chore: bump base version to 0.17.0

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Mirone <Saul-Mirone@outlook.com>

.env.template

@@ -1,5 +1,4 @@
 CHANGELOG_URL=
-ENABLE_PRELOADING=
 ENABLE_NEW_SETTING_UNSTABLE_API=
 ENABLE_CAPTCHA=
 CAPTCHA_SITE_KEY=

.eslintrc.js

@@ -34,8 +34,8 @@ const createPattern = packageName => [
   {
     group: ['@affine/env/constant'],
     message:
-      'Do not import from @affine/env/constant. Use `environment.isDesktop` instead',
-    importNames: ['isDesktop'],
+      'Do not import from @affine/env/constant. Use `BUILD_CONFIG.isElectron` instead',
+    importNames: ['isElectron'],
   },
 ];
 
@@ -43,11 +43,14 @@ const allPackages = [
   'packages/backend/server',
   'packages/frontend/component',
   'packages/frontend/core',
-  'packages/frontend/electron',
+  'packages/frontend/apps/electron',
+  'packages/frontend/apps/web',
+  'packages/frontend/apps/mobile',
   'packages/frontend/graphql',
   'packages/frontend/i18n',
   'packages/frontend/native',
   'packages/frontend/templates',
+  'packages/frontend/track',
   'packages/common/debug',
   'packages/common/env',
   'packages/common/infra',
@@ -248,7 +251,7 @@ const config = {
           'warn',
           {
             additionalHooks:
-              '(useAsyncCallback|useCatchEventCallback|useDraggable|useDropTarget)',
+              '(useAsyncCallback|useCatchEventCallback|useDraggable|useDropTarget|useRefEffect)',
           },
         ],
       },

.github/actions/deploy/deploy.mjs

@@ -90,9 +90,14 @@ const createHelmCommand = ({ isDryRun }) => {
   const deployCommand = [
     `helm upgrade --install affine .github/helm/affine`,
     `--namespace  ${namespace}`,
+    `--set-string global.app.buildType="${buildType}"`,
     `--set        global.ingress.enabled=true`,
     `--set-json   global.ingress.annotations=\"{ \\"kubernetes.io/ingress.class\\": \\"gce\\", \\"kubernetes.io/ingress.allow-http\\": \\"true\\", \\"kubernetes.io/ingress.global-static-ip-name\\": \\"${STATIC_IP_NAME}\\" }\"`,
     `--set-string global.ingress.host="${host}"`,
+    `--set        global.objectStorage.r2.enabled=true`,
+    `--set-string global.objectStorage.r2.accountId="${R2_ACCOUNT_ID}"`,
+    `--set-string global.objectStorage.r2.accessKeyId="${R2_ACCESS_KEY_ID}"`,
+    `--set-string global.objectStorage.r2.secretAccessKey="${R2_SECRET_ACCESS_KEY}"`,
     `--set-string global.version="${APP_VERSION}"`,
     ...redisAndPostgres,
     `--set        web.replicaCount=${webReplicaCount}`,
@@ -106,10 +111,6 @@ const createHelmCommand = ({ isDryRun }) => {
     `--set-string graphql.app.copilot.openai.key="${COPILOT_OPENAI_API_KEY}"`,
     `--set-string graphql.app.copilot.fal.key="${COPILOT_FAL_API_KEY}"`,
     `--set-string graphql.app.copilot.unsplash.key="${COPILOT_UNSPLASH_API_KEY}"`,
-    `--set        graphql.app.objectStorage.r2.enabled=true`,
-    `--set-string graphql.app.objectStorage.r2.accountId="${R2_ACCOUNT_ID}"`,
-    `--set-string graphql.app.objectStorage.r2.accessKeyId="${R2_ACCESS_KEY_ID}"`,
-    `--set-string graphql.app.objectStorage.r2.secretAccessKey="${R2_SECRET_ACCESS_KEY}"`,
     `--set-string graphql.app.mailer.sender="${MAILER_SENDER}"`,
     `--set-string graphql.app.mailer.user="${MAILER_USER}"`,
     `--set-string graphql.app.mailer.password="${MAILER_PASSWORD}"`,
@@ -125,6 +126,8 @@ const createHelmCommand = ({ isDryRun }) => {
     `--set        graphql.app.features.syncClientVersionCheck=true`,
     `--set        sync.replicaCount=${syncReplicaCount}`,
     `--set-string sync.image.tag="${imageTag}"`,
+    `--set-string renderer.image.tag="${imageTag}"`,
+    `--set        renderer.app.host=${host}`,
     ...serviceAnnotations,
     `--timeout 10m`,
     flag,

.github/actions/setup-node/action.yml

@@ -156,7 +156,7 @@ runs:
     - name: Install Playwright's dependencies
       shell: bash
       if: inputs.playwright-install == 'true'
-      run: yarn playwright install --with-deps chromium
+      run: yarn playwright install --with-deps chromium webkit
       env:
         PLAYWRIGHT_BROWSERS_PATH: ${{ github.workspace }}/node_modules/.cache/ms-playwright
 

.github/deployment/front/Dockerfile

@@ -1,7 +1,8 @@
 FROM openresty/openresty:1.25.3.2-0-buster
 WORKDIR /app
-COPY ./packages/frontend/web/dist ./dist
+COPY ./packages/frontend/apps/web/dist ./dist
 COPY ./packages/frontend/admin/dist ./admin
+COPY ./packages/frontend/apps/mobile/dist ./mobile
 COPY ./.github/deployment/front/nginx.conf /usr/local/openresty/nginx/conf/nginx.conf
 COPY ./.github/deployment/front/affine.nginx.conf /etc/nginx/conf.d/affine.nginx.conf
 

.github/deployment/front/affine.nginx.conf

@@ -6,15 +6,33 @@ server {
     try_files $uri/index.html $uri/ $uri /admin/index.html;
   }
 
