[pull] main from appwrite:main

app/config/locale/translations/ar.json

@@ -16,8 +16,8 @@
     "emails.magicSession.signature": "فريق {{project}}",
     "emails.recovery.subject": "تغيير كلمة السر",
     "emails.recovery.hello": "أهلا {{user}}،",
-    "emails.recovery.body": "برجاء اتباع الراط التالي لتغيير كلمة السر الخاصة بـ{{project}}",
-    "emails.recovery.footer": "لولم تطلب تغيير كلمة السر، يمكنك تجاهل هذه الرسالة",
+    "emails.recovery.body": "برجاء اتباع الرابط التالي لتغيير كلمة السر الخاصة بـ{{project}}",
+    "emails.recovery.footer": "لو لم تطلب تغيير كلمة السر، يمكنك تجاهل هذه الرسالة",
     "emails.recovery.thanks": "شكرا،",
     "emails.recovery.buttonText": "إعادة تعيين كلمة المرور",
     "emails.recovery.signature": "فريق {{project}}",

app/config/oAuthProviders.php

@@ -478,6 +478,17 @@
         'mock' => false,
         'class' => 'Appwrite\\Auth\\OAuth2\\Twitch',
     ],
+    'webflow' => [
+        'name' => 'Webflow',
+        'developers' => 'https://developers.webflow.com/data/reference/oauth-app',
+        'icon' => 'icon-webflow',
+        'enabled' => true,
+        'sandbox' => false,
+        'form' => false,
+        'beta' => false,
+        'mock' => false,
+        'class' => 'Appwrite\\Auth\\OAuth2\\Webflow',
+    ],
     'wordpress' => [
         'name' => 'WordPress',
         'developers' => 'https://developer.wordpress.com/docs/oauth2/',

app/controllers/api/account.php

@@ -600,22 +600,21 @@
     ->inject('response')
     ->inject('targetUser')
     ->inject('locale')
-    ->inject('store')
-    ->inject('proofForToken')
-    ->action(function (Response $response, User $targetUser, Locale $locale, Store $store, ProofsToken $proofForToken) {
+    ->inject('session')
+    ->action(function (Response $response, User $targetUser, Locale $locale, ?Document $current) {
 
 
         $sessions = $targetUser->getAttribute('sessions', []);
         // While impersonating, the request runs on the impersonator's session, so none of
         // the target's sessions is marked current.
-        $current = $targetUser->sessionVerify($store->getProperty('secret', ''), $proofForToken);
+        $currentId = $current?->getId();
 
         foreach ($sessions as $key => $session) {
             /** @var Document $session */
             $countryName = $locale->getText('countries.' . strtolower($session->getAttribute('countryCode')), $locale->getText('locale.country.unknown'));
 
             $session->setAttribute('countryName', $countryName);
-            $session->setAttribute('current', ($current == $session->getId()) ? true : false);
+            $session->setAttribute('current', $currentId === $session->getId());
             $session->setAttribute('secret', $session->getAttribute('secret', ''));
 
             $sessions[$key] = $session;
@@ -734,16 +733,15 @@
     ->inject('response')
     ->inject('targetUser')
     ->inject('locale')
-    ->inject('store')
-    ->inject('proofForToken')
-    ->action(function (?string $sessionId, Response $response, User $targetUser, Locale $locale, Store $store, ProofsToken $proofForToken) {
+    ->inject('session')
+    ->action(function (?string $sessionId, Response $response, User $targetUser, Locale $locale, ?Document $current) {
 
         $sessions = $targetUser->getAttribute('sessions', []);
         // While impersonating, the request runs on the impersonator's session, so 'current'
         // resolves against none of the target's sessions and this throws. That matches the
         // sessions list, which marks none of them current for the same reason.
         $sessionId = ($sessionId === 'current')
-            ? $targetUser->sessionVerify($store->getProperty('secret', ''), $proofForToken)
+            ? $current?->getId()
             : $sessionId;
 
         foreach ($sessions as $session) {
@@ -752,7 +750,7 @@
                 $countryName = $locale->getText('countries.' . strtolower($session->getAttribute('countryCode')), $locale->getText('locale.country.unknown'));
 
