Merge pull request #11185 from Shivangisharma4/doc-fix-typos-contributing

doc: Fix typos in CONTRIBUTING.md

.env

@@ -21,13 +21,13 @@ _APP_OPTIONS_ROUTER_PROTECTION=disabled
 _APP_OPTIONS_FORCE_HTTPS=disabled
 _APP_OPTIONS_ROUTER_FORCE_HTTPS=disabled
 _APP_OPENSSL_KEY_V1=your-secret-key
-_APP_DNS=8.8.8.8
-_APP_DOMAIN=traefik
+_APP_DNS=172.16.238.100 # CoreDNS
+_APP_DOMAIN=appwrite.test
 _APP_CONSOLE_DOMAIN=localhost
 _APP_DOMAIN_FUNCTIONS=functions.localhost
 _APP_DOMAIN_SITES=sites.localhost
-_APP_DOMAIN_TARGET_CNAME=test.localhost
-_APP_DOMAIN_TARGET_A=127.0.0.1
+_APP_DOMAIN_TARGET_CNAME=cname.localhost
+_APP_DOMAIN_TARGET_A=203.0.0.1
 _APP_DOMAIN_TARGET_AAAA=::1
 _APP_DOMAIN_TARGET_CAA=digicert.com
 _APP_RULES_FORMAT=md5
@@ -103,6 +103,7 @@ _APP_MAINTENANCE_RETENTION_USAGE_HOURLY=8640000
 _APP_MAINTENANCE_RETENTION_SCHEDULES=86400
 _APP_USAGE_STATS=enabled
 _APP_LOGGING_CONFIG=
+_APP_LOGGING_CONFIG_REALTIME=
 _APP_GRAPHQL_MAX_BATCH_SIZE=10
 _APP_GRAPHQL_MAX_COMPLEXITY=250
 _APP_GRAPHQL_MAX_DEPTH=4
@@ -123,4 +124,5 @@ _APP_MESSAGE_PUSH_TEST_DSN=
 _APP_WEBHOOK_MAX_FAILED_ATTEMPTS=10
 _APP_PROJECT_REGIONS=default
 _APP_FUNCTIONS_CREATION_ABUSE_LIMIT=5000
-_APP_STATS_USAGE_DUAL_WRITING_DBS=database_db_main
+_APP_STATS_USAGE_DUAL_WRITING_DBS=database_db_main
+_APP_TRUSTED_HEADERS=x-forwarded-for

.gitattributes

@@ -5,3 +5,5 @@ src/** linguist-detectable=false
 tests/** linguist-detectable=false
 public/scripts/** linguist-detectable=false
 public/dist/scripts/** linguist-detectable=false
+
+.github/workflows/*.lock.yml linguist-generated=true merge=ours

.github/labeler.yml

@@ -0,0 +1,83 @@
+# Fixes and upgrades for the Appwrite Auth / Users / Teams services.
+"product / auth":
+  - "(auth|session|login|logout|register|2fa|mfa|users|teams|memberships|invite|oauth|oauth2|sso|jwt)"
+
+# Fixes and upgrades for the Appwrite Realtime API.
+"api / realtime":
+  - "(realtime|subscribe|websockets)"
+
+# Console, UI and UX issues
+"product / console":
+  - "(console)"
+
+# Fixes and upgrades for the Appwrite Storage.
+"product / storage":
+  - "(storage|bucket|file|image|preview|download)"
+
+# Fixes and upgrades for the Appwrite Database.
+"product / databases":
+  - "(database|collection|tables|attribute|column|document|row|query|queries|indexes|search|filter|sort|pagination)"
+
+# Fixes and upgrades for the Appwrite Functions.
+"product / functions":
+  - "(function|runtime|deployment|execution|trigger|cron|schedule)"
+
+# Fixes and upgrades for the Appwrite Docs.
+# "product / docs":
+#   -
+
+# Fixes and upgrades for the Appwrite Migrations.
+"product / migrations":
+  - "(migrate|migration)"
+
+# Fixes and upgrades for the Appwrite Messaging.
+"product / messaging":
+  - "(messaging|email|sms|push|provider|topic|target|notification)"
+
+# Fixes and upgrades for the Appwrite Platform.
+# "product / platform":
+#   -
+
+# Fixes and upgrades for database relationships
+"feature / relationships":
+  - "(relationship)"
+
+# Issues found only on Appwrite Cloud
+# "product / cloud":
+#   -
+
+# Fixes and upgrades for the Appwrite VCS.
+"product / vcs":
+  - "(repo|push|vcs|repository)"
+
+# Fixes and upgrades for the Appwrite GraphQL API.
+"api / graphql":
+  - "(graphql|gql|mutation)"
+
+# Fixes and upgrades for the Appwrite Assistant.
+"product / assistant":
+  - "(assistant)"
+
+# Fixes and upgrades for the Appwrite Domains.
+"product / domains":
+  - "(domain|dns|ssl|certificate)"
+
+# Fixes and upgrades for the Appwrite Locale.
+"product / locale":
+  - "(locale|i18n|internationalization|localization|l10n|translation|timezone|country)"
+
+# Fixes and upgrades for the Appwrite Avatars.
+"product / avatars":
+  - "(avatar|initial|flag|icon)"
+
+# Fixes and upgrades for Appwrite Sites.
+"product / sites":
+  - "(site|web|hosting|domain|ssl|certificate|nextjs|nuxt|react|angular|vue|svelte|astro)"
+
+# Fixes and upgrades for the Appwrite CLI.
+"sdk / cli":
+  - "(cli|command line)"
+
+# Issues only found when self-hosting Appwrite
+"product / self-hosted":
+  - "(self-host|self host)"

.github/workflows/ai-moderator.yml

@@ -0,0 +1,32 @@
+name: AI Moderator
+
+on:
+  issues:
+    types: [opened, edited]
+  issue_comment:
+    types: [created, edited]
+  pull_request:
+    types: [opened, edited]
+  pull_request_review:
+    types: [submitted, edited]
+  pull_request_review_comment:
+    types: [created, edited]
+  discussion:
+    types: [created, edited]
+  discussion_comment:
+    types: [created, edited]
+
+permissions:
+  models: read
+  issues: write
+  pull-requests: write
+  discussions: write
+
+jobs:
+  moderate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: AI Moderator
+        uses: github/ai-moderator@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/auto-label-issue.yml

@@ -0,0 +1,22 @@
+name: Auto Label Issue
+
+on:
+  issues:
+    types: [opened]
+
+permissions:
+  issues: write
+  contents: read
+
+jobs:
+  labeler:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Issue Labeler
+        uses: github/issue-labeler@v3.4
+        with:
+          configuration-path: .github/labeler.yml
+          enable-versioned-regex: false
+          include-title: 1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/issue-triage.md

@@ -0,0 +1,115 @@
+---
+on:
+  schedule:
+    - cron: '0 0 * * *'  # Run daily at midnight UTC
+  workflow_dispatch:  # Enable manual trigger
+  stop-after: +30d # workflow will no longer trigger after 30 days. Remove this and recompile to run indefinitely
+  reaction: eyes
+
+permissions: read-all
+
+# Add stricter error-detection patterns so issue text doesn't trigger agent error detection.
+# After merging this file run `gh aw compile` to regenerate the lock file.
+env:
+  GH_AW_ERROR_PATTERNS: >-
+    [
+      {"id":"gh-action-error","pattern":"^::(error)(?:\\\\s+[^:]*)?::(.+)","level_group":1,"message_group":2,"description":"GitHub Actions workflow command - error"},
+      {"id":"gh-action-warning","pattern":"^::(warning)(?:\\\\s+[^:]*)?::(.+)","level_group":1,"message_group":2,"description":"GitHub Actions workflow command - warning"},
+      {"id":"bracketed-level","pattern":"^\\[(ERROR|CRITICAL|WARNING|WARN)\\]\\s+(.+)","level_group":1,"message_group":2,"description":"Bracketed log level at start of line"},
+      {"id":"timestamped-copilot","pattern":"^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z\\s+\\[(ERROR|WARN|WARNING|CRITICAL)\\]\\s+(.+)","level_group":1,"message_group":3,"description":"Timestamped Copilot CLI messages"}
+    ]
+
+network: defaults
+
+safe-outputs:
+  add-labels:
+    max: 100
+    target: "*"
+  add-comment:
+    max: 10
+    target: "*"
+
+tools:
+  web-fetch:
+  web-search:
+  github:
+    toolsets:
+      - default
+      - labels
+
+timeout-minutes: 10
+source: githubnext/agentics/workflows/issue-triage.md@0837fb7b24c3b84ee77fb7c8cfa8735c48be347a
+---
+# Agentic Triage
+
+<!-- Note - this file can be customized to your needs. Replace this section directly, or add further instructions here. After editing run 'gh aw compile' -->
+
+You're a triage assistant for GitHub issues. Your task is to analyze issues that were either created in the last 24 hours or updated (with a new comment) in the last 24 hours, and perform initial triage tasks for each of them.
+
+1. First, use the `list_issues` tool to retrieve all issues created or updated in the last 24 hours. The `since` parameter filters by the issue's `updated_at` timestamp, which includes both newly created issues and recently commented issues. Calculate the timestamp from 24 hours ago (example: 2025-11-06T20:27:14Z for reference) and use it for the `since` parameter.
+
+2. For each issue found, perform the following triage tasks:
+
+3. Use the `get_comments` tool to retrieve all the comments on the issue.
+
+4. Check for spam and quality issue descriptions and comments first:
+   
+   - **Non-English Content**: If the issue is primarily written in a non-English language, add a respectful and appreciative comment explaining that while you appreciate their contribution, the majority of the community communicates in English and kindly ask them to repost in English so everyone can follow along and help. Provide a friendly translation of your message in their language if possible.
+   - **Multiple Topics**: If the issue discusses multiple unrelated topics or problems, add a comment explaining that each issue should focus on one clear topic so the team can effectively solve the right problem. Politely ask them to split it into separate issues.
+   - **Obvious Spam or Bot-Generated Content**: If the issue/comment is obviously spam, generated by a bot, or something that is not an actual issue to be worked on, add an issue comment with a one-sentence analysis and move to the next issue.
+
+5. Retrieve the issue content using the `get_issue` tool for any issues that pass the spam checks.
+
+6. Next, use the GitHub tools to gather additional context about the issue:
+
+   - Fetch the list of labels available in this repository using the `list_label` tool with `owner: "appwrite"` and `repo: "appwrite"` parameters. This will give you the labels you can use for triaging issues.
+   - Fetch any comments on the issue using the `get_issue_comments` tool to understand recent activity
+   - **Search for duplicate and related issues (repo first, then org-wide)**:
+     - First search in this repository using the `search_issues` tool with a query like: `repo:appwrite/appwrite is:issue (is:open OR is:closed) <key terms>`.
+     - Then perform an org-wide search across the entire Appwrite organization using: `org:appwrite is:issue (is:open OR is:closed) <key terms>`.
+     - Prefer linking to OPEN issues when identifying potential duplicates; include CLOSED ones as related history when useful.
+
+7. Analyze the issue content, considering:
+
+   - The issue title and description
+   - The type of issue (bug report, feature request, question, etc.)
+   - Technical areas mentioned
+   - Severity or priority indicators
+   - User impact
+   - Components affected
+
+8. Write notes, ideas, nudges, resource links, debugging strategies and/or reproduction steps for the team to consider relevant to the issue.
+
+9. Select appropriate labels from the available labels list:
+
+   - Choose labels that accurately reflect the issue's nature
+   - Be specific but comprehensive
+   - Select priority labels if you can determine urgency (high-priority, med-priority, or low-priority)
+   - Consider platform labels (android, ios) if applicable
+   - Search for similar issues. If you find a duplicate of another OPEN issue in THIS repository, you may use a "duplicate" label (if available) and reference the canonical issue.
+   - If the closest match is in another repository within the Appwrite org, do NOT mark as duplicate here; instead, link it in your comment under a "Cross‑repo related issues" section.
+   - Only select labels from the provided list
+   - Don't apply the `good first issue` or `help wanted` labels
+   - It's okay to not add any labels if none are clearly applicable
+
+10. Apply the selected labels:
+
+   - Use the `update_issue` tool to apply the labels to the issue
+   - DO NOT communicate directly with users
+   - If no labels are clearly applicable, do not apply any labels
+
+11. Add an issue comment to the issue with your analysis:
+   - Start with "🎯 Agentic Issue Triage"
+   - Provide a brief summary of the issue
+   - **If duplicate or related issues were found**, add sections listing them with links:
+     - "### 🔗 Potentially Related Issues (this repo)" – bullet list of same-repo issues with titles and links
+     - If applicable: "### 🌐 Cross-repo related issues (org: appwrite)" – bullet list including `owner/repo#number` with titles and links
+   - Mention any relevant details that might help the team understand the issue better
+   - Include any debugging strategies or reproduction steps if applicable
+   - Suggest resources or links that might be helpful for resolving the issue or learning skills related to the issue or the particular area of the codebase affected by it
+   - Mention any nudges or ideas that could help the team in addressing the issue
+   - If appropriate break the issue down to sub-tasks and write a checklist of things to do
+   - Use collapsed-by-default sections in the GitHub markdown to keep the comment tidy. Collapse all sections except the short main summary at the top. For bolded section titles, wrap the text with `<strong>` and `</strong>` to make it bold.
+   - Do not indicate/encourage a community member to submit a PR for the issue.
+
+12. After processing all issues, provide a summary of how many issues were triaged (created or updated in the last 24 hours). If no issues matched the criteria, simply note that no issues needed triage.

.github/workflows/publish.yml

@@ -42,6 +42,7 @@ jobs:
       with:
         context: .
         platforms: linux/amd64,linux/arm64
+        target: production
         build-args: |
           VERSION=${{ steps.meta.outputs.version }}
           VITE_APPWRITE_GROWTH_ENDPOINT=https://growth.appwrite.io/v1

.github/workflows/release.yml

@@ -20,10 +20,10 @@ jobs:
         submodules: recursive
 
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v2
+      uses: docker/setup-qemu-action@v3
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v2
+      uses: docker/setup-buildx-action@v3
 
     - name: Login to Docker Hub
       uses: docker/login-action@v2
@@ -46,6 +46,7 @@ jobs:
       with:
         context: .
         platforms: linux/amd64,linux/arm64
+        target: production
         build-args: |
           VERSION=${{ steps.meta.outputs.version }}
         push: true

CHANGES.md

@@ -1,266 +1,654 @@
+# Version 1.8.0
+
+## What's Changed
+
+### Notable changes
+
+* Do not allow full range in [#9847](https://github.com/appwrite/appwrite/pull/9847)
+* Expose internal id as a part of auto increment id in [#9713](https://github.com/appwrite/appwrite/pull/9713)
+* Expose sequence in [#9870](https://github.com/appwrite/appwrite/pull/9870)
+* Add flutter 3.32 and dart 3.8 runtimes in [#9914](https://github.com/appwrite/appwrite/pull/9914)
+* Shorten commit url and branch url in [#9919](https://github.com/appwrite/appwrite/pull/9919)
+* Remove powered by from error pages in [#9927](https://github.com/appwrite/appwrite/pull/9927)
+* Enable resource limits on GIF previews in [#9940](https://github.com/appwrite/appwrite/pull/9940)
+* Only run maintenance task for projects accessed in last 24 hours in [#9989](https://github.com/appwrite/appwrite/pull/9989)
+* Add increment + decrement routes in [#9986](https://github.com/appwrite/appwrite/pull/9986)
+* Only run maintenance task for projects accessed in last 30 days in [#9995](https://github.com/appwrite/appwrite/pull/9995)
+* Update appwrite-assistant image version to 0.8.3 in [#10003](https://github.com/appwrite/appwrite/pull/10003)
+* Update emails to use button in [#9590](https://github.com/appwrite/appwrite/pull/9590)
+* Create commit & branch url for first git deployment when site is linked to repo in [#9969](https://github.com/appwrite/appwrite/pull/9969)
+* Handle React Native schemes in [#9650](https://github.com/appwrite/appwrite/pull/9650)
+* Handle origin validation for web extensions in [#10107](https://github.com/appwrite/appwrite/pull/10107)
+* Preview text for emails in [#10198](https://github.com/appwrite/appwrite/pull/10198)
+* Create email target when using email OTP registration in [#10224](https://github.com/appwrite/appwrite/pull/10224)
+* Add CSV imports in [#10231](https://github.com/appwrite/appwrite/pull/10231)
+* Add support for svg favicons in [#10255](https://github.com/appwrite/appwrite/pull/10255)
+* Realtime support for bulk api in [#10096](https://github.com/appwrite/appwrite/pull/10096)
+* Skip redundant subqueries in users list route in [#10297](https://github.com/appwrite/appwrite/pull/10297)
+* Add native sign in with Apple function template in [#10286](https://github.com/appwrite/appwrite/pull/10286)
+* Add support for HEAD requests in [#10304](https://github.com/appwrite/appwrite/pull/10304)
+* Update invite email copy in [#10309](https://github.com/appwrite/appwrite/pull/10309)
+* Increase dynamic API key expiration in [#10328](https://github.com/appwrite/appwrite/pull/10328)
+* Add TablesDB service in [#10333](https://github.com/appwrite/appwrite/pull/10333)
+* Add execution.deploymentId to response model in [#10357](https://github.com/appwrite/appwrite/pull/10357)
+* Switch Union China Pay to just Union Pay in [#10372](https://github.com/appwrite/appwrite/pull/10372) and [#10382](https://github.com/appwrite/appwrite/pull/10382)
+* Add execution id and log id to response headers in [#10379](https://github.com/appwrite/appwrite/pull/10379)
+* Add executionId and client IP to function headers in [#9147](https://github.com/appwrite/appwrite/pull/9147)
+* Allow HEAD requests in function executions in [#10385](https://github.com/appwrite/appwrite/pull/10385)
+* Add support for select queries when listing deployments in [#10380](https://github.com/appwrite/appwrite/pull/10380)
+* Add spatial type attributes in [#10356](https://github.com/appwrite/appwrite/pull/10356) and [#10443](https://github.com/appwrite/appwrite/pull/10443)
+* Add realtime support for bulk upserts in [#10425](https://github.com/appwrite/appwrite/pull/10425)
+* Add previewUrl to vcs comment from vcs controller in [#10396](https://github.com/appwrite/appwrite/pull/10396)
+* Rename verification SDK methods to be more specific in [#10606](https://github.com/appwrite/appwrite/pull/10606)
+* Add project name in email subject in [#10609](https://github.com/appwrite/appwrite/pull/10609)
+* Throw error when email is not available for account verification in [#10533](https://github.com/appwrite/appwrite/pull/10533)
+* Add support for transactions in [#10023](https://github.com/appwrite/appwrite/pull/10023) and [#10624](https://github.com/appwrite/appwrite/pull/10624)
+* Use bcc only emails for smtp in [#10644](https://github.com/appwrite/appwrite/pull/10644)
+
+### Fixes
+
+* Fix rules on active deployment in [#9902](https://github.com/appwrite/appwrite/pull/9902)
+* Fix for upserts with differing optional parameter sets in [#9928](https://github.com/appwrite/appwrite/pull/9928)
+* Fix teams deletion in [#9888](https://github.com/appwrite/appwrite/pull/9888)
+* Fix deletion logic in [#9938](https://github.com/appwrite/appwrite/pull/9938)
+* Update database for upsert fix in [#9941](https://github.com/appwrite/appwrite/pull/9941)
+* Fix expire format in account recovery, verification, phone and mfa in [#9600](https://github.com/appwrite/appwrite/pull/9600)
+* Fix github comments and deployment creation on branch deletion in [#9949](https://github.com/appwrite/appwrite/pull/9949)
+* Fix cache issues with proxy for deployment download in [#9971](https://github.com/appwrite/appwrite/pull/9971)
+* Redirect rule parent resource in [#9982](https://github.com/appwrite/appwrite/pull/9982)
+* Fix usage queues in [#9946](https://github.com/appwrite/appwrite/pull/9946)
+* Transfer control for the migration in [#9997](https://github.com/appwrite/appwrite/pull/9997)
+* Prevent 'Attribute "factors" must be an array' error in [#10004](https://github.com/appwrite/appwrite/pull/10004)
+* Fix all vcs urls missing region in [#9998](https://github.com/appwrite/appwrite/pull/9998)
+* Add readable error for csv imports in [#9947](https://github.com/appwrite/appwrite/pull/9947)
+* Fix missing screenshot logs in [#10024](https://github.com/appwrite/appwrite/pull/10024)
+* Update executor to fix s3 endpoint bug in [#10036](https://github.com/appwrite/appwrite/pull/10036)
+* Fix build duration calculation in [#10053](https://github.com/appwrite/appwrite/pull/10053)
+* Fix logs order in [#10052](https://github.com/appwrite/appwrite/pull/10052)
+* Fix platform check for Sites with automatic rule in [#10043](https://github.com/appwrite/appwrite/pull/10043)
+* Increase cache ttl to ensure hits in [#10079](https://github.com/appwrite/appwrite/pull/10079)
+* Fix connect to existing repo flow in [#10034](https://github.com/appwrite/appwrite/pull/10034)
+* Fix migrations path and type in [#10090](https://github.com/appwrite/appwrite/pull/10090)
+* Fix JWT authentication database selection for admin mode in [#10098](https://github.com/appwrite/appwrite/pull/10098)
+* Use _APP_CONSOLE_DOMAIN, if not found, then use _APP_DOMAIN in [#9999](https://github.com/appwrite/appwrite/pull/9999)
+* Fix file tokens not working on file-security in [#10120](https://github.com/appwrite/appwrite/pull/10120)
+* Fix build activation race condition in [#9952](https://github.com/appwrite/appwrite/pull/9952)
+* Changed the default permission param of upsert document in [#10129](https://github.com/appwrite/appwrite/pull/10129)
+* Fix success validation in oauth2 redirect in [#10130](https://github.com/appwrite/appwrite/pull/10130)
+* Update OAuth2 redirect URLs in [#10119](https://github.com/appwrite/appwrite/pull/10119)
+* Fix specs with new env vars in [#10135](https://github.com/appwrite/appwrite/pull/10135)
+* Skip deployment when commit is created by us in [#10187](https://github.com/appwrite/appwrite/pull/10187)
+* Use direct source for file-preview when empty in [#10181](https://github.com/appwrite/appwrite/pull/10181)
+* Better error message for invalid function scheduled time in [#10201](https://github.com/appwrite/appwrite/pull/10201)
+* Add defaultBranch in getRepository response in [#10190](https://github.com/appwrite/appwrite/pull/10190)
+* Filter sequence to int because any models skip rule checks in [#10221](https://github.com/appwrite/appwrite/pull/10221)
+* Fix 500 errors on robots and humans txt files in [#10248](https://github.com/appwrite/appwrite/pull/10248)
+* Fix atomic number ops with limit 0 in [#10264](https://github.com/appwrite/appwrite/pull/10264)
+* Update build command for flutter in [#10288](https://github.com/appwrite/appwrite/pull/10288)
+* Add a fallback locale in [#10307](https://github.com/appwrite/appwrite/pull/10307)
+* Fix variables sharing across resources in [#10308](https://github.com/appwrite/appwrite/pull/10308)
+* Fix uncaught invalid arg in [#10318](https://github.com/appwrite/appwrite/pull/10318)
+* Add missing upsert event in [#10317](https://github.com/appwrite/appwrite/pull/10317)
+* Improve font reliability in [#10332](https://github.com/appwrite/appwrite/pull/10332)
+* Truncate logs in function worker in [#9773](https://github.com/appwrite/appwrite/pull/9773)
+* Fix event template configuration issues in [#10350](https://github.com/appwrite/appwrite/pull/10350)
+* Fix users events & missed publisher logic for Functions in [#10348](https://github.com/appwrite/appwrite/pull/10348)
+* Fix incorrect file token expiry in [#10329](https://github.com/appwrite/appwrite/pull/10329)
+* Fix upserting that makes no change in [#10363](https://github.com/appwrite/appwrite/pull/10363) and [#10364](https://github.com/appwrite/appwrite/pull/10364)
+* Fix domain validator in [#10374](https://github.com/appwrite/appwrite/pull/10374)
+* Apply sequence integer casting and attribute cleanup fixes to Row model, TablesDB tests, and document processing in [#10383](https://github.com/appwrite/appwrite/pull/10383)
+* Fix domain validator in [#10386](https://github.com/appwrite/appwrite/pull/10386)
+* Fix sequence removal in [#10388](https://github.com/appwrite/appwrite/pull/10388)
+* Fix TablesDB scopes in [#10387](https://github.com/appwrite/appwrite/pull/10387)
+* Fix request filter in [#10389](https://github.com/appwrite/appwrite/pull/10389)
+* Fix nested filter selects in [#10393](https://github.com/appwrite/appwrite/pull/10393)
+* Fix readonly attr stripping on write in [#10405](https://github.com/appwrite/appwrite/pull/10405)
+* Replace %s with mustache placeholder in [#10392](https://github.com/appwrite/appwrite/pull/10392)
+* Support array headers for set-cookie in [#10427](https://github.com/appwrite/appwrite/pull/10427)
+* Fix put prefs structure validation in [#10436](https://github.com/appwrite/appwrite/pull/10436)
+* Fix oauth identity check in [#10460](https://github.com/appwrite/appwrite/pull/10460)
+* Fix check in [#10489](https://github.com/appwrite/appwrite/pull/10489)
+* Fix database usage metrics  in [#10483](https://github.com/appwrite/appwrite/pull/10483)
+* Throw appropriate 400s from request filters in [#10502](https://github.com/appwrite/appwrite/pull/10502)
+* Catch query exception on bucket/file list in [#10505](https://github.com/appwrite/appwrite/pull/10505)
+* Use outputDirectory attribute from deployment in [#10571](https://github.com/appwrite/appwrite/pull/10571)
+* Fix buildOutput attribute name in deployment check in [#10572](https://github.com/appwrite/appwrite/pull/10572)
+* Update database for nested selection fix in [#10577](https://github.com/appwrite/appwrite/pull/10577)
+* Auto-allow sites domain for OAuth in [#10503](https://github.com/appwrite/appwrite/pull/10503)
+* Handle OIDC well-known endpoint errors in [#10589](https://github.com/appwrite/appwrite/pull/10589)
+* Correct invalid template links in Create temporary deployment endpoint in [#10581](https://github.com/appwrite/appwrite/pull/10581)
+* Update broken create table links in TablesDB docs in [#10592](https://github.com/appwrite/appwrite/pull/10592)
+* Fix cross API compatibility in [#10626](https://github.com/appwrite/appwrite/pull/10626)
+* Fix code 0 from databases on realtime in [#10631](https://github.com/appwrite/appwrite/pull/10631)
+* Throw duplicate error when function id already exists in [#10618](https://github.com/appwrite/appwrite/pull/10618)
+
+### Miscellaneous
+
+* Fix task coroutine hooks in [#9850](https://github.com/appwrite/appwrite/pull/9850)
+* Feat sync encrypt updates in [#9871](https://github.com/appwrite/appwrite/pull/9871)
+* Revert "Feat sync encrypt updates" in [#9877](https://github.com/appwrite/appwrite/pull/9877)
+* Add builds worker group in [#9872](https://github.com/appwrite/appwrite/pull/9872)
+* Revert encrypted attribute changes in [#9898](https://github.com/appwrite/appwrite/pull/9898)
+* Update sdk generator and sdks in [#9849](https://github.com/appwrite/appwrite/pull/9849)
+* Release cli in [#9900](https://github.com/appwrite/appwrite/pull/9900)
+* Improve how rules are fetched in [#9915](https://github.com/appwrite/appwrite/pull/9915)
+* Sync 1.6 in [#9920](https://github.com/appwrite/appwrite/pull/9920)
+* Update messaging library in [#9764](https://github.com/appwrite/appwrite/pull/9764)
+* Disable TCP hook on stats resources in [#9932](https://github.com/appwrite/appwrite/pull/9932)
+* Remove JSON index on roles due to MySQL bug in [#9924](https://github.com/appwrite/appwrite/pull/9924)
+* Update queue in [#9936](https://github.com/appwrite/appwrite/pull/9936)
+* Fix flaky account tests in [#9954](https://github.com/appwrite/appwrite/pull/9954)
+* Fix flaky messaging test in [#9957](https://github.com/appwrite/appwrite/pull/9957)
+* Make usage tests robust in [#9956](https://github.com/appwrite/appwrite/pull/9956)
+* Increase deployment timeouts in tests in [#9955](https://github.com/appwrite/appwrite/pull/9955)
+* Graceful shutdown on SIGTERM in [#9890](https://github.com/appwrite/appwrite/pull/9890)
+* Bring back telemetry for storage in [#9903](https://github.com/appwrite/appwrite/pull/9903)
+* Update version to 1.7.4 and add experimental warnings in [#9959](https://github.com/appwrite/appwrite/pull/9959)
+* Return queue pre-fetch results in [#9731](https://github.com/appwrite/appwrite/pull/9731)
+* Update SDK versions in [#9987](https://github.com/appwrite/appwrite/pull/9987)
+* Restore unique filename for health check #9842 in [#9993](https://github.com/appwrite/appwrite/pull/9993)
+* Add after build hook in [#9996](https://github.com/appwrite/appwrite/pull/9996)
+* Remove endpoint selector in [#10000](https://github.com/appwrite/appwrite/pull/10000)
+* Use static code instead of astro in tests in [#9966](https://github.com/appwrite/appwrite/pull/9966)
+* Add ref param to vcs list contents in [#9991](https://github.com/appwrite/appwrite/pull/9991)
+* Update coderabbit config file in [#10005](https://github.com/appwrite/appwrite/pull/10005)
+* TAR support in [#10016](https://github.com/appwrite/appwrite/pull/10016)
+* Update delete project scope in [#10017](https://github.com/appwrite/appwrite/pull/10017)
+* Lazy-load relationships in [#9669](https://github.com/appwrite/appwrite/pull/9669)
+* Revert "Feat: Lazy-load relationships" in [#10018](https://github.com/appwrite/appwrite/pull/10018)
+* Revert "Update delete project scope" in [#10022](https://github.com/appwrite/appwrite/pull/10022)
+* 1.8.x in [#9985](https://github.com/appwrite/appwrite/pull/9985)
+* Update cli version and add bulk operation warnings in [#10007](https://github.com/appwrite/appwrite/pull/10007)
+* Update Appwrite description to include Sites, add MCP to products list in [#9867](https://github.com/appwrite/appwrite/pull/9867)
+* Update README.md in [#10026](https://github.com/appwrite/appwrite/pull/10026)
+* Fix duplication of platforms in swagger specs in [#10008](https://github.com/appwrite/appwrite/pull/10008)
+* Update react native sdk and changelog in [#10025](https://github.com/appwrite/appwrite/pull/10025)
+* Update delete project signature in [#10028](https://github.com/appwrite/appwrite/pull/10028)
+* Fix Golang SDK examples for docs in [#10001](https://github.com/appwrite/appwrite/pull/10001)
+* Revert "worker: Graceful shutdown on SIGTERM" in [#10035](https://github.com/appwrite/appwrite/pull/10035)
+* Fix benchmark CI in [#10055](https://github.com/appwrite/appwrite/pull/10055)
+* Use ->action(...)) instead of ->callback([$this, 'action']); in [#9967](https://github.com/appwrite/appwrite/pull/9967)
+* Override project via custom domains log in [#10011](https://github.com/appwrite/appwrite/pull/10011)
+* Add database worker job logging in [#10056](https://github.com/appwrite/appwrite/pull/10056)
+* Add runtimeEntrypoint param in [#10062](https://github.com/appwrite/appwrite/pull/10062)
+* Add missing injections in [#10061](https://github.com/appwrite/appwrite/pull/10061)
+* Replace Console loop with Swoole Timer for stats resource m… in [#10054](https://github.com/appwrite/appwrite/pull/10054)
+* Update README.md in [#10063](https://github.com/appwrite/appwrite/pull/10063)
+* Fix parameter order in action function for robots.txt route in [#10067](https://github.com/appwrite/appwrite/pull/10067)
+* Preview endpoint logging in [#10068](https://github.com/appwrite/appwrite/pull/10068)
+* Fix flakyness of account tests in [#10066](https://github.com/appwrite/appwrite/pull/10066)
+* Update cli to 8.1.0 and add changelog in [#10070](https://github.com/appwrite/appwrite/pull/10070)
+* Update composer.json and composer.lock to include appwrite-lab… in [#10051](https://github.com/appwrite/appwrite/pull/10051)
+* Fix tests, for `Cloud` in [#10085](https://github.com/appwrite/appwrite/pull/10085)
+* Update README.md in [#10084](https://github.com/appwrite/appwrite/pull/10084)
+* Revert "chore: update composer.json and composer.lock to include appwrite-lab…" in [#10086](https://github.com/appwrite/appwrite/pull/10086)
+* Update README to add Bulk API link in [#10095](https://github.com/appwrite/appwrite/pull/10095)
+* Add redis publisher to schedule base if available in [#10099](https://github.com/appwrite/appwrite/pull/10099)
+* Fix site template test in [#10104](https://github.com/appwrite/appwrite/pull/10104)
+* Update nodejs 17.1.0 in [#10088](https://github.com/appwrite/appwrite/pull/10088)
+* Update README.md to add Upsert announcement in [#10112](https://github.com/appwrite/appwrite/pull/10112)
+* Reduce delete batch size in [#10128](https://github.com/appwrite/appwrite/pull/10128)
+* Update README.md in [#10134](https://github.com/appwrite/appwrite/pull/10134)
+* Speed up tests in [#10127](https://github.com/appwrite/appwrite/pull/10127)
+* Update cli to 8.2.0 in [#10136](https://github.com/appwrite/appwrite/pull/10136)
+* Prevent injected $user from being shadowed in [#10150](https://github.com/appwrite/appwrite/pull/10150)
+* Update react native to 0.10.1 and dotnet to 0.14.0 in [#10138](https://github.com/appwrite/appwrite/pull/10138)
+* Update README.md in [#10153](https://github.com/appwrite/appwrite/pull/10153)
+* Update cli 8.2.1 in [#10155](https://github.com/appwrite/appwrite/pull/10155)
+* Fix build usage specification in [#10157](https://github.com/appwrite/appwrite/pull/10157)
+* Handle redirect validator in specs + GraphQL type mapper in [#10158](https://github.com/appwrite/appwrite/pull/10158)
+* Update dart 16.1.0, flutter 17.0.2 and cli 8.2.2 in [#10161](https://github.com/appwrite/appwrite/pull/10161)
+* Improve invalid scheme error in origin check in [#10164](https://github.com/appwrite/appwrite/pull/10164)
+* 1.7.x in [#9897](https://github.com/appwrite/appwrite/pull/9897)
+* Added the cases of null permissions in the upsert route and update th… in [#10179](https://github.com/appwrite/appwrite/pull/10179)
+* Fix 1.7.x specs in [#10197](https://github.com/appwrite/appwrite/pull/10197)
+* Suppress git-action exception in deployment worker in [#10199](https://github.com/appwrite/appwrite/pull/10199)
+* Stats-usage on redis in [#10156](https://github.com/appwrite/appwrite/pull/10156)
+* Fix templates on `1.7.x`. in [#10203](https://github.com/appwrite/appwrite/pull/10203)
+* Change preview & body for MFA email in [#10205](https://github.com/appwrite/appwrite/pull/10205)
+* Add docs for nestedType, encode, from and toMap in [#10204](https://github.com/appwrite/appwrite/pull/10204)
+* Update sdks 1.7.x in [#10202](https://github.com/appwrite/appwrite/pull/10202)
+* Update migration release in [#10222](https://github.com/appwrite/appwrite/pull/10222)
+* Remove sequence on incoming docs in [#10228](https://github.com/appwrite/appwrite/pull/10228)
+* Filter certificates renewal task in maintenance by region in [#10227](https://github.com/appwrite/appwrite/pull/10227)
+* Move changelog to sdks platforms array in [#10233](https://github.com/appwrite/appwrite/pull/10233)
+* Update changelog and sdk gen in [#10247](https://github.com/appwrite/appwrite/pull/10247)
+* Telemetry for cache hits and misses in [#10240](https://github.com/appwrite/appwrite/pull/10240)
+* Add model examples + additonal examples to specs in [#10249](https://github.com/appwrite/appwrite/pull/10249)
+* Update favicons endpoint to fallback to ico instead of throwing error in [#10260](https://github.com/appwrite/appwrite/pull/10260)
+* Update README.md in [#10259](https://github.com/appwrite/appwrite/pull/10259)
+* Check CAA record before issuing certificate in [#10258](https://github.com/appwrite/appwrite/pull/10258)
+* Revert "Check CAA record before issuing certificate" in [#10263](https://github.com/appwrite/appwrite/pull/10263)
+* Test var id attribute in [#10243](https://github.com/appwrite/appwrite/pull/10243)
+* Add type attribute to the database creation flow in [#10266](https://github.com/appwrite/appwrite/pull/10266)
+* Add CAA validator in [#10267](https://github.com/appwrite/appwrite/pull/10267)
+* Update database type to grids and legacy in [#10273](https://github.com/appwrite/appwrite/pull/10273)
+* Update README.md in [#10272](https://github.com/appwrite/appwrite/pull/10272)
+* Upgrade composer for utopia migration in [#10274](https://github.com/appwrite/appwrite/pull/10274)
+* Update SDK generator and sdks in [#10271](https://github.com/appwrite/appwrite/pull/10271)
+* Fix wrong resource path for audits in [#10279](https://github.com/appwrite/appwrite/pull/10279)
+* Update `grid` on resource events in [#10282](https://github.com/appwrite/appwrite/pull/10282)
+* Add readonly param to sequence, databaseId and collectionId in [#10278](https://github.com/appwrite/appwrite/pull/10278)
+* Update migrations in [#10283](https://github.com/appwrite/appwrite/pull/10283)
+* Add placeholder detection in [#10284](https://github.com/appwrite/appwrite/pull/10284)
+* Update docker base to 0.10.3 in [#10285](https://github.com/appwrite/appwrite/pull/10285)
+* Make check for adding warning header stricter in [#10293](https://github.com/appwrite/appwrite/pull/10293)
+* Fix databases worker cache clearing bug in [#10294](https://github.com/appwrite/appwrite/pull/10294)
+* Reapply Redis functions queue in [#10299](https://github.com/appwrite/appwrite/pull/10299)
+* Add new database query type tests in [#10296](https://github.com/appwrite/appwrite/pull/10296)
+* Update package in [#10312](https://github.com/appwrite/appwrite/pull/10312)
+* Update required attributes in [#10311](https://github.com/appwrite/appwrite/pull/10311)
+* Remove experiment warnings from bulk methods in [#10310](https://github.com/appwrite/appwrite/pull/10310)
+* Update README.md in [#10313](https://github.com/appwrite/appwrite/pull/10313)
+* Added internal file param to handle upload to internal bucket in [#10321](https://github.com/appwrite/appwrite/pull/10321)
+* Remove temp logging in [#10302](https://github.com/appwrite/appwrite/pull/10302)
+* Improve sites test for stability in [#10331](https://github.com/appwrite/appwrite/pull/10331)
+* Database lib bump to 0.71.15 in [#10336](https://github.com/appwrite/appwrite/pull/10336)
+* Clarify userId param in endpoints that create accounts in [#10117](https://github.com/appwrite/appwrite/pull/10117)
+* Upgrade HTTP in [#10338](https://github.com/appwrite/appwrite/pull/10338)
+* Remove unnessessary external dependnecies in [#10343](https://github.com/appwrite/appwrite/pull/10343)
+* Sync main into 1.7.x in [#10347](https://github.com/appwrite/appwrite/pull/10347)
+* Fix TablesDB casing in [#10346](https://github.com/appwrite/appwrite/pull/10346)
+* Add cookies test in [#10352](https://github.com/appwrite/appwrite/pull/10352)
+* Update token tests with jwt decode in [#10354](https://github.com/appwrite/appwrite/pull/10354)
+* Utilize assets server for fonts in [#10358](https://github.com/appwrite/appwrite/pull/10358)
+* Sync main into 1.7.x in [#10359](https://github.com/appwrite/appwrite/pull/10359)
+* Bump 1.7.x in [#10365](https://github.com/appwrite/appwrite/pull/10365)
+* Fix queue health in [#10369](https://github.com/appwrite/appwrite/pull/10369)
+* Allow publisher messaging override in scheduler in [#10370](https://github.com/appwrite/appwrite/pull/10370)
+* Add replacewith and deprecated since to account methods in [#10377](https://github.com/appwrite/appwrite/pull/10377)
+* Update README.md in [#10376](https://github.com/appwrite/appwrite/pull/10376)
+* Update CLI in [#10390](https://github.com/appwrite/appwrite/pull/10390)
+* Update default method in description in [#10391](https://github.com/appwrite/appwrite/pull/10391)
+* Rename namespace from tables-db to tablesdb in specs in [#10395](https://github.com/appwrite/appwrite/pull/10395)
+* Update tables group in specs in [#10394](https://github.com/appwrite/appwrite/pull/10394)
+* Update description for upsert methods in [#10397](https://github.com/appwrite/appwrite/pull/10397)
+* Update README.md in [#10401](https://github.com/appwrite/appwrite/pull/10401)
+* Added handling of database resources after migration in [#10400](https://github.com/appwrite/appwrite/pull/10400)
+* Revert "Added handling of database resources after migration" in [#10406](https://github.com/appwrite/appwrite/pull/10406)
+* Remove sdk deprecation warnings in [#10408](https://github.com/appwrite/appwrite/pull/10408)
+* Mark Row response model's param with readonly in [#10409](https://github.com/appwrite/appwrite/pull/10409)
+* Update exception thrown when svg sanitization fails in [#10416](https://github.com/appwrite/appwrite/pull/10416)
+* Fix allow null params in [#10417](https://github.com/appwrite/appwrite/pull/10417)
+* Allow running tests with specific response format in [#10418](https://github.com/appwrite/appwrite/pull/10418)
+* Make webhooks publisher overridable in [#10419](https://github.com/appwrite/appwrite/pull/10419)
+* Check audits logs in [#10414](https://github.com/appwrite/appwrite/pull/10414)
+* Remove direct publisher calls in [#10420](https://github.com/appwrite/appwrite/pull/10420)
+* removed spatial type response and will be using the json type for the… in [#10433](https://github.com/appwrite/appwrite/pull/10433)
+* Add tests for new time helpers in [#10437](https://github.com/appwrite/appwrite/pull/10437)
+* Move projects.list() to module in [#10441](https://github.com/appwrite/appwrite/pull/10441)
+* Update cli to 9.1.0 in [#10442](https://github.com/appwrite/appwrite/pull/10442)
+* Add requestBody param examples in specs in [#10431](https://github.com/appwrite/appwrite/pull/10431)
+* Fix mysql tests in [#10445](https://github.com/appwrite/appwrite/pull/10445)
+* Upgrade platform lib to have older queue lib in [#10447](https://github.com/appwrite/appwrite/pull/10447)
+* Fix router compression in [#10452](https://github.com/appwrite/appwrite/pull/10452)
+* Upgrade http lib for backwards compatible default param in [#10455](https://github.com/appwrite/appwrite/pull/10455)
+* Update examples in [#10444](https://github.com/appwrite/appwrite/pull/10444)
+* Automatic pr creation in sdk release script in [#10457](https://github.com/appwrite/appwrite/pull/10457)
+* Remove avatars command from cli in [#10454](https://github.com/appwrite/appwrite/pull/10454)
+* Remove deno from platforms array in [#10453](https://github.com/appwrite/appwrite/pull/10453)
+* Spatial type attributes sdk updates in [#10463](https://github.com/appwrite/appwrite/pull/10463)
+* Stats resources try catch in [#10469](https://github.com/appwrite/appwrite/pull/10469)
+* Move proxy endpoints to modules in [#10470](https://github.com/appwrite/appwrite/pull/10470)
+* Add certificate validation override in [#10471](https://github.com/appwrite/appwrite/pull/10471)
+* Generate SDKs in [#10475](https://github.com/appwrite/appwrite/pull/10475)
+* Spatial test tablesdb updates in [#10473](https://github.com/appwrite/appwrite/pull/10473)
+* Add colors to certificate logs in [#10438](https://github.com/appwrite/appwrite/pull/10438)
+* appwrite db bump in [#10479](https://github.com/appwrite/appwrite/pull/10479)
+* Bump database in [#10480](https://github.com/appwrite/appwrite/pull/10480)
+* Health db queues in [#10482](https://github.com/appwrite/appwrite/pull/10482)
+* Attempt small size for website dependency in [#10485](https://github.com/appwrite/appwrite/pull/10485)
+* Worker stop in [#10498](https://github.com/appwrite/appwrite/pull/10498)
+* Update database in [#10506](https://github.com/appwrite/appwrite/pull/10506)
+* Stats resources and usage sorting by unique field in [#10472](https://github.com/appwrite/appwrite/pull/10472)
+* Add spatial column validation during required mode and tests for exis… in [#10509](https://github.com/appwrite/appwrite/pull/10509)
+* Sub query variables order by in [#10513](https://github.com/appwrite/appwrite/pull/10513)
+* Update README.md in [#10514](https://github.com/appwrite/appwrite/pull/10514)
+* bump database 1.5.0 in [#10515](https://github.com/appwrite/appwrite/pull/10515)
+* Don't remove required attributes in [#10516](https://github.com/appwrite/appwrite/pull/10516)
+* Catch query exception on bulk update/delete in [#10517](https://github.com/appwrite/appwrite/pull/10517)
+* Update cli to 10.0.0 in [#10511](https://github.com/appwrite/appwrite/pull/10511)
+* Add type_enum support and update docs in [#10496](https://github.com/appwrite/appwrite/pull/10496)
+* Improve code readability for schedules in [#10522](https://github.com/appwrite/appwrite/pull/10522)
+* Include response model enum names in [#10538](https://github.com/appwrite/appwrite/pull/10538)
+* SDK releases in [#10539](https://github.com/appwrite/appwrite/pull/10539)
+* Fix health status enum in [#10540](https://github.com/appwrite/appwrite/pull/10540)
+* Update afterbuild fn in [#10541](https://github.com/appwrite/appwrite/pull/10541)
+* Update afterbuild to also pass adapter in [#10545](https://github.com/appwrite/appwrite/pull/10545)
+* Update `z-index` to be the highest in [#9874](https://github.com/appwrite/appwrite/pull/9874)
+* Update framework lib to 0.33.28 in [#10551](https://github.com/appwrite/appwrite/pull/10551)
+* Fix enum typing for platform in specs in [#10553](https://github.com/appwrite/appwrite/pull/10553)
+* Add enums for database type and column status in [#10561](https://github.com/appwrite/appwrite/pull/10561)
+* Fix activities in [#10586](https://github.com/appwrite/appwrite/pull/10586)
+* Fix logs truncation tests in [#10585](https://github.com/appwrite/appwrite/pull/10585)
+* Remove related data in realtime payload in [#10590](https://github.com/appwrite/appwrite/pull/10590)
+* Update composer dependencies in [#10601](https://github.com/appwrite/appwrite/pull/10601)
+* Update sdks add response models in [#10554](https://github.com/appwrite/appwrite/pull/10554)
+* Sanitize 5xx errors on realtime in [#10598](https://github.com/appwrite/appwrite/pull/10598)
+* Update database in [#10596](https://github.com/appwrite/appwrite/pull/10596)
+* Add both collection and table id in the realtime in [#10608](https://github.com/appwrite/appwrite/pull/10608)
+* Chore bump db in [#10611](https://github.com/appwrite/appwrite/pull/10611)
+* Branded email for Console auth flows in [#10501](https://github.com/appwrite/appwrite/pull/10501)
+* Add minor releases for all SDKs - deprecate createVerification, add createEmailVerification in [#10614](https://github.com/appwrite/appwrite/pull/10614)
+* Add automatic releases in [#10615](https://github.com/appwrite/appwrite/pull/10615)
+* Feat txn sdks in [#10621](https://github.com/appwrite/appwrite/pull/10621)
+* Prevent empty releases in sdk release script in [#10627](https://github.com/appwrite/appwrite/pull/10627)
+* Update domains lib to 0.8.2 in [#10629](https://github.com/appwrite/appwrite/pull/10629)
+* Fix txn API scope backwards compat in [#10640](https://github.com/appwrite/appwrite/pull/10640)
+* Fix block schedules in [#10620](https://github.com/appwrite/appwrite/pull/10620)
+* Update .NET SDK to 0.21.2 and improve release detection in [#10641](https://github.com/appwrite/appwrite/pull/10641)
+* Make methods protected for extending in [#10617](https://github.com/appwrite/appwrite/pull/10617)
+
+# Version 1.7.4
+
+## What's Changed
+
+### Notable changes
+
+* Update console image to version 6.0.13 in [#9891](https://github.com/appwrite/appwrite/pull/9891)
+
+### Fixes
+
+* Fix createDeployment chunk upload in [#9886](https://github.com/appwrite/appwrite/pull/9886)
+
+### Miscellaneous
+
+* Update version from 1.7.3 to 1.7.4 in [#9893](https://github.com/appwrite/appwrite/pull/9893)
+
+# Version 1.7.3
+
+## What's Changed
+
+### Notable changes
+
+* Allow unlimited deployment size in [#9866](https://github.com/appwrite/appwrite/pull/9866)
+* Bump console to version 6.0.11 in [#9881](https://github.com/appwrite/appwrite/pull/9881)
+
+### Fixes
+
+* Send deploymentResourceType in rules verification in [#9859](https://github.com/appwrite/appwrite/pull/9859)
+* Fix CNAME validation in [#9861](https://github.com/appwrite/appwrite/pull/9861)
+* Fix bucket not included in path in [#9864](https://github.com/appwrite/appwrite/pull/9864)
+* Fix URL for view logs in github comment in [#9875](https://github.com/appwrite/appwrite/pull/9875)
+* Set owner and region while migrating rules in [#9856](https://github.com/appwrite/appwrite/pull/9856)
+* Remove _APP_DEFAULT_REGION because it is not a valid env var in [#9883](https://github.com/appwrite/appwrite/pull/9883)
+
+### Miscellaneous
+
+* Only load error page for development mode in [#9860](https://github.com/appwrite/appwrite/pull/9860)
+* Make max deployment and build size configurable in [#9863](https://github.com/appwrite/appwrite/pull/9863)
+* Update flutter_web_auth_2 docs to match 4.x in [#9858](https://github.com/appwrite/appwrite/pull/9858)
+* Use unique filename for health check in [#9842](https://github.com/appwrite/appwrite/pull/9842)
+* Added encrypt property in the attribute string response model in [#9868](https://github.com/appwrite/appwrite/pull/9868)
+* Add sequence in [#9865](https://github.com/appwrite/appwrite/pull/9865)
+* Add builds worker group in [#9873](https://github.com/appwrite/appwrite/pull/9873)
+* updated errro for the string encryption in [#9878](https://github.com/appwrite/appwrite/pull/9878)
+* Revert "Add sequence" in [#9879](https://github.com/appwrite/appwrite/pull/9879)
+* Prepare 1.7.3 release in [#9882](https://github.com/appwrite/appwrite/pull/9882)
+
 # Version 1.6.2
 
 ## What's Changed
 
 ### Notable changes
 
-* Delete git folder to reduce build size in [9076](https://github.com/appwrite/appwrite/pull/9076)
-* Upgrade assistant in [9100](https://github.com/appwrite/appwrite/pull/9100)
-* Use redis adapter for abuse in [9121](https://github.com/appwrite/appwrite/pull/9121)
-* Set base specification CPUs to 0.5 again in [9146](https://github.com/appwrite/appwrite/pull/9146)
-* Add new push message parameters in [9060](https://github.com/appwrite/appwrite/pull/9060)
-* Update audits to include user type in [9211](https://github.com/appwrite/appwrite/pull/9211)
-* Enable HEIC in [9251](https://github.com/appwrite/appwrite/pull/9251)
-* Added teamName to membership redirect url in [9269](https://github.com/appwrite/appwrite/pull/9269)
-* Add support endpoint url for S3 in [9303](https://github.com/appwrite/appwrite/pull/9303)
-* Added RuPay Credit Card Icon in Avatars Service in [5046](https://github.com/appwrite/appwrite/pull/5046)
-* Add figma oauth provider in [9623](https://github.com/appwrite/appwrite/pull/9623)
-* Update console to version 5.2.58 in [9637](https://github.com/appwrite/appwrite/pull/9637)
+* Delete git folder to reduce build size in [#9076](https://github.com/appwrite/appwrite/pull/9076)
+* Upgrade assistant in [#9100](https://github.com/appwrite/appwrite/pull/9100)
+* Use redis adapter for abuse in [#9121](https://github.com/appwrite/appwrite/pull/9121)
+* Set base specification CPUs to 0.5 again in [#9146](https://github.com/appwrite/appwrite/pull/9146)
+* Add new push message parameters in [#9060](https://github.com/appwrite/appwrite/pull/9060)
+* Update audits to include user type in [#9211](https://github.com/appwrite/appwrite/pull/9211)
+* Enable HEIC in [#9251](https://github.com/appwrite/appwrite/pull/9251)
+* Added teamName to membership redirect url in [#9269](https://github.com/appwrite/appwrite/pull/9269)
+* Add support endpoint url for S3 in [#9303](https://github.com/appwrite/appwrite/pull/9303)
+* Added RuPay Credit Card Icon in Avatars Service in [#5046](https://github.com/appwrite/appwrite/pull/5046)
+* Add figma oauth provider in [#9623](https://github.com/appwrite/appwrite/pull/9623)
+* Update console to version 5.2.58 in [#9637](https://github.com/appwrite/appwrite/pull/9637)
 
 ### Fixes
 
-* Remove failed attribute in [9032](https://github.com/appwrite/appwrite/pull/9032)
-* Fix delete notFound attribute in [9038](https://github.com/appwrite/appwrite/pull/9038)
-* 🇮🇸 Added missing Icelandic translations for email strings. in [4848](https://github.com/appwrite/appwrite/pull/4848)
-* fix doc comment for filter method in [5769](https://github.com/appwrite/appwrite/pull/5769)
-* Delete attribute No throwing Exception on not found in [9157](https://github.com/appwrite/appwrite/pull/9157)
-* Fix VCS identity collision in [9138](https://github.com/appwrite/appwrite/pull/9138)
-* Fix disabling of email-otp when user wants to in [9200](https://github.com/appwrite/appwrite/pull/9200)
-* Ensure user can delete session in [9209](https://github.com/appwrite/appwrite/pull/9209)
-* Fix resend invitation in [9218](https://github.com/appwrite/appwrite/pull/9218)
-* Fix phone number parsing exception handling in [9246](https://github.com/appwrite/appwrite/pull/9246)
-* Fix amazon oauth in [9253](https://github.com/appwrite/appwrite/pull/9253)
-* Fix slack oauth scopes, and updated to v2 in [9228](https://github.com/appwrite/appwrite/pull/9228)
-* Fix forwarded user agent in [9271](https://github.com/appwrite/appwrite/pull/9271)
-* Fix WEBP File Preview Rendering Issue in [9321](https://github.com/appwrite/appwrite/pull/9321)
-* Fix build memory specifications in [9360](https://github.com/appwrite/appwrite/pull/9360)
-* Fix Self Hosting functions by adding missed config in [9373](https://github.com/appwrite/appwrite/pull/9373)
-* Fix resend team invite if already accepted in [9348](https://github.com/appwrite/appwrite/pull/9348)
-* Fix null errors on team invite in [9391](https://github.com/appwrite/appwrite/pull/9391)
-* Fix email (smtp) to multiple recipients in [9243](https://github.com/appwrite/appwrite/pull/9243)
-* Fix stats timing by using receivedAt date when available in [9428](https://github.com/appwrite/appwrite/pull/9428)
-* Make min/max params optional for attribute update in [9387](https://github.com/appwrite/appwrite/pull/9387)
-* Fix blocking of phone sessions when disabled on console in [9447](https://github.com/appwrite/appwrite/pull/9447)
-* Fix logging config in [9467](https://github.com/appwrite/appwrite/pull/9467)
-* Update audit timestamp origin in [9481](https://github.com/appwrite/appwrite/pull/9481)
-* Fix certificates in deletes worker in [9466](https://github.com/appwrite/appwrite/pull/9466)
-* Fix console audits delete in [9547](https://github.com/appwrite/appwrite/pull/9547)
-* Fix migrations in [9633](https://github.com/appwrite/appwrite/pull/9633)
-* Ensure all 4xx errors in OAuth redirect lead to the failure URL in [9679](https://github.com/appwrite/appwrite/pull/9679)
-* Treat 0 as unlimited for CPUs and memory in [9638](https://github.com/appwrite/appwrite/pull/9638)
-* Add contextual dispatch logic to fix high CPU usage in [9687](https://github.com/appwrite/appwrite/pull/9687)
+* Remove failed attribute in [#9032](https://github.com/appwrite/appwrite/pull/9032)
+* Fix delete notFound attribute in [#9038](https://github.com/appwrite/appwrite/pull/9038)
+* 🇮🇸 Added missing Icelandic translations for email strings. in [#4848](https://github.com/appwrite/appwrite/pull/4848)
+* fix doc comment for filter method in [#5769](https://github.com/appwrite/appwrite/pull/5769)
+* Delete attribute No throwing Exception on not found in [#9157](https://github.com/appwrite/appwrite/pull/9157)
+* Fix VCS identity collision in [#9138](https://github.com/appwrite/appwrite/pull/9138)
+* Fix disabling of email-otp when user wants to in [#9200](https://github.com/appwrite/appwrite/pull/9200)
+* Ensure user can delete session in [#9209](https://github.com/appwrite/appwrite/pull/9209)
+* Fix resend invitation in [#9218](https://github.com/appwrite/appwrite/pull/9218)
+* Fix phone number parsing exception handling in [#9246](https://github.com/appwrite/appwrite/pull/9246)
+* Fix amazon oauth in [#9253](https://github.com/appwrite/appwrite/pull/9253)
+* Fix slack oauth scopes, and updated to v2 in [#9228](https://github.com/appwrite/appwrite/pull/9228)
+* Fix forwarded user agent in [#9271](https://github.com/appwrite/appwrite/pull/9271)
+* Fix WEBP File Preview Rendering Issue in [#9321](https://github.com/appwrite/appwrite/pull/9321)
+* Fix build memory specifications in [#9360](https://github.com/appwrite/appwrite/pull/9360)
+* Fix Self Hosting functions by adding missed config in [#9373](https://github.com/appwrite/appwrite/pull/9373)
+* Fix resend team invite if already accepted in [#9348](https://github.com/appwrite/appwrite/pull/9348)
+* Fix null errors on team invite in [#9391](https://github.com/appwrite/appwrite/pull/9391)
+* Fix email (smtp) to multiple recipients in [#9243](https://github.com/appwrite/appwrite/pull/9243)
+* Fix stats timing by using receivedAt date when available in [#9428](https://github.com/appwrite/appwrite/pull/9428)
+* Make min/max params optional for attribute update in [#9387](https://github.com/appwrite/appwrite/pull/9387)
+* Fix blocking of phone sessions when disabled on console in [#9447](https://github.com/appwrite/appwrite/pull/9447)
+* Fix logging config in [#9467](https://github.com/appwrite/appwrite/pull/9467)
+* Update audit timestamp origin in [#9481](https://github.com/appwrite/appwrite/pull/9481)
+* Fix certificates in deletes worker in [#9466](https://github.com/appwrite/appwrite/pull/9466)
+* Fix console audits delete in [#9547](https://github.com/appwrite/appwrite/pull/9547)
+* Fix migrations in [#9633](https://github.com/appwrite/appwrite/pull/9633)
+* Ensure all 4xx errors in OAuth redirect lead to the failure URL in [#9679](https://github.com/appwrite/appwrite/pull/9679)
+* Treat 0 as unlimited for CPUs and memory in [#9638](https://github.com/appwrite/appwrite/pull/9638)
+* Add contextual dispatch logic to fix high CPU usage in [#9687](https://github.com/appwrite/appwrite/pull/9687)
 
