Add setDatabase() to all project database instances

This completes the fix for utopia-php/database 4.5.2 which removed the automatic USE database statement. All Database instances that create or query project databases now have explicit setDatabase() calls. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Update lock
2026-05-26 13:51:13 +00:00 · 2026-01-15 19:08:25 +13:00 · 2026-01-15 18:45:18 +13:00 · 2026-01-15 18:43:28 +13:00 · 2026-01-15 17:30:13 +13:00 · 2026-01-15 16:57:50 +13:00
347 changed files with 17219 additions and 11539 deletions
@@ -223,7 +223,7 @@ jobs:
            -e _APP_DATABASE_SHARED_TABLES \
            -e _APP_DATABASE_SHARED_TABLES_V1 \
            -e _APP_E2E_RESPONSE_FORMAT="${{ github.event.inputs.response_format }}" \
-            appwrite test /usr/src/code/tests/e2e/Services/${{ matrix.service }} --debug --exclude-group devKeys,screenshots
+            appwrite test /usr/src/code/tests/e2e/Services/${{ matrix.service }} --debug --exclude-group abuseEnabled,screenshots

      - name: Failure Logs
        if: failure()
@@ -312,7 +312,7 @@ jobs:
            -e _APP_DATABASE_SHARED_TABLES \
            -e _APP_DATABASE_SHARED_TABLES_V1 \
            -e _APP_E2E_RESPONSE_FORMAT="${{ github.event.inputs.response_format }}" \
-            appwrite test /usr/src/code/tests/e2e/Services/${{ matrix.service }} --debug --exclude-group devKeys,screenshots
+            appwrite test /usr/src/code/tests/e2e/Services/${{ matrix.service }} --debug --exclude-group abuseEnabled,screenshots

      - name: Failure Logs
        if: failure()
@@ -322,8 +322,8 @@ jobs:
          echo "=== OpenRuntimes Executor Logs ==="
          docker compose logs openruntimes-executor

-  e2e_dev_keys:
-    name: E2E Service Test (Dev Keys)
+  e2e_abuse_enabled:
+    name: E2E Service Test (Abuse enabled)
    runs-on: ubuntu-latest
    needs: setup
    steps:
@@ -344,7 +344,7 @@ jobs:
          docker compose up -d
          sleep 30

-      - name: Run Projects tests with dev keys in dedicated table mode
+      - name: Run Projects tests in dedicated table mode
        run: |
          echo "Using project tables"
          export _APP_DATABASE_SHARED_TABLES=
@@ -354,7 +354,7 @@ jobs:
            -e _APP_DATABASE_SHARED_TABLES \
            -e _APP_DATABASE_SHARED_TABLES_V1 \
            -e _APP_E2E_RESPONSE_FORMAT="${{ github.event.inputs.response_format }}" \
-            appwrite test /usr/src/code/tests/e2e/Services/Projects --debug --group=devKeys
+            appwrite test /usr/src/code/tests/e2e/Services/Projects --debug --group=abuseEnabled

      - name: Failure Logs
        if: failure()
@@ -364,8 +364,8 @@ jobs:
          echo "=== OpenRuntimes Executor Logs ==="
          docker compose logs openruntimes-executor

-  e2e_dev_keys_shared_mode:
-    name: E2E Shared Mode Service Test (Dev Keys)
+  e2e_abuse_enabled_shared_mode:
+    name: E2E Shared Mode Service Test (Abuse enabled)
    runs-on: ubuntu-latest
    needs: [ setup, check_database_changes ]
    if: needs.check_database_changes.outputs.database_changed == 'true'
@@ -394,7 +394,7 @@ jobs:
          docker compose up -d
          sleep 30

-      - name: Run Projects tests with dev keys in ${{ matrix.tables-mode }} table mode
+      - name: Run Projects tests in ${{ matrix.tables-mode }} table mode
        run: |
          if [ "${{ matrix.tables-mode }}" == "Shared V1" ]; then
            echo "Using shared tables V1"
@@ -410,7 +410,7 @@ jobs:
            -e _APP_DATABASE_SHARED_TABLES \
            -e _APP_DATABASE_SHARED_TABLES_V1 \
            -e _APP_E2E_RESPONSE_FORMAT="${{ github.event.inputs.response_format }}" \
-            appwrite test /usr/src/code/tests/e2e/Services/Projects --debug --group=devKeys
+            appwrite test /usr/src/code/tests/e2e/Services/Projects --debug --group=abuseEnabled

      - name: Failure Logs
        if: failure()
@@ -420,7 +420,7 @@ jobs:
          echo "=== OpenRuntimes Executor Logs ==="
          docker compose logs openruntimes-executor

-  e2e_screenshots_keys:
+  e2e_screenshots:
    name: E2E Service Test (Site Screenshots)
    runs-on: ubuntu-latest
    needs: setup
@@ -58,6 +58,10 @@ Examples:

 Avoid introducing new dependencies other than utopia-php.

+## Adding new endpoints
+
+When adding new endpoints, make sure to use modules and follow its patterns. Find instruction in [Modules AGENTS.md](src/Appwrite/Platform/AGENTS.md) file.
+
 ## Pull Request Guidelines
 ### Before Submitting

@@ -1,3 +1,101 @@
+# Version 1.8.1
+
+## What's Changed
+
+### Notable changes
+
+* Add branch deployments support in [#10486](https://github.com/appwrite/appwrite/pull/10486)
+* Add TanStack Start sites support in [#10681](https://github.com/appwrite/appwrite/pull/10681)
+* Add Next.js standalone support in [#10747](https://github.com/appwrite/appwrite/pull/10747)
+* Add Resend integration in [#10690](https://github.com/appwrite/appwrite/pull/10690)
+* Add option to enable/disable image transformations per-bucket in [#10722](https://github.com/appwrite/appwrite/pull/10722)
+* Add operators support in [#10735](https://github.com/appwrite/appwrite/pull/10735) and [#10800](https://github.com/appwrite/appwrite/pull/10800)
+* Add function and sites stats in [#10786](https://github.com/appwrite/appwrite/pull/10786)
+* Add disable count feature in [#10668](https://github.com/appwrite/appwrite/pull/10668)
+* Add ElevenLabs site template in [#10782](https://github.com/appwrite/appwrite/pull/10782)
+* Add suggested environment variables in [#10795](https://github.com/appwrite/appwrite/pull/10795)
+* Update GeoDB database in [#10890](https://github.com/appwrite/appwrite/pull/10890)
+* Update Flutter default build runtime in [#10807](https://github.com/appwrite/appwrite/pull/10807)
+* Upgrade runtimes in [#10804](https://github.com/appwrite/appwrite/pull/10804)
+
+### Fixes
+
+* Fix duplicate document error while creating file in [#10891](https://github.com/appwrite/appwrite/pull/10891)
+* Fix "Update external deployment (authorize)" throwing 500 error due to invalid query in [#10888](https://github.com/appwrite/appwrite/pull/10888)
+* Fix error setting user password in [#10889](https://github.com/appwrite/appwrite/pull/10889)
+* Fix error generating email MFA challenges in [#10884](https://github.com/appwrite/appwrite/pull/10884)
+* Fix file token expiry in [#10877](https://github.com/appwrite/appwrite/pull/10877)
+* Fix TanStack Nitro default in [#10860](https://github.com/appwrite/appwrite/pull/10860)
+* Fix TanStack builds in [#10767](https://github.com/appwrite/appwrite/pull/10767)
+* Fix nullable validation in [#10819](https://github.com/appwrite/appwrite/pull/10819) and [#10778](https://github.com/appwrite/appwrite/pull/10778)
+* Fix WebP library in [#10738](https://github.com/appwrite/appwrite/pull/10738)
+* Fix batch writes in [#10812](https://github.com/appwrite/appwrite/pull/10812)
+* Fix error handler error in [#10719](https://github.com/appwrite/appwrite/pull/10719)
+* Fix Next 16 compatibility in [#10713](https://github.com/appwrite/appwrite/pull/10713)
+* Fix stats usage memory leak in [#10683](https://github.com/appwrite/appwrite/pull/10683)
+* Fix author URL in template deployments in [#10535](https://github.com/appwrite/appwrite/pull/10535)
+* Fix VCS lock deletion in [#10691](https://github.com/appwrite/appwrite/pull/10691)
+
+### Miscellaneous
+
+* Add CSV export functionality in [#10546](https://github.com/appwrite/appwrite/pull/10546), [#10750](https://github.com/appwrite/appwrite/pull/10750), [#10813](https://github.com/appwrite/appwrite/pull/10813), and [#10847](https://github.com/appwrite/appwrite/pull/10847)
+* Add JWT disposition in [#10867](https://github.com/appwrite/appwrite/pull/10867)
+* Add screenshots endpoint in [#10675](https://github.com/appwrite/appwrite/pull/10675)
+* Add screenshot endpoint stats in [#10706](https://github.com/appwrite/appwrite/pull/10706)
+* Add users attributes in [#10688](https://github.com/appwrite/appwrite/pull/10688)
+* Add max build duration environment variable in [#10674](https://github.com/appwrite/appwrite/pull/10674)
+* Add custom realtime logger in [#10871](https://github.com/appwrite/appwrite/pull/10871)
+* Add logs in [#10869](https://github.com/appwrite/appwrite/pull/10869)
+* Improve MFA docs endpoint order in [#10793](https://github.com/appwrite/appwrite/pull/10793)
+* Auth refactor in [#10758](https://github.com/appwrite/appwrite/pull/10758), [#10837](https://github.com/appwrite/appwrite/pull/10837), [#10682](https://github.com/appwrite/appwrite/pull/10682), and [#10667](https://github.com/appwrite/appwrite/pull/10667)
+* Bump assistant to 0.8.4 in [#10887](https://github.com/appwrite/appwrite/pull/10887)
+* Bump database to 3.1.5 in [#10766](https://github.com/appwrite/appwrite/pull/10766)
+* Bump Utopia DNS in [#10761](https://github.com/appwrite/appwrite/pull/10761)
+* Update domains to 0.8.3 in [#10658](https://github.com/appwrite/appwrite/pull/10658)
+* Update domains to 0.9.1 in [#10678](https://github.com/appwrite/appwrite/pull/10678)
+* Update Apple Swift to 13.3.0 in [#10679](https://github.com/appwrite/appwrite/pull/10679)
+* Update Apple Swift in [#10663](https://github.com/appwrite/appwrite/pull/10663)
+* Update CLI to 10.2.2 in [#10672](https://github.com/appwrite/appwrite/pull/10672)
+* Update to CLI 12.0.0 in [#10853](https://github.com/appwrite/appwrite/pull/10853)
+* Update docs examples to use Permission class in [#10707](https://github.com/appwrite/appwrite/pull/10707)
+* Update SDK examples docs in [#10855](https://github.com/appwrite/appwrite/pull/10855)
+* Release Python SDK in [#10762](https://github.com/appwrite/appwrite/pull/10762)
+* Release Flutter 20.3.2 in [#10838](https://github.com/appwrite/appwrite/pull/10838)
+* Release Flutter/Dart add screenshot examples in [#10811](https://github.com/appwrite/appwrite/pull/10811)
+* Release PHP CLI in [#10791](https://github.com/appwrite/appwrite/pull/10791)
+* Release SDKs in [#10817](https://github.com/appwrite/appwrite/pull/10817)
+* Update SDKs in [#10694](https://github.com/appwrite/appwrite/pull/10694), [#10729](https://github.com/appwrite/appwrite/pull/10729), and [#10744](https://github.com/appwrite/appwrite/pull/10744)
+* Update SDK generator in [#10743](https://github.com/appwrite/appwrite/pull/10743)
+* Update database in [#10664](https://github.com/appwrite/appwrite/pull/10664)
+* Update README file in [#10763](https://github.com/appwrite/appwrite/pull/10763)
+* SDK release documentation in [#10745](https://github.com/appwrite/appwrite/pull/10745)
+* SDK release runtime config in [#10765](https://github.com/appwrite/appwrite/pull/10765)
+* Sync specs in [#10789](https://github.com/appwrite/appwrite/pull/10789)
+* Sync 1.8.0 in [#10677](https://github.com/appwrite/appwrite/pull/10677)
+* Add workflow for issue triage in [#10718](https://github.com/appwrite/appwrite/pull/10718)
+* Add issue auto-labeler in [#10700](https://github.com/appwrite/appwrite/pull/10700)
+* Add AI moderator repo in [#10717](https://github.com/appwrite/appwrite/pull/10717)
+* Browser bump in [#10850](https://github.com/appwrite/appwrite/pull/10850)
+* Template type enum override in [#10848](https://github.com/appwrite/appwrite/pull/10848)
+* VCS reference type in [#10852](https://github.com/appwrite/appwrite/pull/10852)
+* Index scope description in [#10851](https://github.com/appwrite/appwrite/pull/10851)
+* Config for environment in [#10833](https://github.com/appwrite/appwrite/pull/10833)
+* Format instance in [#10830](https://github.com/appwrite/appwrite/pull/10830)
+* Replace sleep in webhooks service in [#10656](https://github.com/appwrite/appwrite/pull/10656)
+* Update email composer in [#10720](https://github.com/appwrite/appwrite/pull/10720)
+* Update facts on GitHub sites and functions in [#10593](https://github.com/appwrite/appwrite/pull/10593) and [#10771](https://github.com/appwrite/appwrite/pull/10771)
+* Fix wrong user type in [#10875](https://github.com/appwrite/appwrite/pull/10875)
+* Fix limit and offset computation in [#10880](https://github.com/appwrite/appwrite/pull/10880)
+* Fix enum examples in [#10828](https://github.com/appwrite/appwrite/pull/10828)
+* Fix response models multi-methods in [#10815](https://github.com/appwrite/appwrite/pull/10815)
+* Fix undefined variable in [#10654](https://github.com/appwrite/appwrite/pull/10654)
+* Fix undefined sequence in [#10652](https://github.com/appwrite/appwrite/pull/10652)
+* Fix description in [#10702](https://github.com/appwrite/appwrite/pull/10702)
+* Fix warning in builds worker in [#10705](https://github.com/appwrite/appwrite/pull/10705)
+* Fix sites create deployment docs in [#10566](https://github.com/appwrite/appwrite/pull/10566)
+* Fix test dependencies projects in [#10655](https://github.com/appwrite/appwrite/pull/10655)
+* Fix list sites test in [#10726](https://github.com/appwrite/appwrite/pull/10726)
+
 # Version 1.8.0

 ## What's Changed
@@ -77,6 +77,7 @@ RUN chmod +x /usr/local/bin/doctor && \
    chmod +x /usr/local/bin/queue-count-success && \
    chmod +x /usr/local/bin/worker-audits && \
    chmod +x /usr/local/bin/worker-builds && \
+    chmod +x /usr/local/bin/worker-screenshots && \
    chmod +x /usr/local/bin/worker-certificates && \
    chmod +x /usr/local/bin/worker-databases && \
    chmod +x /usr/local/bin/worker-deletes && \
@@ -72,7 +72,7 @@ docker run -it --rm \
    --volume /var/run/docker.sock:/var/run/docker.sock \
    --volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \
    --entrypoint="install" \
-    appwrite/appwrite:1.8.0
+    appwrite/appwrite:1.8.1
 ```

 ### Windows
@@ -84,7 +84,7 @@ docker run -it --rm ^
    --volume //var/run/docker.sock:/var/run/docker.sock ^
    --volume "%cd%"/appwrite:/usr/src/code/appwrite:rw ^
    --entrypoint="install" ^
-    appwrite/appwrite:1.8.0
+    appwrite/appwrite:1.8.1
 ```

 #### PowerShell
@@ -94,7 +94,7 @@ docker run -it --rm `
    --volume /var/run/docker.sock:/var/run/docker.sock `
    --volume ${pwd}/appwrite:/usr/src/code/appwrite:rw `
    --entrypoint="install" `
-    appwrite/appwrite:1.8.0
+    appwrite/appwrite:1.8.1
 ```

 运行后，可以在浏览器上访问 http://localhost 找到 Appwrite 控制台。在非 Linux 的本机主机上完成安装后，服务器可能需要几分钟才能启动。
@@ -75,7 +75,7 @@ docker run -it --rm \
    --volume /var/run/docker.sock:/var/run/docker.sock \
    --volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \
    --entrypoint="install" \
-    appwrite/appwrite:1.8.0
+    appwrite/appwrite:1.8.1
 ```

 ### Windows
@@ -87,7 +87,7 @@ docker run -it --rm ^
    --volume //var/run/docker.sock:/var/run/docker.sock ^
    --volume "%cd%"/appwrite:/usr/src/code/appwrite:rw ^
    --entrypoint="install" ^
-    appwrite/appwrite:1.8.0
+    appwrite/appwrite:1.8.1
 ```

 #### PowerShell
@@ -97,7 +97,7 @@ docker run -it --rm `
    --volume /var/run/docker.sock:/var/run/docker.sock `
    --volume ${pwd}/appwrite:/usr/src/code/appwrite:rw `
    --entrypoint="install" `
-    appwrite/appwrite:1.8.0
+    appwrite/appwrite:1.8.1
 ```

 Once the Docker installation is complete, go to http://localhost to access the Appwrite console from your browser. Please note that on non-Linux native hosts, the server might take a few minutes to start after completing the installation.
@@ -41,8 +41,6 @@ Config::setParam('runtimes', (new Runtimes('v5'))->getAll(supported: false));
 // require controllers after overwriting runtimes
 require_once __DIR__ . '/controllers/general.php';

-Authorization::disable();
-
 CLI::setResource('register', fn () => $register);

 CLI::setResource('cache', function ($pools) {
@@ -60,7 +58,13 @@ CLI::setResource('pools', function (Registry $register) {
    return $register->get('pools');
 }, ['register']);

-CLI::setResource('dbForPlatform', function ($pools, $cache) {
+CLI::setResource('authorization', function () {
+    $authorization = new Authorization();
+    $authorization->disable();
+    return $authorization;
+}, []);
+
+CLI::setResource('dbForPlatform', function ($pools, $cache, $authorization) {
    $sleep = 3;
    $maxAttempts = 5;
    $attempts = 0;
@@ -74,6 +78,8 @@ CLI::setResource('dbForPlatform', function ($pools, $cache) {
            $dbForPlatform = new Database($adapter, $cache);

            $dbForPlatform
+                ->setDatabase(APP_DATABASE)
+                ->setAuthorization($authorization)
                ->setNamespace('_console')
                ->setMetadata('host', \gethostname())
                ->setMetadata('project', 'console');
@@ -99,7 +105,7 @@ CLI::setResource('dbForPlatform', function ($pools, $cache) {
    }

    return $dbForPlatform;
-}, ['pools', 'cache']);
+}, ['pools', 'cache', 'authorization']);

 CLI::setResource('console', function () {
    return new Document(Config::getParam('console'));
@@ -110,10 +116,10 @@ CLI::setResource(
    fn () => fn (Document $project, string $resourceType, ?string $resourceId) => false
 );

-CLI::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache) {
+CLI::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache, $authorization) {
    $databases = []; // TODO: @Meldiron This should probably be responsibility of utopia-php/pools

-    return function (Document $project) use ($pools, $dbForPlatform, $cache, &$databases) {
+    return function (Document $project) use ($pools, $dbForPlatform, $cache, $authorization, &$databases) {
        if ($project->isEmpty() || $project->getId() === 'console') {
            return $dbForPlatform;
        }
@@ -146,6 +152,7 @@ CLI::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform

        $adapter = new DatabasePool($pools->get($dsn->getHost()));
        $database = new Database($adapter, $cache);
+
        $databases[$dsn->getHost()] = $database;
        $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));

@@ -162,17 +169,19 @@ CLI::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform
        }

        $database
+            ->setDatabase(APP_DATABASE)
+            ->setAuthorization($authorization)
            ->setMetadata('host', \gethostname())
            ->setMetadata('project', $project->getId());

        return $database;
    };
-}, ['pools', 'dbForPlatform', 'cache']);
+}, ['pools', 'dbForPlatform', 'cache', 'authorization']);

-CLI::setResource('getLogsDB', function (Group $pools, Cache $cache) {
+CLI::setResource('getLogsDB', function (Group $pools, Cache $cache, Authorization $authorization) {
    $database = null;

-    return function (?Document $project = null) use ($pools, $cache, $database) {
+    return function (?Document $project = null) use ($pools, $cache, $database, $authorization) {
        if ($database !== null && $project !== null && !$project->isEmpty() && $project->getId() !== 'console') {
            $database->setTenant((int)$project->getSequence());
            return $database;
@@ -182,6 +191,8 @@ CLI::setResource('getLogsDB', function (Group $pools, Cache $cache) {
        $database = new Database($adapter, $cache);

        $database
+            ->setDatabase(APP_DATABASE)
+            ->setAuthorization($authorization)
            ->setSharedTables(true)
            ->setNamespace('logsV1')
            ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_TASK)
@@ -194,7 +205,7 @@ CLI::setResource('getLogsDB', function (Group $pools, Cache $cache) {

        return $database;
    };
-}, ['pools', 'cache']);
+}, ['pools', 'cache', 'authorization']);
 CLI::setResource('publisher', function (Group $pools) {
    return new BrokerPool(publisher: $pools->get('publisher'));
 }, ['pools']);
@@ -257,6 +268,14 @@ CLI::setResource('logError', function (Registry $register) {
            $log->addExtra('trace', $error->getTraceAsString());
            $log->addExtra('detailedTrace', $error->getTrace());

+            if ($error->getPrevious() !== null) {
+                if ($error->getPrevious()->getMessage() != $error->getMessage()) {
+                    $log->addExtra('previousMessage', $error->getPrevious()->getMessage());
+                }
+                $log->addExtra('previousFile', $error->getPrevious()->getFile());
+                $log->addExtra('previousLine', $error->getPrevious()->getLine());
+            }
+
            $log->setAction($action);

            $isProduction = System::getEnv('_APP_ENV', 'development') === 'production';
@@ -6,7 +6,7 @@ use Utopia\Database\Helpers\ID;

 $providers = Config::getParam('oAuthProviders', []);

-return [
+$platformCollections = [
    'projects' => [
        '$collection' => ID::custom(Database::METADATA),
        '$id' => ID::custom('projects'),
@@ -330,7 +330,18 @@ return [
                'default' => null,
                'array' => false,
                'filters' => ['datetime'],
-            ]
+            ],
+            [
+                '$id' => ID::custom('labels'),
+                'type' => Database::VAR_STRING,
+                'format' => '',
+                'size' => 128,
+                'signed' => true,
+                'required' => false,
+                'default' => [],
+                'array' => true,
+                'filters' => [],
+            ],
        ],
        'indexes' => [
            [
@@ -643,6 +654,39 @@ return [
                'array' => false,
                'filters' => [],
            ],
+            [
+                '$id' => 'resourceType',
+                'type' => Database::VAR_STRING,
+                'format' => '',
+                'size' => Database::LENGTH_KEY,
+                'signed' => true,
+                'required' => false,
+                'default' => null,
+                'array' => false,
+                'filters' => [],
+            ],
+            [
+                '$id' => 'resourceId',
+                'type' => Database::VAR_STRING,
+                'format' => '',
+                'size' => Database::LENGTH_KEY,
+                'signed' => true,
+                'required' => false,
+                'default' => null,
+                'array' => false,
+                'filters' => [],
+            ],
+            [
+                '$id' => 'resourceInternalId',
+                'type' => Database::VAR_STRING,
+                'format' => '',
+                'size' => Database::LENGTH_KEY,
+                'signed' => true,
+                'required' => false,
+                'default' => null,
+                'array' => false,
+                'filters' => [],
+            ],
            [
                '$id' => ID::custom('name'),
                'type' => Database::VAR_STRING,
@@ -718,6 +762,13 @@ return [
                'lengths' => [Database::LENGTH_KEY],
                'orders' => [Database::ORDER_ASC],
            ],
+            [
+                '$id' => '_key_resource',
+                'type' => Database::INDEX_KEY,
+                'attributes' => ['resourceType', 'resourceInternalId'],
+                'lengths' => [Database::LENGTH_KEY],
+                'orders' => [Database::ORDER_ASC],
+            ],
            [
                '$id' => '_key_accessedAt',
                'type' => Database::INDEX_KEY,
@@ -1362,21 +1413,21 @@ return [
                '$id' => '_key_type',
                'type' => Database::INDEX_KEY,
                'attributes' => ['type'],
-                'lengths' => [32],
+                'lengths' => [],
                'orders' => [Database::ORDER_ASC],
            ],
            [
                '$id' => '_key_trigger',
                'type' => Database::INDEX_KEY,
                'attributes' => ['trigger'],
-                'lengths' => [32],
+                'lengths' => [],
                'orders' => [Database::ORDER_ASC],
            ],
            [
                '$id' => '_key_deploymentResourceType',
                'type' => Database::INDEX_KEY,
                'attributes' => ['deploymentResourceType'],
-                'lengths' => [32],
+                'lengths' => [],
                'orders' => [Database::ORDER_ASC],
            ],
            [
@@ -1418,23 +1469,23 @@ return [
                '$id' => ID::custom('_key_owner'),
                'type' => Database::INDEX_KEY,
                'attributes' => ['owner'],
-                'lengths' => [16],
+                'lengths' => [],
                'orders' => [Database::ORDER_ASC],
            ],
            [
-                '$id' => ID::custom('_key_region'),
-                'type' => Database::INDEX_KEY,
-                'attributes' => ['region'],
-                'lengths' => [16],
-                'orders' => [Database::ORDER_ASC],
-            ],
-            [
-                '$id' => ID::custom('_key_piid_riid_rt'),
+                '$id' => ID::custom('_key_piid_diid_drt'),
                'type' => Database::INDEX_KEY,
                'attributes' => ['projectInternalId', 'deploymentInternalId', 'deploymentResourceType'],
                'lengths' => [],
                'orders' => [],
            ],
+            [
+                '$id' => '_key_region_status_createdAt',
+                'type' => Database::INDEX_KEY,
+                'attributes' => ['region', 'status', '$createdAt'],
+                'lengths' => [],
+                'orders' => [],
+            ],
        ],
    ],

@@ -1903,3 +1954,31 @@ return [
        'indexes' => []
    ],
 ];
+
+// Organization API keys subquery
+$platformCollections['teams']['attributes'][] = [
+    '$id' => ID::custom('keys'),
+    'type' => Database::VAR_STRING,
+    'format' => '',
+    'size' => 16384,
+    'signed' => true,
+    'required' => false,
+    'default' => null,
+    'array' => false,
+    'filters' => ['subQueryOrganizationKeys'],
+];
+
+// Account API keys subquery
+$platformCollections['users']['attributes'][] = [
+    '$id' => ID::custom('keys'),
+    'type' => Database::VAR_STRING,
+    'format' => '',
+    'size' => 16384,
+    'signed' => true,
+    'required' => false,
+    'default' => null,
+    'array' => false,
+    'filters' => ['subQueryAccountKeys'],
+];
+
+return $platformCollections;
@@ -1103,7 +1103,6 @@ return [
        'name' => Exception::RULE_VERIFICATION_FAILED,
        'description' => 'Domain verification failed. Please check if your DNS records are correct and try again.',
        'code' => 400,
-        'publish' => true
    ],
    Exception::PROJECT_SMTP_CONFIG_INVALID => [
        'name' => Exception::PROJECT_SMTP_CONFIG_INVALID,
@@ -60,7 +60,7 @@ return [
            [
                'key' => 'flutter',
                'name' => 'Flutter',
-                'version' => '20.3.2',
+                'version' => '20.3.3',
                'url' => 'https://github.com/appwrite/sdk-for-flutter',
                'package' => 'https://pub.dev/packages/appwrite',
                'enabled' => true,
@@ -377,7 +377,7 @@ return [
            [
                'key' => 'dart',
                'name' => 'Dart',
-                'version' => '20.1.0',
+                'version' => '20.1.1',
                'url' => 'https://github.com/appwrite/sdk-for-dart',
                'package' => 'https://pub.dev/packages/dart_appwrite',
                'enabled' => true,
@@ -20,7 +20,7 @@ return [
        'name' => 'Console',
        'subtitle' => '',
        'description' => '',
-        'controller' => 'web/console.php',
+        'controller' => '', // Uses modules
        'sdk' => false,
        'docs' => false,
        'docsUrl' => '',
@@ -48,7 +48,7 @@ return [
        'name' => 'Avatars',
        'subtitle' => 'The Avatars service aims to help you complete everyday tasks related to your app image, icons, and avatars.',
        'description' => '/docs/services/avatars.md',
-        'controller' => 'api/avatars.php',
+        'controller' => '', // Uses modules
        'sdk' => true,
        'docs' => true,
        'docsUrl' => 'https://appwrite.io/docs/client/avatars',
@@ -146,7 +146,7 @@ return [
        'name' => 'Storage',
        'subtitle' => 'The Storage service allows you to manage your project files.',
        'description' => '/docs/services/storage.md',
-        'controller' => 'api/storage.php',
+        'controller' => '', // Uses modules
        'sdk' => true,
        'docs' => true,
        'docsUrl' => 'https://appwrite.io/docs/client/storage',
@@ -270,9 +270,9 @@ return [
    'console' => [
        'key' => 'console',
        'name' => 'Console',
-        'subtitle' => 'The Console service allows you to interact with console relevant informations.',
+        'subtitle' => 'The Console service allows you to interact with console relevant information.',
        'description' => '',
-        'controller' => 'api/console.php',
+        'controller' => '', // Uses modules
        'sdk' => true,
        'docs' => true,
        'docsUrl' => '',
@@ -3,4 +3,6 @@
 use Utopia\Image\Image;
 use Utopia\System\System;

-Image::setResourceLimit('memory', intval(System::getEnv('_APP_IMAGES_RESOURCE_LIMIT_MEMORY', 1024*1024*64)));
+if (\class_exists('Imagick')) {
+    Image::setResourceLimit('memory', intval(System::getEnv('_APP_IMAGES_RESOURCE_LIMIT_MEMORY', 1024*1024*64)));
+}
@@ -37,7 +37,7 @@ use libphonenumber\PhoneNumberUtil;
 use MaxMind\Db\Reader;
 use Utopia\Abuse\Abuse;
 use Utopia\App;
-use Utopia\Audit\Audit as EventAudit;
+use Utopia\Audit\Audit;
 use Utopia\Auth\Hashes\Sha;
 use Utopia\Auth\Proofs\Code as ProofsCode;
 use Utopia\Auth\Proofs\Password as ProofsPassword;
@@ -207,10 +207,10 @@ function sendSessionAlert(Locale $locale, Document $user, Document $project, arr
 }


-$createSession = function (string $userId, string $secret, Request $request, Response $response, User $user, Database $dbForProject, Document $project, array $platform, Locale $locale, Reader $geodb, Event $queueForEvents, Mail $queueForMails, Store $store, ProofsToken $proofForToken, ProofsCode $proofForCode) {
+$createSession = function (string $userId, string $secret, Request $request, Response $response, User $user, Database $dbForProject, Document $project, array $platform, Locale $locale, Reader $geodb, Event $queueForEvents, Mail $queueForMails, Store $store, ProofsToken $proofForToken, ProofsCode $proofForCode, Authorization $authorization) {

    /** @var Appwrite\Utopia\Database\Documents\User $userFromRequest */
-    $userFromRequest = Authorization::skip(fn () => $dbForProject->getDocument('users', $userId));
+    $userFromRequest = $authorization->skip(fn () => $dbForProject->getDocument('users', $userId));

    if ($userFromRequest->isEmpty()) {
        throw new Exception(Exception::USER_INVALID_TOKEN);
@@ -266,7 +266,7 @@ $createSession = function (string $userId, string $secret, Request $request, Res
        $detector->getDevice()
    ));

-    Authorization::setRole(Role::user($user->getId())->toString());
+    $authorization->addRole(Role::user($user->getId())->toString());

    $session = $dbForProject->createDocument('sessions', $session
        ->setAttribute('$permissions', [
@@ -275,7 +275,7 @@ $createSession = function (string $userId, string $secret, Request $request, Res
            Permission::delete(Role::user($user->getId())),
        ]));

-    Authorization::skip(fn () => $dbForProject->deleteDocument('tokens', $verifiedToken->getId()));
+    $authorization->skip(fn () => $dbForProject->deleteDocument('tokens', $verifiedToken->getId()));
    $dbForProject->purgeCachedDocument('users', $user->getId());

    // Magic URL + Email OTP
@@ -376,8 +376,9 @@ App::post('/v1/account')
    ->inject('user')
    ->inject('project')
    ->inject('dbForProject')
+    ->inject('authorization')
    ->inject('hooks')
-    ->action(function (string $userId, string $email, string $password, string $name, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Hooks $hooks) {
+    ->action(function (string $userId, string $email, string $password, string $name, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Authorization $authorization, Hooks $hooks) {

        $email = \strtolower($email);
        if ('console' === $project->getId()) {
@@ -469,9 +470,9 @@ App::post('/v1/account')
            ]);

            $user->removeAttribute('$sequence');
-            $user = Authorization::skip(fn () => $dbForProject->createDocument('users', $user));
+            $user = $authorization->skip(fn () => $dbForProject->createDocument('users', $user));
            try {
-                $target = Authorization::skip(fn () => $dbForProject->createDocument('targets', new Document([
+                $target = $authorization->skip(fn () => $dbForProject->createDocument('targets', new Document([
                    '$permissions' => [
                        Permission::read(Role::user($user->getId())),
                        Permission::update(Role::user($user->getId())),
@@ -497,9 +498,9 @@ App::post('/v1/account')
            throw new Exception(Exception::USER_ALREADY_EXISTS);
        }