                 $session
-                    ->setAttribute('current', ($proofForToken->verify($store->getProperty('secret', ''), $session->getAttribute('secret'))))
+                    ->setAttribute('current', $session->getId() === $current?->getId())
                     ->setAttribute('countryName', $countryName)
                     ->setAttribute('secret', $session->getAttribute('secret', ''))
                 ;
@@ -801,11 +799,12 @@
     ->inject('proofForToken')
     ->inject('domainVerification')
     ->inject('cookieDomain')
-    ->action(function (?string $sessionId, ?\DateTime $requestTimestamp, Request $request, Response $response, User $user, Database $dbForProject, Locale $locale, Event $queueForEvents, DeletePublisher $publisherForDeletes, Store $store, ProofsToken $proofForToken, bool $domainVerification, ?string $cookieDomain) {
+    ->inject('session')
+    ->action(function (?string $sessionId, ?\DateTime $requestTimestamp, Request $request, Response $response, User $user, Database $dbForProject, Locale $locale, Event $queueForEvents, DeletePublisher $publisherForDeletes, Store $store, ProofsToken $proofForToken, bool $domainVerification, ?string $cookieDomain, ?Document $current) {
 
         $protocol = $request->getProtocol();
         $sessionId = ($sessionId === 'current')
-            ? $user->sessionVerify($store->getProperty('secret', ''), $proofForToken)
+            ? $current?->getId()
             : $sessionId;
 
         $sessions = $user->getAttribute('sessions', []);
@@ -820,13 +819,13 @@
 
             unset($sessions[$key]);
 
-            $session->setAttribute('current', false);
+            $session->setAttribute('current', $session->getId() === $current?->getId());
 
-            if ($proofForToken->verify($store->getProperty('secret', ''), $session->getAttribute('secret'))) { // If current session delete the cookies too
-                $session
-                    ->setAttribute('current', true)
-                    ->setAttribute('countryName', $locale->getText('countries.' . strtolower($session->getAttribute('countryCode')), $locale->getText('locale.country.unknown')));
+            if ($session->getAttribute('current')) {
+                $session->setAttribute('countryName', $locale->getText('countries.' . strtolower($session->getAttribute('countryCode')), $locale->getText('locale.country.unknown')));
+            }
 
+            if ($proofForToken->verify($store->getProperty('secret', ''), $session->getAttribute('secret'))) { // If current session delete the cookies too
                 if (!$domainVerification) {
                     $response->addHeader('X-Fallback-Cookies', \json_encode([]));
                 }
@@ -885,12 +884,11 @@
     ->inject('dbForProject')
     ->inject('project')
     ->inject('queueForEvents')
-    ->inject('store')
-    ->inject('proofForToken')
-    ->action(function (?string $sessionId, Response $response, User $user, Database $dbForProject, Document $project, Event $queueForEvents, Store $store, ProofsToken $proofForToken) {
+    ->inject('session')
+    ->action(function (?string $sessionId, Response $response, User $user, Database $dbForProject, Document $project, Event $queueForEvents, ?Document $current) {
 
         $sessionId = ($sessionId === 'current')
-            ? $user->sessionVerify($store->getProperty('secret', ''), $proofForToken)
+            ? $current?->getId()
             : $sessionId;
         $sessions = $user->getAttribute('sessions', []);
 
@@ -1627,15 +1625,17 @@
         if (!empty($state['failure']) && !$redirectValidator->isValid($state['failure'])) {
             throw new Exception(Exception::PROJECT_INVALID_FAILURE_URL);
         }
-        // The default relays live on the console host; the same path on any other allowed host is a customer page
+        // The default relays live on the console host; the same path on any other allowed host is a customer page.
+        // Native apps skip the relay: its JavaScript redirect into the app is late or dropped on slow in-app browsers.
         $consoleHostname = \parse_url($platform['consoleUrl'] ?? '', PHP_URL_HOST);
+        $nativeCallback = ['scheme' => 'appwrite-callback-' . $project->getId()];
 