 ### Miscellaneous
 
-* Merge 1.6.x into feat-custom-cf-hostnames in [8904](https://github.com/appwrite/appwrite/pull/8904)
-* Improve compression param checks in [8922](https://github.com/appwrite/appwrite/pull/8922)
-* upgrade utopia storage in [8930](https://github.com/appwrite/appwrite/pull/8930)
-* Feat migration in [8797](https://github.com/appwrite/appwrite/pull/8797)
-* feat fix web routes in [8962](https://github.com/appwrite/appwrite/pull/8962)
-* Fix no pool access in [9027](https://github.com/appwrite/appwrite/pull/9027)
-* feat: use environment variable to check rules format in [9039](https://github.com/appwrite/appwrite/pull/9039)
-* Update storage.php in [9037](https://github.com/appwrite/appwrite/pull/9037)
-* Upgrade db 0.53.200 in [9050](https://github.com/appwrite/appwrite/pull/9050)
-* Chore: upgrade utopia storage in [9066](https://github.com/appwrite/appwrite/pull/9066)
-* Update usage-dump payload in [9085](https://github.com/appwrite/appwrite/pull/9085)
-* GitHub Workflows security hardening in [3728](https://github.com/appwrite/appwrite/pull/3728)
-* Update add-oauth2-provider.md in [4313](https://github.com/appwrite/appwrite/pull/4313)
-* update readme-cn some doc in [5278](https://github.com/appwrite/appwrite/pull/5278)
-* Add accessibility features in [7042](https://github.com/appwrite/appwrite/pull/7042)
-* Add Appwrite Cloud to read me. in [5445](https://github.com/appwrite/appwrite/pull/5445)
-* Migration throw error in [9092](https://github.com/appwrite/appwrite/pull/9092)
-* Fix usage payload bug in [9097](https://github.com/appwrite/appwrite/pull/9097)
-* chore: replace occurrences of dbForConsole to dbForPlatform in [9096](https://github.com/appwrite/appwrite/pull/9096)
-* fix(realtime): decrement connectionCounter only if connection is known in [9055](https://github.com/appwrite/appwrite/pull/9055)
-* payload bug fix in [9098](https://github.com/appwrite/appwrite/pull/9098)
-* Fix usage payload bug in [9099](https://github.com/appwrite/appwrite/pull/9099)
-* Usage payload debug in [9101](https://github.com/appwrite/appwrite/pull/9101)
-* Usage payload debug in [9103](https://github.com/appwrite/appwrite/pull/9103)
-* Usage payload debug in [9104](https://github.com/appwrite/appwrite/pull/9104)
-* Feat: createFunction abuse labels in [9102](https://github.com/appwrite/appwrite/pull/9102)
-* Docs-create-document in [9105](https://github.com/appwrite/appwrite/pull/9105)
-* Docs: Create document and unknown attribute error messages. in [5427](https://github.com/appwrite/appwrite/pull/5427)
-* Fix: update project accessed at from router and schedulers in [9109](https://github.com/appwrite/appwrite/pull/9109)
-* chore: initial commit in [9111](https://github.com/appwrite/appwrite/pull/9111)
-* chore: optimise webhooks payload in [9115](https://github.com/appwrite/appwrite/pull/9115)
-* Revert "chore: initial commit" in [9117](https://github.com/appwrite/appwrite/pull/9117)
-* chore: fix attribute name in [9118](https://github.com/appwrite/appwrite/pull/9118)
-* Migrate to redis abuse in [9124](https://github.com/appwrite/appwrite/pull/9124)
-* Added webhooks usage stats in [9125](https://github.com/appwrite/appwrite/pull/9125)
-* chore remove abuse cleanup in [9137](https://github.com/appwrite/appwrite/pull/9137)
-* fix: remove abuse delete trigger in [9139](https://github.com/appwrite/appwrite/pull/9139)
-* Remove firebase OAuth API endpoints in [9144](https://github.com/appwrite/appwrite/pull/9144)
-* chore: release client sdks in [9112](https://github.com/appwrite/appwrite/pull/9112)
-* Update general.php in [9155](https://github.com/appwrite/appwrite/pull/9155)
-* feat(swoole): allow configuration override of available cpus in [9177](https://github.com/appwrite/appwrite/pull/9177)
-* Usage databases api read writes addition in [9142](https://github.com/appwrite/appwrite/pull/9142)
-* Fix dead connections in [9190](https://github.com/appwrite/appwrite/pull/9190)
-* Add hostname to audits in [9165](https://github.com/appwrite/appwrite/pull/9165)
-* chore: shifted authphone usage tracking to api calls in [9191](https://github.com/appwrite/appwrite/pull/9191)
-* Revert "Fix dead connections" in [9201](https://github.com/appwrite/appwrite/pull/9201)
-* Add assertEventually to messaging provider logs test in [9192](https://github.com/appwrite/appwrite/pull/9192)
-* feat project sms usage in [9198](https://github.com/appwrite/appwrite/pull/9198)
-* chore: add audit labels to project resources in [9056](https://github.com/appwrite/appwrite/pull/9056)
-* fix sms usage in [9207](https://github.com/appwrite/appwrite/pull/9207)
-* Update database in [9202](https://github.com/appwrite/appwrite/pull/9202)
-* Fix dead connections in [9213](https://github.com/appwrite/appwrite/pull/9213)
-* Revert "Fix dead connections" in [9214](https://github.com/appwrite/appwrite/pull/9214)
-* Add logs db init for consistency in [9163](https://github.com/appwrite/appwrite/pull/9163)
-* Split the collection definitions in [9153](https://github.com/appwrite/appwrite/pull/9153)
-* Log path with populated parameters in [9220](https://github.com/appwrite/appwrite/pull/9220)
-* Add missing scope on function template in [9208](https://github.com/appwrite/appwrite/pull/9208)
-* Add relatedCollection default in [9225](https://github.com/appwrite/appwrite/pull/9225)
-* fix: function usage in [9235](https://github.com/appwrite/appwrite/pull/9235)
-* feat: optimise events payloads in [9232](https://github.com/appwrite/appwrite/pull/9232)
-* Optimise webhook events in [9168](https://github.com/appwrite/appwrite/pull/9168)
-* fix: maintenance job missing type in [9238](https://github.com/appwrite/appwrite/pull/9238)
-* Update Fetch to 0.3.0 in [9245](https://github.com/appwrite/appwrite/pull/9245)
-* Fix maintenance job in [9247](https://github.com/appwrite/appwrite/pull/9247)
-* chore: add missing case for executions in [9248](https://github.com/appwrite/appwrite/pull/9248)
-* Add index dependency exception in [9226](https://github.com/appwrite/appwrite/pull/9226)
-* chore: fix benchmarking test when made from fork in [9233](https://github.com/appwrite/appwrite/pull/9233)
-* Update SDK Generator versions in [9188](https://github.com/appwrite/appwrite/pull/9188)
-* chore: skipped job instead of throwing error in [9250](https://github.com/appwrite/appwrite/pull/9250)
-* Implement new SDK Class on 1.6.x in [9237](https://github.com/appwrite/appwrite/pull/9237)
-* Delete collection before Appwrite's attributes in [9256](https://github.com/appwrite/appwrite/pull/9256)
-* Feat batch usage dump in [9255](https://github.com/appwrite/appwrite/pull/9255)
-* Fix cloud tests in [9261](https://github.com/appwrite/appwrite/pull/9261)
-* Usage: Databases reads writes in [9260](https://github.com/appwrite/appwrite/pull/9260)
-* Update: Latest sdk specs in [9274](https://github.com/appwrite/appwrite/pull/9274)
-* Revert "Feat batch usage dump" in [9276](https://github.com/appwrite/appwrite/pull/9276)
-* feat: add fast2SMS adapter in [9263](https://github.com/appwrite/appwrite/pull/9263)
-* Update Sdk Generator dependency in [9280](https://github.com/appwrite/appwrite/pull/9280)
-* Transformed at addition in [9281](https://github.com/appwrite/appwrite/pull/9281)
-* Docs: clarify update endpoints only work on draft messages in [9236](https://github.com/appwrite/appwrite/pull/9236)
-* Update sdk generator dependency in [9282](https://github.com/appwrite/appwrite/pull/9282)
-* Revert "Transformed at addition" in [9284](https://github.com/appwrite/appwrite/pull/9284)
-* replaced init for cloud link in [9285](https://github.com/appwrite/appwrite/pull/9285)
-* Add transformed at in [9289](https://github.com/appwrite/appwrite/pull/9289)
-* Make migrations use Dynamic keys for destination in [9291](https://github.com/appwrite/appwrite/pull/9291)
-* Make sessions limit tests assert eventually in [9298](https://github.com/appwrite/appwrite/pull/9298)
-* Chore update database in [9306](https://github.com/appwrite/appwrite/pull/9306)
-* feat: add AMQP queues in [9287](https://github.com/appwrite/appwrite/pull/9287)
-* fix(test): use assertEventually instead of while(true) in [9308](https://github.com/appwrite/appwrite/pull/9308)
-* fix(certificate worker): events are published without queue name in [9309](https://github.com/appwrite/appwrite/pull/9309)
-* chore: update utopia-php/queue to 0.8.1 in [9311](https://github.com/appwrite/appwrite/pull/9311)
-* chore: update utopia-php/queue to 0.8.2 in [9312](https://github.com/appwrite/appwrite/pull/9312)
-* fix(schedule-tasks): revert back to direct pool usage in [9313](https://github.com/appwrite/appwrite/pull/9313)
-* feat: custom app schemes in [9262](https://github.com/appwrite/appwrite/pull/9262)
-* Revert "feat: custom app schemes" in [9319](https://github.com/appwrite/appwrite/pull/9319)
-* Restore "feat: custom app schemes"" in [9320](https://github.com/appwrite/appwrite/pull/9320)
-* Revert "Restore "feat: custom app schemes""" in [9323](https://github.com/appwrite/appwrite/pull/9323)
-* chore: update dependencies in [9330](https://github.com/appwrite/appwrite/pull/9330)
-* Feat: logs DB in [9272](https://github.com/appwrite/appwrite/pull/9272)
-* Catch invalid index in [9329](https://github.com/appwrite/appwrite/pull/9329)
-* Fix: missing call for image transformations counting in [9342](https://github.com/appwrite/appwrite/pull/9342)
-* Fix drop abuse on shared table project delete in [9346](https://github.com/appwrite/appwrite/pull/9346)
-* Only run all table mode tests on db update in [9338](https://github.com/appwrite/appwrite/pull/9338)
-* Fix: missing periodic metric in [9350](https://github.com/appwrite/appwrite/pull/9350)
-* feat(builds): check if function is blocked before building in [9332](https://github.com/appwrite/appwrite/pull/9332)
-* feat: batch create audit logs in [9347](https://github.com/appwrite/appwrite/pull/9347)
-* Chore: Update migrations in [9355](https://github.com/appwrite/appwrite/pull/9355)
-* Fix: metric time was not being written to DB in [9354](https://github.com/appwrite/appwrite/pull/9354)
-* Fix patch index validation in [9356](https://github.com/appwrite/appwrite/pull/9356)
-* Fix image trnasformation metrics in [9370](https://github.com/appwrite/appwrite/pull/9370)
-* Use batch delete in worker in [9375](https://github.com/appwrite/appwrite/pull/9375)
-* Fix Model Platform is missing response key: store  in [9361](https://github.com/appwrite/appwrite/pull/9361)
-* Feat key segmented usage in [9336](https://github.com/appwrite/appwrite/pull/9336)
-* Feat messaging metrics in [9353](https://github.com/appwrite/appwrite/pull/9353)
-* Fix removed audits for shared v2 in [9388](https://github.com/appwrite/appwrite/pull/9388)
-* chore: bump utopia-php/image to 0.8.0 in [9390](https://github.com/appwrite/appwrite/pull/9390)
-* Fix outdated CLI commands in documentation in [9122](https://github.com/appwrite/appwrite/pull/9122)
-* disable logs display in [9398](https://github.com/appwrite/appwrite/pull/9398)
-* Log batches per project in [9403](https://github.com/appwrite/appwrite/pull/9403)
-* Batch per project in [9410](https://github.com/appwrite/appwrite/pull/9410)
-* Fix: stats resources only queue projects accessed in last 3 hours in [9411](https://github.com/appwrite/appwrite/pull/9411)
-* Track options requests in [9397](https://github.com/appwrite/appwrite/pull/9397)
-* chore: bump docker-base in [9406](https://github.com/appwrite/appwrite/pull/9406)
-* refactor: migrate Realtime::send calls to queueForRealtime in [9325](https://github.com/appwrite/appwrite/pull/9325)
-* Revert "Fix: stats resources only queue projects accessed in last 3 hours" in [9424](https://github.com/appwrite/appwrite/pull/9424)
-* Remove usage and usage dump in favor of stats-usage and stats-usage-dump in [9339](https://github.com/appwrite/appwrite/pull/9339)
-* Fix: disable dual writing in [9429](https://github.com/appwrite/appwrite/pull/9429)
-* Disable transformedAt update for console users in [9425](https://github.com/appwrite/appwrite/pull/9425)
-* chore: add image transformation stats to usage endpoint in [9393](https://github.com/appwrite/appwrite/pull/9393)
-* chore: added timeout to deployment builds in tests in [9426](https://github.com/appwrite/appwrite/pull/9426)
-* fix: model for image transformations in usage project in [9442](https://github.com/appwrite/appwrite/pull/9442)
-* Feat: calculate database storage in stats-resources in [9443](https://github.com/appwrite/appwrite/pull/9443)
-* Activities batch writes in [9438](https://github.com/appwrite/appwrite/pull/9438)
-* chore: bump cache 0.12.x in [9412](https://github.com/appwrite/appwrite/pull/9412)
-* chore: queue console project for maintenance delete in [9479](https://github.com/appwrite/appwrite/pull/9479)
-* chore: added logsdb for deletes worker in [9462](https://github.com/appwrite/appwrite/pull/9462)
-* Feat: calculate and log time taken for each project in [9491](https://github.com/appwrite/appwrite/pull/9491)
-* chore: update initializing dbForLogs in [9494](https://github.com/appwrite/appwrite/pull/9494)
-* Feat bulk audit delete in [9487](https://github.com/appwrite/appwrite/pull/9487)
-* Prepare 1.6.2 release in [9499](https://github.com/appwrite/appwrite/pull/9499)
-* Regenerate specs in [9497](https://github.com/appwrite/appwrite/pull/9497)
-* Regenerate examples in [9498](https://github.com/appwrite/appwrite/pull/9498)
-* chore: bump sdk in [9414](https://github.com/appwrite/appwrite/pull/9414)
-* update queue to 0.9.* in [9505](https://github.com/appwrite/appwrite/pull/9505)
-* Feat improve delete queries in [9507](https://github.com/appwrite/appwrite/pull/9507)
-* Feat: Add rule attributes in [9508](https://github.com/appwrite/appwrite/pull/9508)
-* Sync main into 1.6.x in [9496](https://github.com/appwrite/appwrite/pull/9496)
-* Bump console to version 5.2.53 in [9495](https://github.com/appwrite/appwrite/pull/9495)
-* Prepare 1.6.1 release in [9294](https://github.com/appwrite/appwrite/pull/9294)
-* Improve delete ordering in [9512](https://github.com/appwrite/appwrite/pull/9512)
-* Cleanups in [9511](https://github.com/appwrite/appwrite/pull/9511)
-* Feat dynamic regions in [9408](https://github.com/appwrite/appwrite/pull/9408)
-* Feat env vars to system lib in [9515](https://github.com/appwrite/appwrite/pull/9515)
-* Feat: domains count in [9514](https://github.com/appwrite/appwrite/pull/9514)
-* Migration read from db in [9529](https://github.com/appwrite/appwrite/pull/9529)
-* feat: add pool telemetry in [9530](https://github.com/appwrite/appwrite/pull/9530)
-* Disable PDO persistence since we manage our own pool in [9526](https://github.com/appwrite/appwrite/pull/9526)
-* chore: set min operations to 1 for reads and writes in [9536](https://github.com/appwrite/appwrite/pull/9536)
-* Remove default region in [9430](https://github.com/appwrite/appwrite/pull/9430)
-* Use cursor pagination with bigger limit for maintenance project loop in [9546](https://github.com/appwrite/appwrite/pull/9546)
-* chore: stop tests on failure in [9525](https://github.com/appwrite/appwrite/pull/9525)
-* chore: only update total count for privileged users in [9554](https://github.com/appwrite/appwrite/pull/9554)
-* refactor: initialization of audit retention in [9563](https://github.com/appwrite/appwrite/pull/9563)
-* Delete worker queries fixes in [9523](https://github.com/appwrite/appwrite/pull/9523)
-* Bump database 0.62.x in [9568](https://github.com/appwrite/appwrite/pull/9568)
-* Fix: schedules region filtering in [9577](https://github.com/appwrite/appwrite/pull/9577)
-* Deletes worker fix selects for pagination in [9578](https://github.com/appwrite/appwrite/pull/9578)
-* Add $permissions for delete documents selects in [9579](https://github.com/appwrite/appwrite/pull/9579)
-* chore(audits): return queue pre-fetch results in [9533](https://github.com/appwrite/appwrite/pull/9533)
-* Revert "chore(audits): return queue pre-fetch results" in [9586](https://github.com/appwrite/appwrite/pull/9586)
-* Feat multi tenant insert in [9573](https://github.com/appwrite/appwrite/pull/9573)
-* Add order by for cursor in [9588](https://github.com/appwrite/appwrite/pull/9588)
-* Feat update fetch in [9592](https://github.com/appwrite/appwrite/pull/9592)
-* Fix tenant casting in [9598](https://github.com/appwrite/appwrite/pull/9598)
-* Feat update ws in [9602](https://github.com/appwrite/appwrite/pull/9602)
-* Update database in [9603](https://github.com/appwrite/appwrite/pull/9603)
-* Fix: image transformation cache in [9608](https://github.com/appwrite/appwrite/pull/9608)
-* Remove audit payload in [9610](https://github.com/appwrite/appwrite/pull/9610)
-* Sample rate from DSN in [9559](https://github.com/appwrite/appwrite/pull/9559)
-* Restrict role change for sole org owner in [9615](https://github.com/appwrite/appwrite/pull/9615)
-* chore: update php image to 0.8.1 in [9616](https://github.com/appwrite/appwrite/pull/9616)
-* feat: refactor executor setup in [9420](https://github.com/appwrite/appwrite/pull/9420)
-* chore: update gitpod.yml config in [9561](https://github.com/appwrite/appwrite/pull/9561)
-* chore: update dependencies in [9625](https://github.com/appwrite/appwrite/pull/9625)
-* Update migrations lib in [9628](https://github.com/appwrite/appwrite/pull/9628)
-* feat: cache telemetry in [9624](https://github.com/appwrite/appwrite/pull/9624)
-* Bump console to version 5.2.56 in [9631](https://github.com/appwrite/appwrite/pull/9631)
-* Multi region support in [8667](https://github.com/appwrite/appwrite/pull/8667)
-* Revert "Multi region support" in [9632](https://github.com/appwrite/appwrite/pull/9632)
-* Revert "Revert "Multi region support"" in [9636](https://github.com/appwrite/appwrite/pull/9636)
-* Fix tasks in [9644](https://github.com/appwrite/appwrite/pull/9644)
-* chore: updated the migration version to 8.6 in [9646](https://github.com/appwrite/appwrite/pull/9646)
-* Fix: merge the working of StatsUsage and StatsUsageDump in [9585](https://github.com/appwrite/appwrite/pull/9585)
-* Update database in [9643](https://github.com/appwrite/appwrite/pull/9643)
-* chore: fix error logging for CLI tasks in [9651](https://github.com/appwrite/appwrite/pull/9651)
-* fix: usage test assertion in [9653](https://github.com/appwrite/appwrite/pull/9653)
-* Fix keys in [9656](https://github.com/appwrite/appwrite/pull/9656)
-* Feat: multi tenant dual writing in [9583](https://github.com/appwrite/appwrite/pull/9583)
-* Fix/throwing 400 for null order attributes  in [9657](https://github.com/appwrite/appwrite/pull/9657)
-* feat: sdk group attribute in [9596](https://github.com/appwrite/appwrite/pull/9596)
-* Add configurable function and build size in [9648](https://github.com/appwrite/appwrite/pull/9648)
-* feat: update API endpoint in the code examples in [8933](https://github.com/appwrite/appwrite/pull/8933)
-* chore: abstract token secret hiding to response model in [9574](https://github.com/appwrite/appwrite/pull/9574)
-* chore: update sdks in [9655](https://github.com/appwrite/appwrite/pull/9655)
-* feat: allow non-critical events to ignore exceptions when enqueuing the event in [9680](https://github.com/appwrite/appwrite/pull/9680)
-* Revert "Add configurable function and build size" in [9681](https://github.com/appwrite/appwrite/pull/9681)
-* core: introduce endpoint.docs in specs in [9685](https://github.com/appwrite/appwrite/pull/9685)
-* fix: remove content-type header from get request specs in [9666](https://github.com/appwrite/appwrite/pull/9666)
-* chore: update flutter sdk in [9691](https://github.com/appwrite/appwrite/pull/9691)
+* Merge 1.6.x into feat-custom-cf-hostnames in [#8904](https://github.com/appwrite/appwrite/pull/8904)
+* Improve compression param checks in [#8922](https://github.com/appwrite/appwrite/pull/8922)
+* upgrade utopia storage in [#8930](https://github.com/appwrite/appwrite/pull/8930)
+* Feat migration in [#8797](https://github.com/appwrite/appwrite/pull/8797)
+* feat fix web routes in [#8962](https://github.com/appwrite/appwrite/pull/8962)
+* Fix no pool access in [#9027](https://github.com/appwrite/appwrite/pull/9027)
+* feat: use environment variable to check rules format in [#9039](https://github.com/appwrite/appwrite/pull/9039)
+* Update storage.php in [#9037](https://github.com/appwrite/appwrite/pull/9037)
+* Upgrade db 0.53.200 in [#9050](https://github.com/appwrite/appwrite/pull/9050)
+* Chore: upgrade utopia storage in [#9066](https://github.com/appwrite/appwrite/pull/9066)
+* Update usage-dump payload in [#9085](https://github.com/appwrite/appwrite/pull/9085)
+* GitHub Workflows security hardening in [#3728](https://github.com/appwrite/appwrite/pull/3728)
+* Update add-oauth2-provider.md in [#4313](https://github.com/appwrite/appwrite/pull/4313)
+* update readme-cn some doc in [#5278](https://github.com/appwrite/appwrite/pull/5278)
+* Add accessibility features in [#7042](https://github.com/appwrite/appwrite/pull/7042)
+* Add Appwrite Cloud to read me. in [#5445](https://github.com/appwrite/appwrite/pull/5445)
+* Migration throw error in [#9092](https://github.com/appwrite/appwrite/pull/9092)
+* Fix usage payload bug in [#9097](https://github.com/appwrite/appwrite/pull/9097)
+* chore: replace occurrences of dbForConsole to dbForPlatform in [#9096](https://github.com/appwrite/appwrite/pull/9096)
+* fix(realtime): decrement connectionCounter only if connection is known in [#9055](https://github.com/appwrite/appwrite/pull/9055)
+* payload bug fix in [#9098](https://github.com/appwrite/appwrite/pull/9098)
+* Fix usage payload bug in [#9099](https://github.com/appwrite/appwrite/pull/9099)
+* Usage payload debug in [#9101](https://github.com/appwrite/appwrite/pull/9101)
+* Usage payload debug in [#9103](https://github.com/appwrite/appwrite/pull/9103)
+* Usage payload debug in [#9104](https://github.com/appwrite/appwrite/pull/9104)
+* Feat: createFunction abuse labels in [#9102](https://github.com/appwrite/appwrite/pull/9102)
+* Docs-create-document in [#9105](https://github.com/appwrite/appwrite/pull/9105)
+* Docs: Create document and unknown attribute error messages. in [#5427](https://github.com/appwrite/appwrite/pull/5427)
+* Fix: update project accessed at from router and schedulers in [#9109](https://github.com/appwrite/appwrite/pull/9109)
+* chore: initial commit in [#9111](https://github.com/appwrite/appwrite/pull/9111)
+* chore: optimise webhooks payload in [#9115](https://github.com/appwrite/appwrite/pull/9115)
+* Revert "chore: initial commit" in [#9117](https://github.com/appwrite/appwrite/pull/9117)
+* chore: fix attribute name in [#9118](https://github.com/appwrite/appwrite/pull/9118)
+* Migrate to redis abuse in [#9124](https://github.com/appwrite/appwrite/pull/9124)
+* Added webhooks usage stats in [#9125](https://github.com/appwrite/appwrite/pull/9125)
+* chore remove abuse cleanup in [#9137](https://github.com/appwrite/appwrite/pull/9137)
+* fix: remove abuse delete trigger in [#9139](https://github.com/appwrite/appwrite/pull/9139)
+* Remove firebase OAuth API endpoints in [#9144](https://github.com/appwrite/appwrite/pull/9144)
+* chore: release client sdks in [#9112](https://github.com/appwrite/appwrite/pull/9112)
+* Update general.php in [#9155](https://github.com/appwrite/appwrite/pull/9155)
+* feat(swoole): allow configuration override of available cpus in [#9177](https://github.com/appwrite/appwrite/pull/9177)
+* Usage databases api read writes addition in [#9142](https://github.com/appwrite/appwrite/pull/9142)
+* Fix dead connections in [#9190](https://github.com/appwrite/appwrite/pull/9190)
+* Add hostname to audits in [#9165](https://github.com/appwrite/appwrite/pull/9165)
+* chore: shifted authphone usage tracking to api calls in [#9191](https://github.com/appwrite/appwrite/pull/9191)
+* Revert "Fix dead connections" in [#9201](https://github.com/appwrite/appwrite/pull/9201)
+* Add assertEventually to messaging provider logs test in [#9192](https://github.com/appwrite/appwrite/pull/9192)
+* feat project sms usage in [#9198](https://github.com/appwrite/appwrite/pull/9198)
+* chore: add audit labels to project resources in [#9056](https://github.com/appwrite/appwrite/pull/9056)
+* fix sms usage in [#9207](https://github.com/appwrite/appwrite/pull/9207)
+* Update database in [#9202](https://github.com/appwrite/appwrite/pull/9202)
+* Fix dead connections in [#9213](https://github.com/appwrite/appwrite/pull/9213)
+* Revert "Fix dead connections" in [#9214](https://github.com/appwrite/appwrite/pull/9214)
+* Add logs db init for consistency in [#9163](https://github.com/appwrite/appwrite/pull/9163)
+* Split the collection definitions in [#9153](https://github.com/appwrite/appwrite/pull/9153)
+* Log path with populated parameters in [#9220](https://github.com/appwrite/appwrite/pull/9220)
+* Add missing scope on function template in [#9208](https://github.com/appwrite/appwrite/pull/9208)
+* Add relatedCollection default in [#9225](https://github.com/appwrite/appwrite/pull/9225)
+* fix: function usage in [#9235](https://github.com/appwrite/appwrite/pull/9235)
+* feat: optimise events payloads in [#9232](https://github.com/appwrite/appwrite/pull/9232)
+* Optimise webhook events in [#9168](https://github.com/appwrite/appwrite/pull/9168)
+* fix: maintenance job missing type in [#9238](https://github.com/appwrite/appwrite/pull/9238)
+* Update Fetch to 0.3.0 in [#9245](https://github.com/appwrite/appwrite/pull/9245)
+* Fix maintenance job in [#9247](https://github.com/appwrite/appwrite/pull/9247)
+* chore: add missing case for executions in [#9248](https://github.com/appwrite/appwrite/pull/9248)
+* Add index dependency exception in [#9226](https://github.com/appwrite/appwrite/pull/9226)
+* chore: fix benchmarking test when made from fork in [#9233](https://github.com/appwrite/appwrite/pull/9233)
+* Update SDK Generator versions in [#9188](https://github.com/appwrite/appwrite/pull/9188)
+* chore: skipped job instead of throwing error in [#9250](https://github.com/appwrite/appwrite/pull/9250)
+* Implement new SDK Class on 1.6.x in [#9237](https://github.com/appwrite/appwrite/pull/9237)
+* Delete collection before Appwrite's attributes in [#9256](https://github.com/appwrite/appwrite/pull/9256)
+* Feat batch usage dump in [#9255](https://github.com/appwrite/appwrite/pull/9255)
+* Fix cloud tests in [#9261](https://github.com/appwrite/appwrite/pull/9261)
+* Usage: Databases reads writes in [#9260](https://github.com/appwrite/appwrite/pull/9260)
+* Update: Latest sdk specs in [#9274](https://github.com/appwrite/appwrite/pull/9274)
+* Revert "Feat batch usage dump" in [#9276](https://github.com/appwrite/appwrite/pull/9276)
+* feat: add fast2SMS adapter in [#9263](https://github.com/appwrite/appwrite/pull/9263)
+* Update Sdk Generator dependency in [#9280](https://github.com/appwrite/appwrite/pull/9280)
+* Transformed at addition in [#9281](https://github.com/appwrite/appwrite/pull/9281)
+* Docs: clarify update endpoints only work on draft messages in [#9236](https://github.com/appwrite/appwrite/pull/9236)
+* Update sdk generator dependency in [#9282](https://github.com/appwrite/appwrite/pull/9282)
+* Revert "Transformed at addition" in [#9284](https://github.com/appwrite/appwrite/pull/9284)
+* replaced init for cloud link in [#9285](https://github.com/appwrite/appwrite/pull/9285)
+* Add transformed at in [#9289](https://github.com/appwrite/appwrite/pull/9289)
+* Make migrations use Dynamic keys for destination in [#9291](https://github.com/appwrite/appwrite/pull/9291)
+* Make sessions limit tests assert eventually in [#9298](https://github.com/appwrite/appwrite/pull/9298)
+* Chore update database in [#9306](https://github.com/appwrite/appwrite/pull/9306)
+* feat: add AMQP queues in [#9287](https://github.com/appwrite/appwrite/pull/9287)
+* fix(test): use assertEventually instead of while(true) in [#9308](https://github.com/appwrite/appwrite/pull/9308)
+* fix(certificate worker): events are published without queue name in [#9309](https://github.com/appwrite/appwrite/pull/9309)
+* chore: update utopia-php/queue to 0.8.1 in [#9311](https://github.com/appwrite/appwrite/pull/9311)
+* chore: update utopia-php/queue to 0.8.2 in [#9312](https://github.com/appwrite/appwrite/pull/9312)
+* fix(schedule-tasks): revert back to direct pool usage in [#9313](https://github.com/appwrite/appwrite/pull/9313)
+* feat: custom app schemes in [#9262](https://github.com/appwrite/appwrite/pull/9262)
+* Revert "feat: custom app schemes" in [#9319](https://github.com/appwrite/appwrite/pull/9319)
+* Restore "feat: custom app schemes"" in [#9320](https://github.com/appwrite/appwrite/pull/9320)
+* Revert "Restore "feat: custom app schemes""" in [#9323](https://github.com/appwrite/appwrite/pull/9323)
+* chore: update dependencies in [#9330](https://github.com/appwrite/appwrite/pull/9330)
+* Feat: logs DB in [#9272](https://github.com/appwrite/appwrite/pull/9272)
+* Catch invalid index in [#9329](https://github.com/appwrite/appwrite/pull/9329)
+* Fix: missing call for image transformations counting in [#9342](https://github.com/appwrite/appwrite/pull/9342)
+* Fix drop abuse on shared table project delete in [#9346](https://github.com/appwrite/appwrite/pull/9346)
+* Only run all table mode tests on db update in [#9338](https://github.com/appwrite/appwrite/pull/9338)
+* Fix: missing periodic metric in [#9350](https://github.com/appwrite/appwrite/pull/9350)
+* feat(builds): check if function is blocked before building in [#9332](https://github.com/appwrite/appwrite/pull/9332)
+* feat: batch create audit logs in [#9347](https://github.com/appwrite/appwrite/pull/9347)
+* Chore: Update migrations in [#9355](https://github.com/appwrite/appwrite/pull/9355)
+* Fix: metric time was not being written to DB in [#9354](https://github.com/appwrite/appwrite/pull/9354)
+* Fix patch index validation in [#9356](https://github.com/appwrite/appwrite/pull/9356)
+* Fix image trnasformation metrics in [#9370](https://github.com/appwrite/appwrite/pull/9370)
+* Use batch delete in worker in [#9375](https://github.com/appwrite/appwrite/pull/9375)
+* Fix Model Platform is missing response key: store  in [#9361](https://github.com/appwrite/appwrite/pull/9361)
+* Feat key segmented usage in [#9336](https://github.com/appwrite/appwrite/pull/9336)
+* Feat messaging metrics in [#9353](https://github.com/appwrite/appwrite/pull/9353)
+* Fix removed audits for shared v2 in [#9388](https://github.com/appwrite/appwrite/pull/9388)
+* chore: bump utopia-php/image to 0.8.0 in [#9390](https://github.com/appwrite/appwrite/pull/9390)
+* Fix outdated CLI commands in documentation in [#9122](https://github.com/appwrite/appwrite/pull/9122)
+* disable logs display in [#9398](https://github.com/appwrite/appwrite/pull/9398)
+* Log batches per project in [#9403](https://github.com/appwrite/appwrite/pull/9403)
+* Batch per project in [#9410](https://github.com/appwrite/appwrite/pull/9410)
+* Fix: stats resources only queue projects accessed in last 3 hours in [#9411](https://github.com/appwrite/appwrite/pull/9411)
+* Track options requests in [#9397](https://github.com/appwrite/appwrite/pull/9397)
+* chore: bump docker-base in [#9406](https://github.com/appwrite/appwrite/pull/9406)
+* refactor: migrate Realtime::send calls to queueForRealtime in [#9325](https://github.com/appwrite/appwrite/pull/9325)
+* Revert "Fix: stats resources only queue projects accessed in last 3 hours" in [#9424](https://github.com/appwrite/appwrite/pull/9424)
+* Remove usage and usage dump in favor of stats-usage and stats-usage-dump in [#9339](https://github.com/appwrite/appwrite/pull/9339)
+* Fix: disable dual writing in [#9429](https://github.com/appwrite/appwrite/pull/9429)
+* Disable transformedAt update for console users in [#9425](https://github.com/appwrite/appwrite/pull/9425)
+* chore: add image transformation stats to usage endpoint in [#9393](https://github.com/appwrite/appwrite/pull/9393)
+* chore: added timeout to deployment builds in tests in [#9426](https://github.com/appwrite/appwrite/pull/9426)
+* fix: model for image transformations in usage project in [#9442](https://github.com/appwrite/appwrite/pull/9442)
+* Feat: calculate database storage in stats-resources in [#9443](https://github.com/appwrite/appwrite/pull/9443)
+* Activities batch writes in [#9438](https://github.com/appwrite/appwrite/pull/9438)
+* chore: bump cache 0.12.x in [#9412](https://github.com/appwrite/appwrite/pull/9412)
+* chore: queue console project for maintenance delete in [#9479](https://github.com/appwrite/appwrite/pull/9479)
+* chore: added logsdb for deletes worker in [#9462](https://github.com/appwrite/appwrite/pull/9462)
+* Feat: calculate and log time taken for each project in [#9491](https://github.com/appwrite/appwrite/pull/9491)
+* chore: update initializing dbForLogs in [#9494](https://github.com/appwrite/appwrite/pull/9494)
+* Feat bulk audit delete in [#9487](https://github.com/appwrite/appwrite/pull/9487)
+* Prepare 1.6.2 release in [#9499](https://github.com/appwrite/appwrite/pull/9499)
+* Regenerate specs in [#9497](https://github.com/appwrite/appwrite/pull/9497)
+* Regenerate examples in [#9498](https://github.com/appwrite/appwrite/pull/9498)
+* chore: bump sdk in [#9414](https://github.com/appwrite/appwrite/pull/9414)
+* update queue to 0.9.* in [#9505](https://github.com/appwrite/appwrite/pull/9505)
+* Feat improve delete queries in [#9507](https://github.com/appwrite/appwrite/pull/9507)
+* Feat: Add rule attributes in [#9508](https://github.com/appwrite/appwrite/pull/9508)
+* Sync main into 1.6.x in [#9496](https://github.com/appwrite/appwrite/pull/9496)
+* Bump console to version 5.2.53 in [#9495](https://github.com/appwrite/appwrite/pull/9495)
+* Prepare 1.6.1 release in [#9294](https://github.com/appwrite/appwrite/pull/9294)
+* Improve delete ordering in [#9512](https://github.com/appwrite/appwrite/pull/9512)
+* Cleanups in [#9511](https://github.com/appwrite/appwrite/pull/9511)
+* Feat dynamic regions in [#9408](https://github.com/appwrite/appwrite/pull/9408)
+* Feat env vars to system lib in [#9515](https://github.com/appwrite/appwrite/pull/9515)
+* Feat: domains count in [#9514](https://github.com/appwrite/appwrite/pull/9514)
+* Migration read from db in [#9529](https://github.com/appwrite/appwrite/pull/9529)
+* feat: add pool telemetry in [#9530](https://github.com/appwrite/appwrite/pull/9530)
+* Disable PDO persistence since we manage our own pool in [#9526](https://github.com/appwrite/appwrite/pull/9526)
+* chore: set min operations to 1 for reads and writes in [#9536](https://github.com/appwrite/appwrite/pull/9536)
+* Remove default region in [#9430](https://github.com/appwrite/appwrite/pull/9430)
+* Use cursor pagination with bigger limit for maintenance project loop in [#9546](https://github.com/appwrite/appwrite/pull/9546)
+* chore: stop tests on failure in [#9525](https://github.com/appwrite/appwrite/pull/9525)
+* chore: only update total count for privileged users in [#9554](https://github.com/appwrite/appwrite/pull/9554)
+* refactor: initialization of audit retention in [#9563](https://github.com/appwrite/appwrite/pull/9563)
+* Delete worker queries fixes in [#9523](https://github.com/appwrite/appwrite/pull/9523)
+* Bump database 0.62.x in [#9568](https://github.com/appwrite/appwrite/pull/9568)
+* Fix: schedules region filtering in [#9577](https://github.com/appwrite/appwrite/pull/9577)
+* Deletes worker fix selects for pagination in [#9578](https://github.com/appwrite/appwrite/pull/9578)
+* Add $permissions for delete documents selects in [#9579](https://github.com/appwrite/appwrite/pull/9579)
+* chore(audits): return queue pre-fetch results in [#9533](https://github.com/appwrite/appwrite/pull/9533)
+* Revert "chore(audits): return queue pre-fetch results" in [#9586](https://github.com/appwrite/appwrite/pull/9586)
+* Feat multi tenant insert in [#9573](https://github.com/appwrite/appwrite/pull/9573)
+* Add order by for cursor in [#9588](https://github.com/appwrite/appwrite/pull/9588)
+* Feat update fetch in [#9592](https://github.com/appwrite/appwrite/pull/9592)
+* Fix tenant casting in [#9598](https://github.com/appwrite/appwrite/pull/9598)
+* Feat update ws in [#9602](https://github.com/appwrite/appwrite/pull/9602)
+* Update database in [#9603](https://github.com/appwrite/appwrite/pull/9603)
+* Fix: image transformation cache in [#9608](https://github.com/appwrite/appwrite/pull/9608)
+* Remove audit payload in [#9610](https://github.com/appwrite/appwrite/pull/9610)
+* Sample rate from DSN in [#9559](https://github.com/appwrite/appwrite/pull/9559)
+* Restrict role change for sole org owner in [#9615](https://github.com/appwrite/appwrite/pull/9615)
+* chore: update php image to 0.8.1 in [#9616](https://github.com/appwrite/appwrite/pull/9616)
+* feat: refactor executor setup in [#9420](https://github.com/appwrite/appwrite/pull/9420)
+* chore: update gitpod.yml config in [#9561](https://github.com/appwrite/appwrite/pull/9561)
+* chore: update dependencies in [#9625](https://github.com/appwrite/appwrite/pull/9625)
+* Update migrations lib in [#9628](https://github.com/appwrite/appwrite/pull/9628)
+* feat: cache telemetry in [#9624](https://github.com/appwrite/appwrite/pull/9624)
+* Bump console to version 5.2.56 in [#9631](https://github.com/appwrite/appwrite/pull/9631)
+* Multi region support in [#8667](https://github.com/appwrite/appwrite/pull/8667)
+* Revert "Multi region support" in [#9632](https://github.com/appwrite/appwrite/pull/9632)
+* Revert "Revert "Multi region support"" in [#9636](https://github.com/appwrite/appwrite/pull/9636)
+* Fix tasks in [#9644](https://github.com/appwrite/appwrite/pull/9644)
+* chore: updated the migration version to 8.6 in [#9646](https://github.com/appwrite/appwrite/pull/9646)
+* Fix: merge the working of StatsUsage and StatsUsageDump in [#9585](https://github.com/appwrite/appwrite/pull/9585)
+* Update database in [#9643](https://github.com/appwrite/appwrite/pull/9643)
+* chore: fix error logging for CLI tasks in [#9651](https://github.com/appwrite/appwrite/pull/9651)
+* fix: usage test assertion in [#9653](https://github.com/appwrite/appwrite/pull/9653)
+* Fix keys in [#9656](https://github.com/appwrite/appwrite/pull/9656)
+* Feat: multi tenant dual writing in [#9583](https://github.com/appwrite/appwrite/pull/9583)
+* Fix/throwing 400 for null order attributes  in [#9657](https://github.com/appwrite/appwrite/pull/9657)
+* feat: sdk group attribute in [#9596](https://github.com/appwrite/appwrite/pull/9596)
+* Add configurable function and build size in [#9648](https://github.com/appwrite/appwrite/pull/9648)
+* feat: update API endpoint in the code examples in [#8933](https://github.com/appwrite/appwrite/pull/8933)
+* chore: abstract token secret hiding to response model in [#9574](https://github.com/appwrite/appwrite/pull/9574)
+* chore: update sdks in [#9655](https://github.com/appwrite/appwrite/pull/9655)
+* feat: allow non-critical events to ignore exceptions when enqueuing the event in [#9680](https://github.com/appwrite/appwrite/pull/9680)
+* Revert "Add configurable function and build size" in [#9681](https://github.com/appwrite/appwrite/pull/9681)
+* core: introduce endpoint.docs in specs in [#9685](https://github.com/appwrite/appwrite/pull/9685)
+* fix: remove content-type header from get request specs in [#9666](https://github.com/appwrite/appwrite/pull/9666)
+* chore: update flutter sdk in [#9691](https://github.com/appwrite/appwrite/pull/9691)
 
 # Version 1.6.1
 

CONTRIBUTING.md

@@ -111,7 +111,7 @@ $ git push origin [name_of_your_new_branch]
 
 ## Setup From Source
 
-To set up a working **development environment**, just fork the project git repository and install the backend and frontend dependencies using the proper package manager and create run the docker-compose stack.
+To set up a working **development environment**, just fork the project git repository and install the backend and frontend dependencies using the proper package manager and run the docker-compose stack.
 
 > If you just want to install Appwrite for day-to-day use and not as a contributor, you can reference the [installation guide](https://github.com/appwrite/appwrite#installation), the [getting started guide](https://appwrite.io/docs/quick-starts), or the main [README](README.md) file.
 
@@ -173,12 +173,12 @@ Learn more at our [Technology Stack](#technology-stack) section.
 - [MVVM](https://en.wikipedia.org/wiki/Model%E2%80%93view%E2%80%93viewmodel) - Appwrite console architecture
 
 ##### Container Namespace Conventions
-To keep our services easy to understand within Docker we follow a naming convention for all our containers depending on it's intended use.
+To keep our services easy to understand within Docker we follow a naming convention for all our containers depending on its intended use.
 
 `appwrite-worker-X` - Workers (`src/Appwrite/Platform/Workers/*`)
 `appwrite-task-X` - Tasks (`src/Appwrite/Platform/Tasks/*`)
 
-Other containes should be named the same as their service, for example `redis` should just be called `redis`.
+Other containers should be named the same as their service, for example `redis` should just be called `redis`.
 
 ##### Security
 
@@ -189,7 +189,7 @@ Other containes should be named the same as their service, for example `redis` s
 
 ## Modules
 
-As Appwrite grows, we noticed approach of having all service endpoints in `app/controllers/api/[service].php` is not maintainable. Not only it creates massive files, it also doesnt contain all product's features such as workers or tasks. While there might still be some occurances of those controller files, we avoid it in all new development, and gradually migrate existing controllers to **HTTP modules**.
+As Appwrite grows, we noticed approach of having all service endpoints in `app/controllers/api/[service].php` is not maintainable. Not only it creates massive files, it also doesn't contain all product's features such as workers or tasks. While there might still be some occurrences of those controller files, we avoid it in all new development, and gradually migrate existing controllers to **HTTP modules**.
 
 ### HTTP Endpoints
 
@@ -204,7 +204,7 @@ Tips and tricks:
 1. If endpoint doesn't have resource, use service name as resource name too
 > Example: `Modules/Sites/Http/Sites/Get.php`
 
-2. If there are multiple resources, use then all in folder structure
+2. If there are multiple resources, use them all in folder structure
 > Example: `Modules/Sites/Http/Deployments/Builds/Create.php`
 
 3. Action can only be `Get`, `Create`, `Update`, `Delete` or `XList`
@@ -222,51 +222,73 @@ Appwrite's current structure is a combination of both [Monolithic](https://en.wi
 ```bash
 .
 ├── app # Main application
+│   ├── assets
+│   │   ├── dbip
+│   │   ├── fonts
+│   │   └── security
 │   ├── config # Config files
+│   │   ├── avatars
+│   │   ├── collections
+│   │   ├── locale
+│   │   ├── specs
+│   │   ├── storage
+│   │   └── templates
 │   ├── controllers # API & dashboard controllers
 │   │   ├── api
 │   │   ├── shared
 │   │   └── web
-│   ├── db # DB schemas
-│   ├── sdks # SDKs generated copies (used for generating code examples)
-│   ├── tasks # Server CLI commands
-│   ├── views # HTML server-side templates
-│   └── workers # Background workers
+│   ├── init # DB schemas
+│   │   └── database
+│   └── views # HTML server-side templates
+│       ├── general
+│       └── install
 ├── bin # Server executables (tasks & workers)
-├── docker # Docker related resources and configs
+├── dev # Debugger config
 ├── docs # Docs and tutorials
 │   ├── examples
+│   ├── lists
 │   ├── references
+│   ├── sdks
 │   ├── services
 │   ├── specs
 │   └── tutorials
 ├── public # Public files
-│   ├── dist
 │   ├── fonts
 │   ├── images
-│   ├── scripts
-│   └── styles
-├── src # Supporting libraries (each lib has one role, common libs are released as individual projects)
-│   └── Appwrite
-│       ├── Auth
-│       ├── Detector
-│       ├── Docker
-|       ├── DSN
-│       ├── Event
-│       ├── Extend
-│       ├── GraphQL
-│       ├── Messaging
-│       ├── Migration
-│       ├── Network
-│       ├── OpenSSL
-│       ├── Promises
-│       ├── Specification
-│       ├── Task
-│       ├── Template
-│       ├── URL
-│       └── Utopia
+│   ├── sdk-console
+│   ├── sdk-project
+│   └── sdk-web
+├── src # Supporting libraries (each lib has one role, common libs are released as
+│   ├── Appwrite
+│   │   ├── Auth
+│   │   ├── Certificates
+│   │   ├── Deletes
+│   │   ├── Detector
+│   │   ├── Docker
+│   │   ├── Event
+│   │   ├── Extend
+│   │   ├── Functions/Validator
+│   │   ├── GraphQL
+│   │   ├── Hooks
+│   │   ├── Messaging
+│   │   ├── Migration
+│   │   ├── Network
+│   │   ├── OpenSSL
+│   │   ├── Platform
+│   │   ├── Promises
+│   │   ├── PubSub
+│   │   ├── SDK
+│   │   ├── Task/Validator
+│   │   ├── Template
+│   │   ├── Transformation
+│   │   ├── URL
+│   │   ├── Utopia
+│   │   └── Vcs
+│   └── Executor
 └── tests # End to end & unit tests
+    ├── benchmarks
     ├── e2e
+    ├── extensions
     ├── resources
     └── unit
 ```
@@ -395,7 +417,7 @@ These are the current metrics we collect usage stats for:
 
 > Note: The curly brackets in the metric name represents a template and is replaced with a value when the metric is processed.
 
