refactor(server): plugin modules (#5630)

- [x] separates modules into `fundamental`, `core`, `plugins`
- [x] optional modules with `@OptionalModule` decorator to install modules with requirements met(`requires`, `if`)
- [x] `module.contributesTo` defines optional features that will be enabled if module registered
- [x] `AFFiNE.plugins.use('payment', {})` to enable a optional/plugin module
- [x] `PaymentModule` is the first plugin module
- [x] GraphQLSchema will not be generated for non-included modules
- [x] Frontend can use `ServerConfigType` query to detect which features are enabled
- [x] override existing provider globally

packages/backend/server/src/core/auth/guard.ts

@@ -0,0 +1,152 @@
+import type { CanActivate, ExecutionContext } from '@nestjs/common';
+import {
+  createParamDecorator,
+  Inject,
+  Injectable,
+  SetMetadata,
+  UseGuards,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import type { NextAuthOptions } from 'next-auth';
+import { AuthHandler } from 'next-auth/core';
+
+import {
+  getRequestResponseFromContext,
+  PrismaService,
+} from '../../fundamentals';
+import { NextAuthOptionsProvide } from './next-auth-options';
+import { AuthService } from './service';
+
+export function getUserFromContext(context: ExecutionContext) {
+  return getRequestResponseFromContext(context).req.user;
+}
+
+/**
+ * Used to fetch current user from the request context.
+ *
+ * > The user may be undefined if authorization token is not provided.
+ *
+ * @example
+ *
+ * ```typescript
+ * // Graphql Query
+ * \@Query(() => UserType)
+ * user(@CurrentUser() user?: User) {
+ *  return user;
+ * }
+ * ```
+ *
+ * ```typescript
+ * // HTTP Controller
+ * \@Get('/user)
+ * user(@CurrentUser() user?: User) {
+ *   return user;
+ * }
+ * ```
+ */
+export const CurrentUser = createParamDecorator(
+  (_: unknown, context: ExecutionContext) => {
+    return getUserFromContext(context);
+  }
+);
+
+@Injectable()
+class AuthGuard implements CanActivate {
+  constructor(
+    @Inject(NextAuthOptionsProvide)
+    private readonly nextAuthOptions: NextAuthOptions,
+    private readonly auth: AuthService,
+    private readonly prisma: PrismaService,
+    private readonly reflector: Reflector
+  ) {}
+
+  async canActivate(context: ExecutionContext) {
+    const { req, res } = getRequestResponseFromContext(context);
+    const token = req.headers.authorization;
+
+    // api is public
+    const isPublic = this.reflector.get<boolean>(
+      'isPublic',
+      context.getHandler()
+    );
+    // api can be public, but if user is logged in, we can get user info
+    const isPublicable = this.reflector.get<boolean>(
+      'isPublicable',
+      context.getHandler()
+    );
+
+    if (isPublic) {
+      return true;
+    } else if (!token) {
+      if (!req.cookies) {
+        return isPublicable;
+      }
+
+      const session = await AuthHandler({
+        req: {
+          cookies: req.cookies,
+          action: 'session',
+          method: 'GET',
+          headers: req.headers,
+        },
+        options: this.nextAuthOptions,
+      });
+
+      const { body = {}, cookies, status = 200 } = session;
+      if (!body && !isPublicable) {
+        return false;
+      }
+
+      // @ts-expect-error body is user here
+      req.user = body.user;
+      if (cookies && res) {
+        for (const cookie of cookies) {
+          res.cookie(cookie.name, cookie.value, cookie.options);
+        }
+      }
+
+      return Boolean(
+        status === 200 &&
+          typeof body !== 'string' &&
+          // ignore body if api is publicable
+          (Object.keys(body).length || isPublicable)
+      );
+    } else {
+      const [type, jwt] = token.split(' ') ?? [];
+
+      if (type === 'Bearer') {
+        const claims = await this.auth.verify(jwt);
+        req.user = await this.prisma.user.findUnique({
+          where: { id: claims.id },
+        });
+        return !!req.user;
+      }
+    }
+    return false;
+  }
+}
+
+/**
+ * This guard is used to protect routes/queries/mutations that require a user to be logged in.
+ *
+ * The `@CurrentUser()` parameter decorator used in a `Auth` guarded queries would always give us the user because the `Auth` guard will
+ * fast throw if user is not logged in.
+ *
+ * @example
+ *
+ * ```typescript
+ * \@Auth()
+ * \@Query(() => UserType)
+ * user(@CurrentUser() user: User) {
+ *   return user;
+ * }
+ * ```
+ */
+export const Auth = () => {
+  return UseGuards(AuthGuard);
+};
+
+// api is public accessible
+export const Public = () => SetMetadata('isPublic', true);
+// api is public accessible, but if user is logged in, we can get user info
+export const Publicable = () => SetMetadata('isPublicable', true);

packages/backend/server/src/core/auth/index.ts

@@ -0,0 +1,18 @@
+import { Global, Module } from '@nestjs/common';
+
+import { NextAuthController } from './next-auth.controller';
+import { NextAuthOptionsProvider } from './next-auth-options';
+import { AuthResolver } from './resolver';
+import { AuthService } from './service';
+
+@Global()
+@Module({
+  providers: [AuthService, AuthResolver, NextAuthOptionsProvider],
+  exports: [AuthService, NextAuthOptionsProvider],
+  controllers: [NextAuthController],
+})
+export class AuthModule {}
+
+export * from './guard';
+export { TokenType } from './resolver';
+export { AuthService };

packages/backend/server/src/core/auth/next-auth-options.ts

@@ -0,0 +1,270 @@
+import { PrismaAdapter } from '@auth/prisma-adapter';
+import { FactoryProvider, Logger } from '@nestjs/common';
+import { verify } from '@node-rs/argon2';
+import { assign, omit } from 'lodash-es';
+import { NextAuthOptions } from 'next-auth';
+import Credentials from 'next-auth/providers/credentials';
+import Email from 'next-auth/providers/email';
+import Github from 'next-auth/providers/github';
+import Google from 'next-auth/providers/google';
+
+import {
+  Config,
+  MailService,
+  PrismaService,
+  SessionService,
+} from '../../fundamentals';
+import { FeatureType } from '../features';
+import { Quota_FreePlanV1_1 } from '../quota';
+import {
+  decode,
+  encode,
+  sendVerificationRequest,
+  SendVerificationRequestParams,
+} from './utils';
+
+export const NextAuthOptionsProvide = Symbol('NextAuthOptions');
+
+const TrustedProviders = ['google'];
+
+export const NextAuthOptionsProvider: FactoryProvider<NextAuthOptions> = {
+  provide: NextAuthOptionsProvide,
+  useFactory(
+    config: Config,
+    prisma: PrismaService,
+    mailer: MailService,
+    session: SessionService
+  ) {
+    const logger = new Logger('NextAuth');
+    const prismaAdapter = PrismaAdapter(prisma);
+    // createUser exists in the adapter
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    const createUser = prismaAdapter.createUser!.bind(prismaAdapter);
+    prismaAdapter.createUser = async data => {
+      const userData = {
+        name: data.name,
+        email: data.email,
+        avatarUrl: '',
+        emailVerified: data.emailVerified,
+        features: {
+          create: {
+            reason: 'created by email sign up',
+            activated: true,
+            feature: {
+              connect: {
+                feature_version: Quota_FreePlanV1_1,
+              },
+            },
+          },
+        },
+      };
+      if (data.email && !data.name) {
+        userData.name = data.email.split('@')[0];
+      }
+      if (data.image) {
+        userData.avatarUrl = data.image;
+      }
+      return createUser(userData);
+    };
+    // linkAccount exists in the adapter
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    const linkAccount = prismaAdapter.linkAccount!.bind(prismaAdapter);
+    prismaAdapter.linkAccount = async account => {
+      // google account must be a verified email
+      if (TrustedProviders.includes(account.provider)) {
+        await prisma.user.update({
+          where: {
+            id: account.userId,
+          },
+          data: {
+            emailVerified: new Date(),
+          },
+        });
+      }
+      return linkAccount(account) as Promise<void>;
+    };
+    // getUser exists in the adapter
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    const getUser = prismaAdapter.getUser!.bind(prismaAdapter)!;
+    prismaAdapter.getUser = async id => {
+      const result = await getUser(id);
+      if (result) {
+        // @ts-expect-error Third part library type mismatch
+        result.image = result.avatarUrl;
+        // @ts-expect-error Third part library type mismatch
+        result.hasPassword = Boolean(result.password);
+      }
+      return result;
+    };
+    const nextAuthOptions: NextAuthOptions = {
+      providers: [
+        // @ts-expect-error esm interop issue
+        Email.default({
+          server: {
+            host: config.auth.email.server,
+            port: config.auth.email.port,
+            auth: {
+              user: config.auth.email.login,
+              pass: config.auth.email.password,
+            },
+          },
+          from: config.auth.email.sender,
+          sendVerificationRequest: (params: SendVerificationRequestParams) =>
+            sendVerificationRequest(config, logger, mailer, session, params),
+        }),
+      ],
+      adapter: prismaAdapter,
+      debug: !config.node.prod,
+      session: {
+        strategy: 'database',
+      },
+      logger: {
+        debug(code, metadata) {
+          logger.debug(`${code}: ${JSON.stringify(metadata)}`);
+        },
+        error(code, metadata) {
+          if (metadata instanceof Error) {
+            // @ts-expect-error assign code to error
+            metadata.code = code;
+            logger.error(metadata);
+          } else if (metadata.error instanceof Error) {
+            assign(metadata.error, omit(metadata, 'error'), { code });
+            logger.error(metadata.error);
+          }
+        },
+        warn(code) {
+          logger.warn(code);
+        },
+      },
+    };
+
+    nextAuthOptions.providers.push(
+      // @ts-expect-error esm interop issue
+      Credentials.default({
+        name: 'Password',
+        credentials: {
+          email: {
+            label: 'Email',
+            type: 'text',
+            placeholder: 'torvalds@osdl.org',
+          },
+          password: { label: 'Password', type: 'password' },
+        },
+        async authorize(
+          credentials:
+            | Record<'email' | 'password' | 'hashedPassword', string>
+            | undefined
+        ) {
+          if (!credentials) {
+            return null;
+          }
+          const { password, hashedPassword } = credentials;
+          if (!password || !hashedPassword) {
+            return null;
+          }
+          if (!(await verify(hashedPassword, password))) {
+            return null;
+          }
+          return credentials;
+        },
+      })
+    );
+
+    if (config.auth.oauthProviders.github) {
+      nextAuthOptions.providers.push(
+        // @ts-expect-error esm interop issue
+        Github.default({
+          clientId: config.auth.oauthProviders.github.clientId,
+          clientSecret: config.auth.oauthProviders.github.clientSecret,
+          allowDangerousEmailAccountLinking: true,
+        })
+      );
+    }
+
+    if (config.auth.oauthProviders.google?.enabled) {
+      nextAuthOptions.providers.push(
+        // @ts-expect-error esm interop issue
+        Google.default({
+          clientId: config.auth.oauthProviders.google.clientId,
+          clientSecret: config.auth.oauthProviders.google.clientSecret,
+          checks: 'nonce',
+          allowDangerousEmailAccountLinking: true,
+          authorization: {
+            params: { scope: 'openid email profile', prompt: 'select_account' },
+          },
+        })
+      );
+    }
+
+    nextAuthOptions.jwt = {
+      encode: async ({ token, maxAge }) =>
+        encode(config, prisma, token, maxAge),
+      decode: async ({ token }) => decode(config, token),
+    };
+    nextAuthOptions.secret ??= config.auth.nextAuthSecret;
+
+    nextAuthOptions.callbacks = {
+      session: async ({ session, user, token }) => {
+        if (session.user) {
+          if (user) {
+            // @ts-expect-error Third part library type mismatch
+            session.user.id = user.id;
+            // @ts-expect-error Third part library type mismatch
+            session.user.image = user.image ?? user.avatarUrl;
+            // @ts-expect-error Third part library type mismatch
+            session.user.emailVerified = user.emailVerified;
+            // @ts-expect-error Third part library type mismatch
+            session.user.hasPassword = Boolean(user.password);
+          } else {
+            // technically the sub should be the same as id
+            // @ts-expect-error Third part library type mismatch
+            session.user.id = token.sub;
+            // @ts-expect-error Third part library type mismatch
+            session.user.emailVerified = token.emailVerified;
+            // @ts-expect-error Third part library type mismatch
+            session.user.hasPassword = token.hasPassword;
+          }
+          if (token && token.picture) {
+            session.user.image = token.picture;
+          }
+        }
+        return session;
+      },
+      signIn: async ({ profile, user }) => {
+        if (!config.featureFlags.earlyAccessPreview) {
+          return true;
+        }
+        const email = profile?.email ?? user.email;
+        if (email) {
+          // FIXME: cannot inject FeatureManagementService here
+          // it will cause prisma.account to be undefined
+          // then prismaAdapter.getUserByAccount will throw error
+          if (email.endsWith('@toeverything.info')) return true;
+          return prisma.userFeatures
+            .count({
+              where: {
+                user: {
+                  email,
+                },
+                feature: {
+                  feature: FeatureType.EarlyAccess,
+                },
+                activated: true,
+              },
+            })
+            .then(count => count > 0);
+        }
+        return false;
+      },
+      redirect({ url }) {
+        return url;
+      },
+    };
+
+    nextAuthOptions.pages = {
+      newUser: '/auth/onboarding',
+    };
+    return nextAuthOptions;
+  },
+  inject: [Config, PrismaService, MailService, SessionService],
+};

packages/backend/server/src/core/auth/next-auth.controller.ts

@@ -0,0 +1,409 @@
+import { URLSearchParams } from 'node:url';
+
+import {
+  All,
+  BadRequestException,
+  Controller,
+  Get,
+  Inject,
+  Logger,
+  Next,
+  NotFoundException,
+  Query,
+  Req,
+  Res,
+  UseGuards,
+} from '@nestjs/common';
+import { hash, verify } from '@node-rs/argon2';
+import type { User } from '@prisma/client';
+import type { NextFunction, Request, Response } from 'express';
+import { pick } from 'lodash-es';
+import { nanoid } from 'nanoid';
+import type { AuthAction, CookieOption, NextAuthOptions } from 'next-auth';
+import { AuthHandler } from 'next-auth/core';
+
+import {
+  AuthThrottlerGuard,
+  Config,
+  metrics,
+  PrismaService,
+  SessionService,
+  Throttle,
+} from '../../fundamentals';
+import { NextAuthOptionsProvide } from './next-auth-options';
+import { AuthService } from './service';
+
+const BASE_URL = '/api/auth/';
+
+const DEFAULT_SESSION_EXPIRE_DATE = 2592000 * 1000; // 30 days
+
+@Controller(BASE_URL)
+export class NextAuthController {
+  private readonly callbackSession;
+
+  private readonly logger = new Logger('NextAuthController');
+
+  constructor(
+    readonly config: Config,
+    readonly prisma: PrismaService,
+    private readonly authService: AuthService,
+    @Inject(NextAuthOptionsProvide)
+    private readonly nextAuthOptions: NextAuthOptions,
+    private readonly session: SessionService
+  ) {
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    this.callbackSession = nextAuthOptions.callbacks!.session;
+  }
+
+  @UseGuards(AuthThrottlerGuard)
+  @Throttle({
+    default: {
+      limit: 60,
+      ttl: 60,
+    },
+  })
+  @Get('/challenge')
+  async getChallenge(@Res() res: Response) {
+    const challenge = nanoid();
+    const resource = nanoid();
+    await this.session.set(challenge, resource, 5 * 60 * 1000);
+    res.json({ challenge, resource });
+  }
+
+  @UseGuards(AuthThrottlerGuard)
+  @Throttle({
+    default: {
+      limit: 60,
+      ttl: 60,
+    },
+  })
+  @All('*')
+  async auth(
+    @Req() req: Request,
+    @Res() res: Response,
+    @Query() query: Record<string, any>,
+    @Next() next: NextFunction
+  ) {
+    if (req.path === '/api/auth/signin' && req.method === 'GET') {
+      const query = req.query
+        ? // @ts-expect-error req.query is satisfy with the Record<string, any>
+          `?${new URLSearchParams(req.query).toString()}`
+        : '';
+      res.redirect(`/signin${query}`);
+      return;
+    }
+    const [action, providerId] = req.url // start with request url
+      .slice(BASE_URL.length) // make relative to baseUrl
+      .replace(/\?.*/, '') // remove query part, use only path part
+      .split('/') as [AuthAction, string]; // as array of strings;
+
+    metrics.auth.counter('call_counter').add(1, { action, providerId });
+
+    const credentialsSignIn =
+      req.method === 'POST' && providerId === 'credentials';
+    let userId: string | undefined;
+    if (credentialsSignIn) {
+      const { email } = req.body;
+      if (email) {
+        const user = await this.prisma.user.findFirst({
+          where: {
+            email,
+          },
+        });
+        if (!user) {
+          req.statusCode = 401;
+          req.statusMessage = 'User not found';
+          req.body = null;
+          throw new NotFoundException(`User not found`);
+        } else {
+          userId = user.id;
+          req.body = {
+            ...req.body,
+            name: user.name,
+            email: user.email,
+            image: user.avatarUrl,
+            hashedPassword: user.password,
+          };
+        }
+      }
+    }
+    const options = this.nextAuthOptions;
+    if (req.method === 'POST' && action === 'session') {
+      if (typeof req.body !== 'object' || typeof req.body.data !== 'object') {
+        metrics.auth
+          .counter('call_fails_counter')
+          .add(1, { reason: 'invalid_session_data' });
+        throw new BadRequestException(`Invalid new session data`);
+      }
+      const user = await this.updateSession(req, req.body.data);
+      // callbacks.session existed
+      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+      options.callbacks!.session = ({ session }) => {
+        return {
+          user: {
+            ...pick(user, 'id', 'name', 'email'),
+            image: user.avatarUrl,
+            hasPassword: !!user.password,
+          },
+          expires: session.expires,
+        };
+      };
+    } else {
+      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+      options.callbacks!.session = this.callbackSession;
+    }
+
+    if (
+      this.config.auth.captcha.enable &&
+      req.method === 'POST' &&
+      action === 'signin' &&
+      // TODO: add credentials support in frontend
+      ['email'].includes(providerId)
+    ) {
+      const isVerified = await this.verifyChallenge(req, res);
+      if (!isVerified) return;
+    }
+
+    const { status, headers, body, redirect, cookies } = await AuthHandler({
+      req: {
+        body: req.body,
+        query: query,
+        method: req.method,
+        action,
+        providerId,
+        error: query.error ?? providerId,
+        cookies: req.cookies,
+      },
+      options,
+    });
+
+    if (headers) {
+      for (const { key, value } of headers) {
+        res.setHeader(key, value);
+      }
+    }
+    if (cookies) {
+      for (const cookie of cookies) {
+        res.cookie(cookie.name, cookie.value, cookie.options);
+      }
+    }
+
+    let nextAuthTokenCookie: (CookieOption & { value: string }) | undefined;
+    const secureCookiePrefix = '__Secure-';
+    const sessionCookieName = `next-auth.session-token`;
+    // next-auth credentials login only support JWT strategy
+    // https://next-auth.js.org/configuration/providers/credentials
+    // let's store the session token in the database
+    if (
+      credentialsSignIn &&
+      (nextAuthTokenCookie = cookies?.find(
+        ({ name }) =>
+          name === sessionCookieName ||
+          name === `${secureCookiePrefix}${sessionCookieName}`
+      ))
+    ) {
+      const cookieExpires = new Date();
+      cookieExpires.setTime(
+        cookieExpires.getTime() + DEFAULT_SESSION_EXPIRE_DATE
+      );
+      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+      await this.nextAuthOptions.adapter!.createSession!({
+        sessionToken: nextAuthTokenCookie.value,
+        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+        userId: userId!,
+        expires: cookieExpires,
+      });
+    }
+
+    if (redirect?.endsWith('api/auth/error?error=AccessDenied')) {
+      this.logger.log(`Early access redirect headers: ${req.headers}`);
+      metrics.auth
+        .counter('call_fails_counter')
+        .add(1, { reason: 'no_early_access_permission' });
+
+      if (
+        !req.headers?.referer ||
+        checkUrlOrigin(req.headers.referer, 'https://accounts.google.com')
+      ) {
+        res.redirect('https://community.affine.pro/c/insider-general/');
+      } else {
+        res.status(403);
+        res.json({
+          url: 'https://community.affine.pro/c/insider-general/',
+          error: `You don't have early access permission`,
+        });
+      }
+      return;
+    }
+
+    if (status) {
+      res.status(status);
+    }
+
+    if (redirect) {
+      if (providerId === 'credentials') {
+        res.send(JSON.stringify({ ok: true, url: redirect }));
+      } else if (
+        action === 'callback' ||
+        action === 'error' ||
+        (providerId !== 'credentials' &&
+          // login in the next-auth page, /api/auth/signin, auto redirect.
+          // otherwise, return the json value to allow frontend to handle the redirect.
+          req.headers?.referer?.includes?.('/api/auth/signin'))
+      ) {
+        res.redirect(redirect);
+      } else {
+        res.json({ url: redirect });
+      }
+    } else if (typeof body === 'string') {
+      res.send(body);
+    } else if (body && typeof body === 'object') {
+      res.json(body);
+    } else {
+      next();
+    }
+  }
+
+  private async updateSession(
+    req: Request,
+    newSession: Partial<Omit<User, 'id'>> & { oldPassword?: string }
+  ): Promise<User> {
+    const { name, email, password, oldPassword } = newSession;
+    if (!name && !email && !password) {
+      throw new BadRequestException(`Invalid new session data`);
+    }
+    if (password) {
+      const user = await this.verifyUserFromRequest(req);
+      const { password: userPassword } = user;
+      if (!oldPassword) {
+        if (userPassword) {
+          throw new BadRequestException(
+            `Old password is required to update password`
+          );
+        }
+      } else {
+        if (!userPassword) {
+          throw new BadRequestException(`No existed password`);
+        }
+        if (await verify(userPassword, oldPassword)) {
+          await this.prisma.user.update({
+            where: {
+              id: user.id,
+            },
+            data: {
+              ...pick(newSession, 'email', 'name'),
+              password: await hash(password),
+            },
+          });
+        }
+      }
+      return user;
+    } else {
+      const user = await this.verifyUserFromRequest(req);
+      return this.prisma.user.update({
+        where: {
+          id: user.id,
+        },
+        data: pick(newSession, 'name', 'email'),
+      });
+    }
+  }
+
+  private async verifyChallenge(req: Request, res: Response): Promise<boolean> {
+    const challenge = req.query?.challenge;
+    if (typeof challenge === 'string' && challenge) {
+      const resource = await this.session.get(challenge);
+
+      if (!resource) {
+        this.rejectResponse(res, 'Invalid Challenge');
+        return false;
+      }
+
+      const isChallengeVerified =
+        await this.authService.verifyChallengeResponse(
+          req.query?.token,
+          resource
+        );
+
+      this.logger.debug(
+        `Challenge: ${challenge}, Resource: ${resource}, Response: ${req.query?.token}, isChallengeVerified: ${isChallengeVerified}`
+      );
+
+      if (!isChallengeVerified) {
+        this.rejectResponse(res, 'Invalid Challenge Response');
+        return false;
+      }
+    } else {
+      const isTokenVerified = await this.authService.verifyCaptchaToken(
+        req.query?.token,
+        req.headers['CF-Connecting-IP'] as string
+      );
+
+      if (!isTokenVerified) {
+        this.rejectResponse(res, 'Invalid Captcha Response');
+        return false;
+      }
+    }
+    return true;
+  }
+
+  private async verifyUserFromRequest(req: Request): Promise<User> {
+    const token = req.headers.authorization;
+    if (!token) {
+      const session = await AuthHandler({
+        req: {
+          cookies: req.cookies,
+          action: 'session',
+          method: 'GET',
+          headers: req.headers,
+        },
+        options: this.nextAuthOptions,
+      });
+
+      const { body } = session;
+      // @ts-expect-error check if body.user exists
+      if (body && body.user && body.user.id) {
+        const user = await this.prisma.user.findUnique({
+          where: {
+            // @ts-expect-error body.user.id exists
+            id: body.user.id,
+          },
+        });
+        if (user) {
+          return user;
+        }
+      }
+    } else {
+      const [type, jwt] = token.split(' ') ?? [];
+
+      if (type === 'Bearer') {
+        const claims = await this.authService.verify(jwt);
+        const user = await this.prisma.user.findUnique({
+          where: { id: claims.id },
+        });
+        if (user) {
+          return user;
+        }
+      }
+    }
+    throw new BadRequestException(`User not found`);
+  }
+
+  rejectResponse(res: Response, error: string, status = 400) {
+    res.status(status);
+    res.json({
+      url: `${this.config.baseUrl}/api/auth/error?${new URLSearchParams({
+        error,
+      }).toString()}`,
+      error,
+    });
+  }
+}
+
+const checkUrlOrigin = (url: string, origin: string) => {
+  try {
+    return new URL(url).origin === origin;
+  } catch (e) {
+    return false;
+  }
+};

