fix spec generation

fix sdk method names and use new auth methods after auth refactor
specs
2026-05-26 13:51:13 +00:00 · 2026-01-07 00:46:44 +05:30 · 2026-01-07 00:36:25 +05:30 · 2026-01-07 00:18:30 +05:30 · 2026-01-06 23:59:32 +05:30 · 2026-01-06 23:39:49 +05:30
428 changed files with 40191 additions and 17996 deletions
@@ -69,8 +69,8 @@ _APP_STORAGE_ANTIVIRUS_PORT=3310
 _APP_SMTP_HOST=maildev
 _APP_SMTP_PORT=1025
 _APP_SMTP_SECURE=
-_APP_SMTP_USERNAME=
-_APP_SMTP_PASSWORD=
+_APP_SMTP_USERNAME=user
+_APP_SMTP_PASSWORD=password
 _APP_SMS_PROVIDER=sms://username:password@mock
 _APP_SMS_FROM=+123456789
 _APP_SMS_PROJECTS_DENY_LIST=
@@ -101,6 +101,7 @@ _APP_USAGE_AGGREGATION_INTERVAL=30
 _APP_STATS_RESOURCES_INTERVAL=30
 _APP_MAINTENANCE_RETENTION_USAGE_HOURLY=8640000
 _APP_MAINTENANCE_RETENTION_SCHEDULES=86400
+_APP_INTERVAL_DOMAIN_VERIFICATION=60
 _APP_USAGE_STATS=enabled
 _APP_LOGGING_CONFIG=
 _APP_LOGGING_CONFIG_REALTIME=
@@ -125,4 +126,4 @@ _APP_WEBHOOK_MAX_FAILED_ATTEMPTS=10
 _APP_PROJECT_REGIONS=default
 _APP_FUNCTIONS_CREATION_ABUSE_LIMIT=5000
 _APP_STATS_USAGE_DUAL_WRITING_DBS=database_db_main
-_APP_TRUSTED_HEADERS=x-forwarded-for
+_APP_TRUSTED_HEADERS=x-forwarded-for
@@ -223,7 +223,7 @@ jobs:
            -e _APP_DATABASE_SHARED_TABLES \
            -e _APP_DATABASE_SHARED_TABLES_V1 \
            -e _APP_E2E_RESPONSE_FORMAT="${{ github.event.inputs.response_format }}" \
-            appwrite test /usr/src/code/tests/e2e/Services/${{ matrix.service }} --debug --exclude-group devKeys,screenshots
+            appwrite test /usr/src/code/tests/e2e/Services/${{ matrix.service }} --debug --exclude-group abuseEnabled,screenshots

      - name: Failure Logs
        if: failure()
@@ -312,7 +312,7 @@ jobs:
            -e _APP_DATABASE_SHARED_TABLES \
            -e _APP_DATABASE_SHARED_TABLES_V1 \
            -e _APP_E2E_RESPONSE_FORMAT="${{ github.event.inputs.response_format }}" \
-            appwrite test /usr/src/code/tests/e2e/Services/${{ matrix.service }} --debug --exclude-group devKeys,screenshots
+            appwrite test /usr/src/code/tests/e2e/Services/${{ matrix.service }} --debug --exclude-group abuseEnabled,screenshots

      - name: Failure Logs
        if: failure()
@@ -322,8 +322,8 @@ jobs:
          echo "=== OpenRuntimes Executor Logs ==="
          docker compose logs openruntimes-executor

-  e2e_dev_keys:
-    name: E2E Service Test (Dev Keys)
+  e2e_abuse_enabled:
+    name: E2E Service Test (Abuse enabled)
    runs-on: ubuntu-latest
    needs: setup
    steps:
@@ -344,7 +344,7 @@ jobs:
          docker compose up -d
          sleep 30

-      - name: Run Projects tests with dev keys in dedicated table mode
+      - name: Run Projects tests in dedicated table mode
        run: |
          echo "Using project tables"
          export _APP_DATABASE_SHARED_TABLES=
@@ -354,7 +354,7 @@ jobs:
            -e _APP_DATABASE_SHARED_TABLES \
            -e _APP_DATABASE_SHARED_TABLES_V1 \
            -e _APP_E2E_RESPONSE_FORMAT="${{ github.event.inputs.response_format }}" \
-            appwrite test /usr/src/code/tests/e2e/Services/Projects --debug --group=devKeys
+            appwrite test /usr/src/code/tests/e2e/Services/Projects --debug --group=abuseEnabled

      - name: Failure Logs
        if: failure()
@@ -364,8 +364,8 @@ jobs:
          echo "=== OpenRuntimes Executor Logs ==="
          docker compose logs openruntimes-executor

-  e2e_dev_keys_shared_mode:
-    name: E2E Shared Mode Service Test (Dev Keys)
+  e2e_abuse_enabled_shared_mode:
+    name: E2E Shared Mode Service Test (Abuse enabled)
    runs-on: ubuntu-latest
    needs: [ setup, check_database_changes ]
    if: needs.check_database_changes.outputs.database_changed == 'true'
@@ -394,7 +394,7 @@ jobs:
          docker compose up -d
          sleep 30

-      - name: Run Projects tests with dev keys in ${{ matrix.tables-mode }} table mode
+      - name: Run Projects tests in ${{ matrix.tables-mode }} table mode
        run: |
          if [ "${{ matrix.tables-mode }}" == "Shared V1" ]; then
            echo "Using shared tables V1"
@@ -410,7 +410,7 @@ jobs:
            -e _APP_DATABASE_SHARED_TABLES \
            -e _APP_DATABASE_SHARED_TABLES_V1 \
            -e _APP_E2E_RESPONSE_FORMAT="${{ github.event.inputs.response_format }}" \
-            appwrite test /usr/src/code/tests/e2e/Services/Projects --debug --group=devKeys
+            appwrite test /usr/src/code/tests/e2e/Services/Projects --debug --group=abuseEnabled

      - name: Failure Logs
        if: failure()
@@ -420,7 +420,7 @@ jobs:
          echo "=== OpenRuntimes Executor Logs ==="
          docker compose logs openruntimes-executor

-  e2e_screenshots_keys:
+  e2e_screenshots:
    name: E2E Service Test (Site Screenshots)
    runs-on: ubuntu-latest
    needs: setup
@@ -0,0 +1,77 @@
+# AGENTS.md
+
+Appwrite is an end-to-end backend server for web, mobile, native, and backend apps. This guide provides context and instructions for AI coding agents working on the Appwrite codebase.
+
+## Project Overview
+
+Appwrite is a self-hosted Backend-as-a-Service (BaaS) platform that provides developers with a set of APIs and tools to build secure, scalable applications. The project uses a hybrid monolithic-microservice architecture built with PHP, running on Swoole for high performance.
+
+**Key Technologies:**
+- **Backend:** PHP 8.3+, Swoole
+- **Libraries:** Utopia PHP
+- **Database:** MariaDB, Redis
+- **Cache:** Redis
+- **Queue:** Redis
+- **Containers:** Docker
+
+## Development Commands
+
+```bash
+# Run Appwrite
+docker compose up -d --force-recreate --build
+
+# Run specific test
+docker compose exec appwrite test /usr/src/code/tests/e2e/Services/[ServiceName] --filter=[FunctionName]
+
+# Format code
+composer format
+```
+
+## Code Style Guidelines
+
+- Follow [PSR-12](https://www.php-fig.org/psr/psr-12/) coding standard
+- Use PSR-4 autoloading
+- Strict type declarations where applicable
+- Comprehensive PHPDoc comments
+
+### Naming Conventions
+
+#### `resourceType` Naming Rule
+
+When a collection has a combination of `resourceType`, `resourceId`, and/or `resourceInternalId`, the value of `resourceType` MUST always be **plural** - for example: `functions`, `sites`, `deployments`.
+
+Examples:
+```php
+'resourceType' => 'functions'
+'resourceType' => 'sites'
+'resourceType' => 'deployments'
+```
+
+## Security Considerations
+
+### Critical Security Practices
+
+- **Never hardcode credentials** - Use environment variables
+- **Rate limiting** - Respect abuse prevention mechanisms
+
+## Dependencies
+
+Avoid introducing new dependencies other than utopia-php.
+
+## Adding new endpoints
+
+When adding new endpoints, make sure to use modules and follow its patterns. Find instruction in [Modules AGENTS.md](src/Appwrite/Platform/AGENTS.md) file.
+
+## Pull Request Guidelines
+### Before Submitting
+
+-  Run `composer format`
+- Update documentation if adding features
+- Add/update tests for your changes
+- Check that Docker build succeeds
+`docs/specs/authentication.drawio.svg`
+
+## Known Issues and Gotchas
+
+- **Hot Reload:** Code changes require container restart in some cases
+- **Logging:** There is no central place for logs, so when debugging, ensure to check all possibly relevant containers
@@ -1,3 +1,101 @@
+# Version 1.8.1
+
+## What's Changed
+
+### Notable changes
+
+* Add branch deployments support in [#10486](https://github.com/appwrite/appwrite/pull/10486)
+* Add TanStack Start sites support in [#10681](https://github.com/appwrite/appwrite/pull/10681)
+* Add Next.js standalone support in [#10747](https://github.com/appwrite/appwrite/pull/10747)
+* Add Resend integration in [#10690](https://github.com/appwrite/appwrite/pull/10690)
+* Add option to enable/disable image transformations per-bucket in [#10722](https://github.com/appwrite/appwrite/pull/10722)
+* Add operators support in [#10735](https://github.com/appwrite/appwrite/pull/10735) and [#10800](https://github.com/appwrite/appwrite/pull/10800)
+* Add function and sites stats in [#10786](https://github.com/appwrite/appwrite/pull/10786)
+* Add disable count feature in [#10668](https://github.com/appwrite/appwrite/pull/10668)
+* Add ElevenLabs site template in [#10782](https://github.com/appwrite/appwrite/pull/10782)
+* Add suggested environment variables in [#10795](https://github.com/appwrite/appwrite/pull/10795)
+* Update GeoDB database in [#10890](https://github.com/appwrite/appwrite/pull/10890)
+* Update Flutter default build runtime in [#10807](https://github.com/appwrite/appwrite/pull/10807)
+* Upgrade runtimes in [#10804](https://github.com/appwrite/appwrite/pull/10804)
+
+### Fixes
+
+* Fix duplicate document error while creating file in [#10891](https://github.com/appwrite/appwrite/pull/10891)
+* Fix "Update external deployment (authorize)" throwing 500 error due to invalid query in [#10888](https://github.com/appwrite/appwrite/pull/10888)
+* Fix error setting user password in [#10889](https://github.com/appwrite/appwrite/pull/10889)
+* Fix error generating email MFA challenges in [#10884](https://github.com/appwrite/appwrite/pull/10884)
+* Fix file token expiry in [#10877](https://github.com/appwrite/appwrite/pull/10877)
+* Fix TanStack Nitro default in [#10860](https://github.com/appwrite/appwrite/pull/10860)
+* Fix TanStack builds in [#10767](https://github.com/appwrite/appwrite/pull/10767)
+* Fix nullable validation in [#10819](https://github.com/appwrite/appwrite/pull/10819) and [#10778](https://github.com/appwrite/appwrite/pull/10778)
+* Fix WebP library in [#10738](https://github.com/appwrite/appwrite/pull/10738)
+* Fix batch writes in [#10812](https://github.com/appwrite/appwrite/pull/10812)
+* Fix error handler error in [#10719](https://github.com/appwrite/appwrite/pull/10719)
+* Fix Next 16 compatibility in [#10713](https://github.com/appwrite/appwrite/pull/10713)
+* Fix stats usage memory leak in [#10683](https://github.com/appwrite/appwrite/pull/10683)
+* Fix author URL in template deployments in [#10535](https://github.com/appwrite/appwrite/pull/10535)
+* Fix VCS lock deletion in [#10691](https://github.com/appwrite/appwrite/pull/10691)
+
+### Miscellaneous
+
+* Add CSV export functionality in [#10546](https://github.com/appwrite/appwrite/pull/10546), [#10750](https://github.com/appwrite/appwrite/pull/10750), [#10813](https://github.com/appwrite/appwrite/pull/10813), and [#10847](https://github.com/appwrite/appwrite/pull/10847)
+* Add JWT disposition in [#10867](https://github.com/appwrite/appwrite/pull/10867)
+* Add screenshots endpoint in [#10675](https://github.com/appwrite/appwrite/pull/10675)
+* Add screenshot endpoint stats in [#10706](https://github.com/appwrite/appwrite/pull/10706)
+* Add users attributes in [#10688](https://github.com/appwrite/appwrite/pull/10688)
+* Add max build duration environment variable in [#10674](https://github.com/appwrite/appwrite/pull/10674)
+* Add custom realtime logger in [#10871](https://github.com/appwrite/appwrite/pull/10871)
+* Add logs in [#10869](https://github.com/appwrite/appwrite/pull/10869)
+* Improve MFA docs endpoint order in [#10793](https://github.com/appwrite/appwrite/pull/10793)
+* Auth refactor in [#10758](https://github.com/appwrite/appwrite/pull/10758), [#10837](https://github.com/appwrite/appwrite/pull/10837), [#10682](https://github.com/appwrite/appwrite/pull/10682), and [#10667](https://github.com/appwrite/appwrite/pull/10667)
+* Bump assistant to 0.8.4 in [#10887](https://github.com/appwrite/appwrite/pull/10887)
+* Bump database to 3.1.5 in [#10766](https://github.com/appwrite/appwrite/pull/10766)
+* Bump Utopia DNS in [#10761](https://github.com/appwrite/appwrite/pull/10761)
+* Update domains to 0.8.3 in [#10658](https://github.com/appwrite/appwrite/pull/10658)
+* Update domains to 0.9.1 in [#10678](https://github.com/appwrite/appwrite/pull/10678)
+* Update Apple Swift to 13.3.0 in [#10679](https://github.com/appwrite/appwrite/pull/10679)
+* Update Apple Swift in [#10663](https://github.com/appwrite/appwrite/pull/10663)
+* Update CLI to 10.2.2 in [#10672](https://github.com/appwrite/appwrite/pull/10672)
+* Update to CLI 12.0.0 in [#10853](https://github.com/appwrite/appwrite/pull/10853)
+* Update docs examples to use Permission class in [#10707](https://github.com/appwrite/appwrite/pull/10707)
+* Update SDK examples docs in [#10855](https://github.com/appwrite/appwrite/pull/10855)
+* Release Python SDK in [#10762](https://github.com/appwrite/appwrite/pull/10762)
+* Release Flutter 20.3.2 in [#10838](https://github.com/appwrite/appwrite/pull/10838)
+* Release Flutter/Dart add screenshot examples in [#10811](https://github.com/appwrite/appwrite/pull/10811)
+* Release PHP CLI in [#10791](https://github.com/appwrite/appwrite/pull/10791)
+* Release SDKs in [#10817](https://github.com/appwrite/appwrite/pull/10817)
+* Update SDKs in [#10694](https://github.com/appwrite/appwrite/pull/10694), [#10729](https://github.com/appwrite/appwrite/pull/10729), and [#10744](https://github.com/appwrite/appwrite/pull/10744)
+* Update SDK generator in [#10743](https://github.com/appwrite/appwrite/pull/10743)
+* Update database in [#10664](https://github.com/appwrite/appwrite/pull/10664)
+* Update README file in [#10763](https://github.com/appwrite/appwrite/pull/10763)
+* SDK release documentation in [#10745](https://github.com/appwrite/appwrite/pull/10745)
+* SDK release runtime config in [#10765](https://github.com/appwrite/appwrite/pull/10765)
+* Sync specs in [#10789](https://github.com/appwrite/appwrite/pull/10789)
+* Sync 1.8.0 in [#10677](https://github.com/appwrite/appwrite/pull/10677)
+* Add workflow for issue triage in [#10718](https://github.com/appwrite/appwrite/pull/10718)
+* Add issue auto-labeler in [#10700](https://github.com/appwrite/appwrite/pull/10700)
+* Add AI moderator repo in [#10717](https://github.com/appwrite/appwrite/pull/10717)
+* Browser bump in [#10850](https://github.com/appwrite/appwrite/pull/10850)
+* Template type enum override in [#10848](https://github.com/appwrite/appwrite/pull/10848)
+* VCS reference type in [#10852](https://github.com/appwrite/appwrite/pull/10852)
+* Index scope description in [#10851](https://github.com/appwrite/appwrite/pull/10851)
+* Config for environment in [#10833](https://github.com/appwrite/appwrite/pull/10833)
+* Format instance in [#10830](https://github.com/appwrite/appwrite/pull/10830)
+* Replace sleep in webhooks service in [#10656](https://github.com/appwrite/appwrite/pull/10656)
+* Update email composer in [#10720](https://github.com/appwrite/appwrite/pull/10720)
+* Update facts on GitHub sites and functions in [#10593](https://github.com/appwrite/appwrite/pull/10593) and [#10771](https://github.com/appwrite/appwrite/pull/10771)
+* Fix wrong user type in [#10875](https://github.com/appwrite/appwrite/pull/10875)
+* Fix limit and offset computation in [#10880](https://github.com/appwrite/appwrite/pull/10880)
+* Fix enum examples in [#10828](https://github.com/appwrite/appwrite/pull/10828)
+* Fix response models multi-methods in [#10815](https://github.com/appwrite/appwrite/pull/10815)
+* Fix undefined variable in [#10654](https://github.com/appwrite/appwrite/pull/10654)
+* Fix undefined sequence in [#10652](https://github.com/appwrite/appwrite/pull/10652)
+* Fix description in [#10702](https://github.com/appwrite/appwrite/pull/10702)
+* Fix warning in builds worker in [#10705](https://github.com/appwrite/appwrite/pull/10705)
+* Fix sites create deployment docs in [#10566](https://github.com/appwrite/appwrite/pull/10566)
+* Fix test dependencies projects in [#10655](https://github.com/appwrite/appwrite/pull/10655)
+* Fix list sites test in [#10726](https://github.com/appwrite/appwrite/pull/10726)
+
 # Version 1.8.0

 ## What's Changed
@@ -57,6 +57,7 @@ RUN mkdir -p /storage/uploads && \
 # Executables
 RUN chmod +x /usr/local/bin/doctor && \
    chmod +x /usr/local/bin/install && \
+    chmod +x /usr/local/bin/interval && \
    chmod +x /usr/local/bin/maintenance &&  \
    chmod +x /usr/local/bin/migrate && \
    chmod +x /usr/local/bin/realtime && \
@@ -86,7 +87,9 @@ RUN chmod +x /usr/local/bin/doctor && \
    chmod +x /usr/local/bin/worker-webhooks && \
    chmod +x /usr/local/bin/worker-stats-usage && \
    chmod +x /usr/local/bin/stats-resources && \
-    chmod +x /usr/local/bin/worker-stats-resources
+    chmod +x /usr/local/bin/worker-stats-resources && \
+    chmod +x /usr/local/bin/worker-payments-usage && \
+    chmod +x /usr/local/bin/schedule-payments-usage

 RUN mkdir -p /etc/letsencrypt/live/ && chmod -Rf 755 /etc/letsencrypt/live/

@@ -72,7 +72,7 @@ docker run -it --rm \
    --volume /var/run/docker.sock:/var/run/docker.sock \
    --volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \
    --entrypoint="install" \
-    appwrite/appwrite:1.8.0
+    appwrite/appwrite:1.8.1
 ```

 ### Windows
@@ -84,7 +84,7 @@ docker run -it --rm ^
    --volume //var/run/docker.sock:/var/run/docker.sock ^
    --volume "%cd%"/appwrite:/usr/src/code/appwrite:rw ^
    --entrypoint="install" ^
-    appwrite/appwrite:1.8.0
+    appwrite/appwrite:1.8.1
 ```

 #### PowerShell
@@ -94,7 +94,7 @@ docker run -it --rm `
    --volume /var/run/docker.sock:/var/run/docker.sock `
    --volume ${pwd}/appwrite:/usr/src/code/appwrite:rw `
    --entrypoint="install" `
-    appwrite/appwrite:1.8.0
+    appwrite/appwrite:1.8.1
 ```

 运行后，可以在浏览器上访问 http://localhost 找到 Appwrite 控制台。在非 Linux 的本机主机上完成安装后，服务器可能需要几分钟才能启动。
@@ -75,7 +75,7 @@ docker run -it --rm \
    --volume /var/run/docker.sock:/var/run/docker.sock \
    --volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \
    --entrypoint="install" \
-    appwrite/appwrite:1.8.0
+    appwrite/appwrite:1.8.1
 ```

 ### Windows
@@ -87,7 +87,7 @@ docker run -it --rm ^
    --volume //var/run/docker.sock:/var/run/docker.sock ^
    --volume "%cd%"/appwrite:/usr/src/code/appwrite:rw ^
    --entrypoint="install" ^
-    appwrite/appwrite:1.8.0
+    appwrite/appwrite:1.8.1
 ```

 #### PowerShell
@@ -97,7 +97,7 @@ docker run -it --rm `
    --volume /var/run/docker.sock:/var/run/docker.sock `
    --volume ${pwd}/appwrite:/usr/src/code/appwrite:rw `
    --entrypoint="install" `
-    appwrite/appwrite:1.8.0
+    appwrite/appwrite:1.8.1
 ```

 Once the Docker installation is complete, go to http://localhost to access the Appwrite console from your browser. Please note that on non-Linux native hosts, the server might take a few minutes to start after completing the installation.
@@ -5,6 +5,7 @@ require_once __DIR__ . '/init.php';
 use Appwrite\Event\Certificate;
 use Appwrite\Event\Delete;
 use Appwrite\Event\Func;
+use Appwrite\Event\PaymentsUsage;
 use Appwrite\Event\StatsResources;
 use Appwrite\Event\StatsUsage;
 use Appwrite\Platform\Appwrite;
@@ -41,6 +42,8 @@ Config::setParam('runtimes', (new Runtimes('v5'))->getAll(supported: false));
 // require controllers after overwriting runtimes
 require_once __DIR__ . '/controllers/general.php';

+Authorization::disable();
+
 CLI::setResource('register', fn () => $register);

 CLI::setResource('cache', function ($pools) {
@@ -58,13 +61,7 @@ CLI::setResource('pools', function (Registry $register) {
    return $register->get('pools');
 }, ['register']);

-CLI::setResource('authorization', function () {
-    $authorization = new Authorization();
-    $authorization->disable();
-    return $authorization;
-}, []);
-
-CLI::setResource('dbForPlatform', function ($pools, $cache, $authorization) {
+CLI::setResource('dbForPlatform', function ($pools, $cache) {
    $sleep = 3;
    $maxAttempts = 5;
    $attempts = 0;
@@ -78,7 +75,6 @@ CLI::setResource('dbForPlatform', function ($pools, $cache, $authorization) {
            $dbForPlatform = new Database($adapter, $cache);

            $dbForPlatform
-                ->setAuthorization($authorization)
                ->setNamespace('_console')
                ->setMetadata('host', \gethostname())
                ->setMetadata('project', 'console');
@@ -104,7 +100,7 @@ CLI::setResource('dbForPlatform', function ($pools, $cache, $authorization) {
    }

    return $dbForPlatform;
-}, ['pools', 'cache', 'authorization']);
+}, ['pools', 'cache']);

 CLI::setResource('console', function () {
    return new Document(Config::getParam('console'));
@@ -115,10 +111,10 @@ CLI::setResource(
    fn () => fn (Document $project, string $resourceType, ?string $resourceId) => false
 );

-CLI::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache, $authorization) {
+CLI::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache) {
    $databases = []; // TODO: @Meldiron This should probably be responsibility of utopia-php/pools

-    return function (Document $project) use ($pools, $dbForPlatform, $cache, $authorization, &$databases) {
+    return function (Document $project) use ($pools, $dbForPlatform, $cache, &$databases) {
        if ($project->isEmpty() || $project->getId() === 'console') {
            return $dbForPlatform;
        }
@@ -151,7 +147,6 @@ CLI::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform

        $adapter = new DatabasePool($pools->get($dsn->getHost()));
        $database = new Database($adapter, $cache);
-
        $databases[$dsn->getHost()] = $database;
        $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));

@@ -168,18 +163,17 @@ CLI::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform
        }

        $database
-            ->setAuthorization($authorization)
            ->setMetadata('host', \gethostname())
            ->setMetadata('project', $project->getId());

        return $database;
    };
-}, ['pools', 'dbForPlatform', 'cache', 'authorization']);
+}, ['pools', 'dbForPlatform', 'cache']);

-CLI::setResource('getLogsDB', function (Group $pools, Cache $cache, Authorization $authorization) {
+CLI::setResource('getLogsDB', function (Group $pools, Cache $cache) {
    $database = null;

-    return function (?Document $project = null) use ($pools, $cache, $database, $authorization) {
+    return function (?Document $project = null) use ($pools, $cache, $database) {
        if ($database !== null && $project !== null && !$project->isEmpty() && $project->getId() !== 'console') {
            $database->setTenant((int)$project->getSequence());
            return $database;
@@ -189,7 +183,6 @@ CLI::setResource('getLogsDB', function (Group $pools, Cache $cache, Authorizatio
        $database = new Database($adapter, $cache);

        $database
-            ->setAuthorization($authorization)
            ->setSharedTables(true)
            ->setNamespace('logsV1')
            ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_TASK)
@@ -202,7 +195,7 @@ CLI::setResource('getLogsDB', function (Group $pools, Cache $cache, Authorizatio

        return $database;
    };
-}, ['pools', 'cache', 'authorization']);
+}, ['pools', 'cache']);
 CLI::setResource('publisher', function (Group $pools) {
    return new BrokerPool(publisher: $pools->get('publisher'));
 }, ['pools']);
@@ -236,6 +229,9 @@ CLI::setResource('queueForDeletes', function (Publisher $publisher) {
 CLI::setResource('queueForCertificates', function (Publisher $publisher) {
    return new Certificate($publisher);
 }, ['publisher']);
+CLI::setResource('queueForPaymentsUsage', function (Publisher $publisher) {
+    return new PaymentsUsage($publisher);
+}, ['publisher']);
 CLI::setResource('logError', function (Registry $register) {
    return function (Throwable $error, string $namespace, string $action) use ($register) {
        Console::error('[Error] Timestamp: ' . date('c', time()));
@@ -265,6 +261,14 @@ CLI::setResource('logError', function (Registry $register) {
            $log->addExtra('trace', $error->getTraceAsString());
            $log->addExtra('detailedTrace', $error->getTrace());

+            if ($error->getPrevious() !== null) {
+                if ($error->getPrevious()->getMessage() != $error->getMessage()) {
+                    $log->addExtra('previousMessage', $error->getPrevious()->getMessage());
+                }
+                $log->addExtra('previousFile', $error->getPrevious()->getFile());
+                $log->addExtra('previousLine', $error->getPrevious()->getLine());
+            }
+
            $log->setAction($action);

            $isProduction = System::getEnv('_APP_ENV', 'development') === 'production';
@@ -6,7 +6,7 @@ use Utopia\Database\Helpers\ID;

 $providers = Config::getParam('oAuthProviders', []);

-return [
+$platformCollections = [
    'projects' => [
        '$collection' => ID::custom(Database::METADATA),
        '$id' => ID::custom('projects'),
@@ -232,6 +232,17 @@ return [
                'array' => false,
                'filters' => ['json'],
            ],
+            [
+                '$id' => ID::custom('payments'),
+                'type' => Database::VAR_STRING,
+                'format' => '',
+                'size' => 65536,
+                'signed' => true,
+                'required' => false,
+                'default' => [],
+                'array' => false,
+                'filters' => ['json', 'encrypt'],
+            ],
            [
                '$id' => ID::custom('auths'),
                'type' => Database::VAR_STRING,
@@ -330,7 +341,18 @@ return [
                'default' => null,
                'array' => false,
                'filters' => ['datetime'],
-            ]
+            ],
+            [
+                '$id' => ID::custom('labels'),
+                'type' => Database::VAR_STRING,
+                'format' => '',
+                'size' => 128,
+                'signed' => true,
+                'required' => false,
+                'default' => [],
+                'array' => true,
+                'filters' => [],
+            ],
        ],
        'indexes' => [
            [
@@ -643,6 +665,39 @@ return [
                'array' => false,
                'filters' => [],
            ],
+            [
+                '$id' => 'resourceType',
+                'type' => Database::VAR_STRING,
+                'format' => '',
+                'size' => Database::LENGTH_KEY,
+                'signed' => true,
+                'required' => false,
+                'default' => null,
+                'array' => false,
+                'filters' => [],
+            ],
+            [
+                '$id' => 'resourceId',
+                'type' => Database::VAR_STRING,
+                'format' => '',
+                'size' => Database::LENGTH_KEY,
+                'signed' => true,
+                'required' => false,
+                'default' => null,
+                'array' => false,
+                'filters' => [],
+            ],
+            [
+                '$id' => 'resourceInternalId',
+                'type' => Database::VAR_STRING,
+                'format' => '',
+                'size' => Database::LENGTH_KEY,
+                'signed' => true,
+                'required' => false,
+                'default' => null,
+                'array' => false,
+                'filters' => [],
+            ],
            [
                '$id' => ID::custom('name'),
                'type' => Database::VAR_STRING,
@@ -718,6 +773,13 @@ return [
                'lengths' => [Database::LENGTH_KEY],
                'orders' => [Database::ORDER_ASC],
            ],
+            [
+                '$id' => '_key_resource',
+                'type' => Database::INDEX_KEY,
+                'attributes' => ['resourceType', 'resourceInternalId'],
+                'lengths' => [Database::LENGTH_KEY],
+                'orders' => [Database::ORDER_ASC],
+            ],
            [
                '$id' => '_key_accessedAt',
                'type' => Database::INDEX_KEY,
@@ -1362,21 +1424,21 @@ return [
                '$id' => '_key_type',
                'type' => Database::INDEX_KEY,
                'attributes' => ['type'],
-                'lengths' => [32],
+                'lengths' => [],
                'orders' => [Database::ORDER_ASC],
            ],
            [
                '$id' => '_key_trigger',
                'type' => Database::INDEX_KEY,
                'attributes' => ['trigger'],
-                'lengths' => [32],
+                'lengths' => [],
                'orders' => [Database::ORDER_ASC],
            ],
            [
                '$id' => '_key_deploymentResourceType',
                'type' => Database::INDEX_KEY,
                'attributes' => ['deploymentResourceType'],
-                'lengths' => [32],
+                'lengths' => [],
                'orders' => [Database::ORDER_ASC],
            ],
            [
@@ -1418,23 +1480,23 @@ return [
                '$id' => ID::custom('_key_owner'),
                'type' => Database::INDEX_KEY,
                'attributes' => ['owner'],
-                'lengths' => [16],
+                'lengths' => [],
                'orders' => [Database::ORDER_ASC],
            ],
            [
-                '$id' => ID::custom('_key_region'),
-                'type' => Database::INDEX_KEY,
-                'attributes' => ['region'],
-                'lengths' => [16],
-                'orders' => [Database::ORDER_ASC],
-            ],
-            [
-                '$id' => ID::custom('_key_piid_riid_rt'),
+                '$id' => ID::custom('_key_piid_diid_drt'),
                'type' => Database::INDEX_KEY,
                'attributes' => ['projectInternalId', 'deploymentInternalId', 'deploymentResourceType'],
                'lengths' => [],
                'orders' => [],
            ],
+            [
+                '$id' => '_key_region_status_createdAt',
+                'type' => Database::INDEX_KEY,
+                'attributes' => ['region', 'status', '$createdAt'],
+                'lengths' => [],
+                'orders' => [],
+            ],
        ],
    ],