-        Authorization::unsetRole(Role::guests()->toString());
-        Authorization::setRole(Role::user($user->getId())->toString());
-        Authorization::setRole(Role::users()->toString());
+        $authorization->removeRole(Role::guests()->toString());
+        $authorization->addRole(Role::user($user->getId())->toString());
+        $authorization->addRole(Role::users()->toString());

        $response
            ->setStatusCode(Response::STATUS_CODE_CREATED)
@@ -959,6 +960,7 @@ App::post('/v1/account/sessions/email')
    ))
    ->label('abuse-limit', 10)
    ->label('abuse-key', 'url:{url},email:{param-email}')
+    ->label('abuse-reset', [201])
    ->param('email', '', new EmailValidator(), 'User email.')
    ->param('password', '', new Password(), 'User password. Must be at least 8 chars.')
    ->inject('request')
@@ -975,7 +977,8 @@ App::post('/v1/account/sessions/email')
    ->inject('store')
    ->inject('proofForPassword')
    ->inject('proofForToken')
-    ->action(function (string $email, string $password, Request $request, Response $response, User $user, Database $dbForProject, Document $project, array $platform, Locale $locale, Reader $geodb, Event $queueForEvents, Mail $queueForMails, Hooks $hooks, Store $store, ProofsPassword $proofForPassword, ProofsToken $proofForToken) {
+    ->inject('authorization')
+    ->action(function (string $email, string $password, Request $request, Response $response, User $user, Database $dbForProject, Document $project, array $platform, Locale $locale, Reader $geodb, Event $queueForEvents, Mail $queueForMails, Hooks $hooks, Store $store, ProofsPassword $proofForPassword, ProofsToken $proofForToken, Authorization $authorization) {
        $email = \strtolower($email);
        $protocol = $request->getProtocol();

@@ -1020,7 +1023,7 @@ App::post('/v1/account/sessions/email')
            $detector->getDevice()
        ));

-        Authorization::setRole(Role::user($user->getId())->toString());
+        $authorization->addRole(Role::user($user->getId())->toString());

        // Re-hash if not using recommended algo
        if ($user->getAttribute('hash') !== $proofForPassword->getHash()->getName()) {
@@ -1119,7 +1122,8 @@ App::post('/v1/account/sessions/anonymous')
    ->inject('store')
    ->inject('proofForPassword')
    ->inject('proofForToken')
-    ->action(function (Request $request, Response $response, Locale $locale, User $user, Document $project, Database $dbForProject, Reader $geodb, Event $queueForEvents, Store $store, ProofsPassword $proofForPassword, ProofsToken $proofForToken) {
+    ->inject('authorization')
+    ->action(function (Request $request, Response $response, Locale $locale, User $user, Document $project, Database $dbForProject, Reader $geodb, Event $queueForEvents, Store $store, ProofsPassword $proofForPassword, ProofsToken $proofForToken, Authorization $authorization) {
        $protocol = $request->getProtocol();

        if ('console' === $project->getId()) {
@@ -1164,7 +1168,7 @@ App::post('/v1/account/sessions/anonymous')
            'accessedAt' => DateTime::now(),
        ]);
        $user->removeAttribute('$sequence');
-        Authorization::skip(fn () => $dbForProject->createDocument('users', $user));
+        $user = $authorization->skip(fn () => $dbForProject->createDocument('users', $user));

        // Create session token
        $duration = $project->getAttribute('auths', [])['duration'] ?? TOKEN_EXPIRATION_LOGIN_LONG;
@@ -1190,7 +1194,7 @@ App::post('/v1/account/sessions/anonymous')
            $detector->getDevice()
        ));

-        Authorization::setRole(Role::user($user->getId())->toString());
+        $authorization->addRole(Role::user($user->getId())->toString());

        $session = $dbForProject->createDocument('sessions', $session->setAttribute('$permissions', [
            Permission::read(Role::user($user->getId())),
@@ -1257,6 +1261,7 @@ App::post('/v1/account/sessions/token')
    ))
    ->label('abuse-limit', 10)
    ->label('abuse-key', 'ip:{ip},userId:{param-userId}')
+    ->label('abuse-reset', [201])
    ->param('userId', '', new CustomId(), 'User ID. Choose a custom ID or generate a random ID with `ID.unique()`. Valid chars are a-z, A-Z, 0-9, period, hyphen, and underscore. Can\'t start with a special char. Max length is 36 chars.')
    ->param('secret', '', new Text(256), 'Secret of a token generated by login methods. For example, the `createMagicURLToken` or `createPhoneToken` methods.')
    ->inject('request')
@@ -1272,6 +1277,7 @@ App::post('/v1/account/sessions/token')
    ->inject('store')
    ->inject('proofForToken')
    ->inject('proofForCode')
+->inject('authorization')
    ->action($createSession);

 App::get('/v1/account/sessions/oauth2/:provider')
@@ -1468,7 +1474,8 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect')
    ->inject('store')
    ->inject('proofForPassword')
    ->inject('proofForToken')
-    ->action(function (string $provider, string $code, string $state, string $error, string $error_description, Request $request, Response $response, Document $project, Validator $redirectValidator, Document $devKey, User $user, Database $dbForProject, Reader $geodb, Event $queueForEvents, Store $store, ProofsPassword $proofForPassword, ProofsToken $proofForToken) use ($oauthDefaultSuccess) {
+    ->inject('authorization')
+    ->action(function (string $provider, string $code, string $state, string $error, string $error_description, Request $request, Response $response, Document $project, Validator $redirectValidator, Document $devKey, User $user, Database $dbForProject, Reader $geodb, Event $queueForEvents, Store $store, ProofsPassword $proofForPassword, ProofsToken $proofForToken, Authorization $authorization) use ($oauthDefaultSuccess) {
        $protocol = System::getEnv('_APP_OPTIONS_FORCE_HTTPS') === 'disabled' ? 'http' : 'https';
        $port = $request->getPort();
        $callbackBase = $protocol . '://' . $request->getHostname();
@@ -1724,7 +1731,7 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect')
                    ]);

                    $user->removeAttribute('$sequence');
-                    $userDoc = Authorization::skip(fn () => $dbForProject->createDocument('users', $user));
+                    $userDoc = $authorization->skip(fn () => $dbForProject->createDocument('users', $user));
                    $dbForProject->createDocument('targets', new Document([
                        '$permissions' => [
                            Permission::read(Role::user($user->getId())),
@@ -1742,8 +1749,8 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect')
            }
        }

-        Authorization::setRole(Role::user($user->getId())->toString());
-        Authorization::setRole(Role::users()->toString());
+        $authorization->addRole(Role::user($user->getId())->toString());
+        $authorization->addRole(Role::users()->toString());

        if (false === $user->getAttribute('status')) { // Account is blocked
            $failureRedirect(Exception::USER_BLOCKED); // User is in status blocked
@@ -1814,7 +1821,7 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect')

        $dbForProject->updateDocument('users', $user->getId(), $user);

-        Authorization::setRole(Role::user($user->getId())->toString());
+        $authorization->addRole(Role::user($user->getId())->toString());

        $state['success'] = URLParser::parse($state['success']);
        $query = URLParser::parseQuery($state['success']['query']);
@@ -1838,7 +1845,7 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect')
                'ip' => $request->getIP(),
            ]);

-            Authorization::setRole(Role::user($user->getId())->toString());
+            $authorization->addRole(Role::user($user->getId())->toString());

            $token = $dbForProject->createDocument('tokens', $token
                ->setAttribute('$permissions', [
@@ -2075,7 +2082,8 @@ App::post('/v1/account/tokens/magic-url')
    ->inject('queueForMails')
    ->inject('proofForPassword')
    ->inject('platform')
-    ->action(function (string $userId, string $email, string $url, bool $phrase, Request $request, Response $response, User $user, Document $project, Database $dbForProject, Locale $locale, Event $queueForEvents, Mail $queueForMails, ProofsPassword $proofForPassword, array $platform) {
+    ->inject('authorization')
+    ->action(function (string $userId, string $email, string $url, bool $phrase, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Locale $locale, Event $queueForEvents, Mail $queueForMails, ProofsPassword $proofForPassword, array $platform, Authorization $authorization) {
        if (empty(System::getEnv('_APP_SMTP_HOST'))) {
            throw new Exception(Exception::GENERAL_SMTP_DISABLED, 'SMTP disabled');
        }
@@ -2148,7 +2156,7 @@ App::post('/v1/account/tokens/magic-url')
            ]);

            $user->removeAttribute('$sequence');
-            Authorization::skip(fn () => $dbForProject->createDocument('users', $user));
+            $user = $authorization->skip(fn () => $dbForProject->createDocument('users', $user));
        }

        $proofForToken = new ProofsToken(TOKEN_LENGTH_MAGIC_URL);
@@ -2168,7 +2176,7 @@ App::post('/v1/account/tokens/magic-url')
            'ip' => $request->getIP(),
        ]);

-        Authorization::setRole(Role::user($user->getId())->toString());
+        $authorization->addRole(Role::user($user->getId())->toString());

        $token = $dbForProject->createDocument('tokens', $token
            ->setAttribute('$permissions', [
@@ -2354,7 +2362,8 @@ App::post('/v1/account/tokens/email')
    ->inject('queueForMails')
    ->inject('proofForPassword')
    ->inject('proofForCode')
-    ->action(function (string $userId, string $email, bool $phrase, Request $request, Response $response, User $user, Document $project, array $platform, Database $dbForProject, Locale $locale, Event $queueForEvents, Mail $queueForMails, ProofsPassword $proofForPassword, ProofsCode $proofForCode) {
+    ->inject('authorization')
+    ->action(function (string $userId, string $email, bool $phrase, Request $request, Response $response, User $user, Document $project, array $platform, Database $dbForProject, Locale $locale, Event $queueForEvents, Mail $queueForMails, ProofsPassword $proofForPassword, ProofsCode $proofForCode, Authorization $authorization) {
        if (empty(System::getEnv('_APP_SMTP_HOST'))) {
            throw new Exception(Exception::GENERAL_SMTP_DISABLED, 'SMTP disabled');
        }
@@ -2423,9 +2432,9 @@ App::post('/v1/account/tokens/email')
            ]);

            $user->removeAttribute('$sequence');
-            $user = Authorization::skip(fn () => $dbForProject->createDocument('users', $user));
+            $user = $authorization->skip(fn () => $dbForProject->createDocument('users', $user));
            try {
-                $target = Authorization::skip(fn () => $dbForProject->createDocument('targets', new Document([
+                $target = $authorization->skip(fn () => $dbForProject->createDocument('targets', new Document([
                    '$permissions' => [
                        Permission::read(Role::user($user->getId())),
                        Permission::update(Role::user($user->getId())),
@@ -2463,7 +2472,7 @@ App::post('/v1/account/tokens/email')
            'ip' => $request->getIP(),
        ]);

-        Authorization::setRole(Role::user($user->getId())->toString());
+        $authorization->addRole(Role::user($user->getId())->toString());

        $token = $dbForProject->createDocument('tokens', $token
            ->setAttribute('$permissions', [
@@ -2645,6 +2654,7 @@ App::put('/v1/account/sessions/magic-url')
    ))
    ->label('abuse-limit', 10)
    ->label('abuse-key', 'ip:{ip},userId:{param-userId}')
+    ->label('abuse-reset', [201])
    ->param('userId', '', new CustomId(), 'User ID. Choose a custom ID or generate a random ID with `ID.unique()`. Valid chars are a-z, A-Z, 0-9, period, hyphen, and underscore. Can\'t start with a special char. Max length is 36 chars.')
    ->param('secret', '', new Text(256), 'Valid verification token.')
    ->inject('request')
@@ -2659,10 +2669,11 @@ App::put('/v1/account/sessions/magic-url')
    ->inject('queueForMails')
    ->inject('store')
    ->inject('proofForCode')
-    ->action(function ($userId, $secret, $request, $response, $user, $dbForProject, $project, $platform, $locale, $geodb, $queueForEvents, $queueForMails, $store, $proofForCode) use ($createSession) {
+    ->inject('authorization')
+    ->action(function ($userId, $secret, $request, $response, $user, $dbForProject, $project, $platform, $locale, $geodb, $queueForEvents, $queueForMails, $store, $proofForCode, $authorization) use ($createSession) {
        $proofForToken = new ProofsToken(TOKEN_LENGTH_MAGIC_URL);
        $proofForToken->setHash(new Sha());
-        $createSession($userId, $secret, $request, $response, $user, $dbForProject, $project, $platform, $locale, $geodb, $queueForEvents, $queueForMails, $store, $proofForToken, $proofForCode);
+        $createSession($userId, $secret, $request, $response, $user, $dbForProject, $project, $platform, $locale, $geodb, $queueForEvents, $queueForMails, $store, $proofForToken, $proofForCode, $authorization);
    });

 App::put('/v1/account/sessions/phone')
@@ -2708,6 +2719,7 @@ App::put('/v1/account/sessions/phone')
    ->inject('store')
    ->inject('proofForToken')
    ->inject('proofForCode')
+    ->inject('authorization')
    ->action($createSession);

 App::post('/v1/account/tokens/phone')
@@ -2751,7 +2763,8 @@ App::post('/v1/account/tokens/phone')
    ->inject('plan')
    ->inject('store')
    ->inject('proofForCode')
-    ->action(function (string $userId, string $phone, Request $request, Response $response, User $user, Document $project, array $platform, Database $dbForProject, Event $queueForEvents, Messaging $queueForMessaging, Locale $locale, callable $timelimit, StatsUsage $queueForStatsUsage, array $plan, Store $store, ProofsCode $proofForCode) {
+    ->inject('authorization')
+    ->action(function (string $userId, string $phone, Request $request, Response $response, User $user, Document $project, array $platform, Database $dbForProject, Event $queueForEvents, Messaging $queueForMessaging, Locale $locale, callable $timelimit, StatsUsage $queueForStatsUsage, array $plan, Store $store, ProofsCode $proofForCode, Authorization $authorization) {
        if (empty(System::getEnv('_APP_SMS_PROVIDER'))) {
            throw new Exception(Exception::GENERAL_PHONE_DISABLED, 'Phone provider not configured');
        }
@@ -2801,9 +2814,9 @@ App::post('/v1/account/tokens/phone')
            ]);

            $user->removeAttribute('$sequence');
-            Authorization::skip(fn () => $dbForProject->createDocument('users', $user));
+            $user = $authorization->skip(fn () => $dbForProject->createDocument('users', $user));
            try {
-                $target = Authorization::skip(fn () => $dbForProject->createDocument('targets', new Document([
+                $target = $authorization->skip(fn () => $dbForProject->createDocument('targets', new Document([
                    '$permissions' => [
                        Permission::read(Role::user($user->getId())),
                        Permission::update(Role::user($user->getId())),
@@ -2849,7 +2862,7 @@ App::post('/v1/account/tokens/phone')
            'ip' => $request->getIP(),
        ]);

-        Authorization::setRole(Role::user($user->getId())->toString());
+        $authorization->addRole(Role::user($user->getId())->toString());

        $token = $dbForProject->createDocument('tokens', $token
            ->setAttribute('$permissions', [
@@ -3033,7 +3046,8 @@ App::get('/v1/account/logs')
    ->inject('locale')
    ->inject('geodb')
    ->inject('dbForProject')
-    ->action(function (array $queries, bool $includeTotal, Response $response, Document $user, Locale $locale, Reader $geodb, Database $dbForProject) {
+    ->inject('audit')
+    ->action(function (array $queries, bool $includeTotal, Response $response, Document $user, Locale $locale, Reader $geodb, Database $dbForProject, Audit $audit) {

        try {
            $queries = Query::parseQueries($queries);
@@ -3041,9 +3055,10 @@ App::get('/v1/account/logs')
            throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
        }

-        $audit = new EventAudit($dbForProject);
-
-        $logs = $audit->getLogsByUser($user->getSequence(), $queries);
+        $grouped = Query::groupByType($queries);
+        $limit = $grouped['limit'] ?? 25;
+        $offset = $grouped['offset'] ?? 0;
+        $logs = $audit->getLogsByUser($user->getSequence(), offset: $offset, limit: $limit);

        $output = [];

@@ -3072,7 +3087,7 @@ App::get('/v1/account/logs')
        }

        $response->dynamic(new Document([
-            'total' => $includeTotal ? $audit->countLogsByUser($user->getSequence(), $queries) : 0,
+            'total' => $includeTotal ? $audit->countLogsByUser($user->getSequence()) : 0,
            'logs' => $output,
        ]), Response::MODEL_LOG_LIST);
    });
@@ -3238,7 +3253,8 @@ App::patch('/v1/account/email')
    ->inject('project')
    ->inject('hooks')
    ->inject('proofForPassword')
-    ->action(function (string $email, string $password, ?\DateTime $requestTimestamp, Response $response, User $user, Database $dbForProject, Event $queueForEvents, Document $project, Hooks $hooks, ProofsPassword $proofForPassword) {
+ ->inject('authorization')
+    ->action(function (string $email, string $password, ?\DateTime $requestTimestamp, Response $response, User $user, Database $dbForProject, Event $queueForEvents, Document $project, Hooks $hooks, ProofsPassword $proofForPassword, Authorization $authorization) {
        // passwordUpdate will be empty if the user has never set a password
        $passwordUpdate = $user->getAttribute('passwordUpdate');

@@ -3290,7 +3306,7 @@ App::patch('/v1/account/email')
                ->setAttribute('passwordUpdate', DateTime::now());
        }

-        $target = Authorization::skip(fn () => $dbForProject->findOne('targets', [
+        $target = $authorization->skip(fn () => $dbForProject->findOne('targets', [
            Query::equal('identifier', [$email]),
        ]));

@@ -3306,7 +3322,7 @@ App::patch('/v1/account/email')
            $oldTarget = $user->find('identifier', $oldEmail, 'targets');

            if ($oldTarget instanceof Document && !$oldTarget->isEmpty()) {
-                Authorization::skip(fn () => $dbForProject->updateDocument('targets', $oldTarget->getId(), $oldTarget->setAttribute('identifier', $email)));
+                $authorization->skip(fn () => $dbForProject->updateDocument('targets', $oldTarget->getId(), $oldTarget->setAttribute('identifier', $email)));
            }
            $dbForProject->purgeCachedDocument('users', $user->getId());
        } catch (Duplicate) {
@@ -3347,8 +3363,9 @@ App::patch('/v1/account/phone')
    ->inject('queueForEvents')
    ->inject('project')
    ->inject('hooks')
-    ->inject('proofForPassword')
-    ->action(function (string $phone, string $password, Response $response, User $user, Database $dbForProject, Event $queueForEvents, Document $project, Hooks $hooks, ProofsPassword $proofForPassword) {
+                ->inject('proofForPassword')
+->inject('authorization')
+    ->action(function (string $phone, string $password, Response $response, Document $user, Database $dbForProject, Event $queueForEvents, Document $project, Hooks $hooks, ProofsPassword $proofForPassword, Authorization $authorization) {
        // passwordUpdate will be empty if the user has never set a password
        $passwordUpdate = $user->getAttribute('passwordUpdate');

@@ -3363,7 +3380,7 @@ App::patch('/v1/account/phone')

        $hooks->trigger('passwordValidator', [$dbForProject, $project, $password, &$user, false]);

-        $target = Authorization::skip(fn () => $dbForProject->findOne('targets', [
+        $target = $authorization->skip(fn () => $dbForProject->findOne('targets', [
            Query::equal('identifier', [$phone]),
        ]));

@@ -3394,7 +3411,7 @@ App::patch('/v1/account/phone')
            $oldTarget = $user->find('identifier', $oldPhone, 'targets');

            if ($oldTarget instanceof Document && !$oldTarget->isEmpty()) {
-                Authorization::skip(fn () => $dbForProject->updateDocument('targets', $oldTarget->getId(), $oldTarget->setAttribute('identifier', $phone)));
+                $authorization->skip(fn () => $dbForProject->updateDocument('targets', $oldTarget->getId(), $oldTarget->setAttribute('identifier', $phone)));
            }
            $dbForProject->purgeCachedDocument('users', $user->getId());
        } catch (Duplicate $th) {
@@ -3530,7 +3547,9 @@ App::post('/v1/account/recovery')
    ->inject('queueForMails')
    ->inject('queueForEvents')
    ->inject('proofForToken')
-    ->action(function (string $email, string $url, Request $request, Response $response, User $user, Database $dbForProject, Document $project, array $platform, Locale $locale, Mail $queueForMails, Event $queueForEvents, ProofsToken $proofForToken) {
+    ->inject('authorization')
+    ->action(function (string $email, string $url, Request $request, Response $response, User $user, Database $dbForProject, Document $project, array $platform, Locale $locale, Mail $queueForMails, Event $queueForEvents, ProofsToken $proofForToken, Authorization $authorization) {
+
        if (empty(System::getEnv('_APP_SMTP_HOST'))) {
            throw new Exception(Exception::GENERAL_SMTP_DISABLED, 'SMTP Disabled');
        }
@@ -3566,7 +3585,7 @@ App::post('/v1/account/recovery')
            'ip' => $request->getIP(),
        ]);

-        Authorization::setRole(Role::user($profile->getId())->toString());
+        $authorization->addRole(Role::user($profile->getId())->toString());

        $recovery = $dbForProject->createDocument('tokens', $recovery
            ->setAttribute('$permissions', [
@@ -3722,7 +3741,8 @@ App::put('/v1/account/recovery')
    ->inject('hooks')
    ->inject('proofForPassword')
    ->inject('proofForToken')
-    ->action(function (string $userId, string $secret, string $password, Response $response, User $user, Database $dbForProject, Document $project, Event $queueForEvents, Hooks $hooks, ProofsPassword $proofForPassword, ProofsToken $proofForToken) {
+->inject('authorization')
+    ->action(function (string $userId, string $secret, string $password, Response $response, User $user, Database $dbForProject, Document $project, Event $queueForEvents, Hooks $hooks, ProofsPassword $proofForPassword, ProofsToken $proofForToken, Authorization $authorization) {
        /** @var Appwrite\Utopia\Database\Documents\User $profile */
        $profile = $dbForProject->getDocument('users', $userId);

@@ -3736,7 +3756,7 @@ App::put('/v1/account/recovery')
            throw new Exception(Exception::USER_INVALID_TOKEN);
        }

-        Authorization::setRole(Role::user($profile->getId())->toString());
+        $authorization->addRole(Role::user($profile->getId())->toString());

        $newPassword = $proofForPassword->hash($password);

@@ -3839,7 +3859,8 @@ App::post('/v1/account/verifications/email')
    ->inject('queueForEvents')
    ->inject('queueForMails')
    ->inject('proofForToken')
-    ->action(function (string $url, Request $request, Response $response, Document $project, array $platform, User $user, Database $dbForProject, Locale $locale, Event $queueForEvents, Mail $queueForMails, ProofsToken $proofForToken) {
+    ->inject('authorization')
+    ->action(function (string $url, Request $request, Response $response, Document $project, array $platform, User $user, Database $dbForProject, Locale $locale, Event $queueForEvents, Mail $queueForMails, ProofsToken $proofForToken, Authorization $authorization) {

        if (empty(System::getEnv('_APP_SMTP_HOST'))) {
            throw new Exception(Exception::GENERAL_SMTP_DISABLED, 'SMTP Disabled');
@@ -3868,7 +3889,7 @@ App::post('/v1/account/verifications/email')
            'ip' => $request->getIP(),
        ]);

-        Authorization::setRole(Role::user($user->getId())->toString());
+        $authorization->addRole(Role::user($user->getId())->toString());

        $verification = $dbForProject->createDocument('tokens', $verification
            ->setAttribute('$permissions', [
@@ -4067,9 +4088,10 @@ App::put('/v1/account/verifications/email')
    ->inject('dbForProject')
    ->inject('queueForEvents')
    ->inject('proofForToken')
-    ->action(function (string $userId, string $secret, Response $response, User $user, Database $dbForProject, Event $queueForEvents, ProofsToken $proofForToken) {
+    ->inject('authorization')
+    ->action(function (string $userId, string $secret, Response $response, User $user, Database $dbForProject, Event $queueForEvents, ProofsToken $proofForToken, Authorization $authorization) {
        /** @var Appwrite\Utopia\Database\Documents\User $profile */
-        $profile = Authorization::skip(fn () => $dbForProject->getDocument('users', $userId));
+        $profile = $authorization->skip(fn () => $dbForProject->getDocument('users', $userId));

        if ($profile->isEmpty()) {
            throw new Exception(Exception::USER_NOT_FOUND);
@@ -4081,7 +4103,7 @@ App::put('/v1/account/verifications/email')
            throw new Exception(Exception::USER_INVALID_TOKEN);
        }

-        Authorization::setRole(Role::user($profile->getId())->toString());
+        $authorization->addRole(Role::user($profile->getId())->toString());

        $profile = $dbForProject->updateDocument('users', $profile->getId(), $profile->setAttribute('emailVerification', true));

@@ -4141,7 +4163,8 @@ App::post('/v1/account/verifications/phone')
    ->inject('queueForStatsUsage')
    ->inject('plan')
    ->inject('proofForCode')
-    ->action(function (Request $request, Response $response, User $user, Database $dbForProject, Event $queueForEvents, Messaging $queueForMessaging, Document $project, Locale $locale, callable $timelimit, StatsUsage $queueForStatsUsage, array $plan, ProofsCode $proofForCode) {
+                ->inject('authorization')
+    ->action(function (Request $request, Response $response, User $user, Database $dbForProject, Event $queueForEvents, Messaging $queueForMessaging, Document $project, Locale $locale, callable $timelimit, StatsUsage $queueForStatsUsage, array $plan, ProofsCode $proofForCode, Authorization $authorization) {
        if (empty(System::getEnv('_APP_SMS_PROVIDER'))) {
            throw new Exception(Exception::GENERAL_PHONE_DISABLED, 'Phone provider not configured');
        }
@@ -4180,7 +4203,7 @@ App::post('/v1/account/verifications/phone')
            'ip' => $request->getIP(),
        ]);

-        Authorization::setRole(Role::user($user->getId())->toString());
+        $authorization->addRole(Role::user($user->getId())->toString());

        $verification = $dbForProject->createDocument('tokens', $verification
            ->setAttribute('$permissions', [
@@ -4286,9 +4309,10 @@ App::put('/v1/account/verifications/phone')
    ->inject('dbForProject')
    ->inject('queueForEvents')
    ->inject('proofForCode')
-    ->action(function (string $userId, string $secret, Response $response, User $user, Database $dbForProject, Event $queueForEvents, ProofsCode $proofForCode) {
+    ->inject('authorization')
+    ->action(function (string $userId, string $secret, Response $response, User $user, Database $dbForProject, Event $queueForEvents, ProofsCode $proofForCode, Authorization $authorization) {
        /** @var Appwrite\Utopia\Database\Documents\User  $profile */
-        $profile = Authorization::skip(fn () => $dbForProject->getDocument('users', $userId));
+        $profile = $authorization->skip(fn () => $dbForProject->getDocument('users', $userId));

        if ($profile->isEmpty()) {
            throw new Exception(Exception::USER_NOT_FOUND);
@@ -4300,7 +4324,7 @@ App::put('/v1/account/verifications/phone')
            throw new Exception(Exception::USER_INVALID_TOKEN);
        }

-        Authorization::setRole(Role::user($profile->getId())->toString());
+        $authorization->addRole(Role::user($profile->getId())->toString());

        $profile = $dbForProject->updateDocument('users', $profile->getId(), $profile->setAttribute('phoneVerification', true));

@@ -4353,12 +4377,13 @@ App::post('/v1/account/targets/push')
    ->inject('dbForProject')
    ->inject('store')
    ->inject('proofForToken')
-    ->action(function (string $targetId, string $identifier, string $providerId, Event $queueForEvents, User $user, Request $request, Response $response, Database $dbForProject, Store $store, ProofsToken $proofForToken) {
+    ->inject('authorization')
+    ->action(function (string $targetId, string $identifier, string $providerId, Event $queueForEvents, User $user, Request $request, Response $response, Database $dbForProject, Store $store, ProofsToken $proofForToken, Authorization $authorization) {
        $targetId = $targetId == 'unique()' ? ID::unique() : $targetId;

-        $provider = Authorization::skip(fn () => $dbForProject->getDocument('providers', $providerId));
+        $provider = $authorization->skip(fn () => $dbForProject->getDocument('providers', $providerId));

-        $target = Authorization::skip(fn () => $dbForProject->getDocument('targets', $targetId));
+        $target = $authorization->skip(fn () => $dbForProject->getDocument('targets', $targetId));

        if (!$target->isEmpty()) {
            throw new Exception(Exception::USER_TARGET_ALREADY_EXISTS);
@@ -4433,9 +4458,10 @@ App::put('/v1/account/targets/:targetId/push')
    ->inject('request')
    ->inject('response')
    ->inject('dbForProject')
-    ->action(function (string $targetId, string $identifier, Event $queueForEvents, Document $user, Request $request, Response $response, Database $dbForProject) {
+    ->inject('authorization')
+    ->action(function (string $targetId, string $identifier, Event $queueForEvents, Document $user, Request $request, Response $response, Database $dbForProject, Authorization $authorization) {