         $failure = [];
         if (!empty($state['failure'])) {
             $failure = URLParser::parse($state['failure']);
         }
 
-        $failureRedirect = (function (string $type, ?string $message = null, ?int $code = null, ?\Throwable $previous = null, array $params = []) use ($failure, $response, $project, $oauthDefaultFailure, $consoleHostname) {
+        $failureRedirect = (function (string $type, ?string $message = null, ?int $code = null, ?\Throwable $previous = null, array $params = []) use ($failure, $response, $project, $oauthDefaultFailure, $consoleHostname, $nativeCallback) {
             $exception = new Exception($type, $message, $code, $previous, params: $params);
             if (!empty($failure)) {
                 $query = URLParser::parseQuery($failure['query']);
@@ -1644,10 +1644,9 @@
                     'type' => $exception->getType(),
                     'code' => !\is_null($code) ? $code : $exception->getCode(),
                 ]);
-                // Mirror success path: default OAuth failure relay needs project to deep-link
-                // back into the native app via appwrite-callback-{project}://
                 if ($failure['host'] === $consoleHostname && $failure['path'] === $oauthDefaultFailure) {
                     $query['project'] = $project->getId();
+                    $failure = $nativeCallback;
                 }
                 $failure['query'] = URLParser::unparseQuery($query);
                 $response->redirect(URLParser::unparse($failure), 301);
@@ -2234,6 +2233,7 @@
                 $query['domain'] = $cookieDomain;
                 $query['key'] = $store->getKey();
                 $query['secret'] = $encoded;
+                $state['success'] = $nativeCallback;
             }
 
             $response
@@ -3508,11 +3508,10 @@
     ->inject('dbForProject')
     ->inject('queueForEvents')
     ->inject('hooks')
-    ->inject('store')
     ->inject('proofForPassword')
-    ->inject('proofForToken')
     ->inject('pwnedPasswords')
-    ->action(function (string $password, string $oldPassword, Response $response, User $user, Document $project, Database $dbForProject, Event $queueForEvents, Hooks $hooks, Store $store, ProofsPassword $proofForPassword, ProofsToken $proofForToken, PasswordPwned $pwnedPasswords) {
+    ->inject('session')
+    ->action(function (string $password, string $oldPassword, Response $response, User $user, Document $project, Database $dbForProject, Event $queueForEvents, Hooks $hooks, ProofsPassword $proofForPassword, PasswordPwned $pwnedPasswords, ?Document $current) {
         $userProofForPassword = ProofsPassword::createHash($user->getAttribute('hash'), $user->getAttribute('hashOptions'));
         // Check old password only if its an existing user.
         if (!empty($user->getAttribute('passwordUpdate')) && !$userProofForPassword->verify($oldPassword, $user->getAttribute('password'))) { // Double check user password
@@ -3562,13 +3561,11 @@
 
         $sessions = $user->getAttribute('sessions', []);
 
-        $current = $user->sessionVerify($store->getProperty('secret', ''), $proofForToken);
-
         $invalidate = $project->getAttribute('auths', default: [])['invalidateSessions'] ?? false;
-        if ($invalidate && !empty($current)) {
+        if ($invalidate && $current !== null) {
             foreach ($sessions as $session) {
                 /** @var Document $session */
-                if ($session->getId() !== $current) {
+                if ($session->getId() !== $current->getId()) {
                     $dbForProject->deleteDocument('sessions', $session->getId());
                 }
             }
@@ -5263,10 +5260,9 @@
     ->inject('request')
     ->inject('response')
     ->inject('dbForProject')
-    ->inject('store')
-    ->inject('proofForToken')
     ->inject('authorization')
-    ->action(function (string $targetId, string $identifier, string $providerId, Event $queueForEvents, User $user, Request $request, Response $response, Database $dbForProject, Store $store, ProofsToken $proofForToken, Authorization $authorization) {
+    ->inject('session')
+    ->action(function (string $targetId, string $identifier, string $providerId, Event $queueForEvents, User $user, Request $request, Response $response, Database $dbForProject, Authorization $authorization, ?Document $current) {
         $targetId = $targetId == 'unique()' ? ID::unique() : $targetId;
 
