## Summary
This change restricts email invitation metadata lookup to the
authenticated user that the invitation was issued to.
## Impact
The public invite-info resolver returns workspace, owner, invitee, and
status details for a valid invitation identifier. For email invitations,
that information should only be returned to the intended recipient after
authentication.
## Fix
- Keep existing link-invitation behavior unchanged.
- For email invitations, require an authenticated user whose id matches
the invitation recipient before returning invitation details.
- Return the existing invalid-invitation error for mismatched or
unauthenticated access.
## Validation
- `git diff --check`
- Full test/lint suite was not run locally because dependencies are not
installed in this checkout.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Tightened invitation access checks so non-link invites are only
readable by the intended recipient.
* Invalid or missing user context now returns an error earlier,
preventing access to invite details when the invitation doesn’t match.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Signed-off-by: failsafesecurity <190101117+failsafesecurity@users.noreply.github.com>
Co-authored-by: DarkSky <25152247+darkskygit@users.noreply.github.com>
#### PR Dependency Tree
* **PR #15538** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added rich link previews to mobile and iOS sharing, including images,
metadata, transcripts, and selected text.
* Share imports can now create structured content blocks, embeds,
bookmarks, and transcript callouts.
* Added workspace-aware preview handling for cloud, self-hosted, and
signed-out modes.
* **Accessibility**
* Improved collapse/expand controls with semantic buttons and ARIA
relationships.
* **Bug Fixes**
* Enhanced URL and error sanitization in server logs.
* Improved link-preview CORS support, validation, and request handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!--
Thank you for contributing to AFFiNE!
The PR title must follow Conventional Commits (enforced by CI):
type(scope): description e.g. fix(editor): keep selection after paste
Types: feat fix docs style refactor perf test build ci chore revert
-->
## Description
<!-- What does this PR do? Link related issues, e.g. "Closes #1234".
Screenshots or recordings are welcome for UI changes. -->
## Checklist
- [ ] I have signed the [AFFiNE Contributor License
Agreement](https://cla-assistant.io/toeverything/AFFiNE) — required
before merge; the `license/cla` check must be green ([how it
works](https://github.com/toeverything/AFFiNE/blob/canary/docs/BUILDING.md#sign-the-cla-first))
- [ ] The PR targets the `canary` branch and its title follows
[Conventional Commits](https://www.conventionalcommits.org/)
- [ ] Tests are added or updated where it makes sense
- [ ] `yarn lint` and `yarn typecheck` pass locally
#### PR Dependency Tree
* **PR #15533** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved indexer feature synchronization when the indexer is enabled
or configuration changes.
* Enabled indexer-related capabilities without waiting for native search
readiness checks.
* Improved consistency across search, aggregate, document, and
application startup flows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!--
Thank you for contributing to AFFiNE!
The PR title must follow Conventional Commits (enforced by CI):
type(scope): description e.g. fix(editor): keep selection after paste
Types: feat fix docs style refactor perf test build ci chore revert
-->
## Description
<!-- What does this PR do? Link related issues, e.g. "Closes #1234".
Screenshots or recordings are welcome for UI changes. -->
## Checklist
- [ ] I have signed the [AFFiNE Contributor License
Agreement](https://cla-assistant.io/toeverything/AFFiNE) — required
before merge; the `license/cla` check must be green ([how it
works](https://github.com/toeverything/AFFiNE/blob/canary/docs/BUILDING.md#sign-the-cla-first))
- [ ] The PR targets the `canary` branch and its title follows
[Conventional Commits](https://www.conventionalcommits.org/)
- [ ] Tests are added or updated where it makes sense
- [ ] `yarn lint` and `yarn typecheck` pass locally
#### PR Dependency Tree
* **PR #15532** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved search reconciliation and publication status handling when
workspace reconciliation fails.
* Prevented failed workspace reconciliation from incorrectly blocking
generation completion.
* Preserved active generation state so reconciliation can retry and
complete pending publications.
* Improved managed provider profile migration, including legacy
configurations, unavailable models, conflicting assignments, and missing
defaults.
* **Tests**
* Expanded coverage for workspace recovery and managed provider profile
migration scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Description
Self-hosted GitHub OAuth login fails at token exchange because the
outbound request to `https://github.com/login/oauth/access_token` has no
`User-Agent` header. GitHub then returns 403 ("Request forbidden by
administrative rules"), which is surfaced as
`INVALID_OAUTH_CALLBACK_CODE`.