@@ -1903,3 +1965,31 @@ return [
        'indexes' => []
    ],
 ];
+
+// Organization API keys subquery
+$platformCollections['teams']['attributes'][] = [
+    '$id' => ID::custom('keys'),
+    'type' => Database::VAR_STRING,
+    'format' => '',
+    'size' => 16384,
+    'signed' => true,
+    'required' => false,
+    'default' => null,
+    'array' => false,
+    'filters' => ['subQueryOrganizationKeys'],
+];
+
+// Account API keys subquery
+$platformCollections['users']['attributes'][] = [
+    '$id' => ID::custom('keys'),
+    'type' => Database::VAR_STRING,
+    'format' => '',
+    'size' => 16384,
+    'signed' => true,
+    'required' => false,
+    'default' => null,
+    'array' => false,
+    'filters' => ['subQueryAccountKeys'],
+];
+
+return $platformCollections;
@@ -2645,4 +2645,125 @@ return [
            ],
        ],
    ],
+
+    'payments_plans' => [
+        '$collection' => ID::custom(Database::METADATA),
+        '$id' => ID::custom('payments_plans'),
+        'name' => 'Payments Plans',
+        'attributes' => [
+            [ '$id' => ID::custom('planId'), 'type' => Database::VAR_STRING, 'size' => Database::LENGTH_KEY, 'signed' => true, 'required' => true, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('name'), 'type' => Database::VAR_STRING, 'size' => 2048, 'signed' => true, 'required' => false, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('description'), 'type' => Database::VAR_STRING, 'size' => 8192, 'signed' => true, 'required' => false, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('pricing'), 'type' => Database::VAR_STRING, 'size' => 65536, 'signed' => true, 'required' => false, 'default' => [], 'array' => false, 'filters' => ['json'] ],
+            [ '$id' => ID::custom('isDefault'), 'type' => Database::VAR_BOOLEAN, 'size' => 0, 'signed' => true, 'required' => false, 'default' => false, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('isFree'), 'type' => Database::VAR_BOOLEAN, 'size' => 0, 'signed' => true, 'required' => false, 'default' => false, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('status'), 'type' => Database::VAR_STRING, 'size' => 32, 'signed' => true, 'required' => false, 'default' => 'active', 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('providers'), 'type' => Database::VAR_STRING, 'size' => 65536, 'signed' => true, 'required' => false, 'default' => [], 'array' => false, 'filters' => ['json'] ],
+            [ '$id' => ID::custom('features'), 'type' => Database::VAR_STRING, 'size' => 65536, 'signed' => true, 'required' => false, 'default' => [], 'array' => false, 'filters' => ['json'] ],
+            [ '$id' => ID::custom('search'), 'type' => Database::VAR_STRING, 'size' => 16384, 'signed' => true, 'required' => false, 'default' => null, 'array' => false, 'filters' => [] ],
+        ],
+        'indexes' => [
+            [ '$id' => ID::custom('_key_plan'), 'type' => Database::INDEX_UNIQUE, 'attributes' => ['planId'], 'lengths' => [Database::LENGTH_KEY], 'orders' => [Database::ORDER_ASC] ],
+            [ '$id' => ID::custom('_key_status'), 'type' => Database::INDEX_KEY, 'attributes' => ['status'], 'lengths' => [32], 'orders' => [Database::ORDER_ASC] ],
+            [ '$id' => ID::custom('_fulltext_search'), 'type' => Database::INDEX_FULLTEXT, 'attributes' => ['search'], 'lengths' => [], 'orders' => [] ],
+        ],
+    ],
+
+    'payments_features' => [
+        '$collection' => ID::custom(Database::METADATA),
+        '$id' => ID::custom('payments_features'),
+        'name' => 'Payments Features',
+        'attributes' => [
+            [ '$id' => ID::custom('featureId'), 'type' => Database::VAR_STRING, 'size' => Database::LENGTH_KEY, 'signed' => true, 'required' => true, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('name'), 'type' => Database::VAR_STRING, 'size' => 2048, 'signed' => true, 'required' => false, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('type'), 'type' => Database::VAR_STRING, 'size' => 32, 'signed' => true, 'required' => true, 'default' => 'boolean', 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('description'), 'type' => Database::VAR_STRING, 'size' => 8192, 'signed' => true, 'required' => false, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('providers'), 'type' => Database::VAR_STRING, 'size' => 65536, 'signed' => true, 'required' => false, 'default' => [], 'array' => false, 'filters' => ['json'] ],
+        ],
+        'indexes' => [
+            [ '$id' => ID::custom('_key_feature'), 'type' => Database::INDEX_UNIQUE, 'attributes' => ['featureId'], 'lengths' => [Database::LENGTH_KEY], 'orders' => [Database::ORDER_ASC] ],
+            [ '$id' => ID::custom('_key_type'), 'type' => Database::INDEX_KEY, 'attributes' => ['type'], 'lengths' => [32], 'orders' => [Database::ORDER_ASC] ],
+        ],
+    ],
+
+    'payments_plan_features' => [
+        '$collection' => ID::custom(Database::METADATA),
+        '$id' => ID::custom('payments_plan_features'),
+        'name' => 'Payments Plan Features',
+        'attributes' => [
+            [ '$id' => ID::custom('planId'), 'type' => Database::VAR_STRING, 'size' => Database::LENGTH_KEY, 'signed' => true, 'required' => true, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('featureId'), 'type' => Database::VAR_STRING, 'size' => Database::LENGTH_KEY, 'signed' => true, 'required' => true, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('type'), 'type' => Database::VAR_STRING, 'size' => 32, 'signed' => true, 'required' => true, 'default' => 'boolean', 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('enabled'), 'type' => Database::VAR_BOOLEAN, 'size' => 0, 'signed' => true, 'required' => false, 'default' => true, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('currency'), 'type' => Database::VAR_STRING, 'size' => 8, 'signed' => true, 'required' => false, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('interval'), 'type' => Database::VAR_STRING, 'size' => 16, 'signed' => true, 'required' => false, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('includedUnits'), 'type' => Database::VAR_INTEGER, 'size' => 0, 'signed' => false, 'required' => false, 'default' => 0, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('tiersMode'), 'type' => Database::VAR_STRING, 'size' => 16, 'signed' => true, 'required' => false, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('tiers'), 'type' => Database::VAR_STRING, 'size' => 65536, 'signed' => true, 'required' => false, 'default' => [], 'array' => false, 'filters' => ['json'] ],
+            [ '$id' => ID::custom('usageCap'), 'type' => Database::VAR_INTEGER, 'size' => 0, 'signed' => false, 'required' => false, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('overagePrice'), 'type' => Database::VAR_INTEGER, 'size' => 0, 'signed' => false, 'required' => false, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('providers'), 'type' => Database::VAR_STRING, 'size' => 65536, 'signed' => true, 'required' => false, 'default' => [], 'array' => false, 'filters' => ['json'] ],
+            [ '$id' => ID::custom('metadata'), 'type' => Database::VAR_STRING, 'size' => 65536, 'signed' => true, 'required' => false, 'default' => [], 'array' => false, 'filters' => ['json'] ],
+        ],
+        'indexes' => [
+            [ '$id' => ID::custom('_key_unique'), 'type' => Database::INDEX_UNIQUE, 'attributes' => ['planId','featureId'], 'lengths' => [Database::LENGTH_KEY, Database::LENGTH_KEY], 'orders' => [Database::ORDER_ASC, Database::ORDER_ASC] ],
+            [ '$id' => ID::custom('_key_type'), 'type' => Database::INDEX_KEY, 'attributes' => ['type'], 'lengths' => [16], 'orders' => [Database::ORDER_ASC] ],
+        ],
+    ],
+
+    'payments_subscriptions' => [
+        '$collection' => ID::custom(Database::METADATA),
+        '$id' => ID::custom('payments_subscriptions'),
+        'name' => 'Payments Subscriptions',
+        'attributes' => [
+            [ '$id' => ID::custom('subscriptionId'), 'type' => Database::VAR_STRING, 'size' => Database::LENGTH_KEY, 'signed' => true, 'required' => true, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('providerSubscriptionId'), 'type' => Database::VAR_STRING, 'size' => Database::LENGTH_KEY, 'signed' => true, 'required' => false, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('providerCheckoutId'), 'type' => Database::VAR_STRING, 'size' => Database::LENGTH_KEY, 'signed' => true, 'required' => false, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('actorType'), 'type' => Database::VAR_STRING, 'size' => 16, 'signed' => true, 'required' => true, 'default' => 'user', 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('actorId'), 'type' => Database::VAR_STRING, 'size' => Database::LENGTH_KEY, 'signed' => true, 'required' => true, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('actorInternalId'), 'type' => Database::VAR_STRING, 'size' => Database::LENGTH_KEY, 'signed' => true, 'required' => true, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('planId'), 'type' => Database::VAR_STRING, 'size' => Database::LENGTH_KEY, 'signed' => true, 'required' => true, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('priceId'), 'type' => Database::VAR_STRING, 'size' => Database::LENGTH_KEY, 'signed' => true, 'required' => false, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('status'), 'type' => Database::VAR_STRING, 'size' => 32, 'signed' => true, 'required' => false, 'default' => 'active', 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('trialEndsAt'), 'type' => Database::VAR_DATETIME, 'size' => 0, 'signed' => false, 'required' => false, 'default' => null, 'array' => false, 'filters' => ['datetime'] ],
+            [ '$id' => ID::custom('currentPeriodStart'), 'type' => Database::VAR_DATETIME, 'size' => 0, 'signed' => false, 'required' => false, 'default' => null, 'array' => false, 'filters' => ['datetime'] ],
+            [ '$id' => ID::custom('currentPeriodEnd'), 'type' => Database::VAR_DATETIME, 'size' => 0, 'signed' => false, 'required' => false, 'default' => null, 'array' => false, 'filters' => ['datetime'] ],
+            [ '$id' => ID::custom('cancelAtPeriodEnd'), 'type' => Database::VAR_BOOLEAN, 'size' => 0, 'signed' => true, 'required' => false, 'default' => false, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('canceledAt'), 'type' => Database::VAR_DATETIME, 'size' => 0, 'signed' => false, 'required' => false, 'default' => null, 'array' => false, 'filters' => ['datetime'] ],
+            [ '$id' => ID::custom('providers'), 'type' => Database::VAR_STRING, 'size' => 65536, 'signed' => true, 'required' => false, 'default' => [], 'array' => false, 'filters' => ['json'] ],
+            [ '$id' => ID::custom('usageSummary'), 'type' => Database::VAR_STRING, 'size' => 65536, 'signed' => true, 'required' => false, 'default' => [], 'array' => false, 'filters' => ['json'] ],
+            [ '$id' => ID::custom('tags'), 'type' => Database::VAR_STRING, 'size' => Database::LENGTH_KEY, 'signed' => true, 'required' => false, 'default' => [], 'array' => true, 'filters' => [] ],
+            [ '$id' => ID::custom('search'), 'type' => Database::VAR_STRING, 'size' => 16384, 'signed' => true, 'required' => false, 'default' => null, 'array' => false, 'filters' => [] ],
+        ],
+        'indexes' => [
+            [ '$id' => ID::custom('_key_actor'), 'type' => Database::INDEX_KEY, 'attributes' => ['actorType','actorId'], 'lengths' => [16, Database::LENGTH_KEY], 'orders' => [Database::ORDER_ASC, Database::ORDER_ASC] ],
+            [ '$id' => ID::custom('_key_status'), 'type' => Database::INDEX_KEY, 'attributes' => ['status'], 'lengths' => [32], 'orders' => [Database::ORDER_ASC] ],
+            [ '$id' => ID::custom('_key_plan'), 'type' => Database::INDEX_KEY, 'attributes' => ['planId'], 'lengths' => [Database::LENGTH_KEY], 'orders' => [Database::ORDER_ASC] ],
+            [ '$id' => ID::custom('_key_provider_subscription'), 'type' => Database::INDEX_KEY, 'attributes' => ['providerSubscriptionId'], 'lengths' => [Database::LENGTH_KEY], 'orders' => [Database::ORDER_ASC] ],
+            [ '$id' => ID::custom('_key_provider_checkout'), 'type' => Database::INDEX_KEY, 'attributes' => ['providerCheckoutId'], 'lengths' => [Database::LENGTH_KEY], 'orders' => [Database::ORDER_ASC] ],
+            [ '$id' => ID::custom('_fulltext_search'), 'type' => Database::INDEX_FULLTEXT, 'attributes' => ['search'], 'lengths' => [], 'orders' => [] ],
+        ],
+    ],
+
+    'payments_usage_events' => [
+        '$collection' => ID::custom(Database::METADATA),
+        '$id' => ID::custom('payments_usage_events'),
+        'name' => 'Payments Usage Events',
+        'attributes' => [
+            [ '$id' => ID::custom('subscriptionId'), 'type' => Database::VAR_STRING, 'size' => Database::LENGTH_KEY, 'signed' => true, 'required' => true, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('actorType'), 'type' => Database::VAR_STRING, 'size' => 16, 'signed' => true, 'required' => true, 'default' => 'user', 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('actorId'), 'type' => Database::VAR_STRING, 'size' => Database::LENGTH_KEY, 'signed' => true, 'required' => true, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('planId'), 'type' => Database::VAR_STRING, 'size' => Database::LENGTH_KEY, 'signed' => true, 'required' => true, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('featureId'), 'type' => Database::VAR_STRING, 'size' => Database::LENGTH_KEY, 'signed' => true, 'required' => true, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('quantity'), 'type' => Database::VAR_INTEGER, 'size' => 0, 'signed' => false, 'required' => true, 'default' => 0, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('timestamp'), 'type' => Database::VAR_DATETIME, 'size' => 0, 'signed' => false, 'required' => true, 'default' => null, 'array' => false, 'filters' => ['datetime'] ],
+            [ '$id' => ID::custom('providerSyncState'), 'type' => Database::VAR_STRING, 'size' => 32, 'signed' => true, 'required' => false, 'default' => 'pending', 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('providerEventId'), 'type' => Database::VAR_STRING, 'size' => 256, 'signed' => true, 'required' => false, 'default' => null, 'array' => false, 'filters' => [] ],
+            [ '$id' => ID::custom('metadata'), 'type' => Database::VAR_STRING, 'size' => 65536, 'signed' => true, 'required' => false, 'default' => [], 'array' => false, 'filters' => ['json'] ],
+        ],
+        'indexes' => [
+            [ '$id' => ID::custom('_key_subscription_feature_time'), 'type' => Database::INDEX_KEY, 'attributes' => ['subscriptionId','featureId','timestamp'], 'lengths' => [Database::LENGTH_KEY, Database::LENGTH_KEY, 0], 'orders' => [Database::ORDER_ASC, Database::ORDER_ASC, Database::ORDER_ASC] ],
+            [ '$id' => ID::custom('_key_sync_state'), 'type' => Database::INDEX_KEY, 'attributes' => ['providerSyncState'], 'lengths' => [32], 'orders' => [Database::ORDER_ASC] ],
+        ],
+    ],
 ];
@@ -1329,4 +1329,46 @@ return [
        'description' => 'Target has an invalid provider type.',
        'code' => 400,
    ],
+
+    /** Payments */
+    Exception::PAYMENT_PLAN_NOT_FOUND => [
+        'name' => Exception::PAYMENT_PLAN_NOT_FOUND,
+        'description' => 'Payment plan with the requested ID could not be found.',
+        'code' => 404,
+    ],
+    Exception::PAYMENT_PLAN_ALREADY_EXISTS => [
+        'name' => Exception::PAYMENT_PLAN_ALREADY_EXISTS,
+        'description' => 'Payment plan with the requested ID already exists.',
+        'code' => 409,
+    ],
+    Exception::PAYMENT_SUBSCRIPTION_NOT_FOUND => [
+        'name' => Exception::PAYMENT_SUBSCRIPTION_NOT_FOUND,
+        'description' => 'Payment subscription with the requested ID could not be found.',
+        'code' => 404,
+    ],
+    Exception::PAYMENT_SUBSCRIPTION_ALREADY_EXISTS => [
+        'name' => Exception::PAYMENT_SUBSCRIPTION_ALREADY_EXISTS,
+        'description' => 'Payment subscription already exists for this actor.',
+        'code' => 409,
+    ],
+    Exception::PAYMENT_PROVIDER_NOT_CONFIGURED => [
+        'name' => Exception::PAYMENT_PROVIDER_NOT_CONFIGURED,
+        'description' => 'No payment provider has been configured for this project.',
+        'code' => 400,
+    ],
+    Exception::PAYMENT_PROVIDER_ALREADY_CONFIGURED => [
+        'name' => Exception::PAYMENT_PROVIDER_ALREADY_CONFIGURED,
+        'description' => 'Payment provider is already configured. Disconnect the existing provider before configuring a new one.',
+        'code' => 409,
+    ],
+    Exception::PAYMENT_WEBHOOK_FAILED => [
+        'name' => Exception::PAYMENT_WEBHOOK_FAILED,
+        'description' => 'Failed to create payment provider webhook.',
+        'code' => 500,
+    ],
+    Exception::PAYMENT_FEATURE_NOT_FOUND => [
+        'name' => Exception::PAYMENT_FEATURE_NOT_FOUND,
+        'description' => 'Payment feature with the requested ID could not be found.',
+        'code' => 404,
+    ],
 ];
@@ -462,4 +462,15 @@ return [
        'mock' => true,
        'class' => 'Appwrite\\Auth\\OAuth2\\Mock',
    ],
+    'mock-unverified' => [
+        'name' => 'MockUnverified',
+        'developers' => 'https://appwrite.io',
+        'icon' => 'icon-appwrite',
+        'enabled' => true,
+        'sandbox' => false,
+        'form' => false,
+        'beta' => false,
+        'mock' => true,
+        'class' => 'Appwrite\\Auth\\OAuth2\\MockUnverified',
+    ],
 ];
@@ -58,6 +58,8 @@ $admins = [
    'projects.write',
    'keys.read',
    'keys.write',
+    'devKeys.read',
+    'devKeys.write',
    'webhooks.read',
    'webhooks.write',
    'locale.read',
@@ -166,4 +166,13 @@ return [ // List of publicly visible scopes
    'tokens.write' => [
        'description' => 'Access to create, update, and delete your project\'s tokens',
    ],
+    'payments.read' => [
+        'description' => 'Access to read your project\'s payments data (plans, subscriptions, usage)'
+    ],
+    'payments.write' => [
+        'description' => 'Access to create, update, and delete your project\'s payments resources'
+    ],
+    'payments.subscribe' => [
+        'description' => 'Access to create and manage subscriptions as an actor (user/team)'
+    ],
 ];
@@ -116,6 +116,7 @@ return [
            [
                'key' => 'android',
                'name' => 'Android',
+                'namespace' => 'io.appwrite',
                'version' => '11.4.0',
                'url' => 'https://github.com/appwrite/sdk-for-android',
                'package' => 'https://search.maven.org/artifact/io.appwrite/sdk-for-android',
@@ -395,6 +396,7 @@ return [
            [
                'key' => 'kotlin',
                'name' => 'Kotlin',
+                'namespace' => 'io.appwrite',
                'version' => '13.1.0',
                'url' => 'https://github.com/appwrite/sdk-for-kotlin',
                'package' => 'https://search.maven.org/artifact/io.appwrite/sdk-for-kotlin',
@@ -20,7 +20,7 @@ return [
        'name' => 'Console',
        'subtitle' => '',
        'description' => '',
-        'controller' => 'web/console.php',
+        'controller' => '', // Uses modules
        'sdk' => false,
        'docs' => false,
        'docsUrl' => '',
@@ -146,7 +146,7 @@ return [
        'name' => 'Storage',
        'subtitle' => 'The Storage service allows you to manage your project files.',
        'description' => '/docs/services/storage.md',
-        'controller' => 'api/storage.php',
+        'controller' => '',
        'sdk' => true,
        'docs' => true,
        'docsUrl' => 'https://appwrite.io/docs/client/storage',
@@ -225,6 +225,19 @@ return [
        'icon' => '/images/services/functions.png',
        'platforms' => ['client', 'server', 'console'],
    ],
+    'payments' => [
+        'key' => 'payments',
+        'name' => 'Payments',
+        'subtitle' => 'Create and manage plans, subscriptions, usage and billing providers.',
+        'description' => '/docs/services/payments.md',
+        'controller' => '', // Uses modules
+        'sdk' => true,
+        'docs' => true,
+        'docsUrl' => '',
+        'tests' => false,
+        'optional' => true,
+        'icon' => '/images/services/databases.png',
+    ],
    'proxy' => [
        'key' => 'proxy',
        'name' => 'Proxy',
@@ -270,9 +283,9 @@ return [
    'console' => [
        'key' => 'console',
        'name' => 'Console',
-        'subtitle' => 'The Console service allows you to interact with console relevant informations.',
+        'subtitle' => 'The Console service allows you to interact with console relevant information.',
        'description' => '',
-        'controller' => 'api/console.php',
+        'controller' => '', // Uses modules
        'sdk' => true,
        'docs' => true,
        'docsUrl' => '',
@@ -3,6 +3,4 @@
 use Utopia\Image\Image;
 use Utopia\System\System;

-if (\class_exists('Imagick')) {
-    Image::setResourceLimit('memory', intval(System::getEnv('_APP_IMAGES_RESOURCE_LIMIT_MEMORY', 1024*1024*64)));
-}
+Image::setResourceLimit('memory', intval(System::getEnv('_APP_IMAGES_RESOURCE_LIMIT_MEMORY', 1024*1024*64)));
@@ -37,7 +37,7 @@ use libphonenumber\PhoneNumberUtil;
 use MaxMind\Db\Reader;
 use Utopia\Abuse\Abuse;
 use Utopia\App;
-use Utopia\Audit\Audit as EventAudit;
+use Utopia\Audit\Audit;
 use Utopia\Auth\Hashes\Sha;
 use Utopia\Auth\Proofs\Code as ProofsCode;
 use Utopia\Auth\Proofs\Password as ProofsPassword;
@@ -68,6 +68,7 @@ use Utopia\Validator;
 use Utopia\Validator\ArrayList;
 use Utopia\Validator\Assoc;
 use Utopia\Validator\Boolean;
+use Utopia\Validator\Range;
 use Utopia\Validator\Text;
 use Utopia\Validator\WhiteList;

@@ -206,10 +207,10 @@ function sendSessionAlert(Locale $locale, Document $user, Document $project, arr
 }


-$createSession = function (string $userId, string $secret, Request $request, Response $response, User $user, Database $dbForProject, Document $project, array $platform, Locale $locale, Reader $geodb, Event $queueForEvents, Mail $queueForMails, Store $store, ProofsToken $proofForToken, ProofsCode $proofForCode, Authorization $authorization) {
+$createSession = function (string $userId, string $secret, Request $request, Response $response, User $user, Database $dbForProject, Document $project, array $platform, Locale $locale, Reader $geodb, Event $queueForEvents, Mail $queueForMails, Store $store, ProofsToken $proofForToken, ProofsCode $proofForCode) {

    /** @var Appwrite\Utopia\Database\Documents\User $userFromRequest */
-    $userFromRequest = $authorization->skip(fn () => $dbForProject->getDocument('users', $userId));
+    $userFromRequest = Authorization::skip(fn () => $dbForProject->getDocument('users', $userId));

    if ($userFromRequest->isEmpty()) {
        throw new Exception(Exception::USER_INVALID_TOKEN);
@@ -265,7 +266,7 @@ $createSession = function (string $userId, string $secret, Request $request, Res
        $detector->getDevice()
    ));

-    $authorization->addRole(Role::user($user->getId())->toString());
+    Authorization::setRole(Role::user($user->getId())->toString());

    $session = $dbForProject->createDocument('sessions', $session
        ->setAttribute('$permissions', [
@@ -274,7 +275,7 @@ $createSession = function (string $userId, string $secret, Request $request, Res
            Permission::delete(Role::user($user->getId())),
        ]));

-    $authorization->skip(fn () => $dbForProject->deleteDocument('tokens', $verifiedToken->getId()));
+    Authorization::skip(fn () => $dbForProject->deleteDocument('tokens', $verifiedToken->getId()));
    $dbForProject->purgeCachedDocument('users', $user->getId());

    // Magic URL + Email OTP
@@ -375,9 +376,8 @@ App::post('/v1/account')
    ->inject('user')
    ->inject('project')
    ->inject('dbForProject')
-    ->inject('authorization')
    ->inject('hooks')
-    ->action(function (string $userId, string $email, string $password, string $name, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Authorization $authorization, Hooks $hooks) {
+    ->action(function (string $userId, string $email, string $password, string $name, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Hooks $hooks) {

        $email = \strtolower($email);
        if ('console' === $project->getId()) {
@@ -469,9 +469,9 @@ App::post('/v1/account')
            ]);

            $user->removeAttribute('$sequence');
-            $user = $authorization->skip(fn () => $dbForProject->createDocument('users', $user));
+            $user = Authorization::skip(fn () => $dbForProject->createDocument('users', $user));
            try {
-                $target = $authorization->skip(fn () => $dbForProject->createDocument('targets', new Document([
+                $target = Authorization::skip(fn () => $dbForProject->createDocument('targets', new Document([
                    '$permissions' => [
                        Permission::read(Role::user($user->getId())),
                        Permission::update(Role::user($user->getId())),
@@ -497,9 +497,9 @@ App::post('/v1/account')
            throw new Exception(Exception::USER_ALREADY_EXISTS);
        }

-        $authorization->removeRole(Role::guests()->toString());
-        $authorization->addRole(Role::user($user->getId())->toString());
-        $authorization->addRole(Role::users()->toString());
+        Authorization::unsetRole(Role::guests()->toString());
+        Authorization::setRole(Role::user($user->getId())->toString());
+        Authorization::setRole(Role::users()->toString());

        $response
            ->setStatusCode(Response::STATUS_CODE_CREATED)
@@ -959,6 +959,7 @@ App::post('/v1/account/sessions/email')
    ))
    ->label('abuse-limit', 10)
    ->label('abuse-key', 'url:{url},email:{param-email}')
+    ->label('abuse-reset', [201])
    ->param('email', '', new EmailValidator(), 'User email.')
    ->param('password', '', new Password(), 'User password. Must be at least 8 chars.')
    ->inject('request')
@@ -975,8 +976,7 @@ App::post('/v1/account/sessions/email')
    ->inject('store')
    ->inject('proofForPassword')
    ->inject('proofForToken')
-    ->inject('authorization')
-    ->action(function (string $email, string $password, Request $request, Response $response, User $user, Database $dbForProject, Document $project, array $platform, Locale $locale, Reader $geodb, Event $queueForEvents, Mail $queueForMails, Hooks $hooks, Store $store, ProofsPassword $proofForPassword, ProofsToken $proofForToken, Authorization $authorization) {
+    ->action(function (string $email, string $password, Request $request, Response $response, User $user, Database $dbForProject, Document $project, array $platform, Locale $locale, Reader $geodb, Event $queueForEvents, Mail $queueForMails, Hooks $hooks, Store $store, ProofsPassword $proofForPassword, ProofsToken $proofForToken) {
        $email = \strtolower($email);
        $protocol = $request->getProtocol();

@@ -1021,7 +1021,7 @@ App::post('/v1/account/sessions/email')
            $detector->getDevice()
        ));

-        $authorization->addRole(Role::user($user->getId())->toString());
+        Authorization::setRole(Role::user($user->getId())->toString());

        // Re-hash if not using recommended algo
        if ($user->getAttribute('hash') !== $proofForPassword->getHash()->getName()) {
@@ -1120,8 +1120,7 @@ App::post('/v1/account/sessions/anonymous')
    ->inject('store')
    ->inject('proofForPassword')
    ->inject('proofForToken')
-    ->inject('authorization')
-    ->action(function (Request $request, Response $response, Locale $locale, User $user, Document $project, Database $dbForProject, Reader $geodb, Event $queueForEvents, Store $store, ProofsPassword $proofForPassword, ProofsToken $proofForToken, Authorization $authorization) {
+    ->action(function (Request $request, Response $response, Locale $locale, User $user, Document $project, Database $dbForProject, Reader $geodb, Event $queueForEvents, Store $store, ProofsPassword $proofForPassword, ProofsToken $proofForToken) {
        $protocol = $request->getProtocol();

        if ('console' === $project->getId()) {
@@ -1166,7 +1165,7 @@ App::post('/v1/account/sessions/anonymous')
            'accessedAt' => DateTime::now(),
        ]);
        $user->removeAttribute('$sequence');
-        $user = $authorization->skip(fn () => $dbForProject->createDocument('users', $user));
+        Authorization::skip(fn () => $dbForProject->createDocument('users', $user));

        // Create session token
        $duration = $project->getAttribute('auths', [])['duration'] ?? TOKEN_EXPIRATION_LOGIN_LONG;
@@ -1192,7 +1191,7 @@ App::post('/v1/account/sessions/anonymous')
            $detector->getDevice()
        ));

-        $authorization->addRole(Role::user($user->getId())->toString());
+        Authorization::setRole(Role::user($user->getId())->toString());

        $session = $dbForProject->createDocument('sessions', $session->setAttribute('$permissions', [
            Permission::read(Role::user($user->getId())),
@@ -1259,6 +1258,7 @@ App::post('/v1/account/sessions/token')
    ))
    ->label('abuse-limit', 10)
    ->label('abuse-key', 'ip:{ip},userId:{param-userId}')
+    ->label('abuse-reset', [201])
    ->param('userId', '', new CustomId(), 'User ID. Choose a custom ID or generate a random ID with `ID.unique()`. Valid chars are a-z, A-Z, 0-9, period, hyphen, and underscore. Can\'t start with a special char. Max length is 36 chars.')
    ->param('secret', '', new Text(256), 'Secret of a token generated by login methods. For example, the `createMagicURLToken` or `createPhoneToken` methods.')
    ->inject('request')
@@ -1274,7 +1274,6 @@ App::post('/v1/account/sessions/token')
    ->inject('store')
    ->inject('proofForToken')
    ->inject('proofForCode')
->inject('authorization')
    ->action($createSession);

 App::get('/v1/account/sessions/oauth2/:provider')
@@ -1471,8 +1470,7 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect')
    ->inject('store')
    ->inject('proofForPassword')
    ->inject('proofForToken')
-    ->inject('authorization')
-    ->action(function (string $provider, string $code, string $state, string $error, string $error_description, Request $request, Response $response, Document $project, Validator $redirectValidator, Document $devKey, User $user, Database $dbForProject, Reader $geodb, Event $queueForEvents, Store $store, ProofsPassword $proofForPassword, ProofsToken $proofForToken, Authorization $authorization) use ($oauthDefaultSuccess) {
+    ->action(function (string $provider, string $code, string $state, string $error, string $error_description, Request $request, Response $response, Document $project, Validator $redirectValidator, Document $devKey, User $user, Database $dbForProject, Reader $geodb, Event $queueForEvents, Store $store, ProofsPassword $proofForPassword, ProofsToken $proofForToken) use ($oauthDefaultSuccess) {
        $protocol = System::getEnv('_APP_OPTIONS_FORCE_HTTPS') === 'disabled' ? 'http' : 'https';
        $port = $request->getPort();
        $callbackBase = $protocol . '://' . $request->getHostname();
@@ -1639,9 +1637,6 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect')
                $failureRedirect(Exception::USER_UNAUTHORIZED, 'OAuth provider failed to return email.');
            }

-            /**
-             * Is verified is not used yet, since we don't know after an account is created anymore if it was verified or not.
-             */
            $isVerified = $oauth2->isEmailVerified($accessToken);

            $identity = $dbForProject->findOne('identities', [
@@ -1653,16 +1648,32 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect')
                $user = $dbForProject->getDocument('users', $identity->getAttribute('userId'));
            }

-            // If user is not found, check if there is an identity with the same provider user ID
+            // If user is not found, check if there is a user with the same email
            if ($user === false || $user->isEmpty()) {
                $userWithEmail = $dbForProject->findOne('users', [
                    Query::equal('email', [$email]),
                ]);
                if (!$userWithEmail->isEmpty()) {
+                    if (!$isVerified) {
+                        $failureRedirect(Exception::GENERAL_BAD_REQUEST);
+                    }
                    $user->setAttributes($userWithEmail->getArrayCopy());
                }
            }

+            // If user is not found, check if there is an identity with the same email
+            if ($user === false || $user->isEmpty()) {
+                $identityWithMatchingEmail = $dbForProject->findOne('identities', [
+                    Query::equal('providerEmail', [$email]),
+                ]);
+                if (!$identityWithMatchingEmail->isEmpty()) {
+                    if (!$isVerified) {
+                        $failureRedirect(Exception::GENERAL_BAD_REQUEST);
+                    }
+                    $user->setAttributes($dbForProject->getDocument('users', $identityWithMatchingEmail->getAttribute('userId'))->getArrayCopy());
+                }
+            }
+
            if ($user === false || $user->isEmpty()) { // Last option -> create the user
                $limit = $project->getAttribute('auths', [])['limit'] ?? 0;

@@ -1674,14 +1685,6 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect')
                    }
                }

-                // Makes sure this email is not already used in another identity
-                $identityWithMatchingEmail = $dbForProject->findOne('identities', [
-                    Query::equal('providerEmail', [$email]),
-                ]);
-                if (!$identityWithMatchingEmail->isEmpty()) {
-                    $failureRedirect(Exception::GENERAL_BAD_REQUEST); /** Return a generic bad request to prevent exposing existing accounts */
-                }
-
                try {
                    $emailCanonical = new Email($email);
                } catch (Throwable) {
@@ -1723,7 +1726,7 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect')
                    ]);

                    $user->removeAttribute('$sequence');
-                    $userDoc = $authorization->skip(fn () => $dbForProject->createDocument('users', $user));
+                    $userDoc = Authorization::skip(fn () => $dbForProject->createDocument('users', $user));
                    $dbForProject->createDocument('targets', new Document([
                        '$permissions' => [
                            Permission::read(Role::user($user->getId())),
@@ -1735,15 +1738,14 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect')
                        'providerType' => MESSAGE_TYPE_EMAIL,
                        'identifier' => $email,
                    ]));
-
                } catch (Duplicate) {
                    $failureRedirect(Exception::USER_ALREADY_EXISTS);
                }
            }
        }

-        $authorization->addRole(Role::user($user->getId())->toString());
-        $authorization->addRole(Role::users()->toString());
+        Authorization::setRole(Role::user($user->getId())->toString());
+        Authorization::setRole(Role::users()->toString());

        if (false === $user->getAttribute('status')) { // Account is blocked
            $failureRedirect(Exception::USER_BLOCKED); // User is in status blocked
@@ -1814,7 +1816,7 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect')

        $dbForProject->updateDocument('users', $user->getId(), $user);

-        $authorization->addRole(Role::user($user->getId())->toString());
+        Authorization::setRole(Role::user($user->getId())->toString());

        $state['success'] = URLParser::parse($state['success']);
        $query = URLParser::parseQuery($state['success']['query']);
@@ -1838,7 +1840,7 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect')
                'ip' => $request->getIP(),
            ]);

-            $authorization->addRole(Role::user($user->getId())->toString());
+            Authorization::setRole(Role::user($user->getId())->toString());

            $token = $dbForProject->createDocument('tokens', $token
                ->setAttribute('$permissions', [
@@ -2075,8 +2077,7 @@ App::post('/v1/account/tokens/magic-url')
    ->inject('queueForMails')
    ->inject('proofForPassword')
    ->inject('platform')
-    ->inject('authorization')
-    ->action(function (string $userId, string $email, string $url, bool $phrase, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Locale $locale, Event $queueForEvents, Mail $queueForMails, ProofsPassword $proofForPassword, array $platform, Authorization $authorization) {
+    ->action(function (string $userId, string $email, string $url, bool $phrase, Request $request, Response $response, User $user, Document $project, Database $dbForProject, Locale $locale, Event $queueForEvents, Mail $queueForMails, ProofsPassword $proofForPassword, array $platform) {
        if (empty(System::getEnv('_APP_SMTP_HOST'))) {
            throw new Exception(Exception::GENERAL_SMTP_DISABLED, 'SMTP disabled');
        }
@@ -2149,7 +2150,7 @@ App::post('/v1/account/tokens/magic-url')
            ]);

            $user->removeAttribute('$sequence');
-            $user = $authorization->skip(fn () => $dbForProject->createDocument('users', $user));
+            Authorization::skip(fn () => $dbForProject->createDocument('users', $user));
        }

        $proofForToken = new ProofsToken(TOKEN_LENGTH_MAGIC_URL);
@@ -2169,7 +2170,7 @@ App::post('/v1/account/tokens/magic-url')
            'ip' => $request->getIP(),
        ]);

-        $authorization->addRole(Role::user($user->getId())->toString());
+        Authorization::setRole(Role::user($user->getId())->toString());

        $token = $dbForProject->createDocument('tokens', $token
            ->setAttribute('$permissions', [
@@ -2355,8 +2356,7 @@ App::post('/v1/account/tokens/email')
    ->inject('queueForMails')
    ->inject('proofForPassword')
    ->inject('proofForCode')
-    ->inject('authorization')
-    ->action(function (string $userId, string $email, bool $phrase, Request $request, Response $response, User $user, Document $project, array $platform, Database $dbForProject, Locale $locale, Event $queueForEvents, Mail $queueForMails, ProofsPassword $proofForPassword, ProofsCode $proofForCode, Authorization $authorization) {
+    ->action(function (string $userId, string $email, bool $phrase, Request $request, Response $response, User $user, Document $project, array $platform, Database $dbForProject, Locale $locale, Event $queueForEvents, Mail $queueForMails, ProofsPassword $proofForPassword, ProofsCode $proofForCode) {
        if (empty(System::getEnv('_APP_SMTP_HOST'))) {
            throw new Exception(Exception::GENERAL_SMTP_DISABLED, 'SMTP disabled');
        }
@@ -2425,9 +2425,9 @@ App::post('/v1/account/tokens/email')
            ]);

            $user->removeAttribute('$sequence');
-            $user = $authorization->skip(fn () => $dbForProject->createDocument('users', $user));
+            $user = Authorization::skip(fn () => $dbForProject->createDocument('users', $user));
            try {
-                $target = $authorization->skip(fn () => $dbForProject->createDocument('targets', new Document([
+                $target = Authorization::skip(fn () => $dbForProject->createDocument('targets', new Document([
                    '$permissions' => [
                        Permission::read(Role::user($user->getId())),
                        Permission::update(Role::user($user->getId())),
@@ -2465,7 +2465,7 @@ App::post('/v1/account/tokens/email')
            'ip' => $request->getIP(),
        ]);

-        $authorization->addRole(Role::user($user->getId())->toString());
+        Authorization::setRole(Role::user($user->getId())->toString());

        $token = $dbForProject->createDocument('tokens', $token
            ->setAttribute('$permissions', [
@@ -2647,6 +2647,7 @@ App::put('/v1/account/sessions/magic-url')
    ))
    ->label('abuse-limit', 10)
    ->label('abuse-key', 'ip:{ip},userId:{param-userId}')
+    ->label('abuse-reset', [201])
    ->param('userId', '', new CustomId(), 'User ID. Choose a custom ID or generate a random ID with `ID.unique()`. Valid chars are a-z, A-Z, 0-9, period, hyphen, and underscore. Can\'t start with a special char. Max length is 36 chars.')
    ->param('secret', '', new Text(256), 'Valid verification token.')
    ->inject('request')
@@ -2661,11 +2662,10 @@ App::put('/v1/account/sessions/magic-url')
    ->inject('queueForMails')
    ->inject('store')
    ->inject('proofForCode')
-    ->inject('authorization')
-    ->action(function ($userId, $secret, $request, $response, $user, $dbForProject, $project, $platform, $locale, $geodb, $queueForEvents, $queueForMails, $store, $proofForCode, $authorization) use ($createSession) {
+    ->action(function ($userId, $secret, $request, $response, $user, $dbForProject, $project, $platform, $locale, $geodb, $queueForEvents, $queueForMails, $store, $proofForCode) use ($createSession) {
        $proofForToken = new ProofsToken(TOKEN_LENGTH_MAGIC_URL);
        $proofForToken->setHash(new Sha());
-        $createSession($userId, $secret, $request, $response, $user, $dbForProject, $project, $platform, $locale, $geodb, $queueForEvents, $queueForMails, $store, $proofForToken, $proofForCode, $authorization);
+        $createSession($userId, $secret, $request, $response, $user, $dbForProject, $project, $platform, $locale, $geodb, $queueForEvents, $queueForMails, $store, $proofForToken, $proofForCode);
    });