packages/backend/server/src/core/auth/resolver.ts

@@ -0,0 +1,305 @@
+import {
+  BadRequestException,
+  ForbiddenException,
+  UseGuards,
+} from '@nestjs/common';
+import {
+  Args,
+  Context,
+  Field,
+  Mutation,
+  ObjectType,
+  Parent,
+  ResolveField,
+  Resolver,
+} from '@nestjs/graphql';
+import type { Request } from 'express';
+import { nanoid } from 'nanoid';
+
+import {
+  CloudThrottlerGuard,
+  Config,
+  SessionService,
+  Throttle,
+} from '../../fundamentals';
+import { UserType } from '../users';
+import { Auth, CurrentUser } from './guard';
+import { AuthService } from './service';
+
+@ObjectType()
+export class TokenType {
+  @Field()
+  token!: string;
+
+  @Field()
+  refresh!: string;
+
+  @Field({ nullable: true })
+  sessionToken?: string;
+}
+
+/**
+ * Auth resolver
+ * Token rate limit: 20 req/m
+ * Sign up/in rate limit: 10 req/m
+ * Other rate limit: 5 req/m
+ */
+@UseGuards(CloudThrottlerGuard)
+@Resolver(() => UserType)
+export class AuthResolver {
+  constructor(
+    private readonly config: Config,
+    private readonly auth: AuthService,
+    private readonly session: SessionService
+  ) {}
+
+  @Throttle({
+    default: {
+      limit: 20,
+      ttl: 60,
+    },
+  })
+  @ResolveField(() => TokenType)
+  async token(
+    @Context() ctx: { req: Request },
+    @CurrentUser() currentUser: UserType,
+    @Parent() user: UserType
+  ) {
+    if (user.id !== currentUser.id) {
+      throw new BadRequestException('Invalid user');
+    }
+
+    let sessionToken: string | undefined;
+
+    // only return session if the request is from the same origin & path == /open-app
+    if (
+      ctx.req.headers.referer &&
+      ctx.req.headers.host &&
+      new URL(ctx.req.headers.referer).pathname.startsWith('/open-app') &&
+      ctx.req.headers.host === new URL(this.config.origin).host
+    ) {
+      const cookiePrefix = this.config.node.prod ? '__Secure-' : '';
+      const sessionCookieName = `${cookiePrefix}next-auth.session-token`;
+      sessionToken = ctx.req.cookies?.[sessionCookieName];
+    }
+
+    return {
+      sessionToken,
+      token: this.auth.sign(user),
+      refresh: this.auth.refresh(user),
+    };
+  }
+
+  @Throttle({
+    default: {
+      limit: 10,
+      ttl: 60,
+    },
+  })
+  @Mutation(() => UserType)
+  async signUp(
+    @Context() ctx: { req: Request },
+    @Args('name') name: string,
+    @Args('email') email: string,
+    @Args('password') password: string
+  ) {
+    const user = await this.auth.signUp(name, email, password);
+    ctx.req.user = user;
+    return user;
+  }
+
+  @Throttle({
+    default: {
+      limit: 10,
+      ttl: 60,
+    },
+  })
+  @Mutation(() => UserType)
+  async signIn(
+    @Context() ctx: { req: Request },
+    @Args('email') email: string,
+    @Args('password') password: string
+  ) {
+    const user = await this.auth.signIn(email, password);
+    ctx.req.user = user;
+    return user;
+  }
+
+  @Throttle({
+    default: {
+      limit: 5,
+      ttl: 60,
+    },
+  })
+  @Mutation(() => UserType)
+  @Auth()
+  async changePassword(
+    @CurrentUser() user: UserType,
+    @Args('token') token: string,
+    @Args('newPassword') newPassword: string
+  ) {
+    const id = await this.session.get(token);
+    if (!user.emailVerified) {
+      throw new ForbiddenException('Please verify the email first');
+    }
+    if (
+      !id ||
+      (id !== user.id &&
+        // change password after sign in with email link
+        // we only create user account after user sign in with email link
+        id !== user.email)
+    ) {
+      throw new ForbiddenException('Invalid token');
+    }
+
+    await this.auth.changePassword(user.email, newPassword);
+    await this.session.delete(token);
+
+    return user;
+  }
+
+  @Throttle({
+    default: {
+      limit: 5,
+      ttl: 60,
+    },
+  })
+  @Mutation(() => UserType)
+  @Auth()
+  async changeEmail(
+    @CurrentUser() user: UserType,
+    @Args('token') token: string
+  ) {
+    const key = await this.session.get(token);
+    if (!key) {
+      throw new ForbiddenException('Invalid token');
+    }
+
+    // email has set token in `sendVerifyChangeEmail`
+    const [id, email] = key.split(',');
+    if (!id || id !== user.id || !email) {
+      throw new ForbiddenException('Invalid token');
+    }
+
+    await this.auth.changeEmail(id, email);
+    await this.session.delete(token);
+
+    await this.auth.sendNotificationChangeEmail(email);
+
+    return user;
+  }
+
+  @Throttle({
+    default: {
+      limit: 5,
+      ttl: 60,
+    },
+  })
+  @Mutation(() => Boolean)
+  @Auth()
+  async sendChangePasswordEmail(
+    @CurrentUser() user: UserType,
+    @Args('email') email: string,
+    @Args('callbackUrl') callbackUrl: string
+  ) {
+    const token = nanoid();
+    await this.session.set(token, user.id);
+
+    const url = new URL(callbackUrl, this.config.baseUrl);
+    url.searchParams.set('token', token);
+
+    const res = await this.auth.sendChangePasswordEmail(email, url.toString());
+    return !res.rejected.length;
+  }
+
+  @Throttle({
+    default: {
+      limit: 5,
+      ttl: 60,
+    },
+  })
+  @Mutation(() => Boolean)
+  @Auth()
+  async sendSetPasswordEmail(
+    @CurrentUser() user: UserType,
+    @Args('email') email: string,
+    @Args('callbackUrl') callbackUrl: string
+  ) {
+    const token = nanoid();
+    await this.session.set(token, user.id);
+
+    const url = new URL(callbackUrl, this.config.baseUrl);
+    url.searchParams.set('token', token);
+
+    const res = await this.auth.sendSetPasswordEmail(email, url.toString());
+    return !res.rejected.length;
+  }
+
+  // The change email step is:
+  // 1. send email to primitive email `sendChangeEmail`
+  // 2. user open change email page from email
+  // 3. send verify email to new email `sendVerifyChangeEmail`
+  // 4. user open confirm email page from new email
+  // 5. user click confirm button
+  // 6. send notification email
+  @Throttle({
+    default: {
+      limit: 5,
+      ttl: 60,
+    },
+  })
+  @Mutation(() => Boolean)
+  @Auth()
+  async sendChangeEmail(
+    @CurrentUser() user: UserType,
+    @Args('email') email: string,
+    @Args('callbackUrl') callbackUrl: string
+  ) {
+    const token = nanoid();
+    await this.session.set(token, user.id);
+
+    const url = new URL(callbackUrl, this.config.baseUrl);
+    url.searchParams.set('token', token);
+
+    const res = await this.auth.sendChangeEmail(email, url.toString());
+    return !res.rejected.length;
+  }
+
+  @Throttle({
+    default: {
+      limit: 5,
+      ttl: 60,
+    },
+  })
+  @Mutation(() => Boolean)
+  @Auth()
+  async sendVerifyChangeEmail(
+    @CurrentUser() user: UserType,
+    @Args('token') token: string,
+    @Args('email') email: string,
+    @Args('callbackUrl') callbackUrl: string
+  ) {
+    const id = await this.session.get(token);
+    if (!id || id !== user.id) {
+      throw new ForbiddenException('Invalid token');
+    }
+
+    const hasRegistered = await this.auth.getUserByEmail(email);
+
+    if (hasRegistered) {
+      throw new BadRequestException(`Invalid user email`);
+    }
+
+    const withEmailToken = nanoid();
+    await this.session.set(withEmailToken, `${user.id},${email}`);
+
+    const url = new URL(callbackUrl, this.config.baseUrl);
+    url.searchParams.set('token', withEmailToken);
+
+    const res = await this.auth.sendVerifyChangeEmail(email, url.toString());
+
+    await this.session.delete(token);
+
+    return !res.rejected.length;
+  }
+}

packages/backend/server/src/core/auth/service.ts

@@ -0,0 +1,325 @@
+import { randomUUID } from 'node:crypto';
+
+import {
+  BadRequestException,
+  Injectable,
+  InternalServerErrorException,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { hash, verify } from '@node-rs/argon2';
+import { Algorithm, sign, verify as jwtVerify } from '@node-rs/jsonwebtoken';
+import type { User } from '@prisma/client';
+import { nanoid } from 'nanoid';
+
+import {
+  Config,
+  MailService,
+  PrismaService,
+  verifyChallengeResponse,
+} from '../../fundamentals';
+import { Quota_FreePlanV1_1 } from '../quota';
+
+export type UserClaim = Pick<
+  User,
+  'id' | 'name' | 'email' | 'emailVerified' | 'createdAt' | 'avatarUrl'
+> & {
+  hasPassword?: boolean;
+};
+
+export const getUtcTimestamp = () => Math.floor(Date.now() / 1000);
+
+@Injectable()
+export class AuthService {
+  constructor(
+    private readonly config: Config,
+    private readonly prisma: PrismaService,
+    private readonly mailer: MailService
+  ) {}
+
+  sign(user: UserClaim) {
+    const now = getUtcTimestamp();
+    return sign(
+      {
+        data: {
+          id: user.id,
+          name: user.name,
+          email: user.email,
+          emailVerified: user.emailVerified?.toISOString(),
+          image: user.avatarUrl,
+          hasPassword: Boolean(user.hasPassword),
+          createdAt: user.createdAt.toISOString(),
+        },
+        iat: now,
+        exp: now + this.config.auth.accessTokenExpiresIn,
+        iss: this.config.serverId,
+        sub: user.id,
+        aud: 'https://affine.pro',
+        jti: randomUUID({
+          disableEntropyCache: true,
+        }),
+      },
+      this.config.auth.privateKey,
+      {
+        algorithm: Algorithm.ES256,
+      }
+    );
+  }
+
+  refresh(user: UserClaim) {
+    const now = getUtcTimestamp();
+    return sign(
+      {
+        data: {
+          id: user.id,
+          name: user.name,
+          email: user.email,
+          emailVerified: user.emailVerified?.toISOString(),
+          image: user.avatarUrl,
+          hasPassword: Boolean(user.hasPassword),
+          createdAt: user.createdAt.toISOString(),
+        },
+        exp: now + this.config.auth.refreshTokenExpiresIn,
+        iat: now,
+        iss: this.config.serverId,
+        sub: user.id,
+        aud: 'https://affine.pro',
+        jti: randomUUID({
+          disableEntropyCache: true,
+        }),
+      },
+      this.config.auth.privateKey,
+      {
+        algorithm: Algorithm.ES256,
+      }
+    );
+  }
+
+  async verify(token: string) {
+    try {
+      const data = (
+        await jwtVerify(token, this.config.auth.publicKey, {
+          algorithms: [Algorithm.ES256],
+          iss: [this.config.serverId],
+          leeway: this.config.auth.leeway,
+          requiredSpecClaims: ['exp', 'iat', 'iss', 'sub'],
+          aud: ['https://affine.pro'],
+        })
+      ).data as UserClaim;
+
+      return {
+        ...data,
+        emailVerified: data.emailVerified ? new Date(data.emailVerified) : null,
+        createdAt: new Date(data.createdAt),
+      };
+    } catch (e) {
+      throw new UnauthorizedException('Invalid token');
+    }
+  }
+
+  async verifyCaptchaToken(token: any, ip: string) {
+    if (typeof token !== 'string' || !token) return false;
+
+    const formData = new FormData();
+    formData.append('secret', this.config.auth.captcha.turnstile.secret);
+    formData.append('response', token);
+    formData.append('remoteip', ip);
+    // prevent replay attack
+    formData.append('idempotency_key', nanoid());
+
+    const url = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
+    const result = await fetch(url, {
+      body: formData,
+      method: 'POST',
+    });
+    const outcome = await result.json();
+
+    return (
+      !!outcome.success &&
+      // skip hostname check in dev mode
+      (this.config.affineEnv === 'dev' || outcome.hostname === this.config.host)
+    );
+  }
+
+  async verifyChallengeResponse(response: any, resource: string) {
+    return verifyChallengeResponse(
+      response,
+      this.config.auth.captcha.challenge.bits,
+      resource
+    );
+  }
+
+  async signIn(email: string, password: string): Promise<User> {
+    const user = await this.prisma.user.findFirst({
+      where: {
+        email,
+      },
+    });
+
+    if (!user) {
+      throw new BadRequestException('Invalid email');
+    }
+
+    if (!user.password) {
+      throw new BadRequestException('User has no password');
+    }
+    let equal = false;
+    try {
+      equal = await verify(user.password, password);
+    } catch (e) {
+      console.error(e);
+      throw new InternalServerErrorException(e, 'Verify password failed');
+    }
+    if (!equal) {
+      throw new UnauthorizedException('Invalid password');
+    }
+
+    return user;
+  }
+
+  async signUp(name: string, email: string, password: string): Promise<User> {
+    const user = await this.prisma.user.findFirst({
+      where: {
+        email,
+      },
+    });
+
+    if (user) {
+      throw new BadRequestException('Email already exists');
+    }
+
+    const hashedPassword = await hash(password);
+
+    return this.prisma.user.create({
+      data: {
+        name,
+        email,
+        password: hashedPassword,
+        // TODO(@forehalo): handle in event system
+        features: {
+          create: {
+            reason: 'created by api sign up',
+            activated: true,
+            feature: {
+              connect: {
+                feature_version: Quota_FreePlanV1_1,
+              },
+            },
+          },
+        },
+      },
+    });
+  }
+
+  async createAnonymousUser(email: string): Promise<User> {
+    const user = await this.prisma.user.findFirst({
+      where: {
+        email,
+      },
+    });
+
+    if (user) {
+      throw new BadRequestException('Email already exists');
+    }
+
+    return this.prisma.user.create({
+      data: {
+        name: 'Unnamed',
+        email,
+        features: {
+          create: {
+            reason: 'created by invite sign up',
+            activated: true,
+            feature: {
+              connect: {
+                feature_version: Quota_FreePlanV1_1,
+              },
+            },
+          },
+        },
+      },
+    });
+  }
+
+  async getUserByEmail(email: string): Promise<User | null> {
+    return this.prisma.user.findUnique({
+      where: {
+        email,
+      },
+    });
+  }
+
+  async isUserHasPassword(email: string): Promise<boolean> {
+    const user = await this.prisma.user.findFirst({
+      where: {
+        email,
+      },
+    });
+    if (!user) {
+      throw new BadRequestException('Invalid email');
+    }
+    return Boolean(user.password);
+  }
+
+  async changePassword(email: string, newPassword: string): Promise<User> {
+    const user = await this.prisma.user.findUnique({
+      where: {
+        email,
+        emailVerified: {
+          not: null,
+        },
+      },
+    });
+
+    if (!user) {
+      throw new BadRequestException('Invalid email');
+    }
+
+    const hashedPassword = await hash(newPassword);
+
+    return this.prisma.user.update({
+      where: {
+        id: user.id,
+      },
+      data: {
+        password: hashedPassword,
+      },
+    });
+  }
+
+  async changeEmail(id: string, newEmail: string): Promise<User> {
+    const user = await this.prisma.user.findUnique({
+      where: {
+        id,
+      },
+    });
+
+    if (!user) {
+      throw new BadRequestException('Invalid email');
+    }
+
+    return this.prisma.user.update({
+      where: {
+        id,
+      },
+      data: {
+        email: newEmail,
+      },
+    });
+  }
+
+  async sendChangePasswordEmail(email: string, callbackUrl: string) {
+    return this.mailer.sendChangePasswordEmail(email, callbackUrl);
+  }
+  async sendSetPasswordEmail(email: string, callbackUrl: string) {
+    return this.mailer.sendSetPasswordEmail(email, callbackUrl);
+  }
+  async sendChangeEmail(email: string, callbackUrl: string) {
+    return this.mailer.sendChangeEmail(email, callbackUrl);
+  }
+  async sendVerifyChangeEmail(email: string, callbackUrl: string) {
+    return this.mailer.sendVerifyChangeEmail(email, callbackUrl);
+  }
+  async sendNotificationChangeEmail(email: string) {
+    return this.mailer.sendNotificationChangeEmail(email);
+  }
+}

packages/backend/server/src/core/auth/utils/index.ts

@@ -0,0 +1,3 @@
+export { jwtDecode as decode, jwtEncode as encode } from './jwt';
+export { sendVerificationRequest } from './send-mail';
+export type { SendVerificationRequestParams } from 'next-auth/providers/email';

packages/backend/server/src/core/auth/utils/jwt.ts

@@ -0,0 +1,75 @@
+import { randomUUID } from 'node:crypto';
+
+import { BadRequestException } from '@nestjs/common';
+import { Algorithm, sign, verify as jwtVerify } from '@node-rs/jsonwebtoken';
+import { JWT } from 'next-auth/jwt';
+
+import { Config, PrismaService } from '../../../fundamentals';
+import { getUtcTimestamp, UserClaim } from '../service';
+
+export const jwtEncode = async (
+  config: Config,
+  prisma: PrismaService,
+  token: JWT | undefined,
+  maxAge: number | undefined
+) => {
+  if (!token?.email) {
+    throw new BadRequestException('Missing email in jwt token');
+  }
+  const user = await prisma.user.findFirstOrThrow({
+    where: {
+      email: token.email,
+    },
+  });
+  const now = getUtcTimestamp();
+  return sign(
+    {
+      data: {
+        id: user.id,
+        name: user.name,
+        email: user.email,
+        emailVerified: user.emailVerified?.toISOString(),
+        picture: user.avatarUrl,
+        createdAt: user.createdAt.toISOString(),
+        hasPassword: Boolean(user.password),
+      },
+      iat: now,
+      exp: now + (maxAge ?? config.auth.accessTokenExpiresIn),
+      iss: config.serverId,
+      sub: user.id,
+      aud: 'https://affine.pro',
+      jti: randomUUID({
+        disableEntropyCache: true,
+      }),
+    },
+    config.auth.privateKey,
+    {
+      algorithm: Algorithm.ES256,
+    }
+  );
+};
+
+export const jwtDecode = async (config: Config, token: string | undefined) => {
+  if (!token) {
+    return null;
+  }
+  const { name, email, emailVerified, id, picture, hasPassword } = (
+    await jwtVerify(token, config.auth.publicKey, {
+      algorithms: [Algorithm.ES256],
+      iss: [config.serverId],
+      leeway: config.auth.leeway,
+      requiredSpecClaims: ['exp', 'iat', 'iss', 'sub'],
+    })
+  ).data as Omit<UserClaim, 'avatarUrl'> & {
+    picture: string | undefined;
+  };
+  return {
+    name,
+    email,
+    emailVerified,
+    picture,
+    sub: id,
+    id,
+    hasPassword,
+  };
+};

packages/backend/server/src/core/auth/utils/send-mail.ts

@@ -0,0 +1,39 @@
+import { Logger } from '@nestjs/common';
+import { nanoid } from 'nanoid';
+import type { SendVerificationRequestParams } from 'next-auth/providers/email';
+
+import { Config, MailService, SessionService } from '../../../fundamentals';
+
+export async function sendVerificationRequest(
+  config: Config,
+  logger: Logger,
+  mailer: MailService,
+  session: SessionService,
+  params: SendVerificationRequestParams
+) {
+  const { identifier, url, provider } = params;
+  const urlWithToken = new URL(url);
+  const callbackUrl = urlWithToken.searchParams.get('callbackUrl') || '';
+  if (!callbackUrl) {
+    throw new Error('callbackUrl is not set');
+  } else {
+    const newCallbackUrl = new URL(callbackUrl, config.origin);
+
+    const token = nanoid();
+    await session.set(token, identifier);
+    newCallbackUrl.searchParams.set('token', token);
+
+    urlWithToken.searchParams.set('callbackUrl', newCallbackUrl.toString());
+  }
+
+  const result = await mailer.sendSignInEmail(urlWithToken.toString(), {
+    to: identifier,
+    from: provider.from,
+  });
+  logger.log(`send verification email success: ${result.accepted.join(', ')}`);
+
+  const failed = result.rejected.concat(result.pending).filter(Boolean);
+  if (failed.length) {
+    throw new Error(`Email (${failed.join(', ')}) could not be sent`);
+  }
+}

packages/backend/server/src/core/config.ts

@@ -0,0 +1,58 @@
+import { Module } from '@nestjs/common';
+import { Field, ObjectType, Query, registerEnumType } from '@nestjs/graphql';
+
+export enum ServerFeature {
+  Payment = 'payment',
+}
+
+registerEnumType(ServerFeature, {
+  name: 'ServerFeature',
+});
+
+const ENABLED_FEATURES: ServerFeature[] = [];
+export function ADD_ENABLED_FEATURES(feature: ServerFeature) {
+  ENABLED_FEATURES.push(feature);
+}
+
+@ObjectType()
+export class ServerConfigType {
+  @Field({
+    description:
+      'server identical name could be shown as badge on user interface',
+  })
+  name!: string;
+
+  @Field({ description: 'server version' })
+  version!: string;
+
+  @Field({ description: 'server base url' })
+  baseUrl!: string;
+
+  /**
+   * @deprecated
+   */
+  @Field({ description: 'server flavor', deprecationReason: 'use `features`' })
+  flavor!: string;
+
+  @Field(() => [ServerFeature], { description: 'enabled server features' })
+  features!: ServerFeature[];
+}
+export class ServerConfigResolver {
+  @Query(() => ServerConfigType, {
+    description: 'server config',
+  })
+  serverConfig(): ServerConfigType {
+    return {
+      name: AFFiNE.serverName,
+      version: AFFiNE.version,
+      baseUrl: AFFiNE.baseUrl,
+      flavor: AFFiNE.flavor.type,
+      features: ENABLED_FEATURES,
+    };
+  }
+}
+
+@Module({
+  providers: [ServerConfigResolver],
+})
+export class ServerConfigModule {}

packages/backend/server/src/core/doc/history.ts

@@ -0,0 +1,259 @@
+import { isDeepStrictEqual } from 'node:util';
+
+import { Injectable, Logger } from '@nestjs/common';
+import { Cron, CronExpression } from '@nestjs/schedule';
+
+import {
+  Config,
+  type EventPayload,
+  metrics,
+  OnEvent,
+  PrismaService,
+} from '../../fundamentals';
+import { QuotaService } from '../quota';
+import { Permission } from '../workspaces/types';
+import { isEmptyBuffer } from './manager';
+
+@Injectable()
+export class DocHistoryManager {
+  private readonly logger = new Logger(DocHistoryManager.name);
+  constructor(
+    private readonly config: Config,
+    private readonly db: PrismaService,
+    private readonly quota: QuotaService
+  ) {}
+
+  @OnEvent('workspace.deleted')
+  onWorkspaceDeleted(workspaceId: EventPayload<'workspace.deleted'>) {
+    return this.db.snapshotHistory.deleteMany({
+      where: {
+        workspaceId,
+      },
+    });
+  }
+
+  @OnEvent('snapshot.deleted')
+  onSnapshotDeleted({ workspaceId, id }: EventPayload<'snapshot.deleted'>) {
+    return this.db.snapshotHistory.deleteMany({
+      where: {
+        workspaceId,
+        id,
+      },
+    });
+  }
+
+  @OnEvent('snapshot.updated')
+  async onDocUpdated(
+    { workspaceId, id, previous }: EventPayload<'snapshot.updated'>,
+    forceCreate = false
+  ) {
+    const last = await this.last(workspaceId, id);
+
+    let shouldCreateHistory = false;
+
+    if (!last) {
+      // never created
+      shouldCreateHistory = true;
+    } else if (last.timestamp === previous.updatedAt) {
+      // no change
+      shouldCreateHistory = false;
+    } else if (
+      // force
+      forceCreate ||
+      // last history created before interval in configs
+      last.timestamp.getTime() <
+        previous.updatedAt.getTime() - this.config.doc.history.interval
+    ) {
+      shouldCreateHistory = true;
+    }
+
+    if (shouldCreateHistory) {
+      // skip the history recording when no actual update on snapshot happended
+      if (last && isDeepStrictEqual(last.state, previous.state)) {
+        this.logger.debug(
+          `State matches, skip creating history record for ${id} in workspace ${workspaceId}`
+        );
+        return;
+      }
+
+      if (isEmptyBuffer(previous.blob)) {
+        this.logger.debug(
+          `Doc is empty, skip creating history record for ${id} in workspace ${workspaceId}`
+        );
+        return;
+      }
+
+      await this.db.snapshotHistory
+        .create({
+          select: {
+            timestamp: true,
+          },
+          data: {
+            workspaceId,
+            id,
+            timestamp: previous.updatedAt,
+            blob: previous.blob,
+            state: previous.state,
+            expiredAt: await this.getExpiredDateFromNow(workspaceId),
+          },
+        })
+        .catch(() => {
+          // safe to ignore
+          // only happens when duplicated history record created in multi processes
+        });
+      metrics.doc
+        .counter('history_created_counter', {
+          description: 'How many times the snapshot history created',
+        })
+        .add(1);
+      this.logger.log(`History created for ${id} in workspace ${workspaceId}.`);
+    }
+  }
+
+  async list(
+    workspaceId: string,
+    id: string,
+    before: Date = new Date(),
+    take: number = 10
+  ) {
+    return this.db.snapshotHistory.findMany({
+      select: {
+        timestamp: true,
+      },
+      where: {
+        workspaceId,
+        id,
+        timestamp: {
+          lt: before,
+        },
+        // only include the ones has not expired
+        expiredAt: {
+          gt: new Date(),
+        },
+      },
+      orderBy: {
+        timestamp: 'desc',
+      },
+      take,
+    });
+  }
+
+  async count(workspaceId: string, id: string) {
+    return this.db.snapshotHistory.count({
+      where: {
+        workspaceId,
+        id,
+        expiredAt: {
+          gt: new Date(),
+        },
+      },
+    });
+  }
+
+  async get(workspaceId: string, id: string, timestamp: Date) {
+    return this.db.snapshotHistory.findUnique({
+      where: {
+        workspaceId_id_timestamp: {
+          workspaceId,
+          id,
+          timestamp,
+        },
+        expiredAt: {
+          gt: new Date(),
+        },
+      },
+    });
+  }
+
+  async last(workspaceId: string, id: string) {
+    return this.db.snapshotHistory.findFirst({
+      where: {
+        workspaceId,
+        id,
+      },
+      select: {
+        timestamp: true,
+        state: true,
+      },
+      orderBy: {
+        timestamp: 'desc',
+      },
+    });
+  }
+
+  async recover(workspaceId: string, id: string, timestamp: Date) {
+    const history = await this.db.snapshotHistory.findUnique({
+      where: {
+        workspaceId_id_timestamp: {
+          workspaceId,
+          id,
+          timestamp,
+        },
+      },
+    });
+
+    if (!history) {
+      throw new Error('Given history not found');
+    }
+
+    const oldSnapshot = await this.db.snapshot.findUnique({
+      where: {
+        id_workspaceId: {
+          id,
+          workspaceId,
+        },
+      },
+    });
+
+    if (!oldSnapshot) {
+      // unreachable actually
+      throw new Error('Given Doc not found');
+    }
+
+    // save old snapshot as one history record
+    await this.onDocUpdated({ workspaceId, id, previous: oldSnapshot }, true);
+    // WARN:
+    //  we should never do the snapshot updating in recovering,
+    //  which is not the solution in CRDT.
+    //  let user revert in client and update the data in sync system
+    //    `await this.db.snapshot.update();`
+    metrics.doc
+      .counter('history_recovered_counter', {
+        description: 'How many times history recovered request happened',
+      })
+      .add(1);
+
+    return history.timestamp;
+  }
+
+  async getExpiredDateFromNow(workspaceId: string) {
+    const permission = await this.db.workspaceUserPermission.findFirst({
+      select: {
+        userId: true,
+      },
+      where: {
+        workspaceId,
+        type: Permission.Owner,
+      },
+    });
+
+    if (!permission) {
+      // unreachable actually
+      throw new Error('Workspace owner not found');
+    }
+
+    const quota = await this.quota.getUserQuota(permission.userId);
+    return quota.feature.historyPeriodFromNow;
+  }
+
+  @Cron(CronExpression.EVERY_DAY_AT_MIDNIGHT /* everyday at 12am */)
+  async cleanupExpiredHistory() {
+    await this.db.snapshotHistory.deleteMany({
+      where: {
+        expiredAt: {
+          lte: new Date(),
+        },
+      },
+    });
+  }
+}