+  set $app_root_path /app/dist/;
+  set $mobile_root /app/dist/;
+  set_by_lua $affine_env 'return os.getenv("AFFINE_ENV")';
+
+  if ($affine_env = "dev") {
+    set $mobile_root /app/mobile/;
+  }
+
+  # https://gist.github.com/mariusom/6683dc52b1cad1a1f372e908bdb209d0
+  if ($http_user_agent ~* "(android|bb\d+|meego).+mobile|avantgo|bada\/|blackberry|blazer|compal|elaine|fennec|hiptop|iemobile|ip(hone|od)|iris|kindle|lge |maemo|midp|mmp|mobile.+firefox|netfront|opera m(ob|in)i|palm( os)?|phone|p(ixi|re)\/|plucker|pocket|psp|series(4|6)0|symbian|treo|up\.(browser|link)|vodafone|wap|windows ce|xda|xiino") {
+    set $app_root_path $mobile_root;
+  }
+
+  if ($http_user_agent ~* "^(1207|6310|6590|3gso|4thp|50[1-6]i|770s|802s|a wa|abac|ac(er|oo|s\-)|ai(ko|rn)|al(av|ca|co)|amoi|an(ex|ny|yw)|aptu|ar(ch|go)|as(te|us)|attw|au(di|\-m|r |s )|avan|be(ck|ll|nq)|bi(lb|rd)|bl(ac|az)|br(e|v)w|bumb|bw\-(n|u)|c55\/|capi|ccwa|cdm\-|cell|chtm|cldc|cmd\-|co(mp|nd)|craw|da(it|ll|ng)|dbte|dc\-s|devi|dica|dmob|do(c|p)o|ds(12|\-d)|el(49|ai)|em(l2|ul)|er(ic|k0)|esl8|ez([4-7]0|os|wa|ze)|fetc|fly(\-|_)|g1 u|g560|gene|gf\-5|g\-mo|go(\.w|od)|gr(ad|un)|haie|hcit|hd\-(m|p|t)|hei\-|hi(pt|ta)|hp( i|ip)|hs\-c|ht(c(\-| |_|a|g|p|s|t)|tp)|hu(aw|tc)|i\-(20|go|ma)|i230|iac( |\-|\/)|ibro|idea|ig01|ikom|im1k|inno|ipaq|iris|ja(t|v)a|jbro|jemu|jigs|kddi|keji|kgt( |\/)|klon|kpt |kwc\-|kyo(c|k)|le(no|xi)|lg( g|\/(k|l|u)|50|54|\-[a-w])|libw|lynx|m1\-w|m3ga|m50\/|ma(te|ui|xo)|mc(01|21|ca)|m\-cr|me(rc|ri)|mi(o8|oa|ts)|mmef|mo(01|02|bi|de|do|t(\-| |o|v)|zz)|mt(50|p1|v )|mwbp|mywa|n10[0-2]|n20[2-3]|n30(0|2)|n50(0|2|5)|n7(0(0|1)|10)|ne((c|m)\-|on|tf|wf|wg|wt)|nok(6|i)|nzph|o2im|op(ti|wv)|oran|owg1|p800|pan(a|d|t)|pdxg|pg(13|\-([1-8]|c))|phil|pire|pl(ay|uc)|pn\-2|po(ck|rt|se)|prox|psio|pt\-g|qa\-a|qc(07|12|21|32|60|\-[2-7]|i\-)|qtek|r380|r600|raks|rim9|ro(ve|zo)|s55\/|sa(ge|ma|mm|ms|ny|va)|sc(01|h\-|oo|p\-)|sdk\/|se(c(\-|0|1)|47|mc|nd|ri)|sgh\-|shar|sie(\-|m)|sk\-0|sl(45|id)|sm(al|ar|b3|it|t5)|so(ft|ny)|sp(01|h\-|v\-|v )|sy(01|mb)|t2(18|50)|t6(00|10|18)|ta(gt|lk)|tcl\-|tdg\-|tel(i|m)|tim\-|t\-mo|to(pl|sh)|ts(70|m\-|m3|m5)|tx\-9|up(\.b|g1|si)|utst|v400|v750|veri|vi(rg|te)|vk(40|5[0-3]|\-v)|vm40|voda|vulc|vx(52|53|60|61|70|80|81|83|85|98)|w3c(\-| )|webc|whit|wi(g |nc|nw)|wmlb|wonu|x700|yas\-|your|zeto|zte\-)") {
+    set $app_root_path $mobile_root;
+  }
+
   location ~ ^/(_plugin|assets|imgs|js|plugins|static)/ {
-    root /app/dist/;
+    root $app_root_path;
     try_files $uri $uri/ =404;
   }
 
   location / {
-    root /app/dist/;
+    root $app_root_path;
     index index.html;
     try_files $uri $uri/ /index.html;
+    add_header Cache-Control "private, no-cache, no-store, max-age=0, must-revalidate";
   }
 
   error_page 404 /404.html;

.github/deployment/front/nginx.conf

@@ -1,14 +1,15 @@
-worker_processes  4;
+worker_processes 4;
 error_log /var/log/nginx/error.log warn;
 pcre_jit on;
+env AFFINE_ENV;
 events {
-    worker_connections 1024;
+  worker_connections 1024;
 }
 http {
-    include       mime.types;
-    log_format    main  '$remote_addr [$time_local] "$request" '
-                        '$status $body_bytes_sent "$http_referer" '
-                        '"$http_user_agent" "$http_x_forwarded_for"';
-    access_log    /var/log/nginx/access.log  main;
-    include /etc/nginx/conf.d/*.conf;
+  include mime.types;
+  log_format main '$remote_addr [$time_local] "$request" '
+  '$status $body_bytes_sent "$http_referer" '
+  '"$http_user_agent" "$http_x_forwarded_for"';
+  access_log /var/log/nginx/access.log main;
+  include /etc/nginx/conf.d/*.conf;
 }

.github/deployment/node/Dockerfile

@@ -1,8 +1,9 @@
 FROM node:20-bookworm-slim
 
 COPY ./packages/backend/server /app
-COPY ./packages/frontend/web/dist /app/static
+COPY ./packages/frontend/apps/web/dist /app/static
 COPY ./packages/frontend/admin/dist /app/static/admin
+COPY ./packages/frontend/apps/mobile/dist /app/static/mobile
 WORKDIR /app
 