-Metrics are collected within 3 scopes Daily, monthly, an infinity. Adding new usage metric in order to aggregate usage stats is very simple, but very much dependent on where do you want to collect
+Metrics are collected within 3 scopes Daily, monthly, and infinity. Adding new usage metric in order to aggregate usage stats is very simple, but very much dependent on where do you want to collect
 statistics ,via API or via background worker. For both cases you will need to add a `const` variable in `app/init.php` under the usage metrics list using the naming convention `METRIC_<RESOURCE_NAME>` as shown below.
 
 ```php
@@ -661,7 +683,7 @@ docker compose exec redis redis-cli FLUSHALL
 
 ## Using preview domains locally
 
-Appwrite Functions are automatically given a domain you can visit to execute the function. This domain has format `[SOMETHING].functions.localhost` unless you changed `_APP_DOMAIN_FUNCTIONS` environment variable. This default value works great when running Appwrite locally, but it can be impossible to use preview domains with Cloud woekspaces such as Gitpod or GitHub Codespaces.
+Appwrite Functions are automatically given a domain you can visit to execute the function. This domain has format `[SOMETHING].functions.localhost` unless you changed `_APP_DOMAIN_FUNCTIONS` environment variable. This default value works great when running Appwrite locally, but it can be impossible to use preview domains with Cloud workspaces such as Gitpod or GitHub Codespaces.
 
 To use preview domains on Cloud workspaces, you can visit hostname provided by them, and supply function's preview domain as URL parameter:
 

Dockerfile

@@ -12,7 +12,7 @@ RUN composer install --ignore-platform-reqs --optimize-autoloader \
     --no-plugins --no-scripts --prefer-dist \
     `if [ "$TESTING" != "true" ]; then echo "--no-dev"; fi`
 
-FROM appwrite/base:0.10.4 AS final
+FROM appwrite/base:0.10.6 AS base
 
 LABEL maintainer="team@appwrite.io"
 
@@ -24,11 +24,9 @@ ENV _APP_VERSION=$VERSION \
     _APP_HOME=https://appwrite.io
 
 RUN \
-  if [ "$DEBUG" == "true" ]; then \
+    if [ "$DEBUG" == "true" ]; then \
     apk add boost boost-dev; \
-  fi
-
-RUN apk add libwebp
+    fi
 
 WORKDIR /usr/src/code
 
@@ -38,9 +36,7 @@ COPY --from=composer /usr/local/src/vendor /usr/src/code/vendor
 COPY ./app /usr/src/code/app
 COPY ./public /usr/src/code/public
 COPY ./bin /usr/local/bin
-COPY ./docs /usr/src/code/docs
 COPY ./src /usr/src/code/src
-COPY ./dev /usr/src/code/dev
 
 # Set Volumes
 RUN mkdir -p /storage/uploads && \
@@ -92,14 +88,30 @@ RUN chmod +x /usr/local/bin/doctor && \
     chmod +x /usr/local/bin/stats-resources && \
     chmod +x /usr/local/bin/worker-stats-resources
 
-# Letsencrypt Permissions
 RUN mkdir -p /etc/letsencrypt/live/ && chmod -Rf 755 /etc/letsencrypt/live/
 
-# Enable Extensions
-RUN if [ "$DEBUG" = "true" ]; then cp /usr/src/code/dev/xdebug.ini /usr/local/etc/php/conf.d/xdebug.ini; fi
-RUN if [ "$DEBUG" = "true" ]; then mkdir -p /tmp/xdebug; fi
-RUN if [ "$DEBUG" = "false" ]; then rm -rf /usr/src/code/dev; fi
-RUN if [ "$DEBUG" = "false" ]; then rm -f /usr/local/lib/php/extensions/no-debug-non-zts-20230831/xdebug.so; fi
+FROM base AS production
+
+RUN rm -rf /usr/src/code/app/config/specs && \
+    rm -f /usr/local/lib/php/extensions/no-debug-non-zts-20240924/xdebug.so && \
+    find /usr -name '*.a' -delete 2>/dev/null || true && \
+    find /usr -type d -name '__pycache__' -exec rm -rf {} + 2>/dev/null || true && \
+    find /usr -name '*.pyc' -delete 2>/dev/null || true
+
+EXPOSE 80
+
+CMD [ "php", "app/http.php" ]
+
+FROM base AS development
+
+COPY ./docs /usr/src/code/docs
+COPY ./dev /usr/src/code/dev
+
+RUN if [ "$DEBUG" = "true" ]; then \
+    cp /usr/src/code/dev/xdebug.ini /usr/local/etc/php/conf.d/xdebug.ini && \
+    mkdir -p /tmp/xdebug && \
+    apk add --update --no-cache openssh-client github-cli; \
+    fi
 
 EXPOSE 80
 

README-CN.md

@@ -2,7 +2,7 @@
 
 <br />
 <p align="center">
-    <a href="https://appwrite.io" target="_blank"><img src="./public/images/banner.png" alt="Appwrite banner with logo and slogan build like a team of hundreds""></a>
+    <a href="https://appwrite.io" target="_blank"><img src="./public/images/banner.png" alt="Appwrite banner, with logo and text saying "The Developer's Cloud""></a>
     <br />
     <br />
     <b>适用于[Flutter/Vue/Angular/React/iOS/Android/* 等等平台 *]的完整后端服务</b>
@@ -36,7 +36,6 @@ Appwrite 可以提供给开发者用户验证，外部授权，用户数据读
 
 内容：
 
-
 - [开始](#开始)
 - [安装](#安装)
   - [Unix](#unix)
@@ -57,7 +56,8 @@ Appwrite 可以提供给开发者用户验证，外部授权，用户数据读
 - [版权说明](#版权说明)
 
 ## 开始
-要轻松开始使用Appwrite，您可以[**免费注册Appwrite Cloud**](https://cloud.appwrite.io/)。在Appwrite Cloud公开测试版期间，您可以完全免费使用Appwrite，而且我们不会收集您的信用卡信息。
+
+要轻松开始使用 Appwrite，您可以[**免费注册 Appwrite Cloud**](https://cloud.appwrite.io/)。在 Appwrite Cloud 公开测试版期间，您可以完全免费使用 Appwrite，而且我们不会收集您的信用卡信息。
 
 ## 安装
 
@@ -119,22 +119,16 @@ docker run -it --rm `
           <br /><sub><b>DigitalOcean</b></sub></a>
         </a>
     </td>
-    <td align="center" width="100" height="100">
-      <a href="https://gitpod.io/#https://github.com/appwrite/integration-for-gitpod">
-        <img width="50" height="39" src="public/images/integrations/gitpod-logo.svg" alt="Gitpod Logo" />
-          <br /><sub><b>Gitpod</b></sub></a>    
-      </a>
-    </td>
     <td align="center" width="100" height="100">
       <a href="https://www.linode.com/marketplace/apps/appwrite/appwrite/">
         <img width="50" height="39" src="public/images/integrations/akamai-logo.svg" alt="Akamai Logo" />
-          <br /><sub><b>Akamai Compute</b></sub></a>    
+          <br /><sub><b>Akamai Compute</b></sub></a>
       </a>
     </td>
     <td align="center" width="100" height="100">
       <a href="https://aws.amazon.com/marketplace/pp/prodview-2hiaeo2px4md6">
         <img width="50" height="39" src="public/images/integrations/aws-logo.svg" alt="AWS Logo" />
-          <br /><sub><b>AWS Marketplace</b></sub></a>    
+          <br /><sub><b>AWS Marketplace</b></sub></a>
       </a>
     </td>
   </tr>
@@ -188,25 +182,28 @@ docker run -it --rm `
 以下是当前支持的平台和语言列表。如果您想帮助我们为您选择的平台添加支持，您可以访问我们的 [SDK 生成器](https://github.com/appwrite/sdk-generator) 项目并查看我们的 [贡献指南](https://github.com/appwrite/sdk-generator/blob/master/CONTRIBUTING.md)。
 
 #### 客户端
-* :white_check_mark:  &nbsp; [Web](https://github.com/appwrite/sdk-for-web) (由 Appwrite 团队维护)
-* :white_check_mark:  &nbsp; [Flutter](https://github.com/appwrite/sdk-for-flutter) (由 Appwrite 团队维护)
-* :white_check_mark:  &nbsp; [Apple](https://github.com/appwrite/sdk-for-apple) - **公测** (由 Appwrite 团队维护)
-* :white_check_mark:  &nbsp; [Android](https://github.com/appwrite/sdk-for-android) (由 Appwrite 团队维护)
+
+- :white_check_mark: &nbsp; [Web](https://github.com/appwrite/sdk-for-web) (由 Appwrite 团队维护)
+- :white_check_mark: &nbsp; [Flutter](https://github.com/appwrite/sdk-for-flutter) (由 Appwrite 团队维护)
+- :white_check_mark: &nbsp; [Apple](https://github.com/appwrite/sdk-for-apple) - **公测** (由 Appwrite 团队维护)
+- :white_check_mark: &nbsp; [Android](https://github.com/appwrite/sdk-for-android) (由 Appwrite 团队维护)
 
 #### 服务器
-* :white_check_mark:  &nbsp; [NodeJS](https://github.com/appwrite/sdk-for-node) (由 Appwrite 团队维护)
-* :white_check_mark:  &nbsp; [PHP](https://github.com/appwrite/sdk-for-php) (由 Appwrite 团队维护)
-* :white_check_mark:  &nbsp; [Dart](https://github.com/appwrite/sdk-for-dart) - (由 Appwrite 团队维护)
-* :white_check_mark:  &nbsp; [Deno](https://github.com/appwrite/sdk-for-deno) - **公测** (由 Appwrite 团队维护)
-* :white_check_mark:  &nbsp; [Ruby](https://github.com/appwrite/sdk-for-ruby) (由 Appwrite 团队维护)
-* :white_check_mark:  &nbsp; [Python](https://github.com/appwrite/sdk-for-python) (由 Appwrite 团队维护)
-* :white_check_mark:  &nbsp; [Kotlin](https://github.com/appwrite/sdk-for-kotlin) - **公测** (由 Appwrite 团队维护)
-* :white_check_mark:  &nbsp; [Apple](https://github.com/appwrite/sdk-for-apple) - **公测** (由 Appwrite 团队维护)
-* :white_check_mark:  &nbsp; [.NET](https://github.com/appwrite/sdk-for-dotnet) - **公测** (由 Appwrite 团队维护)
+
+- :white_check_mark: &nbsp; [NodeJS](https://github.com/appwrite/sdk-for-node) (由 Appwrite 团队维护)
+- :white_check_mark: &nbsp; [PHP](https://github.com/appwrite/sdk-for-php) (由 Appwrite 团队维护)
+- :white_check_mark: &nbsp; [Dart](https://github.com/appwrite/sdk-for-dart) - (由 Appwrite 团队维护)
+- :white_check_mark: &nbsp; [Deno](https://github.com/appwrite/sdk-for-deno) - **公测** (由 Appwrite 团队维护)
+- :white_check_mark: &nbsp; [Ruby](https://github.com/appwrite/sdk-for-ruby) (由 Appwrite 团队维护)
+- :white_check_mark: &nbsp; [Python](https://github.com/appwrite/sdk-for-python) (由 Appwrite 团队维护)
+- :white_check_mark: &nbsp; [Kotlin](https://github.com/appwrite/sdk-for-kotlin) - **公测** (由 Appwrite 团队维护)
+- :white_check_mark: &nbsp; [Apple](https://github.com/appwrite/sdk-for-apple) - **公测** (由 Appwrite 团队维护)
+- :white_check_mark: &nbsp; [.NET](https://github.com/appwrite/sdk-for-dotnet) - **公测** (由 Appwrite 团队维护)
 
 #### 开发者社区
-* :white_check_mark:  &nbsp; [Appcelerator Titanium](https://github.com/m1ga/ti.appwrite) (维护者 [Michael Gangolf](https://github.com/m1ga/))  
-* :white_check_mark:  &nbsp; [Godot Engine](https://github.com/GodotNuts/appwrite-sdk) (维护者 [fenix-hub @GodotNuts](https://github.com/fenix-hub))  
+
+- :white_check_mark: &nbsp; [Appcelerator Titanium](https://github.com/m1ga/ti.appwrite) (维护者 [Michael Gangolf](https://github.com/m1ga/))
+- :white_check_mark: &nbsp; [Godot Engine](https://github.com/GodotNuts/appwrite-sdk) (维护者 [fenix-hub @GodotNuts](https://github.com/fenix-hub))
 
 找不到需要的的 SDK？ - 欢迎通过发起 PR 来帮助我们完善 Appwrite 的软件生态环境 [SDK 生成器](https://github.com/appwrite/sdk-generator)!
 

README.md

@@ -1,4 +1,4 @@
-> We just announced Timestamp Overrides for Appwrite Databases - [Learn more](https://appwrite.io/blog/post/announcing-timestamp-overrides)
+> We just announced DB operators for Appwrite Databases - [Learn more](https://appwrite.io/blog/post/announcing-db-operators)
 
 > Appwrite Cloud is now Generally Available - [Learn more](https://appwrite.io/cloud-ga)
 
@@ -6,10 +6,10 @@
 
 <br />
 <p align="center">
-    <a href="https://appwrite.io" target="_blank"><img src="./public/images/banner.png" alt="Appwrite banner, with logo and text saying "Build Like a Team of Hundreds"></a>
+    <a href="https://appwrite.io" target="_blank"><img src="./public/images/banner.png" alt="Appwrite banner, with logo and text saying "The Developer's Cloud"></a>
     <br />
     <br />
-    <b>Appwrite is an all-in-one development platform for Web, Mobile, and Flutter applications. Use built-in backend infrastructure and web hosting, all from a single place. Built with the open source community and optimized for developer experience in the coding languages you love.</b>
+    <b>Appwrite is a best-in-class, developer-first platform that gives builders everything they need to create scalable, stable, and production-ready software, fast.</b>
     <br />
     <br />
 </p>
@@ -32,13 +32,6 @@ Appwrite is an end-to-end platform for building Web, Mobile, Native, or Backend
 
 Using Appwrite, you can easily integrate your app with user authentication and multiple sign-in methods, a database for storing and querying users and team data, storage and file management, image manipulation, Cloud Functions, messaging, and [more services](https://appwrite.io/docs).
 
-<p align="center">
-    <br />
-    <a href="https://www.producthunt.com/posts/appwrite-2?utm_source=badge-top-post-badge&utm_medium=badge&utm_souce=badge-appwrite-2" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/top-post-badge.svg?post_id=360315&theme=light&period=daily" alt="Appwrite - 100&#0037;&#0032;open&#0032;source&#0032;alternative&#0032;for&#0032;Firebase | Product Hunt" style="width: 250px; height: 54px;" width="250" height="54" /></a>
-    <br />
-    <br />
-</p>
-
 ![Appwrite project dashboard showing various Appwrite features](public/images/github.png)
 
 Find out more at: [https://appwrite.io](https://appwrite.io).
@@ -129,12 +122,6 @@ Choose from one of the providers below:
           <br /><sub><b>DigitalOcean</b></sub></a>
         </a>
     </td>
-    <td align="center" width="100" height="100">
-      <a href="https://gitpod.io/#https://github.com/appwrite/integration-for-gitpod">
-        <img width="50" height="39" src="public/images/integrations/gitpod-logo.svg" alt="Gitpod Logo" />
-          <br /><sub><b>Gitpod</b></sub></a>
-      </a>
-    </td>
     <td align="center" width="100" height="100">
       <a href="https://www.linode.com/marketplace/apps/appwrite/appwrite/">
         <img width="50" height="39" src="public/images/integrations/akamai-logo.svg" alt="Akamai Logo" />

app/cli.php

@@ -9,6 +9,7 @@ use Appwrite\Event\StatsResources;
 use Appwrite\Event\StatsUsage;
 use Appwrite\Platform\Appwrite;
 use Appwrite\Runtimes\Runtimes;
+use Appwrite\Utopia\Database\Documents\User;
 use Executor\Executor;
 use Swoole\Runtime;
 use Swoole\Timer;
@@ -40,8 +41,6 @@ Config::setParam('runtimes', (new Runtimes('v5'))->getAll(supported: false));
 // require controllers after overwriting runtimes
 require_once __DIR__ . '/controllers/general.php';
 
-Authorization::disable();
-
 CLI::setResource('register', fn () => $register);
 
 CLI::setResource('cache', function ($pools) {
@@ -59,7 +58,13 @@ CLI::setResource('pools', function (Registry $register) {
     return $register->get('pools');
 }, ['register']);
 
-CLI::setResource('dbForPlatform', function ($pools, $cache) {
+CLI::setResource('authorization', function () {
+    $authorization = new Authorization();
+    $authorization->disable();
+    return $authorization;
+}, []);
+
+CLI::setResource('dbForPlatform', function ($pools, $cache, $authorization) {
     $sleep = 3;
     $maxAttempts = 5;
     $attempts = 0;
@@ -73,9 +78,11 @@ CLI::setResource('dbForPlatform', function ($pools, $cache) {
             $dbForPlatform = new Database($adapter, $cache);
 
             $dbForPlatform
+                ->setAuthorization($authorization)
                 ->setNamespace('_console')
                 ->setMetadata('host', \gethostname())
                 ->setMetadata('project', 'console');
+            $dbForPlatform->setDocumentType('users', User::class);
 
             // Ensure tables exist
             $collections = Config::getParam('collections', [])['console'];
@@ -97,16 +104,21 @@ CLI::setResource('dbForPlatform', function ($pools, $cache) {
     }
 
     return $dbForPlatform;
-}, ['pools', 'cache']);
+}, ['pools', 'cache', 'authorization']);
 
 CLI::setResource('console', function () {
     return new Document(Config::getParam('console'));
 }, []);
 
-CLI::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache) {
+CLI::setResource(
+    'isResourceBlocked',
+    fn () => fn (Document $project, string $resourceType, ?string $resourceId) => false
+);
+
+CLI::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache, $authorization) {
     $databases = []; // TODO: @Meldiron This should probably be responsibility of utopia-php/pools
 
-    return function (Document $project) use ($pools, $dbForPlatform, $cache, &$databases) {
+    return function (Document $project) use ($pools, $dbForPlatform, $cache, $authorization, &$databases) {
         if ($project->isEmpty() || $project->getId() === 'console') {
             return $dbForPlatform;
         }
@@ -139,6 +151,7 @@ CLI::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform
 
         $adapter = new DatabasePool($pools->get($dsn->getHost()));
         $database = new Database($adapter, $cache);
+
         $databases[$dsn->getHost()] = $database;
         $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
 
@@ -155,17 +168,18 @@ CLI::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform
         }
 
         $database
+            ->setAuthorization($authorization)
             ->setMetadata('host', \gethostname())
             ->setMetadata('project', $project->getId());
 
         return $database;
     };
-}, ['pools', 'dbForPlatform', 'cache']);
+}, ['pools', 'dbForPlatform', 'cache', 'authorization']);
 
-CLI::setResource('getLogsDB', function (Group $pools, Cache $cache) {
+CLI::setResource('getLogsDB', function (Group $pools, Cache $cache, Authorization $authorization) {
     $database = null;
 
-    return function (?Document $project = null) use ($pools, $cache, $database) {
+    return function (?Document $project = null) use ($pools, $cache, $database, $authorization) {
         if ($database !== null && $project !== null && !$project->isEmpty() && $project->getId() !== 'console') {
             $database->setTenant((int)$project->getSequence());
             return $database;
@@ -175,6 +189,7 @@ CLI::setResource('getLogsDB', function (Group $pools, Cache $cache) {
         $database = new Database($adapter, $cache);
 
         $database
+            ->setAuthorization($authorization)
             ->setSharedTables(true)
             ->setNamespace('logsV1')
             ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_TASK)
@@ -187,7 +202,7 @@ CLI::setResource('getLogsDB', function (Group $pools, Cache $cache) {
 
         return $database;
     };
-}, ['pools', 'cache']);
+}, ['pools', 'cache', 'authorization']);
 CLI::setResource('publisher', function (Group $pools) {
     return new BrokerPool(publisher: $pools->get('publisher'));
 }, ['pools']);

app/config/collections/common.php

@@ -1,6 +1,6 @@
 <?php
 
-use Appwrite\Auth\Auth;
+use Utopia\Auth\Hashes\Argon2;
 use Utopia\Database\Database;
 use Utopia\Database\Helpers\ID;
 
@@ -173,7 +173,7 @@ return [
                 'size' => 256,
                 'signed' => true,
                 'required' => false,
-                'default' => Auth::DEFAULT_ALGO,
+                'default' => (new Argon2())->getName(),
                 'array' => false,
                 'filters' => [],
             ],
@@ -184,7 +184,7 @@ return [
                 'size' => 65535,
                 'signed' => true,
                 'required' => false,
-                'default' => Auth::DEFAULT_ALGO_OPTIONS,
+                'default' => (new Argon2())->getOptions(),
                 'array' => false,
                 'filters' => ['json'],
             ],
@@ -364,6 +364,61 @@ return [
                 'array' => false,
                 'filters' => ['datetime'],
             ],
+            [
+                '$id' => ID::custom('emailCanonical'),
+                'type' => Database::VAR_STRING,
+                'format' => '',
+                'size' => 320,
+                'signed' => true,
+                'required' => false,
+                'default' => null,
+                'array' => false,
+                'filters' => [],
+            ],
+            [
+                '$id' => ID::custom('emailIsFree'),
+                'type' => Database::VAR_BOOLEAN,
+                'format' => '',
+                'size' => 0,
+                'signed' => true,
+                'required' => false,
+                'default' => null,
+                'array' => false,
+                'filters' => [],
+            ],
+            [
+                '$id' => ID::custom('emailIsDisposable'),
+                'type' => Database::VAR_BOOLEAN,
+                'format' => '',
+                'size' => 0,
+                'signed' => true,
+                'required' => false,
+                'default' => null,
+                'array' => false,
+                'filters' => [],
+            ],
+            [
+                '$id' => ID::custom('emailIsCorporate'),
+                'type' => Database::VAR_BOOLEAN,
+                'format' => '',
+                'size' => 0,
+                'signed' => true,
+                'required' => false,
+                'default' => null,
+                'array' => false,
+                'filters' => [],
+            ],
+            [
+                '$id' => ID::custom('emailIsCanonical'),
+                'type' => Database::VAR_BOOLEAN,
+                'format' => '',
+                'size' => 0,
+                'signed' => true,
+                'required' => false,
+                'default' => null,
+                'array' => false,
+                'filters' => [],
+            ],
         ],
         'indexes' => [
             [
@@ -1527,6 +1582,17 @@ return [
                 'required' => true,
                 'array' => false,
             ],
+            [
+                '$id' => ID::custom('transformations'),
+                'type' => Database::VAR_BOOLEAN,
+                'signed' => true,
+                'size' => 0,
+                'format' => '',
+                'filters' => [],
+                'required' => false,
+                'array' => false,
+                'default' => true,
+            ],
             [
                 '$id' => ID::custom('search'),
                 'type' => Database::VAR_STRING,

app/config/collections/platform.php

@@ -1317,6 +1317,17 @@ return [
                 'array' => false,
                 'filters' => [],
             ],
+            [
+                '$id' => ID::custom('logs'),
+                'type' => Database::VAR_STRING,
+                'format' => '',
+                'size' => 1000000,
+                'signed' => true,
+                'required' => false,
+                'default' => '',
+                'array' => false,
+                'filters' => [],
+            ],
         ],
         'indexes' => [
             [

app/config/collections/projects.php

@@ -2345,7 +2345,7 @@ return [
                 '$id' => ID::custom('errors'),
                 'type' => Database::VAR_STRING,
                 'format' => '',
-                'size' => 65535,
+                'size' => 1_000_000,
                 'signed' => true,
                 'required' => true,
                 'default' => null,
@@ -2521,4 +2521,128 @@ return [
             ],
         ],
     ],
+
+    'transactions' => [
+        '$collection' => ID::custom(Database::METADATA),
+        '$id' => ID::custom('transactions'),
+        'name' => 'Transactions',
+        'attributes' => [
+            [
+                '$id' => ID::custom('status'),
+                'type' => Database::VAR_STRING,
+                'size' => 16, // pending | committing | committed | failed
+                'signed' => true,
+                'required' => false,
+                'default' => 'pending',
+                'array' => false,
+                'filters' => [],
+            ],
+            [
+                '$id' => ID::custom('operations'),
+                'type' => Database::VAR_INTEGER,
+                'size' => 0,
+                'signed' => false,
+                'required' => true,
+                'default' => 0,
+                'array' => false,
+                'filters' => [],
+            ],
+            [
+                '$id' => ID::custom('expiresAt'),
+                'type' => Database::VAR_DATETIME,
+                'size' => 0,
+                'signed' => true,
+                'required' => true,
+                'default' => null,
+                'array' => false,
+                'filters' => ['datetime'],
+            ],
+        ],
+        'indexes' => [
+            [
+                '$id' => ID::custom('_key_expiresAt'),
+                'type' => Database::INDEX_KEY,
+                'attributes' => ['expiresAt'],
+                'lengths' => [],
+                'orders' => [Database::ORDER_DESC],
+            ],
+        ],
+    ],
+
+    'transactionLogs' => [
+        '$collection' => ID::custom(Database::METADATA),
+        '$id' => ID::custom('transactionLogs'),
+        'name' => 'Transaction Logs',
+        'attributes' => [
+            [
+                '$id' => ID::custom('transactionInternalId'),
+                'type' => Database::VAR_STRING,
+                'size' => Database::LENGTH_KEY,
+                'signed' => true,
+                'required' => true,
+                'default' => null,
+                'array' => false,
+                'filters' => [],
+            ],
+            [
+                '$id' => ID::custom('databaseInternalId'),
+                'type' => Database::VAR_STRING,
+                'size' => Database::LENGTH_KEY,
+                'signed' => true,
+                'required' => true,
+                'default' => null,
+                'array' => false,
+                'filters' => [],
+            ],
+            [
+                '$id' => ID::custom('collectionInternalId'),
+                'type' => Database::VAR_STRING,
+                'size' => Database::LENGTH_KEY,
+                'signed' => true,
+                'required' => true,
+                'default' => null,
+                'array' => false,
+                'filters' => [],
+            ],
+            [
+                '$id' => ID::custom('documentId'),
+                'type' => Database::VAR_STRING,
+                'size' => Database::LENGTH_KEY,
+                'signed' => true,
+                'required' => false,
+                'default' => null,
+                'array' => false,
+                'filters' => [],
+            ],
+            [
+                '$id' => ID::custom('action'),
+                'type' => Database::VAR_STRING,
+                'size' => 32, // create | update | upsert | increment | decrement | delete | bulkCreate | bulkUpdate | bulkUpsert | bulkDelete
+                'signed' => true,
+                'required' => true,
+                'default' => null,
+                'array' => false,
+                'filters' => [],
+            ],
+            [
+                '$id' => ID::custom('data'),
+                'type' => Database::VAR_STRING,
+                'size' => 5_000_000, // Allow large payloads for bulk operations
+                'signed' => false,
+                'required' => true,
+                'default' => null,
+                'array' => false,
+                'filters' => ['json'],
+            ],
+        ],
+        'indexes' => [
+            [
+                '$id' => ID::custom('_key_transaction'),
+                'type' => Database::INDEX_KEY,
+                'attributes' => ['transactionInternalId'],
+                'lengths' => [],
+                'orders' => [],
+            ],
+        ],
+    ],
 ];

app/config/console.php

@@ -4,7 +4,6 @@
  * Initializes console project document.
  */
 
-use Appwrite\Auth\Auth;
 use Appwrite\Network\Platform;
 use Utopia\Database\Helpers\ID;
 use Utopia\System\System;
@@ -38,7 +37,7 @@ $console = [
         'mockNumbers' => [],
         'invites' => System::getEnv('_APP_CONSOLE_INVITES', 'enabled') === 'enabled',
         'limit' => (System::getEnv('_APP_CONSOLE_WHITELIST_ROOT', 'enabled') === 'enabled') ? 1 : 0, // limit signup to 1 user
-        'duration' => Auth::TOKEN_EXPIRATION_LOGIN_LONG, // 1 Year in seconds
+        'duration' => TOKEN_EXPIRATION_LOGIN_LONG, // 1 Year in seconds
         'sessionAlerts' => System::getEnv('_APP_CONSOLE_SESSION_ALERTS', 'disabled') === 'enabled',
         'invalidateSessions' => true
     ],
@@ -49,6 +48,7 @@ $console = [
         'githubSecret' => System::getEnv('_APP_CONSOLE_GITHUB_SECRET', ''),
         'githubAppid' => System::getEnv('_APP_CONSOLE_GITHUB_APP_ID', '')
     ],
+    'smtpBaseTemplate' => APP_BRANDED_EMAIL_BASE_TEMPLATE,
 ];
 
 return $console;

app/config/errors.php

@@ -211,6 +211,11 @@ return [
         'description' => 'User with the requested ID could not be found.',
         'code' => 404,
     ],
+    Exception::USER_EMAIL_NOT_FOUND => [
+        'name' => Exception::USER_EMAIL_NOT_FOUND,
+        'description' => 'User email could not be found.',
+        'code' => 400,
+    ],
     Exception::USER_EMAIL_ALREADY_EXISTS => [
         'name' => Exception::USER_EMAIL_ALREADY_EXISTS,
         'description' => 'A user with the same email already exists in the current project.',
@@ -312,11 +317,21 @@ return [
         'description' => 'OAuth2 provider returned some error.',
         'code' => 424,
     ],
+    Exception::USER_EMAIL_NOT_VERIFIED => [
+        'name' => Exception::USER_EMAIL_NOT_VERIFIED,
+        'description' => 'User email is not verified',
+        'code' => 400,
+    ],
     Exception::USER_EMAIL_ALREADY_VERIFIED => [
         'name' => Exception::USER_EMAIL_ALREADY_VERIFIED,
         'description' => 'User email is already verified',
         'code' => 409,
     ],
+    Exception::USER_PHONE_NOT_VERIFIED => [
+        'name' => Exception::USER_PHONE_NOT_VERIFIED,
+        'description' => 'User phone is not verified',
+        'code' => 400,
+    ],
     Exception::USER_PHONE_ALREADY_VERIFIED => [
         'name' => Exception::USER_PHONE_ALREADY_VERIFIED,
         'description' => 'User phone is already verified',
@@ -507,6 +522,11 @@ return [
         'description' => 'The requested file is not publicly readable.',
         'code' => 403,
     ],
+    Exception::STORAGE_BUCKET_TRANSFORMATIONS_DISABLED => [
+        'name' => Exception::STORAGE_BUCKET_TRANSFORMATIONS_DISABLED,
+        'description' => 'Image transformations are disabled for the requested bucket.',
+        'code' => 403,
+    ],
 
     /** Tokens */
     Exception::TOKEN_NOT_FOUND => [
@@ -563,6 +583,11 @@ return [
         'description' => 'The requested runtime is either inactive or unsupported. Please check the value of the _APP_FUNCTIONS_RUNTIMES environment variable.',
         'code' => 404,
     ],
+    Exception::FUNCTION_ALREADY_EXISTS => [
+        'name' => Exception::FUNCTION_ALREADY_EXISTS,
+        'description' => 'Function with the requested ID already exists. Try again with a different ID or use ID.unique() to generate a unique ID.',
+        'code' => 409,
+    ],
     Exception::FUNCTION_ENTRYPOINT_MISSING => [
         'name' => Exception::FUNCTION_ENTRYPOINT_MISSING,
         'description' => 'Entrypoint for your Appwrite Function is missing. Please specify it when making deployment or update the entrypoint under your function\'s "Settings" > "Configuration" > "Entrypoint".',
@@ -663,12 +688,12 @@ return [
     /** Databases */
     Exception::DATABASE_NOT_FOUND => [
         'name' => Exception::DATABASE_NOT_FOUND,
-        'description' => 'Database not found',
+        'description' => 'Database with the requested ID \'%s\' could not be found.',
         'code' => 404
     ],
     Exception::DATABASE_ALREADY_EXISTS => [
         'name' => Exception::DATABASE_ALREADY_EXISTS,
-        'description' => 'Database already exists',
+        'description' => 'Database with the requested ID \'%s\' already exists. Try again with a different ID or use ID.unique() to generate a unique ID.',
         'code' => 409
     ],
     Exception::DATABASE_TIMEOUT => [
@@ -685,41 +710,41 @@ return [
     /** Collections */
     Exception::COLLECTION_NOT_FOUND => [
         'name' => Exception::COLLECTION_NOT_FOUND,
-        'description' => 'Collection with the requested ID could not be found.',
+        'description' => 'Collection with the requested ID \'%s\' could not be found.',
         'code' => 404,
     ],
     Exception::COLLECTION_ALREADY_EXISTS => [
         'name' => Exception::COLLECTION_ALREADY_EXISTS,
-        'description' => 'A collection with the requested ID already exists. Try again with a different ID or use ID.unique() to generate a unique ID.',
+        'description' => 'A collection with the requested ID \'%s\' already exists. Try again with a different ID or use ID.unique() to generate a unique ID.',
         'code' => 409,
     ],
     Exception::COLLECTION_LIMIT_EXCEEDED => [
         'name' => Exception::COLLECTION_LIMIT_EXCEEDED,
-        'description' => 'The maximum number of collections has been reached.',
+        'description' => 'The maximum number of collections for database \'%s\' has been reached.',
         'code' => 400,
     ],
 
     /** Tables */
     Exception::TABLE_NOT_FOUND => [
         'name' => Exception::TABLE_NOT_FOUND,
-        'description' => 'Table with the requested ID could not be found.',
+        'description' => 'Table with the requested ID \'%s\' could not be found.',
         'code' => 404,
     ],
     Exception::TABLE_ALREADY_EXISTS => [
         'name' => Exception::TABLE_ALREADY_EXISTS,
-        'description' => 'A table with the requested ID already exists. Try again with a different ID or use ID.unique() to generate a unique ID.',
+        'description' => 'A table with the requested ID \'%s\' already exists. Try again with a different ID or use ID.unique() to generate a unique ID.',
         'code' => 409,
     ],
     Exception::TABLE_LIMIT_EXCEEDED => [
         'name' => Exception::TABLE_LIMIT_EXCEEDED,
-        'description' => 'The maximum number of tables has been reached.',
+        'description' => 'The maximum number of tables for database \'%s\' has been reached.',
         'code' => 400,
     ],
 
     /** Documents */
     Exception::DOCUMENT_NOT_FOUND => [
         'name' => Exception::DOCUMENT_NOT_FOUND,
-        'description' => 'Document with the requested ID could not be found.',
+        'description' => 'Document with the requested ID \'%s\' could not be found.',
         'code' => 404,
     ],
     Exception::DOCUMENT_INVALID_STRUCTURE => [
@@ -739,7 +764,7 @@ return [
     ],
     Exception::DOCUMENT_ALREADY_EXISTS => [
         'name' => Exception::DOCUMENT_ALREADY_EXISTS,
-        'description' => 'Document with the requested ID already exists. Try again with a different ID or use ID.unique() to generate a unique ID.',
+        'description' => 'Document with the requested ID \'%s\' already exists. Try again with a different ID or use ID.unique() to generate a unique ID.',
         'code' => 409,
     ],
     Exception::DOCUMENT_UPDATE_CONFLICT => [
@@ -756,7 +781,7 @@ return [
     /** Rows */
     Exception::ROW_NOT_FOUND => [
         'name' => Exception::ROW_NOT_FOUND,
-        'description' => 'Row with the requested ID could not be found.',
+        'description' => 'Row with the requested ID \'%s\' could not be found.',
         'code' => 404,
     ],
     Exception::ROW_INVALID_STRUCTURE => [
@@ -766,7 +791,7 @@ return [
     ],
     Exception::ROW_MISSING_DATA => [
         'name' => Exception::ROW_MISSING_DATA,
-        'description' => 'The row data is missing. Try again with row data populated',
+        'description' => 'The row data is missing. Try again with row data populated.',
         'code' => 400,
     ],
     Exception::ROW_MISSING_PAYLOAD => [
@@ -776,7 +801,7 @@ return [
     ],
     Exception::ROW_ALREADY_EXISTS => [
         'name' => Exception::ROW_ALREADY_EXISTS,
-        'description' => 'Row with the requested ID already exists. Try again with a different ID or use ID.unique() to generate a unique ID.',
+        'description' => 'Row with the requested ID \'%s\' already exists. Try again with a different ID or use ID.unique() to generate a unique ID.',
         'code' => 409,
     ],
     Exception::ROW_UPDATE_CONFLICT => [
@@ -793,17 +818,17 @@ return [
     /** Attributes */
     Exception::ATTRIBUTE_NOT_FOUND => [
         'name' => Exception::ATTRIBUTE_NOT_FOUND,
-        'description' => 'Attribute with the requested ID could not be found.',
+        'description' => 'Attribute with the requested key \'%s\' could not be found.',
         'code' => 404,
     ],
     Exception::ATTRIBUTE_UNKNOWN => [
         'name' => Exception::ATTRIBUTE_UNKNOWN,
-        'description' => 'The attribute required for the index could not be found. Please confirm all your attributes are in the available state.',
+        'description' => 'The attribute \'%s\' required for the index could not be found. Please confirm all your attributes are in the available state.',
         'code' => 400,
     ],
     Exception::ATTRIBUTE_NOT_AVAILABLE => [
         'name' => Exception::ATTRIBUTE_NOT_AVAILABLE,
-        'description' => 'The requested attribute is not yet available. Please try again later.',
+        'description' => 'The requested attribute \'%s\' is not yet available. Please try again later.',
         'code' => 400,
     ],
     Exception::ATTRIBUTE_FORMAT_UNSUPPORTED => [
@@ -818,12 +843,12 @@ return [
     ],
     Exception::ATTRIBUTE_ALREADY_EXISTS => [
         'name' => Exception::ATTRIBUTE_ALREADY_EXISTS,
-        'description' => 'Attribute with the requested key already exists. Attribute keys must be unique, try again with a different key.',
+        'description' => 'Attribute with the requested key \'%s\' already exists. Attribute keys must be unique, try again with a different key.',
         'code' => 409,
     ],
     Exception::ATTRIBUTE_LIMIT_EXCEEDED => [
         'name' => Exception::ATTRIBUTE_LIMIT_EXCEEDED,
-        'description' => 'The maximum number or size of attributes for this collection has been reached.',
+        'description' => 'The maximum number or size of attributes for collection \'%s\' has been reached.',
         'code' => 400,
     ],
     Exception::ATTRIBUTE_VALUE_INVALID => [
@@ -833,7 +858,7 @@ return [
     ],
     Exception::ATTRIBUTE_TYPE_INVALID => [
         'name' => Exception::ATTRIBUTE_TYPE_INVALID,
-        'description' => 'The attribute type is invalid.',
+        'description' => 'The attribute \'%s\' type is invalid.',
         'code' => 400,
     ],
     Exception::ATTRIBUTE_INVALID_RESIZE => [
@@ -844,7 +869,7 @@ return [
 
     Exception::ATTRIBUTE_TYPE_NOT_SUPPORTED => [
         'name' => Exception::ATTRIBUTE_TYPE_NOT_SUPPORTED,
-        'description' => 'Attribute type is not supported.',
+        'description' => 'Attribute type \'%s\' is not supported.',
         'code' => 400,
     ],
 
@@ -858,17 +883,17 @@ return [
     /** Columns */
     Exception::COLUMN_NOT_FOUND => [
         'name' => Exception::COLUMN_NOT_FOUND,
-        'description' => 'Column with the requested ID could not be found.',
+        'description' => 'Column with the requested key \'%s\' could not be found.',
         'code' => 404,
     ],
     Exception::COLUMN_UNKNOWN => [
         'name' => Exception::COLUMN_UNKNOWN,
-        'description' => 'The column required for the index could not be found. Please confirm all your columns are in the available state.',
+        'description' => 'The column \'%s\' required for the index could not be found. Please confirm all your columns are in the available state.',
         'code' => 400,
     ],
     Exception::COLUMN_NOT_AVAILABLE => [
         'name' => Exception::COLUMN_NOT_AVAILABLE,
-        'description' => 'The requested column is not yet available. Please try again later.',
+        'description' => 'The requested column \'%s\' is not yet available. Please try again later.',
         'code' => 400,
     ],
     Exception::COLUMN_FORMAT_UNSUPPORTED => [
@@ -883,12 +908,12 @@ return [
     ],
     Exception::COLUMN_ALREADY_EXISTS => [
         'name' => Exception::COLUMN_ALREADY_EXISTS,
-        'description' => 'Column with the requested key already exists. Column keys must be unique, try again with a different key.',
+        'description' => 'Column with the requested key \'%s\' already exists. Column keys must be unique, try again with a different key.',
         'code' => 409,
     ],
     Exception::COLUMN_LIMIT_EXCEEDED => [
         'name' => Exception::COLUMN_LIMIT_EXCEEDED,
-        'description' => 'The maximum number or size of columns for this table has been reached.',
+        'description' => 'The maximum number or size of columns for table \'%s\' has been reached.',
         'code' => 400,
     ],
     Exception::COLUMN_VALUE_INVALID => [
@@ -898,7 +923,7 @@ return [
     ],
     Exception::COLUMN_TYPE_INVALID => [
         'name' => Exception::COLUMN_TYPE_INVALID,
-        'description' => 'The column type is invalid.',
+        'description' => 'The column \'%s\' type is invalid.',
         'code' => 400,
     ],
     Exception::COLUMN_INVALID_RESIZE => [
@@ -908,24 +933,24 @@ return [
     ],
     Exception::COLUMN_TYPE_NOT_SUPPORTED => [
         'name' => Exception::COLUMN_TYPE_NOT_SUPPORTED,
-        'description' => 'Column type is not supported.',
+        'description' => 'Column type \'%s\' is not supported.',
         'code' => 400,
     ],
 
     /** Indexes */
     Exception::INDEX_NOT_FOUND => [
         'name' => Exception::INDEX_NOT_FOUND,
-        'description' => 'Index with the requested ID could not be found.',
+        'description' => 'Index with the requested key \'%s\' could not be found.',
         'code' => 404,
     ],
     Exception::INDEX_LIMIT_EXCEEDED => [
         'name' => Exception::INDEX_LIMIT_EXCEEDED,
-        'description' => 'The maximum number of indexes has been reached.',
+        'description' => 'The maximum number of indexes for collection \'%s\' has been reached.',
         'code' => 400,
     ],
     Exception::INDEX_ALREADY_EXISTS => [
         'name' => Exception::INDEX_ALREADY_EXISTS,
-        'description' => 'Index with the requested key already exists. Try again with a different key.',
+        'description' => 'Index with the requested key \'%s\' already exists. Try again with a different key.',
         'code' => 409,
     ],
     Exception::INDEX_INVALID => [
@@ -935,24 +960,24 @@ return [
     ],
     Exception::INDEX_DEPENDENCY => [
         'name' => Exception::INDEX_DEPENDENCY,
-        'description' => 'Attribute cannot be renamed or deleted. Please remove the associated index first.',
+        'description' => 'Attribute \'%s\' cannot be renamed or deleted. Please remove the associated index first.',
         'code' => 409,
     ],
 
     /** Column Indexes, same as Indexes but with different type */
     Exception::COLUMN_INDEX_NOT_FOUND => [
         'name' => Exception::COLUMN_INDEX_NOT_FOUND,
-        'description' => 'Index with the requested ID could not be found.',
+        'description' => 'Index with the requested key \'%s\' could not be found.',
         'code' => 404,
     ],
     Exception::COLUMN_INDEX_LIMIT_EXCEEDED => [
         'name' => Exception::COLUMN_INDEX_LIMIT_EXCEEDED,
-        'description' => 'The maximum number of indexes has been reached.',
+        'description' => 'The maximum number of indexes for table \'%s\' has been reached.',
         'code' => 400,
     ],
     Exception::COLUMN_INDEX_ALREADY_EXISTS => [
         'name' => Exception::COLUMN_INDEX_ALREADY_EXISTS,
-        'description' => 'Index with the requested key already exists. Try again with a different key.',
+        'description' => 'Index with the requested key \'%s\' already exists. Try again with a different key.',
         'code' => 409,
     ],
     Exception::COLUMN_INDEX_INVALID => [
@@ -962,10 +987,52 @@ return [
     ],
     Exception::COLUMN_INDEX_DEPENDENCY => [
         'name' => Exception::COLUMN_INDEX_DEPENDENCY,
-        'description' => 'Column cannot be renamed or deleted. Please remove the associated index first.',
+        'description' => 'Column \'%s\' cannot be renamed or deleted. Please remove the associated index first.',
         'code' => 409,
     ],
 
+    /** Transactions */
+    Exception::TRANSACTION_NOT_FOUND => [
+        'name' => Exception::TRANSACTION_NOT_FOUND,
+        'description' => 'Transaction with the requested ID \'%s\' could not be found.',
+        'code' => 404,
+    ],
+    Exception::TRANSACTION_ALREADY_EXISTS => [
+        'name' => Exception::TRANSACTION_ALREADY_EXISTS,
+        'description' => 'Transaction with the requested ID \'%s\' already exists. Try again with a different ID or use ID.unique() to generate a unique ID.',
+        'code' => 409,
+    ],
+    Exception::TRANSACTION_INVALID => [
+        'name' => Exception::TRANSACTION_INVALID,
+        'description' => 'The transaction is invalid. Please check the transaction state and try again.',
+        'code' => 400,
+    ],
+    Exception::TRANSACTION_FAILED => [
+        'name' => Exception::TRANSACTION_FAILED,
+        'description' => 'The transaction has errored. Please check the transaction data and try again.',
+        'code' => 400,
+    ],
+    Exception::TRANSACTION_EXPIRED => [
+        'name' => Exception::TRANSACTION_EXPIRED,
+        'description' => 'The transaction has expired. Please create a new transaction and try again.',
+        'code' => 410,
+    ],
+    Exception::TRANSACTION_CONFLICT => [
+        'name' => Exception::TRANSACTION_CONFLICT,
+        'description' => 'The transaction has a conflict. Please resolve the conflict and try again.',
+        'code' => 409,
+    ],
+    Exception::TRANSACTION_LIMIT_EXCEEDED => [
+        'name' => Exception::TRANSACTION_LIMIT_EXCEEDED,
+        'description' => 'The maximum number of operations per transaction has been exceeded.',
+        'code' => 400,
+    ],
+    Exception::TRANSACTION_NOT_READY => [
+        'name' => Exception::TRANSACTION_NOT_READY,
+        'description' => 'The transaction is not ready yet. Please try again later.',
+        'code' => 400,
+    ],
+
     /** Project Errors */
     Exception::PROJECT_NOT_FOUND => [
         'name' => Exception::PROJECT_NOT_FOUND,

app/config/frameworks.php

@@ -8,20 +8,13 @@ use Utopia\Config\Config;
 
 $templateRuntimes = Config::getParam('template-runtimes');
 
-function getVersions(array $versions, string $prefix)
-{
-    return array_map(function ($version) use ($prefix) {
-        return $prefix . '-' . $version;
-    }, $versions);
-}
-
 return [
     'analog' => [
         'key' => 'analog',
         'name' => 'Analog',
         'screenshotSleep' => 3000,
         'buildRuntime' => 'node-22',
-        'runtimes' => getVersions($templateRuntimes['NODE']['versions'], 'node'),
+        'runtimes' => $templateRuntimes['NODE'],
         'bundleCommand' => 'bash /usr/local/server/helpers/analog/bundle.sh',
         'envCommand' => 'source /usr/local/server/helpers/analog/env.sh',
         'adapters' => [
@@ -47,7 +40,7 @@ return [
         'name' => 'Angular',
         'screenshotSleep' => 3000,
         'buildRuntime' => 'node-22',
-        'runtimes' => getVersions($templateRuntimes['NODE']['versions'], 'node'),
+        'runtimes' => $templateRuntimes['NODE'],
         'bundleCommand' => 'bash /usr/local/server/helpers/angular/bundle.sh',
         'envCommand' => 'source /usr/local/server/helpers/angular/env.sh',
         'adapters' => [
@@ -73,7 +66,7 @@ return [
         'name' => 'Next.js',
         'screenshotSleep' => 3000,
         'buildRuntime' => 'node-22',
-        'runtimes' => getVersions($templateRuntimes['NODE']['versions'], 'node'),
+        'runtimes' => $templateRuntimes['NODE'],
         'bundleCommand' => 'bash /usr/local/server/helpers/next-js/bundle.sh',
         'envCommand' => 'source /usr/local/server/helpers/next-js/env.sh',
         'adapters' => [
@@ -98,7 +91,7 @@ return [
         'name' => 'React',
         'screenshotSleep' => 3000,
         'buildRuntime' => 'node-22',
-        'runtimes' => getVersions($templateRuntimes['NODE']['versions'], 'node'),
+        'runtimes' => $templateRuntimes['NODE'],
         'adapters' => [
             'static' => [
                 'key' => 'static',
@@ -115,7 +108,7 @@ return [
         'name' => 'Nuxt',
         'screenshotSleep' => 3000,
         'buildRuntime' => 'node-22',
-        'runtimes' => getVersions($templateRuntimes['NODE']['versions'], 'node'),
+        'runtimes' => $templateRuntimes['NODE'],
         'bundleCommand' => 'bash /usr/local/server/helpers/nuxt/bundle.sh',
         'envCommand' => 'source /usr/local/server/helpers/nuxt/env.sh',
         'adapters' => [
@@ -140,7 +133,7 @@ return [
         'name' => 'Vue.js',
         'screenshotSleep' => 5000,
         'buildRuntime' => 'node-22',
-        'runtimes' => getVersions($templateRuntimes['NODE']['versions'], 'node'),
+        'runtimes' => $templateRuntimes['NODE'],
         'adapters' => [
             'static' => [
                 'key' => 'static',
@@ -157,7 +150,7 @@ return [
         'name' => 'SvelteKit',
         'screenshotSleep' => 3000,
         'buildRuntime' => 'node-22',
-        'runtimes' => getVersions($templateRuntimes['NODE']['versions'], 'node'),
+        'runtimes' => $templateRuntimes['NODE'],
         'bundleCommand' => 'bash /usr/local/server/helpers/sveltekit/bundle.sh',
         'envCommand' => 'source /usr/local/server/helpers/sveltekit/env.sh',
         'adapters' => [
@@ -182,7 +175,7 @@ return [
         'name' => 'Astro',
         'screenshotSleep' => 3000,
         'buildRuntime' => 'node-22',
-        'runtimes' => getVersions($templateRuntimes['NODE']['versions'], 'node'),
+        'runtimes' => $templateRuntimes['NODE'],
         'bundleCommand' => 'bash /usr/local/server/helpers/astro/bundle.sh',
         'envCommand' => 'source /usr/local/server/helpers/astro/env.sh',
         'adapters' => [
@@ -202,12 +195,37 @@ return [
             ]
         ]
     ],
+    'tanstack-start' => [
+        'key' => 'tanstack-start',
+        'name' => 'TanStack Start',
+        'screenshotSleep' => 3000,
+        'buildRuntime' => 'node-22',
+        'runtimes' => $templateRuntimes['NODE'],
+        'bundleCommand' => 'bash /usr/local/server/helpers/tanstack-start/bundle.sh',
+        'envCommand' => 'source /usr/local/server/helpers/tanstack-start/env.sh',
+        'adapters' => [
+            'ssr' => [
+                'key' => 'ssr',
+                'buildCommand' => 'npm run build',
+                'installCommand' => 'npm install',
+                'outputDirectory' => './.output',
+                'startCommand' => 'bash helpers/tanstack-start/server.sh',
+            ],
+            'static' => [
+                'key' => 'static',
+                'buildCommand' => 'npm run build',
+                'installCommand' => 'npm install',
+                'outputDirectory' => './dist/client',
+                'startCommand' => 'bash helpers/server.sh',
+            ]
+        ]
+    ],
     'remix' => [
         'key' => 'remix',
         'name' => 'Remix',
         'screenshotSleep' => 3000,
         'buildRuntime' => 'node-22',
-        'runtimes' => getVersions($templateRuntimes['NODE']['versions'], 'node'),
+        'runtimes' => $templateRuntimes['NODE'],
         'bundleCommand' => 'bash /usr/local/server/helpers/remix/bundle.sh',
         'envCommand' => 'source /usr/local/server/helpers/remix/env.sh',
         'adapters' => [
@@ -232,7 +250,7 @@ return [
         'name' => 'Lynx',
         'screenshotSleep' => 5000,
         'buildRuntime' => 'node-22',
-        'runtimes' => getVersions($templateRuntimes['NODE']['versions'], 'node'),
+        'runtimes' => $templateRuntimes['NODE'],
         'adapters' => [
             'static' => [
                 'key' => 'static',
@@ -248,8 +266,8 @@ return [
         'key' => 'flutter',
         'name' => 'Flutter',
         'screenshotSleep' => 5000,
-        'buildRuntime' => 'flutter-3.29',
-        'runtimes' => getVersions($templateRuntimes['FLUTTER']['versions'], 'flutter'),
+        'buildRuntime' => 'flutter-3.35',
+        'runtimes' => $templateRuntimes['FLUTTER'],
         'adapters' => [
             'static' => [
                 'key' => 'static',
@@ -257,6 +275,7 @@ return [
                 'installCommand' => 'flutter pub get',
                 'outputDirectory' => './build/web',
                 'startCommand' => 'bash helpers/server.sh',
+                'fallbackFile' => 'index.html'
             ],
         ],
     ],
@@ -265,7 +284,7 @@ return [
         'name' => 'React Native',
         'screenshotSleep' => 3000,
         'buildRuntime' => 'node-22',
-        'runtimes' => getVersions($templateRuntimes['NODE']['versions'], 'node'),
+        'runtimes' => $templateRuntimes['NODE'],
         'adapters' => [
             'static' => [
                 'key' => 'static',
@@ -282,7 +301,7 @@ return [
         'name' => 'Vite',
         'screenshotSleep' => 3000,
         'buildRuntime' => 'node-22',
-        'runtimes' => getVersions($templateRuntimes['NODE']['versions'], 'node'),
+        'runtimes' => $templateRuntimes['NODE'],
         'adapters' => [
             'static' => [
                 'key' => 'static',
@@ -298,7 +317,7 @@ return [
         'name' => 'Other',
         'screenshotSleep' => 3000,
         'buildRuntime' => 'node-22',
-        'runtimes' => getVersions($templateRuntimes['NODE']['versions'], 'node'),
+        'runtimes' => $templateRuntimes['NODE'],
         'adapters' => [
             'static' => [
                 'key' => 'static',

app/config/locale/templates/email-base-styled.tpl

@@ -2,6 +2,38 @@
 <html>
     <head>
         <link rel="preconnect" href="https://assets.appwrite.io/" crossorigin>
+        <meta name="color-scheme" content="light dark">
+        <meta name="supported-color-schemes" content="light dark">
+        <style type="text/css">
+            :root {
+                color-scheme: light dark;
+                supported-color-schemes: light dark;
+            }
+
+            @media (prefers-color-scheme: dark ) {
+                body {
+                    color: #616b7c !important;
+                    background-color: #ffffff !important;
+                }
+                a {
+                    color: currentColor !important;
+                }
+                a.button {
+                    color: #ffffff !important;
+                    background-color: {{accentColor}} !important;
+                    border-color: {{accentColor}} !important;
+                }
+                h1, h2, h3 {
+                    color: #373b4d !important;
+                }
+                h4 {
+                    color: #4f5769 !important;
+                }
+                p.security-phrase:not(:empty), hr {
+                    border-color: #e8e9f0 !important;
+                }
+            }
+        </style>
         <style>
             @font-face {
                 font-family: 'Inter';
@@ -37,7 +69,6 @@
                 font-family: "Inter", sans-serif;
                 background-color: #ffffff;
                 margin: 0;
-                padding: 0;
             }
             a {
                 color: currentColor;
@@ -98,6 +129,7 @@
                 color: #ffffff;
                 border-radius: 8px;
                 height: 48px;
+                line-height: 24px;
                 padding: 12px 20px;
                 box-sizing: border-box;
                 cursor: pointer;
@@ -131,6 +163,14 @@
             .social-icon > img {
                 margin: auto;
             }
+            p.security-phrase:not(:empty) {
+                opacity: 0.7;
+                margin: 0;
+                padding: 0;
+                margin-top: 32px;
+                padding-top: 32px;
+                border-top: 1px solid #e8e9f0;
+            }
         </style>
     </head>
 
@@ -145,8 +185,9 @@
                 <tr>
                     <td>
                         <img
-                            height="32px"
+                            height="26px"
                             src="{{logoUrl}}"
+                            alt="{{platform}} logo"
                         />
                     </td>
                 </tr>
@@ -155,12 +196,12 @@
             <table style="margin-top: 32px">
                 <tr>
                     <td>
-                        <h1>{{subject}}</h1>
+                        <h1>{{heading}}</h1>
                     </td>
                 </tr>
             </table>
 
-            <table style="margin-top: 32px">
+            <table style="margin-top: 16px">
                 <tr>
                     <td>
 {{body}}
@@ -184,7 +225,7 @@
                 <tr>
                     <td style="padding-left: 4px; padding-right: 4px">
                         <a
-                            href="{{twitterUrl}}"
+                            href="{{twitter}}"
                             class="social-icon"
                             title="Twitter"
                         >
@@ -193,7 +234,7 @@
                     </td>
                     <td style="padding-left: 4px; padding-right: 4px">
                         <a
-                            href="{{discordUrl}}"
+                            href="{{discord}}"
                             class="social-icon"
                         >
                             <img src="https://cloud.appwrite.io/images/mails/discord.png" height="24" width="24" />
@@ -201,7 +242,7 @@
                     </td>
                     <td style="padding-left: 4px; padding-right: 4px">
                         <a
-                            href="{{githubUrl}}"
+                            href="{{github}}"
                             class="social-icon"
                         >
                             <img src="https://cloud.appwrite.io/images/mails/github.png" height="24" width="24" />
@@ -211,15 +252,15 @@
             </table>
             <table style="width: auto; margin: 0 auto; margin-top: 60px">
                 <tr>
-                    <td><a href="{{termsUrl}}">Terms</a></td>
+                    <td><a href="{{terms}}">Terms</a></td>
                     <td style="color: #e8e9f0">
                         <div style="margin: 0 8px">|</div>
                     </td>
-                    <td><a href="{{privacyUrl}}">Privacy</a></td>
+                    <td><a href="{{privacy}}">Privacy</a></td>
                 </tr>
             </table>
             <p style="text-align: center" align="center">
-                &copy; {{year}} Appwrite | 251 Little Falls Drive, Wilmington 19808,
+                &copy; {{year}} {{platform}} | 251 Little Falls Drive, Wilmington 19808,
                 Delaware, United States
             </p>
         </div>

app/config/locale/templates/email-base.tpl

@@ -2,6 +2,38 @@
 <html>
     <head>
         <link rel="preconnect" href="https://assets.appwrite.io/" crossorigin>
+        <meta name="color-scheme" content="light dark">
+        <meta name="supported-color-schemes" content="light dark">
+        <style type="text/css">
+            :root {
+                color-scheme: light dark;
+                supported-color-schemes: light dark;
+            }
+
+            @media (prefers-color-scheme: dark ) {
+                body {
+                    color: #616b7c !important;
+                    background-color: #ffffff !important;
+                }
+                a {
+                    color: currentColor !important;
+                }
+                a.button {
+                    color: #ffffff !important;
+                    background-color: #2D2D31 !important;
+                    border-color: #414146 !important;
+                }
+                h1, h2, h3 {
+                    color: #373b4d !important;
+                }
+                h4 {
+                    color: #4f5769 !important;
+                }
+                p.security-phrase:not(:empty), hr {
+                    border-color: #e8e9f0 !important;
+                }
+            }
+        </style>
         <style>
             @font-face {
                 font-family: 'Inter';
@@ -44,6 +76,21 @@
                 color: currentColor;
                 word-break: break-all;
             }
+            a.button {
+                box-sizing: border-box;
+                display: inline-block;
+                text-align: center;
+                text-decoration: none;
+                padding: 9px 14px;
+                color: #ffffff;
+                background-color: #2D2D31;
+                border: 1px solid #414146;
+                border-radius: 8px;
+            }
+            a.button:hover,
+            a.button:focus {
+                opacity: 0.8;
+            }
             table {
                 width: 100%;
                 border-spacing: 0 !important;
@@ -94,10 +141,15 @@
             h* {
                 font-family: 'Poppins', sans-serif;
             }
-    
             p {
                 margin-bottom: 10px;
             }
+            p.security-phrase:not(:empty) {
+                opacity: 0.7;
+                margin-top: 32px;
+                padding-top: 32px;
+                border-top: 1px solid #e8e9f0;
+            }
         </style>
     </head>
 

app/config/locale/templates/email-export-failed.tpl

@@ -0,0 +1,8 @@
+<p>{{hello}}</p>
+<p>{{body}}</p>
+<p>{{footer}}</p>
+<p style="margin-bottom: 32px">
+    {{thanks}}
+    <br/>
+    {{signature}}
+</p>

app/config/locale/templates/email-inner-base.tpl

@@ -1,6 +1,6 @@
 <p>{{hello}}</p>
 <p>{{body}}</p>
-<p><a href="{{redirect}}" target="_blank" style="font-size: 14px; font-family: Inter, sans-serif; color: #ffffff; text-decoration: none; background-color: #2D2D31; border-radius: 8px; padding: 9px 14px; border: 1px solid #414146; display: inline-block; text-align:center; box-sizing: border-box;">{{buttonText}}</a></p>
+<p><a href="{{redirect}}" target="_blank" class="button">{{buttonText}}</a></p>
 <p>{{footer}}</p>
 <p style="margin-bottom: 32px">
     {{thanks}}

app/config/locale/templates/email-magic-url.tpl

@@ -5,7 +5,7 @@
 <table border="0" cellspacing="0" cellpadding="0" style="padding-top: 10px; padding-bottom: 10px; display: inline-block;">
     <tr>
         <td align="center" style="border-radius: 8px; background-color: #19191D;">
-            <a rel="noopener" target="_blank" href="{{redirect}}" style="font-size: 14px; font-family: Inter; color: #ffffff; text-decoration: none; border-radius: 8px; padding: 9px 14px; border: 1px solid #19191D; display: inline-block;">{{buttonText}}</a>
+            <a rel="noopener" target="_blank" href="{{redirect}}" class="button">{{buttonText}}</a>
         </td>
     </tr>
 </table>

app/config/locale/templates/email-mfa-challenge.tpl

@@ -5,7 +5,7 @@
 <table border="0" cellspacing="0" cellpadding="0" style="padding-top: 10px; padding-bottom: 10px; display: inline-block;">
     <tr>
         <td align="center" style="border-radius: 8px; background-color: #ffffff;">
-            <p style="font-size: 24px; text-indent: 18px; letter-spacing: 18px; font-family: 'Inter', sans-serif; color: #414146; text-decoration: none; border-radius: 8px; padding: 24px 12px; border: 1px solid #EDEDF0; display: inline-block; font-weight: bold; ">{{otp}}</p>
+            <p style="font-size: 24px; text-indent: 18px; letter-spacing: 18px; font-family: 'Inter', sans-serif; color: #414146; text-decoration: none; border-radius: 8px; margin-top: 0px; margin-bottom: 0px; padding: 24px 12px; border: 1px solid #EDEDF0; display: inline-block; font-weight: bold;">{{otp}}</p>
         </td>
     </tr>
 </table>

app/config/locale/templates/email-otp.tpl

@@ -5,7 +5,7 @@
 <table border="0" cellspacing="0" cellpadding="0" style="padding-top: 10px; padding-bottom: 10px; display: inline-block;">
     <tr>
         <td align="center" style="border-radius: 8px; background-color: #ffffff;">
-            <p style="font-size: 24px; text-indent: 18px; letter-spacing: 18px; font-family: Inter; color: #414146; text-decoration: none; border-radius: 8px; padding: 24px 12px; border: 1px solid #EDEDF0; display: inline-block; font-weight: bold; ">{{otp}}</p>
+            <p style="font-size: 24px; text-indent: 18px; letter-spacing: 18px; font-family: 'Inter', sans-serif; color: #414146; text-decoration: none; border-radius: 8px; margin-top: 0px; margin-bottom: 0px; padding: 24px 12px; border: 1px solid #EDEDF0; display: inline-block; font-weight: bold; ">{{otp}}</p>
         </td>
     </tr>
 </table>
@@ -15,6 +15,4 @@
 <p style="margin-bottom: 0px;">{{thanks}}</p>
 <p style="margin-top: 0px;">{{signature}}</p>
 
-<hr style="margin-block-start: 1rem; margin-block-end: 1rem;">
-
-<p style="opacity: 0.7;">{{securityPhrase}}</p>
+<p class="security-phrase">{{securityPhrase}}</p>

app/config/locale/translations/en.json

@@ -3,8 +3,9 @@
     "settings.locale": "en",
     "settings.direction": "ltr",
     "emails.sender": "{{project}} Team",
-    "emails.verification.subject": "Account Verification",
+    "emails.verification.subject": "Account Verification for {{project}}",
     "emails.verification.preview": "Verify your email to activate your {{project}} account.",
+    "emails.verification.heading": "Verify your email to start using {{project}}",
     "emails.verification.hello": "Hello {{user}},",
     "emails.verification.body": "Follow this link to verify your email address to your {{b}}{{project}}{{/b}} account.",
     "emails.verification.footer": "If you didn’t ask to verify this address, you can ignore this message.",
@@ -33,6 +34,7 @@
     "emails.sessionAlert.signature": "{{project}} team",
     "emails.otpSession.subject": "OTP for {{project}} Login",
     "emails.otpSession.preview": "Use OTP {{otp}} to sign in to {{project}}. Expires in 15 minutes.",
+    "emails.otpSession.heading": "Login with OTP to use {{project}}",
     "emails.otpSession.hello": "Hello {{user}},",
     "emails.otpSession.description": "Enter the following verification code when prompted to securely sign in to your {{b}}{{project}}{{/b}} account. This code will expire in 15 minutes.",
     "emails.otpSession.clientInfo": "This sign in was requested using {{b}}{{agentClient}}{{/b}} on {{b}}{{agentDevice}}{{/b}} {{b}}{{agentOs}}{{/b}}. If you didn't request the sign in, you can safely ignore this email.",
@@ -41,12 +43,13 @@
     "emails.otpSession.signature": "{{project}} team",
     "emails.mfaChallenge.subject": "Verification Code for {{project}}",
     "emails.mfaChallenge.preview": "Use code {{otp}} for two-step verification in {{project}}. Expires in 15 minutes.",
+    "emails.mfaChallenge.heading": "Complete two-step verification to use {{project}}",
     "emails.mfaChallenge.hello": "Hello {{user}},",
     "emails.mfaChallenge.description": "Enter the following code to confirm your two-step verification in {{b}}{{project}}{{/b}}. This code will expire in 15 minutes.",
     "emails.mfaChallenge.clientInfo": "This verification code was requested using {{b}}{{agentClient}}{{/b}} on {{b}}{{agentDevice}}{{/b}} {{b}}{{agentOs}}{{/b}}. If you didn't request the verification code, you can safely ignore this email.",
     "emails.mfaChallenge.thanks": "Thanks,",
     "emails.mfaChallenge.signature": "{{project}} team",
-    "emails.recovery.subject": "Password Reset",
+    "emails.recovery.subject": "Password Reset for {{project}}",
     "emails.recovery.preview": "Reset your {{project}} password using the link.",
     "emails.recovery.hello": "Hello {{user}},",
     "emails.recovery.body": "Follow this link to reset your {{b}}{{project}}{{/b}} password.",
@@ -54,6 +57,21 @@
     "emails.recovery.thanks": "Thanks,",
     "emails.recovery.buttonText": "Reset password",
     "emails.recovery.signature": "{{project}} team",
+    "emails.csvExport.success.subject": "Your CSV export is ready",
+    "emails.csvExport.success.preview": "Your data export has been completed successfully.",
+    "emails.csvExport.success.hello": "Hello {{user}},",
+    "emails.csvExport.success.body": "Your CSV export is ready to download. Click the button below to download your data export.",
+    "emails.csvExport.success.footer": "This download link will expire in 1 hour.",
+    "emails.csvExport.success.thanks": "Thanks,",
+    "emails.csvExport.success.buttonText": "Download CSV",
+    "emails.csvExport.success.signature": "Appwrite team",
+    "emails.csvExport.failure.subject": "Your CSV export failed - file too large",
+    "emails.csvExport.failure.preview": "Your data export failed because the file size exceeds your plan limit.",
+    "emails.csvExport.failure.hello": "Hello {{user}},",
+    "emails.csvExport.failure.body": "Your CSV export could not be completed because the export file size ({{size}}MB) exceeds your plan limit. Please consider upgrading your plan or exporting a smaller dataset.",
+    "emails.csvExport.failure.footer": "If you have any questions, please contact our support team.",
+    "emails.csvExport.failure.thanks": "Thanks,",
+    "emails.csvExport.failure.signature": "{{project}} team",
     "emails.invitation.subject": "Invitation to {{team}} Team at {{project}}",
     "emails.invitation.preview": "{{owner}} invited you to join {{team}} at {{project}}",
     "emails.invitation.hello": "Hello {{user}},",

app/config/oAuthProviders.php

@@ -462,4 +462,15 @@ return [
         'mock' => true,
         'class' => 'Appwrite\\Auth\\OAuth2\\Mock',
     ],
+    'mock-unverified' => [
+        'name' => 'MockUnverified',
+        'developers' => 'https://appwrite.io',
+        'icon' => 'icon-appwrite',
+        'enabled' => true,
+        'sandbox' => false,
+        'form' => false,
+        'beta' => false,
+        'mock' => true,
+        'class' => 'Appwrite\\Auth\\OAuth2\\MockUnverified',
+    ],
 ];

app/config/platform.php

@@ -0,0 +1,26 @@
+<?php
+
+use Utopia\System\System;
+
+/**
+ * Platform configuration
+ */
+return [
+    'apiHostname' => System::getEnv('_APP_DOMAIN', 'localhost'),
+    'consoleHostname' => System::getEnv('_APP_CONSOLE_DOMAIN', System::getEnv('_APP_DOMAIN', 'localhost')),
+    'hostnames' => array_filter(array_unique([
+        System::getEnv('_APP_DOMAIN', 'localhost'),
+        System::getEnv('_APP_CONSOLE_DOMAIN', 'localhost'),
+    ])),
+    'platformName' => APP_EMAIL_PLATFORM_NAME,
+    'logoUrl' => APP_EMAIL_LOGO_URL,
+    'accentColor' => APP_EMAIL_ACCENT_COLOR,
+    'footerImageUrl' => APP_EMAIL_FOOTER_IMAGE_URL,
+    'twitterUrl' => APP_SOCIAL_TWITTER,
+    'discordUrl' => APP_SOCIAL_DISCORD,
+    'githubUrl' => APP_SOCIAL_GITHUB,
+    'termsUrl' => APP_EMAIL_TERMS_URL,
+    'privacyUrl' => APP_EMAIL_PRIVACY_URL,
+    'websiteUrl' => 'https://' . APP_DOMAIN,
+    'emailSenderName' => APP_EMAIL_PLATFORM_NAME,
+];

app/config/roles.php

@@ -1,6 +1,6 @@
 <?php
 
-use Appwrite\Auth\Auth;
+use Appwrite\Utopia\Database\Documents\User;
 
 $member = [
     'global',
@@ -28,7 +28,7 @@ $member = [
     'subscribers.write',
     'subscribers.read',
     'assistant.read',
-    'rules.read'
+    'rules.read',
 ];
 
 $admins = [
@@ -58,6 +58,8 @@ $admins = [
     'projects.write',
     'keys.read',
     'keys.write',
+    'devKeys.read',
+    'devKeys.write',
     'webhooks.read',
     'webhooks.write',
     'locale.read',
@@ -92,7 +94,7 @@ $admins = [
 ];
 
 return [
-    Auth::USER_ROLE_GUESTS => [
+    User::ROLE_GUESTS => [
         'label' => 'Guests',
         'scopes' => [
             'global',
@@ -112,23 +114,23 @@ return [
             'execution.write',
         ],
     ],
-    Auth::USER_ROLE_USERS => [
+    User::ROLE_USERS => [
         'label' => 'Users',
         'scopes' => \array_merge($member),
     ],
-    Auth::USER_ROLE_ADMIN => [
+    User::ROLE_ADMIN => [
         'label' => 'Admin',
         'scopes' => \array_merge($admins),
     ],
-    Auth::USER_ROLE_DEVELOPER => [
+    User::ROLE_DEVELOPER => [
         'label' => 'Developer',
         'scopes' => \array_merge($admins),
     ],
-    Auth::USER_ROLE_OWNER => [
+    User::ROLE_OWNER => [
         'label' => 'Owner',
         'scopes' => \array_merge($member, $admins),
     ],
-    Auth::USER_ROLE_APPS => [
+    User::ROLE_APPS => [
         'label' => 'Applications',
         'scopes' => ['global', 'health.read', 'graphql'],
     ],

app/config/scopes.php

@@ -47,10 +47,10 @@ return [ // List of publicly visible scopes
         'description' => 'Access to create, update, and delete your project\'s database table\'s columns',
     ],
     'indexes.read' => [
-        'description' => 'Access to read your project\'s database collection\'s indexes',
+        'description' => 'Access to read your project\'s database table\'s indexes',
     ],
     'indexes.write' => [
-        'description' => 'Access to create, update, and delete your project\'s database collection\'s indexes',
+        'description' => 'Access to create, update, and delete your project\'s database table\'s indexes',
     ],
     'documents.read'  => [
         'description' => 'Access to read your project\'s database documents',

app/config/sdks.php

@@ -1,8 +1,8 @@
 <?php
 
 return [
-    APP_PLATFORM_CLIENT => [
-        'key' => APP_PLATFORM_CLIENT,
+    APP_SDK_PLATFORM_CLIENT => [
+        'key' => APP_SDK_PLATFORM_CLIENT,
         'name' => 'Client',
         'description' => 'Client libraries for integrating with Appwrite to build client-based applications and websites. Read the [getting started for web](https://appwrite.io/docs/getting-started-for-web) or [getting started for Flutter](https://appwrite.io/docs/getting-started-for-flutter) tutorials to start building your first application.',
         'enabled' => true,
@@ -11,14 +11,14 @@ return [
             [
                 'key' => 'web',
                 'name' => 'Web',
-                'version' => '20.1.0',
+                'version' => '21.5.0',
                 'url' => 'https://github.com/appwrite/sdk-for-web',
                 'package' => 'https://www.npmjs.com/package/appwrite',
                 'enabled' => true,
                 'beta' => false,
                 'dev' => false,
                 'hidden' => false,
-                'family' => APP_PLATFORM_CLIENT,
+                'family' => APP_SDK_PLATFORM_CLIENT,
                 'prism' => 'javascript',
                 'source' => \realpath(__DIR__ . '/../sdks/client-web'),
                 'gitUrl' => 'git@github.com:appwrite/sdk-for-web.git',
@@ -60,14 +60,14 @@ return [
             [
                 'key' => 'flutter',
                 'name' => 'Flutter',
-                'version' => '19.1.0',
+                'version' => '20.3.2',
                 'url' => 'https://github.com/appwrite/sdk-for-flutter',
                 'package' => 'https://pub.dev/packages/appwrite',
                 'enabled' => true,
                 'beta' => false,
                 'dev' => false,
                 'hidden' => false,
-                'family' => APP_PLATFORM_CLIENT,
+                'family' => APP_SDK_PLATFORM_CLIENT,
                 'prism' => 'dart',
                 'source' => \realpath(__DIR__ . '/../sdks/client-flutter'),
                 'gitUrl' => 'git@github.com:appwrite/sdk-for-flutter.git',
@@ -79,14 +79,14 @@ return [
             [
                 'key' => 'apple',
                 'name' => 'Apple',
-                'version' => '12.1.0',
+                'version' => '13.5.0',
                 'url' => 'https://github.com/appwrite/sdk-for-apple',
                 'package' => 'https://github.com/appwrite/sdk-for-apple',
                 'enabled' => true,
                 'beta' => false,
                 'dev' => false,
                 'hidden' => false,
-                'family' => APP_PLATFORM_CLIENT,
+                'family' => APP_SDK_PLATFORM_CLIENT,
                 'prism' => 'swift',
                 'source' => \realpath(__DIR__ . '/../sdks/client-apple'),
                 'gitUrl' => 'git@github.com:appwrite/sdk-for-apple.git',
@@ -104,7 +104,7 @@ return [
                 'beta' => false,
                 'dev' => false,
                 'hidden' => false,
-                'family' => APP_PLATFORM_CLIENT,
+                'family' => APP_SDK_PLATFORM_CLIENT,
                 'prism' => '',
                 'source' => false,
                 'gitUrl' => 'git@github.com:appwrite/sdk-for-objective-c.git',
@@ -116,14 +116,14 @@ return [
             [
                 'key' => 'android',
                 'name' => 'Android',
-                'version' => '10.1.0',
+                'version' => '11.4.0',
                 'url' => 'https://github.com/appwrite/sdk-for-android',
                 'package' => 'https://search.maven.org/artifact/io.appwrite/sdk-for-android',
                 'enabled' => true,
                 'beta' => false,
                 'dev' => false,
                 'hidden' => false,
-                'family' => APP_PLATFORM_CLIENT,
+                'family' => APP_SDK_PLATFORM_CLIENT,
                 'prism' => 'kotlin',
                 'source' => \realpath(__DIR__ . '/../sdks/client-android'),
                 'gitUrl' => 'git@github.com:appwrite/sdk-for-android.git',
@@ -139,14 +139,14 @@ return [
             [
                 'key' => 'react-native',
                 'name' => 'React Native',
-                'version' => '0.14.0',
+                'version' => '0.19.0',
                 'url' => 'https://github.com/appwrite/sdk-for-react-native',
                 'package' => 'https://npmjs.com/package/react-native-appwrite',
                 'enabled' => true,
                 'beta' => true,
                 'dev' => false,
                 'hidden' => false,
-                'family' => APP_PLATFORM_CLIENT,
+                'family' => APP_SDK_PLATFORM_CLIENT,
                 'prism' => 'javascript',
                 'source' => \realpath(__DIR__ . '/../sdks/client-react-native'),
                 'gitUrl' => 'git@github.com:appwrite/sdk-for-react-native.git',
@@ -165,7 +165,7 @@ return [
                 'beta' => false,
                 'dev' => false,
                 'hidden' => true,
-                'family' => APP_PLATFORM_CLIENT,
+                'family' => APP_SDK_PLATFORM_CLIENT,
                 'prism' => 'graphql',
                 'source' => \realpath(__DIR__ . '/../sdks/client-graphql'),
                 'gitUrl' => '',
@@ -185,7 +185,7 @@ return [
                 'beta' => false,
                 'dev' => false,
                 'hidden' => true,
-                'family' => APP_PLATFORM_CLIENT,
+                'family' => APP_SDK_PLATFORM_CLIENT,
                 'prism' => 'http',
                 'source' => \realpath(__DIR__ . '/../sdks/client-rest'),
                 'gitUrl' => '',
@@ -198,8 +198,8 @@ return [
         ],
     ],
 
-    APP_PLATFORM_CONSOLE => [
-        'key' => APP_PLATFORM_CONSOLE,
+    APP_SDK_PLATFORM_CONSOLE => [
+        'key' => APP_SDK_PLATFORM_CONSOLE,
         'name' => 'Console',
         'enabled' => false,
         'beta' => false,
@@ -207,14 +207,14 @@ return [
             [
                 'key' => 'web',
                 'name' => 'Console',
-                'version' => '0.1.0',
+                'version' => '0.2.0',
                 'url' => '',
                 'package' => '',
                 'enabled' => true,
                 'beta' => false,
                 'dev' => false,
                 'hidden' => true,
-                'family' => APP_PLATFORM_CONSOLE,
+                'family' => APP_SDK_PLATFORM_CONSOLE,
                 'prism' => 'javascript',
                 'source' => \realpath(__DIR__ . '/../sdks/console-web'),
                 'gitUrl' => '',
@@ -226,14 +226,14 @@ return [
             [
                 'key' => 'cli',
                 'name' => 'Command Line',
-                'version' => '10.0.0',
+                'version' => '12.0.1',
                 'url' => 'https://github.com/appwrite/sdk-for-cli',
                 'package' => 'https://www.npmjs.com/package/appwrite-cli',
                 'enabled' => true,
                 'beta' => true,
                 'dev' => false,
                 'hidden' => false,
-                'family' => APP_PLATFORM_CONSOLE,
+                'family' => APP_SDK_PLATFORM_CONSOLE,
                 'prism' => 'bash',
                 'source' => \realpath(__DIR__ . '/../sdks/console-cli'),
                 'gitUrl' => 'git@github.com:appwrite/sdk-for-cli.git',
@@ -252,8 +252,8 @@ return [
         ],
     ],
 
-    APP_PLATFORM_SERVER => [
-        'key' => APP_PLATFORM_SERVER,
+    APP_SDK_PLATFORM_SERVER => [
+        'key' => APP_SDK_PLATFORM_SERVER,
         'name' => 'Server',
         'description' => 'Libraries for integrating with Appwrite to build server side integrations. Read the [getting started for server](https://appwrite.io/docs/getting-started-for-server) tutorial to start building your first server integration.',
         'enabled' => true,
@@ -262,14 +262,14 @@ return [
             [
                 'key' => 'nodejs',
                 'name' => 'Node.js',
-                'version' => '19.1.0',
+                'version' => '21.1.0',
                 'url' => 'https://github.com/appwrite/sdk-for-node',
                 'package' => 'https://www.npmjs.com/package/node-appwrite',
                 'enabled' => true,
                 'beta' => false,
                 'dev' => false,
                 'hidden' => false,
-                'family' => APP_PLATFORM_SERVER,
+                'family' => APP_SDK_PLATFORM_SERVER,
                 'prism' => 'javascript',
                 'source' => \realpath(__DIR__ . '/../sdks/server-nodejs'),
                 'gitUrl' => 'git@github.com:appwrite/sdk-for-node.git',
@@ -281,14 +281,14 @@ return [
             [
                 'key' => 'php',
                 'name' => 'PHP',
-                'version' => '17.1.0',
+                'version' => '19.1.0',
                 'url' => 'https://github.com/appwrite/sdk-for-php',
                 'package' => 'https://packagist.org/packages/appwrite/appwrite',
                 'enabled' => true,
                 'beta' => false,
                 'dev' => false,
                 'hidden' => false,
-                'family' => APP_PLATFORM_SERVER,
+                'family' => APP_SDK_PLATFORM_SERVER,
                 'prism' => 'php',
                 'source' => \realpath(__DIR__ . '/../sdks/server-php'),
                 'gitUrl' => 'git@github.com:appwrite/sdk-for-php.git',
@@ -300,14 +300,14 @@ return [
             [
                 'key' => 'python',
                 'name' => 'Python',
-                'version' => '13.1.0',
+                'version' => '14.1.0',
                 'url' => 'https://github.com/appwrite/sdk-for-python',
                 'package' => 'https://pypi.org/project/appwrite/',
                 'enabled' => true,
                 'beta' => false,
                 'dev' => false,
                 'hidden' => false,
-                'family' => APP_PLATFORM_SERVER,
+                'family' => APP_SDK_PLATFORM_SERVER,
                 'prism' => 'python',
                 'source' => \realpath(__DIR__ . '/../sdks/server-python'),
                 'gitUrl' => 'git@github.com:appwrite/sdk-for-python.git',
@@ -319,14 +319,14 @@ return [
             [
                 'key' => 'ruby',
                 'name' => 'Ruby',
-                'version' => '18.1.0',
+                'version' => '20.1.0',
                 'url' => 'https://github.com/appwrite/sdk-for-ruby',
                 'package' => 'https://rubygems.org/gems/appwrite',
