queueForEvents')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 
@@ -75,12 +76,13 @@ class Update extends Action
         Response $response,
         Database $dbForProject,
         Event $queueForEvents,
-        Authorization $authorization
+        Authorization $authorization,
+        User $user
     ) {
         $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
@@ -108,7 +110,7 @@ class Update extends Action
 
         // Users can only manage their own roles, API keys and Admin users can manage any
         $roles = $authorization->getRoles();
-        if (!User::isApp($roles) && !User::isPrivileged($roles) && !\is_null($permissions)) {
+        if (!$user->isApp($roles) && !$user->isPrivileged($roles) && !\is_null($permissions)) {
             foreach (Database::PERMISSIONS as $type) {
                 foreach ($permissions as $permission) {
                     $permission = Permission::parse($permission);

src/Appwrite/Platform/Modules/Storage/Http/Buckets/Files/View/Get.php

@@ -71,6 +71,7 @@ class Get extends Action
             ->inject('resourceToken')
             ->inject('deviceForFiles')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 
@@ -84,13 +85,14 @@ class Get extends Action
         string $mode,
         Document $resourceToken,
         Device $deviceForFiles,
-        Authorization $authorization
+        Authorization $authorization,
+        User $user
     ) {
         /* @type Document $bucket */
         $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);

src/Appwrite/Platform/Modules/Storage/Http/Buckets/Files/XList.php

@@ -63,6 +63,7 @@ class XList extends Action
             ->inject('dbForProject')
             ->inject('mode')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 
@@ -74,12 +75,13 @@ class XList extends Action
         Response $response,
         Database $dbForProject,
         string $mode,
-        Authorization $authorization
+        Authorization $authorization,
+        User $user
     ) {
         $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAPIKey = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);

src/Appwrite/Platform/Modules/Storage/Http/Buckets/Update.php

@@ -99,12 +99,8 @@ class Update extends Action
 
         $permissions ??= $bucket->getPermissions();
         $maximumFileSize ??= $bucket->getAttribute('maximumFileSize', (int) System::getEnv('_APP_STORAGE_LIMIT', 0));
-        $allowedFileExtensions ??= $bucket->getAttribute('allowedFileExtensions', []);
-        $enabled ??= $bucket->getAttribute('enabled', true);
         $encryption ??= $bucket->getAttribute('encryption', true);
-        $antivirus ??= $bucket->getAttribute('antivirus', true);
         $compression ??= $bucket->getAttribute('compression', Compression::NONE);
-        $transformations ??= $bucket->getAttribute('transformations', true);
 
         // Map aggregate permissions into the multiple permissions they represent.
         $permissions = Permission::aggregate($permissions);

src/Appwrite/Platform/Modules/Teams/Http/Memberships/Create.php

@@ -98,10 +98,10 @@ class Create extends Action
             ->callback($this->action(...));
     }
 
-    public function action(string $teamId, string $email, string $userId, string $phone, array $roles, string $url, string $name, Response $response, Document $project, Document $user, Database $dbForProject, Authorization $authorization, Locale $locale, Mail $queueForMails, Messaging $queueForMessaging, Event $queueForEvents, callable $timelimit, Context $usage, array $plan, Password $proofForPassword, Token $proofForToken)
+    public function action(string $teamId, string $email, string $userId, string $phone, array $roles, string $url, string $name, Response $response, Document $project, User $user, Database $dbForProject, Authorization $authorization, Locale $locale, Mail $queueForMails, Messaging $queueForMessaging, Event $queueForEvents, callable $timelimit, Context $usage, array $plan, Password $proofForPassword, Token $proofForToken)
     {
-        $isAppUser = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAppUser = $user->isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
 
         if (empty($url)) {
             if (! $isAppUser && ! $isPrivilegedUser) {

src/Appwrite/Platform/Modules/Teams/Http/Memberships/Get.php

@@ -52,10 +52,11 @@ class Get extends Action
             ->inject('project')
             ->inject('dbForProject')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 
-    public function action(string $teamId, string $membershipId, Response $response, Document $project, Database $dbForProject, Authorization $authorization)
+    public function action(string $teamId, string $membershipId, Response $response, Document $project, Database $dbForProject, Authorization $authorization, User $user)
     {
         $team = $dbForProject->getDocument('teams', $teamId);
 
@@ -76,25 +77,25 @@ class Get extends Action
         ];
 
         $roles = $authorization->getRoles();
-        $isPrivilegedUser = User::isPrivileged($roles);
-        $isAppUser = User::isApp($roles);
+        $isPrivilegedUser = $user->isPrivileged($roles);
+        $isAppUser = $user->isApp($roles);
 
         $membershipsPrivacy = array_map(function ($privacy) use ($isPrivilegedUser, $isAppUser) {
             return $privacy || $isPrivilegedUser || $isAppUser;
         }, $membershipsPrivacy);
 