         $provider = $authorization->skip(fn () => $dbForProject->getDocument('providers', $providerId));
@@ -5282,8 +5278,7 @@
 
         $device = $detector->getDevice();
 
-        $sessionId = $user->sessionVerify($store->getProperty('secret', ''), $proofForToken);
-        $session = $dbForProject->getDocument('sessions', $sessionId);
+        $session = $dbForProject->getDocument('sessions', $current?->getId() ?? '');
         $name = "{$device['deviceBrand']} {$device['deviceModel']}";
 
         // A session is one device install holding one push token per provider. Re-registering a rotated

app/init/constants.php

@@ -41,6 +41,7 @@
 const APP_LIMIT_ARRAY_LABELS_SIZE = 1000; // Default maximum of how many labels elements can there be in API parameter that expects array value
 const APP_LIMIT_ARRAY_SCOPES_SIZE = 200; // Default maximum of how many scope elements can there be in API parameter that expects array value
 const APP_LIMIT_ARRAY_ELEMENT_SIZE = 4096; // Default maximum length of element in array parameter represented by maximum URL length.
+const APP_LIMIT_ROLE_LENGTH = 81; // Maximum length of a team role: `project-<projectId>-<role>` is 9 template characters around two 36-character IDs
 const APP_LIMIT_SUBQUERY = 1000;
 const APP_LIMIT_SUBSCRIBERS_SUBQUERY = 25;
 

app/init/models.php

@@ -157,6 +157,7 @@
 use Appwrite\Utopia\Response\Model\OAuth2TikTok;
 use Appwrite\Utopia\Response\Model\OAuth2Tradeshift;
 use Appwrite\Utopia\Response\Model\OAuth2Twitch;
+use Appwrite\Utopia\Response\Model\OAuth2Webflow;
 use Appwrite\Utopia\Response\Model\OAuth2WordPress;
 use Appwrite\Utopia\Response\Model\OAuth2X;
 use Appwrite\Utopia\Response\Model\OAuth2Yahoo;
@@ -435,6 +436,7 @@
 Response::setModel(new OAuth2Yandex());
 Response::setModel(new OAuth2X());
 Response::setModel(new OAuth2WordPress());
+Response::setModel(new OAuth2Webflow());
 Response::setModel(new OAuth2Twitch());
 Response::setModel(new OAuth2Stripe());
 Response::setModel(new OAuth2Spotify());

app/init/resources/request.php

@@ -647,14 +647,29 @@
         return $project;
     }, ['dbForPlatform', 'request', 'console', 'authorization', 'utopia', 'projectIdFromPath']);
 
-    $context->set('session', function (User $user, Store $store, Token $proofForToken) {
+    $context->set('session', function (User $user, Store $store, Token $proofForToken, Request $request) {
         if ($user->isEmpty()) {
             return;
         }
 
         $sessions = $user->getAttribute('sessions', []);
         $sessionId = $user->sessionVerify($store->getProperty('secret', ''), $proofForToken);
 
+        $authJWT = $request->getHeaderLine('x-appwrite-jwt', '');
+        if (! $sessionId && ! empty($authJWT)) {
+            $jwt = new JWT(System::getEnv('_APP_OPENSSL_KEY_V1'), 'HS256', 3600, 0);
+            try {
+                $payload = $jwt->decode($authJWT);
+            } catch (JWTException) {
+                return;
+            }
+
+            $jwtSessionId = $payload['sessionId'] ?? '';
+            if (($payload['userId'] ?? '') === $user->getId() && ! empty($jwtSessionId) && $user->sessionActive($jwtSessionId)) {
+                $sessionId = $jwtSessionId;
+            }
+        }
+
         if (! $sessionId) {
             return;
         }
@@ -666,7 +681,7 @@
         }
 
         return;
-    }, ['user', 'store', 'proofForToken']);
+    }, ['user', 'store', 'proofForToken', 'request']);
 
