test merge cloudflare certs

Revert "feat fix web routes"

.github/workflows/tests.yml

@@ -127,6 +127,11 @@ jobs:
             Messaging,
             Migrations
           ]
+        tables-mode: [
+          'Project',
+          'Shared V1',
+          'Shared V2',
+        ]
 
     steps:
       - name: checkout
@@ -145,11 +150,26 @@ jobs:
           docker compose up -d
           sleep 30
 
-      - name: Run ${{matrix.service}} Tests
-        run: docker compose exec -T appwrite test /usr/src/code/tests/e2e/Services/${{matrix.service}} --debug
-
-      - name: Run ${{matrix.service}} Shared Tables Tests
-        run: _APP_DATABASE_SHARED_TABLES=database_db_main docker compose exec -T appwrite test /usr/src/code/tests/e2e/Services/${{matrix.service}} --debug
+      - name: Run ${{ matrix.service }} tests with ${{ matrix.tables-mode }} table mode
+        run: |
+          if [ "${{ matrix.tables-mode }}" == "Shared V1" ]; then
+            echo "Using shared tables V1"
+            export _APP_DATABASE_SHARED_TABLES=database_db_main
+            export _APP_DATABASE_SHARED_TABLES_V1=database_db_main
+          elif [ "${{ matrix.tables-mode }}" == "Shared V2" ]; then
+            echo "Using shared tables V2"
+            export _APP_DATABASE_SHARED_TABLES=database_db_main
+            export _APP_DATABASE_SHARED_TABLES_V1=
+          else
+            echo "Using project tables"
+            export _APP_DATABASE_SHARED_TABLES=
+            export _APP_DATABASE_SHARED_TABLES_V1=
+          fi
+      
+          docker compose exec -T \
+            -e _APP_DATABASE_SHARED_TABLES \
+            -e _APP_DATABASE_SHARED_TABLES_V1 \
+            appwrite test /usr/src/code/tests/e2e/Services/${{ matrix.service }} --debug
 
   benchmarking:
     name: Benchmark

app/cli.php

@@ -114,8 +114,9 @@ CLI::setResource('getProjectDB', function (Group $pools, Database $dbForConsole,
 
         if (isset($databases[$dsn->getHost()])) {
             $database = $databases[$dsn->getHost()];
+            $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
 
-            if ($dsn->getHost() === System::getEnv('_APP_DATABASE_SHARED_TABLES', '')) {
+            if (\in_array($dsn->getHost(), $sharedTables)) {
                 $database
                     ->setSharedTables(true)
                     ->setTenant($project->getInternalId())
@@ -136,10 +137,10 @@ CLI::setResource('getProjectDB', function (Group $pools, Database $dbForConsole,
             ->getResource();
 
         $database = new Database($dbAdapter, $cache);
-
         $databases[$dsn->getHost()] = $database;
+        $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
 
-        if ($dsn->getHost() === System::getEnv('_APP_DATABASE_SHARED_TABLES', '')) {
+        if (\in_array($dsn->getHost(), $sharedTables)) {
             $database
                 ->setSharedTables(true)
                 ->setTenant($project->getInternalId())

app/config/errors.php

@@ -686,7 +686,7 @@ return [
     ],
     Exception::ATTRIBUTE_LIMIT_EXCEEDED => [
         'name' => Exception::ATTRIBUTE_LIMIT_EXCEEDED,
-        'description' => 'The maximum number of attributes has been reached.',
+        'description' => 'The maximum number or size of attributes for this collection has been reached.',
         'code' => 400,
     ],
     Exception::ATTRIBUTE_VALUE_INVALID => [

app/controllers/api/databases.php

@@ -152,7 +152,7 @@ function createAttribute(string $databaseId, string $collectionId, Document $att
     } catch (DuplicateException) {
         throw new Exception(Exception::ATTRIBUTE_ALREADY_EXISTS);
     } catch (LimitException) {
-        throw new Exception(Exception::ATTRIBUTE_LIMIT_EXCEEDED, 'Attribute limit exceeded');
+        throw new Exception(Exception::ATTRIBUTE_LIMIT_EXCEEDED);
     } catch (\Throwable $e) {
         $dbForProject->purgeCachedDocument('database_' . $db->getInternalId(), $collectionId);
         $dbForProject->purgeCachedCollection('database_' . $db->getInternalId() . '_collection_' . $collection->getInternalId());
@@ -196,7 +196,7 @@ function createAttribute(string $databaseId, string $collectionId, Document $att
             throw new Exception(Exception::ATTRIBUTE_ALREADY_EXISTS);
         } catch (LimitException) {
             $dbForProject->deleteDocument('attributes', $attribute->getId());
-            throw new Exception(Exception::ATTRIBUTE_LIMIT_EXCEEDED, 'Attribute limit exceeded');
+            throw new Exception(Exception::ATTRIBUTE_LIMIT_EXCEEDED);
         } catch (\Throwable $e) {
             $dbForProject->purgeCachedDocument('database_' . $db->getInternalId(), $relatedCollection->getId());
             $dbForProject->purgeCachedCollection('database_' . $db->getInternalId() . '_collection_' . $relatedCollection->getInternalId());
@@ -392,6 +392,8 @@ function updateAttribute(
             throw new Exception(Exception::ATTRIBUTE_INVALID_RESIZE);
         } catch (NotFoundException) {
             throw new Exception(Exception::ATTRIBUTE_NOT_FOUND);
+        } catch (LimitException) {
+            throw new Exception(Exception::ATTRIBUTE_LIMIT_EXCEEDED);
         }
     }
 
@@ -2631,7 +2633,8 @@ App::post('/v1/databases/:databaseId/collections/:collectionId/indexes')
 
         $validator = new IndexValidator(
             $collection->getAttribute('attributes'),
-            $dbForProject->getAdapter()->getMaxIndexLength()
+            $dbForProject->getAdapter()->getMaxIndexLength(),
+            $dbForProject->getAdapter()->getInternalIndexesKeys(),
         );
         if (!$validator->isValid($index)) {
             throw new Exception(Exception::INDEX_INVALID, $validator->getDescription());

app/controllers/api/projects.php

@@ -122,6 +122,10 @@ App::post('/v1/projects')
 
         $projectId = ($projectId == 'unique()') ? ID::unique() : $projectId;
 
+        if ($projectId === 'console') {
+            throw new Exception(Exception::PROJECT_RESERVED_PROJECT, "'console' is a reserved project.");
+        }
+
         $databases = Config::getParam('pools-database', []);
 
         $databaseOverride = System::getEnv('_APP_DATABASE_OVERRIDE');
@@ -132,16 +136,14 @@ App::post('/v1/projects')
             $dsn = $databases[array_rand($databases)];
         }
 
-        if ($projectId === 'console') {
-            throw new Exception(Exception::PROJECT_RESERVED_PROJECT, "'console' is a reserved project.");
-        }
-
         // TODO: Temporary until all projects are using shared tables.
-        if ($dsn === System::getEnv('_APP_DATABASE_SHARED_TABLES', '')) {
+        $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
+
+        if (\in_array($dsn, $sharedTables)) {
             $schema = 'appwrite';
             $database = 'appwrite';
             $namespace = System::getEnv('_APP_DATABASE_SHARED_NAMESPACE', '');
-            $dsn = $schema . '://' . System::getEnv('_APP_DATABASE_SHARED_TABLES', '') . '?database=' . $database;
+            $dsn = $schema . '://' . $dsn . '?database=' . $database;
 
             if (!empty($namespace)) {
                 $dsn .= '&namespace=' . $namespace;
@@ -195,11 +197,18 @@ App::post('/v1/projects')
 
         $adapter = $pools->get($dsn->getHost())->pop()->getResource();
         $dbForProject = new Database($adapter, $cache);
+        $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
+        $sharedTablesV1 = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES_V1', ''));
 
-        if ($dsn->getHost() === System::getEnv('_APP_DATABASE_SHARED_TABLES', '')) {
+        $projectTables = !\in_array($dsn->getHost(), $sharedTables);
+        $sharedTablesV1 = \in_array($dsn->getHost(), $sharedTablesV1);
+        $sharedTablesV2 = !$projectTables && !$sharedTablesV1;
+        $sharedTables = $sharedTablesV1 || $sharedTablesV2;
+
+        if ($sharedTables) {
             $dbForProject
                 ->setSharedTables(true)
-                ->setTenant($project->getInternalId())
+                ->setTenant($sharedTablesV1 ? $project->getInternalId() : null)
                 ->setNamespace($dsn->getParam('namespace'));
         } else {
             $dbForProject
@@ -208,34 +217,70 @@ App::post('/v1/projects')
                 ->setNamespace('_' . $project->getInternalId());
         }
 