                 'enabled' => true,
                 'beta' => false,
                 'dev' => false,
                 'hidden' => false,
-                'family' => APP_PLATFORM_SERVER,
+                'family' => APP_SDK_PLATFORM_SERVER,
                 'prism' => 'ruby',
                 'source' => \realpath(__DIR__ . '/../sdks/server-ruby'),
                 'gitUrl' => 'git@github.com:appwrite/sdk-for-ruby.git',
@@ -338,14 +338,14 @@ return [
             [
                 'key' => 'go',
                 'name' => 'Go',
-                'version' => '0.12.0',
+                'version' => 'v0.16.0',
                 'url' => 'https://github.com/appwrite/sdk-for-go',
                 'package' => 'https://github.com/appwrite/sdk-for-go',
                 'enabled' => true,
                 'beta' => true,
                 'dev' => false,
                 'hidden' => false,
-                'family' => APP_PLATFORM_SERVER,
+                'family' => APP_SDK_PLATFORM_SERVER,
                 'prism' => 'go',
                 'source' => \realpath(__DIR__ . '/../sdks/server-go'),
                 'gitUrl' => 'git@github.com:appwrite/sdk-for-go.git',
@@ -357,14 +357,14 @@ return [
             [
                 'key' => 'dotnet',
                 'name' => '.NET',
-                'version' => '0.18.0',
+                'version' => '0.24.0',
                 'url' => 'https://github.com/appwrite/sdk-for-dotnet',
                 'package' => 'https://www.nuget.org/packages/Appwrite',
                 'enabled' => true,
                 'beta' => true,
                 'dev' => false,
                 'hidden' => false,
-                'family' => APP_PLATFORM_SERVER,
+                'family' => APP_SDK_PLATFORM_SERVER,
                 'prism' => 'csharp',
                 'source' => \realpath(__DIR__ . '/../sdks/server-dotnet'),
                 'gitUrl' => 'git@github.com:appwrite/sdk-for-dotnet.git',
@@ -376,14 +376,14 @@ return [
             [
                 'key' => 'dart',
                 'name' => 'Dart',
-                'version' => '18.1.0',
+                'version' => '20.1.0',
                 'url' => 'https://github.com/appwrite/sdk-for-dart',
                 'package' => 'https://pub.dev/packages/dart_appwrite',
                 'enabled' => true,
                 'beta' => false,
                 'dev' => false,
                 'hidden' => false,
-                'family' => APP_PLATFORM_SERVER,
+                'family' => APP_SDK_PLATFORM_SERVER,
                 'prism' => 'dart',
                 'source' => \realpath(__DIR__ . '/../sdks/server-dart'),
                 'gitUrl' => 'git@github.com:appwrite/sdk-for-dart.git',
@@ -395,14 +395,14 @@ return [
             [
                 'key' => 'kotlin',
                 'name' => 'Kotlin',
-                'version' => '11.1.0',
+                'version' => '13.1.0',
                 'url' => 'https://github.com/appwrite/sdk-for-kotlin',
                 'package' => 'https://search.maven.org/artifact/io.appwrite/sdk-for-kotlin',
                 'enabled' => true,
                 'beta' => false,
                 'dev' => false,
                 'hidden' => false,
-                'family' => APP_PLATFORM_SERVER,
+                'family' => APP_SDK_PLATFORM_SERVER,
                 'prism' => 'kotlin',
                 'source' => \realpath(__DIR__ . '/../sdks/server-kotlin'),
                 'gitUrl' => 'git@github.com:appwrite/sdk-for-kotlin.git',
@@ -418,14 +418,14 @@ return [
             [
                 'key' => 'swift',
                 'name' => 'Swift',
-                'version' => '12.1.0',
+                'version' => '14.1.0',
                 'url' => 'https://github.com/appwrite/sdk-for-swift',
                 'package' => 'https://github.com/appwrite/sdk-for-swift',
                 'enabled' => true,
                 'beta' => false,
                 'dev' => false,
                 'hidden' => false,
-                'family' => APP_PLATFORM_SERVER,
+                'family' => APP_SDK_PLATFORM_SERVER,
                 'prism' => 'swift',
                 'source' => \realpath(__DIR__ . '/../sdks/server-swift'),
                 'gitUrl' => 'git@github.com:appwrite/sdk-for-swift.git',
@@ -444,7 +444,7 @@ return [
                 'beta' => false,
                 'dev' => false,
                 'hidden' => true,
-                'family' => APP_PLATFORM_SERVER,
+                'family' => APP_SDK_PLATFORM_SERVER,
                 'prism' => 'graphql',
                 'source' => \realpath(__DIR__ . '/../sdks/server-graphql'),
                 'gitUrl' => '',
@@ -464,7 +464,7 @@ return [
                 'beta' => false,
                 'dev' => false,
                 'hidden' => true,
-                'family' => APP_PLATFORM_SERVER,
+                'family' => APP_SDK_PLATFORM_SERVER,
                 'prism' => 'http',
                 'source' => \realpath(__DIR__ . '/../sdks/server-rest'),
                 'gitUrl' => '',

app/config/services.php

@@ -13,6 +13,7 @@ return [
         'tests' => false,
         'optional' => false,
         'icon' => '',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'web/console' => [
         'key' => 'web/console',
@@ -26,6 +27,7 @@ return [
         'tests' => false,
         'optional' => false,
         'icon' => '',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'account' => [
         'key' => 'account',
@@ -39,6 +41,7 @@ return [
         'tests' => false,
         'optional' => true,
         'icon' => '/images/services/account.png',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'avatars' => [
         'key' => 'avatars',
@@ -52,6 +55,7 @@ return [
         'tests' => false,
         'optional' => true,
         'icon' => '/images/services/avatars.png',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'databases' => [
         'key' => 'databases',
@@ -65,6 +69,7 @@ return [
         'tests' => false,
         'optional' => true,
         'icon' => '/images/services/databases.png',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'tablesdb' => [
         'key' => 'tablesdb',
@@ -78,6 +83,7 @@ return [
         'tests' => false,
         'optional' => true,
         'icon' => '/images/services/databases.png',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'locale' => [
         'key' => 'locale',
@@ -91,6 +97,7 @@ return [
         'tests' => false,
         'optional' => true,
         'icon' => '/images/services/locale.png',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'health' => [
         'key' => 'health',
@@ -104,6 +111,7 @@ return [
         'tests' => false,
         'optional' => true,
         'icon' => '/images/services/health.png',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'projects' => [
         'key' => 'projects',
@@ -117,6 +125,7 @@ return [
         'tests' => false,
         'optional' => false,
         'icon' => '',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'project' => [
         'key' => 'project',
@@ -130,6 +139,7 @@ return [
         'tests' => false,
         'optional' => false,
         'icon' => '',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'storage' => [
         'key' => 'storage',
@@ -143,6 +153,7 @@ return [
         'tests' => false,
         'optional' => true,
         'icon' => '/images/services/storage.png',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'teams' => [
         'key' => 'teams',
@@ -156,6 +167,7 @@ return [
         'tests' => false,
         'optional' => true,
         'icon' => '/images/services/teams.png',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'users' => [
         'key' => 'users',
@@ -169,6 +181,7 @@ return [
         'tests' => false,
         'optional' => true,
         'icon' => '/images/services/users.png',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'vcs' => [
         'key' => 'vcs',
@@ -182,6 +195,7 @@ return [
         'tests' => false,
         'optional' => false,
         'icon' => '',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'sites' => [
         'key' => 'sites',
@@ -195,6 +209,7 @@ return [
         'tests' => false,
         'optional' => true,
         'icon' => '/images/services/sites.png',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'functions' => [
         'key' => 'functions',
@@ -208,6 +223,7 @@ return [
         'tests' => false,
         'optional' => true,
         'icon' => '/images/services/functions.png',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'proxy' => [
         'key' => 'proxy',
@@ -221,6 +237,7 @@ return [
         'tests' => false,
         'optional' => false,
         'icon' => '/images/services/proxy.png',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'mock' => [
         'key' => 'mock',
@@ -234,6 +251,7 @@ return [
         'tests' => true,
         'optional' => false,
         'icon' => '',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'graphql' => [
         'key' => 'graphql',
@@ -247,6 +265,7 @@ return [
         'tests' => true,
         'optional' => true,
         'icon' => '/images/services/graphql.png',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'console' => [
         'key' => 'console',
@@ -260,6 +279,7 @@ return [
         'tests' => false,
         'optional' => false,
         'icon' => '',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'migrations' => [
         'key' => 'migrations',
@@ -273,6 +293,7 @@ return [
         'tests' => true,
         'optional' => false,
         'icon' => '/images/services/migrations.png',
+        'platforms' => ['client', 'server', 'console'],
     ],
     'messaging' => [
         'key' => 'messaging',
@@ -286,5 +307,6 @@ return [
         'tests' => true,
         'optional' => true,
         'icon' => '/images/services/messaging.png',
+        'platforms' => ['client', 'server', 'console'],
     ]
 ];

app/config/storage/resource_limits.php

@@ -3,4 +3,6 @@
 use Utopia\Image\Image;
 use Utopia\System\System;
 
-Image::setResourceLimit('memory', intval(System::getEnv('_APP_IMAGES_RESOURCE_LIMIT_MEMORY', 1024*1024*64)));
+if (\class_exists('Imagick')) {
+    Image::setResourceLimit('memory', intval(System::getEnv('_APP_IMAGES_RESOURCE_LIMIT_MEMORY', 1024*1024*64)));
+}

app/config/template-runtimes.php

@@ -1,43 +1,12 @@
 <?php
 
-// TODO: Remove, replace with runtimes.php directly
-// Used in function templates and site frameworks
+use Utopia\Config\Config;
 
-return [
-    'NODE' => [
-        'name' => 'node',
-        'versions' => ['22', '21.0', '20.0', '19.0', '18.0', '16.0', '14.5']
-    ],
-    'PYTHON' => [
-        'name' => 'python',
-        'versions' => ['3.12', '3.11', '3.10', '3.9', '3.8']
-    ],
-    'DART' => [
-        'name' => 'dart',
-        'versions' => ['3.8', '3.5', '3.3', '3.1', '3.0', '2.19', '2.18', '2.17', '2.16']
-    ],
-    'GO' => [
-        'name' => 'go',
-        'versions' => ['1.23']
-    ],
-    'PHP' => [
-        'name' => 'php',
-        'versions' => ['8.3', '8.2', '8.1', '8.0']
-    ],
-    'DENO' => [
-        'name' => 'deno',
-        'versions' => ['2.0', '1.46', '1.40', '1.35', '1.24', '1.21']
-    ],
-    'BUN' => [
-        'name' => 'bun',
-        'versions' => ['1.1', '1.0']
-    ],
-    'RUBY' => [
-        'name' => 'ruby',
-        'versions' => ['3.3', '3.2', '3.1', '3.0']
-    ],
-    'FLUTTER' => [
-        'name' => 'flutter',
-        'versions' => ['3.32', '3.24']
-    ],
-];
+$runtimes = Config::getParam('runtimes');
+
+$mappedRuntimes = \array_reduce($runtimes, function ($acc, $runtime) {
+    $acc[strtoupper($runtime['key'])][] = $runtime['key'] . '-' . $runtime['version'];
+    return $acc;
+}, []);
+
+return $mappedRuntimes;

app/config/templates/function.php

@@ -1,20 +1,22 @@
 <?php
 
 use Utopia\Config\Config;
+use Utopia\System\System;
 
 $templateRuntimes = Config::getParam('template-runtimes');
+$allowList = \array_map('trim', \explode(',', System::getEnv('_APP_FUNCTIONS_RUNTIMES', '')));
 
-function getRuntimes($runtime, $commands, $entrypoint, $providerRootDirectory, $versionsDenyList = [])
+function getRuntimes($runtimes, $commands, $entrypoint, $providerRootDirectory, $allowList)
 {
-    return array_map(function ($version) use ($runtime, $commands, $entrypoint, $providerRootDirectory) {
+    return array_map(function ($runtime) use ($commands, $entrypoint, $providerRootDirectory) {
         return [
-            'name' => $runtime['name'] . '-' . $version,
+            'name' => $runtime,
             'commands' => $commands,
             'entrypoint' => $entrypoint,
             'providerRootDirectory' => $providerRootDirectory
         ];
-    }, array_filter($runtime['versions'], function ($version) use ($versionsDenyList) {
-        return !in_array($version, $versionsDenyList);
+    }, array_filter($runtimes, function ($runtime) use ($allowList) {
+        return in_array($runtime, $allowList);
     }));
 }
 
@@ -32,24 +34,26 @@ return [
         'timeout' => 15,
         'useCases' => ['starter'],
         'runtimes' => [
-            ...getRuntimes($templateRuntimes['NODE'], 'npm install', 'src/main.js', 'node/starter'),
+            ...getRuntimes($templateRuntimes['NODE'], 'npm install', 'src/main.js', 'node/starter', $allowList),
             ...getRuntimes(
                 $templateRuntimes['PYTHON'],
                 'pip install -r requirements.txt',
                 'src/main.py',
-                'python/starter'
+                'python/starter',
+                $allowList
             ),
-            ...getRuntimes($templateRuntimes['DART'], 'dart pub get', 'lib/main.dart', 'dart/starter'),
-            ...getRuntimes($templateRuntimes['GO'], '', 'main.go', 'go/starter'),
+            ...getRuntimes($templateRuntimes['DART'], 'dart pub get', 'lib/main.dart', 'dart/starter', $allowList),
+            ...getRuntimes($templateRuntimes['GO'], '', 'main.go', 'go/starter', $allowList),
             ...getRuntimes(
                 $templateRuntimes['PHP'],
                 'composer install',
                 'src/index.php',
-                'php/starter'
+                'php/starter',
+                $allowList
             ),
-            ...getRuntimes($templateRuntimes['DENO'], 'deno cache src/main.ts', 'src/main.ts', 'deno/starter'),
-            ...getRuntimes($templateRuntimes['BUN'], 'bun install', 'src/main.ts', 'bun/starter'),
-            ...getRuntimes($templateRuntimes['RUBY'], 'bundle install', 'lib/main.rb', 'ruby/starter'),
+            ...getRuntimes($templateRuntimes['DENO'], 'deno cache src/main.ts', 'src/main.ts', 'deno/starter', $allowList),
+            ...getRuntimes($templateRuntimes['BUN'], 'bun install', 'src/main.ts', 'bun/starter', $allowList),
+            ...getRuntimes($templateRuntimes['RUBY'], 'bundle install', 'lib/main.rb', 'ruby/starter', $allowList),
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/starter">file</a>.',
         'vcsProvider' => 'github',
@@ -75,7 +79,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/query-upstash-vector'
+                'node/query-upstash-vector',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/query-upstash-vector">file</a>.',
@@ -120,7 +125,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/query-redis-labs'
+                'node/query-redis-labs',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/query-redis-labs">file</a>.',
@@ -164,7 +170,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/query-neo4j-auradb'
+                'node/query-neo4j-auradb',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/query-neo4j-auradb">file</a>.',
@@ -217,7 +224,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/query-mongo-atlas'
+                'node/query-mongo-atlas',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/query-mongo-atlas">file</a>.',
@@ -255,7 +263,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/query-neon-postgres'
+                'node/query-neon-postgres',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/query-neon-postgres">file</a>.',
@@ -323,25 +332,29 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/prompt-chatgpt'
+                'node/prompt-chatgpt',
+                $allowList
             ),
             ...getRuntimes(
                 $templateRuntimes['PYTHON'],
                 'pip install -r requirements.txt',
                 'src/main.py',
-                'python/prompt_chatgpt'
+                'python/prompt_chatgpt',
+                $allowList
             ),
             ...getRuntimes(
                 $templateRuntimes['PHP'],
                 'composer install',
                 'src/index.php',
-                'php/prompt-chatgpt'
+                'php/prompt-chatgpt',
+                $allowList
             ),
             ...getRuntimes(
                 $templateRuntimes['DART'],
                 'dart pub get',
                 'lib/main.dart',
-                'dart/prompt_chatgpt'
+                'dart/prompt_chatgpt',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/prompt-chatgpt">file</a>.',
@@ -385,19 +398,22 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install && npm run setup',
                 'src/main.js',
-                'node/discord-command-bot'
+                'node/discord-command-bot',
+                $allowList
             ),
             ...getRuntimes(
                 $templateRuntimes['PYTHON'],
                 'pip install -r requirements.txt && python src/setup.py',
                 'src/main.py',
-                'python/discord_command_bot'
+                'python/discord_command_bot',
+                $allowList
             ),
             ...getRuntimes(
                 $templateRuntimes['GO'],
                 '',
                 'main.go',
-                'go/discord-command-bot'
+                'go/discord-command-bot',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/discord-command-bot">file</a>.',
@@ -449,7 +465,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/analyze-with-perspectiveapi'
+                'node/analyze-with-perspectiveapi',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/analyze-with-perspectiveapi">file</a>.',
@@ -486,19 +503,22 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/censor-with-redact'
+                'node/censor-with-redact',
+                $allowList
             ),
             ...getRuntimes(
                 $templateRuntimes['PYTHON'],
                 'pip install -r requirements.txt',
                 'src/main.py',
-                'python/censor_with_redact'
+                'python/censor_with_redact',
+                $allowList
             ),
             ...getRuntimes(
                 $templateRuntimes['DART'],
                 'dart pub get',
                 'lib/main.dart',
-                'dart/censor_with_redact'
+                'dart/censor_with_redact',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/censor-with-redact">file</a>.',
@@ -530,7 +550,7 @@ return [
         'timeout' => 15,
         'useCases' => ['utilities'],
         'runtimes' => [
-            ...getRuntimes($templateRuntimes['NODE'], 'npm install', 'src/main.js', 'node/generate-pdf')
+            ...getRuntimes($templateRuntimes['NODE'], 'npm install', 'src/main.js', 'node/generate-pdf', $allowList)
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/generate-pdf">file</a>.',
         'vcsProvider' => 'github',
@@ -557,7 +577,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/github-issue-bot'
+                'node/github-issue-bot',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/github-issue-bot">file</a>.',
@@ -601,7 +622,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/url-shortener'
+                'node/url-shortener',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/url-shortener">file</a>.',
@@ -653,19 +675,22 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/sync-with-algolia'
+                'node/sync-with-algolia',
+                $allowList
             ),
             ...getRuntimes(
                 $templateRuntimes['PYTHON'],
                 'pip install -r requirements.txt',
                 'src/main.py',
-                'python/sync_with_algolia'
+                'python/sync_with_algolia',
+                $allowList
             ),
             ...getRuntimes(
                 $templateRuntimes['PHP'],
                 'composer install',
                 'src/index.php',
-                'php/sync-with-algolia'
+                'php/sync-with-algolia',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/sync-with-algolia">file</a>.',
@@ -735,31 +760,36 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/sync-with-meilisearch'
+                'node/sync-with-meilisearch',
+                $allowList
             ),
             ...getRuntimes(
                 $templateRuntimes['PYTHON'],
                 'pip install -r requirements.txt',
                 'src/main.py',
-                'python/sync-with-meilisearch'
+                'python/sync-with-meilisearch',
+                $allowList
             ),
             ...getRuntimes(
                 $templateRuntimes['PHP'],
                 'composer install',
                 'src/index.php',
-                'php/sync-with-meilisearch'
+                'php/sync-with-meilisearch',
+                $allowList
             ),
             ...getRuntimes(
                 $templateRuntimes['BUN'],
                 'bun install',
                 'src/main.ts',
-                'bun/sync-with-meilisearch'
+                'bun/sync-with-meilisearch',
+                $allowList
             ),
             ...getRuntimes(
                 $templateRuntimes['RUBY'],
                 'bundle install',
                 'lib/main.rb',
-                'ruby/sync-with-meilisearch'
+                'ruby/sync-with-meilisearch',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/sync-with-meilisearch">file</a>.',
@@ -829,37 +859,43 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/whatsapp-with-vonage'
+                'node/whatsapp-with-vonage',
+                $allowList
             ),
             ...getRuntimes(
                 $templateRuntimes['PYTHON'],
                 'pip install -r requirements.txt',
                 'src/main.py',
-                'python/whatsapp_with_vonage'
+                'python/whatsapp_with_vonage',
+                $allowList
             ),
             ...getRuntimes(
                 $templateRuntimes['DART'],
                 'dart pub get',
                 'lib/main.dart',
-                'dart/whatsapp-with-vonage'
+                'dart/whatsapp-with-vonage',
+                $allowList
             ),
             ...getRuntimes(
                 $templateRuntimes['PHP'],
                 'composer install',
                 'src/index.php',
-                'php/whatsapp-with-vonage'
+                'php/whatsapp-with-vonage',
+                $allowList
             ),
             ...getRuntimes(
                 $templateRuntimes['BUN'],
                 'bun install',
                 'src/main.ts',
-                'bun/whatsapp-with-vonage'
+                'bun/whatsapp-with-vonage',
+                $allowList
             ),
             ...getRuntimes(
                 $templateRuntimes['RUBY'],
                 'bundle install',
                 'lib/main.rb',
-                'ruby/whatsapp-with-vonage'
+                'ruby/whatsapp-with-vonage',
+                $allowList
             ),
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/whatsapp-with-vonage">file</a>.',
@@ -916,7 +952,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/push-notification-with-fcm'
+                'node/push-notification-with-fcm',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/push-notification-with-fcm">file</a>.',
@@ -973,19 +1010,22 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/email-contact-form'
+                'node/email-contact-form',
+                $allowList
             ),
             ...getRuntimes(
                 $templateRuntimes['PYTHON'],
                 'pip install -r requirements.txt',
                 'src/main.py',
-                'python/email_contact_form'
+                'python/email_contact_form',
+                $allowList
             ),
             ...getRuntimes(
                 $templateRuntimes['PHP'],
                 'composer install',
                 'src/index.php',
-                'php/email-contact-form'
+                'php/email-contact-form',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/email-contact-form">file</a>.',
@@ -1057,7 +1097,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/subscriptions-with-stripe'
+                'node/subscriptions-with-stripe',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/subscriptions-with-stripe">file</a>.',
@@ -1099,7 +1140,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/payments-with-stripe'
+                'node/payments-with-stripe',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/payments-with-stripe">file</a>.',
@@ -1157,7 +1199,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/text-generation-with-huggingface'
+                'node/text-generation-with-huggingface',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/text-generation-with-huggingface">file</a>.',
@@ -1192,7 +1235,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/language-translation-with-huggingface'
+                'node/language-translation-with-huggingface',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/language-translation-with-huggingface">file</a>.',
@@ -1227,7 +1271,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install && npm run setup',
                 'src/main.js',
-                'node/image-classification-with-huggingface'
+                'node/image-classification-with-huggingface',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/image-classification-with-huggingface">file</a>.',
@@ -1286,7 +1331,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install && npm run setup',
                 'src/main.js',
-                'node/object-detection-with-huggingface'
+                'node/object-detection-with-huggingface',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/object-detection-with-huggingface">file</a>.',
@@ -1345,7 +1391,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install && npm run setup',
                 'src/main.js',
-                'node/speech-recognition-with-huggingface'
+                'node/speech-recognition-with-huggingface',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/speech-recognition-with-huggingface">file</a>.',
@@ -1407,7 +1454,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install && npm run setup',
                 'src/main.js',
-                'node/text-to-speech-with-huggingface'
+                'node/text-to-speech-with-huggingface',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/text-to-speech-with-huggingface">file</a>.',
@@ -1466,7 +1514,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/generate-with-replicate'
+                'node/generate-with-replicate',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/generate-with-replicate">file</a>.',
@@ -1502,7 +1551,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/generate-with-together-ai'
+                'node/generate-with-together-ai',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/generate-with-together-ai">file</a>.',
@@ -1545,7 +1595,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/chat-with-perplexity-ai'
+                'node/chat-with-perplexity-ai',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/chat-with-perplexity-ai">file</a>.',
@@ -1587,7 +1638,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/generate-with-replicate'
+                'node/generate-with-replicate',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/generate-with-replicate">file</a>.',
@@ -1623,7 +1675,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/sync-with-pinecone'
+                'node/sync-with-pinecone',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/sync-with-pinecone">file</a>.',
@@ -1687,7 +1740,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/rag-with-langchain'
+                'node/rag-with-langchain',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/rag-with-langchain">file</a>.',
@@ -1751,7 +1805,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/speak-with-elevenlabs'
+                'node/speak-with-elevenlabs',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/speak-with-elevenlabs">file</a>.',
@@ -1807,7 +1862,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/speak-with-lmnt'
+                'node/speak-with-lmnt',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/speak-with-lmnt">file</a>.',
@@ -1849,7 +1905,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/chat-with-anyscale'
+                'node/chat-with-anyscale',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/chat-with-anyscale">file</a>.',
@@ -1891,7 +1948,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install && npm run setup',
                 'src/main.js',
-                'node/music-generation-with-huggingface'
+                'node/music-generation-with-huggingface',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/music-generation-with-huggingface">file</a>.',
@@ -1934,7 +1992,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/generate-with-fal-ai'
+                'node/generate-with-fal-ai',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/generate-with-fal-ai">file</a>.',
@@ -1970,7 +2029,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/subscriptions-with-lemon-squeezy'
+                'node/subscriptions-with-lemon-squeezy',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/subscriptions-with-lemon-squeezy">file</a>.',
@@ -2026,7 +2086,8 @@ return [
                 $templateRuntimes['NODE'],
                 'npm install',
                 'src/main.js',
-                'node/payments-with-lemon-squeezy'
+                'node/payments-with-lemon-squeezy',
+                $allowList
             )
         ],
         'instructions' => 'For documentation and instructions check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/node/payments-with-lemon-squeezy">file</a>.',
@@ -2094,7 +2155,7 @@ return [
         'timeout' => 15,
         'useCases' => ['auth'],
         'runtimes' => [
-            ...getRuntimes($templateRuntimes['DART'], 'dart pub get', 'lib/main.dart', 'dart/sign_in_with_apple')
+            ...getRuntimes($templateRuntimes['DART'], 'dart pub get', 'lib/main.dart', 'dart/sign_in_with_apple', $allowList)
         ],
         'instructions' => 'For documentation and instructions, check out <a target="_blank" rel="noopener noreferrer" class="link" href="https://github.com/appwrite/templates/tree/main/dart/sign_in_with_apple">file</a>.',
         'vcsProvider' => 'github',

app/config/templates/site.php

@@ -1,5 +1,6 @@
 <?php
 
+use Utopia\Config\Config;
 use Utopia\System\System;
 
 /**
@@ -7,7 +8,8 @@ use Utopia\System\System;
  */
 
 $protocol = System::getEnv('_APP_OPTIONS_FORCE_HTTPS') === 'disabled' ? 'http' : 'https';
-$hostname = System::getEnv('_APP_DOMAIN', '');
+$platform = Config::getParam('platform', []);
+$hostname = $platform['consoleHostname'] ?? '';
 
 $url = $protocol . '://' . $hostname;
 
@@ -19,6 +21,9 @@ class UseCases
     public const ECOMMERCE = 'ecommerce';
     public const DOCUMENTATION = 'documentation';
     public const BLOG = 'blog';
+    public const AI = 'artificial intelligence';
+    public const FORMS = 'forms';
+    public const DASHBOARD = 'dashboard';
 }
 
 const TEMPLATE_FRAMEWORKS = [
@@ -78,7 +83,7 @@ const TEMPLATE_FRAMEWORKS = [
         'installCommand' => '',
         'buildCommand' => 'flutter build web',
         'outputDirectory' => './build/web',
-        'buildRuntime' => 'flutter-3.29',
+        'buildRuntime' => 'flutter-3.35',
         'adapter' => 'static',
         'fallbackFile' => '',
     ],
@@ -111,6 +116,16 @@ const TEMPLATE_FRAMEWORKS = [
         'outputDirectory' => './dist',
         'fallbackFile' => '+not-found.html',
     ],
+    'TANSTACK_START' => [
+        'key' => 'tanstack-start',
+        'name' => 'TanStack Start',
+        'installCommand' => 'npm install',
+        'buildCommand' => 'npm run build',
+        'outputDirectory' => './dist',
+        'buildRuntime' => 'node-22',
+        'adapter' => 'ssr',
+        'fallbackFile' => '',
+    ],
     'ANGULAR' => [
         'key' => 'angular',
         'name' => 'Angular',
@@ -950,6 +965,50 @@ return [
             ],
         ]
     ],
+    [
+        'key' => 'starter-for-tanstack-start',
+        'name' => 'TanStack Start starter',
+        'useCases' => [UseCases::STARTER],
+        'tagline' => 'Simple TanStack Start application integrated with Appwrite SDK.',
+        'score' => 9, // 0 to 10 based on looks of screenshot (avoid 1,2,3,8,9,10 if possible)
+        'screenshotDark' => $url . '/images/sites/templates/starter-for-tanstack-start-dark.png',
+        'screenshotLight' => $url . '/images/sites/templates/starter-for-tanstack-start-light.png',
+        'frameworks' => [
+            getFramework('TANSTACK_START', [
+                'providerRootDirectory' => './',
+            ]),
+        ],
+        'vcsProvider' => 'github',
+        'providerRepositoryId' => 'starter-for-tanstack-start',
+        'providerOwner' => 'appwrite',
+        'providerVersion' => '0.1.*',
+        'variables' => [
+            [
+                'name' => 'VITE_APPWRITE_ENDPOINT',
+                'description' => 'Endpoint of Appwrite server',
+                'value' => '{apiEndpoint}',
+                'placeholder' => '{apiEndpoint}',
+                'required' => true,
+                'type' => 'text'
+            ],
+            [
+                'name' => 'VITE_APPWRITE_PROJECT_ID',
+                'description' => 'Your Appwrite project ID',
+                'value' => '{projectId}',
+                'placeholder' => '{projectId}',
+                'required' => true,
+                'type' => 'text'
+            ],
+            [
+                'name' => 'VITE_APPWRITE_PROJECT_NAME',
+                'description' => 'Your Appwrite project name',
+                'value' => '{projectName}',
+                'placeholder' => '{projectName}',
+                'required' => true,
+                'type' => 'text'
+            ],
+        ]
+    ],
     [
         'key' => 'starter-for-nuxt',
         'name' => 'Nuxt starter',
@@ -1327,6 +1386,25 @@ return [
         'providerVersion' => '0.3.*',
         'variables' => [],
     ],
+    [
+        'key' => 'playground-for-tanstack-start',
+        'name' => 'TanStack Start playground',
+        'tagline' => 'A basic TanStack Start website without Appwrite SDK integration.',
+        'score' => 1, // 0 to 10 based on looks of screenshot (avoid 1,2,3,8,9,10 if possible)
+        'useCases' => [UseCases::STARTER],
+        'screenshotDark' => $url . '/images/sites/templates/playground-for-tanstack-start-dark.png',
+        'screenshotLight' => $url . '/images/sites/templates/playground-for-tanstack-start-light.png',
+        'frameworks' => [
+            getFramework('TANSTACK_START', [
+                'providerRootDirectory' => './tanstack-start/starter',
+            ]),
+        ],
+        'vcsProvider' => 'github',
+        'providerRepositoryId' => 'templates-for-sites',
+        'providerOwner' => 'appwrite',
+        'providerVersion' => '0.5.*',
+        'variables' => [],
+    ],
     [
         'key' => 'playground-for-react-native',
         'name' => 'React Native playground',
@@ -1365,4 +1443,163 @@ return [
         'providerVersion' => '0.3.*',
         'variables' => []
     ],
+    [
+        'key' => 'text-to-speech',
+        'name' => 'Text-to-speech with ElevenLabs',
+        'tagline' => 'Next.js app that transforms text into natural, human-like speech using ElevenLabs',
+        'score' => 10, // 0 to 10 based on looks of screenshot (avoid 1,2,3,8,9,10 if possible)
+        'useCases' => [UseCases::AI],
+        'screenshotDark' => $url . '/images/sites/templates/text-to-speech-dark.png',
+        'screenshotLight' => $url . '/images/sites/templates/text-to-speech-light.png',
+        'frameworks' => [
+            getFramework('NEXTJS', [
+                'providerRootDirectory' => './nextjs/text-to-speech',
+            ]),
+        ],
+        'vcsProvider' => 'github',
+        'providerRepositoryId' => 'templates-for-sites',
+        'providerOwner' => 'appwrite',
+        'providerVersion' => '0.6.*',
+        'variables' => [
+            [
+                'name' => 'ELEVENLABS_API_KEY',
+                'description' => 'Your ElevenLabs API key',
+                'value' => '',
+                'placeholder' => 'sk_.....',
+                'required' => true,
+                'type' => 'password'
+            ],
+        ]
+    ],
+    [
+        'key' => 'crm-dashboard-react-admin',
+        'name' => 'CRM dashboard with React Admin',
+        'tagline' => 'A React-based admin dashboard template with CRM features.',
+        'score' => 4, // 0 to 10 based on looks of screenshot (avoid 1,2,3,8,9,10 if possible)
+        'useCases' => [UseCases::DASHBOARD],
+        'screenshotDark' => $url . '/images/sites/templates/crm-dashboard-react-admin-dark.png',
+        'screenshotLight' => $url . '/images/sites/templates/crm-dashboard-react-admin-light.png',
+        'frameworks' => [
+            getFramework('REACT', [
+                'providerRootDirectory' => './react/react-admin',
+                'installCommand' => 'pnpm install',
+                'buildCommand' => 'pnpm build && pnpm db-seed',
+                'outputDirectory' => './dist',
+            ]),
+        ],
+        'vcsProvider' => 'github',
+        'providerRepositoryId' => 'templates-for-sites',
+        'providerOwner' => 'appwrite',
+        'providerVersion' => '0.7.*',
+        'variables' => [
+            [
+                'name' => 'VITE_APPWRITE_ENDPOINT',
+                'description' => 'Endpoint of Appwrite server',
+                'value' => '{apiEndpoint}',
+                'placeholder' => '{apiEndpoint}',
+                'required' => true,
+                'type' => 'text'
+            ],
+            [
+                'name' => 'VITE_APPWRITE_PROJECT_ID',
+                'description' => 'Your Appwrite project ID',
+                'value' => '{projectId}',
+                'placeholder' => '{projectId}',
+                'required' => true,
+                'type' => 'text'
+            ],
+            [
+                'name' => 'APPWRITE_API_KEY',
+                'description' => 'Your Appwrite API key (for seeding only)',
+                'value' => '',
+                'placeholder' => 'a0b1...',
+                'required' => true,
+                'type' => 'password'
+            ],
+            [
+                'name' => 'VITE_APPWRITE_DATABASE_ID',
+                'description' => 'Database ID (default: admin)',
+                'value' => 'admin',
+                'placeholder' => 'admin',
+                'required' => false,
+                'type' => 'text'
+            ],
+            [
+                'name' => 'VITE_APPWRITE_TABLE_REVIEWS',
+                'description' => 'Table ID for reviews table',
+                'value' => 'reviews',
+                'placeholder' => 'reviews',
+                'required' => false,
+                'type' => 'text'
+            ],
+            [
+                'name' => 'VITE_APPWRITE_TABLE_INVOICES',
+                'description' => 'Table ID for invoices table',
+                'value' => 'invoices',
+                'placeholder' => 'invoices',
+                'required' => false,
+                'type' => 'text'
+            ],
+            [
+                'name' => 'VITE_APPWRITE_TABLE_ORDERS',
+                'description' => 'Table ID for orders table',
+                'value' => 'orders',
+                'placeholder' => 'orders',
+                'required' => false,
+                'type' => 'text'
+            ],
+            [
+                'name' => 'VITE_APPWRITE_TABLE_PRODUCTS',
+                'description' => 'Table ID for products table',
+                'value' => 'products',
+                'placeholder' => 'products',
+                'required' => false,
+                'type' => 'text'
+            ],
+            [
+                'name' => 'VITE_APPWRITE_TABLE_CATEGORIES',
+                'description' => 'Table ID for categories table',
+                'value' => 'categories',
+                'placeholder' => 'categories',
+                'required' => false,
+                'type' => 'text'
+            ],
+            [
+                'name' => 'VITE_APPWRITE_TABLE_CUSTOMERS',
+                'description' => 'Table ID for customers table',
+                'value' => 'customers',
+                'placeholder' => 'customers',
+                'required' => false,
+                'type' => 'text'
+            ],
+        ]
+    ],
+    [
+        'key' => 'job-applications-formspree',
+        'name' => 'Job applications form with Formspree',
+        'tagline' => 'A simple form submission template using Formspree.',
+        'score' => 4, // 0 to 10 based on looks of screenshot (avoid 1,2,3,8,9,10 if possible)
+        'useCases' => [UseCases::FORMS],
+        'screenshotDark' => $url . '/images/sites/templates/job-applications-formspree-dark.png',
+        'screenshotLight' => $url . '/images/sites/templates/job-applications-formspree-light.png',
+        'frameworks' => [
+            getFramework('REACT', [
+                'providerRootDirectory' => './react/formspree',
+            ]),
+        ],
+        'vcsProvider' => 'github',
+        'providerRepositoryId' => 'templates-for-sites',
+        'providerOwner' => 'appwrite',
+        'providerVersion' => '0.7.*',
+        'variables' => [
+            [
+                'name' => 'VITE_FORMSPREE_FORM_ID',
+                'description' => 'Your Formspree form ID',
+                'value' => '',
+                'placeholder' => 'xrgkpqld',
+                'required' => true,
+                'type' => 'text'
+            ],
+        ]
+    ]
 ];

app/config/variables.php

@@ -81,7 +81,7 @@ return [
             ],
             [
                 'name' => '_APP_DOMAIN',
-                'description' => 'Your Appwrite domain address. When setting a public suffix domain, Appwrite will attempt to issue a valid SSL certificate automatically. When used with a dev domain, Appwrite will assign a self-signed SSL certificate. The default value is \'localhost\'.',
+                'description' => 'Your Appwrite domain address. When setting a public suffix domain, Appwrite will attempt to issue a valid SSL certificate automatically. When used with a dev domain, Appwrite will assign a self-signed SSL certificate. The default value is \'localhost\'. Multiple domains can be separated by commas.',
                 'introduction' => '',
                 'default' => 'localhost',
                 'required' => true,
@@ -357,6 +357,15 @@ return [
                 'required' => false,
                 'question' => '',
                 'filter' => ''
+            ],
+            [
+                'name' => '_APP_TRUSTED_HEADERS',
+                'description' => 'This option allows you to set the list of trusted headers, the value is a comma‑separated list of HTTP header names, evaluated left-to-right for the first valid IP. Header names are treated case-insensitively.',
+                'introduction' => '1.8.0',
+                'default' => 'x-forwarded-for',
+                'required' => false,
+                'question' => '',
+                'filter' => ''
             ]
         ],
     ],
@@ -952,6 +961,16 @@ return [
                 'question' => '',
                 'filter' => ''
             ],
+            [
+                'name' => '_APP_BROWSER_HOST',
+                'description' => 'The host used by Appwrite to communicate with the browser service for screenshots.',
+                'introduction' => '1.8.0',
+                'default' => 'http://appwrite-browser:3000/v1',
+                'required' => false,
+                'overwrite' => true,
+                'question' => '',
+                'filter' => ''
+            ],
             [
                 'name' => '_APP_EXECUTOR_RUNTIME_NETWORK',
                 'description' => 'Deprecated with 0.14.0, use \'OPEN_RUNTIMES_NETWORK\' instead.',

app/controllers/api/avatars.php

@@ -1,5 +1,6 @@
 <?php
 
+use Appwrite\Event\StatsUsage;
 use Appwrite\Extend\Exception;
 use Appwrite\SDK\AuthType;
 use Appwrite\SDK\ContentType;
@@ -23,6 +24,8 @@ use Utopia\Fetch\Client;
 use Utopia\Image\Image;
 use Utopia\Logger\Logger;
 use Utopia\System\System;
+use Utopia\Validator\ArrayList;
+use Utopia\Validator\Assoc;
 use Utopia\Validator\Boolean;
 use Utopia\Validator\HexColor;
 use Utopia\Validator\Range;
@@ -67,9 +70,9 @@ $avatarCallback = function (string $type, string $code, int $width, int $height,
     unset($image);
 };
 
-$getUserGitHub = function (string $userId, Document $project, Database $dbForProject, Database $dbForPlatform, ?Logger $logger) {
+$getUserGitHub = function (string $userId, Document $project, Database $dbForProject, Database $dbForPlatform, Authorization $authorization, ?Logger $logger) {
     try {
-        $user = Authorization::skip(fn () => $dbForPlatform->getDocument('users', $userId));
+        $user = $authorization->skip(fn () => $dbForPlatform->getDocument('users', $userId));
 
         $sessions = $user->getAttribute('sessions', []);
 
@@ -93,8 +96,8 @@ $getUserGitHub = function (string $userId, Document $project, Database $dbForPro
         $appId = $project->getAttribute('oAuthProviders', [])[$provider . 'Appid'] ?? '';
         $appSecret = $project->getAttribute('oAuthProviders', [])[$provider . 'Secret'] ?? '{}';
 
-        $className = 'Appwrite\\Auth\\OAuth2\\' . \ucfirst($provider);
-
+        $oAuthProviders = Config::getParam('oAuthProviders');
+        $className = $oAuthProviders[$provider]['class'];
         if (!\class_exists($className)) {
             throw new Exception(Exception::PROJECT_PROVIDER_UNSUPPORTED);
         }
@@ -120,7 +123,7 @@ $getUserGitHub = function (string $userId, Document $project, Database $dbForPro
                     ->setAttribute('providerRefreshToken', $refreshToken)
                     ->setAttribute('providerAccessTokenExpiry', DateTime::addSeconds(new \DateTime(), (int)$oauth2->getAccessTokenExpiry('')));
 
-                Authorization::skip(fn () => $dbForProject->updateDocument('sessions', $gitHubSession->getId(), $gitHubSession));
+                $authorization->skip(fn () => $dbForProject->updateDocument('sessions', $gitHubSession->getId(), $gitHubSession));
 
                 $dbForProject->purgeCachedDocument('users', $user->getId());
             } catch (Throwable $err) {
@@ -128,7 +131,7 @@ $getUserGitHub = function (string $userId, Document $project, Database $dbForPro
                 do {
                     $previousAccessToken = $gitHubSession->getAttribute('providerAccessToken');
 
-                    $user = Authorization::skip(fn () => $dbForPlatform->getDocument('users', $userId));
+                    $user = $authorization->skip(fn () => $dbForPlatform->getDocument('users', $userId));
                     $sessions = $user->getAttribute('sessions', []);
 
                     $gitHubSession = new Document();
@@ -175,7 +178,7 @@ App::get('/v1/avatars/credit-cards/:code')
         group: null,
         name: 'getCreditCard',
         description: '/docs/references/avatars/get-credit-card.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         type: MethodType::LOCATION,
         responses: [
             new SDKResponse(
@@ -203,7 +206,7 @@ App::get('/v1/avatars/browsers/:code')
         group: null,
         name: 'getBrowser',
         description: '/docs/references/avatars/get-browser.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         type: MethodType::LOCATION,
         responses: [
             new SDKResponse(
@@ -231,7 +234,7 @@ App::get('/v1/avatars/flags/:code')
         group: null,
         name: 'getFlag',
         description: '/docs/references/avatars/get-flag.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         type: MethodType::LOCATION,
         responses: [
             new SDKResponse(
@@ -259,7 +262,7 @@ App::get('/v1/avatars/image')
         group: null,
         name: 'getImage',
         description: '/docs/references/avatars/get-image.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         type: MethodType::LOCATION,
         responses: [
             new SDKResponse(
@@ -330,7 +333,7 @@ App::get('/v1/avatars/favicon')
         group: null,
         name: 'getFavicon',
         description: '/docs/references/avatars/get-favicon.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         type: MethodType::LOCATION,
         responses: [
             new SDKResponse(
@@ -504,7 +507,7 @@ App::get('/v1/avatars/qr')
         group: null,
         name: 'getQR',
         description: '/docs/references/avatars/get-qr.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         type: MethodType::LOCATION,
         responses: [
             new SDKResponse(
@@ -554,7 +557,7 @@ App::get('/v1/avatars/initials')
         group: null,
         name: 'getInitials',
         description: '/docs/references/avatars/get-initials.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         type: MethodType::LOCATION,
         responses: [
             new SDKResponse(
@@ -635,6 +638,187 @@ App::get('/v1/avatars/initials')
             ->file($image->getImageBlob());
     });
 
+App::get('/v1/avatars/screenshots')
+    ->desc('Get webpage screenshot')
+    ->groups(['api', 'avatars'])
+    ->label('scope', 'avatars.read')
+    ->label('usage.metric', METRIC_AVATARS_SCREENSHOTS_GENERATED)
+    ->label('abuse-limit', 60)
+    ->label('cache', true)
+    ->label('cache.resourceType', 'avatar/screenshot')
+    ->label('cache.resource', 'screenshot/{request.url}/{request.width}/{request.height}/{request.scale}/{request.theme}/{request.userAgent}/{request.fullpage}/{request.locale}/{request.timezone}/{request.latitude}/{request.longitude}/{request.accuracy}/{request.touch}/{request.permissions}/{request.sleep}/{request.quality}/{request.output}')
+    ->label('sdk', new Method(
+        namespace: 'avatars',
+        group: null,
+        name: 'getScreenshot',
+        description: '/docs/references/avatars/get-screenshot.md',
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        type: MethodType::LOCATION,
+        responses: [
+            new SDKResponse(
+                code: Response::STATUS_CODE_OK,
+                model: Response::MODEL_NONE,
+            )
+        ],
+        contentType: ContentType::IMAGE_PNG
+    ))
+    ->param('url', '', new URL(['http', 'https']), 'Website URL which you want to capture.', example: 'https://example.com')
+    ->param('headers', [], new Assoc(), 'HTTP headers to send with the browser request. Defaults to empty.', true, example: '{"Authorization":"Bearer token123","X-Custom-Header":"value"}')
+    ->param('viewportWidth', 1280, new Range(1, 1920), 'Browser viewport width. Pass an integer between 1 to 1920. Defaults to 1280.', true, example: '1920')
+    ->param('viewportHeight', 720, new Range(1, 1080), 'Browser viewport height. Pass an integer between 1 to 1080. Defaults to 720.', true, example: '1080')
+    ->param('scale', 1, new Range(0.1, 3, Range::TYPE_FLOAT), 'Browser scale factor. Pass a number between 0.1 to 3. Defaults to 1.', true, example: '2')
+    ->param('theme', 'light', new WhiteList(['light', 'dark']), 'Browser theme. Pass "light" or "dark". Defaults to "light".', true, example: 'dark')
+    ->param('userAgent', '', new Text(512), 'Custom user agent string. Defaults to browser default.', true, example: 'Mozilla/5.0 (iPhone; CPU iPhone OS 14_0 like Mac OS X) AppleWebKit/605.1.15')
+    ->param('fullpage', false, new Boolean(true), 'Capture full page scroll. Pass 0 for viewport only, or 1 for full page. Defaults to 0.', true, example: 'true')
+    ->param('locale', '', new Text(10), 'Browser locale (e.g., "en-US", "fr-FR"). Defaults to browser default.', true, example: 'en-US')
+    ->param('timezone', '', new WhiteList(timezone_identifiers_list()), 'IANA timezone identifier (e.g., "America/New_York", "Europe/London"). Defaults to browser default.', true, example: 'america/new_york')
+    ->param('latitude', 0, new Range(-90, 90, Range::TYPE_FLOAT), 'Geolocation latitude. Pass a number between -90 to 90. Defaults to 0.', true, example: '37.7749')
+    ->param('longitude', 0, new Range(-180, 180, Range::TYPE_FLOAT), 'Geolocation longitude. Pass a number between -180 to 180. Defaults to 0.', true, example: '-122.4194')
+    ->param('accuracy', 0, new Range(0, 100000, Range::TYPE_FLOAT), 'Geolocation accuracy in meters. Pass a number between 0 to 100000. Defaults to 0.', true, example: '100')
+    ->param('touch', false, new Boolean(true), 'Enable touch support. Pass 0 for no touch, or 1 for touch enabled. Defaults to 0.', true, example: 'true')
+    ->param('permissions', [], new ArrayList(new WhiteList(['geolocation', 'camera', 'microphone', 'notifications', 'midi', 'push', 'clipboard-read', 'clipboard-write', 'payment-handler', 'usb', 'bluetooth', 'accelerometer', 'gyroscope', 'magnetometer', 'ambient-light-sensor', 'background-sync', 'persistent-storage', 'screen-wake-lock', 'web-share', 'xr-spatial-tracking'])), 'Browser permissions to grant. Pass an array of permission names like ["geolocation", "camera", "microphone"]. Defaults to empty.', true, example: '["geolocation","notifications"]')
+    ->param('sleep', 0, new Range(0, 10), 'Wait time in seconds before taking the screenshot. Pass an integer between 0 to 10. Defaults to 0.', true, example: '3')
+    ->param('width', 0, new Range(0, 2000), 'Output image width. Pass 0 to use original width, or an integer between 1 to 2000. Defaults to 0 (original width).', true, example: '800')
+    ->param('height', 0, new Range(0, 2000), 'Output image height. Pass 0 to use original height, or an integer between 1 to 2000. Defaults to 0 (original height).', true, example: '600')
+    ->param('quality', -1, new Range(-1, 100), 'Screenshot quality. Pass an integer between 0 to 100. Defaults to keep existing image quality.', true, example: '85')
+    ->param('output', '', new WhiteList(\array_keys(Config::getParam('storage-outputs')), true), 'Output format type (jpeg, jpg, png, gif and webp).', true, example: 'jpeg')
+    ->inject('response')
+    ->inject('queueForStatsUsage')
+    ->action(function (string $url, array $headers, int $viewportWidth, int $viewportHeight, float $scale, string $theme, string $userAgent, bool $fullpage, string $locale, string $timezone, float $latitude, float $longitude, float $accuracy, bool $touch, array $permissions, int $sleep, int $width, int $height, int $quality, string $output, Response $response, StatsUsage $queueForStatsUsage) {
+
+        if (!\extension_loaded('imagick')) {
+            throw new Exception(Exception::GENERAL_SERVER_ERROR, 'Imagick extension is missing');
+        }
+
+        $domain = new Domain(\parse_url($url, PHP_URL_HOST));
+
+        if (!$domain->isKnown()) {
+            throw new Exception(Exception::AVATAR_REMOTE_URL_FAILED);
+        }
+
+        $client = new Client();
+        $client->setTimeout(30);
+        $client->addHeader('content-type', Client::CONTENT_TYPE_APPLICATION_JSON);
+
+        // Convert indexed array to empty array (should not happen due to Assoc validator)
+        if (is_array($headers) && count($headers) > 0 && array_keys($headers) === range(0, count($headers) - 1)) {
+            $headers = [];
+        }
+
+        // Create a new object to ensure proper JSON serialization
+        $headersObject = new \stdClass();
+        foreach ($headers as $key => $value) {
+            $headersObject->$key = $value;
+        }
+
+        // Create the config with headers as an object
+        // The custom browser service accepts: url, theme, headers, sleep, viewport, userAgent, fullPage, locale, timezoneId, geolocation, hasTouch, scale
+        $config = [
+            'url' => $url,
+            'theme' => $theme,
+            'headers' => $headersObject,
+            'sleep' => $sleep * 1000, // Convert seconds to milliseconds
+            'waitUntil' => 'load',
+            'viewport' => [
+                'width' => $viewportWidth,
+                'height' => $viewportHeight
+            ]
+        ];
+
+        // Add scale if not default
+        if ($scale != 1) {
+            $config['deviceScaleFactor'] = $scale;
+        }
+
+        // Add optional parameters that were set, preserving arrays as arrays
+        if (!empty($userAgent)) {
+            $config['userAgent'] = $userAgent;
+        }
+
+        if ($fullpage) {
+            $config['fullPage'] = true;
+        }
+
+        if (!empty($locale)) {
+            $config['locale'] = $locale;
+        }
+
+        if (!empty($timezone)) {
+            $config['timezoneId'] = $timezone;
+        }
+
+        // Add geolocation if any coordinates are provided
+        if ($latitude != 0 || $longitude != 0) {
+            $config['geolocation'] = [
+                'latitude' => $latitude,
+                'longitude' => $longitude,
+                'accuracy' => $accuracy
+            ];
+        }
+
+        if ($touch) {
+            $config['hasTouch'] = true;
+        }
+
+        // Add permissions if provided (preserve as array)
+        if (!empty($permissions)) {
+            $config['permissions'] = $permissions; // Keep as array
+        }
+
+        try {
+            $browserEndpoint = System::getEnv('_APP_BROWSER_HOST', 'http://appwrite-browser:3000/v1');
+
+            $fetchResponse = $client->fetch(
+                url: $browserEndpoint . '/screenshots',
+                method: 'POST',
+                body: $config
+            );
+
+            if ($fetchResponse->getStatusCode() >= 400) {
+                throw new Exception(Exception::AVATAR_REMOTE_URL_FAILED, 'Screenshot service failed: ' . $fetchResponse->getBody());
+            }
+
+            $screenshot = $fetchResponse->getBody();
+
+            if (empty($screenshot)) {
+                throw new Exception(Exception::AVATAR_IMAGE_NOT_FOUND, 'Screenshot not generated');
+            }
+
+            // Determine if image processing is needed
+            $needsProcessing = ($width > 0 || $height > 0) || $quality !== -1 || !empty($output);
+
+            if ($needsProcessing) {
+                // Process image with cropping, quality adjustment, or format conversion
+                $image = new Image($screenshot);
+
+                $image->crop($width, $height);
+
+                $output = $output ?: 'png'; // Default to PNG if not specified
+                $resizedScreenshot = $image->output($output, $quality);
+                unset($image);
+            } else {
+                // Return original screenshot without processing
+                $resizedScreenshot = $screenshot;
+                $output = 'png'; // Screenshots are typically PNG by default
+            }
+
+            // Set content type based on output format
+            $outputs = Config::getParam('storage-outputs');
+            $contentType = $outputs[$output] ?? $outputs['png'];
+
+            $queueForStatsUsage->addMetric(METRIC_AVATARS_SCREENSHOTS_GENERATED, 1);
+
+            $response
+                ->addHeader('Cache-Control', 'private, max-age=2592000') // 30 days
+                ->setContentType($contentType)
+                ->file($resizedScreenshot);
+
+
+        } catch (\Throwable $th) {
+            throw new Exception(Exception::AVATAR_REMOTE_URL_FAILED, 'Screenshot generation failed: ' . $th->getMessage());
+        }
+    });
+
 App::get('/v1/cards/cloud')
     ->desc('Get front Of Cloud Card')
     ->groups(['api', 'avatars'])
@@ -657,8 +841,9 @@ App::get('/v1/cards/cloud')
     ->inject('contributors')
     ->inject('employees')
     ->inject('logger')
-    ->action(function (string $userId, string $mock, int $width, int $height, Document $user, Document $project, Database $dbForProject, Database $dbForPlatform, Response $response, array $heroes, array $contributors, array $employees, ?Logger $logger) use ($getUserGitHub) {
-        $user = Authorization::skip(fn () => $dbForPlatform->getDocument('users', $userId));
+    ->inject('authorization')
+    ->action(function (string $userId, string $mock, int $width, int $height, Document $user, Document $project, Database $dbForProject, Database $dbForPlatform, Response $response, array $heroes, array $contributors, array $employees, ?Logger $logger, Authorization $authorization) use ($getUserGitHub) {
+        $user = $authorization->skip(fn () => $dbForPlatform->getDocument('users', $userId));
 
         if ($user->isEmpty() && empty($mock)) {
             throw new Exception(Exception::USER_NOT_FOUND);
@@ -669,7 +854,7 @@ App::get('/v1/cards/cloud')
             $email = $user->getAttribute('email', '');
             $createdAt = new \DateTime($user->getCreatedAt());
 
-            $gitHub = $getUserGitHub($user->getId(), $project, $dbForProject, $dbForPlatform, $logger);
+            $gitHub = $getUserGitHub($user->getId(), $project, $dbForProject, $dbForPlatform, $authorization, $logger);
             $githubName = $gitHub['name'] ?? '';
             $githubId = $gitHub['id'] ?? '';
 
@@ -864,8 +1049,9 @@ App::get('/v1/cards/cloud-back')
     ->inject('contributors')
     ->inject('employees')
     ->inject('logger')
-    ->action(function (string $userId, string $mock, int $width, int $height, Document $user, Document $project, Database $dbForProject, Database $dbForPlatform, Response $response, array $heroes, array $contributors, array $employees, ?Logger $logger) use ($getUserGitHub) {
-        $user = Authorization::skip(fn () => $dbForPlatform->getDocument('users', $userId));
+    ->inject('authorization')
+    ->action(function (string $userId, string $mock, int $width, int $height, Document $user, Document $project, Database $dbForProject, Database $dbForPlatform, Response $response, array $heroes, array $contributors, array $employees, ?Logger $logger, Authorization $authorization) use ($getUserGitHub) {
+        $user = $authorization->skip(fn () => $dbForPlatform->getDocument('users', $userId));
 
         if ($user->isEmpty() && empty($mock)) {
             throw new Exception(Exception::USER_NOT_FOUND);
@@ -875,7 +1061,7 @@ App::get('/v1/cards/cloud-back')
             $userId = $user->getId();
             $email = $user->getAttribute('email', '');
 
-            $gitHub = $getUserGitHub($user->getId(), $project, $dbForProject, $dbForPlatform, $logger);
+            $gitHub = $getUserGitHub($user->getId(), $project, $dbForProject, $dbForPlatform, $authorization, $logger);
             $githubId = $gitHub['id'] ?? '';
 
             $isHero = \array_key_exists($email, $heroes);
@@ -942,8 +1128,9 @@ App::get('/v1/cards/cloud-og')
     ->inject('contributors')
     ->inject('employees')
     ->inject('logger')
-    ->action(function (string $userId, string $mock, int $width, int $height, Document $user, Document $project, Database $dbForProject, Database $dbForPlatform, Response $response, array $heroes, array $contributors, array $employees, ?Logger $logger) use ($getUserGitHub) {
-        $user = Authorization::skip(fn () => $dbForPlatform->getDocument('users', $userId));
+    ->inject('authorization')
+    ->action(function (string $userId, string $mock, int $width, int $height, Document $user, Document $project, Database $dbForProject, Database $dbForPlatform, Response $response, array $heroes, array $contributors, array $employees, ?Logger $logger, Authorization $authorization) use ($getUserGitHub) {
+        $user = $authorization->skip(fn () => $dbForPlatform->getDocument('users', $userId));
 
         if ($user->isEmpty() && empty($mock)) {
             throw new Exception(Exception::USER_NOT_FOUND);
@@ -958,7 +1145,7 @@ App::get('/v1/cards/cloud-og')
             $email = $user->getAttribute('email', '');
             $createdAt = new \DateTime($user->getCreatedAt());
 
-            $gitHub = $getUserGitHub($user->getId(), $project, $dbForProject, $dbForPlatform, $logger);
+            $gitHub = $getUserGitHub($user->getId(), $project, $dbForProject, $dbForPlatform, $authorization, $logger);
             $githubName = $gitHub['name'] ?? '';
             $githubId = $gitHub['id'] ?? '';
 

app/controllers/api/console.php

@@ -43,9 +43,6 @@ App::get('/v1/console/variables')
     ))
     ->inject('response')
     ->action(function (Response $response) {
-        $validator = new Domain(System::getEnv('_APP_DOMAIN'));
-        $isDomainValid = !empty(System::getEnv('_APP_DOMAIN', '')) && $validator->isKnown() && !$validator->isTest();
-
         $validator = new Domain(System::getEnv('_APP_DOMAIN_TARGET_CNAME'));
         $isCNAMEValid = !empty(System::getEnv('_APP_DOMAIN_TARGET_CNAME', '')) && $validator->isKnown() && !$validator->isTest();
 
@@ -55,9 +52,7 @@ App::get('/v1/console/variables')
         $validator = new IP(IP::V6);
         $isAAAAValid = !empty(System::getEnv('_APP_DOMAIN_TARGET_AAAA', '')) && $validator->isValid(System::getEnv('_APP_DOMAIN_TARGET_AAAA'));
 
-        $isDomainEnabled = $isDomainValid && (
-            $isAAAAValid || $isAValid || $isCNAMEValid
-        );
+        $isDomainEnabled = $isAAAAValid || $isAValid || $isCNAMEValid;
 
         $isVcsEnabled = !empty(System::getEnv('_APP_VCS_GITHUB_APP_NAME', ''))
             && !empty(System::getEnv('_APP_VCS_GITHUB_PRIVATE_KEY', ''))
@@ -74,6 +69,7 @@ App::get('/v1/console/variables')
             // Combine CAA domain with most common flags and tag (no parameters)
             '_APP_DOMAIN_TARGET_CAA' => '0 issue "' . System::getEnv('_APP_DOMAIN_TARGET_CAA') . '"',
             '_APP_STORAGE_LIMIT' => +System::getEnv('_APP_STORAGE_LIMIT'),
+            '_APP_COMPUTE_BUILD_TIMEOUT' => +System::getEnv('_APP_COMPUTE_BUILD_TIMEOUT'),
             '_APP_COMPUTE_SIZE_LIMIT' => +System::getEnv('_APP_COMPUTE_SIZE_LIMIT'),
             '_APP_USAGE_STATS' => System::getEnv('_APP_USAGE_STATS'),
             '_APP_VCS_ENABLED' => $isVcsEnabled,

app/controllers/api/graphql.php

@@ -1,6 +1,5 @@
 <?php
 
-use Appwrite\Auth\Auth;
 use Appwrite\Extend\Exception;
 use Appwrite\Extend\Exception as AppwriteException;
 use Appwrite\GraphQL\Promises\Adapter;
@@ -9,6 +8,7 @@ use Appwrite\SDK\AuthType;
 use Appwrite\SDK\Method;
 use Appwrite\SDK\MethodType;
 use Appwrite\SDK\Response as SDKResponse;
+use Appwrite\Utopia\Database\Documents\User;
 use Appwrite\Utopia\Request;
 use Appwrite\Utopia\Response;
 use GraphQL\Error\DebugFlag;
@@ -28,11 +28,12 @@ use Utopia\Validator\Text;
 App::init()
     ->groups(['graphql'])
     ->inject('project')
-    ->action(function (Document $project) {
+    ->inject('authorization')
+    ->action(function (Document $project, Authorization $authorization) {
         if (
             array_key_exists('graphql', $project->getAttribute('apis', []))
             && !$project->getAttribute('apis', [])['graphql']
-            && !(Auth::isPrivilegedUser(Authorization::getRoles()) || Auth::isAppUser(Authorization::getRoles()))
+            && !(User::isPrivileged($authorization->getRoles()) || User::isApp($authorization->getRoles()))
         ) {
             throw new AppwriteException(AppwriteException::GENERAL_API_DISABLED);
         }
@@ -46,7 +47,7 @@ App::get('/v1/graphql')
         namespace: 'graphql',
         group: 'graphql',
         name: 'get',
-        auth: [AuthType::KEY, AuthType::SESSION, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::KEY, AuthType::SESSION, AuthType::JWT],
         hide: true,
         description: '/docs/references/graphql/get.md',
         responses: [
@@ -93,7 +94,7 @@ App::post('/v1/graphql/mutation')
         namespace: 'graphql',
         group: 'graphql',
         name: 'mutation',
-        auth: [AuthType::KEY, AuthType::SESSION, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::KEY, AuthType::SESSION, AuthType::JWT],
         description: '/docs/references/graphql/post.md',
         responses: [
             new SDKResponse(
@@ -144,7 +145,7 @@ App::post('/v1/graphql')
         namespace: 'graphql',
         group: 'graphql',
         name: 'query',
-        auth: [AuthType::KEY, AuthType::SESSION, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::KEY, AuthType::SESSION, AuthType::JWT],
         description: '/docs/references/graphql/post.md',
         responses: [
             new SDKResponse(

app/controllers/api/health.php

@@ -50,7 +50,7 @@ App::get('/v1/health')
         group: 'health',
         name: 'get',
         description: '/docs/references/health/get.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -89,7 +89,7 @@ App::get('/v1/health/db')
         group: 'health',
         name: 'getDB',
         description: '/docs/references/health/get-db.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -120,7 +120,7 @@ App::get('/v1/health/db')
                         $output[] = new Document([
                             'name' => $key . " ($database)",
                             'status' => 'pass',
-                            'ping' => \round((\microtime(true) - $checkStart) / 1000)
+                            'ping' => \round((\microtime(true) - $checkStart) * 1000)
                         ]);
                     } else {
                         $failures[] = $database;
@@ -131,6 +131,8 @@ App::get('/v1/health/db')
             }
         }
 
+        // Only throw error if ALL databases failed (no successful pings)
+        // This allows partial failures in environments where not all DBs are ready
         if (!empty($failures)) {
             throw new Exception(Exception::GENERAL_SERVER_ERROR, 'DB failure on: ' . implode(", ", $failures));
         }
@@ -150,7 +152,7 @@ App::get('/v1/health/cache')
         group: 'health',
         name: 'getCache',
         description: '/docs/references/health/get-cache.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -180,7 +182,7 @@ App::get('/v1/health/cache')
                         $output[] = new Document([
                             'name' => $key . " ($cache)",
                             'status' => 'pass',
-                            'ping' => \round((\microtime(true) - $checkStart) / 1000)
+                            'ping' => \round((\microtime(true) - $checkStart) * 1000)
                         ]);
                     } else {
                         $failures[] = $cache;
@@ -210,7 +212,7 @@ App::get('/v1/health/pubsub')
         group: 'health',
         name: 'getPubSub',
         description: '/docs/references/health/get-pubsub.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -240,7 +242,7 @@ App::get('/v1/health/pubsub')
                         $output[] = new Document([
                             'name' => $key . " ($pubsub)",
                             'status' => 'pass',
-                            'ping' => \round((\microtime(true) - $checkStart) / 1000)
+                            'ping' => \round((\microtime(true) - $checkStart) * 1000)
                         ]);
                     } else {
                         $failures[] = $pubsub;
@@ -270,7 +272,7 @@ App::get('/v1/health/time')
         group: 'health',
         name: 'getTime',
         description: '/docs/references/health/get-time.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -334,7 +336,7 @@ App::get('/v1/health/queue/webhooks')
         group: 'queue',
         name: 'getQueueWebhooks',
         description: '/docs/references/health/get-queue-webhooks.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -367,7 +369,7 @@ App::get('/v1/health/queue/logs')
         group: 'queue',
         name: 'getQueueLogs',
         description: '/docs/references/health/get-queue-logs.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -400,7 +402,7 @@ App::get('/v1/health/certificate')
         group: 'health',
         name: 'getCertificate',
         description: '/docs/references/health/get-certificate.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -457,7 +459,7 @@ App::get('/v1/health/queue/certificates')
         group: 'queue',
         name: 'getQueueCertificates',
         description: '/docs/references/health/get-queue-certificates.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -490,7 +492,7 @@ App::get('/v1/health/queue/builds')
         group: 'queue',
         name: 'getQueueBuilds',
         description: '/docs/references/health/get-queue-builds.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -523,7 +525,7 @@ App::get('/v1/health/queue/databases')
         group: 'queue',
         name: 'getQueueDatabases',
         description: '/docs/references/health/get-queue-databases.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -556,7 +558,7 @@ App::get('/v1/health/queue/deletes')
         group: 'queue',
         name: 'getQueueDeletes',
         description: '/docs/references/health/get-queue-deletes.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -589,7 +591,7 @@ App::get('/v1/health/queue/mails')
         group: 'queue',
         name: 'getQueueMails',
         description: '/docs/references/health/get-queue-mails.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -622,7 +624,7 @@ App::get('/v1/health/queue/messaging')
         group: 'queue',
         name: 'getQueueMessaging',
         description: '/docs/references/health/get-queue-messaging.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -655,7 +657,7 @@ App::get('/v1/health/queue/migrations')
         group: 'queue',
         name: 'getQueueMigrations',
         description: '/docs/references/health/get-queue-migrations.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -688,7 +690,7 @@ App::get('/v1/health/queue/functions')
         group: 'queue',
         name: 'getQueueFunctions',
         description: '/docs/references/health/get-queue-functions.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -721,7 +723,7 @@ App::get('/v1/health/queue/stats-resources')
         group: 'queue',
         name: 'getQueueStatsResources',
         description: '/docs/references/health/get-queue-stats-resources.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -754,7 +756,7 @@ App::get('/v1/health/queue/stats-usage')
         group: 'queue',
         name: 'getQueueUsage',
         description: '/docs/references/health/get-queue-stats-usage.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -787,7 +789,7 @@ App::get('/v1/health/storage/local')
         group: 'storage',
         name: 'getStorageLocal',
         description: '/docs/references/health/get-storage-local.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -822,7 +824,7 @@ App::get('/v1/health/storage/local')
 
         $output = [
             'status' => 'pass',
-            'ping' => \round((\microtime(true) - $checkStart) / 1000)
+            'ping' => \round((\microtime(true) - $checkStart) * 1000)
         ];
 
         $response->dynamic(new Document($output), Response::MODEL_HEALTH_STATUS);
@@ -837,7 +839,7 @@ App::get('/v1/health/storage')
         group: 'storage',
         name: 'getStorage',
         description: '/docs/references/health/get-storage.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -874,7 +876,7 @@ App::get('/v1/health/storage')
 
         $output = [
             'status' => 'pass',
-            'ping' => \round((\microtime(true) - $checkStart) / 1000)
+            'ping' => \round((\microtime(true) - $checkStart) * 1000)
         ];
 
         $response->dynamic(new Document($output), Response::MODEL_HEALTH_STATUS);
@@ -889,7 +891,7 @@ App::get('/v1/health/anti-virus')
         group: 'health',
         name: 'getAntivirus',
         description: '/docs/references/health/get-storage-anti-virus.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -935,7 +937,7 @@ App::get('/v1/health/queue/failed/:name')
         group: 'queue',
         name: 'getFailedJobs',
         description: '/docs/references/health/get-failed-queue-jobs.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,

app/controllers/api/locale.php

@@ -20,7 +20,7 @@ App::get('/v1/locale')
         group: null,
         name: 'get',
         description: '/docs/references/locale/get-locale.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -37,7 +37,6 @@ App::get('/v1/locale')
         $currencies = Config::getParam('locale-currencies');
         $output = [];
         $ip = $request->getIP();
-        $time = (60 * 60 * 24 * 45); // 45 days cache
 
         $output['ip'] = $ip;
 
@@ -68,10 +67,6 @@ App::get('/v1/locale')
             $output['currency'] = $currency;
         }
 
-        $response
-            ->addHeader('Cache-Control', 'public, max-age=' . $time)
-            ->addHeader('Cache-Control', 'private, max-age=3888000') // 45 days
-        ;
         $response->dynamic(new Document($output), Response::MODEL_LOCALE);
     });
 
@@ -84,7 +79,7 @@ App::get('/v1/locale/codes')
         group: null,
         name: 'listCodes',
         description: '/docs/references/locale/list-locale-codes.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -110,7 +105,7 @@ App::get('/v1/locale/countries')
         group: null,
         name: 'listCountries',
         description: '/docs/references/locale/list-countries.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -147,7 +142,7 @@ App::get('/v1/locale/countries/eu')
         group: null,
         name: 'listCountriesEU',
         description: '/docs/references/locale/list-countries-eu.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -186,7 +181,7 @@ App::get('/v1/locale/countries/phones')
         group: null,
         name: 'listCountriesPhones',
         description: '/docs/references/locale/list-countries-phones.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -224,7 +219,7 @@ App::get('/v1/locale/continents')
         group: null,
         name: 'listContinents',
         description: '/docs/references/locale/list-continents.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -260,7 +255,7 @@ App::get('/v1/locale/currencies')
         group: null,
         name: 'listCurrencies',
         description: '/docs/references/locale/list-currencies.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -287,7 +282,7 @@ App::get('/v1/locale/languages')
         group: null,
         name: 'listLanguages',
         description: '/docs/references/locale/list-languages.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,

app/controllers/api/migrations.php

@@ -1,6 +1,5 @@
 <?php
 
-use Appwrite\Auth\Auth;
 use Appwrite\Event\Event;
 use Appwrite\Event\Migration;
 use Appwrite\Extend\Exception;
@@ -20,6 +19,7 @@ use Utopia\Database\Exception\Query as QueryException;
 use Utopia\Database\Helpers\ID;
 use Utopia\Database\Query;
 use Utopia\Database\Validator\Authorization;
+use Utopia\Database\Validator\Queries\Documents;
 use Utopia\Database\Validator\Query\Cursor;
 use Utopia\Database\Validator\UID;
 use Utopia\Migration\Resource;
@@ -69,10 +69,11 @@ App::post('/v1/migrations/appwrite')
     ->inject('response')
     ->inject('dbForProject')
     ->inject('project')
+    ->inject('platform')
     ->inject('user')
     ->inject('queueForEvents')
     ->inject('queueForMigrations')
-    ->action(function (array $resources, string $endpoint, string $projectId, string $apiKey, Response $response, Database $dbForProject, Document $project, Document $user, Event $queueForEvents, Migration $queueForMigrations) {
+    ->action(function (array $resources, string $endpoint, string $projectId, string $apiKey, Response $response, Database $dbForProject, Document $project, array $platform, Document $user, Event $queueForEvents, Migration $queueForMigrations) {
         $migration = $dbForProject->createDocument('migrations', new Document([
             '$id' => ID::unique(),
             'status' => 'pending',
@@ -96,6 +97,7 @@ App::post('/v1/migrations/appwrite')
         $queueForMigrations
             ->setMigration($migration)
             ->setProject($project)
+            ->setPlatform($platform)
             ->setUser($user)
             ->trigger();
 
@@ -128,10 +130,11 @@ App::post('/v1/migrations/firebase')
     ->inject('response')
     ->inject('dbForProject')
     ->inject('project')
+    ->inject('platform')
     ->inject('user')
     ->inject('queueForEvents')
     ->inject('queueForMigrations')
-    ->action(function (array $resources, string $serviceAccount, Response $response, Database $dbForProject, Document $project, Document $user, Event $queueForEvents, Migration $queueForMigrations) {
+    ->action(function (array $resources, string $serviceAccount, Response $response, Database $dbForProject, Document $project, array $platform, Document $user, Event $queueForEvents, Migration $queueForMigrations) {
         $serviceAccountData = json_decode($serviceAccount, true);
 
         if (empty($serviceAccountData)) {
@@ -163,6 +166,7 @@ App::post('/v1/migrations/firebase')
         $queueForMigrations
             ->setMigration($migration)
             ->setProject($project)
+            ->setPlatform($platform)
             ->setUser($user)
             ->trigger();
 
@@ -200,10 +204,11 @@ App::post('/v1/migrations/supabase')
     ->inject('response')
     ->inject('dbForProject')
     ->inject('project')
+    ->inject('platform')
     ->inject('user')
     ->inject('queueForEvents')
     ->inject('queueForMigrations')
-    ->action(function (array $resources, string $endpoint, string $apiKey, string $databaseHost, string $username, string $password, int $port, Response $response, Database $dbForProject, Document $project, Document $user, Event $queueForEvents, Migration $queueForMigrations) {