 App::put('/v1/account/sessions/phone')
@@ -2711,7 +2711,6 @@ App::put('/v1/account/sessions/phone')
    ->inject('store')
    ->inject('proofForToken')
    ->inject('proofForCode')
-    ->inject('authorization')
    ->action($createSession);

 App::post('/v1/account/tokens/phone')
@@ -2755,8 +2754,7 @@ App::post('/v1/account/tokens/phone')
    ->inject('plan')
    ->inject('store')
    ->inject('proofForCode')
-    ->inject('authorization')
-    ->action(function (string $userId, string $phone, Request $request, Response $response, User $user, Document $project, array $platform, Database $dbForProject, Event $queueForEvents, Messaging $queueForMessaging, Locale $locale, callable $timelimit, StatsUsage $queueForStatsUsage, array $plan, Store $store, ProofsCode $proofForCode, Authorization $authorization) {
+    ->action(function (string $userId, string $phone, Request $request, Response $response, User $user, Document $project, array $platform, Database $dbForProject, Event $queueForEvents, Messaging $queueForMessaging, Locale $locale, callable $timelimit, StatsUsage $queueForStatsUsage, array $plan, Store $store, ProofsCode $proofForCode) {
        if (empty(System::getEnv('_APP_SMS_PROVIDER'))) {
            throw new Exception(Exception::GENERAL_PHONE_DISABLED, 'Phone provider not configured');
        }
@@ -2806,9 +2804,9 @@ App::post('/v1/account/tokens/phone')
            ]);

            $user->removeAttribute('$sequence');
-            $user = $authorization->skip(fn () => $dbForProject->createDocument('users', $user));
+            Authorization::skip(fn () => $dbForProject->createDocument('users', $user));
            try {
-                $target = $authorization->skip(fn () => $dbForProject->createDocument('targets', new Document([
+                $target = Authorization::skip(fn () => $dbForProject->createDocument('targets', new Document([
                    '$permissions' => [
                        Permission::read(Role::user($user->getId())),
                        Permission::update(Role::user($user->getId())),
@@ -2854,7 +2852,7 @@ App::post('/v1/account/tokens/phone')
            'ip' => $request->getIP(),
        ]);

-        $authorization->addRole(Role::user($user->getId())->toString());
+        Authorization::setRole(Role::user($user->getId())->toString());

        $token = $dbForProject->createDocument('tokens', $token
            ->setAttribute('$permissions', [
@@ -2959,20 +2957,22 @@ App::post('/v1/account/jwts')
        ],
        contentType: ContentType::JSON,
    ))
-    ->label('abuse-limit', 100)
+    ->param('duration', 900, new Range(0, 3600), 'Time in seconds before JWT expires. Default duration is 900 seconds, and maximum is 3600 seconds.', true)
+    ->label('abuse-limit', APP_LIMIT_WRITE_RATE_DEFAULT * 2)
+    ->label('abuse-time', APP_LIMIT_WRITE_RATE_PERIOD_DEFAULT)
    ->label('abuse-key', 'url:{url},userId:{userId}')
    ->inject('response')
    ->inject('user')
    ->inject('store')
    ->inject('proofForToken')
-    ->action(function (Response $response, User $user, Store $store, ProofsToken $proofForToken) {
+    ->action(function (int $duration, Response $response, User $user, Store $store, ProofsToken $proofForToken) {
        $sessionId = $user->sessionVerify($store->getProperty('secret', ''), $proofForToken);

        if (!$sessionId) {
            throw new Exception(Exception::USER_SESSION_NOT_FOUND);
        }

-        $jwt = new JWT(System::getEnv('_APP_OPENSSL_KEY_V1'), 'HS256', 900, 0);
+        $jwt = new JWT(System::getEnv('_APP_OPENSSL_KEY_V1'), 'HS256', $duration, 0);

        $response
            ->setStatusCode(Response::STATUS_CODE_CREATED)
@@ -3036,7 +3036,8 @@ App::get('/v1/account/logs')
    ->inject('locale')
    ->inject('geodb')
    ->inject('dbForProject')
-    ->action(function (array $queries, bool $includeTotal, Response $response, Document $user, Locale $locale, Reader $geodb, Database $dbForProject) {
+    ->inject('audit')
+    ->action(function (array $queries, bool $includeTotal, Response $response, Document $user, Locale $locale, Reader $geodb, Database $dbForProject, Audit $audit) {

        try {
            $queries = Query::parseQueries($queries);
@@ -3044,9 +3045,10 @@ App::get('/v1/account/logs')
            throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
        }

-        $audit = new EventAudit($dbForProject);
-
-        $logs = $audit->getLogsByUser($user->getSequence(), $queries);
+        $grouped = Query::groupByType($queries);
+        $limit = $grouped['limit'] ?? 25;
+        $offset = $grouped['offset'] ?? 0;
+        $logs = $audit->getLogsByUser($user->getSequence(), offset: $offset, limit: $limit);

        $output = [];

@@ -3075,7 +3077,7 @@ App::get('/v1/account/logs')
        }

        $response->dynamic(new Document([
-            'total' => $includeTotal ? $audit->countLogsByUser($user->getSequence(), $queries) : 0,
+            'total' => $includeTotal ? $audit->countLogsByUser($user->getSequence()) : 0,
            'logs' => $output,
        ]), Response::MODEL_LOG_LIST);
    });
@@ -3241,8 +3243,7 @@ App::patch('/v1/account/email')
    ->inject('project')
    ->inject('hooks')
    ->inject('proofForPassword')
- ->inject('authorization')
-    ->action(function (string $email, string $password, ?\DateTime $requestTimestamp, Response $response, User $user, Database $dbForProject, Event $queueForEvents, Document $project, Hooks $hooks, ProofsPassword $proofForPassword, Authorization $authorization) {
+    ->action(function (string $email, string $password, ?\DateTime $requestTimestamp, Response $response, User $user, Database $dbForProject, Event $queueForEvents, Document $project, Hooks $hooks, ProofsPassword $proofForPassword) {
        // passwordUpdate will be empty if the user has never set a password
        $passwordUpdate = $user->getAttribute('passwordUpdate');

@@ -3294,7 +3295,7 @@ App::patch('/v1/account/email')
                ->setAttribute('passwordUpdate', DateTime::now());
        }

-        $target = $authorization->skip(fn () => $dbForProject->findOne('targets', [
+        $target = Authorization::skip(fn () => $dbForProject->findOne('targets', [
            Query::equal('identifier', [$email]),
        ]));

@@ -3310,7 +3311,7 @@ App::patch('/v1/account/email')
            $oldTarget = $user->find('identifier', $oldEmail, 'targets');

            if ($oldTarget instanceof Document && !$oldTarget->isEmpty()) {
-                $authorization->skip(fn () => $dbForProject->updateDocument('targets', $oldTarget->getId(), $oldTarget->setAttribute('identifier', $email)));
+                Authorization::skip(fn () => $dbForProject->updateDocument('targets', $oldTarget->getId(), $oldTarget->setAttribute('identifier', $email)));
            }
            $dbForProject->purgeCachedDocument('users', $user->getId());
        } catch (Duplicate) {
@@ -3351,9 +3352,8 @@ App::patch('/v1/account/phone')
    ->inject('queueForEvents')
    ->inject('project')
    ->inject('hooks')
-                ->inject('proofForPassword')
->inject('authorization')
-    ->action(function (string $phone, string $password, Response $response, Document $user, Database $dbForProject, Event $queueForEvents, Document $project, Hooks $hooks, ProofsPassword $proofForPassword, Authorization $authorization) {
+    ->inject('proofForPassword')
+    ->action(function (string $phone, string $password, Response $response, User $user, Database $dbForProject, Event $queueForEvents, Document $project, Hooks $hooks, ProofsPassword $proofForPassword) {
        // passwordUpdate will be empty if the user has never set a password
        $passwordUpdate = $user->getAttribute('passwordUpdate');

@@ -3368,7 +3368,7 @@ App::patch('/v1/account/phone')

        $hooks->trigger('passwordValidator', [$dbForProject, $project, $password, &$user, false]);

-        $target = $authorization->skip(fn () => $dbForProject->findOne('targets', [
+        $target = Authorization::skip(fn () => $dbForProject->findOne('targets', [
            Query::equal('identifier', [$phone]),
        ]));

@@ -3399,7 +3399,7 @@ App::patch('/v1/account/phone')
            $oldTarget = $user->find('identifier', $oldPhone, 'targets');

            if ($oldTarget instanceof Document && !$oldTarget->isEmpty()) {
-                $authorization->skip(fn () => $dbForProject->updateDocument('targets', $oldTarget->getId(), $oldTarget->setAttribute('identifier', $phone)));
+                Authorization::skip(fn () => $dbForProject->updateDocument('targets', $oldTarget->getId(), $oldTarget->setAttribute('identifier', $phone)));
            }
            $dbForProject->purgeCachedDocument('users', $user->getId());
        } catch (Duplicate $th) {
@@ -3535,9 +3535,7 @@ App::post('/v1/account/recovery')
    ->inject('queueForMails')
    ->inject('queueForEvents')
    ->inject('proofForToken')
-    ->inject('authorization')
-    ->action(function (string $email, string $url, Request $request, Response $response, User $user, Database $dbForProject, Document $project, array $platform, Locale $locale, Mail $queueForMails, Event $queueForEvents, ProofsToken $proofForToken, Authorization $authorization) {
-
+    ->action(function (string $email, string $url, Request $request, Response $response, User $user, Database $dbForProject, Document $project, array $platform, Locale $locale, Mail $queueForMails, Event $queueForEvents, ProofsToken $proofForToken) {
        if (empty(System::getEnv('_APP_SMTP_HOST'))) {
            throw new Exception(Exception::GENERAL_SMTP_DISABLED, 'SMTP Disabled');
        }
@@ -3573,7 +3571,7 @@ App::post('/v1/account/recovery')
            'ip' => $request->getIP(),
        ]);

-        $authorization->addRole(Role::user($profile->getId())->toString());
+        Authorization::setRole(Role::user($profile->getId())->toString());

        $recovery = $dbForProject->createDocument('tokens', $recovery
            ->setAttribute('$permissions', [
@@ -3729,8 +3727,7 @@ App::put('/v1/account/recovery')
    ->inject('hooks')
    ->inject('proofForPassword')
    ->inject('proofForToken')
->inject('authorization')
-    ->action(function (string $userId, string $secret, string $password, Response $response, User $user, Database $dbForProject, Document $project, Event $queueForEvents, Hooks $hooks, ProofsPassword $proofForPassword, ProofsToken $proofForToken, Authorization $authorization) {
+    ->action(function (string $userId, string $secret, string $password, Response $response, User $user, Database $dbForProject, Document $project, Event $queueForEvents, Hooks $hooks, ProofsPassword $proofForPassword, ProofsToken $proofForToken) {
        /** @var Appwrite\Utopia\Database\Documents\User $profile */
        $profile = $dbForProject->getDocument('users', $userId);

@@ -3744,7 +3741,7 @@ App::put('/v1/account/recovery')
            throw new Exception(Exception::USER_INVALID_TOKEN);
        }

-        $authorization->addRole(Role::user($profile->getId())->toString());
+        Authorization::setRole(Role::user($profile->getId())->toString());

        $newPassword = $proofForPassword->hash($password);

@@ -3847,8 +3844,7 @@ App::post('/v1/account/verifications/email')
    ->inject('queueForEvents')
    ->inject('queueForMails')
    ->inject('proofForToken')
-    ->inject('authorization')
-    ->action(function (string $url, Request $request, Response $response, Document $project, array $platform, User $user, Database $dbForProject, Locale $locale, Event $queueForEvents, Mail $queueForMails, ProofsToken $proofForToken, Authorization $authorization) {
+    ->action(function (string $url, Request $request, Response $response, Document $project, array $platform, User $user, Database $dbForProject, Locale $locale, Event $queueForEvents, Mail $queueForMails, ProofsToken $proofForToken) {

        if (empty(System::getEnv('_APP_SMTP_HOST'))) {
            throw new Exception(Exception::GENERAL_SMTP_DISABLED, 'SMTP Disabled');
@@ -3877,7 +3873,7 @@ App::post('/v1/account/verifications/email')
            'ip' => $request->getIP(),
        ]);

-        $authorization->addRole(Role::user($user->getId())->toString());
+        Authorization::setRole(Role::user($user->getId())->toString());

        $verification = $dbForProject->createDocument('tokens', $verification
            ->setAttribute('$permissions', [
@@ -4076,10 +4072,9 @@ App::put('/v1/account/verifications/email')
    ->inject('dbForProject')
    ->inject('queueForEvents')
    ->inject('proofForToken')
-    ->inject('authorization')
-    ->action(function (string $userId, string $secret, Response $response, User $user, Database $dbForProject, Event $queueForEvents, ProofsToken $proofForToken, Authorization $authorization) {
+    ->action(function (string $userId, string $secret, Response $response, User $user, Database $dbForProject, Event $queueForEvents, ProofsToken $proofForToken) {
        /** @var Appwrite\Utopia\Database\Documents\User $profile */
-        $profile = $authorization->skip(fn () => $dbForProject->getDocument('users', $userId));
+        $profile = Authorization::skip(fn () => $dbForProject->getDocument('users', $userId));

        if ($profile->isEmpty()) {
            throw new Exception(Exception::USER_NOT_FOUND);
@@ -4091,7 +4086,7 @@ App::put('/v1/account/verifications/email')
            throw new Exception(Exception::USER_INVALID_TOKEN);
        }

-        $authorization->addRole(Role::user($profile->getId())->toString());
+        Authorization::setRole(Role::user($profile->getId())->toString());

        $profile = $dbForProject->updateDocument('users', $profile->getId(), $profile->setAttribute('emailVerification', true));

@@ -4151,8 +4146,7 @@ App::post('/v1/account/verifications/phone')
    ->inject('queueForStatsUsage')
    ->inject('plan')
    ->inject('proofForCode')
-                ->inject('authorization')
-    ->action(function (Request $request, Response $response, User $user, Database $dbForProject, Event $queueForEvents, Messaging $queueForMessaging, Document $project, Locale $locale, callable $timelimit, StatsUsage $queueForStatsUsage, array $plan, ProofsCode $proofForCode, Authorization $authorization) {
+    ->action(function (Request $request, Response $response, User $user, Database $dbForProject, Event $queueForEvents, Messaging $queueForMessaging, Document $project, Locale $locale, callable $timelimit, StatsUsage $queueForStatsUsage, array $plan, ProofsCode $proofForCode) {
        if (empty(System::getEnv('_APP_SMS_PROVIDER'))) {
            throw new Exception(Exception::GENERAL_PHONE_DISABLED, 'Phone provider not configured');
        }
@@ -4191,7 +4185,7 @@ App::post('/v1/account/verifications/phone')
            'ip' => $request->getIP(),
        ]);

-        $authorization->addRole(Role::user($user->getId())->toString());
+        Authorization::setRole(Role::user($user->getId())->toString());

        $verification = $dbForProject->createDocument('tokens', $verification
            ->setAttribute('$permissions', [
@@ -4297,10 +4291,9 @@ App::put('/v1/account/verifications/phone')
    ->inject('dbForProject')
    ->inject('queueForEvents')
    ->inject('proofForCode')
-    ->inject('authorization')
-    ->action(function (string $userId, string $secret, Response $response, User $user, Database $dbForProject, Event $queueForEvents, ProofsCode $proofForCode, Authorization $authorization) {
+    ->action(function (string $userId, string $secret, Response $response, User $user, Database $dbForProject, Event $queueForEvents, ProofsCode $proofForCode) {
        /** @var Appwrite\Utopia\Database\Documents\User  $profile */
-        $profile = $authorization->skip(fn () => $dbForProject->getDocument('users', $userId));
+        $profile = Authorization::skip(fn () => $dbForProject->getDocument('users', $userId));

        if ($profile->isEmpty()) {
            throw new Exception(Exception::USER_NOT_FOUND);
@@ -4312,7 +4305,7 @@ App::put('/v1/account/verifications/phone')
            throw new Exception(Exception::USER_INVALID_TOKEN);
        }

-        $authorization->addRole(Role::user($profile->getId())->toString());
+        Authorization::setRole(Role::user($profile->getId())->toString());

        $profile = $dbForProject->updateDocument('users', $profile->getId(), $profile->setAttribute('phoneVerification', true));

@@ -4365,13 +4358,12 @@ App::post('/v1/account/targets/push')
    ->inject('dbForProject')
    ->inject('store')
    ->inject('proofForToken')
-    ->inject('authorization')
-    ->action(function (string $targetId, string $identifier, string $providerId, Event $queueForEvents, User $user, Request $request, Response $response, Database $dbForProject, Store $store, ProofsToken $proofForToken, Authorization $authorization) {
+    ->action(function (string $targetId, string $identifier, string $providerId, Event $queueForEvents, User $user, Request $request, Response $response, Database $dbForProject, Store $store, ProofsToken $proofForToken) {
        $targetId = $targetId == 'unique()' ? ID::unique() : $targetId;

-        $provider = $authorization->skip(fn () => $dbForProject->getDocument('providers', $providerId));
+        $provider = Authorization::skip(fn () => $dbForProject->getDocument('providers', $providerId));

-        $target = $authorization->skip(fn () => $dbForProject->getDocument('targets', $targetId));
+        $target = Authorization::skip(fn () => $dbForProject->getDocument('targets', $targetId));

        if (!$target->isEmpty()) {
            throw new Exception(Exception::USER_TARGET_ALREADY_EXISTS);
@@ -4446,10 +4438,9 @@ App::put('/v1/account/targets/:targetId/push')
    ->inject('request')
    ->inject('response')
    ->inject('dbForProject')
-    ->inject('authorization')
-    ->action(function (string $targetId, string $identifier, Event $queueForEvents, Document $user, Request $request, Response $response, Database $dbForProject, Authorization $authorization) {
+    ->action(function (string $targetId, string $identifier, Event $queueForEvents, Document $user, Request $request, Response $response, Database $dbForProject) {

-        $target = $authorization->skip(fn () => $dbForProject->getDocument('targets', $targetId));
+        $target = Authorization::skip(fn () => $dbForProject->getDocument('targets', $targetId));

        if ($target->isEmpty()) {
            throw new Exception(Exception::USER_TARGET_NOT_FOUND);
@@ -4512,9 +4503,8 @@ App::delete('/v1/account/targets/:targetId/push')
    ->inject('request')
    ->inject('response')
    ->inject('dbForProject')
-    ->inject('authorization')
-    ->action(function (string $targetId, Event $queueForEvents, Delete $queueForDeletes, Document $user, Request $request, Response $response, Database $dbForProject, Authorization $authorization) {
-        $target = $authorization->skip(fn () => $dbForProject->getDocument('targets', $targetId));
+    ->action(function (string $targetId, Event $queueForEvents, Delete $queueForDeletes, Document $user, Request $request, Response $response, Database $dbForProject) {
+        $target = Authorization::skip(fn () => $dbForProject->getDocument('targets', $targetId));

        if ($target->isEmpty()) {
            throw new Exception(Exception::USER_TARGET_NOT_FOUND);
@@ -70,9 +70,9 @@ $avatarCallback = function (string $type, string $code, int $width, int $height,
    unset($image);
 };

-$getUserGitHub = function (string $userId, Document $project, Database $dbForProject, Database $dbForPlatform, Authorization $authorization, ?Logger $logger) {
+$getUserGitHub = function (string $userId, Document $project, Database $dbForProject, Database $dbForPlatform, ?Logger $logger) {
    try {
-        $user = $authorization->skip(fn () => $dbForPlatform->getDocument('users', $userId));
+        $user = Authorization::skip(fn () => $dbForPlatform->getDocument('users', $userId));

        $sessions = $user->getAttribute('sessions', []);

@@ -123,7 +123,7 @@ $getUserGitHub = function (string $userId, Document $project, Database $dbForPro
                    ->setAttribute('providerRefreshToken', $refreshToken)
                    ->setAttribute('providerAccessTokenExpiry', DateTime::addSeconds(new \DateTime(), (int)$oauth2->getAccessTokenExpiry('')));

-                $authorization->skip(fn () => $dbForProject->updateDocument('sessions', $gitHubSession->getId(), $gitHubSession));
+                Authorization::skip(fn () => $dbForProject->updateDocument('sessions', $gitHubSession->getId(), $gitHubSession));

                $dbForProject->purgeCachedDocument('users', $user->getId());
            } catch (Throwable $err) {
@@ -131,7 +131,7 @@ $getUserGitHub = function (string $userId, Document $project, Database $dbForPro
                do {
                    $previousAccessToken = $gitHubSession->getAttribute('providerAccessToken');

-                    $user = $authorization->skip(fn () => $dbForPlatform->getDocument('users', $userId));
+                    $user = Authorization::skip(fn () => $dbForPlatform->getDocument('users', $userId));
                    $sessions = $user->getAttribute('sessions', []);

                    $gitHubSession = new Document();
@@ -697,7 +697,7 @@ App::get('/v1/avatars/screenshots')
        }

        $client = new Client();
-        $client->setTimeout(30);
+        $client->setTimeout(30 * 1000); // 30 seconds
        $client->addHeader('content-type', Client::CONTENT_TYPE_APPLICATION_JSON);

        // Convert indexed array to empty array (should not happen due to Assoc validator)
@@ -841,9 +841,8 @@ App::get('/v1/cards/cloud')
    ->inject('contributors')
    ->inject('employees')
    ->inject('logger')
-    ->inject('authorization')
-    ->action(function (string $userId, string $mock, int $width, int $height, Document $user, Document $project, Database $dbForProject, Database $dbForPlatform, Response $response, array $heroes, array $contributors, array $employees, ?Logger $logger, Authorization $authorization) use ($getUserGitHub) {
-        $user = $authorization->skip(fn () => $dbForPlatform->getDocument('users', $userId));
+    ->action(function (string $userId, string $mock, int $width, int $height, Document $user, Document $project, Database $dbForProject, Database $dbForPlatform, Response $response, array $heroes, array $contributors, array $employees, ?Logger $logger) use ($getUserGitHub) {
+        $user = Authorization::skip(fn () => $dbForPlatform->getDocument('users', $userId));

        if ($user->isEmpty() && empty($mock)) {
            throw new Exception(Exception::USER_NOT_FOUND);
@@ -854,7 +853,7 @@ App::get('/v1/cards/cloud')
            $email = $user->getAttribute('email', '');
            $createdAt = new \DateTime($user->getCreatedAt());

-            $gitHub = $getUserGitHub($user->getId(), $project, $dbForProject, $dbForPlatform, $authorization, $logger);
+            $gitHub = $getUserGitHub($user->getId(), $project, $dbForProject, $dbForPlatform, $logger);
            $githubName = $gitHub['name'] ?? '';
            $githubId = $gitHub['id'] ?? '';

@@ -1049,9 +1048,8 @@ App::get('/v1/cards/cloud-back')
    ->inject('contributors')
    ->inject('employees')
    ->inject('logger')
-    ->inject('authorization')
-    ->action(function (string $userId, string $mock, int $width, int $height, Document $user, Document $project, Database $dbForProject, Database $dbForPlatform, Response $response, array $heroes, array $contributors, array $employees, ?Logger $logger, Authorization $authorization) use ($getUserGitHub) {
-        $user = $authorization->skip(fn () => $dbForPlatform->getDocument('users', $userId));
+    ->action(function (string $userId, string $mock, int $width, int $height, Document $user, Document $project, Database $dbForProject, Database $dbForPlatform, Response $response, array $heroes, array $contributors, array $employees, ?Logger $logger) use ($getUserGitHub) {
+        $user = Authorization::skip(fn () => $dbForPlatform->getDocument('users', $userId));

        if ($user->isEmpty() && empty($mock)) {
            throw new Exception(Exception::USER_NOT_FOUND);
@@ -1061,7 +1059,7 @@ App::get('/v1/cards/cloud-back')
            $userId = $user->getId();
            $email = $user->getAttribute('email', '');

-            $gitHub = $getUserGitHub($user->getId(), $project, $dbForProject, $dbForPlatform, $authorization, $logger);
+            $gitHub = $getUserGitHub($user->getId(), $project, $dbForProject, $dbForPlatform, $logger);
            $githubId = $gitHub['id'] ?? '';

            $isHero = \array_key_exists($email, $heroes);
@@ -1128,9 +1126,8 @@ App::get('/v1/cards/cloud-og')
    ->inject('contributors')
    ->inject('employees')
    ->inject('logger')
-    ->inject('authorization')
-    ->action(function (string $userId, string $mock, int $width, int $height, Document $user, Document $project, Database $dbForProject, Database $dbForPlatform, Response $response, array $heroes, array $contributors, array $employees, ?Logger $logger, Authorization $authorization) use ($getUserGitHub) {
-        $user = $authorization->skip(fn () => $dbForPlatform->getDocument('users', $userId));
+    ->action(function (string $userId, string $mock, int $width, int $height, Document $user, Document $project, Database $dbForProject, Database $dbForPlatform, Response $response, array $heroes, array $contributors, array $employees, ?Logger $logger) use ($getUserGitHub) {
+        $user = Authorization::skip(fn () => $dbForPlatform->getDocument('users', $userId));

        if ($user->isEmpty() && empty($mock)) {
            throw new Exception(Exception::USER_NOT_FOUND);
@@ -1145,7 +1142,7 @@ App::get('/v1/cards/cloud-og')
            $email = $user->getAttribute('email', '');
            $createdAt = new \DateTime($user->getCreatedAt());

-            $gitHub = $getUserGitHub($user->getId(), $project, $dbForProject, $dbForPlatform, $authorization, $logger);
+            $gitHub = $getUserGitHub($user->getId(), $project, $dbForProject, $dbForPlatform, $logger);
            $githubName = $gitHub['name'] ?? '';
            $githubId = $gitHub['id'] ?? '';

@@ -1,147 +0,0 @@
-<?php
-
-use Appwrite\Extend\Exception;
-use Appwrite\SDK\AuthType;
-use Appwrite\SDK\ContentType;
-use Appwrite\SDK\Method;
-use Appwrite\SDK\Response as SDKResponse;
-use Appwrite\Utopia\Response;
-use Utopia\App;
-use Utopia\Database\Document;
-use Utopia\Domains\Domain;
-use Utopia\System\System;
-use Utopia\Validator\IP;
-use Utopia\Validator\Text;
-
-App::init()
-    ->groups(['console'])
-    ->inject('project')
-    ->action(function (Document $project) {
-        if ($project->getId() !== 'console') {
-            throw new Exception(Exception::GENERAL_ACCESS_FORBIDDEN);
-        }
-    });
-
-
-App::get('/v1/console/variables')
-    ->desc('Get variables')
-    ->groups(['api', 'projects'])
-    ->label('scope', 'projects.read')
-    ->label('sdk', new Method(
-        namespace: 'console',
-        group: 'console',
-        name: 'variables',
-        description: '/docs/references/console/variables.md',
-        auth: [AuthType::ADMIN],
-        responses: [
-            new SDKResponse(
-                code: Response::STATUS_CODE_OK,
-                model: Response::MODEL_CONSOLE_VARIABLES,
-            )
-        ],
-        contentType: ContentType::JSON
-    ))
-    ->inject('response')
-    ->action(function (Response $response) {
-        $validator = new Domain(System::getEnv('_APP_DOMAIN_TARGET_CNAME'));
-        $isCNAMEValid = !empty(System::getEnv('_APP_DOMAIN_TARGET_CNAME', '')) && $validator->isKnown() && !$validator->isTest();
-
-        $validator = new IP(IP::V4);
-        $isAValid = !empty(System::getEnv('_APP_DOMAIN_TARGET_A', '')) && ($validator->isValid(System::getEnv('_APP_DOMAIN_TARGET_A')));
-
-        $validator = new IP(IP::V6);
-        $isAAAAValid = !empty(System::getEnv('_APP_DOMAIN_TARGET_AAAA', '')) && $validator->isValid(System::getEnv('_APP_DOMAIN_TARGET_AAAA'));
-
-        $isDomainEnabled = $isAAAAValid || $isAValid || $isCNAMEValid;
-
-        $isVcsEnabled = !empty(System::getEnv('_APP_VCS_GITHUB_APP_NAME', ''))
-            && !empty(System::getEnv('_APP_VCS_GITHUB_PRIVATE_KEY', ''))
-            && !empty(System::getEnv('_APP_VCS_GITHUB_APP_ID', ''))
-            && !empty(System::getEnv('_APP_VCS_GITHUB_CLIENT_ID', ''))
-            && !empty(System::getEnv('_APP_VCS_GITHUB_CLIENT_SECRET', ''));
-
-        $isAssistantEnabled = !empty(System::getEnv('_APP_ASSISTANT_OPENAI_API_KEY', ''));
-
-        $variables = new Document([
-            '_APP_DOMAIN_TARGET_CNAME' => System::getEnv('_APP_DOMAIN_TARGET_CNAME'),
-            '_APP_DOMAIN_TARGET_AAAA' => System::getEnv('_APP_DOMAIN_TARGET_AAAA'),
-            '_APP_DOMAIN_TARGET_A' => System::getEnv('_APP_DOMAIN_TARGET_A'),
-            // Combine CAA domain with most common flags and tag (no parameters)
-            '_APP_DOMAIN_TARGET_CAA' => '0 issue "' . System::getEnv('_APP_DOMAIN_TARGET_CAA') . '"',
-            '_APP_STORAGE_LIMIT' => +System::getEnv('_APP_STORAGE_LIMIT'),
-            '_APP_COMPUTE_BUILD_TIMEOUT' => +System::getEnv('_APP_COMPUTE_BUILD_TIMEOUT'),
-            '_APP_COMPUTE_SIZE_LIMIT' => +System::getEnv('_APP_COMPUTE_SIZE_LIMIT'),
-            '_APP_USAGE_STATS' => System::getEnv('_APP_USAGE_STATS'),
-            '_APP_VCS_ENABLED' => $isVcsEnabled,
-            '_APP_DOMAIN_ENABLED' => $isDomainEnabled,
-            '_APP_ASSISTANT_ENABLED' => $isAssistantEnabled,
-            '_APP_DOMAIN_SITES' => System::getEnv('_APP_DOMAIN_SITES'),
-            '_APP_DOMAIN_FUNCTIONS' => System::getEnv('_APP_DOMAIN_FUNCTIONS'),
-            '_APP_OPTIONS_FORCE_HTTPS' => System::getEnv('_APP_OPTIONS_FORCE_HTTPS'),
-            '_APP_DOMAINS_NAMESERVERS' => System::getEnv('_APP_DOMAINS_NAMESERVERS'),
-        ]);
-
-        $response->dynamic($variables, Response::MODEL_CONSOLE_VARIABLES);
-    });
-
-App::post('/v1/console/assistant')
-    ->desc('Create assistant query')
-    ->groups(['api', 'assistant'])
-    ->label('scope', 'assistant.read')
-    ->label('sdk', new Method(
-        namespace: 'assistant',
-        group: 'console',
-        name: 'chat',
-        description: '/docs/references/assistant/chat.md',
-        auth: [AuthType::ADMIN],
-        responses: [
-            new SDKResponse(
-                code: Response::STATUS_CODE_OK,
-                model: Response::MODEL_NONE,
-            )
-        ],
-        contentType: ContentType::TEXT
-    ))
-    ->label('abuse-limit', 15)
-    ->label('abuse-key', 'userId:{userId}')
-    ->param('prompt', '', new Text(2000), 'Prompt. A string containing questions asked to the AI assistant.')
-    ->inject('response')
-    ->action(function (string $prompt, Response $response) {
-        $ch = curl_init('http://appwrite-assistant:3003/v1/models/assistant/prompt');
-        $responseHeaders = [];
-        $query = json_encode(['prompt' => $prompt]);
-        $headers = ['accept: text/event-stream'];
-        $handleEvent = function ($ch, $data) use ($response) {
-            $response->chunk($data);
-
-            return \strlen($data);
-        };
-
-        curl_setopt($ch, CURLOPT_WRITEFUNCTION, $handleEvent);
-
-        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
-        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
-        curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
-        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 0);
-        curl_setopt($ch, CURLOPT_TIMEOUT, 9000);
-        curl_setopt($ch, CURLOPT_HEADERFUNCTION, function ($curl, $header) use (&$responseHeaders) {
-            $len = strlen($header);
-            $header = explode(':', $header, 2);
-
-            if (count($header) < 2) { // ignore invalid headers
-                return $len;
-            }
-
-            $responseHeaders[strtolower(trim($header[0]))] = trim($header[1]);
-
-            return $len;
-        });
-
-        curl_setopt($ch, CURLOPT_POSTFIELDS, $query);
-
-        curl_exec($ch);
-
-        curl_close($ch);
-
-        $response->chunk('', true);
-    });
@@ -28,12 +28,11 @@ use Utopia\Validator\Text;
 App::init()
    ->groups(['graphql'])
    ->inject('project')
-    ->inject('authorization')
-    ->action(function (Document $project, Authorization $authorization) {
+    ->action(function (Document $project) {
        if (
            array_key_exists('graphql', $project->getAttribute('apis', []))
            && !$project->getAttribute('apis', [])['graphql']
-            && !(User::isPrivileged($authorization->getRoles()) || User::isApp($authorization->getRoles()))
+            && !(User::isPrivileged(Authorization::getRoles()) || User::isApp(Authorization::getRoles()))
        ) {
            throw new AppwriteException(AppwriteException::GENERAL_API_DISABLED);
        }
@@ -120,7 +120,7 @@ App::get('/v1/health/db')
                        $output[] = new Document([
                            'name' => $key . " ($database)",
                            'status' => 'pass',
-                            'ping' => \round((\microtime(true) - $checkStart) * 1000)
+                            'ping' => \round((\microtime(true) - $checkStart) / 1000)
                        ]);
                    } else {
                        $failures[] = $database;
@@ -131,8 +131,6 @@ App::get('/v1/health/db')
            }
        }

-        // Only throw error if ALL databases failed (no successful pings)
-        // This allows partial failures in environments where not all DBs are ready
        if (!empty($failures)) {
            throw new Exception(Exception::GENERAL_SERVER_ERROR, 'DB failure on: ' . implode(", ", $failures));
        }
@@ -182,7 +180,7 @@ App::get('/v1/health/cache')
                        $output[] = new Document([
                            'name' => $key . " ($cache)",
                            'status' => 'pass',
-                            'ping' => \round((\microtime(true) - $checkStart) * 1000)
+                            'ping' => \round((\microtime(true) - $checkStart) / 1000)
                        ]);
                    } else {
                        $failures[] = $cache;
@@ -242,7 +240,7 @@ App::get('/v1/health/pubsub')
                        $output[] = new Document([
                            'name' => $key . " ($pubsub)",
                            'status' => 'pass',
-                            'ping' => \round((\microtime(true) - $checkStart) * 1000)
+                            'ping' => \round((\microtime(true) - $checkStart) / 1000)
                        ]);
                    } else {
                        $failures[] = $pubsub;
@@ -824,7 +822,7 @@ App::get('/v1/health/storage/local')

        $output = [
            'status' => 'pass',
-            'ping' => \round((\microtime(true) - $checkStart) * 1000)
+            'ping' => \round((\microtime(true) - $checkStart) / 1000)
        ];