packages/backend/server/src/core/doc/index.ts

@@ -0,0 +1,14 @@
+import { Module } from '@nestjs/common';
+
+import { QuotaModule } from '../quota';
+import { DocHistoryManager } from './history';
+import { DocManager } from './manager';
+
+@Module({
+  imports: [QuotaModule],
+  providers: [DocManager, DocHistoryManager],
+  exports: [DocManager, DocHistoryManager],
+})
+export class DocModule {}
+
+export { DocHistoryManager, DocManager };

packages/backend/server/src/core/doc/manager.ts

@@ -0,0 +1,737 @@
+import {
+  Injectable,
+  Logger,
+  OnModuleDestroy,
+  OnModuleInit,
+} from '@nestjs/common';
+import { Snapshot, Update } from '@prisma/client';
+import { chunk } from 'lodash-es';
+import { defer, retry } from 'rxjs';
+import {
+  applyUpdate,
+  decodeStateVector,
+  Doc,
+  encodeStateAsUpdate,
+  encodeStateVector,
+  transact,
+} from 'yjs';
+
+import {
+  Cache,
+  Config,
+  EventEmitter,
+  type EventPayload,
+  mergeUpdatesInApplyWay as jwstMergeUpdates,
+  metrics,
+  OnEvent,
+  PrismaService,
+} from '../../fundamentals';
+
+function compare(yBinary: Buffer, jwstBinary: Buffer, strict = false): boolean {
+  if (yBinary.equals(jwstBinary)) {
+    return true;
+  }
+
+  if (strict) {
+    return false;
+  }
+
+  const doc = new Doc();
+  applyUpdate(doc, jwstBinary);
+
+  const yBinary2 = Buffer.from(encodeStateAsUpdate(doc));
+
+  return compare(yBinary, yBinary2, true);
+}
+
+/**
+ * Detect whether rhs state is newer than lhs state.
+ *
+ * How could we tell a state is newer:
+ *
+ *   i. if the state vector size is larger, it's newer
+ *  ii. if the state vector size is same, compare each client's state
+ */
+function isStateNewer(lhs: Buffer, rhs: Buffer): boolean {
+  const lhsVector = decodeStateVector(lhs);
+  const rhsVector = decodeStateVector(rhs);
+
+  if (lhsVector.size < rhsVector.size) {
+    return true;
+  }
+
+  for (const [client, state] of lhsVector) {
+    const rstate = rhsVector.get(client);
+    if (!rstate) {
+      return false;
+    }
+
+    if (state < rstate) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+export function isEmptyBuffer(buf: Buffer): boolean {
+  return (
+    buf.length === 0 ||
+    // 0x0000
+    (buf.length === 2 && buf[0] === 0 && buf[1] === 0)
+  );
+}
+
+const MAX_SEQ_NUM = 0x3fffffff; // u31
+
+/**
+ * Since we can't directly save all client updates into database, in which way the database will overload,
+ * we need to buffer the updates and merge them to reduce db write.
+ *
+ * And also, if a new client join, it would be nice to see the latest doc asap,
+ * so we need to at least store a snapshot of the doc and return quickly,
+ * along side all the updates that have not been applies to that snapshot(timestamp).
+ */
+@Injectable()
+export class DocManager implements OnModuleInit, OnModuleDestroy {
+  private readonly logger = new Logger(DocManager.name);
+  private job: NodeJS.Timeout | null = null;
+  private readonly seqMap = new Map<string, number>();
+  private busy = false;
+
+  constructor(
+    private readonly db: PrismaService,
+    private readonly config: Config,
+    private readonly cache: Cache,
+    private readonly event: EventEmitter
+  ) {}
+
+  onModuleInit() {
+    if (this.config.doc.manager.enableUpdateAutoMerging) {
+      this.logger.log('Use Database');
+      this.setup();
+    }
+  }
+
+  onModuleDestroy() {
+    this.destroy();
+  }
+
+  private recoverDoc(...updates: Buffer[]): Promise<Doc> {
+    const doc = new Doc();
+    const chunks = chunk(updates, 10);
+
+    return new Promise(resolve => {
+      const next = () => {
+        const updates = chunks.shift();
+        if (updates?.length) {
+          transact(doc, () => {
+            updates.forEach(u => {
+              try {
+                applyUpdate(doc, u);
+              } catch (e) {
+                this.logger.error('Failed to apply update', e);
+              }
+            });
+          });
+
+          // avoid applying too many updates in single round which will take the whole cpu time like dead lock
+          setImmediate(() => {
+            next();
+          });
+        } else {
+          resolve(doc);
+        }
+      };
+
+      next();
+    });
+  }
+
+  private async applyUpdates(guid: string, ...updates: Buffer[]): Promise<Doc> {
+    const doc = await this.recoverDoc(...updates);
+
+    // test jwst codec
+    if (
+      this.config.affine.canary &&
+      this.config.doc.manager.experimentalMergeWithJwstCodec &&
+      updates.length < 100 /* avoid overloading */
+    ) {
+      metrics.jwst.counter('codec_merge_counter').add(1);
+      const yjsResult = Buffer.from(encodeStateAsUpdate(doc));
+      let log = false;
+      try {
+        const jwstResult = jwstMergeUpdates(updates);
+        if (!compare(yjsResult, jwstResult)) {
+          metrics.jwst.counter('codec_not_match').add(1);
+          this.logger.warn(
+            `jwst codec result doesn't match yjs codec result for: ${guid}`
+          );
+          log = true;
+          if (this.config.node.dev) {
+            this.logger.warn(`Expected:\n  ${yjsResult.toString('hex')}`);
+            this.logger.warn(`Result:\n  ${jwstResult.toString('hex')}`);
+          }
+        }
+      } catch (e) {
+        metrics.jwst.counter('codec_fails_counter').add(1);
+        this.logger.warn(`jwst apply update failed for ${guid}: ${e}`);
+        log = true;
+      } finally {
+        if (log && this.config.node.dev) {
+          this.logger.warn(
+            `Updates: ${updates.map(u => u.toString('hex')).join('\n')}`
+          );
+        }
+      }
+    }
+
+    return doc;
+  }
+
+  /**
+   * setup pending update processing loop
+   */
+  setup() {
+    this.job = setInterval(() => {
+      if (!this.busy) {
+        this.busy = true;
+        this.autoSquash()
+          .catch(() => {
+            /* we handle all errors in work itself */
+          })
+          .finally(() => {
+            this.busy = false;
+          });
+      }
+    }, this.config.doc.manager.updatePollInterval);
+
+    this.logger.log('Automation started');
+    if (this.config.doc.manager.experimentalMergeWithJwstCodec) {
+      this.logger.warn(
+        'Experimental feature enabled: merge updates with jwst codec is enabled'
+      );
+    }
+  }
+
+  /**
+   * stop pending update processing loop
+   */
+  destroy() {
+    if (this.job) {
+      clearInterval(this.job);
+      this.job = null;
+      this.logger.log('Automation stopped');
+    }
+  }
+
+  @OnEvent('workspace.deleted')
+  async onWorkspaceDeleted(workspaceId: string) {
+    await this.db.snapshot.deleteMany({
+      where: {
+        workspaceId,
+      },
+    });
+    await this.db.update.deleteMany({
+      where: {
+        workspaceId,
+      },
+    });
+  }
+
+  @OnEvent('snapshot.deleted')
+  async onSnapshotDeleted({
+    id,
+    workspaceId,
+  }: EventPayload<'snapshot.deleted'>) {
+    await this.db.update.deleteMany({
+      where: {
+        id,
+        workspaceId,
+      },
+    });
+  }
+
+  /**
+   * add update to manager for later processing.
+   */
+  async push(
+    workspaceId: string,
+    guid: string,
+    update: Buffer,
+    retryTimes = 10
+  ) {
+    await new Promise<void>((resolve, reject) => {
+      defer(async () => {
+        const seq = await this.getUpdateSeq(workspaceId, guid);
+        await this.db.update.create({
+          select: {
+            seq: true,
+          },
+          data: {
+            workspaceId,
+            id: guid,
+            seq,
+            blob: update,
+          },
+        });
+      })
+        .pipe(retry(retryTimes)) // retry until seq num not conflict
+        .subscribe({
+          next: () => {
+            this.logger.debug(
+              `pushed 1 update for ${guid} in workspace ${workspaceId}`
+            );
+            resolve();
+          },
+          error: e => {
+            this.logger.error('Failed to push updates', e);
+            reject(new Error('Failed to push update'));
+          },
+        });
+    }).then(() => {
+      return this.updateCachedUpdatesCount(workspaceId, guid, 1);
+    });
+  }
+
+  async batchPush(
+    workspaceId: string,
+    guid: string,
+    updates: Buffer[],
+    retryTimes = 10
+  ) {
+    await new Promise<void>((resolve, reject) => {
+      defer(async () => {
+        const seq = await this.getUpdateSeq(workspaceId, guid, updates.length);
+        let turn = 0;
+        const batchCount = 10;
+        for (const batch of chunk(updates, batchCount)) {
+          await this.db.update.createMany({
+            data: batch.map((update, i) => ({
+              workspaceId,
+              id: guid,
+              // `seq` is the last seq num of the batch
+              // example for 11 batched updates, start from seq num 20
+              // seq for first update in the batch should be:
+              // 31             - 11                + 0        * 10          + 0 + 1 = 21
+              // ^ last seq num   ^ updates.length    ^ turn     ^ batchCount  ^i
+              seq: seq - updates.length + turn * batchCount + i + 1,
+              blob: update,
+            })),
+          });
+          turn++;
+        }
+      })
+        .pipe(retry(retryTimes)) // retry until seq num not conflict
+        .subscribe({
+          next: () => {
+            this.logger.debug(
+              `pushed ${updates.length} updates for ${guid} in workspace ${workspaceId}`
+            );
+            resolve();
+          },
+          error: e => {
+            this.logger.error('Failed to push updates', e);
+            reject(new Error('Failed to push update'));
+          },
+        });
+    }).then(() => {
+      return this.updateCachedUpdatesCount(workspaceId, guid, updates.length);
+    });
+  }
+
+  /**
+   * get the latest doc with all update applied.
+   */
+  async get(workspaceId: string, guid: string): Promise<Doc | null> {
+    const result = await this._get(workspaceId, guid);
+    if (result) {
+      if ('doc' in result) {
+        return result.doc;
+      } else if ('snapshot' in result) {
+        return this.recoverDoc(result.snapshot);
+      }
+    }
+
+    return null;
+  }
+
+  /**
+   * get the latest doc binary with all update applied.
+   */
+  async getBinary(workspaceId: string, guid: string): Promise<Buffer | null> {
+    const result = await this._get(workspaceId, guid);
+    if (result) {
+      if ('doc' in result) {
+        return Buffer.from(encodeStateAsUpdate(result.doc));
+      } else if ('snapshot' in result) {
+        return result.snapshot;
+      }
+    }
+
+    return null;
+  }
+
+  /**
+   * get the latest doc state vector with all update applied.
+   */
+  async getState(workspaceId: string, guid: string): Promise<Buffer | null> {
+    const snapshot = await this.getSnapshot(workspaceId, guid);
+    const updates = await this.getUpdates(workspaceId, guid);
+
+    if (updates.length) {
+      const doc = await this.squash(updates, snapshot);
+      return Buffer.from(encodeStateVector(doc));
+    }
+
+    return snapshot ? snapshot.state : null;
+  }
+
+  /**
+   * get the snapshot of the doc we've seen.
+   */
+  async getSnapshot(workspaceId: string, guid: string) {
+    return this.db.snapshot.findUnique({
+      where: {
+        id_workspaceId: {
+          workspaceId,
+          id: guid,
+        },
+      },
+    });
+  }
+
+  /**
+   * get pending updates
+   */
+  async getUpdates(workspaceId: string, guid: string) {
+    const updates = await this.db.update.findMany({
+      where: {
+        workspaceId,
+        id: guid,
+      },
+      // take it ease, we don't want to overload db and or cpu
+      // if we limit the taken number here,
+      // user will never see the latest doc if there are too many updates pending to be merged.
+      take: 100,
+    });
+
+    // perf(memory): avoid sorting in db
+    return updates.sort((a, b) => (a.createdAt < b.createdAt ? -1 : 1));
+  }
+
+  /**
+   * apply pending updates to snapshot
+   */
+  private async autoSquash() {
+    // find the first update and batch process updates with same id
+    const candidate = await this.getAutoSquashCandidate();
+
+    // no pending updates
+    if (!candidate) {
+      return;
+    }
+
+    const { id, workspaceId } = candidate;
+
+    await this.lockUpdatesForAutoSquash(workspaceId, id, async () => {
+      try {
+        await this._get(workspaceId, id);
+      } catch (e) {
+        this.logger.error(
+          `Failed to apply updates for workspace: ${workspaceId}, guid: ${id}`
+        );
+        this.logger.error(e);
+      }
+    });
+  }
+
+  private async getAutoSquashCandidate() {
+    const cache = await this.getAutoSquashCandidateFromCache();
+
+    if (cache) {
+      return cache;
+    }
+
+    return this.db.update.findFirst({
+      select: {
+        id: true,
+        workspaceId: true,
+      },
+    });
+  }
+
+  private async upsert(
+    workspaceId: string,
+    guid: string,
+    doc: Doc,
+    // we always delay the snapshot update to avoid db overload,
+    // so the value of `updatedAt` will not be accurate to user's real action time
+    updatedAt: Date,
+    initialSeq?: number
+  ) {
+    return this.lockSnapshotForUpsert(workspaceId, guid, async () => {
+      const blob = Buffer.from(encodeStateAsUpdate(doc));
+
+      if (isEmptyBuffer(blob)) {
+        return false;
+      }
+
+      const state = Buffer.from(encodeStateVector(doc));
+
+      return await this.db.$transaction(async db => {
+        const snapshot = await db.snapshot.findUnique({
+          where: {
+            id_workspaceId: {
+              id: guid,
+              workspaceId,
+            },
+          },
+        });
+
+        // update
+        if (snapshot) {
+          // only update if state is newer
+          if (isStateNewer(snapshot.state ?? Buffer.from([0]), state)) {
+            await db.snapshot.update({
+              select: {
+                seq: true,
+              },
+              where: {
+                id_workspaceId: {
+                  workspaceId,
+                  id: guid,
+                },
+              },
+              data: {
+                blob,
+                state,
+                updatedAt,
+              },
+            });
+
+            return true;
+          } else {
+            return false;
+          }
+        } else {
+          // create
+          await db.snapshot.create({
+            select: {
+              seq: true,
+            },
+            data: {
+              id: guid,
+              workspaceId,
+              blob,
+              state,
+              seq: initialSeq,
+              createdAt: updatedAt,
+              updatedAt,
+            },
+          });
+
+          return true;
+        }
+      });
+    });
+  }
+
+  private async _get(
+    workspaceId: string,
+    guid: string
+  ): Promise<{ doc: Doc } | { snapshot: Buffer } | null> {
+    const snapshot = await this.getSnapshot(workspaceId, guid);
+    const updates = await this.getUpdates(workspaceId, guid);
+
+    if (updates.length) {
+      return {
+        doc: await this.squash(updates, snapshot),
+      };
+    }
+
+    return snapshot ? { snapshot: snapshot.blob } : null;
+  }
+
+  /**
+   * Squash updates into a single update and save it as snapshot,
+   * and delete the updates records at the same time.
+   */
+  private async squash(updates: Update[], snapshot: Snapshot | null) {
+    if (!updates.length) {
+      throw new Error('No updates to squash');
+    }
+    const first = updates[0];
+    const last = updates[updates.length - 1];
+
+    const { id, workspaceId } = first;
+
+    const doc = await this.applyUpdates(
+      first.id,
+      snapshot ? snapshot.blob : Buffer.from([0, 0]),
+      ...updates.map(u => u.blob)
+    );
+
+    const done = await this.upsert(
+      workspaceId,
+      id,
+      doc,
+      last.createdAt,
+      last.seq
+    );
+
+    if (done) {
+      if (snapshot) {
+        this.event.emit('snapshot.updated', {
+          id,
+          workspaceId,
+          previous: {
+            blob: snapshot.blob,
+            state: snapshot.state,
+            updatedAt: snapshot.updatedAt,
+          },
+        });
+      }
+
+      this.logger.debug(
+        `Squashed ${updates.length} updates for ${id} in workspace ${workspaceId}`
+      );
+    }
+
+    // always delete updates
+    // the upsert will return false if the state is not newer, so we don't need to worry about it
+    const { count } = await this.db.update.deleteMany({
+      where: {
+        id,
+        workspaceId,
+        seq: {
+          in: updates.map(u => u.seq),
+        },
+      },
+    });
+
+    await this.updateCachedUpdatesCount(workspaceId, id, -count);
+
+    return doc;
+  }
+
+  private async getUpdateSeq(workspaceId: string, guid: string, batch = 1) {
+    try {
+      const { seq } = await this.db.snapshot.update({
+        select: {
+          seq: true,
+        },
+        where: {
+          id_workspaceId: {
+            workspaceId,
+            id: guid,
+          },
+        },
+        data: {
+          seq: {
+            increment: batch,
+          },
+        },
+      });
+
+      // reset
+      if (seq >= MAX_SEQ_NUM) {
+        await this.db.snapshot.update({
+          select: {
+            seq: true,
+          },
+          where: {
+            id_workspaceId: {
+              workspaceId,
+              id: guid,
+            },
+          },
+          data: {
+            seq: 0,
+          },
+        });
+      }
+
+      return seq;
+    } catch {
+      // not existing snapshot just count it from 1
+      const last = this.seqMap.get(workspaceId + guid) ?? 0;
+      this.seqMap.set(workspaceId + guid, last + batch);
+      return last + batch;
+    }
+  }
+
+  private async updateCachedUpdatesCount(
+    workspaceId: string,
+    guid: string,
+    count: number
+  ) {
+    const result = await this.cache.mapIncrease(
+      `doc:manager:updates`,
+      `${workspaceId}::${guid}`,
+      count
+    );
+
+    if (result <= 0) {
+      await this.cache.mapDelete(
+        `doc:manager:updates`,
+        `${workspaceId}::${guid}`
+      );
+    }
+  }
+
+  private async getAutoSquashCandidateFromCache() {
+    const key = await this.cache.mapRandomKey('doc:manager:updates');
+
+    if (key) {
+      const count = await this.cache.mapGet<number>('doc:manager:updates', key);
+      if (typeof count === 'number' && count > 0) {
+        const [workspaceId, id] = key.split('::');
+        return { id, workspaceId };
+      }
+    }
+
+    return null;
+  }
+
+  private async doWithLock<T>(lock: string, job: () => Promise<T>) {
+    const acquired = await this.cache.setnx(lock, 1, {
+      ttl: 60 * 1000,
+    });
+
+    if (!acquired) {
+      return;
+    }
+
+    try {
+      return await job();
+    } finally {
+      await this.cache.delete(lock).catch(e => {
+        // safe, the lock will be expired when ttl ends
+        this.logger.error(`Failed to release lock ${lock}`, e);
+      });
+    }
+  }
+
+  private async lockUpdatesForAutoSquash<T>(
+    workspaceId: string,
+    guid: string,
+    job: () => Promise<T>
+  ) {
+    return this.doWithLock(
+      `doc:manager:updates-lock:${workspaceId}::${guid}`,
+      job
+    );
+  }
+
+  async lockSnapshotForUpsert<T>(
+    workspaceId: string,
+    guid: string,
+    job: () => Promise<T>
+  ) {
+    return this.doWithLock(
+      `doc:manager:snapshot-lock:${workspaceId}::${guid}`,
+      job
+    );
+  }
+}

packages/backend/server/src/core/features/feature.ts

@@ -0,0 +1,98 @@
+import { PrismaClient } from '@prisma/client';
+
+import { Feature, FeatureSchema, FeatureType } from './types';
+
+class FeatureConfig {
+  readonly config: Feature;
+
+  constructor(data: any) {
+    const config = FeatureSchema.safeParse(data);
+    if (config.success) {
+      this.config = config.data;
+    } else {
+      throw new Error(`Invalid quota config: ${config.error.message}`);
+    }
+  }
+
+  /// feature name of quota
+  get name() {
+    return this.config.feature;
+  }
+}
+
+export class CopilotFeatureConfig extends FeatureConfig {
+  override config!: Feature & { feature: FeatureType.Copilot };
+  constructor(data: any) {
+    super(data);
+
+    if (this.config.feature !== FeatureType.Copilot) {
+      throw new Error('Invalid feature config: type is not Copilot');
+    }
+  }
+}
+
+export class EarlyAccessFeatureConfig extends FeatureConfig {
+  override config!: Feature & { feature: FeatureType.EarlyAccess };
+
+  constructor(data: any) {
+    super(data);
+
+    if (this.config.feature !== FeatureType.EarlyAccess) {
+      throw new Error('Invalid feature config: type is not EarlyAccess');
+    }
+  }
+}
+
+export class UnlimitedWorkspaceFeatureConfig extends FeatureConfig {
+  override config!: Feature & { feature: FeatureType.UnlimitedWorkspace };
+
+  constructor(data: any) {
+    super(data);
+
+    if (this.config.feature !== FeatureType.UnlimitedWorkspace) {
+      throw new Error('Invalid feature config: type is not EarlyAccess');
+    }
+  }
+}
+
+const FeatureConfigMap = {
+  [FeatureType.Copilot]: CopilotFeatureConfig,
+  [FeatureType.EarlyAccess]: EarlyAccessFeatureConfig,
+  [FeatureType.UnlimitedWorkspace]: UnlimitedWorkspaceFeatureConfig,
+};
+
+export type FeatureConfigType<F extends FeatureType> = InstanceType<
+  (typeof FeatureConfigMap)[F]
+>;
+
+const FeatureCache = new Map<number, FeatureConfigType<FeatureType>>();
+
+export async function getFeature(prisma: PrismaClient, featureId: number) {
+  const cachedQuota = FeatureCache.get(featureId);
+
+  if (cachedQuota) {
+    return cachedQuota;
+  }
+
+  const feature = await prisma.features.findFirst({
+    where: {
+      id: featureId,
+    },
+  });
+  if (!feature) {
+    // this should unreachable
+    throw new Error(`Quota config ${featureId} not found`);
+  }
+  const ConfigClass = FeatureConfigMap[feature.feature as FeatureType];
+
+  if (!ConfigClass) {
+    throw new Error(`Feature config ${featureId} not found`);
+  }
+
+  const config = new ConfigClass(feature);
+  // we always edit quota config as a new quota config
+  // so we can cache it by featureId
+  FeatureCache.set(featureId, config);
+
+  return config;
+}