 RUN apt-get update && \

.github/helm/affine/Chart.yaml

@@ -3,4 +3,4 @@ name: affine
 description: AFFiNE cloud chart
 type: application
 version: 0.0.0
-appVersion: "0.16.0"
+appVersion: "0.17.0"

.github/helm/affine/charts/graphql/Chart.yaml

@@ -3,7 +3,7 @@ name: graphql
 description: AFFiNE GraphQL server
 type: application
 version: 0.0.0
-appVersion: "0.16.0"
+appVersion: "0.17.0"
 dependencies:
   - name: gcloud-sql-proxy
     version: 0.0.0

.github/helm/affine/charts/graphql/templates/deployment.yaml

@@ -76,9 +76,7 @@ spec:
           - name: AFFINE_SERVER_HTTPS
             value: "{{ .Values.app.https }}"
           - name: ENABLE_R2_OBJECT_STORAGE
-            value: "{{ .Values.app.objectStorage.r2.enabled }}"
-          - name: ENABLE_CAPTCHA
-            value: "{{ .Values.app.captcha.enabled }}"
+            value: "{{ .Values.global.objectStorage.r2.enabled }}"
           - name: FEATURES_EARLY_ACCESS_PREVIEW
             value: "{{ .Values.app.features.earlyAccessPreview }}"
           - name: FEATURES_SYNC_CLIENT_VERSION_CHECK
@@ -124,21 +122,21 @@ spec:
           - name: DOC_MERGE_USE_JWST_CODEC
             value: "true"
           {{ end }}
-          {{ if .Values.app.objectStorage.r2.enabled }}
+          {{ if .Values.global.objectStorage.r2.enabled }}
           - name: R2_OBJECT_STORAGE_ACCOUNT_ID
             valueFrom:
               secretKeyRef:
-                name: "{{ .Values.app.objectStorage.r2.secretName }}"
+                name: "{{ .Values.global.objectStorage.r2.secretName }}"
                 key: accountId
           - name: R2_OBJECT_STORAGE_ACCESS_KEY_ID
             valueFrom:
               secretKeyRef:
-                name: "{{ .Values.app.objectStorage.r2.secretName }}"
+                name: "{{ .Values.global.objectStorage.r2.secretName }}"
                 key: accessKeyId
           - name: R2_OBJECT_STORAGE_SECRET_ACCESS_KEY
             valueFrom:
               secretKeyRef:
-                name: "{{ .Values.app.objectStorage.r2.secretName }}"
+                name: "{{ .Values.global.objectStorage.r2.secretName }}"
                 key: secretAccessKey
           {{ end }}
           {{ if .Values.app.captcha.enabled }}

.github/helm/affine/charts/graphql/templates/migration.yaml

@@ -37,21 +37,21 @@ spec:
           - name: DATABASE_URL
             value: postgres://{{ .Values.global.database.user }}:$(DATABASE_PASSWORD)@{{ .Values.global.database.gcloud.cloudSqlInternal }}:{{ .Values.global.database.port }}/{{ .Values.global.database.name }}
           {{ end }}
-          {{ if .Values.app.objectStorage.r2.enabled }}
+          {{ if .Values.global.objectStorage.r2.enabled }}
           - name: R2_OBJECT_STORAGE_ACCOUNT_ID
             valueFrom:
               secretKeyRef:
-                name: "{{ .Values.app.objectStorage.r2.secretName }}"
+                name: "{{ .Values.global.objectStorage.r2.secretName }}"
                 key: accountId
           - name: R2_OBJECT_STORAGE_ACCESS_KEY_ID
             valueFrom:
               secretKeyRef:
-                name: "{{ .Values.app.objectStorage.r2.secretName }}"
+                name: "{{ .Values.global.objectStorage.r2.secretName }}"
                 key: accessKeyId
           - name: R2_OBJECT_STORAGE_SECRET_ACCESS_KEY
             valueFrom:
               secretKeyRef:
-                name: "{{ .Values.app.objectStorage.r2.secretName }}"
+                name: "{{ .Values.global.objectStorage.r2.secretName }}"
                 key: secretAccessKey
           {{ end }}
         resources:

.github/helm/affine/charts/graphql/templates/r2-secret.yaml

@@ -1,11 +0,0 @@
-{{- if .Values.app.objectStorage.r2.enabled -}}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: "{{ .Values.app.objectStorage.r2.secretName }}"
-type: Opaque
-data:
-  accountId: {{ .Values.app.objectStorage.r2.accountId | b64enc }}
-  accessKeyId: {{ .Values.app.objectStorage.r2.accessKeyId | b64enc }}
-  secretAccessKey: {{ .Values.app.objectStorage.r2.secretAccessKey | b64enc }}
-{{- end }}

.github/helm/affine/charts/graphql/values.yaml

@@ -29,14 +29,7 @@ app:
     secretName: copilot
     openai:
       key: ''
-  objectStorage:
-    r2:
-      enabled: false
-      secretName: r2
-      accountId: ''
-      accessKeyId: ''
-      secretAccessKey: ''
-  oauth: 
+  oauth:
     google:
       enabled: false
       secretName: oauth-google

.github/helm/affine/charts/renderer/Chart.yaml

@@ -0,0 +1,11 @@
+apiVersion: v2
+name: renderer
+description: AFFiNE renderer server
+type: application
+version: 0.0.0
+appVersion: "0.16.0"
+dependencies:
+  - name: gcloud-sql-proxy
+    version: 0.0.0
+    repository: "file://../gcloud-sql-proxy"
+    condition: .global.database.gcloud.enabled

.github/helm/affine/charts/renderer/templates/NOTES.txt

@@ -0,0 +1,16 @@
+1. Get the application URL by running these commands:
+{{- if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "renderer.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "renderer.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "renderer.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "renderer.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}

.github/helm/affine/charts/renderer/templates/_helpers.tpl

@@ -0,0 +1,63 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "renderer.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "renderer.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "renderer.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "renderer.labels" -}}
+helm.sh/chart: {{ include "renderer.chart" . }}
+{{ include "renderer.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+monitoring: enabled
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "renderer.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "renderer.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "renderer.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "renderer.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