        $response->dynamic(new Document($output), Response::MODEL_HEALTH_STATUS);
@@ -876,7 +874,7 @@ App::get('/v1/health/storage')

        $output = [
            'status' => 'pass',
-            'ping' => \round((\microtime(true) - $checkStart) * 1000)
+            'ping' => \round((\microtime(true) - $checkStart) / 1000)
        ];

        $response->dynamic(new Document($output), Response::MODEL_HEALTH_STATUS);
@@ -947,18 +945,18 @@ App::get('/v1/health/queue/failed/:name')
        contentType: ContentType::JSON
    ))
    ->param('name', '', new WhiteList([
-        Event::DATABASE_QUEUE_NAME,
-        Event::DELETE_QUEUE_NAME,
-        Event::AUDITS_QUEUE_NAME,
-        Event::MAILS_QUEUE_NAME,
-        Event::FUNCTIONS_QUEUE_NAME,
-        Event::STATS_RESOURCES_QUEUE_NAME,
-        Event::STATS_USAGE_QUEUE_NAME,
-        Event::WEBHOOK_QUEUE_NAME,
-        Event::CERTIFICATES_QUEUE_NAME,
-        Event::BUILDS_QUEUE_NAME,
-        Event::MESSAGING_QUEUE_NAME,
-        Event::MIGRATIONS_QUEUE_NAME
+        System::getEnv('_APP_DATABASE_QUEUE_NAME', Event::DATABASE_QUEUE_NAME),
+        System::getEnv('_APP_DELETE_QUEUE_NAME', Event::DELETE_QUEUE_NAME),
+        System::getEnv('_APP_AUDITS_QUEUE_NAME', Event::AUDITS_QUEUE_NAME),
+        System::getEnv('_APP_MAILS_QUEUE_NAME', Event::MAILS_QUEUE_NAME),
+        System::getEnv('_APP_FUNCTIONS_QUEUE_NAME', Event::FUNCTIONS_QUEUE_NAME),
+        System::getEnv('_APP_STATS_RESOURCES_QUEUE_NAME', Event::STATS_RESOURCES_QUEUE_NAME),
+        System::getEnv('_APP_STATS_USAGE_QUEUE_NAME', Event::STATS_USAGE_QUEUE_NAME),
+        System::getEnv('_APP_WEBHOOK_QUEUE_NAME', Event::WEBHOOK_QUEUE_NAME),
+        System::getEnv('_APP_CERTIFICATES_QUEUE_NAME', Event::CERTIFICATES_QUEUE_NAME),
+        System::getEnv('_APP_BUILDS_QUEUE_NAME', Event::BUILDS_QUEUE_NAME),
+        System::getEnv('_APP_MESSAGING_QUEUE_NAME', Event::MESSAGING_QUEUE_NAME),
+        System::getEnv('_APP_MIGRATIONS_QUEUE_NAME', Event::MIGRATIONS_QUEUE_NAME)
    ]), 'The name of the queue')
    ->param('threshold', 5000, new Integer(true), 'Queue size threshold. When hit (equal or higher), endpoint returns server error. Default value is 5000.', true)
    ->inject('response')
@@ -995,18 +993,18 @@ App::get('/v1/health/queue/failed/:name')

        /** @var Event $queue */
        $queue = match ($name) {
-            Event::DATABASE_QUEUE_NAME => $queueForDatabase,
-            Event::DELETE_QUEUE_NAME => $queueForDeletes,
-            Event::AUDITS_QUEUE_NAME => $queueForAudits,
-            Event::MAILS_QUEUE_NAME => $queueForMails,
-            Event::FUNCTIONS_QUEUE_NAME => $queueForFunctions,
-            Event::STATS_RESOURCES_QUEUE_NAME => $queueForStatsResources,
-            Event::STATS_USAGE_QUEUE_NAME => $queueForStatsUsage,
-            Event::WEBHOOK_QUEUE_NAME => $queueForWebhooks,
-            Event::CERTIFICATES_QUEUE_NAME => $queueForCertificates,
-            Event::BUILDS_QUEUE_NAME => $queueForBuilds,
-            Event::MESSAGING_QUEUE_NAME => $queueForMessaging,
-            Event::MIGRATIONS_QUEUE_NAME => $queueForMigrations,
+            System::getEnv('_APP_DATABASE_QUEUE_NAME', Event::DATABASE_QUEUE_NAME) => $queueForDatabase,
+            System::getEnv('_APP_DELETE_QUEUE_NAME', Event::DELETE_QUEUE_NAME) => $queueForDeletes,
+            System::getEnv('_APP_AUDITS_QUEUE_NAME', Event::AUDITS_QUEUE_NAME) => $queueForAudits,
+            System::getEnv('_APP_MAILS_QUEUE_NAME', Event::MAILS_QUEUE_NAME) => $queueForMails,
+            System::getEnv('_APP_FUNCTIONS_QUEUE_NAME', Event::FUNCTIONS_QUEUE_NAME) => $queueForFunctions,
+            System::getEnv('_APP_STATS_RESOURCES_QUEUE_NAME', Event::STATS_RESOURCES_QUEUE_NAME) => $queueForStatsResources,
+            System::getEnv('_APP_STATS_USAGE_QUEUE_NAME', Event::STATS_USAGE_QUEUE_NAME) => $queueForStatsUsage,
+            System::getEnv('_APP_WEBHOOK_QUEUE_NAME', Event::WEBHOOK_QUEUE_NAME) => $queueForWebhooks,
+            System::getEnv('_APP_CERTIFICATES_QUEUE_NAME', Event::CERTIFICATES_QUEUE_NAME) => $queueForCertificates,
+            System::getEnv('_APP_BUILDS_QUEUE_NAME', Event::BUILDS_QUEUE_NAME) => $queueForBuilds,
+            System::getEnv('_APP_MESSAGING_QUEUE_NAME', Event::MESSAGING_QUEUE_NAME) => $queueForMessaging,
+            System::getEnv('_APP_MIGRATIONS_QUEUE_NAME', Event::MIGRATIONS_QUEUE_NAME) => $queueForMigrations,
        };
        $failed = $queue->getSize(failed: true);

@@ -36,7 +36,6 @@ use Utopia\Database\Exception\Query as QueryException;
 use Utopia\Database\Helpers\ID;
 use Utopia\Database\Query;
 use Utopia\Database\Validator\Authorization;
-use Utopia\Database\Validator\Authorization\Input;
 use Utopia\Database\Validator\Datetime as DatetimeValidator;
 use Utopia\Database\Validator\Queries;
 use Utopia\Database\Validator\Query\Cursor;
@@ -1074,9 +1073,8 @@ App::get('/v1/messaging/providers')
    ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
    ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
    ->inject('dbForProject')
-    ->inject('authorization')
    ->inject('response')
-    ->action(function (array $queries, string $search, bool $includeTotal, Database $dbForProject, Authorization $authorization, Response $response) {
+    ->action(function (array $queries, string $search, bool $includeTotal, Database $dbForProject, Response $response) {
        try {
            $queries = Query::parseQueries($queries);
        } catch (QueryException $e) {
@@ -1102,7 +1100,7 @@ App::get('/v1/messaging/providers')
            }

            $providerId = $cursor->getValue();
-            $cursorDocument = $authorization->skip(fn () => $dbForProject->getDocument('providers', $providerId));
+            $cursorDocument = Authorization::skip(fn () => $dbForProject->getDocument('providers', $providerId));

            if ($cursorDocument->isEmpty()) {
                throw new Exception(Exception::GENERAL_CURSOR_NOT_FOUND, "Provider '{$providerId}' for the 'cursor' value not found.");
@@ -1147,7 +1145,8 @@ App::get('/v1/messaging/providers/:providerId/logs')
    ->inject('dbForProject')
    ->inject('locale')
    ->inject('geodb')
-    ->action(function (string $providerId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb) {
+    ->inject('audit')
+    ->action(function (string $providerId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb, Audit $audit) {
        $provider = $dbForProject->getDocument('providers', $providerId);

        if ($provider->isEmpty()) {
@@ -1160,9 +1159,12 @@ App::get('/v1/messaging/providers/:providerId/logs')
            throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
        }

-        $audit = new Audit($dbForProject);
+        $grouped = Query::groupByType($queries);
+        $limit = $grouped['limit'] ?? 25;
+        $offset = $grouped['offset'] ?? 0;
+
        $resource = 'provider/' . $providerId;
-        $logs = $audit->getLogsByResource($resource, $queries);
+        $logs = $audit->getLogsByResource($resource, offset: $offset, limit: $limit);
        $output = [];

        foreach ($logs as $i => &$log) {
@@ -1209,7 +1211,7 @@ App::get('/v1/messaging/providers/:providerId/logs')
        }

        $response->dynamic(new Document([
-            'total' => $includeTotal ? $audit->countLogsByResource($resource, $queries) : 0,
+            'total' => $includeTotal ? $audit->countLogsByResource($resource) : 0,
            'logs' => $output,
        ]), Response::MODEL_LOG_LIST);
    });
@@ -2479,9 +2481,8 @@ App::get('/v1/messaging/topics')
    ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
    ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
    ->inject('dbForProject')
-    ->inject('authorization')
    ->inject('response')
-    ->action(function (array $queries, string $search, bool $includeTotal, Database $dbForProject, Authorization $authorization, Response $response) {
+    ->action(function (array $queries, string $search, bool $includeTotal, Database $dbForProject, Response $response) {
        try {
            $queries = Query::parseQueries($queries);
        } catch (QueryException $e) {
@@ -2507,7 +2508,7 @@ App::get('/v1/messaging/topics')
            }

            $topicId = $cursor->getValue();
-            $cursorDocument = $authorization->skip(fn () => $dbForProject->getDocument('topics', $topicId));
+            $cursorDocument = Authorization::skip(fn () => $dbForProject->getDocument('topics', $topicId));

            if ($cursorDocument->isEmpty()) {
                throw new Exception(Exception::GENERAL_CURSOR_NOT_FOUND, "Topic '{$topicId}' for the 'cursor' value not found.");
@@ -2552,7 +2553,8 @@ App::get('/v1/messaging/topics/:topicId/logs')
    ->inject('dbForProject')
    ->inject('locale')
    ->inject('geodb')
-    ->action(function (string $topicId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb) {
+    ->inject('audit')
+    ->action(function (string $topicId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb, Audit $audit) {
        $topic = $dbForProject->getDocument('topics', $topicId);

        if ($topic->isEmpty()) {
@@ -2565,9 +2567,12 @@ App::get('/v1/messaging/topics/:topicId/logs')
            throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
        }

-        $audit = new Audit($dbForProject);
+        $grouped = Query::groupByType($queries);
+        $limit = $grouped['limit'] ?? 25;
+        $offset = $grouped['offset'] ?? 0;
+
        $resource = 'topic/' . $topicId;
-        $logs = $audit->getLogsByResource($resource, $queries);
+        $logs = $audit->getLogsByResource($resource, offset: $offset, limit: $limit);

        $output = [];

@@ -2615,7 +2620,7 @@ App::get('/v1/messaging/topics/:topicId/logs')
        }

        $response->dynamic(new Document([
-            'total' => $includeTotal ? $audit->countLogsByResource($resource, $queries) : 0,
+            'total' => $includeTotal ? $audit->countLogsByResource($resource) : 0,
            'logs' => $output,
        ]), Response::MODEL_LOG_LIST);
    });
@@ -2777,27 +2782,29 @@ App::post('/v1/messaging/topics/:topicId/subscribers')
    ->param('targetId', '', new UID(), 'Target ID. The target ID to link to the specified Topic ID.')
    ->inject('queueForEvents')
    ->inject('dbForProject')
-    ->inject('authorization')
    ->inject('response')
-    ->action(function (string $subscriberId, string $topicId, string $targetId, Event $queueForEvents, Database $dbForProject, Authorization $authorization, Response $response) {
+    ->action(function (string $subscriberId, string $topicId, string $targetId, Event $queueForEvents, Database $dbForProject, Response $response) {
        $subscriberId = $subscriberId == 'unique()' ? ID::unique() : $subscriberId;

-        $topic = $authorization->skip(fn () => $dbForProject->getDocument('topics', $topicId));
+        $topic = Authorization::skip(fn () => $dbForProject->getDocument('topics', $topicId));

        if ($topic->isEmpty()) {
            throw new Exception(Exception::TOPIC_NOT_FOUND);
        }
-        if (!$authorization->isValid(new Input('subscribe', $topic->getAttribute('subscribe')))) {
-            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
+
+        $validator = new Authorization('subscribe');
+
+        if (!$validator->isValid($topic->getAttribute('subscribe'))) {
+            throw new Exception(Exception::USER_UNAUTHORIZED, $validator->getDescription());
        }

-        $target = $authorization->skip(fn () => $dbForProject->getDocument('targets', $targetId));
+        $target = Authorization::skip(fn () => $dbForProject->getDocument('targets', $targetId));

        if ($target->isEmpty()) {
            throw new Exception(Exception::USER_TARGET_NOT_FOUND);
        }

-        $user = $authorization->skip(fn () => $dbForProject->getDocument('users', $target->getAttribute('userId')));
+        $user = Authorization::skip(fn () => $dbForProject->getDocument('users', $target->getAttribute('userId')));

        $subscriber = new Document([
            '$id' => $subscriberId,
@@ -2830,7 +2837,7 @@ App::post('/v1/messaging/topics/:topicId/subscribers')
                default => throw new Exception(Exception::TARGET_PROVIDER_INVALID_TYPE),
            };

-            $authorization->skip(fn () => $dbForProject->increaseDocumentAttribute(
+            Authorization::skip(fn () => $dbForProject->increaseDocumentAttribute(
                'topics',
                $topicId,
                $totalAttribute,
@@ -2875,9 +2882,8 @@ App::get('/v1/messaging/topics/:topicId/subscribers')
    ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
    ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
    ->inject('dbForProject')
-    ->inject('authorization')
    ->inject('response')
-    ->action(function (string $topicId, array $queries, string $search, bool $includeTotal, Database $dbForProject, Authorization $authorization, Response $response) {
+    ->action(function (string $topicId, array $queries, string $search, bool $includeTotal, Database $dbForProject, Response $response) {
        try {
            $queries = Query::parseQueries($queries);
        } catch (QueryException $e) {
@@ -2888,7 +2894,7 @@ App::get('/v1/messaging/topics/:topicId/subscribers')
            $queries[] = Query::search('search', $search);
        }

-        $topic = $authorization->skip(fn () => $dbForProject->getDocument('topics', $topicId));
+        $topic = Authorization::skip(fn () => $dbForProject->getDocument('topics', $topicId));

        if ($topic->isEmpty()) {
            throw new Exception(Exception::TOPIC_NOT_FOUND);
@@ -2911,7 +2917,7 @@ App::get('/v1/messaging/topics/:topicId/subscribers')
            }

            $subscriberId = $cursor->getValue();
-            $cursorDocument = $authorization->skip(fn () => $dbForProject->getDocument('subscribers', $subscriberId));
+            $cursorDocument = Authorization::skip(fn () => $dbForProject->getDocument('subscribers', $subscriberId));

            if ($cursorDocument->isEmpty()) {
                throw new Exception(Exception::GENERAL_CURSOR_NOT_FOUND, "Subscriber '{$subscriberId}' for the 'cursor' value not found.");
@@ -2925,10 +2931,10 @@ App::get('/v1/messaging/topics/:topicId/subscribers')
            throw new Exception(Exception::DATABASE_QUERY_ORDER_NULL, "The order attribute '{$e->getAttribute()}' had a null value. Cursor pagination requires all documents order attribute values are non-null.");
        }

-        $subscribers = batch(\array_map(function (Document $subscriber) use ($dbForProject, $authorization) {
-            return function () use ($subscriber, $dbForProject, $authorization) {
-                $target = $authorization->skip(fn () => $dbForProject->getDocument('targets', $subscriber->getAttribute('targetId')));
-                $user = $authorization->skip(fn () => $dbForProject->getDocument('users', $target->getAttribute('userId')));
+        $subscribers = batch(\array_map(function (Document $subscriber) use ($dbForProject) {
+            return function () use ($subscriber, $dbForProject) {
+                $target = Authorization::skip(fn () => $dbForProject->getDocument('targets', $subscriber->getAttribute('targetId')));
+                $user = Authorization::skip(fn () => $dbForProject->getDocument('users', $target->getAttribute('userId')));

                return $subscriber
                    ->setAttribute('target', $target)
@@ -2968,7 +2974,8 @@ App::get('/v1/messaging/subscribers/:subscriberId/logs')
    ->inject('dbForProject')
    ->inject('locale')
    ->inject('geodb')
-    ->action(function (string $subscriberId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb) {
+    ->inject('audit')
+    ->action(function (string $subscriberId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb, Audit $audit) {
        $subscriber = $dbForProject->getDocument('subscribers', $subscriberId);

        if ($subscriber->isEmpty()) {
@@ -2981,9 +2988,12 @@ App::get('/v1/messaging/subscribers/:subscriberId/logs')
            throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
        }

-        $audit = new Audit($dbForProject);
+        $grouped = Query::groupByType($queries);
+        $limit = $grouped['limit'] ?? 25;
+        $offset = $grouped['offset'] ?? 0;
+
        $resource = 'subscriber/' . $subscriberId;
-        $logs = $audit->getLogsByResource($resource, $queries);
+        $logs = $audit->getLogsByResource($resource, limit: $limit, offset: $offset);

        $output = [];

@@ -3031,7 +3041,7 @@ App::get('/v1/messaging/subscribers/:subscriberId/logs')
        }

        $response->dynamic(new Document([
-            'total' => $includeTotal ? $audit->countLogsByResource($resource, $queries) : 0,
+            'total' => $includeTotal ? $audit->countLogsByResource($resource) : 0,
            'logs' => $output,
        ]), Response::MODEL_LOG_LIST);
    });
@@ -3057,10 +3067,9 @@ App::get('/v1/messaging/topics/:topicId/subscribers/:subscriberId')
    ->param('topicId', '', new UID(), 'Topic ID. The topic ID subscribed to.')
    ->param('subscriberId', '', new UID(), 'Subscriber ID.')
    ->inject('dbForProject')
-    ->inject('authorization')
    ->inject('response')
-    ->action(function (string $topicId, string $subscriberId, Database $dbForProject, Authorization $authorization, Response $response) {
-        $topic = $authorization->skip(fn () => $dbForProject->getDocument('topics', $topicId));
+    ->action(function (string $topicId, string $subscriberId, Database $dbForProject, Response $response) {
+        $topic = Authorization::skip(fn () => $dbForProject->getDocument('topics', $topicId));

        if ($topic->isEmpty()) {
            throw new Exception(Exception::TOPIC_NOT_FOUND);
@@ -3072,8 +3081,8 @@ App::get('/v1/messaging/topics/:topicId/subscribers/:subscriberId')
            throw new Exception(Exception::SUBSCRIBER_NOT_FOUND);
        }

-        $target = $authorization->skip(fn () => $dbForProject->getDocument('targets', $subscriber->getAttribute('targetId')));
-        $user = $authorization->skip(fn () => $dbForProject->getDocument('users', $target->getAttribute('userId')));
+        $target = Authorization::skip(fn () => $dbForProject->getDocument('targets', $subscriber->getAttribute('targetId')));
+        $user = Authorization::skip(fn () => $dbForProject->getDocument('users', $target->getAttribute('userId')));

        $subscriber
            ->setAttribute('target', $target)
@@ -3109,10 +3118,9 @@ App::delete('/v1/messaging/topics/:topicId/subscribers/:subscriberId')
    ->param('subscriberId', '', new UID(), 'Subscriber ID.')
    ->inject('queueForEvents')
    ->inject('dbForProject')
-    ->inject('authorization')
    ->inject('response')
-    ->action(function (string $topicId, string $subscriberId, Event $queueForEvents, Database $dbForProject, Authorization $authorization, Response $response) {
-        $topic = $authorization->skip(fn () => $dbForProject->getDocument('topics', $topicId));
+    ->action(function (string $topicId, string $subscriberId, Event $queueForEvents, Database $dbForProject, Response $response) {
+        $topic = Authorization::skip(fn () => $dbForProject->getDocument('topics', $topicId));

        if ($topic->isEmpty()) {
            throw new Exception(Exception::TOPIC_NOT_FOUND);
@@ -3135,7 +3143,7 @@ App::delete('/v1/messaging/topics/:topicId/subscribers/:subscriberId')
            default => throw new Exception(Exception::TARGET_PROVIDER_INVALID_TYPE),
        };

-        $authorization->skip(fn () => $dbForProject->decreaseDocumentAttribute(
+        Authorization::skip(fn () => $dbForProject->decreaseDocumentAttribute(
            'topics',
            $topicId,
            $totalAttribute,
@@ -3694,9 +3702,8 @@ App::get('/v1/messaging/messages')
    ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
    ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
    ->inject('dbForProject')
-    ->inject('authorization')
    ->inject('response')
-    ->action(function (array $queries, string $search, bool $includeTotal, Database $dbForProject, Authorization $authorization, Response $response) {
+    ->action(function (array $queries, string $search, bool $includeTotal, Database $dbForProject, Response $response) {
        try {
            $queries = Query::parseQueries($queries);
        } catch (QueryException $e) {
@@ -3722,7 +3729,7 @@ App::get('/v1/messaging/messages')
            }

            $messageId = $cursor->getValue();
-            $cursorDocument = $authorization->skip(fn () => $dbForProject->getDocument('messages', $messageId));
+            $cursorDocument = Authorization::skip(fn () => $dbForProject->getDocument('messages', $messageId));

            if ($cursorDocument->isEmpty()) {
                throw new Exception(Exception::GENERAL_CURSOR_NOT_FOUND, "Message '{$messageId}' for the 'cursor' value not found.");
@@ -3767,7 +3774,8 @@ App::get('/v1/messaging/messages/:messageId/logs')
    ->inject('dbForProject')
    ->inject('locale')
    ->inject('geodb')
-    ->action(function (string $messageId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb) {
+    ->inject('audit')
+    ->action(function (string $messageId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb, Audit $audit) {
        $message = $dbForProject->getDocument('messages', $messageId);

        if ($message->isEmpty()) {
@@ -3780,9 +3788,12 @@ App::get('/v1/messaging/messages/:messageId/logs')
            throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
        }

-        $audit = new Audit($dbForProject);
+        $grouped = Query::groupByType($queries);
+        $limit = $grouped['limit'] ?? 25;
+        $offset = $grouped['offset'] ?? 0;
+
        $resource = 'message/' . $messageId;
-        $logs = $audit->getLogsByResource($resource, $queries);
+        $logs = $audit->getLogsByResource($resource, limit: $limit, offset: $offset);

        $output = [];

@@ -3830,7 +3841,7 @@ App::get('/v1/messaging/messages/:messageId/logs')
        }

        $response->dynamic(new Document([
-            'total' => $includeTotal ? $audit->countLogsByResource($resource, $queries) : 0,
+            'total' => $includeTotal ? $audit->countLogsByResource($resource) : 0,
            'logs' => $output,
        ]), Response::MODEL_LOG_LIST);
    });
@@ -342,7 +342,6 @@ App::post('/v1/migrations/csv/imports')
    ->inject('response')
    ->inject('dbForProject')
    ->inject('dbForPlatform')
-    ->inject('authorization')
    ->inject('project')
    ->inject('platform')
    ->inject('deviceForFiles')
@@ -357,7 +356,6 @@ App::post('/v1/migrations/csv/imports')
        Response $response,
        Database $dbForProject,
        Database $dbForPlatform,
-        Authorization $authorization,
        Document $project,
        array $platform,
        Device $deviceForFiles,
@@ -365,7 +363,7 @@ App::post('/v1/migrations/csv/imports')
        Event $queueForEvents,
        Migration $queueForMigrations
    ) {
-        $bucket = $authorization->skip(function () use ($internalFile, $dbForPlatform, $dbForProject, $bucketId) {
+        $bucket = Authorization::skip(function () use ($internalFile, $dbForPlatform, $dbForProject, $bucketId) {
            if ($internalFile) {
                return $dbForPlatform->getDocument('buckets', 'default');
            }
@@ -376,7 +374,7 @@ App::post('/v1/migrations/csv/imports')
            throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
        }

-        $file = $authorization->skip(fn () => $internalFile ? $dbForPlatform->getDocument('bucket_' . $bucket->getSequence(), $fileId) : $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+        $file = Authorization::skip(fn () => $internalFile ? $dbForPlatform->getDocument('bucket_' . $bucket->getSequence(), $fileId) : $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
        if ($file->isEmpty()) {
            throw new Exception(Exception::STORAGE_FILE_NOT_FOUND);
        }
@@ -493,7 +491,6 @@ App::post('/v1/migrations/csv/exports')
    ->inject('response')
    ->inject('dbForProject')
    ->inject('dbForPlatform')
-    ->inject('authorization')
    ->inject('project')
    ->inject('platform')
    ->inject('queueForEvents')
@@ -512,7 +509,6 @@ App::post('/v1/migrations/csv/exports')
        Response $response,
        Database $dbForProject,
        Database $dbForPlatform,
-        Authorization $authorization,
        Document $project,
        array $platform,
        Event $queueForEvents,
@@ -524,7 +520,7 @@ App::post('/v1/migrations/csv/exports')
            throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
        }

-        $bucket = $authorization->skip(fn () => $dbForPlatform->getDocument('buckets', 'default'));
+        $bucket = Authorization::skip(fn () => $dbForPlatform->getDocument('buckets', 'default'));
        if ($bucket->isEmpty()) {
            throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
        }
@@ -537,12 +533,12 @@ App::post('/v1/migrations/csv/exports')
            throw new Exception(Exception::COLLECTION_NOT_FOUND);
        }

-        $database = $authorization->skip(fn () => $dbForProject->getDocument('databases', $databaseId));
+        $database = Authorization::skip(fn () => $dbForProject->getDocument('databases', $databaseId));
        if ($database->isEmpty()) {
            throw new Exception(Exception::DATABASE_NOT_FOUND);
        }

-        $collection = $authorization->skip(fn () => $dbForProject->getDocument('database_' . $database->getSequence(), $collectionId));
+        $collection = Authorization::skip(fn () => $dbForProject->getDocument('database_' . $database->getSequence(), $collectionId));
        if ($collection->isEmpty()) {
            throw new Exception(Exception::COLLECTION_NOT_FOUND);
        }
@@ -45,10 +45,9 @@ App::get('/v1/project/usage')
    ->inject('response')
    ->inject('project')
    ->inject('dbForProject')
-    ->inject('authorization')
    ->inject('getLogsDB')
    ->inject('smsRates')
-    ->action(function (string $startDate, string $endDate, string $period, Response $response, Document $project, Database $dbForProject, Authorization $authorization, callable $getLogsDB, array $smsRates) {
+    ->action(function (string $startDate, string $endDate, string $period, Response $response, Document $project, Database $dbForProject, callable $getLogsDB, array $smsRates) {
        $stats = $total = $usage = [];
        $format = 'Y-m-d 00:00:00';
        $firstDay = (new DateTime($startDate))->format($format);
@@ -103,7 +102,7 @@ App::get('/v1/project/usage')
            '1d' => 'Y-m-d\T00:00:00.000P',
        };

-        $authorization->skip(function () use ($dbForProject, $dbForLogs, $firstDay, $lastDay, $period, $metrics, $limit, &$total, &$stats) {
+        Authorization::skip(function () use ($dbForProject, $dbForLogs, $firstDay, $lastDay, $period, $metrics, $limit, &$total, &$stats) {
            foreach ($metrics['total'] as $metric) {
                $db = ($metric === METRIC_FILES_IMAGES_TRANSFORMED) ? $dbForLogs : $dbForProject;

@@ -287,7 +286,7 @@ App::get('/v1/project/usage')
        }, $dbForProject->find('functions'));

        // This total is includes free and paid SMS usage
-        $authPhoneTotal = $authorization->skip(fn () => $dbForProject->sum('stats', 'value', [
+        $authPhoneTotal = Authorization::skip(fn () => $dbForProject->sum('stats', 'value', [
            Query::equal('metric', [METRIC_AUTH_METHOD_PHONE]),
            Query::equal('period', ['1d']),
            Query::greaterThanEqual('time', $firstDay),
@@ -295,7 +294,7 @@ App::get('/v1/project/usage')
        ]));

        // This estimate is only for paid SMS usage
-        $authPhoneMetrics = $authorization->skip(fn () => $dbForProject->find('stats', [
+        $authPhoneMetrics = Authorization::skip(fn () => $dbForProject->find('stats', [
            Query::startsWith('metric', METRIC_AUTH_METHOD_PHONE . '.'),
            Query::equal('period', ['1d']),
            Query::greaterThanEqual('time', $firstDay),
@@ -21,6 +21,7 @@ use Appwrite\Utopia\Request;
 use Appwrite\Utopia\Response;
 use PHPMailer\PHPMailer\PHPMailer;
 use Utopia\App;
+use Utopia\Audit\Adapter\Database as AdapterDatabase;
 use Utopia\Audit\Audit;
 use Utopia\Cache\Cache;
 use Utopia\Config\Config;
@@ -203,6 +204,7 @@ App::post('/v1/projects')
                'accessedAt' => DateTime::now(),
                'search' => implode(' ', [$projectId, $name]),
                'database' => $dsn,
+                'labels' => [],
            ]));
        } catch (Duplicate) {
            throw new Exception(Exception::PROJECT_ALREADY_EXISTS);
@@ -247,13 +249,15 @@ App::post('/v1/projects')
            }

            if ($create || $projectTables) {
-                $audit = new Audit($dbForProject);
+                $adapter = new AdapterDatabase($dbForProject);
+                $audit = new Audit($adapter);
                $audit->setup();
            }

            if (!$create && $sharedTablesV1) {
-                $attributes = \array_map(fn ($attribute) => new Document($attribute), Audit::ATTRIBUTES);
-                $indexes = \array_map(fn (array $index) => new Document($index), Audit::INDEXES);
+                $adapter = new AdapterDatabase($dbForProject);
+                $attributes = $adapter->getAttributeDocuments();
+                $indexes = $adapter->getIndexDocuments();
                $dbForProject->createDocument(Database::METADATA, new Document([
                    '$id' => ID::custom('audit'),
                    '$permissions' => [Permission::create(Role::any())],
@@ -294,7 +298,7 @@ App::post('/v1/projects')

        // Hook allowing instant project mirroring during migration
        // Outside of migration, hook is not registered and has no effect
-        $hooks->trigger('afterProjectCreation', [ $project, $pools, $cache ]);
+        $hooks->trigger('afterProjectCreation', [$project, $pools, $cache]);

        $response
            ->setStatusCode(Response::STATUS_CODE_CREATED)
@@ -1497,8 +1501,12 @@ App::post('/v1/projects/:projectId/keys')
                Permission::update(Role::any()),
                Permission::delete(Role::any()),
            ],
+            // TODO: @hmacr Remove `projectInternalId` and `projectId` column writes before deleting the column.
            'projectInternalId' => $project->getSequence(),
            'projectId' => $project->getId(),
+            'resourceInternalId' => $project->getSequence(),
+            'resourceId' => $project->getId(),
+            'resourceType' => 'projects',
            'name' => $name,
            'scopes' => $scopes,
            'expire' => $expire,
@@ -1546,7 +1554,8 @@ App::get('/v1/projects/:projectId/keys')
        }

        $keys = $dbForPlatform->find('keys', [
-            Query::equal('projectInternalId', [$project->getSequence()]),
+            Query::equal('resourceType', ['projects']),
+            Query::equal('resourceInternalId', [$project->getSequence()]),
            Query::limit(5000),
        ]);

@@ -1587,7 +1596,8 @@ App::get('/v1/projects/:projectId/keys/:keyId')

        $key = $dbForPlatform->findOne('keys', [
            Query::equal('$id', [$keyId]),
-            Query::equal('projectInternalId', [$project->getSequence()]),
+            Query::equal('resourceType', ['projects']),
+            Query::equal('resourceInternalId', [$project->getSequence()]),
        ]);

        if ($key->isEmpty()) {
@@ -1631,7 +1641,8 @@ App::put('/v1/projects/:projectId/keys/:keyId')

        $key = $dbForPlatform->findOne('keys', [
            Query::equal('$id', [$keyId]),
-            Query::equal('projectInternalId', [$project->getSequence()]),
+            Query::equal('resourceType', ['projects']),
+            Query::equal('resourceInternalId', [$project->getSequence()]),
        ]);

        if ($key->isEmpty()) {
@@ -1682,7 +1693,8 @@ App::delete('/v1/projects/:projectId/keys/:keyId')

        $key = $dbForPlatform->findOne('keys', [
            Query::equal('$id', [$keyId]),
-            Query::equal('projectInternalId', [$project->getSequence()]),
+            Query::equal('resourceType', ['projects']),
+            Query::equal('resourceInternalId', [$project->getSequence()]),
        ]);

        if ($key->isEmpty()) {
@@ -2079,6 +2091,7 @@ App::patch('/v1/projects/:projectId/smtp')
        if ($enabled) {
            $mail = new PHPMailer(true);
            $mail->isSMTP();
+            $mail->SMTPAuth = (!empty($username) && !empty($password));
            $mail->Username = $username;
            $mail->Password = $password;
            $mail->Host = $host;
@@ -2094,7 +2107,7 @@ App::patch('/v1/projects/:projectId/smtp')
                    throw new Exception('Connection is not valid.');
                }
            } catch (Throwable $error) {
-                throw new Exception(Exception::PROJECT_SMTP_CONFIG_INVALID, 'Could not connect to SMTP server: ' . $error->getMessage());
+                throw new Exception(Exception::PROJECT_SMTP_CONFIG_INVALID, $error->getMessage());
            }
        }

@@ -2665,7 +2678,7 @@ App::patch('/v1/projects/:projectId/auth/session-invalidation')
        $auths = $project->getAttribute('auths', []);
        $auths['invalidateSessions'] = $enabled;
        $dbForPlatform->updateDocument('projects', $project->getId(), $project
-        ->setAttribute('auths', $auths));
+            ->setAttribute('auths', $auths));

        $response->dynamic($project, Response::MODEL_PROJECT);
    });
@@ -86,17 +86,16 @@ App::post('/v1/teams')
    ->inject('response')
    ->inject('user')
    ->inject('dbForProject')
-    ->inject('authorization')
    ->inject('queueForEvents')
-    ->action(function (string $teamId, string $name, array $roles, Response $response, Document $user, Database $dbForProject, Authorization $authorization, Event $queueForEvents) {
+    ->action(function (string $teamId, string $name, array $roles, Response $response, Document $user, Database $dbForProject, Event $queueForEvents) {

-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
-        $isAppUser = User::isApp($authorization->getRoles());
+        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
+        $isAppUser = User::isApp(Authorization::getRoles());

        $teamId = $teamId == 'unique()' ? ID::unique() : $teamId;

        try {
-            $team = $authorization->skip(fn () => $dbForProject->createDocument('teams', new Document([
+            $team = Authorization::skip(fn () => $dbForProject->createDocument('teams', new Document([
                '$id' => $teamId,
                '$permissions' => [
                    Permission::read(Role::team($teamId)),
@@ -492,7 +491,6 @@ App::post('/v1/teams/:teamId/memberships')
    ->inject('project')
    ->inject('user')
    ->inject('dbForProject')
-    ->inject('authorization')
    ->inject('locale')
    ->inject('queueForMails')
    ->inject('queueForMessaging')
@@ -502,9 +500,9 @@ App::post('/v1/teams/:teamId/memberships')
    ->inject('plan')
    ->inject('proofForPassword')
    ->inject('proofForToken')
-    ->action(function (string $teamId, string $email, string $userId, string $phone, array $roles, string $url, string $name, Response $response, Document $project, Document $user, Database $dbForProject, Authorization $authorization, Locale $locale, Mail $queueForMails, Messaging $queueForMessaging, Event $queueForEvents, callable $timelimit, StatsUsage $queueForStatsUsage, array $plan, Password $proofForPassword, Token $proofForToken) {
-        $isAppUser = User::isApp($authorization->getRoles());
-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+    ->action(function (string $teamId, string $email, string $userId, string $phone, array $roles, string $url, string $name, Response $response, Document $project, Document $user, Database $dbForProject, Locale $locale, Mail $queueForMails, Messaging $queueForMessaging, Event $queueForEvents, callable $timelimit, StatsUsage $queueForStatsUsage, array $plan, Password $proofForPassword, Token $proofForToken) {
+        $isAppUser = User::isApp(Authorization::getRoles());
+        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());