packages/backend/server/src/core/features/index.ts

@@ -0,0 +1,20 @@
+import { Module } from '@nestjs/common';
+
+import { FeatureManagementService } from './management';
+import { FeatureService } from './service';
+
+/**
+ * Feature module provider pre-user feature flag management.
+ * includes:
+ * - feature query/update/permit
+ * - feature statistics
+ */
+@Module({
+  providers: [FeatureService, FeatureManagementService],
+  exports: [FeatureService, FeatureManagementService],
+})
+export class FeatureModule {}
+
+export { type CommonFeature, commonFeatureSchema } from './types';
+export { FeatureKind, Features, FeatureType } from './types';
+export { FeatureManagementService, FeatureService };

packages/backend/server/src/core/features/management.ts

@@ -0,0 +1,114 @@
+import { Injectable, Logger } from '@nestjs/common';
+
+import { Config, PrismaService } from '../../fundamentals';
+import { FeatureService } from './service';
+import { FeatureType } from './types';
+
+const STAFF = ['@toeverything.info'];
+
+@Injectable()
+export class FeatureManagementService {
+  protected logger = new Logger(FeatureManagementService.name);
+
+  constructor(
+    private readonly feature: FeatureService,
+    private readonly prisma: PrismaService,
+    private readonly config: Config
+  ) {}
+
+  // ======== Admin ========
+
+  // todo(@darkskygit): replace this with abac
+  isStaff(email: string) {
+    for (const domain of STAFF) {
+      if (email.endsWith(domain)) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  // ======== Early Access ========
+
+  async addEarlyAccess(userId: string) {
+    return this.feature.addUserFeature(
+      userId,
+      FeatureType.EarlyAccess,
+      2,
+      'Early access user'
+    );
+  }
+
+  async removeEarlyAccess(userId: string) {
+    return this.feature.removeUserFeature(userId, FeatureType.EarlyAccess);
+  }
+
+  async listEarlyAccess() {
+    return this.feature.listFeatureUsers(FeatureType.EarlyAccess);
+  }
+
+  async isEarlyAccessUser(email: string) {
+    const user = await this.prisma.user.findFirst({
+      where: {
+        email,
+      },
+    });
+    if (user) {
+      const canEarlyAccess = await this.feature
+        .hasUserFeature(user.id, FeatureType.EarlyAccess)
+        .catch(() => false);
+
+      return canEarlyAccess;
+    }
+    return false;
+  }
+
+  /// check early access by email
+  async canEarlyAccess(email: string) {
+    if (this.config.featureFlags.earlyAccessPreview && !this.isStaff(email)) {
+      return this.isEarlyAccessUser(email);
+    } else {
+      return true;
+    }
+  }
+
+  // ======== Workspace Feature ========
+  async addWorkspaceFeatures(
+    workspaceId: string,
+    feature: FeatureType,
+    version?: number,
+    reason?: string
+  ) {
+    const latestVersions = await this.feature.getFeaturesVersion();
+    // use latest version if not specified
+    const latestVersion = version || latestVersions[feature];
+    if (!Number.isInteger(latestVersion)) {
+      throw new Error(`Version of feature ${feature} not found`);
+    }
+    return this.feature.addWorkspaceFeature(
+      workspaceId,
+      feature,
+      latestVersion,
+      reason || 'add feature by api'
+    );
+  }
+
+  async getWorkspaceFeatures(workspaceId: string) {
+    const features = await this.feature.getWorkspaceFeatures(workspaceId);
+    return features.filter(f => f.activated).map(f => f.feature.name);
+  }
+
+  async hasWorkspaceFeature(workspaceId: string, feature: FeatureType) {
+    return this.feature.hasWorkspaceFeature(workspaceId, feature);
+  }
+
+  async removeWorkspaceFeature(workspaceId: string, feature: FeatureType) {
+    return this.feature
+      .removeWorkspaceFeature(workspaceId, feature)
+      .then(c => c > 0);
+  }
+
+  async listFeatureWorkspaces(feature: FeatureType) {
+    return this.feature.listFeatureWorkspaces(feature);
+  }
+}

packages/backend/server/src/core/features/service.ts

@@ -0,0 +1,342 @@
+import { Injectable } from '@nestjs/common';
+
+import { PrismaService } from '../../fundamentals';
+import { UserType } from '../users/types';
+import { WorkspaceType } from '../workspaces/types';
+import { FeatureConfigType, getFeature } from './feature';
+import { FeatureKind, FeatureType } from './types';
+
+@Injectable()
+export class FeatureService {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async getFeaturesVersion() {
+    const features = await this.prisma.features.findMany({
+      where: {
+        type: FeatureKind.Feature,
+      },
+      select: {
+        feature: true,
+        version: true,
+      },
+    });
+    return features.reduce(
+      (acc, feature) => {
+        // only keep the latest version
+        if (acc[feature.feature]) {
+          if (acc[feature.feature] < feature.version) {
+            acc[feature.feature] = feature.version;
+          }
+        } else {
+          acc[feature.feature] = feature.version;
+        }
+        return acc;
+      },
+      {} as Record<string, number>
+    );
+  }
+
+  async getFeature<F extends FeatureType>(
+    feature: F
+  ): Promise<FeatureConfigType<F> | undefined> {
+    const data = await this.prisma.features.findFirst({
+      where: {
+        feature,
+        type: FeatureKind.Feature,
+      },
+      select: { id: true },
+      orderBy: {
+        version: 'desc',
+      },
+    });
+    if (data) {
+      return getFeature(this.prisma, data.id) as FeatureConfigType<F>;
+    }
+    return undefined;
+  }
+
+  // ======== User Features ========
+
+  async addUserFeature(
+    userId: string,
+    feature: FeatureType,
+    version: number,
+    reason: string,
+    expiredAt?: Date | string
+  ) {
+    return this.prisma.$transaction(async tx => {
+      const latestFlag = await tx.userFeatures.findFirst({
+        where: {
+          userId,
+          feature: {
+            feature,
+            type: FeatureKind.Feature,
+          },
+          activated: true,
+        },
+        orderBy: {
+          createdAt: 'desc',
+        },
+      });
+      if (latestFlag) {
+        return latestFlag.id;
+      } else {
+        return tx.userFeatures
+          .create({
+            data: {
+              reason,
+              expiredAt,
+              activated: true,
+              user: {
+                connect: {
+                  id: userId,
+                },
+              },
+              feature: {
+                connect: {
+                  feature_version: {
+                    feature,
+                    version,
+                  },
+                  type: FeatureKind.Feature,
+                },
+              },
+            },
+          })
+          .then(r => r.id);
+      }
+    });
+  }
+
+  async removeUserFeature(userId: string, feature: FeatureType) {
+    return this.prisma.userFeatures
+      .updateMany({
+        where: {
+          userId,
+          feature: {
+            feature,
+            type: FeatureKind.Feature,
+          },
+          activated: true,
+        },
+        data: {
+          activated: false,
+        },
+      })
+      .then(r => r.count);
+  }
+
+  /**
+   * get user's features, will included inactivated features
+   * @param userId user id
+   * @returns list of features
+   */
+  async getUserFeatures(userId: string) {
+    const features = await this.prisma.userFeatures.findMany({
+      where: {
+        user: { id: userId },
+        feature: {
+          type: FeatureKind.Feature,
+        },
+      },
+      select: {
+        activated: true,
+        reason: true,
+        createdAt: true,
+        expiredAt: true,
+        featureId: true,
+      },
+    });
+
+    const configs = await Promise.all(
+      features.map(async feature => ({
+        ...feature,
+        feature: await getFeature(this.prisma, feature.featureId),
+      }))
+    );
+
+    return configs.filter(feature => !!feature.feature);
+  }
+
+  async listFeatureUsers(feature: FeatureType): Promise<UserType[]> {
+    return this.prisma.userFeatures
+      .findMany({
+        where: {
+          activated: true,
+          feature: {
+            feature: feature,
+            type: FeatureKind.Feature,
+          },
+        },
+        select: {
+          user: {
+            select: {
+              id: true,
+              name: true,
+              avatarUrl: true,
+              email: true,
+              emailVerified: true,
+              createdAt: true,
+            },
+          },
+        },
+      })
+      .then(users => users.map(user => user.user));
+  }
+
+  async hasUserFeature(userId: string, feature: FeatureType) {
+    return this.prisma.userFeatures
+      .count({
+        where: {
+          userId,
+          activated: true,
+          feature: {
+            feature,
+            type: FeatureKind.Feature,
+          },
+        },
+      })
+      .then(count => count > 0);
+  }
+
+  // ======== Workspace Features ========
+
+  async addWorkspaceFeature(
+    workspaceId: string,
+    feature: FeatureType,
+    version: number,
+    reason: string,
+    expiredAt?: Date | string
+  ) {
+    return this.prisma.$transaction(async tx => {
+      const latestFlag = await tx.workspaceFeatures.findFirst({
+        where: {
+          workspaceId,
+          feature: {
+            feature,
+            type: FeatureKind.Feature,
+          },
+          activated: true,
+        },
+        orderBy: {
+          createdAt: 'desc',
+        },
+      });
+      if (latestFlag) {
+        return latestFlag.id;
+      } else {
+        return tx.workspaceFeatures
+          .create({
+            data: {
+              reason,
+              expiredAt,
+              activated: true,
+              workspace: {
+                connect: {
+                  id: workspaceId,
+                },
+              },
+              feature: {
+                connect: {
+                  feature_version: {
+                    feature,
+                    version,
+                  },
+                  type: FeatureKind.Feature,
+                },
+              },
+            },
+          })
+          .then(r => r.id);
+      }
+    });
+  }
+
+  async removeWorkspaceFeature(workspaceId: string, feature: FeatureType) {
+    return this.prisma.workspaceFeatures
+      .updateMany({
+        where: {
+          workspaceId,
+          feature: {
+            feature,
+            type: FeatureKind.Feature,
+          },
+          activated: true,
+        },
+        data: {
+          activated: false,
+        },
+      })
+      .then(r => r.count);
+  }
+
+  /**
+   * get workspace's features, will included inactivated features
+   * @param workspaceId workspace id
+   * @returns list of features
+   */
+  async getWorkspaceFeatures(workspaceId: string) {
+    const features = await this.prisma.workspaceFeatures.findMany({
+      where: {
+        workspace: { id: workspaceId },
+        feature: {
+          type: FeatureKind.Feature,
+        },
+      },
+      select: {
+        activated: true,
+        reason: true,
+        createdAt: true,
+        expiredAt: true,
+        featureId: true,
+      },
+    });
+
+    const configs = await Promise.all(
+      features.map(async feature => ({
+        ...feature,
+        feature: await getFeature(this.prisma, feature.featureId),
+      }))
+    );
+
+    return configs.filter(feature => !!feature.feature);
+  }
+
+  async listFeatureWorkspaces(feature: FeatureType): Promise<WorkspaceType[]> {
+    return this.prisma.workspaceFeatures
+      .findMany({
+        where: {
+          activated: true,
+          feature: {
+            feature: feature,
+            type: FeatureKind.Feature,
+          },
+        },
+        select: {
+          workspace: {
+            select: {
+              id: true,
+              public: true,
+              createdAt: true,
+            },
+          },
+        },
+      })
+      .then(wss => wss.map(ws => ws.workspace as WorkspaceType));
+  }
+
+  async hasWorkspaceFeature(workspaceId: string, feature: FeatureType) {
+    return this.prisma.workspaceFeatures
+      .count({
+        where: {
+          workspaceId,
+          activated: true,
+          feature: {
+            feature,
+            type: FeatureKind.Feature,
+          },
+        },
+      })
+      .then(count => count > 0);
+  }
+}

packages/backend/server/src/core/features/types/common.ts

@@ -0,0 +1,12 @@
+import { registerEnumType } from '@nestjs/graphql';
+
+export enum FeatureType {
+  Copilot = 'copilot',
+  EarlyAccess = 'early_access',
+  UnlimitedWorkspace = 'unlimited_workspace',
+}
+
+registerEnumType(FeatureType, {
+  name: 'FeatureType',
+  description: 'The type of workspace feature',
+});

packages/backend/server/src/core/features/types/copilot.ts

@@ -0,0 +1,8 @@
+import { z } from 'zod';
+
+import { FeatureType } from './common';
+
+export const featureCopilot = z.object({
+  feature: z.literal(FeatureType.Copilot),
+  configs: z.object({}),
+});

packages/backend/server/src/core/features/types/early-access.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+
+import { FeatureType } from './common';
+
+export const featureEarlyAccess = z.object({
+  feature: z.literal(FeatureType.EarlyAccess),
+  configs: z.object({
+    // field polyfill, make it optional in the future
+    whitelist: z.string().array(),
+  }),
+});

packages/backend/server/src/core/features/types/index.ts

@@ -0,0 +1,73 @@
+import { z } from 'zod';
+
+import { FeatureType } from './common';
+import { featureCopilot } from './copilot';
+import { featureEarlyAccess } from './early-access';
+import { featureUnlimitedWorkspace } from './unlimited-workspace';
+
+/// ======== common schema ========
+
+export enum FeatureKind {
+  Feature,
+  Quota,
+}
+
+export const commonFeatureSchema = z.object({
+  feature: z.string(),
+  type: z.nativeEnum(FeatureKind),
+  version: z.number(),
+  configs: z.unknown(),
+});
+
+export type CommonFeature = z.infer<typeof commonFeatureSchema>;
+
+/// ======== feature define ========
+
+export const Features: Feature[] = [
+  {
+    feature: FeatureType.Copilot,
+    type: FeatureKind.Feature,
+    version: 1,
+    configs: {},
+  },
+  {
+    feature: FeatureType.EarlyAccess,
+    type: FeatureKind.Feature,
+    version: 1,
+    configs: {
+      whitelist: ['@toeverything.info'],
+    },
+  },
+  {
+    feature: FeatureType.EarlyAccess,
+    type: FeatureKind.Feature,
+    version: 2,
+    configs: {
+      whitelist: [],
+    },
+  },
+  {
+    feature: FeatureType.UnlimitedWorkspace,
+    type: FeatureKind.Feature,
+    version: 1,
+    configs: {},
+  },
+];
+
+/// ======== schema infer ========
+
+export const FeatureSchema = commonFeatureSchema
+  .extend({
+    type: z.literal(FeatureKind.Feature),
+  })
+  .and(
+    z.discriminatedUnion('feature', [
+      featureCopilot,
+      featureEarlyAccess,
+      featureUnlimitedWorkspace,
+    ])
+  );
+
+export type Feature = z.infer<typeof FeatureSchema>;
+
+export { FeatureType };

packages/backend/server/src/core/features/types/unlimited-workspace.ts

@@ -0,0 +1,8 @@
+import { z } from 'zod';
+
+import { FeatureType } from './common';
+
+export const featureUnlimitedWorkspace = z.object({
+  feature: z.literal(FeatureType.UnlimitedWorkspace),
+  configs: z.object({}),
+});

packages/backend/server/src/core/quota/constant.ts

@@ -0,0 +1,5 @@
+export const OneKB = 1024;
+export const OneMB = OneKB * OneKB;
+export const OneGB = OneKB * OneMB;
+export const OneDay = 1000 * 60 * 60 * 24;
+export const ByteUnit = ['B', 'KB', 'MB', 'GB', 'TB', 'PB', 'EB', 'ZB', 'YB'];

packages/backend/server/src/core/quota/index.ts

@@ -0,0 +1,24 @@
+import { Module } from '@nestjs/common';
+
+import { StorageModule } from '../storage';
+import { PermissionService } from '../workspaces/permission';
+import { QuotaService } from './service';
+import { QuotaManagementService } from './storage';
+
+/**
+ * Quota module provider pre-user quota management.
+ * includes:
+ * - quota query/update/permit
+ * - quota statistics
+ */
+@Module({
+  // FIXME: Quota really need to know `Storage`?
+  imports: [StorageModule],
+  providers: [PermissionService, QuotaService, QuotaManagementService],
+  exports: [QuotaService, QuotaManagementService],
+})
+export class QuotaModule {}
+
+export { QuotaManagementService, QuotaService };
+export { Quota_FreePlanV1_1, Quota_ProPlanV1, Quotas } from './schema';
+export { QuotaQueryType, QuotaType } from './types';

packages/backend/server/src/core/quota/quota.ts

@@ -0,0 +1,85 @@
+import { PrismaService } from '../../fundamentals';
+import { formatDate, formatSize, Quota, QuotaSchema } from './types';
+
+const QuotaCache = new Map<number, QuotaConfig>();
+
+export class QuotaConfig {
+  readonly config: Quota;
+
+  static async get(prisma: PrismaService, featureId: number) {
+    const cachedQuota = QuotaCache.get(featureId);
+
+    if (cachedQuota) {
+      return cachedQuota;
+    }
+
+    const quota = await prisma.features.findFirst({
+      where: {
+        id: featureId,
+      },
+    });
+
+    if (!quota) {
+      throw new Error(`Quota config ${featureId} not found`);
+    }
+
+    const config = new QuotaConfig(quota);
+    // we always edit quota config as a new quota config
+    // so we can cache it by featureId
+    QuotaCache.set(featureId, config);
+
+    return config;
+  }
+
+  private constructor(data: any) {
+    const config = QuotaSchema.safeParse(data);
+    if (config.success) {
+      this.config = config.data;
+    } else {
+      throw new Error(
+        `Invalid quota config: ${config.error.message}, ${JSON.stringify(
+          data
+        )})}`
+      );
+    }
+  }
+
+  get version() {
+    return this.config.version;
+  }
+
+  /// feature name of quota
+  get name() {
+    return this.config.feature;
+  }
+
+  get blobLimit() {
+    return this.config.configs.blobLimit;
+  }
+
+  get storageQuota() {
+    return this.config.configs.storageQuota;
+  }
+
+  get historyPeriod() {
+    return this.config.configs.historyPeriod;
+  }
+
+  get historyPeriodFromNow() {
+    return new Date(Date.now() + this.historyPeriod);
+  }
+
+  get memberLimit() {
+    return this.config.configs.memberLimit;
+  }
+
+  get humanReadable() {
+    return {
+      name: this.config.configs.name,
+      blobLimit: formatSize(this.blobLimit),
+      storageQuota: formatSize(this.storageQuota),
+      historyPeriod: formatDate(this.historyPeriod),
+      memberLimit: this.memberLimit.toString(),
+    };
+  }
+}

packages/backend/server/src/core/quota/schema.ts

@@ -0,0 +1,84 @@
+import { FeatureKind } from '../features';
+import { OneDay, OneGB, OneMB } from './constant';
+import { Quota, QuotaType } from './types';
+
+export const Quotas: Quota[] = [
+  {
+    feature: QuotaType.FreePlanV1,
+    type: FeatureKind.Quota,
+    version: 1,
+    configs: {
+      // quota name
+      name: 'Free',
+      // single blob limit 10MB
+      blobLimit: 10 * OneMB,
+      // total blob limit 10GB
+      storageQuota: 10 * OneGB,
+      // history period of validity 7 days
+      historyPeriod: 7 * OneDay,
+      // member limit 3
+      memberLimit: 3,
+    },
+  },
+  {
+    feature: QuotaType.ProPlanV1,
+    type: FeatureKind.Quota,
+    version: 1,
+    configs: {
+      // quota name
+      name: 'Pro',
+      // single blob limit 100MB
+      blobLimit: 100 * OneMB,
+      // total blob limit 100GB
+      storageQuota: 100 * OneGB,
+      // history period of validity 30 days
+      historyPeriod: 30 * OneDay,
+      // member limit 10
+      memberLimit: 10,
+    },
+  },
+  {
+    feature: QuotaType.RestrictedPlanV1,
+    type: FeatureKind.Quota,
+    version: 1,
+    configs: {
+      // quota name
+      name: 'Restricted',
+      // single blob limit 10MB
+      blobLimit: OneMB,
+      // total blob limit 1GB
+      storageQuota: 10 * OneMB,
+      // history period of validity 30 days
+      historyPeriod: 30 * OneDay,
+      // member limit 10
+      memberLimit: 10,
+    },
+  },
+  {
+    feature: QuotaType.FreePlanV1,
+    type: FeatureKind.Quota,
+    version: 2,
+    configs: {
+      // quota name
+      name: 'Free',
+      // single blob limit 10MB
+      blobLimit: 100 * OneMB,
+      // total blob limit 10GB
+      storageQuota: 10 * OneGB,
+      // history period of validity 7 days
+      historyPeriod: 7 * OneDay,
+      // member limit 3
+      memberLimit: 3,
+    },
+  },
+];
+
+export const Quota_FreePlanV1_1 = {
+  feature: Quotas[3].feature,
+  version: Quotas[3].version,
+};
+
+export const Quota_ProPlanV1 = {
+  feature: Quotas[1].feature,
+  version: Quotas[1].version,
+};

packages/backend/server/src/core/quota/service.ts

@@ -0,0 +1,180 @@
+import { Injectable } from '@nestjs/common';
+
+import { type EventPayload, OnEvent, PrismaService } from '../../fundamentals';
+import { FeatureKind } from '../features';
+import { QuotaConfig } from './quota';
+import { QuotaType } from './types';
+
+type Transaction = Parameters<Parameters<PrismaService['$transaction']>[0]>[0];
+
+@Injectable()
+export class QuotaService {
+  constructor(private readonly prisma: PrismaService) {}
+
+  // get activated user quota
+  async getUserQuota(userId: string) {
+    const quota = await this.prisma.userFeatures.findFirst({
+      where: {
+        user: {
+          id: userId,
+        },
+        feature: {
+          type: FeatureKind.Quota,
+        },
+        activated: true,
+      },
+      select: {
+        reason: true,
+        createdAt: true,
+        expiredAt: true,
+        featureId: true,
+      },
+    });
+
+    if (!quota) {
+      // this should unreachable
+      throw new Error(`User ${userId} has no quota`);
+    }
+
+    const feature = await QuotaConfig.get(this.prisma, quota.featureId);
+    return { ...quota, feature };
+  }
+
+  // get user all quota records
+  async getUserQuotas(userId: string) {
+    const quotas = await this.prisma.userFeatures.findMany({
+      where: {
+        user: {
+          id: userId,
+        },
+        feature: {
+          type: FeatureKind.Quota,
+        },
+      },
+      select: {
+        activated: true,
+        reason: true,
+        createdAt: true,
+        expiredAt: true,
+        featureId: true,
+      },
+    });
+    const configs = await Promise.all(
+      quotas.map(async quota => {
+        try {
+          return {
+            ...quota,
+            feature: await QuotaConfig.get(this.prisma, quota.featureId),
+          };
+        } catch (_) {}
+        return null as unknown as typeof quota & {
+          feature: QuotaConfig;
+        };
+      })
+    );
+
+    return configs.filter(quota => !!quota);
+  }
+
+  // switch user to a new quota
+  // currently each user can only have one quota
+  async switchUserQuota(
+    userId: string,
+    quota: QuotaType,
+    reason?: string,
+    expiredAt?: Date
+  ) {
+    await this.prisma.$transaction(async tx => {
+      const hasSameActivatedQuota = await this.hasQuota(userId, quota, tx);
+
+      if (hasSameActivatedQuota) {
+        // don't need to switch
+        return;
+      }
+
+      const latestPlanVersion = await tx.features.aggregate({
+        where: {
+          feature: quota,
+        },
+        _max: {
+          version: true,
+        },
+      });
+
+      // we will deactivate all exists quota for this user
+      await tx.userFeatures.updateMany({
+        where: {
+          id: undefined,
+          userId,
+          feature: {
+            type: FeatureKind.Quota,
+          },
+        },
+        data: {
+          activated: false,
+        },
+      });
+
+      await tx.userFeatures.create({
+        data: {
+          user: {
+            connect: {
+              id: userId,
+            },
+          },
+          feature: {
+            connect: {
+              feature_version: {
+                feature: quota,
+                version: latestPlanVersion._max.version || 1,
+              },
+              type: FeatureKind.Quota,
+            },
+          },
+          reason: reason ?? 'switch quota',
+          activated: true,
+          expiredAt,
+        },
+      });
+    });
+  }
+
+  async hasQuota(userId: string, quota: QuotaType, transaction?: Transaction) {
+    const executor = transaction ?? this.prisma;
+
+    return executor.userFeatures
+      .count({
+        where: {
+          userId,
+          feature: {
+            feature: quota,
+            type: FeatureKind.Quota,
+          },
+          activated: true,
+        },
+      })
+      .then(count => count > 0);
+  }
+
+  @OnEvent('user.subscription.activated')
+  async onSubscriptionUpdated({
+    userId,
+  }: EventPayload<'user.subscription.activated'>) {
+    await this.switchUserQuota(
+      userId,
+      QuotaType.ProPlanV1,
+      'subscription activated'
+    );
+  }
+
+  @OnEvent('user.subscription.canceled')
+  async onSubscriptionCanceled(
+    userId: EventPayload<'user.subscription.canceled'>
+  ) {
+    await this.switchUserQuota(
+      userId,
+      QuotaType.FreePlanV1,
+      'subscription canceled'
+    );
+  }
+}