-        $dbForProject->create();
+        $create = true;
 
-        $audit = new Audit($dbForProject);
-        $audit->setup();
+        try {
+            $dbForProject->create();
+        } catch (Duplicate) {
+            $create = false;
+        }
 
-        $abuse = new TimeLimit('', 0, 1, $dbForProject);
-        $abuse->setup();
+        if ($create || $projectTables) {
+            $audit = new Audit($dbForProject);
+            $audit->setup();
 
-        /** @var array $collections */
-        $collections = Config::getParam('collections', [])['projects'] ?? [];
+            $abuse = new TimeLimit('', 0, 1, $dbForProject);
+            $abuse->setup();
+        }
 
-        foreach ($collections as $key => $collection) {
-            if (($collection['$collection'] ?? '') !== Database::METADATA) {
-                continue;
-            }
+        if (!$create && $sharedTablesV1) {
+            $attributes = \array_map(fn ($attribute) => new Document($attribute), Audit::ATTRIBUTES);
+            $indexes = \array_map(fn (array $index) => new Document($index), Audit::INDEXES);
+            $dbForProject->createDocument(Database::METADATA, new Document([
+                '$id' => ID::custom('audit'),
+                '$permissions' => [Permission::create(Role::any())],
+                'name' => 'audit',
+                'attributes' => $attributes,
+                'indexes' => $indexes,
+                'documentSecurity' => true
+            ]));
 
-            $attributes = \array_map(function (array $attribute) {
-                return new Document($attribute);
-            }, $collection['attributes']);
+            $attributes = \array_map(fn ($attribute) => new Document($attribute), TimeLimit::ATTRIBUTES);
+            $indexes = \array_map(fn (array $index) => new Document($index), TimeLimit::INDEXES);
+            $dbForProject->createDocument(Database::METADATA, new Document([
+                '$id' => ID::custom('abuse'),
+                '$permissions' => [Permission::create(Role::any())],
+                'name' => 'abuse',
+                'attributes' => $attributes,
+                'indexes' => $indexes,
+                'documentSecurity' => true
+            ]));
+        }
 
-            $indexes = \array_map(function (array $index) {
-                return new Document($index);
-            }, $collection['indexes']);
+        if ($create || $sharedTablesV1) {
+            /** @var array $collections */
+            $collections = Config::getParam('collections', [])['projects'] ?? [];
 
-            try {
-                $dbForProject->createCollection($key, $attributes, $indexes);
-            } catch (Duplicate) {
-                // Collection already exists
+            foreach ($collections as $key => $collection) {
+                if (($collection['$collection'] ?? '') !== Database::METADATA) {
+                    continue;
+                }
+
+                $attributes = \array_map(fn ($attribute) => new Document($attribute), $collection['attributes']);
+                $indexes = \array_map(fn (array $index) => new Document($index), $collection['indexes']);
+
+                try {
+                    $dbForProject->createCollection($key, $attributes, $indexes);
+                } catch (Duplicate) {
+                    $dbForProject->createDocument(Database::METADATA, new Document([
+                        '$id' => ID::custom($key),
+                        '$permissions' => [Permission::create(Role::any())],
+                        'name' => $key,
+                        'attributes' => $attributes,
+                        'indexes' => $indexes,
+                        'documentSecurity' => true
+                    ]));
+                }
             }
         }
 

app/controllers/api/storage.php

@@ -68,19 +68,19 @@ App::post('/v1/storage/buckets')
     ->param('enabled', true, new Boolean(true), 'Is bucket enabled? When set to \'disabled\', users cannot access the files in this bucket but Server SDKs with and API key can still access the bucket. No files are lost when this is toggled.', true)
     ->param('maximumFileSize', fn (array $plan) => empty($plan['fileSize']) ? (int) System::getEnv('_APP_STORAGE_LIMIT', 0) : $plan['fileSize'] * 1000 * 1000, fn (array $plan) => new Range(1, empty($plan['fileSize']) ? (int) System::getEnv('_APP_STORAGE_LIMIT', 0) : $plan['fileSize'] * 1000 * 1000), 'Maximum file size allowed in bytes. Maximum allowed value is ' . Storage::human(System::getEnv('_APP_STORAGE_LIMIT', 0), 0) . '.', true, ['plan'])
     ->param('allowedFileExtensions', [], new ArrayList(new Text(64), APP_LIMIT_ARRAY_PARAMS_SIZE), 'Allowed file extensions. Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' extensions are allowed, each 64 characters long.', true)
-    ->param('compression', Compression::NONE, new WhiteList([Compression::NONE, Compression::GZIP, Compression::ZSTD]), 'Compression algorithm choosen for compression. Can be one of ' . Compression::NONE . ',  [' . Compression::GZIP . '](https://en.wikipedia.org/wiki/Gzip), or [' . Compression::ZSTD . '](https://en.wikipedia.org/wiki/Zstd), For file size above ' . Storage::human(APP_STORAGE_READ_BUFFER, 0) . ' compression is skipped even if it\'s enabled', true)
+    ->param('compression', Compression::NONE, new WhiteList([Compression::NONE, Compression::GZIP, Compression::ZSTD], true), 'Compression algorithm choosen for compression. Can be one of ' . Compression::NONE . ',  [' . Compression::GZIP . '](https://en.wikipedia.org/wiki/Gzip), or [' . Compression::ZSTD . '](https://en.wikipedia.org/wiki/Zstd), For file size above ' . Storage::human(APP_STORAGE_READ_BUFFER, 0) . ' compression is skipped even if it\'s enabled', true)
     ->param('encryption', true, new Boolean(true), 'Is encryption enabled? For file size above ' . Storage::human(APP_STORAGE_READ_BUFFER, 0) . ' encryption is skipped even if it\'s enabled', true)
     ->param('antivirus', true, new Boolean(true), 'Is virus scanning enabled? For file size above ' . Storage::human(APP_LIMIT_ANTIVIRUS, 0) . ' AntiVirus scanning is skipped even if it\'s enabled', true)
     ->inject('response')
     ->inject('dbForProject')
     ->inject('queueForEvents')
-    ->action(function (string $bucketId, string $name, ?array $permissions, bool $fileSecurity, bool $enabled, int $maximumFileSize, array $allowedFileExtensions, string $compression, bool $encryption, bool $antivirus, Response $response, Database $dbForProject, Event $queueForEvents) {
+    ->action(function (string $bucketId, string $name, ?array $permissions, bool $fileSecurity, bool $enabled, int $maximumFileSize, array $allowedFileExtensions, ?string $compression, bool $encryption, bool $antivirus, Response $response, Database $dbForProject, Event $queueForEvents) {
 
         $bucketId = $bucketId === 'unique()' ? ID::unique() : $bucketId;
 