.github/helm/affine/charts/renderer/templates/deployment.yaml

@@ -0,0 +1,124 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "renderer.fullname" . }}
+  labels:
+    {{- include "renderer.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "renderer.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "renderer.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "renderer.serviceAccountName" . }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          env:
+          - name: AFFINE_PRIVATE_KEY
+            valueFrom:
+              secretKeyRef:
+                name: "{{ .Values.global.secret.secretName }}"
+                key: key
+          - name: NODE_ENV
+            value: "{{ .Values.env }}"
+          - name: NODE_OPTIONS
+            value: "--max-old-space-size=4096"
+          - name: NO_COLOR
+            value: "1"
+          - name: DEPLOYMENT_TYPE
+            value: "affine"
+          - name: SERVER_FLAVOR
+            value: "renderer"
+          - name: AFFINE_ENV
+            value: "{{ .Release.Namespace }}"
+          - name: DATABASE_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: pg-postgresql
+                key: postgres-password
+          - name: DATABASE_URL
+            value: postgres://{{ .Values.global.database.user }}:$(DATABASE_PASSWORD)@{{ .Values.global.database.url }}:{{ .Values.global.database.port }}/{{ .Values.global.database.name }}
+          - name: REDIS_SERVER_ENABLED
+            value: "true"
+          - name: REDIS_SERVER_HOST
+            value: "{{ .Values.global.redis.host }}"
+          - name: REDIS_SERVER_PORT
+            value: "{{ .Values.global.redis.port }}"
+          - name: REDIS_SERVER_USER
+            value: "{{ .Values.global.redis.username }}"
+          - name: REDIS_SERVER_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: redis
+                key: redis-password
+          - name: REDIS_SERVER_DATABASE
+            value: "{{ .Values.global.redis.database }}"
+          - name: AFFINE_SERVER_PORT
+            value: "{{ .Values.service.port }}"
+          - name: AFFINE_SERVER_SUB_PATH
+            value: "{{ .Values.app.path }}"
+          - name: AFFINE_SERVER_HOST
+            value: "{{ .Values.app.host }}"
+          - name: AFFINE_SERVER_HTTPS
+            value: "{{ .Values.app.https }}"
+          - name: ENABLE_R2_OBJECT_STORAGE
+            value: "{{ .Values.global.objectStorage.r2.enabled }}"
+          {{ if .Values.global.objectStorage.r2.enabled }}
+          - name: R2_OBJECT_STORAGE_ACCOUNT_ID
+            valueFrom:
+              secretKeyRef:
+                name: "{{ .Values.global.objectStorage.r2.secretName }}"
+                key: accountId
+          - name: R2_OBJECT_STORAGE_ACCESS_KEY_ID
+            valueFrom:
+              secretKeyRef:
+                name: "{{ .Values.global.objectStorage.r2.secretName }}"
+                key: accessKeyId
+          - name: R2_OBJECT_STORAGE_SECRET_ACCESS_KEY
+            valueFrom:
+              secretKeyRef:
+                name: "{{ .Values.global.objectStorage.r2.secretName }}"
+                key: secretAccessKey
+          {{ end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /info
+              port: http
+            initialDelaySeconds: {{ .Values.probe.initialDelaySeconds }}
+          readinessProbe:
+            httpGet:
+              path: /info
+              port: http
+            initialDelaySeconds: {{ .Values.probe.initialDelaySeconds }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

.github/helm/affine/charts/renderer/templates/service.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "graphql.fullname" . }}
+  labels:
+    {{- include "graphql.labels" . | nindent 4 }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "graphql.selectorLabels" . | nindent 4 }}

.github/helm/affine/charts/renderer/templates/serviceaccount.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "graphql.serviceAccountName" . }}
+  labels:
+    {{- include "graphql.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

.github/helm/affine/charts/renderer/templates/tests/test-connection.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "renderer.fullname" . }}-test-connection"
+  labels:
+    {{- include "renderer.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+spec:
+  containers:
+    - name: wget
+      image: busybox
+      command: ['wget']
+      args: ['{{ include "renderer.fullname" . }}:{{ .Values.service.port }}']
+  restartPolicy: Never

.github/helm/affine/charts/renderer/values.yaml

@@ -0,0 +1,38 @@
+replicaCount: 1
+image:
+  repository: ghcr.io/toeverything/affine-graphql
+  pullPolicy: IfNotPresent
+  tag: ''
+
+imagePullSecrets: []
+nameOverride: ''
+fullnameOverride: ''
+# map to NODE_ENV environment variable
+env: 'production'
+app:
+  # AFFINE_SERVER_SUB_PATH
+  path: ''
+  # AFFINE_SERVER_HOST
+  host: '0.0.0.0'
+  https: true
+serviceAccount:
+  create: true
+  annotations: {}
+  name: 'affine-renderer'
+
+podAnnotations: {}
+
+podSecurityContext:
+  fsGroup: 2000
+
+resources:
+  requests:
+    cpu: '4'
+    memory: 4Gi
+
+probe:
+  initialDelaySeconds: 20
+
+nodeSelector: {}
+tolerations: []
+affinity: {}

.github/helm/affine/charts/sync/Chart.yaml

@@ -3,7 +3,7 @@ name: sync
 description: AFFiNE Sync Server
 type: application
 version: 0.0.0
-appVersion: "0.16.0"
+appVersion: "0.17.0"
 dependencies:
   - name: gcloud-sql-proxy
     version: 0.0.0

.github/helm/affine/charts/web/templates/deployment.yaml

@@ -27,6 +27,9 @@ spec:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          env:
+          - name: AFFINE_ENV
+            value: "{{ .Release.Namespace }}"
           ports:
             - name: http
               containerPort: {{ .Values.service.port }}

.github/helm/affine/templates/configmap.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-runtime-config
+data:
+  web-assets-manifest: |-
+    {{ .Files.Get "web-assets-manifest.json" | nindent 4 }}
+  mobile-assets-manifest: |-
+    {{ .Files.Get "mobile-assets-manifest.json" | nindent 4 }}