-        $target = Authorization::skip(fn () => $dbForProject->getDocument('targets', $targetId));
+        $target = $authorization->skip(fn () => $dbForProject->getDocument('targets', $targetId));

        if ($target->isEmpty()) {
            throw new Exception(Exception::USER_TARGET_NOT_FOUND);
@@ -4498,8 +4524,9 @@ App::delete('/v1/account/targets/:targetId/push')
    ->inject('request')
    ->inject('response')
    ->inject('dbForProject')
-    ->action(function (string $targetId, Event $queueForEvents, Delete $queueForDeletes, Document $user, Request $request, Response $response, Database $dbForProject) {
-        $target = Authorization::skip(fn () => $dbForProject->getDocument('targets', $targetId));
+    ->inject('authorization')
+    ->action(function (string $targetId, Event $queueForEvents, Delete $queueForDeletes, Document $user, Request $request, Response $response, Database $dbForProject, Authorization $authorization) {
+        $target = $authorization->skip(fn () => $dbForProject->getDocument('targets', $targetId));

        if ($target->isEmpty()) {
            throw new Exception(Exception::USER_TARGET_NOT_FOUND);
@@ -1,147 +0,0 @@
-<?php
-
-use Appwrite\Extend\Exception;
-use Appwrite\SDK\AuthType;
-use Appwrite\SDK\ContentType;
-use Appwrite\SDK\Method;
-use Appwrite\SDK\Response as SDKResponse;
-use Appwrite\Utopia\Response;
-use Utopia\App;
-use Utopia\Database\Document;
-use Utopia\Domains\Domain;
-use Utopia\System\System;
-use Utopia\Validator\IP;
-use Utopia\Validator\Text;
-
-App::init()
-    ->groups(['console'])
-    ->inject('project')
-    ->action(function (Document $project) {
-        if ($project->getId() !== 'console') {
-            throw new Exception(Exception::GENERAL_ACCESS_FORBIDDEN);
-        }
-    });
-
-
-App::get('/v1/console/variables')
-    ->desc('Get variables')
-    ->groups(['api', 'projects'])
-    ->label('scope', 'projects.read')
-    ->label('sdk', new Method(
-        namespace: 'console',
-        group: 'console',
-        name: 'variables',
-        description: '/docs/references/console/variables.md',
-        auth: [AuthType::ADMIN],
-        responses: [
-            new SDKResponse(
-                code: Response::STATUS_CODE_OK,
-                model: Response::MODEL_CONSOLE_VARIABLES,
-            )
-        ],
-        contentType: ContentType::JSON
-    ))
-    ->inject('response')
-    ->action(function (Response $response) {
-        $validator = new Domain(System::getEnv('_APP_DOMAIN_TARGET_CNAME'));
-        $isCNAMEValid = !empty(System::getEnv('_APP_DOMAIN_TARGET_CNAME', '')) && $validator->isKnown() && !$validator->isTest();
-
-        $validator = new IP(IP::V4);
-        $isAValid = !empty(System::getEnv('_APP_DOMAIN_TARGET_A', '')) && ($validator->isValid(System::getEnv('_APP_DOMAIN_TARGET_A')));
-
-        $validator = new IP(IP::V6);
-        $isAAAAValid = !empty(System::getEnv('_APP_DOMAIN_TARGET_AAAA', '')) && $validator->isValid(System::getEnv('_APP_DOMAIN_TARGET_AAAA'));
-
-        $isDomainEnabled = $isAAAAValid || $isAValid || $isCNAMEValid;
-
-        $isVcsEnabled = !empty(System::getEnv('_APP_VCS_GITHUB_APP_NAME', ''))
-            && !empty(System::getEnv('_APP_VCS_GITHUB_PRIVATE_KEY', ''))
-            && !empty(System::getEnv('_APP_VCS_GITHUB_APP_ID', ''))
-            && !empty(System::getEnv('_APP_VCS_GITHUB_CLIENT_ID', ''))
-            && !empty(System::getEnv('_APP_VCS_GITHUB_CLIENT_SECRET', ''));
-
-        $isAssistantEnabled = !empty(System::getEnv('_APP_ASSISTANT_OPENAI_API_KEY', ''));
-
-        $variables = new Document([
-            '_APP_DOMAIN_TARGET_CNAME' => System::getEnv('_APP_DOMAIN_TARGET_CNAME'),
-            '_APP_DOMAIN_TARGET_AAAA' => System::getEnv('_APP_DOMAIN_TARGET_AAAA'),
-            '_APP_DOMAIN_TARGET_A' => System::getEnv('_APP_DOMAIN_TARGET_A'),
-            // Combine CAA domain with most common flags and tag (no parameters)
-            '_APP_DOMAIN_TARGET_CAA' => '0 issue "' . System::getEnv('_APP_DOMAIN_TARGET_CAA') . '"',
-            '_APP_STORAGE_LIMIT' => +System::getEnv('_APP_STORAGE_LIMIT'),
-            '_APP_COMPUTE_BUILD_TIMEOUT' => +System::getEnv('_APP_COMPUTE_BUILD_TIMEOUT'),
-            '_APP_COMPUTE_SIZE_LIMIT' => +System::getEnv('_APP_COMPUTE_SIZE_LIMIT'),
-            '_APP_USAGE_STATS' => System::getEnv('_APP_USAGE_STATS'),
-            '_APP_VCS_ENABLED' => $isVcsEnabled,
-            '_APP_DOMAIN_ENABLED' => $isDomainEnabled,
-            '_APP_ASSISTANT_ENABLED' => $isAssistantEnabled,
-            '_APP_DOMAIN_SITES' => System::getEnv('_APP_DOMAIN_SITES'),
-            '_APP_DOMAIN_FUNCTIONS' => System::getEnv('_APP_DOMAIN_FUNCTIONS'),
-            '_APP_OPTIONS_FORCE_HTTPS' => System::getEnv('_APP_OPTIONS_FORCE_HTTPS'),
-            '_APP_DOMAINS_NAMESERVERS' => System::getEnv('_APP_DOMAINS_NAMESERVERS'),
-        ]);
-
-        $response->dynamic($variables, Response::MODEL_CONSOLE_VARIABLES);
-    });
-
-App::post('/v1/console/assistant')
-    ->desc('Create assistant query')
-    ->groups(['api', 'assistant'])
-    ->label('scope', 'assistant.read')
-    ->label('sdk', new Method(
-        namespace: 'assistant',
-        group: 'console',
-        name: 'chat',
-        description: '/docs/references/assistant/chat.md',
-        auth: [AuthType::ADMIN],
-        responses: [
-            new SDKResponse(
-                code: Response::STATUS_CODE_OK,
-                model: Response::MODEL_NONE,
-            )
-        ],
-        contentType: ContentType::TEXT
-    ))
-    ->label('abuse-limit', 15)
-    ->label('abuse-key', 'userId:{userId}')
-    ->param('prompt', '', new Text(2000), 'Prompt. A string containing questions asked to the AI assistant.')
-    ->inject('response')
-    ->action(function (string $prompt, Response $response) {
-        $ch = curl_init('http://appwrite-assistant:3003/v1/models/assistant/prompt');
-        $responseHeaders = [];
-        $query = json_encode(['prompt' => $prompt]);
-        $headers = ['accept: text/event-stream'];
-        $handleEvent = function ($ch, $data) use ($response) {
-            $response->chunk($data);
-
-            return \strlen($data);
-        };
-
-        curl_setopt($ch, CURLOPT_WRITEFUNCTION, $handleEvent);
-
-        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
-        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
-        curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
-        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 0);
-        curl_setopt($ch, CURLOPT_TIMEOUT, 9000);
-        curl_setopt($ch, CURLOPT_HEADERFUNCTION, function ($curl, $header) use (&$responseHeaders) {
-            $len = strlen($header);
-            $header = explode(':', $header, 2);
-
-            if (count($header) < 2) { // ignore invalid headers
-                return $len;
-            }
-
-            $responseHeaders[strtolower(trim($header[0]))] = trim($header[1]);
-
-            return $len;
-        });
-
-        curl_setopt($ch, CURLOPT_POSTFIELDS, $query);
-
-        curl_exec($ch);
-
-        curl_close($ch);
-
-        $response->chunk('', true);
-    });
@@ -28,11 +28,12 @@ use Utopia\Validator\Text;
 App::init()
    ->groups(['graphql'])
    ->inject('project')
-    ->action(function (Document $project) {
+    ->inject('authorization')
+    ->action(function (Document $project, Authorization $authorization) {
        if (
            array_key_exists('graphql', $project->getAttribute('apis', []))
            && !$project->getAttribute('apis', [])['graphql']
-            && !(User::isPrivileged(Authorization::getRoles()) || User::isApp(Authorization::getRoles()))
+            && !(User::isPrivileged($authorization->getRoles()) || User::isApp($authorization->getRoles()))
        ) {
            throw new AppwriteException(AppwriteException::GENERAL_API_DISABLED);
        }
@@ -11,6 +11,7 @@ use Appwrite\Event\Func;
 use Appwrite\Event\Mail;
 use Appwrite\Event\Messaging;
 use Appwrite\Event\Migration;
+use Appwrite\Event\Screenshot;
 use Appwrite\Event\StatsResources;
 use Appwrite\Event\StatsUsage;
 use Appwrite\Event\Webhook;
@@ -26,6 +27,7 @@ use Utopia\Cache\Adapter\Pool as CachePool;
 use Utopia\Config\Config;
 use Utopia\Database\Adapter\Pool as DatabasePool;
 use Utopia\Database\Document;
+use Utopia\Database\Validator\Authorization;
 use Utopia\Domains\Validator\PublicDomain;
 use Utopia\Pools\Group;
 use Utopia\Registry\Registry;
@@ -100,7 +102,8 @@ App::get('/v1/health/db')
    ))
    ->inject('response')
    ->inject('pools')
-    ->action(function (Response $response, Group $pools) {
+    ->inject('authorization')
+    ->action(action: function (Response $response, Group $pools, Authorization $authorization) {
        $output = [];
        $failures = [];

@@ -113,14 +116,14 @@ App::get('/v1/health/db')
            foreach ($config as $database) {
                try {
                    $adapter = new DatabasePool($pools->get($database));
-
+                    $adapter->setAuthorization($authorization);
                    $checkStart = \microtime(true);

                    if ($adapter->ping()) {
                        $output[] = new Document([
                            'name' => $key . " ($database)",
                            'status' => 'pass',
-                            'ping' => \round((\microtime(true) - $checkStart) / 1000)
+                            'ping' => \round((\microtime(true) - $checkStart) * 1000)
                        ]);
                    } else {
                        $failures[] = $database;
@@ -131,6 +134,8 @@ App::get('/v1/health/db')
            }
        }

+        // Only throw error if ALL databases failed (no successful pings)
+        // This allows partial failures in environments where not all DBs are ready
        if (!empty($failures)) {
            throw new Exception(Exception::GENERAL_SERVER_ERROR, 'DB failure on: ' . implode(", ", $failures));
        }
@@ -180,7 +185,7 @@ App::get('/v1/health/cache')
                        $output[] = new Document([
                            'name' => $key . " ($cache)",
                            'status' => 'pass',
-                            'ping' => \round((\microtime(true) - $checkStart) / 1000)
+                            'ping' => \round((\microtime(true) - $checkStart) * 1000)
                        ]);
                    } else {
                        $failures[] = $cache;
@@ -240,7 +245,7 @@ App::get('/v1/health/pubsub')
                        $output[] = new Document([
                            'name' => $key . " ($pubsub)",
                            'status' => 'pass',
-                            'ping' => \round((\microtime(true) - $checkStart) / 1000)
+                            'ping' => \round((\microtime(true) - $checkStart) * 1000)
                        ]);
                    } else {
                        $failures[] = $pubsub;
@@ -822,7 +827,7 @@ App::get('/v1/health/storage/local')

        $output = [
            'status' => 'pass',
-            'ping' => \round((\microtime(true) - $checkStart) / 1000)
+            'ping' => \round((\microtime(true) - $checkStart) * 1000)
        ];

        $response->dynamic(new Document($output), Response::MODEL_HEALTH_STATUS);
@@ -874,7 +879,7 @@ App::get('/v1/health/storage')

        $output = [
            'status' => 'pass',
-            'ping' => \round((\microtime(true) - $checkStart) / 1000)
+            'ping' => \round((\microtime(true) - $checkStart) * 1000)
        ];

        $response->dynamic(new Document($output), Response::MODEL_HEALTH_STATUS);
@@ -955,6 +960,7 @@ App::get('/v1/health/queue/failed/:name')
        System::getEnv('_APP_WEBHOOK_QUEUE_NAME', Event::WEBHOOK_QUEUE_NAME),
        System::getEnv('_APP_CERTIFICATES_QUEUE_NAME', Event::CERTIFICATES_QUEUE_NAME),
        System::getEnv('_APP_BUILDS_QUEUE_NAME', Event::BUILDS_QUEUE_NAME),
+        System::getEnv('_APP_SCREENSHOTS_QUEUE_NAME', Event::SCREENSHOTS_QUEUE_NAME),
        System::getEnv('_APP_MESSAGING_QUEUE_NAME', Event::MESSAGING_QUEUE_NAME),
        System::getEnv('_APP_MIGRATIONS_QUEUE_NAME', Event::MIGRATIONS_QUEUE_NAME)
    ]), 'The name of the queue')
@@ -972,6 +978,7 @@ App::get('/v1/health/queue/failed/:name')
    ->inject('queueForBuilds')
    ->inject('queueForMessaging')
    ->inject('queueForMigrations')
+    ->inject('queueForScreenshots')
    ->action(function (
        string $name,
        int|string $threshold,
@@ -987,7 +994,8 @@ App::get('/v1/health/queue/failed/:name')
        Certificate $queueForCertificates,
        Build $queueForBuilds,
        Messaging $queueForMessaging,
-        Migration $queueForMigrations
+        Migration $queueForMigrations,
+        Screenshot $queueForScreenshots,
    ) {
        $threshold = \intval($threshold);

@@ -1003,6 +1011,7 @@ App::get('/v1/health/queue/failed/:name')
            System::getEnv('_APP_WEBHOOK_QUEUE_NAME', Event::WEBHOOK_QUEUE_NAME) => $queueForWebhooks,
            System::getEnv('_APP_CERTIFICATES_QUEUE_NAME', Event::CERTIFICATES_QUEUE_NAME) => $queueForCertificates,
            System::getEnv('_APP_BUILDS_QUEUE_NAME', Event::BUILDS_QUEUE_NAME) => $queueForBuilds,
+            System::getEnv('_APP_SCREENSHOTS_QUEUE_NAME', Event::SCREENSHOTS_QUEUE_NAME) => $queueForScreenshots,
            System::getEnv('_APP_MESSAGING_QUEUE_NAME', Event::MESSAGING_QUEUE_NAME) => $queueForMessaging,
            System::getEnv('_APP_MIGRATIONS_QUEUE_NAME', Event::MIGRATIONS_QUEUE_NAME) => $queueForMigrations,
        };
@@ -36,6 +36,7 @@ use Utopia\Database\Exception\Query as QueryException;
 use Utopia\Database\Helpers\ID;
 use Utopia\Database\Query;
 use Utopia\Database\Validator\Authorization;
+use Utopia\Database\Validator\Authorization\Input;
 use Utopia\Database\Validator\Datetime as DatetimeValidator;
 use Utopia\Database\Validator\Queries;
 use Utopia\Database\Validator\Query\Cursor;
@@ -1073,8 +1074,9 @@ App::get('/v1/messaging/providers')
    ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
    ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
    ->inject('dbForProject')
+    ->inject('authorization')
    ->inject('response')
-    ->action(function (array $queries, string $search, bool $includeTotal, Database $dbForProject, Response $response) {
+    ->action(function (array $queries, string $search, bool $includeTotal, Database $dbForProject, Authorization $authorization, Response $response) {
        try {
            $queries = Query::parseQueries($queries);
        } catch (QueryException $e) {
@@ -1100,7 +1102,7 @@ App::get('/v1/messaging/providers')
            }

            $providerId = $cursor->getValue();
-            $cursorDocument = Authorization::skip(fn () => $dbForProject->getDocument('providers', $providerId));
+            $cursorDocument = $authorization->skip(fn () => $dbForProject->getDocument('providers', $providerId));

            if ($cursorDocument->isEmpty()) {
                throw new Exception(Exception::GENERAL_CURSOR_NOT_FOUND, "Provider '{$providerId}' for the 'cursor' value not found.");
@@ -1145,7 +1147,8 @@ App::get('/v1/messaging/providers/:providerId/logs')
    ->inject('dbForProject')
    ->inject('locale')
    ->inject('geodb')
-    ->action(function (string $providerId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb) {
+    ->inject('audit')
+    ->action(function (string $providerId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb, Audit $audit) {
        $provider = $dbForProject->getDocument('providers', $providerId);

        if ($provider->isEmpty()) {
@@ -1158,9 +1161,12 @@ App::get('/v1/messaging/providers/:providerId/logs')
            throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
        }

-        $audit = new Audit($dbForProject);
+        $grouped = Query::groupByType($queries);
+        $limit = $grouped['limit'] ?? 25;
+        $offset = $grouped['offset'] ?? 0;
+
        $resource = 'provider/' . $providerId;
-        $logs = $audit->getLogsByResource($resource, $queries);
+        $logs = $audit->getLogsByResource($resource, offset: $offset, limit: $limit);
        $output = [];

        foreach ($logs as $i => &$log) {
@@ -1207,7 +1213,7 @@ App::get('/v1/messaging/providers/:providerId/logs')
        }

        $response->dynamic(new Document([
-            'total' => $includeTotal ? $audit->countLogsByResource($resource, $queries) : 0,
+            'total' => $includeTotal ? $audit->countLogsByResource($resource) : 0,
            'logs' => $output,
        ]), Response::MODEL_LOG_LIST);
    });
@@ -2477,8 +2483,9 @@ App::get('/v1/messaging/topics')
    ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
    ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
    ->inject('dbForProject')
+    ->inject('authorization')
    ->inject('response')
-    ->action(function (array $queries, string $search, bool $includeTotal, Database $dbForProject, Response $response) {
+    ->action(function (array $queries, string $search, bool $includeTotal, Database $dbForProject, Authorization $authorization, Response $response) {
        try {
            $queries = Query::parseQueries($queries);
        } catch (QueryException $e) {
@@ -2504,7 +2511,7 @@ App::get('/v1/messaging/topics')
            }

            $topicId = $cursor->getValue();
-            $cursorDocument = Authorization::skip(fn () => $dbForProject->getDocument('topics', $topicId));
+            $cursorDocument = $authorization->skip(fn () => $dbForProject->getDocument('topics', $topicId));

            if ($cursorDocument->isEmpty()) {
                throw new Exception(Exception::GENERAL_CURSOR_NOT_FOUND, "Topic '{$topicId}' for the 'cursor' value not found.");
@@ -2549,7 +2556,8 @@ App::get('/v1/messaging/topics/:topicId/logs')
    ->inject('dbForProject')
    ->inject('locale')
    ->inject('geodb')
-    ->action(function (string $topicId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb) {
+    ->inject('audit')
+    ->action(function (string $topicId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb, Audit $audit) {
        $topic = $dbForProject->getDocument('topics', $topicId);

        if ($topic->isEmpty()) {
@@ -2562,9 +2570,12 @@ App::get('/v1/messaging/topics/:topicId/logs')
            throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
        }

-        $audit = new Audit($dbForProject);
+        $grouped = Query::groupByType($queries);
+        $limit = $grouped['limit'] ?? 25;
+        $offset = $grouped['offset'] ?? 0;
+
        $resource = 'topic/' . $topicId;
-        $logs = $audit->getLogsByResource($resource, $queries);
+        $logs = $audit->getLogsByResource($resource, offset: $offset, limit: $limit);

        $output = [];

@@ -2612,7 +2623,7 @@ App::get('/v1/messaging/topics/:topicId/logs')
        }

        $response->dynamic(new Document([
-            'total' => $includeTotal ? $audit->countLogsByResource($resource, $queries) : 0,
+            'total' => $includeTotal ? $audit->countLogsByResource($resource) : 0,
            'logs' => $output,
        ]), Response::MODEL_LOG_LIST);
    });
@@ -2774,29 +2785,27 @@ App::post('/v1/messaging/topics/:topicId/subscribers')
    ->param('targetId', '', new UID(), 'Target ID. The target ID to link to the specified Topic ID.')
    ->inject('queueForEvents')
    ->inject('dbForProject')
+    ->inject('authorization')
    ->inject('response')
-    ->action(function (string $subscriberId, string $topicId, string $targetId, Event $queueForEvents, Database $dbForProject, Response $response) {
+    ->action(function (string $subscriberId, string $topicId, string $targetId, Event $queueForEvents, Database $dbForProject, Authorization $authorization, Response $response) {
        $subscriberId = $subscriberId == 'unique()' ? ID::unique() : $subscriberId;

-        $topic = Authorization::skip(fn () => $dbForProject->getDocument('topics', $topicId));
+        $topic = $authorization->skip(fn () => $dbForProject->getDocument('topics', $topicId));

        if ($topic->isEmpty()) {
            throw new Exception(Exception::TOPIC_NOT_FOUND);
        }
-
-        $validator = new Authorization('subscribe');
-
-        if (!$validator->isValid($topic->getAttribute('subscribe'))) {
-            throw new Exception(Exception::USER_UNAUTHORIZED, $validator->getDescription());
+        if (!$authorization->isValid(new Input('subscribe', $topic->getAttribute('subscribe')))) {
+            throw new Exception(Exception::USER_UNAUTHORIZED, $authorization->getDescription());
        }

-        $target = Authorization::skip(fn () => $dbForProject->getDocument('targets', $targetId));
+        $target = $authorization->skip(fn () => $dbForProject->getDocument('targets', $targetId));

        if ($target->isEmpty()) {
            throw new Exception(Exception::USER_TARGET_NOT_FOUND);
        }

-        $user = Authorization::skip(fn () => $dbForProject->getDocument('users', $target->getAttribute('userId')));
+        $user = $authorization->skip(fn () => $dbForProject->getDocument('users', $target->getAttribute('userId')));

        $subscriber = new Document([
            '$id' => $subscriberId,
@@ -2829,7 +2838,7 @@ App::post('/v1/messaging/topics/:topicId/subscribers')
                default => throw new Exception(Exception::TARGET_PROVIDER_INVALID_TYPE),
            };

-            Authorization::skip(fn () => $dbForProject->increaseDocumentAttribute(
+            $authorization->skip(fn () => $dbForProject->increaseDocumentAttribute(
                'topics',
                $topicId,
                $totalAttribute,
@@ -2874,8 +2883,9 @@ App::get('/v1/messaging/topics/:topicId/subscribers')
    ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
    ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
    ->inject('dbForProject')
+    ->inject('authorization')
    ->inject('response')
-    ->action(function (string $topicId, array $queries, string $search, bool $includeTotal, Database $dbForProject, Response $response) {
+    ->action(function (string $topicId, array $queries, string $search, bool $includeTotal, Database $dbForProject, Authorization $authorization, Response $response) {
        try {
            $queries = Query::parseQueries($queries);
        } catch (QueryException $e) {
@@ -2886,7 +2896,7 @@ App::get('/v1/messaging/topics/:topicId/subscribers')
            $queries[] = Query::search('search', $search);
        }

-        $topic = Authorization::skip(fn () => $dbForProject->getDocument('topics', $topicId));
+        $topic = $authorization->skip(fn () => $dbForProject->getDocument('topics', $topicId));

        if ($topic->isEmpty()) {
            throw new Exception(Exception::TOPIC_NOT_FOUND);
@@ -2909,7 +2919,7 @@ App::get('/v1/messaging/topics/:topicId/subscribers')
            }

            $subscriberId = $cursor->getValue();
-            $cursorDocument = Authorization::skip(fn () => $dbForProject->getDocument('subscribers', $subscriberId));
+            $cursorDocument = $authorization->skip(fn () => $dbForProject->getDocument('subscribers', $subscriberId));

            if ($cursorDocument->isEmpty()) {
                throw new Exception(Exception::GENERAL_CURSOR_NOT_FOUND, "Subscriber '{$subscriberId}' for the 'cursor' value not found.");
@@ -2923,10 +2933,10 @@ App::get('/v1/messaging/topics/:topicId/subscribers')
            throw new Exception(Exception::DATABASE_QUERY_ORDER_NULL, "The order attribute '{$e->getAttribute()}' had a null value. Cursor pagination requires all documents order attribute values are non-null.");
        }

-        $subscribers = batch(\array_map(function (Document $subscriber) use ($dbForProject) {
-            return function () use ($subscriber, $dbForProject) {
-                $target = Authorization::skip(fn () => $dbForProject->getDocument('targets', $subscriber->getAttribute('targetId')));
-                $user = Authorization::skip(fn () => $dbForProject->getDocument('users', $target->getAttribute('userId')));
+        $subscribers = batch(\array_map(function (Document $subscriber) use ($dbForProject, $authorization) {
+            return function () use ($subscriber, $dbForProject, $authorization) {
+                $target = $authorization->skip(fn () => $dbForProject->getDocument('targets', $subscriber->getAttribute('targetId')));
+                $user = $authorization->skip(fn () => $dbForProject->getDocument('users', $target->getAttribute('userId')));

                return $subscriber
                    ->setAttribute('target', $target)
@@ -2966,7 +2976,8 @@ App::get('/v1/messaging/subscribers/:subscriberId/logs')
    ->inject('dbForProject')
    ->inject('locale')
    ->inject('geodb')
-    ->action(function (string $subscriberId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb) {
+    ->inject('audit')
+    ->action(function (string $subscriberId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb, Audit $audit) {
        $subscriber = $dbForProject->getDocument('subscribers', $subscriberId);

        if ($subscriber->isEmpty()) {
@@ -2979,9 +2990,12 @@ App::get('/v1/messaging/subscribers/:subscriberId/logs')
            throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
        }

-        $audit = new Audit($dbForProject);
+        $grouped = Query::groupByType($queries);
+        $limit = $grouped['limit'] ?? 25;
+        $offset = $grouped['offset'] ?? 0;
+
        $resource = 'subscriber/' . $subscriberId;
-        $logs = $audit->getLogsByResource($resource, $queries);
+        $logs = $audit->getLogsByResource($resource, limit: $limit, offset: $offset);

        $output = [];

@@ -3029,7 +3043,7 @@ App::get('/v1/messaging/subscribers/:subscriberId/logs')
        }

        $response->dynamic(new Document([
-            'total' => $includeTotal ? $audit->countLogsByResource($resource, $queries) : 0,
+            'total' => $includeTotal ? $audit->countLogsByResource($resource) : 0,
            'logs' => $output,
        ]), Response::MODEL_LOG_LIST);
    });
@@ -3055,9 +3069,10 @@ App::get('/v1/messaging/topics/:topicId/subscribers/:subscriberId')
    ->param('topicId', '', new UID(), 'Topic ID. The topic ID subscribed to.')
    ->param('subscriberId', '', new UID(), 'Subscriber ID.')
    ->inject('dbForProject')
+    ->inject('authorization')
    ->inject('response')
-    ->action(function (string $topicId, string $subscriberId, Database $dbForProject, Response $response) {
-        $topic = Authorization::skip(fn () => $dbForProject->getDocument('topics', $topicId));
+    ->action(function (string $topicId, string $subscriberId, Database $dbForProject, Authorization $authorization, Response $response) {
+        $topic = $authorization->skip(fn () => $dbForProject->getDocument('topics', $topicId));

        if ($topic->isEmpty()) {
            throw new Exception(Exception::TOPIC_NOT_FOUND);
@@ -3069,8 +3084,8 @@ App::get('/v1/messaging/topics/:topicId/subscribers/:subscriberId')
            throw new Exception(Exception::SUBSCRIBER_NOT_FOUND);
        }

-        $target = Authorization::skip(fn () => $dbForProject->getDocument('targets', $subscriber->getAttribute('targetId')));
-        $user = Authorization::skip(fn () => $dbForProject->getDocument('users', $target->getAttribute('userId')));
+        $target = $authorization->skip(fn () => $dbForProject->getDocument('targets', $subscriber->getAttribute('targetId')));
+        $user = $authorization->skip(fn () => $dbForProject->getDocument('users', $target->getAttribute('userId')));

        $subscriber
            ->setAttribute('target', $target)
@@ -3106,9 +3121,10 @@ App::delete('/v1/messaging/topics/:topicId/subscribers/:subscriberId')
    ->param('subscriberId', '', new UID(), 'Subscriber ID.')
    ->inject('queueForEvents')
    ->inject('dbForProject')
+    ->inject('authorization')
    ->inject('response')
-    ->action(function (string $topicId, string $subscriberId, Event $queueForEvents, Database $dbForProject, Response $response) {
-        $topic = Authorization::skip(fn () => $dbForProject->getDocument('topics', $topicId));
+    ->action(function (string $topicId, string $subscriberId, Event $queueForEvents, Database $dbForProject, Authorization $authorization, Response $response) {
+        $topic = $authorization->skip(fn () => $dbForProject->getDocument('topics', $topicId));

        if ($topic->isEmpty()) {
            throw new Exception(Exception::TOPIC_NOT_FOUND);
@@ -3131,7 +3147,7 @@ App::delete('/v1/messaging/topics/:topicId/subscribers/:subscriberId')
            default => throw new Exception(Exception::TARGET_PROVIDER_INVALID_TYPE),
        };

-        Authorization::skip(fn () => $dbForProject->decreaseDocumentAttribute(
+        $authorization->skip(fn () => $dbForProject->decreaseDocumentAttribute(
            'topics',
            $topicId,
            $totalAttribute,
@@ -3690,8 +3706,9 @@ App::get('/v1/messaging/messages')
    ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
    ->param('total', true, new Boolean(true), 'When set to false, the total count returned will be 0 and will not be calculated.', true)
    ->inject('dbForProject')
+    ->inject('authorization')
    ->inject('response')
-    ->action(function (array $queries, string $search, bool $includeTotal, Database $dbForProject, Response $response) {
+    ->action(function (array $queries, string $search, bool $includeTotal, Database $dbForProject, Authorization $authorization, Response $response) {
        try {
            $queries = Query::parseQueries($queries);
        } catch (QueryException $e) {
@@ -3717,7 +3734,7 @@ App::get('/v1/messaging/messages')
            }

            $messageId = $cursor->getValue();
-            $cursorDocument = Authorization::skip(fn () => $dbForProject->getDocument('messages', $messageId));
+            $cursorDocument = $authorization->skip(fn () => $dbForProject->getDocument('messages', $messageId));

            if ($cursorDocument->isEmpty()) {
                throw new Exception(Exception::GENERAL_CURSOR_NOT_FOUND, "Message '{$messageId}' for the 'cursor' value not found.");
@@ -3762,7 +3779,8 @@ App::get('/v1/messaging/messages/:messageId/logs')
    ->inject('dbForProject')
    ->inject('locale')
    ->inject('geodb')
-    ->action(function (string $messageId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb) {
+    ->inject('audit')
+    ->action(function (string $messageId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb, Audit $audit) {
        $message = $dbForProject->getDocument('messages', $messageId);

        if ($message->isEmpty()) {
@@ -3775,9 +3793,12 @@ App::get('/v1/messaging/messages/:messageId/logs')
            throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
        }

-        $audit = new Audit($dbForProject);
+        $grouped = Query::groupByType($queries);
+        $limit = $grouped['limit'] ?? 25;
+        $offset = $grouped['offset'] ?? 0;
+
        $resource = 'message/' . $messageId;
-        $logs = $audit->getLogsByResource($resource, $queries);
+        $logs = $audit->getLogsByResource($resource, limit: $limit, offset: $offset);

        $output = [];

@@ -3825,7 +3846,7 @@ App::get('/v1/messaging/messages/:messageId/logs')
        }

        $response->dynamic(new Document([
-            'total' => $includeTotal ? $audit->countLogsByResource($resource, $queries) : 0,
+            'total' => $includeTotal ? $audit->countLogsByResource($resource) : 0,
            'logs' => $output,
        ]), Response::MODEL_LOG_LIST);
    });
@@ -342,6 +342,7 @@ App::post('/v1/migrations/csv/imports')
    ->inject('response')
    ->inject('dbForProject')
    ->inject('dbForPlatform')
+    ->inject('authorization')
    ->inject('project')
    ->inject('platform')
    ->inject('deviceForFiles')
@@ -356,6 +357,7 @@ App::post('/v1/migrations/csv/imports')
        Response $response,
        Database $dbForProject,
        Database $dbForPlatform,
+        Authorization $authorization,
        Document $project,
        array $platform,
        Device $deviceForFiles,
@@ -363,7 +365,7 @@ App::post('/v1/migrations/csv/imports')
        Event $queueForEvents,
        Migration $queueForMigrations
    ) {
-        $bucket = Authorization::skip(function () use ($internalFile, $dbForPlatform, $dbForProject, $bucketId) {
+        $bucket = $authorization->skip(function () use ($internalFile, $dbForPlatform, $dbForProject, $bucketId) {
            if ($internalFile) {
                return $dbForPlatform->getDocument('buckets', 'default');
            }
@@ -374,7 +376,7 @@ App::post('/v1/migrations/csv/imports')
            throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
        }

-        $file = Authorization::skip(fn () => $internalFile ? $dbForPlatform->getDocument('bucket_' . $bucket->getSequence(), $fileId) : $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+        $file = $authorization->skip(fn () => $internalFile ? $dbForPlatform->getDocument('bucket_' . $bucket->getSequence(), $fileId) : $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
        if ($file->isEmpty()) {
            throw new Exception(Exception::STORAGE_FILE_NOT_FOUND);
        }
@@ -491,6 +493,7 @@ App::post('/v1/migrations/csv/exports')
    ->inject('response')
    ->inject('dbForProject')
    ->inject('dbForPlatform')
+    ->inject('authorization')
    ->inject('project')
    ->inject('platform')
    ->inject('queueForEvents')
@@ -509,6 +512,7 @@ App::post('/v1/migrations/csv/exports')
        Response $response,
        Database $dbForProject,
        Database $dbForPlatform,
+        Authorization $authorization,
        Document $project,
        array $platform,
        Event $queueForEvents,
@@ -520,7 +524,7 @@ App::post('/v1/migrations/csv/exports')
            throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
        }

-        $bucket = Authorization::skip(fn () => $dbForPlatform->getDocument('buckets', 'default'));
+        $bucket = $authorization->skip(fn () => $dbForPlatform->getDocument('buckets', 'default'));
        if ($bucket->isEmpty()) {
            throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
        }
@@ -533,12 +537,12 @@ App::post('/v1/migrations/csv/exports')
            throw new Exception(Exception::COLLECTION_NOT_FOUND);
        }

-        $database = Authorization::skip(fn () => $dbForProject->getDocument('databases', $databaseId));
+        $database = $authorization->skip(fn () => $dbForProject->getDocument('databases', $databaseId));
        if ($database->isEmpty()) {
            throw new Exception(Exception::DATABASE_NOT_FOUND);
        }

-        $collection = Authorization::skip(fn () => $dbForProject->getDocument('database_' . $database->getSequence(), $collectionId));
+        $collection = $authorization->skip(fn () => $dbForProject->getDocument('database_' . $database->getSequence(), $collectionId));
        if ($collection->isEmpty()) {
            throw new Exception(Exception::COLLECTION_NOT_FOUND);
        }
@@ -45,9 +45,10 @@ App::get('/v1/project/usage')
    ->inject('response')
    ->inject('project')
    ->inject('dbForProject')
+    ->inject('authorization')
    ->inject('getLogsDB')
    ->inject('smsRates')
-    ->action(function (string $startDate, string $endDate, string $period, Response $response, Document $project, Database $dbForProject, callable $getLogsDB, array $smsRates) {
+    ->action(function (string $startDate, string $endDate, string $period, Response $response, Document $project, Database $dbForProject, Authorization $authorization, callable $getLogsDB, array $smsRates) {
        $stats = $total = $usage = [];
        $format = 'Y-m-d 00:00:00';
        $firstDay = (new DateTime($startDate))->format($format);
@@ -102,7 +103,7 @@ App::get('/v1/project/usage')
            '1d' => 'Y-m-d\T00:00:00.000P',
        };

-        Authorization::skip(function () use ($dbForProject, $dbForLogs, $firstDay, $lastDay, $period, $metrics, $limit, &$total, &$stats) {
+        $authorization->skip(function () use ($dbForProject, $dbForLogs, $firstDay, $lastDay, $period, $metrics, $limit, &$total, &$stats) {
            foreach ($metrics['total'] as $metric) {
                $db = ($metric === METRIC_FILES_IMAGES_TRANSFORMED) ? $dbForLogs : $dbForProject;

@@ -286,7 +287,7 @@ App::get('/v1/project/usage')
        }, $dbForProject->find('functions'));

        // This total is includes free and paid SMS usage
-        $authPhoneTotal = Authorization::skip(fn () => $dbForProject->sum('stats', 'value', [
+        $authPhoneTotal = $authorization->skip(fn () => $dbForProject->sum('stats', 'value', [
            Query::equal('metric', [METRIC_AUTH_METHOD_PHONE]),
            Query::equal('period', ['1d']),
            Query::greaterThanEqual('time', $firstDay),
@@ -294,7 +295,7 @@ App::get('/v1/project/usage')
        ]));