        $url = htmlentities($url);
        if (empty($url)) {
@@ -621,13 +619,13 @@ App::post('/v1/teams/:teamId/memberships')
            ]);

            try {
-                $invitee = $authorization->skip(fn () => $dbForProject->createDocument('users', $userDocument));
+                $invitee = Authorization::skip(fn () => $dbForProject->createDocument('users', $userDocument));
            } catch (Duplicate $th) {
                throw new Exception(Exception::USER_ALREADY_EXISTS);
            }
        }

-        $isOwner = $authorization->hasRole('team:' . $team->getId() . '/owner');
+        $isOwner = Authorization::isRole('team:' . $team->getId() . '/owner');

        if (!$isOwner && !$isPrivilegedUser && !$isAppUser) { // Not owner, not admin, not app (server)
            throw new Exception(Exception::USER_UNAUTHORIZED, 'User is not allowed to send invitations for this team');
@@ -663,11 +661,11 @@ App::post('/v1/teams/:teamId/memberships')
            ]);

            $membership = ($isPrivilegedUser || $isAppUser) ?
-                $authorization->skip(fn () => $dbForProject->createDocument('memberships', $membership)) :
+                Authorization::skip(fn () => $dbForProject->createDocument('memberships', $membership)) :
                $dbForProject->createDocument('memberships', $membership);

            if ($isPrivilegedUser || $isAppUser) {
-                $authorization->skip(fn () => $dbForProject->increaseDocumentAttribute('teams', $team->getId(), 'total', 1));
+                Authorization::skip(fn () => $dbForProject->increaseDocumentAttribute('teams', $team->getId(), 'total', 1));
            }
        } elseif ($membership->getAttribute('confirm') === false) {
            $membership->setAttribute('secret', $proofForToken->hash($secret));
@@ -679,7 +677,7 @@ App::post('/v1/teams/:teamId/memberships')
            }

            $membership = ($isPrivilegedUser || $isAppUser) ?
-                $authorization->skip(fn () => $dbForProject->updateDocument('memberships', $membership->getId(), $membership)) :
+                Authorization::skip(fn () => $dbForProject->updateDocument('memberships', $membership->getId(), $membership)) :
                $dbForProject->updateDocument('memberships', $membership->getId(), $membership);
        } else {
            throw new Exception(Exception::MEMBERSHIP_ALREADY_CONFIRMED);
@@ -865,8 +863,7 @@ App::get('/v1/teams/:teamId/memberships')
    ->inject('response')
    ->inject('project')
    ->inject('dbForProject')
-    ->inject('authorization')
-    ->action(function (string $teamId, array $queries, string $search, bool $includeTotal, Response $response, Document $project, Database $dbForProject, Authorization $authorization) {
+    ->action(function (string $teamId, array $queries, string $search, bool $includeTotal, Response $response, Document $project, Database $dbForProject) {
        $team = $dbForProject->getDocument('teams', $teamId);

        if ($team->isEmpty()) {
@@ -936,7 +933,7 @@ App::get('/v1/teams/:teamId/memberships')
            'mfa' => $project->getAttribute('auths', [])['membershipsMfa'] ?? true,
        ];

-        $roles = $authorization->getRoles();
+        $roles = Authorization::getRoles();
        $isPrivilegedUser = User::isPrivileged($roles);
        $isAppUser = User::isApp($roles);

@@ -1007,8 +1004,7 @@ App::get('/v1/teams/:teamId/memberships/:membershipId')
    ->inject('response')
    ->inject('project')
    ->inject('dbForProject')
-    ->inject('authorization')
-    ->action(function (string $teamId, string $membershipId, Response $response, Document $project, Database $dbForProject, Authorization $authorization) {
+    ->action(function (string $teamId, string $membershipId, Response $response, Document $project, Database $dbForProject) {

        $team = $dbForProject->getDocument('teams', $teamId);

@@ -1028,7 +1024,7 @@ App::get('/v1/teams/:teamId/memberships/:membershipId')
            'mfa' => $project->getAttribute('auths', [])['membershipsMfa'] ?? true,
        ];

-        $roles = $authorization->getRoles();
+        $roles = Authorization::getRoles();
        $isPrivilegedUser = User::isPrivileged($roles);
        $isAppUser = User::isApp($roles);

@@ -1107,9 +1103,8 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId')
    ->inject('user')
    ->inject('project')
    ->inject('dbForProject')
-    ->inject('authorization')
    ->inject('queueForEvents')
-    ->action(function (string $teamId, string $membershipId, array $roles, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Authorization $authorization, Event $queueForEvents) {
+    ->action(function (string $teamId, string $membershipId, array $roles, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Event $queueForEvents) {

        $team = $dbForProject->getDocument('teams', $teamId);
        if ($team->isEmpty()) {
@@ -1126,9 +1121,9 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId')
            throw new Exception(Exception::USER_NOT_FOUND);
        }

-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
-        $isAppUser = User::isApp($authorization->getRoles());
-        $isOwner = $authorization->hasRole('team:' . $team->getId() . '/owner');
+        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
+        $isAppUser = User::isApp(Authorization::getRoles());
+        $isOwner = Authorization::isRole('team:' . $team->getId() . '/owner');

        if ($project->getId() === 'console') {
            // Quick check: fetch up to 2 owners to determine if only one exists
@@ -1209,13 +1204,12 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
    ->inject('response')
    ->inject('user')
    ->inject('dbForProject')
-    ->inject('authorization')
    ->inject('project')
    ->inject('geodb')
    ->inject('queueForEvents')
    ->inject('store')
    ->inject('proofForToken')
-    ->action(function (string $teamId, string $membershipId, string $userId, string $secret, Request $request, Response $response, Document $user, Database $dbForProject, Authorization $authorization, $project, Reader $geodb, Event $queueForEvents, Store $store, Token $proofForToken) {
+    ->action(function (string $teamId, string $membershipId, string $userId, string $secret, Request $request, Response $response, Document $user, Database $dbForProject, Document $project, Reader $geodb, Event $queueForEvents, Store $store, Token $proofForToken) {
        $protocol = $request->getProtocol();

        $membership = $dbForProject->getDocument('memberships', $membershipId);
@@ -1224,7 +1218,7 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
            throw new Exception(Exception::MEMBERSHIP_NOT_FOUND);
        }

-        $team = $authorization->skip(fn () => $dbForProject->getDocument('teams', $teamId));
+        $team = Authorization::skip(fn () => $dbForProject->getDocument('teams', $teamId));

        if ($team->isEmpty()) {
            throw new Exception(Exception::TEAM_NOT_FOUND);
@@ -1260,11 +1254,11 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
            ->setAttribute('confirm', true)
        ;

-        $authorization->skip(fn () => $dbForProject->updateDocument('users', $user->getId(), $user->setAttribute('emailVerification', true)));
+        Authorization::skip(fn () => $dbForProject->updateDocument('users', $user->getId(), $user->setAttribute('emailVerification', true)));

        // Create session for the user if not logged in
        if (!$hasSession) {
-            $authorization->addRole(Role::user($user->getId())->toString());
+            Authorization::setRole(Role::user($user->getId())->toString());

            $detector = new Detector($request->getUserAgent('UNKNOWN'));
            $record = $geodb->get($request->getIP());
@@ -1292,7 +1286,7 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')

            $session = $dbForProject->createDocument('sessions', $session);

-            $authorization->addRole(Role::user($userId)->toString());
+            Authorization::setRole(Role::user($userId)->toString());

            $encoded = $store
                ->setProperty('id', $user->getId())
@@ -1330,7 +1324,7 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')

        $dbForProject->purgeCachedDocument('users', $user->getId());

-        $authorization->skip(fn () => $dbForProject->increaseDocumentAttribute('teams', $team->getId(), 'total', 1));
+        Authorization::skip(fn () => $dbForProject->increaseDocumentAttribute('teams', $team->getId(), 'total', 1));

        $queueForEvents
            ->setParam('userId', $user->getId())
@@ -1374,9 +1368,8 @@ App::delete('/v1/teams/:teamId/memberships/:membershipId')
    ->inject('project')
    ->inject('response')
    ->inject('dbForProject')
-    ->inject('authorization')
    ->inject('queueForEvents')
-    ->action(function (string $teamId, string $membershipId, Document $user, Document $project, Response $response, Database $dbForProject, Authorization $authorization, Event $queueForEvents) {
+    ->action(function (string $teamId, string $membershipId, Document $user, Document $project, Response $response, Database $dbForProject, Event $queueForEvents) {

        $membership = $dbForProject->getDocument('memberships', $membershipId);

@@ -1434,7 +1427,7 @@ App::delete('/v1/teams/:teamId/memberships/:membershipId')
        $dbForProject->purgeCachedDocument('users', $profile->getId());

        if ($membership->getAttribute('confirm')) { // Count only confirmed members
-            $authorization->skip(fn () => $dbForProject->decreaseDocumentAttribute('teams', $team->getId(), 'total', 1, 0));
+            Authorization::skip(fn () => $dbForProject->decreaseDocumentAttribute('teams', $team->getId(), 'total', 1, 0));
        }

        $queueForEvents
@@ -1471,7 +1464,8 @@ App::get('/v1/teams/:teamId/logs')
    ->inject('dbForProject')
    ->inject('locale')
    ->inject('geodb')
-    ->action(function (string $teamId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb) {
+    ->inject('audit')
+    ->action(function (string $teamId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb, Audit $audit) {

        $team = $dbForProject->getDocument('teams', $teamId);

@@ -1485,9 +1479,12 @@ App::get('/v1/teams/:teamId/logs')
            throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
        }

-        $audit = new Audit($dbForProject);
+        $grouped = Query::groupByType($queries);
+        $limit = $grouped['limit'] ?? 25;
+        $offset = $grouped['offset'] ?? 0;
+
        $resource = 'team/' . $team->getId();
-        $logs = $audit->getLogsByResource($resource, $queries);
+        $logs = $audit->getLogsByResource($resource, offset: $offset, limit: $limit);

        $output = [];

@@ -1534,7 +1531,7 @@ App::get('/v1/teams/:teamId/logs')
            }
        }
        $response->dynamic(new Document([
-            'total' => $includeTotal ? $audit->countLogsByResource($resource, $queries) : 0,
+            'total' => $includeTotal ? $audit->countLogsByResource($resource) : 0,
            'logs' => $output,
        ]), Response::MODEL_LOG_LIST);
    });
@@ -945,7 +945,8 @@ App::get('/v1/users/:userId/logs')
    ->inject('dbForProject')
    ->inject('locale')
    ->inject('geodb')
-    ->action(function (string $userId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb) {
+    ->inject('audit')
+    ->action(function (string $userId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb, Audit $audit) {

        $user = $dbForProject->getDocument('users', $userId);

@@ -958,8 +959,11 @@ App::get('/v1/users/:userId/logs')
            throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
        }

-        $audit = new Audit($dbForProject);
-        $logs = $audit->getLogsByUser($user->getSequence(), $queries);
+        $grouped = Query::groupByType($queries);
+        $limit = $grouped['limit'] ?? 25;
+        $offset = $grouped['offset'] ?? 0;
+
+        $logs = $audit->getLogsByUser($user->getSequence(), limit: $limit, offset: $offset);
        $output = [];
        foreach ($logs as $i => &$log) {
            $log['userAgent'] = (!empty($log['userAgent'])) ? $log['userAgent'] : 'UNKNOWN';
@@ -999,7 +1003,7 @@ App::get('/v1/users/:userId/logs')
        }

        $response->dynamic(new Document([
-            'total' => $includeTotal ? $audit->countLogsByUser($user->getSequence(), $queries) : 0,
+            'total' => $includeTotal ? $audit->countLogsByUser($user->getSequence()) : 0,
            'logs' => $output,
        ]), Response::MODEL_LOG_LIST);
    });
@@ -2674,8 +2678,8 @@ App::get('/v1/users/usage')
    ->param('range', '30d', new WhiteList(['24h', '30d', '90d'], true), 'Date range.', true)
    ->inject('response')
    ->inject('dbForProject')
-    ->inject('authorization')
-    ->action(function (string $range, Response $response, Database $dbForProject, Authorization $authorization) {
+    ->inject('register')
+    ->action(function (string $range, Response $response, Database $dbForProject) {

        $periods = Config::getParam('usage', []);
        $stats = $usage = [];
@@ -2685,7 +2689,7 @@ App::get('/v1/users/usage')
            METRIC_SESSIONS,
        ];

-        $authorization->skip(function () use ($dbForProject, $days, $metrics, &$stats) {
+        Authorization::skip(function () use ($dbForProject, $days, $metrics, &$stats) {
            foreach ($metrics as $count => $metric) {
                $result =  $dbForProject->findOne('stats', [
                    Query::equal('metric', [$metric]),
@@ -76,7 +76,7 @@ use Utopia\VCS\Exception\RepositoryNotFound;

 use function Swoole\Coroutine\batch;

-$createGitDeployments = function (GitHub $github, string $providerInstallationId, array $repositories, string $providerBranch, string $providerBranchUrl, string $providerRepositoryName, string $providerRepositoryUrl, string $providerRepositoryOwner, string $providerCommitHash, string $providerCommitAuthor, string $providerCommitAuthorUrl, string $providerCommitMessage, string $providerCommitUrl, string $providerPullRequestId, bool $external, Database $dbForPlatform, Authorization $authorization, Build $queueForBuilds, callable $getProjectDB, Request $request, array $platform) {
+$createGitDeployments = function (GitHub $github, string $providerInstallationId, array $repositories, string $providerBranch, string $providerBranchUrl, string $providerRepositoryName, string $providerRepositoryUrl, string $providerRepositoryOwner, string $providerCommitHash, string $providerCommitAuthor, string $providerCommitAuthorUrl, string $providerCommitMessage, string $providerCommitUrl, string $providerPullRequestId, bool $external, Database $dbForPlatform, Build $queueForBuilds, callable $getProjectDB, array $platform) {
    $errors = [];
    foreach ($repositories as $repository) {
        try {
@@ -87,12 +87,12 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
            }

            $projectId = $repository->getAttribute('projectId');
-            $project = $authorization->skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
+            $project = Authorization::skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
            $dbForProject = $getProjectDB($project);

            $resourceCollection = $resourceType === "function" ? 'functions' : 'sites';
            $resourceId = $repository->getAttribute('resourceId');
-            $resource = $authorization->skip(fn () => $dbForProject->getDocument($resourceCollection, $resourceId));
+            $resource = Authorization::skip(fn () => $dbForProject->getDocument($resourceCollection, $resourceId));
            $resourceInternalId = $resource->getSequence();

            $deploymentId = ID::unique();
@@ -141,7 +141,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
            $latestCommentId = '';

            if (!empty($providerPullRequestId) && $resource->getAttribute('providerSilentMode', false) === false) {
-                $latestComment = $authorization->skip(fn () => $dbForPlatform->findOne('vcsComments', [
+                $latestComment = Authorization::skip(fn () => $dbForPlatform->findOne('vcsComments', [
                    Query::equal('providerRepositoryId', [$providerRepositoryId]),
                    Query::equal('providerPullRequestId', [$providerPullRequestId]),
                    Query::orderDesc('$createdAt'),
@@ -180,7 +180,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId

                            $latestCommentId = \strval($github->updateComment($owner, $repositoryName, $latestCommentId, $comment->generateComment()));
                        } finally {
-                            $authorization->skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
+                            Authorization::skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
                        }
                    }
                } else {
@@ -191,7 +191,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                    if (!empty($latestCommentId)) {
                        $teamId = $project->getAttribute('teamId', '');

-                        $latestComment = $authorization->skip(fn () => $dbForPlatform->createDocument('vcsComments', new Document([
+                        $latestComment = Authorization::skip(fn () => $dbForPlatform->createDocument('vcsComments', new Document([
                            '$id' => ID::unique(),
                            '$permissions' => [
                                Permission::read(Role::team(ID::custom($teamId))),
@@ -212,7 +212,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                    }
                }
            } elseif (!empty($providerBranch)) {
-                $latestComments = $authorization->skip(fn () => $dbForPlatform->find('vcsComments', [
+                $latestComments = Authorization::skip(fn () => $dbForPlatform->find('vcsComments', [
                    Query::equal('providerRepositoryId', [$providerRepositoryId]),
                    Query::equal('providerBranch', [$providerBranch]),
                    Query::orderDesc('$createdAt'),
@@ -251,7 +251,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId

                            $latestCommentId = \strval($github->updateComment($owner, $repositoryName, $latestCommentId, $comment->generateComment()));
                        } finally {
-                            $authorization->skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
+                            Authorization::skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
                        }
                    }
                }
@@ -294,7 +294,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                $commands[] = $resource->getAttribute('commands', '');
            }

-            $deployment = $authorization->skip(fn () => $dbForProject->createDocument('deployments', new Document([
+            $deployment = Authorization::skip(fn () => $dbForProject->createDocument('deployments', new Document([
                '$id' => $deploymentId,
                '$permissions' => [
                    Permission::read(Role::any()),
@@ -334,7 +334,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                ->setAttribute('latestDeploymentInternalId', $deployment->getSequence())
                ->setAttribute('latestDeploymentCreatedAt', $deployment->getCreatedAt())
                ->setAttribute('latestDeploymentStatus', $deployment->getAttribute('status', ''));
-            $authorization->skip(fn () => $dbForProject->updateDocument($resource->getCollection(), $resource->getId(), $resource));
+            Authorization::skip(fn () => $dbForProject->updateDocument($resource->getCollection(), $resource->getId(), $resource));

            if ($resource->getCollection() === 'sites') {
                $projectId = $project->getId();
@@ -344,7 +344,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                $domain = ID::unique() . "." . $sitesDomain;
                $ruleId = md5($domain);
                $previewRuleId = $ruleId;
-                $authorization->skip(
+                Authorization::skip(
                    fn () => $dbForPlatform->createDocument('rules', new Document([
                        '$id' => $ruleId,
                        'projectId' => $project->getId(),
@@ -377,7 +377,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                    $domain = "branch-{$branchPrefix}-{$resourceProjectHash}.{$sitesDomain}";
                    $ruleId = md5($domain);
                    try {
-                        $authorization->skip(
+                        Authorization::skip(
                            fn () => $dbForPlatform->createDocument('rules', new Document([
                                '$id' => $ruleId,
                                'projectId' => $project->getId(),
@@ -408,7 +408,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                    $domain = "commit-" . substr($providerCommitHash, 0, 16) . ".{$sitesDomain}";
                    $ruleId = md5($domain);
                    try {
-                        $authorization->skip(
+                        Authorization::skip(
                            fn () => $dbForPlatform->createDocument('rules', new Document([
                                '$id' => $ruleId,
                                'projectId' => $project->getId(),
@@ -460,7 +460,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                if ($lockAcquired) {
                    // Wrap in try/finally to ensure lock file gets deleted
                    try {
-                        $rule = $authorization->skip(fn () => $dbForPlatform->getDocument('rules', $previewRuleId));
+                        $rule = Authorization::skip(fn () => $dbForPlatform->getDocument('rules', $previewRuleId));

                        $protocol = System::getEnv('_APP_OPTIONS_FORCE_HTTPS') === 'disabled' ? 'http' : 'https';
                        $previewUrl = !empty($rule) ? ("{$protocol}://" . $rule->getAttribute('domain', '')) : '';
@@ -472,7 +472,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                            $github->updateComment($owner, $repositoryName, $latestCommentId, $comment->generateComment());
                        }
                    } finally {
-                        $authorization->skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
+                        Authorization::skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
                    }
                }
            }
@@ -1476,12 +1476,11 @@ App::post('/v1/vcs/github/events')
    ->inject('request')
    ->inject('response')
    ->inject('dbForPlatform')
-    ->inject('authorization')
    ->inject('getProjectDB')
    ->inject('queueForBuilds')
    ->inject('platform')
    ->action(
-        function (GitHub $github, Request $request, Response $response, Database $dbForPlatform, Authorization $authorization, callable $getProjectDB, Build $queueForBuilds, array $platform) use ($createGitDeployments) {
+        function (GitHub $github, Request $request, Response $response, Database $dbForPlatform, callable $getProjectDB, Build $queueForBuilds, array $platform) use ($createGitDeployments) {
            $payload = $request->getRawPayload();
            $signatureRemote = $request->getHeader('x-hub-signature-256', '');
            $signatureLocal = System::getEnv('_APP_VCS_GITHUB_WEBHOOK_SECRET', '');
@@ -1517,14 +1516,14 @@ App::post('/v1/vcs/github/events')
                $github->initializeVariables($providerInstallationId, $privateKey, $githubAppId);

                //find resourceId from relevant resources table
-                $repositories = $authorization->skip(fn () => $dbForPlatform->find('repositories', [
+                $repositories = Authorization::skip(fn () => $dbForPlatform->find('repositories', [
                    Query::equal('providerRepositoryId', [$providerRepositoryId]),
                    Query::limit(100),
                ]));

                // create new deployment only on push (not committed by us) and not when branch is created or deleted
                if ($providerCommitAuthorEmail !== APP_VCS_GITHUB_EMAIL && !$providerBranchCreated && !$providerBranchDeleted) {
-                    $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, $providerBranchUrl, $providerRepositoryName, $providerRepositoryUrl, $providerRepositoryOwner, $providerCommitHash, $providerCommitAuthorName, $providerCommitAuthorUrl, $providerCommitMessage, $providerCommitUrl, '', false, $dbForPlatform, $authorization, $queueForBuilds, $getProjectDB, $request, $platform);
+                    $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, $providerBranchUrl, $providerRepositoryName, $providerRepositoryUrl, $providerRepositoryOwner, $providerCommitHash, $providerCommitAuthorName, $providerCommitAuthorUrl, $providerCommitMessage, $providerCommitUrl, '', false, $dbForPlatform, $queueForBuilds, $getProjectDB, $platform);
                }
            } elseif ($event == $github::EVENT_INSTALLATION) {
                if ($parsedPayload["action"] == "deleted") {
@@ -1537,16 +1536,16 @@ App::post('/v1/vcs/github/events')
                    ]);

                    foreach ($installations as $installation) {
-                        $repositories = $authorization->skip(fn () => $dbForPlatform->find('repositories', [
+                        $repositories = Authorization::skip(fn () => $dbForPlatform->find('repositories', [
                            Query::equal('installationInternalId', [$installation->getSequence()]),
                            Query::limit(1000)
                        ]));

                        foreach ($repositories as $repository) {
-                            $authorization->skip(fn () => $dbForPlatform->deleteDocument('repositories', $repository->getId()));
+                            Authorization::skip(fn () => $dbForPlatform->deleteDocument('repositories', $repository->getId()));
                        }

-                        $authorization->skip(fn () => $dbForPlatform->deleteDocument('installations', $installation->getId()));
+                        Authorization::skip(fn () => $dbForPlatform->deleteDocument('installations', $installation->getId()));
                    }
                }
            } elseif ($event == $github::EVENT_PULL_REQUEST) {
@@ -1575,12 +1574,12 @@ App::post('/v1/vcs/github/events')
                    $providerCommitAuthor = $commitDetails["commitAuthor"] ?? '';
                    $providerCommitMessage = $commitDetails["commitMessage"] ?? '';

-                    $repositories = $authorization->skip(fn () => $dbForPlatform->find('repositories', [
+                    $repositories = Authorization::skip(fn () => $dbForPlatform->find('repositories', [
                        Query::equal('providerRepositoryId', [$providerRepositoryId]),
                        Query::orderDesc('$createdAt')
                    ]));

-                    $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, $providerBranchUrl, $providerRepositoryName, $providerRepositoryUrl, $providerRepositoryOwner, $providerCommitHash, $providerCommitAuthor, $providerCommitAuthorUrl, $providerCommitMessage, $providerCommitUrl, $providerPullRequestId, $external, $dbForPlatform, $authorization, $queueForBuilds, $getProjectDB, $request, $platform);
+                    $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, $providerBranchUrl, $providerRepositoryName, $providerRepositoryUrl, $providerRepositoryOwner, $providerCommitHash, $providerCommitAuthor, $providerCommitAuthorUrl, $providerCommitMessage, $providerCommitUrl, $providerPullRequestId, $external, $dbForPlatform, $queueForBuilds, $getProjectDB, $platform);
                } elseif ($parsedPayload["action"] == "closed") {
                    // Allowed external contributions cleanup

@@ -1589,7 +1588,7 @@ App::post('/v1/vcs/github/events')
                    $external = $parsedPayload["external"] ?? true;

                    if ($external) {
-                        $repositories = $authorization->skip(fn () => $dbForPlatform->find('repositories', [
+                        $repositories = Authorization::skip(fn () => $dbForPlatform->find('repositories', [
                            Query::equal('providerRepositoryId', [$providerRepositoryId]),
                            Query::orderDesc('$createdAt')
                        ]));
@@ -1600,7 +1599,7 @@ App::post('/v1/vcs/github/events')
                            if (\in_array($providerPullRequestId, $providerPullRequestIds)) {
                                $providerPullRequestIds = \array_diff($providerPullRequestIds, [$providerPullRequestId]);
                                $repository = $repository->setAttribute('providerPullRequestIds', $providerPullRequestIds);
-                                $repository = $authorization->skip(fn () => $dbForPlatform->updateDocument('repositories', $repository->getId(), $repository));
+                                $repository = Authorization::skip(fn () => $dbForPlatform->updateDocument('repositories', $repository->getId(), $repository));
                            }
                        }
                    }
@@ -1787,18 +1786,17 @@ App::patch('/v1/vcs/github/installations/:installationId/repositories/:repositor
    ->inject('response')
    ->inject('project')
    ->inject('dbForPlatform')
-    ->inject('authorization')
    ->inject('getProjectDB')
    ->inject('queueForBuilds')
    ->inject('platform')
-    ->action(function (string $installationId, string $repositoryId, string $providerPullRequestId, GitHub $github, Request $request, Response $response, Document $project, Database $dbForPlatform, Authorization $authorization, callable $getProjectDB, Build $queueForBuilds, array $platform) use ($createGitDeployments) {
+    ->action(function (string $installationId, string $repositoryId, string $providerPullRequestId, GitHub $github, Response $response, Document $project, Database $dbForPlatform, callable $getProjectDB, Build $queueForBuilds, array $platform) use ($createGitDeployments) {
        $installation = $dbForPlatform->getDocument('installations', $installationId);

        if ($installation->isEmpty()) {
            throw new Exception(Exception::INSTALLATION_NOT_FOUND);
        }

-        $repository = $authorization->skip(fn () => $dbForPlatform->findOne('repositories', [
+        $repository = Authorization::skip(fn () => $dbForPlatform->findOne('repositories', [
            Query::equal('$id', [$repositoryId]),
            Query::equal('projectInternalId', [$project->getSequence()])
        ]));
@@ -1816,7 +1814,7 @@ App::patch('/v1/vcs/github/installations/:installationId/repositories/:repositor

        // TODO: Delete from array when PR is closed

-        $repository = $authorization->skip(fn () => $dbForPlatform->updateDocument('repositories', $repository->getId(), $repository));
+        $repository = Authorization::skip(fn () => $dbForPlatform->updateDocument('repositories', $repository->getId(), $repository));

        $privateKey = System::getEnv('_APP_VCS_GITHUB_PRIVATE_KEY');
        $githubAppId = System::getEnv('_APP_VCS_GITHUB_APP_ID');
@@ -1848,7 +1846,7 @@ App::patch('/v1/vcs/github/installations/:installationId/repositories/:repositor
        $providerCommitMessage = $pullRequestResponse['title'] ?? '';
        $providerCommitUrl = $pullRequestResponse['html_url'] ?? '';

-        $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, '', '', '', '', $providerCommitHash, '', '', '', '', $providerPullRequestId, true, $dbForPlatform, $authorization, $queueForBuilds, $getProjectDB, $request, $platform);
+        $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, $providerBranchUrl, $providerRepositoryName, $providerRepositoryUrl, $providerRepositoryOwner, $providerCommitHash, $providerCommitAuthor, $providerCommitAuthorUrl, $providerCommitMessage, $providerCommitUrl, $providerPullRequestId, true, $dbForPlatform, $queueForBuilds, $getProjectDB, $platform);

        $response->noContent();
    });
@@ -59,7 +59,7 @@ Config::setParam('domainVerification', false);
 Config::setParam('cookieDomain', 'localhost');
 Config::setParam('cookieSamesite', Response::COOKIE_SAMESITE_NONE);

-function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, Authorization $authorization, ?Key $apiKey)
+function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, ?Key $apiKey)
 {
    $host = $request->getHostname() ?? '';
    if (!empty($previewHostname)) {
@@ -67,16 +67,16 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
    }

    // TODO: (@Meldiron) Remove after 1.7.x migration
-    if (System::getEnv('_APP_RULES_FORMAT') === 'md5') {
-        $rule = $authorization->skip(fn () => $dbForPlatform->getDocument('rules', md5($host)));
-    } else {
-        $rule = $authorization->skip(
-            fn () => $dbForPlatform->find('rules', [
-                Query::equal('domain', [$host]),
-                Query::limit(1)
-            ])
-        )[0] ?? new Document();
-    }
+    $isMd5 = System::getEnv('_APP_RULES_FORMAT') === 'md5';
+    $rule = Authorization::skip(function () use ($dbForPlatform, $host, $isMd5) {
+        if ($isMd5) {
+            return $dbForPlatform->getDocument('rules', md5($host));
+        }
+
+        return $dbForPlatform->findOne('rules', [
+            Query::equal('domain', [$host]),
+        ]) ?? new Document();
+    });

    $errorView = __DIR__ . '/../views/general/error.phtml';
    $protocol = System::getEnv('_APP_OPTIONS_FORCE_HTTPS') == 'disabled' ? 'http' : 'https';
@@ -111,7 +111,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
    }

    $projectId = $rule->getAttribute('projectId');
-    $project = $authorization->skip(
+    $project = Authorization::skip(
        fn () => $dbForPlatform->getDocument('projects', $projectId)
    );

@@ -119,7 +119,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
        $accessedAt = $project->getAttribute('accessedAt', 0);
        if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_PROJECT_ACCESS)) > $accessedAt) {
            $project->setAttribute('accessedAt', DateTime::now());
-            $authorization->skip(fn () => $dbForPlatform->updateDocument('projects', $project->getId(), $project));
+            Authorization::skip(fn () => $dbForPlatform->updateDocument('projects', $project->getId(), $project));
        }

        /**
@@ -158,7 +158,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw

        /** @var Document $deployment */
        if (!empty($rule->getAttribute('deploymentId', ''))) {
-            $deployment = $authorization->skip(fn () => $dbForProject->getDocument('deployments', $rule->getAttribute('deploymentId')));
+            $deployment = Authorization::skip(fn () => $dbForProject->getDocument('deployments', $rule->getAttribute('deploymentId')));
        } else {
            // 1.6.x DB schema compatibility
            // TODO: Make sure deploymentId is never empty, and remove this code
@@ -172,15 +172,15 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw

            // Document of site or function
            $resource = $resourceType === 'function' ?
-                $authorization->skip(fn () => $dbForProject->getDocument('functions', $resourceId)) :
-                $authorization->skip(fn () => $dbForProject->getDocument('sites', $resourceId));
+                Authorization::skip(fn () => $dbForProject->getDocument('functions', $resourceId)) :
+                Authorization::skip(fn () => $dbForProject->getDocument('sites', $resourceId));

            // ID of active deployments
            // Attempts to use attribute from both schemas (1.6 and 1.7)
            $activeDeploymentId = $resource->getAttribute('deploymentId', $resource->getAttribute('deployment', ''));

            // Get deployment document, as intended originally
-            $deployment = $authorization->skip(fn () => $dbForProject->getDocument('deployments', $activeDeploymentId));
+            $deployment = Authorization::skip(fn () => $dbForProject->getDocument('deployments', $activeDeploymentId));
        }

        if ($deployment->getAttribute('resourceType', '') === 'functions') {
@@ -199,8 +199,8 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
        }

        $resource = $type === 'function' ?
-            $authorization->skip(fn () => $dbForProject->getDocument('functions', $deployment->getAttribute('resourceId', ''))) :
-            $authorization->skip(fn () => $dbForProject->getDocument('sites', $deployment->getAttribute('resourceId', '')));
+            Authorization::skip(fn () => $dbForProject->getDocument('functions', $deployment->getAttribute('resourceId', ''))) :
+            Authorization::skip(fn () => $dbForProject->getDocument('sites', $deployment->getAttribute('resourceId', '')));

        $isPreview = $type === 'function' ? false : ($rule->getAttribute('trigger', '') !== 'manual');

@@ -242,7 +242,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
                $userExists = false;
                $userId = $payload['userId'] ?? '';
                if (!empty($userId)) {
-                    $user = $authorization->skip(fn () => $dbForPlatform->getDocument('users', $userId));
+                    $user = Authorization::skip(fn () => $dbForPlatform->getDocument('users', $userId));
                    if (!$user->isEmpty() && $user->getAttribute('status', false)) {
                        $userExists = true;
                    }
@@ -255,7 +255,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
                }

                $membershipExists = false;
-                $project = $authorization->skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
+                $project = Authorization::skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
                if (!$project->isEmpty() && isset($user)) {
                    $teamId = $project->getAttribute('teamId', '');
                    $membership = $user->find('teamId', $teamId, 'memberships');
@@ -862,16 +862,15 @@ App::init()
    ->inject('devKey')
    ->inject('apiKey')
    ->inject('cors')
-    ->inject('authorization')
-    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Document $project, Database $dbForPlatform, callable $getProjectDB, Locale $locale, array $localeCodes, Reader $geodb, StatsUsage $queueForStatsUsage, Event $queueForEvents, Func $queueForFunctions, Executor $executor, array $platform, callable $isResourceBlocked, string $previewHostname, Document $devKey, ?Key $apiKey, Cors $cors, Authorization $authorization) {
+    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Document $project, Database $dbForPlatform, callable $getProjectDB, Locale $locale, array $localeCodes, Reader $geodb, StatsUsage $queueForStatsUsage, Event $queueForEvents, Func $queueForFunctions, Executor $executor, array $platform, callable $isResourceBlocked, string $previewHostname, Document $devKey, ?Key $apiKey, Cors $cors) {
        /*
        * Appwrite Router
        */
        $hostname = $request->getHostname() ?? '';
        $platformHostnames = $platform['hostnames'] ?? [];
        // Only run Router when external domain
-        if (!\in_array($hostname, $platformHostnames) || !empty($previewHostname)) {
-            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $authorization, $apiKey)) {
+        if (!in_array($hostname, $platformHostnames) || !empty($previewHostname)) {
+            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $apiKey)) {
                $utopia->getRoute()?->label('router', true);
            }
        }
@@ -1049,18 +1048,15 @@ App::init()
       if (empty($domain->get()) || !$domain->isKnown() || $domain->isTest()) {
           $cache[$domain->get()] = false;
           Config::setParam('hostnames', $cache);
-           Console::warning($domain->get() . ' is not a publicly accessible domain. Skipping SSL certificate generation.');
           return;
       }

       if (str_starts_with($request->getURI(), '/.well-known/acme-challenge')) {
-           Console::warning('Skipping SSL certificates generation on ACME challenge.');
           return;
       }