.github/helm/affine/templates/ingress.yaml

@@ -60,13 +60,13 @@ spec:
                 name: affine-graphql
                 port:
                   number: {{ .Values.graphql.service.port }}
-          - path: /oauth
+          - path: /workspace
             pathType: Prefix
             backend:
               service:
-                name: affine-graphql
+                name: affine-renderer
                 port:
-                  number: {{ .Values.graphql.service.port }}
+                  number: {{ .Values.renderer.service.port }}
           - path: /
             pathType: Prefix
             backend:
@@ -74,11 +74,4 @@ spec:
                 name: affine-web
                 port:
                   number: {{ .Values.web.service.port }}
-          - path: /js/worker.(.+).js
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: affine-web
-                port:
-                  number: {{ .Values.web.service.port }}
 {{- end }}

.github/helm/affine/templates/r2-secret.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.global.objectStorage.r2.enabled -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ .Values.global.objectStorage.r2.secretName }}"
+type: Opaque
+data:
+  accountId: {{ .Values.global.objectStorage.r2.accountId | b64enc }}
+  accessKeyId: {{ .Values.global.objectStorage.r2.accessKeyId | b64enc }}
+  secretAccessKey: {{ .Values.global.objectStorage.r2.secretAccessKey | b64enc }}
+{{- end }}

.github/helm/affine/values.yaml

@@ -1,4 +1,6 @@
 global:
+  app:
+    buildType: 'stable'
   ingress:
     enabled: false
     className: ''
@@ -28,6 +30,13 @@ global:
     username: ''
     password: ''
     database: 0
+  objectStorage:
+    r2:
+      enabled: false
+      secretName: r2
+      accountId: ''
+      accessKeyId: ''
+      secretAccessKey: ''
   gke:
     enabled: true
 
@@ -45,6 +54,13 @@ sync:
     annotations:
       cloud.google.com/backend-config: '{"default": "affine-api-backendconfig"}'
 
+renderer:
+  service:
+    type: ClusterIP
+    port: 3000
+    annotations:
+      cloud.google.com/backend-config: '{"default": "affine-api-backendconfig"}'
+
 web:
   service:
     type: ClusterIP

.github/labeler.yml

@@ -77,7 +77,7 @@ app:core:
 app:electron:
   - changed-files:
       - any-glob-to-any-file:
-          - 'packages/frontend/electron/**/*'
+          - 'packages/frontend/apps/electron/**/*'
 
 app:server:
   - changed-files:

.github/renovate.json

@@ -23,12 +23,11 @@
       "groupName": "oxlint"
     },
     {
-      "groupName": "blocksuite-canary",
+      "groupName": "blocksuite",
       "matchPackagePatterns": ["^@blocksuite"],
       "excludePackageNames": ["@blocksuite/icons"],
       "rangeStrategy": "replace",
-      "followTag": "canary",
-      "enabled": false
+      "changelogUrl": "https://github.com/toeverything/blocksuite/blob/master/packages/blocks/CHANGELOG.md"
     },
     {
       "groupName": "all non-major dependencies",
@@ -41,6 +40,10 @@
       "groupName": "rust toolchain",
       "matchManagers": ["custom.regex"],
       "matchDepNames": ["rustc"]
+    },
+    {
+      "groupName": "nestjs",
+      "matchPackagePatterns": ["^@nestjs"]
     }
   ],
   "commitMessagePrefix": "chore: ",

.github/workflows/build-images.yml

@@ -6,11 +6,6 @@ on:
       flavor:
         type: string
         required: true
-  workflow_dispatch:
-    inputs:
-      flavor:
-        type: string
-        required: false
 
 env:
   NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
@@ -43,6 +38,103 @@ jobs:
           path: ./packages/backend/server/dist
           if-no-files-found: error
 
+  build-web:
+    name: Build @affine/web
+    runs-on: ubuntu-latest
+    environment: ${{ github.event.inputs.flavor }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Version
+        id: version
+        uses: ./.github/actions/setup-version
+      - name: Setup Node.js
+        uses: ./.github/actions/setup-node
+      - name: Build Core
+        run: yarn nx build @affine/web --skip-nx-cache
+        env:
+          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
+          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          BUILD_TYPE: ${{ github.event.inputs.flavor }}
+          CAPTCHA_SITE_KEY: ${{ secrets.CAPTCHA_SITE_KEY }}
+          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
+          SENTRY_PROJECT: 'affine-web'
+          SENTRY_RELEASE: ${{ steps.version.outputs.APP_VERSION }}
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+          PERFSEE_TOKEN: ${{ secrets.PERFSEE_TOKEN }}
+          MIXPANEL_TOKEN: ${{ secrets.MIXPANEL_TOKEN }}
+      - name: Upload web artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: web
+          path: ./packages/frontend/apps/web/dist
+          if-no-files-found: error
+
+  build-admin:
+    name: Build @affine/admin
+    runs-on: ubuntu-latest
+    environment: ${{ github.event.inputs.flavor }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Version
+        id: version
+        uses: ./.github/actions/setup-version
+      - name: Setup Node.js
+        uses: ./.github/actions/setup-node
+      - name: Build Admin
+        run: yarn nx build @affine/admin --skip-nx-cache
+        env:
+          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
+          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          BUILD_TYPE: ${{ github.event.inputs.flavor }}
+          CAPTCHA_SITE_KEY: ${{ secrets.CAPTCHA_SITE_KEY }}
+          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
+          SENTRY_PROJECT: 'affine-admin'
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+          PERFSEE_TOKEN: ${{ secrets.PERFSEE_TOKEN }}
+          MIXPANEL_TOKEN: ${{ secrets.MIXPANEL_TOKEN }}
+      - name: Upload admin artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: admin
+          path: ./packages/frontend/admin/dist
+          if-no-files-found: error
+
+  build-mobile:
+    name: Build @affine/mobile
+    runs-on: ubuntu-latest
+    environment: ${{ github.event.inputs.flavor }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Version
+        id: version
+        uses: ./.github/actions/setup-version
+      - name: Setup Node.js
+        uses: ./.github/actions/setup-node
+      - name: Build Mobile
+        run: yarn nx build @affine/mobile --skip-nx-cache
+        env:
+          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
+          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          BUILD_TYPE: ${{ github.event.inputs.flavor }}
+          CAPTCHA_SITE_KEY: ${{ secrets.CAPTCHA_SITE_KEY }}
+          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
+          SENTRY_PROJECT: 'affine-mobile'
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+          PERFSEE_TOKEN: ${{ secrets.PERFSEE_TOKEN }}
+          MIXPANEL_TOKEN: ${{ secrets.MIXPANEL_TOKEN }}
+      - name: Upload mobile artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: mobile
+          path: ./packages/frontend/apps/mobile/dist
+          if-no-files-found: error
+
   build-web-selfhost:
     name: Build @affine/web selfhost
     runs-on: ubuntu-latest
@@ -67,7 +159,32 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: selfhost-web
-          path: ./packages/frontend/web/dist
+          path: ./packages/frontend/apps/web/dist
+          if-no-files-found: error
+
+  build-mobile-selfhost:
+    name: Build @affine/mobile selfhost
+    runs-on: ubuntu-latest
+    environment: ${{ github.event.inputs.flavor }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Version
+        id: version
+        uses: ./.github/actions/setup-version
+      - name: Setup Node.js
+        uses: ./.github/actions/setup-node
+      - name: Build Mobile
+        run: yarn nx build @affine/mobile --skip-nx-cache
+        env:
+          BUILD_TYPE: ${{ github.event.inputs.flavor }}
+          PUBLIC_PATH: '/'
+          SELF_HOSTED: true
+          MIXPANEL_TOKEN: ${{ secrets.MIXPANEL_TOKEN }}
+      - name: Upload mobile artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: selfhost-mobile
+          path: ./packages/frontend/apps/mobile/dist
           if-no-files-found: error
 