        // This estimate is only for paid SMS usage
-        $authPhoneMetrics = Authorization::skip(fn () => $dbForProject->find('stats', [
+        $authPhoneMetrics = $authorization->skip(fn () => $dbForProject->find('stats', [
            Query::startsWith('metric', METRIC_AUTH_METHOD_PHONE . '.'),
            Query::equal('period', ['1d']),
            Query::greaterThanEqual('time', $firstDay),
@@ -21,6 +21,7 @@ use Appwrite\Utopia\Request;
 use Appwrite\Utopia\Response;
 use PHPMailer\PHPMailer\PHPMailer;
 use Utopia\App;
+use Utopia\Audit\Adapter\Database as AdapterDatabase;
 use Utopia\Audit\Audit;
 use Utopia\Cache\Cache;
 use Utopia\Config\Config;
@@ -203,6 +204,7 @@ App::post('/v1/projects')
                'accessedAt' => DateTime::now(),
                'search' => implode(' ', [$projectId, $name]),
                'database' => $dsn,
+                'labels' => [],
            ]));
        } catch (Duplicate) {
            throw new Exception(Exception::PROJECT_ALREADY_EXISTS);
@@ -225,6 +227,7 @@ App::post('/v1/projects')
        if (!$sharedTablesV2) {
            $adapter = new DatabasePool($pools->get($dsn->getHost()));
            $dbForProject = new Database($adapter, $cache);
+            $dbForProject->setDatabase(APP_DATABASE);

            if ($sharedTables) {
                $dbForProject
@@ -247,13 +250,15 @@ App::post('/v1/projects')
            }

            if ($create || $projectTables) {
-                $audit = new Audit($dbForProject);
+                $adapter = new AdapterDatabase($dbForProject);
+                $audit = new Audit($adapter);
                $audit->setup();
            }

            if (!$create && $sharedTablesV1) {
-                $attributes = \array_map(fn ($attribute) => new Document($attribute), Audit::ATTRIBUTES);
-                $indexes = \array_map(fn (array $index) => new Document($index), Audit::INDEXES);
+                $adapter = new AdapterDatabase($dbForProject);
+                $attributes = $adapter->getAttributeDocuments();
+                $indexes = $adapter->getIndexDocuments();
                $dbForProject->createDocument(Database::METADATA, new Document([
                    '$id' => ID::custom('audit'),
                    '$permissions' => [Permission::create(Role::any())],
@@ -1497,8 +1502,12 @@ App::post('/v1/projects/:projectId/keys')
                Permission::update(Role::any()),
                Permission::delete(Role::any()),
            ],
+            // TODO: @hmacr Remove `projectInternalId` and `projectId` column writes before deleting the column.
            'projectInternalId' => $project->getSequence(),
            'projectId' => $project->getId(),
+            'resourceInternalId' => $project->getSequence(),
+            'resourceId' => $project->getId(),
+            'resourceType' => 'projects',
            'name' => $name,
            'scopes' => $scopes,
            'expire' => $expire,
@@ -1546,7 +1555,8 @@ App::get('/v1/projects/:projectId/keys')
        }

        $keys = $dbForPlatform->find('keys', [
-            Query::equal('projectInternalId', [$project->getSequence()]),
+            Query::equal('resourceType', ['projects']),
+            Query::equal('resourceInternalId', [$project->getSequence()]),
            Query::limit(5000),
        ]);

@@ -1587,7 +1597,8 @@ App::get('/v1/projects/:projectId/keys/:keyId')

        $key = $dbForPlatform->findOne('keys', [
            Query::equal('$id', [$keyId]),
-            Query::equal('projectInternalId', [$project->getSequence()]),
+            Query::equal('resourceType', ['projects']),
+            Query::equal('resourceInternalId', [$project->getSequence()]),
        ]);

        if ($key->isEmpty()) {
@@ -1631,7 +1642,8 @@ App::put('/v1/projects/:projectId/keys/:keyId')

        $key = $dbForPlatform->findOne('keys', [
            Query::equal('$id', [$keyId]),
-            Query::equal('projectInternalId', [$project->getSequence()]),
+            Query::equal('resourceType', ['projects']),
+            Query::equal('resourceInternalId', [$project->getSequence()]),
        ]);

        if ($key->isEmpty()) {
@@ -1682,7 +1694,8 @@ App::delete('/v1/projects/:projectId/keys/:keyId')

        $key = $dbForPlatform->findOne('keys', [
            Query::equal('$id', [$keyId]),
-            Query::equal('projectInternalId', [$project->getSequence()]),
+            Query::equal('resourceType', ['projects']),
+            Query::equal('resourceInternalId', [$project->getSequence()]),
        ]);

        if ($key->isEmpty()) {
@@ -86,16 +86,17 @@ App::post('/v1/teams')
    ->inject('response')
    ->inject('user')
    ->inject('dbForProject')
+    ->inject('authorization')
    ->inject('queueForEvents')
-    ->action(function (string $teamId, string $name, array $roles, Response $response, Document $user, Database $dbForProject, Event $queueForEvents) {
+    ->action(function (string $teamId, string $name, array $roles, Response $response, Document $user, Database $dbForProject, Authorization $authorization, Event $queueForEvents) {

-        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
-        $isAppUser = User::isApp(Authorization::getRoles());
+        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAppUser = User::isApp($authorization->getRoles());

        $teamId = $teamId == 'unique()' ? ID::unique() : $teamId;

        try {
-            $team = Authorization::skip(fn () => $dbForProject->createDocument('teams', new Document([
+            $team = $authorization->skip(fn () => $dbForProject->createDocument('teams', new Document([
                '$id' => $teamId,
                '$permissions' => [
                    Permission::read(Role::team($teamId)),
@@ -491,6 +492,7 @@ App::post('/v1/teams/:teamId/memberships')
    ->inject('project')
    ->inject('user')
    ->inject('dbForProject')
+    ->inject('authorization')
    ->inject('locale')
    ->inject('queueForMails')
    ->inject('queueForMessaging')
@@ -500,9 +502,9 @@ App::post('/v1/teams/:teamId/memberships')
    ->inject('plan')
    ->inject('proofForPassword')
    ->inject('proofForToken')
-    ->action(function (string $teamId, string $email, string $userId, string $phone, array $roles, string $url, string $name, Response $response, Document $project, Document $user, Database $dbForProject, Locale $locale, Mail $queueForMails, Messaging $queueForMessaging, Event $queueForEvents, callable $timelimit, StatsUsage $queueForStatsUsage, array $plan, Password $proofForPassword, Token $proofForToken) {
-        $isAppUser = User::isApp(Authorization::getRoles());
-        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
+    ->action(function (string $teamId, string $email, string $userId, string $phone, array $roles, string $url, string $name, Response $response, Document $project, Document $user, Database $dbForProject, Authorization $authorization, Locale $locale, Mail $queueForMails, Messaging $queueForMessaging, Event $queueForEvents, callable $timelimit, StatsUsage $queueForStatsUsage, array $plan, Password $proofForPassword, Token $proofForToken) {
+        $isAppUser = User::isApp($authorization->getRoles());
+        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());

        $url = htmlentities($url);
        if (empty($url)) {
@@ -619,13 +621,13 @@ App::post('/v1/teams/:teamId/memberships')
            ]);

            try {
-                $invitee = Authorization::skip(fn () => $dbForProject->createDocument('users', $userDocument));
+                $invitee = $authorization->skip(fn () => $dbForProject->createDocument('users', $userDocument));
            } catch (Duplicate $th) {
                throw new Exception(Exception::USER_ALREADY_EXISTS);
            }
        }

-        $isOwner = Authorization::isRole('team:' . $team->getId() . '/owner');
+        $isOwner = $authorization->hasRole('team:' . $team->getId() . '/owner');

        if (!$isOwner && !$isPrivilegedUser && !$isAppUser) { // Not owner, not admin, not app (server)
            throw new Exception(Exception::USER_UNAUTHORIZED, 'User is not allowed to send invitations for this team');
@@ -661,11 +663,11 @@ App::post('/v1/teams/:teamId/memberships')
            ]);

            $membership = ($isPrivilegedUser || $isAppUser) ?
-                Authorization::skip(fn () => $dbForProject->createDocument('memberships', $membership)) :
+                $authorization->skip(fn () => $dbForProject->createDocument('memberships', $membership)) :
                $dbForProject->createDocument('memberships', $membership);

            if ($isPrivilegedUser || $isAppUser) {
-                Authorization::skip(fn () => $dbForProject->increaseDocumentAttribute('teams', $team->getId(), 'total', 1));
+                $authorization->skip(fn () => $dbForProject->increaseDocumentAttribute('teams', $team->getId(), 'total', 1));
            }
        } elseif ($membership->getAttribute('confirm') === false) {
            $membership->setAttribute('secret', $proofForToken->hash($secret));
@@ -677,7 +679,7 @@ App::post('/v1/teams/:teamId/memberships')
            }

            $membership = ($isPrivilegedUser || $isAppUser) ?
-                Authorization::skip(fn () => $dbForProject->updateDocument('memberships', $membership->getId(), $membership)) :
+                $authorization->skip(fn () => $dbForProject->updateDocument('memberships', $membership->getId(), $membership)) :
                $dbForProject->updateDocument('memberships', $membership->getId(), $membership);
        } else {
            throw new Exception(Exception::MEMBERSHIP_ALREADY_CONFIRMED);
@@ -863,7 +865,8 @@ App::get('/v1/teams/:teamId/memberships')
    ->inject('response')
    ->inject('project')
    ->inject('dbForProject')
-    ->action(function (string $teamId, array $queries, string $search, bool $includeTotal, Response $response, Document $project, Database $dbForProject) {
+    ->inject('authorization')
+    ->action(function (string $teamId, array $queries, string $search, bool $includeTotal, Response $response, Document $project, Database $dbForProject, Authorization $authorization) {
        $team = $dbForProject->getDocument('teams', $teamId);

        if ($team->isEmpty()) {
@@ -933,7 +936,7 @@ App::get('/v1/teams/:teamId/memberships')
            'mfa' => $project->getAttribute('auths', [])['membershipsMfa'] ?? true,
        ];

-        $roles = Authorization::getRoles();
+        $roles = $authorization->getRoles();
        $isPrivilegedUser = User::isPrivileged($roles);
        $isAppUser = User::isApp($roles);

@@ -1004,7 +1007,8 @@ App::get('/v1/teams/:teamId/memberships/:membershipId')
    ->inject('response')
    ->inject('project')
    ->inject('dbForProject')
-    ->action(function (string $teamId, string $membershipId, Response $response, Document $project, Database $dbForProject) {
+    ->inject('authorization')
+    ->action(function (string $teamId, string $membershipId, Response $response, Document $project, Database $dbForProject, Authorization $authorization) {

        $team = $dbForProject->getDocument('teams', $teamId);

@@ -1024,7 +1028,7 @@ App::get('/v1/teams/:teamId/memberships/:membershipId')
            'mfa' => $project->getAttribute('auths', [])['membershipsMfa'] ?? true,
        ];

-        $roles = Authorization::getRoles();
+        $roles = $authorization->getRoles();
        $isPrivilegedUser = User::isPrivileged($roles);
        $isAppUser = User::isApp($roles);

@@ -1103,8 +1107,9 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId')
    ->inject('user')
    ->inject('project')
    ->inject('dbForProject')
+    ->inject('authorization')
    ->inject('queueForEvents')
-    ->action(function (string $teamId, string $membershipId, array $roles, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Event $queueForEvents) {
+    ->action(function (string $teamId, string $membershipId, array $roles, Request $request, Response $response, Document $user, Document $project, Database $dbForProject, Authorization $authorization, Event $queueForEvents) {

        $team = $dbForProject->getDocument('teams', $teamId);
        if ($team->isEmpty()) {
@@ -1121,9 +1126,9 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId')
            throw new Exception(Exception::USER_NOT_FOUND);
        }

-        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
-        $isAppUser = User::isApp(Authorization::getRoles());
-        $isOwner = Authorization::isRole('team:' . $team->getId() . '/owner');
+        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAppUser = User::isApp($authorization->getRoles());
+        $isOwner = $authorization->hasRole('team:' . $team->getId() . '/owner');

        if ($project->getId() === 'console') {
            // Quick check: fetch up to 2 owners to determine if only one exists
@@ -1204,12 +1209,13 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
    ->inject('response')
    ->inject('user')
    ->inject('dbForProject')
+    ->inject('authorization')
    ->inject('project')
    ->inject('geodb')
    ->inject('queueForEvents')
    ->inject('store')
    ->inject('proofForToken')
-    ->action(function (string $teamId, string $membershipId, string $userId, string $secret, Request $request, Response $response, Document $user, Database $dbForProject, Document $project, Reader $geodb, Event $queueForEvents, Store $store, Token $proofForToken) {
+    ->action(function (string $teamId, string $membershipId, string $userId, string $secret, Request $request, Response $response, Document $user, Database $dbForProject, Authorization $authorization, $project, Reader $geodb, Event $queueForEvents, Store $store, Token $proofForToken) {
        $protocol = $request->getProtocol();

        $membership = $dbForProject->getDocument('memberships', $membershipId);
@@ -1218,7 +1224,7 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
            throw new Exception(Exception::MEMBERSHIP_NOT_FOUND);
        }

-        $team = Authorization::skip(fn () => $dbForProject->getDocument('teams', $teamId));
+        $team = $authorization->skip(fn () => $dbForProject->getDocument('teams', $teamId));

        if ($team->isEmpty()) {
            throw new Exception(Exception::TEAM_NOT_FOUND);
@@ -1254,11 +1260,11 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')
            ->setAttribute('confirm', true)
        ;

-        Authorization::skip(fn () => $dbForProject->updateDocument('users', $user->getId(), $user->setAttribute('emailVerification', true)));
+        $authorization->skip(fn () => $dbForProject->updateDocument('users', $user->getId(), $user->setAttribute('emailVerification', true)));

        // Create session for the user if not logged in
        if (!$hasSession) {
-            Authorization::setRole(Role::user($user->getId())->toString());
+            $authorization->addRole(Role::user($user->getId())->toString());

            $detector = new Detector($request->getUserAgent('UNKNOWN'));
            $record = $geodb->get($request->getIP());
@@ -1286,7 +1292,7 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')

            $session = $dbForProject->createDocument('sessions', $session);

-            Authorization::setRole(Role::user($userId)->toString());
+            $authorization->addRole(Role::user($userId)->toString());

            $encoded = $store
                ->setProperty('id', $user->getId())
@@ -1324,7 +1330,7 @@ App::patch('/v1/teams/:teamId/memberships/:membershipId/status')

        $dbForProject->purgeCachedDocument('users', $user->getId());

-        Authorization::skip(fn () => $dbForProject->increaseDocumentAttribute('teams', $team->getId(), 'total', 1));
+        $authorization->skip(fn () => $dbForProject->increaseDocumentAttribute('teams', $team->getId(), 'total', 1));

        $queueForEvents
            ->setParam('userId', $user->getId())
@@ -1368,8 +1374,9 @@ App::delete('/v1/teams/:teamId/memberships/:membershipId')
    ->inject('project')
    ->inject('response')
    ->inject('dbForProject')
+    ->inject('authorization')
    ->inject('queueForEvents')
-    ->action(function (string $teamId, string $membershipId, Document $user, Document $project, Response $response, Database $dbForProject, Event $queueForEvents) {
+    ->action(function (string $teamId, string $membershipId, Document $user, Document $project, Response $response, Database $dbForProject, Authorization $authorization, Event $queueForEvents) {

        $membership = $dbForProject->getDocument('memberships', $membershipId);

@@ -1427,7 +1434,7 @@ App::delete('/v1/teams/:teamId/memberships/:membershipId')
        $dbForProject->purgeCachedDocument('users', $profile->getId());

        if ($membership->getAttribute('confirm')) { // Count only confirmed members
-            Authorization::skip(fn () => $dbForProject->decreaseDocumentAttribute('teams', $team->getId(), 'total', 1, 0));
+            $authorization->skip(fn () => $dbForProject->decreaseDocumentAttribute('teams', $team->getId(), 'total', 1, 0));
        }

        $queueForEvents
@@ -1464,7 +1471,8 @@ App::get('/v1/teams/:teamId/logs')
    ->inject('dbForProject')
    ->inject('locale')
    ->inject('geodb')
-    ->action(function (string $teamId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb) {
+    ->inject('audit')
+    ->action(function (string $teamId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb, Audit $audit) {

        $team = $dbForProject->getDocument('teams', $teamId);

@@ -1478,9 +1486,12 @@ App::get('/v1/teams/:teamId/logs')
            throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
        }

-        $audit = new Audit($dbForProject);
+        $grouped = Query::groupByType($queries);
+        $limit = $grouped['limit'] ?? 25;
+        $offset = $grouped['offset'] ?? 0;
+
        $resource = 'team/' . $team->getId();
-        $logs = $audit->getLogsByResource($resource, $queries);
+        $logs = $audit->getLogsByResource($resource, offset: $offset, limit: $limit);

        $output = [];

@@ -1527,7 +1538,7 @@ App::get('/v1/teams/:teamId/logs')
            }
        }
        $response->dynamic(new Document([
-            'total' => $includeTotal ? $audit->countLogsByResource($resource, $queries) : 0,
+            'total' => $includeTotal ? $audit->countLogsByResource($resource) : 0,
            'logs' => $output,
        ]), Response::MODEL_LOG_LIST);
    });
@@ -945,7 +945,8 @@ App::get('/v1/users/:userId/logs')
    ->inject('dbForProject')
    ->inject('locale')
    ->inject('geodb')
-    ->action(function (string $userId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb) {
+    ->inject('audit')
+    ->action(function (string $userId, array $queries, bool $includeTotal, Response $response, Database $dbForProject, Locale $locale, Reader $geodb, Audit $audit) {

        $user = $dbForProject->getDocument('users', $userId);

@@ -958,8 +959,11 @@ App::get('/v1/users/:userId/logs')
            throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage());
        }

-        $audit = new Audit($dbForProject);
-        $logs = $audit->getLogsByUser($user->getSequence(), $queries);
+        $grouped = Query::groupByType($queries);
+        $limit = $grouped['limit'] ?? 25;
+        $offset = $grouped['offset'] ?? 0;
+
+        $logs = $audit->getLogsByUser($user->getSequence(), limit: $limit, offset: $offset);
        $output = [];
        foreach ($logs as $i => &$log) {
            $log['userAgent'] = (!empty($log['userAgent'])) ? $log['userAgent'] : 'UNKNOWN';
@@ -999,7 +1003,7 @@ App::get('/v1/users/:userId/logs')
        }

        $response->dynamic(new Document([
-            'total' => $includeTotal ? $audit->countLogsByUser($user->getSequence(), $queries) : 0,
+            'total' => $includeTotal ? $audit->countLogsByUser($user->getSequence()) : 0,
            'logs' => $output,
        ]), Response::MODEL_LOG_LIST);
    });
@@ -2674,8 +2678,8 @@ App::get('/v1/users/usage')
    ->param('range', '30d', new WhiteList(['24h', '30d', '90d'], true), 'Date range.', true)
    ->inject('response')
    ->inject('dbForProject')
-    ->inject('register')
-    ->action(function (string $range, Response $response, Database $dbForProject) {
+    ->inject('authorization')
+    ->action(function (string $range, Response $response, Database $dbForProject, Authorization $authorization) {

        $periods = Config::getParam('usage', []);
        $stats = $usage = [];
@@ -2685,7 +2689,7 @@ App::get('/v1/users/usage')
            METRIC_SESSIONS,
        ];

-        Authorization::skip(function () use ($dbForProject, $days, $metrics, &$stats) {
+        $authorization->skip(function () use ($dbForProject, $days, $metrics, &$stats) {
            foreach ($metrics as $count => $metric) {
                $result =  $dbForProject->findOne('stats', [
                    Query::equal('metric', [$metric]),
@@ -76,7 +76,7 @@ use Utopia\VCS\Exception\RepositoryNotFound;

 use function Swoole\Coroutine\batch;

-$createGitDeployments = function (GitHub $github, string $providerInstallationId, array $repositories, string $providerBranch, string $providerBranchUrl, string $providerRepositoryName, string $providerRepositoryUrl, string $providerRepositoryOwner, string $providerCommitHash, string $providerCommitAuthor, string $providerCommitAuthorUrl, string $providerCommitMessage, string $providerCommitUrl, string $providerPullRequestId, bool $external, Database $dbForPlatform, Build $queueForBuilds, callable $getProjectDB, array $platform) {
+$createGitDeployments = function (GitHub $github, string $providerInstallationId, array $repositories, string $providerBranch, string $providerBranchUrl, string $providerRepositoryName, string $providerRepositoryUrl, string $providerRepositoryOwner, string $providerCommitHash, string $providerCommitAuthor, string $providerCommitAuthorUrl, string $providerCommitMessage, string $providerCommitUrl, string $providerPullRequestId, bool $external, Database $dbForPlatform, Authorization $authorization, Build $queueForBuilds, callable $getProjectDB, Request $request, array $platform) {
    $errors = [];
    foreach ($repositories as $repository) {
        try {
@@ -87,12 +87,12 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
            }

            $projectId = $repository->getAttribute('projectId');
-            $project = Authorization::skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
+            $project = $authorization->skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
            $dbForProject = $getProjectDB($project);

            $resourceCollection = $resourceType === "function" ? 'functions' : 'sites';
            $resourceId = $repository->getAttribute('resourceId');
-            $resource = Authorization::skip(fn () => $dbForProject->getDocument($resourceCollection, $resourceId));
+            $resource = $authorization->skip(fn () => $dbForProject->getDocument($resourceCollection, $resourceId));
            $resourceInternalId = $resource->getSequence();

            $deploymentId = ID::unique();
@@ -141,7 +141,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
            $latestCommentId = '';

            if (!empty($providerPullRequestId) && $resource->getAttribute('providerSilentMode', false) === false) {
-                $latestComment = Authorization::skip(fn () => $dbForPlatform->findOne('vcsComments', [
+                $latestComment = $authorization->skip(fn () => $dbForPlatform->findOne('vcsComments', [
                    Query::equal('providerRepositoryId', [$providerRepositoryId]),
                    Query::equal('providerPullRequestId', [$providerPullRequestId]),
                    Query::orderDesc('$createdAt'),
@@ -180,7 +180,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId

                            $latestCommentId = \strval($github->updateComment($owner, $repositoryName, $latestCommentId, $comment->generateComment()));
                        } finally {
-                            Authorization::skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
+                            $authorization->skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
                        }
                    }
                } else {
@@ -191,7 +191,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                    if (!empty($latestCommentId)) {
                        $teamId = $project->getAttribute('teamId', '');

-                        $latestComment = Authorization::skip(fn () => $dbForPlatform->createDocument('vcsComments', new Document([
+                        $latestComment = $authorization->skip(fn () => $dbForPlatform->createDocument('vcsComments', new Document([
                            '$id' => ID::unique(),
                            '$permissions' => [
                                Permission::read(Role::team(ID::custom($teamId))),
@@ -212,7 +212,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                    }
                }
            } elseif (!empty($providerBranch)) {
-                $latestComments = Authorization::skip(fn () => $dbForPlatform->find('vcsComments', [
+                $latestComments = $authorization->skip(fn () => $dbForPlatform->find('vcsComments', [
                    Query::equal('providerRepositoryId', [$providerRepositoryId]),
                    Query::equal('providerBranch', [$providerBranch]),
                    Query::orderDesc('$createdAt'),
@@ -251,7 +251,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId

                            $latestCommentId = \strval($github->updateComment($owner, $repositoryName, $latestCommentId, $comment->generateComment()));
                        } finally {
-                            Authorization::skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
+                            $authorization->skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
                        }
                    }
                }
@@ -294,7 +294,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                $commands[] = $resource->getAttribute('commands', '');
            }

-            $deployment = Authorization::skip(fn () => $dbForProject->createDocument('deployments', new Document([
+            $deployment = $authorization->skip(fn () => $dbForProject->createDocument('deployments', new Document([
                '$id' => $deploymentId,
                '$permissions' => [
                    Permission::read(Role::any()),
@@ -334,7 +334,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                ->setAttribute('latestDeploymentInternalId', $deployment->getSequence())
                ->setAttribute('latestDeploymentCreatedAt', $deployment->getCreatedAt())
                ->setAttribute('latestDeploymentStatus', $deployment->getAttribute('status', ''));
-            Authorization::skip(fn () => $dbForProject->updateDocument($resource->getCollection(), $resource->getId(), $resource));
+            $authorization->skip(fn () => $dbForProject->updateDocument($resource->getCollection(), $resource->getId(), $resource));

            if ($resource->getCollection() === 'sites') {
                $projectId = $project->getId();
@@ -344,7 +344,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                $domain = ID::unique() . "." . $sitesDomain;
                $ruleId = md5($domain);
                $previewRuleId = $ruleId;
-                Authorization::skip(
+                $authorization->skip(
                    fn () => $dbForPlatform->createDocument('rules', new Document([
                        '$id' => $ruleId,
                        'projectId' => $project->getId(),
@@ -377,7 +377,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                    $domain = "branch-{$branchPrefix}-{$resourceProjectHash}.{$sitesDomain}";
                    $ruleId = md5($domain);
                    try {
-                        Authorization::skip(
+                        $authorization->skip(
                            fn () => $dbForPlatform->createDocument('rules', new Document([
                                '$id' => $ruleId,
                                'projectId' => $project->getId(),
@@ -408,7 +408,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                    $domain = "commit-" . substr($providerCommitHash, 0, 16) . ".{$sitesDomain}";
                    $ruleId = md5($domain);
                    try {
-                        Authorization::skip(
+                        $authorization->skip(
                            fn () => $dbForPlatform->createDocument('rules', new Document([
                                '$id' => $ruleId,
                                'projectId' => $project->getId(),
@@ -460,7 +460,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                if ($lockAcquired) {
                    // Wrap in try/finally to ensure lock file gets deleted
                    try {
-                        $rule = Authorization::skip(fn () => $dbForPlatform->getDocument('rules', $previewRuleId));
+                        $rule = $authorization->skip(fn () => $dbForPlatform->getDocument('rules', $previewRuleId));

                        $protocol = System::getEnv('_APP_OPTIONS_FORCE_HTTPS') === 'disabled' ? 'http' : 'https';
                        $previewUrl = !empty($rule) ? ("{$protocol}://" . $rule->getAttribute('domain', '')) : '';
@@ -472,7 +472,7 @@ $createGitDeployments = function (GitHub $github, string $providerInstallationId
                            $github->updateComment($owner, $repositoryName, $latestCommentId, $comment->generateComment());
                        }
                    } finally {
-                        Authorization::skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
+                        $authorization->skip(fn () => $dbForPlatform->deleteDocument('vcsCommentLocks', $latestCommentId));
                    }
                }
            }
@@ -1476,11 +1476,12 @@ App::post('/v1/vcs/github/events')
    ->inject('request')
    ->inject('response')
    ->inject('dbForPlatform')
+    ->inject('authorization')
    ->inject('getProjectDB')
    ->inject('queueForBuilds')
    ->inject('platform')
    ->action(
-        function (GitHub $github, Request $request, Response $response, Database $dbForPlatform, callable $getProjectDB, Build $queueForBuilds, array $platform) use ($createGitDeployments) {
+        function (GitHub $github, Request $request, Response $response, Database $dbForPlatform, Authorization $authorization, callable $getProjectDB, Build $queueForBuilds, array $platform) use ($createGitDeployments) {
            $payload = $request->getRawPayload();
            $signatureRemote = $request->getHeader('x-hub-signature-256', '');
            $signatureLocal = System::getEnv('_APP_VCS_GITHUB_WEBHOOK_SECRET', '');
@@ -1516,14 +1517,14 @@ App::post('/v1/vcs/github/events')
                $github->initializeVariables($providerInstallationId, $privateKey, $githubAppId);

                //find resourceId from relevant resources table
-                $repositories = Authorization::skip(fn () => $dbForPlatform->find('repositories', [
+                $repositories = $authorization->skip(fn () => $dbForPlatform->find('repositories', [
                    Query::equal('providerRepositoryId', [$providerRepositoryId]),
                    Query::limit(100),
                ]));

                // create new deployment only on push (not committed by us) and not when branch is created or deleted
                if ($providerCommitAuthorEmail !== APP_VCS_GITHUB_EMAIL && !$providerBranchCreated && !$providerBranchDeleted) {
-                    $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, $providerBranchUrl, $providerRepositoryName, $providerRepositoryUrl, $providerRepositoryOwner, $providerCommitHash, $providerCommitAuthorName, $providerCommitAuthorUrl, $providerCommitMessage, $providerCommitUrl, '', false, $dbForPlatform, $queueForBuilds, $getProjectDB, $platform);
+                    $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, $providerBranchUrl, $providerRepositoryName, $providerRepositoryUrl, $providerRepositoryOwner, $providerCommitHash, $providerCommitAuthorName, $providerCommitAuthorUrl, $providerCommitMessage, $providerCommitUrl, '', false, $dbForPlatform, $authorization, $queueForBuilds, $getProjectDB, $request, $platform);
                }
            } elseif ($event == $github::EVENT_INSTALLATION) {
                if ($parsedPayload["action"] == "deleted") {
@@ -1536,16 +1537,16 @@ App::post('/v1/vcs/github/events')
                    ]);

                    foreach ($installations as $installation) {
-                        $repositories = Authorization::skip(fn () => $dbForPlatform->find('repositories', [
+                        $repositories = $authorization->skip(fn () => $dbForPlatform->find('repositories', [
                            Query::equal('installationInternalId', [$installation->getSequence()]),
                            Query::limit(1000)
                        ]));

                        foreach ($repositories as $repository) {
-                            Authorization::skip(fn () => $dbForPlatform->deleteDocument('repositories', $repository->getId()));
+                            $authorization->skip(fn () => $dbForPlatform->deleteDocument('repositories', $repository->getId()));
                        }

-                        Authorization::skip(fn () => $dbForPlatform->deleteDocument('installations', $installation->getId()));
+                        $authorization->skip(fn () => $dbForPlatform->deleteDocument('installations', $installation->getId()));
                    }
                }
            } elseif ($event == $github::EVENT_PULL_REQUEST) {
@@ -1574,12 +1575,12 @@ App::post('/v1/vcs/github/events')
                    $providerCommitAuthor = $commitDetails["commitAuthor"] ?? '';
                    $providerCommitMessage = $commitDetails["commitMessage"] ?? '';

-                    $repositories = Authorization::skip(fn () => $dbForPlatform->find('repositories', [
+                    $repositories = $authorization->skip(fn () => $dbForPlatform->find('repositories', [
                        Query::equal('providerRepositoryId', [$providerRepositoryId]),
                        Query::orderDesc('$createdAt')
                    ]));

-                    $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, $providerBranchUrl, $providerRepositoryName, $providerRepositoryUrl, $providerRepositoryOwner, $providerCommitHash, $providerCommitAuthor, $providerCommitAuthorUrl, $providerCommitMessage, $providerCommitUrl, $providerPullRequestId, $external, $dbForPlatform, $queueForBuilds, $getProjectDB, $platform);
+                    $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, $providerBranchUrl, $providerRepositoryName, $providerRepositoryUrl, $providerRepositoryOwner, $providerCommitHash, $providerCommitAuthor, $providerCommitAuthorUrl, $providerCommitMessage, $providerCommitUrl, $providerPullRequestId, $external, $dbForPlatform, $authorization, $queueForBuilds, $getProjectDB, $request, $platform);
                } elseif ($parsedPayload["action"] == "closed") {
                    // Allowed external contributions cleanup

@@ -1588,7 +1589,7 @@ App::post('/v1/vcs/github/events')
                    $external = $parsedPayload["external"] ?? true;

                    if ($external) {
-                        $repositories = Authorization::skip(fn () => $dbForPlatform->find('repositories', [
+                        $repositories = $authorization->skip(fn () => $dbForPlatform->find('repositories', [
                            Query::equal('providerRepositoryId', [$providerRepositoryId]),
                            Query::orderDesc('$createdAt')
                        ]));
@@ -1599,7 +1600,7 @@ App::post('/v1/vcs/github/events')
                            if (\in_array($providerPullRequestId, $providerPullRequestIds)) {
                                $providerPullRequestIds = \array_diff($providerPullRequestIds, [$providerPullRequestId]);
                                $repository = $repository->setAttribute('providerPullRequestIds', $providerPullRequestIds);
-                                $repository = Authorization::skip(fn () => $dbForPlatform->updateDocument('repositories', $repository->getId(), $repository));
+                                $repository = $authorization->skip(fn () => $dbForPlatform->updateDocument('repositories', $repository->getId(), $repository));
                            }
                        }
                    }
@@ -1786,17 +1787,18 @@ App::patch('/v1/vcs/github/installations/:installationId/repositories/:repositor
    ->inject('response')
    ->inject('project')
    ->inject('dbForPlatform')
+    ->inject('authorization')
    ->inject('getProjectDB')
    ->inject('queueForBuilds')
    ->inject('platform')
-    ->action(function (string $installationId, string $repositoryId, string $providerPullRequestId, GitHub $github, Response $response, Document $project, Database $dbForPlatform, callable $getProjectDB, Build $queueForBuilds, array $platform) use ($createGitDeployments) {
+    ->action(function (string $installationId, string $repositoryId, string $providerPullRequestId, GitHub $github, Request $request, Response $response, Document $project, Database $dbForPlatform, Authorization $authorization, callable $getProjectDB, Build $queueForBuilds, array $platform) use ($createGitDeployments) {
        $installation = $dbForPlatform->getDocument('installations', $installationId);

        if ($installation->isEmpty()) {
            throw new Exception(Exception::INSTALLATION_NOT_FOUND);
        }