         // Map aggregate permissions into the multiple permissions they represent.
         $permissions = Permission::aggregate($permissions);
-
+        $compression ??= Compression::NONE;
         try {
             $files = (Config::getParam('collections', [])['buckets'] ?? [])['files'] ?? [];
             if (empty($files)) {
@@ -254,13 +254,13 @@ App::put('/v1/storage/buckets/:bucketId')
     ->param('enabled', true, new Boolean(true), 'Is bucket enabled? When set to \'disabled\', users cannot access the files in this bucket but Server SDKs with and API key can still access the bucket. No files are lost when this is toggled.', true)
     ->param('maximumFileSize', fn (array $plan) => empty($plan['fileSize']) ? (int) System::getEnv('_APP_STORAGE_LIMIT', 0) : $plan['fileSize'] * 1000 * 1000, fn (array $plan) => new Range(1, empty($plan['fileSize']) ? (int) System::getEnv('_APP_STORAGE_LIMIT', 0) : $plan['fileSize'] * 1000 * 1000), 'Maximum file size allowed in bytes. Maximum allowed value is ' . Storage::human(System::getEnv('_APP_STORAGE_LIMIT', 0), 0) . '.', true, ['plan'])
     ->param('allowedFileExtensions', [], new ArrayList(new Text(64), APP_LIMIT_ARRAY_PARAMS_SIZE), 'Allowed file extensions. Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' extensions are allowed, each 64 characters long.', true)
-    ->param('compression', Compression::NONE, new WhiteList([Compression::NONE, Compression::GZIP, Compression::ZSTD]), 'Compression algorithm choosen for compression. Can be one of ' . Compression::NONE . ', [' . Compression::GZIP . '](https://en.wikipedia.org/wiki/Gzip), or [' . Compression::ZSTD . '](https://en.wikipedia.org/wiki/Zstd), For file size above ' . Storage::human(APP_STORAGE_READ_BUFFER, 0) . ' compression is skipped even if it\'s enabled', true)
+    ->param('compression', Compression::NONE, new WhiteList([Compression::NONE, Compression::GZIP, Compression::ZSTD], true), 'Compression algorithm choosen for compression. Can be one of ' . Compression::NONE . ', [' . Compression::GZIP . '](https://en.wikipedia.org/wiki/Gzip), or [' . Compression::ZSTD . '](https://en.wikipedia.org/wiki/Zstd), For file size above ' . Storage::human(APP_STORAGE_READ_BUFFER, 0) . ' compression is skipped even if it\'s enabled', true)
     ->param('encryption', true, new Boolean(true), 'Is encryption enabled? For file size above ' . Storage::human(APP_STORAGE_READ_BUFFER, 0) . ' encryption is skipped even if it\'s enabled', true)
     ->param('antivirus', true, new Boolean(true), 'Is virus scanning enabled? For file size above ' . Storage::human(APP_LIMIT_ANTIVIRUS, 0) . ' AntiVirus scanning is skipped even if it\'s enabled', true)
     ->inject('response')
     ->inject('dbForProject')
     ->inject('queueForEvents')
-    ->action(function (string $bucketId, string $name, ?array $permissions, bool $fileSecurity, bool $enabled, ?int $maximumFileSize, array $allowedFileExtensions, string $compression, bool $encryption, bool $antivirus, Response $response, Database $dbForProject, Event $queueForEvents) {
+    ->action(function (string $bucketId, string $name, ?array $permissions, bool $fileSecurity, bool $enabled, ?int $maximumFileSize, array $allowedFileExtensions, ?string $compression, bool $encryption, bool $antivirus, Response $response, Database $dbForProject, Event $queueForEvents) {
         $bucket = $dbForProject->getDocument('buckets', $bucketId);
 
         if ($bucket->isEmpty()) {
@@ -273,6 +273,7 @@ App::put('/v1/storage/buckets/:bucketId')
         $enabled ??= $bucket->getAttribute('enabled', true);
         $encryption ??= $bucket->getAttribute('encryption', true);
         $antivirus ??= $bucket->getAttribute('antivirus', true);
+        $compression ??= $bucket->getAttribute('compression', Compression::NONE);
 
         // Map aggregate permissions into the multiple permissions they represent.
         $permissions = Permission::aggregate($permissions);

app/controllers/general.php

@@ -63,7 +63,7 @@ function router(App $utopia, Database $dbForConsole, callable $getProjectDB, Swo
         }
 
         if (System::getEnv('_APP_OPTIONS_ROUTER_PROTECTION', 'disabled') === 'enabled') {
-            if ($host !== 'localhost' && $host !== APP_HOSTNAME_INTERNAL) { // localhost allowed for proxy, APP_HOSTNAME_INTERNAL allowed for migrations
+            if ($host !== 'localhost' && $host !== APP_HOSTNAME_INTERNAL && $host !== System::getEnv('_APP_CONSOLE_DOMAIN', '')) {
                 throw new AppwriteException(AppwriteException::GENERAL_ACCESS_FORBIDDEN, 'Router protection does not allow accessing Appwrite over this domain. Please add it as custom domain to your project or disable _APP_OPTIONS_ROUTER_PROTECTION environment variable.');
             }
         }

app/http.php

@@ -16,6 +16,7 @@ use Utopia\CLI\Console;
 use Utopia\Config\Config;
 use Utopia\Database\Database;
 use Utopia\Database\Document;
+use Utopia\Database\Exception\Duplicate;
 use Utopia\Database\Helpers\ID;
 use Utopia\Database\Helpers\Permission;
 use Utopia\Database\Helpers\Role;
@@ -60,8 +61,6 @@ include __DIR__ . '/controllers/general.php';
 
 $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $register) {
     $app = new App('UTC');
-    $app->setCompression(true);
-    $app->setCompressionMinSize(intval(System::getEnv('_APP_COMPRESSION_MIN_SIZE_BYTES', '1024'))); // 1KB
 
     go(function () use ($register, $app) {
         $pools = $register->get('pools');
@@ -93,7 +92,7 @@ $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $reg
         try {
             Console::success('[Setup] - Creating database: appwrite...');
             $dbForConsole->create();
-        } catch (\Throwable $e) {
+        } catch (Duplicate) {
             Console::success('[Setup] - Skip: metadata table already exists');
         }
 
@@ -225,7 +224,7 @@ $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $reg
     });
 });
 
-$http->on('request', function (SwooleRequest $swooleRequest, SwooleResponse $swooleResponse) use ($register) {
+$http->on(Constant::EVENT_REQUEST, function (SwooleRequest $swooleRequest, SwooleResponse $swooleResponse) use ($register) {
     App::setResource('swooleRequest', fn () => $swooleRequest);
     App::setResource('swooleResponse', fn () => $swooleResponse);
 

app/init.php

@@ -21,6 +21,7 @@ if (\file_exists(__DIR__ . '/../vendor/autoload.php')) {
 use Ahc\Jwt\JWT;
 use Ahc\Jwt\JWTException;
 use Appwrite\Auth\Auth;
+use Appwrite\Certificates\LetsEncrypt;
 use Appwrite\Event\Audit;
 use Appwrite\Event\Build;
 use Appwrite\Event\Certificate;
@@ -1432,7 +1433,9 @@ App::setResource('dbForProject', function (Group $pools, Database $dbForConsole,
         $dsn = new DSN('mysql://' . $project->getAttribute('database'));
     }
 
-    if ($dsn->getHost() === System::getEnv('_APP_DATABASE_SHARED_TABLES', '')) {
+    $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
+
+    if (\in_array($dsn->getHost(), $sharedTables)) {
         $database
             ->setSharedTables(true)
             ->setTenant($project->getInternalId())
@@ -1487,7 +1490,9 @@ App::setResource('getProjectDB', function (Group $pools, Database $dbForConsole,
                 ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS)
                 ->setMaxQueryValues(APP_DATABASE_QUERY_MAX_VALUES);
 
-            if ($dsn->getHost() === System::getEnv('_APP_DATABASE_SHARED_TABLES', '')) {
+            $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
+
+            if (\in_array($dsn->getHost(), $sharedTables)) {
                 $database
                     ->setSharedTables(true)
                     ->setTenant($project->getInternalId())
@@ -1534,6 +1539,15 @@ App::setResource('cache', function (Group $pools) {
     return new Cache(new Sharding($adapters));
 }, ['pools']);
 
+App::setResource('certificates', function () {
+    $email = System::getEnv('_APP_EMAIL_CERTIFICATES', System::getEnv('_APP_SYSTEM_SECURITY_EMAIL_ADDRESS'));
+    if (empty($email)) {
+        throw new Exception('You must set a valid security email address (_APP_EMAIL_CERTIFICATES) to issue a LetsEncrypt SSL certificate.');
+    }
+
+    return new LetsEncrypt($email);
+});
+
 App::setResource('deviceForLocal', function () {
     return new Local();
 });

app/realtime.php

@@ -93,7 +93,9 @@ if (!function_exists('getProjectDB')) {
 
         $database = new Database($adapter, getCache());
 
-        if ($dsn->getHost() === System::getEnv('_APP_DATABASE_SHARED_TABLES', '')) {
+        $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
+
+        if (\in_array($dsn->getHost(), $sharedTables)) {
             $database
                 ->setSharedTables(true)
                 ->setTenant($project->getInternalId())

app/worker.php

@@ -93,7 +93,9 @@ Server::setResource('dbForProject', function (Cache $cache, Registry $register,
         $dsn = new DSN('mysql://' . $project->getAttribute('database'));
     }
 
-    if ($dsn->getHost() === System::getEnv('_APP_DATABASE_SHARED_TABLES', '')) {
+    $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
+
+    if (\in_array($dsn->getHost(), $sharedTables)) {
         $database
             ->setSharedTables(true)
             ->setTenant($project->getInternalId())
@@ -126,7 +128,9 @@ Server::setResource('getProjectDB', function (Group $pools, Database $dbForConso
         if (isset($databases[$dsn->getHost()])) {
             $database = $databases[$dsn->getHost()];
 
-            if ($dsn->getHost() === System::getEnv('_APP_DATABASE_SHARED_TABLES', '')) {
+            $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
+
+            if (\in_array($dsn->getHost(), $sharedTables)) {
                 $database
                     ->setSharedTables(true)
                     ->setTenant($project->getInternalId())
@@ -150,7 +154,9 @@ Server::setResource('getProjectDB', function (Group $pools, Database $dbForConso
 