   build-admin-selfhost:
@@ -81,7 +198,7 @@ jobs:
         uses: ./.github/actions/setup-version
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
-      - name: Build Core
+      - name: Build admin
         run: yarn nx build @affine/admin --skip-nx-cache
         env:
           BUILD_TYPE: ${{ github.event.inputs.flavor }}
@@ -131,12 +248,16 @@ jobs:
           path: ./packages/backend/native/server-native.node
           if-no-files-found: error
 
-  build-docker:
-    name: Build Docker
+  build-images:
+    name: Build Images
     runs-on: ubuntu-latest
     needs:
       - build-server
+      - build-web
+      - build-mobile
+      - build-admin
       - build-web-selfhost
+      - build-mobile-selfhost
       - build-admin-selfhost
       - build-server-native
     steps:
@@ -195,17 +316,41 @@ jobs:
           registry-url: https://npm.pkg.github.com
           scope: '@toeverything'
 
+      - name: Download web artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: web
+          path: ./packages/frontend/apps/web/dist
+
+      - name: Download mobile artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: mobile
+          path: ./packages/frontend/apps/mobile/dist
+
+      - name: Download admin artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: admin
+          path: ./packages/frontend/admin/dist
+
       - name: Download selfhost web artifact
         uses: actions/download-artifact@v4
         with:
           name: selfhost-web
-          path: ./packages/frontend/web/dist
+          path: ./packages/frontend/apps/web/dist/selfhost
+
+      - name: Download selfhost mobile artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: selfhost-mobile
+          path: ./packages/frontend/apps/mobile/dist/selfhost
 
       - name: Download selfhost admin artifact
         uses: actions/download-artifact@v4
         with:
           name: selfhost-admin
-          path: ./packages/frontend/admin/dist
+          path: ./packages/frontend/admin/dist/selfhost
 
       - name: Install Node.js dependencies
         run: |
@@ -220,6 +365,17 @@ jobs:
         id: version
         uses: ./.github/actions/setup-version
 
+      - name: Build front Dockerfile
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          pull: true
+          platforms: linux/amd64,linux/arm64
+          provenance: true
+          file: .github/deployment/front/Dockerfile
+          tags: ghcr.io/toeverything/affine-front:${{env.RELEASE_FLAVOR}}-${{ env.GIT_SHORT_HASH }},ghcr.io/toeverything/affine-front:${{env.RELEASE_FLAVOR}}
+
       - name: Build graphql Dockerfile
         uses: docker/build-push-action@v6
         with:

.github/workflows/build-selfhost-image.yml

@@ -20,6 +20,6 @@ permissions:
 jobs:
   build-image:
     name: Build Image
-    uses: ./.github/workflows/build-server-image.yml
+    uses: ./.github/workflows/build-images.yml
     with:
       flavor: ${{ github.event.inputs.flavor }}

.github/workflows/build-test.yml

@@ -117,7 +117,7 @@ jobs:
     name: E2E Test
     runs-on: ubuntu-latest
     env:
-      DISTRIBUTION: browser
+      DISTRIBUTION: web
       IN_CI_TEST: true
     strategy:
       fail-fast: false
@@ -143,11 +143,41 @@ jobs:
           path: ./test-results
           if-no-files-found: ignore
 
+  e2e-mobile-test:
+    name: E2E Mobile Test
+    runs-on: ubuntu-latest
+    env:
+      DISTRIBUTION: mobile
+      IN_CI_TEST: true
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4, 5]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Node.js
+        uses: ./.github/actions/setup-node
+        with:
+          playwright-install: true
+          electron-install: false
+          full-cache: true
+
+      - name: Run playwright tests
+        run: yarn workspace @affine-test/affine-mobile e2e --forbid-only --shard=${{ matrix.shard }}/${{ strategy.job-total }}
+
+      - name: Upload test results
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-results-e2e-mobile-${{ matrix.shard }}
+          path: ./test-results
+          if-no-files-found: ignore
+
   e2e-migration-test:
     name: E2E Migration Test
     runs-on: ubuntu-latest
     env:
-      DISTRIBUTION: browser
+      DISTRIBUTION: web
     steps:
       - uses: actions/checkout@v4
       - name: Setup Node.js
@@ -174,7 +204,7 @@ jobs:
     needs:
       - build-native
     env:
-      DISTRIBUTION: browser
+      DISTRIBUTION: web
     steps:
       - uses: actions/checkout@v4
       - name: Setup Node.js
@@ -266,8 +296,8 @@ jobs:
           path: ./packages/backend/native/server-native.node
           if-no-files-found: error
 