OAuth `safeFetch` only forwarded `authorization`, `content-type`, and
`accept`, so even a User-Agent on the request would be stripped. This
change:
- allows `user-agent` in OAuth `fetchOptions()`
- always sends `User-Agent: AFFiNE-Server` from `fetchJson()` (covers
token exchange and `api.github.com` user/email fetches)
Fixes#15521
## Checklist
- [x] The PR targets the `canary` branch and its title follows
Conventional Commits
- [x] Tests are added or updated where it makes sense
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved OAuth request compatibility by including a standard
`User-Agent` header.
* Ensured the header is permitted consistently during OAuth token
exchanges.
* **Tests**
* Added coverage to verify case-insensitive handling of the `User-Agent`
header in GitHub OAuth requests.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
fix#15523fix#15526
#### PR Dependency Tree
* **PR #15528** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Improved search generation cleanup, provider error reporting, and
reconciliation reliability.
- Retired search resources are cleaned up safely, including after
credential changes.
- Prompt size checks now ignore tool parameters and provide clearer
errors.
- Reserved documents are protected from accidental cleanup, and
malformed identifiers are rejected.
- **Configuration**
- Managed Copilot profiles require explicit, non-duplicated model
assignments.
- Improved managed provider profile migration.
- **Performance & Reliability**
- Reduced unnecessary search-history cleanup and adjusted
consistency-check intervals.
- Failed reconciliation jobs stop after one attempt and are removed
automatically.
- **Data Updates**
- Updated legacy AI session prompt names to current labels.
- Improved cloud load-balancer health-check configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
#### PR Dependency Tree
* **PR #15512** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Search now supports generation-based indexing with embedded and remote
providers.
* Added automatic search reconciliation and improved handling of
document, workspace, and permission changes.
* Added clearer search status errors for unavailable, syncing, unready,
or failed indexes.
* Added Manticore Search end-to-end support and provider-specific search
behavior.
* **Improvements**
* Search and aggregate pagination now report returned results and
continuation status more accurately.
* Improved permission filtering to prevent inaccessible documents from
appearing in results.
* Admin provider selection now consistently enables indexing.
* **Documentation**
* Clarified search pagination, aggregation counts, provider
configuration, and end-to-end setup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
fix#15505fix#15502fix#15496fix#15491
#### PR Dependency Tree
* **PR #15510** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added configurable delays for invitations, invite links, and document
publishing by newly created accounts.
- Added workspace action checks that explain blocked actions and retry
timing.
- BYOK setup now verifies model capabilities and saves only validated
options.
- **Bug Fixes**
- Improved BYOK probing for chat, structured responses, tool calls,
embeddings, reranking, and image generation.
- Preserved probe request order and strengthened response validation.
- Authentication configuration changes now reload correctly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Retry failed Copilot transcription tasks in real time.
* Retried tasks resume processing and report updated status.
* Managed Copilot provider models can be omitted to use provider
defaults.
* **Bug Fixes**
* Improved handling of incomplete BYOK profiles, including safe
replacement of legacy records.
* Duplicate profile creation now returns a clear validation error.
* Improved transcript processing reliability by preventing duplicate or
stale dispatches.
* **Migration**
* Consolidated legacy managed-provider settings while preserving
existing profiles and defaults.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
#### PR Dependency Tree
* **PR #15485** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Upgraded built-in AI actions and chat model selection to Gemini 3.7
Flash.
* Transcript attachments now retain storage keys and support secure
presigned URLs during processing.
* Completed transcript results preserve attachment metadata for reliable
access.
* **Bug Fixes**
* Improved transcript handling across uploads, retries, and native
processing.
* Added safeguards for invalid or missing attachment URLs.
* **Maintenance**
* Added a migration to backfill storage keys for existing transcript
records without altering their URLs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
#### PR Dependency Tree
* **PR #15477** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for custom signed download URLs with configurable CDN
origins, object paths, expiration times, and security signatures.
* Custom download signing is available when both the URL prefix and
signing key are configured.
* **Bug Fixes**
* Preserved custom URL and signing settings when generating download
links.
* Added validation for invalid signing configurations.
* Standard S3 storage continues using its existing presigned URL
behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
#### PR Dependency Tree
* **PR #15476** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Improved connectivity for AI services configured with a global
location while preserving support for regional locations.
- Failed audio transcription jobs can now be restarted without
recreating the job.
- Preserved existing behavior for transcription jobs that are still
waiting or already in other non-retryable states.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
#### PR Dependency Tree
* **PR #15464** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Replaced the project’s formatting and linting workflow with Oxfmt and
Oxlint.