         $databases[$dsn->getHost()] = $database;
 
-        if ($dsn->getHost() === System::getEnv('_APP_DATABASE_SHARED_TABLES', '')) {
+        $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
+
+        if (\in_array($dsn->getHost(), $sharedTables)) {
             $database
                 ->setSharedTables(true)
                 ->setTenant($project->getInternalId())

composer.json

@@ -45,13 +45,13 @@
         "ext-sockets": "*",
         "appwrite/php-runtimes": "0.16.*",
         "appwrite/php-clamav": "2.0.*",
-        "utopia-php/abuse": "0.43.0",
+        "utopia-php/abuse": "0.43.*",
         "utopia-php/analytics": "0.10.*",
-        "utopia-php/audit": "0.43.0",
+        "utopia-php/audit": "0.43.*",
         "utopia-php/cache": "0.11.*",
         "utopia-php/cli": "0.15.*",
         "utopia-php/config": "0.2.*",
-        "utopia-php/database": "0.53.16",
+        "utopia-php/database": "0.53.20",
         "utopia-php/domains": "0.5.*",
         "utopia-php/dsn": "0.2.1",
         "utopia-php/framework": "0.33.*",

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "c56db8736d679aff6e2b275ec59f1dbf",
+    "content-hash": "ae3b9a491c9870a4897cdf712caba1e3",
     "packages": [
         {
             "name": "adhocore/jwt",
@@ -3135,16 +3135,16 @@
         },
         {
             "name": "utopia-php/abuse",
-            "version": "0.43.0",
+            "version": "0.43.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/utopia-php/abuse.git",
-                "reference": "6346a3b4c5177a43160035a7289e30fdfb0790d6"
+                "reference": "e404c21e8dcf6a310bc83cf1d74e716b105598fa"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/utopia-php/abuse/zipball/6346a3b4c5177a43160035a7289e30fdfb0790d6",
-                "reference": "6346a3b4c5177a43160035a7289e30fdfb0790d6",
+                "url": "https://api.github.com/repos/utopia-php/abuse/zipball/e404c21e8dcf6a310bc83cf1d74e716b105598fa",
+                "reference": "e404c21e8dcf6a310bc83cf1d74e716b105598fa",
                 "shasum": ""
             },
             "require": {
@@ -3180,9 +3180,9 @@
             ],
             "support": {
                 "issues": "https://github.com/utopia-php/abuse/issues",
-                "source": "https://github.com/utopia-php/abuse/tree/0.43.0"
+                "source": "https://github.com/utopia-php/abuse/tree/0.43.1"
             },
-            "time": "2024-08-30T05:17:23+00:00"
+            "time": "2024-10-23T04:29:12+00:00"
         },
         {
             "name": "utopia-php/analytics",
@@ -3232,16 +3232,16 @@
         },
         {
             "name": "utopia-php/audit",
-            "version": "0.43.0",
+            "version": "0.43.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/utopia-php/audit.git",
-                "reference": "cef22b5dc6a6d28fcd522f41c7bf7ded4a4dfd3e"
+                "reference": "04a47dd1f5f92e2d50e971a06bcc9e759325d277"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/utopia-php/audit/zipball/cef22b5dc6a6d28fcd522f41c7bf7ded4a4dfd3e",
-                "reference": "cef22b5dc6a6d28fcd522f41c7bf7ded4a4dfd3e",
+                "url": "https://api.github.com/repos/utopia-php/audit/zipball/04a47dd1f5f92e2d50e971a06bcc9e759325d277",
+                "reference": "04a47dd1f5f92e2d50e971a06bcc9e759325d277",
                 "shasum": ""
             },
             "require": {
@@ -3273,9 +3273,9 @@
             ],
             "support": {
                 "issues": "https://github.com/utopia-php/audit/issues",
-                "source": "https://github.com/utopia-php/audit/tree/0.43.0"
+                "source": "https://github.com/utopia-php/audit/tree/0.43.1"
             },
-            "time": "2024-08-30T05:17:36+00:00"
+            "time": "2024-10-23T04:27:59+00:00"
         },
         {
             "name": "utopia-php/cache",
@@ -3475,16 +3475,16 @@
         },
         {
             "name": "utopia-php/database",
-            "version": "0.53.16",
+            "version": "0.53.20",
             "source": {
                 "type": "git",
                 "url": "https://github.com/utopia-php/database.git",
-                "reference": "6661edffeef05b59e16d102b989a72f7f78cf7de"
+                "reference": "e43f8ee26e06ee8812737e63642dbd7ee7c9dc04"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/utopia-php/database/zipball/6661edffeef05b59e16d102b989a72f7f78cf7de",
-                "reference": "6661edffeef05b59e16d102b989a72f7f78cf7de",
+                "url": "https://api.github.com/repos/utopia-php/database/zipball/e43f8ee26e06ee8812737e63642dbd7ee7c9dc04",
+                "reference": "e43f8ee26e06ee8812737e63642dbd7ee7c9dc04",
                 "shasum": ""
             },
             "require": {
@@ -3525,9 +3525,9 @@
             ],
             "support": {
                 "issues": "https://github.com/utopia-php/database/issues",
-                "source": "https://github.com/utopia-php/database/tree/0.53.16"
+                "source": "https://github.com/utopia-php/database/tree/0.53.20"
             },
-            "time": "2024-11-06T03:07:16+00:00"
+            "time": "2024-11-12T00:23:36+00:00"
         },
         {
             "name": "utopia-php/domains",

docker-compose.yml

@@ -193,6 +193,7 @@ services:
       - _APP_EXPERIMENT_LOGGING_PROVIDER
       - _APP_EXPERIMENT_LOGGING_CONFIG
       - _APP_DATABASE_SHARED_TABLES
+      - _APP_DATABASE_SHARED_TABLES_V1
 
   appwrite-console:
     <<: *x-logging

src/Appwrite/Certificates/Adapter.php

@@ -0,0 +1,14 @@
+<?php
+
+namespace Appwrite\Certificates;
+
+use Utopia\Logger\Log;
+
+interface Adapter
+{
+    public function issueCertificate(string $certName, string $domain): ?string;
+
+    public function isRenewRequired(string $domain, Log $log): bool;
+
+    public function deleteCertificate(string $domain): void;
+}