+    ->action(function (array $resources, string $endpoint, string $apiKey, string $databaseHost, string $username, string $password, int $port, Response $response, Database $dbForProject, Document $project, array $platform, Document $user, Event $queueForEvents, Migration $queueForMigrations) {
         $migration = $dbForProject->createDocument('migrations', new Document([
             '$id' => ID::unique(),
             'status' => 'pending',
@@ -230,6 +235,7 @@ App::post('/v1/migrations/supabase')
         $queueForMigrations
             ->setMigration($migration)
             ->setProject($project)
+            ->setPlatform($platform)
             ->setUser($user)
             ->trigger();
 
@@ -268,10 +274,11 @@ App::post('/v1/migrations/nhost')
     ->inject('response')
     ->inject('dbForProject')
     ->inject('project')
+    ->inject('platform')
     ->inject('user')
     ->inject('queueForEvents')
     ->inject('queueForMigrations')
-    ->action(function (array $resources, string $subdomain, string $region, string $adminSecret, string $database, string $username, string $password, int $port, Response $response, Database $dbForProject, Document $project, Document $user, Event $queueForEvents, Migration $queueForMigrations) {
+    ->action(function (array $resources, string $subdomain, string $region, string $adminSecret, string $database, string $username, string $password, int $port, Response $response, Database $dbForProject, Document $project, array $platform, Document $user, Event $queueForEvents, Migration $queueForMigrations) {
         $migration = $dbForProject->createDocument('migrations', new Document([
             '$id' => ID::unique(),
             'status' => 'pending',
@@ -299,6 +306,7 @@ App::post('/v1/migrations/nhost')
         $queueForMigrations
             ->setMigration($migration)
             ->setProject($project)
+            ->setPlatform($platform)
             ->setUser($user)
             ->trigger();
 
@@ -307,7 +315,8 @@ App::post('/v1/migrations/nhost')
             ->dynamic($migration, Response::MODEL_MIGRATION);
     });
 
-App::post('/v1/migrations/csv')
+App::post('/v1/migrations/csv/imports')
+    ->alias('/v1/migrations/csv')
     ->groups(['api', 'migrations'])
     ->desc('Import documents from a CSV')
     ->label('scope', 'migrations.write')
@@ -316,8 +325,8 @@ App::post('/v1/migrations/csv')
     ->label('sdk', new Method(
         namespace: 'migrations',
         group: null,
-        name: 'createCsvMigration',
-        description: '/docs/references/migrations/migration-csv.md',
+        name: 'createCSVImport',
+        description: '/docs/references/migrations/migration-csv-import.md',
         auth: [AuthType::ADMIN],
         responses: [
             new SDKResponse(
@@ -333,29 +342,41 @@ App::post('/v1/migrations/csv')
     ->inject('response')
     ->inject('dbForProject')
     ->inject('dbForPlatform')
+    ->inject('authorization')
     ->inject('project')
+    ->inject('platform')
     ->inject('deviceForFiles')
-    ->inject('deviceForImports')
+    ->inject('deviceForMigrations')
     ->inject('queueForEvents')
     ->inject('queueForMigrations')
-    ->action(function (string $bucketId, string $fileId, string $resourceId, bool $internalFile, Response $response, Database $dbForProject, Database $dbForPlatform, Document $project, Device $deviceForFiles, Device $deviceForImports, Event $queueForEvents, Migration $queueForMigrations) {
-        $isAPIKey = Auth::isAppUser(Authorization::getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles());
-        if ($internalFile && !$isPrivilegedUser) {
-            throw new Exception(Exception::USER_UNAUTHORIZED);
-        }
-        $bucket = Authorization::skip(function () use ($internalFile, $dbForPlatform, $dbForProject, $bucketId) {
+    ->action(function (
+        string $bucketId,
+        string $fileId,
+        string $resourceId,
+        bool $internalFile,
+        Response $response,
+        Database $dbForProject,
+        Database $dbForPlatform,
+        Authorization $authorization,
+        Document $project,
+        array $platform,
+        Device $deviceForFiles,
+        Device $deviceForMigrations,
+        Event $queueForEvents,
+        Migration $queueForMigrations
+    ) {
+        $bucket = $authorization->skip(function () use ($internalFile, $dbForPlatform, $dbForProject, $bucketId) {
             if ($internalFile) {
                 return $dbForPlatform->getDocument('buckets', 'default');
             }
             return $dbForProject->getDocument('buckets', $bucketId);
         });
 
-        if ($bucket->isEmpty() || (!$isAPIKey && !$isPrivilegedUser)) {
+        if ($bucket->isEmpty()) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
         }
 
-        $file = Authorization::skip(fn () => $internalFile ? $dbForPlatform->getDocument('bucket_' . $bucket->getSequence(), $fileId) : $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+        $file = $authorization->skip(fn () => $internalFile ? $dbForPlatform->getDocument('bucket_' . $bucket->getSequence(), $fileId) : $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
         if ($file->isEmpty()) {
             throw new Exception(Exception::STORAGE_FILE_NOT_FOUND);
         }
@@ -365,18 +386,17 @@ App::post('/v1/migrations/csv')
             throw new Exception(Exception::STORAGE_FILE_NOT_FOUND, 'File not found in ' . $path);
         }
 
-        // no encryption, compression on files above 20MB.
+        // No encryption or compression on files above 20MB.
         $hasEncryption = !empty($file->getAttribute('openSSLCipher'));
         $compression = $file->getAttribute('algorithm', Compression::NONE);
         $hasCompression = $compression !== Compression::NONE;
 
         $migrationId = ID::unique();
-        $newPath = $deviceForImports->getPath($migrationId . '_' . $fileId . '.csv');
+        $newPath = $deviceForMigrations->getPath($migrationId . '_' . $fileId . '.csv');
 
         if ($hasEncryption || $hasCompression) {
             $source = $deviceForFiles->read($path);
 
-            // 1. decrypt
             if ($hasEncryption) {
                 $source = OpenSSL::decrypt(
                     $source,
@@ -388,7 +408,6 @@ App::post('/v1/migrations/csv')
                 );
             }
 
-            // 2. decompress
             if ($hasCompression) {
                 switch ($compression) {
                     case Compression::ZSTD:
@@ -400,15 +419,15 @@ App::post('/v1/migrations/csv')
                 }
             }
 
-            // manual write after decryption and/or decompression
-            if (! $deviceForImports->write($newPath, $source, 'text/csv')) {
-                throw new \Exception("Unable to copy file");
+            // Manual write after decryption and/or decompression
+            if (!$deviceForMigrations->write($newPath, $source, 'text/csv')) {
+                throw new \Exception('Unable to copy file');
             }
-        } elseif (! $deviceForFiles->transfer($path, $newPath, $deviceForImports)) {
-            throw new \Exception("Unable to copy file");
+        } elseif (!$deviceForFiles->transfer($path, $newPath, $deviceForMigrations)) {
+            throw new \Exception('Unable to copy file');
         }
 
-        $fileSize = $deviceForImports->getFileSize($newPath);
+        $fileSize = $deviceForMigrations->getFileSize($newPath);
         $resources = Transfer::extractServices([Transfer::GROUP_DATABASES]);
 
         $migration = $dbForProject->createDocument('migrations', new Document([
@@ -434,6 +453,142 @@ App::post('/v1/migrations/csv')
         $queueForMigrations
             ->setMigration($migration)
             ->setProject($project)
+            ->setProject($project)
+            ->trigger();
+
+        $response
+            ->setStatusCode(Response::STATUS_CODE_ACCEPTED)
+            ->dynamic($migration, Response::MODEL_MIGRATION);
+    });
+
+App::post('/v1/migrations/csv/exports')
+    ->groups(['api', 'migrations'])
+    ->desc('Export documents to CSV')
+    ->label('scope', 'migrations.write')
+    ->label('event', 'migrations.[migrationId].create')
+    ->label('audits.event', 'migration.create')
+    ->label('sdk', new Method(
+        namespace: 'migrations',
+        group: null,
+        name: 'createCSVExport',
+        description: '/docs/references/migrations/migration-csv-export.md',
+        auth: [AuthType::ADMIN],
+        responses: [
+            new SDKResponse(
+                code: Response::STATUS_CODE_ACCEPTED,
+                model: Response::MODEL_MIGRATION,
+            )
+        ]
+    ))
+    ->param('resourceId', null, new CompoundUID(), 'Composite ID in the format {databaseId:collectionId}, identifying a collection within a database to export.')
+    ->param('filename', '', new Text(255), 'The name of the file to be created for the export, excluding the .csv extension.')
+    ->param('columns', [], new ArrayList(new Text(Database::LENGTH_KEY)), 'List of attributes to export. If empty, all attributes will be exported. You can use the `*` wildcard to export all attributes from the collection.', true)
+    ->param('queries', [], new ArrayList(new Text(0)), 'Array of query strings generated using the Query class provided by the SDK to filter documents to export. [Learn more about queries](https://appwrite.io/docs/databases#querying-documents). Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' queries are allowed, each ' . APP_LIMIT_ARRAY_ELEMENT_SIZE . ' characters long.', true)
+    ->param('delimiter', ',', new Text(1), 'The character that separates each column value. Default is comma.', true)
+    ->param('enclosure', '"', new Text(1), 'The character that encloses each column value. Default is double quotes.', true)
+    ->param('escape', '"', new Text(1), 'The escape character for the enclosure character. Default is double quotes.', true)
+    ->param('header', true, new Boolean(), 'Whether to include the header row with column names. Default is true.', true)
+    ->param('notify', true, new Boolean(), 'Set to true to receive an email when the export is complete. Default is true.', true)
+    ->inject('user')
+    ->inject('response')
+    ->inject('dbForProject')
+    ->inject('dbForPlatform')
+    ->inject('authorization')
+    ->inject('project')
+    ->inject('platform')
+    ->inject('queueForEvents')
+    ->inject('queueForMigrations')
+    ->action(function (
+        string $resourceId,
+        string $filename,
+        array $columns,
+        array $queries,
+        string $delimiter,
+        string $enclosure,
+        string $escape,
+        bool $header,
+        bool $notify,
+        Document $user,
+        Response $response,
+        Database $dbForProject,
+        Database $dbForPlatform,
+        Authorization $authorization,
+        Document $project,
+        array $platform,
+        Event $queueForEvents,
+        Migration $queueForMigrations
+    ) {
+        try {
+            $parsedQueries = Query::parseQueries($queries);
+        } catch (QueryException $e) {
+            throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
+        }
+
+        $bucket = $authorization->skip(fn () => $dbForPlatform->getDocument('buckets', 'default'));
+        if ($bucket->isEmpty()) {
+            throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
+        }
+
+        [$databaseId, $collectionId] = \explode(':', $resourceId, 2);
+        if (empty($databaseId)) {
+            throw new Exception(Exception::DATABASE_NOT_FOUND);
+        }
+        if (empty($collectionId)) {
+            throw new Exception(Exception::COLLECTION_NOT_FOUND);
+        }
+
+        $database = $authorization->skip(fn () => $dbForProject->getDocument('databases', $databaseId));
+        if ($database->isEmpty()) {
+            throw new Exception(Exception::DATABASE_NOT_FOUND);
+        }
+
+        $collection = $authorization->skip(fn () => $dbForProject->getDocument('database_' . $database->getSequence(), $collectionId));
+        if ($collection->isEmpty()) {
+            throw new Exception(Exception::COLLECTION_NOT_FOUND);
+        }
+
+        $validator = new Documents(
+            attributes: $collection->getAttribute('attributes', []),
+            indexes: $collection->getAttribute('indexes', []),
+            idAttributeType: $dbForProject->getAdapter()->getIdAttributeType(),
+        );
+
+        if (!$validator->isValid($parsedQueries)) {
+            throw new Exception(Exception::GENERAL_QUERY_INVALID, $validator->getDescription());
+        }
+
+        $migration = $dbForProject->createDocument('migrations', new Document([
+            '$id' => ID::unique(),
+            'status' => 'pending',
+            'stage' => 'init',
+            'source' => Appwrite::getName(),
+            'destination' => CSV::getName(),
+            'resources' => Transfer::extractServices([Transfer::GROUP_DATABASES]),
+            'resourceId' => $resourceId,
+            'resourceType' => Resource::TYPE_DATABASE,
+            'statusCounters' => '{}',
+            'resourceData' => '{}',
+            'errors' => [],
+            'options' => [
+                'bucketId' => 'default', // Always use internal bucket
+                'filename' => $filename,
+                'columns' => $columns,
+                'queries' => $queries,
+                'delimiter' => $delimiter,
+                'enclosure' => $enclosure,
+                'escape' => $escape,
+                'header' => $header,
+                'notify' => $notify,
+                'userInternalId' => $user->getSequence(),
+            ],
+        ]));
+
+        $queueForEvents->setParam('migrationId', $migration->getId());
+
+        $queueForMigrations
+            ->setMigration($migration)
+            ->setProject($project)
+            ->setPlatform($platform)
             ->trigger();
 
         $response
@@ -460,9 +615,10 @@ App::get('/v1/migrations')
     ))
     ->param('queries', [], new Migrations(), 'Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/databases#querying-documents). Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' queries are allowed, each ' . APP_LIMIT_ARRAY_ELEMENT_SIZE . ' characters long. You may filter on the following attributes: ' . implode(', ', Migrations::ALLOWED_ATTRIBUTES), true)
     ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
+    ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
     ->inject('response')
     ->inject('dbForProject')
-    ->action(function (array $queries, string $search, Response $response, Database $dbForProject) {
+    ->action(function (array $queries, string $search, bool $includeTotal, Response $response, Database $dbForProject) {
         try {
             $queries = Query::parseQueries($queries);
         } catch (QueryException $e) {
@@ -501,7 +657,7 @@ App::get('/v1/migrations')
         $filterQueries = Query::groupByType($queries)['filters'];
         try {
             $migrations = $dbForProject->find('migrations', $queries);
-            $total = $dbForProject->count('migrations', $filterQueries, APP_LIMIT_COUNT);
+            $total = $includeTotal ? $dbForProject->count('migrations', $filterQueries, APP_LIMIT_COUNT) : 0;
         } catch (OrderException $e) {
             throw new Exception(Exception::DATABASE_QUERY_ORDER_NULL, "The order attribute '{$e->getAttribute()}' had a null value. Cursor pagination requires all documents order attribute values are non-null.");
         }
@@ -765,9 +921,10 @@ App::patch('/v1/migrations/:migrationId')
     ->inject('response')
     ->inject('dbForProject')
     ->inject('project')
+    ->inject('platform')
     ->inject('user')
     ->inject('queueForMigrations')
-    ->action(function (string $migrationId, Response $response, Database $dbForProject, Document $project, Document $user, Migration $queueForMigrations) {
+    ->action(function (string $migrationId, Response $response, Database $dbForProject, Document $project, array $platform, Document $user, Migration $queueForMigrations) {
         $migration = $dbForProject->getDocument('migrations', $migrationId);
 
         if ($migration->isEmpty()) {
@@ -786,6 +943,7 @@ App::patch('/v1/migrations/:migrationId')
         $queueForMigrations
             ->setMigration($migration)
             ->setProject($project)
+            ->setPlatform($platform)
             ->setUser($user)
             ->trigger();
 

app/controllers/api/project.php

@@ -18,6 +18,7 @@ use Utopia\Database\Validator\Authorization;
 use Utopia\Database\Validator\Datetime as DateTimeValidator;
 use Utopia\Database\Validator\UID;
 use Utopia\Validator\Boolean;
+use Utopia\Validator\Nullable;
 use Utopia\Validator\Text;
 use Utopia\Validator\WhiteList;
 
@@ -44,9 +45,10 @@ App::get('/v1/project/usage')
     ->inject('response')
     ->inject('project')
     ->inject('dbForProject')
+    ->inject('authorization')
     ->inject('getLogsDB')
     ->inject('smsRates')
-    ->action(function (string $startDate, string $endDate, string $period, Response $response, Document $project, Database $dbForProject, callable $getLogsDB, array $smsRates) {
+    ->action(function (string $startDate, string $endDate, string $period, Response $response, Document $project, Database $dbForProject, Authorization $authorization, callable $getLogsDB, array $smsRates) {
         $stats = $total = $usage = [];
         $format = 'Y-m-d 00:00:00';
         $firstDay = (new DateTime($startDate))->format($format);
@@ -101,7 +103,7 @@ App::get('/v1/project/usage')
             '1d' => 'Y-m-d\T00:00:00.000P',
         };
 
-        Authorization::skip(function () use ($dbForProject, $dbForLogs, $firstDay, $lastDay, $period, $metrics, $limit, &$total, &$stats) {
+        $authorization->skip(function () use ($dbForProject, $dbForLogs, $firstDay, $lastDay, $period, $metrics, $limit, &$total, &$stats) {
             foreach ($metrics['total'] as $metric) {
                 $db = ($metric === METRIC_FILES_IMAGES_TRANSFORMED) ? $dbForLogs : $dbForProject;
 
@@ -285,7 +287,7 @@ App::get('/v1/project/usage')
         }, $dbForProject->find('functions'));
 
         // This total is includes free and paid SMS usage
-        $authPhoneTotal = Authorization::skip(fn () => $dbForProject->sum('stats', 'value', [
+        $authPhoneTotal = $authorization->skip(fn () => $dbForProject->sum('stats', 'value', [
             Query::equal('metric', [METRIC_AUTH_METHOD_PHONE]),
             Query::equal('period', ['1d']),
             Query::greaterThanEqual('time', $firstDay),
@@ -293,7 +295,7 @@ App::get('/v1/project/usage')
         ]));
 
         // This estimate is only for paid SMS usage
-        $authPhoneMetrics = Authorization::skip(fn () => $dbForProject->find('stats', [
+        $authPhoneMetrics = $authorization->skip(fn () => $dbForProject->find('stats', [
             Query::startsWith('metric', METRIC_AUTH_METHOD_PHONE . '.'),
             Query::equal('period', ['1d']),
             Query::greaterThanEqual('time', $firstDay),
@@ -526,8 +528,8 @@ App::put('/v1/project/variables/:variableId')
     ))
     ->param('variableId', '', new UID(), 'Variable unique ID.', false)
     ->param('key', null, new Text(255), 'Variable key. Max length: 255 chars.', false)
-    ->param('value', null, new Text(8192, 0), 'Variable value. Max length: 8192 chars.', true)
-    ->param('secret', null, new Boolean(), 'Secret variables can be updated or deleted, but only projects can read them during build and runtime.', true)
+    ->param('value', null, new Nullable(new Text(8192, 0)), 'Variable value. Max length: 8192 chars.', true)
+    ->param('secret', null, new Nullable(new Boolean()), 'Secret variables can be updated or deleted, but only projects can read them during build and runtime.', true)
     ->inject('project')
     ->inject('response')
     ->inject('dbForProject')

app/controllers/api/projects.php

@@ -1,7 +1,6 @@
 <?php
 
 use Ahc\Jwt\JWT;
-use Appwrite\Auth\Auth;
 use Appwrite\Auth\Validator\MockNumber;
 use Appwrite\Event\Delete;
 use Appwrite\Event\Mail;
@@ -46,6 +45,7 @@ use Utopia\Validator\Boolean;
 use Utopia\Validator\Hostname;
 use Utopia\Validator\Integer;
 use Utopia\Validator\Multiple;
+use Utopia\Validator\Nullable;
 use Utopia\Validator\Range;
 use Utopia\Validator\Text;
 use Utopia\Validator\URL;
@@ -118,7 +118,7 @@ App::post('/v1/projects')
             'maxSessions' => APP_LIMIT_USER_SESSIONS_DEFAULT,
             'passwordHistory' => 0,
             'passwordDictionary' => false,
-            'duration' => Auth::TOKEN_EXPIRATION_LOGIN_LONG,
+            'duration' => TOKEN_EXPIRATION_LOGIN_LONG,
             'personalDataCheck' => false,
             'mockNumbers' => [],
             'sessionAlerts' => false,
@@ -563,6 +563,7 @@ App::patch('/v1/projects/:projectId/api')
                 since: '1.8.0',
                 replaceWith: 'projects.updateAPIStatus',
             ),
+            public: false,
         ),
         new Method(
             namespace: 'projects',
@@ -620,6 +621,7 @@ App::patch('/v1/projects/:projectId/api/all')
                 since: '1.8.0',
                 replaceWith: 'projects.updateAPIStatusAll',
             ),
+            public: false,
         ),
         new Method(
             namespace: 'projects',
@@ -678,9 +680,9 @@ App::patch('/v1/projects/:projectId/oauth2')
     ))
     ->param('projectId', '', new UID(), 'Project unique ID.')
     ->param('provider', '', new WhiteList(\array_keys(Config::getParam('oAuthProviders')), true), 'Provider Name')
-    ->param('appId', null, new Text(256), 'Provider app ID. Max length: 256 chars.', true)
-    ->param('secret', null, new text(512), 'Provider secret key. Max length: 512 chars.', true)
-    ->param('enabled', null, new Boolean(), 'Provider status. Set to \'false\' to disable new session creation.', true)
+    ->param('appId', null, new Nullable(new Text(256)), 'Provider app ID. Max length: 256 chars.', true)
+    ->param('secret', null, new Nullable(new text(512)), 'Provider secret key. Max length: 512 chars.', true)
+    ->param('enabled', null, new Nullable(new Boolean()), 'Provider status. Set to \'false\' to disable new session creation.', true)
     ->inject('response')
     ->inject('dbForPlatform')
     ->action(function (string $projectId, string $provider, ?string $appId, ?string $secret, ?bool $enabled, Response $response, Database $dbForPlatform) {
@@ -1234,9 +1236,10 @@ App::get('/v1/projects/:projectId/webhooks')
         ]
     ))
     ->param('projectId', '', new UID(), 'Project unique ID.')
+    ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
     ->inject('response')
     ->inject('dbForPlatform')
-    ->action(function (string $projectId, Response $response, Database $dbForPlatform) {
+    ->action(function (string $projectId, bool $includeTotal, Response $response, Database $dbForPlatform) {
 
         $project = $dbForPlatform->getDocument('projects', $projectId);
 
@@ -1251,7 +1254,7 @@ App::get('/v1/projects/:projectId/webhooks')
 
         $response->dynamic(new Document([
             'webhooks' => $webhooks,
-            'total' => count($webhooks),
+            'total' => $includeTotal ? count($webhooks) : 0,
         ]), Response::MODEL_WEBHOOK_LIST);
     });
 
@@ -1475,8 +1478,8 @@ App::post('/v1/projects/:projectId/keys')
     ))
     ->param('projectId', '', new UID(), 'Project unique ID.')
     ->param('name', null, new Text(128), 'Key name. Max length: 128 chars.')
-    ->param('scopes', null, new ArrayList(new WhiteList(array_keys(Config::getParam('scopes')), true), APP_LIMIT_ARRAY_PARAMS_SIZE), 'Key scopes list. Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' scopes are allowed.')
-    ->param('expire', null, new DatetimeValidator(), 'Expiration time in [ISO 8601](https://www.iso.org/iso-8601-date-and-time-format.html) format. Use null for unlimited expiration.', true)
+    ->param('scopes', null, new Nullable(new ArrayList(new WhiteList(array_keys(Config::getParam('scopes')), true), APP_LIMIT_ARRAY_PARAMS_SIZE)), 'Key scopes list. Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' scopes are allowed.')
+    ->param('expire', null, new Nullable(new DatetimeValidator()), 'Expiration time in [ISO 8601](https://www.iso.org/iso-8601-date-and-time-format.html) format. Use null for unlimited expiration.', true)
     ->inject('response')
     ->inject('dbForPlatform')
     ->action(function (string $projectId, string $name, array $scopes, ?string $expire, Response $response, Database $dbForPlatform) {
@@ -1531,9 +1534,10 @@ App::get('/v1/projects/:projectId/keys')
         ]
     ))
     ->param('projectId', '', new UID(), 'Project unique ID.')
+    ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
     ->inject('response')
     ->inject('dbForPlatform')
-    ->action(function (string $projectId, Response $response, Database $dbForPlatform) {
+    ->action(function (string $projectId, bool $includeTotal, Response $response, Database $dbForPlatform) {
 
         $project = $dbForPlatform->getDocument('projects', $projectId);
 
@@ -1548,7 +1552,7 @@ App::get('/v1/projects/:projectId/keys')
 
         $response->dynamic(new Document([
             'keys' => $keys,
-            'total' => count($keys),
+            'total' => $includeTotal ? count($keys) : 0,
         ]), Response::MODEL_KEY_LIST);
     });
 
@@ -1613,8 +1617,8 @@ App::put('/v1/projects/:projectId/keys/:keyId')
     ->param('projectId', '', new UID(), 'Project unique ID.')
     ->param('keyId', '', new UID(), 'Key unique ID.')
     ->param('name', null, new Text(128), 'Key name. Max length: 128 chars.')
-    ->param('scopes', null, new ArrayList(new WhiteList(array_keys(Config::getParam('scopes')), true), APP_LIMIT_ARRAY_PARAMS_SIZE), 'Key scopes list. Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' events are allowed.')
-    ->param('expire', null, new DatetimeValidator(), 'Expiration time in [ISO 8601](https://www.iso.org/iso-8601-date-and-time-format.html) format. Use null for unlimited expiration.', true)
+    ->param('scopes', null, new Nullable(new ArrayList(new WhiteList(array_keys(Config::getParam('scopes')), true), APP_LIMIT_ARRAY_PARAMS_SIZE)), 'Key scopes list. Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' events are allowed.')
+    ->param('expire', null, new Nullable(new DatetimeValidator()), 'Expiration time in [ISO 8601](https://www.iso.org/iso-8601-date-and-time-format.html) format. Use null for unlimited expiration.', true)
     ->inject('response')
     ->inject('dbForPlatform')
     ->action(function (string $projectId, string $keyId, string $name, array $scopes, ?string $expire, Response $response, Database $dbForPlatform) {
@@ -1756,7 +1760,28 @@ App::post('/v1/projects/:projectId/platforms')
         ]
     ))
     ->param('projectId', '', new UID(), 'Project unique ID.')
-    ->param('type', null, new WhiteList([Platform::TYPE_WEB, Platform::TYPE_FLUTTER_WEB, Platform::TYPE_FLUTTER_IOS, Platform::TYPE_FLUTTER_ANDROID, Platform::TYPE_FLUTTER_LINUX, Platform::TYPE_FLUTTER_MACOS, Platform::TYPE_FLUTTER_WINDOWS, Platform::TYPE_APPLE_IOS, Platform::TYPE_APPLE_MACOS,  Platform::TYPE_APPLE_WATCHOS, Platform::TYPE_APPLE_TVOS, Platform::TYPE_ANDROID, Platform::TYPE_UNITY, Platform::TYPE_REACT_NATIVE_IOS, Platform::TYPE_REACT_NATIVE_ANDROID], true), 'Platform type.')
+    ->param(
+        'type',
+        null,
+        new WhiteList([
+            Platform::TYPE_WEB,
+            Platform::TYPE_FLUTTER_WEB,
+            Platform::TYPE_FLUTTER_IOS,
+            Platform::TYPE_FLUTTER_ANDROID,
+            Platform::TYPE_FLUTTER_LINUX,
+            Platform::TYPE_FLUTTER_MACOS,
+            Platform::TYPE_FLUTTER_WINDOWS,
+            Platform::TYPE_APPLE_IOS,
+            Platform::TYPE_APPLE_MACOS,
+            Platform::TYPE_APPLE_WATCHOS,
+            Platform::TYPE_APPLE_TVOS,
+            Platform::TYPE_ANDROID,
+            Platform::TYPE_UNITY,
+            Platform::TYPE_REACT_NATIVE_IOS,
+            Platform::TYPE_REACT_NATIVE_ANDROID,
+        ], true),
+        'Platform type. Possible values are: web, flutter-web, flutter-ios, flutter-android, flutter-linux, flutter-macos, flutter-windows, apple-ios, apple-macos, apple-watchos, apple-tvos, android, unity, react-native-ios, react-native-android.'
+    )
     ->param('name', null, new Text(128), 'Platform name. Max length: 128 chars.')
     ->param('key', '', new Text(256), 'Package name for Android or bundle ID for iOS or macOS. Max length: 256 chars.', true)
     ->param('store', '', new Text(256), 'App store or Google Play store ID. Max length: 256 chars.', true)
@@ -1813,9 +1838,10 @@ App::get('/v1/projects/:projectId/platforms')
         ]
     ))
     ->param('projectId', '', new UID(), 'Project unique ID.')
+    ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
     ->inject('response')
     ->inject('dbForPlatform')
-    ->action(function (string $projectId, Response $response, Database $dbForPlatform) {
+    ->action(function (string $projectId, bool $includeTotal, Response $response, Database $dbForPlatform) {
 
         $project = $dbForPlatform->getDocument('projects', $projectId);
 
@@ -1830,7 +1856,7 @@ App::get('/v1/projects/:projectId/platforms')
 
         $response->dynamic(new Document([
             'platforms' => $platforms,
-            'total' => count($platforms),
+            'total' => $includeTotal ? count($platforms) : 0,
         ]), Response::MODEL_PLATFORM_LIST);
     });
 
@@ -2000,6 +2026,7 @@ App::patch('/v1/projects/:projectId/smtp')
                 since: '1.8.0',
                 replaceWith: 'projects.updateSMTP',
             ),
+            public: false,
         ),
         new Method(
             namespace: 'projects',
@@ -2116,6 +2143,7 @@ App::post('/v1/projects/:projectId/smtp/tests')
                 since: '1.8.0',
                 replaceWith: 'projects.createSMTPTest',
             ),
+            public: false,
         ),
         new Method(
             namespace: 'projects',
@@ -2210,6 +2238,7 @@ App::get('/v1/projects/:projectId/templates/sms/:type/:locale')
                 since: '1.8.0',
                 replaceWith: 'projects.getSMSTemplate',
             ),
+            public: false,
         ),
         new Method(
             namespace: 'projects',
@@ -2376,6 +2405,7 @@ App::patch('/v1/projects/:projectId/templates/sms/:type/:locale')
                 since: '1.8.0',
                 replaceWith: 'projects.updateSMSTemplate',
             ),
+            public: false,
         ),
         new Method(
             namespace: 'projects',
@@ -2500,6 +2530,7 @@ App::delete('/v1/projects/:projectId/templates/sms/:type/:locale')
                 since: '1.8.0',
                 replaceWith: 'projects.deleteSMSTemplate',
             ),
+            public: false,
         ),
         new Method(
             namespace: 'projects',

app/controllers/api/storage.php

@@ -2,7 +2,6 @@
 
 use Ahc\Jwt\JWT;
 use Ahc\Jwt\JWTException;
-use Appwrite\Auth\Auth;
 use Appwrite\ClamAV\Network;
 use Appwrite\Event\Delete;
 use Appwrite\Event\Event;
@@ -13,6 +12,7 @@ use Appwrite\SDK\ContentType;
 use Appwrite\SDK\Method;
 use Appwrite\SDK\MethodType;
 use Appwrite\SDK\Response as SDKResponse;
+use Appwrite\Utopia\Database\Documents\User;
 use Appwrite\Utopia\Database\Validator\CustomId;
 use Appwrite\Utopia\Database\Validator\Queries\Buckets;
 use Appwrite\Utopia\Database\Validator\Queries\Files;
@@ -32,6 +32,7 @@ use Utopia\Database\Helpers\Permission;
 use Utopia\Database\Helpers\Role;
 use Utopia\Database\Query;
 use Utopia\Database\Validator\Authorization;
+use Utopia\Database\Validator\Authorization\Input;
 use Utopia\Database\Validator\Permissions;
 use Utopia\Database\Validator\Query\Cursor;
 use Utopia\Database\Validator\UID;
@@ -50,6 +51,7 @@ use Utopia\System\System;
 use Utopia\Validator\ArrayList;
 use Utopia\Validator\Boolean;
 use Utopia\Validator\HexColor;
+use Utopia\Validator\Nullable;
 use Utopia\Validator\Range;
 use Utopia\Validator\Text;
 use Utopia\Validator\WhiteList;
@@ -67,7 +69,7 @@ App::post('/v1/storage/buckets')
         group: 'buckets',
         name: 'createBucket',
         description: '/docs/references/storage/create-bucket.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_CREATED,
@@ -77,7 +79,7 @@ App::post('/v1/storage/buckets')
     ))
     ->param('bucketId', '', new CustomId(), 'Unique Id. Choose a custom ID or generate a random ID with `ID.unique()`. Valid chars are a-z, A-Z, 0-9, period, hyphen, and underscore. Can\'t start with a special char. Max length is 36 chars.')
     ->param('name', '', new Text(128), 'Bucket name')
-    ->param('permissions', null, new Permissions(APP_LIMIT_ARRAY_PARAMS_SIZE), 'An array of permission strings. By default, no user is granted with any permissions. [Learn more about permissions](https://appwrite.io/docs/permissions).', true)
+    ->param('permissions', null, new Nullable(new Permissions(APP_LIMIT_ARRAY_PARAMS_SIZE)), 'An array of permission strings. By default, no user is granted with any permissions. [Learn more about permissions](https://appwrite.io/docs/permissions).', true)
     ->param('fileSecurity', false, new Boolean(true), 'Enables configuring permissions for individual file. A user needs one of file or bucket level permissions to access a file. [Learn more about permissions](https://appwrite.io/docs/permissions).', true)
     ->param('enabled', true, new Boolean(true), 'Is bucket enabled? When set to \'disabled\', users cannot access the files in this bucket but Server SDKs with and API key can still access the bucket. No files are lost when this is toggled.', true)
     ->param('maximumFileSize', fn (array $plan) => empty($plan['fileSize']) ? (int) System::getEnv('_APP_STORAGE_LIMIT', 0) : $plan['fileSize'] * 1000 * 1000, fn (array $plan) => new Range(1, empty($plan['fileSize']) ? (int) System::getEnv('_APP_STORAGE_LIMIT', 0) : $plan['fileSize'] * 1000 * 1000), 'Maximum file size allowed in bytes. Maximum allowed value is ' . Storage::human(System::getEnv('_APP_STORAGE_LIMIT', 0), 0) . '.', true, ['plan'])
@@ -85,10 +87,11 @@ App::post('/v1/storage/buckets')
     ->param('compression', Compression::NONE, new WhiteList([Compression::NONE, Compression::GZIP, Compression::ZSTD], true), 'Compression algorithm choosen for compression. Can be one of ' . Compression::NONE . ',  [' . Compression::GZIP . '](https://en.wikipedia.org/wiki/Gzip), or [' . Compression::ZSTD . '](https://en.wikipedia.org/wiki/Zstd), For file size above ' . Storage::human(APP_STORAGE_READ_BUFFER, 0) . ' compression is skipped even if it\'s enabled', true)
     ->param('encryption', true, new Boolean(true), 'Is encryption enabled? For file size above ' . Storage::human(APP_STORAGE_READ_BUFFER, 0) . ' encryption is skipped even if it\'s enabled', true)
     ->param('antivirus', true, new Boolean(true), 'Is virus scanning enabled? For file size above ' . Storage::human(APP_LIMIT_ANTIVIRUS, 0) . ' AntiVirus scanning is skipped even if it\'s enabled', true)
+    ->param('transformations', true, new Boolean(true), 'Are image transformations enabled?', true)
     ->inject('response')
     ->inject('dbForProject')
     ->inject('queueForEvents')
-    ->action(function (string $bucketId, string $name, ?array $permissions, bool $fileSecurity, bool $enabled, int $maximumFileSize, array $allowedFileExtensions, ?string $compression, ?bool $encryption, bool $antivirus, Response $response, Database $dbForProject, Event $queueForEvents) {
+    ->action(function (string $bucketId, string $name, ?array $permissions, bool $fileSecurity, bool $enabled, int $maximumFileSize, array $allowedFileExtensions, ?string $compression, ?bool $encryption, bool $antivirus, bool $transformations, Response $response, Database $dbForProject, Event $queueForEvents) {
 
         $bucketId = $bucketId === 'unique()' ? ID::unique() : $bucketId;
 
@@ -141,6 +144,7 @@ App::post('/v1/storage/buckets')
                 'compression' => $compression,
                 'encryption' => $encryption,
                 'antivirus' => $antivirus,
+                'transformations' => $transformations,
                 'search' => implode(' ', [$bucketId, $name]),
             ]));
 
@@ -170,7 +174,7 @@ App::get('/v1/storage/buckets')
         group: 'buckets',
         name: 'listBuckets',
         description: '/docs/references/storage/list-buckets.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -180,9 +184,10 @@ App::get('/v1/storage/buckets')
     ))
     ->param('queries', [], new Buckets(), 'Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/queries). Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' queries are allowed, each ' . APP_LIMIT_ARRAY_ELEMENT_SIZE . ' characters long. You may filter on the following attributes: ' . implode(', ', Buckets::ALLOWED_ATTRIBUTES), true)
     ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
+    ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
     ->inject('response')
     ->inject('dbForProject')
-    ->action(function (array $queries, string $search, Response $response, Database $dbForProject) {
+    ->action(function (array $queries, string $search, bool $includeTotal, Response $response, Database $dbForProject) {
 
         try {
             $queries = Query::parseQueries($queries);
@@ -222,7 +227,7 @@ App::get('/v1/storage/buckets')
         $filterQueries = Query::groupByType($queries)['filters'];
         try {
             $buckets = $dbForProject->find('buckets', $queries);
-            $total = $dbForProject->count('buckets', $filterQueries, APP_LIMIT_COUNT);
+            $total = $includeTotal ? $dbForProject->count('buckets', $filterQueries, APP_LIMIT_COUNT) : 0;
         } catch (OrderException $e) {
             throw new Exception(Exception::DATABASE_QUERY_ORDER_NULL, "The order attribute '{$e->getAttribute()}' had a null value. Cursor pagination requires all documents order attribute values are non-null.");
         } catch (QueryException $e) {
@@ -244,7 +249,7 @@ App::get('/v1/storage/buckets/:bucketId')
         group: 'buckets',
         name: 'getBucket',
         description: '/docs/references/storage/get-bucket.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -279,7 +284,7 @@ App::put('/v1/storage/buckets/:bucketId')
         group: 'buckets',
         name: 'updateBucket',
         description: '/docs/references/storage/update-bucket.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -289,7 +294,7 @@ App::put('/v1/storage/buckets/:bucketId')
     ))
     ->param('bucketId', '', new UID(), 'Bucket unique ID.')
     ->param('name', null, new Text(128), 'Bucket name', false)
-    ->param('permissions', null, new Permissions(APP_LIMIT_ARRAY_PARAMS_SIZE), 'An array of permission strings. By default, the current permissions are inherited. [Learn more about permissions](https://appwrite.io/docs/permissions).', true)
+    ->param('permissions', null, new Nullable(new Permissions(APP_LIMIT_ARRAY_PARAMS_SIZE)), 'An array of permission strings. By default, the current permissions are inherited. [Learn more about permissions](https://appwrite.io/docs/permissions).', true)
     ->param('fileSecurity', false, new Boolean(true), 'Enables configuring permissions for individual file. A user needs one of file or bucket level permissions to access a file. [Learn more about permissions](https://appwrite.io/docs/permissions).', true)
     ->param('enabled', true, new Boolean(true), 'Is bucket enabled? When set to \'disabled\', users cannot access the files in this bucket but Server SDKs with and API key can still access the bucket. No files are lost when this is toggled.', true)
     ->param('maximumFileSize', fn (array $plan) => empty($plan['fileSize']) ? (int) System::getEnv('_APP_STORAGE_LIMIT', 0) : $plan['fileSize'] * 1000 * 1000, fn (array $plan) => new Range(1, empty($plan['fileSize']) ? (int) System::getEnv('_APP_STORAGE_LIMIT', 0) : $plan['fileSize'] * 1000 * 1000), 'Maximum file size allowed in bytes. Maximum allowed value is ' . Storage::human(System::getEnv('_APP_STORAGE_LIMIT', 0), 0) . '.', true, ['plan'])
@@ -297,10 +302,11 @@ App::put('/v1/storage/buckets/:bucketId')
     ->param('compression', Compression::NONE, new WhiteList([Compression::NONE, Compression::GZIP, Compression::ZSTD], true), 'Compression algorithm choosen for compression. Can be one of ' . Compression::NONE . ', [' . Compression::GZIP . '](https://en.wikipedia.org/wiki/Gzip), or [' . Compression::ZSTD . '](https://en.wikipedia.org/wiki/Zstd), For file size above ' . Storage::human(APP_STORAGE_READ_BUFFER, 0) . ' compression is skipped even if it\'s enabled', true)
     ->param('encryption', true, new Boolean(true), 'Is encryption enabled? For file size above ' . Storage::human(APP_STORAGE_READ_BUFFER, 0) . ' encryption is skipped even if it\'s enabled', true)
     ->param('antivirus', true, new Boolean(true), 'Is virus scanning enabled? For file size above ' . Storage::human(APP_LIMIT_ANTIVIRUS, 0) . ' AntiVirus scanning is skipped even if it\'s enabled', true)
+    ->param('transformations', true, new Boolean(true), 'Are image transformations enabled?', true)
     ->inject('response')
     ->inject('dbForProject')
     ->inject('queueForEvents')
-    ->action(function (string $bucketId, string $name, ?array $permissions, bool $fileSecurity, bool $enabled, ?int $maximumFileSize, array $allowedFileExtensions, ?string $compression, ?bool $encryption, bool $antivirus, Response $response, Database $dbForProject, Event $queueForEvents) {
+    ->action(function (string $bucketId, string $name, ?array $permissions, bool $fileSecurity, bool $enabled, ?int $maximumFileSize, array $allowedFileExtensions, ?string $compression, ?bool $encryption, bool $antivirus, bool $transformations, Response $response, Database $dbForProject, Event $queueForEvents) {
         $bucket = $dbForProject->getDocument('buckets', $bucketId);
 
         if ($bucket->isEmpty()) {
@@ -314,6 +320,7 @@ App::put('/v1/storage/buckets/:bucketId')
         $encryption ??= $bucket->getAttribute('encryption', true);
         $antivirus ??= $bucket->getAttribute('antivirus', true);
         $compression ??= $bucket->getAttribute('compression', Compression::NONE);
+        $transformations ??= $bucket->getAttribute('transformations', true);
 
         // Map aggregate permissions into the multiple permissions they represent.
         $permissions = Permission::aggregate($permissions);
@@ -327,7 +334,8 @@ App::put('/v1/storage/buckets/:bucketId')
             ->setAttribute('enabled', $enabled)
             ->setAttribute('encryption', $encryption)
             ->setAttribute('compression', $compression)
-            ->setAttribute('antivirus', $antivirus));
+            ->setAttribute('antivirus', $antivirus)
+            ->setAttribute('transformations', $transformations));
 
         $dbForProject->updateCollection('bucket_' . $bucket->getSequence(), $permissions, $fileSecurity);
 
@@ -350,7 +358,7 @@ App::delete('/v1/storage/buckets/:bucketId')
         group: 'buckets',
         name: 'deleteBucket',
         description: '/docs/references/storage/delete-bucket.md',
-        auth: [AuthType::KEY],
+        auth: [AuthType::ADMIN, AuthType::KEY],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_NOCONTENT,
@@ -404,7 +412,7 @@ App::post('/v1/storage/buckets/:bucketId/files')
         group: 'files',
         name: 'createFile',
         description: '/docs/references/storage/create-file.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_CREATED,
@@ -417,7 +425,7 @@ App::post('/v1/storage/buckets/:bucketId/files')
     ->param('bucketId', '', new UID(), 'Storage bucket unique ID. You can create a new storage bucket using the Storage service [server integration](https://appwrite.io/docs/server/storage#createBucket).')
     ->param('fileId', '', new CustomId(), 'File ID. Choose a custom ID or generate a random ID with `ID.unique()`. Valid chars are a-z, A-Z, 0-9, period, hyphen, and underscore. Can\'t start with a special char. Max length is 36 chars.')
     ->param('file', [], new File(), 'Binary file. Appwrite SDKs provide helpers to handle file input. [Learn about file input](https://appwrite.io/docs/products/storage/upload-download#input-file).', skipValidation: true)
-    ->param('permissions', null, new Permissions(APP_LIMIT_ARRAY_PARAMS_SIZE, [Database::PERMISSION_READ, Database::PERMISSION_UPDATE, Database::PERMISSION_DELETE, Database::PERMISSION_WRITE]), 'An array of permission strings. By default, only the current user is granted all permissions. [Learn more about permissions](https://appwrite.io/docs/permissions).', true)
+    ->param('permissions', null, new Nullable(new Permissions(APP_LIMIT_ARRAY_PARAMS_SIZE, [Database::PERMISSION_READ, Database::PERMISSION_UPDATE, Database::PERMISSION_DELETE, Database::PERMISSION_WRITE])), 'An array of permission strings. By default, only the current user is granted all permissions. [Learn more about permissions](https://appwrite.io/docs/permissions).', true)
     ->inject('request')
     ->inject('response')
     ->inject('dbForProject')
@@ -426,20 +434,20 @@ App::post('/v1/storage/buckets/:bucketId/files')
     ->inject('mode')
     ->inject('deviceForFiles')
     ->inject('deviceForLocal')
-    ->action(function (string $bucketId, string $fileId, mixed $file, ?array $permissions, Request $request, Response $response, Database $dbForProject, Document $user, Event $queueForEvents, string $mode, Device $deviceForFiles, Device $deviceForLocal) {
+    ->inject('authorization')
+    ->action(function (string $bucketId, string $fileId, mixed $file, ?array $permissions, Request $request, Response $response, Database $dbForProject, Document $user, Event $queueForEvents, string $mode, Device $deviceForFiles, Device $deviceForLocal, Authorization $authorization) {
 
-        $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+        $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = Auth::isAppUser(Authorization::getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles());
+        $isAPIKey = User::isApp($authorization->getRoles());
+        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
         }
 
-        $validator = new Authorization(Database::PERMISSION_CREATE);
-        if (!$validator->isValid($bucket->getCreate())) {
-            throw new Exception(Exception::USER_UNAUTHORIZED);
+        if (!$authorization->isValid(new Input(Database::PERMISSION_CREATE, $bucket->getCreate()))) {
+            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
         }
 
         $allowedPermissions = [
@@ -462,8 +470,8 @@ App::post('/v1/storage/buckets/:bucketId/files')
         }
 
         // Users can only manage their own roles, API keys and Admin users can manage any
-        $roles = Authorization::getRoles();
-        if (!Auth::isAppUser($roles) && !Auth::isPrivilegedUser($roles)) {
+        $roles = $authorization->getRoles();
+        if (!User::isApp($roles) && !User::isPrivileged($roles)) {
             foreach (Database::PERMISSIONS as $type) {
                 foreach ($permissions as $permission) {
                     $permission = Permission::parse($permission);
@@ -475,7 +483,7 @@ App::post('/v1/storage/buckets/:bucketId/files')
                         $permission->getIdentifier(),
                         $permission->getDimension()
                     ))->toString();
-                    if (!Authorization::isRole($role)) {
+                    if (!$authorization->hasRole($role)) {
                         throw new Exception(Exception::USER_UNAUTHORIZED, 'Permissions must be one of: (' . \implode(', ', $roles) . ')');
                     }
                 }
@@ -674,7 +682,13 @@ App::post('/v1/storage/buckets/:bucketId/files')
                     'metadata' => $metadata,
                 ]);
 
-                $file = $dbForProject->createDocument('bucket_' . $bucket->getSequence(), $doc);
+                try {
+                    $file = $dbForProject->createDocument('bucket_' . $bucket->getSequence(), $doc);
+                } catch (DuplicateException) {
+                    throw new Exception(Exception::STORAGE_FILE_ALREADY_EXISTS);
+                } catch (NotFoundException) {
+                    throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
+                }
             } else {
                 $file = $file
                     ->setAttribute('$permissions', $permissions)
@@ -695,11 +709,10 @@ App::post('/v1/storage/buckets/:bucketId/files')
                  * However as with chunk upload even if we are updating, we are essentially creating a file
                  * adding it's new chunk so we validate create permission instead of update
                  */
-                $validator = new Authorization(Database::PERMISSION_CREATE);
-                if (!$validator->isValid($bucket->getCreate())) {
-                    throw new Exception(Exception::USER_UNAUTHORIZED);
+                if (!$authorization->isValid(new Input(Database::PERMISSION_CREATE, $bucket->getCreate()))) {
+                    throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
                 }
-                $file = Authorization::skip(fn () => $dbForProject->updateDocument('bucket_' . $bucket->getSequence(), $fileId, $file));
+                $file = $authorization->skip(fn () => $dbForProject->updateDocument('bucket_' . $bucket->getSequence(), $fileId, $file));
             }
         } else {
             if ($file->isEmpty()) {
@@ -724,6 +737,8 @@ App::post('/v1/storage/buckets/:bucketId/files')
 
                 try {
                     $file = $dbForProject->createDocument('bucket_' . $bucket->getSequence(), $doc);
+                } catch (DuplicateException) {
+                    throw new Exception(Exception::STORAGE_FILE_ALREADY_EXISTS);
                 } catch (NotFoundException) {
                     throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
                 }
@@ -738,13 +753,12 @@ App::post('/v1/storage/buckets/:bucketId/files')
                  * However as with chunk upload even if we are updating, we are essentially creating a file
                  * adding it's new chunk so we validate create permission instead of update
                  */
-                $validator = new Authorization(Database::PERMISSION_CREATE);
-                if (!$validator->isValid($bucket->getCreate())) {
-                    throw new Exception(Exception::USER_UNAUTHORIZED);
+                if (!$authorization->isValid(new Input(Database::PERMISSION_CREATE, $bucket->getCreate()))) {
+                    throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
                 }
 
                 try {
-                    $file = Authorization::skip(fn () => $dbForProject->updateDocument('bucket_' . $bucket->getSequence(), $fileId, $file));
+                    $file = $authorization->skip(fn () => $dbForProject->updateDocument('bucket_' . $bucket->getSequence(), $fileId, $file));
                 } catch (NotFoundException) {
                     throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
                 }
@@ -774,7 +788,7 @@ App::get('/v1/storage/buckets/:bucketId/files')
         group: 'files',
         name: 'listFiles',
         description: '/docs/references/storage/list-files.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -785,24 +799,25 @@ App::get('/v1/storage/buckets/:bucketId/files')
     ->param('bucketId', '', new UID(), 'Storage bucket unique ID. You can create a new storage bucket using the Storage service [server integration](https://appwrite.io/docs/server/storage#createBucket).')
     ->param('queries', [], new Files(), 'Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/queries). Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' queries are allowed, each ' . APP_LIMIT_ARRAY_ELEMENT_SIZE . ' characters long. You may filter on the following attributes: ' . implode(', ', Files::ALLOWED_ATTRIBUTES), true)
     ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
+    ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
     ->inject('response')
     ->inject('dbForProject')
+    ->inject('authorization')
     ->inject('mode')
-    ->action(function (string $bucketId, array $queries, string $search, Response $response, Database $dbForProject, string $mode) {
-        $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+    ->action(function (string $bucketId, array $queries, string $search, bool $includeTotal, Response $response, Database $dbForProject, Authorization $authorization, string $mode) {
+        $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = Auth::isAppUser(Authorization::getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles());
+        $isAPIKey = User::isApp($authorization->getRoles());
+        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
         }
 
         $fileSecurity = $bucket->getAttribute('fileSecurity', false);
-        $validator = new Authorization(Database::PERMISSION_READ);
-        $valid = $validator->isValid($bucket->getRead());
+        $valid = $authorization->isValid(new Input(Database::PERMISSION_READ, $bucket->getRead()));
         if (!$fileSecurity && !$valid) {
-            throw new Exception(Exception::USER_UNAUTHORIZED);
+            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
         }
 
         $queries = Query::parseQueries($queries);
@@ -831,7 +846,7 @@ App::get('/v1/storage/buckets/:bucketId/files')
             if ($fileSecurity && !$valid) {
                 $cursorDocument = $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId);
             } else {
-                $cursorDocument = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+                $cursorDocument = $authorization->skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
             }
 
             if ($cursorDocument->isEmpty()) {
@@ -841,15 +856,13 @@ App::get('/v1/storage/buckets/:bucketId/files')
             $cursor->setValue($cursorDocument);
         }
 
-        $filterQueries = Query::groupByType($queries)['filters'];
-
         try {
             if ($fileSecurity && !$valid) {
                 $files = $dbForProject->find('bucket_' . $bucket->getSequence(), $queries);
-                $total = $dbForProject->count('bucket_' . $bucket->getSequence(), $filterQueries, APP_LIMIT_COUNT);
+                $total = $includeTotal ? $dbForProject->count('bucket_' . $bucket->getSequence(), $queries, APP_LIMIT_COUNT) : 0;
             } else {
-                $files = Authorization::skip(fn () => $dbForProject->find('bucket_' . $bucket->getSequence(), $queries));
-                $total = Authorization::skip(fn () => $dbForProject->count('bucket_' . $bucket->getSequence(), $filterQueries, APP_LIMIT_COUNT));
+                $files = $authorization->skip(fn () => $dbForProject->find('bucket_' . $bucket->getSequence(), $queries));
+                $total = $includeTotal ? $authorization->skip(fn () => $dbForProject->count('bucket_' . $bucket->getSequence(), $queries, APP_LIMIT_COUNT)) : 0;
             }
         } catch (NotFoundException) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
@@ -876,7 +889,7 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId')
         group: 'files',
         name: 'getFile',
         description: '/docs/references/storage/get-file.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -888,28 +901,28 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId')
     ->param('fileId', '', new UID(), 'File ID.')
     ->inject('response')
     ->inject('dbForProject')
+    ->inject('authorization')
     ->inject('mode')
-    ->action(function (string $bucketId, string $fileId, Response $response, Database $dbForProject, string $mode) {
-        $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+    ->action(function (string $bucketId, string $fileId, Response $response, Database $dbForProject, Authorization $authorization, string $mode) {
+        $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = Auth::isAppUser(Authorization::getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles());
+        $isAPIKey = User::isApp($authorization->getRoles());
+        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
         }
 
         $fileSecurity = $bucket->getAttribute('fileSecurity', false);
-        $validator = new Authorization(Database::PERMISSION_READ);
-        $valid = $validator->isValid($bucket->getRead());
+        $valid = $authorization->isValid(new Input(Database::PERMISSION_READ, $bucket->getRead()));
         if (!$fileSecurity && !$valid) {
-            throw new Exception(Exception::USER_UNAUTHORIZED);
+            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
         }
 
         if ($fileSecurity && !$valid) {
             $file = $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId);
         } else {
-            $file = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+            $file = $authorization->skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
         }
 
         if ($file->isEmpty()) {
@@ -933,7 +946,7 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/preview')
         group: 'files',
         name: 'getFilePreview',
         description: '/docs/references/storage/get-file-preview.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -965,35 +978,39 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/preview')
     ->inject('deviceForFiles')
     ->inject('deviceForLocal')
     ->inject('project')
-    ->action(function (string $bucketId, string $fileId, int $width, int $height, string $gravity, int $quality, int $borderWidth, string $borderColor, int $borderRadius, float $opacity, int $rotation, string $background, string $output, ?string $token, Request $request, Response $response, Database $dbForProject, Document $resourceToken, Device $deviceForFiles, Device $deviceForLocal, Document $project) {
+    ->inject('authorization')
+    ->action(function (string $bucketId, string $fileId, int $width, int $height, string $gravity, int $quality, int $borderWidth, string $borderColor, int $borderRadius, float $opacity, int $rotation, string $background, string $output, ?string $token, Request $request, Response $response, Database $dbForProject, Document $resourceToken, Device $deviceForFiles, Device $deviceForLocal, Document $project, Authorization $authorization) {
 
         if (!\extension_loaded('imagick')) {
             throw new Exception(Exception::GENERAL_SERVER_ERROR, 'Imagick extension is missing');
         }
 
         /* @type Document $bucket */
-        $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+        $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = Auth::isAppUser(Authorization::getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles());
+        $isAPIKey = User::isApp($authorization->getRoles());
+        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
         }
 
+        if (!$bucket->getAttribute('transformations', true) && !$isAPIKey && !$isPrivilegedUser) {
+            throw new Exception(Exception::STORAGE_BUCKET_TRANSFORMATIONS_DISABLED);
+        }
+
         $isToken = !$resourceToken->isEmpty() && $resourceToken->getAttribute('bucketInternalId') === $bucket->getSequence();
         $fileSecurity = $bucket->getAttribute('fileSecurity', false);
-        $validator = new Authorization(Database::PERMISSION_READ);
-        $valid = $validator->isValid($bucket->getRead());
+        $valid = $authorization->isValid(new Input(Database::PERMISSION_READ, $bucket->getRead()));
         if (!$fileSecurity && !$valid && !$isToken) {
-            throw new Exception(Exception::USER_UNAUTHORIZED);
+            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
         }
 
         if ($fileSecurity && !$valid && !$isToken) {
             $file = $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId);
         } else {
             /* @type Document $file */
-            $file = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+            $file = $authorization->skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
         }
 
         if (!$resourceToken->isEmpty() && $resourceToken->getAttribute('fileInternalId') !== $file->getSequence()) {
@@ -1115,11 +1132,11 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/preview')
         $contentType = (\array_key_exists($output, $outputs)) ? $outputs[$output] : $outputs['jpg'];
 
         //Do not update transformedAt if it's a console user
-        if (!Auth::isPrivilegedUser(Authorization::getRoles())) {
+        if (!User::isPrivileged($authorization->getRoles())) {
             $transformedAt = $file->getAttribute('transformedAt', '');
             if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_PROJECT_ACCESS)) > $transformedAt) {
                 $file->setAttribute('transformedAt', DateTime::now());
-                Authorization::skip(fn () => $dbForProject->updateDocument('bucket_' . $file->getAttribute('bucketInternalId'), $file->getId(), $file));
+                $authorization->skip(fn () => $dbForProject->updateDocument('bucket_' . $file->getAttribute('bucketInternalId'), $file->getId(), $file));
             }
         }
 
@@ -1142,7 +1159,7 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/download')
         group: 'files',
         name: 'getFileDownload',
         description: '/docs/references/storage/get-file-download.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -1159,15 +1176,16 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/download')
     ->inject('request')
     ->inject('response')
     ->inject('dbForProject')
+    ->inject('authorization')
     ->inject('mode')
     ->inject('resourceToken')
     ->inject('deviceForFiles')
-    ->action(function (string $bucketId, string $fileId, ?string $token, Request $request, Response $response, Database $dbForProject, string $mode, Document $resourceToken, Device $deviceForFiles) {
+    ->action(function (string $bucketId, string $fileId, ?string $token, Request $request, Response $response, Database $dbForProject, Authorization $authorization, string $mode, Document $resourceToken, Device $deviceForFiles) {
         /* @type Document $bucket */
-        $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+        $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = Auth::isAppUser(Authorization::getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles());
+        $isAPIKey = User::isApp($authorization->getRoles());
+        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
@@ -1175,21 +1193,20 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/download')
 
         $isToken = !$resourceToken->isEmpty() && $resourceToken->getAttribute('bucketInternalId') === $bucket->getSequence();
         $fileSecurity = $bucket->getAttribute('fileSecurity', false);
-        $validator = new Authorization(Database::PERMISSION_READ);
-        $valid = $validator->isValid($bucket->getRead());
+        $valid = $authorization->isValid(new Input(Database::PERMISSION_READ, $bucket->getRead()));
         if (!$fileSecurity && !$valid && !$isToken) {
-            throw new Exception(Exception::USER_UNAUTHORIZED);
+            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
         }
 
         if ($fileSecurity && !$valid && !$isToken) {
             $file = $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId);
         } else {
             /* @type Document $file */
-            $file = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+            $file = $authorization->skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
         }
 
         if (!$resourceToken->isEmpty() && $resourceToken->getAttribute('fileInternalId') !== $file->getSequence()) {
-            throw new Exception(Exception::USER_UNAUTHORIZED);
+            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
         }
 
         if ($file->isEmpty()) {
@@ -1303,7 +1320,7 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/view')
         group: 'files',
         name: 'getFileView',
         description: '/docs/references/storage/get-file-view.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -1323,12 +1340,13 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/view')
     ->inject('mode')
     ->inject('resourceToken')
     ->inject('deviceForFiles')
-    ->action(function (string $bucketId, string $fileId, ?string $token, Response $response, Request $request, Database $dbForProject, string $mode, Document $resourceToken, Device $deviceForFiles) {
+    ->inject('authorization')
+    ->action(function (string $bucketId, string $fileId, ?string $token, Response $response, Request $request, Database $dbForProject, string $mode, Document $resourceToken, Device $deviceForFiles, Authorization $authorization) {
         /* @type Document $bucket */
-        $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+        $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = Auth::isAppUser(Authorization::getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles());
+        $isAPIKey = User::isApp($authorization->getRoles());
+        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
@@ -1336,21 +1354,20 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/view')
 
         $isToken = !$resourceToken->isEmpty() && $resourceToken->getAttribute('bucketInternalId') === $bucket->getSequence();
         $fileSecurity = $bucket->getAttribute('fileSecurity', false);
-        $validator = new Authorization(Database::PERMISSION_READ);
-        $valid = $validator->isValid($bucket->getRead());
+        $valid = $authorization->isValid(new Input(Database::PERMISSION_READ, $bucket->getRead()));
         if (!$fileSecurity && !$valid && !$isToken) {
-            throw new Exception(Exception::USER_UNAUTHORIZED);
+            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
         }
 
         if ($fileSecurity && !$valid && !$isToken) {
             $file = $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId);
         } else {
             /* @type Document $file */
-            $file = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+            $file = $authorization->skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
         }
 
         if (!$resourceToken->isEmpty() && $resourceToken->getAttribute('fileInternalId') !== $file->getSequence()) {
-            throw new Exception(Exception::USER_UNAUTHORIZED);
+            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
         }
 
         if ($file->isEmpty()) {
@@ -1475,12 +1492,12 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/push')
     ->inject('response')
     ->inject('request')
     ->inject('dbForProject')
+    ->inject('dbForPlatform')
     ->inject('project')
     ->inject('mode')
     ->inject('deviceForFiles')
-    ->action(function (string $bucketId, string $fileId, string $jwt, Response $response, Request $request, Database $dbForProject, Document $project, string $mode, Device $deviceForFiles) {
-        $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
-
+    ->inject('authorization')
+    ->action(function (string $bucketId, string $fileId, string $jwt, Response $response, Request $request, Database $dbForProject, Database $dbForPlatform, Document $project, string $mode, Device $deviceForFiles, Authorization $authorization) {
         $decoder = new JWT(System::getEnv('_APP_OPENSSL_KEY_V1'), 'HS256', 3600, 0);
 
         try {
@@ -1497,15 +1514,19 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/push')
             throw new Exception(Exception::USER_UNAUTHORIZED);
         }
 
-        $isAPIKey = Auth::isAppUser(Authorization::getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles());
+        $isInternal = $decoded['internal'] ?? false;
+        $disposition = $decoded['disposition'] ?? 'inline';
+        $dbForProject = $isInternal ? $dbForPlatform : $dbForProject;
 
+        $isAPIKey = User::isApp($authorization->getRoles());
+        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+
+        $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
         }
 
-        $file = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
-
+        $file = $authorization->skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
         if ($file->isEmpty()) {
             throw new Exception(Exception::STORAGE_FILE_NOT_FOUND);
         }
@@ -1513,7 +1534,6 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/push')
         $mimes = Config::getParam('storage-mimes');
 
         $path = $file->getAttribute('path', '');
-
         if (!$deviceForFiles->exists($path)) {
             throw new Exception(Exception::STORAGE_FILE_NOT_FOUND, 'File not found in ' . $path);
         }
@@ -1551,7 +1571,7 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/push')
             ->setContentType($contentType)
             ->addHeader('Content-Security-Policy', 'script-src none;')
             ->addHeader('X-Content-Type-Options', 'nosniff')
-            ->addHeader('Content-Disposition', 'inline; filename="' . $file->getAttribute('name', '') . '"')
+            ->addHeader('Content-Disposition', $disposition . '; filename="' . $file->getAttribute('name', '') . '"')
             ->addHeader('Cache-Control', 'private, max-age=3888000') // 45 days
             ->addHeader('X-Peak', \memory_get_peak_usage());
 
@@ -1633,7 +1653,7 @@ App::put('/v1/storage/buckets/:bucketId/files/:fileId')
         group: 'files',
         name: 'updateFile',
         description: '/docs/references/storage/update-file.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -1643,33 +1663,33 @@ App::put('/v1/storage/buckets/:bucketId/files/:fileId')
     ))
     ->param('bucketId', '', new UID(), 'Storage bucket unique ID. You can create a new storage bucket using the Storage service [server integration](https://appwrite.io/docs/server/storage#createBucket).')
     ->param('fileId', '', new UID(), 'File unique ID.')
-    ->param('name', null, new Text(255), 'Name of the file', true)
-    ->param('permissions', null, new Permissions(APP_LIMIT_ARRAY_PARAMS_SIZE, [Database::PERMISSION_READ, Database::PERMISSION_UPDATE, Database::PERMISSION_DELETE, Database::PERMISSION_WRITE]), 'An array of permission string. By default, the current permissions are inherited. [Learn more about permissions](https://appwrite.io/docs/permissions).', true)
+    ->param('name', null, new Nullable(new Text(255)), 'Name of the file', true)
+    ->param('permissions', null, new Nullable(new Permissions(APP_LIMIT_ARRAY_PARAMS_SIZE, [Database::PERMISSION_READ, Database::PERMISSION_UPDATE, Database::PERMISSION_DELETE, Database::PERMISSION_WRITE])), 'An array of permission string. By default, the current permissions are inherited. [Learn more about permissions](https://appwrite.io/docs/permissions).', true)
     ->inject('response')
     ->inject('dbForProject')
     ->inject('user')
     ->inject('mode')
     ->inject('queueForEvents')
-    ->action(function (string $bucketId, string $fileId, ?string $name, ?array $permissions, Response $response, Database $dbForProject, Document $user, string $mode, Event $queueForEvents) {
+    ->inject('authorization')
+    ->action(function (string $bucketId, string $fileId, ?string $name, ?array $permissions, Response $response, Database $dbForProject, Document $user, string $mode, Event $queueForEvents, Authorization $authorization) {
 
-        $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+        $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = Auth::isAppUser(Authorization::getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles());
+        $isAPIKey = User::isApp($authorization->getRoles());
+        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
         }
 
         $fileSecurity = $bucket->getAttribute('fileSecurity', false);
-        $validator = new Authorization(Database::PERMISSION_UPDATE);
-        $valid = $validator->isValid($bucket->getUpdate());
+        $valid = $authorization->isValid(new Input(Database::PERMISSION_UPDATE, $bucket->getUpdate()));
         if (!$fileSecurity && !$valid) {
-            throw new Exception(Exception::USER_UNAUTHORIZED);
+            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
         }
 
         // Read permission should not be required for update
-        $file = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+        $file = $authorization->skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
 
         if ($file->isEmpty()) {
             throw new Exception(Exception::STORAGE_FILE_NOT_FOUND);
@@ -1683,8 +1703,8 @@ App::put('/v1/storage/buckets/:bucketId/files/:fileId')
         ]);
 
         // Users can only manage their own roles, API keys and Admin users can manage any
-        $roles = Authorization::getRoles();
-        if (!Auth::isAppUser($roles) && !Auth::isPrivilegedUser($roles) && !\is_null($permissions)) {
+        $roles = $authorization->getRoles();
+        if (!User::isApp($roles) && !User::isPrivileged($roles) && !\is_null($permissions)) {
             foreach (Database::PERMISSIONS as $type) {
                 foreach ($permissions as $permission) {
                     $permission = Permission::parse($permission);
@@ -1696,7 +1716,7 @@ App::put('/v1/storage/buckets/:bucketId/files/:fileId')
                         $permission->getIdentifier(),
                         $permission->getDimension()
                     ))->toString();
-                    if (!Authorization::isRole($role)) {
+                    if (!$authorization->hasRole($role)) {
                         throw new Exception(Exception::USER_UNAUTHORIZED, 'Permissions must be one of: (' . \implode(', ', $roles) . ')');
                     }
                 }
@@ -1717,7 +1737,7 @@ App::put('/v1/storage/buckets/:bucketId/files/:fileId')
             if ($fileSecurity && !$valid) {
                 $file = $dbForProject->updateDocument('bucket_' . $bucket->getSequence(), $fileId, $file);
             } else {
-                $file = Authorization::skip(fn () => $dbForProject->updateDocument('bucket_' . $bucket->getSequence(), $fileId, $file));
+                $file = $authorization->skip(fn () => $dbForProject->updateDocument('bucket_' . $bucket->getSequence(), $fileId, $file));
             }
         } catch (NotFoundException) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
@@ -1748,7 +1768,7 @@ App::delete('/v1/storage/buckets/:bucketId/files/:fileId')
         group: 'files',
         name: 'deleteFile',
         description: '/docs/references/storage/delete-file.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_NOCONTENT,
@@ -1765,33 +1785,34 @@ App::delete('/v1/storage/buckets/:bucketId/files/:fileId')
     ->inject('mode')
     ->inject('deviceForFiles')
     ->inject('queueForDeletes')
-    ->action(function (string $bucketId, string $fileId, Response $response, Database $dbForProject, Event $queueForEvents, string $mode, Device $deviceForFiles, Delete $queueForDeletes) {
-        $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+    ->inject('authorization')
+    ->action(function (string $bucketId, string $fileId, Response $response, Database $dbForProject, Event $queueForEvents, string $mode, Device $deviceForFiles, Delete $queueForDeletes, Authorization $authorization) {
+        $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
-        $isAPIKey = Auth::isAppUser(Authorization::getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles());
+        $isAPIKey = User::isApp($authorization->getRoles());
+        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
 
         if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAPIKey && !$isPrivilegedUser)) {
             throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
         }
 
         $fileSecurity = $bucket->getAttribute('fileSecurity', false);
-        $validator = new Authorization(Database::PERMISSION_DELETE);
-        $valid = $validator->isValid($bucket->getDelete());
+        $valid = $authorization->isValid(new Input(Database::PERMISSION_DELETE, $bucket->getDelete()));
         if (!$fileSecurity && !$valid) {
-            throw new Exception(Exception::USER_UNAUTHORIZED);
+            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
         }
 
         // Read permission should not be required for delete
-        $file = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+        $file = $authorization->skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
 
         if ($file->isEmpty()) {
             throw new Exception(Exception::STORAGE_FILE_NOT_FOUND);
         }
 
         // Make sure we don't delete the file before the document permission check occurs
-        if ($fileSecurity && !$valid && !$validator->isValid($file->getDelete())) {
-            throw new Exception(Exception::USER_UNAUTHORIZED);
+        $validFile = $authorization->isValid(new Input(Database::PERMISSION_DELETE, $file->getDelete()));
+        if ($fileSecurity && !$valid && !$validFile) {
+            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
         }
 
         $deviceDeleted = false;
@@ -1815,7 +1836,7 @@ App::delete('/v1/storage/buckets/:bucketId/files/:fileId')
                 if ($fileSecurity && !$valid) {
                     $deleted = $dbForProject->deleteDocument('bucket_' . $bucket->getSequence(), $fileId);
                 } else {
-                    $deleted = Authorization::skip(fn () => $dbForProject->deleteDocument('bucket_' . $bucket->getSequence(), $fileId));
+                    $deleted = $authorization->skip(fn () => $dbForProject->deleteDocument('bucket_' . $bucket->getSequence(), $fileId));
                 }
             } catch (NotFoundException) {
                 throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
@@ -1860,7 +1881,8 @@ App::get('/v1/storage/usage')
     ->param('range', '30d', new WhiteList(['24h', '30d', '90d'], true), 'Date range.', true)
     ->inject('response')
     ->inject('dbForProject')
-    ->action(function (string $range, Response $response, Database $dbForProject) {
+    ->inject('authorization')
+    ->action(function (string $range, Response $response, Database $dbForProject, Authorization $authorization) {
 
         $periods = Config::getParam('usage', []);
         $stats = $usage = [];
@@ -1872,7 +1894,7 @@ App::get('/v1/storage/usage')
         ];
 
         $total = [];
-        Authorization::skip(function () use ($dbForProject, $days, $metrics, &$stats, &$total) {
+        $authorization->skip(function () use ($dbForProject, $days, $metrics, &$stats, &$total) {
             foreach ($metrics as $metric) {
                 $result = $dbForProject->findOne('stats', [
                     Query::equal('metric', [$metric]),
@@ -1950,7 +1972,8 @@ App::get('/v1/storage/:bucketId/usage')
     ->inject('project')
     ->inject('dbForProject')
     ->inject('getLogsDB')
-    ->action(function (string $bucketId, string $range, Response $response, Document $project, Database $dbForProject, callable $getLogsDB) {
+    ->inject('authorization')
+    ->action(function (string $bucketId, string $range, Response $response, Document $project, Database $dbForProject, callable $getLogsDB, Authorization $authorization) {
 
         $dbForLogs = call_user_func($getLogsDB, $project);
         $bucket = $dbForProject->getDocument('buckets', $bucketId);
@@ -1968,7 +1991,7 @@ App::get('/v1/storage/:bucketId/usage')
             str_replace('{bucketInternalId}', $bucket->getSequence(), METRIC_BUCKET_ID_FILES_IMAGES_TRANSFORMED),
         ];
 
-        Authorization::skip(function () use ($dbForProject, $dbForLogs, $bucket, $days, $metrics, &$stats) {
+        $authorization->skip(function () use ($dbForProject, $dbForLogs, $bucket, $days, $metrics, &$stats) {
             foreach ($metrics as $metric) {
                 $db = ($metric === str_replace('{bucketInternalId}', $bucket->getSequence(), METRIC_BUCKET_ID_FILES_IMAGES_TRANSFORMED))
                     ? $dbForLogs

app/controllers/api/teams.php

@@ -1,6 +1,5 @@
 <?php
 
-use Appwrite\Auth\Auth;
 use Appwrite\Auth\MFA\Type\TOTP;
 use Appwrite\Auth\Validator\Phone;
 use Appwrite\Detector\Detector;
@@ -10,7 +9,7 @@ use Appwrite\Event\Mail;
 use Appwrite\Event\Messaging;
 use Appwrite\Event\StatsUsage;
 use Appwrite\Extend\Exception;
-use Appwrite\Network\Validator\Email;
+use Appwrite\Network\Validator\Email as EmailValidator;
 use Appwrite\Network\Validator\Redirect;
 use Appwrite\Platform\Workers\Deletes;
 use Appwrite\SDK\AuthType;
@@ -18,6 +17,7 @@ use Appwrite\SDK\ContentType;
 use Appwrite\SDK\Method;
 use Appwrite\SDK\Response as SDKResponse;
 use Appwrite\Template\Template;
+use Appwrite\Utopia\Database\Documents\User;
 use Appwrite\Utopia\Database\Validator\CustomId;
 use Appwrite\Utopia\Database\Validator\Queries\Memberships;
 use Appwrite\Utopia\Database\Validator\Queries\Teams;
@@ -28,6 +28,9 @@ use MaxMind\Db\Reader;
 use Utopia\Abuse\Abuse;
 use Utopia\App;
 use Utopia\Audit\Audit;
+use Utopia\Auth\Proofs\Password;
+use Utopia\Auth\Proofs\Token;
+use Utopia\Auth\Store;
 use Utopia\Config\Config;
 use Utopia\Database\Database;
 use Utopia\Database\DateTime;
@@ -48,12 +51,13 @@ use Utopia\Database\Validator\Query\Cursor;
 use Utopia\Database\Validator\Query\Limit;
 use Utopia\Database\Validator\Query\Offset;
 use Utopia\Database\Validator\UID;
+use Utopia\Emails\Email;
 use Utopia\Locale\Locale;
 use Utopia\System\System;
 use Utopia\Validator\ArrayList;
 use Utopia\Validator\Assoc;
+use Utopia\Validator\Boolean;
 use Utopia\Validator\Text;
-use Utopia\Validator\URL;
 use Utopia\Validator\WhiteList;
 
 App::post('/v1/teams')
@@ -68,7 +72,7 @@ App::post('/v1/teams')
         group: 'teams',
         name: 'create',
         description: '/docs/references/teams/create-team.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_CREATED,
@@ -82,16 +86,17 @@ App::post('/v1/teams')
     ->inject('response')
     ->inject('user')
     ->inject('dbForProject')
+    ->inject('authorization')
     ->inject('queueForEvents')
-    ->action(function (string $teamId, string $name, array $roles, Response $response, Document $user, Database $dbForProject, Event $queueForEvents) {
+    ->action(function (string $teamId, string $name, array $roles, Response $response, Document $user, Database $dbForProject, Authorization $authorization, Event $queueForEvents) {
 