* Added shared formatting and linting configuration, editor integration,
and updated automated checks.
* Updated generated files, scripts, and lint guidance to use the new
tooling.
* **Style**
* Reformatted templates, source code, examples, and configuration files
for consistent readability.
* No user-facing functionality or rendering behavior changed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
fix#14287fix#15359fix#15424
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Redesigned workspace AI provider settings with connection testing,
storage options, model selection, capability management, ordering, and
custom endpoints.
* AI chat model choices now adapt to the selected workspace and
conversation route.
* Added support for image-based AI requests.
* **Bug Fixes**
* Improved handling of unavailable or outdated model selections.
* App configuration updates now reject overlapping paths and load
deterministically.
* **Tests**
* Expanded coverage for provider models, AI chat scoping, image
requests, and configuration validation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
#### PR Dependency Tree
* **PR #15426** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added workspace BYOK profiles with provider/model catalogs, capability
validation, connection probing, credential rotation, reordering, and
secure local leases.
* Added Copilot route options, selectable targets, managed tiers,
explicit profile/model overrides, and improved streaming with tool
callbacks and abort support.
* Added Copilot availability controls to prevent access when the feature
is disabled.
* **Changes**
* Simplified Copilot configuration and removed legacy provider-specific
settings.
* Removed obsolete model, token-cost, transcript strategy, and provider
metadata fields from public responses.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
#### PR Dependency Tree
* **PR #15386** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved email rendering and formatting consistency.
* Preserved calendar synchronization windows while removing reliance on
date utility libraries.
* Enhanced cleanup of Prisma engine files, including deduplication and
space-saving reporting.
* **Tests**
* Updated email snapshots to validate formatted HTML output.
* **Refactor**
* Streamlined email component usage and centralized email rendering
behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Standardized `usePresignedURL` configuration for AWS S3 and Cloudflare
R2 (including `enabled`, `urlPrefix`, and `signKey`).
- Storage upload URL generation now supports both direct provider
presigning and server-mediated proxying based on configuration.
- **Bug Fixes**
- Tightened upload and multipart validation (content type/length checks,
header vs query consistency, and stricter expiration handling).
- Improved fallback behavior when direct upload URL initialization
fails.
- **Tests**
- Updated R2 storage proxy end-to-end coverage to match the new
URL/token behavior.
- **Documentation**
- Refreshed self-hosted JSON schema guidance for upload URL settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
#### PR Dependency Tree
* **PR #15363** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved validation of workspace roots and document projections, with
clearer failures for malformed or incomplete data.
* Improved document reference rebuilding and cleanup reliability.
* Updated document update merging to better handle invalid binary data.
* **Performance**
* Avoided unnecessary document reconstruction when no updates are
pending.
* **Tests**
* Updated coverage for malformed workspace roots and document snapshot
parsing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
#### PR Dependency Tree
* **PR #15329** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements**
* Enhanced reliability of document reconciliation/projection by
improving failure tracking and resumability after partial runs.
* Upgraded checkpoint persistence to include additional state (including
parser version and failure counts) so interrupted processing can resume
accurately.
* Improved recovery behavior so repeated rebuilds and parser-upgrade
scenarios correctly complete and reset failure indicators when
appropriate.
* **Tests**
* Added integration coverage for checkpoint failure/resume semantics,
including partial limits and upgrade-style recovery behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
fix#15283
#### PR Dependency Tree
* **PR #15305** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Document metadata now consistently reports documents as not public
when no applicable access policy is available.
* Improved reliability of document visibility information across
document listings and pagination.
* **Tests**
* Added coverage verifying the `public` status in document details and
paginated results.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
#### PR Dependency Tree
* **PR #15282** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added automated document cleanup to reconcile missing workspace docs,
delete related stored data, and recover if the doc returns.
* Added effect-based follow-up reconciliation for search indexing,
Copilot embeddings, and comment attachment cleanup with explicit
acknowledgements.
* **Bug Fixes**
* Deleted-document references now persist as dangling references rather
than disappearing.
* Improved document deletion flow to enforce permissions and ensure
authorized deletions succeed.
* **Tests**
* Expanded coverage for cleanup recovery, indexing/embedding
reconciliation, permissions, and reference semantics.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
#### PR Dependency Tree
* **PR #15280** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved workspace document discovery so documents in trashed pages
are correctly included when loading workspace content.
* Fixed dragging collections into Favorites, including reordering
collections within Favorites.