-        $repository = Authorization::skip(fn () => $dbForPlatform->findOne('repositories', [
+        $repository = $authorization->skip(fn () => $dbForPlatform->findOne('repositories', [
            Query::equal('$id', [$repositoryId]),
            Query::equal('projectInternalId', [$project->getSequence()])
        ]));
@@ -1814,7 +1816,7 @@ App::patch('/v1/vcs/github/installations/:installationId/repositories/:repositor

        // TODO: Delete from array when PR is closed

-        $repository = Authorization::skip(fn () => $dbForPlatform->updateDocument('repositories', $repository->getId(), $repository));
+        $repository = $authorization->skip(fn () => $dbForPlatform->updateDocument('repositories', $repository->getId(), $repository));

        $privateKey = System::getEnv('_APP_VCS_GITHUB_PRIVATE_KEY');
        $githubAppId = System::getEnv('_APP_VCS_GITHUB_APP_ID');
@@ -1846,7 +1848,7 @@ App::patch('/v1/vcs/github/installations/:installationId/repositories/:repositor
        $providerCommitMessage = $pullRequestResponse['title'] ?? '';
        $providerCommitUrl = $pullRequestResponse['html_url'] ?? '';

-        $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, $providerBranchUrl, $providerRepositoryName, $providerRepositoryUrl, $providerRepositoryOwner, $providerCommitHash, $providerCommitAuthor, $providerCommitAuthorUrl, $providerCommitMessage, $providerCommitUrl, $providerPullRequestId, true, $dbForPlatform, $queueForBuilds, $getProjectDB, $platform);
+        $createGitDeployments($github, $providerInstallationId, $repositories, $providerBranch, '', '', '', '', $providerCommitHash, '', '', '', '', $providerPullRequestId, true, $dbForPlatform, $authorization, $queueForBuilds, $getProjectDB, $request, $platform);

        $response->noContent();
    });
@@ -59,7 +59,7 @@ Config::setParam('domainVerification', false);
 Config::setParam('cookieDomain', 'localhost');
 Config::setParam('cookieSamesite', Response::COOKIE_SAMESITE_NONE);

-function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, ?Key $apiKey)
+function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, Authorization $authorization, ?Key $apiKey)
 {
    $host = $request->getHostname() ?? '';
    if (!empty($previewHostname)) {
@@ -67,16 +67,16 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
    }

    // TODO: (@Meldiron) Remove after 1.7.x migration
-    $isMd5 = System::getEnv('_APP_RULES_FORMAT') === 'md5';
-    $rule = Authorization::skip(function () use ($dbForPlatform, $host, $isMd5) {
-        if ($isMd5) {
-            return $dbForPlatform->getDocument('rules', md5($host));
-        }
-
-        return $dbForPlatform->findOne('rules', [
-            Query::equal('domain', [$host]),
-        ]) ?? new Document();
-    });
+    if (System::getEnv('_APP_RULES_FORMAT') === 'md5') {
+        $rule = $authorization->skip(fn () => $dbForPlatform->getDocument('rules', md5($host)));
+    } else {
+        $rule = $authorization->skip(
+            fn () => $dbForPlatform->find('rules', [
+                Query::equal('domain', [$host]),
+                Query::limit(1)
+            ])
+        )[0] ?? new Document();
+    }

    $errorView = __DIR__ . '/../views/general/error.phtml';
    $protocol = System::getEnv('_APP_OPTIONS_FORCE_HTTPS') == 'disabled' ? 'http' : 'https';
@@ -111,7 +111,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
    }

    $projectId = $rule->getAttribute('projectId');
-    $project = Authorization::skip(
+    $project = $authorization->skip(
        fn () => $dbForPlatform->getDocument('projects', $projectId)
    );

@@ -119,7 +119,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
        $accessedAt = $project->getAttribute('accessedAt', 0);
        if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_PROJECT_ACCESS)) > $accessedAt) {
            $project->setAttribute('accessedAt', DateTime::now());
-            Authorization::skip(fn () => $dbForPlatform->updateDocument('projects', $project->getId(), $project));
+            $authorization->skip(fn () => $dbForPlatform->updateDocument('projects', $project->getId(), $project));
        }

        /**
@@ -158,7 +158,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw

        /** @var Document $deployment */
        if (!empty($rule->getAttribute('deploymentId', ''))) {
-            $deployment = Authorization::skip(fn () => $dbForProject->getDocument('deployments', $rule->getAttribute('deploymentId')));
+            $deployment = $authorization->skip(fn () => $dbForProject->getDocument('deployments', $rule->getAttribute('deploymentId')));
        } else {
            // 1.6.x DB schema compatibility
            // TODO: Make sure deploymentId is never empty, and remove this code
@@ -172,15 +172,15 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw

            // Document of site or function
            $resource = $resourceType === 'function' ?
-                Authorization::skip(fn () => $dbForProject->getDocument('functions', $resourceId)) :
-                Authorization::skip(fn () => $dbForProject->getDocument('sites', $resourceId));
+                $authorization->skip(fn () => $dbForProject->getDocument('functions', $resourceId)) :
+                $authorization->skip(fn () => $dbForProject->getDocument('sites', $resourceId));

            // ID of active deployments
            // Attempts to use attribute from both schemas (1.6 and 1.7)
            $activeDeploymentId = $resource->getAttribute('deploymentId', $resource->getAttribute('deployment', ''));

            // Get deployment document, as intended originally
-            $deployment = Authorization::skip(fn () => $dbForProject->getDocument('deployments', $activeDeploymentId));
+            $deployment = $authorization->skip(fn () => $dbForProject->getDocument('deployments', $activeDeploymentId));
        }

        if ($deployment->getAttribute('resourceType', '') === 'functions') {
@@ -199,8 +199,8 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
        }

        $resource = $type === 'function' ?
-            Authorization::skip(fn () => $dbForProject->getDocument('functions', $deployment->getAttribute('resourceId', ''))) :
-            Authorization::skip(fn () => $dbForProject->getDocument('sites', $deployment->getAttribute('resourceId', '')));
+            $authorization->skip(fn () => $dbForProject->getDocument('functions', $deployment->getAttribute('resourceId', ''))) :
+            $authorization->skip(fn () => $dbForProject->getDocument('sites', $deployment->getAttribute('resourceId', '')));

        $isPreview = $type === 'function' ? false : ($rule->getAttribute('trigger', '') !== 'manual');

@@ -242,7 +242,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
                $userExists = false;
                $userId = $payload['userId'] ?? '';
                if (!empty($userId)) {
-                    $user = Authorization::skip(fn () => $dbForPlatform->getDocument('users', $userId));
+                    $user = $authorization->skip(fn () => $dbForPlatform->getDocument('users', $userId));
                    if (!$user->isEmpty() && $user->getAttribute('status', false)) {
                        $userExists = true;
                    }
@@ -255,7 +255,7 @@ function router(App $utopia, Database $dbForPlatform, callable $getProjectDB, Sw
                }

                $membershipExists = false;
-                $project = Authorization::skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
+                $project = $authorization->skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
                if (!$project->isEmpty() && isset($user)) {
                    $teamId = $project->getAttribute('teamId', '');
                    $membership = $user->find('teamId', $teamId, 'memberships');
@@ -862,15 +862,16 @@ App::init()
    ->inject('devKey')
    ->inject('apiKey')
    ->inject('cors')
-    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Document $project, Database $dbForPlatform, callable $getProjectDB, Locale $locale, array $localeCodes, Reader $geodb, StatsUsage $queueForStatsUsage, Event $queueForEvents, Func $queueForFunctions, Executor $executor, array $platform, callable $isResourceBlocked, string $previewHostname, Document $devKey, ?Key $apiKey, Cors $cors) {
+    ->inject('authorization')
+    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Document $project, Database $dbForPlatform, callable $getProjectDB, Locale $locale, array $localeCodes, Reader $geodb, StatsUsage $queueForStatsUsage, Event $queueForEvents, Func $queueForFunctions, Executor $executor, array $platform, callable $isResourceBlocked, string $previewHostname, Document $devKey, ?Key $apiKey, Cors $cors, Authorization $authorization) {
        /*
        * Appwrite Router
        */
        $hostname = $request->getHostname() ?? '';
        $platformHostnames = $platform['hostnames'] ?? [];
        // Only run Router when external domain
-        if (!in_array($hostname, $platformHostnames) || !empty($previewHostname)) {
-            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $apiKey)) {
+        if (!\in_array($hostname, $platformHostnames) || !empty($previewHostname)) {
+            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $authorization, $apiKey)) {
                $utopia->getRoute()?->label('router', true);
            }
        }
@@ -1033,7 +1034,8 @@ App::init()
   ->inject('dbForPlatform')
   ->inject('queueForCertificates')
   ->inject('platform')
-   ->action(function (Request $request, Document $console, Database $dbForPlatform, Certificate $queueForCertificates, array $platform) {
+    ->inject('authorization')
+   ->action(function (Request $request, Document $console, Database $dbForPlatform, Certificate $queueForCertificates, array $platform, Authorization $authorization) {
       $hostname = $request->getHostname();
       $cache = Config::getParam('hostnames', []);
       $platformHostnames = $platform['hostnames'] ?? [];
@@ -1061,64 +1063,64 @@ App::init()
       }

       // 4. Check/create rule (requires DB access)
-       Authorization::disable();
-       try {
-           // TODO: (@Meldiron) Remove after 1.7.x migration
-           $isMd5 = System::getEnv('_APP_RULES_FORMAT') === 'md5';
-           $document = $isMd5
-               ? $dbForPlatform->getDocument('rules', md5($domain->get()))
-               : $dbForPlatform->findOne('rules', [
-                   Query::equal('domain', [$domain->get()]),
+       $authorization->skip(function () use ($dbForPlatform, $domain, $console, $queueForCertificates, &$cache) {
+           try {
+               // TODO: (@Meldiron) Remove after 1.7.x migration
+               $isMd5 = System::getEnv('_APP_RULES_FORMAT') === 'md5';
+               $document = $isMd5
+                   ? $dbForPlatform->getDocument('rules', md5($domain->get()))
+                   : $dbForPlatform->findOne('rules', [
+                       Query::equal('domain', [$domain->get()]),
+                   ]);
+
+               if (!$document->isEmpty()) {
+                   return;
+               }
+
+               // 5. Create new rule
+               $owner = '';
+               $fallback = System::getEnv('_APP_DOMAIN_FUNCTIONS_FALLBACK', '');
+               $funcDomain = System::getEnv('_APP_DOMAIN_FUNCTIONS', '');
+               $siteDomain = System::getEnv('_APP_DOMAIN_SITES', '');
+
+               if (!empty($fallback) && \str_ends_with($domain->get(), $fallback)) {
+                   $funcDomain = $fallback;
+               }
+
+               if (
+                   (!empty($funcDomain) && \str_ends_with($domain->get(), $funcDomain)) ||
+                   (!empty($siteDomain) && \str_ends_with($domain->get(), $siteDomain))
+               ) {
+                   $owner = 'Appwrite';
+               }
+
+               $ruleId = $isMd5 ? md5($domain->get()) : ID::unique();
+               $document = new Document([
+                   '$id' => $ruleId,
+                   'domain' => $domain->get(),
+                   'type' => 'api',
+                   'status' => 'verifying',
+                   'projectId' => $console->getId(),
+                   'projectInternalId' => $console->getSequence(),
+                   'search' => implode(' ', [$ruleId, $domain->get()]),
+                   'owner' => $owner,
+                   'region' => $console->getAttribute('region')
               ]);

-           if (!$document->isEmpty()) {
-               return;
+               $dbForPlatform->createDocument('rules', $document);
+
+               Console::info('Issuing a TLS certificate for the main domain (' . $domain->get() . ') in a few seconds...');
+               $queueForCertificates
+                   ->setDomain($document)
+                   ->setSkipRenewCheck(true)
+                   ->trigger();
+           } catch (Duplicate $e) {
+               Console::info('Certificate already exists');
+           } finally {
+               $cache[$domain->get()] = true;
+               Config::setParam('hostnames', $cache);
           }
-
-           // 5. Create new rule
-           $owner = '';
-           $fallback = System::getEnv('_APP_DOMAIN_FUNCTIONS_FALLBACK', '');
-           $funcDomain = System::getEnv('_APP_DOMAIN_FUNCTIONS', '');
-           $siteDomain = System::getEnv('_APP_DOMAIN_SITES', '');
-
-           if (!empty($fallback) && \str_ends_with($domain->get(), $fallback)) {
-               $funcDomain = $fallback;
-           }
-
-           if (
-               (!empty($funcDomain) && \str_ends_with($domain->get(), $funcDomain)) ||
-               (!empty($siteDomain) && \str_ends_with($domain->get(), $siteDomain))
-           ) {
-               $owner = 'Appwrite';
-           }
-
-           $ruleId = $isMd5 ? md5($domain->get()) : ID::unique();
-           $document = new Document([
-               '$id' => $ruleId,
-               'domain' => $domain->get(),
-               'type' => 'api',
-               'status' => 'verifying',
-               'projectId' => $console->getId(),
-               'projectInternalId' => $console->getSequence(),
-               'search' => implode(' ', [$ruleId, $domain->get()]),
-               'owner' => $owner,
-               'region' => $console->getAttribute('region')
-           ]);
-
-           $dbForPlatform->createDocument('rules', $document);
-
-           Console::info('Issuing a TLS certificate for the main domain (' . $domain->get() . ') in a few seconds...');
-           $queueForCertificates
-               ->setDomain($document)
-               ->setSkipRenewCheck(true)
-               ->trigger();
-       } catch (Duplicate $e) {
-           Console::info('Certificate already exists');
-       } finally {
-           $cache[$domain->get()] = true;
-           Config::setParam('hostnames', $cache);
-           Authorization::reset();
-       }
+       });
   });

 App::options()
@@ -1141,14 +1143,15 @@ App::options()
    ->inject('devKey')
    ->inject('apiKey')
    ->inject('cors')
-    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, Document $project, Document $devKey, ?Key $apiKey, Cors $cors) {
+    ->inject('authorization')
+    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, Document $project, Document $devKey, ?Key $apiKey, Cors $cors, Authorization $authorization) {
        /*
        * Appwrite Router
        */
        $platformHostnames = $platform['hostnames'] ?? [];
        // Only run Router when external domain
        if (!in_array($request->getHostname(), $platformHostnames) || !empty($previewHostname)) {
-            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $apiKey)) {
+            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $authorization, $apiKey)) {
                $utopia->getRoute()?->label('router', true);
            }
        }
@@ -1182,7 +1185,8 @@ App::error()
    ->inject('log')
    ->inject('queueForStatsUsage')
    ->inject('devKey')
-    ->action(function (Throwable $error, App $utopia, Request $request, Response $response, Document $project, ?Logger $logger, Log $log, StatsUsage $queueForStatsUsage) {
+    ->inject('authorization')
+    ->action(function (Throwable $error, App $utopia, Request $request, Response $response, Document $project, ?Logger $logger, Log $log, StatsUsage $queueForStatsUsage, Document $devKey, Authorization $authorization) {
        $version = System::getEnv('_APP_VERSION', 'UNKNOWN');
        $route = $utopia->getRoute();
        $class = \get_class($error);
@@ -1264,7 +1268,7 @@ App::error()
         * If not a publishable error, track usage stats. Publishable errors are >= 500 or those explicitly marked as publish=true in errors.php
         */
        if (!$publish && $project->getId() !== 'console') {
-            if (!DBUser::isPrivileged(Authorization::getRoles())) {
+            if (!DBUser::isPrivileged($authorization->getRoles())) {
                $fileSize = 0;
                $file = $request->getFiles('file');
                if (!empty($file)) {
@@ -1326,7 +1330,87 @@ App::error()
            $log->addExtra('file', $error->getFile());
            $log->addExtra('line', $error->getLine());
            $log->addExtra('trace', $error->getTraceAsString());
-            $log->addExtra('roles', Authorization::getRoles());
+            $log->addExtra('roles', $authorization->getRoles());
+
+            try {
+                /* add queries to log */
+                $queries = $request->getParam('queries', []);
+                if (!empty($queries) && is_array($queries)) {
+                    $parsedQueries = Query::parseQueries($queries);
+
+                    // format query by removing sensitive values
+                    $formatQuery = function (array $queryArray) use (&$formatQuery): ?array {
+                        $method = $queryArray['method'] ?? '';
+                        $values = $queryArray['values'] ?? [];
+                        $attribute = $queryArray['attribute'] ?? '';
+
+                        if (!is_string($method) || $method === '') {
+                            return null;
+                        }
+
+                        // logical queries - recursively format nested queries
+                        if (in_array($method, [Query::TYPE_AND, Query::TYPE_OR], true)) {
+                            $nested = [];
+                            foreach ($values as $nestedArray) {
+                                if (is_array($nestedArray)) {
+                                    $formatted = $formatQuery($nestedArray);
+                                    if ($formatted !== null) {
+                                        $nested[] = $formatted;
+                                    }
+                                }
+                            }
+                            return empty($nested) ? null : [$method => $nested];
+                        }
+
+                        // select - show selected attributes
+                        if ($method === Query::TYPE_SELECT) {
+                            $attributes = array_values(array_filter($values, 'is_string'));
+                            return [$method => $attributes];
+                        }
+
+                        // pagination
+                        if (in_array($method, [
+                            Query::TYPE_LIMIT,
+                            Query::TYPE_OFFSET,
+                            Query::TYPE_CURSOR_AFTER,
+                            Query::TYPE_CURSOR_BEFORE
+                        ], true)) {
+                            return [$method => []];
+                        }
+
+                        // orders
+                        if (in_array($method, [
+                            Query::TYPE_ORDER_DESC,
+                            Query::TYPE_ORDER_ASC,
+                            Query::TYPE_ORDER_RANDOM
+                        ], true)) {
+                            return [$method => !empty($attribute) ? [$attribute] : []];
+                        }
+
+                        // filter
+                        if (!empty($attribute)) {
+                            return [$method => [$attribute]];
+                        }
+
+                        // fallback
+                        return [$method => []];
+                    };
+
+                    $formattedQueries = [];
+                    foreach ($parsedQueries as $query) {
+                        $formatted = $formatQuery($query->toArray());
+                        if ($formatted !== null) {
+                            $formattedQueries[] = $formatted;
+                        }
+                    }
+
+                    if (!empty($formattedQueries)) {
+                        $log->addExtra('queries', $formattedQueries);
+                    }
+                }
+            } catch (Throwable $_) {
+                // don't fail the error handler
+            }

            $action = 'UNKNOWN_NAMESPACE.UNKNOWN.METHOD';
            if (!empty($sdk)) {
@@ -1450,13 +1534,14 @@ App::get('/robots.txt')
    ->inject('platform')
    ->inject('previewHostname')
    ->inject('apiKey')
-    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, ?Key $apiKey) {
+    ->inject('authorization')
+    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, ?Key $apiKey, Authorization $authorization) {
        $platformHostnames = $platform['hostnames'] ?? [];
        if (in_array($request->getHostname(), $platformHostnames) || !empty($previewHostname)) {
            $template = new View(__DIR__ . '/../views/general/robots.phtml');
            $response->text($template->render(false));
        } else {
-            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $apiKey)) {
+            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $authorization, $apiKey)) {
                $utopia->getRoute()?->label('router', true);
            }
        }
@@ -1482,13 +1567,14 @@ App::get('/humans.txt')
    ->inject('platform')
    ->inject('previewHostname')
    ->inject('apiKey')
-    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, ?Key $apiKey) {
+    ->inject('authorization')
+    ->action(function (App $utopia, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Database $dbForPlatform, callable $getProjectDB, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, ?Key $apiKey, Authorization $authorization) {
        $platformHostnames = $platform['hostnames'] ?? [];
        if (in_array($request->getHostname(), $platformHostnames) || !empty($previewHostname)) {
            $template = new View(__DIR__ . '/../views/general/humans.phtml');
            $response->text($template->render(false));
        } else {
-            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $apiKey)) {
+            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $authorization, $apiKey)) {
                $utopia->getRoute()?->label('router', true);
            }
        }
@@ -1572,7 +1658,8 @@ App::get('/v1/ping')
    ->inject('project')
    ->inject('dbForPlatform')
    ->inject('queueForEvents')
-    ->action(function (Response $response, Document $project, Database $dbForPlatform, Event $queueForEvents) {
+    ->inject('authorization')
+    ->action(function (Response $response, Document $project, Database $dbForPlatform, Event $queueForEvents, Authorization $authorization) {
        if ($project->isEmpty() || $project->getId() === 'console') {
            throw new AppwriteException(AppwriteException::PROJECT_NOT_FOUND);
        }
@@ -1584,7 +1671,7 @@ App::get('/v1/ping')
            ->setAttribute('pingCount', $pingCount)
            ->setAttribute('pingedAt', $pingedAt);

-        Authorization::skip(function () use ($dbForPlatform, $project) {
+        $authorization->skip(function () use ($dbForPlatform, $project) {
            $dbForPlatform->updateDocument('projects', $project->getId(), $project);
        });

@@ -200,8 +200,12 @@ App::post('/v1/mock/api-key-unprefixed')
                Permission::update(Role::any()),
                Permission::delete(Role::any()),
            ],
+            // TODO: @hmacr Remove `projectInternalId` and `projectId` column writes before deleting the column.
            'projectInternalId' => $project->getSequence(),
            'projectId' => $project->getId(),
+            'resourceInternalId' => $project->getSequence(),
+            'resourceId' => $project->getId(),
+            'resourceType' => 'projects',
            'name' => 'Outdated key',
            'scopes' => $scopes,
            'expire' => null,
@@ -30,6 +30,7 @@ use Utopia\Database\DateTime;
 use Utopia\Database\Document;
 use Utopia\Database\Helpers\Role;
 use Utopia\Database\Validator\Authorization;
+use Utopia\Database\Validator\Authorization\Input;
 use Utopia\Queue\Publisher;
 use Utopia\System\System;
 use Utopia\Telemetry\Adapter as Telemetry;
@@ -233,7 +234,8 @@ App::init()
    ->inject('mode')
    ->inject('team')
    ->inject('apiKey')
-    ->action(function (App $utopia, Request $request, Database $dbForPlatform, Database $dbForProject, Audit $queueForAudits, Document $project, User $user, ?Document $session, array $servers, string $mode, Document $team, ?Key $apiKey) {
+    ->inject('authorization')
+    ->action(function (App $utopia, Request $request, Database $dbForPlatform, Database $dbForProject, Audit $queueForAudits, Document $project, Document $user, ?Document $session, array $servers, string $mode, Document $team, ?Key $apiKey, Authorization $authorization) {
        $route = $utopia->getRoute();

        /**
@@ -318,7 +320,7 @@ App::init()
            // Handle special app role case
            if ($apiKey->getRole() === User::ROLE_APPS) {
                // Disable authorization checks for API keys
-                Authorization::setDefaultStatus(false);
+                $authorization->setDefaultStatus(false);

                $user = new User([
                    '$id' => '',
@@ -392,14 +394,14 @@ App::init()
                $scopes = \array_merge($scopes, $roles[$role]['scopes']);
            }

-            Authorization::setDefaultStatus(false);  // Cancel security segmentation for admin users.
+            $authorization->setDefaultStatus(false);  // Cancel security segmentation for admin users.
        }

        $scopes = \array_unique($scopes);

-        Authorization::setRole($role);
-        foreach ($user->getRoles() as $authRole) {
-            Authorization::setRole($authRole);
+        $authorization->addRole($role);
+        foreach ($user->getRoles($authorization) as $authRole) {
+            $authorization->addRole($authRole);
        }

        // Step 6: Update project and user last activity
@@ -407,7 +409,7 @@ App::init()
            $accessedAt = $project->getAttribute('accessedAt', 0);
            if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_PROJECT_ACCESS)) > $accessedAt) {
                $project->setAttribute('accessedAt', DateTime::now());
-                Authorization::skip(fn () => $dbForPlatform->updateDocument('projects', $project->getId(), $project));
+                $authorization->skip(fn () => $dbForPlatform->updateDocument('projects', $project->getId(), $project));
            }
        }

@@ -442,7 +444,7 @@ App::init()
            if (
                array_key_exists($namespace, $project->getAttribute('services', []))
                && !$project->getAttribute('services', [])[$namespace]
-                && !(User::isPrivileged(Authorization::getRoles()) || User::isApp(Authorization::getRoles()))
+                && !(User::isPrivileged($authorization->getRoles()) || User::isApp($authorization->getRoles()))
            ) {
                throw new Exception(Exception::GENERAL_SERVICE_DISABLED);
            }
@@ -509,14 +511,15 @@ App::init()
    ->inject('devKey')
    ->inject('telemetry')
    ->inject('platform')
-    ->action(function (App $utopia, Request $request, Response $response, Document $project, Document $user, Publisher $publisher, Publisher $publisherFunctions, Publisher $publisherWebhooks, Event $queueForEvents, Messaging $queueForMessaging, Audit $queueForAudits, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Mail $queueForMails, Migration $queueForMigrations, Database $dbForProject, callable $timelimit, Document $resourceToken, string $mode, ?Key $apiKey, array $plan, Document $devKey, Telemetry $telemetry, array $platform) use ($usageDatabaseListener, $eventDatabaseListener) {
+    ->inject('authorization')
+    ->action(function (App $utopia, Request $request, Response $response, Document $project, Document $user, Publisher $publisher, Publisher $publisherFunctions, Publisher $publisherWebhooks, Event $queueForEvents, Messaging $queueForMessaging, Audit $queueForAudits, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Mail $queueForMails, Migration $queueForMigrations, Database $dbForProject, callable $timelimit, Document $resourceToken, string $mode, ?Key $apiKey, array $plan, Document $devKey, Telemetry $telemetry, array $platform, Authorization $authorization) use ($usageDatabaseListener, $eventDatabaseListener) {

        $route = $utopia->getRoute();

        if (
            array_key_exists('rest', $project->getAttribute('apis', []))
            && !$project->getAttribute('apis', [])['rest']
-            && !(User::isPrivileged(Authorization::getRoles()) || User::isApp(Authorization::getRoles()))
+            && !(User::isPrivileged($authorization->getRoles()) || User::isApp($authorization->getRoles()))
        ) {
            throw new AppwriteException(AppwriteException::GENERAL_API_DISABLED);
        }
@@ -546,7 +549,7 @@ App::init()

        $closestLimit = null;

-        $roles = Authorization::getRoles();
+        $roles = $authorization->getRoles();
        $isPrivilegedUser = User::isPrivileged($roles);
        $isAppUser = User::isApp($roles);

@@ -657,10 +660,10 @@ App::init()
        if ($useCache) {
            $route = $utopia->match($request);
            $isImageTransformation = $route->getPath() === '/v1/storage/buckets/:bucketId/files/:fileId/preview';
-            $isDisabled = isset($plan['imageTransformations']) && $plan['imageTransformations'] === -1 && !User::isPrivileged(Authorization::getRoles());
+            $isDisabled = isset($plan['imageTransformations']) && $plan['imageTransformations'] === -1 && !User::isPrivileged($authorization->getRoles());

            $key = $request->cacheIdentifier();
-            $cacheLog  = Authorization::skip(fn () => $dbForProject->getDocument('cache', $key));
+            $cacheLog  = $authorization->skip(fn () => $dbForProject->getDocument('cache', $key));
            $cache = new Cache(
                new Filesystem(APP_STORAGE_CACHE . DIRECTORY_SEPARATOR . 'app-' . $project->getId())
            );
@@ -677,10 +680,10 @@ App::init()

                if ($type === 'bucket' && (!$isImageTransformation || !$isDisabled)) {
                    $bucketId = $parts[1] ?? null;
-                    $bucket = Authorization::skip(fn () => $dbForProject->getDocument('buckets', $bucketId));
+                    $bucket = $authorization->skip(fn () => $dbForProject->getDocument('buckets', $bucketId));

                    $isToken = !$resourceToken->isEmpty() && $resourceToken->getAttribute('bucketInternalId') === $bucket->getSequence();
-                    $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
+                    $isPrivilegedUser = User::isPrivileged($authorization->getRoles());

                    if ($bucket->isEmpty() || (!$bucket->getAttribute('enabled') && !$isAppUser && !$isPrivilegedUser)) {
                        throw new Exception(Exception::STORAGE_BUCKET_NOT_FOUND);
@@ -691,8 +694,7 @@ App::init()
                    }

                    $fileSecurity = $bucket->getAttribute('fileSecurity', false);
-                    $validator = new Authorization(Database::PERMISSION_READ);
-                    $valid = $validator->isValid($bucket->getRead());
+                    $valid = $authorization->isValid(new Input(Database::PERMISSION_READ, $bucket->getRead()));
                    if (!$fileSecurity && !$valid && !$isToken) {
                        throw new Exception(Exception::USER_UNAUTHORIZED);
                    }
@@ -703,7 +705,7 @@ App::init()
                    if ($fileSecurity && !$valid && !$isToken) {
                        $file = $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId);
                    } else {
-                        $file = Authorization::skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
+                        $file = $authorization->skip(fn () => $dbForProject->getDocument('bucket_' . $bucket->getSequence(), $fileId));
                    }

                    if (!$resourceToken->isEmpty() && $resourceToken->getAttribute('fileInternalId') !== $file->getSequence()) {
@@ -714,11 +716,11 @@ App::init()
                        throw new Exception(Exception::STORAGE_FILE_NOT_FOUND);
                    }
                    //Do not update transformedAt if it's a console user
-                    if (!User::isPrivileged(Authorization::getRoles())) {
+                    if (!User::isPrivileged($authorization->getRoles())) {
                        $transformedAt = $file->getAttribute('transformedAt', '');
                        if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_PROJECT_ACCESS)) > $transformedAt) {
                            $file->setAttribute('transformedAt', DateTime::now());
-                            Authorization::skip(fn () => $dbForProject->updateDocument('bucket_' . $file->getAttribute('bucketInternalId'), $file->getId(), $file));
+                            $authorization->skip(fn () => $dbForProject->updateDocument('bucket_' . $file->getAttribute('bucketInternalId'), $file->getId(), $file));
                        }
                    }
                }
@@ -814,7 +816,9 @@ App::shutdown()
    ->inject('queueForWebhooks')
    ->inject('queueForRealtime')
    ->inject('dbForProject')
-    ->action(function (App $utopia, Request $request, Response $response, Document $project, User $user, Event $queueForEvents, Audit $queueForAudits, StatsUsage $queueForStatsUsage, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, Messaging $queueForMessaging, Func $queueForFunctions, Event $queueForWebhooks, Realtime $queueForRealtime, Database $dbForProject) use ($parseLabel) {
+    ->inject('authorization')
+    ->inject('timelimit')
+    ->action(function (App $utopia, Request $request, Response $response, Document $project, User $user, Event $queueForEvents, Audit $queueForAudits, StatsUsage $queueForStatsUsage, Delete $queueForDeletes, EventDatabase $queueForDatabase, Build $queueForBuilds, Messaging $queueForMessaging, Func $queueForFunctions, Event $queueForWebhooks, Realtime $queueForRealtime, Database $dbForProject, Authorization $authorization, callable $timelimit) use ($parseLabel) {

        $responsePayload = $response->getPayload();

@@ -848,6 +852,41 @@ App::shutdown()
        $route = $utopia->getRoute();
        $requestParams = $route->getParamsValues();

+        /**
+         * Abuse labels
+         */
+        $abuseEnabled = System::getEnv('_APP_OPTIONS_ABUSE', 'enabled') !== 'disabled';
+        $abuseResetCode = $route->getLabel('abuse-reset', []);
+        $abuseResetCode = \is_array($abuseResetCode) ? $abuseResetCode : [$abuseResetCode];
+
+        if ($abuseEnabled && \count($abuseResetCode) > 0 && \in_array($response->getStatusCode(), $abuseResetCode)) {
+            $abuseKeyLabel = $route->getLabel('abuse-key', 'url:{url},ip:{ip}');
+            $abuseKeyLabel = (!is_array($abuseKeyLabel)) ? [$abuseKeyLabel] : $abuseKeyLabel;
+
+            foreach ($abuseKeyLabel as $abuseKey) {
+                $start = $request->getContentRangeStart();
+                $end = $request->getContentRangeEnd();
+                $timeLimit = $timelimit($abuseKey, $route->getLabel('abuse-limit', 0), $route->getLabel('abuse-time', 3600));
+                $timeLimit
+                    ->setParam('{projectId}', $project->getId())
+                    ->setParam('{userId}', $user->getId())
+                    ->setParam('{userAgent}', $request->getUserAgent(''))
+                    ->setParam('{ip}', $request->getIP())
+                    ->setParam('{url}', $request->getHostname() . $route->getPath())
+                    ->setParam('{method}', $request->getMethod())
+                    ->setParam('{chunkId}', (int)($start / ($end + 1 - $start)));
+
+                foreach ($request->getParams() as $key => $value) { // Set request params as potential abuse keys
+                    if (!empty($value)) {
+                        $timeLimit->setParam('{param-' . $key . '}', (\is_array($value)) ? \json_encode($value) : $value);
+                    }
+                }
+
+                $abuse = new Abuse($timeLimit);
+                $abuse->reset();
+            }
+        }
+
        /**
         * Audit labels
         */
@@ -940,11 +979,11 @@ App::shutdown()