-        $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles());
-        $isAppUser = Auth::isAppUser(Authorization::getRoles());
+        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAppUser = User::isApp($authorization->getRoles());
 
         $teamId = $teamId == 'unique()' ? ID::unique() : $teamId;
 
         try {
-            $team = Authorization::skip(fn () => $dbForProject->createDocument('teams', new Document([
+            $team = $authorization->skip(fn () => $dbForProject->createDocument('teams', new Document([
                 '$id' => $teamId,
                 '$permissions' => [
                     Permission::read(Role::team($teamId)),
@@ -159,7 +164,7 @@ App::get('/v1/teams')
         group: 'teams',
         name: 'list',
         description: '/docs/references/teams/list-teams.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -169,9 +174,11 @@ App::get('/v1/teams')
     ))
     ->param('queries', [], new Teams(), 'Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/queries). Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' queries are allowed, each ' . APP_LIMIT_ARRAY_ELEMENT_SIZE . ' characters long. You may filter on the following attributes: ' . implode(', ', Teams::ALLOWED_ATTRIBUTES), true)
     ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
+    ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
     ->inject('response')
     ->inject('dbForProject')
-    ->action(function (array $queries, string $search, Response $response, Database $dbForProject) {
+    ->action(function (array $queries, string $search, bool $includeTotal, Response $response, Database $dbForProject) {
+
 
         try {
             $queries = Query::parseQueries($queries);
@@ -211,7 +218,7 @@ App::get('/v1/teams')
         $filterQueries = Query::groupByType($queries)['filters'];
         try {
             $results = $dbForProject->find('teams', $queries);
-            $total = $dbForProject->count('teams', $filterQueries, APP_LIMIT_COUNT);
+            $total = $includeTotal ? $dbForProject->count('teams', $filterQueries, APP_LIMIT_COUNT) : 0;
         } catch (OrderException $e) {
             throw new Exception(Exception::DATABASE_QUERY_ORDER_NULL, "The order attribute '{$e->getAttribute()}' had a null value. Cursor pagination requires all documents order attribute values are non-null.");
         }
@@ -231,7 +238,7 @@ App::get('/v1/teams/:teamId')
         group: 'teams',
         name: 'get',
         description: '/docs/references/teams/get-team.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -262,7 +269,7 @@ App::get('/v1/teams/:teamId/prefs')
         group: 'teams',
         name: 'getPrefs',
         description: '/docs/references/teams/get-team-prefs.md',
-        auth: [AuthType::SESSION, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -304,7 +311,7 @@ App::put('/v1/teams/:teamId')
         group: 'teams',
         name: 'updateName',
         description: '/docs/references/teams/update-team-name.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -350,7 +357,7 @@ App::put('/v1/teams/:teamId/prefs')
         group: 'teams',
         name: 'updatePrefs',
         description: '/docs/references/teams/update-team-prefs.md',
-        auth: [AuthType::SESSION, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -397,7 +404,7 @@ App::delete('/v1/teams/:teamId')
         group: 'teams',
         name: 'delete',
         description: '/docs/references/teams/delete-team.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_NOCONTENT,
@@ -456,7 +463,7 @@ App::post('/v1/teams/:teamId/memberships')
         group: 'memberships',
         name: 'createMembership',
         description: '/docs/references/teams/create-team-membership.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_CREATED,
@@ -466,26 +473,26 @@ App::post('/v1/teams/:teamId/memberships')
     ))
     ->label('abuse-limit', 10)
     ->param('teamId', '', new UID(), 'Team ID.')
-    ->param('email', '', new Email(), 'Email of the new team member.', true)
+    ->param('email', '', new EmailValidator(), 'Email of the new team member.', true)
     ->param('userId', '', new UID(), 'ID of the user to be added to a team.', true)
     ->param('phone', '', new Phone(), 'Phone number. Format this number with a leading \'+\' and a country code, e.g., +16175551212.', true)
     ->param('roles', [], function (Document $project) {
         if ($project->getId() === 'console') {
-            ;
             $roles = array_keys(Config::getParam('roles', []));
-            array_filter($roles, function ($role) {
-                return !in_array($role, [Auth::USER_ROLE_APPS, Auth::USER_ROLE_GUESTS, Auth::USER_ROLE_USERS]);
+            $roles = array_filter($roles, function ($role) {
+                return !in_array($role, [User::ROLE_APPS, User::ROLE_GUESTS, User::ROLE_USERS]);
             });
             return new ArrayList(new WhiteList($roles), APP_LIMIT_ARRAY_PARAMS_SIZE);
         }
         return new ArrayList(new Key(), APP_LIMIT_ARRAY_PARAMS_SIZE);
     }, 'Array of strings. Use this param to set the user roles in the team. A role can be any string. Learn more about [roles and permissions](https://appwrite.io/docs/permissions). Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' roles are allowed, each 32 characters long.', false, ['project'])
-    ->param('url', '', fn ($platforms, $devKey) => $devKey->isEmpty() ? new Redirect($platforms) : new URL(), 'URL to redirect the user back to your app from the invitation email. This parameter is not required when an API key is supplied. Only URLs from hostnames in your project platform list are allowed. This requirement helps to prevent an [open redirect](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html) attack against your project API.', true, ['platforms', 'devKey']) // TODO add our own built-in confirm page
+    ->param('url', '', fn ($redirectValidator) => $redirectValidator, 'URL to redirect the user back to your app from the invitation email. This parameter is not required when an API key is supplied. Only URLs from hostnames in your project platform list are allowed. This requirement helps to prevent an [open redirect](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html) attack against your project API.', true, ['redirectValidator']) // TODO add our own built-in confirm page
     ->param('name', '', new Text(128), 'Name of the new team member. Max length: 128 chars.', true)
     ->inject('response')
     ->inject('project')
     ->inject('user')
     ->inject('dbForProject')
+    ->inject('authorization')
     ->inject('locale')
     ->inject('queueForMails')
     ->inject('queueForMessaging')
@@ -493,9 +500,11 @@ App::post('/v1/teams/:teamId/memberships')
     ->inject('timelimit')
     ->inject('queueForStatsUsage')
     ->inject('plan')
-    ->action(function (string $teamId, string $email, string $userId, string $phone, array $roles, string $url, string $name, Response $response, Document $project, Document $user, Database $dbForProject, Locale $locale, Mail $queueForMails, Messaging $queueForMessaging, Event $queueForEvents, callable $timelimit, StatsUsage $queueForStatsUsage, array $plan) {
-        $isAppUser = Auth::isAppUser(Authorization::getRoles());
-        $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles());
+    ->inject('proofForPassword')
+    ->inject('proofForToken')
+    ->action(function (string $teamId, string $email, string $userId, string $phone, array $roles, string $url, string $name, Response $response, Document $project, Document $user, Database $dbForProject, Authorization $authorization, Locale $locale, Mail $queueForMails, Messaging $queueForMessaging, Event $queueForEvents, callable $timelimit, StatsUsage $queueForStatsUsage, array $plan, Password $proofForPassword, Token $proofForToken) {
+        $isAppUser = User::isApp($authorization->getRoles());
+        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
 
         $url = htmlentities($url);
         if (empty($url)) {
@@ -566,43 +575,59 @@ App::post('/v1/teams/:teamId/memberships')
 
             try {
                 $userId = ID::unique();
-                $invitee = Authorization::skip(fn () => $dbForProject->createDocument('users', new Document([
-                    '$id' => $userId,
-                    '$permissions' => [
-                        Permission::read(Role::any()),
-                        Permission::read(Role::user($userId)),
-                        Permission::update(Role::user($userId)),
-                        Permission::delete(Role::user($userId)),
-                    ],
-                    'email' => empty($email) ? null : $email,
-                    'phone' => empty($phone) ? null : $phone,
-                    'emailVerification' => false,
-                    'status' => true,
-                    // TODO: Set password empty?
-                    'password' => Auth::passwordHash(Auth::passwordGenerator(), Auth::DEFAULT_ALGO, Auth::DEFAULT_ALGO_OPTIONS),
-                    'hash' => Auth::DEFAULT_ALGO,
-                    'hashOptions' => Auth::DEFAULT_ALGO_OPTIONS,
-                    /**
-                     * Set the password update time to 0 for users created using
-                     * team invite and OAuth to allow password updates without an
-                     * old password
-                     */
-                    'passwordUpdate' => null,
-                    'registration' => DateTime::now(),
-                    'reset' => false,
-                    'name' => $name,
-                    'prefs' => new \stdClass(),
-                    'sessions' => null,
-                    'tokens' => null,
-                    'memberships' => null,
-                    'search' => implode(' ', [$userId, $email, $name]),
-                ])));
+                $hash = $proofForPassword->hash($proofForPassword->generate());
+                $emailCanonical = new Email($email);
+            } catch (Throwable) {
+                $emailCanonical = null;
+            }
+
+            $userId = ID::unique();
+
+            $userDocument = new Document([
+                '$id' => $userId,
+                '$permissions' => [
+                    Permission::read(Role::any()),
+                    Permission::read(Role::user($userId)),
+                    Permission::update(Role::user($userId)),
+                    Permission::delete(Role::user($userId)),
+                ],
+                'email' => empty($email) ? null : $email,
+                'phone' => empty($phone) ? null : $phone,
+                'emailVerification' => false,
+                'status' => true,
+                // TODO: Set password empty?
+                'password' => $hash,
+                'hash' => $proofForPassword->getHash()->getName(),
+                'hashOptions' => $proofForPassword->getHash()->getOptions(),
+                /**
+                 * Set the password update time to 0 for users created using
+                 * team invite and OAuth to allow password updates without an
+                 * old password
+                 */
+                'passwordUpdate' => null,
+                'registration' => DateTime::now(),
+                'reset' => false,
+                'name' => $name,
+                'prefs' => new \stdClass(),
+                'sessions' => null,
+                'tokens' => null,
+                'memberships' => null,
+                'search' => implode(' ', [$userId, $email, $name]),
+                'emailCanonical' => $emailCanonical?->getCanonical(),
+                'emailIsCanonical' => $emailCanonical?->isCanonicalSupported(),
+                'emailIsCorporate' => $emailCanonical?->isCorporate(),
+                'emailIsDisposable' => $emailCanonical?->isDisposable(),
+                'emailIsFree' => $emailCanonical?->isFree(),
+            ]);
+
+            try {
+                $invitee = $authorization->skip(fn () => $dbForProject->createDocument('users', $userDocument));
             } catch (Duplicate $th) {
                 throw new Exception(Exception::USER_ALREADY_EXISTS);
             }
         }
 
-        $isOwner = Authorization::isRole('team:' . $team->getId() . '/owner');
+        $isOwner = $authorization->hasRole('team:' . $team->getId() . '/owner');
 
         if (!$isOwner && !$isPrivilegedUser && !$isAppUser) { // Not owner, not admin, not app (server)
             throw new Exception(Exception::USER_UNAUTHORIZED, 'User is not allowed to send invitations for this team');
@@ -613,7 +638,7 @@ App::post('/v1/teams/:teamId/memberships')
             Query::equal('teamInternalId', [$team->getSequence()]),
         ]);
 
-        $secret = Auth::tokenGenerator();
+        $secret = $proofForToken->generate();
         if ($membership->isEmpty()) {
             $membershipId = ID::unique();
             $membership = new Document([
@@ -633,20 +658,19 @@ App::post('/v1/teams/:teamId/memberships')
                 'invited' => DateTime::now(),
                 'joined' => ($isPrivilegedUser || $isAppUser) ? DateTime::now() : null,
                 'confirm' => ($isPrivilegedUser || $isAppUser),
-                'secret' => Auth::hash($secret),
+                'secret' => $proofForToken->hash($secret),
                 'search' => implode(' ', [$membershipId, $invitee->getId()])
             ]);
 
             $membership = ($isPrivilegedUser || $isAppUser) ?
-                Authorization::skip(fn () => $dbForProject->createDocument('memberships', $membership)) :
+                $authorization->skip(fn () => $dbForProject->createDocument('memberships', $membership)) :
                 $dbForProject->createDocument('memberships', $membership);
 
             if ($isPrivilegedUser || $isAppUser) {
-                Authorization::skip(fn () => $dbForProject->increaseDocumentAttribute('teams', $team->getId(), 'total', 1));
+                $authorization->skip(fn () => $dbForProject->increaseDocumentAttribute('teams', $team->getId(), 'total', 1));
             }
-
         } elseif ($membership->getAttribute('confirm') === false) {
-            $membership->setAttribute('secret', Auth::hash($secret));
+            $membership->setAttribute('secret', $proofForToken->hash($secret));
             $membership->setAttribute('invited', DateTime::now());
 
             if ($isPrivilegedUser || $isAppUser) {
@@ -655,7 +679,7 @@ App::post('/v1/teams/:teamId/memberships')
             }
 
             $membership = ($isPrivilegedUser || $isAppUser) ?
-                Authorization::skip(fn () => $dbForProject->updateDocument('memberships', $membership->getId(), $membership)) :
+                $authorization->skip(fn () => $dbForProject->updateDocument('memberships', $membership->getId(), $membership)) :
                 $dbForProject->updateDocument('memberships', $membership->getId(), $membership);
         } else {
             throw new Exception(Exception::MEMBERSHIP_ALREADY_CONFIRMED);
@@ -749,7 +773,6 @@ App::post('/v1/teams/:teamId/memberships')
                     ->setName($invitee->getAttribute('name', ''))
                     ->setVariables($emailVariables)
                     ->trigger();
-
             } elseif (!empty($phone)) {
                 if (empty(System::getEnv('_APP_SMS_PROVIDER'))) {
                     throw new Exception(Exception::GENERAL_PHONE_DISABLED, 'Phone provider not configured');
@@ -827,7 +850,7 @@ App::get('/v1/teams/:teamId/memberships')
         group: 'memberships',
         name: 'listMemberships',
         description: '/docs/references/teams/list-team-members.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -838,10 +861,12 @@ App::get('/v1/teams/:teamId/memberships')
     ->param('teamId', '', new UID(), 'Team ID.')
     ->param('queries', [], new Memberships(), 'Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/queries). Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' queries are allowed, each ' . APP_LIMIT_ARRAY_ELEMENT_SIZE . ' characters long. You may filter on the following attributes: ' . implode(', ', Memberships::ALLOWED_ATTRIBUTES), true)
     ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
+    ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
     ->inject('response')
     ->inject('project')
     ->inject('dbForProject')
-    ->action(function (string $teamId, array $queries, string $search, Response $response, Document $project, Database $dbForProject) {
+    ->inject('authorization')
+    ->action(function (string $teamId, array $queries, string $search, bool $includeTotal, Response $response, Document $project, Database $dbForProject, Authorization $authorization) {
         $team = $dbForProject->getDocument('teams', $teamId);
 
         if ($team->isEmpty()) {
@@ -893,11 +918,11 @@ App::get('/v1/teams/:teamId/memberships')
                 collection: 'memberships',
                 queries: $queries,
             );
-            $total = $dbForProject->count(
+            $total = $includeTotal ? $dbForProject->count(
                 collection: 'memberships',
                 queries: $filterQueries,
                 max: APP_LIMIT_COUNT
-            );
+            ) : 0;
         } catch (OrderException $e) {
             throw new Exception(Exception::DATABASE_QUERY_ORDER_NULL, "The order attribute '{$e->getAttribute()}' had a null value. Cursor pagination requires all documents order attribute values are non-null.");
         }
@@ -911,9 +936,9 @@ App::get('/v1/teams/:teamId/memberships')
             'mfa' => $project->getAttribute('auths', [])['membershipsMfa'] ?? true,
         ];
 
-        $roles = Authorization::getRoles();
-        $isPrivilegedUser = Auth::isPrivilegedUser($roles);
-        $isAppUser = Auth::isAppUser($roles);
+        $roles = $authorization->getRoles();
+        $isPrivilegedUser = User::isPrivileged($roles);
+        $isAppUser = User::isApp($roles);
 
         $membershipsPrivacy = array_map(function ($privacy) use ($isPrivilegedUser, $isAppUser) {
             return $privacy || $isPrivilegedUser || $isAppUser;
@@ -969,7 +994,7 @@ App::get('/v1/teams/:teamId/memberships/:membershipId')
         group: 'memberships',
         name: 'getMembership',
         description: '/docs/references/teams/get-team-member.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -982,7 +1007,8 @@ App::get('/v1/teams/:teamId/memberships/:membershipId')
     ->inject('response')
     ->inject('project')
     ->inject('dbForProject')
-    ->action(function (string $teamId, string $membershipId, Response $response, Document $project, Database $dbForProject) {
+    ->inject('authorization')
+    ->action(function (string $teamId, string $membershipId, Response $response, Document $project, Database $dbForProject, Authorization $authorization) {
 
         $team = $dbForProject->getDocument('teams', $teamId);
 
@@ -1002,9 +1028,9 @@ App::get('/v1/teams/:teamId/memberships/:membershipId')
             'mfa' => $project->getAttribute('auths', [])['membershipsMfa'] ?? true,
         ];
 
-        $roles = Authorization::getRoles();
-        $isPrivilegedUser = Auth::isPrivilegedUser($roles);
-        $isAppUser = Auth::isAppUser($roles);
+        $roles = $authorization->getRoles();
+        $isPrivilegedUser = User::isPrivileged($roles);
+        $isAppUser = User::isApp($roles);
 
         $membershipsPrivacy = array_map(function ($privacy) use ($isPrivilegedUser, $isAppUser) {
             return $privacy || $isPrivilegedUser || $isAppUser;
@@ -1056,7 +1082,7 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId')
         group: 'memberships',
         name: 'updateMembership',
         description: '/docs/references/teams/update-team-membership.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -1069,8 +1095,8 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId')
     ->param('roles', [], function (Document $project) {
         if ($project->getId() === 'console') {
             $roles = array_keys(Config::getParam('roles', []));
-            array_filter($roles, function ($role) {
-                return !in_array($role, [Auth::USER_ROLE_APPS, Auth::USER_ROLE_GUESTS, Auth::USER_ROLE_USERS]);
+            $roles = array_filter($roles, function ($role) {
+                return !in_array($role, [User::ROLE_APPS, User::ROLE_GUESTS, User::ROLE_USERS]);
             });
             return new ArrayList(new WhiteList($roles), APP_LIMIT_ARRAY_PARAMS_SIZE);
         }
@@ -1081,8 +1107,9 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId')
     ->inject('user')
     ->inject('project')
     ->inject('dbForProject')
+    ->inject('authorization')
     ->inject('queueForEvents')
-    ->action(function (string $teamId, string $membershipId, array $roles, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Event $queueForEvents) {
+    ->action(function (string $teamId, string $membershipId, array $roles, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Authorization $authorization, Event $queueForEvents) {
 
         $team = $dbForProject->getDocument('teams', $teamId);
         if ($team->isEmpty()) {
@@ -1099,9 +1126,9 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId')
             throw new Exception(Exception::USER_NOT_FOUND);
         }
 
-        $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles());
-        $isAppUser = Auth::isAppUser(Authorization::getRoles());
-        $isOwner = Authorization::isRole('team:' . $team->getId() . '/owner');
+        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAppUser = User::isApp($authorization->getRoles());
+        $isOwner = $authorization->hasRole('team:' . $team->getId() . '/owner');
 
         if ($project->getId() === 'console') {
             // Quick check: fetch up to 2 owners to determine if only one exists
@@ -1166,7 +1193,7 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
         group: 'memberships',
         name: 'updateMembershipStatus',
         description: '/docs/references/teams/update-team-membership-status.md',
-        auth: [AuthType::SESSION, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_OK,
@@ -1182,10 +1209,13 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
     ->inject('response')
     ->inject('user')
     ->inject('dbForProject')
+    ->inject('authorization')
     ->inject('project')
     ->inject('geodb')
     ->inject('queueForEvents')
-    ->action(function (string $teamId, string $membershipId, string $userId, string $secret, Request $request, Response $response, Document $user, Database $dbForProject, Document $project, Reader $geodb, Event $queueForEvents) {
+    ->inject('store')
+    ->inject('proofForToken')
+    ->action(function (string $teamId, string $membershipId, string $userId, string $secret, Request $request, Response $response, Document $user, Database $dbForProject, Authorization $authorization, $project, Reader $geodb, Event $queueForEvents, Store $store, Token $proofForToken) {
         $protocol = $request->getProtocol();
 
         $membership = $dbForProject->getDocument('memberships', $membershipId);
@@ -1194,7 +1224,7 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
             throw new Exception(Exception::MEMBERSHIP_NOT_FOUND);
         }
 
-        $team = Authorization::skip(fn () => $dbForProject->getDocument('teams', $teamId));
+        $team = $authorization->skip(fn () => $dbForProject->getDocument('teams', $teamId));
 
         if ($team->isEmpty()) {
             throw new Exception(Exception::TEAM_NOT_FOUND);
@@ -1204,7 +1234,7 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
             throw new Exception(Exception::TEAM_MEMBERSHIP_MISMATCH);
         }
 
-        if (Auth::hash($secret) !== $membership->getAttribute('secret')) {
+        if (!$proofForToken->verify($secret, $membership->getAttribute('secret'))) {
             throw new Exception(Exception::TEAM_INVALID_SECRET);
         }
 
@@ -1230,17 +1260,17 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
             ->setAttribute('confirm', true)
         ;
 
-        Authorization::skip(fn () => $dbForProject->updateDocument('users', $user->getId(), $user->setAttribute('emailVerification', true)));
+        $authorization->skip(fn () => $dbForProject->updateDocument('users', $user->getId(), $user->setAttribute('emailVerification', true)));
 
         // Create session for the user if not logged in
         if (!$hasSession) {
-            Authorization::setRole(Role::user($user->getId())->toString());
+            $authorization->addRole(Role::user($user->getId())->toString());
 
             $detector = new Detector($request->getUserAgent('UNKNOWN'));
             $record = $geodb->get($request->getIP());
-            $authDuration = $project->getAttribute('auths', [])['duration'] ?? Auth::TOKEN_EXPIRATION_LOGIN_LONG;
+            $authDuration = $project->getAttribute('auths', [])['duration'] ?? TOKEN_EXPIRATION_LOGIN_LONG;
             $expire = DateTime::addSeconds(new \DateTime(), $authDuration);
-            $secret = Auth::tokenGenerator();
+            $secret = $proofForToken->generate();
             $session = new Document(array_merge([
                 '$id' => ID::unique(),
                 '$permissions' => [
@@ -1250,9 +1280,9 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
                 ],
                 'userId' => $user->getId(),
                 'userInternalId' => $user->getSequence(),
-                'provider' => Auth::SESSION_PROVIDER_EMAIL,
+                'provider' => SESSION_PROVIDER_EMAIL,
                 'providerUid' => $user->getAttribute('email'),
-                'secret' => Auth::hash($secret), // One way hash encryption to protect DB leak
+                'secret' => $proofForToken->hash($secret), // One way hash encryption to protect DB leak
                 'userAgent' => $request->getUserAgent('UNKNOWN'),
                 'ip' => $request->getIP(),
                 'factors' => ['email'],
@@ -1262,16 +1292,21 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
 
             $session = $dbForProject->createDocument('sessions', $session);
 
-            Authorization::setRole(Role::user($userId)->toString());
+            $authorization->addRole(Role::user($userId)->toString());
+
+            $encoded = $store
+                ->setProperty('id', $user->getId())
+                ->setProperty('secret', $secret)
+                ->encode();
 
             if (!Config::getParam('domainVerification')) {
-                $response->addHeader('X-Fallback-Cookies', \json_encode([Auth::$cookieName => Auth::encodeSession($user->getId(), $secret)]));
+                $response->addHeader('X-Fallback-Cookies', \json_encode([$store->getKey() => $encoded]));
             }
 
             $response
                 ->addCookie(
-                    name: Auth::$cookieName . '_legacy',
-                    value: Auth::encodeSession($user->getId(), $secret),
+                    name: $store->getKey() . '_legacy',
+                    value: $encoded,
                     expire: (new \DateTime($expire))->getTimestamp(),
                     path: '/',
                     domain: Config::getParam('cookieDomain'),
@@ -1279,8 +1314,8 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
                     httponly: true
                 )
                 ->addCookie(
-                    name: Auth::$cookieName,
-                    value: Auth::encodeSession($user->getId(), $secret),
+                    name: $store->getKey(),
+                    value: $encoded,
                     expire: (new \DateTime($expire))->getTimestamp(),
                     path: '/',
                     domain: Config::getParam('cookieDomain'),
@@ -1295,7 +1330,7 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
 
         $dbForProject->purgeCachedDocument('users', $user->getId());
 
-        Authorization::skip(fn () => $dbForProject->increaseDocumentAttribute('teams', $team->getId(), 'total', 1));
+        $authorization->skip(fn () => $dbForProject->increaseDocumentAttribute('teams', $team->getId(), 'total', 1));
 
         $queueForEvents
             ->setParam('userId', $user->getId())
@@ -1324,7 +1359,7 @@ App::delete('/v1/teams/:teamId/memberships/:membershipId')
         group: 'memberships',
         name: 'deleteMembership',
         description: '/docs/references/teams/delete-team-membership.md',
-        auth: [AuthType::SESSION, AuthType::KEY, AuthType::JWT],
+        auth: [AuthType::ADMIN, AuthType::SESSION, AuthType::KEY, AuthType::JWT],
         responses: [
             new SDKResponse(
                 code: Response::STATUS_CODE_NOCONTENT,
@@ -1339,8 +1374,9 @@ App::delete('/v1/teams/:teamId/memberships/:membershipId')
     ->inject('project')
     ->inject('response')
     ->inject('dbForProject')
+    ->inject('authorization')
     ->inject('queueForEvents')
-    ->action(function (string $teamId, string $membershipId, Document $user, Document $project, Response $response, Database $dbForProject, Event $queueForEvents) {
+    ->action(function (string $teamId, string $membershipId, Document $user, Document $project, Response $response, Database $dbForProject, Authorization $authorization, Event $queueForEvents) {
 
         $membership = $dbForProject->getDocument('memberships', $membershipId);
 
@@ -1398,7 +1434,7 @@ App::delete('/v1/teams/:teamId/memberships/:membershipId')
         $dbForProject->purgeCachedDocument('users', $profile->getId());
 
         if ($membership->getAttribute('confirm')) { // Count only confirmed members
-            Authorization::skip(fn () => $dbForProject->decreaseDocumentAttribute('teams', $team->getId(), 'total', 1, 0));
+            $authorization->skip(fn () => $dbForProject->decreaseDocumentAttribute('teams', $team->getId(), 'total', 1, 0));
         }
 
         $queueForEvents
@@ -1430,11 +1466,12 @@ App::get('/v1/teams/:teamId/logs')
     ))
     ->param('teamId', '', new UID(), 'Team ID.')
     ->param('queries', [], new Queries([new Limit(), new Offset()]), 'Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/queries). Only supported methods are limit and offset', true)
+    ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
     ->inject('response')
     ->inject('dbForProject')
     ->inject('locale')
     ->inject('geodb')
-    ->action(function (string $teamId, array $queries, Response $response, Database $dbForProject, Locale $locale, Reader $geodb) {
+    ->action(function (string $teamId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb) {
 
         $team = $dbForProject->getDocument('teams', $teamId);
 
@@ -1448,12 +1485,6 @@ App::get('/v1/teams/:teamId/logs')
             throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
         }
 
-        // Temp fix for logs
-        $queries[] = Query::or([
-            Query::greaterThan('$createdAt', DateTime::format(new \DateTime('2025-02-26T01:30+00:00'))),
-            Query::lessThan('$createdAt', DateTime::format(new \DateTime('2025-02-13T00:00+00:00'))),
-        ]);
-
         $audit = new Audit($dbForProject);
         $resource = 'team/' . $team->getId();
         $logs = $audit->getLogsByResource($resource, $queries);
@@ -1503,7 +1534,7 @@ App::get('/v1/teams/:teamId/logs')
             }
         }
         $response->dynamic(new Document([
-            'total' => $audit->countLogsByResource($resource, $queries),
+            'total' => $includeTotal ? $audit->countLogsByResource($resource, $queries) : 0,
             'logs' => $output,
         ]), Response::MODEL_LOG_LIST);
     });

app/controllers/api/vcs.php

@@ -4,7 +4,6 @@ use Appwrite\Auth\OAuth2\Github as OAuth2Github;
 use Appwrite\Event\Build;
 use Appwrite\Event\Delete;
 use Appwrite\Extend\Exception;
-use Appwrite\Network\Validator\Redirect;
 use Appwrite\SDK\AuthType;
 use Appwrite\SDK\ContentType;
 use Appwrite\SDK\Method;
@@ -14,9 +13,12 @@ use Appwrite\Utopia\Database\Validator\Queries\Installations;
 use Appwrite\Utopia\Request;
 use Appwrite\Utopia\Response;
 use Appwrite\Vcs\Comment;
+use Swoole\Coroutine\WaitGroup;
 use Utopia\App;
 use Utopia\CLI\Console;
+use Utopia\Config\Adapters\Dotenv as ConfigDotenv;
 use Utopia\Config\Config;
+use Utopia\Config\Exceptions\Parse;
 use Utopia\Database\Database;
 use Utopia\Database\DateTime;
 use Utopia\Database\Document;
@@ -28,13 +30,24 @@ use Utopia\Database\Helpers\Permission;
 use Utopia\Database\Helpers\Role;
 use Utopia\Database\Query;
 use Utopia\Database\Validator\Authorization;
+use Utopia\Database\Validator\Queries;
 use Utopia\Database\Validator\Query\Cursor;
+use Utopia\Database\Validator\Query\Limit;
+use Utopia\Database\Validator\Query\Offset;
+use Utopia\Detector\Detection\Framework\Analog;
+use Utopia\Detector\Detection\Framework\Angular;
 use Utopia\Detector\Detection\Framework\Astro;
 use Utopia\Detector\Detection\Framework\Flutter;
+use Utopia\Detector\Detection\Framework\Lynx;
 use Utopia\Detector\Detection\Framework\NextJs;
 use Utopia\Detector\Detection\Framework\Nuxt;
+use Utopia\Detector\Detection\Framework\React;
+use Utopia\Detector\Detection\Framework\ReactNative;
 use Utopia\Detector\Detection\Framework\Remix;
+use Utopia\Detector\Detection\Framework\Svelte;
 use Utopia\Detector\Detection\Framework\SvelteKit;
+use Utopia\Detector\Detection\Framework\TanStackStart;
+use Utopia\Detector\Detection\Framework\Vue;
 use Utopia\Detector\Detection\Packager\NPM;
 use Utopia\Detector\Detection\Packager\PNPM;
 use Utopia\Detector\Detection\Packager\Yarn;
@@ -58,11 +71,12 @@ use Utopia\Validator\Boolean;
 use Utopia\Validator\Text;
 use Utopia\Validator\WhiteList;
 use Utopia\VCS\Adapter\Git\GitHub;
+use Utopia\VCS\Exception\FileNotFound;
 use Utopia\VCS\Exception\RepositoryNotFound;
 
 use function Swoole\Coroutine\batch;
 
-$createGitDeployments = function (GitHub $github, string $providerInstallationId, array $repositories, string $providerBranch, string $providerBranchUrl, string $providerRepositoryName, string $providerRepositoryUrl, string $providerRepositoryOwner, string $providerCommitHash, string $providerCommitAuthor, string $providerCommitAuthorUrl, string $providerCommitMessage, string $providerCommitUrl, string $providerPullRequestId, bool $external, Database $dbForPlatform, Build $queueForBuilds, callable $getProjectDB, Request $request) {
+$createGitDeployments = function (GitHub $github, string $providerInstallationId, array $repositories, string $providerBranch, string $providerBranchUrl, string $providerRepositoryName, string $providerRepositoryUrl, string $providerRepositoryOwner, string $providerCommitHash, string $providerCommitAuthor, string $providerCommitAuthorUrl, string $providerCommitMessage, string $providerCommitUrl, string $providerPullRequestId, bool $external, Database $dbForPlatform, Authorization $authorization, Build $queueForBuilds, callable $getProjectDB, Request $request, array $platform) {
     $errors = [];
     foreach ($repositories as $repository) {
         try {
@@ -73,12 +87,12 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
             }
 
             $projectId = $repository->getAttribute('projectId');
-            $project = Authorization::skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
+            $project = $authorization->skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
             $dbForProject = $getProjectDB($project);
 
             $resourceCollection = $resourceType === "function" ? 'functions' : 'sites';
             $resourceId = $repository->getAttribute('resourceId');
-            $resource = Authorization::skip(fn () => $dbForProject->getDocument($resourceCollection, $resourceId));
+            $resource = $authorization->skip(fn () => $dbForProject->getDocument($resourceCollection, $resourceId));
             $resourceInternalId = $resource->getSequence();
 
             $deploymentId = ID::unique();
@@ -118,7 +132,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
 
             $commentStatus = $isAuthorized ? 'waiting' : 'failed';
             $protocol = System::getEnv('_APP_OPTIONS_FORCE_HTTPS') === 'disabled' ? 'http' : 'https';
-            $hostname = System::getEnv('_APP_CONSOLE_DOMAIN', System::getEnv('_APP_DOMAIN', ''));
+            $hostname = $platform['consoleHostname'] ?? '';
 
             $authorizeUrl = $protocol . '://' . $hostname . "/console/git/authorize-contributor?projectId={$projectId}&installationId={$installationId}&repositoryId={$repositoryId}&providerPullRequestId={$providerPullRequestId}";
 
@@ -127,7 +141,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
             $latestCommentId = '';
 
             if (!empty($providerPullRequestId) && $resource->getAttribute('providerSilentMode', false) === false) {
-                $latestComment = Authorization::skip(fn () => $dbForPlatform->findOne('vcsComments', [
+                $latestComment = $authorization->skip(fn () => $dbForPlatform->findOne('vcsComments', [
                     Query::equal('providerRepositoryId', [$providerRepositoryId]),
                     Query::equal('providerPullRequestId', [$providerPullRequestId]),
                     Query::orderDesc('$createdAt'),
@@ -160,24 +174,24 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                     if ($lockAcquired) {
                         // Wrap in try/finally to ensure lock file gets deleted
                         try {
-                            $comment = new Comment();
+                            $comment = new Comment($platform);
                             $comment->parseComment($github->getComment($owner, $repositoryName, $latestCommentId));
                             $comment->addBuild($project, $resource, $resourceType, $commentStatus, $deploymentId, $action, '');
 
                             $latestCommentId = \strval($github->updateComment($owner, $repositoryName, $latestCommentId, $comment->generateComment()));
                         } finally {
-                            $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId);
+                            $authorization->skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
                         }
                     }
                 } else {
-                    $comment = new Comment();
+                    $comment = new Comment($platform);
                     $comment->addBuild($project, $resource, $resourceType, $commentStatus, $deploymentId, $action, '');
                     $latestCommentId = \strval($github->createComment($owner, $repositoryName, $providerPullRequestId, $comment->generateComment()));
 
                     if (!empty($latestCommentId)) {
                         $teamId = $project->getAttribute('teamId', '');
 
-                        $latestComment = Authorization::skip(fn () => $dbForPlatform->createDocument('vcsComments', new Document([
+                        $latestComment = $authorization->skip(fn () => $dbForPlatform->createDocument('vcsComments', new Document([
                             '$id' => ID::unique(),
                             '$permissions' => [
                                 Permission::read(Role::team(ID::custom($teamId))),
@@ -198,7 +212,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                     }
                 }
             } elseif (!empty($providerBranch)) {
-                $latestComments = Authorization::skip(fn () => $dbForPlatform->find('vcsComments', [
+                $latestComments = $authorization->skip(fn () => $dbForPlatform->find('vcsComments', [
                     Query::equal('providerRepositoryId', [$providerRepositoryId]),
                     Query::equal('providerBranch', [$providerBranch]),
                     Query::orderDesc('$createdAt'),
@@ -231,13 +245,13 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                     if ($lockAcquired) {
                         // Wrap in try/finally to ensure lock file gets deleted
                         try {
-                            $comment = new Comment();
+                            $comment = new Comment($platform);
                             $comment->parseComment($github->getComment($owner, $repositoryName, $latestCommentId));
                             $comment->addBuild($project, $resource, $resourceType, $commentStatus, $deploymentId, $action, '');
 
                             $latestCommentId = \strval($github->updateComment($owner, $repositoryName, $latestCommentId, $comment->generateComment()));
                         } finally {
-                            $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId);
+                            $authorization->skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
                         }
                     }
                 }
@@ -280,7 +294,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                 $commands[] = $resource->getAttribute('commands', '');
             }
 
-            $deployment = Authorization::skip(fn () => $dbForProject->createDocument('deployments', new Document([
+            $deployment = $authorization->skip(fn () => $dbForProject->createDocument('deployments', new Document([
                 '$id' => $deploymentId,
                 '$permissions' => [
                     Permission::read(Role::any()),
@@ -320,7 +334,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                 ->setAttribute('latestDeploymentInternalId', $deployment->getSequence())
                 ->setAttribute('latestDeploymentCreatedAt', $deployment->getCreatedAt())
                 ->setAttribute('latestDeploymentStatus', $deployment->getAttribute('status', ''));
-            Authorization::skip(fn () => $dbForProject->updateDocument($resource->getCollection(), $resource->getId(), $resource));
+            $authorization->skip(fn () => $dbForProject->updateDocument($resource->getCollection(), $resource->getId(), $resource));
 
             if ($resource->getCollection() === 'sites') {
                 $projectId = $project->getId();
@@ -330,7 +344,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                 $domain = ID::unique() . "." . $sitesDomain;
                 $ruleId = md5($domain);
                 $previewRuleId = $ruleId;
-                Authorization::skip(
+                $authorization->skip(
                     fn () => $dbForPlatform->createDocument('rules', new Document([
                         '$id' => $ruleId,
                         'projectId' => $project->getId(),
@@ -363,7 +377,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                     $domain = "branch-{$branchPrefix}-{$resourceProjectHash}.{$sitesDomain}";
                     $ruleId = md5($domain);
                     try {
-                        Authorization::skip(
+                        $authorization->skip(
                             fn () => $dbForPlatform->createDocument('rules', new Document([
                                 '$id' => $ruleId,
                                 'projectId' => $project->getId(),
@@ -394,7 +408,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                     $domain = "commit-" . substr($providerCommitHash, 0, 16) . ".{$sitesDomain}";
                     $ruleId = md5($domain);
                     try {
-                        Authorization::skip(
+                        $authorization->skip(
                             fn () => $dbForPlatform->createDocument('rules', new Document([
                                 '$id' => $ruleId,
                                 'projectId' => $project->getId(),
@@ -446,19 +460,19 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                 if ($lockAcquired) {
                     // Wrap in try/finally to ensure lock file gets deleted
                     try {
-                        $rule = Authorization::skip(fn () => $dbForPlatform->getDocument('rules', $previewRuleId));
+                        $rule = $authorization->skip(fn () => $dbForPlatform->getDocument('rules', $previewRuleId));
 
                         $protocol = System::getEnv('_APP_OPTIONS_FORCE_HTTPS') === 'disabled' ? 'http' : 'https';
                         $previewUrl = !empty($rule) ? ("{$protocol}://" . $rule->getAttribute('domain', '')) : '';
 
                         if (!empty($previewUrl)) {
-                            $comment = new Comment();
+                            $comment = new Comment($platform);
                             $comment->parseComment($github->getComment($owner, $repositoryName, $latestCommentId));
                             $comment->addBuild($project, $resource, $resourceType, $commentStatus, $deploymentId, $action, $previewUrl);
                             $github->updateComment($owner, $repositoryName, $latestCommentId, $comment->generateComment());
                         }
                     } finally {
-                        $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId);
+                        $authorization->skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
                     }
                 }
             }
@@ -527,12 +541,12 @@ App::get('/v1/vcs/github/authorize')
         type: MethodType::WEBAUTH,
         hide: true,
     ))
-    ->param('success', '', fn ($platforms) => new Redirect($platforms), 'URL to redirect back to console after a successful installation attempt.', true, ['platforms'])
-    ->param('failure', '', fn ($platforms) => new Redirect($platforms), 'URL to redirect back to console after a failed installation attempt.', true, ['platforms'])
-    ->inject('request')
+    ->param('success', '', fn ($redirectValidator) => $redirectValidator, 'URL to redirect back to console after a successful installation attempt.', true, ['redirectValidator'])
+    ->param('failure', '', fn ($redirectValidator) => $redirectValidator, 'URL to redirect back to console after a failed installation attempt.', true, ['redirectValidator'])
     ->inject('response')
     ->inject('project')
-    ->action(function (string $success, string $failure, Request $request, Response $response, Document $project) {
+    ->inject('platform')
+    ->action(function (string $success, string $failure, Response $response, Document $project, array $platform) {
         $state = \json_encode([
             'projectId' => $project->getId(),
             'success' => $success,
@@ -541,7 +555,7 @@ App::get('/v1/vcs/github/authorize')
 
         $appName = System::getEnv('_APP_VCS_GITHUB_APP_NAME');
         $protocol = System::getEnv('_APP_OPTIONS_FORCE_HTTPS') === 'disabled' ? 'http' : 'https';
-        $hostname = System::getEnv('_APP_CONSOLE_DOMAIN', System::getEnv('_APP_DOMAIN', ''));
+        $hostname = $platform['consoleHostname'] ?? '';
 
         if (empty($appName)) {
             throw new Exception(Exception::GENERAL_SERVER_ERROR, 'GitHub App name is not configured. Please configure VCS (Version Control System) variables in .env file.');
@@ -570,10 +584,10 @@ App::get('/v1/vcs/github/callback')
     ->inject('gitHub')
     ->inject('user')
     ->inject('project')
-    ->inject('request')
     ->inject('response')
     ->inject('dbForPlatform')
-    ->action(function (string $providerInstallationId, string $setupAction, string $state, string $code, GitHub $github, Document $user, Document $project, Request $request, Response $response, Database $dbForPlatform) {
+    ->inject('platform')
+    ->action(function (string $providerInstallationId, string $setupAction, string $state, string $code, GitHub $github, Document $user, Document $project, Response $response, Database $dbForPlatform, array $platform) {
         if (empty($state)) {
             $error = 'Installation requests from organisation members for the Appwrite GitHub App are currently unsupported. To proceed with the installation, login to the Appwrite Console and install the GitHub App.';
             throw new Exception(Exception::GENERAL_ARGUMENT_INVALID, $error);
@@ -600,7 +614,7 @@ App::get('/v1/vcs/github/callback')
 
         $region = $project->getAttribute('region', 'default');
         $protocol = System::getEnv('_APP_OPTIONS_FORCE_HTTPS') === 'disabled' ? 'http' : 'https';
-        $hostname = System::getEnv('_APP_CONSOLE_DOMAIN', System::getEnv('_APP_DOMAIN', ''));
+        $hostname = $platform['consoleHostname'] ?? '';
 
         $defaultState = [
             'success' => $protocol . '://' . $hostname . "/console/project-$region-$projectId/settings/git-installations",
@@ -818,7 +832,10 @@ App::post('/v1/vcs/github/installations/:installationId/detections')
         $files = \array_column($files, 'name');
         $languages = $github->listRepositoryLanguages($owner, $repositoryName);
 
-        $detector = new Packager($files);
+        $detector = new Packager();
+        foreach ($files as $file) {
+            $detector->addInput($file);
+        }
         $detector
             ->addOption(new Yarn())
             ->addOption(new PNPM())
@@ -828,6 +845,14 @@ App::post('/v1/vcs/github/installations/:installationId/detections')
         $packager = !\is_null($detection) ? $detection->getName() : 'npm';
 
         if ($type === 'framework') {
+            $packages = '';
+            try {
+                $contentResponse = $github->getRepositoryContent($owner, $repositoryName, \rtrim($providerRootDirectory, '/') . '/package.json');
+                $packages = $contentResponse['content'] ?? '';
+            } catch (FileNotFound $e) {
+                // Continue detection without package.json
+            }
+
             $output = new Document([
                 'framework' => '',
                 'installCommand' => '',
@@ -835,14 +860,27 @@ App::post('/v1/vcs/github/installations/:installationId/detections')
                 'outputDirectory' => '',
             ]);
 
-            $detector = new Framework($files, $packager);
+            $detector = new Framework($packager);
+            $detector->addInput($packages, Framework::INPUT_PACKAGES);
+            foreach ($files as $file) {
+                $detector->addInput($file, Framework::INPUT_FILE);
+            }
+
             $detector
-                ->addOption(new Flutter())
-                ->addOption(new Nuxt())
+                ->addOption(new Analog())
+                ->addOption(new Angular())
                 ->addOption(new Astro())
-                ->addOption(new SvelteKit())
+                ->addOption(new Flutter())
+                ->addOption(new Lynx())
                 ->addOption(new NextJs())
-                ->addOption(new Remix());
+                ->addOption(new Nuxt())
+                ->addOption(new React())
+                ->addOption(new ReactNative())
+                ->addOption(new Remix())
+                ->addOption(new Svelte())
+                ->addOption(new SvelteKit())
+                ->addOption(new TanStackStart())
+                ->addOption(new Vue());
 
             $framework = $detector->detect();
 
@@ -877,7 +915,18 @@ App::post('/v1/vcs/github/installations/:installationId/detections')
             ];
 
             foreach ($strategies as $strategy) {
-                $detector = new Runtime($strategy === Strategy::LANGUAGES ? $languages : $files, $strategy, $packager);
+                $detector = new Runtime($strategy, $packager);
+
+                if ($strategy === Strategy::LANGUAGES) {
+                    foreach ($languages as $language) {
+                        $detector->addInput($language);
+                    }
+                } else {
+                    foreach ($files as $file) {
+                        $detector->addInput($file);
+                    }
+                }
+
                 $detector
                     ->addOption(new Node())
                     ->addOption(new Bun())
@@ -919,6 +968,46 @@ App::post('/v1/vcs/github/installations/:installationId/detections')
                 throw new Exception(Exception::FUNCTION_RUNTIME_NOT_DETECTED);
             }
         }
+
+        $wg = new WaitGroup();
+        $envs = [];
+        foreach ($files as $file) {
+            if (!(\str_starts_with($file, '.env'))) {
+                continue;
+            }
+
+            $wg->add();
+            go(function () use ($github, $owner, $repositoryName, $providerRootDirectory, $file, $wg, &$envs) {
+                try {
+                    $contentResponse = $github->getRepositoryContent($owner, $repositoryName, \rtrim($providerRootDirectory, '/') . '/' . $file);
+                    $envFile = $contentResponse['content'] ?? '';
+
+                    $configAdapter = new ConfigDotenv();
+                    try {
+                        $envObject = $configAdapter->parse($envFile);
+                        foreach ($envObject as $envName => $envValue) {
+                            $envs[$envName] = $envValue;
+                        }
+                    } catch (Parse $err) {
+                        // Silence error, so rest of endpoint can return
+                    }
+                } finally {
+                    $wg->done();
+                }
+            });
+        }
+        $wg->wait();
+
+        $variables = [];
+        foreach ($envs as $key => $value) {
+            $variables[] = [
+                'name' => $key,
+                'value' => $value,
+            ];
+        }
+
+        $output->setAttribute('variables', $variables);
+
         $response->dynamic($output, $type === 'framework' ? Response::MODEL_DETECTION_FRAMEWORK : Response::MODEL_DETECTION_RUNTIME);
     });
 
@@ -946,10 +1035,11 @@ App::get('/v1/vcs/github/installations/:installationId/providerRepositories')
     ->param('installationId', '', new Text(256), 'Installation Id')
     ->param('type', '', new WhiteList(['runtime', 'framework']), 'Detector type. Must be one of the following: runtime, framework')
     ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
+    ->param('queries', [], new Queries([new Limit(), new Offset()]), 'Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/queries). Only supported methods are limit and offset', true)
     ->inject('gitHub')
     ->inject('response')
     ->inject('dbForPlatform')
-    ->action(function (string $installationId, string $type, string $search, GitHub $github, Response $response, Database $dbForPlatform) {
+    ->action(function (string $installationId, string $type, string $search, array $queries, GitHub $github, Response $response, Database $dbForPlatform) {
         if (empty($search)) {
             $search = "";
         }
@@ -965,11 +1055,20 @@ App::get('/v1/vcs/github/installations/:installationId/providerRepositories')
         $githubAppId = System::getEnv('_APP_VCS_GITHUB_APP_ID');
         $github->initializeVariables($providerInstallationId, $privateKey, $githubAppId);
 
-        $page = 1;
-        $perPage = 4;
+        $queries = Query::parseQueries($queries);
+        $limitQuery = current(array_filter($queries, fn ($query) => $query->getMethod() === Query::TYPE_LIMIT));
+        $offsetQuery = current(array_filter($queries, fn ($query) => $query->getMethod() === Query::TYPE_OFFSET));
 
+        $limit = !empty($limitQuery) ? $limitQuery->getValue() : 4;
+        $offset = !empty($offsetQuery) ? $offsetQuery->getValue() : 0;
+
+        if ($offset % $limit !== 0) {
+            throw new Exception(Exception::GENERAL_ARGUMENT_INVALID, 'offset must be a multiple of the limit');
+        }
+
+        $page = ($offset / $limit) + 1;
         $owner = $github->getOwnerName($providerInstallationId);
-        $repos = $github->searchRepositories($owner, $page, $perPage, $search);
+        ['items' => $repos, 'total' => $total] = $github->searchRepositories($owner, $page, $limit, $search);
 
         $repos = \array_map(function ($repo) use ($installation) {
             $repo['id'] = \strval($repo['id'] ?? '');
@@ -984,7 +1083,10 @@ App::get('/v1/vcs/github/installations/:installationId/providerRepositories')
                 $files = $github->listRepositoryContents($repo['organization'], $repo['name'], '');
                 $files = \array_column($files, 'name');
 
-                $detector = new Packager($files);
+                $detector = new Packager();
+                foreach ($files as $file) {
+                    $detector->addInput($file);
+                }
                 $detector
                     ->addOption(new Yarn())
                     ->addOption(new PNPM())
@@ -994,14 +1096,35 @@ App::get('/v1/vcs/github/installations/:installationId/providerRepositories')
                 $packager = !\is_null($detection) ? $detection->getName() : 'npm';
 
                 if ($type === 'framework') {
-                    $frameworkDetector = new Framework($files, $packager);
+                    $packages = '';
+                    try {
+                        $contentResponse = $github->getRepositoryContent($repo['organization'], $repo['name'], 'package.json');
+                        $packages = $contentResponse['content'] ?? '';
+                    } catch (FileNotFound $e) {
+                        // Continue detection without package.json
+                    }
+
+                    $frameworkDetector = new Framework($packager);
+                    $frameworkDetector->addInput($packages, Framework::INPUT_PACKAGES);
+                    foreach ($files as $file) {
+                        $frameworkDetector->addInput($file, Framework::INPUT_FILE);
+                    }
+
                     $frameworkDetector
-                        ->addOption(new Flutter())
-                        ->addOption(new Nuxt())
+                        ->addOption(new Analog())
+                        ->addOption(new Angular())
                         ->addOption(new Astro())
-                        ->addOption(new SvelteKit())
+                        ->addOption(new Flutter())
+                        ->addOption(new Lynx())
                         ->addOption(new NextJs())
-                        ->addOption(new Remix());
+                        ->addOption(new Nuxt())
+                        ->addOption(new React())
+                        ->addOption(new ReactNative())
+                        ->addOption(new Remix())
+                        ->addOption(new Svelte())
+                        ->addOption(new SvelteKit())
+                        ->addOption(new TanStackStart())
+                        ->addOption(new Vue());
 
                     $detectedFramework = $frameworkDetector->detect();
 
@@ -1026,7 +1149,16 @@ App::get('/v1/vcs/github/installations/:installationId/providerRepositories')
                     ];
 
                     foreach ($strategies as $strategy) {
-                        $detector = new Runtime($strategy === Strategy::LANGUAGES ? $languages : $files, $strategy, $packager);
+                        $detector = new Runtime($strategy, $packager);
+                        if ($strategy === Strategy::LANGUAGES) {
+                            foreach ($languages as $language) {
+                                $detector->addInput($language);
+                            }
+                        } else {
+                            foreach ($files as $file) {
+                                $detector->addInput($file);
+                            }
+                        }
                         $detector
                             ->addOption(new Node())
                             ->addOption(new Bun())
@@ -1060,6 +1192,44 @@ App::get('/v1/vcs/github/installations/:installationId/providerRepositories')
                         $repo['runtime'] = $runtimeWithVersion ?? '';
                     }
                 }
+
+                $wg = new WaitGroup();
+                $envs = [];
+                foreach ($files as $file) {
+                    if (!(\str_starts_with($file, '.env'))) {
+                        continue;
+                    }
+
+                    $wg->add();
+                    go(function () use ($github, $repo, $file, $wg, &$envs) {
+                        try {
+                            $contentResponse = $github->getRepositoryContent($repo['organization'], $repo['name'], $file);
+                            $envFile = $contentResponse['content'] ?? '';
+
+                            $configAdapter = new ConfigDotenv();
+                            try {
+                                $envObject = $configAdapter->parse($envFile);
+                                foreach ($envObject as $envName => $envValue) {
+                                    $envs[$envName] = $envValue;
+                                }
+                            } catch (Parse) {
+                                // Silence error, so rest of endpoint can return
+                            }
+                        } finally {
+                            $wg->done();
+                        }
+                    });
+                }
+                $wg->wait();
+
+                $repo['variables'] = [];
+                foreach ($envs as $key => $value) {
+                    $repo['variables'][] = [
+                        'name' => $key,
+                        'value' => $value,
+                    ];
+                }
+
                 return $repo;
             };
         }, $repos));
@@ -1070,7 +1240,7 @@ App::get('/v1/vcs/github/installations/:installationId/providerRepositories')
 
         $response->dynamic(new Document([
             $type === 'framework' ? 'frameworkProviderRepositories' : 'runtimeProviderRepositories' => $repos,
-            'total' => \count($repos),
+            'total' => $total,
         ]), ($type === 'framework') ? Response::MODEL_PROVIDER_REPOSITORY_FRAMEWORK_LIST : Response::MODEL_PROVIDER_REPOSITORY_RUNTIME_LIST);
     });
 
@@ -1306,10 +1476,12 @@ App::post('/v1/vcs/github/events')
     ->inject('request')
     ->inject('response')
     ->inject('dbForPlatform')
+    ->inject('authorization')
     ->inject('getProjectDB')
     ->inject('queueForBuilds')
+    ->inject('platform')
     ->action(
-        function (GitHub $github, Request $request, Response $response, Database $dbForPlatform, callable $getProjectDB, Build $queueForBuilds) use ($createGitDeployments) {
+        function (GitHub $github, Request $request, Response $response, Database $dbForPlatform, Authorization $authorization, callable $getProjectDB, Build $queueForBuilds, array $platform) use ($createGitDeployments) {
             $payload = $request->getRawPayload();
             $signatureRemote = $request->getHeader('x-hub-signature-256', '');
             $signatureLocal = System::getEnv('_APP_VCS_GITHUB_WEBHOOK_SECRET', '');
@@ -1345,14 +1517,14 @@ App::post('/v1/vcs/github/events')
                 $github->initializeVariables($providerInstallationId, $privateKey, $githubAppId);
 
                 //find resourceId from relevant resources table
-                $repositories = Authorization::skip(fn () => $dbForPlatform->find('repositories', [
+                $repositories = $authorization->skip(fn () => $dbForPlatform->find('repositories', [
                     Query::equal('providerRepositoryId', [$providerRepositoryId]),
                     Query::limit(100),
                 ]));
 
                 // create new deployment only on push (not committed by us) and not when branch is created or deleted
                 if ($providerCommitAuthorEmail !== APP_VCS_GITHUB_EMAIL && !$providerBranchCreated && !$providerBranchDeleted) {
-                    $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, $providerBranchUrl, $providerRepositoryName, $providerRepositoryUrl, $providerRepositoryOwner, $providerCommitHash, $providerCommitAuthorName, $providerCommitAuthorUrl, $providerCommitMessage, $providerCommitUrl, '', false, $dbForPlatform, $queueForBuilds, $getProjectDB, $request);
+                    $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, $providerBranchUrl, $providerRepositoryName, $providerRepositoryUrl, $providerRepositoryOwner, $providerCommitHash, $providerCommitAuthorName, $providerCommitAuthorUrl, $providerCommitMessage, $providerCommitUrl, '', false, $dbForPlatform, $authorization, $queueForBuilds, $getProjectDB, $request, $platform);
                 }
             } elseif ($event == $github::EVENT_INSTALLATION) {
                 if ($parsedPayload["action"] == "deleted") {
@@ -1365,16 +1537,16 @@ App::post('/v1/vcs/github/events')
                     ]);
 
                     foreach ($installations as $installation) {
-                        $repositories = Authorization::skip(fn () => $dbForPlatform->find('repositories', [
+                        $repositories = $authorization->skip(fn () => $dbForPlatform->find('repositories', [
                             Query::equal('installationInternalId', [$installation->getSequence()]),
                             Query::limit(1000)
                         ]));
 
                         foreach ($repositories as $repository) {
-                            Authorization::skip(fn () => $dbForPlatform->deleteDocument('repositories', $repository->getId()));
+                            $authorization->skip(fn () => $dbForPlatform->deleteDocument('repositories', $repository->getId()));
                         }
 
-                        $dbForPlatform->deleteDocument('installations', $installation->getId());
+                        $authorization->skip(fn () => $dbForPlatform->deleteDocument('installations', $installation->getId()));
                     }
                 }
             } elseif ($event == $github::EVENT_PULL_REQUEST) {
@@ -1403,12 +1575,12 @@ App::post('/v1/vcs/github/events')
                     $providerCommitAuthor = $commitDetails["commitAuthor"] ?? '';
                     $providerCommitMessage = $commitDetails["commitMessage"] ?? '';
 
-                    $repositories = Authorization::skip(fn () => $dbForPlatform->find('repositories', [
+                    $repositories = $authorization->skip(fn () => $dbForPlatform->find('repositories', [
                         Query::equal('providerRepositoryId', [$providerRepositoryId]),
                         Query::orderDesc('$createdAt')
                     ]));
 
-                    $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, $providerBranchUrl, $providerRepositoryName, $providerRepositoryUrl, $providerRepositoryOwner, $providerCommitHash, $providerCommitAuthor, $providerCommitAuthorUrl, $providerCommitMessage, $providerCommitUrl, $providerPullRequestId, $external, $dbForPlatform, $queueForBuilds, $getProjectDB, $request);
+                    $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, $providerBranchUrl, $providerRepositoryName, $providerRepositoryUrl, $providerRepositoryOwner, $providerCommitHash, $providerCommitAuthor, $providerCommitAuthorUrl, $providerCommitMessage, $providerCommitUrl, $providerPullRequestId, $external, $dbForPlatform, $authorization, $queueForBuilds, $getProjectDB, $request, $platform);
                 } elseif ($parsedPayload["action"] == "closed") {
                     // Allowed external contributions cleanup
 
@@ -1417,7 +1589,7 @@ App::post('/v1/vcs/github/events')
                     $external = $parsedPayload["external"] ?? true;
 
                     if ($external) {
-                        $repositories = Authorization::skip(fn () => $dbForPlatform->find('repositories', [
+                        $repositories = $authorization->skip(fn () => $dbForPlatform->find('repositories', [
                             Query::equal('providerRepositoryId', [$providerRepositoryId]),
                             Query::orderDesc('$createdAt')
                         ]));
@@ -1428,7 +1600,7 @@ App::post('/v1/vcs/github/events')
                             if (\in_array($providerPullRequestId, $providerPullRequestIds)) {
                                 $providerPullRequestIds = \array_diff($providerPullRequestIds, [$providerPullRequestId]);
                                 $repository = $repository->setAttribute('providerPullRequestIds', $providerPullRequestIds);
-                                $repository = Authorization::skip(fn () => $dbForPlatform->updateDocument('repositories', $repository->getId(), $repository));
+                                $repository = $authorization->skip(fn () => $dbForPlatform->updateDocument('repositories', $repository->getId(), $repository));
                             }
                         }
                     }
@@ -1458,11 +1630,12 @@ App::get('/v1/vcs/installations')
     ))
     ->param('queries', [], new Installations(), 'Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/queries). Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' queries are allowed, each ' . APP_LIMIT_ARRAY_ELEMENT_SIZE . ' characters long. You may filter on the following attributes: ' . implode(', ', Installations::ALLOWED_ATTRIBUTES), true)
     ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
+    ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
     ->inject('response')
     ->inject('project')
     ->inject('dbForProject')
     ->inject('dbForPlatform')
-    ->action(function (array $queries, string $search, Response $response, Document $project, Database $dbForProject, Database $dbForPlatform) {
+    ->action(function (array $queries, string $search, bool $includeTotal, Response $response, Document $project, Database $dbForProject, Database $dbForPlatform) {
         try {
             $queries = Query::parseQueries($queries);
         } catch (QueryException $e) {
@@ -1503,7 +1676,7 @@ App::get('/v1/vcs/installations')
         $filterQueries = Query::groupByType($queries)['filters'];
         try {
             $results = $dbForPlatform->find('installations', $queries);
-            $total = $dbForPlatform->count('installations', $filterQueries, APP_LIMIT_COUNT);
+            $total = $includeTotal ? $dbForPlatform->count('installations', $filterQueries, APP_LIMIT_COUNT) : 0;
         } catch (OrderException $e) {
             throw new Exception(Exception::DATABASE_QUERY_ORDER_NULL, "The order attribute '{$e->getAttribute()}' had a null value. Cursor pagination requires all documents order attribute values are non-null.");
         }
@@ -1611,20 +1784,22 @@ App::patch('/v1/vcs/github/installations/:installationId/repositories/:repositor
     ->param('repositoryId', '', new Text(256), 'VCS Repository Id')
     ->param('providerPullRequestId', '', new Text(256), 'GitHub Pull Request Id')
     ->inject('gitHub')
-    ->inject('request')
     ->inject('response')
     ->inject('project')
     ->inject('dbForPlatform')
+    ->inject('authorization')
     ->inject('getProjectDB')
     ->inject('queueForBuilds')
-    ->action(function (string $installationId, string $repositoryId, string $providerPullRequestId, GitHub $github, Request $request, Response $response, Document $project, Database $dbForPlatform, callable $getProjectDB, Build $queueForBuilds) use ($createGitDeployments) {
+    ->inject('platform')
+    ->action(function (string $installationId, string $repositoryId, string $providerPullRequestId, GitHub $github, Request $request, Response $response, Document $project, Database $dbForPlatform, Authorization $authorization, callable $getProjectDB, Build $queueForBuilds, array $platform) use ($createGitDeployments) {
         $installation = $dbForPlatform->getDocument('installations', $installationId);
 
         if ($installation->isEmpty()) {
             throw new Exception(Exception::INSTALLATION_NOT_FOUND);
         }
 
-        $repository = Authorization::skip(fn () => $dbForPlatform->getDocument('repositories', $repositoryId, [
+        $repository = $authorization->skip(fn () => $dbForPlatform->findOne('repositories', [
+            Query::equal('$id', [$repositoryId]),
             Query::equal('projectInternalId', [$project->getSequence()])
         ]));
 
@@ -1641,7 +1816,7 @@ App::patch('/v1/vcs/github/installations/:installationId/repositories/:repositor
 
         // TODO: Delete from array when PR is closed
 
-        $repository = Authorization::skip(fn () => $dbForPlatform->updateDocument('repositories', $repository->getId(), $repository));
+        $repository = $authorization->skip(fn () => $dbForPlatform->updateDocument('repositories', $repository->getId(), $repository));
 
         $privateKey = System::getEnv('_APP_VCS_GITHUB_PRIVATE_KEY');
         $githubAppId = System::getEnv('_APP_VCS_GITHUB_APP_ID');
@@ -1664,8 +1839,16 @@ App::patch('/v1/vcs/github/installations/:installationId/repositories/:repositor
 
         $providerBranch = \explode(':', $pullRequestResponse['head']['label'])[1] ?? '';
         $providerCommitHash = $pullRequestResponse['head']['sha'] ?? '';
+        $providerBranchUrl = $pullRequestResponse['head']['repo']['html_url'] ?? '';
+        $providerRepositoryName = $pullRequestResponse['head']['repo']['name'] ?? '';
+        $providerRepositoryUrl = $pullRequestResponse['head']['repo']['html_url'] ?? '';
+        $providerRepositoryOwner = $pullRequestResponse['head']['repo']['owner']['login'] ?? '';
+        $providerCommitAuthor = $pullRequestResponse['head']['user']['login'] ?? '';
+        $providerCommitAuthorUrl = $pullRequestResponse['head']['user']['html_url'] ?? '';
+        $providerCommitMessage = $pullRequestResponse['title'] ?? '';
+        $providerCommitUrl = $pullRequestResponse['html_url'] ?? '';
 
-        $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, $providerCommitHash, $providerPullRequestId, true, $dbForPlatform, $queueForBuilds, $getProjectDB, $request);
+        $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, '', '', '', '', $providerCommitHash, '', '', '', '', $providerPullRequestId, true, $dbForPlatform, $authorization, $queueForBuilds, $getProjectDB, $request, $platform);
 
         $response->noContent();
     });

app/controllers/general.php

@@ -4,25 +4,26 @@ require_once __DIR__ . '/../init.php';
 
 use Ahc\Jwt\JWT;
 use Ahc\Jwt\JWTException;
-use Appwrite\Auth\Auth;
 use Appwrite\Auth\Key;
 use Appwrite\Event\Certificate;
 use Appwrite\Event\Event;
 use Appwrite\Event\Func;
 use Appwrite\Event\StatsUsage;
 use Appwrite\Extend\Exception as AppwriteException;
-use Appwrite\Network\Validator\Origin;
+use Appwrite\Network\Cors;
 use Appwrite\Platform\Appwrite;
 use Appwrite\SDK\Method;
 use Appwrite\SDK\Response as SDKResponse;
 use Appwrite\Transformation\Adapter\Preview;
 use Appwrite\Transformation\Transformation;
+use Appwrite\Utopia\Database\Documents\User as DBUser;
 use Appwrite\Utopia\Request;
 use Appwrite\Utopia\Request\Filters\V16 as RequestV16;
 use Appwrite\Utopia\Request\Filters\V17 as RequestV17;
 use Appwrite\Utopia\Request\Filters\V18 as RequestV18;
 use Appwrite\Utopia\Request\Filters\V19 as RequestV19;
 use Appwrite\Utopia\Request\Filters\V20 as RequestV20;
+use Appwrite\Utopia\Request\Filters\V21 as RequestV21;
 use Appwrite\Utopia\Response;
 use Appwrite\Utopia\Response\Filters\V16 as ResponseV16;
 use Appwrite\Utopia\Response\Filters\V17 as ResponseV17;
@@ -38,6 +39,7 @@ use Utopia\Config\Config;
 use Utopia\Database\Database;
 use Utopia\Database\DateTime;
 use Utopia\Database\Document;
+use Utopia\Database\Exception\Duplicate;
 use Utopia\Database\Helpers\ID;
 use Utopia\Database\Query;
 use Utopia\Database\Validator\Authorization;
@@ -50,24 +52,25 @@ use Utopia\Logger\Log\User;
 use Utopia\Logger\Logger;
 use Utopia\Platform\Service;
 use Utopia\System\System;
+use Utopia\Validator;
 use Utopia\Validator\Text;
 
 Config::setParam('domainVerification', false);
 Config::setParam('cookieDomain', 'localhost');
 Config::setParam('cookieSamesite', Response::COOKIE_SAMESITE_NONE);
 
-function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, string $previewHostname, ?Key $apiKey)
+function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, Authorization $authorization, ?Key $apiKey)
 {
     $host = $request->getHostname() ?? '';
     if (!empty($previewHostname)) {
         $host = $previewHostname;
     }
 
-    // TODO: @christyjacob remove once we migrate the rules in 1.7.x
+    // TODO: (@Meldiron) Remove after 1.7.x migration
     if (System::getEnv('_APP_RULES_FORMAT') === 'md5') {
-        $rule = Authorization::skip(fn () => $dbForPlatform->getDocument('rules', md5($host)));
+        $rule = $authorization->skip(fn () => $dbForPlatform->getDocument('rules', md5($host)));
     } else {
-        $rule = Authorization::skip(
+        $rule = $authorization->skip(
             fn () => $dbForPlatform->find('rules', [
                 Query::equal('domain', [$host]),
                 Query::limit(1)
@@ -76,7 +79,9 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
     }
 
     $errorView = __DIR__ . '/../views/general/error.phtml';
-    $url = (System::getEnv('_APP_OPTIONS_FORCE_HTTPS') == 'disabled' ? 'http' : 'https') . '://' . System::getEnv('_APP_CONSOLE_DOMAIN', System::getEnv('_APP_DOMAIN', ''));
+    $protocol = System::getEnv('_APP_OPTIONS_FORCE_HTTPS') == 'disabled' ? 'http' : 'https';
+    $url = $protocol . '://' . $platform['consoleHostname'];
+    $platformHostnames = $platform['hostnames'] ?? [];
 
     if ($rule->isEmpty()) {
         $appDomainFunctionsFallback = System::getEnv('_APP_DOMAIN_FUNCTIONS_FALLBACK', '');
@@ -97,10 +102,8 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
             throw $exception;
         }
 
-        if (System::getEnv('_APP_OPTIONS_ROUTER_PROTECTION', 'disabled') === 'enabled') {
-            if ($host !== 'localhost' && $host !== APP_HOSTNAME_INTERNAL && $host !== System::getEnv('_APP_CONSOLE_DOMAIN', '')) {
-                throw new AppwriteException(AppwriteException::GENERAL_ACCESS_FORBIDDEN, 'Router protection does not allow accessing Appwrite over this domain. Please add it as custom domain to your project or disable _APP_OPTIONS_ROUTER_PROTECTION environment variable.', view: $errorView);
-            }
+        if (!in_array($host, $platformHostnames)) {
+            throw new AppwriteException(AppwriteException::GENERAL_ACCESS_FORBIDDEN, 'Router protection does not allow accessing Appwrite over this domain. Please add it as custom domain to your project or disable _APP_OPTIONS_ROUTER_PROTECTION environment variable.', view: $errorView);
         }
 
         // Act as API - no Proxy logic
@@ -108,7 +111,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
     }
 
     $projectId = $rule->getAttribute('projectId');
-    $project = Authorization::skip(
+    $project = $authorization->skip(
         fn () => $dbForPlatform->getDocument('projects', $projectId)
     );
 
@@ -116,7 +119,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
         $accessedAt = $project->getAttribute('accessedAt', 0);
         if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_PROJECT_ACCESS)) > $accessedAt) {
             $project->setAttribute('accessedAt', DateTime::now());
-            Authorization::skip(fn () => $dbForPlatform->updateDocument('projects', $project->getId(), $project));
+            $authorization->skip(fn () => $dbForPlatform->updateDocument('projects', $project->getId(), $project));
         }
 
         /**
@@ -142,7 +145,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
 
     if ($type === 'deployment') {
         if (System::getEnv('_APP_OPTIONS_ROUTER_FORCE_HTTPS', 'disabled') === 'enabled') { // Force HTTPS
-            if ($request->getProtocol() !== 'https' && $request->getHostname() !== APP_HOSTNAME_INTERNAL) {
+            if ($request->getProtocol() !== 'https') {
                 if ($request->getMethod() !== Request::METHOD_GET) {
                     throw new AppwriteException(AppwriteException::GENERAL_PROTOCOL_UNSUPPORTED, 'Method unsupported over HTTP. Please use HTTPS instead.', view: $errorView);
                 }
@@ -155,7 +158,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
 
         /** @var Document $deployment */
         if (!empty($rule->getAttribute('deploymentId', ''))) {
-            $deployment = Authorization::skip(fn () => $dbForProject->getDocument('deployments', $rule->getAttribute('deploymentId')));
+            $deployment = $authorization->skip(fn () => $dbForProject->getDocument('deployments', $rule->getAttribute('deploymentId')));
         } else {
             // 1.6.x DB schema compatibility
             // TODO: Make sure deploymentId is never empty, and remove this code
@@ -169,15 +172,15 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
 
             // Document of site or function
             $resource = $resourceType === 'function' ?
-                Authorization::skip(fn () => $dbForProject->getDocument('functions', $resourceId)) :
-                Authorization::skip(fn () => $dbForProject->getDocument('sites', $resourceId));
+                $authorization->skip(fn () => $dbForProject->getDocument('functions', $resourceId)) :
+                $authorization->skip(fn () => $dbForProject->getDocument('sites', $resourceId));
 
             // ID of active deployments
             // Attempts to use attribute from both schemas (1.6 and 1.7)
             $activeDeploymentId = $resource->getAttribute('deploymentId', $resource->getAttribute('deployment', ''));
 
             // Get deployment document, as intended originally
-            $deployment = Authorization::skip(fn () => $dbForProject->getDocument('deployments', $activeDeploymentId));
+            $deployment = $authorization->skip(fn () => $dbForProject->getDocument('deployments', $activeDeploymentId));
         }
 
         if ($deployment->getAttribute('resourceType', '') === 'functions') {
@@ -196,8 +199,8 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
         }
 
         $resource = $type === 'function' ?
-            Authorization::skip(fn () => $dbForProject->getDocument('functions', $deployment->getAttribute('resourceId', ''))) :
-            Authorization::skip(fn () => $dbForProject->getDocument('sites', $deployment->getAttribute('resourceId', '')));
+            $authorization->skip(fn () => $dbForProject->getDocument('functions', $deployment->getAttribute('resourceId', ''))) :
+            $authorization->skip(fn () => $dbForProject->getDocument('sites', $deployment->getAttribute('resourceId', '')));
 
         $isPreview = $type === 'function' ? false : ($rule->getAttribute('trigger', '') !== 'manual');
 