packages/backend/server/src/core/quota/storage.ts

@@ -0,0 +1,61 @@
+import { Injectable, NotFoundException } from '@nestjs/common';
+
+import { WorkspaceBlobStorage } from '../storage';
+import { PermissionService } from '../workspaces/permission';
+import { QuotaService } from './service';
+import { QuotaQueryType } from './types';
+
+@Injectable()
+export class QuotaManagementService {
+  constructor(
+    private readonly quota: QuotaService,
+    private readonly permissions: PermissionService,
+    private readonly storage: WorkspaceBlobStorage
+  ) {}
+
+  async getUserQuota(userId: string) {
+    const quota = await this.quota.getUserQuota(userId);
+
+    return {
+      name: quota.feature.name,
+      reason: quota.reason,
+      createAt: quota.createdAt,
+      expiredAt: quota.expiredAt,
+      blobLimit: quota.feature.blobLimit,
+      storageQuota: quota.feature.storageQuota,
+      historyPeriod: quota.feature.historyPeriod,
+      memberLimit: quota.feature.memberLimit,
+    };
+  }
+
+  // TODO: lazy calc, need to be optimized with cache
+  async getUserUsage(userId: string) {
+    const workspaces = await this.permissions.getOwnedWorkspaces(userId);
+
+    const sizes = await Promise.all(
+      workspaces.map(workspace => this.storage.totalSize(workspace))
+    );
+
+    return sizes.reduce((total, size) => total + size, 0);
+  }
+
+  // get workspace's owner quota and total size of used
+  // quota was apply to owner's account
+  async getWorkspaceUsage(workspaceId: string): Promise<QuotaQueryType> {
+    const { user: owner } =
+      await this.permissions.getWorkspaceOwner(workspaceId);
+    if (!owner) throw new NotFoundException('Workspace owner not found');
+    const { storageQuota, blobLimit } = await this.getUserQuota(owner.id);
+    // get all workspaces size of owner used
+    const usedSize = await this.getUserUsage(owner.id);
+
+    return { storageQuota, usedSize, blobLimit };
+  }
+
+  async checkBlobQuota(workspaceId: string, size: number) {
+    const { storageQuota, usedSize } =
+      await this.getWorkspaceUsage(workspaceId);
+
+    return storageQuota - (size + usedSize);
+  }
+}

packages/backend/server/src/core/quota/types.ts

@@ -0,0 +1,71 @@
+import { Field, Int, ObjectType } from '@nestjs/graphql';
+import { z } from 'zod';
+
+import { commonFeatureSchema, FeatureKind } from '../features';
+import { ByteUnit, OneDay, OneKB } from './constant';
+
+/// ======== quota define ========
+
+export enum QuotaType {
+  FreePlanV1 = 'free_plan_v1',
+  ProPlanV1 = 'pro_plan_v1',
+  // only for test, smaller quota
+  RestrictedPlanV1 = 'restricted_plan_v1',
+}
+
+const quotaPlan = z.object({
+  feature: z.enum([
+    QuotaType.FreePlanV1,
+    QuotaType.ProPlanV1,
+    QuotaType.RestrictedPlanV1,
+  ]),
+  configs: z.object({
+    name: z.string(),
+    blobLimit: z.number().positive().int(),
+    storageQuota: z.number().positive().int(),
+    historyPeriod: z.number().positive().int(),
+    memberLimit: z.number().positive().int(),
+  }),
+});
+
+/// ======== schema infer ========
+
+export const QuotaSchema = commonFeatureSchema
+  .extend({
+    type: z.literal(FeatureKind.Quota),
+  })
+  .and(z.discriminatedUnion('feature', [quotaPlan]));
+
+export type Quota = z.infer<typeof QuotaSchema>;
+
+/// ======== query types ========
+
+@ObjectType()
+export class QuotaQueryType {
+  @Field(() => Int)
+  storageQuota!: number;
+
+  @Field(() => Int)
+  usedSize!: number;
+
+  @Field(() => Int)
+  blobLimit!: number;
+}
+
+/// ======== utils ========
+
+export function formatSize(bytes: number, decimals: number = 2): string {
+  if (bytes === 0) return '0 B';
+
+  const dm = decimals < 0 ? 0 : decimals;
+
+  const i = Math.floor(Math.log(bytes) / Math.log(OneKB));
+
+  return (
+    parseFloat((bytes / Math.pow(OneKB, i)).toFixed(dm)) + ' ' + ByteUnit[i]
+  );
+}
+
+export function formatDate(ms: number): string {
+  return `${(ms / OneDay).toFixed(0)} days`;
+}

packages/backend/server/src/core/storage/index.ts

@@ -0,0 +1,11 @@
+import { Module } from '@nestjs/common';
+
+import { AvatarStorage, WorkspaceBlobStorage } from './wrappers';
+
+@Module({
+  providers: [WorkspaceBlobStorage, AvatarStorage],
+  exports: [WorkspaceBlobStorage, AvatarStorage],
+})
+export class StorageModule {}
+
+export { AvatarStorage, WorkspaceBlobStorage };

packages/backend/server/src/core/storage/wrappers/avatar.ts

@@ -0,0 +1,46 @@
+import { Injectable } from '@nestjs/common';
+
+import type {
+  BlobInputType,
+  EventPayload,
+  PutObjectMetadata,
+  StorageProvider,
+} from '../../../fundamentals';
+import { Config, createStorageProvider, OnEvent } from '../../../fundamentals';
+
+@Injectable()
+export class AvatarStorage {
+  public readonly provider: StorageProvider;
+  private readonly storageConfig: Config['storage']['storages']['avatar'];
+
+  constructor(private readonly config: Config) {
+    this.provider = createStorageProvider(this.config.storage, 'avatar');
+    this.storageConfig = this.config.storage.storages.avatar;
+  }
+
+  async put(key: string, blob: BlobInputType, metadata?: PutObjectMetadata) {
+    await this.provider.put(key, blob, metadata);
+    let link = this.storageConfig.publicLinkFactory(key);
+
+    if (link.startsWith('/')) {
+      link = this.config.baseUrl + link;
+    }
+
+    return link;
+  }
+
+  get(key: string) {
+    return this.provider.get(key);
+  }
+
+  delete(key: string) {
+    return this.provider.delete(key);
+  }
+
+  @OnEvent('user.deleted')
+  async onUserDeleted(user: EventPayload<'user.deleted'>) {
+    if (user.avatarUrl) {
+      await this.delete(user.avatarUrl);
+    }
+  }
+}

packages/backend/server/src/core/storage/wrappers/blob.ts

@@ -0,0 +1,78 @@
+import { Injectable } from '@nestjs/common';
+
+import type {
+  BlobInputType,
+  EventPayload,
+  StorageProvider,
+} from '../../../fundamentals';
+import {
+  Config,
+  createStorageProvider,
+  EventEmitter,
+  OnEvent,
+} from '../../../fundamentals';
+
+@Injectable()
+export class WorkspaceBlobStorage {
+  public readonly provider: StorageProvider;
+
+  constructor(
+    private readonly event: EventEmitter,
+    private readonly config: Config
+  ) {
+    this.provider = createStorageProvider(this.config.storage, 'blob');
+  }
+
+  async put(workspaceId: string, key: string, blob: BlobInputType) {
+    await this.provider.put(`${workspaceId}/${key}`, blob);
+  }
+
+  async get(workspaceId: string, key: string) {
+    return this.provider.get(`${workspaceId}/${key}`);
+  }
+
+  async list(workspaceId: string) {
+    const blobs = await this.provider.list(workspaceId + '/');
+
+    blobs.forEach(item => {
+      // trim workspace prefix
+      item.key = item.key.slice(workspaceId.length + 1);
+    });
+
+    return blobs;
+  }
+
+  /**
+   * we won't really delete the blobs until the doc blobs manager is implemented sounded
+   */
+  async delete(_workspaceId: string, _key: string) {
+    // return this.provider.delete(`${workspaceId}/${key}`);
+  }
+
+  async totalSize(workspaceId: string) {
+    const blobs = await this.list(workspaceId);
+    // how could we ignore the ones get soft-deleted?
+    return blobs.reduce((acc, item) => acc + item.size, 0);
+  }
+
+  @OnEvent('workspace.deleted')
+  async onWorkspaceDeleted(workspaceId: EventPayload<'workspace.deleted'>) {
+    const blobs = await this.list(workspaceId);
+
+    // to reduce cpu time holding
+    blobs.forEach(blob => {
+      this.event.emit('workspace.blob.deleted', {
+        workspaceId: workspaceId,
+        name: blob.key,
+      });
+    });
+  }
+
+  @OnEvent('workspace.blob.deleted')
+  async onDeleteWorkspaceBlob({
+    workspaceId,
+    name,
+  }: EventPayload<'workspace.blob.deleted'>) {
+    await this.delete(workspaceId, name);
+  }
+}

packages/backend/server/src/core/storage/wrappers/index.ts

@@ -0,0 +1,2 @@
+export { AvatarStorage } from './avatar';
+export { WorkspaceBlobStorage } from './blob';

packages/backend/server/src/core/sync/events/error.ts

@@ -0,0 +1,81 @@
+enum EventErrorCode {
+  WORKSPACE_NOT_FOUND = 'WORKSPACE_NOT_FOUND',
+  DOC_NOT_FOUND = 'DOC_NOT_FOUND',
+  NOT_IN_WORKSPACE = 'NOT_IN_WORKSPACE',
+  ACCESS_DENIED = 'ACCESS_DENIED',
+  INTERNAL = 'INTERNAL',
+  VERSION_REJECTED = 'VERSION_REJECTED',
+}
+
+// Such errore are generally raised from the gateway handling to user,
+// the stack must be full of internal code,
+// so there is no need to inherit from `Error` class.
+export class EventError {
+  constructor(
+    public readonly code: EventErrorCode,
+    public readonly message: string
+  ) {}
+
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+    };
+  }
+}
+
+export class WorkspaceNotFoundError extends EventError {
+  constructor(public readonly workspaceId: string) {
+    super(
+      EventErrorCode.WORKSPACE_NOT_FOUND,
+      `You are trying to access an unknown workspace ${workspaceId}.`
+    );
+  }
+}
+
+export class DocNotFoundError extends EventError {
+  constructor(
+    public readonly workspaceId: string,
+    public readonly docId: string
+  ) {
+    super(
+      EventErrorCode.DOC_NOT_FOUND,
+      `You are trying to access an unknown doc ${docId} under workspace ${workspaceId}.`
+    );
+  }
+}
+
+export class NotInWorkspaceError extends EventError {
+  constructor(public readonly workspaceId: string) {
+    super(
+      EventErrorCode.NOT_IN_WORKSPACE,
+      `You should join in workspace ${workspaceId} before broadcasting messages.`
+    );
+  }
+}
+
+export class AccessDeniedError extends EventError {
+  constructor(public readonly workspaceId: string) {
+    super(
+      EventErrorCode.ACCESS_DENIED,
+      `You have no permission to access workspace ${workspaceId}.`
+    );
+  }
+}
+
+export class InternalError extends EventError {
+  constructor(public readonly error: Error) {
+    super(EventErrorCode.INTERNAL, `Internal error happened: ${error.message}`);
+  }
+}
+
+export class VersionRejectedError extends EventError {
+  constructor(public readonly version: number) {
+    super(
+      EventErrorCode.VERSION_REJECTED,
+      // TODO: Too general error message,
+      // need to be more specific when versioning system is implemented.
+      `The version ${version} is rejected by server.`
+    );
+  }
+}

packages/backend/server/src/core/sync/events/events.gateway.ts

@@ -0,0 +1,465 @@
+import { applyDecorators, Logger } from '@nestjs/common';
+import {
+  ConnectedSocket,
+  MessageBody,
+  OnGatewayConnection,
+  OnGatewayDisconnect,
+  SubscribeMessage as RawSubscribeMessage,
+  WebSocketGateway,
+  WebSocketServer,
+} from '@nestjs/websockets';
+import { Server, Socket } from 'socket.io';
+import { encodeStateAsUpdate, encodeStateVector } from 'yjs';
+
+import { CallTimer, metrics } from '../../../fundamentals';
+import { Auth, CurrentUser } from '../../auth';
+import { DocManager } from '../../doc';
+import { UserType } from '../../users';
+import { DocID } from '../../utils/doc';
+import { PermissionService } from '../../workspaces/permission';
+import { Permission } from '../../workspaces/types';
+import {
+  AccessDeniedError,
+  DocNotFoundError,
+  EventError,
+  InternalError,
+  NotInWorkspaceError,
+} from './error';
+
+export const GatewayErrorWrapper = (): MethodDecorator => {
+  // @ts-expect-error allow
+  return (
+    _target,
+    _key,
+    desc: TypedPropertyDescriptor<(...args: any[]) => any>
+  ) => {
+    const originalMethod = desc.value;
+    if (!originalMethod) {
+      return desc;
+    }
+
+    desc.value = function (...args: any[]) {
+      let result: any;
+      try {
+        result = originalMethod.apply(this, args);
+      } catch (e) {
+        metrics.socketio.counter('unhandled_errors').add(1);
+        return {
+          error: new InternalError(e as Error),
+        };
+      }
+
+      if (result instanceof Promise) {
+        return result.catch(e => {
+          metrics.socketio.counter('unhandled_errors').add(1);
+          return {
+            error: new InternalError(e),
+          };
+        });
+      } else {
+        return result;
+      }
+    };
+
+    return desc;
+  };
+};
+
+const SubscribeMessage = (event: string) =>
+  applyDecorators(
+    GatewayErrorWrapper(),
+    CallTimer('socketio', 'event_duration', { event }),
+    RawSubscribeMessage(event)
+  );
+
+type EventResponse<Data = any> =
+  | {
+      error: EventError;
+    }
+  | (Data extends never
+      ? {
+          data?: never;
+        }
+      : {
+          data: Data;
+        });
+
+@WebSocketGateway({
+  cors: process.env.NODE_ENV !== 'production',
+  transports: ['websocket'],
+  // see: https://socket.io/docs/v4/server-options/#maxhttpbuffersize
+  maxHttpBufferSize: 1e8, // 100 MB
+})
+export class EventsGateway implements OnGatewayConnection, OnGatewayDisconnect {
+  protected logger = new Logger(EventsGateway.name);
+  private connectionCount = 0;
+
+  constructor(
+    private readonly docManager: DocManager,
+    private readonly permissions: PermissionService
+  ) {}
+
+  @WebSocketServer()
+  server!: Server;
+
+  handleConnection() {
+    this.connectionCount++;
+    metrics.socketio.gauge('realtime_connections').record(this.connectionCount);
+  }
+
+  handleDisconnect() {
+    this.connectionCount--;
+    metrics.socketio.gauge('realtime_connections').record(this.connectionCount);
+  }
+
+  @Auth()
+  @SubscribeMessage('client-handshake-sync')
+  async handleClientHandshakeSync(
+    @CurrentUser() user: UserType,
+    @MessageBody() workspaceId: string,
+    @ConnectedSocket() client: Socket
+  ): Promise<EventResponse<{ clientId: string }>> {
+    const canWrite = await this.permissions.tryCheckWorkspace(
+      workspaceId,
+      user.id,
+      Permission.Write
+    );
+
+    if (canWrite) {
+      await client.join(`${workspaceId}:sync`);
+      return {
+        data: {
+          clientId: client.id,
+        },
+      };
+    } else {
+      return {
+        error: new AccessDeniedError(workspaceId),
+      };
+    }
+  }
+
+  @Auth()
+  @SubscribeMessage('client-handshake-awareness')
+  async handleClientHandshakeAwareness(
+    @CurrentUser() user: UserType,
+    @MessageBody() workspaceId: string,
+    @ConnectedSocket() client: Socket
+  ): Promise<EventResponse<{ clientId: string }>> {
+    const canWrite = await this.permissions.tryCheckWorkspace(
+      workspaceId,
+      user.id,
+      Permission.Write
+    );
+
+    if (canWrite) {
+      await client.join(`${workspaceId}:awareness`);
+      return {
+        data: {
+          clientId: client.id,
+        },
+      };
+    } else {
+      return {
+        error: new AccessDeniedError(workspaceId),
+      };
+    }
+  }
+
+  /**
+   * @deprecated use `client-handshake-sync` and `client-handshake-awareness` instead
+   */
+  @Auth()
+  @SubscribeMessage('client-handshake')
+  async handleClientHandShake(
+    @CurrentUser() user: UserType,
+    @MessageBody()
+    workspaceId: string,
+    @ConnectedSocket() client: Socket
+  ): Promise<EventResponse<{ clientId: string }>> {
+    const canWrite = await this.permissions.tryCheckWorkspace(
+      workspaceId,
+      user.id,
+      Permission.Write
+    );
+
+    if (canWrite) {
+      await client.join([`${workspaceId}:sync`, `${workspaceId}:awareness`]);
+      return {
+        data: {
+          clientId: client.id,
+        },
+      };
+    } else {
+      return {
+        error: new AccessDeniedError(workspaceId),
+      };
+    }
+  }
+
+  @SubscribeMessage('client-leave-sync')
+  async handleLeaveSync(
+    @MessageBody() workspaceId: string,
+    @ConnectedSocket() client: Socket
+  ): Promise<EventResponse> {
+    if (client.rooms.has(`${workspaceId}:sync`)) {
+      await client.leave(`${workspaceId}:sync`);
+      return {};
+    } else {
+      return {
+        error: new NotInWorkspaceError(workspaceId),
+      };
+    }
+  }
+
+  @SubscribeMessage('client-leave-awareness')
+  async handleLeaveAwareness(
+    @MessageBody() workspaceId: string,
+    @ConnectedSocket() client: Socket
+  ): Promise<EventResponse> {
+    if (client.rooms.has(`${workspaceId}:awareness`)) {
+      await client.leave(`${workspaceId}:awareness`);
+      return {};
+    } else {
+      return {
+        error: new NotInWorkspaceError(workspaceId),
+      };
+    }
+  }
+
+  /**
+   * @deprecated use `client-leave-sync` and `client-leave-awareness` instead
+   */
+  @SubscribeMessage('client-leave')
+  async handleClientLeave(
+    @MessageBody() workspaceId: string,
+    @ConnectedSocket() client: Socket
+  ): Promise<EventResponse> {
+    if (client.rooms.has(`${workspaceId}:sync`)) {
+      await client.leave(`${workspaceId}:sync`);
+    }
+    if (client.rooms.has(`${workspaceId}:awareness`)) {
+      await client.leave(`${workspaceId}:awareness`);
+    }
+    return {};
+  }
+
+  /**
+   * This is the old version of the `client-update` event without any data protocol.
+   * It only exists for backwards compatibility to adapt older clients.
+   *
+   * @deprecated
+   */
+  @SubscribeMessage('client-update')
+  async handleClientUpdateV1(
+    @MessageBody()
+    {
+      workspaceId,
+      guid,
+      update,
+    }: {
+      workspaceId: string;
+      guid: string;
+      update: string;
+    },
+    @ConnectedSocket() client: Socket
+  ) {
+    if (!client.rooms.has(`${workspaceId}:sync`)) {
+      this.logger.verbose(
+        `Client ${client.id} tried to push update to workspace ${workspaceId} without joining it first`
+      );
+      return;
+    }
+
+    const docId = new DocID(guid, workspaceId);
+
+    client
+      .to(`${docId.workspace}:sync`)
+      .emit('server-update', { workspaceId, guid, update });
+
+    // broadcast to all clients with newer version that only listen to `server-updates`
+    client
+      .to(`${docId.workspace}:sync`)
+      .emit('server-updates', { workspaceId, guid, updates: [update] });
+
+    const buf = Buffer.from(update, 'base64');
+    await this.docManager.push(docId.workspace, docId.guid, buf);
+  }
+
+  /**
+   * This is the old version of the `doc-load` event without any data protocol.
+   * It only exists for backwards compatibility to adapt older clients.
+   *
+   * @deprecated
+   */
+  @Auth()
+  @SubscribeMessage('doc-load')
+  async loadDocV1(
+    @ConnectedSocket() client: Socket,
+    @CurrentUser() user: UserType,
+    @MessageBody()
+    {
+      workspaceId,
+      guid,
+      stateVector,
+    }: {
+      workspaceId: string;
+      guid: string;
+      stateVector?: string;
+    }
+  ): Promise<{ missing: string; state?: string } | false> {
+    if (!client.rooms.has(`${workspaceId}:sync`)) {
+      const canRead = await this.permissions.tryCheckWorkspace(
+        workspaceId,
+        user.id
+      );
+      if (!canRead) {
+        return false;
+      }
+    }
+
+    const docId = new DocID(guid, workspaceId);
+    const doc = await this.docManager.get(docId.workspace, docId.guid);
+
+    if (!doc) {
+      return false;
+    }
+
+    const missing = Buffer.from(
+      encodeStateAsUpdate(
+        doc,
+        stateVector ? Buffer.from(stateVector, 'base64') : undefined
+      )
+    ).toString('base64');
+    const state = Buffer.from(encodeStateVector(doc)).toString('base64');
+
+    return {
+      missing,
+      state,
+    };
+  }
+
+  @SubscribeMessage('client-update-v2')
+  async handleClientUpdateV2(
+    @MessageBody()
+    {
+      workspaceId,
+      guid,
+      updates,
+    }: {
+      workspaceId: string;
+      guid: string;
+      updates: string[];
+    },
+    @ConnectedSocket() client: Socket
+  ): Promise<EventResponse<{ accepted: true }>> {
+    if (!client.rooms.has(`${workspaceId}:sync`)) {
+      return {
+        error: new NotInWorkspaceError(workspaceId),
+      };
+    }
+
+    const docId = new DocID(guid, workspaceId);
+    client
+      .to(`${docId.workspace}:sync`)
+      .emit('server-updates', { workspaceId, guid, updates });
+
+    const buffers = updates.map(update => Buffer.from(update, 'base64'));
+
+    await this.docManager.batchPush(docId.workspace, docId.guid, buffers);
+    return {
+      data: {
+        accepted: true,
+      },
+    };
+  }
+
+  @Auth()
+  @SubscribeMessage('doc-load-v2')
+  async loadDocV2(
+    @ConnectedSocket() client: Socket,
+    @CurrentUser() user: UserType,
+    @MessageBody()
+    {
+      workspaceId,
+      guid,
+      stateVector,
+    }: {
+      workspaceId: string;
+      guid: string;
+      stateVector?: string;
+    }
+  ): Promise<EventResponse<{ missing: string; state?: string }>> {
+    if (!client.rooms.has(`${workspaceId}:sync`)) {
+      const canRead = await this.permissions.tryCheckWorkspace(
+        workspaceId,
+        user.id
+      );
+      if (!canRead) {
+        return {
+          error: new AccessDeniedError(workspaceId),
+        };
+      }
+    }
+
+    const docId = new DocID(guid, workspaceId);
+    const doc = await this.docManager.get(docId.workspace, docId.guid);
+
+    if (!doc) {
+      return {
+        error: new DocNotFoundError(workspaceId, docId.guid),
+      };
+    }
+
+    const missing = Buffer.from(
+      encodeStateAsUpdate(
+        doc,
+        stateVector ? Buffer.from(stateVector, 'base64') : undefined
+      )
+    ).toString('base64');
+    const state = Buffer.from(encodeStateVector(doc)).toString('base64');
+
+    return {
+      data: {
+        missing,
+        state,
+      },
+    };
+  }
+
+  @SubscribeMessage('awareness-init')
+  async handleInitAwareness(
+    @MessageBody() workspaceId: string,
+    @ConnectedSocket() client: Socket
+  ): Promise<EventResponse<{ clientId: string }>> {
+    if (client.rooms.has(`${workspaceId}:awareness`)) {
+      client.to(`${workspaceId}:awareness`).emit('new-client-awareness-init');
+      return {
+        data: {
+          clientId: client.id,
+        },
+      };
+    } else {
+      return {
+        error: new NotInWorkspaceError(workspaceId),
+      };
+    }
+  }
+
+  @SubscribeMessage('awareness-update')
+  async handleHelpGatheringAwareness(
+    @MessageBody() message: { workspaceId: string; awarenessUpdate: string },
+    @ConnectedSocket() client: Socket
+  ): Promise<EventResponse> {
+    if (client.rooms.has(`${message.workspaceId}:awareness`)) {
+      client
+        .to(`${message.workspaceId}:awareness`)
+        .emit('server-awareness-broadcast', message);
+      return {};
+    } else {
+      return {
+        error: new NotInWorkspaceError(message.workspaceId),
+      };
+    }
+  }
+}

packages/backend/server/src/core/sync/events/events.module.ts

@@ -0,0 +1,11 @@
+import { Module } from '@nestjs/common';
+
+import { DocModule } from '../../doc';
+import { PermissionService } from '../../workspaces/permission';
+import { EventsGateway } from './events.gateway';
+
+@Module({
+  imports: [DocModule],
+  providers: [EventsGateway, PermissionService],
+})
+export class EventsModule {}

packages/backend/server/src/core/sync/index.ts

@@ -0,0 +1,8 @@
+import { Module } from '@nestjs/common';
+
+import { EventsModule } from './events/events.module';
+
+@Module({
+  imports: [EventsModule],
+})
+export class SyncModule {}