* **Tests**
* Added coverage for document projection behavior and collection
drag-and-drop interactions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
fix#15246
#### PR Dependency Tree
* **PR #15247** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved consistency when issuing and validating MCP credential tokens
by using a shared token prefix across issuance and parsing.
* Preserved correct recognition of standard JWT-based authentication
tokens.
* **Tests**
* Updated MCP credentials coverage to validate behavior through the HTTP
API response (instead of direct controller invocation).
* Adjusted workspace quota e2e setup to derive restricted limits via
entitlements before reconciling quota state.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
#### PR Dependency Tree
* **PR #15221** 👈
This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added MCP credential management (create/reveal, list, rotate, revoke)
with expiration and status tracking.
* Introduced read-only vs read/write access modes, with read/write
tooling enabled only when permitted.
* Added workspace MCP credential configuration UI, including token
reveal and setup generation.
* Added MCP credential GraphQL APIs to back the UI.
* **Changes**
* Replaced legacy access-token support with MCP credentials across
authentication and realtime updates.
* **Bug Fixes**
* MCP authentication now reliably rejects revoked, rotated, expired, or
disabled-user credentials.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
This is a backend-only workaround for native/mobile sessions expiring
much earlier than the normal AFFiNE auth session.
Native JWT-backed sessions now use the existing `auth.session.ttl`
instead of the hard-coded 15-minute TTL.
No database migration, no new config, and no mobile client changes are
required.
## Background / Investigation
PR #15060 introduced native session exchange and JWT-backed native
sessions for mobile/desktop clients.
Relevant code introduced there:
- `packages/backend/server/src/core/auth/session-issuer.ts`
- Native clients no longer receive normal auth cookies.
- `SessionIssuer` clears cookies for native clients and returns a native
session exchange code instead.
- `packages/backend/server/src/core/auth/native-exchange.ts`
- Native clients exchange the one-time code for a JWT-backed session
token.
- `packages/backend/server/src/core/auth/jwt-session.ts`
- The JWT session implementation was introduced with:
- `const JWT_SESSION_TTL = 15 * 60`
- `expiresIn: JWT_SESSION_TTL`
- normal `jwt.verify(...)` expiration enforcement
That means a native/mobile client that does not reconnect and
exchange/sign in again within 15 minutes can lose backend auth even
though the DB-backed AFFiNE user session is still valid for the normal
app session TTL, currently 15 days by default.
Web does not hit this path because web keeps using the normal
cookie-backed session issued by `AuthService`, whose expiration is based
on `auth.session.ttl`.
## Related Issues / PRs Checked
- Source PR: #15060
- Introduced native session exchange, JWT-backed sessions, native token
storage, and websocket JWT support.
- This PR appears to be the source of the hard-coded 15-minute native
JWT TTL behavior.
I did not find a public issue that directly reports "native JWT expires
after 15 minutes".
## What Changed
- Removed the hard-coded 15-minute native JWT TTL.
- Updated `JwtSessionService.sign()` to issue native JWTs with
`auth.session.ttl`.
- Kept `JwtSessionService.verify()` on normal JWT expiration
verification, so existing JWTs that already expired under the previous
15-minute `exp` need to be refreshed by signing in again.
- Kept the existing DB-backed session lookup:
- sign-out still revokes the native JWT by deleting the backing session
- expired/deleted DB sessions still reject the JWT
## Why This Is A Workaround
A more complete long-term design would add a true refresh-token flow for
native clients, likely with persisted refresh tokens,
rotation/revocation semantics, and database changes.
This PR intentionally avoids that larger design. It restores the
expected mobile login lifetime for newly issued native JWTs by aligning
native JWT lifetime with the existing app session lifetime, while
preserving the current native exchange model, Keychain/Keystore storage,
and revoke-by-session behavior.
## Compatibility
- Backend only
- No DB schema change
- No mobile app change
- No new config
- Existing native JWTs that already expired under the old 15-minute
`exp` will still require signing in again.
- Newly issued native JWTs use `auth.session.ttl`.
## Verification
Latest verification after removing the extra native JWT TTL config:
- JWT session tests: 4 passed
- `yarn typecheck`: passed
- `lint-staged`: passed via `corepack yarn`
- `lint:ox`: passed via `corepack yarn`
Earlier broader checks on this branch also passed selected auth tests
and the websocket JWT auth subset.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Session login tokens now follow the configured session lifetime, so
expiration behavior can be adjusted through app settings.
* **Bug Fixes**
* Improved consistency between token expiration and session expiry
checks.
* Added coverage for cases where a session is missing, expired, or the
session lifetime changes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
FailSafe