src/Appwrite/Certificates/LetsEncrypt.php

@@ -0,0 +1,125 @@
+<?php
+
+namespace Appwrite\Certificates;
+
+use Exception;
+use Utopia\App;
+use Utopia\CLI\Console;
+use Utopia\Database\DateTime;
+use Utopia\Logger\Log;
+
+class LetsEncrypt implements Adapter
+{
+    private string $email;
+
+    public function __construct(string $email)
+    {
+        $this->email = $email;
+    }
+
+
+    public function issueCertificate(string $certName, string $domain): ?string
+    {
+        $stdout = '';
+        $stderr = '';
+
+        $staging = (App::isProduction()) ? '' : ' --dry-run';
+        $exit = Console::execute(
+            "certbot certonly -v --webroot --noninteractive --agree-tos{$staging}"
+            . " --email " . $this->email
+            . " --cert-name " . $certName
+            . " -w " . APP_STORAGE_CERTIFICATES
+            . " -d {$domain}",
+            '',
+            $stdout,
+            $stderr
+        );
+
+        // Unexpected error, usually 5XX, API limits, ...
+        if ($exit !== 0) {
+            throw new Exception('Failed to issue a certificate with message: ' . $stderr);
+        }
+
+        // Prepare folder in storage for domain
+        $path = APP_STORAGE_CERTIFICATES . '/' . $domain;
+        if (!\is_readable($path)) {
+            if (!\mkdir($path, 0755, true)) {
+                throw new Exception('Failed to create path for certificate.');
+            }
+        }
+
+        // Move generated files
+        if (!@\rename('/etc/letsencrypt/live/' . $certName . '/cert.pem', APP_STORAGE_CERTIFICATES . '/' . $domain . '/cert.pem')) {
+            throw new Exception('Failed to rename certificate cert.pem. Let\'s Encrypt log: ' . $stderr . ' ; ' . $stdout);
+        }
+
+        if (!@\rename('/etc/letsencrypt/live/' . $certName . '/chain.pem', APP_STORAGE_CERTIFICATES . '/' . $domain . '/chain.pem')) {
+            throw new Exception('Failed to rename certificate chain.pem. Let\'s Encrypt log: ' . $stderr . ' ; ' . $stdout);
+        }
+
+        if (!@\rename('/etc/letsencrypt/live/' . $certName . '/fullchain.pem', APP_STORAGE_CERTIFICATES . '/' . $domain . '/fullchain.pem')) {
+            throw new Exception('Failed to rename certificate fullchain.pem. Let\'s Encrypt log: ' . $stderr . ' ; ' . $stdout);
+        }
+
+        if (!@\rename('/etc/letsencrypt/live/' . $certName . '/privkey.pem', APP_STORAGE_CERTIFICATES . '/' . $domain . '/privkey.pem')) {
+            throw new Exception('Failed to rename certificate privkey.pem. Let\'s Encrypt log: ' . $stderr . ' ; ' . $stdout);
+        }
+
+        $config = \implode(PHP_EOL, [
+            "tls:",
+            "  certificates:",
+            "    - certFile: /storage/certificates/{$domain}/fullchain.pem",
+            "      keyFile: /storage/certificates/{$domain}/privkey.pem"
+        ]);
+
+        // Save configuration into Traefik using our new cert files
+        if (!\file_put_contents(APP_STORAGE_CONFIG . '/' . $domain . '.yml', $config)) {
+            throw new Exception('Failed to save Traefik configuration.');
+        }
+
+        $certPath = APP_STORAGE_CERTIFICATES . '/' . $domain . '/cert.pem';
+        $certData = openssl_x509_parse(file_get_contents($certPath));
+        $validTo = $certData['validTo_time_t'] ?? null;
+        $dt = (new \DateTime())->setTimestamp($validTo);
+        return DateTime::addSeconds($dt, -60 * 60 * 24 * 30);
+    }
+
+    public function isRenewRequired(string $domain, Log $log): bool
+    {
+        $certPath = APP_STORAGE_CERTIFICATES . '/' . $domain . '/cert.pem';
+        if (\file_exists($certPath)) {
+            $certData = openssl_x509_parse(file_get_contents($certPath));
+            $validTo = $certData['validTo_time_t'] ?? 0;
+
+            if (empty($validTo)) {
+                $log->addTag('certificateDomain', $domain);
+                throw new Exception('Unable to read certificate file (cert.pem).');
+            }
+
+            // LetsEncrypt allows renewal 30 days before expiry
+            $expiryInAdvance = (60 * 60 * 24 * 30);
+            if ($validTo - $expiryInAdvance > \time()) {
+                $log->addTag('certificateDomain', $domain);
+                $log->addExtra('certificateData', \is_array($certData) ? \json_encode($certData) : \strval($certData));
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    public function deleteCertificate(string $domain): void
+    {
+        $directory = APP_STORAGE_CERTIFICATES . '/' . $domain;
+        $checkTraversal = realpath($directory) === $directory;
+
+        if ($checkTraversal && is_dir($directory)) {
+            // Delete files, so Traefik is aware of change
+            array_map('unlink', glob($directory . '/*.*'));
+            rmdir($directory);
+            Console::info("Deleted certificate files for {$domain}");
+        } else {
+            Console::info("No certificate files found for {$domain}");
+        }
+    }
+}

src/Appwrite/Platform/Tasks/Maintenance.php

@@ -149,6 +149,7 @@ class Maintenance extends Action
 
         $certificates = $dbForConsole->find('certificates', [
             Query::lessThan('attempts', 5), // Maximum 5 attempts
+            Query::isNotNull('renewDate'),
             Query::lessThanEqual('renewDate', $time), // includes 60 days cooldown (we have 30 days to renew)
             Query::limit(200), // Limit 200 comes from LetsEncrypt (300 orders per 3 hours, keeping some for new domains)
         ]);

src/Appwrite/Platform/Workers/Certificates.php

@@ -2,6 +2,7 @@
 
 namespace Appwrite\Platform\Workers;
 
+use Appwrite\Certificates\Adapter as CertificatesAdapter;
 use Appwrite\Event\Event;
 use Appwrite\Event\Func;
 use Appwrite\Event\Mail;
@@ -11,7 +12,6 @@ use Appwrite\Template\Template;
 use Appwrite\Utopia\Response\Model\Rule;
 use Exception;
 use Throwable;
-use Utopia\App;
 use Utopia\CLI\Console;
 use Utopia\Database\Database;
 use Utopia\Database\DateTime;
@@ -48,7 +48,11 @@ class Certificates extends Action
             ->inject('queueForEvents')
             ->inject('queueForFunctions')
             ->inject('log')
-            ->callback(fn (Message $message, Database $dbForConsole, Mail $queueForMails, Event $queueForEvents, Func $queueForFunctions, Log $log) => $this->action($message, $dbForConsole, $queueForMails, $queueForEvents, $queueForFunctions, $log));
+            ->inject('certificates')
+            ->callback(
+                fn (Message $message, Database $dbForConsole, Mail $queueForMails, Event $queueForEvents, Func $queueForFunctions, Log $log, CertificatesAdapter $certificates) =>
+                    $this->action($message, $dbForConsole, $queueForMails, $queueForEvents, $queueForFunctions, $log, $certificates)
+            );
     }
 
     /**
@@ -58,11 +62,12 @@ class Certificates extends Action
      * @param Event $queueForEvents
      * @param Func $queueForFunctions
      * @param Log $log
+     * @param CertificatesAdapter $certificates
      * @return void
      * @throws Throwable
      * @throws \Utopia\Database\Exception
      */
-    public function action(Message $message, Database $dbForConsole, Mail $queueForMails, Event $queueForEvents, Func $queueForFunctions, Log $log): void
+    public function action(Message $message, Database $dbForConsole, Mail $queueForMails, Event $queueForEvents, Func $queueForFunctions, Log $log, CertificatesAdapter $certificates): void
     {
         $payload = $message->getPayload() ?? [];
 
@@ -76,7 +81,7 @@ class Certificates extends Action
 
         $log->addTag('domain', $domain->get());
 
-        $this->execute($domain, $dbForConsole, $queueForMails, $queueForEvents, $queueForFunctions, $log, $skipRenewCheck);
+        $this->execute($domain, $dbForConsole, $queueForMails, $queueForEvents, $queueForFunctions, $log, $certificates, $skipRenewCheck);
     }
 
     /**
@@ -85,24 +90,24 @@ class Certificates extends Action
      * @param Mail $queueForMails
      * @param Event $queueForEvents
      * @param Func $queueForFunctions
+     * @param CertificatesAdapter $certificates
      * @param bool $skipRenewCheck
      * @return void
      * @throws Throwable
      * @throws \Utopia\Database\Exception
      */
-    private function execute(Domain $domain, Database $dbForConsole, Mail $queueForMails, Event $queueForEvents, Func $queueForFunctions, Log $log, bool $skipRenewCheck = false): void
+    private function execute(Domain $domain, Database $dbForConsole, Mail $queueForMails, Event $queueForEvents, Func $queueForFunctions, Log $log, CertificatesAdapter $certificates, bool $skipRenewCheck = false): void
     {
         /**
          * 1. Read arguments and validate domain
          * 2. Get main domain
          * 3. Validate CNAME DNS if parameter is not main domain (meaning it's custom domain)
-         * 4. Validate security email. Cannot be empty, required by LetsEncrypt
-         * 5. Validate renew date with certificate file, unless requested to skip by parameter
-         * 6. Issue a certificate using certbot CLI
-         * 7. Update 'log' attribute on certificate document with Certbot message
-         * 8. Create storage folder for certificate, if not ready already
-         * 9. Move certificates from Certbot location to our Storage
-         * 10. Create/Update our Storage with new Traefik config with new certificate paths
+         * 4. Validate renew date with certificate file, unless requested to skip by parameter
+         * 5. Issue a certificate using certbot CLI
+         * 6. Update 'log' attribute on certificate document with Certbot message
+         * 7. Create storage folder for certificate, if not ready already
+         * 8. Move certificates from Certbot location to our Storage
+         * 9. Create/Update our Storage with new Traefik config with new certificate paths
          * 11. Read certificate file and update 'renewDate' on certificate document
          * 12. Update 'issueDate' and 'attempts' on certificate
          *
@@ -119,7 +124,7 @@ class Certificates extends Action
          * 2. Save document to database
          * 3. Update all domains documents with current certificate ID
          *
-         * Note: Renewals are checked and scheduled from maintenence worker
+         * Note: Renewals are checked and scheduled from maintenance worker
          */
 