packages/backend/server/src/core/users/controller.ts

@@ -0,0 +1,40 @@
+import {
+  Controller,
+  ForbiddenException,
+  Get,
+  NotFoundException,
+  Param,
+  Res,
+} from '@nestjs/common';
+import type { Response } from 'express';
+
+import { AvatarStorage } from '../storage';
+
+@Controller('/api/avatars')
+export class UserAvatarController {
+  constructor(private readonly storage: AvatarStorage) {}
+
+  @Get('/:id')
+  async getAvatar(@Res() res: Response, @Param('id') id: string) {
+    if (this.storage.provider.type !== 'fs') {
+      throw new ForbiddenException(
+        'Only available when avatar storage provider set to fs.'
+      );
+    }
+
+    const { body, metadata } = await this.storage.get(id);
+
+    if (!body) {
+      throw new NotFoundException(`Avatar ${id} not found.`);
+    }
+
+    // metadata should always exists if body is not null
+    if (metadata) {
+      res.setHeader('content-type', metadata.contentType);
+      res.setHeader('last-modified', metadata.lastModified.toISOString());
+      res.setHeader('content-length', metadata.contentLength);
+    }
+
+    body.pipe(res);
+  }
+}

packages/backend/server/src/core/users/index.ts

@@ -0,0 +1,20 @@
+import { Module } from '@nestjs/common';
+
+import { FeatureModule } from '../features';
+import { QuotaModule } from '../quota';
+import { StorageModule } from '../storage';
+import { UserAvatarController } from './controller';
+import { UserManagementResolver } from './management';
+import { UserResolver } from './resolver';
+import { UsersService } from './users';
+
+@Module({
+  imports: [StorageModule, FeatureModule, QuotaModule],
+  providers: [UserResolver, UserManagementResolver, UsersService],
+  controllers: [UserAvatarController],
+  exports: [UsersService],
+})
+export class UsersModule {}
+
+export { UserType } from './types';
+export { UsersService } from './users';

packages/backend/server/src/core/users/management.ts

@@ -0,0 +1,91 @@
+import {
+  BadRequestException,
+  ForbiddenException,
+  UseGuards,
+} from '@nestjs/common';
+import { Args, Context, Int, Mutation, Query, Resolver } from '@nestjs/graphql';
+
+import { CloudThrottlerGuard, Throttle } from '../../fundamentals';
+import { Auth, CurrentUser } from '../auth/guard';
+import { AuthService } from '../auth/service';
+import { FeatureManagementService } from '../features';
+import { UserType } from './types';
+import { UsersService } from './users';
+
+/**
+ * User resolver
+ * All op rate limit: 10 req/m
+ */
+@UseGuards(CloudThrottlerGuard)
+@Auth()
+@Resolver(() => UserType)
+export class UserManagementResolver {
+  constructor(
+    private readonly auth: AuthService,
+    private readonly users: UsersService,
+    private readonly feature: FeatureManagementService
+  ) {}
+
+  @Throttle({
+    default: {
+      limit: 10,
+      ttl: 60,
+    },
+  })
+  @Mutation(() => Int)
+  async addToEarlyAccess(
+    @CurrentUser() currentUser: UserType,
+    @Args('email') email: string
+  ): Promise<number> {
+    if (!this.feature.isStaff(currentUser.email)) {
+      throw new ForbiddenException('You are not allowed to do this');
+    }
+    const user = await this.users.findUserByEmail(email);
+    if (user) {
+      return this.feature.addEarlyAccess(user.id);
+    } else {
+      const user = await this.auth.createAnonymousUser(email);
+      return this.feature.addEarlyAccess(user.id);
+    }
+  }
+
+  @Throttle({
+    default: {
+      limit: 10,
+      ttl: 60,
+    },
+  })
+  @Mutation(() => Int)
+  async removeEarlyAccess(
+    @CurrentUser() currentUser: UserType,
+    @Args('email') email: string
+  ): Promise<number> {
+    if (!this.feature.isStaff(currentUser.email)) {
+      throw new ForbiddenException('You are not allowed to do this');
+    }
+    const user = await this.users.findUserByEmail(email);
+    if (!user) {
+      throw new BadRequestException(`User ${email} not found`);
+    }
+    return this.feature.removeEarlyAccess(user.id);
+  }
+
+  @Throttle({
+    default: {
+      limit: 10,
+      ttl: 60,
+    },
+  })
+  @Query(() => [UserType])
+  async earlyAccessUsers(
+    @Context() ctx: { isAdminQuery: boolean },
+    @CurrentUser() user: UserType
+  ): Promise<UserType[]> {
+    if (!this.feature.isStaff(user.email)) {
+      throw new ForbiddenException('You are not allowed to do this');
+    }
+    // allow query other user's subscription
+    ctx.isAdminQuery = true;
+    return this.feature.listEarlyAccess();
+  }
+}

packages/backend/server/src/core/users/resolver.ts

@@ -0,0 +1,212 @@
+import { BadRequestException, HttpStatus, UseGuards } from '@nestjs/common';
+import {
+  Args,
+  Int,
+  Mutation,
+  Query,
+  ResolveField,
+  Resolver,
+} from '@nestjs/graphql';
+import type { User } from '@prisma/client';
+import { GraphQLError } from 'graphql';
+import GraphQLUpload from 'graphql-upload/GraphQLUpload.mjs';
+
+import {
+  CloudThrottlerGuard,
+  EventEmitter,
+  type FileUpload,
+  PrismaService,
+  Throttle,
+} from '../../fundamentals';
+import { Auth, CurrentUser, Public, Publicable } from '../auth/guard';
+import { FeatureManagementService } from '../features';
+import { QuotaService } from '../quota';
+import { AvatarStorage } from '../storage';
+import {
+  DeleteAccount,
+  RemoveAvatar,
+  UserOrLimitedUser,
+  UserQuotaType,
+  UserType,
+} from './types';
+import { UsersService } from './users';
+
+/**
+ * User resolver
+ * All op rate limit: 10 req/m
+ */
+@UseGuards(CloudThrottlerGuard)
+@Auth()
+@Resolver(() => UserType)
+export class UserResolver {
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly storage: AvatarStorage,
+    private readonly users: UsersService,
+    private readonly feature: FeatureManagementService,
+    private readonly quota: QuotaService,
+    private readonly event: EventEmitter
+  ) {}
+
+  @Throttle({
+    default: {
+      limit: 10,
+      ttl: 60,
+    },
+  })
+  @Publicable()
+  @Query(() => UserType, {
+    name: 'currentUser',
+    description: 'Get current user',
+    nullable: true,
+  })
+  async currentUser(@CurrentUser() user?: UserType) {
+    if (!user) {
+      return null;
+    }
+
+    const storedUser = await this.users.findUserById(user.id);
+    if (!storedUser) {
+      throw new BadRequestException(`User ${user.id} not found in db`);
+    }
+    return {
+      id: storedUser.id,
+      name: storedUser.name,
+      email: storedUser.email,
+      emailVerified: storedUser.emailVerified,
+      avatarUrl: storedUser.avatarUrl,
+      createdAt: storedUser.createdAt,
+      hasPassword: !!storedUser.password,
+    };
+  }
+
+  @Throttle({
+    default: {
+      limit: 10,
+      ttl: 60,
+    },
+  })
+  @Query(() => UserOrLimitedUser, {
+    name: 'user',
+    description: 'Get user by email',
+    nullable: true,
+  })
+  @Public()
+  async user(
+    @CurrentUser() currentUser?: UserType,
+    @Args('email') email?: string
+  ) {
+    if (!email || !(await this.feature.canEarlyAccess(email))) {
+      return new GraphQLError(
+        `You don't have early access permission\nVisit https://community.affine.pro/c/insider-general/ for more information`,
+        {
+          extensions: {
+            status: HttpStatus[HttpStatus.PAYMENT_REQUIRED],
+            code: HttpStatus.PAYMENT_REQUIRED,
+          },
+        }
+      );
+    }
+
+    // TODO: need to limit a user can only get another user witch is in the same workspace
+    const user = await this.users.findUserByEmail(email);
+    if (currentUser) return user;
+
+    // return empty response when user not exists
+    if (!user) return null;
+
+    // only return limited info when not logged in
+    return {
+      email: user?.email,
+      hasPassword: !!user?.password,
+    };
+  }
+
+  @Throttle({ default: { limit: 10, ttl: 60 } })
+  @ResolveField(() => UserQuotaType, { name: 'quota', nullable: true })
+  async getQuota(@CurrentUser() me: User) {
+    const quota = await this.quota.getUserQuota(me.id);
+
+    return quota.feature;
+  }
+
+  @Throttle({ default: { limit: 10, ttl: 60 } })
+  @ResolveField(() => Int, {
+    name: 'invoiceCount',
+    description: 'Get user invoice count',
+  })
+  async invoiceCount(@CurrentUser() user: UserType) {
+    return this.prisma.userInvoice.count({
+      where: { userId: user.id },
+    });
+  }
+
+  @Throttle({
+    default: {
+      limit: 10,
+      ttl: 60,
+    },
+  })
+  @Mutation(() => UserType, {
+    name: 'uploadAvatar',
+    description: 'Upload user avatar',
+  })
+  async uploadAvatar(
+    @CurrentUser() user: UserType,
+    @Args({ name: 'avatar', type: () => GraphQLUpload })
+    avatar: FileUpload
+  ) {
+    if (!user) {
+      throw new BadRequestException(`User not found`);
+    }
+
+    const link = await this.storage.put(
+      `${user.id}-avatar`,
+      avatar.createReadStream(),
+      {
+        contentType: avatar.mimetype,
+      }
+    );
+
+    return this.prisma.user.update({
+      where: { id: user.id },
+      data: {
+        avatarUrl: link,
+      },
+    });
+  }
+
+  @Throttle({
+    default: {
+      limit: 10,
+      ttl: 60,
+    },
+  })
+  @Mutation(() => RemoveAvatar, {
+    name: 'removeAvatar',
+    description: 'Remove user avatar',
+  })
+  async removeAvatar(@CurrentUser() user: UserType) {
+    if (!user) {
+      throw new BadRequestException(`User not found`);
+    }
+    await this.prisma.user.update({
+      where: { id: user.id },
+      data: { avatarUrl: null },
+    });
+    return { success: true };
+  }
+
+  @Throttle({
+    default: {
+      limit: 10,
+      ttl: 60,
+    },
+  })
+  @Mutation(() => DeleteAccount)
+  async deleteAccount(@CurrentUser() user: UserType): Promise<DeleteAccount> {
+    const deletedUser = await this.users.deleteUser(user.id);
+    this.event.emit('user.deleted', deletedUser);
+    return { success: true };
+  }
+}

packages/backend/server/src/core/users/types.ts

@@ -0,0 +1,103 @@
+import { createUnionType, Field, ID, ObjectType } from '@nestjs/graphql';
+import type { User } from '@prisma/client';
+import { SafeIntResolver } from 'graphql-scalars';
+
+@ObjectType('UserQuotaHumanReadable')
+export class UserQuotaHumanReadableType {
+  @Field({ name: 'name' })
+  name!: string;
+
+  @Field({ name: 'blobLimit' })
+  blobLimit!: string;
+
+  @Field({ name: 'storageQuota' })
+  storageQuota!: string;
+
+  @Field({ name: 'historyPeriod' })
+  historyPeriod!: string;
+
+  @Field({ name: 'memberLimit' })
+  memberLimit!: string;
+}
+
+@ObjectType('UserQuota')
+export class UserQuotaType {
+  @Field({ name: 'name' })
+  name!: string;
+
+  @Field(() => SafeIntResolver, { name: 'blobLimit' })
+  blobLimit!: number;
+
+  @Field(() => SafeIntResolver, { name: 'storageQuota' })
+  storageQuota!: number;
+
+  @Field(() => SafeIntResolver, { name: 'historyPeriod' })
+  historyPeriod!: number;
+
+  @Field({ name: 'memberLimit' })
+  memberLimit!: number;
+
+  @Field({ name: 'humanReadable' })
+  humanReadable!: UserQuotaHumanReadableType;
+}
+
+@ObjectType()
+export class UserType implements Partial<User> {
+  @Field(() => ID)
+  id!: string;
+
+  @Field({ description: 'User name' })
+  name!: string;
+
+  @Field({ description: 'User email' })
+  email!: string;
+
+  @Field(() => String, { description: 'User avatar url', nullable: true })
+  avatarUrl: string | null = null;
+
+  @Field(() => Date, { description: 'User email verified', nullable: true })
+  emailVerified: Date | null = null;
+
+  @Field({ description: 'User created date', nullable: true })
+  createdAt!: Date;
+
+  @Field(() => Boolean, {
+    description: 'User password has been set',
+    nullable: true,
+  })
+  hasPassword?: boolean;
+}
+
+@ObjectType()
+export class LimitedUserType implements Partial<User> {
+  @Field({ description: 'User email' })
+  email!: string;
+
+  @Field(() => Boolean, {
+    description: 'User password has been set',
+    nullable: true,
+  })
+  hasPassword?: boolean;
+}
+
+export const UserOrLimitedUser = createUnionType({
+  name: 'UserOrLimitedUser',
+  types: () => [UserType, LimitedUserType] as const,
+  resolveType(value) {
+    if (value.id) {
+      return UserType;
+    }
+    return LimitedUserType;
+  },
+});
+
+@ObjectType()
+export class DeleteAccount {
+  @Field()
+  success!: boolean;
+}
+@ObjectType()
+export class RemoveAvatar {
+  @Field()
+  success!: boolean;
+}

packages/backend/server/src/core/users/users.ts

@@ -0,0 +1,32 @@
+import { Injectable } from '@nestjs/common';
+
+import { PrismaService } from '../../fundamentals';
+
+@Injectable()
+export class UsersService {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async findUserByEmail(email: string) {
+    return this.prisma.user
+      .findUnique({
+        where: { email },
+      })
+      .catch(() => {
+        return null;
+      });
+  }
+
+  async findUserById(id: string) {
+    return this.prisma.user
+      .findUnique({
+        where: { id },
+      })
+      .catch(() => {
+        return null;
+      });
+  }
+
+  async deleteUser(id: string) {
+    return this.prisma.user.delete({ where: { id } });
+  }
+}

packages/backend/server/src/core/utils/__tests__/doc.spec.ts

@@ -0,0 +1,82 @@
+import test from 'ava';
+
+import { DocID, DocVariant } from '../doc';
+
+test('can parse', t => {
+  // workspace only
+  let id = new DocID('ws');
+
+  t.is(id.workspace, 'ws');
+  t.assert(id.isWorkspace);
+
+  // full id
+  id = new DocID('ws:space:sub');
+
+  t.is(id.workspace, 'ws');
+  t.is(id.variant, DocVariant.Space);
+  t.is(id.guid, 'sub');
+
+  // variant only
+  id = new DocID('space:sub', 'ws');
+
+  t.is(id.workspace, 'ws');
+  t.is(id.variant, DocVariant.Space);
+  t.is(id.guid, 'sub');
+
+  // sub id only
+  id = new DocID('sub', 'ws');
+
+  t.is(id.workspace, 'ws');
+  t.is(id.variant, DocVariant.Unknown);
+  t.is(id.guid, 'sub');
+});
+
+test('fail', t => {
+  t.throws(() => new DocID('a:b:c:d'), {
+    message: 'Invalid format of Doc ID: a:b:c:d',
+  });
+  t.throws(() => new DocID(':space:sub'), { message: 'Workspace is required' });
+  t.throws(() => new DocID('space:sub'), { message: 'Workspace is required' });
+  t.throws(() => new DocID('ws:any:sub'), {
+    message: 'Invalid ID variant: any',
+  });
+  t.throws(() => new DocID('ws:space:'), {
+    message: 'ID is required for non-workspace doc',
+  });
+  t.throws(() => new DocID('ws::space'), {
+    message: 'Variant is required for non-workspace doc',
+  });
+});
+
+test('fix', t => {
+  let id = new DocID('ws');
+  // can't fix because the doc variant is [Workspace]
+  id.fixWorkspace('ws2');
+  t.is(id.workspace, 'ws');
+  t.is(id.toString(), 'ws');
+
+  id = new DocID('ws:space:sub');
+
+  id.fixWorkspace('ws2');
+
+  t.is(id.workspace, 'ws2');
+  t.is(id.toString(), 'ws2:space:sub');
+
+  id = new DocID('space:sub', 'ws');
+  t.is(id.workspace, 'ws');
+  t.is(id.toString(), 'ws:space:sub');
+
+  id = new DocID('ws2:space:sub', 'ws');
+  t.is(id.workspace, 'ws');
+  t.is(id.toString(), 'ws:space:sub');
+});
+
+test('special case: `wsId:space:page:pageId`', t => {
+  const id = new DocID('ws:space:page:page');
+  t.is(id.workspace, 'ws');
+  t.is(id.guid, 'page');
+
+  t.throws(() => new DocID('ws:s:p:page'));
+  t.throws(() => new DocID('ws:space:b:page'));
+  t.throws(() => new DocID('ws:s:page:page'));
+});

packages/backend/server/src/core/utils/doc.ts

@@ -0,0 +1,121 @@
+import { registerEnumType } from '@nestjs/graphql';
+
+export enum DocVariant {
+  Workspace = 'workspace',
+  Page = 'page',
+  Space = 'space',
+  Settings = 'settings',
+  Unknown = 'unknown',
+}
+
+registerEnumType(DocVariant, {
+  name: 'DocVariant',
+});
+
+export class DocID {
+  raw: string;
+  workspace: string;
+  variant: DocVariant;
+  private readonly sub: string | null;
+
+  static parse(raw: string): DocID | null {
+    try {
+      return new DocID(raw);
+    } catch (e) {
+      return null;
+    }
+  }
+
+  /**
+   * pure guid for workspace and subdoc without any prefix
+   */
+  get guid(): string {
+    return this.variant === DocVariant.Workspace
+      ? this.workspace
+      : // sub is always truthy when variant is not workspace
+        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+        this.sub!;
+  }
+
+  get full(): string {
+    return this.variant === DocVariant.Workspace
+      ? this.workspace
+      : `${this.workspace}:${this.variant}:${this.sub}`;
+  }
+
+  get isWorkspace(): boolean {
+    return this.variant === DocVariant.Workspace;
+  }
+
+  constructor(raw: string, workspaceId?: string) {
+    if (!raw.length) {
+      throw new Error('Invalid Empty Doc ID');
+    }
+
+    let parts = raw.split(':');
+
+    if (parts.length > 3) {
+      // special adapt case `wsId:space:page:pageId`
+      if (parts[1] === DocVariant.Space && parts[2] === DocVariant.Page) {
+        parts = [workspaceId ?? parts[0], DocVariant.Space, parts[3]];
+      } else {
+        throw new Error(`Invalid format of Doc ID: ${raw}`);
+      }
+    } else if (parts.length === 2) {
+      // `${variant}:${guid}`
+      if (!workspaceId) {
+        throw new Error('Workspace is required');
+      }
+
+      parts.unshift(workspaceId);
+    } else if (parts.length === 1) {
+      // ${ws} or ${pageId}
+      if (workspaceId && parts[0] !== workspaceId) {
+        parts = [workspaceId, DocVariant.Unknown, parts[0]];
+      } else {
+        // parts:[ws] equals [workspaceId]
+      }
+    }
+
+    let workspace = parts.at(0);
+
+    // fix for `${non-workspaceId}:${variant}:${guid}`
+    if (workspaceId) {
+      workspace = workspaceId;
+    }
+
+    const variant = parts.at(1);
+    const docId = parts.at(2);
+
+    if (!workspace) {
+      throw new Error('Workspace is required');
+    }
+
+    if (variant) {
+      if (!Object.values(DocVariant).includes(variant as any)) {
+        throw new Error(`Invalid ID variant: ${variant}`);
+      }
+
+      if (!docId) {
+        throw new Error('ID is required for non-workspace doc');
+      }
+    } else if (docId) {
+      throw new Error('Variant is required for non-workspace doc');
+    }
+
+    this.raw = raw;
+    this.workspace = workspace;
+    this.variant = (variant as DocVariant | undefined) ?? DocVariant.Workspace;
+    this.sub = docId || null;
+  }
+
+  toString() {
+    return this.full;
+  }
+
+  fixWorkspace(workspaceId: string) {
+    if (!this.isWorkspace && this.workspace !== workspaceId) {
+      this.workspace = workspaceId;
+    }
+  }
+}

packages/backend/server/src/core/workspaces/controller.ts

@@ -0,0 +1,150 @@
+import {
+  Controller,
+  ForbiddenException,
+  Get,
+  Logger,
+  NotFoundException,
+  Param,
+  Res,
+} from '@nestjs/common';
+import type { Response } from 'express';
+
+import { CallTimer, PrismaService } from '../../fundamentals';
+import { Auth, CurrentUser, Publicable } from '../auth';
+import { DocHistoryManager, DocManager } from '../doc';
+import { WorkspaceBlobStorage } from '../storage';
+import { UserType } from '../users';
+import { DocID } from '../utils/doc';
+import { PermissionService, PublicPageMode } from './permission';
+import { Permission } from './types';
+
+@Controller('/api/workspaces')
+export class WorkspacesController {
+  logger = new Logger(WorkspacesController.name);
+  constructor(
+    private readonly storage: WorkspaceBlobStorage,
+    private readonly permission: PermissionService,
+    private readonly docManager: DocManager,
+    private readonly historyManager: DocHistoryManager,
+    private readonly prisma: PrismaService
+  ) {}
+
+  // get workspace blob
+  //
+  // NOTE: because graphql can't represent a File, so we have to use REST API to get blob
+  @Get('/:id/blobs/:name')
+  @CallTimer('controllers', 'workspace_get_blob')
+  async blob(
+    @Param('id') workspaceId: string,
+    @Param('name') name: string,
+    @Res() res: Response
+  ) {
+    const { body, metadata } = await this.storage.get(workspaceId, name);
+
+    if (!body) {
+      throw new NotFoundException(
+        `Blob not found in workspace ${workspaceId}: ${name}`
+      );
+    }
+
+    // metadata should always exists if body is not null
+    if (metadata) {
+      res.setHeader('content-type', metadata.contentType);
+      res.setHeader('last-modified', metadata.lastModified.toISOString());
+      res.setHeader('content-length', metadata.contentLength);
+    } else {
+      this.logger.warn(`Blob ${workspaceId}/${name} has no metadata`);
+    }
+
+    res.setHeader('cache-control', 'public, max-age=31536000, immutable');
+    body.pipe(res);
+  }
+
+  // get doc binary
+  @Get('/:id/docs/:guid')
+  @Auth()
+  @Publicable()
+  @CallTimer('controllers', 'workspace_get_doc')
+  async doc(
+    @CurrentUser() user: UserType | undefined,
+    @Param('id') ws: string,
+    @Param('guid') guid: string,
+    @Res() res: Response
+  ) {
+    const docId = new DocID(guid, ws);
+    if (
+      // if a user has the permission
+      !(await this.permission.isAccessible(
+        docId.workspace,
+        docId.guid,
+        user?.id
+      ))
+    ) {
+      throw new ForbiddenException('Permission denied');
+    }
+
+    const update = await this.docManager.getBinary(docId.workspace, docId.guid);
+
+    if (!update) {
+      throw new NotFoundException('Doc not found');
+    }
+
+    if (!docId.isWorkspace) {
+      // fetch the publish page mode for publish page
+      const publishPage = await this.prisma.workspacePage.findUnique({
+        where: {
+          workspaceId_pageId: {
+            workspaceId: docId.workspace,
+            pageId: docId.guid,
+          },
+        },
+      });
+      const publishPageMode =
+        publishPage?.mode === PublicPageMode.Edgeless ? 'edgeless' : 'page';
+
+      res.setHeader('publish-mode', publishPageMode);
+    }
+
+    res.setHeader('content-type', 'application/octet-stream');
+    res.send(update);
+  }
+
+  @Get('/:id/docs/:guid/histories/:timestamp')
+  @Auth()
+  @CallTimer('controllers', 'workspace_get_history')
+  async history(
+    @CurrentUser() user: UserType,
+    @Param('id') ws: string,
+    @Param('guid') guid: string,
+    @Param('timestamp') timestamp: string,
+    @Res() res: Response
+  ) {
+    const docId = new DocID(guid, ws);
+    let ts;
+    try {
+      ts = new Date(timestamp);
+    } catch (e) {
+      throw new Error('Invalid timestamp');
+    }
+
+    await this.permission.checkPagePermission(
+      docId.workspace,
+      docId.guid,
+      user.id,
+      Permission.Write
+    );
+
+    const history = await this.historyManager.get(
+      docId.workspace,
+      docId.guid,
+      ts
+    );
+
+    if (history) {
+      res.setHeader('content-type', 'application/octet-stream');
+      res.send(history.blob);
+    } else {
+      throw new NotFoundException('Doc history not found');
+    }
+  }
+}

packages/backend/server/src/core/workspaces/index.ts

@@ -0,0 +1,34 @@
+import { Module } from '@nestjs/common';
+
+import { DocModule } from '../doc';
+import { FeatureModule } from '../features';
+import { QuotaModule } from '../quota';
+import { StorageModule } from '../storage';
+import { UsersService } from '../users';
+import { WorkspacesController } from './controller';
+import { WorkspaceManagementResolver } from './management';
+import { PermissionService } from './permission';
+import {
+  DocHistoryResolver,
+  PagePermissionResolver,
+  WorkspaceBlobResolver,
+  WorkspaceResolver,
+} from './resolvers';
+
+@Module({
+  imports: [DocModule, FeatureModule, QuotaModule, StorageModule],
+  controllers: [WorkspacesController],
+  providers: [
+    WorkspaceResolver,
+    WorkspaceManagementResolver,
+    PermissionService,
+    UsersService,
+    PagePermissionResolver,
+    DocHistoryResolver,
+    WorkspaceBlobResolver,
+  ],
+  exports: [PermissionService],
+})
+export class WorkspaceModule {}
+
+export type { InvitationType, WorkspaceType } from './types';