       // 3. Check if domain is a main domain
       if (!in_array($domain->get(), $platformHostnames)) {
-           Console::warning($domain->get() . ' is not a main domain. Skipping SSL certificate generation.');
           return;
       }

@@ -1145,8 +1141,7 @@ App::options()
    ->inject('devKey')
    ->inject('apiKey')
    ->inject('cors')
-    ->inject('authorization')
-    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, Document $project, Document $devKey, ?Key $apiKey, Cors $cors, Authorization $authorization) {
+    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, Document $project, Document $devKey, ?Key $apiKey, Cors $cors) {
        /*
        * Appwrite Router
        */
@@ -1187,8 +1182,7 @@ App::error()
    ->inject('log')
    ->inject('queueForStatsUsage')
    ->inject('devKey')
-    ->inject('authorization')
-    ->action(function (Throwable $error, App $utopia, Request $request, Response $response, Document $project, ?Logger $logger, Log $log, StatsUsage $queueForStatsUsage, Document $devKey, Authorization $authorization) {
+    ->action(function (Throwable $error, App $utopia, Request $request, Response $response, Document $project, ?Logger $logger, Log $log, StatsUsage $queueForStatsUsage) {
        $version = System::getEnv('_APP_VERSION', 'UNKNOWN');
        $route = $utopia->getRoute();
        $class = \get_class($error);
@@ -1270,7 +1264,7 @@ App::error()
         * If not a publishable error, track usage stats. Publishable errors are >= 500 or those explicitly marked as publish=true in errors.php
         */
        if (!$publish && $project->getId() !== 'console') {
-            if (!DBUser::isPrivileged($authorization->getRoles())) {
+            if (!DBUser::isPrivileged(Authorization::getRoles())) {
                $fileSize = 0;
                $file = $request->getFiles('file');
                if (!empty($file)) {
@@ -1332,7 +1326,7 @@ App::error()
            $log->addExtra('file', $error->getFile());
            $log->addExtra('line', $error->getLine());
            $log->addExtra('trace', $error->getTraceAsString());
-            $log->addExtra('roles', $authorization->getRoles());
+            $log->addExtra('roles', Authorization::getRoles());

            $action = 'UNKNOWN_NAMESPACE.UNKNOWN.METHOD';
            if (!empty($sdk)) {
@@ -1456,14 +1450,13 @@ App::get('/robots.txt')
    ->inject('platform')
    ->inject('previewHostname')
    ->inject('apiKey')
-    ->inject('authorization')
-    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, ?Key $apiKey, Authorization $authorization) {
+    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, ?Key $apiKey) {
        $platformHostnames = $platform['hostnames'] ?? [];
        if (in_array($request->getHostname(), $platformHostnames) || !empty($previewHostname)) {
            $template = new View(__DIR__ . '/../views/general/robots.phtml');
            $response->text($template->render(false));
        } else {
-            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $authorization, $apiKey)) {
+            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $apiKey)) {
                $utopia->getRoute()?->label('router', true);
            }
        }
@@ -1489,14 +1482,13 @@ App::get('/humans.txt')
    ->inject('platform')
    ->inject('previewHostname')
    ->inject('apiKey')
-    ->inject('authorization')
-    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, ?Key $apiKey, Authorization $authorization) {
+    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, ?Key $apiKey) {
        $platformHostnames = $platform['hostnames'] ?? [];
        if (in_array($request->getHostname(), $platformHostnames) || !empty($previewHostname)) {
            $template = new View(__DIR__ . '/../views/general/humans.phtml');
            $response->text($template->render(false));
        } else {
-            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $authorization, $apiKey)) {
+            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $apiKey)) {
                $utopia->getRoute()?->label('router', true);
            }
        }
@@ -1580,8 +1572,7 @@ App::get('/v1/ping')
    ->inject('project')
    ->inject('dbForPlatform')
    ->inject('queueForEvents')
-    ->inject('authorization')
-    ->action(function (Response $response, Document $project, Database $dbForPlatform, Event $queueForEvents, Authorization $authorization) {
+    ->action(function (Response $response, Document $project, Database $dbForPlatform, Event $queueForEvents) {
        if ($project->isEmpty() || $project->getId() === 'console') {
            throw new AppwriteException(AppwriteException::PROJECT_NOT_FOUND);
        }
@@ -1593,7 +1584,7 @@ App::get('/v1/ping')
            ->setAttribute('pingCount', $pingCount)
            ->setAttribute('pingedAt', $pingedAt);

-        $authorization->skip(function () use ($dbForPlatform, $project) {
+        Authorization::skip(function () use ($dbForPlatform, $project) {
            $dbForPlatform->updateDocument('projects', $project->getId(), $project);
        });

@@ -117,6 +117,28 @@ App::get('/v1/mock/tests/general/oauth2/user')
            'id' => 1,
            'name' => 'User Name',
            'email' => 'useroauth@localhost.test',
+            'verified' => true,
+        ]);
+    });
+
+App::get('/v1/mock/tests/general/oauth2/user-unverified')
+    ->desc('OAuth2 User Unverified')
+    ->groups(['mock'])
+    ->label('scope', 'public')
+    ->label('docs', false)
+    ->param('token', '', new Text(100), 'OAuth2 Access Token.')
+    ->inject('response')
+    ->action(function (string $token, Response $response) {
+
+        if ($token != '123456') {
+            throw new Exception(Exception::GENERAL_MOCK, 'Invalid token');
+        }
+
+        $response->json([
+            'id' => 2,
+            'name' => 'User Name Unverified',
+            'email' => 'useroauthunverified@localhost.test',
+            'verified' => false,
        ]);
    });

@@ -178,8 +200,12 @@ App::post('/v1/mock/api-key-unprefixed')
                Permission::update(Role::any()),
                Permission::delete(Role::any()),
            ],
+            // TODO: @hmacr Remove `projectInternalId` and `projectId` column writes before deleting the column.
            'projectInternalId' => $project->getSequence(),
            'projectId' => $project->getId(),
+            'resourceInternalId' => $project->getSequence(),
+            'resourceId' => $project->getId(),
+            'resourceType' => 'projects',
            'name' => 'Outdated key',
            'scopes' => $scopes,
            'expire' => null,
@@ -30,7 +30,6 @@ use Utopia\Database\DateTime;
 use Utopia\Database\Document;
 use Utopia\Database\Helpers\Role;
 use Utopia\Database\Validator\Authorization;
-use Utopia\Database\Validator\Authorization\Input;
 use Utopia\Queue\Publisher;
 use Utopia\System\System;
 use Utopia\Telemetry\Adapter as Telemetry;
@@ -234,8 +233,7 @@ App::init()
    ->inject('mode')
    ->inject('team')
    ->inject('apiKey')
-    ->inject('authorization')
-    ->action(function (App $utopia, Request $request, Database $dbForPlatform, Database $dbForProject, Audit $queueForAudits, Document $project, Document $user, ?Document $session, array $servers, string $mode, Document $team, ?Key $apiKey, Authorization $authorization) {
+    ->action(function (App $utopia, Request $request, Database $dbForPlatform, Database $dbForProject, Audit $queueForAudits, Document $project, User $user, ?Document $session, array $servers, string $mode, Document $team, ?Key $apiKey) {
        $route = $utopia->getRoute();

        /**
@@ -320,7 +318,7 @@ App::init()
            // Handle special app role case
            if ($apiKey->getRole() === User::ROLE_APPS) {
                // Disable authorization checks for API keys
-                $authorization->setDefaultStatus(false);
+                Authorization::setDefaultStatus(false);

                $user = new User([
                    '$id' => '',
@@ -394,14 +392,14 @@ App::init()
                $scopes = \array_merge($scopes, $roles[$role]['scopes']);
            }

-            $authorization->setDefaultStatus(false);  // Cancel security segmentation for admin users.
+            Authorization::setDefaultStatus(false);  // Cancel security segmentation for admin users.
        }

        $scopes = \array_unique($scopes);

-        $authorization->addRole($role);
-        foreach ($user->getRoles($authorization) as $authRole) {
-            $authorization->addRole($authRole);
+        Authorization::setRole($role);
+        foreach ($user->getRoles() as $authRole) {
+            Authorization::setRole($authRole);
        }

        // Step 6: Update project and user last activity
@@ -409,7 +407,7 @@ App::init()
            $accessedAt = $project->getAttribute('accessedAt', 0);
            if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_PROJECT_ACCESS)) > $accessedAt) {
                $project->setAttribute('accessedAt', DateTime::now());
-                $authorization->skip(fn () => $dbForPlatform->updateDocument('projects', $project->getId(), $project));
+                Authorization::skip(fn () => $dbForPlatform->updateDocument('projects', $project->getId(), $project));
            }
        }

@@ -444,7 +442,7 @@ App::init()
            if (
                array_key_exists($namespace, $project->getAttribute('services', []))
                && !$project->getAttribute('services', [])[$namespace]
-                && !(User::isPrivileged($authorization->getRoles()) || User::isApp($authorization->getRoles()))
+                && !(User::isPrivileged(Authorization::getRoles()) || User::isApp(Authorization::getRoles()))
            ) {
                throw new Exception(Exception::GENERAL_SERVICE_DISABLED);
            }
@@ -511,15 +509,14 @@ App::init()
    ->inject('devKey')
    ->inject('telemetry')
    ->inject('platform')
-    ->inject('authorization')
-    ->action(function (App $utopia, Request $request, Response $response, Document $project, Document $user, Publisher $publisher, Publisher $publisherFunctions, Publisher $publisherWebhooks, Event $queueForEvents, Messaging $queueForMessaging, Audit $queueForAudits, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Mail $queueForMails, Migration $queueForMigrations, Database $dbForProject, callable $timelimit, Document $resourceToken, string $mode, ?Key $apiKey, array $plan, Document $devKey, Telemetry $telemetry, array $platform, Authorization $authorization) use ($usageDatabaseListener, $eventDatabaseListener) {
+    ->action(function (App $utopia, Request $request, Response $response, Document $project, Document $user, Publisher $publisher, Publisher $publisherFunctions, Publisher $publisherWebhooks, Event $queueForEvents, Messaging $queueForMessaging, Audit $queueForAudits, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Mail $queueForMails, Migration $queueForMigrations, Database $dbForProject, callable $timelimit, Document $resourceToken, string $mode, ?Key $apiKey, array $plan, Document $devKey, Telemetry $telemetry, array $platform) use ($usageDatabaseListener, $eventDatabaseListener) {

        $route = $utopia->getRoute();

        if (
            array_key_exists('rest', $project->getAttribute('apis', []))
            && !$project->getAttribute('apis', [])['rest']
-            && !(User::isPrivileged($authorization->getRoles()) || User::isApp($authorization->getRoles()))
+            && !(User::isPrivileged(Authorization::getRoles()) || User::isApp(Authorization::getRoles()))
        ) {
            throw new AppwriteException(AppwriteException::GENERAL_API_DISABLED);
        }
@@ -549,7 +546,7 @@ App::init()

        $closestLimit = null;

-        $roles = $authorization->getRoles();
+        $roles = Authorization::getRoles();
        $isPrivilegedUser = User::isPrivileged($roles);
        $isAppUser = User::isApp($roles);

@@ -660,10 +657,10 @@ App::init()
        if ($useCache) {
            $route = $utopia->match($request);
            $isImageTransformation = $route->getPath() === '/v1/storage/buckets/:bucketId/files/:fileId/preview';
-            $isDisabled = isset($plan['imageTransformations']) && $plan['imageTransformations'] === -1 && !User::isPrivileged($authorization->getRoles());
+            $isDisabled = isset($plan['imageTransformations']) && $plan['imageTransformations'] === -1 && !User::isPrivileged(Authorization::getRoles());

            $key = $request->cacheIdentifier();
-            $cacheLog  = $authorization->skip(fn () => $dbForProject->getDocument('cache', $key));
+            $cacheLog  = Authorization::skip(fn () => $dbForProject->getDocument('cache', $key));
            $cache = new Cache(
                new Filesystem(APP_STORAGE_CACHE . DIRECTORY_SEPARATOR . 'app-' . $project->getId())
            );
@@ -680,10 +677,10 @@ App::init()

                if ($type === 'bucket' && (!$isImageTransformation || !$isDisabled)) {
                    $bucketId = $parts[1] ?? null;
-                    $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+                    $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));

                    $isToken = !$resourceToken->isEmpty() && $resourceToken->getAttribute('bucketInternalId') === $bucket->getSequence();
-                    $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+                    $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());

                    if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAppUser && !$isPrivilegedUser)) {
                        throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
@@ -694,7 +691,8 @@ App::init()
                    }

                    $fileSecurity = $bucket->getAttribute('fileSecurity', false);
-                    $valid = $authorization->isValid(new Input(Database::PERMISSION_READ, $bucket->getRead()));
+                    $validator = new Authorization(Database::PERMISSION_READ);
+                    $valid = $validator->isValid($bucket->getRead());
                    if (!$fileSecurity && !$valid && !$isToken) {
                        throw new Exception(Exception::USER_UNAUTHORIZED);
                    }
@@ -705,7 +703,7 @@ App::init()
                    if ($fileSecurity && !$valid && !$isToken) {
                        $file = $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId);
                    } else {
-                        $file = $authorization->skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+                        $file = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
                    }

                    if (!$resourceToken->isEmpty() && $resourceToken->getAttribute('fileInternalId') !== $file->getSequence()) {
@@ -716,11 +714,11 @@ App::init()
                        throw new Exception(Exception::STORAGE_FILE_NOT_FOUND);
                    }
                    //Do not update transformedAt if it's a console user
-                    if (!User::isPrivileged($authorization->getRoles())) {
+                    if (!User::isPrivileged(Authorization::getRoles())) {
                        $transformedAt = $file->getAttribute('transformedAt', '');
                        if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_PROJECT_ACCESS)) > $transformedAt) {
                            $file->setAttribute('transformedAt', DateTime::now());
-                            $authorization->skip(fn () => $dbForProject->updateDocument('bucket_' . $file->getAttribute('bucketInternalId'), $file->getId(), $file));
+                            Authorization::skip(fn () => $dbForProject->updateDocument('bucket_' . $file->getAttribute('bucketInternalId'), $file->getId(), $file));
                        }
                    }
                }
@@ -816,8 +814,8 @@ App::shutdown()
    ->inject('queueForWebhooks')
    ->inject('queueForRealtime')
    ->inject('dbForProject')
-    ->inject('authorization')
-    ->action(function (App $utopia, Request $request, Response $response, Document $project, Document $user, Event $queueForEvents, Audit $queueForAudits, StatsUsage $queueForStatsUsage, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, Messaging $queueForMessaging, Func $queueForFunctions, Event $queueForWebhooks, Realtime $queueForRealtime, Database $dbForProject, Authorization $authorization) use ($parseLabel) {
+    ->inject('timelimit')
+    ->action(function (App $utopia, Request $request, Response $response, Document $project, User $user, Event $queueForEvents, Audit $queueForAudits, StatsUsage $queueForStatsUsage, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, Messaging $queueForMessaging, Func $queueForFunctions, Event $queueForWebhooks, Realtime $queueForRealtime, Database $dbForProject, callable $timelimit) use ($parseLabel) {

        $responsePayload = $response->getPayload();

@@ -851,6 +849,41 @@ App::shutdown()
        $route = $utopia->getRoute();
        $requestParams = $route->getParamsValues();

+        /**
+         * Abuse labels
+         */
+        $abuseEnabled = System::getEnv('_APP_OPTIONS_ABUSE', 'enabled') !== 'disabled';
+        $abuseResetCode = $route->getLabel('abuse-reset', []);
+        $abuseResetCode = \is_array($abuseResetCode) ? $abuseResetCode : [$abuseResetCode];
+
+        if ($abuseEnabled && \count($abuseResetCode) > 0 && \in_array($response->getStatusCode(), $abuseResetCode)) {
+            $abuseKeyLabel = $route->getLabel('abuse-key', 'url:{url},ip:{ip}');
+            $abuseKeyLabel = (!is_array($abuseKeyLabel)) ? [$abuseKeyLabel] : $abuseKeyLabel;
+
+            foreach ($abuseKeyLabel as $abuseKey) {
+                $start = $request->getContentRangeStart();
+                $end = $request->getContentRangeEnd();
+                $timeLimit = $timelimit($abuseKey, $route->getLabel('abuse-limit', 0), $route->getLabel('abuse-time', 3600));
+                $timeLimit
+                    ->setParam('{projectId}', $project->getId())
+                    ->setParam('{userId}', $user->getId())
+                    ->setParam('{userAgent}', $request->getUserAgent(''))
+                    ->setParam('{ip}', $request->getIP())
+                    ->setParam('{url}', $request->getHostname() . $route->getPath())
+                    ->setParam('{method}', $request->getMethod())
+                    ->setParam('{chunkId}', (int)($start / ($end + 1 - $start)));
+
+                foreach ($request->getParams() as $key => $value) { // Set request params as potential abuse keys
+                    if (!empty($value)) {
+                        $timeLimit->setParam('{param-' . $key . '}', (\is_array($value)) ? \json_encode($value) : $value);
+                    }
+                }
+
+                $abuse = new Abuse($timeLimit);
+                $abuse->reset();
+            }
+        }
+
        /**
         * Audit labels
         */
@@ -943,11 +976,11 @@ App::shutdown()

                $key = $request->cacheIdentifier();
                $signature = md5($data['payload']);
-                $cacheLog  =  $authorization->skip(fn () => $dbForProject->getDocument('cache', $key));
+                $cacheLog  =  Authorization::skip(fn () => $dbForProject->getDocument('cache', $key));
                $accessedAt = $cacheLog->getAttribute('accessedAt', 0);
                $now = DateTime::now();
                if ($cacheLog->isEmpty()) {
-                    $authorization->skip(fn () => $dbForProject->createDocument('cache', new Document([
+                    Authorization::skip(fn () => $dbForProject->createDocument('cache', new Document([
                        '$id' => $key,
                        'resource' => $resource,
                        'resourceType' => $resourceType,
@@ -957,7 +990,7 @@ App::shutdown()
                    ])));
                } elseif (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_CACHE_UPDATE)) > $accessedAt) {
                    $cacheLog->setAttribute('accessedAt', $now);
-                    $authorization->skip(fn () => $dbForProject->updateDocument('cache', $cacheLog->getId(), $cacheLog));
+                    Authorization::skip(fn () => $dbForProject->updateDocument('cache', $cacheLog->getId(), $cacheLog));
                    // Overwrite the file every APP_CACHE_UPDATE seconds to update the file modified time that is used in the TTL checks in cache->load()
                    $cache->save($key, $data['payload']);
                }
@@ -969,7 +1002,7 @@ App::shutdown()
        }

        if ($project->getId() !== 'console') {
-            if (!User::isPrivileged($authorization->getRoles())) {
+            if (!User::isPrivileged(Authorization::getRoles())) {
                $fileSize = 0;
                $file = $request->getFiles('file');
                if (!empty($file)) {
@@ -36,8 +36,7 @@ App::init()
    ->inject('request')
    ->inject('project')
    ->inject('geodb')
-    ->inject('authorization')
-    ->action(function (App $utopia, Request $request, Document $project, Reader $geodb, Authorization $authorization) {
+    ->action(function (App $utopia, Request $request, Document $project, Reader $geodb) {
        $denylist = System::getEnv('_APP_CONSOLE_COUNTRIES_DENYLIST', '');
        if (!empty($denylist && $project->getId() === 'console')) {
            $countries = explode(',', $denylist);
@@ -50,8 +49,8 @@ App::init()

        $route = $utopia->match($request);

-        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
-        $isAppUser = User::isApp($authorization->getRoles());
+        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
+        $isAppUser = User::isApp(Authorization::getRoles());

        if ($isAppUser || $isPrivilegedUser) { // Skip limits for app and console devs
            return;
@@ -1,43 +0,0 @@
-<?php
-
-use Appwrite\Utopia\Request;
-use Appwrite\Utopia\Response;
-use Utopia\App;
-
-App::init()
-    ->groups(['web'])
-    ->inject('request')
-    ->inject('response')
-    ->action(function (Request $request, Response $response) {
-        $response
-            ->addHeader('X-Frame-Options', 'SAMEORIGIN') // Avoid console and homepage from showing in iframes
-            ->addHeader('X-XSS-Protection', '1; mode=block; report=/v1/xss?url=' . \urlencode($request->getURI()))
-            ->addHeader('X-UA-Compatible', 'IE=Edge') // Deny IE browsers from going into quirks mode
-        ;
-    });
-
-App::get('/')
-    ->alias('auth/*')
-    ->alias('/invite')
-    ->alias('/login')
-    ->alias('/mfa')
-    ->alias('/card/*')
-    ->alias('/recover')
-    ->alias('/register/*')
-    ->groups(['web'])
-    ->label('permission', 'public')
-    ->label('scope', 'home')
-    ->inject('request')
-    ->inject('response')
-    ->action(function (Request $request, Response $response) {
-        $url = parse_url($request->getURI());
-        $target = "/console{$url['path']}";
-        $params = $request->getParams();
-        if (!empty($params)) {
-            $target .= "?" . \http_build_query($params);
-        }
-        if ($url['fragment'] ?? false) {
-            $target .= "#{$url['fragment']}";
-        }
-        $response->redirect($target);
-    });
@@ -12,6 +12,8 @@ use Swoole\Process;
 use Swoole\Table;
 use Swoole\Timer;
 use Utopia\App;
+use Utopia\Audit\Adapter\Database as AdapterDatabase;
+use Utopia\Audit\Adapter\SQL as AuditAdapterSQL;
 use Utopia\Audit\Audit;
 use Utopia\CLI\Console;
 use Utopia\Compression\Compression;
@@ -25,6 +27,7 @@ use Utopia\Database\Helpers\ID;
 use Utopia\Database\Helpers\Permission;
 use Utopia\Database\Helpers\Role;
 use Utopia\Database\Query;
+use Utopia\Database\Validator\Authorization;
 use Utopia\Logger\Log;
 use Utopia\Logger\Log\User;
 use Utopia\Pools\Group;
@@ -258,11 +261,10 @@ $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $reg
        createDatabase($app, 'getLogsDB', 'logs', $collections['logs'], $pools);

        // create appwrite database, `dbForPlatform` is a direct access call.
-        createDatabase($app, 'dbForPlatform', 'appwrite', $collections['console'], $pools, function (Database $dbForPlatform) use ($collections, $app) {
-            $authorization = $app->getResource('authorization');
-
-            if ($dbForPlatform->getCollection(Audit::COLLECTION)->isEmpty()) {
-                $audit = new Audit($dbForPlatform);
+        createDatabase($app, 'dbForPlatform', 'appwrite', $collections['console'], $pools, function (Database $dbForPlatform) use ($collections) {
+            if ($dbForPlatform->getCollection(AuditAdapterSQL::COLLECTION)->isEmpty()) {
+                $adapter = new AdapterDatabase($dbForPlatform);
+                $audit = new Audit($adapter);
                $audit->setup();
            }

@@ -319,9 +321,9 @@ $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $reg
                $dbForPlatform->createCollection('bucket_' . $bucket->getSequence(), $attributes, $indexes);
            }

-            if ($authorization->skip(fn () => $dbForPlatform->getDocument('buckets', 'screenshots')->isEmpty())) {
+            if (Authorization::skip(fn () => $dbForPlatform->getDocument('buckets', 'screenshots')->isEmpty())) {
                Console::info("    └── Creating screenshots bucket...");
-                $authorization->skip(fn () => $dbForPlatform->createDocument('buckets', new Document([
+                Authorization::skip(fn () => $dbForPlatform->createDocument('buckets', new Document([
                    '$id' => ID::custom('screenshots'),
                    '$collection' => ID::custom('buckets'),
                    'name' => 'Screenshots',
@@ -336,7 +338,7 @@ $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $reg
                    'search' => 'buckets Screenshots',
                ])));

-                $bucket = $authorization->skip(fn () => $dbForPlatform->getDocument('buckets', 'screenshots'));
+                $bucket = Authorization::skip(fn () => $dbForPlatform->getDocument('buckets', 'screenshots'));

                Console::info("    └── Creating files collection for screenshots bucket...");
                $files = $collections['buckets']['files'] ?? [];
@@ -364,7 +366,7 @@ $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $reg
                    'orders' => $index['orders'],
                ]), $files['indexes']);

-                $authorization->skip(fn () => $dbForPlatform->createCollection('bucket_' . $bucket->getSequence(), $attributes, $indexes));
+                Authorization::skip(fn () => $dbForPlatform->createCollection('bucket_' . $bucket->getSequence(), $attributes, $indexes));
            }
        });

@@ -390,8 +392,9 @@ $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $reg
                Console::success('[Setup] - Skip: metadata table already exists');
            }

-            if ($dbForProject->getCollection(Audit::COLLECTION)->isEmpty()) {
-                $audit = new Audit($dbForProject);
+            if ($dbForProject->getCollection(AuditAdapterSQL::COLLECTION)->isEmpty()) {
+                $adapter = new AdapterDatabase($dbForProject);
+                $audit = new Audit($adapter);
                $audit->setup();
            }

@@ -455,12 +458,8 @@ $http->on(Constant::EVENT_REQUEST, function (SwooleRequest $swooleRequest, Swool
    App::setResource('pools', fn () => $pools);

    try {
-        $authorization = $app->getResource('authorization');
-
-        $request->setAuthorization($authorization);
-        $response->setAuthorization($authorization);
-        $authorization->cleanRoles();
-        $authorization->addRole(Role::any()->toString());
+        Authorization::cleanRoles();
+        Authorization::setRole(Role::any()->toString());

        $app->run($request, $response);
    } catch (\Throwable $th) {
@@ -502,7 +501,7 @@ $http->on(Constant::EVENT_REQUEST, function (SwooleRequest $swooleRequest, Swool
            $log->addExtra('file', $th->getFile());
            $log->addExtra('line', $th->getLine());
            $log->addExtra('trace', $th->getTraceAsString());
-            $log->addExtra('roles', isset($authorization) ? $authorization->getRoles() : []);
+            $log->addExtra('roles', Authorization::getRoles());

            $sdk = $route->getLabel("sdk", false);

@@ -561,7 +560,7 @@ $http->on(Constant::EVENT_TASK, function () use ($register, $domains) {
    /** @var Utopia\Database\Database $dbForPlatform */
    $dbForPlatform = $app->getResource('dbForPlatform');

-    Timer::tick(DOMAIN_SYNC_TIMER * 1000, function () use ($dbForPlatform, $domains, &$lastSyncUpdate, $app) {
+    Timer::tick(DOMAIN_SYNC_TIMER * 1000, function () use ($dbForPlatform, $domains, &$lastSyncUpdate) {
        try {
            $time = DateTime::now();
            $limit = 1000;
@@ -578,8 +577,7 @@ $http->on(Constant::EVENT_TASK, function () use ($register, $domains) {
                }
                $results = [];
                try {
-                    $authorization = $app->getResource('authorization');
-                    $results = $authorization->skip(fn () =>  $dbForPlatform->find('rules', $queries));
+                    $results = Authorization::skip(fn () =>  $dbForPlatform->find('rules', $queries));
                } catch (Throwable $th) {
                    Console::error($th->getMessage());
                }
@@ -26,6 +26,7 @@ require_once __DIR__ . '/init/database/filters.php';
 require_once __DIR__ . '/init/database/formats.php';
 require_once __DIR__ . '/init/locales.php';
 require_once __DIR__ . '/init/registers.php';
+require_once __DIR__ . '/init/models.php';
 require_once __DIR__ . '/init/resources.php';

 \stream_context_set_default([ // Set global user agent and http settings
@@ -44,7 +44,7 @@ const APP_RESOURCE_TOKEN_ACCESS = 24 * 60 * 60; // 24 hours
 const APP_FILE_ACCESS = 24 * 60 * 60; // 24 hours
 const APP_CACHE_UPDATE = 24 * 60 * 60; // 24 hours
 const APP_CACHE_BUSTER = 4321;
-const APP_VERSION_STABLE = '1.8.0';
+const APP_VERSION_STABLE = '1.8.1';
 const APP_DATABASE_ATTRIBUTE_EMAIL = 'email';
 const APP_DATABASE_ATTRIBUTE_ENUM = 'enum';
 const APP_DATABASE_ATTRIBUTE_IP = 'ip';
@@ -360,6 +360,7 @@ const RESOURCE_TYPE_TOPICS = 'topics';
 const RESOURCE_TYPE_SUBSCRIBERS = 'subscribers';
 const RESOURCE_TYPE_MESSAGES = 'messages';
 const RESOURCE_TYPE_EXECUTIONS = 'executions';
+const RESOURCE_TYPE_PAYMENTS = 'payments';

 // Resource types for Tokens
 const TOKENS_RESOURCE_TYPE_FILES = 'files';
@@ -4,6 +4,7 @@ use Appwrite\OpenSSL\OpenSSL;
 use Utopia\Database\Database;
 use Utopia\Database\Document;
 use Utopia\Database\Query;
+use Utopia\Database\Validator\Authorization;
 use Utopia\System\System;

 Database::addFilter(
@@ -69,11 +70,11 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        $attributes = $database->getAuthorization()->skip(fn () => $database->find('attributes', [
+        $attributes = $database->find('attributes', [
            Query::equal('collectionInternalId', [$document->getSequence()]),
            Query::equal('databaseInternalId', [$document->getAttribute('databaseInternalId')]),
            Query::limit($database->getLimitForAttributes()),
-        ]));
+        ]);

        foreach ($attributes as $attribute) {
            $attributeType = $attribute->getAttribute('type');
@@ -104,12 +105,12 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return $database->getAuthorization()->skip(fn () => $database
+        return $database
            ->find('indexes', [
                Query::equal('collectionInternalId', [$document->getSequence()]),
                Query::equal('databaseInternalId', [$document->getAttribute('databaseInternalId')]),
                Query::limit($database->getLimitForIndexes()),
-            ]));
+            ]);
    }
 );

@@ -119,11 +120,11 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return $database->getAuthorization()->skip(fn () => $database
+        return $database
            ->find('platforms', [
                Query::equal('projectInternalId', [$document->getSequence()]),
                Query::limit(APP_LIMIT_SUBQUERY),
-            ]));
+            ]);
    }
 );

@@ -133,11 +134,12 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return $database->getAuthorization()->skip(fn () => $database
+        return $database
            ->find('keys', [
-                Query::equal('projectInternalId', [$document->getSequence()]),
+                Query::equal('resourceType', ['projects']),
+                Query::equal('resourceInternalId', [$document->getSequence()]),
                Query::limit(APP_LIMIT_SUBQUERY),
-            ]));
+            ]);
    }
 );

@@ -147,11 +149,11 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return $database->getAuthorization()->skip(fn () => $database
+        return $database
            ->find('devKeys', [
                Query::equal('projectInternalId', [$document->getSequence()]),
                Query::limit(APP_LIMIT_SUBQUERY),
-            ]));
+            ]);
    }
 );

@@ -161,11 +163,11 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return $database->getAuthorization()->skip(fn () => $database
+        return $database
            ->find('webhooks', [
                Query::equal('projectInternalId', [$document->getSequence()]),
                Query::limit(APP_LIMIT_SUBQUERY),
-            ]));
+            ]);
    }
 );

@@ -175,7 +177,7 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return  $database->getAuthorization()->skip(fn () => $database->find('sessions', [
+        return Authorization::skip(fn () => $database->find('sessions', [
            Query::equal('userInternalId', [$document->getSequence()]),
            Query::limit(APP_LIMIT_SUBQUERY),
        ]));
@@ -188,7 +190,7 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return  $database->getAuthorization()->skip(fn () => $database
+        return Authorization::skip(fn () => $database
            ->find('tokens', [
                Query::equal('userInternalId', [$document->getSequence()]),
                Query::limit(APP_LIMIT_SUBQUERY),
@@ -202,7 +204,7 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return  $database->getAuthorization()->skip(fn () => $database
+        return Authorization::skip(fn () => $database
            ->find('challenges', [
                Query::equal('userInternalId', [$document->getSequence()]),
                Query::limit(APP_LIMIT_SUBQUERY),
@@ -216,7 +218,7 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return $database->getAuthorization()->skip(fn () => $database
+        return Authorization::skip(fn () => $database
            ->find('authenticators', [
                Query::equal('userInternalId', [$document->getSequence()]),
                Query::limit(APP_LIMIT_SUBQUERY),
@@ -230,7 +232,7 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return  $database->getAuthorization()->skip(fn () => $database
+        return Authorization::skip(fn () => $database
            ->find('memberships', [
                Query::equal('userInternalId', [$document->getSequence()]),
                Query::limit(APP_LIMIT_SUBQUERY),
@@ -250,14 +252,14 @@ Database::addFilter(
            default => ['function', 'site']
        };

-        return $database->getAuthorization()->skip(fn () => $database
+        return $database
            ->find('variables', [
                Query::equal('resourceInternalId', [$document->getSequence()]),
                Query::equal('resourceType', $resourceType),
                Query::orderAsc('resourceType'),
                Query::orderAsc(),
                Query::limit(APP_LIMIT_SUBQUERY),
-            ]));
+            ]);
    }
 );

@@ -293,11 +295,11 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return $database->getAuthorization()->skip(fn () => $database
+        return $database
            ->find('variables', [
                Query::equal('resourceType', ['project']),
                Query::limit(APP_LIMIT_SUBQUERY)
-            ]));
+            ]);
    }
 );