-        $user = !empty(array_filter($membershipsPrivacy))
+        $memberUser = !empty(array_filter($membershipsPrivacy))
             ? $dbForProject->getDocument('users', $membership->getAttribute('userId'))
             : new Document();
 
         if ($membershipsPrivacy['mfa']) {
-            $mfa = $user->getAttribute('mfa', false);
+            $mfa = $memberUser->getAttribute('mfa', false);
 
             if ($mfa) {
-                $totp = TOTP::getAuthenticatorFromUser($user);
+                $totp = TOTP::getAuthenticatorFromUser($memberUser);
                 $totpEnabled = $totp && $totp->getAttribute('verified', false);
-                $emailEnabled = $user->getAttribute('email', false) && $user->getAttribute('emailVerification', false);
-                $phoneEnabled = $user->getAttribute('phone', false) && $user->getAttribute('phoneVerification', false);
+                $emailEnabled = $memberUser->getAttribute('email', false) && $memberUser->getAttribute('emailVerification', false);
+                $phoneEnabled = $memberUser->getAttribute('phone', false) && $memberUser->getAttribute('phoneVerification', false);
 
                 if (!$totpEnabled && !$emailEnabled && !$phoneEnabled) {
                     $mfa = false;
@@ -105,11 +106,11 @@ class Get extends Action
         }
 
         if ($membershipsPrivacy['userName']) {
-            $membership->setAttribute('userName', $user->getAttribute('name'));
+            $membership->setAttribute('userName', $memberUser->getAttribute('name'));
         }
 
         if ($membershipsPrivacy['userEmail']) {
-            $membership->setAttribute('userEmail', $user->getAttribute('email'));
+            $membership->setAttribute('userEmail', $memberUser->getAttribute('email'));
         }
 
         $membership->setAttribute('teamName', $team->getAttribute('name'));

src/Appwrite/Platform/Modules/Teams/Http/Memberships/Update.php

@@ -66,7 +66,7 @@ class Update extends Action
             ->callback($this->action(...));
     }
 
-    public function action(string $teamId, string $membershipId, array $roles, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Authorization $authorization, Event $queueForEvents)
+    public function action(string $teamId, string $membershipId, array $roles, Request $request, Response $response, User $user, Document $project, Database $dbForProject, Authorization $authorization, Event $queueForEvents)
     {
         $team = $dbForProject->getDocument('teams', $teamId);
         if ($team->isEmpty()) {
@@ -83,8 +83,8 @@ class Update extends Action
             throw new Exception(Exception::USER_NOT_FOUND);
         }
 
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
-        $isAppUser = User::isApp($authorization->getRoles());
+        $isPrivilegedUser = $user->isPrivileged($authorization->getRoles());
+        $isAppUser = $user->isApp($authorization->getRoles());
         $isOwner = $authorization->hasRole('team:' . $team->getId() . '/owner');
 
         if ($project->getId() === 'console') {

src/Appwrite/Platform/Modules/Teams/Http/Memberships/XList.php

@@ -61,10 +61,11 @@ class XList extends Action
             ->inject('project')
             ->inject('dbForProject')
             ->inject('authorization')
+            ->inject('user')
             ->callback($this->action(...));
     }
 
-    public function action(string $teamId, array $queries, string $search, bool $includeTotal, Response $response, Document $project, Database $dbForProject, Authorization $authorization)
+    public function action(string $teamId, array $queries, string $search, bool $includeTotal, Response $response, Document $project, Database $dbForProject, Authorization $authorization, User $user)
     {
         $team = $dbForProject->getDocument('teams', $teamId);
 
@@ -129,26 +130,26 @@ class XList extends Action
         ];
 
         $roles = $authorization->getRoles();
-        $isPrivilegedUser = User::isPrivileged($roles);
-        $isAppUser = User::isApp($roles);
+        $isPrivilegedUser = $user->isPrivileged($roles);
+        $isAppUser = $user->isApp($roles);
 
         $membershipsPrivacy = array_map(function ($privacy) use ($isPrivilegedUser, $isAppUser) {
             return $privacy || $isPrivilegedUser || $isAppUser;
         }, $membershipsPrivacy);
 
         $memberships = array_map(function ($membership) use ($dbForProject, $team, $membershipsPrivacy) {
-            $user = !empty(array_filter($membershipsPrivacy))
+            $memberUser = !empty(array_filter($membershipsPrivacy))
                 ? $dbForProject->getDocument('users', $membership->getAttribute('userId'))
                 : new Document();
 
             if ($membershipsPrivacy['mfa']) {
-                $mfa = $user->getAttribute('mfa', false);
+                $mfa = $memberUser->getAttribute('mfa', false);
 
                 if ($mfa) {
-                    $totp = TOTP::getAuthenticatorFromUser($user);
+                    $totp = TOTP::getAuthenticatorFromUser($memberUser);
                     $totpEnabled = $totp && $totp->getAttribute('verified', false);
-                    $emailEnabled = $user->getAttribute('email', false) && $user->getAttribute('emailVerification', false);
-                    $phoneEnabled = $user->getAttribute('phone', false) && $user->getAttribute('phoneVerification', false);
+                    $emailEnabled = $memberUser->getAttribute('email', false) && $memberUser->getAttribute('emailVerification', false);
+                    $phoneEnabled = $memberUser->getAttribute('phone', false) && $memberUser->getAttribute('phoneVerification', false);
 
                     if (!$totpEnabled && !$emailEnabled && !$phoneEnabled) {
                         $mfa = false;
@@ -159,11 +160,11 @@ class XList extends Action
             }
 
             if ($membershipsPrivacy['userName']) {
-                $membership->setAttribute('userName', $user->getAttribute('name'));
+                $membership->setAttribute('userName', $memberUser->getAttribute('name'));
             }
 
             if ($membershipsPrivacy['userEmail']) {
-                $membership->setAttribute('userEmail', $user->getAttribute('email'));
+                $membership->setAttribute('userEmail', $memberUser->getAttribute('email'));
             }
 
             $membership->setAttribute('teamName', $team->getAttribute('name'));