packages/backend/server/src/core/workspaces/management.ts

@@ -0,0 +1,136 @@
+import { ForbiddenException, UseGuards } from '@nestjs/common';
+import {
+  Args,
+  Int,
+  Mutation,
+  Parent,
+  Query,
+  ResolveField,
+  Resolver,
+} from '@nestjs/graphql';
+
+import { CloudThrottlerGuard, Throttle } from '../../fundamentals';
+import { Auth, CurrentUser } from '../auth';
+import { FeatureManagementService, FeatureType } from '../features';
+import { UserType } from '../users';
+import { PermissionService } from './permission';
+import { WorkspaceType } from './types';
+
+@UseGuards(CloudThrottlerGuard)
+@Auth()
+@Resolver(() => WorkspaceType)
+export class WorkspaceManagementResolver {
+  constructor(
+    private readonly feature: FeatureManagementService,
+    private readonly permission: PermissionService
+  ) {}
+
+  @Throttle({
+    default: {
+      limit: 10,
+      ttl: 60,
+    },
+  })
+  @Mutation(() => Int)
+  async addWorkspaceFeature(
+    @CurrentUser() currentUser: UserType,
+    @Args('workspaceId') workspaceId: string,
+    @Args('feature', { type: () => FeatureType }) feature: FeatureType
+  ): Promise<number> {
+    if (!this.feature.isStaff(currentUser.email)) {
+      throw new ForbiddenException('You are not allowed to do this');
+    }
+
+    return this.feature.addWorkspaceFeatures(workspaceId, feature);
+  }
+
+  @Throttle({
+    default: {
+      limit: 10,
+      ttl: 60,
+    },
+  })
+  @Mutation(() => Int)
+  async removeWorkspaceFeature(
+    @CurrentUser() currentUser: UserType,
+    @Args('workspaceId') workspaceId: string,
+    @Args('feature', { type: () => FeatureType }) feature: FeatureType
+  ): Promise<boolean> {
+    if (!this.feature.isStaff(currentUser.email)) {
+      throw new ForbiddenException('You are not allowed to do this');
+    }
+
+    return this.feature.removeWorkspaceFeature(workspaceId, feature);
+  }
+
+  @Throttle({
+    default: {
+      limit: 10,
+      ttl: 60,
+    },
+  })
+  @Query(() => [WorkspaceType])
+  async listWorkspaceFeatures(
+    @CurrentUser() user: UserType,
+    @Args('feature', { type: () => FeatureType }) feature: FeatureType
+  ): Promise<WorkspaceType[]> {
+    if (!this.feature.isStaff(user.email)) {
+      throw new ForbiddenException('You are not allowed to do this');
+    }
+
+    return this.feature.listFeatureWorkspaces(feature);
+  }
+
+  @Mutation(() => Boolean)
+  async setWorkspaceExperimentalFeature(
+    @CurrentUser() user: UserType,
+    @Args('workspaceId') workspaceId: string,
+    @Args('feature', { type: () => FeatureType }) feature: FeatureType,
+    @Args('enable') enable: boolean
+  ): Promise<boolean> {
+    if (!(await this.feature.canEarlyAccess(user.email))) {
+      throw new ForbiddenException('You are not allowed to do this');
+    }
+
+    const owner = await this.permission.getWorkspaceOwner(workspaceId);
+    const availableFeatures = await this.availableFeatures(user);
+    if (owner.user.id !== user.id || !availableFeatures.includes(feature)) {
+      throw new ForbiddenException('You are not allowed to do this');
+    }
+
+    if (enable) {
+      return await this.feature
+        .addWorkspaceFeatures(
+          workspaceId,
+          feature,
+          undefined,
+          'add by experimental feature api'
+        )
+        .then(id => id > 0);
+    } else {
+      return await this.feature.removeWorkspaceFeature(workspaceId, feature);
+    }
+  }
+
+  @ResolveField(() => [FeatureType], {
+    description: 'Available features of workspace',
+    complexity: 2,
+  })
+  async availableFeatures(
+    @CurrentUser() user: UserType
+  ): Promise<FeatureType[]> {
+    if (await this.feature.canEarlyAccess(user.email)) {
+      return [FeatureType.Copilot];
+    } else {
+      return [];
+    }
+  }
+
+  @ResolveField(() => [FeatureType], {
+    description: 'Enabled features of workspace',
+    complexity: 2,
+  })
+  async features(@Parent() workspace: WorkspaceType): Promise<FeatureType[]> {
+    return this.feature.getWorkspaceFeatures(workspace.id);
+  }
+}

packages/backend/server/src/core/workspaces/permission.ts

@@ -0,0 +1,426 @@
+import { ForbiddenException, Injectable } from '@nestjs/common';
+import { Prisma } from '@prisma/client';
+
+import { PrismaService } from '../../fundamentals';
+import { Permission } from './types';
+
+export enum PublicPageMode {
+  Page,
+  Edgeless,
+}
+
+@Injectable()
+export class PermissionService {
+  constructor(private readonly prisma: PrismaService) {}
+
+  /// Start regin: workspace permission
+  async get(ws: string, user: string) {
+    const data = await this.prisma.workspaceUserPermission.findFirst({
+      where: {
+        workspaceId: ws,
+        userId: user,
+        accepted: true,
+      },
+    });
+
+    return data?.type as Permission;
+  }
+
+  async getOwnedWorkspaces(userId: string) {
+    return this.prisma.workspaceUserPermission
+      .findMany({
+        where: {
+          userId,
+          accepted: true,
+          type: Permission.Owner,
+        },
+        select: {
+          workspaceId: true,
+        },
+      })
+      .then(data => data.map(({ workspaceId }) => workspaceId));
+  }
+
+  async getWorkspaceOwner(workspaceId: string) {
+    return this.prisma.workspaceUserPermission.findFirstOrThrow({
+      where: {
+        workspaceId,
+        type: Permission.Owner,
+      },
+      include: {
+        user: true,
+      },
+    });
+  }
+
+  async tryGetWorkspaceOwner(workspaceId: string) {
+    return this.prisma.workspaceUserPermission.findFirst({
+      where: {
+        workspaceId,
+        type: Permission.Owner,
+      },
+      include: {
+        user: true,
+      },
+    });
+  }
+
+  async isAccessible(ws: string, id: string, user?: string): Promise<boolean> {
+    // workspace
+    if (ws === id) {
+      return this.tryCheckWorkspace(ws, user, Permission.Read);
+    }
+
+    return this.tryCheckPage(ws, id, user);
+  }
+
+  async checkWorkspace(
+    ws: string,
+    user?: string,
+    permission: Permission = Permission.Read
+  ) {
+    if (!(await this.tryCheckWorkspace(ws, user, permission))) {
+      throw new ForbiddenException('Permission denied');
+    }
+  }
+
+  async tryCheckWorkspace(
+    ws: string,
+    user?: string,
+    permission: Permission = Permission.Read
+  ) {
+    // If the permission is read, we should check if the workspace is public
+    if (permission === Permission.Read) {
+      const count = await this.prisma.workspace.count({
+        where: { id: ws, public: true },
+      });
+
+      // workspace is public
+      // accessible
+      if (count > 0) {
+        return true;
+      }
+
+      const publicPage = await this.prisma.workspacePage.findFirst({
+        select: {
+          pageId: true,
+        },
+        where: {
+          workspaceId: ws,
+          public: true,
+        },
+      });
+
+      // has any public pages
+      if (publicPage) {
+        return true;
+      }
+    }
+
+    if (user) {
+      // normally check if the user has the permission
+      const count = await this.prisma.workspaceUserPermission.count({
+        where: {
+          workspaceId: ws,
+          userId: user,
+          accepted: true,
+          type: {
+            gte: permission,
+          },
+        },
+      });
+
+      return count > 0;
+    }
+
+    // unsigned in, workspace is not public
+    // unaccessible
+    return false;
+  }
+
+  async grant(
+    ws: string,
+    user: string,
+    permission: Permission = Permission.Read
+  ): Promise<string> {
+    const data = await this.prisma.workspaceUserPermission.findFirst({
+      where: {
+        workspaceId: ws,
+        userId: user,
+        accepted: true,
+      },
+    });
+
+    if (data) {
+      const [p] = await this.prisma.$transaction(
+        [
+          this.prisma.workspaceUserPermission.update({
+            where: {
+              workspaceId_userId: {
+                workspaceId: ws,
+                userId: user,
+              },
+            },
+            data: {
+              type: permission,
+            },
+          }),
+
+          // If the new permission is owner, we need to revoke old owner
+          permission === Permission.Owner
+            ? this.prisma.workspaceUserPermission.updateMany({
+                where: {
+                  workspaceId: ws,
+                  type: Permission.Owner,
+                  userId: {
+                    not: user,
+                  },
+                },
+                data: {
+                  type: Permission.Admin,
+                },
+              })
+            : null,
+        ].filter(Boolean) as Prisma.PrismaPromise<any>[]
+      );
+
+      return p.id;
+    }
+
+    return this.prisma.workspaceUserPermission
+      .create({
+        data: {
+          workspaceId: ws,
+          userId: user,
+          type: permission,
+        },
+      })
+      .then(p => p.id);
+  }
+
+  async getWorkspaceInvitation(invitationId: string, workspaceId: string) {
+    return this.prisma.workspaceUserPermission.findUniqueOrThrow({
+      where: {
+        id: invitationId,
+        workspaceId,
+      },
+      include: {
+        user: true,
+      },
+    });
+  }
+
+  async acceptWorkspaceInvitation(invitationId: string, workspaceId: string) {
+    const result = await this.prisma.workspaceUserPermission.updateMany({
+      where: {
+        id: invitationId,
+        workspaceId: workspaceId,
+      },
+      data: {
+        accepted: true,
+      },
+    });
+
+    return result.count > 0;
+  }
+
+  async revokeWorkspace(ws: string, user: string) {
+    const result = await this.prisma.workspaceUserPermission.deleteMany({
+      where: {
+        workspaceId: ws,
+        userId: user,
+        type: {
+          // We shouldn't revoke owner permission, should auto deleted by workspace/user delete cascading
+          not: Permission.Owner,
+        },
+      },
+    });
+
+    return result.count > 0;
+  }
+  /// End regin: workspace permission
+
+  /// Start regin: page permission
+  async checkPagePermission(
+    ws: string,
+    page: string,
+    user?: string,
+    permission = Permission.Read
+  ) {
+    if (!(await this.tryCheckPage(ws, page, user, permission))) {
+      throw new ForbiddenException('Permission denied');
+    }
+  }
+
+  async tryCheckPage(
+    ws: string,
+    page: string,
+    user?: string,
+    permission = Permission.Read
+  ) {
+    // check whether page is public
+    if (permission === Permission.Read) {
+      const count = await this.prisma.workspacePage.count({
+        where: {
+          workspaceId: ws,
+          pageId: page,
+          public: true,
+        },
+      });
+
+      // page is public
+      // accessible
+      if (count > 0) {
+        return true;
+      }
+    }
+
+    if (user) {
+      const count = await this.prisma.workspacePageUserPermission.count({
+        where: {
+          workspaceId: ws,
+          pageId: page,
+          userId: user,
+          accepted: true,
+          type: {
+            gte: permission,
+          },
+        },
+      });
+
+      // page shared to user
+      // accessible
+      if (count > 0) {
+        return true;
+      }
+    }
+
+    // check whether user has workspace related permission
+    return this.tryCheckWorkspace(ws, user, permission);
+  }
+
+  async publishPage(ws: string, page: string, mode = PublicPageMode.Page) {
+    return this.prisma.workspacePage.upsert({
+      where: {
+        workspaceId_pageId: {
+          workspaceId: ws,
+          pageId: page,
+        },
+      },
+      update: {
+        public: true,
+        mode,
+      },
+      create: {
+        workspaceId: ws,
+        pageId: page,
+        mode,
+        public: true,
+      },
+    });
+  }
+
+  async revokePublicPage(ws: string, page: string) {
+    const workspacePage = await this.prisma.workspacePage.findUnique({
+      where: {
+        workspaceId_pageId: {
+          workspaceId: ws,
+          pageId: page,
+        },
+      },
+    });
+    if (!workspacePage) {
+      throw new Error('Page is not public');
+    }
+
+    return this.prisma.workspacePage.update({
+      where: {
+        workspaceId_pageId: {
+          workspaceId: ws,
+          pageId: page,
+        },
+      },
+      data: {
+        public: false,
+      },
+    });
+  }
+
+  async grantPage(
+    ws: string,
+    page: string,
+    user: string,
+    permission: Permission = Permission.Read
+  ) {
+    const data = await this.prisma.workspacePageUserPermission.findFirst({
+      where: {
+        workspaceId: ws,
+        pageId: page,
+        userId: user,
+        accepted: true,
+      },
+    });
+
+    if (data) {
+      const [p] = await this.prisma.$transaction(
+        [
+          this.prisma.workspacePageUserPermission.update({
+            where: {
+              id: data.id,
+            },
+            data: {
+              type: permission,
+            },
+          }),
+
+          // If the new permission is owner, we need to revoke old owner
+          permission === Permission.Owner
+            ? this.prisma.workspacePageUserPermission.updateMany({
+                where: {
+                  workspaceId: ws,
+                  pageId: page,
+                  type: Permission.Owner,
+                  userId: {
+                    not: user,
+                  },
+                },
+                data: {
+                  type: Permission.Admin,
+                },
+              })
+            : null,
+        ].filter(Boolean) as Prisma.PrismaPromise<any>[]
+      );
+
+      return p.id;
+    }
+
+    return this.prisma.workspacePageUserPermission
+      .create({
+        data: {
+          workspaceId: ws,
+          pageId: page,
+          userId: user,
+          type: permission,
+        },
+      })
+      .then(p => p.id);
+  }
+
+  async revokePage(ws: string, page: string, user: string) {
+    const result = await this.prisma.workspacePageUserPermission.deleteMany({
+      where: {
+        workspaceId: ws,
+        pageId: page,
+        userId: user,
+        type: {
+          // We shouldn't revoke owner permission, should auto deleted by workspace/user delete cascading
+          not: Permission.Owner,
+        },
+      },
+    });
+
+    return result.count > 0;
+  }
+  /// End regin: page permission
+}

packages/backend/server/src/core/workspaces/resolvers/blob.ts

@@ -0,0 +1,226 @@
+import { HttpStatus, Logger, UseGuards } from '@nestjs/common';
+import {
+  Args,
+  Int,
+  Mutation,
+  Parent,
+  Query,
+  ResolveField,
+  Resolver,
+} from '@nestjs/graphql';
+import { GraphQLError } from 'graphql';
+import { SafeIntResolver } from 'graphql-scalars';
+import GraphQLUpload from 'graphql-upload/GraphQLUpload.mjs';
+
+import {
+  CloudThrottlerGuard,
+  type FileUpload,
+  MakeCache,
+  PreventCache,
+} from '../../../fundamentals';
+import { Auth, CurrentUser } from '../../auth';
+import { FeatureManagementService, FeatureType } from '../../features';
+import { QuotaManagementService } from '../../quota';
+import { WorkspaceBlobStorage } from '../../storage';
+import { UserType } from '../../users';
+import { PermissionService } from '../permission';
+import { Permission, WorkspaceBlobSizes, WorkspaceType } from '../types';
+
+@UseGuards(CloudThrottlerGuard)
+@Auth()
+@Resolver(() => WorkspaceType)
+export class WorkspaceBlobResolver {
+  logger = new Logger(WorkspaceBlobResolver.name);
+  constructor(
+    private readonly permissions: PermissionService,
+    private readonly feature: FeatureManagementService,
+    private readonly quota: QuotaManagementService,
+    private readonly storage: WorkspaceBlobStorage
+  ) {}
+
+  @ResolveField(() => [String], {
+    description: 'List blobs of workspace',
+    complexity: 2,
+  })
+  async blobs(
+    @CurrentUser() user: UserType,
+    @Parent() workspace: WorkspaceType
+  ) {
+    await this.permissions.checkWorkspace(workspace.id, user.id);
+
+    return this.storage
+      .list(workspace.id)
+      .then(list => list.map(item => item.key));
+  }
+
+  @ResolveField(() => Int, {
+    description: 'Blobs size of workspace',
+    complexity: 2,
+  })
+  async blobsSize(@Parent() workspace: WorkspaceType) {
+    return this.storage.totalSize(workspace.id);
+  }
+
+  /**
+   * @deprecated use `workspace.blobs` instead
+   */
+  @Query(() => [String], {
+    description: 'List blobs of workspace',
+    deprecationReason: 'use `workspace.blobs` instead',
+  })
+  @MakeCache(['blobs'], ['workspaceId'])
+  async listBlobs(
+    @CurrentUser() user: UserType,
+    @Args('workspaceId') workspaceId: string
+  ) {
+    await this.permissions.checkWorkspace(workspaceId, user.id);
+
+    return this.storage
+      .list(workspaceId)
+      .then(list => list.map(item => item.key));
+  }
+
+  /**
+   * @deprecated use `user.storageUsage` instead
+   */
+  @Query(() => WorkspaceBlobSizes, {
+    deprecationReason: 'use `user.storageUsage` instead',
+  })
+  async collectAllBlobSizes(@CurrentUser() user: UserType) {
+    const size = await this.quota.getUserUsage(user.id);
+    return { size };
+  }
+
+  /**
+   * @deprecated mutation `setBlob` will check blob limit & quota usage
+   */
+  @Query(() => WorkspaceBlobSizes, {
+    deprecationReason: 'no more needed',
+  })
+  async checkBlobSize(
+    @CurrentUser() user: UserType,
+    @Args('workspaceId') workspaceId: string,
+    @Args('size', { type: () => SafeIntResolver }) blobSize: number
+  ) {
+    const canWrite = await this.permissions.tryCheckWorkspace(
+      workspaceId,
+      user.id,
+      Permission.Write
+    );
+    if (canWrite) {
+      const size = await this.quota.checkBlobQuota(workspaceId, blobSize);
+      return { size };
+    }
+    return false;
+  }
+
+  @Mutation(() => String)
+  @PreventCache(['blobs'], ['workspaceId'])
+  async setBlob(
+    @CurrentUser() user: UserType,
+    @Args('workspaceId') workspaceId: string,
+    @Args({ name: 'blob', type: () => GraphQLUpload })
+    blob: FileUpload
+  ) {
+    await this.permissions.checkWorkspace(
+      workspaceId,
+      user.id,
+      Permission.Write
+    );
+
+    const { storageQuota, usedSize, blobLimit } =
+      await this.quota.getWorkspaceUsage(workspaceId);
+
+    const unlimited = await this.feature.hasWorkspaceFeature(
+      workspaceId,
+      FeatureType.UnlimitedWorkspace
+    );
+
+    const checkExceeded = (recvSize: number) => {
+      if (!storageQuota) {
+        throw new GraphQLError('cannot find user quota', {
+          extensions: {
+            status: HttpStatus[HttpStatus.FORBIDDEN],
+            code: HttpStatus.FORBIDDEN,
+          },
+        });
+      }
+      const total = usedSize + recvSize;
+      // only skip total storage check if workspace has unlimited feature
+      if (total > storageQuota && !unlimited) {
+        this.logger.log(
+          `storage size limit exceeded: ${total} > ${storageQuota}`
+        );
+        return true;
+      } else if (recvSize > blobLimit) {
+        this.logger.log(`blob size limit exceeded: ${recvSize} > ${blobLimit}`);
+        return true;
+      } else {
+        return false;
+      }
+    };
+
+    if (checkExceeded(0)) {
+      throw new GraphQLError('storage or blob size limit exceeded', {
+        extensions: {
+          status: HttpStatus[HttpStatus.PAYLOAD_TOO_LARGE],
+          code: HttpStatus.PAYLOAD_TOO_LARGE,
+        },
+      });
+    }
+    const buffer = await new Promise<Buffer>((resolve, reject) => {
+      const stream = blob.createReadStream();
+      const chunks: Uint8Array[] = [];
+      stream.on('data', chunk => {
+        chunks.push(chunk);
+
+        // check size after receive each chunk to avoid unnecessary memory usage
+        const bufferSize = chunks.reduce((acc, cur) => acc + cur.length, 0);
+        if (checkExceeded(bufferSize)) {
+          reject(
+            new GraphQLError('storage or blob size limit exceeded', {
+              extensions: {
+                status: HttpStatus[HttpStatus.PAYLOAD_TOO_LARGE],
+                code: HttpStatus.PAYLOAD_TOO_LARGE,
+              },
+            })
+          );
+        }
+      });
+      stream.on('error', reject);
+      stream.on('end', () => {
+        const buffer = Buffer.concat(chunks);
+
+        if (checkExceeded(buffer.length)) {
+          reject(
+            new GraphQLError('storage limit exceeded', {
+              extensions: {
+                status: HttpStatus[HttpStatus.PAYLOAD_TOO_LARGE],
+                code: HttpStatus.PAYLOAD_TOO_LARGE,
+              },
+            })
+          );
+        } else {
+          resolve(buffer);
+        }
+      });
+    });
+
+    await this.storage.put(workspaceId, blob.filename, buffer);
+    return blob.filename;
+  }
+
+  @Mutation(() => Boolean)
+  @PreventCache(['blobs'], ['workspaceId'])
+  async deleteBlob(
+    @CurrentUser() user: UserType,
+    @Args('workspaceId') workspaceId: string,
+    @Args('hash') name: string
+  ) {
+    await this.permissions.checkWorkspace(workspaceId, user.id);
+
+    await this.storage.delete(workspaceId, name);
+
+    return true;
+  }
+}

packages/backend/server/src/core/workspaces/resolvers/history.ts

@@ -0,0 +1,94 @@
+import { UseGuards } from '@nestjs/common';
+import {
+  Args,
+  Field,
+  GraphQLISODateTime,
+  Int,
+  Mutation,
+  ObjectType,
+  Parent,
+  ResolveField,
+  Resolver,
+} from '@nestjs/graphql';
+import type { SnapshotHistory } from '@prisma/client';
+
+import { CloudThrottlerGuard } from '../../../fundamentals';
+import { Auth, CurrentUser } from '../../auth';
+import { DocHistoryManager } from '../../doc';
+import { UserType } from '../../users';
+import { DocID } from '../../utils/doc';
+import { PermissionService } from '../permission';
+import { Permission, WorkspaceType } from '../types';
+
+@ObjectType()
+class DocHistoryType implements Partial<SnapshotHistory> {
+  @Field()
+  workspaceId!: string;
+
+  @Field()
+  id!: string;
+
+  @Field(() => GraphQLISODateTime)
+  timestamp!: Date;
+}
+
+@UseGuards(CloudThrottlerGuard)
+@Resolver(() => WorkspaceType)
+export class DocHistoryResolver {
+  constructor(
+    private readonly historyManager: DocHistoryManager,
+    private readonly permission: PermissionService
+  ) {}
+
+  @ResolveField(() => [DocHistoryType])
+  async histories(
+    @Parent() workspace: WorkspaceType,
+    @Args('guid') guid: string,
+    @Args({ name: 'before', type: () => GraphQLISODateTime, nullable: true })
+    timestamp: Date = new Date(),
+    @Args({ name: 'take', type: () => Int, nullable: true })
+    take?: number
+  ): Promise<DocHistoryType[]> {
+    const docId = new DocID(guid, workspace.id);
+
+    if (docId.isWorkspace) {
+      throw new Error('Invalid guid for listing doc histories.');
+    }
+
+    return this.historyManager
+      .list(workspace.id, docId.guid, timestamp, take)
+      .then(rows =>
+        rows.map(({ timestamp }) => {
+          return {
+            workspaceId: workspace.id,
+            id: docId.guid,
+            timestamp,
+          };
+        })
+      );
+  }
+
+  @Auth()
+  @Mutation(() => Date)
+  async recoverDoc(
+    @CurrentUser() user: UserType,
+    @Args('workspaceId') workspaceId: string,
+    @Args('guid') guid: string,
+    @Args({ name: 'timestamp', type: () => GraphQLISODateTime }) timestamp: Date
+  ): Promise<Date> {
+    const docId = new DocID(guid, workspaceId);
+
+    if (docId.isWorkspace) {
+      throw new Error('Invalid guid for recovering doc from history.');
+    }
+
+    await this.permission.checkPagePermission(
+      docId.workspace,
+      docId.guid,
+      user.id,
+      Permission.Write
+    );
+
+    return this.historyManager.recover(docId.workspace, docId.guid, timestamp);
+  }
+}

packages/backend/server/src/core/workspaces/resolvers/index.ts

@@ -0,0 +1,4 @@
+export * from './blob';
+export * from './history';
+export * from './page';
+export * from './workspace';