                $key = $request->cacheIdentifier();
                $signature = md5($data['payload']);
-                $cacheLog  =  Authorization::skip(fn () => $dbForProject->getDocument('cache', $key));
+                $cacheLog  =  $authorization->skip(fn () => $dbForProject->getDocument('cache', $key));
                $accessedAt = $cacheLog->getAttribute('accessedAt', 0);
                $now = DateTime::now();
                if ($cacheLog->isEmpty()) {
-                    Authorization::skip(fn () => $dbForProject->createDocument('cache', new Document([
+                    $authorization->skip(fn () => $dbForProject->createDocument('cache', new Document([
                        '$id' => $key,
                        'resource' => $resource,
                        'resourceType' => $resourceType,
@@ -954,7 +993,7 @@ App::shutdown()
                    ])));
                } elseif (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_CACHE_UPDATE)) > $accessedAt) {
                    $cacheLog->setAttribute('accessedAt', $now);
-                    Authorization::skip(fn () => $dbForProject->updateDocument('cache', $cacheLog->getId(), $cacheLog));
+                    $authorization->skip(fn () => $dbForProject->updateDocument('cache', $cacheLog->getId(), $cacheLog));
                    // Overwrite the file every APP_CACHE_UPDATE seconds to update the file modified time that is used in the TTL checks in cache->load()
                    $cache->save($key, $data['payload']);
                }
@@ -966,7 +1005,7 @@ App::shutdown()
        }

        if ($project->getId() !== 'console') {
-            if (!User::isPrivileged(Authorization::getRoles())) {
+            if (!User::isPrivileged($authorization->getRoles())) {
                $fileSize = 0;
                $file = $request->getFiles('file');
                if (!empty($file)) {
@@ -36,7 +36,8 @@ App::init()
    ->inject('request')
    ->inject('project')
    ->inject('geodb')
-    ->action(function (App $utopia, Request $request, Document $project, Reader $geodb) {
+    ->inject('authorization')
+    ->action(function (App $utopia, Request $request, Document $project, Reader $geodb, Authorization $authorization) {
        $denylist = System::getEnv('_APP_CONSOLE_COUNTRIES_DENYLIST', '');
        if (!empty($denylist && $project->getId() === 'console')) {
            $countries = explode(',', $denylist);
@@ -49,8 +50,8 @@ App::init()

        $route = $utopia->match($request);

-        $isPrivilegedUser = User::isPrivileged(Authorization::getRoles());
-        $isAppUser = User::isApp(Authorization::getRoles());
+        $isPrivilegedUser = User::isPrivileged($authorization->getRoles());
+        $isAppUser = User::isApp($authorization->getRoles());

        if ($isAppUser || $isPrivilegedUser) { // Skip limits for app and console devs
            return;
@@ -1,43 +0,0 @@
-<?php
-
-use Appwrite\Utopia\Request;
-use Appwrite\Utopia\Response;
-use Utopia\App;
-
-App::init()
-    ->groups(['web'])
-    ->inject('request')
-    ->inject('response')
-    ->action(function (Request $request, Response $response) {
-        $response
-            ->addHeader('X-Frame-Options', 'SAMEORIGIN') // Avoid console and homepage from showing in iframes
-            ->addHeader('X-XSS-Protection', '1; mode=block; report=/v1/xss?url=' . \urlencode($request->getURI()))
-            ->addHeader('X-UA-Compatible', 'IE=Edge') // Deny IE browsers from going into quirks mode
-        ;
-    });
-
-App::get('/')
-    ->alias('auth/*')
-    ->alias('/invite')
-    ->alias('/login')
-    ->alias('/mfa')
-    ->alias('/card/*')
-    ->alias('/recover')
-    ->alias('/register/*')
-    ->groups(['web'])
-    ->label('permission', 'public')
-    ->label('scope', 'home')
-    ->inject('request')
-    ->inject('response')
-    ->action(function (Request $request, Response $response) {
-        $url = parse_url($request->getURI());
-        $target = "/console{$url['path']}";
-        $params = $request->getParams();
-        if (!empty($params)) {
-            $target .= "?" . \http_build_query($params);
-        }
-        if ($url['fragment'] ?? false) {
-            $target .= "#{$url['fragment']}";
-        }
-        $response->redirect($target);
-    });
@@ -12,6 +12,8 @@ use Swoole\Process;
 use Swoole\Table;
 use Swoole\Timer;
 use Utopia\App;
+use Utopia\Audit\Adapter\Database as AdapterDatabase;
+use Utopia\Audit\Adapter\SQL as AuditAdapterSQL;
 use Utopia\Audit\Audit;
 use Utopia\CLI\Console;
 use Utopia\Compression\Compression;
@@ -25,7 +27,6 @@ use Utopia\Database\Helpers\ID;
 use Utopia\Database\Helpers\Permission;
 use Utopia\Database\Helpers\Role;
 use Utopia\Database\Query;
-use Utopia\Database\Validator\Authorization;
 use Utopia\Logger\Log;
 use Utopia\Logger\Log\User;
 use Utopia\Pools\Group;
@@ -259,9 +260,12 @@ $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $reg
        createDatabase($app, 'getLogsDB', 'logs', $collections['logs'], $pools);

        // create appwrite database, `dbForPlatform` is a direct access call.
-        createDatabase($app, 'dbForPlatform', 'appwrite', $collections['console'], $pools, function (Database $dbForPlatform) use ($collections) {
-            if ($dbForPlatform->getCollection(Audit::COLLECTION)->isEmpty()) {
-                $audit = new Audit($dbForPlatform);
+        createDatabase($app, 'dbForPlatform', 'appwrite', $collections['console'], $pools, function (Database $dbForPlatform) use ($collections, $app) {
+            $authorization = $app->getResource('authorization');
+
+            if ($dbForPlatform->getCollection(AuditAdapterSQL::COLLECTION)->isEmpty()) {
+                $adapter = new AdapterDatabase($dbForPlatform);
+                $audit = new Audit($adapter);
                $audit->setup();
            }

@@ -318,9 +322,9 @@ $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $reg
                $dbForPlatform->createCollection('bucket_' . $bucket->getSequence(), $attributes, $indexes);
            }

-            if (Authorization::skip(fn () => $dbForPlatform->getDocument('buckets', 'screenshots')->isEmpty())) {
+            if ($authorization->skip(fn () => $dbForPlatform->getDocument('buckets', 'screenshots')->isEmpty())) {
                Console::info("    └── Creating screenshots bucket...");
-                Authorization::skip(fn () => $dbForPlatform->createDocument('buckets', new Document([
+                $authorization->skip(fn () => $dbForPlatform->createDocument('buckets', new Document([
                    '$id' => ID::custom('screenshots'),
                    '$collection' => ID::custom('buckets'),
                    'name' => 'Screenshots',
@@ -335,7 +339,7 @@ $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $reg
                    'search' => 'buckets Screenshots',
                ])));

-                $bucket = Authorization::skip(fn () => $dbForPlatform->getDocument('buckets', 'screenshots'));
+                $bucket = $authorization->skip(fn () => $dbForPlatform->getDocument('buckets', 'screenshots'));

                Console::info("    └── Creating files collection for screenshots bucket...");
                $files = $collections['buckets']['files'] ?? [];
@@ -363,7 +367,7 @@ $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $reg
                    'orders' => $index['orders'],
                ]), $files['indexes']);

-                Authorization::skip(fn () => $dbForPlatform->createCollection('bucket_' . $bucket->getSequence(), $attributes, $indexes));
+                $authorization->skip(fn () => $dbForPlatform->createCollection('bucket_' . $bucket->getSequence(), $attributes, $indexes));
            }
        });

@@ -389,8 +393,9 @@ $http->on(Constant::EVENT_START, function (Server $http) use ($payloadSize, $reg
                Console::success('[Setup] - Skip: metadata table already exists');
            }

-            if ($dbForProject->getCollection(Audit::COLLECTION)->isEmpty()) {
-                $audit = new Audit($dbForProject);
+            if ($dbForProject->getCollection(AuditAdapterSQL::COLLECTION)->isEmpty()) {
+                $adapter = new AdapterDatabase($dbForProject);
+                $audit = new Audit($adapter);
                $audit->setup();
            }

@@ -454,8 +459,12 @@ $http->on(Constant::EVENT_REQUEST, function (SwooleRequest $swooleRequest, Swool
    App::setResource('pools', fn () => $pools);

    try {
-        Authorization::cleanRoles();
-        Authorization::setRole(Role::any()->toString());
+        $authorization = $app->getResource('authorization');
+
+        $request->setAuthorization($authorization);
+        $response->setAuthorization($authorization);
+        $authorization->cleanRoles();
+        $authorization->addRole(Role::any()->toString());

        $app->run($request, $response);
    } catch (\Throwable $th) {
@@ -497,7 +506,7 @@ $http->on(Constant::EVENT_REQUEST, function (SwooleRequest $swooleRequest, Swool
            $log->addExtra('file', $th->getFile());
            $log->addExtra('line', $th->getLine());
            $log->addExtra('trace', $th->getTraceAsString());
-            $log->addExtra('roles', Authorization::getRoles());
+            $log->addExtra('roles', isset($authorization) ? $authorization->getRoles() : []);

            $sdk = $route->getLabel("sdk", false);

@@ -556,7 +565,7 @@ $http->on(Constant::EVENT_TASK, function () use ($register, $domains) {
    /** @var Utopia\Database\Database $dbForPlatform */
    $dbForPlatform = $app->getResource('dbForPlatform');

-    Timer::tick(DOMAIN_SYNC_TIMER * 1000, function () use ($dbForPlatform, $domains, &$lastSyncUpdate) {
+    Timer::tick(DOMAIN_SYNC_TIMER * 1000, function () use ($dbForPlatform, $domains, &$lastSyncUpdate, $app) {
        try {
            $time = DateTime::now();
            $limit = 1000;
@@ -573,7 +582,8 @@ $http->on(Constant::EVENT_TASK, function () use ($register, $domains) {
                }
                $results = [];
                try {
-                    $results = Authorization::skip(fn () =>  $dbForPlatform->find('rules', $queries));
+                    $authorization = $app->getResource('authorization');
+                    $results = $authorization->skip(fn () =>  $dbForPlatform->find('rules', $queries));
                } catch (Throwable $th) {
                    Console::error($th->getMessage());
                }
@@ -26,6 +26,7 @@ require_once __DIR__ . '/init/database/filters.php';
 require_once __DIR__ . '/init/database/formats.php';
 require_once __DIR__ . '/init/locales.php';
 require_once __DIR__ . '/init/registers.php';
+require_once __DIR__ . '/init/models.php';
 require_once __DIR__ . '/init/resources.php';

 \stream_context_set_default([ // Set global user agent and http settings
@@ -44,7 +44,7 @@ const APP_RESOURCE_TOKEN_ACCESS = 24 * 60 * 60; // 24 hours
 const APP_FILE_ACCESS = 24 * 60 * 60; // 24 hours
 const APP_CACHE_UPDATE = 24 * 60 * 60; // 24 hours
 const APP_CACHE_BUSTER = 4321;
-const APP_VERSION_STABLE = '1.8.0';
+const APP_VERSION_STABLE = '1.8.1';
 const APP_DATABASE_ATTRIBUTE_EMAIL = 'email';
 const APP_DATABASE_ATTRIBUTE_ENUM = 'enum';
 const APP_DATABASE_ATTRIBUTE_IP = 'ip';
@@ -161,6 +161,9 @@ const ACTIVITY_TYPE_GUEST = 'guest';
 const MFA_RECENT_DURATION = 1800; // 30 mins


+// Database name
+const APP_DATABASE = 'appwrite';
+
 // Database Reconnect
 const DATABASE_RECONNECT_SLEEP = 2;
 const DATABASE_RECONNECT_MAX_ATTEMPTS = 10;
@@ -4,7 +4,6 @@ use Appwrite\OpenSSL\OpenSSL;
 use Utopia\Database\Database;
 use Utopia\Database\Document;
 use Utopia\Database\Query;
-use Utopia\Database\Validator\Authorization;
 use Utopia\System\System;

 Database::addFilter(
@@ -70,11 +69,11 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        $attributes = $database->find('attributes', [
+        $attributes = $database->getAuthorization()->skip(fn () => $database->find('attributes', [
            Query::equal('collectionInternalId', [$document->getSequence()]),
            Query::equal('databaseInternalId', [$document->getAttribute('databaseInternalId')]),
            Query::limit($database->getLimitForAttributes()),
-        ]);
+        ]));

        foreach ($attributes as $attribute) {
            $attributeType = $attribute->getAttribute('type');
@@ -105,12 +104,12 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return $database
+        return $database->getAuthorization()->skip(fn () => $database
            ->find('indexes', [
                Query::equal('collectionInternalId', [$document->getSequence()]),
                Query::equal('databaseInternalId', [$document->getAttribute('databaseInternalId')]),
                Query::limit($database->getLimitForIndexes()),
-            ]);
+            ]));
    }
 );

@@ -120,11 +119,11 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return $database
+        return $database->getAuthorization()->skip(fn () => $database
            ->find('platforms', [
                Query::equal('projectInternalId', [$document->getSequence()]),
                Query::limit(APP_LIMIT_SUBQUERY),
-            ]);
+            ]));
    }
 );

@@ -134,11 +133,12 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return $database
+        return $database->getAuthorization()->skip(fn () => $database
            ->find('keys', [
-                Query::equal('projectInternalId', [$document->getSequence()]),
+                Query::equal('resourceType', ['projects']),
+                Query::equal('resourceInternalId', [$document->getSequence()]),
                Query::limit(APP_LIMIT_SUBQUERY),
-            ]);
+            ]));
    }
 );

@@ -148,11 +148,11 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return $database
+        return $database->getAuthorization()->skip(fn () => $database
            ->find('devKeys', [
                Query::equal('projectInternalId', [$document->getSequence()]),
                Query::limit(APP_LIMIT_SUBQUERY),
-            ]);
+            ]));
    }
 );

@@ -162,11 +162,11 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return $database
+        return $database->getAuthorization()->skip(fn () => $database
            ->find('webhooks', [
                Query::equal('projectInternalId', [$document->getSequence()]),
                Query::limit(APP_LIMIT_SUBQUERY),
-            ]);
+            ]));
    }
 );

@@ -176,7 +176,7 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return Authorization::skip(fn () => $database->find('sessions', [
+        return  $database->getAuthorization()->skip(fn () => $database->find('sessions', [
            Query::equal('userInternalId', [$document->getSequence()]),
            Query::limit(APP_LIMIT_SUBQUERY),
        ]));
@@ -189,7 +189,7 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return Authorization::skip(fn () => $database
+        return  $database->getAuthorization()->skip(fn () => $database
            ->find('tokens', [
                Query::equal('userInternalId', [$document->getSequence()]),
                Query::limit(APP_LIMIT_SUBQUERY),
@@ -203,7 +203,7 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return Authorization::skip(fn () => $database
+        return  $database->getAuthorization()->skip(fn () => $database
            ->find('challenges', [
                Query::equal('userInternalId', [$document->getSequence()]),
                Query::limit(APP_LIMIT_SUBQUERY),
@@ -217,7 +217,7 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return Authorization::skip(fn () => $database
+        return $database->getAuthorization()->skip(fn () => $database
            ->find('authenticators', [
                Query::equal('userInternalId', [$document->getSequence()]),
                Query::limit(APP_LIMIT_SUBQUERY),
@@ -231,7 +231,7 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return Authorization::skip(fn () => $database
+        return  $database->getAuthorization()->skip(fn () => $database
            ->find('memberships', [
                Query::equal('userInternalId', [$document->getSequence()]),
                Query::limit(APP_LIMIT_SUBQUERY),
@@ -251,14 +251,14 @@ Database::addFilter(
            default => ['function', 'site']
        };

-        return $database
+        return $database->getAuthorization()->skip(fn () => $database
            ->find('variables', [
                Query::equal('resourceInternalId', [$document->getSequence()]),
                Query::equal('resourceType', $resourceType),
                Query::orderAsc('resourceType'),
                Query::orderAsc(),
                Query::limit(APP_LIMIT_SUBQUERY),
-            ]);
+            ]));
    }
 );

@@ -294,11 +294,11 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return $database
+        return $database->getAuthorization()->skip(fn () => $database
            ->find('variables', [
                Query::equal('resourceType', ['project']),
                Query::limit(APP_LIMIT_SUBQUERY)
-            ]);
+            ]));
    }
 );

@@ -331,7 +331,7 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        return Authorization::skip(fn () => $database
+        return  $database->getAuthorization()->skip(fn () => $database
            ->find('targets', [
                Query::equal('userInternalId', [$document->getSequence()]),
                Query::limit(APP_LIMIT_SUBQUERY)
@@ -345,7 +345,7 @@ Database::addFilter(
        return;
    },
    function (mixed $value, Document $document, Database $database) {
-        $targetIds = Authorization::skip(fn () => \array_map(
+        $targetIds =  $database->getAuthorization()->skip(fn () => \array_map(
            fn ($document) => $document->getAttribute('targetInternalId'),
            $database->find('subscribers', [
                Query::equal('topicInternalId', [$document->getSequence()]),
@@ -0,0 +1,344 @@
+<?php
+
+use Appwrite\Utopia\Response;
+use Appwrite\Utopia\Response\Model\Account;
+use Appwrite\Utopia\Response\Model\AlgoArgon2;
+use Appwrite\Utopia\Response\Model\AlgoBcrypt;
+use Appwrite\Utopia\Response\Model\AlgoMd5;
+use Appwrite\Utopia\Response\Model\AlgoPhpass;
+use Appwrite\Utopia\Response\Model\AlgoScrypt;
+use Appwrite\Utopia\Response\Model\AlgoScryptModified;
+use Appwrite\Utopia\Response\Model\AlgoSha;
+use Appwrite\Utopia\Response\Model\Any;
+use Appwrite\Utopia\Response\Model\Attribute;
+use Appwrite\Utopia\Response\Model\AttributeBoolean;
+use Appwrite\Utopia\Response\Model\AttributeDatetime;
+use Appwrite\Utopia\Response\Model\AttributeEmail;
+use Appwrite\Utopia\Response\Model\AttributeEnum;
+use Appwrite\Utopia\Response\Model\AttributeFloat;
+use Appwrite\Utopia\Response\Model\AttributeInteger;
+use Appwrite\Utopia\Response\Model\AttributeIP;
+use Appwrite\Utopia\Response\Model\AttributeLine;
+use Appwrite\Utopia\Response\Model\AttributeList;
+use Appwrite\Utopia\Response\Model\AttributePoint;
+use Appwrite\Utopia\Response\Model\AttributePolygon;
+use Appwrite\Utopia\Response\Model\AttributeRelationship;
+use Appwrite\Utopia\Response\Model\AttributeString;
+use Appwrite\Utopia\Response\Model\AttributeURL;
+use Appwrite\Utopia\Response\Model\AuthProvider;
+use Appwrite\Utopia\Response\Model\BaseList;
+use Appwrite\Utopia\Response\Model\Branch;
+use Appwrite\Utopia\Response\Model\Bucket;
+use Appwrite\Utopia\Response\Model\Collection;
+use Appwrite\Utopia\Response\Model\Column;
+use Appwrite\Utopia\Response\Model\ColumnBoolean;
+use Appwrite\Utopia\Response\Model\ColumnDatetime;
+use Appwrite\Utopia\Response\Model\ColumnEmail;
+use Appwrite\Utopia\Response\Model\ColumnEnum;
+use Appwrite\Utopia\Response\Model\ColumnFloat;
+use Appwrite\Utopia\Response\Model\ColumnIndex;
+use Appwrite\Utopia\Response\Model\ColumnInteger;
+use Appwrite\Utopia\Response\Model\ColumnIP;
+use Appwrite\Utopia\Response\Model\ColumnLine;
+use Appwrite\Utopia\Response\Model\ColumnList;
+use Appwrite\Utopia\Response\Model\ColumnPoint;
+use Appwrite\Utopia\Response\Model\ColumnPolygon;
+use Appwrite\Utopia\Response\Model\ColumnRelationship;
+use Appwrite\Utopia\Response\Model\ColumnString;
+use Appwrite\Utopia\Response\Model\ColumnURL;
+use Appwrite\Utopia\Response\Model\ConsoleVariables;
+use Appwrite\Utopia\Response\Model\Continent;
+use Appwrite\Utopia\Response\Model\Country;
+use Appwrite\Utopia\Response\Model\Currency;
+use Appwrite\Utopia\Response\Model\Database;
+use Appwrite\Utopia\Response\Model\Deployment;
+use Appwrite\Utopia\Response\Model\DetectionFramework;
+use Appwrite\Utopia\Response\Model\DetectionRuntime;
+use Appwrite\Utopia\Response\Model\DetectionVariable;
+use Appwrite\Utopia\Response\Model\DevKey;
+use Appwrite\Utopia\Response\Model\Document as ModelDocument;
+use Appwrite\Utopia\Response\Model\Error;
+use Appwrite\Utopia\Response\Model\ErrorDev;
+use Appwrite\Utopia\Response\Model\Execution;
+use Appwrite\Utopia\Response\Model\File;
+use Appwrite\Utopia\Response\Model\Framework;
+use Appwrite\Utopia\Response\Model\FrameworkAdapter;
+use Appwrite\Utopia\Response\Model\Func;
+use Appwrite\Utopia\Response\Model\Headers;
+use Appwrite\Utopia\Response\Model\HealthAntivirus;
+use Appwrite\Utopia\Response\Model\HealthCertificate;
+use Appwrite\Utopia\Response\Model\HealthQueue;
+use Appwrite\Utopia\Response\Model\HealthStatus;
+use Appwrite\Utopia\Response\Model\HealthTime;
+use Appwrite\Utopia\Response\Model\HealthVersion;
+use Appwrite\Utopia\Response\Model\Identity;
+use Appwrite\Utopia\Response\Model\Index;
+use Appwrite\Utopia\Response\Model\Installation;
+use Appwrite\Utopia\Response\Model\JWT;
+use Appwrite\Utopia\Response\Model\Key;
+use Appwrite\Utopia\Response\Model\Language;
+use Appwrite\Utopia\Response\Model\Locale;
+use Appwrite\Utopia\Response\Model\LocaleCode;
+use Appwrite\Utopia\Response\Model\Log;
+use Appwrite\Utopia\Response\Model\Membership;
+use Appwrite\Utopia\Response\Model\Message;
+use Appwrite\Utopia\Response\Model\Metric;
+use Appwrite\Utopia\Response\Model\MetricBreakdown;
+use Appwrite\Utopia\Response\Model\MFAChallenge;
+use Appwrite\Utopia\Response\Model\MFAFactors;
+use Appwrite\Utopia\Response\Model\MFARecoveryCodes;
+use Appwrite\Utopia\Response\Model\MFAType;
+use Appwrite\Utopia\Response\Model\Migration;
+use Appwrite\Utopia\Response\Model\MigrationFirebaseProject;
+use Appwrite\Utopia\Response\Model\MigrationReport;
+use Appwrite\Utopia\Response\Model\Mock;
+use Appwrite\Utopia\Response\Model\MockNumber;
+use Appwrite\Utopia\Response\Model\None;
+use Appwrite\Utopia\Response\Model\Phone;
+use Appwrite\Utopia\Response\Model\Platform;
+use Appwrite\Utopia\Response\Model\Preferences;
+use Appwrite\Utopia\Response\Model\Project;
+use Appwrite\Utopia\Response\Model\Provider;
+use Appwrite\Utopia\Response\Model\ProviderRepository;
+use Appwrite\Utopia\Response\Model\ProviderRepositoryFramework;
+use Appwrite\Utopia\Response\Model\ProviderRepositoryRuntime;
+use Appwrite\Utopia\Response\Model\ResourceToken;
+use Appwrite\Utopia\Response\Model\Row;
+use Appwrite\Utopia\Response\Model\Rule;
+use Appwrite\Utopia\Response\Model\Runtime;
+use Appwrite\Utopia\Response\Model\Session;
+use Appwrite\Utopia\Response\Model\Site;
+use Appwrite\Utopia\Response\Model\Specification;
+use Appwrite\Utopia\Response\Model\Subscriber;
+use Appwrite\Utopia\Response\Model\Table;
+use Appwrite\Utopia\Response\Model\Target;
+use Appwrite\Utopia\Response\Model\Team;
+use Appwrite\Utopia\Response\Model\TemplateEmail;
+use Appwrite\Utopia\Response\Model\TemplateFramework;
+use Appwrite\Utopia\Response\Model\TemplateFunction;
+use Appwrite\Utopia\Response\Model\TemplateRuntime;
+use Appwrite\Utopia\Response\Model\TemplateSite;
+use Appwrite\Utopia\Response\Model\TemplateSMS;
+use Appwrite\Utopia\Response\Model\TemplateVariable;
+use Appwrite\Utopia\Response\Model\Token;
+use Appwrite\Utopia\Response\Model\Topic;
+use Appwrite\Utopia\Response\Model\Transaction;
+use Appwrite\Utopia\Response\Model\UsageBuckets;
+use Appwrite\Utopia\Response\Model\UsageCollection;
+use Appwrite\Utopia\Response\Model\UsageDatabase;
+use Appwrite\Utopia\Response\Model\UsageDatabases;
+use Appwrite\Utopia\Response\Model\UsageFunction;
+use Appwrite\Utopia\Response\Model\UsageFunctions;
+use Appwrite\Utopia\Response\Model\UsageProject;
+use Appwrite\Utopia\Response\Model\UsageSite;
+use Appwrite\Utopia\Response\Model\UsageSites;
+use Appwrite\Utopia\Response\Model\UsageStorage;
+use Appwrite\Utopia\Response\Model\UsageTable;
+use Appwrite\Utopia\Response\Model\UsageUsers;
+use Appwrite\Utopia\Response\Model\User;
+use Appwrite\Utopia\Response\Model\Variable;
+use Appwrite\Utopia\Response\Model\VcsContent;
+use Appwrite\Utopia\Response\Model\Webhook;
+
+// General
+Response::setModel(new None());
+Response::setModel(new Any());
+Response::setModel(new Error());
+Response::setModel(new ErrorDev());
+
+// Lists
+Response::setModel(new BaseList('Rows List', Response::MODEL_ROW_LIST, 'rows', Response::MODEL_ROW));
+Response::setModel(new BaseList('Documents List', Response::MODEL_DOCUMENT_LIST, 'documents', Response::MODEL_DOCUMENT));
+Response::setModel(new BaseList('Tables List', Response::MODEL_TABLE_LIST, 'tables', Response::MODEL_TABLE));
+Response::setModel(new BaseList('Collections List', Response::MODEL_COLLECTION_LIST, 'collections', Response::MODEL_COLLECTION));
+Response::setModel(new BaseList('Databases List', Response::MODEL_DATABASE_LIST, 'databases', Response::MODEL_DATABASE));
+Response::setModel(new BaseList('Indexes List', Response::MODEL_INDEX_LIST, 'indexes', Response::MODEL_INDEX));
+Response::setModel(new BaseList('Column Indexes List', Response::MODEL_COLUMN_INDEX_LIST, 'indexes', Response::MODEL_COLUMN_INDEX));
+Response::setModel(new BaseList('Users List', Response::MODEL_USER_LIST, 'users', Response::MODEL_USER));
+Response::setModel(new BaseList('Sessions List', Response::MODEL_SESSION_LIST, 'sessions', Response::MODEL_SESSION));
+Response::setModel(new BaseList('Identities List', Response::MODEL_IDENTITY_LIST, 'identities', Response::MODEL_IDENTITY));
+Response::setModel(new BaseList('Logs List', Response::MODEL_LOG_LIST, 'logs', Response::MODEL_LOG));
+Response::setModel(new BaseList('Files List', Response::MODEL_FILE_LIST, 'files', Response::MODEL_FILE));
+Response::setModel(new BaseList('Buckets List', Response::MODEL_BUCKET_LIST, 'buckets', Response::MODEL_BUCKET));
+Response::setModel(new BaseList('Resource Tokens List', Response::MODEL_RESOURCE_TOKEN_LIST, 'tokens', Response::MODEL_RESOURCE_TOKEN));
+Response::setModel(new BaseList('Teams List', Response::MODEL_TEAM_LIST, 'teams', Response::MODEL_TEAM));
+Response::setModel(new BaseList('Memberships List', Response::MODEL_MEMBERSHIP_LIST, 'memberships', Response::MODEL_MEMBERSHIP));
+Response::setModel(new BaseList('Sites List', Response::MODEL_SITE_LIST, 'sites', Response::MODEL_SITE));
+Response::setModel(new BaseList('Site Templates List', Response::MODEL_TEMPLATE_SITE_LIST, 'templates', Response::MODEL_TEMPLATE_SITE));
+Response::setModel(new BaseList('Functions List', Response::MODEL_FUNCTION_LIST, 'functions', Response::MODEL_FUNCTION));
+Response::setModel(new BaseList('Function Templates List', Response::MODEL_TEMPLATE_FUNCTION_LIST, 'templates', Response::MODEL_TEMPLATE_FUNCTION));
+Response::setModel(new BaseList('Installations List', Response::MODEL_INSTALLATION_LIST, 'installations', Response::MODEL_INSTALLATION));
+Response::setModel(new BaseList('Framework Provider Repositories List', Response::MODEL_PROVIDER_REPOSITORY_FRAMEWORK_LIST, 'frameworkProviderRepositories', Response::MODEL_PROVIDER_REPOSITORY_FRAMEWORK));
+Response::setModel(new BaseList('Runtime Provider Repositories List', Response::MODEL_PROVIDER_REPOSITORY_RUNTIME_LIST, 'runtimeProviderRepositories', Response::MODEL_PROVIDER_REPOSITORY_RUNTIME));
+Response::setModel(new BaseList('Branches List', Response::MODEL_BRANCH_LIST, 'branches', Response::MODEL_BRANCH));
+Response::setModel(new BaseList('Frameworks List', Response::MODEL_FRAMEWORK_LIST, 'frameworks', Response::MODEL_FRAMEWORK));
+Response::setModel(new BaseList('Runtimes List', Response::MODEL_RUNTIME_LIST, 'runtimes', Response::MODEL_RUNTIME));
+Response::setModel(new BaseList('Deployments List', Response::MODEL_DEPLOYMENT_LIST, 'deployments', Response::MODEL_DEPLOYMENT));
+Response::setModel(new BaseList('Executions List', Response::MODEL_EXECUTION_LIST, 'executions', Response::MODEL_EXECUTION));
+Response::setModel(new BaseList('Projects List', Response::MODEL_PROJECT_LIST, 'projects', Response::MODEL_PROJECT, true, false));
+Response::setModel(new BaseList('Webhooks List', Response::MODEL_WEBHOOK_LIST, 'webhooks', Response::MODEL_WEBHOOK, true, false));
+Response::setModel(new BaseList('API Keys List', Response::MODEL_KEY_LIST, 'keys', Response::MODEL_KEY, true, false));
+Response::setModel(new BaseList('Dev Keys List', Response::MODEL_DEV_KEY_LIST, 'devKeys', Response::MODEL_DEV_KEY, true, false));
+Response::setModel(new BaseList('Auth Providers List', Response::MODEL_AUTH_PROVIDER_LIST, 'platforms', Response::MODEL_AUTH_PROVIDER, true, false));
+Response::setModel(new BaseList('Platforms List', Response::MODEL_PLATFORM_LIST, 'platforms', Response::MODEL_PLATFORM, true, false));
+Response::setModel(new BaseList('Countries List', Response::MODEL_COUNTRY_LIST, 'countries', Response::MODEL_COUNTRY));
+Response::setModel(new BaseList('Continents List', Response::MODEL_CONTINENT_LIST, 'continents', Response::MODEL_CONTINENT));
+Response::setModel(new BaseList('Languages List', Response::MODEL_LANGUAGE_LIST, 'languages', Response::MODEL_LANGUAGE));
+Response::setModel(new BaseList('Currencies List', Response::MODEL_CURRENCY_LIST, 'currencies', Response::MODEL_CURRENCY));
+Response::setModel(new BaseList('Phones List', Response::MODEL_PHONE_LIST, 'phones', Response::MODEL_PHONE));
+Response::setModel(new BaseList('Metric List', Response::MODEL_METRIC_LIST, 'metrics', Response::MODEL_METRIC, true, false));
+Response::setModel(new BaseList('Variables List', Response::MODEL_VARIABLE_LIST, 'variables', Response::MODEL_VARIABLE));
+Response::setModel(new BaseList('Status List', Response::MODEL_HEALTH_STATUS_LIST, 'statuses', Response::MODEL_HEALTH_STATUS));
+Response::setModel(new BaseList('Rule List', Response::MODEL_PROXY_RULE_LIST, 'rules', Response::MODEL_PROXY_RULE));
+Response::setModel(new BaseList('Locale codes list', Response::MODEL_LOCALE_CODE_LIST, 'localeCodes', Response::MODEL_LOCALE_CODE));
+Response::setModel(new BaseList('Provider list', Response::MODEL_PROVIDER_LIST, 'providers', Response::MODEL_PROVIDER));
+Response::setModel(new BaseList('Message list', Response::MODEL_MESSAGE_LIST, 'messages', Response::MODEL_MESSAGE));
+Response::setModel(new BaseList('Topic list', Response::MODEL_TOPIC_LIST, 'topics', Response::MODEL_TOPIC));
+Response::setModel(new BaseList('Subscriber list', Response::MODEL_SUBSCRIBER_LIST, 'subscribers', Response::MODEL_SUBSCRIBER));
+Response::setModel(new BaseList('Target list', Response::MODEL_TARGET_LIST, 'targets', Response::MODEL_TARGET));
+Response::setModel(new BaseList('Transaction List', Response::MODEL_TRANSACTION_LIST, 'transactions', Response::MODEL_TRANSACTION));
+Response::setModel(new BaseList('Migrations List', Response::MODEL_MIGRATION_LIST, 'migrations', Response::MODEL_MIGRATION));
+Response::setModel(new BaseList('Migrations Firebase Projects List', Response::MODEL_MIGRATION_FIREBASE_PROJECT_LIST, 'projects', Response::MODEL_MIGRATION_FIREBASE_PROJECT));
+Response::setModel(new BaseList('Specifications List', Response::MODEL_SPECIFICATION_LIST, 'specifications', Response::MODEL_SPECIFICATION));
+Response::setModel(new BaseList('VCS Content List', Response::MODEL_VCS_CONTENT_LIST, 'contents', Response::MODEL_VCS_CONTENT));
+
+// Entities
+Response::setModel(new Database());
+
+// Collection API Models
+Response::setModel(new Collection());
+Response::setModel(new Attribute());
+Response::setModel(new AttributeList());
+Response::setModel(new AttributeString());
+Response::setModel(new AttributeInteger());
+Response::setModel(new AttributeFloat());
+Response::setModel(new AttributeBoolean());
+Response::setModel(new AttributeEmail());
+Response::setModel(new AttributeEnum());
+Response::setModel(new AttributeIP());
+Response::setModel(new AttributeURL());
+Response::setModel(new AttributeDatetime());
+Response::setModel(new AttributeRelationship());
+Response::setModel(new AttributePoint());
+Response::setModel(new AttributeLine());
+Response::setModel(new AttributePolygon());
+
+// Table API Models
+Response::setModel(new Table());
+Response::setModel(new Column());
+Response::setModel(new ColumnList());
+Response::setModel(new ColumnString());
+Response::setModel(new ColumnInteger());
+Response::setModel(new ColumnFloat());
+Response::setModel(new ColumnBoolean());
+Response::setModel(new ColumnEmail());
+Response::setModel(new ColumnEnum());
+Response::setModel(new ColumnIP());
+Response::setModel(new ColumnURL());
+Response::setModel(new ColumnDatetime());
+Response::setModel(new ColumnRelationship());
+Response::setModel(new ColumnPoint());
+Response::setModel(new ColumnLine());
+Response::setModel(new ColumnPolygon());
+Response::setModel(new Index());
+Response::setModel(new ColumnIndex());
+Response::setModel(new Row());
+Response::setModel(new ModelDocument());
+Response::setModel(new Log());
+Response::setModel(new User());
+Response::setModel(new AlgoMd5());
+Response::setModel(new AlgoSha());
+Response::setModel(new AlgoPhpass());
+Response::setModel(new AlgoBcrypt());
+Response::setModel(new AlgoScrypt());
+Response::setModel(new AlgoScryptModified());
+Response::setModel(new AlgoArgon2());
+Response::setModel(new Account());
+Response::setModel(new Preferences());
+Response::setModel(new Session());
+Response::setModel(new Identity());
+Response::setModel(new Token());
+Response::setModel(new JWT());
+Response::setModel(new Locale());
+Response::setModel(new LocaleCode());
+Response::setModel(new File());
+Response::setModel(new Bucket());
+Response::setModel(new ResourceToken());
+Response::setModel(new Team());
+Response::setModel(new Membership());
+Response::setModel(new Site());
+Response::setModel(new TemplateSite());
+Response::setModel(new TemplateFramework());
+Response::setModel(new Func());
+Response::setModel(new TemplateFunction());
+Response::setModel(new TemplateRuntime());
+Response::setModel(new TemplateVariable());
+Response::setModel(new Installation());
+Response::setModel(new ProviderRepository());
+Response::setModel(new ProviderRepositoryFramework());
+Response::setModel(new ProviderRepositoryRuntime());
+Response::setModel(new DetectionFramework());
+Response::setModel(new DetectionRuntime());
+Response::setModel(new DetectionVariable());
+Response::setModel(new VcsContent());
+Response::setModel(new Branch());
+Response::setModel(new Runtime());
+Response::setModel(new Framework());
+Response::setModel(new FrameworkAdapter());
+Response::setModel(new Deployment());
+Response::setModel(new Execution());
+Response::setModel(new Project());
+Response::setModel(new Webhook());
+Response::setModel(new Key());
+Response::setModel(new DevKey());
+Response::setModel(new MockNumber());
+Response::setModel(new AuthProvider());
+Response::setModel(new Platform());
+Response::setModel(new Variable());
+Response::setModel(new Country());
+Response::setModel(new Continent());
+Response::setModel(new Language());
+Response::setModel(new Currency());
+Response::setModel(new Phone());
+Response::setModel(new HealthAntivirus());
+Response::setModel(new HealthQueue());
+Response::setModel(new HealthStatus());
+Response::setModel(new HealthCertificate());
+Response::setModel(new HealthTime());
+Response::setModel(new HealthVersion());
+Response::setModel(new Metric());
+Response::setModel(new MetricBreakdown());
+Response::setModel(new UsageDatabases());
+Response::setModel(new UsageDatabase());
+Response::setModel(new UsageTable());
+Response::setModel(new UsageCollection());
+Response::setModel(new UsageUsers());
+Response::setModel(new UsageStorage());
+Response::setModel(new UsageBuckets());
+Response::setModel(new UsageFunctions());
+Response::setModel(new UsageFunction());
+Response::setModel(new UsageSites());
+Response::setModel(new UsageSite());
+Response::setModel(new UsageProject());
+Response::setModel(new Headers());
+Response::setModel(new Specification());
+Response::setModel(new Rule());
+Response::setModel(new TemplateSMS());
+Response::setModel(new TemplateEmail());
+Response::setModel(new ConsoleVariables());
+Response::setModel(new MFAChallenge());
+Response::setModel(new MFARecoveryCodes());
+Response::setModel(new MFAType());
+Response::setModel(new MFAFactors());
+Response::setModel(new Provider());
+Response::setModel(new Message());
+Response::setModel(new Topic());
+Response::setModel(new Transaction());
+Response::setModel(new Subscriber());
+Response::setModel(new Target());
+Response::setModel(new Migration());
+Response::setModel(new MigrationReport());
+Response::setModel(new MigrationFirebaseProject());
+
+// Tests (keep last)
+Response::setModel(new Mock());
@@ -324,6 +324,12 @@ $register->set('pools', function () {
        Config::setParam('pools-' . $key, $config);
    }