         // Get current certificate
@@ -134,40 +139,27 @@ class Certificates extends Action
         $success = false;
 
         try {
-            // Email for alerts is required by LetsEncrypt
-            $email = System::getEnv('_APP_EMAIL_CERTIFICATES', System::getEnv('_APP_SYSTEM_SECURITY_EMAIL_ADDRESS'));
-            if (empty($email)) {
-                throw new Exception('You must set a valid security email address (_APP_EMAIL_CERTIFICATES) to issue an SSL certificate.');
-            }
-
             // Validate domain and DNS records. Skip if job is forced
             if (!$skipRenewCheck) {
                 $mainDomain = $this->getMainDomain();
                 $isMainDomain = !isset($mainDomain) || $domain->get() === $mainDomain;
                 $this->validateDomain($domain, $isMainDomain, $log);
+
+                // If certificate exists already, double-check expiry date. Skip if job is forced
+                if (!$certificates->isRenewRequired($domain->get(), $log)) {
+                    throw new Exception('Renew isn\'t required.');
+                }
             }
 
-            // If certificate exists already, double-check expiry date. Skip if job is forced
-            if (!$skipRenewCheck && !$this->isRenewRequired($domain->get(), $log)) {
-                throw new Exception('Renew isn\'t required.');
-            }
-
-            // Prepare folder name for certbot. Using this helps prevent miss-match in LetsEncrypt configuration when renewing certificate
-            $folder = ID::unique();
-
-            // Generate certificate files using Let's Encrypt
-            $letsEncryptData = $this->issueCertificate($folder, $domain->get(), $email);
+            // Prepare unique cert name. Using this helps prevent miss-match in configuration when renewing certificates.
+            $certName = ID::unique();
+            $renewDate = $certificates->issueCertificate($certName, $domain->get());
 
             // Command succeeded, store all data into document
-            $logs = 'Certificate successfully generated.';
-            $certificate->setAttribute('logs', \mb_strcut($logs, 0, 1000000));// Limit to 1MB
-
-
-            // Give certificates to Traefik
-            $this->applyCertificateFiles($folder, $domain->get(), $letsEncryptData);
+            $certificate->setAttribute('logs', 'Certificate successfully generated.');
 
             // Update certificate info stored in database
-            $certificate->setAttribute('renewDate', $this->getRenewDate($domain->get()));
+            $certificate->setAttribute('renewDate', $renewDate);
             $certificate->setAttribute('attempts', 0);
             $certificate->setAttribute('issueDate', DateTime::now());
             $success = true;
@@ -181,7 +173,7 @@ class Certificates extends Action
             $attempts = $certificate->getAttribute('attempts', 0) + 1;
             $certificate->setAttribute('attempts', $attempts);
 
-            // Store cuttent time as renew date to ensure another attempt in next maintenance cycle
+            // Store current time as renew date to ensure another attempt in next maintenance cycle.
             $certificate->setAttribute('renewDate', DateTime::now());
 
             // Send email to security email
@@ -245,8 +237,8 @@ class Certificates extends Action
     }
 
     /**
-     * Internal domain validation functionality to prevent unnecessary attempts failed from Let's Encrypt side. We check:
-     * - Domain needs to be public and valid (prevents NFT domains that are not supported by Let's Encrypt)
+     * Internal domain validation functionality to prevent unnecessary attempts. We check:
+     * - Domain needs to be public and valid (prevents NFT domains that are not supported)
      * - Domain must have proper DNS record
      *
      * @param Domain $domain Domain which we validate
@@ -292,136 +284,6 @@ class Certificates extends Action
         }
     }
 
-    /**
-     * Reads expiry date of certificate from file and decides if renewal is required or not.
-     *
-     * @param string $domain Domain for which we check certificate file
-     * @return bool True, if certificate needs to be renewed
-     * @throws Exception
-     */
-    private function isRenewRequired(string $domain, Log $log): bool
-    {
-        $certPath = APP_STORAGE_CERTIFICATES . '/' . $domain . '/cert.pem';
-        if (\file_exists($certPath)) {
-            $validTo = null;
-
-            $certData = openssl_x509_parse(file_get_contents($certPath));
-            $validTo = $certData['validTo_time_t'] ?? 0;
-
-            if (empty($validTo)) {
-                $log->addTag('certificateDomain', $domain);
-                throw new Exception('Unable to read certificate file (cert.pem).');
-            }
-
-            // LetsEncrypt allows renewal 30 days before expiry
-            $expiryInAdvance = (60 * 60 * 24 * 30);
-            if ($validTo - $expiryInAdvance > \time()) {
-                $log->addTag('certificateDomain', $domain);
-                $log->addExtra('certificateData', \is_array($certData) ? \json_encode($certData) : \strval($certData));
-                return false;
-            }
-        }
-
-        return true;
-    }
-
-    /**
-     * LetsEncrypt communication to issue certificate (using certbot CLI)
-     *
-     * @param string $folder Folder into which certificates should be generated
-     * @param string $domain Domain to generate certificate for
-     * @return array Named array with keys 'stdout' and 'stderr', both string
-     * @throws Exception
-     */
-    private function issueCertificate(string $folder, string $domain, string $email): array
-    {
-        $stdout = '';
-        $stderr = '';
-
-        $staging = (App::isProduction()) ? '' : ' --dry-run';
-        $exit = Console::execute("certbot certonly -v --webroot --noninteractive --agree-tos{$staging}"
-            . " --email " . $email
-            . " --cert-name " . $folder
-            . " -w " . APP_STORAGE_CERTIFICATES
-            . " -d {$domain}", '', $stdout, $stderr);
-
-        // Unexpected error, usually 5XX, API limits, ...
-        if ($exit !== 0) {
-            throw new Exception('Failed to issue a certificate with message: ' . $stderr);
-        }
-
-        return [
-            'stdout' => $stdout,
-            'stderr' => $stderr
-        ];
-    }
-
-    /**
-     * Read new renew date from certificate file generated by Let's Encrypt
-     *
-     * @param string $domain Domain which certificate was generated for
-     * @return string
-     * @throws \Utopia\Database\Exception
-     */
-    private function getRenewDate(string $domain): string
-    {
-        $certPath = APP_STORAGE_CERTIFICATES . '/' . $domain . '/cert.pem';
-        $certData = openssl_x509_parse(file_get_contents($certPath));
-        $validTo = $certData['validTo_time_t'] ?? null;
-        $dt = (new \DateTime())->setTimestamp($validTo);
-        return DateTime::addSeconds($dt, -60 * 60 * 24 * 30); // -30 days
-    }
-
-    /**
-     * Method to take files from Let's Encrypt, and put it into Traefik.
-     *
-     * @param string $domain Domain which certificate was generated for
-     * @param string $folder Folder in which certificates were generated
-     * @param array $letsEncryptData Let's Encrypt logs to use for additional info when throwing error
-     * @return void
-     * @throws Exception
-     */
-    private function applyCertificateFiles(string $folder, string $domain, array $letsEncryptData): void
-    {
-
-        // Prepare folder in storage for domain
-        $path = APP_STORAGE_CERTIFICATES . '/' . $domain;
-        if (!\is_readable($path)) {
-            if (!\mkdir($path, 0755, true)) {
-                throw new Exception('Failed to create path for certificate.');
-            }
-        }
-
-        // Move generated files
-        if (!@\rename('/etc/letsencrypt/live/' . $folder . '/cert.pem', APP_STORAGE_CERTIFICATES . '/' . $domain . '/cert.pem')) {
-            throw new Exception('Failed to rename certificate cert.pem. Let\'s Encrypt log: ' . $letsEncryptData['stderr'] . ' ; ' . $letsEncryptData['stdout']);
-        }
-
-        if (!@\rename('/etc/letsencrypt/live/' . $folder . '/chain.pem', APP_STORAGE_CERTIFICATES . '/' . $domain . '/chain.pem')) {
-            throw new Exception('Failed to rename certificate chain.pem. Let\'s Encrypt log: ' . $letsEncryptData['stderr'] . ' ; ' . $letsEncryptData['stdout']);
-        }
-
-        if (!@\rename('/etc/letsencrypt/live/' . $folder . '/fullchain.pem', APP_STORAGE_CERTIFICATES . '/' . $domain . '/fullchain.pem')) {
-            throw new Exception('Failed to rename certificate fullchain.pem. Let\'s Encrypt log: ' . $letsEncryptData['stderr'] . ' ; ' . $letsEncryptData['stdout']);
-        }
-
-        if (!@\rename('/etc/letsencrypt/live/' . $folder . '/privkey.pem', APP_STORAGE_CERTIFICATES . '/' . $domain . '/privkey.pem')) {
-            throw new Exception('Failed to rename certificate privkey.pem. Let\'s Encrypt log: ' . $letsEncryptData['stderr'] . ' ; ' . $letsEncryptData['stdout']);
-        }
-
-        $config = \implode(PHP_EOL, [
-            "tls:",
-            "  certificates:",
-            "    - certFile: /storage/certificates/{$domain}/fullchain.pem",
-            "      keyFile: /storage/certificates/{$domain}/privkey.pem"
-        ]);
-
-        // Save configuration into Traefik using our new cert files
-        if (!\file_put_contents(APP_STORAGE_CONFIG . '/' . $domain . '.yml', $config)) {
-            throw new Exception('Failed to save Traefik configuration.');
-        }
-    }
-
     /**
      * Method to make sure information about error is delivered to admnistrator.
      *
@@ -494,6 +356,10 @@ class Certificates extends Action
 