@@ -330,7 +332,7 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return  $database->getAuthorization()->skip(fn () => $database
+        return Authorization::skip(fn () => $database
            ->find('targets', [
                Query::equal('userInternalId', [$document->getSequence()]),
                Query::limit(APP_LIMIT_SUBQUERY)
@@ -344,7 +346,7 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        $targetIds =  $database->getAuthorization()->skip(fn () => \array_map(
+        $targetIds = Authorization::skip(fn () => \array_map(
            fn ($document) => $document->getAttribute('targetInternalId'),
            $database->find('subscribers', [
                Query::equal('topicInternalId', [$document->getSequence()]),
@@ -0,0 +1,366 @@
+<?php
+
+use Appwrite\Utopia\Response;
+use Appwrite\Utopia\Response\Model\Account;
+use Appwrite\Utopia\Response\Model\AlgoArgon2;
+use Appwrite\Utopia\Response\Model\AlgoBcrypt;
+use Appwrite\Utopia\Response\Model\AlgoMd5;
+use Appwrite\Utopia\Response\Model\AlgoPhpass;
+use Appwrite\Utopia\Response\Model\AlgoScrypt;
+use Appwrite\Utopia\Response\Model\AlgoScryptModified;
+use Appwrite\Utopia\Response\Model\AlgoSha;
+use Appwrite\Utopia\Response\Model\Any;
+use Appwrite\Utopia\Response\Model\Attribute;
+use Appwrite\Utopia\Response\Model\AttributeBoolean;
+use Appwrite\Utopia\Response\Model\AttributeDatetime;
+use Appwrite\Utopia\Response\Model\AttributeEmail;
+use Appwrite\Utopia\Response\Model\AttributeEnum;
+use Appwrite\Utopia\Response\Model\AttributeFloat;
+use Appwrite\Utopia\Response\Model\AttributeInteger;
+use Appwrite\Utopia\Response\Model\AttributeIP;
+use Appwrite\Utopia\Response\Model\AttributeLine;
+use Appwrite\Utopia\Response\Model\AttributeList;
+use Appwrite\Utopia\Response\Model\AttributePoint;
+use Appwrite\Utopia\Response\Model\AttributePolygon;
+use Appwrite\Utopia\Response\Model\AttributeRelationship;
+use Appwrite\Utopia\Response\Model\AttributeString;
+use Appwrite\Utopia\Response\Model\AttributeURL;
+use Appwrite\Utopia\Response\Model\AuthProvider;
+use Appwrite\Utopia\Response\Model\BaseList;
+use Appwrite\Utopia\Response\Model\Branch;
+use Appwrite\Utopia\Response\Model\Bucket;
+use Appwrite\Utopia\Response\Model\Collection;
+use Appwrite\Utopia\Response\Model\Column;
+use Appwrite\Utopia\Response\Model\ColumnBoolean;
+use Appwrite\Utopia\Response\Model\ColumnDatetime;
+use Appwrite\Utopia\Response\Model\ColumnEmail;
+use Appwrite\Utopia\Response\Model\ColumnEnum;
+use Appwrite\Utopia\Response\Model\ColumnFloat;
+use Appwrite\Utopia\Response\Model\ColumnIndex;
+use Appwrite\Utopia\Response\Model\ColumnInteger;
+use Appwrite\Utopia\Response\Model\ColumnIP;
+use Appwrite\Utopia\Response\Model\ColumnLine;
+use Appwrite\Utopia\Response\Model\ColumnList;
+use Appwrite\Utopia\Response\Model\ColumnPoint;
+use Appwrite\Utopia\Response\Model\ColumnPolygon;
+use Appwrite\Utopia\Response\Model\ColumnRelationship;
+use Appwrite\Utopia\Response\Model\ColumnString;
+use Appwrite\Utopia\Response\Model\ColumnURL;
+use Appwrite\Utopia\Response\Model\ConsoleVariables;
+use Appwrite\Utopia\Response\Model\Continent;
+use Appwrite\Utopia\Response\Model\Country;
+use Appwrite\Utopia\Response\Model\Currency;
+use Appwrite\Utopia\Response\Model\Database;
+use Appwrite\Utopia\Response\Model\Deployment;
+use Appwrite\Utopia\Response\Model\DetectionFramework;
+use Appwrite\Utopia\Response\Model\DetectionRuntime;
+use Appwrite\Utopia\Response\Model\DetectionVariable;
+use Appwrite\Utopia\Response\Model\DevKey;
+use Appwrite\Utopia\Response\Model\Document as ModelDocument;
+use Appwrite\Utopia\Response\Model\Error;
+use Appwrite\Utopia\Response\Model\ErrorDev;
+use Appwrite\Utopia\Response\Model\Execution;
+use Appwrite\Utopia\Response\Model\File;
+use Appwrite\Utopia\Response\Model\Framework;
+use Appwrite\Utopia\Response\Model\FrameworkAdapter;
+use Appwrite\Utopia\Response\Model\Func;
+use Appwrite\Utopia\Response\Model\Headers;
+use Appwrite\Utopia\Response\Model\HealthAntivirus;
+use Appwrite\Utopia\Response\Model\HealthCertificate;
+use Appwrite\Utopia\Response\Model\HealthQueue;
+use Appwrite\Utopia\Response\Model\HealthStatus;
+use Appwrite\Utopia\Response\Model\HealthTime;
+use Appwrite\Utopia\Response\Model\HealthVersion;
+use Appwrite\Utopia\Response\Model\Identity;
+use Appwrite\Utopia\Response\Model\Index;
+use Appwrite\Utopia\Response\Model\Installation;
+use Appwrite\Utopia\Response\Model\JWT;
+use Appwrite\Utopia\Response\Model\Key;
+use Appwrite\Utopia\Response\Model\Language;
+use Appwrite\Utopia\Response\Model\Locale;
+use Appwrite\Utopia\Response\Model\LocaleCode;
+use Appwrite\Utopia\Response\Model\Log;
+use Appwrite\Utopia\Response\Model\Membership;
+use Appwrite\Utopia\Response\Model\Message;
+use Appwrite\Utopia\Response\Model\Metric;
+use Appwrite\Utopia\Response\Model\MetricBreakdown;
+use Appwrite\Utopia\Response\Model\MFAChallenge;
+use Appwrite\Utopia\Response\Model\MFAFactors;
+use Appwrite\Utopia\Response\Model\MFARecoveryCodes;
+use Appwrite\Utopia\Response\Model\MFAType;
+use Appwrite\Utopia\Response\Model\Migration;
+use Appwrite\Utopia\Response\Model\MigrationFirebaseProject;
+use Appwrite\Utopia\Response\Model\MigrationReport;
+use Appwrite\Utopia\Response\Model\Mock;
+use Appwrite\Utopia\Response\Model\MockNumber;
+use Appwrite\Utopia\Response\Model\None;
+use Appwrite\Utopia\Response\Model\PaymentFeature;
+use Appwrite\Utopia\Response\Model\PaymentInvoice;
+use Appwrite\Utopia\Response\Model\PaymentPlan;
+use Appwrite\Utopia\Response\Model\PaymentPlanFeature;
+use Appwrite\Utopia\Response\Model\PaymentProviderConfig;
+use Appwrite\Utopia\Response\Model\PaymentSubscription;
+use Appwrite\Utopia\Response\Model\PaymentUsageEvent;
+use Appwrite\Utopia\Response\Model\Phone;
+use Appwrite\Utopia\Response\Model\Platform;
+use Appwrite\Utopia\Response\Model\Preferences;
+use Appwrite\Utopia\Response\Model\Project;
+use Appwrite\Utopia\Response\Model\Provider;
+use Appwrite\Utopia\Response\Model\ProviderRepository;
+use Appwrite\Utopia\Response\Model\ProviderRepositoryFramework;
+use Appwrite\Utopia\Response\Model\ProviderRepositoryRuntime;
+use Appwrite\Utopia\Response\Model\ResourceToken;
+use Appwrite\Utopia\Response\Model\Row;
+use Appwrite\Utopia\Response\Model\Rule;
+use Appwrite\Utopia\Response\Model\Runtime;
+use Appwrite\Utopia\Response\Model\Session;
+use Appwrite\Utopia\Response\Model\Site;
+use Appwrite\Utopia\Response\Model\Specification;
+use Appwrite\Utopia\Response\Model\Subscriber;
+use Appwrite\Utopia\Response\Model\Table;
+use Appwrite\Utopia\Response\Model\Target;
+use Appwrite\Utopia\Response\Model\Team;
+use Appwrite\Utopia\Response\Model\TemplateEmail;
+use Appwrite\Utopia\Response\Model\TemplateFramework;
+use Appwrite\Utopia\Response\Model\TemplateFunction;
+use Appwrite\Utopia\Response\Model\TemplateRuntime;
+use Appwrite\Utopia\Response\Model\TemplateSite;
+use Appwrite\Utopia\Response\Model\TemplateSMS;
+use Appwrite\Utopia\Response\Model\TemplateVariable;
+use Appwrite\Utopia\Response\Model\Token;
+use Appwrite\Utopia\Response\Model\Topic;
+use Appwrite\Utopia\Response\Model\Transaction;
+use Appwrite\Utopia\Response\Model\UsageBuckets;
+use Appwrite\Utopia\Response\Model\UsageCollection;
+use Appwrite\Utopia\Response\Model\UsageDatabase;
+use Appwrite\Utopia\Response\Model\UsageDatabases;
+use Appwrite\Utopia\Response\Model\UsageFunction;
+use Appwrite\Utopia\Response\Model\UsageFunctions;
+use Appwrite\Utopia\Response\Model\UsageProject;
+use Appwrite\Utopia\Response\Model\UsageSite;
+use Appwrite\Utopia\Response\Model\UsageSites;
+use Appwrite\Utopia\Response\Model\UsageStorage;
+use Appwrite\Utopia\Response\Model\UsageTable;
+use Appwrite\Utopia\Response\Model\UsageUsers;
+use Appwrite\Utopia\Response\Model\User;
+use Appwrite\Utopia\Response\Model\Variable;
+use Appwrite\Utopia\Response\Model\VcsContent;
+use Appwrite\Utopia\Response\Model\Webhook;
+
+// General
+Response::setModel(new None());
+Response::setModel(new Any());
+Response::setModel(new Error());
+Response::setModel(new ErrorDev());
+
+// Lists
+Response::setModel(new BaseList('Rows List', Response::MODEL_ROW_LIST, 'rows', Response::MODEL_ROW));
+Response::setModel(new BaseList('Documents List', Response::MODEL_DOCUMENT_LIST, 'documents', Response::MODEL_DOCUMENT));
+Response::setModel(new BaseList('Tables List', Response::MODEL_TABLE_LIST, 'tables', Response::MODEL_TABLE));
+Response::setModel(new BaseList('Collections List', Response::MODEL_COLLECTION_LIST, 'collections', Response::MODEL_COLLECTION));
+Response::setModel(new BaseList('Databases List', Response::MODEL_DATABASE_LIST, 'databases', Response::MODEL_DATABASE));
+Response::setModel(new BaseList('Indexes List', Response::MODEL_INDEX_LIST, 'indexes', Response::MODEL_INDEX));
+Response::setModel(new BaseList('Column Indexes List', Response::MODEL_COLUMN_INDEX_LIST, 'indexes', Response::MODEL_COLUMN_INDEX));
+Response::setModel(new BaseList('Users List', Response::MODEL_USER_LIST, 'users', Response::MODEL_USER));
+Response::setModel(new BaseList('Sessions List', Response::MODEL_SESSION_LIST, 'sessions', Response::MODEL_SESSION));
+Response::setModel(new BaseList('Identities List', Response::MODEL_IDENTITY_LIST, 'identities', Response::MODEL_IDENTITY));
+Response::setModel(new BaseList('Logs List', Response::MODEL_LOG_LIST, 'logs', Response::MODEL_LOG));
+Response::setModel(new BaseList('Files List', Response::MODEL_FILE_LIST, 'files', Response::MODEL_FILE));
+Response::setModel(new BaseList('Buckets List', Response::MODEL_BUCKET_LIST, 'buckets', Response::MODEL_BUCKET));
+Response::setModel(new BaseList('Resource Tokens List', Response::MODEL_RESOURCE_TOKEN_LIST, 'tokens', Response::MODEL_RESOURCE_TOKEN));
+Response::setModel(new BaseList('Teams List', Response::MODEL_TEAM_LIST, 'teams', Response::MODEL_TEAM));
+Response::setModel(new BaseList('Memberships List', Response::MODEL_MEMBERSHIP_LIST, 'memberships', Response::MODEL_MEMBERSHIP));
+Response::setModel(new BaseList('Sites List', Response::MODEL_SITE_LIST, 'sites', Response::MODEL_SITE));
+Response::setModel(new BaseList('Site Templates List', Response::MODEL_TEMPLATE_SITE_LIST, 'templates', Response::MODEL_TEMPLATE_SITE));
+Response::setModel(new BaseList('Functions List', Response::MODEL_FUNCTION_LIST, 'functions', Response::MODEL_FUNCTION));
+Response::setModel(new BaseList('Function Templates List', Response::MODEL_TEMPLATE_FUNCTION_LIST, 'templates', Response::MODEL_TEMPLATE_FUNCTION));
+Response::setModel(new BaseList('Installations List', Response::MODEL_INSTALLATION_LIST, 'installations', Response::MODEL_INSTALLATION));
+Response::setModel(new BaseList('Framework Provider Repositories List', Response::MODEL_PROVIDER_REPOSITORY_FRAMEWORK_LIST, 'frameworkProviderRepositories', Response::MODEL_PROVIDER_REPOSITORY_FRAMEWORK));
+Response::setModel(new BaseList('Runtime Provider Repositories List', Response::MODEL_PROVIDER_REPOSITORY_RUNTIME_LIST, 'runtimeProviderRepositories', Response::MODEL_PROVIDER_REPOSITORY_RUNTIME));
+Response::setModel(new BaseList('Branches List', Response::MODEL_BRANCH_LIST, 'branches', Response::MODEL_BRANCH));
+Response::setModel(new BaseList('Frameworks List', Response::MODEL_FRAMEWORK_LIST, 'frameworks', Response::MODEL_FRAMEWORK));
+Response::setModel(new BaseList('Runtimes List', Response::MODEL_RUNTIME_LIST, 'runtimes', Response::MODEL_RUNTIME));
+Response::setModel(new BaseList('Deployments List', Response::MODEL_DEPLOYMENT_LIST, 'deployments', Response::MODEL_DEPLOYMENT));
+Response::setModel(new BaseList('Executions List', Response::MODEL_EXECUTION_LIST, 'executions', Response::MODEL_EXECUTION));
+Response::setModel(new BaseList('Projects List', Response::MODEL_PROJECT_LIST, 'projects', Response::MODEL_PROJECT, true, false));
+Response::setModel(new BaseList('Webhooks List', Response::MODEL_WEBHOOK_LIST, 'webhooks', Response::MODEL_WEBHOOK, true, false));
+Response::setModel(new BaseList('API Keys List', Response::MODEL_KEY_LIST, 'keys', Response::MODEL_KEY, true, false));
+Response::setModel(new BaseList('Dev Keys List', Response::MODEL_DEV_KEY_LIST, 'devKeys', Response::MODEL_DEV_KEY, true, false));
+Response::setModel(new BaseList('Auth Providers List', Response::MODEL_AUTH_PROVIDER_LIST, 'platforms', Response::MODEL_AUTH_PROVIDER, true, false));
+Response::setModel(new BaseList('Platforms List', Response::MODEL_PLATFORM_LIST, 'platforms', Response::MODEL_PLATFORM, true, false));
+Response::setModel(new BaseList('Countries List', Response::MODEL_COUNTRY_LIST, 'countries', Response::MODEL_COUNTRY));
+Response::setModel(new BaseList('Continents List', Response::MODEL_CONTINENT_LIST, 'continents', Response::MODEL_CONTINENT));
+Response::setModel(new BaseList('Languages List', Response::MODEL_LANGUAGE_LIST, 'languages', Response::MODEL_LANGUAGE));
+Response::setModel(new BaseList('Currencies List', Response::MODEL_CURRENCY_LIST, 'currencies', Response::MODEL_CURRENCY));
+Response::setModel(new BaseList('Phones List', Response::MODEL_PHONE_LIST, 'phones', Response::MODEL_PHONE));
+Response::setModel(new BaseList('Metric List', Response::MODEL_METRIC_LIST, 'metrics', Response::MODEL_METRIC, true, false));
+Response::setModel(new BaseList('Variables List', Response::MODEL_VARIABLE_LIST, 'variables', Response::MODEL_VARIABLE));
+Response::setModel(new BaseList('Status List', Response::MODEL_HEALTH_STATUS_LIST, 'statuses', Response::MODEL_HEALTH_STATUS));
+Response::setModel(new BaseList('Rule List', Response::MODEL_PROXY_RULE_LIST, 'rules', Response::MODEL_PROXY_RULE));
+Response::setModel(new BaseList('Locale codes list', Response::MODEL_LOCALE_CODE_LIST, 'localeCodes', Response::MODEL_LOCALE_CODE));
+Response::setModel(new BaseList('Provider list', Response::MODEL_PROVIDER_LIST, 'providers', Response::MODEL_PROVIDER));
+Response::setModel(new BaseList('Message list', Response::MODEL_MESSAGE_LIST, 'messages', Response::MODEL_MESSAGE));
+Response::setModel(new BaseList('Topic list', Response::MODEL_TOPIC_LIST, 'topics', Response::MODEL_TOPIC));
+Response::setModel(new BaseList('Subscriber list', Response::MODEL_SUBSCRIBER_LIST, 'subscribers', Response::MODEL_SUBSCRIBER));
+Response::setModel(new BaseList('Target list', Response::MODEL_TARGET_LIST, 'targets', Response::MODEL_TARGET));
+Response::setModel(new BaseList('Transaction List', Response::MODEL_TRANSACTION_LIST, 'transactions', Response::MODEL_TRANSACTION));
+Response::setModel(new BaseList('Migrations List', Response::MODEL_MIGRATION_LIST, 'migrations', Response::MODEL_MIGRATION));
+Response::setModel(new BaseList('Migrations Firebase Projects List', Response::MODEL_MIGRATION_FIREBASE_PROJECT_LIST, 'projects', Response::MODEL_MIGRATION_FIREBASE_PROJECT));
+Response::setModel(new BaseList('Specifications List', Response::MODEL_SPECIFICATION_LIST, 'specifications', Response::MODEL_SPECIFICATION));
+Response::setModel(new BaseList('VCS Content List', Response::MODEL_VCS_CONTENT_LIST, 'contents', Response::MODEL_VCS_CONTENT));
+
+// Entities
+Response::setModel(new Database());
+
+// Collection API Models
+Response::setModel(new Collection());
+Response::setModel(new Attribute());
+Response::setModel(new AttributeList());
+Response::setModel(new AttributeString());
+Response::setModel(new AttributeInteger());
+Response::setModel(new AttributeFloat());
+Response::setModel(new AttributeBoolean());
+Response::setModel(new AttributeEmail());
+Response::setModel(new AttributeEnum());
+Response::setModel(new AttributeIP());
+Response::setModel(new AttributeURL());
+Response::setModel(new AttributeDatetime());
+Response::setModel(new AttributeRelationship());
+Response::setModel(new AttributePoint());
+Response::setModel(new AttributeLine());
+Response::setModel(new AttributePolygon());
+
+// Table API Models
+Response::setModel(new Table());
+Response::setModel(new Column());
+Response::setModel(new ColumnList());
+Response::setModel(new ColumnString());
+Response::setModel(new ColumnInteger());
+Response::setModel(new ColumnFloat());
+Response::setModel(new ColumnBoolean());
+Response::setModel(new ColumnEmail());
+Response::setModel(new ColumnEnum());
+Response::setModel(new ColumnIP());
+Response::setModel(new ColumnURL());
+Response::setModel(new ColumnDatetime());
+Response::setModel(new ColumnRelationship());
+Response::setModel(new ColumnPoint());
+Response::setModel(new ColumnLine());
+Response::setModel(new ColumnPolygon());
+Response::setModel(new Index());
+Response::setModel(new ColumnIndex());
+Response::setModel(new Row());
+Response::setModel(new ModelDocument());
+Response::setModel(new Log());
+Response::setModel(new User());
+Response::setModel(new AlgoMd5());
+Response::setModel(new AlgoSha());
+Response::setModel(new AlgoPhpass());
+Response::setModel(new AlgoBcrypt());
+Response::setModel(new AlgoScrypt());
+Response::setModel(new AlgoScryptModified());
+Response::setModel(new AlgoArgon2());
+Response::setModel(new Account());
+Response::setModel(new Preferences());
+Response::setModel(new Session());
+Response::setModel(new Identity());
+Response::setModel(new Token());
+Response::setModel(new JWT());
+Response::setModel(new Locale());
+Response::setModel(new LocaleCode());
+Response::setModel(new File());
+Response::setModel(new Bucket());
+Response::setModel(new ResourceToken());
+Response::setModel(new Team());
+Response::setModel(new Membership());
+Response::setModel(new Site());
+Response::setModel(new TemplateSite());
+Response::setModel(new TemplateFramework());
+Response::setModel(new Func());
+Response::setModel(new TemplateFunction());
+Response::setModel(new TemplateRuntime());
+Response::setModel(new TemplateVariable());
+Response::setModel(new Installation());
+Response::setModel(new ProviderRepository());
+Response::setModel(new ProviderRepositoryFramework());
+Response::setModel(new ProviderRepositoryRuntime());
+Response::setModel(new DetectionFramework());
+Response::setModel(new DetectionRuntime());
+Response::setModel(new DetectionVariable());
+Response::setModel(new VcsContent());
+Response::setModel(new Branch());
+Response::setModel(new Runtime());
+Response::setModel(new Framework());
+Response::setModel(new FrameworkAdapter());
+Response::setModel(new Deployment());
+Response::setModel(new Execution());
+Response::setModel(new Project());
+Response::setModel(new Webhook());
+Response::setModel(new Key());
+Response::setModel(new DevKey());
+Response::setModel(new MockNumber());
+Response::setModel(new AuthProvider());
+Response::setModel(new Platform());
+Response::setModel(new Variable());
+Response::setModel(new Country());
+Response::setModel(new Continent());
+Response::setModel(new Language());
+Response::setModel(new Currency());
+Response::setModel(new Phone());
+Response::setModel(new HealthAntivirus());
+Response::setModel(new HealthQueue());
+Response::setModel(new HealthStatus());
+Response::setModel(new HealthCertificate());
+Response::setModel(new HealthTime());
+Response::setModel(new HealthVersion());
+Response::setModel(new Metric());
+Response::setModel(new MetricBreakdown());
+Response::setModel(new UsageDatabases());
+Response::setModel(new UsageDatabase());
+Response::setModel(new UsageTable());
+Response::setModel(new UsageCollection());
+Response::setModel(new UsageUsers());
+Response::setModel(new UsageStorage());
+Response::setModel(new UsageBuckets());
+Response::setModel(new UsageFunctions());
+Response::setModel(new UsageFunction());
+Response::setModel(new UsageSites());
+Response::setModel(new UsageSite());
+Response::setModel(new UsageProject());
+Response::setModel(new Headers());
+Response::setModel(new Specification());
+Response::setModel(new Rule());
+Response::setModel(new TemplateSMS());
+Response::setModel(new TemplateEmail());
+Response::setModel(new ConsoleVariables());
+Response::setModel(new MFAChallenge());
+Response::setModel(new MFARecoveryCodes());
+Response::setModel(new MFAType());
+Response::setModel(new MFAFactors());
+Response::setModel(new Provider());
+Response::setModel(new Message());
+Response::setModel(new Topic());
+Response::setModel(new Transaction());
+Response::setModel(new Subscriber());
+Response::setModel(new Target());
+Response::setModel(new Migration());
+Response::setModel(new MigrationReport());
+Response::setModel(new MigrationFirebaseProject());
+
+// Payments
+Response::setModel(new PaymentPlan());
+Response::setModel(new PaymentFeature());
+Response::setModel(new PaymentSubscription());
+Response::setModel(new PaymentProviderConfig());
+Response::setModel(new PaymentPlanFeature());
+Response::setModel(new PaymentInvoice());
+Response::setModel(new PaymentUsageEvent());
+Response::setModel(new BaseList('Payment Subscription List', Response::MODEL_PAYMENT_SUBSCRIPTION_LIST, 'subscriptions', Response::MODEL_PAYMENT_SUBSCRIPTION, true, true));
+Response::setModel(new BaseList('Payment Plan List', Response::MODEL_PAYMENT_PLAN_LIST, 'plans', Response::MODEL_PAYMENT_PLAN, true, true));
+Response::setModel(new BaseList('Payment Feature List', Response::MODEL_PAYMENT_FEATURE_LIST, 'features', Response::MODEL_PAYMENT_FEATURE, true, true));
+Response::setModel(new BaseList('Payment Plan Feature List', Response::MODEL_PAYMENT_PLAN_FEATURE_LIST, 'features', Response::MODEL_PAYMENT_PLAN_FEATURE, true, true));
+Response::setModel(new BaseList('Payment Invoice List', Response::MODEL_PAYMENT_INVOICE_LIST, 'invoices', Response::MODEL_PAYMENT_INVOICE, true, true));
+Response::setModel(new BaseList('Payment Usage Event List', Response::MODEL_PAYMENT_USAGE_EVENT_LIST, 'events', Response::MODEL_PAYMENT_USAGE_EVENT, true, true));
+
+// Tests (keep last)
+Response::setModel(new Mock());
@@ -360,6 +360,8 @@ $register->set('smtp', function () {
    $mail->SMTPSecure = System::getEnv('_APP_SMTP_SECURE', '');
    $mail->SMTPAutoTLS = false;
    $mail->CharSet = 'UTF-8';
+    $mail->Timeout = 10; /* Connection timeout */
+    $mail->getSMTPInstance()->Timelimit = 30; /* Timeout for each individual SMTP command (e.g. HELO, EHLO, etc.) */

    $from = \urldecode(System::getEnv('_APP_SYSTEM_EMAIL_NAME', APP_NAME . ' Server'));
    $email = System::getEnv('_APP_SYSTEM_EMAIL_ADDRESS', APP_EMAIL_TEAM);
@@ -386,3 +388,8 @@ $register->set('promiseAdapter', function () {
 $register->set('hooks', function () {
    return new Hooks();
 });
+$register->set('registryPayments', function () {
+    $registry = new \Appwrite\Payments\Provider\Registry();
+    $registry->register('stripe', \Appwrite\Payments\Provider\StripeAdapter::class);
+    return $registry;
+});
@@ -4,7 +4,7 @@ use Ahc\Jwt\JWT;
 use Ahc\Jwt\JWTException;
 use Appwrite\Auth\Key;
 use Appwrite\Databases\TransactionState;
-use Appwrite\Event\Audit;
+use Appwrite\Event\Audit as AuditEvent;
 use Appwrite\Event\Build;
 use Appwrite\Event\Certificate;
 use Appwrite\Event\Database as EventDatabase;
@@ -30,6 +30,8 @@ use Appwrite\Utopia\Response;
 use Executor\Executor;
 use Utopia\Abuse\Adapters\TimeLimit\Redis as TimeLimitRedis;
 use Utopia\App;
+use Utopia\Audit\Adapter\Database as AdapterDatabase;
+use Utopia\Audit\Audit;
 use Utopia\Auth\Hashes\Argon2;
 use Utopia\Auth\Hashes\Sha;
 use Utopia\Auth\Proofs\Code;
@@ -80,6 +82,9 @@ App::setResource('hooks', function ($register) {
 }, ['register']);

 App::setResource('register', fn () => $register);
+App::setResource('registryPayments', function ($register) {
+    return $register->get('registryPayments');
+}, ['register']);
 App::setResource('locale', function () {
    $locale = new Locale(System::getEnv('_APP_LOCALE', 'en'));
    $locale->setFallback(System::getEnv('_APP_LOCALE', 'en'));
@@ -146,7 +151,7 @@ App::setResource('queueForStatsUsage', function (Publisher $publisher) {
    return new StatsUsage($publisher);
 }, ['publisher']);
 App::setResource('queueForAudits', function (Publisher $publisher) {
-    return new Audit($publisher);
+    return new AuditEvent($publisher);
 }, ['publisher']);
 App::setResource('queueForFunctions', function (Publisher $publisher) {
    return new Func($publisher);
@@ -224,7 +229,7 @@ App::setResource('allowedSchemes', function (Document $project) {
 /**
 * Rule associated with a request origin.
 */
-App::setResource('rule', function (Request $request, Database $dbForPlatform, Document $project, Authorization $authorization) {
+App::setResource('rule', function (Request $request, Database $dbForPlatform, Document $project) {
    $domain = \parse_url($request->getOrigin(), PHP_URL_HOST);
    if (empty($domain)) {
        return new Document();
@@ -232,7 +237,7 @@ App::setResource('rule', function (Request $request, Database $dbForPlatform, Do

    // TODO: (@Meldiron) Remove after 1.7.x migration
    $isMd5 = System::getEnv('_APP_RULES_FORMAT') === 'md5';
-    $rule = $authorization->skip(function () use ($dbForPlatform, $domain, $isMd5) {
+    $rule = Authorization::skip(function () use ($dbForPlatform, $domain, $isMd5) {
        if ($isMd5) {
            return $dbForPlatform->getDocument('rules', md5($domain));
        }
@@ -247,7 +252,7 @@ App::setResource('rule', function (Request $request, Database $dbForPlatform, Do
    }

    return $rule;
-}, ['request', 'dbForPlatform', 'project', 'authorization']);
+}, ['request', 'dbForPlatform', 'project']);

 /**
 * CORS service
@@ -275,6 +280,7 @@ App::setResource('cors', fn (array $allowedHostnames) => new Cors(
        'X-Appwrite-ID',
        'X-Appwrite-Timestamp',
        'X-Appwrite-Session',
+        'X-Appwrite-Platform', // for `$platform` injection and SDK generator
        // SDK generator
        'X-SDK-Version',
        'X-SDK-Name',
@@ -314,7 +320,7 @@ App::setResource('redirectValidator', function (Document $devKey, array $allowed
    return new Redirect($allowedHostnames, $allowedSchemes);
 }, ['devKey', 'allowedHostnames', 'allowedSchemes']);

-App::setResource('user', function (string $mode, Document $project, Document $console, Request $request, Response $response, Database $dbForProject, Database $dbForPlatform, Store $store, Token $proofForToken, $authorization) {
+App::setResource('user', function (string $mode, Document $project, Document $console, Request $request, Response $response, Database $dbForProject, Database $dbForPlatform, Store $store, Token $proofForToken) {
    /**
     * Handles user authentication and session validation.
     *
@@ -334,7 +340,7 @@ App::setResource('user', function (string $mode, Document $project, Document $co
     *    overwriting the previous value.
     */

-    $authorization->setDefaultStatus(true);
+    Authorization::setDefaultStatus(true);

    $store->setKey('a_session_' . $project->getId());

@@ -401,7 +407,7 @@ App::setResource('user', function (string $mode, Document $project, Document $co
    }
    // if (APP_MODE_ADMIN === $mode) {
    //     if ($user->find('teamInternalId', $project->getAttribute('teamInternalId'), 'memberships')) {
-    //         $authorization->setDefaultStatus(false);  // Cancel security segmentation for admin users.
+    //         Authorization::setDefaultStatus(false);  // Cancel security segmentation for admin users.
    //     } else {
    //         $user = new Document([]);
    //     }
@@ -433,9 +439,9 @@ App::setResource('user', function (string $mode, Document $project, Document $co
    $dbForPlatform->setMetadata('user', $user->getId());

    return $user;
-}, ['mode', 'project', 'console', 'request', 'response', 'dbForProject', 'dbForPlatform', 'store', 'proofForToken', 'authorization']);
+}, ['mode', 'project', 'console', 'request', 'response', 'dbForProject', 'dbForPlatform', 'store', 'proofForToken']);

-App::setResource('project', function ($dbForPlatform, $request, $console, $authorization) {
+App::setResource('project', function ($dbForPlatform, $request, $console) {
    /** @var Appwrite\Utopia\Request $request */
    /** @var Utopia\Database\Database $dbForPlatform */
    /** @var Utopia\Database\Document $console */
@@ -446,10 +452,10 @@ App::setResource('project', function ($dbForPlatform, $request, $console, $autho
        return $console;
    }

-    $project = $authorization->skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
+    $project = Authorization::skip(fn () => $dbForPlatform->getDocument('projects', $projectId));

    return $project;
-}, ['dbForPlatform', 'request', 'console', 'authorization']);
+}, ['dbForPlatform', 'request', 'console']);

 App::setResource('session', function (User $user, Store $store, Token $proofForToken) {
    if ($user->isEmpty()) {
@@ -472,6 +478,10 @@ App::setResource('session', function (User $user, Store $store, Token $proofForT
    return;
 }, ['user', 'store', 'proofForToken']);

+App::setResource('console', function () {
+    return new Document(Config::getParam('console'));
+}, []);
+
 App::setResource('store', function (): Store {
    return new Store();
 });
@@ -502,15 +512,7 @@ App::setResource('proofForCode', function (): Code {
    return $code;
 });

-App::setResource('console', function () {
-    return new Document(Config::getParam('console'));
-}, []);
-
-App::setResource('authorization', function () {
-    return new Authorization();
-}, []);
-
-App::setResource('dbForProject', function (Group $pools, Database $dbForPlatform, Cache $cache, Document $project, Authorization $authorization) {
+App::setResource('dbForProject', function (Group $pools, Database $dbForPlatform, Cache $cache, Document $project) {
    if ($project->isEmpty() || $project->getId() === 'console') {
        return $dbForPlatform;
    }
@@ -526,7 +528,6 @@ App::setResource('dbForProject', function (Group $pools, Database $dbForPlatform
    $database = new Database($adapter, $cache);

    $database
-        ->setAuthorization($authorization)
        ->setMetadata('host', \gethostname())
        ->setMetadata('project', $project->getId())
        ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_API)
@@ -548,15 +549,13 @@ App::setResource('dbForProject', function (Group $pools, Database $dbForPlatform
    }

    return $database;
-}, ['pools', 'dbForPlatform', 'cache', 'project', 'authorization']);
-
-App::setResource('dbForPlatform', function (Group $pools, Cache $cache, Authorization $authorization) {
+}, ['pools', 'dbForPlatform', 'cache', 'project']);

+App::setResource('dbForPlatform', function (Group $pools, Cache $cache) {
    $adapter = new DatabasePool($pools->get('console'));
    $database = new Database($adapter, $cache);

    $database
-        ->setAuthorization($authorization)
        ->setNamespace('_console')
        ->setMetadata('host', \gethostname())
        ->setMetadata('project', 'console')
@@ -566,12 +565,12 @@ App::setResource('dbForPlatform', function (Group $pools, Cache $cache, Authoriz
    $database->setDocumentType('users', User::class);

    return $database;
-}, ['pools', 'cache', 'authorization']);
+}, ['pools', 'cache']);

-App::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache, Authorization $authorization) {
+App::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache) {
    $databases = [];

-    return function (Document $project) use ($pools, $dbForPlatform, $cache, $authorization, &$databases) {
+    return function (Document $project) use ($pools, $dbForPlatform, $cache, &$databases) {
        if ($project->isEmpty() || $project->getId() === 'console') {
            return $dbForPlatform;
        }
@@ -583,15 +582,13 @@ App::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform
            $dsn = new DSN('mysql://' . $project->getAttribute('database'));
        }

-        $configure = (function (Database $database) use ($project, $dsn, $authorization) {
+        $configure = (function (Database $database) use ($project, $dsn) {
            $database
-                ->setAuthorization($authorization)
                ->setMetadata('host', \gethostname())
                ->setMetadata('project', $project->getId())
                ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_API)
-                ->setMaxQueryValues(APP_DATABASE_QUERY_MAX_VALUES)
-                ->setDocumentType('users', User::class)
-            ;
+                ->setMaxQueryValues(APP_DATABASE_QUERY_MAX_VALUES);
+            $database->setDocumentType('users', User::class);

            $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));

@@ -621,12 +618,12 @@ App::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform

        return $database;
    };
-}, ['pools', 'dbForPlatform', 'cache', 'authorization']);
+}, ['pools', 'dbForPlatform', 'cache']);

-App::setResource('getLogsDB', function (Group $pools, Cache $cache, Authorization $authorization) {
+App::setResource('getLogsDB', function (Group $pools, Cache $cache) {
    $database = null;

-    return function (?Document $project = null) use ($pools, $cache, $authorization, &$database) {
+    return function (?Document $project = null) use ($pools, $cache, &$database) {
        if ($database !== null && $project !== null && !$project->isEmpty() && $project->getId() !== 'console') {
            $database->setTenant((int) $project->getSequence());
            return $database;
@@ -636,7 +633,6 @@ App::setResource('getLogsDB', function (Group $pools, Cache $cache, Authorizatio
        $database = new Database($adapter, $cache);

        $database
-            ->setAuthorization($authorization)
            ->setSharedTables(true)
            ->setNamespace('logsV1')
            ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_API)
@@ -649,7 +645,12 @@ App::setResource('getLogsDB', function (Group $pools, Cache $cache, Authorizatio

        return $database;
    };
-}, ['pools', 'cache', 'authorization']);
+}, ['pools', 'cache']);
+
+App::setResource('audit', function ($dbForProject) {
+    $adapter = new AdapterDatabase($dbForProject);
+    return new Audit($adapter);
+}, ['dbForProject']);

 App::setResource('telemetry', fn () => new NoTelemetry());

@@ -843,7 +844,7 @@ App::setResource('promiseAdapter', function ($register) {
    return $register->get('promiseAdapter');
 }, ['register']);

-App::setResource('schema', function ($utopia, $dbForProject, $authorization) {
+App::setResource('schema', function ($utopia, $dbForProject) {

    $complexity = function (int $complexity, array $args) {
        $queries = Query::parseQueries($args['queries'] ?? []);
@@ -853,8 +854,8 @@ App::setResource('schema', function ($utopia, $dbForProject, $authorization) {
        return $complexity * $limit;
    };