     $context->set('pwnedPasswords', function (Cache $cache) {
         // Nothing is asked until an operator points this at a service

composer.json

@@ -26,6 +26,7 @@
         "psr-4": {
             "Appwrite\\": "src/Appwrite",
             "Executor\\": "src/Executor",
+            "Utopia\\Abuse\\": "packages/abuse/src",
             "Utopia\\Agents\\": "packages/agents/src",
             "Utopia\\Audit\\": "packages/audit/src",
             "Utopia\\Auth\\": "packages/auth/src",
@@ -49,6 +50,7 @@
             "Utopia\\Lock\\": "packages/lock/src",
             "Utopia\\Messaging\\": "packages/messaging/src",
             "Utopia\\Mqtt\\": "packages/mqtt/src",
+            "Utopia\\NATS\\": "packages/nats/src",
             "Utopia\\OpenAPI\\": "packages/openapi/src",
             "Utopia\\Platform\\": "packages/platform/src",
             "Utopia\\Pools\\": "packages/pools/src",
@@ -78,6 +80,7 @@
             "Tests\\E2E\\": "tests/e2e",
             "Tests\\Unit\\": "tests/unit",
             "Appwrite\\Tests\\": "tests/extensions",
+            "Utopia\\Abuse\\Tests\\": "packages/abuse/tests",
             "Utopia\\Agents\\Tests\\": "packages/agents/tests",
             "Utopia\\Audit\\Tests\\": "packages/audit/tests",
             "Utopia\\Auth\\Tests\\": "packages/auth/tests",
@@ -102,6 +105,7 @@
             "Utopia\\Lock\\Tests\\": "packages/lock/tests",
             "Utopia\\Messaging\\Tests\\": "packages/messaging/tests",
             "Utopia\\Mqtt\\Tests\\": "packages/mqtt/tests",
+            "Utopia\\NATS\\Tests\\": "packages/nats/tests",
             "Utopia\\OpenAPI\\Tests\\": "packages/openapi/tests",
             "Utopia\\Platform\\Tests\\": "packages/platform/tests",
             "Utopia\\Pools\\Tests\\": "packages/pools/tests",
@@ -144,9 +148,8 @@
         "ext-sockets": "*",
         "appwrite/php-runtimes": "0.20.*",
         "appwrite/php-clamav": "2.0.*",
-        "utopia-php/abuse": "2.0.*",
         "utopia-php/config": "1.*",
-        "utopia-php/database": "^7.3.11",
+        "utopia-php/database": "^7.4.0",
         "utopia-php/migration": "^2.0.0",
         "mustangostang/spyc": "0.6.*",
         "dragonmantank/cron-expression": "3.4.*",
@@ -164,7 +167,8 @@
         "psr/http-factory": "^1.0",
         "psr/http-client": "^1.0",
         "psr/http-message": "^2.0",
-        "psr/container": "^2.0"
+        "psr/container": "^2.0",
+        "appwrite/appwrite": "^27.1"
     },
     "require-dev": {
         "ext-fileinfo": "*",
@@ -193,6 +197,7 @@
         }
     },
     "replace": {
+        "utopia-php/abuse": "*",
         "utopia-php/agents": "*",
         "utopia-php/audit": "*",
         "utopia-php/auth": "*",
@@ -217,6 +222,7 @@
         "utopia-php/lock": "*",
         "utopia-php/messaging": "*",
         "utopia-php/mqtt": "*",
+        "utopia-php/nats": "*",
         "utopia-php/openapi": "*",
         "utopia-php/platform": "*",
         "utopia-php/pools": "*",