-  build-web:
-    name: Build @affine/web
+  build-electron-renderer:
+    name: Build @affine/electron renderer
     runs-on: ubuntu-latest
 
     steps:
@@ -277,13 +307,13 @@ jobs:
         with:
           electron-install: false
           full-cache: true
-      - name: Build Web
+      - name: Build Electron renderer
         # always skip cache because its fast, and cache configuration is always changing
-        run: yarn nx build @affine/web --skip-nx-cache
+        run: yarn build
         env:
-          DISTRIBUTION: 'desktop'
+          DISTRIBUTION: desktop
       - name: zip web
-        run: tar -czf dist.tar.gz --directory=packages/frontend/electron/renderer/dist .
+        run: tar -czf dist.tar.gz --directory=packages/frontend/apps/electron/renderer/dist .
       - name: Upload web artifact
         uses: actions/upload-artifact@v4
         with:
@@ -297,7 +327,7 @@ jobs:
     needs: build-server-native
     env:
       NODE_ENV: test
-      DISTRIBUTION: browser
+      DISTRIBUTION: web
     services:
       postgres:
         image: postgres
@@ -366,7 +396,7 @@ jobs:
     name: ${{ matrix.tests.name }}
     runs-on: ubuntu-latest
     env:
-      DISTRIBUTION: browser
+      DISTRIBUTION: web
       DATABASE_URL: postgresql://affine:affine@localhost:5432/affine
       IN_CI_TEST: true
     strategy:
@@ -490,7 +520,7 @@ jobs:
               test: true,
             }
     needs:
-      - build-web
+      - build-electron-renderer
       - build-native
     steps:
       - uses: actions/checkout@v4
@@ -524,7 +554,7 @@ jobs:
       - name: Download web artifact
         uses: ./.github/actions/download-web
         with:
-          path: packages/frontend/electron/resources/web-static
+          path: packages/frontend/apps/electron/resources/web-static
 
       - name: Build Desktop Layers
         run: yarn workspace @affine/electron build
@@ -571,8 +601,11 @@ jobs:
       - lint
       - check-yarn-binary
       - e2e-test
+      - e2e-mobile-test
       - e2e-migration-test
       - unit-test
+      - build-native
+      - build-server-native
       - server-test
       - server-e2e-test
       - desktop-test

.github/workflows/deploy.yml

@@ -62,133 +62,19 @@ jobs:
           echo "version=$prev_version" >> $GITHUB_OUTPUT
           echo "namesapce=$namespace" >> $GITHUB_OUTPUT
 
-  build-server-image:
-    name: Build Server Image
-    uses: ./.github/workflows/build-server-image.yml
+  build-images:
+    name: Build Images
+    uses: ./.github/workflows/build-images.yml
+    secrets: inherit
     with:
       flavor: ${{ github.event.inputs.flavor }}
 
-  build-web:
-    name: Build @affine/web
-    runs-on: ubuntu-latest
-    environment: ${{ github.event.inputs.flavor }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup Version
-        id: version
-        uses: ./.github/actions/setup-version
-      - name: Setup Node.js
-        uses: ./.github/actions/setup-node
-      - name: Build Core
-        run: yarn nx build @affine/web --skip-nx-cache
-        env:
-          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
-          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-          BUILD_TYPE: ${{ github.event.inputs.flavor }}
-          CAPTCHA_SITE_KEY: ${{ secrets.CAPTCHA_SITE_KEY }}
-          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
-          SENTRY_PROJECT: 'affine-web'
-          SENTRY_RELEASE: ${{ steps.version.outputs.APP_VERSION }}
-          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-          PERFSEE_TOKEN: ${{ secrets.PERFSEE_TOKEN }}
-          MIXPANEL_TOKEN: ${{ secrets.MIXPANEL_TOKEN }}
-      - name: Upload web artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: web
-          path: ./packages/frontend/web/dist
-          if-no-files-found: error
-
-  build-admin:
-    name: Build @affine/admin
-    runs-on: ubuntu-latest
-    environment: ${{ github.event.inputs.flavor }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup Version
-        id: version
-        uses: ./.github/actions/setup-version
-      - name: Setup Node.js
-        uses: ./.github/actions/setup-node
-      - name: Build Core
-        run: yarn nx build @affine/admin --skip-nx-cache
-        env:
-          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
-          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-          BUILD_TYPE: ${{ github.event.inputs.flavor }}
-          CAPTCHA_SITE_KEY: ${{ secrets.CAPTCHA_SITE_KEY }}
-          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
-          SENTRY_PROJECT: 'affine-admin'
-          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-          PERFSEE_TOKEN: ${{ secrets.PERFSEE_TOKEN }}
-          MIXPANEL_TOKEN: ${{ secrets.MIXPANEL_TOKEN }}
-      - name: Upload admin artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: admin
-          path: ./packages/frontend/admin/dist
-          if-no-files-found: error
-
-  build-frontend-image:
-    name: Build Frontend Image
-    runs-on: ubuntu-latest
-    needs:
-      - build-web
-      - build-admin
-    steps:
-      - uses: actions/checkout@v4
-      - name: Download web artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: web
-          path: ./packages/frontend/web/dist
-      - name: Download admin artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: admin
-          path: ./packages/frontend/admin/dist
-      - name: Setup env
-        run: |
-          echo "GIT_SHORT_HASH=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV"
-          if [ -z "${{ inputs.flavor }}" ]
-          then
-            echo "RELEASE_FLAVOR=canary" >> "$GITHUB_ENV"
-          else
-            echo "RELEASE_FLAVOR=${{ inputs.flavor }}" >> "$GITHUB_ENV"
-          fi
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          logout: false
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Build front Dockerfile
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          push: true
-          pull: true
-          platforms: linux/amd64,linux/arm64
-          provenance: true
-          file: .github/deployment/front/Dockerfile
-          tags: ghcr.io/toeverything/affine-front:${{env.RELEASE_FLAVOR}}-${{ env.GIT_SHORT_HASH }},ghcr.io/toeverything/affine-front:${{env.RELEASE_FLAVOR}}
-
   deploy:
     name: Deploy to cluster
     if: ${{ github.event_name == 'workflow_dispatch' }}
     environment: ${{ github.event.inputs.flavor }}
     needs:
-      - build-frontend-image
-      - build-server-image
+      - build-images
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -238,8 +124,7 @@ jobs:
   deploy-done:
     needs:
       - output-prev-version
-      - build-frontend-image
-      - build-server-image
+      - build-images
       - deploy
     if: always()
     runs-on: ubuntu-latest
@@ -288,7 +173,7 @@ jobs:
           BLOCKSUITE_REPO_PATH: ${{ github.workspace }}/blocksuite
       - name: Post Failed event to a Slack channel
         id: failed-slack
-        uses: slackapi/slack-github-action@v1.26.0
+        uses: slackapi/slack-github-action@v1.27.0
         if: ${{ always() && contains(needs.*.result, 'failure') }}
         with:
           channel-id: ${{ secrets.RELEASE_SLACK_CHNNEL_ID }}
@@ -308,7 +193,7 @@ jobs:
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
       - name: Post Cancel event to a Slack channel
         id: cancel-slack
-        uses: slackapi/slack-github-action@v1.26.0
+        uses: slackapi/slack-github-action@v1.27.0
         if: ${{ always() && contains(needs.*.result, 'cancelled') && !contains(needs.*.result, 'failure') }}
         with:
           channel-id: ${{ secrets.RELEASE_SLACK_CHNNEL_ID }}