             $project = $dbForConsole->getDocument('projects', $projectId);
 
+            if ($project->isEmpty()) {
+                return;
+            }
+
             /** Trigger Webhook */
             $ruleModel = new Rule();
             $queueForEvents

src/Appwrite/Platform/Workers/Deletes.php

@@ -3,6 +3,7 @@
 namespace Appwrite\Platform\Workers;
 
 use Appwrite\Auth\Auth;
+use Appwrite\Certificates\Adapter as CertificatesAdapter;
 use Appwrite\Extend\Exception;
 use Executor\Executor;
 use Throwable;
@@ -50,18 +51,22 @@ class Deletes extends Action
             ->inject('deviceForFunctions')
             ->inject('deviceForBuilds')
             ->inject('deviceForCache')
+            ->inject('certificates')
             ->inject('abuseRetention')
             ->inject('executionRetention')
             ->inject('auditRetention')
             ->inject('log')
-            ->callback(fn ($message, $dbForConsole, callable $getProjectDB, Device $deviceForFiles, Device $deviceForFunctions, Device $deviceForBuilds, Device $deviceForCache, string $abuseRetention, string $executionRetention, string $auditRetention, Log $log) => $this->action($message, $dbForConsole, $getProjectDB, $deviceForFiles, $deviceForFunctions, $deviceForBuilds, $deviceForCache, $abuseRetention, $executionRetention, $auditRetention, $log));
+            ->callback(
+                fn ($message, $dbForConsole, callable $getProjectDB, Device $deviceForFiles, Device $deviceForFunctions, Device $deviceForBuilds, Device $deviceForCache, CertificatesAdapter $certificates, string $abuseRetention, string $executionRetention, string $auditRetention, Log $log) =>
+                    $this->action($message, $dbForConsole, $getProjectDB, $deviceForFiles, $deviceForFunctions, $deviceForBuilds, $deviceForCache, $certificates, $abuseRetention, $executionRetention, $auditRetention, $log)
+            );
     }
 
     /**
      * @throws Exception
      * @throws Throwable
      */
-    public function action(Message $message, Database $dbForConsole, callable $getProjectDB, Device $deviceForFiles, Device $deviceForFunctions, Device $deviceForBuilds, Device $deviceForCache, string $abuseRetention, string $executionRetention, string $auditRetention, Log $log): void
+    public function action(Message $message, Database $dbForConsole, callable $getProjectDB, Device $deviceForFiles, Device $deviceForFunctions, Device $deviceForBuilds, Device $deviceForCache, CertificatesAdapter $certificates, string $abuseRetention, string $executionRetention, string $auditRetention, Log $log): void
     {
         $payload = $message->getPayload() ?? [];
 
@@ -84,10 +89,10 @@ class Deletes extends Action
             case DELETE_TYPE_DOCUMENT:
                 switch ($document->getCollection()) {
                     case DELETE_TYPE_PROJECTS:
-                        $this->deleteProject($dbForConsole, $getProjectDB, $deviceForFiles, $deviceForFunctions, $deviceForBuilds, $deviceForCache, $document);
+                        $this->deleteProject($dbForConsole, $getProjectDB, $deviceForFiles, $deviceForFunctions, $deviceForBuilds, $deviceForCache, $certificates, $document);
                         break;
                     case DELETE_TYPE_FUNCTIONS:
-                        $this->deleteFunction($dbForConsole, $getProjectDB, $deviceForFunctions, $deviceForBuilds, $document, $project);
+                        $this->deleteFunction($dbForConsole, $getProjectDB, $deviceForFunctions, $deviceForBuilds, $certificates, $document, $project);
                         break;
                     case DELETE_TYPE_DEPLOYMENTS:
                         $this->deleteDeployment($getProjectDB, $deviceForFunctions, $deviceForBuilds, $document, $project);
@@ -102,7 +107,7 @@ class Deletes extends Action
                         $this->deleteInstallation($dbForConsole, $getProjectDB, $document, $project);
                         break;
                     case DELETE_TYPE_RULES:
-                        $this->deleteRule($dbForConsole, $document);
+                        $this->deleteRule($dbForConsole, $document, $certificates);
                         break;
                     default:
                         Console::error('No lazy delete operation available for document of type: ' . $document->getCollection());
@@ -110,7 +115,7 @@ class Deletes extends Action
                 }
                 break;
             case DELETE_TYPE_TEAM_PROJECTS:
-                $this->deleteProjectsByTeam($dbForConsole, $getProjectDB, $document);
+                $this->deleteProjectsByTeam($dbForConsole, $getProjectDB, $certificates, $document);
                 break;
             case DELETE_TYPE_EXECUTIONS:
                 $this->deleteExecutionLogs($project, $getProjectDB, $executionRetention);
@@ -264,7 +269,7 @@ class Deletes extends Action
                         MESSAGE_TYPE_EMAIL => 'emailTotal',
                         MESSAGE_TYPE_SMS => 'smsTotal',
                         MESSAGE_TYPE_PUSH => 'pushTotal',
-                        default => throw new Exception('Invalid target provider type'),
+                        default => throw new Exception('Invalid target CertificatesAdapter type'),
                     };
                     $dbForProject->decreaseDocumentAttribute(
                         'topics',
@@ -442,7 +447,7 @@ class Deletes extends Action
      * @throws Structure
      * @throws Exception
      */
-    private function deleteProjectsByTeam(Database $dbForConsole, callable $getProjectDB, Document $document): void
+    private function deleteProjectsByTeam(Database $dbForConsole, callable $getProjectDB, CertificatesAdapter $certificates, Document $document): void
     {
 
         $projects = $dbForConsole->find('projects', [
@@ -455,7 +460,7 @@ class Deletes extends Action
             $deviceForBuilds = getDevice(APP_STORAGE_BUILDS . '/app-' . $project->getId());
             $deviceForCache = getDevice(APP_STORAGE_CACHE . '/app-' . $project->getId());
 
-            $this->deleteProject($dbForConsole, $getProjectDB, $deviceForFiles, $deviceForFunctions, $deviceForBuilds, $deviceForCache, $project);
+            $this->deleteProject($dbForConsole, $getProjectDB, $deviceForFiles, $deviceForFunctions, $deviceForBuilds, $deviceForCache, $certificates, $project);
             $dbForConsole->deleteDocument('projects', $project->getId());
         }
     }
@@ -473,7 +478,7 @@ class Deletes extends Action
      * @throws Authorization
      * @throws DatabaseException
      */
-    private function deleteProject(Database $dbForConsole, callable $getProjectDB, Device $deviceForFiles, Device $deviceForFunctions, Device $deviceForBuilds, Device $deviceForCache, Document $document): void
+    private function deleteProject(Database $dbForConsole, callable $getProjectDB, Device $deviceForFiles, Device $deviceForFunctions, Device $deviceForBuilds, Device $deviceForCache, CertificatesAdapter $certificates, Document $document): void
     {
         $projectInternalId = $document->getInternalId();
         $projectId = $document->getId();
@@ -494,30 +499,24 @@ class Deletes extends Action
         ];
 
         $limit = \count($projectCollectionIds) + 25;
+        $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
 
         while (true) {
             $collections = $dbForProject->listCollections($limit);
 
             foreach ($collections as $collection) {
-                if ($dsn->getHost() !== System::getEnv('_APP_DATABASE_SHARED_TABLES', '') || !\in_array($collection->getId(), $projectCollectionIds)) {
-                    try {
+                try {
+                    if (!\in_array($dsn->getHost(), $sharedTables) || !\in_array($collection->getId(), $projectCollectionIds)) {
                         $dbForProject->deleteCollection($collection->getId());
-                    } catch (Throwable $e) {
-                        Console::error('Error deleting '.$collection->getId().' '.$e->getMessage());
-
-                        /**
-                         * Ignore junction tables;
-                         */
-                        if (!preg_match('/^_\d+_\d+$/', $collection->getId())) {
-                            throw $e;
-                        }
+                    } else {
+                        $this->deleteByGroup($collection->getId(), [], database: $dbForProject);
                     }
-                } else {
-                    $this->deleteByGroup($collection->getId(), [], database: $dbForProject);
+                } catch (Throwable $e) {
+                    Console::error('Error deleting '.$collection->getId().' '.$e->getMessage());
                 }
             }
 