packages/backend/server/src/core/workspaces/resolvers/page.ts

@@ -0,0 +1,162 @@
+import { ForbiddenException, UseGuards } from '@nestjs/common';
+import {
+  Args,
+  Field,
+  Mutation,
+  ObjectType,
+  Parent,
+  registerEnumType,
+  ResolveField,
+  Resolver,
+} from '@nestjs/graphql';
+import type { WorkspacePage as PrismaWorkspacePage } from '@prisma/client';
+
+import { CloudThrottlerGuard, PrismaService } from '../../../fundamentals';
+import { Auth, CurrentUser } from '../../auth';
+import { UserType } from '../../users';
+import { DocID } from '../../utils/doc';
+import { PermissionService, PublicPageMode } from '../permission';
+import { Permission, WorkspaceType } from '../types';
+
+registerEnumType(PublicPageMode, {
+  name: 'PublicPageMode',
+  description: 'The mode which the public page default in',
+});
+
+@ObjectType()
+class WorkspacePage implements Partial<PrismaWorkspacePage> {
+  @Field(() => String, { name: 'id' })
+  pageId!: string;
+
+  @Field()
+  workspaceId!: string;
+
+  @Field(() => PublicPageMode)
+  mode!: PublicPageMode;
+
+  @Field()
+  public!: boolean;
+}
+
+@UseGuards(CloudThrottlerGuard)
+@Auth()
+@Resolver(() => WorkspaceType)
+export class PagePermissionResolver {
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly permission: PermissionService
+  ) {}
+
+  /**
+   * @deprecated
+   */
+  @ResolveField(() => [String], {
+    description: 'Shared pages of workspace',
+    complexity: 2,
+    deprecationReason: 'use WorkspaceType.publicPages',
+  })
+  async sharedPages(@Parent() workspace: WorkspaceType) {
+    const data = await this.prisma.workspacePage.findMany({
+      where: {
+        workspaceId: workspace.id,
+        public: true,
+      },
+    });
+
+    return data.map(row => row.pageId);
+  }
+
+  @ResolveField(() => [WorkspacePage], {
+    description: 'Public pages of a workspace',
+    complexity: 2,
+  })
+  async publicPages(@Parent() workspace: WorkspaceType) {
+    return this.prisma.workspacePage.findMany({
+      where: {
+        workspaceId: workspace.id,
+        public: true,
+      },
+    });
+  }
+
+  /**
+   * @deprecated
+   */
+  @Mutation(() => Boolean, {
+    name: 'sharePage',
+    deprecationReason: 'renamed to publicPage',
+  })
+  async deprecatedSharePage(
+    @CurrentUser() user: UserType,
+    @Args('workspaceId') workspaceId: string,
+    @Args('pageId') pageId: string
+  ) {
+    await this.publishPage(user, workspaceId, pageId, PublicPageMode.Page);
+    return true;
+  }
+
+  @Mutation(() => WorkspacePage)
+  async publishPage(
+    @CurrentUser() user: UserType,
+    @Args('workspaceId') workspaceId: string,
+    @Args('pageId') pageId: string,
+    @Args({
+      name: 'mode',
+      type: () => PublicPageMode,
+      nullable: true,
+      defaultValue: PublicPageMode.Page,
+    })
+    mode: PublicPageMode
+  ) {
+    const docId = new DocID(pageId, workspaceId);
+
+    if (docId.isWorkspace) {
+      throw new ForbiddenException('Expect page not to be workspace');
+    }
+
+    await this.permission.checkWorkspace(
+      docId.workspace,
+      user.id,
+      Permission.Read
+    );
+
+    return this.permission.publishPage(docId.workspace, docId.guid, mode);
+  }
+
+  /**
+   * @deprecated
+   */
+  @Mutation(() => Boolean, {
+    name: 'revokePage',
+    deprecationReason: 'use revokePublicPage',
+  })
+  async deprecatedRevokePage(
+    @CurrentUser() user: UserType,
+    @Args('workspaceId') workspaceId: string,
+    @Args('pageId') pageId: string
+  ) {
+    await this.revokePublicPage(user, workspaceId, pageId);
+    return true;
+  }
+
+  @Mutation(() => WorkspacePage)
+  async revokePublicPage(
+    @CurrentUser() user: UserType,
+    @Args('workspaceId') workspaceId: string,
+    @Args('pageId') pageId: string
+  ) {
+    const docId = new DocID(pageId, workspaceId);
+
+    if (docId.isWorkspace) {
+      throw new ForbiddenException('Expect page not to be workspace');
+    }
+
+    await this.permission.checkWorkspace(
+      docId.workspace,
+      user.id,
+      Permission.Read
+    );
+
+    return this.permission.revokePublicPage(docId.workspace, docId.guid);
+  }
+}

packages/backend/server/src/core/workspaces/resolvers/workspace.ts

@@ -0,0 +1,560 @@
+import {
+  ForbiddenException,
+  HttpStatus,
+  Logger,
+  NotFoundException,
+  UseGuards,
+} from '@nestjs/common';
+import {
+  Args,
+  Int,
+  Mutation,
+  Parent,
+  Query,
+  ResolveField,
+  Resolver,
+} from '@nestjs/graphql';
+import type { User } from '@prisma/client';
+import { getStreamAsBuffer } from 'get-stream';
+import { GraphQLError } from 'graphql';
+import GraphQLUpload from 'graphql-upload/GraphQLUpload.mjs';
+import { applyUpdate, Doc } from 'yjs';
+
+import {
+  CloudThrottlerGuard,
+  EventEmitter,
+  type FileUpload,
+  MailService,
+  PrismaService,
+  Throttle,
+} from '../../../fundamentals';
+import { Auth, CurrentUser, Public } from '../../auth';
+import { AuthService } from '../../auth/service';
+import { FeatureManagementService, FeatureType } from '../../features';
+import { QuotaManagementService, QuotaQueryType } from '../../quota';
+import { WorkspaceBlobStorage } from '../../storage';
+import { UsersService, UserType } from '../../users';
+import { PermissionService } from '../permission';
+import {
+  InvitationType,
+  InviteUserType,
+  Permission,
+  UpdateWorkspaceInput,
+  WorkspaceType,
+} from '../types';
+import { defaultWorkspaceAvatar } from '../utils';
+
+/**
+ * Workspace resolver
+ * Public apis rate limit: 10 req/m
+ * Other rate limit: 120 req/m
+ */
+@UseGuards(CloudThrottlerGuard)
+@Auth()
+@Resolver(() => WorkspaceType)
+export class WorkspaceResolver {
+  private readonly logger = new Logger(WorkspaceResolver.name);
+
+  constructor(
+    private readonly auth: AuthService,
+    private readonly mailer: MailService,
+    private readonly prisma: PrismaService,
+    private readonly permissions: PermissionService,
+    private readonly feature: FeatureManagementService,
+    private readonly quota: QuotaManagementService,
+    private readonly users: UsersService,
+    private readonly event: EventEmitter,
+    private readonly blobStorage: WorkspaceBlobStorage
+  ) {}
+
+  @ResolveField(() => Permission, {
+    description: 'Permission of current signed in user in workspace',
+    complexity: 2,
+  })
+  async permission(
+    @CurrentUser() user: UserType,
+    @Parent() workspace: WorkspaceType
+  ) {
+    // may applied in workspaces query
+    if ('permission' in workspace) {
+      return workspace.permission;
+    }
+
+    const permission = await this.permissions.get(workspace.id, user.id);
+
+    if (!permission) {
+      throw new ForbiddenException();
+    }
+
+    return permission;
+  }
+
+  @ResolveField(() => Int, {
+    description: 'member count of workspace',
+    complexity: 2,
+  })
+  memberCount(@Parent() workspace: WorkspaceType) {
+    return this.prisma.workspaceUserPermission.count({
+      where: {
+        workspaceId: workspace.id,
+      },
+    });
+  }
+
+  @ResolveField(() => UserType, {
+    description: 'Owner of workspace',
+    complexity: 2,
+  })
+  async owner(@Parent() workspace: WorkspaceType) {
+    const data = await this.permissions.getWorkspaceOwner(workspace.id);
+
+    return data.user;
+  }
+
+  @ResolveField(() => [InviteUserType], {
+    description: 'Members of workspace',
+    complexity: 2,
+  })
+  async members(
+    @Parent() workspace: WorkspaceType,
+    @Args('skip', { type: () => Int, nullable: true }) skip?: number,
+    @Args('take', { type: () => Int, nullable: true }) take?: number
+  ) {
+    const data = await this.prisma.workspaceUserPermission.findMany({
+      where: {
+        workspaceId: workspace.id,
+      },
+      skip,
+      take: take || 8,
+      orderBy: [
+        {
+          createdAt: 'asc',
+        },
+        {
+          type: 'desc',
+        },
+      ],
+      include: {
+        user: true,
+      },
+    });
+
+    return data
+      .filter(({ user }) => !!user)
+      .map(({ id, accepted, type, user }) => ({
+        ...user,
+        permission: type,
+        inviteId: id,
+        accepted,
+      }));
+  }
+
+  @ResolveField(() => QuotaQueryType, {
+    name: 'quota',
+    description: 'quota of workspace',
+    complexity: 2,
+  })
+  workspaceQuota(@Parent() workspace: WorkspaceType) {
+    return this.quota.getWorkspaceUsage(workspace.id);
+  }
+
+  @Query(() => Boolean, {
+    description: 'Get is owner of workspace',
+    complexity: 2,
+  })
+  async isOwner(
+    @CurrentUser() user: UserType,
+    @Args('workspaceId') workspaceId: string
+  ) {
+    const data = await this.permissions.tryGetWorkspaceOwner(workspaceId);
+
+    return data?.user?.id === user.id;
+  }
+
+  @Query(() => [WorkspaceType], {
+    description: 'Get all accessible workspaces for current user',
+    complexity: 2,
+  })
+  async workspaces(@CurrentUser() user: User) {
+    const data = await this.prisma.workspaceUserPermission.findMany({
+      where: {
+        userId: user.id,
+        accepted: true,
+      },
+      include: {
+        workspace: true,
+      },
+    });
+
+    return data.map(({ workspace, type }) => {
+      return {
+        ...workspace,
+        permission: type,
+      };
+    });
+  }
+
+  @Throttle({
+    default: {
+      limit: 10,
+      ttl: 30,
+    },
+  })
+  @Public()
+  @Query(() => WorkspaceType, {
+    description: 'Get public workspace by id',
+  })
+  async publicWorkspace(@Args('id') id: string) {
+    const workspace = await this.prisma.workspace.findUnique({
+      where: { id },
+    });
+
+    if (workspace?.public) {
+      return workspace;
+    }
+
+    throw new NotFoundException("Workspace doesn't exist");
+  }
+
+  @Query(() => WorkspaceType, {
+    description: 'Get workspace by id',
+  })
+  async workspace(@CurrentUser() user: UserType, @Args('id') id: string) {
+    await this.permissions.checkWorkspace(id, user.id);
+    const workspace = await this.prisma.workspace.findUnique({ where: { id } });
+
+    if (!workspace) {
+      throw new NotFoundException("Workspace doesn't exist");
+    }
+
+    return workspace;
+  }
+
+  @Mutation(() => WorkspaceType, {
+    description: 'Create a new workspace',
+  })
+  async createWorkspace(
+    @CurrentUser() user: UserType,
+    // we no longer support init workspace with a preload file
+    // use sync system to uploading them once created
+    @Args({ name: 'init', type: () => GraphQLUpload, nullable: true })
+    init: FileUpload | null
+  ) {
+    const workspace = await this.prisma.workspace.create({
+      data: {
+        public: false,
+        permissions: {
+          create: {
+            type: Permission.Owner,
+            user: {
+              connect: {
+                id: user.id,
+              },
+            },
+            accepted: true,
+          },
+        },
+      },
+    });
+
+    if (init) {
+      // convert stream to buffer
+      const buffer = await new Promise<Buffer>(resolve => {
+        const stream = init.createReadStream();
+        const chunks: Uint8Array[] = [];
+        stream.on('data', chunk => {
+          chunks.push(chunk);
+        });
+        stream.on('error', () => {
+          resolve(Buffer.from([]));
+        });
+        stream.on('end', () => {
+          resolve(Buffer.concat(chunks));
+        });
+      });
+
+      if (buffer.length) {
+        await this.prisma.snapshot.create({
+          data: {
+            id: workspace.id,
+            workspaceId: workspace.id,
+            blob: buffer,
+          },
+        });
+      }
+    }
+
+    return workspace;
+  }
+
+  @Mutation(() => WorkspaceType, {
+    description: 'Update workspace',
+  })
+  async updateWorkspace(
+    @CurrentUser() user: UserType,
+    @Args({ name: 'input', type: () => UpdateWorkspaceInput })
+    { id, ...updates }: UpdateWorkspaceInput
+  ) {
+    await this.permissions.checkWorkspace(id, user.id, Permission.Admin);
+
+    return this.prisma.workspace.update({
+      where: {
+        id,
+      },
+      data: updates,
+    });
+  }
+
+  @Mutation(() => Boolean)
+  async deleteWorkspace(@CurrentUser() user: UserType, @Args('id') id: string) {
+    await this.permissions.checkWorkspace(id, user.id, Permission.Owner);
+
+    await this.prisma.workspace.delete({
+      where: {
+        id,
+      },
+    });
+
+    this.event.emit('workspace.deleted', id);
+
+    return true;
+  }
+
+  @Mutation(() => String)
+  async invite(
+    @CurrentUser() user: UserType,
+    @Args('workspaceId') workspaceId: string,
+    @Args('email') email: string,
+    @Args('permission', { type: () => Permission }) permission: Permission,
+    @Args('sendInviteMail', { nullable: true }) sendInviteMail: boolean
+  ) {
+    await this.permissions.checkWorkspace(
+      workspaceId,
+      user.id,
+      Permission.Admin
+    );
+
+    if (permission === Permission.Owner) {
+      throw new ForbiddenException('Cannot change owner');
+    }
+
+    const unlimited = await this.feature.hasWorkspaceFeature(
+      workspaceId,
+      FeatureType.UnlimitedWorkspace
+    );
+    if (!unlimited) {
+      // member limit check
+      const [memberCount, quota] = await Promise.all([
+        this.prisma.workspaceUserPermission.count({
+          where: { workspaceId },
+        }),
+        this.quota.getUserQuota(user.id),
+      ]);
+      if (memberCount >= quota.memberLimit) {
+        throw new GraphQLError('Workspace member limit reached', {
+          extensions: {
+            status: HttpStatus[HttpStatus.PAYLOAD_TOO_LARGE],
+            code: HttpStatus.PAYLOAD_TOO_LARGE,
+          },
+        });
+      }
+    }
+
+    let target = await this.users.findUserByEmail(email);
+    if (target) {
+      const originRecord = await this.prisma.workspaceUserPermission.findFirst({
+        where: {
+          workspaceId,
+          userId: target.id,
+        },
+      });
+      // only invite if the user is not already in the workspace
+      if (originRecord) return originRecord.id;
+    } else {
+      target = await this.auth.createAnonymousUser(email);
+    }
+
+    const inviteId = await this.permissions.grant(
+      workspaceId,
+      target.id,
+      permission
+    );
+    if (sendInviteMail) {
+      const inviteInfo = await this.getInviteInfo(inviteId);
+
+      try {
+        await this.mailer.sendInviteEmail(email, inviteId, {
+          workspace: {
+            id: inviteInfo.workspace.id,
+            name: inviteInfo.workspace.name,
+            avatar: inviteInfo.workspace.avatar,
+          },
+          user: {
+            avatar: inviteInfo.user?.avatarUrl || '',
+            name: inviteInfo.user?.name || '',
+          },
+        });
+      } catch (e) {
+        const ret = await this.permissions.revokeWorkspace(
+          workspaceId,
+          target.id
+        );
+
+        if (!ret) {
+          this.logger.fatal(
+            `failed to send ${workspaceId} invite email to ${email} and failed to revoke permission: ${inviteId}, ${e}`
+          );
+        } else {
+          this.logger.warn(
+            `failed to send ${workspaceId} invite email to ${email}, but successfully revoked permission: ${e}`
+          );
+        }
+        return new GraphQLError(
+          'failed to send invite email, please try again',
+          {
+            extensions: {
+              status: HttpStatus[HttpStatus.INTERNAL_SERVER_ERROR],
+              code: HttpStatus.INTERNAL_SERVER_ERROR,
+            },
+          }
+        );
+      }
+    }
+    return inviteId;
+  }
+
+  @Throttle({
+    default: {
+      limit: 10,
+      ttl: 30,
+    },
+  })
+  @Public()
+  @Query(() => InvitationType, {
+    description: 'Update workspace',
+  })
+  async getInviteInfo(@Args('inviteId') inviteId: string) {
+    const workspaceId = await this.prisma.workspaceUserPermission
+      .findUniqueOrThrow({
+        where: {
+          id: inviteId,
+        },
+        select: {
+          workspaceId: true,
+        },
+      })
+      .then(({ workspaceId }) => workspaceId);
+
+    const snapshot = await this.prisma.snapshot.findFirstOrThrow({
+      where: {
+        id: workspaceId,
+        workspaceId,
+      },
+    });
+
+    const doc = new Doc();
+
+    applyUpdate(doc, new Uint8Array(snapshot.blob));
+    const metaJSON = doc.getMap('meta').toJSON();
+
+    const owner = await this.permissions.getWorkspaceOwner(workspaceId);
+    const invitee = await this.permissions.getWorkspaceInvitation(
+      inviteId,
+      workspaceId
+    );
+
+    let avatar = '';
+
+    if (metaJSON.avatar) {
+      const avatarBlob = await this.blobStorage.get(
+        workspaceId,
+        metaJSON.avatar
+      );
+
+      if (avatarBlob.body) {
+        avatar = (await getStreamAsBuffer(avatarBlob.body)).toString('base64');
+      }
+    }
+
+    return {
+      workspace: {
+        name: metaJSON.name || '',
+        avatar: avatar || defaultWorkspaceAvatar,
+        id: workspaceId,
+      },
+      user: owner.user,
+      invitee: invitee.user,
+    };
+  }
+
+  @Mutation(() => Boolean)
+  async revoke(
+    @CurrentUser() user: UserType,
+    @Args('workspaceId') workspaceId: string,
+    @Args('userId') userId: string
+  ) {
+    await this.permissions.checkWorkspace(
+      workspaceId,
+      user.id,
+      Permission.Admin
+    );
+
+    return this.permissions.revokeWorkspace(workspaceId, userId);
+  }
+
+  @Mutation(() => Boolean)
+  @Public()
+  async acceptInviteById(
+    @Args('workspaceId') workspaceId: string,
+    @Args('inviteId') inviteId: string,
+    @Args('sendAcceptMail', { nullable: true }) sendAcceptMail: boolean
+  ) {
+    const {
+      invitee,
+      user: inviter,
+      workspace,
+    } = await this.getInviteInfo(inviteId);
+
+    if (!inviter || !invitee) {
+      throw new ForbiddenException(
+        `can not find inviter/invitee by inviteId: ${inviteId}`
+      );
+    }
+
+    if (sendAcceptMail) {
+      await this.mailer.sendAcceptedEmail(inviter.email, {
+        inviteeName: invitee.name,
+        workspaceName: workspace.name,
+      });
+    }
+
+    return this.permissions.acceptWorkspaceInvitation(inviteId, workspaceId);
+  }
+
+  @Mutation(() => Boolean)
+  async leaveWorkspace(
+    @CurrentUser() user: UserType,
+    @Args('workspaceId') workspaceId: string,
+    @Args('workspaceName') workspaceName: string,
+    @Args('sendLeaveMail', { nullable: true }) sendLeaveMail: boolean
+  ) {
+    await this.permissions.checkWorkspace(workspaceId, user.id);
+
+    const owner = await this.permissions.getWorkspaceOwner(workspaceId);
+
+    if (!owner.user) {
+      throw new ForbiddenException(
+        `can not find owner by workspaceId: ${workspaceId}`
+      );
+    }
+
+    if (sendLeaveMail) {
+      await this.mailer.sendLeaveWorkspaceEmail(owner.user.email, {
+        workspaceName,
+        inviteeName: user.name,
+      });
+    }
+
+    return this.permissions.revokeWorkspace(workspaceId, user.id);
+  }
+}

packages/backend/server/src/core/workspaces/types.ts

@@ -0,0 +1,103 @@
+import {
+  Field,
+  ID,
+  InputType,
+  ObjectType,
+  OmitType,
+  PartialType,
+  PickType,
+  registerEnumType,
+} from '@nestjs/graphql';
+import type { Workspace } from '@prisma/client';
+import { SafeIntResolver } from 'graphql-scalars';
+
+import { UserType } from '../users/types';
+
+export enum Permission {
+  Read = 0,
+  Write = 1,
+  Admin = 10,
+  Owner = 99,
+}
+
+registerEnumType(Permission, {
+  name: 'Permission',
+  description: 'User permission in workspace',
+});
+
+@ObjectType()
+export class InviteUserType extends OmitType(
+  PartialType(UserType),
+  ['id'],
+  ObjectType
+) {
+  @Field(() => ID)
+  id!: string;
+
+  @Field(() => Permission, { description: 'User permission in workspace' })
+  permission!: Permission;
+
+  @Field({ description: 'Invite id' })
+  inviteId!: string;
+
+  @Field({ description: 'User accepted' })
+  accepted!: boolean;
+}
+
+@ObjectType()
+export class WorkspaceType implements Partial<Workspace> {
+  @Field(() => ID)
+  id!: string;
+
+  @Field({ description: 'is Public workspace' })
+  public!: boolean;
+
+  @Field({ description: 'Workspace created date' })
+  createdAt!: Date;
+
+  @Field(() => [InviteUserType], {
+    description: 'Members of workspace',
+  })
+  members!: InviteUserType[];
+}
+
+@ObjectType()
+export class InvitationWorkspaceType {
+  @Field(() => ID)
+  id!: string;
+
+  @Field({ description: 'Workspace name' })
+  name!: string;
+
+  @Field(() => String, {
+    // nullable: true,
+    description: 'Base64 encoded avatar',
+  })
+  avatar!: string;
+}
+
+@ObjectType()
+export class WorkspaceBlobSizes {
+  @Field(() => SafeIntResolver)
+  size!: number;
+}
+
+@ObjectType()
+export class InvitationType {
+  @Field({ description: 'Workspace information' })
+  workspace!: InvitationWorkspaceType;
+  @Field({ description: 'User information' })
+  user!: UserType;
+  @Field({ description: 'Invitee information' })
+  invitee!: UserType;
+}
+
+@InputType()
+export class UpdateWorkspaceInput extends PickType(
+  PartialType(WorkspaceType),
+  ['public'],
+  InputType
+) {
+  @Field(() => ID)
+  id!: string;
+}

packages/backend/server/src/core/workspaces/utils.ts

@@ -0,0 +1,2 @@
+export const defaultWorkspaceAvatar =
+  'iVBORw0KGgoAAAANSUhEUgAAABgAAAAYCAYAAADgdz34AAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAQtSURBVHgBfVa9jhxFEK6q7rkf+4T2AgdIIC0ZoXkBuNQJtngBuIzs1hIRye1FhL438D0CRgKRGUeE6wwkhHYlkE2AtGdkbN/MdJe/qu7Z27PWnnG5Znq7v/rqd47pHddkNh/918tR1/FBamXc9zxOPVFKfJ4yP86qD1LD3/986/3F2zB40+LXv83HrHq/6+gAoNS1kF4odUz2nhJRTkI5E6mD6Bk1crLJkLy5cHc+P4ohzxLng8RKLqKUq6hkUtBSe8Zvdmfir7TT2a0fnkzeaeCbv/44ztSfZskjP2ygVRM0mbYTpgHMMMS8CsIIj/c+//Hp8UYD3z758whQUwdeEwPjAZQLqJhI0VxB2MVco+kXP/0zuZKD6dP5uM397ELzqEtMba/UJ4t7iXeq8U94z52Q+js09qjlIXMxAEsRDJpI59dVPzlDTooHko7BdlR2FcYmAtbGMmAt2mFI4yDQkIjtEQkxUAMKAPD9SiOK4b578N0S7Nt+fqFKbTbmRD1YGXurEmdtnjjz4kFuIV0gtWewV62hMHBY2gpEOw3Rnmztx9jnO72xzTV/YkzgNmgkiypeYJdCLjonqyAAg7VCshVpjTbD08HbxrySdhKxcDvoJTA5gLvpeXVQ+K340WKea9UkNeZVqGSba/IbF6athj+LUeRmRCyiAVnlAKhJJQfmugGZ28ZWna24RGzwNUNUqpWGf6HkajvAgNA4NsSjHgcb9obx+k5c3DUttcwd3NcHxpVurXQ2d4MZACGw9TwEHsdtbEwytL1xywAGcxavjoH1quLVywuGi+aBhFWexRilFSwK0QzgdUdkkVMeKw4wijrgxjzz2CefCRZn+21ViOWW4Ym9nNnyFLMbMS8ivNhGP8RdlgUojBkuBLDpEPi+5LpWiDURgFkKOIIckJTgN/sZ84KtKkKpDnsOZiTQ47jD4ZGwHghbw6AXIL3lo5Zg6Tp2AwIAyYJ8BRzGfmfPl6kI7HOLUdN2LIg+4IfL5SiFdvkK4blI6h50qda7jQI0CUMLdEhFIkqtQciMvXsgpaZ1pWtVUfrIa+TX5/8+RBcftAhTa91r8ycXA5ZxBqhAh2zgVagUAddxMkxfF/JxfvbpB+8d2jhBtsPhtuqsE0HJlhxYeHKdkCU8xUCos8dmkDdnGaOlJ1yy9dM52J2spqldvz9fTgB4z+aQd2kqjUY2KU2s4dTT7ezD0AqDAbvZiKF/VO9+fGPv9IoBu+b/P5ti6djDY+JlSg4ug1jc6fJbMAx9/3b4CNGTD/evT698D9avv188m4gKvko8MiMeJC3jmOvU9MSuHXZohAVpOrmxd+10HW/jR3/58uU45TRFt35ZR2XpY61DzW+tH3z/7xdM8sP93d3Fm1gbDawbEtU7CMtt/JVxEw01Kh7RAmoBE4+u7eycYv38bRivAZbdHBtPrwOHAAAAAElFTkSuQmCC';