+    $reconnectAttempts = (int) System::getEnv('_APP_CONNECTIONS_RECONNECT_ATTEMPTS', 5);
+    $reconnectSleep = (int) System::getEnv('_APP_CONNECTIONS_RECONNECT_SLEEP', 2);
+
+    $group->setReconnectAttempts($reconnectAttempts);
+    $group->setReconnectSleep($reconnectSleep);
+
    return $group;
 });

@@ -360,6 +366,8 @@ $register->set('smtp', function () {
    $mail->SMTPSecure = System::getEnv('_APP_SMTP_SECURE', '');
    $mail->SMTPAutoTLS = false;
    $mail->CharSet = 'UTF-8';
+    $mail->Timeout = 10; /* Connection timeout */
+    $mail->getSMTPInstance()->Timelimit = 30; /* Timeout for each individual SMTP command (e.g. HELO, EHLO, etc.) */

    $from = \urldecode(System::getEnv('_APP_SYSTEM_EMAIL_NAME', APP_NAME . ' Server'));
    $email = System::getEnv('_APP_SYSTEM_EMAIL_ADDRESS', APP_EMAIL_TEAM);
@@ -4,7 +4,7 @@ use Ahc\Jwt\JWT;
 use Ahc\Jwt\JWTException;
 use Appwrite\Auth\Key;
 use Appwrite\Databases\TransactionState;
-use Appwrite\Event\Audit;
+use Appwrite\Event\Audit as AuditEvent;
 use Appwrite\Event\Build;
 use Appwrite\Event\Certificate;
 use Appwrite\Event\Database as EventDatabase;
@@ -15,6 +15,7 @@ use Appwrite\Event\Mail;
 use Appwrite\Event\Messaging;
 use Appwrite\Event\Migration;
 use Appwrite\Event\Realtime;
+use Appwrite\Event\Screenshot;
 use Appwrite\Event\StatsResources;
 use Appwrite\Event\StatsUsage;
 use Appwrite\Event\Webhook;
@@ -30,6 +31,8 @@ use Appwrite\Utopia\Response;
 use Executor\Executor;
 use Utopia\Abuse\Adapters\TimeLimit\Redis as TimeLimitRedis;
 use Utopia\App;
+use Utopia\Audit\Adapter\Database as AdapterDatabase;
+use Utopia\Audit\Audit;
 use Utopia\Auth\Hashes\Argon2;
 use Utopia\Auth\Hashes\Sha;
 use Utopia\Auth\Proofs\Code;
@@ -127,6 +130,9 @@ App::setResource('queueForMails', function (Publisher $publisher) {
 App::setResource('queueForBuilds', function (Publisher $publisher) {
    return new Build($publisher);
 }, ['publisher']);
+App::setResource('queueForScreenshots', function (Publisher $publisher) {
+    return new Screenshot($publisher);
+}, ['publisher']);
 App::setResource('queueForDatabase', function (Publisher $publisher) {
    return new EventDatabase($publisher);
 }, ['publisher']);
@@ -146,7 +152,7 @@ App::setResource('queueForStatsUsage', function (Publisher $publisher) {
    return new StatsUsage($publisher);
 }, ['publisher']);
 App::setResource('queueForAudits', function (Publisher $publisher) {
-    return new Audit($publisher);
+    return new AuditEvent($publisher);
 }, ['publisher']);
 App::setResource('queueForFunctions', function (Publisher $publisher) {
    return new Func($publisher);
@@ -224,7 +230,7 @@ App::setResource('allowedSchemes', function (Document $project) {
 /**
 * Rule associated with a request origin.
 */
-App::setResource('rule', function (Request $request, Database $dbForPlatform, Document $project) {
+App::setResource('rule', function (Request $request, Database $dbForPlatform, Document $project, Authorization $authorization) {
    $domain = \parse_url($request->getOrigin(), PHP_URL_HOST);
    if (empty($domain)) {
        return new Document();
@@ -232,7 +238,7 @@ App::setResource('rule', function (Request $request, Database $dbForPlatform, Do

    // TODO: (@Meldiron) Remove after 1.7.x migration
    $isMd5 = System::getEnv('_APP_RULES_FORMAT') === 'md5';
-    $rule = Authorization::skip(function () use ($dbForPlatform, $domain, $isMd5) {
+    $rule = $authorization->skip(function () use ($dbForPlatform, $domain, $isMd5) {
        if ($isMd5) {
            return $dbForPlatform->getDocument('rules', md5($domain));
        }
@@ -247,7 +253,7 @@ App::setResource('rule', function (Request $request, Database $dbForPlatform, Do
    }

    return $rule;
-}, ['request', 'dbForPlatform', 'project']);
+}, ['request', 'dbForPlatform', 'project', 'authorization']);

 /**
 * CORS service
@@ -315,7 +321,7 @@ App::setResource('redirectValidator', function (Document $devKey, array $allowed
    return new Redirect($allowedHostnames, $allowedSchemes);
 }, ['devKey', 'allowedHostnames', 'allowedSchemes']);

-App::setResource('user', function (string $mode, Document $project, Document $console, Request $request, Response $response, Database $dbForProject, Database $dbForPlatform, Store $store, Token $proofForToken) {
+App::setResource('user', function (string $mode, Document $project, Document $console, Request $request, Response $response, Database $dbForProject, Database $dbForPlatform, Store $store, Token $proofForToken, $authorization) {
    /**
     * Handles user authentication and session validation.
     *
@@ -335,7 +341,7 @@ App::setResource('user', function (string $mode, Document $project, Document $co
     *    overwriting the previous value.
     */

-    Authorization::setDefaultStatus(true);
+    $authorization->setDefaultStatus(true);

    $store->setKey('a_session_' . $project->getId());

@@ -402,7 +408,7 @@ App::setResource('user', function (string $mode, Document $project, Document $co
    }
    // if (APP_MODE_ADMIN === $mode) {
    //     if ($user->find('teamInternalId', $project->getAttribute('teamInternalId'), 'memberships')) {
-    //         Authorization::setDefaultStatus(false);  // Cancel security segmentation for admin users.
+    //         $authorization->setDefaultStatus(false);  // Cancel security segmentation for admin users.
    //     } else {
    //         $user = new Document([]);
    //     }
@@ -434,9 +440,9 @@ App::setResource('user', function (string $mode, Document $project, Document $co
    $dbForPlatform->setMetadata('user', $user->getId());

    return $user;
-}, ['mode', 'project', 'console', 'request', 'response', 'dbForProject', 'dbForPlatform', 'store', 'proofForToken']);
+}, ['mode', 'project', 'console', 'request', 'response', 'dbForProject', 'dbForPlatform', 'store', 'proofForToken', 'authorization']);

-App::setResource('project', function ($dbForPlatform, $request, $console) {
+App::setResource('project', function ($dbForPlatform, $request, $console, $authorization) {
    /** @var Appwrite\Utopia\Request $request */
    /** @var Utopia\Database\Database $dbForPlatform */
    /** @var Utopia\Database\Document $console */
@@ -447,10 +453,10 @@ App::setResource('project', function ($dbForPlatform, $request, $console) {
        return $console;
    }

-    $project = Authorization::skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
+    $project = $authorization->skip(fn () => $dbForPlatform->getDocument('projects', $projectId));

    return $project;
-}, ['dbForPlatform', 'request', 'console']);
+}, ['dbForPlatform', 'request', 'console', 'authorization']);

 App::setResource('session', function (User $user, Store $store, Token $proofForToken) {
    if ($user->isEmpty()) {
@@ -473,10 +479,6 @@ App::setResource('session', function (User $user, Store $store, Token $proofForT
    return;
 }, ['user', 'store', 'proofForToken']);

-App::setResource('console', function () {
-    return new Document(Config::getParam('console'));
-}, []);
-
 App::setResource('store', function (): Store {
    return new Store();
 });
@@ -507,7 +509,15 @@ App::setResource('proofForCode', function (): Code {
    return $code;
 });

-App::setResource('dbForProject', function (Group $pools, Database $dbForPlatform, Cache $cache, Document $project) {
+App::setResource('console', function () {
+    return new Document(Config::getParam('console'));
+}, []);
+
+App::setResource('authorization', function () {
+    return new Authorization();
+}, []);
+
+App::setResource('dbForProject', function (Group $pools, Database $dbForPlatform, Cache $cache, Document $project, Authorization $authorization) {
    if ($project->isEmpty() || $project->getId() === 'console') {
        return $dbForPlatform;
    }
@@ -523,6 +533,8 @@ App::setResource('dbForProject', function (Group $pools, Database $dbForPlatform
    $database = new Database($adapter, $cache);

    $database
+        ->setDatabase(APP_DATABASE)
+        ->setAuthorization($authorization)
        ->setMetadata('host', \gethostname())
        ->setMetadata('project', $project->getId())
        ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_API)
@@ -544,13 +556,16 @@ App::setResource('dbForProject', function (Group $pools, Database $dbForPlatform
    }

    return $database;
-}, ['pools', 'dbForPlatform', 'cache', 'project']);
+}, ['pools', 'dbForPlatform', 'cache', 'project', 'authorization']);
+
+App::setResource('dbForPlatform', function (Group $pools, Cache $cache, Authorization $authorization) {

-App::setResource('dbForPlatform', function (Group $pools, Cache $cache) {
    $adapter = new DatabasePool($pools->get('console'));
    $database = new Database($adapter, $cache);

    $database
+        ->setDatabase(APP_DATABASE)
+        ->setAuthorization($authorization)
        ->setNamespace('_console')
        ->setMetadata('host', \gethostname())
        ->setMetadata('project', 'console')
@@ -560,12 +575,12 @@ App::setResource('dbForPlatform', function (Group $pools, Cache $cache) {
    $database->setDocumentType('users', User::class);

    return $database;
-}, ['pools', 'cache']);
+}, ['pools', 'cache', 'authorization']);

-App::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache) {
+App::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache, Authorization $authorization) {
    $databases = [];

-    return function (Document $project) use ($pools, $dbForPlatform, $cache, &$databases) {
+    return function (Document $project) use ($pools, $dbForPlatform, $cache, $authorization, &$databases) {
        if ($project->isEmpty() || $project->getId() === 'console') {
            return $dbForPlatform;
        }
@@ -577,13 +592,16 @@ App::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform
            $dsn = new DSN('mysql://' . $project->getAttribute('database'));
        }

-        $configure = (function (Database $database) use ($project, $dsn) {
+        $configure = (function (Database $database) use ($project, $dsn, $authorization) {
            $database
+                ->setDatabase(APP_DATABASE)
+                ->setAuthorization($authorization)
                ->setMetadata('host', \gethostname())
                ->setMetadata('project', $project->getId())
                ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_API)
-                ->setMaxQueryValues(APP_DATABASE_QUERY_MAX_VALUES);
-            $database->setDocumentType('users', User::class);
+                ->setMaxQueryValues(APP_DATABASE_QUERY_MAX_VALUES)
+                ->setDocumentType('users', User::class)
+            ;

            $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));

@@ -613,12 +631,12 @@ App::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform

        return $database;
    };
-}, ['pools', 'dbForPlatform', 'cache']);
+}, ['pools', 'dbForPlatform', 'cache', 'authorization']);

-App::setResource('getLogsDB', function (Group $pools, Cache $cache) {
+App::setResource('getLogsDB', function (Group $pools, Cache $cache, Authorization $authorization) {
    $database = null;

-    return function (?Document $project = null) use ($pools, $cache, &$database) {
+    return function (?Document $project = null) use ($pools, $cache, $authorization, &$database) {
        if ($database !== null && $project !== null && !$project->isEmpty() && $project->getId() !== 'console') {
            $database->setTenant((int) $project->getSequence());
            return $database;
@@ -628,6 +646,8 @@ App::setResource('getLogsDB', function (Group $pools, Cache $cache) {
        $database = new Database($adapter, $cache);

        $database
+            ->setDatabase(APP_DATABASE)
+            ->setAuthorization($authorization)
            ->setSharedTables(true)
            ->setNamespace('logsV1')
            ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_API)
@@ -640,7 +660,12 @@ App::setResource('getLogsDB', function (Group $pools, Cache $cache) {

        return $database;
    };
-}, ['pools', 'cache']);
+}, ['pools', 'cache', 'authorization']);
+
+App::setResource('audit', function ($dbForProject) {
+    $adapter = new AdapterDatabase($dbForProject);
+    return new Audit($adapter);
+}, ['dbForProject']);

 App::setResource('telemetry', fn () => new NoTelemetry());

@@ -834,7 +859,7 @@ App::setResource('promiseAdapter', function ($register) {
    return $register->get('promiseAdapter');
 }, ['register']);

-App::setResource('schema', function ($utopia, $dbForProject) {
+App::setResource('schema', function ($utopia, $dbForProject, $authorization) {

    $complexity = function (int $complexity, array $args) {
        $queries = Query::parseQueries($args['queries'] ?? []);
@@ -844,8 +869,8 @@ App::setResource('schema', function ($utopia, $dbForProject) {
        return $complexity * $limit;
    };

-    $attributes = function (int $limit, int $offset) use ($dbForProject) {
-        $attrs = Authorization::skip(fn () => $dbForProject->find('attributes', [
+    $attributes = function (int $limit, int $offset) use ($dbForProject, $authorization) {
+        $attrs = $authorization->skip(fn () => $dbForProject->find('attributes', [
            Query::limit($limit),
            Query::offset($offset),
        ]));
@@ -919,7 +944,7 @@ App::setResource('schema', function ($utopia, $dbForProject) {
        $urls,
        $params,
    );
-}, ['utopia', 'dbForProject']);
+}, ['utopia', 'dbForProject', 'authorization']);

 App::setResource('gitHub', function (Cache $cache) {
    return new VcsGitHub($cache);
@@ -947,7 +972,7 @@ App::setResource('smsRates', function () {
    return [];
 });

-App::setResource('devKey', function (Request $request, Document $project, array $servers, Database $dbForPlatform) {
+App::setResource('devKey', function (Request $request, Document $project, array $servers, Database $dbForPlatform, Authorization $authorization) {
    $devKey = $request->getHeader('x-appwrite-dev-key', $request->getParam('devKey', ''));

    // Check if given key match project's development keys
@@ -966,7 +991,7 @@ App::setResource('devKey', function (Request $request, Document $project, array
    $accessedAt = $key->getAttribute('accessedAt', 0);
    if (empty($accessedAt) || DatabaseDateTime::formatTz(DatabaseDateTime::addSeconds(new \DateTime(), -APP_KEY_ACCESS)) > $accessedAt) {
        $key->setAttribute('accessedAt', DatabaseDateTime::now());
-        Authorization::skip(fn () => $dbForPlatform->updateDocument('devKeys', $key->getId(), $key));
+        $authorization->skip(fn () => $dbForPlatform->updateDocument('devKeys', $key->getId(), $key));
        $dbForPlatform->purgeCachedDocument('projects', $project->getId());
    }

@@ -983,15 +1008,15 @@ App::setResource('devKey', function (Request $request, Document $project, array

            /** Update access time as well */
            $key->setAttribute('accessedAt', DatabaseDateTime::now());
-            $key = Authorization::skip(fn () => $dbForPlatform->updateDocument('devKeys', $key->getId(), $key));
+            $key = $authorization->skip(fn () => $dbForPlatform->updateDocument('devKeys', $key->getId(), $key));
            $dbForPlatform->purgeCachedDocument('projects', $project->getId());
        }
    }

    return $key;
-}, ['request', 'project', 'servers', 'dbForPlatform']);
+}, ['request', 'project', 'servers', 'dbForPlatform', 'authorization']);

-App::setResource('team', function (Document $project, Database $dbForPlatform, App $utopia, Request $request) {
+App::setResource('team', function (Document $project, Database $dbForPlatform, App $utopia, Request $request, Authorization $authorization) {
    $teamInternalId = '';
    if ($project->getId() !== 'console') {
        $teamInternalId = $project->getAttribute('teamInternalId', '');
@@ -1001,7 +1026,7 @@ App::setResource('team', function (Document $project, Database $dbForPlatform, A
        if (str_starts_with($path, '/v1/projects/:projectId')) {
            $uri = $request->getURI();
            $pid = explode('/', $uri)[3];
-            $p = Authorization::skip(fn () => $dbForPlatform->getDocument('projects', $pid));
+            $p = $authorization->skip(fn () => $dbForPlatform->getDocument('projects', $pid));
            $teamInternalId = $p->getAttribute('teamInternalId', '');
        } elseif ($path === '/v1/projects') {
            $teamId = $request->getParam('teamId', '');
@@ -1010,7 +1035,7 @@ App::setResource('team', function (Document $project, Database $dbForPlatform, A
                return new Document([]);
            }

-            $team = Authorization::skip(fn () => $dbForPlatform->getDocument('teams', $teamId));
+            $team = $authorization->skip(fn () => $dbForPlatform->getDocument('teams', $teamId));
            return $team;
        }
    }
@@ -1019,14 +1044,14 @@ App::setResource('team', function (Document $project, Database $dbForPlatform, A
        return new Document([]);
    }

-    $team = Authorization::skip(function () use ($dbForPlatform, $teamInternalId) {
+    $team = $authorization->skip(function () use ($dbForPlatform, $teamInternalId) {
        return $dbForPlatform->findOne('teams', [
            Query::equal('$sequence', [$teamInternalId]),
        ]);
    });

    return $team;
-}, ['project', 'dbForPlatform', 'utopia', 'request']);
+}, ['project', 'dbForPlatform', 'utopia', 'request', 'authorization']);

 App::setResource(
    'isResourceBlocked',
@@ -1064,7 +1089,7 @@ App::setResource('apiKey', function (Request $request, Document $project): ?Key

 App::setResource('executor', fn () => new Executor());

-App::setResource('resourceToken', function ($project, $dbForProject, $request) {
+App::setResource('resourceToken', function ($project, $dbForProject, $request, Authorization $authorization) {
    $tokenJWT = $request->getParam('token');

    if (!empty($tokenJWT) && !$project->isEmpty()) { // JWT authentication
@@ -1082,7 +1107,7 @@ App::setResource('resourceToken', function ($project, $dbForProject, $request) {
            return new Document([]);
        }

-        $token = Authorization::skip(fn () => $dbForProject->getDocument('resourceTokens', $tokenId));
+        $token = $authorization->skip(fn () => $dbForProject->getDocument('resourceTokens', $tokenId));

        if ($token->isEmpty()) {
            return new Document([]);
@@ -1100,7 +1125,7 @@ App::setResource('resourceToken', function ($project, $dbForProject, $request) {
        }

        return match ($token->getAttribute('resourceType')) {
-            TOKENS_RESOURCE_TYPE_FILES => (function () use ($token, $dbForProject) {
+            TOKENS_RESOURCE_TYPE_FILES => (function () use ($token, $dbForProject, $authorization) {
                $sequences = explode(':', $token->getAttribute('resourceInternalId'));
                $ids = explode(':', $token->getAttribute('resourceId'));

@@ -1111,7 +1136,7 @@ App::setResource('resourceToken', function ($project, $dbForProject, $request) {
                $accessedAt = $token->getAttribute('accessedAt', 0);
                if (empty($accessedAt) || DatabaseDateTime::formatTz(DatabaseDateTime::addSeconds(new \DateTime(), -APP_RESOURCE_TOKEN_ACCESS)) > $accessedAt) {
                    $token->setAttribute('accessedAt', DatabaseDateTime::now());
-                    Authorization::skip(fn () => $dbForProject->updateDocument('resourceTokens', $token->getId(), $token));
+                    $authorization->skip(fn () => $dbForProject->updateDocument('resourceTokens', $token->getId(), $token));
                }

                return new Document([
@@ -1126,8 +1151,8 @@ App::setResource('resourceToken', function ($project, $dbForProject, $request) {
        };
    }
    return new Document([]);
-}, ['project', 'dbForProject', 'request']);
+}, ['project', 'dbForProject', 'request', 'authorization']);

-App::setResource('transactionState', function (Database $dbForProject) {
-    return new TransactionState($dbForProject);
-}, ['dbForProject']);
+App::setResource('transactionState', function (Database $dbForProject, Authorization $authorization) {
+    return new TransactionState($dbForProject, $authorization);
+}, ['dbForProject', 'authorization']);
@@ -32,7 +32,6 @@ use Utopia\Database\Document;
 use Utopia\Database\Helpers\ID;
 use Utopia\Database\Helpers\Role;
 use Utopia\Database\Query;
-use Utopia\Database\Validator\Authorization;
 use Utopia\DSN\DSN;
 use Utopia\Logger\Log;
 use Utopia\Pools\Group;
@@ -67,6 +66,7 @@ if (!function_exists('getConsoleDB')) {
        $adapter = new DatabasePool($pools->get('console'));
        $database = new Database($adapter, getCache());
        $database
+            ->setDatabase(APP_DATABASE)
            ->setNamespace('_console')
            ->setMetadata('host', \gethostname())
            ->setMetadata('project', '_console');
@@ -123,6 +123,7 @@ if (!function_exists('getProjectDB')) {
        }

        $database
+            ->setDatabase(APP_DATABASE)
            ->setMetadata('host', \gethostname())
            ->setMetadata('project', $project->getId());

@@ -309,7 +310,7 @@ $server->onStart(function () use ($stats, $register, $containerId, &$statsDocume
                    'value' => '{}'
                ]);

-                $statsDocument = Authorization::skip(fn () => $database->createDocument('realtime', $document));
+                $statsDocument = $database->getAuthorization()->skip(fn () => $database->createDocument('realtime', $document));
                break;
            } catch (Throwable) {
                Console::warning("Collection not ready. Retrying connection ({$attempts})...");
@@ -339,7 +340,7 @@ $server->onStart(function () use ($stats, $register, $containerId, &$statsDocume
                    ->setAttribute('timestamp', DateTime::now())
                    ->setAttribute('value', json_encode($payload));

-                Authorization::skip(fn () => $database->updateDocument('realtime', $statsDocument->getId(), $statsDocument));
+                $database->getAuthorization()->skip(fn () => $database->updateDocument('realtime', $statsDocument->getId(), $statsDocument));
            } catch (Throwable $th) {
                $logError($th, "updateWorkerDocument");
            }
@@ -370,7 +371,7 @@ $server->onWorkerStart(function (int $workerId) use ($server, $register, $stats,

                $payload = [];

-                $list = Authorization::skip(fn () => $database->find('realtime', [
+                $list = $database->getAuthorization()->skip(fn () => $database->find('realtime', [
                    Query::greaterThan('timestamp', DateTime::addSeconds(new \DateTime(), -15)),
                ]));

@@ -464,13 +465,13 @@ $server->onWorkerStart(function (int $workerId) use ($server, $register, $stats,
                    if ($realtime->hasSubscriber($projectId, 'user:' . $userId)) {
                        $connection = array_key_first(reset($realtime->subscriptions[$projectId]['user:' . $userId]));
                        $consoleDatabase = getConsoleDB();
-                        $project = Authorization::skip(fn () => $consoleDatabase->getDocument('projects', $projectId));
+                        $project = $consoleDatabase->getAuthorization()->skip(fn () => $consoleDatabase->getDocument('projects', $projectId));
                        $database = getProjectDB($project);

                        /** @var Appwrite\Utopia\Database\Documents\User $user */
                        $user = $database->getDocument('users', $userId);

-                        $roles = $user->getRoles();
+                        $roles = $user->getRoles($database->getAuthorization());
                        $channels = $realtime->connections[$connection]['channels'];

                        $realtime->unsubscribe($connection);
@@ -526,6 +527,7 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
    try {
        /** @var Document $project */
        $project = $app->getResource('project');
+        $authorization = $app->getResource('authorization');

        /*
         *  Project Check
@@ -537,7 +539,7 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
        if (
            array_key_exists('realtime', $project->getAttribute('apis', []))
            && !$project->getAttribute('apis', [])['realtime']
-            && !(User::isPrivileged(Authorization::getRoles()) || User::isApp(Authorization::getRoles()))
+            && !(User::isPrivileged($authorization->getRoles()) || User::isApp($authorization->getRoles()))
        ) {
            throw new AppwriteException(AppwriteException::GENERAL_API_DISABLED);
        }
@@ -573,7 +575,7 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
            throw new Exception(Exception::REALTIME_POLICY_VIOLATION, $originValidator->getDescription());
        }

-        $roles = $user->getRoles();
+        $roles = $user->getRoles($authorization);

        $channels = Realtime::convertChannels($request->getQuery('channels', []), $user->getId());

@@ -586,6 +588,8 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,

        $realtime->subscribe($project->getId(), $connection, $roles, $channels);

+        $realtime->connections[$connection]['authorization'] = $authorization;
+
        $user = empty($user->getId()) ? null : $response->output($user, Response::MODEL_ACCOUNT);

        $server->send([$connection], json_encode([
@@ -614,6 +618,7 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
            $code = 500;
        }

+
        $message = $th->getMessage();

        // sanitize 0 && 5xx errors
@@ -643,12 +648,19 @@ $server->onOpen(function (int $connection, SwooleRequest $request) use ($server,
 $server->onMessage(function (int $connection, string $message) use ($server, $register, $realtime, $containerId) {
    try {
        $response = new Response(new SwooleResponse());
-        $projectId = $realtime->connections[$connection]['projectId'];
+        $projectId = $realtime->connections[$connection]['projectId'] ?? null;
+
+        // Get authorization from connection (stored during onOpen)
+        $authorization = $realtime->connections[$connection]['authorization'] ?? null;
+
        $database = getConsoleDB();
+        $database->setAuthorization($authorization);

        if ($projectId !== 'console') {
-            $project = Authorization::skip(fn () => $database->getDocument('projects', $projectId));
+            $project = $authorization->skip(fn () => $database->getDocument('projects', $projectId));
+
            $database = getProjectDB($project);
+            $database->setAuthorization($authorization);
        } else {
            $project = null;
        }
@@ -712,10 +724,19 @@ $server->onMessage(function (int $connection, string $message) use ($server, $re
                    throw new Exception(Exception::REALTIME_MESSAGE_FORMAT_INVALID, 'Session is not valid.');
                }

-                $roles = $user->getRoles();
+                $roles = $user->getRoles($database->getAuthorization());
                $channels = Realtime::convertChannels(array_flip($realtime->connections[$connection]['channels']), $user->getId());
+
+                // Preserve authorization before subscribe overwrites the connection array
+                $authorization = $realtime->connections[$connection]['authorization'] ?? null;
+
                $realtime->subscribe($realtime->connections[$connection]['projectId'], $connection, $roles, $channels);