-            if ($dsn->getHost() === System::getEnv('_APP_DATABASE_SHARED_TABLES', '')) {
+            if (\in_array($dsn->getHost(), $sharedTables)) {
                 $collectionsIds = \array_map(fn ($collection) => $collection->getId(), $collections);
 
                 if (empty(\array_diff($collectionsIds, $projectCollectionIds))) {
@@ -536,8 +535,8 @@ class Deletes extends Action
         // Delete project and function rules
         $this->deleteByGroup('rules', [
             Query::equal('projectInternalId', [$projectInternalId])
-        ], $dbForConsole, function (Document $document) use ($dbForConsole) {
-            $this->deleteRule($dbForConsole, $document);
+        ], $dbForConsole, function (Document $document) use ($dbForConsole, $certificates) {
+            $this->deleteRule($dbForConsole, $document, $certificates);
         });
 
         // Delete Keys
@@ -571,10 +570,10 @@ class Deletes extends Action
         ], $dbForConsole);
 
         // Delete metadata table
-        if ($dsn->getHost() !== System::getEnv('_APP_DATABASE_SHARED_TABLES', '')) {
-            $dbForProject->deleteCollection('_metadata');
+        if (!\in_array($dsn->getHost(), $sharedTables)) {
+            $dbForProject->deleteCollection(Database::METADATA);
         } else {
-            $this->deleteByGroup('_metadata', [], $dbForProject);
+            $this->deleteByGroup(Database::METADATA, [], $dbForProject);
         }
 
         // Delete all storage directories
@@ -738,7 +737,7 @@ class Deletes extends Action
      * @return void
      * @throws Exception
      */
-    private function deleteFunction(Database $dbForConsole, callable $getProjectDB, Device $deviceForFunctions, Device $deviceForBuilds, Document $document, Document $project): void
+    private function deleteFunction(Database $dbForConsole, callable $getProjectDB, Device $deviceForFunctions, Device $deviceForBuilds, CertificatesAdapter $certificates, Document $document, Document $project): void
     {
         $projectId = $project->getId();
         $dbForProject = $getProjectDB($project);
@@ -753,8 +752,8 @@ class Deletes extends Action
             Query::equal('resourceType', ['function']),
             Query::equal('resourceInternalId', [$functionInternalId]),
             Query::equal('projectInternalId', [$project->getInternalId()])
-        ], $dbForConsole, function (Document $document) use ($project, $dbForConsole) {
-            $this->deleteRule($dbForConsole, $document);
+        ], $dbForConsole, function (Document $document) use ($project, $dbForConsole, $certificates) {
+            $this->deleteRule($dbForConsole, $document, $certificates);
         });
 
         /**
@@ -1040,21 +1039,10 @@ class Deletes extends Action
      * @param Document $document rule document
      * @return void
      */
-    private function deleteRule(Database $dbForConsole, Document $document): void
+    private function deleteRule(Database $dbForConsole, Document $document, CertificatesAdapter $certificates): void
     {
-
         $domain = $document->getAttribute('domain');
-        $directory = APP_STORAGE_CERTIFICATES . '/' . $domain;
-        $checkTraversal = realpath($directory) === $directory;
-
-        if ($checkTraversal && is_dir($directory)) {
-            // Delete files, so Traefik is aware of change
-            array_map('unlink', glob($directory . '/*.*'));
-            rmdir($directory);
-            Console::info("Deleted certificate files for {$domain}");
-        } else {
-            Console::info("No certificate files found for {$domain}");
-        }
+        $certificates->deleteCertificate($domain);
 
         // Delete certificate document, so Appwrite is aware of change
         if (isset($document['certificateId'])) {

src/Appwrite/Utopia/Response/Model/Func.php

@@ -94,7 +94,7 @@ class Func extends Model
             ])
             ->addRule('schedule', [
                 'type' => self::TYPE_STRING,
-                'description' => 'Function execution schedult in CRON format.',
+                'description' => 'Function execution schedule in CRON format.',
                 'default' => '',
                 'example' => '5 4 * * *',
             ])

tests/e2e/Services/Databases/DatabasesCustomServerTest.php

@@ -1362,7 +1362,7 @@ class DatabasesCustomServerTest extends Scope
         ]);
 
         $this->assertEquals(400, $tooWide['headers']['status-code']);
-        $this->assertEquals('Attribute limit exceeded', $tooWide['body']['message']);
+        $this->assertEquals('attribute_limit_exceeded', $tooWide['body']['type']);
     }
 
     public function testIndexLimitException()

tests/e2e/Services/Projects/ProjectsConsoleClientTest.php

@@ -3727,11 +3727,11 @@ class ProjectsConsoleClientTest extends Scope
             'x-appwrite-project' => $this->getProject()['$id'],
         ], $this->getHeaders()), [
             'teamId' => ID::unique(),
-            'name' => 'Amating Team',
+            'name' => 'Amazing Team',
         ]);
 
         $this->assertEquals(201, $team['headers']['status-code']);
-        $this->assertEquals('Amating Team', $team['body']['name']);
+        $this->assertEquals('Amazing Team', $team['body']['name']);
         $this->assertNotEmpty($team['body']['$id']);
 
         $teamId = $team['body']['$id'];
@@ -3794,6 +3794,103 @@ class ProjectsConsoleClientTest extends Scope
         return $data;
     }
 
+    public function testDeleteSharedProject(): void
+    {
+        $team = $this->client->call(Client::METHOD_POST, '/teams', array_merge([
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ], $this->getHeaders()), [
+            'teamId' => ID::unique(),
+            'name' => 'Amazing Team',
+        ]);
+
+        $teamId = $team['body']['$id'];
+
+        // Ensure deleting one project does not affect another project
+        $project1 = $this->client->call(Client::METHOD_POST, '/projects', array_merge([
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ], $this->getHeaders()), [
+            'projectId' => ID::unique(),
+            'name' => 'Amazing Project 1',
+            'teamId' => $teamId,
+            'region' => 'default'
+        ]);
+
+        $project2 = $this->client->call(Client::METHOD_POST, '/projects', array_merge([
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ], $this->getHeaders()), [
+            'projectId' => ID::unique(),
+            'name' => 'Amazing Project 2',
+            'teamId' => $teamId,
+            'region' => 'default'
+        ]);
+
+        $project1Id = $project1['body']['$id'];
+        $project2Id = $project2['body']['$id'];
+
+        // Create user in each project
+        $key1 = $this->client->call(Client::METHOD_POST, '/projects/' . $project1Id . '/keys', array_merge([
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ], $this->getHeaders()), [
+            'name' => 'Key Test',
+            'scopes' => ['users.read', 'users.write'],
+        ]);
+
+        $user1 = $this->client->call(Client::METHOD_POST, '/users', [
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $project1Id,
+            'x-appwrite-key' => $key1['body']['secret'],
+        ], [
+            'userId' => ID::unique(),
+            'email' => 'test1@appwrite.io',
+            'password' => 'password',
+        ]);
+
+        $this->assertEquals(201, $user1['headers']['status-code']);
+
+        $key2 = $this->client->call(Client::METHOD_POST, '/projects/' . $project2Id . '/keys', array_merge([
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ], $this->getHeaders()), [
+            'name' => 'Key Test',
+            'scopes' => ['users.read', 'users.write'],
+        ]);
+
+        $user2 = $this->client->call(Client::METHOD_POST, '/users', [
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $project2Id,
+            'x-appwrite-key' => $key2['body']['secret'],
+        ], [
+            'userId' => ID::unique(),
+            'email' => 'test2@appwrite.io',
+            'password' => 'password',
+        ]);
+
+        $this->assertEquals(201, $user2['headers']['status-code']);
+
+        // Delete project 1
+        $project1 = $this->client->call(Client::METHOD_DELETE, '/projects/' . $project1Id, array_merge([
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $this->getProject()['$id'],
+        ], $this->getHeaders()));
+
+        $this->assertEquals(204, $project1['headers']['status-code']);
+
+        \sleep(3);
+
+        // Ensure project 2 user is still there
+        $user2 = $this->client->call(Client::METHOD_GET, '/users/' . $user2['body']['$id'], [
+            'content-type' => 'application/json',
+            'x-appwrite-project' => $project2Id,
+            'x-appwrite-key' => $key2['body']['secret'],
+        ]);
+
+        $this->assertEquals(200, $user2['headers']['status-code']);
+    }
+
     /**
      * @depends testCreateProject
      */