@@ -222,7 +225,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
         */
         $requirePreview = \is_null($apiKey) || !$apiKey->isPreviewAuthDisabled();
         if ($isPreview && $requirePreview) {
-            $cookie = $request->getCookie(Auth::$cookieNamePreview, '');
+            $cookie = $request->getCookie(COOKIE_NAME_PREVIEW, '');
             $authorized = false;
 
             // Security checks to mark authorized true
@@ -239,7 +242,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
                 $userExists = false;
                 $userId = $payload['userId'] ?? '';
                 if (!empty($userId)) {
-                    $user = Authorization::skip(fn () => $dbForPlatform->getDocument('users', $userId));
+                    $user = $authorization->skip(fn () => $dbForPlatform->getDocument('users', $userId));
                     if (!$user->isEmpty() && $user->getAttribute('status', false)) {
                         $userExists = true;
                     }
@@ -252,7 +255,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
                 }
 
                 $membershipExists = false;
-                $project = Authorization::skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
+                $project = $authorization->skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
                 if (!$project->isEmpty() && isset($user)) {
                     $teamId = $project->getAttribute('teamId', '');
                     $membership = $user->find('teamId', $teamId, 'memberships');
@@ -267,7 +270,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
             }
 
             if (!$authorized) {
-                $url = (System::getEnv('_APP_OPTIONS_FORCE_HTTPS') == 'disabled' ? 'http' : 'https') . "://" . System::getEnv('_APP_CONSOLE_DOMAIN', System::getEnv('_APP_DOMAIN', ''));
+                $url = $protocol . "://" . $platform['consoleHostname'];
                 $response
                     ->addHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0')
                     ->addHeader('Pragma', 'no-cache')
@@ -455,9 +458,8 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
             $vars[$var->getAttribute('key')] = $var->getAttribute('value', '');
         }
 
-        $protocol = System::getEnv('_APP_OPTIONS_FORCE_HTTPS') === 'disabled' ? 'http' : 'https';
-        $hostname = System::getEnv('_APP_DOMAIN');
-        $endpoint = $protocol . '://' . $hostname . "/v1";
+        $protocol = System::getEnv('_APP_OPTIONS_FORCE_HTTPS') == 'disabled' ? 'http' : 'https';
+        $endpoint = "$protocol://{$platform['apiHostname']}/v1";
 
         // Appwrite vars
         if ($type === 'function') {
@@ -844,34 +846,32 @@ App::init()
     ->inject('request')
     ->inject('response')
     ->inject('log')
-    ->inject('console')
     ->inject('project')
     ->inject('dbForPlatform')
     ->inject('getProjectDB')
     ->inject('locale')
     ->inject('localeCodes')
-    ->inject('platforms')
     ->inject('geodb')
     ->inject('queueForStatsUsage')
     ->inject('queueForEvents')
-    ->inject('queueForCertificates')
     ->inject('queueForFunctions')
     ->inject('executor')
+    ->inject('platform')
     ->inject('isResourceBlocked')
     ->inject('previewHostname')
     ->inject('devKey')
     ->inject('apiKey')
-    ->inject('httpReferrer')
-    ->inject('httpReferrerSafe')
-    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Document $console, Document $project, Database $dbForPlatform, callable $getProjectDB, Locale $locale, array $localeCodes, array $platforms, Reader $geodb, StatsUsage $queueForStatsUsage, Event $queueForEvents, Certificate $queueForCertificates, Func $queueForFunctions, Executor $executor, callable $isResourceBlocked, string $previewHostname, Document $devKey, ?Key $apiKey, string $httpReferrer, string $httpReferrerSafe) {
+    ->inject('cors')
+    ->inject('authorization')
+    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Document $project, Database $dbForPlatform, callable $getProjectDB, Locale $locale, array $localeCodes, Reader $geodb, StatsUsage $queueForStatsUsage, Event $queueForEvents, Func $queueForFunctions, Executor $executor, array $platform, callable $isResourceBlocked, string $previewHostname, Document $devKey, ?Key $apiKey, Cors $cors, Authorization $authorization) {
         /*
         * Appwrite Router
         */
-        $host = $request->getHostname() ?? '';
-        $mainDomain = System::getEnv('_APP_DOMAIN', '');
+        $hostname = $request->getHostname() ?? '';
+        $platformHostnames = $platform['hostnames'] ?? [];
         // Only run Router when external domain
-        if ($host !== $mainDomain || !empty($previewHostname)) {
-            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $previewHostname, $apiKey)) {
+        if (!\in_array($hostname, $platformHostnames) || !empty($previewHostname)) {
+            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $authorization, $apiKey)) {
                 $utopia->getRoute()?->label('router', true);
             }
         }
@@ -906,92 +906,9 @@ App::init()
                 $dbForProject = $getProjectDB($project);
                 $request->addFilter(new RequestV20($dbForProject, $route->getPathValues($request)));
             }
-        }
-
-        $domain = $request->getHostname();
-        $domains = Config::getParam('domains', []);
-        if (!array_key_exists($domain, $domains)) {
-            $domain = new Domain(!empty($domain) ? $domain : '');
-
-            if (empty($domain->get()) || !$domain->isKnown() || $domain->isTest()) {
-                $domains[$domain->get()] = false;
-                Console::warning($domain->get() . ' is not a publicly accessible domain. Skipping SSL certificate generation.');
-            } elseif (str_starts_with($request->getURI(), '/.well-known/acme-challenge')) {
-                Console::warning('Skipping SSL certificates generation on ACME challenge.');
-            } else {
-                Authorization::disable();
-
-                $envDomain = System::getEnv('_APP_DOMAIN', '');
-                $mainDomain = null;
-                if (!empty($envDomain) && $envDomain !== 'localhost') {
-                    $mainDomain = $envDomain;
-                } else {
-                    // TODO: @christyjacob remove once we migrate the rules in 1.7.x
-                    if (System::getEnv('_APP_RULES_FORMAT') === 'md5') {
-                        $domainDocument = $dbForPlatform->getDocument('rules', md5($envDomain));
-                    } else {
-                        $domainDocument = $dbForPlatform->findOne('rules', [Query::orderAsc('$id')]);
-                    }
-                    $mainDomain = !$domainDocument->isEmpty() ? $domainDocument->getAttribute('domain') : $domain->get();
-                }
-
-                if ($mainDomain !== $domain->get()) {
-                    Console::warning($domain->get() . ' is not a main domain. Skipping SSL certificate generation.');
-                } else {
-                    // TODO: @christyjacob remove once we migrate the rules in 1.7.x
-                    if (System::getEnv('_APP_RULES_FORMAT') === 'md5') {
-                        $domainDocument = $dbForPlatform->getDocument('rules', md5($domain->get()));
-                    } else {
-                        $domainDocument = $dbForPlatform->findOne('rules', [
-                            Query::equal('domain', [$domain->get()])
-                        ]);
-                    }
-
-                    $owner = '';
-                    $functionsDomainFallback = System::getEnv('_APP_DOMAIN_FUNCTIONS_FALLBACK', '');
-                    $functionsDomain = System::getEnv('_APP_DOMAIN_FUNCTIONS', '');
-                    $siteDomain = System::getEnv('_APP_DOMAIN_SITES', '');
-                    if (!empty($functionsDomainFallback) && \str_ends_with($host, $functionsDomainFallback)) {
-                        $functionsDomain = $functionsDomainFallback;
-                    }
-
-                    if (
-                        (!empty($functionsDomain) && \str_ends_with($domain->get(), $functionsDomain)) ||
-                        (!empty($siteDomain) && \str_ends_with($domain->get(), $siteDomain))
-                    ) {
-                        $owner = 'Appwrite';
-                    }
-
-                    if ($domainDocument->isEmpty()) {
-                        $ruleId = System::getEnv('_APP_RULES_FORMAT') === 'md5' ? md5($domain->get()) : ID::unique();
-                        $domainDocument = new Document([
-                            // TODO: @christyjacob remove once we migrate the rules in 1.7.x
-                            '$id' => $ruleId,
-                            'domain' => $domain->get(),
-                            'type' => 'api',
-                            'status' => 'verifying',
-                            'projectId' => $console->getId(),
-                            'projectInternalId' => $console->getSequence(),
-                            'search' => implode(' ', [$ruleId, $domain->get()]),
-                            'owner' => $owner,
-                            'region' => $console->getAttribute('region')
-                        ]);
-
-                        $domainDocument = $dbForPlatform->createDocument('rules', $domainDocument);
-
-                        Console::info('Issuing a TLS certificate for the main domain (' . $domain->get() . ') in a few seconds...');
-
-                        $queueForCertificates
-                            ->setDomain($domainDocument)
-                            ->setSkipRenewCheck(true)
-                            ->trigger();
-                    }
-                }
-                $domains[$domain->get()] = true;
-
-                Authorization::reset(); // ensure authorization is re-enabled
+            if (version_compare($requestFormat, '1.9.0', '<')) {
+                $request->addFilter(new RequestV21());
             }
-            Config::setParam('domains', $domains);
         }
 
         $localeParam = (string) $request->getParam('locale', $request->getHeader('x-appwrite-locale', ''));
@@ -999,7 +916,7 @@ App::init()
             $locale->setDefault($localeParam);
         }
 
-        $origin = \parse_url($request->getOrigin($httpReferrer), PHP_URL_HOST);
+        $origin = \parse_url($request->getOrigin($request->getReferer('')), PHP_URL_HOST);
         $selfDomain = new Domain($request->getHostname());
         $endDomain = new Domain((string)$origin);
         Config::setParam(
@@ -1028,8 +945,8 @@ App::init()
         $warnings = [];
 
         /*
-        * Response format
-        */
+         * Response format
+         */
         $responseFormat = $request->getHeader('x-appwrite-response-format', System::getEnv('_APP_SYSTEM_RESPONSE_FORMAT', ''));
         if ($responseFormat) {
             if (version_compare($responseFormat, '1.4.0', '<')) {
@@ -1049,14 +966,13 @@ App::init()
             }
         }
 
-        /*
-        * Security Headers
-        *
-        * As recommended at:
-        * @see https://www.owasp.org/index.php/List_of_useful_HTTP_headers
-        */
+        // Add Appwrite warning headers
+        if (!empty($warnings)) {
+            $response->addHeader('X-Appwrite-Warning', implode(';', $warnings));
+        }
+
         if (System::getEnv('_APP_OPTIONS_FORCE_HTTPS', 'disabled') === 'enabled') { // Force HTTPS
-            if ($request->getProtocol() !== 'https' && ($swooleRequest->header['host'] ?? '') !== 'localhost' && ($swooleRequest->header['host'] ?? '') !== APP_HOSTNAME_INTERNAL) { // localhost allowed for proxy, APP_HOSTNAME_INTERNAL allowed for migrations
+            if ($request->getProtocol() !== 'https' && ($swooleRequest->header['host'] ?? '') !== 'localhost') { // localhost allowed for proxy, APP_HOSTNAME_INTERNAL allowed for migrations
                 if ($request->getMethod() !== Request::METHOD_GET) {
                     throw new AppwriteException(AppwriteException::GENERAL_PROTOCOL_UNSUPPORTED, 'Method unsupported over HTTP. Please use HTTPS instead.');
                 }
@@ -1064,49 +980,152 @@ App::init()
                 return $response->redirect('https://' . $request->getHostname() . $request->getURI());
             }
         }
+    });
 
-        if ($request->getProtocol() === 'https') {
-            $response->addHeader('Strict-Transport-Security', 'max-age=' . (60 * 60 * 24 * 126)); // 126 days
+/**
+ * Security headers
+ *
+ * @see https://www.owasp.org/index.php/List_of_useful_HTTP_headers
+ */
+App::init()
+    ->groups(['api', 'web'])
+    ->inject('request')
+    ->inject('response')
+    ->inject('cors')
+    ->inject('devKey')
+    ->inject('originValidator')
+    ->action(function (Request $request, Response $response, Cors $cors, Document $devKey, Validator $originValidator) {
+        // CORS headers
+        foreach ($cors->headers($request->getOrigin()) as $name => $value) {
+            $response->addHeader($name, $value);
         }
 
+        // Security headers
         $response
             ->addHeader('Server', 'Appwrite')
-            ->addHeader('X-Content-Type-Options', 'nosniff')
-            ->addHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE')
-            ->addHeader('Access-Control-Allow-Headers', 'Origin, Cookie, Set-Cookie, X-Requested-With, Content-Type, Access-Control-Allow-Origin, Access-Control-Request-Headers, Accept, X-Appwrite-Project, X-Appwrite-Key, X-Appwrite-Dev-Key, X-Appwrite-Locale, X-Appwrite-Mode, X-Appwrite-JWT, X-Appwrite-Response-Format, X-Appwrite-Timeout, X-SDK-Version, X-SDK-Name, X-SDK-Language, X-SDK-Platform, X-SDK-GraphQL, X-Appwrite-ID, X-Appwrite-Timestamp, Content-Range, Range, Cache-Control, Expires, Pragma, X-Forwarded-For, X-Forwarded-User-Agent')
-            ->addHeader('Access-Control-Expose-Headers', 'X-Appwrite-Session, X-Fallback-Cookies')
-            ->addHeader('Access-Control-Allow-Origin', $httpReferrerSafe)
-            ->addHeader('Access-Control-Allow-Credentials', 'true');
+            ->addHeader('X-Content-Type-Options', 'nosniff');
 
-        if (!$devKey->isEmpty()) {
-            $response->addHeader('Access-Control-Allow-Origin', '*');
+        if ($request->getProtocol() === 'https') {
+            $maxAge = 60 * 60 * 24 * 126; // 126 days
+            $response->addHeader('Strict-Transport-Security', "max-age=$maxAge");
         }
 
-        if (!empty($warnings)) {
-            $response->addHeader('X-Appwrite-Warning', implode(';', $warnings));
+        // Application level CSRF protection
+        $origin = $request->getOrigin();
+        if (empty($origin) || !$devKey->isEmpty() || !empty($request->getHeader('x-appwrite-key'))) {
+            return;
         }
-
-        /*
-        * Validate Client Domain - Check to avoid CSRF attack
-        *  Adding Appwrite API domains to allow XDOMAIN communication
-        *  Skip this check for non-web platforms which are not required to send an origin header
-        */
-        $origin = $request->getOrigin($request->getReferer(''));
-        $originValidator = new Origin($platforms);
-
-        if (
-            $devKey->isEmpty()
-            && !empty($origin)
-            && !$originValidator->isValid($origin)
-            && \in_array($request->getMethod(), [Request::METHOD_POST, Request::METHOD_PUT, Request::METHOD_PATCH, Request::METHOD_DELETE])
-            && $route->getLabel('origin', false) !== '*'
-            && empty($request->getHeader('x-appwrite-key', ''))
-            && \parse_url($httpReferrerSafe, PHP_URL_HOST) === 'localhost'
-        ) {
+        $route = $request->getRoute();
+        if ($route->getLabel('origin', false) === '*') {
+            return;
+        }
+        if (!$originValidator->isValid($origin)) {
             throw new AppwriteException(AppwriteException::GENERAL_UNKNOWN_ORIGIN, $originValidator->getDescription());
         }
     });
 
+/**
+ * Automatic certificate generation
+ */
+App::init()
+   ->groups(['api', 'web'])
+   ->inject('request')
+   ->inject('console')
+   ->inject('dbForPlatform')
+   ->inject('queueForCertificates')
+   ->inject('platform')
+   ->inject('authorization')
+   ->action(function (Request $request, Document $console, Database $dbForPlatform, Certificate $queueForCertificates, array $platform, Authorization $authorization) {
+       $hostname = $request->getHostname();
+       $cache = Config::getParam('hostnames', []);
+       $platformHostnames = $platform['hostnames'] ?? [];
+
+       // 1. Cache hit
+       if (array_key_exists($hostname, $cache)) {
+           return;
+       }
+
+       // 2. Domain validation
+       $domain = new Domain(!empty($hostname) ? $hostname : '');
+       if (empty($domain->get()) || !$domain->isKnown() || $domain->isTest()) {
+           $cache[$domain->get()] = false;
+           Config::setParam('hostnames', $cache);
+           Console::warning($domain->get() . ' is not a publicly accessible domain. Skipping SSL certificate generation.');
+           return;
+       }
+
+       if (str_starts_with($request->getURI(), '/.well-known/acme-challenge')) {
+           Console::warning('Skipping SSL certificates generation on ACME challenge.');
+           return;
+       }
+
+       // 3. Check if domain is a main domain
+       if (!in_array($domain->get(), $platformHostnames)) {
+           Console::warning($domain->get() . ' is not a main domain. Skipping SSL certificate generation.');
+           return;
+       }
+
+       // 4. Check/create rule (requires DB access)
+       $authorization->disable();
+       try {
+           // TODO: (@Meldiron) Remove after 1.7.x migration
+           $isMd5 = System::getEnv('_APP_RULES_FORMAT') === 'md5';
+           $document = $isMd5
+               ? $dbForPlatform->getDocument('rules', md5($domain->get()))
+               : $dbForPlatform->findOne('rules', [
+                   Query::equal('domain', [$domain->get()]),
+               ]);
+
+           if (!$document->isEmpty()) {
+               return;
+           }
+
+           // 5. Create new rule
+           $owner = '';
+           $fallback = System::getEnv('_APP_DOMAIN_FUNCTIONS_FALLBACK', '');
+           $funcDomain = System::getEnv('_APP_DOMAIN_FUNCTIONS', '');
+           $siteDomain = System::getEnv('_APP_DOMAIN_SITES', '');
+
+           if (!empty($fallback) && \str_ends_with($domain->get(), $fallback)) {
+               $funcDomain = $fallback;
+           }
+
+           if (
+               (!empty($funcDomain) && \str_ends_with($domain->get(), $funcDomain)) ||
+               (!empty($siteDomain) && \str_ends_with($domain->get(), $siteDomain))
+           ) {
+               $owner = 'Appwrite';
+           }
+
+           $ruleId = $isMd5 ? md5($domain->get()) : ID::unique();
+           $document = new Document([
+               '$id' => $ruleId,
+               'domain' => $domain->get(),
+               'type' => 'api',
+               'status' => 'verifying',
+               'projectId' => $console->getId(),
+               'projectInternalId' => $console->getSequence(),
+               'search' => implode(' ', [$ruleId, $domain->get()]),
+               'owner' => $owner,
+               'region' => $console->getAttribute('region')
+           ]);
+
+           $dbForPlatform->createDocument('rules', $document);
+
+           Console::info('Issuing a TLS certificate for the main domain (' . $domain->get() . ') in a few seconds...');
+           $queueForCertificates
+               ->setDomain($document)
+               ->setSkipRenewCheck(true)
+               ->trigger();
+       } catch (Duplicate $e) {
+           Console::info('Certificate already exists');
+       } finally {
+           $cache[$domain->get()] = true;
+           Config::setParam('hostnames', $cache);
+           $authorization->reset();
+       }
+   });
+
 App::options()
     ->inject('utopia')
     ->inject('swooleRequest')
@@ -1121,38 +1140,33 @@ App::options()
     ->inject('executor')
     ->inject('geodb')
     ->inject('isResourceBlocked')
+    ->inject('platform')
     ->inject('previewHostname')
     ->inject('project')
     ->inject('devKey')
     ->inject('apiKey')
-    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, string $previewHostname, Document $project, Document $devKey, ?Key $apiKey) {
+    ->inject('cors')
+    ->inject('authorization')
+    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, Document $project, Document $devKey, ?Key $apiKey, Cors $cors, Authorization $authorization) {
         /*
         * Appwrite Router
         */
-        $host = $request->getHostname() ?? '';
-        $mainDomain = System::getEnv('_APP_DOMAIN', '');
+        $platformHostnames = $platform['hostnames'] ?? [];
         // Only run Router when external domain
-        if ($host !== $mainDomain || !empty($previewHostname)) {
-            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $previewHostname, $apiKey)) {
+        if (!in_array($request->getHostname(), $platformHostnames) || !empty($previewHostname)) {
+            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $apiKey)) {
                 $utopia->getRoute()?->label('router', true);
             }
         }
 
-        $origin = $request->getOrigin();
+        foreach ($cors->headers($request->getOrigin()) as $name => $value) {
+            $response->addHeader($name, $value);
+        }
 
         $response
             ->addHeader('Server', 'Appwrite')
-            ->addHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE')
-            ->addHeader('Access-Control-Allow-Headers', 'Origin, Cookie, Set-Cookie, X-Requested-With, Content-Type, Access-Control-Allow-Origin, Access-Control-Request-Headers, Accept, X-Appwrite-Project, X-Appwrite-Key, X-Appwrite-Dev-Key, X-Appwrite-Locale, X-Appwrite-Mode, X-Appwrite-JWT, X-Appwrite-Response-Format, X-Appwrite-Timeout, X-SDK-Version, X-SDK-Name, X-SDK-Language, X-SDK-Platform, X-SDK-GraphQL, X-Appwrite-ID, X-Appwrite-Timestamp, Content-Range, Range, Cache-Control, Expires, Pragma, X-Appwrite-Session, X-Fallback-Cookies, X-Forwarded-For, X-Forwarded-User-Agent')
-            ->addHeader('Access-Control-Expose-Headers', 'X-Appwrite-Session, X-Fallback-Cookies')
-            ->addHeader('Access-Control-Allow-Origin', $origin)
-            ->addHeader('Access-Control-Allow-Credentials', 'true')
             ->noContent();
 
-        if (!$devKey->isEmpty()) {
-            $response->addHeader('Access-Control-Allow-Origin', '*');
-        }
-
         /** OPTIONS requests in utopia do not execute shutdown handlers, as a result we need to track the OPTIONS requests explicitly
          * @see https://github.com/utopia-php/http/blob/0.33.16/src/App.php#L825-L855
          */
@@ -1174,7 +1188,8 @@ App::error()
     ->inject('log')
     ->inject('queueForStatsUsage')
     ->inject('devKey')
-    ->action(function (Throwable $error, App $utopia, Request $request, Response $response, Document $project, ?Logger $logger, Log $log, StatsUsage $queueForStatsUsage) {
+    ->inject('authorization')
+    ->action(function (Throwable $error, App $utopia, Request $request, Response $response, Document $project, ?Logger $logger, Log $log, StatsUsage $queueForStatsUsage, Document $devKey, Authorization $authorization) {
         $version = System::getEnv('_APP_VERSION', 'UNKNOWN');
         $route = $utopia->getRoute();
         $class = \get_class($error);
@@ -1253,10 +1268,10 @@ App::error()
         }
 
         /**
-         * If its not a publishable error, track usage stats. Publishable errors are >= 500 or those explicitly marked as publish=true in errors.php
+         * If not a publishable error, track usage stats. Publishable errors are >= 500 or those explicitly marked as publish=true in errors.php
          */
         if (!$publish && $project->getId() !== 'console') {
-            if (!Auth::isPrivilegedUser(Authorization::getRoles())) {
+            if (!DBUser::isPrivileged($authorization->getRoles())) {
                 $fileSize = 0;
                 $file = $request->getFiles('file');
                 if (!empty($file)) {
@@ -1318,7 +1333,7 @@ App::error()
             $log->addExtra('file', $error->getFile());
             $log->addExtra('line', $error->getLine());
             $log->addExtra('trace', $error->getTraceAsString());
-            $log->addExtra('roles', Authorization::getRoles());
+            $log->addExtra('roles', $authorization->getRoles());
 
             $action = 'UNKNOWN_NAMESPACE.UNKNOWN.METHOD';
             if (!empty($sdk)) {
@@ -1355,6 +1370,7 @@ App::error()
             case 409: // Error allowed publicly
             case 412: // Error allowed publicly
             case 416: // Error allowed publicly
+            case 422: // Error allowed publicly
             case 429: // Error allowed publicly
             case 451: // Error allowed publicly
             case 501: // Error allowed publicly
@@ -1438,18 +1454,17 @@ App::get('/robots.txt')
     ->inject('executor')
     ->inject('geodb')
     ->inject('isResourceBlocked')
+    ->inject('platform')
     ->inject('previewHostname')
     ->inject('apiKey')
-    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, string $previewHostname, ?Key $apiKey) {
-        $host = $request->getHostname() ?? '';
-        $consoleDomain = System::getEnv('_APP_CONSOLE_DOMAIN', '');
-        $mainDomain = System::getEnv('_APP_DOMAIN', '');
-
-        if (($host === $consoleDomain || $host === $mainDomain || $host === 'localhost') && empty($previewHostname)) {
+    ->inject('authorization')
+    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, ?Key $apiKey, Authorization $authorization) {
+        $platformHostnames = $platform['hostnames'] ?? [];
+        if (in_array($request->getHostname(), $platformHostnames) || !empty($previewHostname)) {
             $template = new View(__DIR__ . '/../views/general/robots.phtml');
             $response->text($template->render(false));
         } else {
-            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $previewHostname, $apiKey)) {
+            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $authorization, $apiKey)) {
                 $utopia->getRoute()?->label('router', true);
             }
         }
@@ -1472,18 +1487,17 @@ App::get('/humans.txt')
     ->inject('executor')
     ->inject('geodb')
     ->inject('isResourceBlocked')
+    ->inject('platform')
     ->inject('previewHostname')
     ->inject('apiKey')
-    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, string $previewHostname, ?Key $apiKey) {
-        $host = $request->getHostname() ?? '';
-        $consoleDomain = System::getEnv('_APP_CONSOLE_DOMAIN', '');
-        $mainDomain = System::getEnv('_APP_DOMAIN', '');
-
-        if (($host === $consoleDomain || $host === $mainDomain || $host === 'localhost') && empty($previewHostname)) {
+    ->inject('authorization')
+    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, ?Key $apiKey, Authorization $authorization) {
+        $platformHostnames = $platform['hostnames'] ?? [];
+        if (in_array($request->getHostname(), $platformHostnames) || !empty($previewHostname)) {
             $template = new View(__DIR__ . '/../views/general/humans.phtml');
             $response->text($template->render(false));
         } else {
-            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $previewHostname, $apiKey)) {
+            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $authorization, $apiKey)) {
                 $utopia->getRoute()?->label('router', true);
             }
         }
@@ -1567,7 +1581,8 @@ App::get('/v1/ping')
     ->inject('project')
     ->inject('dbForPlatform')
     ->inject('queueForEvents')
-    ->action(function (Response $response, Document $project, Database $dbForPlatform, Event $queueForEvents) {
+    ->inject('authorization')
+    ->action(function (Response $response, Document $project, Database $dbForPlatform, Event $queueForEvents, Authorization $authorization) {
         if ($project->isEmpty() || $project->getId() === 'console') {
             throw new AppwriteException(AppwriteException::PROJECT_NOT_FOUND);
         }
@@ -1579,7 +1594,7 @@ App::get('/v1/ping')
             ->setAttribute('pingCount', $pingCount)
             ->setAttribute('pingedAt', $pingedAt);
 
-        Authorization::skip(function () use ($dbForPlatform, $project) {
+        $authorization->skip(function () use ($dbForPlatform, $project) {
             $dbForPlatform->updateDocument('projects', $project->getId(), $project);
         });
 
@@ -1612,7 +1627,7 @@ App::get('/_appwrite/authorize')
         $expire = DateTime::formatTz(DateTime::addSeconds(new \DateTime(), $duration));
 
         $response
-            ->addCookie(Auth::$cookieNamePreview, $jwt, (new \DateTime($expire))->getTimestamp(), '/', $host, ('https' === $protocol), true, null)
+            ->addCookie(COOKIE_NAME_PREVIEW, $jwt, (new \DateTime($expire))->getTimestamp(), '/', $host, ('https' === $protocol), true, null)
             ->addHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0')
             ->addHeader('Pragma', 'no-cache')
             ->redirect($protocol . '://' . $host . $path);

app/controllers/mock.php

@@ -15,7 +15,6 @@ use Utopia\Database\Helpers\Role;
 use Utopia\Database\Validator\UID;
 use Utopia\Locale\Locale;
 use Utopia\System\System;
-use Utopia\Validator\Host;
 use Utopia\Validator\Text;
 use Utopia\Validator\WhiteList;
 use Utopia\VCS\Adapter\Git\GitHub;
@@ -27,7 +26,7 @@ App::get('/v1/mock/tests/general/oauth2')
     ->label('docs', false)
     ->label('mock', true)
     ->param('client_id', '', new Text(100), 'OAuth2 Client ID.')
-    ->param('redirect_uri', '', new Host(['localhost']), 'OAuth2 Redirect URI.') // Important to deny an open redirect attack
+    ->param('redirect_uri', '', fn ($redirectValidator) => $redirectValidator, 'URL to redirect back to your app after a failed login attempt.  Only URLs from hostnames in your project\'s platform list are allowed. This requirement helps to prevent an [open redirect](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html) attack against your project API.', true, ['redirectValidator']) // Important to deny an open redirect attack
     ->param('scope', '', new Text(100), 'OAuth2 scope list.')
     ->param('state', '', new Text(1024), 'OAuth2 state.')
     ->inject('response')
@@ -64,7 +63,7 @@ App::get('/v1/mock/tests/general/oauth2/token')
     ->param('client_id', '', new Text(100), 'OAuth2 Client ID.')
     ->param('client_secret', '', new Text(100), 'OAuth2 scope list.')
     ->param('grant_type', 'authorization_code', new WhiteList(['refresh_token', 'authorization_code']), 'OAuth2 Grant Type.', true)
-    ->param('redirect_uri', '', new Host(['localhost']), 'OAuth2 Redirect URI.', true)
+    ->param('redirect_uri', '', fn ($redirectValidator) => $redirectValidator, 'URL to redirect back to your app after a successful login attempt.  Only URLs from hostnames in your project\'s platform list are allowed. This requirement helps to prevent an [open redirect](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html) attack against your project API.', true, ['redirectValidator'])
     ->param('code', '', new Text(100), 'OAuth2 state.', true)
     ->param('refresh_token', '', new Text(100), 'OAuth2 refresh token.', true)
     ->inject('response')
@@ -118,6 +117,28 @@ App::get('/v1/mock/tests/general/oauth2/user')
             'id' => 1,
             'name' => 'User Name',
             'email' => 'useroauth@localhost.test',
+            'verified' => true,
+        ]);
+    });
+
+App::get('/v1/mock/tests/general/oauth2/user-unverified')
+    ->desc('OAuth2 User Unverified')
+    ->groups(['mock'])
+    ->label('scope', 'public')
+    ->label('docs', false)
+    ->param('token', '', new Text(100), 'OAuth2 Access Token.')
+    ->inject('response')
+    ->action(function (string $token, Response $response) {
+
+        if ($token != '123456') {
+            throw new Exception(Exception::GENERAL_MOCK, 'Invalid token');
+        }
+
+        $response->json([
+            'id' => 2,
+            'name' => 'User Name Unverified',
+            'email' => 'useroauthunverified@localhost.test',
+            'verified' => false,
         ]);
     });
 

app/controllers/shared/api.php

@@ -1,6 +1,5 @@
 <?php
 
-use Appwrite\Auth\Auth;
 use Appwrite\Auth\Key;
 use Appwrite\Auth\MFA\Type\TOTP;
 use Appwrite\Event\Audit;
@@ -9,32 +8,35 @@ use Appwrite\Event\Database as EventDatabase;
 use Appwrite\Event\Delete;
 use Appwrite\Event\Event;
 use Appwrite\Event\Func;
+use Appwrite\Event\Mail;
 use Appwrite\Event\Messaging;
+use Appwrite\Event\Migration;
 use Appwrite\Event\Realtime;
 use Appwrite\Event\StatsUsage;
 use Appwrite\Event\Webhook;
 use Appwrite\Extend\Exception;
 use Appwrite\Extend\Exception as AppwriteException;
 use Appwrite\SDK\Method;
+use Appwrite\Utopia\Database\Documents\User;
 use Appwrite\Utopia\Request;
 use Appwrite\Utopia\Response;
 use Utopia\Abuse\Abuse;
 use Utopia\App;
 use Utopia\Cache\Adapter\Filesystem;
 use Utopia\Cache\Cache;
-use Utopia\CLI\Console;
 use Utopia\Config\Config;
 use Utopia\Database\Database;
 use Utopia\Database\DateTime;
 use Utopia\Database\Document;
 use Utopia\Database\Helpers\Role;
 use Utopia\Database\Validator\Authorization;
+use Utopia\Database\Validator\Authorization\Input;
 use Utopia\Queue\Publisher;
 use Utopia\System\System;
 use Utopia\Telemetry\Adapter as Telemetry;
 use Utopia\Validator\WhiteList;
 
-$parseLabel = function (string $label, array $responsePayload, array $requestParams, Document $user) {
+$parseLabel = function (string $label, array $responsePayload, array $requestParams, User $user) {
     preg_match_all('/{(.*?)}/', $label, $matches);
     foreach ($matches[1] ?? [] as $pos => $match) {
         $find = $matches[0][$pos];
@@ -54,7 +56,20 @@ $parseLabel = function (string $label, array $responsePayload, array $requestPar
         };
 
         if (array_key_exists($replace, $params)) {
-            $label = \str_replace($find, $params[$replace], $label);
+            $replacement = $params[$replace];
+            // Convert to string if it's not already a string
+            if (!is_string($replacement)) {
+                if (is_array($replacement)) {
+                    $replacement = json_encode($replacement);
+                } elseif (is_object($replacement) && method_exists($replacement, '__toString')) {
+                    $replacement = (string)$replacement;
+                } elseif (is_scalar($replacement)) {
+                    $replacement = (string)$replacement;
+                } else {
+                    throw new Exception(Exception::GENERAL_SERVER_ERROR, "The server encountered an error while parsing the label: $label. Please create an issue on GitHub to allow us to investigate further https://github.com/appwrite/appwrite/issues/new/choose");
+                }
+            }
+            $label = \str_replace($find, $replacement, $label);
         }
     }
     return $label;
@@ -219,42 +234,98 @@ App::init()
     ->inject('mode')
     ->inject('team')
     ->inject('apiKey')
-    ->action(function (App $utopia, Request $request, Database $dbForPlatform, Database $dbForProject, Audit $queueForAudits, Document $project, Document $user, ?Document $session, array $servers, string $mode, Document $team, ?Key $apiKey) {
+    ->inject('authorization')
+    ->action(function (App $utopia, Request $request, Database $dbForPlatform, Database $dbForProject, Audit $queueForAudits, Document $project, Document $user, ?Document $session, array $servers, string $mode, Document $team, ?Key $apiKey, Authorization $authorization) {
         $route = $utopia->getRoute();
 
+        /**
+         * Handle user authentication and session validation.
+         *
+         * This function follows a series of steps to determine the appropriate user session
+         * based on cookies, headers, and JWT tokens.
+         *
+         * Process:
+         *
+         * Project & Role Validation:
+         * 1. Check if the project is empty. If so, throw an exception.
+         * 2. Get the roles configuration.
+         * 3. Determine the role for the user based on the user document.
+         * 4. Get the scopes for the role.
+         *
+         * API Key Authentication:
+         * 5. If there is an API key:
+         *    - Verify no user session exists simultaneously
+         *    - Check if key is expired
+         *    - Set role and scopes from API key
+         *    - Handle special app role case
+         *    - For standard keys, update last accessed time
+         *
+         * User Activity:
+         * 6. If the project is not the console and user is not admin:
+         *    - Update user's last activity timestamp
+         *
+         * Access Control:
+         * 7. Get the method from the route
+         * 8. Validate namespace permissions
+         * 9. Validate scope permissions
+         * 10. Check if user is blocked
+         *
+         * Security Checks:
+         * 11. Verify password status (check if reset required)
+         * 12. Validate MFA requirements:
+         *     - Check if MFA is enabled
+         *     - Verify email status
+         *     - Verify phone status
+         *     - Verify authenticator status
+         * 13. Handle Multi-Factor Authentication:
+         *     - Check remaining required factors
+         *     - Validate factor completion
+         *     - Throw exception if factors incomplete
+         */
+
+        // Step 1: Check if project is empty
         if ($project->isEmpty()) {
             throw new Exception(Exception::PROJECT_NOT_FOUND);
         }
 
+        // Step 2: Get roles configuration
         $roles = Config::getParam('roles', []);
 
+        // Step 3: Determine role for user
+        // TODO get scopes from the identity instead of the user roles config. The identity will containn the scopes the user authorized for the access token.
+
         $role = $user->isEmpty()
             ? Role::guests()->toString()
             : Role::users()->toString();
 
+        // Step 4: Get scopes for the role
         $scopes = $roles[$role]['scopes'];
 
-        // API Key authentication
+        // Step 5: API Key Authentication
         if (!empty($apiKey)) {
+            // Verify no user session exists simultaneously
             if (!$user->isEmpty()) {
                 throw new Exception(Exception::USER_API_KEY_AND_SESSION_SET);
             }
+            // Check if key is expired
             if ($apiKey->isExpired()) {
                 throw new Exception(Exception::PROJECT_KEY_EXPIRED);
             }
 
+            // Set role and scopes from API key
             $role = $apiKey->getRole();
             $scopes = $apiKey->getScopes();
 
 
-            if ($apiKey->getRole() === Auth::USER_ROLE_APPS) {
+            // Handle special app role case
+            if ($apiKey->getRole() === User::ROLE_APPS) {
                 // Disable authorization checks for API keys
-                Authorization::setDefaultStatus(false);
+                $authorization->setDefaultStatus(false);
 
-                $user = new Document([
+                $user = new User([
                     '$id' => '',
                     'status' => true,
-                    'type' => Auth::ACTIVITY_TYPE_APP,
+                    'type' => ACTIVITY_TYPE_APP,
                     'email' => 'app.' . $project->getId() . '@service.' . $request->getHostname(),
                     'password' => '',
                     'name' => $apiKey->getName(),
@@ -263,6 +334,7 @@ App::init()
                 $queueForAudits->setUser($user);
             }
 
+            // For standard keys, update last accessed time
             if ($apiKey->getType() === API_KEY_STANDARD) {
                 $dbKey = $project->find(
                     key: 'secret',
@@ -322,26 +394,25 @@ App::init()
                 $scopes = \array_merge($scopes, $roles[$role]['scopes']);
             }
 
-            Authorization::setDefaultStatus(false);  // Cancel security segmentation for admin users.
+            $authorization->setDefaultStatus(false);  // Cancel security segmentation for admin users.
         }
 
         $scopes = \array_unique($scopes);
 
-        Authorization::setRole($role);
-        foreach (Auth::getRoles($user) as $authRole) {
-            Authorization::setRole($authRole);
+        $authorization->addRole($role);
+        foreach ($user->getRoles($authorization) as $authRole) {
+            $authorization->addRole($authRole);
         }
 
-        // Update project last activity
+        // Step 6: Update project and user last activity
         if (!$project->isEmpty() && $project->getId() !== 'console') {
             $accessedAt = $project->getAttribute('accessedAt', 0);
             if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_PROJECT_ACCESS)) > $accessedAt) {
                 $project->setAttribute('accessedAt', DateTime::now());
-                Authorization::skip(fn () => $dbForPlatform->updateDocument('projects', $project->getId(), $project));
+                $authorization->skip(fn () => $dbForPlatform->updateDocument('projects', $project->getId(), $project));
             }
         }
 
-        // Update user last activity
         if (!empty($user->getId())) {
             $accessedAt = $user->getAttribute('accessedAt', 0);
             if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_USER_ACCESS)) > $accessedAt) {
@@ -355,6 +426,7 @@ App::init()
             }
         }
 
+        // Steps 7-9: Access Control - Method, Namespace and Scope Validation
         /**
          * @var ?Method $method
          */
@@ -372,27 +444,29 @@ App::init()
             if (
                 array_key_exists($namespace, $project->getAttribute('services', []))
                 && !$project->getAttribute('services', [])[$namespace]
-                && !(Auth::isPrivilegedUser(Authorization::getRoles()) || Auth::isAppUser(Authorization::getRoles()))
+                && !(User::isPrivileged($authorization->getRoles()) || User::isApp($authorization->getRoles()))
             ) {
                 throw new Exception(Exception::GENERAL_SERVICE_DISABLED);
             }
         }
 
-        // Do now allow access if scope is not allowed
+        // Step 9: Validate scope permissions
         $allowed = (array)$route->getLabel('scope', 'none');
         if (empty(\array_intersect($allowed, $scopes))) {
             throw new Exception(Exception::GENERAL_UNAUTHORIZED_SCOPE, $user->getAttribute('email', 'User') . ' (role: ' . \strtolower($roles[$role]['label']) . ') missing scopes (' . \json_encode($allowed) . ')');
         }
 
-        // Do not allow access to blocked accounts
+        // Step 10: Check if user is blocked
         if (false === $user->getAttribute('status')) { // Account is blocked
             throw new Exception(Exception::USER_BLOCKED);
         }
 
+        // Step 11: Verify password status
         if ($user->getAttribute('reset')) {
             throw new Exception(Exception::USER_PASSWORD_RESET_REQUIRED);
         }
 
+        // Step 12: Validate MFA requirements
         $mfaEnabled = $user->getAttribute('mfa', false);
         $hasVerifiedEmail = $user->getAttribute('emailVerification', false);
         $hasVerifiedPhone = $user->getAttribute('phoneVerification', false);
@@ -400,6 +474,7 @@ App::init()
         $hasMoreFactors = $hasVerifiedEmail || $hasVerifiedPhone || $hasVerifiedAuthenticator;
         $minimumFactors = ($mfaEnabled && $hasMoreFactors) ? 2 : 1;
 
+        // Step 13: Handle Multi-Factor Authentication
         if (!in_array('mfa', $route->getGroups())) {
             if ($session && \count($session->getAttribute('factors', [])) < $minimumFactors) {
                 throw new Exception(Exception::USER_MORE_FACTORS_REQUIRED);
@@ -424,6 +499,9 @@ App::init()
     ->inject('queueForDatabase')
     ->inject('queueForBuilds')
     ->inject('queueForStatsUsage')
+    ->inject('queueForFunctions')
+    ->inject('queueForMails')
+    ->inject('queueForMigrations')
     ->inject('dbForProject')
     ->inject('timelimit')
     ->inject('resourceToken')
@@ -432,14 +510,16 @@ App::init()
     ->inject('plan')
     ->inject('devKey')
     ->inject('telemetry')
-    ->action(function (App $utopia, Request $request, Response $response, Document $project, Document $user, Publisher $publisher, Publisher $publisherFunctions, Publisher $publisherWebhooks, Event $queueForEvents, Messaging $queueForMessaging, Audit $queueForAudits, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, StatsUsage $queueForStatsUsage, Database $dbForProject, callable $timelimit, Document $resourceToken, string $mode, ?Key $apiKey, array $plan, Document $devKey, Telemetry $telemetry) use ($usageDatabaseListener, $eventDatabaseListener) {
+    ->inject('platform')
+    ->inject('authorization')
+    ->action(function (App $utopia, Request $request, Response $response, Document $project, Document $user, Publisher $publisher, Publisher $publisherFunctions, Publisher $publisherWebhooks, Event $queueForEvents, Messaging $queueForMessaging, Audit $queueForAudits, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Mail $queueForMails, Migration $queueForMigrations, Database $dbForProject, callable $timelimit, Document $resourceToken, string $mode, ?Key $apiKey, array $plan, Document $devKey, Telemetry $telemetry, array $platform, Authorization $authorization) use ($usageDatabaseListener, $eventDatabaseListener) {
 
         $route = $utopia->getRoute();
 
         if (
             array_key_exists('rest', $project->getAttribute('apis', []))
             && !$project->getAttribute('apis', [])['rest']
-            && !(Auth::isPrivilegedUser(Authorization::getRoles()) || Auth::isAppUser(Authorization::getRoles()))
+            && !(User::isPrivileged($authorization->getRoles()) || User::isApp($authorization->getRoles()))
         ) {
             throw new AppwriteException(AppwriteException::GENERAL_API_DISABLED);
         }
@@ -469,9 +549,9 @@ App::init()
 
         $closestLimit = null;
 
-        $roles = Authorization::getRoles();
-        $isPrivilegedUser = Auth::isPrivilegedUser($roles);
-        $isAppUser = Auth::isAppUser($roles);
+        $roles = $authorization->getRoles();
+        $isPrivilegedUser = User::isPrivileged($roles);
+        $isAppUser = User::isApp($roles);
 
         foreach ($timeLimitArray as $timeLimit) {
             foreach ($request->getParams() as $key => $value) { // Set request params as potential abuse keys
@@ -506,6 +586,10 @@ App::init()
             }
         }
 
+        /**
+         *  TODO: (@loks0n)
+         *  Avoid mutating the message across file boundaries - it's difficult to reason about at scale.
+         */
         /*
         * Background Jobs
         */
@@ -526,7 +610,7 @@ App::init()
         if (!$user->isEmpty()) {
             $userClone = clone $user;
             // $user doesn't support `type` and can cause unintended effects.
-            $userClone->setAttribute('type', Auth::ACTIVITY_TYPE_USER);
+            $userClone->setAttribute('type', ACTIVITY_TYPE_USER);
             $queueForAudits->setUser($userClone);
         }
 
@@ -536,10 +620,17 @@ App::init()
             }
         }
 
+        /* Auto-set projects */
         $queueForDeletes->setProject($project);
         $queueForDatabase->setProject($project);
-        $queueForBuilds->setProject($project);
         $queueForMessaging->setProject($project);
+        $queueForFunctions->setProject($project);
+        $queueForBuilds->setProject($project);
+
+        /* Auto-set platforms */
+        $queueForFunctions->setPlatform($platform);
+        $queueForBuilds->setPlatform($platform);
+        $queueForMails->setPlatform($platform);
 
         // Clone the queues, to prevent events triggered by the database listener
         // from overwriting the events that are supposed to be triggered in the shutdown hook.
@@ -569,10 +660,10 @@ App::init()
         if ($useCache) {
             $route = $utopia->match($request);
             $isImageTransformation = $route->getPath() === '/v1/storage/buckets/:bucketId/files/:fileId/preview';
-            $isDisabled = isset($plan['imageTransformations']) && $plan['imageTransformations'] === -1 && !Auth::isPrivilegedUser(Authorization::getRoles());
+            $isDisabled = isset($plan['imageTransformations']) && $plan['imageTransformations'] === -1 && !User::isPrivileged($authorization->getRoles());
 
             $key = $request->cacheIdentifier();
-            $cacheLog  = Authorization::skip(fn () => $dbForProject->getDocument('cache', $key));
+            $cacheLog  = $authorization->skip(fn () => $dbForProject->getDocument('cache', $key));
             $cache = new Cache(
                 new Filesystem(APP_STORAGE_CACHE . DIRECTORY_SEPARATOR . 'app-' . $project->getId())
             );
@@ -580,23 +671,30 @@ App::init()
             $data = $cache->load($key, $timestamp);
 
             if (!empty($data) && !$cacheLog->isEmpty()) {
+                $usageMetric = $route->getLabel('usage.metric', null);
+                if ($usageMetric === METRIC_AVATARS_SCREENSHOTS_GENERATED) {
+                    $queueForStatsUsage->disableMetric(METRIC_AVATARS_SCREENSHOTS_GENERATED);
+                }
                 $parts = explode('/', $cacheLog->getAttribute('resourceType', ''));
                 $type = $parts[0] ?? null;
 
                 if ($type === 'bucket' && (!$isImageTransformation || !$isDisabled)) {
                     $bucketId = $parts[1] ?? null;
-                    $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+                    $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
 
                     $isToken = !$resourceToken->isEmpty() && $resourceToken->getAttribute('bucketInternalId') === $bucket->getSequence();
-                    $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles());
+                    $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
 
                     if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAppUser && !$isPrivilegedUser)) {
                         throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
                     }
 
+                    if (!$bucket->getAttribute('transformations', true) && !$isAppUser && !$isPrivilegedUser) {
+                        throw new Exception(Exception::STORAGE_BUCKET_TRANSFORMATIONS_DISABLED);
+                    }
+
                     $fileSecurity = $bucket->getAttribute('fileSecurity', false);
-                    $validator = new Authorization(Database::PERMISSION_READ);
-                    $valid = $validator->isValid($bucket->getRead());
+                    $valid = $authorization->isValid(new Input(Database::PERMISSION_READ, $bucket->getRead()));
                     if (!$fileSecurity && !$valid && !$isToken) {
                         throw new Exception(Exception::USER_UNAUTHORIZED);
                     }
@@ -607,7 +705,7 @@ App::init()
                     if ($fileSecurity && !$valid && !$isToken) {
                         $file = $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId);
                     } else {
-                        $file = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+                        $file = $authorization->skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
                     }
 
                     if (!$resourceToken->isEmpty() && $resourceToken->getAttribute('fileInternalId') !== $file->getSequence()) {
@@ -618,11 +716,11 @@ App::init()
                         throw new Exception(Exception::STORAGE_FILE_NOT_FOUND);
                     }
                     //Do not update transformedAt if it's a console user
-                    if (!Auth::isPrivilegedUser(Authorization::getRoles())) {
+                    if (!User::isPrivileged($authorization->getRoles())) {
                         $transformedAt = $file->getAttribute('transformedAt', '');
                         if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_PROJECT_ACCESS)) > $transformedAt) {
                             $file->setAttribute('transformedAt', DateTime::now());
-                            Authorization::skip(fn () => $dbForProject->updateDocument('bucket_' . $file->getAttribute('bucketInternalId'), $file->getId(), $file));
+                            $authorization->skip(fn () => $dbForProject->updateDocument('bucket_' . $file->getAttribute('bucketInternalId'), $file->getId(), $file));
                         }
                     }
                 }
@@ -718,7 +816,8 @@ App::shutdown()
     ->inject('queueForWebhooks')
     ->inject('queueForRealtime')
     ->inject('dbForProject')
-    ->action(function (App $utopia, Request $request, Response $response, Document $project, Document $user, Event $queueForEvents, Audit $queueForAudits, StatsUsage $queueForStatsUsage, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, Messaging $queueForMessaging, Func $queueForFunctions, Event $queueForWebhooks, Realtime $queueForRealtime, Database $dbForProject) use ($parseLabel) {
+    ->inject('authorization')
+    ->action(function (App $utopia, Request $request, Response $response, Document $project, Document $user, Event $queueForEvents, Audit $queueForAudits, StatsUsage $queueForStatsUsage, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, Messaging $queueForMessaging, Func $queueForFunctions, Event $queueForWebhooks, Realtime $queueForRealtime, Database $dbForProject, Authorization $authorization) use ($parseLabel) {
 
         $responsePayload = $response->getPayload();
 
@@ -766,7 +865,7 @@ App::shutdown()
         if (!$user->isEmpty()) {
             $userClone = clone $user;
             // $user doesn't support `type` and can cause unintended effects.
-            $userClone->setAttribute('type', Auth::ACTIVITY_TYPE_USER);
+            $userClone->setAttribute('type', ACTIVITY_TYPE_USER);
             $queueForAudits->setUser($userClone);
         } elseif ($queueForAudits->getUser() === null || $queueForAudits->getUser()->isEmpty()) {
             /**
@@ -777,10 +876,10 @@ App::shutdown()
              *
              * Therefore, we consider this an anonymous request and create a relevant user.
              */
-            $user = new Document([
+            $user = new User([
                 '$id' => '',
                 'status' => true,
-                'type' => Auth::ACTIVITY_TYPE_GUEST,
+                'type' => ACTIVITY_TYPE_GUEST,
                 'email' => 'guest.' . $project->getId() . '@service.' . $request->getHostname(),
                 'password' => '',
                 'name' => 'Guest',
@@ -844,11 +943,11 @@ App::shutdown()
 
                 $key = $request->cacheIdentifier();
                 $signature = md5($data['payload']);
-                $cacheLog  =  Authorization::skip(fn () => $dbForProject->getDocument('cache', $key));
+                $cacheLog  =  $authorization->skip(fn () => $dbForProject->getDocument('cache', $key));
                 $accessedAt = $cacheLog->getAttribute('accessedAt', 0);
                 $now = DateTime::now();
                 if ($cacheLog->isEmpty()) {
-                    Authorization::skip(fn () => $dbForProject->createDocument('cache', new Document([
+                    $authorization->skip(fn () => $dbForProject->createDocument('cache', new Document([
                         '$id' => $key,
                         'resource' => $resource,
                         'resourceType' => $resourceType,
@@ -858,7 +957,7 @@ App::shutdown()
                     ])));
                 } elseif (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_CACHE_UPDATE)) > $accessedAt) {
                     $cacheLog->setAttribute('accessedAt', $now);
-                    Authorization::skip(fn () => $dbForProject->updateDocument('cache', $cacheLog->getId(), $cacheLog));
+                    $authorization->skip(fn () => $dbForProject->updateDocument('cache', $cacheLog->getId(), $cacheLog));
                     // Overwrite the file every APP_CACHE_UPDATE seconds to update the file modified time that is used in the TTL checks in cache->load()
                     $cache->save($key, $data['payload']);
                 }
@@ -870,7 +969,7 @@ App::shutdown()
         }
 
         if ($project->getId() !== 'console') {
-            if (!Auth::isPrivilegedUser(Authorization::getRoles())) {
+            if (!User::isPrivileged($authorization->getRoles())) {
                 $fileSize = 0;
                 $file = $request->getFiles('file');
                 if (!empty($file)) {

app/controllers/shared/api/auth.php

@@ -1,7 +1,7 @@
 <?php
 
-use Appwrite\Auth\Auth;
 use Appwrite\Extend\Exception;
+use Appwrite\Utopia\Database\Documents\User;
 use Appwrite\Utopia\Request;
 use MaxMind\Db\Reader;
 use Utopia\App;
@@ -20,7 +20,7 @@ App::init()
         $lastUpdate = $session->getAttribute('mfaUpdatedAt');
         if (!empty($lastUpdate)) {
             $now = DateTime::now();
-            $maxAllowedDate = DateTime::addSeconds(new \DateTime($lastUpdate), Auth::MFA_RECENT_DURATION); // Maximum date until session is considered safe before asking for another challenge
+            $maxAllowedDate = DateTime::addSeconds(new \DateTime($lastUpdate), MFA_RECENT_DURATION); // Maximum date until session is considered safe before asking for another challenge
 
             $isSessionFresh = DateTime::formatTz($maxAllowedDate) >= DateTime::formatTz($now);
         }
@@ -36,7 +36,8 @@ App::init()
     ->inject('request')
     ->inject('project')
     ->inject('geodb')
-    ->action(function (App $utopia, Request $request, Document $project, Reader $geodb) {
+    ->inject('authorization')
+    ->action(function (App $utopia, Request $request, Document $project, Reader $geodb, Authorization $authorization) {
         $denylist = System::getEnv('_APP_CONSOLE_COUNTRIES_DENYLIST', '');
         if (!empty($denylist && $project->getId() === 'console')) {
             $countries = explode(',', $denylist);
@@ -49,8 +50,8 @@ App::init()
 
         $route = $utopia->match($request);
 
-        $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles());
-        $isAppUser = Auth::isAppUser(Authorization::getRoles());
+        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAppUser = User::isApp($authorization->getRoles());
 
         if ($isAppUser || $isPrivilegedUser) { // Skip limits for app and console devs
             return;

app/controllers/web/home.php

@@ -10,7 +10,7 @@ App::get('/versions')
     ->label('scope', 'public')
     ->inject('response')
     ->action(function (Response $response) {
-        $platforms = Config::getParam('platforms');
+        $platforms = Config::getParam('sdks');
 
         $versions = [
             'server' => APP_VERSION_STABLE,

app/http.php

@@ -25,7 +25,6 @@ use Utopia\Database\Helpers\ID;
 use Utopia\Database\Helpers\Permission;
 use Utopia\Database\Helpers\Role;
 use Utopia\Database\Query;
-use Utopia\Database\Validator\Authorization;
 use Utopia\Logger\Log;
 use Utopia\Logger\Log\User;
 use Utopia\Pools\Group;
@@ -259,7 +258,9 @@ $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $reg
         createDatabase($app, 'getLogsDB', 'logs', $collections['logs'], $pools);
 
         // create appwrite database, `dbForPlatform` is a direct access call.
-        createDatabase($app, 'dbForPlatform', 'appwrite', $collections['console'], $pools, function (Database $dbForPlatform) use ($collections) {
+        createDatabase($app, 'dbForPlatform', 'appwrite', $collections['console'], $pools, function (Database $dbForPlatform) use ($collections, $app) {
+            $authorization = $app->getResource('authorization');
+
             if ($dbForPlatform->getCollection(Audit::COLLECTION)->isEmpty()) {
                 $audit = new Audit($dbForPlatform);
                 $audit->setup();
@@ -318,9 +319,9 @@ $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $reg
                 $dbForPlatform->createCollection('bucket_' . $bucket->getSequence(), $attributes, $indexes);
             }
 
-            if (Authorization::skip(fn () => $dbForPlatform->getDocument('buckets', 'screenshots')->isEmpty())) {
+            if ($authorization->skip(fn () => $dbForPlatform->getDocument('buckets', 'screenshots')->isEmpty())) {
                 Console::info("    └── Creating screenshots bucket...");
-                Authorization::skip(fn () => $dbForPlatform->createDocument('buckets', new Document([
+                $authorization->skip(fn () => $dbForPlatform->createDocument('buckets', new Document([
                     '$id' => ID::custom('screenshots'),
                     '$collection' => ID::custom('buckets'),
                     'name' => 'Screenshots',
@@ -335,7 +336,7 @@ $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $reg
                     'search' => 'buckets Screenshots',
                 ])));
 
-                $bucket = Authorization::skip(fn () => $dbForPlatform->getDocument('buckets', 'screenshots'));
+                $bucket = $authorization->skip(fn () => $dbForPlatform->getDocument('buckets', 'screenshots'));
 
                 Console::info("    └── Creating files collection for screenshots bucket...");
                 $files = $collections['buckets']['files'] ?? [];
@@ -363,7 +364,7 @@ $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $reg
                     'orders' => $index['orders'],
                 ]), $files['indexes']);
 
-                Authorization::skip(fn () => $dbForPlatform->createCollection('bucket_' . $bucket->getSequence(), $attributes, $indexes));
+                $authorization->skip(fn () => $dbForPlatform->createCollection('bucket_' . $bucket->getSequence(), $attributes, $indexes));
             }
         });
 
@@ -454,8 +455,12 @@ $http->on(Constant::EVENT_REQUEST, function (SwooleRequest $swooleRequest, Swool
     App::setResource('pools', fn () => $pools);
 
     try {
-        Authorization::cleanRoles();
-        Authorization::setRole(Role::any()->toString());
+        $authorization = $app->getResource('authorization');
+
+        $request->setAuthorization($authorization);
+        $response->setAuthorization($authorization);
+        $authorization->cleanRoles();
+        $authorization->addRole(Role::any()->toString());
 
         $app->run($request, $response);
     } catch (\Throwable $th) {
@@ -497,7 +502,7 @@ $http->on(Constant::EVENT_REQUEST, function (SwooleRequest $swooleRequest, Swool
             $log->addExtra('file', $th->getFile());
             $log->addExtra('line', $th->getLine());
             $log->addExtra('trace', $th->getTraceAsString());
-            $log->addExtra('roles', Authorization::getRoles());
+            $log->addExtra('roles', isset($authorization) ? $authorization->getRoles() : []);
 
             $sdk = $route->getLabel("sdk", false);
 
@@ -556,7 +561,7 @@ $http->on(Constant::EVENT_TASK, function () use ($register, $domains) {
     /** @var Utopia\Database\Database $dbForPlatform */
     $dbForPlatform = $app->getResource('dbForPlatform');
 
-    Timer::tick(DOMAIN_SYNC_TIMER * 1000, function () use ($dbForPlatform, $domains, &$lastSyncUpdate) {
+    Timer::tick(DOMAIN_SYNC_TIMER * 1000, function () use ($dbForPlatform, $domains, &$lastSyncUpdate, $app) {
         try {
             $time = DateTime::now();
             $limit = 1000;
@@ -573,7 +578,8 @@ $http->on(Constant::EVENT_TASK, function () use ($register, $domains) {
                 }
                 $results = [];
                 try {
-                    $results = Authorization::skip(fn () =>  $dbForPlatform->find('rules', $queries));
+                    $authorization = $app->getResource('authorization');
+                    $results = $authorization->skip(fn () =>  $dbForPlatform->find('rules', $queries));
                 } catch (Throwable $th) {
                     Console::error($th->getMessage());
                 }

app/init/configs.php

@@ -1,42 +1,46 @@
 <?php
 
+use Utopia\Config\Adapters\PHP;
 use Utopia\Config\Config;
 
 require_once __DIR__ . '/../config/storage/resource_limits.php';
 
-Config::load('template-runtimes', __DIR__ . '/../config/template-runtimes.php');
-Config::load('events', __DIR__ . '/../config/events.php');
-Config::load('auth', __DIR__ . '/../config/auth.php');
-Config::load('apis', __DIR__ . '/../config/apis.php');  // List of APIs
-Config::load('errors', __DIR__ . '/../config/errors.php');
-Config::load('oAuthProviders', __DIR__ . '/../config/oAuthProviders.php');
-Config::load('platforms', __DIR__ . '/../config/platforms.php');
-Config::load('console', __DIR__ . '/../config/console.php');
-Config::load('collections', __DIR__ . '/../config/collections.php');
-Config::load('frameworks', __DIR__ . '/../config/frameworks.php');
-Config::load('runtimes', __DIR__ . '/../config/runtimes.php');
-Config::load('runtimes-v2', __DIR__ . '/../config/runtimes-v2.php');
-Config::load('usage', __DIR__ . '/../config/usage.php');
-Config::load('roles', __DIR__ . '/../config/roles.php');  // User roles and scopes
-Config::load('scopes', __DIR__ . '/../config/scopes.php');  // User roles and scopes
-Config::load('services', __DIR__ . '/../config/services.php');  // List of services
-Config::load('variables', __DIR__ . '/../config/variables.php');  // List of env variables
-Config::load('regions', __DIR__ . '/../config/regions.php'); // List of available regions
-Config::load('avatar-browsers', __DIR__ . '/../config/avatars/browsers.php');
-Config::load('avatar-credit-cards', __DIR__ . '/../config/avatars/credit-cards.php');
-Config::load('avatar-flags', __DIR__ . '/../config/avatars/flags.php');
-Config::load('locale-codes', __DIR__ . '/../config/locale/codes.php');
-Config::load('locale-currencies', __DIR__ . '/../config/locale/currencies.php');
-Config::load('locale-eu', __DIR__ . '/../config/locale/eu.php');
-Config::load('locale-languages', __DIR__ . '/../config/locale/languages.php');
-Config::load('locale-phones', __DIR__ . '/../config/locale/phones.php');
-Config::load('locale-countries', __DIR__ . '/../config/locale/countries.php');
-Config::load('locale-continents', __DIR__ . '/../config/locale/continents.php');
-Config::load('locale-templates', __DIR__ . '/../config/locale/templates.php');
-Config::load('storage-logos', __DIR__ . '/../config/storage/logos.php');
-Config::load('storage-mimes', __DIR__ . '/../config/storage/mimes.php');
-Config::load('storage-inputs', __DIR__ . '/../config/storage/inputs.php');
-Config::load('storage-outputs', __DIR__ . '/../config/storage/outputs.php');
-Config::load('specifications', __DIR__ . '/../config/specifications.php');
-Config::load('templates-function', __DIR__ . '/../config/templates/function.php');
-Config::load('templates-site', __DIR__ . '/../config/templates/site.php');
+$configAdapter = new PHP();
+
+Config::load('runtimes', __DIR__ . '/../config/runtimes.php', $configAdapter);
+Config::load('runtimes-v2', __DIR__ . '/../config/runtimes-v2.php', $configAdapter);
+Config::load('template-runtimes', __DIR__ . '/../config/template-runtimes.php', $configAdapter);
+Config::load('events', __DIR__ . '/../config/events.php', $configAdapter);
+Config::load('auth', __DIR__ . '/../config/auth.php', $configAdapter);
+Config::load('apis', __DIR__ . '/../config/apis.php', $configAdapter);  // List of APIs
+Config::load('errors', __DIR__ . '/../config/errors.php', $configAdapter);
+Config::load('oAuthProviders', __DIR__ . '/../config/oAuthProviders.php', $configAdapter);
+Config::load('sdks', __DIR__ . '/../config/sdks.php', $configAdapter);
+Config::load('platform', __DIR__ . '/../config/platform.php', $configAdapter);
+Config::load('console', __DIR__ . '/../config/console.php', $configAdapter);
+Config::load('collections', __DIR__ . '/../config/collections.php', $configAdapter);
+Config::load('frameworks', __DIR__ . '/../config/frameworks.php', $configAdapter);
+Config::load('usage', __DIR__ . '/../config/usage.php', $configAdapter);
+Config::load('roles', __DIR__ . '/../config/roles.php', $configAdapter);  // User roles and scopes
+Config::load('scopes', __DIR__ . '/../config/scopes.php', $configAdapter);  // User roles and scopes
+Config::load('services', __DIR__ . '/../config/services.php', $configAdapter);  // List of services
+Config::load('variables', __DIR__ . '/../config/variables.php', $configAdapter);  // List of env variables
+Config::load('regions', __DIR__ . '/../config/regions.php', $configAdapter); // List of available regions
+Config::load('avatar-browsers', __DIR__ . '/../config/avatars/browsers.php', $configAdapter);
+Config::load('avatar-credit-cards', __DIR__ . '/../config/avatars/credit-cards.php', $configAdapter);
+Config::load('avatar-flags', __DIR__ . '/../config/avatars/flags.php', $configAdapter);
+Config::load('locale-codes', __DIR__ . '/../config/locale/codes.php', $configAdapter);
+Config::load('locale-currencies', __DIR__ . '/../config/locale/currencies.php', $configAdapter);
+Config::load('locale-eu', __DIR__ . '/../config/locale/eu.php', $configAdapter);
+Config::load('locale-languages', __DIR__ . '/../config/locale/languages.php', $configAdapter);
+Config::load('locale-phones', __DIR__ . '/../config/locale/phones.php', $configAdapter);
+Config::load('locale-countries', __DIR__ . '/../config/locale/countries.php', $configAdapter);
+Config::load('locale-continents', __DIR__ . '/../config/locale/continents.php', $configAdapter);
+Config::load('locale-templates', __DIR__ . '/../config/locale/templates.php', $configAdapter);
+Config::load('storage-logos', __DIR__ . '/../config/storage/logos.php', $configAdapter);
+Config::load('storage-mimes', __DIR__ . '/../config/storage/mimes.php', $configAdapter);
+Config::load('storage-inputs', __DIR__ . '/../config/storage/inputs.php', $configAdapter);
+Config::load('storage-outputs', __DIR__ . '/../config/storage/outputs.php', $configAdapter);
+Config::load('specifications', __DIR__ . '/../config/specifications.php', $configAdapter);
+Config::load('templates-function', __DIR__ . '/../config/templates/function.php', $configAdapter);
+Config::load('templates-site', __DIR__ . '/../config/templates/site.php', $configAdapter);

app/init/constants.php

@@ -4,12 +4,17 @@ use Appwrite\Platform\Modules\Compute\Specification;
 
 const APP_NAME = 'Appwrite';
 const APP_DOMAIN = 'appwrite.io';
+
+// Email
 const APP_EMAIL_TEAM = 'team@localhost.test'; // Default email address
 const APP_EMAIL_SECURITY = ''; // Default security email address
 const APP_EMAIL_LOGO_URL = 'https://cloud.appwrite.io/images/mails/logo.png';
 const APP_EMAIL_ACCENT_COLOR = '#fd366e';
 const APP_EMAIL_TERMS_URL = 'https://appwrite.io/terms';
 const APP_EMAIL_PRIVACY_URL = 'https://appwrite.io/privacy';
+const APP_EMAIL_PLATFORM_NAME = 'Appwrite';
+const APP_EMAIL_FOOTER_IMAGE_URL = 'https://appwrite.io/email/footer.png';
+
 const APP_USERAGENT = APP_NAME . '-Server v%s. Please report abuse at %s';
 const APP_MODE_DEFAULT = 'default';
 const APP_MODE_ADMIN = 'admin';
@@ -31,6 +36,7 @@ const APP_LIMIT_WRITE_RATE_DEFAULT = 60; // Default maximum write rate per rate
 const APP_LIMIT_WRITE_RATE_PERIOD_DEFAULT = 60; // Default maximum write rate period in seconds
 const APP_LIMIT_LIST_DEFAULT = 25; // Default maximum number of items to return in list API calls
 const APP_LIMIT_DATABASE_BATCH = 100; // Default maximum batch size for database operations
+const APP_LIMIT_DATABASE_TRANSACTION = 100; // Default maximum operations per transaction
 const APP_KEY_ACCESS = 24 * 60 * 60; // 24 hours
 const APP_USER_ACCESS = 24 * 60 * 60; // 24 hours
 const APP_PROJECT_ACCESS = 24 * 60 * 60; // 24 hours
@@ -54,7 +60,12 @@ const APP_DATABASE_TIMEOUT_MILLISECONDS_API = 15 * 1000; // 15 seconds
 const APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER = 300 * 1000; // 5 minutes
 const APP_DATABASE_TIMEOUT_MILLISECONDS_TASK = 300 * 1000; // 5 minutes
 const APP_DATABASE_QUERY_MAX_VALUES = 500;
+const APP_DATABASE_QUERY_MAX_VALUES_WORKER = 5000;
 const APP_DATABASE_ENCRYPT_SIZE_MIN = 150;
+const APP_DATABASE_TXN_TTL_MIN = 60; // 1 minute
+const APP_DATABASE_TXN_TTL_MAX = 3600; // 1 hour
+const APP_DATABASE_TXN_TTL_DEFAULT = 300; // 5 minutes
+const APP_DATABASE_TXN_MAX_OPERATIONS = 100; // Maximum operations per transaction
 const APP_STORAGE_UPLOADS = '/storage/uploads';
 const APP_STORAGE_SITES = '/storage/sites';
 const APP_STORAGE_FUNCTIONS = '/storage/functions';
@@ -76,15 +87,79 @@ const APP_SOCIAL_DISCORD_CHANNEL = '564160730845151244';
 const APP_SOCIAL_DEV = 'https://dev.to/appwrite';
 const APP_SOCIAL_STACKSHARE = 'https://stackshare.io/appwrite';
 const APP_SOCIAL_YOUTUBE = 'https://www.youtube.com/c/appwrite?sub_confirmation=1';
-const APP_HOSTNAME_INTERNAL = 'appwrite';
 const APP_COMPUTE_CPUS_DEFAULT = 0.5;
 const APP_COMPUTE_MEMORY_DEFAULT = 512;
 const APP_COMPUTE_SPECIFICATION_DEFAULT = Specification::S_1VCPU_512MB;
-const APP_PLATFORM_SERVER = 'server';
-const APP_PLATFORM_CLIENT = 'client';
-const APP_PLATFORM_CONSOLE = 'console';
+const APP_SDK_PLATFORM_SERVER = 'server';
+const APP_SDK_PLATFORM_CLIENT = 'client';
+const APP_SDK_PLATFORM_CONSOLE = 'console';
 const APP_VCS_GITHUB_USERNAME = 'Appwrite';
 const APP_VCS_GITHUB_EMAIL = 'team@appwrite.io';
+const APP_VCS_GITHUB_URL = 'https://github.com/TeamAppwrite';
+const APP_BRANDED_EMAIL_BASE_TEMPLATE = 'email-base-styled';
+
+/**
+ * JWT for Resource Tokens.
+ */
+const RESOURCE_TOKEN_ALGORITHM = 'HS256';
+const RESOURCE_TOKEN_MAX_AGE = 86400 * 365 * 10; /* 10 years */
+const RESOURCE_TOKEN_LEEWAY = 10; // 10 seconds
+
+/**
+ * Token Expiration times.
+ */
+const TOKEN_EXPIRATION_LOGIN_LONG = 31536000;      /* 1 year */
+const TOKEN_EXPIRATION_LOGIN_SHORT = 3600;         /* 1 hour */
+const TOKEN_EXPIRATION_RECOVERY = 3600;            /* 1 hour */
+const TOKEN_EXPIRATION_CONFIRM = 3600 * 1;         /* 1 hour */
+const TOKEN_EXPIRATION_OTP = 60 * 15;            /* 15 minutes */
+const TOKEN_EXPIRATION_GENERIC = 60 * 15;        /* 15 minutes */
+
+/**
+ * Token Lengths.
+ */
+const TOKEN_LENGTH_MAGIC_URL = 64;
+const TOKEN_LENGTH_VERIFICATION = 256;
+const TOKEN_LENGTH_RECOVERY = 256;
+const TOKEN_LENGTH_OAUTH2 = 64;
+const TOKEN_LENGTH_SESSION = 256;
+
+/**
+ * Token Types.
+ */
+const TOKEN_TYPE_LOGIN = 1; // Deprecated
+const TOKEN_TYPE_VERIFICATION = 2;
+const TOKEN_TYPE_RECOVERY = 3;
+const TOKEN_TYPE_INVITE = 4;
+const TOKEN_TYPE_MAGIC_URL = 5;
+const TOKEN_TYPE_PHONE = 6;
+const TOKEN_TYPE_OAUTH2 = 7;
+const TOKEN_TYPE_GENERIC = 8;
+const TOKEN_TYPE_EMAIL = 9; // OTP
+
+/**
+ * Session Providers.
+ */
+const SESSION_PROVIDER_EMAIL = 'email';
+const SESSION_PROVIDER_ANONYMOUS = 'anonymous';
+const SESSION_PROVIDER_MAGIC_URL = 'magic-url';
+const SESSION_PROVIDER_PHONE = 'phone';
+const SESSION_PROVIDER_OAUTH2 = 'oauth2';
+const SESSION_PROVIDER_TOKEN = 'token';
+const SESSION_PROVIDER_SERVER = 'server';
+
+/**
+ * Activity associated with user or the app.
+ */
+const ACTIVITY_TYPE_APP = 'app';
+const ACTIVITY_TYPE_USER = 'user';
+const ACTIVITY_TYPE_GUEST = 'guest';
+
+/**
+ * MFA
+ */
+const MFA_RECENT_DURATION = 1800; // 30 mins
+
 
 // Database Reconnect
 const DATABASE_RECONNECT_SLEEP = 2;
@@ -104,8 +179,11 @@ const BUILD_TYPE_RETRY = 'retry';
 
 // Deletion Types
 const DELETE_TYPE_DATABASES = 'databases';
+
 const DELETE_TYPE_DOCUMENT = 'document';
 const DELETE_TYPE_COLLECTIONS = 'collections';
+const DELETE_TYPE_TRANSACTION = 'transaction';
+const DELETE_TYPE_EXPIRED_TRANSACTIONS = 'expired_transactions';
 const DELETE_TYPE_PROJECTS = 'projects';
 const DELETE_TYPE_SITES = 'sites';
 const DELETE_TYPE_FUNCTIONS = 'functions';
@@ -128,8 +206,15 @@ const DELETE_TYPE_TOPIC = 'topic';
 const DELETE_TYPE_TARGET = 'target';
 const DELETE_TYPE_EXPIRED_TARGETS = 'invalid_targets';
 const DELETE_TYPE_SESSION_TARGETS = 'session_targets';
+const DELETE_TYPE_CSV_EXPORTS = 'csv_exports';
 const DELETE_TYPE_MAINTENANCE = 'maintenance';
 
+// Rule statuses
+const RULE_STATUS_CREATED = 'created'; // This is also the status when domain DNS verification fails.
+const RULE_STATUS_CERTIFICATE_GENERATING = 'verifying';
+const RULE_STATUS_CERTIFICATE_GENERATION_FAILED = 'unverified';
+const RULE_STATUS_VERIFIED = 'verified';
+
 // Message types
 const MESSAGE_SEND_TYPE_INTERNAL = 'internal';
 const MESSAGE_SEND_TYPE_EXTERNAL = 'external';
@@ -260,6 +345,9 @@ const METRIC_SITES_OUTBOUND = 'sites.outbound';
 const METRIC_SITES_ID_REQUESTS = 'sites.{siteInternalId}.requests';
 const METRIC_SITES_ID_INBOUND = 'sites.{siteInternalId}.inbound';
 const METRIC_SITES_ID_OUTBOUND = 'sites.{siteInternalId}.outbound';
+const METRIC_AVATARS_SCREENSHOTS_GENERATED = 'avatars.screenshotsGenerated';
+const METRIC_FUNCTIONS_RUNTIME = 'functions.runtimes.{runtime}';
+const METRIC_SITES_FRAMEWORK = 'sites.frameworks.{framework}';
 
 // Resource types
 const RESOURCE_TYPE_PROJECTS = 'projects';
@@ -283,3 +371,6 @@ const TOKENS_RESOURCE_TYPE_DATABASES = 'databases';
 const SCHEDULE_RESOURCE_TYPE_EXECUTION = 'execution';
 const SCHEDULE_RESOURCE_TYPE_FUNCTION = 'function';
 const SCHEDULE_RESOURCE_TYPE_MESSAGE = 'message';
+
+/** Preview cookie */
+const COOKIE_NAME_PREVIEW = 'a_jwt_console';

app/init/database/filters.php

@@ -4,7 +4,6 @@ use Appwrite\OpenSSL\OpenSSL;
 use Utopia\Database\Database;
 use Utopia\Database\Document;
 use Utopia\Database\Query;
-use Utopia\Database\Validator\Authorization;
 use Utopia\System\System;
 
 Database::addFilter(
@@ -70,11 +69,11 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        $attributes = $database->find('attributes', [
+        $attributes = $database->getAuthorization()->skip(fn () => $database->find('attributes', [
             Query::equal('collectionInternalId', [$document->getSequence()]),
             Query::equal('databaseInternalId', [$document->getAttribute('databaseInternalId')]),
             Query::limit($database->getLimitForAttributes()),
-        ]);
+        ]));
 
         foreach ($attributes as $attribute) {
             $attributeType = $attribute->getAttribute('type');
@@ -105,12 +104,12 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        return $database
+        return $database->getAuthorization()->skip(fn () => $database
             ->find('indexes', [
                 Query::equal('collectionInternalId', [$document->getSequence()]),
                 Query::equal('databaseInternalId', [$document->getAttribute('databaseInternalId')]),
                 Query::limit($database->getLimitForIndexes()),
-            ]);
+            ]));
     }
 );
 
@@ -120,11 +119,11 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        return $database
+        return $database->getAuthorization()->skip(fn () => $database
             ->find('platforms', [
                 Query::equal('projectInternalId', [$document->getSequence()]),
                 Query::limit(APP_LIMIT_SUBQUERY),
-            ]);
+            ]));
     }
 );
 
@@ -134,11 +133,11 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        return $database
+        return $database->getAuthorization()->skip(fn () => $database
             ->find('keys', [
                 Query::equal('projectInternalId', [$document->getSequence()]),
                 Query::limit(APP_LIMIT_SUBQUERY),
-            ]);
+            ]));
     }
 );
 
@@ -148,11 +147,11 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        return $database
+        return $database->getAuthorization()->skip(fn () => $database
             ->find('devKeys', [
                 Query::equal('projectInternalId', [$document->getSequence()]),
                 Query::limit(APP_LIMIT_SUBQUERY),
-            ]);
+            ]));
     }
 );
 
@@ -162,11 +161,11 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        return $database
+        return $database->getAuthorization()->skip(fn () => $database
             ->find('webhooks', [
                 Query::equal('projectInternalId', [$document->getSequence()]),
                 Query::limit(APP_LIMIT_SUBQUERY),
-            ]);
+            ]));
     }
 );
 
@@ -176,7 +175,7 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        return Authorization::skip(fn () => $database->find('sessions', [
+        return  $database->getAuthorization()->skip(fn () => $database->find('sessions', [
             Query::equal('userInternalId', [$document->getSequence()]),
             Query::limit(APP_LIMIT_SUBQUERY),
         ]));
@@ -189,7 +188,7 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        return Authorization::skip(fn () => $database
+        return  $database->getAuthorization()->skip(fn () => $database
             ->find('tokens', [
                 Query::equal('userInternalId', [$document->getSequence()]),
                 Query::limit(APP_LIMIT_SUBQUERY),
@@ -203,7 +202,7 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        return Authorization::skip(fn () => $database
+        return  $database->getAuthorization()->skip(fn () => $database
             ->find('challenges', [
                 Query::equal('userInternalId', [$document->getSequence()]),
                 Query::limit(APP_LIMIT_SUBQUERY),
@@ -217,7 +216,7 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        return Authorization::skip(fn () => $database
+        return $database->getAuthorization()->skip(fn () => $database
             ->find('authenticators', [
                 Query::equal('userInternalId', [$document->getSequence()]),
                 Query::limit(APP_LIMIT_SUBQUERY),
@@ -231,7 +230,7 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        return Authorization::skip(fn () => $database
+        return  $database->getAuthorization()->skip(fn () => $database
             ->find('memberships', [
                 Query::equal('userInternalId', [$document->getSequence()]),
                 Query::limit(APP_LIMIT_SUBQUERY),
@@ -251,14 +250,14 @@ Database::addFilter(
             default => ['function', 'site']
         };
 
-        return $database
+        return $database->getAuthorization()->skip(fn () => $database
             ->find('variables', [
                 Query::equal('resourceInternalId', [$document->getSequence()]),