-    $attributes = function (int $limit, int $offset) use ($dbForProject, $authorization) {
-        $attrs = $authorization->skip(fn () => $dbForProject->find('attributes', [
+    $attributes = function (int $limit, int $offset) use ($dbForProject) {
+        $attrs = Authorization::skip(fn () => $dbForProject->find('attributes', [
            Query::limit($limit),
            Query::offset($offset),
        ]));
@@ -928,7 +929,7 @@ App::setResource('schema', function ($utopia, $dbForProject, $authorization) {
        $urls,
        $params,
    );
-}, ['utopia', 'dbForProject', 'authorization']);
+}, ['utopia', 'dbForProject']);

 App::setResource('gitHub', function (Cache $cache) {
    return new VcsGitHub($cache);
@@ -956,7 +957,7 @@ App::setResource('smsRates', function () {
    return [];
 });

-App::setResource('devKey', function (Request $request, Document $project, array $servers, Database $dbForPlatform, Authorization $authorization) {
+App::setResource('devKey', function (Request $request, Document $project, array $servers, Database $dbForPlatform) {
    $devKey = $request->getHeader('x-appwrite-dev-key', $request->getParam('devKey', ''));

    // Check if given key match project's development keys
@@ -975,7 +976,7 @@ App::setResource('devKey', function (Request $request, Document $project, array
    $accessedAt = $key->getAttribute('accessedAt', 0);
    if (empty($accessedAt) || DatabaseDateTime::formatTz(DatabaseDateTime::addSeconds(new \DateTime(), -APP_KEY_ACCESS)) > $accessedAt) {
        $key->setAttribute('accessedAt', DatabaseDateTime::now());
-        $authorization->skip(fn () => $dbForPlatform->updateDocument('devKeys', $key->getId(), $key));
+        Authorization::skip(fn () => $dbForPlatform->updateDocument('devKeys', $key->getId(), $key));
        $dbForPlatform->purgeCachedDocument('projects', $project->getId());
    }

@@ -992,15 +993,15 @@ App::setResource('devKey', function (Request $request, Document $project, array

            /** Update access time as well */
            $key->setAttribute('accessedAt', DatabaseDateTime::now());
-            $key = $authorization->skip(fn () => $dbForPlatform->updateDocument('devKeys', $key->getId(), $key));
+            $key = Authorization::skip(fn () => $dbForPlatform->updateDocument('devKeys', $key->getId(), $key));
            $dbForPlatform->purgeCachedDocument('projects', $project->getId());
        }
    }

    return $key;
-}, ['request', 'project', 'servers', 'dbForPlatform', 'authorization']);
+}, ['request', 'project', 'servers', 'dbForPlatform']);

-App::setResource('team', function (Document $project, Database $dbForPlatform, App $utopia, Request $request, Authorization $authorization) {
+App::setResource('team', function (Document $project, Database $dbForPlatform, App $utopia, Request $request) {
    $teamInternalId = '';
    if ($project->getId() !== 'console') {
        $teamInternalId = $project->getAttribute('teamInternalId', '');
@@ -1010,7 +1011,7 @@ App::setResource('team', function (Document $project, Database $dbForPlatform, A
        if (str_starts_with($path, '/v1/projects/:projectId')) {
            $uri = $request->getURI();
            $pid = explode('/', $uri)[3];
-            $p = $authorization->skip(fn () => $dbForPlatform->getDocument('projects', $pid));
+            $p = Authorization::skip(fn () => $dbForPlatform->getDocument('projects', $pid));
            $teamInternalId = $p->getAttribute('teamInternalId', '');
        } elseif ($path === '/v1/projects') {
            $teamId = $request->getParam('teamId', '');
@@ -1019,7 +1020,7 @@ App::setResource('team', function (Document $project, Database $dbForPlatform, A
                return new Document([]);
            }

-            $team = $authorization->skip(fn () => $dbForPlatform->getDocument('teams', $teamId));
+            $team = Authorization::skip(fn () => $dbForPlatform->getDocument('teams', $teamId));
            return $team;
        }
    }
@@ -1028,14 +1029,14 @@ App::setResource('team', function (Document $project, Database $dbForPlatform, A
        return new Document([]);
    }

-    $team = $authorization->skip(function () use ($dbForPlatform, $teamInternalId) {
+    $team = Authorization::skip(function () use ($dbForPlatform, $teamInternalId) {
        return $dbForPlatform->findOne('teams', [
            Query::equal('$sequence', [$teamInternalId]),
        ]);
    });

    return $team;
-}, ['project', 'dbForPlatform', 'utopia', 'request', 'authorization']);
+}, ['project', 'dbForPlatform', 'utopia', 'request']);

 App::setResource(
    'isResourceBlocked',
@@ -1073,7 +1074,7 @@ App::setResource('apiKey', function (Request $request, Document $project): ?Key

 App::setResource('executor', fn () => new Executor());

-App::setResource('resourceToken', function ($project, $dbForProject, $request, Authorization $authorization) {
+App::setResource('resourceToken', function ($project, $dbForProject, $request) {
    $tokenJWT = $request->getParam('token');

    if (!empty($tokenJWT) && !$project->isEmpty()) { // JWT authentication
@@ -1091,7 +1092,7 @@ App::setResource('resourceToken', function ($project, $dbForProject, $request, A
            return new Document([]);
        }

-        $token = $authorization->skip(fn () => $dbForProject->getDocument('resourceTokens', $tokenId));
+        $token = Authorization::skip(fn () => $dbForProject->getDocument('resourceTokens', $tokenId));

        if ($token->isEmpty()) {
            return new Document([]);
@@ -1109,7 +1110,7 @@ App::setResource('resourceToken', function ($project, $dbForProject, $request, A
        }

        return match ($token->getAttribute('resourceType')) {
-            TOKENS_RESOURCE_TYPE_FILES => (function () use ($token, $dbForProject, $authorization) {
+            TOKENS_RESOURCE_TYPE_FILES => (function () use ($token, $dbForProject) {
                $sequences = explode(':', $token->getAttribute('resourceInternalId'));
                $ids = explode(':', $token->getAttribute('resourceId'));

@@ -1120,7 +1121,7 @@ App::setResource('resourceToken', function ($project, $dbForProject, $request, A
                $accessedAt = $token->getAttribute('accessedAt', 0);
                if (empty($accessedAt) || DatabaseDateTime::formatTz(DatabaseDateTime::addSeconds(new \DateTime(), -APP_RESOURCE_TOKEN_ACCESS)) > $accessedAt) {
                    $token->setAttribute('accessedAt', DatabaseDateTime::now());
-                    $authorization->skip(fn () => $dbForProject->updateDocument('resourceTokens', $token->getId(), $token));
+                    Authorization::skip(fn () => $dbForProject->updateDocument('resourceTokens', $token->getId(), $token));
                }

                return new Document([
@@ -1135,8 +1136,8 @@ App::setResource('resourceToken', function ($project, $dbForProject, $request, A
        };
    }
    return new Document([]);
-}, ['project', 'dbForProject', 'request', 'authorization']);
+}, ['project', 'dbForProject', 'request']);

-App::setResource('transactionState', function (Database $dbForProject, Authorization $authorization) {
-    return new TransactionState($dbForProject, $authorization);
-}, ['dbForProject', 'authorization']);
+App::setResource('transactionState', function (Database $dbForProject) {
+    return new TransactionState($dbForProject);
+}, ['dbForProject']);
@@ -32,6 +32,7 @@ use Utopia\Database\Document;
 use Utopia\Database\Helpers\ID;
 use Utopia\Database\Helpers\Role;
 use Utopia\Database\Query;
+use Utopia\Database\Validator\Authorization;
 use Utopia\DSN\DSN;
 use Utopia\Logger\Log;
 use Utopia\Pools\Group;
@@ -308,7 +309,7 @@ $server->onStart(function () use ($stats, $register, $containerId, &$statsDocume
                    'value' => '{}'
                ]);

-                $statsDocument = $database->getAuthorization()->skip(fn () => $database->createDocument('realtime', $document));
+                $statsDocument = Authorization::skip(fn () => $database->createDocument('realtime', $document));
                break;
            } catch (Throwable) {
                Console::warning("Collection not ready. Retrying connection ({$attempts})...");
@@ -338,7 +339,7 @@ $server->onStart(function () use ($stats, $register, $containerId, &$statsDocume
                    ->setAttribute('timestamp', DateTime::now())
                    ->setAttribute('value', json_encode($payload));

-                $database->getAuthorization()->skip(fn () => $database->updateDocument('realtime', $statsDocument->getId(), $statsDocument));
+                Authorization::skip(fn () => $database->updateDocument('realtime', $statsDocument->getId(), $statsDocument));
            } catch (Throwable $th) {
                $logError($th, "updateWorkerDocument");
            }
@@ -369,7 +370,7 @@ $server->onWorkerStart(function (int $workerId) use ($server, $register, $stats,

                $payload = [];

-                $list = $database->getAuthorization()->skip(fn () => $database->find('realtime', [
+                $list = Authorization::skip(fn () => $database->find('realtime', [
                    Query::greaterThan('timestamp', DateTime::addSeconds(new \DateTime(), -15)),
                ]));

@@ -463,13 +464,13 @@ $server->onWorkerStart(function (int $workerId) use ($server, $register, $stats,
                    if ($realtime->hasSubscriber($projectId, 'user:' . $userId)) {
                        $connection = array_key_first(reset($realtime->subscriptions[$projectId]['user:' . $userId]));
                        $consoleDatabase = getConsoleDB();
-                        $project = $consoleDatabase->getAuthorization()->skip(fn () => $consoleDatabase->getDocument('projects', $projectId));
+                        $project = Authorization::skip(fn () => $consoleDatabase->getDocument('projects', $projectId));
                        $database = getProjectDB($project);

                        /** @var Appwrite\Utopia\Database\Documents\User $user */
                        $user = $database->getDocument('users', $userId);

-                        $roles = $user->getRoles($database->getAuthorization());
+                        $roles = $user->getRoles();
                        $channels = $realtime->connections[$connection]['channels'];

                        $realtime->unsubscribe($connection);
@@ -525,7 +526,6 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
    try {
        /** @var Document $project */
        $project = $app->getResource('project');
-        $authorization = $app->getResource('authorization');

        /*
         *  Project Check
@@ -537,7 +537,7 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
        if (
            array_key_exists('realtime', $project->getAttribute('apis', []))
            && !$project->getAttribute('apis', [])['realtime']
-            && !(User::isPrivileged($authorization->getRoles()) || User::isApp($authorization->getRoles()))
+            && !(User::isPrivileged(Authorization::getRoles()) || User::isApp(Authorization::getRoles()))
        ) {
            throw new AppwriteException(AppwriteException::GENERAL_API_DISABLED);
        }
@@ -573,7 +573,7 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
            throw new Exception(Exception::REALTIME_POLICY_VIOLATION, $originValidator->getDescription());
        }

-        $roles = $user->getRoles($authorization);
+        $roles = $user->getRoles();

        $channels = Realtime::convertChannels($request->getQuery('channels', []), $user->getId());

@@ -586,8 +586,6 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,

        $realtime->subscribe($project->getId(), $connection, $roles, $channels);

-        $realtime->connections[$connection]['authorization'] = $authorization;
-
        $user = empty($user->getId()) ? null : $response->output($user, Response::MODEL_ACCOUNT);

        $server->send([$connection], json_encode([
@@ -616,7 +614,6 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
            $code = 500;
        }

-
        $message = $th->getMessage();

        // sanitize 0 && 5xx errors
@@ -646,19 +643,12 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
 $server->onMessage(function (int $connection, string $message) use ($server, $register, $realtime, $containerId) {
    try {
        $response = new Response(new SwooleResponse());
-        $projectId = $realtime->connections[$connection]['projectId'] ?? null;
-
-        // Get authorization from connection (stored during onOpen)
-        $authorization = $realtime->connections[$connection]['authorization'] ?? null;
-
+        $projectId = $realtime->connections[$connection]['projectId'];
        $database = getConsoleDB();
-        $database->setAuthorization($authorization);

        if ($projectId !== 'console') {
-            $project = $authorization->skip(fn () => $database->getDocument('projects', $projectId));
-
+            $project = Authorization::skip(fn () => $database->getDocument('projects', $projectId));
            $database = getProjectDB($project);
-            $database->setAuthorization($authorization);
        } else {
            $project = null;
        }
@@ -722,19 +712,10 @@ $server->onMessage(function (int $connection, string $message) use ($server, $re
                    throw new Exception(Exception::REALTIME_MESSAGE_FORMAT_INVALID, 'Session is not valid.');
                }

-                $roles = $user->getRoles($database->getAuthorization());
+                $roles = $user->getRoles();
                $channels = Realtime::convertChannels(array_flip($realtime->connections[$connection]['channels']), $user->getId());
-
-                // Preserve authorization before subscribe overwrites the connection array
-                $authorization = $realtime->connections[$connection]['authorization'] ?? null;
-
                $realtime->subscribe($realtime->connections[$connection]['projectId'], $connection, $roles, $channels);

-                // Restore authorization after subscribe
-                if ($authorization !== null) {
-                    $realtime->connections[$connection]['authorization'] = $authorization;
-                }
-
                $user = $response->output($user, Response::MODEL_ACCOUNT);
                $server->send([$connection], json_encode([
                    'type' => 'response',
@@ -11,6 +11,7 @@ $httpsPort = $this->getParam('httpsPort', '');
 $version = $this->getParam('version', '');
 $organization = $this->getParam('organization', '');
 $image = $this->getParam('image', '');
+$enableAssistant = $this->getParam('enableAssistant', false);
 ?>services:
  traefik:
    image: traefik:2.11
@@ -179,7 +180,7 @@ $image = $this->getParam('image', '');
  appwrite-console:
    <<: *x-logging
    container_name: appwrite-console
-    image: <?php echo $organization; ?>/console:7.4.7
+    image: <?php echo $organization; ?>/console:7.5.7
    restart: unless-stopped
    networks:
      - appwrite
@@ -848,6 +849,7 @@ $image = $this->getParam('image', '');
      - _APP_DB_USER
      - _APP_DB_PASS

+<?php if ($enableAssistant): ?>
  appwrite-assistant:
    image: appwrite/assistant:0.8.4
    container_name: appwrite-assistant
@@ -857,6 +859,7 @@ $image = $this->getParam('image', '');
      - appwrite
    environment:
      - _APP_ASSISTANT_OPENAI_API_KEY
+<?php endif; ?>

  appwrite-browser:
    image: appwrite/browser:0.3.2
@@ -21,6 +21,8 @@ use Appwrite\Utopia\Database\Documents\User;
 use Executor\Executor;
 use Swoole\Runtime;
 use Utopia\Abuse\Adapters\TimeLimit\Redis as TimeLimitRedis;
+use Utopia\Audit\Adapter\Database as AdapterDatabase;
+use Utopia\Audit\Audit as UtopiaAudit;
 use Utopia\Cache\Adapter\Pool as CachePool;
 use Utopia\Cache\Adapter\Sharding;
 use Utopia\Cache\Cache;
@@ -46,30 +48,19 @@ use Utopia\System\System;
 use Utopia\Telemetry\Adapter as Telemetry;
 use Utopia\Telemetry\Adapter\None as NoTelemetry;

+Authorization::disable();
 Runtime::enableCoroutine();

 Server::setResource('register', fn () => $register);

-Server::setResource('authorization', function () {
-    $authorization = new Authorization();
-    $authorization->disable();
-    return  $authorization;
-}, []);
-
-Server::setResource('dbForPlatform', function (Cache $cache, Registry $register, Authorization $authorization) {
+Server::setResource('dbForPlatform', function (Cache $cache, Registry $register) {
    $pools = $register->get('pools');
    $adapter = new DatabasePool($pools->get('console'));
    $dbForPlatform = new Database($adapter, $cache);
-
-    $dbForPlatform
-        ->setAuthorization($authorization)
-        ->setNamespace('_console')
-        ->setDocumentType('users', User::class)
-    ;
-
-
+    $dbForPlatform->setNamespace('_console');
+    $dbForPlatform->setDocumentType('users', User::class);
    return $dbForPlatform;
-}, ['cache', 'register', 'authorization']);
+}, ['cache', 'register']);

 Server::setResource('project', function (Message $message, Database $dbForPlatform) {
    $payload = $message->getPayload() ?? [];
@@ -82,7 +73,7 @@ Server::setResource('project', function (Message $message, Database $dbForPlatfo
    return $dbForPlatform->getDocument('projects', $project->getId());
 }, ['message', 'dbForPlatform']);

-Server::setResource('dbForProject', function (Cache $cache, Registry $register, Message $message, Document $project, Database $dbForPlatform, Authorization $authorization) {
+Server::setResource('dbForProject', function (Cache $cache, Registry $register, Message $message, Document $project, Database $dbForPlatform) {
    if ($project->isEmpty() || $project->getId() === 'console') {
        return $dbForPlatform;
    }
@@ -114,17 +105,15 @@ Server::setResource('dbForProject', function (Cache $cache, Registry $register,
            ->setNamespace('_' . $project->getSequence());
    }

-    $database
-        ->setAuthorization($authorization)
-        ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER);
+    $database->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER);

    return $database;
-}, ['cache', 'register', 'message', 'project', 'dbForPlatform', 'authorization']);
+}, ['cache', 'register', 'message', 'project', 'dbForPlatform']);

-Server::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache, Authorization $authorization) {
+Server::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache) {
    $databases = []; // TODO: @Meldiron This should probably be responsibility of utopia-php/pools

-    return function (Document $project) use ($pools, $dbForPlatform, $cache, $authorization, &$databases): Database {
+    return function (Document $project) use ($pools, $dbForPlatform, $cache, &$databases): Database {
        if ($project->isEmpty() || $project->getId() === 'console') {
            return $dbForPlatform;
        }
@@ -138,7 +127,7 @@ Server::setResource('getProjectDB', function (Group $pools, Database $dbForPlatf

        if (isset($databases[$dsn->getHost()])) {
            $database = $databases[$dsn->getHost()];
-            $database->setAuthorization($authorization);
+
            $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));

            if (\in_array($dsn->getHost(), $sharedTables)) {
@@ -175,17 +164,15 @@ Server::setResource('getProjectDB', function (Group $pools, Database $dbForPlatf
                ->setNamespace('_' . $project->getSequence());
        }

-        $database
-            ->setAuthorization($authorization)
-            ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER);
+        $database->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER);

        return $database;
    };
-}, ['pools', 'dbForPlatform', 'cache', 'authorization']);
+}, ['pools', 'dbForPlatform', 'cache']);

-Server::setResource('getLogsDB', function (Group $pools, Cache $cache, Authorization $authorization) {
+Server::setResource('getLogsDB', function (Group $pools, Cache $cache) {
    $database = null;
-    return function (?Document $project = null) use ($pools, $cache, $database, $authorization) {
+    return function (?Document $project = null) use ($pools, $cache, $database) {
        if ($database !== null && $project !== null && !$project->isEmpty() && $project->getId() !== 'console') {
            $database->setTenant((int)$project->getSequence());
            return $database;
@@ -195,7 +182,6 @@ Server::setResource('getLogsDB', function (Group $pools, Cache $cache, Authoriza
        $database = new Database($adapter, $cache);

        $database
-            ->setAuthorization($authorization)
            ->setSharedTables(true)
            ->setNamespace('logsV1')
            ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER)
@@ -208,7 +194,7 @@ Server::setResource('getLogsDB', function (Group $pools, Cache $cache, Authoriza

        return $database;
    };
-}, ['pools', 'cache', 'authorization']);
+}, ['pools', 'cache']);

 Server::setResource('abuseRetention', function () {
    return time() - (int) System::getEnv('_APP_MAINTENANCE_RETENTION_ABUSE', 86400); // 1 day
@@ -396,6 +382,10 @@ Server::setResource('plan', function (array $plan = []) {
    return [];
 });

+Server::setResource('registryPayments', function (Registry $register) {
+    return $register->get('registryPayments');
+}, ['register']);
+
 Server::setResource('certificates', function () {
    $email = System::getEnv('_APP_EMAIL_CERTIFICATES', System::getEnv('_APP_SYSTEM_SECURITY_EMAIL_ADDRESS'));
    if (empty($email)) {
@@ -466,6 +456,19 @@ Server::setResource('logError', function (Registry $register, Document $project)

 Server::setResource('executor', fn () => new Executor());

+Server::setResource('getAudit', function (Database $dbForPlatform, callable $getProjectDB) {
+    return function (Document $project) use ($dbForPlatform, $getProjectDB) {
+        if ($project->isEmpty() || $project->getId() === 'console') {
+            $adapter = new AdapterDatabase($dbForPlatform);
+            return new UtopiaAudit($adapter);
+        }
+
+        $dbForProject = $getProjectDB($project);
+        $adapter = new AdapterDatabase($dbForProject);
+        return new UtopiaAudit($adapter);
+    };
+}, ['dbForPlatform', 'getProjectDB']);
+
 $pools = $register->get('pools');
 $platform = new Appwrite();
 $args = $platform->getEnv('argv');
@@ -510,8 +513,7 @@ $worker
    ->inject('log')
    ->inject('pools')
    ->inject('project')
-    ->inject('authorization')
-    ->action(function (Throwable $error, ?Logger $logger, Log $log, Group $pools, Document $project, Authorization $authorization) use ($worker, $queueName) {
+    ->action(function (Throwable $error, ?Logger $logger, Log $log, Group $pools, Document $project) use ($worker, $queueName) {
        $version = System::getEnv('_APP_VERSION', 'UNKNOWN');

        if ($logger) {
@@ -527,7 +529,7 @@ $worker
            $log->addExtra('file', $error->getFile());
            $log->addExtra('line', $error->getLine());
            $log->addExtra('trace', $error->getTraceAsString());
-            $log->addExtra('roles', $authorization->getRoles());
+            $log->addExtra('roles', Authorization::getRoles());

            $isProduction = System::getEnv('_APP_ENV', 'development') === 'production';
            $log->setEnvironment($isProduction ? Log::ENVIRONMENT_PRODUCTION : Log::ENVIRONMENT_STAGING);
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php doctor $@
+exec php /usr/src/code/app/cli.php doctor "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php install $@
+exec php /usr/src/code/app/cli.php install "$@"
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+exec php /usr/src/code/app/cli.php interval "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php maintenance $@
+exec php /usr/src/code/app/cli.php maintenance "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php migrate $@
+exec php /usr/src/code/app/cli.php migrate "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php queue-count --type=failed $@
+exec php /usr/src/code/app/cli.php queue-count --type=failed "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php queue-count --type=processing $@
+exec php /usr/src/code/app/cli.php queue-count --type=processing "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php queue-count --type=success $@
+exec php /usr/src/code/app/cli.php queue-count --type=success "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php queue-retry $@
+exec php /usr/src/code/app/cli.php queue-retry "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/realtime.php $@
+exec php /usr/src/code/app/realtime.php "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php schedule-executions $@
+exec php /usr/src/code/app/cli.php schedule-executions "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php schedule-functions $@
+exec php /usr/src/code/app/cli.php schedule-functions "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php schedule-messages $@
+exec php /usr/src/code/app/cli.php schedule-messages "$@"
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+php /usr/src/code/app/cli.php schedule-payments-usage $@
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php screenshot $@
+exec php /usr/src/code/app/cli.php screenshot "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php sdks $@
+exec php /usr/src/code/app/cli.php sdks "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php specs $@
+exec php /usr/src/code/app/cli.php specs "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php ssl $@
+exec php /usr/src/code/app/cli.php ssl "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php stats-resources $@
+exec php /usr/src/code/app/cli.php stats-resources "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-/usr/src/code/vendor/bin/phpunit --configuration /usr/src/code/phpunit.xml $@
+exec /usr/src/code/vendor/bin/phpunit --configuration /usr/src/code/phpunit.xml "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php upgrade $@
+exec php /usr/src/code/app/cli.php upgrade "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php vars $@
+exec php /usr/src/code/app/cli.php vars "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php audits $@
+exec php /usr/src/code/app/worker.php audits "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php builds $@
+exec php /usr/src/code/app/worker.php builds "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php certificates $@
+exec php /usr/src/code/app/worker.php certificates "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php databases $@
+exec php /usr/src/code/app/worker.php databases "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php deletes $@
+exec php /usr/src/code/app/worker.php deletes "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php functions $@
+exec php /usr/src/code/app/worker.php functions "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php mails $@
+exec php /usr/src/code/app/worker.php mails "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php messaging $@
+exec php /usr/src/code/app/worker.php messaging "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php migrations $@
+exec php /usr/src/code/app/worker.php migrations "$@"
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+php /usr/src/code/app/worker.php payments-usage-sync $@
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php stats-resources $@
+exec php /usr/src/code/app/worker.php stats-resources "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php stats-usage $@
+exec php /usr/src/code/app/worker.php stats-usage "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php webhooks $@
+exec php /usr/src/code/app/worker.php webhooks "$@"
@@ -45,26 +45,26 @@
        "ext-sockets": "*",
        "appwrite/php-runtimes": "0.19.*",
        "appwrite/php-clamav": "2.0.*",
-        "utopia-php/abuse": "1.*",
+        "utopia-php/abuse": "1.*.*",
        "utopia-php/analytics": "0.10.*",
-        "utopia-php/audit": "1.*",
+        "utopia-php/audit": "2.0.2-rc3",
        "utopia-php/auth": "0.5.*",
        "utopia-php/cache": "0.13.*",
        "utopia-php/cli": "0.15.*",
        "utopia-php/config": "1.*.*",
-        "utopia-php/database": "4.*",
+        "utopia-php/database": "3.*.*",
        "utopia-php/detector": "0.2.*",
        "utopia-php/domains": "0.9.*",
        "utopia-php/emails": "0.6.*",
        "utopia-php/dns": "1.4.*",
        "utopia-php/dsn": "0.2.1",
        "utopia-php/framework": "0.33.*",
-        "utopia-php/fetch": "0.4.*",
+        "utopia-php/fetch": "0.5.*",
        "utopia-php/image": "0.8.*",
        "utopia-php/locale": "0.8.*",
        "utopia-php/logger": "0.6.*",
        "utopia-php/messaging": "0.20.*",
-        "utopia-php/migration": "1.3.*",
+        "utopia-php/migration": "1.*.*",
        "utopia-php/orchestration": "0.9.*",
        "utopia-php/platform": "0.7.*",
        "utopia-php/pools": "0.8.*",
@@ -109,4 +109,4 @@
            "tbachert/spi": true
        }
    }
-}
+}
@@ -230,7 +230,7 @@ services:
  appwrite-console:
    <<: *x-logging
    container_name: appwrite-console
-    image: appwrite/console:7.4.11
+    image: appwrite/console:7.5.7
    restart: unless-stopped
    networks:
      - appwrite
@@ -555,6 +555,7 @@ services:
      - _APP_DOMAIN_TARGET_CAA
      - _APP_DNS
      - _APP_DOMAIN_FUNCTIONS
+      - _APP_DOMAIN_SITES
      - _APP_EMAIL_CERTIFICATES
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
@@ -753,6 +754,7 @@ services:
      - ./app:/usr/src/code/app
      - ./src:/usr/src/code/src
    depends_on:
+      - mariadb
      - redis
    environment:
      - _APP_ENV
@@ -785,6 +787,43 @@ services:
      - _APP_MAINTENANCE_START_TIME
      - _APP_DATABASE_SHARED_TABLES

+  appwrite-task-interval:
+    entrypoint: interval
+    <<: *x-logging
+    container_name: appwrite-task-interval
+    image: appwrite-dev
+    networks:
+      - appwrite
+    volumes:
+      - ./app:/usr/src/code/app
+      - ./src:/usr/src/code/src
+    depends_on:
+      - mariadb
+      - redis
+    environment:
+      - _APP_ENV
+      - _APP_WORKER_PER_CORE
+      - _APP_DOMAIN
+      - _APP_DOMAIN_TARGET_CNAME
+      - _APP_DOMAIN_TARGET_AAAA
+      - _APP_DOMAIN_TARGET_A
+      - _APP_DOMAIN_TARGET_CAA
+      - _APP_DNS
+      - _APP_DOMAIN_FUNCTIONS
+      - _APP_DOMAIN_SITES
+      - _APP_OPENSSL_KEY_V1
+      - _APP_REDIS_HOST
+      - _APP_REDIS_PORT
+      - _APP_REDIS_USER
+      - _APP_REDIS_PASS
+      - _APP_DB_HOST
+      - _APP_DB_PORT
+      - _APP_DB_SCHEMA
+      - _APP_DB_USER
+      - _APP_DB_PASS
+      - _APP_DATABASE_SHARED_TABLES
+      - _APP_INTERVAL_DOMAIN_VERIFICATION
+
  appwrite-task-stats-resources:
    container_name: appwrite-task-stats-resources
    entrypoint: stats-resources
@@ -878,6 +917,65 @@ services:
      - _APP_USAGE_AGGREGATION_INTERVAL
      - _APP_DATABASE_SHARED_TABLES

+  appwrite-worker-payments-usage:
+    entrypoint: worker-payments-usage
+    <<: *x-logging
+    container_name: appwrite-worker-payments-usage
+    image: appwrite-dev
+    networks:
+      - appwrite
+    volumes:
+      - ./app:/usr/src/code/app
+      - ./src:/usr/src/code/src
+    depends_on:
+      - redis
+      - mariadb
+    environment:
+      - _APP_ENV
+      - _APP_WORKER_PER_CORE
+      - _APP_OPENSSL_KEY_V1
+      - _APP_DB_HOST
+      - _APP_DB_PORT
+      - _APP_DB_SCHEMA
+      - _APP_DB_USER
+      - _APP_DB_PASS
+      - _APP_REDIS_HOST
+      - _APP_REDIS_PORT
+      - _APP_REDIS_USER
+      - _APP_REDIS_PASS
+      - _APP_LOGGING_CONFIG
+      - _APP_DATABASE_SHARED_TABLES
+
+  appwrite-task-scheduler-payments-usage:
+    entrypoint: schedule-payments-usage
+    <<: *x-logging
+    container_name: appwrite-task-scheduler-payments-usage
+    image: appwrite-dev
+    networks:
+      - appwrite
+    volumes:
+      - ./app:/usr/src/code/app
+      - ./src:/usr/src/code/src
+    depends_on:
+      - mariadb
+      - redis
+    environment:
+      - _APP_ENV
+      - _APP_WORKER_PER_CORE
+      - _APP_OPENSSL_KEY_V1
+      - _APP_REDIS_HOST
+      - _APP_REDIS_PORT
+      - _APP_REDIS_USER
+      - _APP_REDIS_PASS
+      - _APP_DB_HOST
+      - _APP_DB_PORT
+      - _APP_DB_SCHEMA
+      - _APP_DB_USER
+      - _APP_DB_PASS
+      - _APP_LOGGING_CONFIG
+      - _APP_DATABASE_SHARED_TABLES
+      - _APP_PAYMENTS_USAGE_SYNC_INTERVAL
+
  appwrite-task-scheduler-functions:
    entrypoint: schedule-functions
    <<: *x-logging
@@ -1028,27 +1126,6 @@ services:
      - OPR_EXECUTOR_STORAGE_WASABI_REGION=$_APP_STORAGE_WASABI_REGION
      - OPR_EXECUTOR_STORAGE_WASABI_BUCKET=$_APP_STORAGE_WASABI_BUCKET

-  openruntimes-proxy:
-    container_name: openruntimes-proxy
-    hostname: proxy
-    <<: *x-logging
-    stop_signal: SIGINT
-    image: openruntimes/proxy:0.5.5
-    networks:
-      - appwrite
-      - runtimes
-    environment:
-      - OPR_PROXY_WORKER_PER_CORE=$_APP_WORKER_PER_CORE
-      - OPR_PROXY_ENV=$_APP_ENV
-      - OPR_PROXY_EXECUTOR_SECRET=$_APP_EXECUTOR_SECRET
-      - OPR_PROXY_SECRET=$_APP_EXECUTOR_SECRET
-      - OPR_PROXY_LOGGING_CONFIG=$_APP_LOGGING_CONFIG
-      - OPR_PROXY_ALGORITHM=random
-      - OPR_PROXY_EXECUTORS=exc1
-      - OPR_PROXY_HEALTHCHECK_INTERVAL=10000
-      - OPR_PROXY_MAX_TIMEOUT=600
-      - OPR_PROXY_HEALTHCHECK=enabled
-
  mariadb:
    image: mariadb:10.11 # fix issues when upgrading using: mysql_upgrade -u root -p
    container_name: appwrite-mariadb
@@ -1131,6 +1208,9 @@ services:
      - "traefik.http.routers.appwrite_maildev_https.rule=Host(`mail.localhost`)"
      - "traefik.http.routers.appwrite_maildev_https.service=appwrite_maildev"
      - "traefik.http.routers.appwrite_maildev_https.tls=true"
+    environment:
+      - MAILDEV_INCOMING_USER=${_APP_SMTP_USERNAME}
+      - MAILDEV_INCOMING_PASS=${_APP_SMTP_PASSWORD}

  request-catcher-webhook: # used mainly for dev tests (mock HTTP webhook)
    image: appwrite/requestcatcher:1.0.0
@@ -130,7 +130,9 @@ class Mock extends OAuth2
     */
    public function isEmailVerified(string $accessToken): bool
    {
-        return true;
+        $user = $this->getUser($accessToken);
+
+        return $user['verified'] ?? true;
    }

    /**
@@ -0,0 +1,30 @@
+<?php
+
+namespace Appwrite\Auth\OAuth2;
+
+class MockUnverified extends Mock
+{
+    /**
+     * @return string
+     */
+    public function getName(): string
+    {
+        return 'mock-unverified';
+    }
+
+    /**
+     * @param string $accessToken
+     *
+     * @return array
+     */
+    protected function getUser(string $accessToken): array
+    {
+        if (empty($this->user)) {
+            $user = $this->request('GET', 'http://localhost/' . $this->version . '/mock/tests/general/oauth2/user-unverified?token=' . \urlencode($accessToken));
+
+            $this->user = \json_decode($user, true);
+        }
+
+        return $this->user;
+    }
+}
@@ -8,6 +8,10 @@ interface Adapter
 {
    public function issueCertificate(string $certName, string $domain, ?string $domainType): ?string;

+    public function isInstantGeneration(string $domain, ?string $domainType): bool;
+
+    public function getCertificateStatus(string $domain, ?string $domainType): string;
+
    public function isRenewRequired(string $domain, ?string $domainType, Log $log): bool;

    public function deleteCertificate(string $domain): void;
@@ -0,0 +1,10 @@
+<?php
+
+namespace Appwrite\Certificates\Exception;
+
+use Exception;
+
+// Exception thrown during certificate status retrieval
+class CertificateStatus extends Exception
+{
+}
@@ -2,6 +2,7 @@

 namespace Appwrite\Certificates;

+use Appwrite\Certificates\Exception\CertificateStatus as CertificateStatusException;
 use Exception;
 use Utopia\App;
 use Utopia\CLI\Console;
@@ -84,6 +85,16 @@ class LetsEncrypt implements Adapter
        return DateTime::addSeconds($dt, -60 * 60 * 24 * 30);
    }

+    public function isInstantGeneration(string $domain, ?string $domainType): bool
+    {
+        return true;
+    }
+
+    public function getCertificateStatus(string $domain, ?string $domainType): string
+    {
+        throw new CertificateStatusException('Certificate status retrieval is not supported for LetsEncrypt.');
+    }
+
    public function isRenewRequired(string $domain, ?string $domainType, Log $log): bool
    {
        $certPath = APP_STORAGE_CERTIFICATES . '/' . $domain . '/cert.pem';
--- a/Show More
+++ b/Show More