+                // Restore authorization after subscribe
+                if ($authorization !== null) {
+                    $realtime->connections[$connection]['authorization'] = $authorization;
+                }
+
                $user = $response->output($user, Response::MODEL_ACCOUNT);
                $server->send([$connection], json_encode([
                    'type' => 'response',
@@ -11,6 +11,7 @@ $httpsPort = $this->getParam('httpsPort', '');
 $version = $this->getParam('version', '');
 $organization = $this->getParam('organization', '');
 $image = $this->getParam('image', '');
+$enableAssistant = $this->getParam('enableAssistant', false);
 ?>services:
  traefik:
    image: traefik:2.11
@@ -179,7 +180,7 @@ $image = $this->getParam('image', '');
  appwrite-console:
    <<: *x-logging
    container_name: appwrite-console
-    image: <?php echo $organization; ?>/console:7.4.7
+    image: <?php echo $organization; ?>/console:7.5.7
    restart: unless-stopped
    networks:
      - appwrite
@@ -848,6 +849,7 @@ $image = $this->getParam('image', '');
      - _APP_DB_USER
      - _APP_DB_PASS

+<?php if ($enableAssistant): ?>
  appwrite-assistant:
    image: appwrite/assistant:0.8.4
    container_name: appwrite-assistant
@@ -857,6 +859,7 @@ $image = $this->getParam('image', '');
      - appwrite
    environment:
      - _APP_ASSISTANT_OPENAI_API_KEY
+<?php endif; ?>

  appwrite-browser:
    image: appwrite/browser:0.3.2
@@ -14,6 +14,7 @@ use Appwrite\Event\Mail;
 use Appwrite\Event\Messaging;
 use Appwrite\Event\Migration;
 use Appwrite\Event\Realtime;
+use Appwrite\Event\Screenshot;
 use Appwrite\Event\StatsUsage;
 use Appwrite\Event\Webhook;
 use Appwrite\Platform\Appwrite;
@@ -21,6 +22,8 @@ use Appwrite\Utopia\Database\Documents\User;
 use Executor\Executor;
 use Swoole\Runtime;
 use Utopia\Abuse\Adapters\TimeLimit\Redis as TimeLimitRedis;
+use Utopia\Audit\Adapter\Database as AdapterDatabase;
+use Utopia\Audit\Audit as UtopiaAudit;
 use Utopia\Cache\Adapter\Pool as CachePool;
 use Utopia\Cache\Adapter\Sharding;
 use Utopia\Cache\Cache;
@@ -46,19 +49,31 @@ use Utopia\System\System;
 use Utopia\Telemetry\Adapter as Telemetry;
 use Utopia\Telemetry\Adapter\None as NoTelemetry;

-Authorization::disable();
 Runtime::enableCoroutine();

 Server::setResource('register', fn () => $register);

-Server::setResource('dbForPlatform', function (Cache $cache, Registry $register) {
+Server::setResource('authorization', function () {
+    $authorization = new Authorization();
+    $authorization->disable();
+    return  $authorization;
+}, []);
+
+Server::setResource('dbForPlatform', function (Cache $cache, Registry $register, Authorization $authorization) {
    $pools = $register->get('pools');
    $adapter = new DatabasePool($pools->get('console'));
    $dbForPlatform = new Database($adapter, $cache);
-    $dbForPlatform->setNamespace('_console');
-    $dbForPlatform->setDocumentType('users', User::class);
+
+    $dbForPlatform
+        ->setDatabase(APP_DATABASE)
+        ->setAuthorization($authorization)
+        ->setNamespace('_console')
+        ->setDocumentType('users', User::class)
+    ;
+
+
    return $dbForPlatform;
-}, ['cache', 'register']);
+}, ['cache', 'register', 'authorization']);

 Server::setResource('project', function (Message $message, Database $dbForPlatform) {
    $payload = $message->getPayload() ?? [];
@@ -71,7 +86,7 @@ Server::setResource('project', function (Message $message, Database $dbForPlatfo
    return $dbForPlatform->getDocument('projects', $project->getId());
 }, ['message', 'dbForPlatform']);

-Server::setResource('dbForProject', function (Cache $cache, Registry $register, Message $message, Document $project, Database $dbForPlatform) {
+Server::setResource('dbForProject', function (Cache $cache, Registry $register, Message $message, Document $project, Database $dbForPlatform, Authorization $authorization) {
    if ($project->isEmpty() || $project->getId() === 'console') {
        return $dbForPlatform;
    }
@@ -103,15 +118,18 @@ Server::setResource('dbForProject', function (Cache $cache, Registry $register,
            ->setNamespace('_' . $project->getSequence());
    }

-    $database->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER);
+    $database
+        ->setDatabase(APP_DATABASE)
+        ->setAuthorization($authorization)
+        ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER);

    return $database;
-}, ['cache', 'register', 'message', 'project', 'dbForPlatform']);
+}, ['cache', 'register', 'message', 'project', 'dbForPlatform', 'authorization']);

-Server::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache) {
+Server::setResource('getProjectDB', function (Group $pools, Database $dbForPlatform, $cache, Authorization $authorization) {
    $databases = []; // TODO: @Meldiron This should probably be responsibility of utopia-php/pools

-    return function (Document $project) use ($pools, $dbForPlatform, $cache, &$databases): Database {
+    return function (Document $project) use ($pools, $dbForPlatform, $cache, $authorization, &$databases): Database {
        if ($project->isEmpty() || $project->getId() === 'console') {
            return $dbForPlatform;
        }
@@ -125,7 +143,7 @@ Server::setResource('getProjectDB', function (Group $pools, Database $dbForPlatf

        if (isset($databases[$dsn->getHost()])) {
            $database = $databases[$dsn->getHost()];
-
+            $database->setAuthorization($authorization);
            $sharedTables = \explode(',', System::getEnv('_APP_DATABASE_SHARED_TABLES', ''));

            if (\in_array($dsn->getHost(), $sharedTables)) {
@@ -162,15 +180,18 @@ Server::setResource('getProjectDB', function (Group $pools, Database $dbForPlatf
                ->setNamespace('_' . $project->getSequence());
        }

-        $database->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER);
+        $database
+            ->setDatabase(APP_DATABASE)
+            ->setAuthorization($authorization)
+            ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER);

        return $database;
    };
-}, ['pools', 'dbForPlatform', 'cache']);
+}, ['pools', 'dbForPlatform', 'cache', 'authorization']);

-Server::setResource('getLogsDB', function (Group $pools, Cache $cache) {
+Server::setResource('getLogsDB', function (Group $pools, Cache $cache, Authorization $authorization) {
    $database = null;
-    return function (?Document $project = null) use ($pools, $cache, $database) {
+    return function (?Document $project = null) use ($pools, $cache, $database, $authorization) {
        if ($database !== null && $project !== null && !$project->isEmpty() && $project->getId() !== 'console') {
            $database->setTenant((int)$project->getSequence());
            return $database;
@@ -180,6 +201,8 @@ Server::setResource('getLogsDB', function (Group $pools, Cache $cache) {
        $database = new Database($adapter, $cache);

        $database
+            ->setDatabase(APP_DATABASE)
+            ->setAuthorization($authorization)
            ->setSharedTables(true)
            ->setNamespace('logsV1')
            ->setTimeout(APP_DATABASE_TIMEOUT_MILLISECONDS_WORKER)
@@ -192,7 +215,7 @@ Server::setResource('getLogsDB', function (Group $pools, Cache $cache) {

        return $database;
    };
-}, ['pools', 'cache']);
+}, ['pools', 'cache', 'authorization']);

 Server::setResource('abuseRetention', function () {
    return time() - (int) System::getEnv('_APP_MAINTENANCE_RETENTION_ABUSE', 86400); // 1 day
@@ -305,6 +328,10 @@ Server::setResource('queueForBuilds', function (Publisher $publisher) {
    return new Build($publisher);
 }, ['publisher']);

+Server::setResource('queueForScreenshots', function (Publisher $publisher) {
+    return new Screenshot($publisher);
+}, ['publisher']);
+
 Server::setResource('queueForDeletes', function (Publisher $publisher) {
    return new Delete($publisher);
 }, ['publisher']);
@@ -450,6 +477,19 @@ Server::setResource('logError', function (Registry $register, Document $project)

 Server::setResource('executor', fn () => new Executor());

+Server::setResource('getAudit', function (Database $dbForPlatform, callable $getProjectDB) {
+    return function (Document $project) use ($dbForPlatform, $getProjectDB) {
+        if ($project->isEmpty() || $project->getId() === 'console') {
+            $adapter = new AdapterDatabase($dbForPlatform);
+            return new UtopiaAudit($adapter);
+        }
+
+        $dbForProject = $getProjectDB($project);
+        $adapter = new AdapterDatabase($dbForProject);
+        return new UtopiaAudit($adapter);
+    };
+}, ['dbForPlatform', 'getProjectDB']);
+
 $pools = $register->get('pools');
 $platform = new Appwrite();
 $args = $platform->getEnv('argv');
@@ -494,7 +534,8 @@ $worker
    ->inject('log')
    ->inject('pools')
    ->inject('project')
-    ->action(function (Throwable $error, ?Logger $logger, Log $log, Group $pools, Document $project) use ($worker, $queueName) {
+    ->inject('authorization')
+    ->action(function (Throwable $error, ?Logger $logger, Log $log, Group $pools, Document $project, Authorization $authorization) use ($worker, $queueName) {
        $version = System::getEnv('_APP_VERSION', 'UNKNOWN');

        if ($logger) {
@@ -510,7 +551,7 @@ $worker
            $log->addExtra('file', $error->getFile());
            $log->addExtra('line', $error->getLine());
            $log->addExtra('trace', $error->getTraceAsString());
-            $log->addExtra('roles', Authorization::getRoles());
+            $log->addExtra('roles', $authorization->getRoles());

            $isProduction = System::getEnv('_APP_ENV', 'development') === 'production';
            $log->setEnvironment($isProduction ? Log::ENVIRONMENT_PRODUCTION : Log::ENVIRONMENT_STAGING);
@@ -529,9 +570,4 @@ $worker
        Console::error('[Error] Line: ' . $error->getLine());
    });

-$worker->workerStart()
-    ->action(function () use ($workerName) {
-        Console::info("Worker $workerName  started");
-    });
-
 $worker->start();
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php doctor $@
+exec php /usr/src/code/app/cli.php doctor "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php install $@
+exec php /usr/src/code/app/cli.php install "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php interval $@
+exec php /usr/src/code/app/cli.php interval "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php maintenance $@
+exec php /usr/src/code/app/cli.php maintenance "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php migrate $@
+exec php /usr/src/code/app/cli.php migrate "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php queue-count --type=failed $@
+exec php /usr/src/code/app/cli.php queue-count --type=failed "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php queue-count --type=processing $@
+exec php /usr/src/code/app/cli.php queue-count --type=processing "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php queue-count --type=success $@
+exec php /usr/src/code/app/cli.php queue-count --type=success "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php queue-retry $@
+exec php /usr/src/code/app/cli.php queue-retry "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/realtime.php $@
+exec php /usr/src/code/app/realtime.php "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php schedule-executions $@
+exec php /usr/src/code/app/cli.php schedule-executions "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php schedule-functions $@
+exec php /usr/src/code/app/cli.php schedule-functions "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php schedule-messages $@
+exec php /usr/src/code/app/cli.php schedule-messages "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php screenshot $@
+exec php /usr/src/code/app/cli.php screenshot "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php sdks $@
+exec php /usr/src/code/app/cli.php sdks "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php specs $@
+exec php /usr/src/code/app/cli.php specs "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php ssl $@
+exec php /usr/src/code/app/cli.php ssl "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php stats-resources $@
+exec php /usr/src/code/app/cli.php stats-resources "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-/usr/src/code/vendor/bin/phpunit --configuration /usr/src/code/phpunit.xml $@
+exec /usr/src/code/vendor/bin/phpunit --configuration /usr/src/code/phpunit.xml "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php upgrade $@
+exec php /usr/src/code/app/cli.php upgrade "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/cli.php vars $@
+exec php /usr/src/code/app/cli.php vars "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php audits $@
+exec php /usr/src/code/app/worker.php audits "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php builds $@
+exec php /usr/src/code/app/worker.php builds "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php certificates $@
+exec php /usr/src/code/app/worker.php certificates "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php databases $@
+exec php /usr/src/code/app/worker.php databases "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php deletes $@
+exec php /usr/src/code/app/worker.php deletes "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php functions $@
+exec php /usr/src/code/app/worker.php functions "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php mails $@
+exec php /usr/src/code/app/worker.php mails "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php messaging $@
+exec php /usr/src/code/app/worker.php messaging "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php migrations $@
+exec php /usr/src/code/app/worker.php migrations "$@"
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+exec php /usr/src/code/app/worker.php screenshots "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php stats-resources $@
+exec php /usr/src/code/app/worker.php stats-resources "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php stats-usage $@
+exec php /usr/src/code/app/worker.php stats-usage "$@"
@@ -1,3 +1,3 @@
 #!/bin/sh

-php /usr/src/code/app/worker.php webhooks $@
+exec php /usr/src/code/app/worker.php webhooks "$@"
@@ -47,32 +47,32 @@
        "appwrite/php-clamav": "2.0.*",
        "utopia-php/abuse": "1.*",
        "utopia-php/analytics": "0.10.*",
-        "utopia-php/audit": "1.*",
+        "utopia-php/audit": "2.*",
        "utopia-php/auth": "0.5.*",
        "utopia-php/cache": "0.13.*",
        "utopia-php/cli": "0.15.*",
-        "utopia-php/config": "1.*.*",
-        "utopia-php/database": "3.*",
+        "utopia-php/config": "1.*",
+        "utopia-php/database": "4.*",
        "utopia-php/detector": "0.2.*",
-        "utopia-php/domains": "0.9.*",
+        "utopia-php/domains": "0.11.*",
        "utopia-php/emails": "0.6.*",
-        "utopia-php/dns": "1.4.*",
+        "utopia-php/dns": "1.5.*",
        "utopia-php/dsn": "0.2.1",
        "utopia-php/framework": "0.33.*",
-        "utopia-php/fetch": "0.4.*",
+        "utopia-php/fetch": "0.5.*",
        "utopia-php/image": "0.8.*",
        "utopia-php/locale": "0.8.*",
        "utopia-php/logger": "0.6.*",
        "utopia-php/messaging": "0.20.*",
-        "utopia-php/migration": "1.3.*",
+        "utopia-php/migration": "1.*",
        "utopia-php/orchestration": "0.9.*",
        "utopia-php/platform": "0.7.*",
        "utopia-php/pools": "0.8.*",
        "utopia-php/preloader": "0.2.*",
-        "utopia-php/queue": "0.11.*",
+        "utopia-php/queue": "0.15.*",
        "utopia-php/registry": "0.5.*",
        "utopia-php/storage": "0.18.*",
-        "utopia-php/swoole": "0.8.*",
+        "utopia-php/swoole": "1.*",
        "utopia-php/system": "0.9.*",
        "utopia-php/telemetry": "0.1.*",
        "utopia-php/vcs": "0.13.*",
@@ -230,7 +230,7 @@ services:
  appwrite-console:
    <<: *x-logging
    container_name: appwrite-console
-    image: appwrite/console:7.4.11
+    image: appwrite/console:7.5.7
    restart: unless-stopped
    networks:
      - appwrite
@@ -466,14 +466,12 @@ services:
      - appwrite-functions:/storage/functions:rw
      - appwrite-sites:/storage/sites:rw
      - appwrite-builds:/storage/builds:rw
-      - appwrite-uploads:/storage/uploads:rw
      - ./app:/usr/src/code/app
      - ./src:/usr/src/code/src
    depends_on:
      - redis
      - mariadb
    environment:
-      - _APP_BROWSER_HOST
      - _APP_ENV
      - _APP_WORKER_PER_CORE
      - _APP_OPENSSL_KEY_V1
@@ -529,6 +527,65 @@ services:
    extra_hosts:
      - "host.docker.internal:host-gateway"

+  appwrite-worker-screenshots:
+    entrypoint: worker-screenshots
+    <<: *x-logging
+    container_name: appwrite-worker-screenshots
+    image: appwrite-dev
+    networks:
+      - appwrite
+    volumes:
+      - appwrite-uploads:/storage/uploads:rw
+      - ./app:/usr/src/code/app
+      - ./src:/usr/src/code/src
+    depends_on:
+      - redis
+      - mariadb
+    environment:
+      # Specific
+      - _APP_BROWSER_HOST
+      # Basic
+      - _APP_ENV
+      - _APP_WORKER_PER_CORE
+      - _APP_LOGGING_CONFIG
+      # Database
+      - _APP_OPENSSL_KEY_V1
+      - _APP_REDIS_HOST
+      - _APP_REDIS_PORT
+      - _APP_REDIS_USER
+      - _APP_REDIS_PASS
+      - _APP_DB_HOST
+      - _APP_DB_PORT
+      - _APP_DB_SCHEMA
+      - _APP_DB_USER
+      - _APP_DB_PASS
+      - _APP_DATABASE_SHARED_TABLES
+      # Storage
+      - _APP_STORAGE_DEVICE
+      - _APP_STORAGE_S3_ACCESS_KEY
+      - _APP_STORAGE_S3_SECRET
+      - _APP_STORAGE_S3_REGION
+      - _APP_STORAGE_S3_BUCKET
+      - _APP_STORAGE_S3_ENDPOINT
+      - _APP_STORAGE_DO_SPACES_ACCESS_KEY
+      - _APP_STORAGE_DO_SPACES_SECRET
+      - _APP_STORAGE_DO_SPACES_REGION
+      - _APP_STORAGE_DO_SPACES_BUCKET
+      - _APP_STORAGE_BACKBLAZE_ACCESS_KEY
+      - _APP_STORAGE_BACKBLAZE_SECRET
+      - _APP_STORAGE_BACKBLAZE_REGION
+      - _APP_STORAGE_BACKBLAZE_BUCKET
+      - _APP_STORAGE_LINODE_ACCESS_KEY
+      - _APP_STORAGE_LINODE_SECRET
+      - _APP_STORAGE_LINODE_REGION
+      - _APP_STORAGE_LINODE_BUCKET
+      - _APP_STORAGE_WASABI_ACCESS_KEY
+      - _APP_STORAGE_WASABI_SECRET
+      - _APP_STORAGE_WASABI_REGION
+      - _APP_STORAGE_WASABI_BUCKET
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+
  appwrite-worker-certificates:
    entrypoint: worker-certificates
    <<: *x-logging
@@ -1067,27 +1124,6 @@ services:
      - OPR_EXECUTOR_STORAGE_WASABI_REGION=$_APP_STORAGE_WASABI_REGION
      - OPR_EXECUTOR_STORAGE_WASABI_BUCKET=$_APP_STORAGE_WASABI_BUCKET

-  openruntimes-proxy:
-    container_name: openruntimes-proxy
-    hostname: proxy
-    <<: *x-logging
-    stop_signal: SIGINT
-    image: openruntimes/proxy:0.5.5
-    networks:
-      - appwrite
-      - runtimes
-    environment:
-      - OPR_PROXY_WORKER_PER_CORE=$_APP_WORKER_PER_CORE
-      - OPR_PROXY_ENV=$_APP_ENV
-      - OPR_PROXY_EXECUTOR_SECRET=$_APP_EXECUTOR_SECRET
-      - OPR_PROXY_SECRET=$_APP_EXECUTOR_SECRET
-      - OPR_PROXY_LOGGING_CONFIG=$_APP_LOGGING_CONFIG
-      - OPR_PROXY_ALGORITHM=random
-      - OPR_PROXY_EXECUTORS=exc1
-      - OPR_PROXY_HEALTHCHECK_INTERVAL=10000
-      - OPR_PROXY_MAX_TIMEOUT=600
-      - OPR_PROXY_HEALTHCHECK=enabled
-
  mariadb:
    image: mariadb:10.11 # fix issues when upgrading using: mysql_upgrade -u root -p
    container_name: appwrite-mariadb
@@ -1,5 +1,9 @@
 # Change Log

+## 20.1.1
+
+* Fix boolean parameter not handled correctly in Client requests
+
 ## 20.1.0

 * Added ability to create columns and indexes synchronously while creating a table
@@ -1,5 +1,9 @@
 # Change Log

+## 20.3.3
+
+* Fix boolean parameter not handled correctly in Client requests
+
 ## 20.3.2

 * Fix OAuth2 browser infinite redirect issue
@@ -20,10 +20,12 @@ use Utopia\Database\Validator\Authorization;
 class TransactionState
 {
    private Database $dbForProject;
-
-    public function __construct(Database $dbForProject)
+    private Authorization $authorization;
+    /** @var Authorization $authorization */
+    public function __construct(Database $dbForProject, Authorization $authorization)
    {
        $this->dbForProject = $dbForProject;
+        $this->authorization = $authorization;
    }


@@ -342,12 +344,12 @@ class TransactionState
     */
    private function getTransactionState(string $transactionId): array
    {
-        $transaction = Authorization::skip(fn () => $this->dbForProject->getDocument('transactions', $transactionId));
+        $transaction = $this->authorization->skip(fn () => $this->dbForProject->getDocument('transactions', $transactionId));
        if ($transaction->isEmpty() || $transaction->getAttribute('status') !== 'pending') {
            return [];
        }

-        $operations = Authorization::skip(fn () => $this->dbForProject->find('transactionLogs', [
+        $operations = $this->authorization->skip(fn () => $this->dbForProject->find('transactionLogs', [
            Query::equal('transactionInternalId', [$transaction->getSequence()]),
            Query::orderAsc(),
            Query::limit(PHP_INT_MAX)
@@ -3,8 +3,10 @@
 namespace Appwrite\Deletes;

 use Appwrite\Extend\Exception;
+use Utopia\Console;
 use Utopia\Database\Database;
 use Utopia\Database\Document;
+use Utopia\Database\Exception\Limit as LimitException;
 use Utopia\Database\Query;

 class Targets
@@ -42,12 +44,17 @@ class Targets
                        MESSAGE_TYPE_PUSH => 'pushTotal',
                        default => throw new Exception('Invalid target provider type'),
                    };
-                    $database->decreaseDocumentAttribute(
-                        'topics',
-                        $topicId,
-                        $totalAttribute,
-                        min: 0
-                    );
+
+                    try {
+                        $database->decreaseDocumentAttribute(
+                            'topics',
+                            $topicId,
+                            $totalAttribute,
+                            min: 0
+                        );
+                    } catch (LimitException $e) {
+                        Console::error("Delete subscribers decreaseDocumentAttribute (topicId={$topicId}): {$e->getMessage()}");
+                    }
                }
            }
        );
@@ -39,6 +39,9 @@ class Event
    public const BUILDS_QUEUE_NAME = 'v1-builds';
    public const BUILDS_CLASS_NAME = 'BuildsV1';

+    public const SCREENSHOTS_QUEUE_NAME = 'v1-screenshots';
+    public const SCREENSHOTS_CLASS_NAME = 'ScreenshotsV1';
+
    public const MESSAGING_QUEUE_NAME = 'v1-messaging';
    public const MESSAGING_CLASS_NAME = 'MessagingV1';

@@ -0,0 +1,50 @@
+<?php
+
+namespace Appwrite\Event;
+
+use Utopia\Config\Config;
+use Utopia\Queue\Publisher;
+use Utopia\System\System;
+
+class Screenshot extends Event
+{
+    protected string $deploymentId = '';
+
+    public function __construct(protected Publisher $publisher)
+    {
+        parent::__construct($publisher);
+
+        $this
+            ->setQueue(System::getEnv('_APP_SCREENSHOTS_QUEUE_NAME', Event::SCREENSHOTS_QUEUE_NAME))
+            ->setClass(System::getEnv('_APP_SCREENSHOTS_CLASS_NAME', Event::SCREENSHOTS_CLASS_NAME));
+    }
+
+    public function setDeploymentId(string $deploymentId): self
+    {
+        $this->deploymentId = $deploymentId;
+
+        return $this;
+    }
+
+    protected function preparePayload(): array
+    {
+        $platform = $this->platform;
+        if (empty($platform)) {
+            $platform = Config::getParam('platform', []);
+        }
+
+        return [
+            'project' => $this->project,
+            'deploymentId' => $this->deploymentId,
+            'platform' => $platform,
+        ];
+    }
+
+    public function reset(): self
+    {
+        $this->deploymentId = '';
+        parent::reset();
+
+        return $this;
+    }
+}
@@ -90,6 +90,7 @@ abstract class Migration
        '1.7.3' => 'V22',
        '1.7.4' => 'V22',
        '1.8.0' => 'V23',
+        '1.8.1' => 'V23',
    ];

    /**
@@ -99,8 +100,6 @@ abstract class Migration

    public function __construct()
    {
-        Authorization::disable();
-        Authorization::setDefaultStatus(false);

        $this->collections = Config::getParam('collections', []);

@@ -128,6 +127,7 @@ abstract class Migration
        Document $project,
        Database $dbForProject,
        Database $dbForPlatform,
+        Authorization $authorization,
        ?callable $getProjectDB = null
    ): self {
        $this->project = $project;
@@ -135,6 +135,9 @@ abstract class Migration
        $this->dbForPlatform = $dbForPlatform;
        $this->getProjectDB = $getProjectDB;

+        $authorization->disable();
+        $authorization->setDefaultStatus(false);
+
        return $this;
    }

@@ -139,7 +139,7 @@ class V23 extends Migration
                    } catch (\Throwable $th) {
                        Console::warning("Failed to  migration error attribute size in collection {$id}: {$th->getMessage()}");
                    }
-
+                    break;
                case 'buckets':
                    try {
                        $this->createAttributeFromCollection($this->dbForProject, $id, 'transformations');
@@ -148,6 +148,21 @@ class V23 extends Migration
                    }
                    $this->dbForProject->purgeCachedCollection($id);
                    break;
+                case 'users':
+                    $attributes = [
+                        'emailCanonical',
+                        'emailIsFree',
+                        'emailIsDisposable',
+                        'emailIsCorporate',
+                        'emailIsCanonical',
+                    ];
+                    try {
+                        $this->createAttributesFromCollection($this->dbForProject, $id, $attributes);
+                    } catch (\Throwable $th) {
+                        Console::warning('Failed to create attributes "' . \implode(', ', $attributes) . "\" in collection {$id}: {$th->getMessage()}");
+                    }
+                    $this->dbForProject->purgeCachedCollection($id);
+                    break;
                default:
                    break;
            }
@@ -0,0 +1,67 @@
+# Modules AGENTS.md
+
+> Before reading this file, also read Appwrite's base [AGENTS.md](../../../AGENTS.md).
+
+Modules are the building blocks of the Appwrite platform. They are responsible for handling specific tasks, defining background workers, and providing API endpoints. Each module should have its own directory within the `src/Appwrite/Platform/Modules` directory.
+
+Generally-speaking, each service is its own module, but there are some exceptions. The goal is to always put related code that achieves a specific goal under one roof.
+
+## Structure and Naming Conventions
+
+When adding a module, always add a new directory under `src/Appwrite/Platform/Modules`. The directory name should be PascalCase, and if possible, use only one word. For example, `User`, `Database`, `Storage`, etc. Avoid using shorthands, unless they are standardized, such as `DB`, `JWT`, or `SMTP`.
+
+A module consists of:
+
+- `Module.php` - Simple register class registering all module's services (from `Services` directory)
+- `Workers` directory - Contains behavior for module-specific workers
+- `Tasks` directory - Contains behavior for module-specific CLI tasks
+- `Http` directory - Contains HTTP endpoints for the module
+- `Services` directory - Contains register classes for all relevant types of services
+
+Inside module, the `Services` directory can contain:
+
+- `Http.php` - Register HTTP endpoints and hooks from `Http` directory
+- `Workers.php` - Register workers from `Workers` directory
+- `Tasks.php` - Register CLI tasks from `Tasks` directory
+
+> After implementing a module, make sure to register it in `src/Appwrite/Platform/Appwrite.php`.
+
+### HTTP directory structure
+
+Inside module's `Http` directory, there are multiple rules to follow:
+
+1. Directly in `Http` directory, there should only be directories for services (and hooks, check point number 2). If a module is a single service, it's okay to only have one directory, with the same name as the service, for example `src/Appwrite/Platform/Modules/Account/Http/Account`. An example with multiple services is `src/Appwrite/Platform/Modules/Databases/Http/Databases` and `src/Appwrite/Platform/Modules/Databases/Http/TablesDB`.
+
+2. Hooks should live in `Hooks` directory, under `Init`, `Shutdown`, or `Error` directories, inside `Http` directory. For example, an init hook to prevent unauthorized access might live in `src/Appwrite/Platform/Modules/Functions/Http/Hooks/Init/Authentication.php`.
+
+3. Inside `Http` directories for services, file names can only be `Get.php`, `Update.php`, `Create.php`, `Delete.php` or `XList.php`. We call it `XList`, because `List` is a reserved keyword and PHP would not like that. Never use any other words! Let's say you want a method to be `blockUser`, tempting to add `Users/Block.php`, instead, think of the resource and property it affects. Better naming would be `Users/Status/Update.php` (update user's status). Doing so also nicely reflects in the HTTP endpoint, `PATCH /v1/users/:userId/status`.
+
+4. It's allowed to nest directories in `Http` service directories. For example, if you want to create a new deployment for a function based on a template, an endpoint might live in `src/Appwrite/Platform/Modules/Functions/Http/Functions/Deployments/Template/Create.php`. In this example, notice functions and deployments are resources, and template is property - both resources and properties can be nested, and have separate directories.
+
+### Sample module directory structure
+
+```bash
+src/Appwrite/Platform/Modules/Functions
+├── Module.php
+├── Workers
+│   └── Builds.php
+├── Tasks
+│   └── Block.php
+├── Http
+│   └── Functions
+│       ├── Create.php
+│       ├── XList.php
+│       ├── Update.php
+│       ├── Delete.php
+│       ├── Get.php
+│       └── Deployments
+│           ├── XList.php
+│           ├── Delete.php
+│           ├── Get.php
+│           └── Template
+│               └── Create.php
+└── Services
+    ├── Http.php
+    ├── Workers.php
+    └── Tasks.php
+```
@@ -2,8 +2,6 @@

 namespace Appwrite\Platform;

-use Appwrite\Utopia\Request;
-use Appwrite\Utopia\Response;
 use Swoole\Coroutine as Co;
 use Utopia\CLI\Console;
 use Utopia\Database\Database;
@@ -161,50 +159,4 @@ class Action extends UtopiaAction
                Console::info("[" . DateTime::now() . "] " . $method . ' ' . $type . ' ' . $project->getSequence() . ' ' . $project->getId() . ' ' . $collectionId . ' ' . $log);
        }
    }
-
-
-    /**
-     * Helper to apply (request) select queries to response model.
-     *
-     * This prevents default values of rules to be presnet for not-selected attributes
-     *
-     * @param Request $request
-     * @param Document $document
-     * @return void
-     */
-    public function applySelectQueries(Request $request, Response $response, string $model): void
-    {
-        $queries = $request->getParam('queries', []);
-
-        $queries = Query::parseQueries($queries);
-        $selectQueries = Query::groupByType($queries)['selections'] ?? [];
-
-        // No select queries means no filtering out
-        if (empty($selectQueries)) {
-            return;
-        }
-
-        $attributes = [];
-        foreach ($selectQueries as $query) {
-            foreach ($query->getValues() as $attribute) {
-                $attributes[] = $attribute;
-            }
-        }
-
-        // found a wildcard, return!
-        if (\in_array('*', $attributes)) {
-            return;
-        }
-
-        $responseModel = $response->getModel($model);
-        foreach ($responseModel->getRules() as $ruleName => $rule) {
-            if (\str_starts_with($ruleName, '$')) {
-                continue;
-            }
-
-            if (!\in_array($ruleName, $attributes)) {
-                $responseModel->removeRule($ruleName);
-            }
-        }
-    }
 }
@@ -3,6 +3,7 @@
 namespace Appwrite\Platform;

 use Appwrite\Platform\Modules\Account;
+use Appwrite\Platform\Modules\Avatars;
 use Appwrite\Platform\Modules\Console;
 use Appwrite\Platform\Modules\Core;
 use Appwrite\Platform\Modules\Databases;
@@ -10,6 +11,7 @@ use Appwrite\Platform\Modules\Functions;
 use Appwrite\Platform\Modules\Projects;
 use Appwrite\Platform\Modules\Proxy;
 use Appwrite\Platform\Modules\Sites;
+use Appwrite\Platform\Modules\Storage;
 use Appwrite\Platform\Modules\Tokens;
 use Utopia\Platform\Platform;

@@ -19,6 +21,7 @@ class Appwrite extends Platform
    {
        parent::__construct(new Core());
        $this->addModule(new Account\Module());
+        $this->addModule(new Avatars\Module());
        $this->addModule(new Databases\Module());
        $this->addModule(new Projects\Module());
        $this->addModule(new Functions\Module());
@@ -26,5 +29,6 @@ class Appwrite extends Platform
        $this->addModule(new Console\Module());
        $this->addModule(new Proxy\Module());
        $this->addModule(new Tokens\Module());
+        $this->addModule(new Storage\Module());
    }
 }
--- a/Show More
+++ b/Show More