                 Query::equal('resourceType', $resourceType),
                 Query::orderAsc('resourceType'),
                 Query::orderAsc(),
                 Query::limit(APP_LIMIT_SUBQUERY),
-            ]);
+            ]));
     }
 );
 
@@ -294,11 +293,11 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        return $database
+        return $database->getAuthorization()->skip(fn () => $database
             ->find('variables', [
                 Query::equal('resourceType', ['project']),
                 Query::limit(APP_LIMIT_SUBQUERY)
-            ]);
+            ]));
     }
 );
 
@@ -331,7 +330,7 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        return Authorization::skip(fn () => $database
+        return  $database->getAuthorization()->skip(fn () => $database
             ->find('targets', [
                 Query::equal('userInternalId', [$document->getSequence()]),
                 Query::limit(APP_LIMIT_SUBQUERY)
@@ -345,7 +344,7 @@ Database::addFilter(
         return;
     },
     function (mixed $value, Document $document, Database $database) {
-        $targetIds = Authorization::skip(fn () => \array_map(
+        $targetIds =  $database->getAuthorization()->skip(fn () => \array_map(
             fn ($document) => $document->getAttribute('targetInternalId'),
             $database->find('subscribers', [
                 Query::equal('topicInternalId', [$document->getSequence()]),

app/init/registers.php

@@ -39,6 +39,7 @@ if (!App::isProduction()) {
     PublicDomain::allow(['request-catcher-sms']);
     PublicDomain::allow(['request-catcher-webhook']);
 }
+
 $register->set('logger', function () {
     // Register error logger
     $providerName = System::getEnv('_APP_LOGGING_PROVIDER', '');
@@ -97,6 +98,51 @@ $register->set('logger', function () {
     return new Logger($adapter);
 });
 
+$register->set('realtimeLogger', function () {
+    // Register error logger for realtime, falls back to default logging config
+    $providerConfig = System::getEnv('_APP_LOGGING_CONFIG_REALTIME', '')
+        ?: System::getEnv('_APP_LOGGING_CONFIG', '');
+
+    if (empty($providerConfig)) {
+        return;
+    }
+
+    $loggingProvider = new DSN($providerConfig);
+    $providerName = $loggingProvider->getScheme();
+    $providerConfig = match ($providerName) {
+        'sentry' => ['key' => $loggingProvider->getPassword(), 'projectId' => $loggingProvider->getUser() ?? '', 'host' => 'https://' . $loggingProvider->getHost()],
+        'logowl' => ['ticket' => $loggingProvider->getUser() ?? '', 'host' => $loggingProvider->getHost()],
+        default => ['key' => $loggingProvider->getHost()],
+    };
+
+    if (empty($providerName) || empty($providerConfig)) {
+        return;
+    }
+
+    if (!Logger::hasProvider($providerName)) {
+        throw new Exception(Exception::GENERAL_SERVER_ERROR, "Logging provider not supported. Logging is disabled");
+    }
+
+    try {
+        $adapter = match ($providerName) {
+            'sentry' => new Sentry($providerConfig['projectId'], $providerConfig['key'], $providerConfig['host']),
+            'logowl' => new LogOwl($providerConfig['ticket'], $providerConfig['host']),
+            'raygun' => new Raygun($providerConfig['key']),
+            'appsignal' => new AppSignal($providerConfig['key']),
+            default => null
+        };
+    } catch (Throwable $th) {
+        $adapter = null;
+    }
+
+    if ($adapter === null) {
+        Console::error("Logging provider not supported. Logging is disabled");
+        return;
+    }
+
+    return new Logger($adapter);
+});
+
 $register->set('pools', function () {
     $group = new Group();
 
@@ -326,7 +372,7 @@ $register->set('smtp', function () {
     return $mail;
 });
 $register->set('geodb', function () {
-    return new Reader(__DIR__ . '/../assets/dbip/dbip-country-lite-2024-09.mmdb');
+    return new Reader(__DIR__ . '/../assets/dbip/dbip-country-lite-2025-12.mmdb');
 });
 $register->set('passwordsDictionary', function () {
     $content = \file_get_contents(__DIR__ . '/../assets/security/10k-common-passwords');

app/init/resources.php

@@ -2,8 +2,8 @@
 
 use Ahc\Jwt\JWT;
 use Ahc\Jwt\JWTException;
-use Appwrite\Auth\Auth;
 use Appwrite\Auth\Key;
+use Appwrite\Databases\TransactionState;
 use Appwrite\Event\Audit;
 use Appwrite\Event\Build;
 use Appwrite\Event\Certificate;
@@ -20,12 +20,22 @@ use Appwrite\Event\StatsUsage;
 use Appwrite\Event\Webhook;
 use Appwrite\Extend\Exception;
 use Appwrite\GraphQL\Schema;
+use Appwrite\Network\Cors;
 use Appwrite\Network\Platform;
 use Appwrite\Network\Validator\Origin;
+use Appwrite\Network\Validator\Redirect;
+use Appwrite\Utopia\Database\Documents\User;
 use Appwrite\Utopia\Request;
+use Appwrite\Utopia\Response;
 use Executor\Executor;
 use Utopia\Abuse\Adapters\TimeLimit\Redis as TimeLimitRedis;
 use Utopia\App;
+use Utopia\Auth\Hashes\Argon2;
+use Utopia\Auth\Hashes\Sha;
+use Utopia\Auth\Proofs\Code;
+use Utopia\Auth\Proofs\Password;
+use Utopia\Auth\Proofs\Token;
+use Utopia\Auth\Store;
 use Utopia\Cache\Adapter\Pool as CachePool;
 use Utopia\Cache\Adapter\Sharding;
 use Utopia\Cache\Cache;
@@ -35,7 +45,6 @@ use Utopia\Database\Adapter\Pool as DatabasePool;
 use Utopia\Database\Database;
 use Utopia\Database\DateTime as DatabaseDateTime;
 use Utopia\Database\Document;
-use Utopia\Database\Helpers\ID;
 use Utopia\Database\Query;
 use Utopia\Database\Validator\Authorization;
 use Utopia\DSN\DSN;
@@ -56,7 +65,7 @@ use Utopia\Storage\Storage;
 use Utopia\System\System;
 use Utopia\Telemetry\Adapter as Telemetry;
 use Utopia\Telemetry\Adapter\None as NoTelemetry;
-use Utopia\Validator\Hostname;
+use Utopia\Validator\URL;
 use Utopia\Validator\WhiteList;
 use Utopia\VCS\Adapter\Git\GitHub as VcsGitHub;
 
@@ -151,140 +160,260 @@ App::setResource('queueForMigrations', function (Publisher $publisher) {
 App::setResource('queueForStatsResources', function (Publisher $publisher) {
     return new StatsResources($publisher);
 }, ['publisher']);
-App::setResource('platforms', function (Request $request, Document $console, Document $project) {
-    $console->setAttribute('platforms', [ // Always allow current host
-        '$collection' => ID::custom('platforms'),
-        'name' => 'Current Host',
-        'type' => Platform::TYPE_WEB,
-        'hostname' => $request->getHostname(),
-    ], Document::SET_TYPE_APPEND);
 
-    $hostnames = explode(',', System::getEnv('_APP_CONSOLE_HOSTNAMES', ''));
-    $validator = new Hostname();
-    foreach ($hostnames as $hostname) {
-        $hostname = trim($hostname);
-        if (!$validator->isValid($hostname)) {
-            continue;
-        }
-        $console->setAttribute('platforms', [
-            '$collection' => ID::custom('platforms'),
-            'type' => Platform::TYPE_WEB,
-            'name' => $hostname,
-            'hostname' => $hostname,
-        ], Document::SET_TYPE_APPEND);
-    }
+/**
+ * Platform configuration
+ */
+App::setResource('platform', function () {
+    return Config::getParam('platform', []);
+}, []);
 
-    // Add `exp` and `appwrite-callback-{projectId}` schemes
+/**
+ * List of allowed request hostnames for the request.
+ */
+App::setResource('allowedHostnames', function (array $platform, Document $project, Document $rule, Document $devKey, Request $request) {
+    $allowed = [...($platform['hostnames'] ?? [])];
+
+    /* Add platform configured hostnames */
     if (!$project->isEmpty() && $project->getId() !== 'console') {
-        $project->setAttribute('platforms', [
-            '$collection' => ID::custom('platforms'),
-            'type' => Platform::TYPE_SCHEME,
-            'name' => 'Expo',
-            'key' => 'exp',
-        ], Document::SET_TYPE_APPEND);
-        $project->setAttribute('platforms', [
-            '$collection' => ID::custom('platforms'),
-            'type' => Platform::TYPE_SCHEME,
-            'name' => 'Appwrite Callback',
-            'key' => 'appwrite-callback-' . $project->getId(),
-        ], Document::SET_TYPE_APPEND);
+        $platforms = $project->getAttribute('platforms', []);
+        $hostnames = Platform::getHostnames($platforms);
+        $allowed = [...$allowed, ...$hostnames];
     }
 
-    return [
-        ...$console->getAttribute('platforms', []),
-        ...$project->getAttribute('platforms', []),
-    ];
-}, ['request', 'console', 'project']);
+    /* Add the request hostname if a dev key is found */
+    if (!$devKey->isEmpty()) {
+        $allowed[] = $request->getHostname();
+    }
 
-App::setResource('user', function ($mode, $project, $console, $request, $response, $dbForProject, $dbForPlatform) {
-    /** @var Appwrite\Utopia\Request $request */
-    /** @var Appwrite\Utopia\Response $response */
-    /** @var Utopia\Database\Document $project */
-    /** @var Utopia\Database\Database $dbForProject */
-    /** @var Utopia\Database\Database $dbForPlatform */
-    /** @var string $mode */
+    $originHostname = parse_url($request->getOrigin(), PHP_URL_HOST);
 
-    Authorization::setDefaultStatus(true);
+    /* Add request hostname for preflight requests */
+    if ($request->getMethod() === 'OPTIONS') {
+        $allowed[] = $originHostname;
+    }
 
-    Auth::setCookieName('a_session_' . $project->getId());
+    /* Allow the request origin if a dev key or rule is found */
+    if ((!$rule->isEmpty() || !$devKey->isEmpty()) && !empty($originHostname)) {
+        $allowed[] = $originHostname;
+    }
+
+    return array_unique($allowed);
+}, ['platform', 'project', 'rule', 'devKey', 'request']);
+
+/**
+ * List of allowed request schemes for the request.
+ */
+App::setResource('allowedSchemes', function (Document $project) {
+    $allowed = [];
+
+    if (!$project->isEmpty() && $project->getId() !== 'console') {
+        /* Add hardcoded schemes */
+        $allowed[] = 'exp';
+        $allowed[] = 'appwrite-callback-' . $project->getId();
+
+        /* Add platform configured schemes */
+        $platforms = $project->getAttribute('platforms', []);
+        $schemes = Platform::getSchemes($platforms);
+        $allowed = [...$allowed, ...$schemes];
+    }
+
+    return array_unique($allowed);
+}, ['project']);
+
+/**
+ * Rule associated with a request origin.
+ */
+App::setResource('rule', function (Request $request, Database $dbForPlatform, Document $project, Authorization $authorization) {
+    $domain = \parse_url($request->getOrigin(), PHP_URL_HOST);
+    if (empty($domain)) {
+        return new Document();
+    }
+
+    // TODO: (@Meldiron) Remove after 1.7.x migration
+    $isMd5 = System::getEnv('_APP_RULES_FORMAT') === 'md5';
+    $rule = $authorization->skip(function () use ($dbForPlatform, $domain, $isMd5) {
+        if ($isMd5) {
+            return $dbForPlatform->getDocument('rules', md5($domain));
+        }
+
+        return $dbForPlatform->findOne('rules', [
+            Query::equal('domain', [$domain]),
+        ]) ?? new Document();
+    });
+
+    if ($rule->getAttribute('projectInternalId') !== $project->getSequence()) {
+        return new Document();
+    }
+
+    return $rule;
+}, ['request', 'dbForPlatform', 'project', 'authorization']);
+
+/**
+ * CORS service
+ */
+App::setResource('cors', fn (array $allowedHostnames) => new Cors(
+    $allowedHostnames,
+    allowedMethods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
+    allowedHeaders: [
+        'Accept',
+        'Origin',
+        'Cookie',
+        'Set-Cookie',
+        // Content
+        'Content-Type',
+        'Content-Range',
+        // Appwrite
+        'X-Appwrite-Project',
+        'X-Appwrite-Key',
+        'X-Appwrite-Dev-Key',
+        'X-Appwrite-Locale',
+        'X-Appwrite-Mode',
+        'X-Appwrite-JWT',
+        'X-Appwrite-Response-Format',
+        'X-Appwrite-Timeout',
+        'X-Appwrite-ID',
+        'X-Appwrite-Timestamp',
+        'X-Appwrite-Session',
+        // SDK generator
+        'X-SDK-Version',
+        'X-SDK-Name',
+        'X-SDK-Language',
+        'X-SDK-Platform',
+        'X-SDK-GraphQL',
+        'X-SDK-Profile',
+        // Caching
+        'Range',
+        'Cache-Control',
+        'Expires',
+        'Pragma',
+        // Server to server
+        'X-Fallback-Cookies',
+        'X-Requested-With',
+        'X-Forwarded-For',
+        'X-Forwarded-User-Agent',
+    ],
+    allowCredentials: true,
+    exposedHeaders: [
+        'X-Appwrite-Session',
+        'X-Fallback-Cookies',
+    ],
+), ['allowedHostnames']);
+
+App::setResource('originValidator', function (Document $devKey, array $allowedHostnames, array $allowedSchemes) {
+    if (!$devKey->isEmpty()) {
+        return new URL();
+    }
+    return new Origin($allowedHostnames, $allowedSchemes);
+}, ['devKey', 'allowedHostnames', 'allowedSchemes']);
+
+App::setResource('redirectValidator', function (Document $devKey, array $allowedHostnames, array $allowedSchemes) {
+    if (!$devKey->isEmpty()) {
+        return new URL();
+    }
+    return new Redirect($allowedHostnames, $allowedSchemes);
+}, ['devKey', 'allowedHostnames', 'allowedSchemes']);
+
+App::setResource('user', function (string $mode, Document $project, Document $console, Request $request, Response $response, Database $dbForProject, Database $dbForPlatform, Store $store, Token $proofForToken, $authorization) {
+    /**
+     * Handles user authentication and session validation.
+     *
+     * This function follows a series of steps to determine the appropriate user session
+     * based on cookies, headers, and JWT tokens.
+     *
+     * Process:
+     * 1. Checks the cookie based on mode:
+     *    - If in admin mode, uses console project id for key.
+     *    - Otherwise, sets the key using the project ID
+     * 2. If no cookie is found, attempts to retrieve the fallback header `x-fallback-cookies`.
+     *    - If this method is used, returns the header: `X-Debug-Fallback: true`.
+     * 3. Fetches the user document from the appropriate database based on the mode.
+     * 4. If the user document is empty or the session key cannot be verified, sets an empty user document.
+     * 5. Regardless of the results from steps 1-4, attempts to fetch the JWT token.
+     * 6. If the JWT user has a valid session ID, updates the user variable with the user from `projectDB`,
+     *    overwriting the previous value.
+     */
+
+    $authorization->setDefaultStatus(true);
+
+    $store->setKey('a_session_' . $project->getId());
 
     if (APP_MODE_ADMIN === $mode) {
-        Auth::setCookieName('a_session_' . $console->getId());
+        $store->setKey('a_session_' . $console->getId());
     }
 
-    $session = Auth::decodeSession(
+    $store->decode(
         $request->getCookie(
-            Auth::$cookieName, // Get sessions
-            $request->getCookie(Auth::$cookieName . '_legacy', '')
+            $store->getKey(), // Get sessions
+            $request->getCookie($store->getKey() . '_legacy', '')
         )
     );
 
     // Get session from header for SSR clients
-    if (empty($session['id']) && empty($session['secret'])) {
+    if (empty($store->getProperty('id', '')) && empty($store->getProperty('secret', ''))) {
         $sessionHeader = $request->getHeader('x-appwrite-session', '');
 
         if (!empty($sessionHeader)) {
-            $session = Auth::decodeSession($sessionHeader);
+            $store->decode($sessionHeader);
         }
     }
 
     // Get fallback session from old clients (no SameSite support) or clients who block 3rd-party cookies
-    if ($response) {
+    if ($response) { // if in http context - add debug header
         $response->addHeader('X-Debug-Fallback', 'false');
     }
 
-    if (empty($session['id']) && empty($session['secret'])) {
+    if (empty($store->getProperty('id', '')) && empty($store->getProperty('secret', ''))) {
         if ($response) {
             $response->addHeader('X-Debug-Fallback', 'true');
         }
         $fallback = $request->getHeader('x-fallback-cookies', '');
         $fallback = \json_decode($fallback, true);
-        $session = Auth::decodeSession(((isset($fallback[Auth::$cookieName])) ? $fallback[Auth::$cookieName] : ''));
+        $store->decode(((is_array($fallback) && isset($fallback[$store->getKey()])) ? $fallback[$store->getKey()] : ''));
     }
 
-    Auth::$unique = $session['id'] ?? '';
-    Auth::$secret = $session['secret'] ?? '';
-
-    $user = new Document([]);
-
-    if (!empty(Auth::$unique)) {
-        if ($mode === APP_MODE_ADMIN) {
-            $user = $dbForPlatform->getDocument('users', Auth::$unique);
-        } elseif (!$project->isEmpty()) {
-            if ($project->getId() === 'console') {
-                $user = $dbForPlatform->getDocument('users', Auth::$unique);
-            } else {
-                $user = $dbForProject->getDocument('users', Auth::$unique);
+    $user = null;
+    if (APP_MODE_ADMIN === $mode) {
+        /** @var User $user */
+        $user = $dbForPlatform->getDocument('users', $store->getProperty('id', ''));
+    } else {
+        if ($project->isEmpty()) {
+            $user = new User([]);
+        } else {
+            if (!empty($store->getProperty('id', ''))) {
+                if ($project->getId() === 'console') {
+                    /** @var User $user */
+                    $user = $dbForPlatform->getDocument('users', $store->getProperty('id', ''));
+                } else {
+                    /** @var User $user */
+                    $user = $dbForProject->getDocument('users', $store->getProperty('id', ''));
+                }
             }
         }
     }
 
     if (
+        !$user ||
         $user->isEmpty() // Check a document has been found in the DB
-        || !Auth::sessionVerify($user->getAttribute('sessions', []), Auth::$secret)
+        || !$user->sessionVerify($store->getProperty('secret', ''), $proofForToken)
     ) { // Validate user has valid login token
-        $user = new Document([]);
+        $user = new User([]);
     }
-
     // if (APP_MODE_ADMIN === $mode) {
     //     if ($user->find('teamInternalId', $project->getAttribute('teamInternalId'), 'memberships')) {
-    //         Authorization::setDefaultStatus(false);  // Cancel security segmentation for admin users.
+    //         $authorization->setDefaultStatus(false);  // Cancel security segmentation for admin users.
     //     } else {
     //         $user = new Document([]);
     //     }
     // }
-
     $authJWT = $request->getHeader('x-appwrite-jwt', '');
-
     if (!empty($authJWT) && !$project->isEmpty()) { // JWT authentication
         $jwt = new JWT(System::getEnv('_APP_OPENSSL_KEY_V1'), 'HS256', 3600, 0);
-
         try {
             $payload = $jwt->decode($authJWT);
         } catch (JWTException $error) {
             throw new Exception(Exception::USER_JWT_INVALID, 'Failed to verify JWT. ' . $error->getMessage());
         }
-
         $jwtUserId = $payload['userId'] ?? '';
         if (!empty($jwtUserId)) {
             if ($mode === APP_MODE_ADMIN) {
@@ -293,22 +422,20 @@ App::setResource('user', function ($mode, $project, $console, $request, $respons
                 $user = $dbForProject->getDocument('users', $jwtUserId);
             }
         }
-
         $jwtSessionId = $payload['sessionId'] ?? '';
         if (!empty($jwtSessionId)) {
             if (empty($user->find('$id', $jwtSessionId, 'sessions'))) { // Match JWT to active token
-                $user = new Document([]);
+                $user = new User([]);
             }
         }
     }
-
     $dbForProject->setMetadata('user', $user->getId());
     $dbForPlatform->setMetadata('user', $user->getId());
 
     return $user;
-}, ['mode', 'project', 'console', 'request', 'response', 'dbForProject', 'dbForPlatform']);
+}, ['mode', 'project', 'console', 'request', 'response', 'dbForProject', 'dbForPlatform', 'store', 'proofForToken', 'authorization']);
 
-App::setResource('project', function ($dbForPlatform, $request, $console) {
+App::setResource('project', function ($dbForPlatform, $request, $console, $authorization) {
     /** @var Appwrite\Utopia\Request $request */
     /** @var Utopia\Database\Database $dbForPlatform */
     /** @var Utopia\Database\Document $console */
@@ -319,37 +446,71 @@ App::setResource('project', function ($dbForPlatform, $request, $console) {
         return $console;
     }
 
-    $project = Authorization::skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
+    $project = $authorization->skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
 
     return $project;
-}, ['dbForPlatform', 'request', 'console']);
+}, ['dbForPlatform', 'request', 'console', 'authorization']);
 
-App::setResource('session', function (Document $user) {
+App::setResource('session', function (User $user, Store $store, Token $proofForToken) {
     if ($user->isEmpty()) {
         return;
     }
 
     $sessions = $user->getAttribute('sessions', []);
-    $sessionId = Auth::sessionVerify($user->getAttribute('sessions'), Auth::$secret);
+    $sessionId = $user->sessionVerify($store->getProperty('secret', ''), $proofForToken);
 
     if (!$sessionId) {
         return;
     }
-
-    foreach ($sessions as $session) {/** @var Document $session */
+    foreach ($sessions as $session) {
+        /** @var Document $session */
         if ($sessionId === $session->getId()) {
             return $session;
         }
     }
 
     return;
-}, ['user']);
+}, ['user', 'store', 'proofForToken']);
+
+App::setResource('store', function (): Store {
+    return new Store();
+});
+
+App::setResource('proofForPassword', function (): Password {
+    $hash = new Argon2();
+    $hash
+        ->setMemoryCost(7168)
+        ->setTimeCost(5)
+        ->setThreads(1);
+
+    $password = new Password();
+    $password
+        ->setHash($hash);
+
+    return $password;
+});
+
+App::setResource('proofForToken', function (): Token {
+    $token = new Token();
+    $token->setHash(new Sha());
+    return $token;
+});
+
+App::setResource('proofForCode', function (): Code {
+    $code = new Code();
+    $code->setHash(new Sha());
+    return $code;
+});
 
 App::setResource('console', function () {
     return new Document(Config::getParam('console'));
 }, []);
 
-App::setResource('dbForProject', function (Group $pools, Database $dbForPlatform, Cache $cache, Document $project) {
+App::setResource('authorization', function () {
+    return new Authorization();
+}, []);
+
+App::setResource('dbForProject', function (Group $pools, Database $dbForPlatform, Cache $cache, Document $project, Authorization $authorization) {
     if ($project->isEmpty() || $project->getId() === 'console') {
         return $dbForPlatform;
     }
@@ -365,17 +526,19 @@ App::setResource('dbForProject', function (Group $pools, Database $dbForPlatform
     $database = new Database($adapter, $cache);
 
     $database
+        ->setAuthorization($authorization)
         ->setMetadata('host', \gethostname())
         ->setMetadata('project', $project->getId())
         ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_API)
         ->setMaxQueryValues(APP_DATABASE_QUERY_MAX_VALUES);
+    $database->setDocumentType('users', User::class);
 
     $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
 
     if (\in_array($dsn->getHost(), $sharedTables)) {
         $database
             ->setSharedTables(true)
-            ->setTenant((int)$project->getSequence())
+            ->setTenant((int) $project->getSequence())
             ->setNamespace($dsn->getParam('namespace'));
     } else {
         $database
@@ -385,26 +548,30 @@ App::setResource('dbForProject', function (Group $pools, Database $dbForPlatform
     }
 
     return $database;
-}, ['pools', 'dbForPlatform', 'cache', 'project']);
+}, ['pools', 'dbForPlatform', 'cache', 'project', 'authorization']);
+
+App::setResource('dbForPlatform', function (Group $pools, Cache $cache, Authorization $authorization) {
 
-App::setResource('dbForPlatform', function (Group $pools, Cache $cache) {
     $adapter = new DatabasePool($pools->get('console'));
     $database = new Database($adapter, $cache);
 
     $database
+        ->setAuthorization($authorization)
         ->setNamespace('_console')
         ->setMetadata('host', \gethostname())
         ->setMetadata('project', 'console')
         ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_API)
         ->setMaxQueryValues(APP_DATABASE_QUERY_MAX_VALUES);
 
-    return $database;
-}, ['pools', 'cache']);
+    $database->setDocumentType('users', User::class);
 
-App::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache) {
+    return $database;
+}, ['pools', 'cache', 'authorization']);
+
+App::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache, Authorization $authorization) {
     $databases = [];
 
-    return function (Document $project) use ($pools, $dbForPlatform, $cache, &$databases) {
+    return function (Document $project) use ($pools, $dbForPlatform, $cache, $authorization, &$databases) {
         if ($project->isEmpty() || $project->getId() === 'console') {
             return $dbForPlatform;
         }
@@ -416,19 +583,22 @@ App::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform
             $dsn = new DSN('mysql://' . $project->getAttribute('database'));
         }
 
-        $configure = (function (Database $database) use ($project, $dsn) {
+        $configure = (function (Database $database) use ($project, $dsn, $authorization) {
             $database
+                ->setAuthorization($authorization)
                 ->setMetadata('host', \gethostname())
                 ->setMetadata('project', $project->getId())
                 ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_API)
-                ->setMaxQueryValues(APP_DATABASE_QUERY_MAX_VALUES);
+                ->setMaxQueryValues(APP_DATABASE_QUERY_MAX_VALUES)
+                ->setDocumentType('users', User::class)
+            ;
 
             $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
 
             if (\in_array($dsn->getHost(), $sharedTables)) {
                 $database
                     ->setSharedTables(true)
-                    ->setTenant((int)$project->getSequence())
+                    ->setTenant((int) $project->getSequence())
                     ->setNamespace($dsn->getParam('namespace'));
             } else {
                 $database
@@ -451,14 +621,14 @@ App::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform
 
         return $database;
     };
-}, ['pools', 'dbForPlatform', 'cache']);
+}, ['pools', 'dbForPlatform', 'cache', 'authorization']);
 
-App::setResource('getLogsDB', function (Group $pools, Cache $cache) {
+App::setResource('getLogsDB', function (Group $pools, Cache $cache, Authorization $authorization) {
     $database = null;
 
-    return function (?Document $project = null) use ($pools, $cache, &$database) {
+    return function (?Document $project = null) use ($pools, $cache, $authorization, &$database) {
         if ($database !== null && $project !== null && !$project->isEmpty() && $project->getId() !== 'console') {
-            $database->setTenant((int)$project->getSequence());
+            $database->setTenant((int) $project->getSequence());
             return $database;
         }
 
@@ -466,6 +636,7 @@ App::setResource('getLogsDB', function (Group $pools, Cache $cache) {
         $database = new Database($adapter, $cache);
 
         $database
+            ->setAuthorization($authorization)
             ->setSharedTables(true)
             ->setNamespace('logsV1')
             ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_API)
@@ -473,12 +644,12 @@ App::setResource('getLogsDB', function (Group $pools, Cache $cache) {
 
         // set tenant
         if ($project !== null && !$project->isEmpty() && $project->getId() !== 'console') {
-            $database->setTenant((int)$project->getSequence());
+            $database->setTenant((int) $project->getSequence());
         }
 
         return $database;
     };
-}, ['pools', 'cache']);
+}, ['pools', 'cache', 'authorization']);
 
 App::setResource('telemetry', fn () => new NoTelemetry());
 
@@ -501,7 +672,7 @@ App::setResource('redis', function () {
     $pass = System::getEnv('_APP_REDIS_PASS', '');
 
     $redis = new \Redis();
-    @$redis->pconnect($host, (int)$port);
+    @$redis->pconnect($host, (int) $port);
     if ($pass) {
         $redis->auth($pass);
     }
@@ -525,7 +696,7 @@ App::setResource('deviceForFiles', function ($project, Telemetry $telemetry) {
 App::setResource('deviceForSites', function ($project, Telemetry $telemetry) {
     return new Device\Telemetry($telemetry, getDevice(APP_STORAGE_SITES . '/app-' . $project->getId()));
 }, ['project', 'telemetry']);
-App::setResource('deviceForImports', function ($project, Telemetry $telemetry) {
+App::setResource('deviceForMigrations', function ($project, Telemetry $telemetry) {
     return new Device\Telemetry($telemetry, getDevice(APP_STORAGE_IMPORTS . '/app-' . $project->getId()));
 }, ['project', 'telemetry']);
 App::setResource('deviceForFunctions', function ($project, Telemetry $telemetry) {
@@ -658,8 +829,8 @@ App::setResource('passwordsDictionary', function ($register) {
 
 
 App::setResource('servers', function () {
-    $platforms = Config::getParam('platforms');
-    $server = $platforms[APP_PLATFORM_SERVER];
+    $platforms = Config::getParam('sdks');
+    $server = $platforms[APP_SDK_PLATFORM_SERVER];
 
     $languages = array_map(function ($language) {
         return strtolower($language['name']);
@@ -672,7 +843,7 @@ App::setResource('promiseAdapter', function ($register) {
     return $register->get('promiseAdapter');
 }, ['register']);
 
-App::setResource('schema', function ($utopia, $dbForProject) {
+App::setResource('schema', function ($utopia, $dbForProject, $authorization) {
 
     $complexity = function (int $complexity, array $args) {
         $queries = Query::parseQueries($args['queries'] ?? []);
@@ -682,8 +853,8 @@ App::setResource('schema', function ($utopia, $dbForProject) {
         return $complexity * $limit;
     };
 
-    $attributes = function (int $limit, int $offset) use ($dbForProject) {
-        $attrs = Authorization::skip(fn () => $dbForProject->find('attributes', [
+    $attributes = function (int $limit, int $offset) use ($dbForProject, $authorization) {
+        $attrs = $authorization->skip(fn () => $dbForProject->find('attributes', [
             Query::limit($limit),
             Query::offset($offset),
         ]));
@@ -714,7 +885,7 @@ App::setResource('schema', function ($utopia, $dbForProject) {
     // NOTE: `params` and `urls` are not used internally in the `Schema::build` function below!
     $params = [
         'list' => function (string $databaseId, string $collectionId, array $args) {
-            return [ 'queries' => $args['queries']];
+            return ['queries' => $args['queries']];
         },
         'create' => function (string $databaseId, string $collectionId, array $args) {
             $id = $args['id'] ?? 'unique()';
@@ -757,25 +928,7 @@ App::setResource('schema', function ($utopia, $dbForProject) {
         $urls,
         $params,
     );
-}, ['utopia', 'dbForProject']);
-
-App::setResource('contributors', function () {
-    $path = 'app/config/contributors.json';
-    $list = (file_exists($path)) ? json_decode(file_get_contents($path), true) : [];
-    return $list;
-});
-
-App::setResource('employees', function () {
-    $path = 'app/config/employees.json';
-    $list = (file_exists($path)) ? json_decode(file_get_contents($path), true) : [];
-    return $list;
-});
-
-App::setResource('heroes', function () {
-    $path = 'app/config/heroes.json';
-    $list = (file_exists($path)) ? json_decode(file_get_contents($path), true) : [];
-    return $list;
-});
+}, ['utopia', 'dbForProject', 'authorization']);
 
 App::setResource('gitHub', function (Cache $cache) {
     return new VcsGitHub($cache);
@@ -803,7 +956,7 @@ App::setResource('smsRates', function () {
     return [];
 });
 
-App::setResource('devKey', function (Request $request, Document $project, array $servers, Database $dbForPlatform) {
+App::setResource('devKey', function (Request $request, Document $project, array $servers, Database $dbForPlatform, Authorization $authorization) {
     $devKey = $request->getHeader('x-appwrite-dev-key', $request->getParam('devKey', ''));
 
     // Check if given key match project's development keys
@@ -822,7 +975,7 @@ App::setResource('devKey', function (Request $request, Document $project, array
     $accessedAt = $key->getAttribute('accessedAt', 0);
     if (empty($accessedAt) || DatabaseDateTime::formatTz(DatabaseDateTime::addSeconds(new \DateTime(), -APP_KEY_ACCESS)) > $accessedAt) {
         $key->setAttribute('accessedAt', DatabaseDateTime::now());
-        Authorization::skip(fn () => $dbForPlatform->updateDocument('devKeys', $key->getId(), $key));
+        $authorization->skip(fn () => $dbForPlatform->updateDocument('devKeys', $key->getId(), $key));
         $dbForPlatform->purgeCachedDocument('projects', $project->getId());
     }
 
@@ -839,14 +992,15 @@ App::setResource('devKey', function (Request $request, Document $project, array
 
             /** Update access time as well */
             $key->setAttribute('accessedAt', DatabaseDateTime::now());
-            $key = Authorization::skip(fn () => $dbForPlatform->updateDocument('devKeys', $key->getId(), $key));
+            $key = $authorization->skip(fn () => $dbForPlatform->updateDocument('devKeys', $key->getId(), $key));
             $dbForPlatform->purgeCachedDocument('projects', $project->getId());
         }
     }
-    return $key;
-}, ['request', 'project', 'servers', 'dbForPlatform']);
 
-App::setResource('team', function (Document $project, Database $dbForPlatform, App $utopia, Request $request) {
+    return $key;
+}, ['request', 'project', 'servers', 'dbForPlatform', 'authorization']);
+
+App::setResource('team', function (Document $project, Database $dbForPlatform, App $utopia, Request $request, Authorization $authorization) {
     $teamInternalId = '';
     if ($project->getId() !== 'console') {
         $teamInternalId = $project->getAttribute('teamInternalId', '');
@@ -856,7 +1010,7 @@ App::setResource('team', function (Document $project, Database $dbForPlatform, A
         if (str_starts_with($path, '/v1/projects/:projectId')) {
             $uri = $request->getURI();
             $pid = explode('/', $uri)[3];
-            $p = Authorization::skip(fn () => $dbForPlatform->getDocument('projects', $pid));
+            $p = $authorization->skip(fn () => $dbForPlatform->getDocument('projects', $pid));
             $teamInternalId = $p->getAttribute('teamInternalId', '');
         } elseif ($path === '/v1/projects') {
             $teamId = $request->getParam('teamId', '');
@@ -865,7 +1019,7 @@ App::setResource('team', function (Document $project, Database $dbForPlatform, A
                 return new Document([]);
             }
 
-            $team = Authorization::skip(fn () => $dbForPlatform->getDocument('teams', $teamId));
+            $team = $authorization->skip(fn () => $dbForPlatform->getDocument('teams', $teamId));
             return $team;
         }
     }
@@ -874,14 +1028,14 @@ App::setResource('team', function (Document $project, Database $dbForPlatform, A
         return new Document([]);
     }
 
-    $team = Authorization::skip(function () use ($dbForPlatform, $teamInternalId) {
+    $team = $authorization->skip(function () use ($dbForPlatform, $teamInternalId) {
         return $dbForPlatform->findOne('teams', [
             Query::equal('$sequence', [$teamInternalId]),
         ]);
     });
 
     return $team;
-}, ['project', 'dbForPlatform', 'utopia', 'request']);
+}, ['project', 'dbForPlatform', 'utopia', 'request', 'authorization']);
 
 App::setResource(
     'isResourceBlocked',
@@ -919,11 +1073,12 @@ App::setResource('apiKey', function (Request $request, Document $project): ?Key
 
 App::setResource('executor', fn () => new Executor());
 
-App::setResource('resourceToken', function ($project, $dbForProject, $request) {
+App::setResource('resourceToken', function ($project, $dbForProject, $request, Authorization $authorization) {
     $tokenJWT = $request->getParam('token');
 
     if (!empty($tokenJWT) && !$project->isEmpty()) { // JWT authentication
-        $jwt = new JWT(System::getEnv('_APP_OPENSSL_KEY_V1'), 'HS256', 900, 10); // Instantiate with key, algo, maxAge and leeway.
+        // Use a large but reasonable maxAge to avoid auto-exp when token has no expiry
+        $jwt = new JWT(System::getEnv('_APP_OPENSSL_KEY_V1'), RESOURCE_TOKEN_ALGORITHM, RESOURCE_TOKEN_MAX_AGE, RESOURCE_TOKEN_LEEWAY); // Instantiate with key, algo, maxAge and leeway.
 
         try {
             $payload = $jwt->decode($tokenJWT);
@@ -936,7 +1091,7 @@ App::setResource('resourceToken', function ($project, $dbForProject, $request) {
             return new Document([]);
         }
 
-        $token = Authorization::skip(fn () => $dbForProject->getDocument('resourceTokens', $tokenId));
+        $token = $authorization->skip(fn () => $dbForProject->getDocument('resourceTokens', $tokenId));
 
         if ($token->isEmpty()) {
             return new Document([]);
@@ -954,7 +1109,7 @@ App::setResource('resourceToken', function ($project, $dbForProject, $request) {
         }
 
         return match ($token->getAttribute('resourceType')) {
-            TOKENS_RESOURCE_TYPE_FILES => (function () use ($token, $dbForProject) {
+            TOKENS_RESOURCE_TYPE_FILES => (function () use ($token, $dbForProject, $authorization) {
                 $sequences = explode(':', $token->getAttribute('resourceInternalId'));
                 $ids = explode(':', $token->getAttribute('resourceId'));
 
@@ -963,9 +1118,9 @@ App::setResource('resourceToken', function ($project, $dbForProject, $request) {
                 }
 
                 $accessedAt = $token->getAttribute('accessedAt', 0);
-                if (empty($accessedAt) || DatabaseDateTime::formatTz(DatabaseDateTime::addSeconds(new \DateTime(), - APP_RESOURCE_TOKEN_ACCESS)) > $accessedAt) {
+                if (empty($accessedAt) || DatabaseDateTime::formatTz(DatabaseDateTime::addSeconds(new \DateTime(), -APP_RESOURCE_TOKEN_ACCESS)) > $accessedAt) {
                     $token->setAttribute('accessedAt', DatabaseDateTime::now());
-                    Authorization::skip(fn () => $dbForProject->updateDocument('resourceTokens', $token->getId(), $token));
+                    $authorization->skip(fn () => $dbForProject->updateDocument('resourceTokens', $token->getId(), $token));
                 }
 
                 return new Document([
@@ -980,53 +1135,8 @@ App::setResource('resourceToken', function ($project, $dbForProject, $request) {
         };
     }
     return new Document([]);
-}, ['project', 'dbForProject', 'request']);
+}, ['project', 'dbForProject', 'request', 'authorization']);
 
-App::setResource('httpReferrer', function (Request $request): string {
-    $referrer = $request->getReferer();
-    return $referrer;
-}, ['request']);
-
-App::setResource('httpReferrerSafe', function (Request $request, string $httpReferrer, array $platforms, Database $dbForPlatform, Document $project, App $utopia): string {
-    $origin = \parse_url($request->getOrigin($httpReferrer), PHP_URL_HOST);
-    $protocol = \parse_url($request->getOrigin($httpReferrer), PHP_URL_SCHEME);
-    $port = \parse_url($request->getOrigin($httpReferrer), PHP_URL_PORT);
-    $referrer = (!empty($protocol) ? $protocol : $request->getProtocol()) . '://' . $origin . (!empty($port) ? ':' . $port : '');
-
-    // Safe if route is publicly accessible
-    $route = $utopia->getRoute();
-    if ($route->getLabel('origin', false)) {
-        return $referrer;
-    }
-
-    // Safe if added as web platform
-    $originValidator = new Origin($platforms);
-    if ($originValidator->isValid($request->getOrigin($httpReferrer))) {
-        return $referrer;
-    }
-
-    // Safe if rule with same project ID exists
-    if (!empty($origin)) {
-        if (System::getEnv('_APP_RULES_FORMAT') === 'md5') {
-            $rule = Authorization::skip(fn () => $dbForPlatform->getDocument('rules', md5($origin ?? '')));
-        } else {
-            $rule = Authorization::skip(
-                fn () => $dbForPlatform->find('rules', [
-                    Query::equal('domain', [$origin]),
-                    Query::limit(1)
-                ])
-            )[0] ?? new Document();
-        }
-
-        if (!$rule->isEmpty() && $rule->getAttribute('projectInternalId') === $project->getSequence()) {
-            return $referrer;
-        }
-    }
-
-    // Unsafe; Localhost is always safe for ease of local development
-    $origin = 'localhost';
-    $protocol = \parse_url($request->getOrigin($httpReferrer), PHP_URL_SCHEME);
-    $port = \parse_url($request->getOrigin($httpReferrer), PHP_URL_PORT);
-    $referrer = (!empty($protocol) ? $protocol : $request->getProtocol()) . '://' . $origin . (!empty($port) ? ':' . $port : '');
-    return $referrer;
-}, ['request', 'httpReferrer', 'platforms', 'dbForPlatform', 'project', 'utopia']);
+App::setResource('transactionState', function (Database $dbForProject, Authorization $authorization) {
+    return new TransactionState($dbForProject, $authorization);
+}, ['dbForProject', 'authorization']);

app/realtime.php

@@ -1,13 +1,14 @@
 <?php
 
-use Appwrite\Auth\Auth;
 use Appwrite\Extend\Exception;
 use Appwrite\Extend\Exception as AppwriteException;
 use Appwrite\Messaging\Adapter\Realtime;
 use Appwrite\Network\Validator\Origin;
 use Appwrite\PubSub\Adapter\Pool as PubSubPool;
+use Appwrite\Utopia\Database\Documents\User;
 use Appwrite\Utopia\Request;
 use Appwrite\Utopia\Response;
+use Swoole\Coroutine;
 use Swoole\Http\Request as SwooleRequest;
 use Swoole\Http\Response as SwooleResponse;
 use Swoole\Runtime;
@@ -16,6 +17,9 @@ use Swoole\Timer;
 use Utopia\Abuse\Abuse;
 use Utopia\Abuse\Adapters\TimeLimit\Redis as TimeLimitRedis;
 use Utopia\App;
+use Utopia\Auth\Hashes\Sha;
+use Utopia\Auth\Proofs\Token;
+use Utopia\Auth\Store;
 use Utopia\Cache\Adapter\Pool as CachePool;
 use Utopia\Cache\Adapter\Sharding;
 use Utopia\Cache\Cache;
@@ -28,7 +32,6 @@ use Utopia\Database\Document;
 use Utopia\Database\Helpers\ID;
 use Utopia\Database\Helpers\Role;
 use Utopia\Database\Query;
-use Utopia\Database\Validator\Authorization;
 use Utopia\DSN\DSN;
 use Utopia\Logger\Log;
 use Utopia\Pools\Group;
@@ -49,14 +52,14 @@ Runtime::enableCoroutine(SWOOLE_HOOK_ALL);
 if (!function_exists('getConsoleDB')) {
     function getConsoleDB(): Database
     {
-        global $register;
+        $ctx = Coroutine::getContext();
 
-        static $database = null;
-
-        if ($database !== null) {
-            return $database;
+        if (isset($ctx['dbForPlatform'])) {
+            return $ctx['dbForPlatform'];
         }
 
+        global $register;
+
         /** @var Group $pools */
         $pools = $register->get('pools');
 
@@ -66,8 +69,8 @@ if (!function_exists('getConsoleDB')) {
             ->setNamespace('_console')
             ->setMetadata('host', \gethostname())
             ->setMetadata('project', '_console');
-
-        return $database;
+        $database->setDocumentType('users', User::class);
+        return $ctx['dbForPlatform'] = $database;
     }
 }
 
@@ -75,14 +78,18 @@ if (!function_exists('getConsoleDB')) {
 if (!function_exists('getProjectDB')) {
     function getProjectDB(Document $project): Database
     {
-        global $register;
+        $ctx = Coroutine::getContext();
 
-        static $databases = [];
-
-        if (isset($databases[$project->getSequence()])) {
-            return $databases[$project->getSequence()];
+        if (!isset($ctx['dbForProject'])) {
+            $ctx['dbForProject'] = [];
         }
 
+        if (isset($ctx['dbForProject'][$project->getSequence()])) {
+            return $ctx['dbForProject'][$project->getSequence()];
+        }
+
+        global $register;
+
         /** @var Group $pools */
         $pools = $register->get('pools');
 
@@ -118,7 +125,9 @@ if (!function_exists('getProjectDB')) {
             ->setMetadata('host', \gethostname())
             ->setMetadata('project', $project->getId());
 
-        return $databases[$project->getSequence()] = $database;
+        $database->setDocumentType('users', User::class);
+
+        return $ctx['dbForProject'][$project->getSequence()] = $database;
     }
 }
 
@@ -126,14 +135,14 @@ if (!function_exists('getProjectDB')) {
 if (!function_exists('getCache')) {
     function getCache(): Cache
     {
-        global $register;
+        $ctx = Coroutine::getContext();
 
-        static $cache = null;
-
-        if ($cache !== null) {
-            return $cache;
+        if (isset($ctx['cache'])) {
+            return $ctx['cache'];
         }
 
+        global $register;
+
         $pools = $register->get('pools'); /** @var Group $pools */
 
         $list = Config::getParam('pools-cache', []);
@@ -143,7 +152,7 @@ if (!function_exists('getCache')) {
             $adapters[] = new CachePool($pools->get($value));
         }
 
-        return $cache = new Cache(new Sharding($adapters));
+        return $ctx['cache'] = new Cache(new Sharding($adapters));
     }
 }
 
@@ -151,10 +160,10 @@ if (!function_exists('getCache')) {
 if (!function_exists('getRedis')) {
     function getRedis(): \Redis
     {
-        static $redis = null;
+        $ctx = Coroutine::getContext();
 
-        if ($redis !== null) {
-            return $redis;
+        if (isset($ctx['redis'])) {
+            return $ctx['redis'];
         }
 
         $host = System::getEnv('_APP_REDIS_HOST', 'localhost');
@@ -168,46 +177,46 @@ if (!function_exists('getRedis')) {
         }
         $redis->setOption(\Redis::OPT_READ_TIMEOUT, -1);
 
-        return $redis;
+        return $ctx['redis'] = $redis;
     }
 }
 
 if (!function_exists('getTimelimit')) {
-    function getTimelimit(): TimeLimitRedis
+    function getTimelimit(string $key = "", int $limit = 0, int $seconds = 1): TimeLimitRedis
     {
-        static $timelimit = null;
+        $ctx = Coroutine::getContext();
 
-        if ($timelimit !== null) {
-            return $timelimit;
+        if (isset($ctx['timelimit'])) {
+            return $ctx['timelimit'];
         }
 
-        return $timelimit = new TimeLimitRedis("", 0, 1, getRedis());
+        return $ctx['timelimit'] = new TimeLimitRedis($key, $limit, $seconds, getRedis());
     }
 }
 
 if (!function_exists('getRealtime')) {
     function getRealtime(): Realtime
     {
-        static $realtime = null;
+        $ctx = Coroutine::getContext();
 
-        if ($realtime !== null) {
-            return $realtime;
+        if (isset($ctx['realtime'])) {
+            return $ctx['realtime'];
         }
 
-        return $realtime = new Realtime();
+        return $ctx['realtime'] = new Realtime();
     }
 }
 
 if (!function_exists('getTelemetry')) {
     function getTelemetry(int $workerId): Utopia\Telemetry\Adapter
     {
-        static $telemetry = null;
+        $ctx = Coroutine::getContext();
 
-        if ($telemetry !== null) {
-            return $telemetry;
+        if (isset($ctx['telemetry'])) {
+            return $ctx['telemetry'];
         }
 
-        return $telemetry = new NoTelemetry();
+        return $ctx['telemetry'] = new NoTelemetry();
     }
 }
 
@@ -236,7 +245,7 @@ $adapter
 $server = new Server($adapter);
 
 $logError = function (Throwable $error, string $action) use ($register) {
-    $logger = $register->get('logger');
+    $logger = $register->get('realtimeLogger');
 
     if ($logger && !$error instanceof Exception) {
         $version = System::getEnv('_APP_VERSION', 'UNKNOWN');
@@ -299,7 +308,7 @@ $server->onStart(function () use ($stats, $register, $containerId, &$statsDocume
                     'value' => '{}'
                 ]);
 
-                $statsDocument = Authorization::skip(fn () => $database->createDocument('realtime', $document));
+                $statsDocument = $database->getAuthorization()->skip(fn () => $database->createDocument('realtime', $document));
                 break;
             } catch (Throwable) {
                 Console::warning("Collection not ready. Retrying connection ({$attempts})...");
@@ -329,7 +338,7 @@ $server->onStart(function () use ($stats, $register, $containerId, &$statsDocume
                     ->setAttribute('timestamp', DateTime::now())
                     ->setAttribute('value', json_encode($payload));
 
-                Authorization::skip(fn () => $database->updateDocument('realtime', $statsDocument->getId(), $statsDocument));
+                $database->getAuthorization()->skip(fn () => $database->updateDocument('realtime', $statsDocument->getId(), $statsDocument));
             } catch (Throwable $th) {
                 $logError($th, "updateWorkerDocument");
             }
@@ -360,7 +369,7 @@ $server->onWorkerStart(function (int $workerId) use ($server, $register, $stats,
 
                 $payload = [];
 
-                $list = Authorization::skip(fn () => $database->find('realtime', [
+                $list = $database->getAuthorization()->skip(fn () => $database->find('realtime', [
                     Query::greaterThan('timestamp', DateTime::addSeconds(new \DateTime(), -15)),
                 ]));
 
@@ -454,12 +463,13 @@ $server->onWorkerStart(function (int $workerId) use ($server, $register, $stats,
                     if ($realtime->hasSubscriber($projectId, 'user:' . $userId)) {
                         $connection = array_key_first(reset($realtime->subscriptions[$projectId]['user:' . $userId]));
                         $consoleDatabase = getConsoleDB();
-                        $project = Authorization::skip(fn () => $consoleDatabase->getDocument('projects', $projectId));
+                        $project = $consoleDatabase->getAuthorization()->skip(fn () => $consoleDatabase->getDocument('projects', $projectId));
                         $database = getProjectDB($project);
 
+                        /** @var Appwrite\Utopia\Database\Documents\User $user */
                         $user = $database->getDocument('users', $userId);
 
-                        $roles = Auth::getRoles($user);
+                        $roles = $user->getRoles($database->getAuthorization());
                         $channels = $realtime->connections[$connection]['channels'];
 
                         $realtime->unsubscribe($connection);
@@ -515,6 +525,7 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
     try {
         /** @var Document $project */
         $project = $app->getResource('project');
+        $authorization = $app->getResource('authorization');
 
         /*
          *  Project Check
@@ -526,14 +537,13 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
         if (
             array_key_exists('realtime', $project->getAttribute('apis', []))
             && !$project->getAttribute('apis', [])['realtime']
-            && !(Auth::isPrivilegedUser(Authorization::getRoles()) || Auth::isAppUser(Authorization::getRoles()))
+            && !(User::isPrivileged($authorization->getRoles()) || User::isApp($authorization->getRoles()))
         ) {
             throw new AppwriteException(AppwriteException::GENERAL_API_DISABLED);
         }
 
         $timelimit = $app->getResource('timelimit');
-        $platforms = $app->getResource('platforms');
-        $user = $app->getResource('user'); /** @var Document $user */
+        $user = $app->getResource('user'); /** @var User $user */
 
         /*
          * Abuse Check
@@ -557,13 +567,13 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
          * Skip this check for non-web platforms which are not required to send an origin header.
          */
         $origin = $request->getOrigin();
-        $originValidator = new Origin($platforms);
+        $originValidator = $app->getResource('originValidator');
 
         if (!empty($origin) && !$originValidator->isValid($origin) && $project->getId() !== 'console') {
             throw new Exception(Exception::REALTIME_POLICY_VIOLATION, $originValidator->getDescription());
         }
 
-        $roles = Auth::getRoles($user);
+        $roles = $user->getRoles($authorization);
 
         $channels = Realtime::convertChannels($request->getQuery('channels', []), $user->getId());
 
@@ -576,6 +586,8 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
 
         $realtime->subscribe($project->getId(), $connection, $roles, $channels);
 
+        $realtime->connections[$connection]['authorization'] = $authorization;
+
         $user = empty($user->getId()) ? null : $response->output($user, Response::MODEL_ACCOUNT);
 
         $server->send([$connection], json_encode([
@@ -604,11 +616,19 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
             $code = 500;
         }
 
+
+        $message = $th->getMessage();
+
+        // sanitize 0 && 5xx errors
+        if (($code === 0 || $code >= 500) && !App::isDevelopment()) {
+            $message = 'Error: Server Error';
+        }
+
         $response = [
             'type' => 'error',
             'data' => [
                 'code' => $code,
-                'message' => $th->getMessage()
+                'message' => $message
             ]
         ];
 
@@ -626,12 +646,19 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
 $server->onMessage(function (int $connection, string $message) use ($server, $register, $realtime, $containerId) {
     try {
         $response = new Response(new SwooleResponse());
-        $projectId = $realtime->connections[$connection]['projectId'];
+        $projectId = $realtime->connections[$connection]['projectId'] ?? null;
+
+        // Get authorization from connection (stored during onOpen)
+        $authorization = $realtime->connections[$connection]['authorization'] ?? null;
+
         $database = getConsoleDB();
+        $database->setAuthorization($authorization);
 
         if ($projectId !== 'console') {
-            $project = Authorization::skip(fn () => $database->getDocument('projects', $projectId));
+            $project = $authorization->skip(fn () => $database->getDocument('projects', $projectId));
+
             $database = getProjectDB($project);
+            $database->setAuthorization($authorization);
         } else {
             $project = null;
         }
@@ -671,24 +698,43 @@ $server->onMessage(function (int $connection, string $message) use ($server, $re
                     throw new Exception(Exception::REALTIME_MESSAGE_FORMAT_INVALID, 'Payload is not valid.');
                 }
 
-                $session = Auth::decodeSession($message['data']['session']);
-                Auth::$unique = $session['id'] ?? '';
-                Auth::$secret = $session['secret'] ?? '';
+                $store = new Store();
 
-                $user = $database->getDocument('users', Auth::$unique);
+                $store->decode($message['data']['session']);
+
+                /** @var User $user */
+                $user = $database->getDocument('users', $store->getProperty('id', ''));
+
+                /**
+                 * TODO:
+                 * Moving forward, we should try to use our dependency injection container
+                 * to inject the proof for token.
+                 * This way we will have one source of truth for the proof for token.
+                 */
+                $proofForToken = new Token();
+                $proofForToken->setHash(new Sha());
 
                 if (
                     empty($user->getId()) // Check a document has been found in the DB
-                    || !Auth::sessionVerify($user->getAttribute('sessions', []), Auth::$secret) // Validate user has valid login token
+                    || !$user->sessionVerify($store->getProperty('secret', ''), $proofForToken) // Validate user has valid login token
                 ) {
                     // cookie not valid
                     throw new Exception(Exception::REALTIME_MESSAGE_FORMAT_INVALID, 'Session is not valid.');
                 }
 
-                $roles = Auth::getRoles($user);
+                $roles = $user->getRoles($database->getAuthorization());
                 $channels = Realtime::convertChannels(array_flip($realtime->connections[$connection]['channels']), $user->getId());
+
+                // Preserve authorization before subscribe overwrites the connection array
+                $authorization = $realtime->connections[$connection]['authorization'] ?? null;
+
                 $realtime->subscribe($realtime->connections[$connection]['projectId'], $connection, $roles, $channels);
 
+                // Restore authorization after subscribe
+                if ($authorization !== null) {
+                    $realtime->connections[$connection]['authorization'] = $authorization;
+                }
+
                 $user = $response->output($user, Response::MODEL_ACCOUNT);
                 $server->send([$connection], json_encode([
                     'type' => 'response',
@@ -705,11 +751,23 @@ $server->onMessage(function (int $connection, string $message) use ($server, $re
                 throw new Exception(Exception::REALTIME_MESSAGE_FORMAT_INVALID, 'Message type is not valid.');
         }
     } catch (Throwable $th) {
+        $code = $th->getCode();
+        if (!is_int($code)) {
+            $code = 500;
+        }
+
+        $message = $th->getMessage();
+
+        // sanitize 0 && 5xx errors
+        if (($code === 0 || $code >= 500) && !App::isDevelopment()) {
+            $message = 'Error: Server Error';
+        }
+
         $response = [
             'type' => 'error',
             'data' => [
-                'code' => $th->getCode(),
-                'message' => $th->getMessage()
+                'code' => $code,
+                'message' => $message
             ]
         ];
 

app/views/general/error.phtml

@@ -1,4 +1,5 @@
 <?php
+use Utopia\Config\Config;
 use Utopia\System\System;
 
 $development = $this->getParam('development', false);
@@ -15,7 +16,8 @@ $labelClass = '';
 $buttons = [];
 
 $protocol = System::getEnv('_APP_OPTIONS_FORCE_HTTPS') == 'disabled' ? 'http' : 'https';
-$hostname = System::getEnv('_APP_CONSOLE_DOMAIN', System::getEnv('_APP_DOMAIN', ''));
+$platform = Config::getParam('platform', []);
+$hostname = $platform['consoleHostname'] ?? '';
 // TODO: remove this later
 if (System::getEnv('_APP_ENV') === 'development') {
     $hostname = 'localhost';
@@ -537,4 +539,4 @@ switch ($type) {
     </script>
 </body>
 
-</html>
+</html>

app/views/install/compose.phtml

@@ -179,7 +179,7 @@ $image = $this->getParam('image', '');
   appwrite-console:
     <<: *x-logging
     container_name: appwrite-console
-    image: <?php echo $organization; ?>/console:7.0.2
+    image: <?php echo $organization; ?>/console:7.4.7
     restart: unless-stopped
     networks:
       - appwrite
@@ -849,7 +849,7 @@ $image = $this->getParam('image', '');
       - _APP_DB_PASS
 
   appwrite-assistant:
-    image: appwrite/assistant:0.8.3
+    image: appwrite/assistant:0.8.4
     container_name: appwrite-assistant
     <<: *x-logging
     restart: unless-stopped
@@ -857,9 +857,9 @@ $image = $this->getParam('image', '');
       - appwrite
     environment:
       - _APP_ASSISTANT_OPENAI_API_KEY
-      
+
   appwrite-browser:
-    image: appwrite/browser:0.2.4
+    image: appwrite/browser:0.3.2
     container_name: appwrite-browser
     <<: *x-logging
     restart: unless-stopped

app/worker.php

@@ -17,6 +17,7 @@ use Appwrite\Event\Realtime;
 use Appwrite\Event\StatsUsage;
 use Appwrite\Event\Webhook;
 use Appwrite\Platform\Appwrite;
+use Appwrite\Utopia\Database\Documents\User;
 use Executor\Executor;
 use Swoole\Runtime;
 use Utopia\Abuse\Adapters\TimeLimit\Redis as TimeLimitRedis;
@@ -45,19 +46,30 @@ use Utopia\System\System;
 use Utopia\Telemetry\Adapter as Telemetry;
 use Utopia\Telemetry\Adapter\None as NoTelemetry;
 
-Authorization::disable();
 Runtime::enableCoroutine();
 
 Server::setResource('register', fn () => $register);
 
-Server::setResource('dbForPlatform', function (Cache $cache, Registry $register) {
+Server::setResource('authorization', function () {
+    $authorization = new Authorization();
+    $authorization->disable();
+    return  $authorization;
+}, []);
+
+Server::setResource('dbForPlatform', function (Cache $cache, Registry $register, Authorization $authorization) {
     $pools = $register->get('pools');
     $adapter = new DatabasePool($pools->get('console'));
     $dbForPlatform = new Database($adapter, $cache);
-    $dbForPlatform->setNamespace('_console');
+
+    $dbForPlatform
+        ->setAuthorization($authorization)
+        ->setNamespace('_console')
+        ->setDocumentType('users', User::class)
+    ;
+
 
     return $dbForPlatform;
-}, ['cache', 'register']);
+}, ['cache', 'register', 'authorization']);
 
 Server::setResource('project', function (Message $message, Database $dbForPlatform) {
     $payload = $message->getPayload() ?? [];
@@ -70,7 +82,7 @@ Server::setResource('project', function (Message $message, Database $dbForPlatfo
     return $dbForPlatform->getDocument('projects', $project->getId());
 }, ['message', 'dbForPlatform']);
 
-Server::setResource('dbForProject', function (Cache $cache, Registry $register, Message $message, Document $project, Database $dbForPlatform) {
+Server::setResource('dbForProject', function (Cache $cache, Registry $register, Message $message, Document $project, Database $dbForPlatform, Authorization $authorization) {
     if ($project->isEmpty() || $project->getId() === 'console') {
         return $dbForPlatform;
     }
@@ -86,6 +98,7 @@ Server::setResource('dbForProject', function (Cache $cache, Registry $register,
 
     $adapter = new DatabasePool($pools->get($dsn->getHost()));
     $database = new Database($adapter, $cache);
+    $database->setDocumentType('users', User::class);
 
     $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
 
@@ -101,15 +114,17 @@ Server::setResource('dbForProject', function (Cache $cache, Registry $register,
             ->setNamespace('_' . $project->getSequence());
     }
 
-    $database->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER);
+    $database
+        ->setAuthorization($authorization)
+        ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER);
 
     return $database;
-}, ['cache', 'register', 'message', 'project', 'dbForPlatform']);
+}, ['cache', 'register', 'message', 'project', 'dbForPlatform', 'authorization']);
 
-Server::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache) {
+Server::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache, Authorization $authorization) {
     $databases = []; // TODO: @Meldiron This should probably be responsibility of utopia-php/pools
 
-    return function (Document $project) use ($pools, $dbForPlatform, $cache, &$databases): Database {
+    return function (Document $project) use ($pools, $dbForPlatform, $cache, $authorization, &$databases): Database {
         if ($project->isEmpty() || $project->getId() === 'console') {
             return $dbForPlatform;
         }
@@ -123,7 +138,7 @@ Server::setResource('getProjectDB', function (Group $pools, Database $dbForPlatf
 
         if (isset($databases[$dsn->getHost()])) {
             $database = $databases[$dsn->getHost()];
-
+            $database->setAuthorization($authorization);
             $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));
 
             if (\in_array($dsn->getHost(), $sharedTables)) {
@@ -160,15 +175,17 @@ Server::setResource('getProjectDB', function (Group $pools, Database $dbForPlatf
                 ->setNamespace('_' . $project->getSequence());
         }
 
-        $database->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER);
+        $database
+            ->setAuthorization($authorization)
+            ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER);
 
         return $database;
     };
-}, ['pools', 'dbForPlatform', 'cache']);
+}, ['pools', 'dbForPlatform', 'cache', 'authorization']);
 
-Server::setResource('getLogsDB', function (Group $pools, Cache $cache) {
+Server::setResource('getLogsDB', function (Group $pools, Cache $cache, Authorization $authorization) {
     $database = null;
-    return function (?Document $project = null) use ($pools, $cache, $database) {
+    return function (?Document $project = null) use ($pools, $cache, $database, $authorization) {
         if ($database !== null && $project !== null && !$project->isEmpty() && $project->getId() !== 'console') {
             $database->setTenant((int)$project->getSequence());
             return $database;
@@ -178,10 +195,11 @@ Server::setResource('getLogsDB', function (Group $pools, Cache $cache) {
         $database = new Database($adapter, $cache);
 
         $database
+            ->setAuthorization($authorization)
             ->setSharedTables(true)
             ->setNamespace('logsV1')
             ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER)
-            ->setMaxQueryValues(APP_DATABASE_QUERY_MAX_VALUES);
+            ->setMaxQueryValues(APP_DATABASE_QUERY_MAX_VALUES_WORKER);
 
         // set tenant
         if ($project !== null && !$project->isEmpty() && $project->getId() !== 'console') {
@@ -190,7 +208,7 @@ Server::setResource('getLogsDB', function (Group $pools, Cache $cache) {
 
         return $database;
     };
-}, ['pools', 'cache']);
+}, ['pools', 'cache', 'authorization']);
 
 Server::setResource('abuseRetention', function () {
     return time() - (int) System::getEnv('_APP_MAINTENANCE_RETENTION_ABUSE', 86400); // 1 day
@@ -349,7 +367,7 @@ Server::setResource('deviceForSites', function (Document $project, Telemetry $te
     return new TelemetryDevice($telemetry, getDevice(APP_STORAGE_SITES . '/app-' . $project->getId()));
 }, ['project', 'telemetry']);
 
-Server::setResource('deviceForImports', function (Document $project, Telemetry $telemetry) {
+Server::setResource('deviceForMigrations', function (Document $project, Telemetry $telemetry) {
     return new TelemetryDevice($telemetry, getDevice(APP_STORAGE_IMPORTS . '/app-' . $project->getId()));
 }, ['project', 'telemetry']);
 
@@ -409,6 +427,13 @@ Server::setResource('logError', function (Registry $register, Document $project)
             $log->addExtra('line', $error->getLine());
             $log->addExtra('trace', $error->getTraceAsString());
 
+            if ($error->getPrevious() !== null) {
+                if ($error->getPrevious()->getMessage() != $error->getMessage()) {
+                    $log->addExtra('previousMessage', $error->getPrevious()->getMessage());
+                }
+                $log->addExtra('previousFile', $error->getPrevious()->getFile());
+                $log->addExtra('previousLine', $error->getPrevious()->getLine());
+            }
 
             foreach (($extras ?? []) as $key => $value) {
                 $log->addExtra($key, $value);
@@ -429,6 +454,13 @@ Server::setResource('logError', function (Registry $register, Document $project)
 
         Console::warning("Failed: {$error->getMessage()}");
         Console::warning($error->getTraceAsString());
+
+        if ($error->getPrevious() !== null) {
+            if ($error->getPrevious()->getMessage() != $error->getMessage()) {
+                Console::warning("Previous Failed: {$error->getPrevious()->getMessage()}");
+            }
+            Console::warning("Previous File: {$error->getPrevious()->getFile()} Line: {$error->getPrevious()->getLine()}");
+        }
     };
 }, ['register', 'project']);
 
@@ -478,7 +510,8 @@ $worker
     ->inject('log')
     ->inject('pools')
     ->inject('project')
-    ->action(function (Throwable $error, ?Logger $logger, Log $log, Group $pools, Document $project) use ($worker, $queueName) {
+    ->inject('authorization')
+    ->action(function (Throwable $error, ?Logger $logger, Log $log, Group $pools, Document $project, Authorization $authorization) use ($worker, $queueName) {
         $version = System::getEnv('_APP_VERSION', 'UNKNOWN');
 
         if ($logger) {
@@ -494,7 +527,7 @@ $worker
             $log->addExtra('file', $error->getFile());
             $log->addExtra('line', $error->getLine());
             $log->addExtra('trace', $error->getTraceAsString());
-            $log->addExtra('roles', Authorization::getRoles());
+            $log->addExtra('roles', $authorization->getRoles());
 
             $isProduction = System::getEnv('_APP_ENV', 'development') === 'production';
             $log->setEnvironment($isProduction ? Log::ENVIRONMENT_PRODUCTION : Log::ENVIRONMENT_STAGING);

composer.json

@@ -1,5 +1,4 @@
 {
-
     "name": "appwrite/server-ce",
     "description": "End to end backend server for frontend and mobile apps.",
     "type": "project",
@@ -49,21 +48,23 @@
         "utopia-php/abuse": "1.*",
         "utopia-php/analytics": "0.10.*",
         "utopia-php/audit": "1.*",
+        "utopia-php/auth": "0.5.*",
         "utopia-php/cache": "0.13.*",
         "utopia-php/cli": "0.15.*",
-        "utopia-php/config": "0.2.*",
-        "utopia-php/database": "1.*",
-        "utopia-php/detector": "0.1.*",
-        "utopia-php/domains": "0.8.*",
-        "utopia-php/dns": "0.3.*",
+        "utopia-php/config": "1.*.*",
+        "utopia-php/database": "4.*",
+        "utopia-php/detector": "0.2.*",
+        "utopia-php/domains": "0.9.*",
+        "utopia-php/emails": "0.6.*",
+        "utopia-php/dns": "1.4.*",
         "utopia-php/dsn": "0.2.1",
         "utopia-php/framework": "0.33.*",
         "utopia-php/fetch": "0.4.*",
         "utopia-php/image": "0.8.*",
         "utopia-php/locale": "0.8.*",
         "utopia-php/logger": "0.6.*",
-        "utopia-php/messaging": "0.18.*",
-        "utopia-php/migration": "1.*",
+        "utopia-php/messaging": "0.20.*",
+        "utopia-php/migration": "1.3.*",
         "utopia-php/orchestration": "0.9.*",
         "utopia-php/platform": "0.7.*",
         "utopia-php/pools": "0.8.*",
@@ -74,7 +75,7 @@
         "utopia-php/swoole": "0.8.*",
         "utopia-php/system": "0.9.*",
         "utopia-php/telemetry": "0.1.*",
-        "utopia-php/vcs": "0.11.*",
+        "utopia-php/vcs": "0.13.*",
         "utopia-php/websocket": "0.3.*",
         "matomo/device-detector": "6.4.*",
         "dragonmantank/cron-expression": "3.4.*",

docker-compose.yml

@@ -38,9 +38,15 @@ services:
     depends_on:
       - appwrite
     networks:
-      - gateway
-      - appwrite
-      - runtimes
+      appwrite:
+        aliases:
+          - appwrite.test
+      gateway:
+        aliases:
+          - appwrite.test
+      runtimes:
+        aliases:
+          - appwrite.test
 
   appwrite:
     container_name: appwrite
@@ -48,6 +54,7 @@ services:
     image: appwrite-dev
     build:
       context: .
+      target: development
       args:
         DEBUG: false
         TESTING: true
@@ -56,6 +63,8 @@ services:
       - 9501:80
     networks:
       - appwrite
+    dns:
+      - 172.16.238.100
     labels:
       - "traefik.enable=true"
       - "traefik.constraint-label-stack=appwrite"
@@ -92,6 +101,7 @@ services:
     depends_on:
       - mariadb
       - redis
+      - coredns
       # - clamav
     entrypoint:
       - php
@@ -213,13 +223,14 @@ services:
       - _APP_DATABASE_SHARED_NAMESPACE
       - _APP_FUNCTIONS_CREATION_ABUSE_LIMIT
       - _APP_CUSTOM_DOMAIN_DENY_LIST
+      - _APP_TRUSTED_HEADERS
     extra_hosts:
       - "host.docker.internal:host-gateway"
 
   appwrite-console:
     <<: *x-logging
     container_name: appwrite-console
-    image: appwrite/console:7.0.2
+    image: appwrite/console:7.4.11
     restart: unless-stopped
     networks:
       - appwrite
@@ -285,6 +296,7 @@ services:
       - _APP_DB_PASS
       - _APP_USAGE_STATS
       - _APP_LOGGING_CONFIG
+      - _APP_LOGGING_CONFIG_REALTIME
       - _APP_DATABASE_SHARED_TABLES
 
   appwrite-worker-audits:
@@ -698,6 +710,7 @@ services:
       - appwrite
     volumes:
       - appwrite-imports:/storage/imports:rw
+      - appwrite-uploads:/storage/uploads:rw
       - ./app:/usr/src/code/app
       - ./src:/usr/src/code/src
       - ./tests:/usr/src/code/tests
@@ -727,6 +740,7 @@ services:
       - _APP_MIGRATIONS_FIREBASE_CLIENT_ID
       - _APP_MIGRATIONS_FIREBASE_CLIENT_SECRET
       - _APP_DATABASE_SHARED_TABLES
+      - _APP_OPTIONS_FORCE_HTTPS
 
   appwrite-task-maintenance:
     entrypoint: maintenance
@@ -949,7 +963,7 @@ services:
 
   appwrite-assistant:
     container_name: appwrite-assistant
-    image: appwrite/assistant:0.8.3
+    image: appwrite/assistant:0.8.4
     networks:
       - appwrite
     environment:
@@ -957,7 +971,7 @@ services:
 
   appwrite-browser:
     container_name: appwrite-browser
-    image: appwrite/browser:0.2.4
+    image: appwrite/browser:0.3.2
     networks:
       - appwrite
 
@@ -966,7 +980,7 @@ services:
     hostname: exc1
     <<: *x-logging
     stop_signal: SIGINT
-    image: openruntimes/executor:0.11.0
+    image: openruntimes/executor:0.11.4
     restart: unless-stopped
     networks:
       - appwrite
@@ -1069,6 +1083,21 @@ services:
     volumes:
       - appwrite-redis:/data:rw
 
+  coredns: # DNS server for testing purposes (Proxy APIs)
+    image: coredns/coredns:1.12.4
+    container_name: appwrite-coredns
+    restart: unless-stopped
+    <<: *x-logging
+    command: ["-conf", "/mnt/resources/Corefile"]
+    # If you need to debug CoreDNS, do it from "appwrite container", or port forward:
+    # ports:
+    #  - "53:53"
+    networks:
+      appwrite:
+        ipv4_address: 172.16.238.100
+    volumes:
+      - ./tests/resources/coredns:/mnt/resources:ro
+
   # Dev Tools Start ------------------------------------------------------------------------------------------
   #
   # The Appwrite Team uses the following tools to help debug, monitor and diagnose the Appwrite stack
@@ -1082,13 +1111,26 @@ services:
   # GraphQl Explorer - A nice UI for exploring GraphQL API
 
   maildev: # used mainly for dev tests
-    image: appwrite/mailcatcher:1.0.0
+    image: appwrite/mailcatcher:1.1.1
     container_name: appwrite-mailcatcher
     <<: *x-logging
     ports:
       - "9503:1080"
     networks:
       - appwrite
+      - gateway
+    labels:
+      - "traefik.enable=true"
+      - "traefik.constraint-label-stack=appwrite"
+      - "traefik.docker.network=gateway"
+      - "traefik.http.services.appwrite_maildev.loadbalancer.server.port=1080"
+      - "traefik.http.routers.appwrite_maildev_http.entrypoints=appwrite_web"
+      - "traefik.http.routers.appwrite_maildev_http.rule=Host(`mail.localhost`)"
+      - "traefik.http.routers.appwrite_maildev_http.service=appwrite_maildev"
+      - "traefik.http.routers.appwrite_maildev_https.entrypoints=appwrite_websecure"
+      - "traefik.http.routers.appwrite_maildev_https.rule=Host(`mail.localhost`)"
+      - "traefik.http.routers.appwrite_maildev_https.service=appwrite_maildev"
+      - "traefik.http.routers.appwrite_maildev_https.tls=true"
 
   request-catcher-webhook: # used mainly for dev tests (mock HTTP webhook)
     image: appwrite/requestcatcher:1.0.0
@@ -1117,14 +1159,54 @@ services:
       - 9506:8080
     networks:
       - appwrite
+      - gateway
+    environment:
+      - ADMINER_DESIGN=pepa-linha
+      - ADMINER_DEFAULT_SERVER=mariadb
+      - ADMINER_DEFAULT_USERNAME=root
+      - ADMINER_DEFAULT_PASSWORD=rootsecretpassword
+      - ADMINER_DEFAULT_DB=appwrite
+    configs:
+      - source: adminer-index.php
+        target: /var/www/html/index.php
+        mode: 0755
+    labels:
+      - "traefik.enable=true"
+      - "traefik.constraint-label-stack=appwrite"
+      - "traefik.docker.network=gateway"
+      - "traefik.http.services.appwrite_adminer.loadbalancer.server.port=8080"
+      - "traefik.http.routers.appwrite_adminer_http.entrypoints=appwrite_web"
+      - "traefik.http.routers.appwrite_adminer_http.rule=Host(`mysql.localhost`)"
+      - "traefik.http.routers.appwrite_adminer_http.service=appwrite_adminer"
+      - "traefik.http.routers.appwrite_adminer_https.entrypoints=appwrite_websecure"
+      - "traefik.http.routers.appwrite_adminer_https.rule=Host(`mysql.localhost`)"
+      - "traefik.http.routers.appwrite_adminer_https.service=appwrite_adminer"
+      - "traefik.http.routers.appwrite_adminer_https.tls=true"
 
   redis-insight:
     image: redis/redisinsight:latest
     restart: unless-stopped
     networks:
       - appwrite
+      - gateway
     environment:
-      - REDIS_HOSTS=redis
+      - RI_PRE_SETUP_DATABASES_PATH=/mnt/connections.json
+    configs:
+      - source: redisinsight-connections.json
+        target: /mnt/connections.json
+        mode: 0755
+    labels:
+      - "traefik.enable=true"
+      - "traefik.constraint-label-stack=appwrite"
+      - "traefik.docker.network=gateway"
+      - "traefik.http.services.appwrite_redisinsight.loadbalancer.server.port=5540"
+      - "traefik.http.routers.appwrite_redisinsight_http.entrypoints=appwrite_web"
+      - "traefik.http.routers.appwrite_redisinsight_http.rule=Host(`redis.localhost`)"
+      - "traefik.http.routers.appwrite_redisinsight_http.service=appwrite_redisinsight"
+      - "traefik.http.routers.appwrite_redisinsight_https.entrypoints=appwrite_websecure"
+      - "traefik.http.routers.appwrite_redisinsight_https.rule=Host(`redis.localhost`)"
+      - "traefik.http.routers.appwrite_redisinsight_https.service=appwrite_redisinsight"
+      - "traefik.http.routers.appwrite_redisinsight_https.tls=true"
     ports:
       - "8081:5540"
 
@@ -1146,9 +1228,67 @@ networks:
     name: gateway
   appwrite:
     name: appwrite
+    ipam:
+      config:
+        - subnet: 172.16.238.0/24
   runtimes:
     name: runtimes
 
+configs:
+  redisinsight-connections.json:
+    content: |
+      [
+        {
+          "compressor": "NONE",
+          "id": "104dc90a-21ef-4d5e-8912-b30baabb152f",
+          "host": "redis",
+          "port": 6379,
+          "name": "redis:6379",
+          "db": 0,
+          "username": "default",
+          "password": null,
+          "connectionType": "STANDALONE",
+          "nameFromProvider": null,
+          "provider": "REDIS",
+          "lastConnection": "2025-10-16T09:22:02.591Z",
+          "modules": [
+            {
+              "name": "ReJSON",
+              "version": 20808,
+              "semanticVersion": "2.8.8"
+            },
+            {
+              "name": "search",
+              "version": 21015,
+              "semanticVersion": "2.10.15"
+            }
+          ],
+          "tls": false,
+          "tlsServername": null,
+          "verifyServerCert": null,
+          "caCert": null,
+          "clientCert": null,
+          "ssh": false,
+          "sshOptions": null,
+          "forceStandalone": false,
+          "tags": []
+        }
+      ]
+
+  adminer-index.php:
+    content: |
+      <?php
+        if(!count($$_GET)) {
+          $$_POST['auth'] = [
+            'server' => $$_ENV['ADMINER_DEFAULT_SERVER'],
+            'driver' => 'server', /* seems to autodetect the driver from server settings */
+            'username' => $$_ENV['ADMINER_DEFAULT_USERNAME'],
+            'password' => $$_ENV['ADMINER_DEFAULT_PASSWORD'],
+            'db' => $$_ENV['ADMINER_DEFAULT_DB'],
+          ];
+        }
+        include './adminer.php';
+
 volumes:
   appwrite-mariadb:
   appwrite-redis:

docs/examples/1.5.x/client-rest/examples/account/create-challenge.md

@@ -1,4 +1,4 @@
-POST /v1/account/mfa/challenge HTTP/1.1
+POST /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.5.0

docs/examples/1.5.x/client-rest/examples/account/create-mfa-challenge.md

@@ -1,4 +1,4 @@
-POST /v1/account/mfa/challenge HTTP/1.1
+POST /v1/account/mfa/challenges HTTP/1.1
 Host: <REGION>.cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.6.0

docs/examples/1.5.x/client-rest/examples/account/create2f-a-challenge.md

@@ -1,4 +1,4 @@
-POST /v1/account/mfa/challenge HTTP/1.1
+POST /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.5.0

docs/examples/1.5.x/client-rest/examples/account/update-challenge.md

@@ -1,4 +1,4 @@
-PUT /v1/account/mfa/challenge HTTP/1.1
+PUT /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.5.0

docs/examples/1.5.x/client-rest/examples/account/update-mfa-challenge.md

@@ -1,4 +1,4 @@
-PUT /v1/account/mfa/challenge HTTP/1.1
+PUT /v1/account/mfa/challenges HTTP/1.1
 Host: <REGION>.cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.6.0

docs/examples/1.5.x/server-rest/examples/account/create-challenge.md

@@ -1,4 +1,4 @@
-POST /v1/account/mfa/challenge HTTP/1.1
+POST /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.5.0

docs/examples/1.5.x/server-rest/examples/account/create-mfa-challenge.md

@@ -1,4 +1,4 @@
-POST /v1/account/mfa/challenge HTTP/1.1
+POST /v1/account/mfa/challenges HTTP/1.1
 Host: <REGION>.cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.6.0

docs/examples/1.5.x/server-rest/examples/account/create2f-a-challenge.md

@@ -1,4 +1,4 @@
-POST /v1/account/mfa/challenge HTTP/1.1
+POST /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.5.0

docs/examples/1.5.x/server-rest/examples/account/update-challenge.md

@@ -1,4 +1,4 @@
-PUT /v1/account/mfa/challenge HTTP/1.1
+PUT /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.5.0

docs/examples/1.5.x/server-rest/examples/account/update-mfa-challenge.md

@@ -1,4 +1,4 @@
-PUT /v1/account/mfa/challenge HTTP/1.1
+PUT /v1/account/mfa/challenges HTTP/1.1
 Host: <REGION>.cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.6.0

docs/examples/1.6.x/client-rest/examples/account/create-mfa-challenge.md

@@ -1,4 +1,4 @@
-POST /v1/account/mfa/challenge HTTP/1.1
+POST /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.6.0

docs/examples/1.6.x/client-rest/examples/account/update-mfa-challenge.md

@@ -1,4 +1,4 @@
-PUT /v1/account/mfa/challenge HTTP/1.1
+PUT /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.6.0

docs/examples/1.6.x/server-rest/examples/account/create-mfa-challenge.md

@@ -1,4 +1,4 @@
-POST /v1/account/mfa/challenge HTTP/1.1
+POST /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.6.0

docs/examples/1.6.x/server-rest/examples/account/update-mfa-challenge.md

@@ -1,4 +1,4 @@
-PUT /v1/account/mfa/challenge HTTP/1.1
+PUT /v1/account/mfa/challenges HTTP/1.1
 Host: cloud.appwrite.io
 Content-Type: application/json
 X-Appwrite-Response-Format: 1.6.0