.github/workflows/languages-sync.yml

@@ -1,35 +0,0 @@
-name: Languages Sync
-
-on:
-  push:
-    branches: ['canary']
-    paths:
-      - 'packages/frontend/i18n/**'
-      - '.github/workflows/languages-sync.yml'
-      - '!.github/actions/setup-node/action.yml'
-  pull_request_target:
-    branches: ['canary']
-    paths:
-      - 'packages/frontend/i18n/**'
-      - '.github/workflows/languages-sync.yml'
-      - '!.github/actions/setup-node/action.yml'
-  workflow_dispatch:
-
-jobs:
-  main:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup Node.js
-        uses: ./.github/actions/setup-node
-      - name: Check Language Key
-        if: github.ref != 'refs/heads/canary'
-        run: yarn workspace @affine/i18n run sync-languages:check
-        env:
-          TOLGEE_API_KEY: ${{ secrets.TOLGEE_API_KEY }}
-
-      - name: Sync Languages
-        if: github.ref == 'refs/heads/canary'
-        run: yarn workspace @affine/i18n run sync-languages
-        env:
-          TOLGEE_API_KEY: ${{ secrets.TOLGEE_API_KEY }}

.github/workflows/release-desktop.yml

@@ -67,7 +67,7 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: web
-          path: packages/frontend/electron/resources/web-static
+          path: packages/frontend/apps/electron/resources/web-static
 
   make-distribution:
     strategy:
@@ -119,7 +119,7 @@ jobs:
       - uses: actions/download-artifact@v4
         with:
           name: web
-          path: packages/frontend/electron/resources/web-static
+          path: packages/frontend/apps/electron/resources/web-static
 
       - name: Build Desktop Layers
         run: yarn workspace @affine/electron build
@@ -146,20 +146,20 @@ jobs:
       - name: signing DMG
         if: ${{ matrix.spec.platform == 'darwin' }}
         run: |
-          codesign --force --sign "Developer ID Application: TOEVERYTHING PTE. LTD." packages/frontend/electron/out/${{ env.BUILD_TYPE }}/make/AFFiNE.dmg
+          codesign --force --sign "Developer ID Application: TOEVERYTHING PTE. LTD." packages/frontend/apps/electron/out/${{ env.BUILD_TYPE }}/make/AFFiNE.dmg
 
       - name: Save artifacts (mac)
         if: ${{ matrix.spec.platform == 'darwin' }}
         run: |
           mkdir -p builds
-          mv packages/frontend/electron/out/*/make/*.dmg ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-macos-${{ matrix.spec.arch }}.dmg
-          mv packages/frontend/electron/out/*/make/zip/darwin/${{ matrix.spec.arch }}/*.zip ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-macos-${{ matrix.spec.arch }}.zip
+          mv packages/frontend/apps/electron/out/*/make/*.dmg ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-macos-${{ matrix.spec.arch }}.dmg
+          mv packages/frontend/apps/electron/out/*/make/zip/darwin/${{ matrix.spec.arch }}/*.zip ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-macos-${{ matrix.spec.arch }}.zip
       - name: Save artifacts (linux)
         if: ${{ matrix.spec.platform == 'linux' }}
         run: |
           mkdir -p builds
-          mv packages/frontend/electron/out/*/make/zip/linux/x64/*.zip ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-linux-x64.zip
-          mv packages/frontend/electron/out/*/make/*.AppImage ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-linux-x64.appimage
+          mv packages/frontend/apps/electron/out/*/make/zip/linux/x64/*.zip ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-linux-x64.zip
+          mv packages/frontend/apps/electron/out/*/make/*.AppImage ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-linux-x64.appimage
 
       - uses: actions/attest-build-provenance@v1
         if: ${{ matrix.spec.platform == 'darwin' }}
@@ -221,7 +221,7 @@ jobs:
       - uses: actions/download-artifact@v4
         with:
           name: web
-          path: packages/frontend/electron/resources/web-static
+          path: packages/frontend/apps/electron/resources/web-static
 
       - name: Build Desktop Layers
         run: yarn workspace @affine/electron build
@@ -235,12 +235,12 @@ jobs:
       - name: get all files to be signed
         id: get_files_to_be_signed
         run: |
-          Set-Variable -Name FILES_TO_BE_SIGNED -Value ((Get-ChildItem -Path packages/frontend/electron/out -Recurse -File | Where-Object { $_.Extension -in @(".exe", ".node", ".dll", ".msi") } | ForEach-Object { '"' + $_.FullName.Replace((Get-Location).Path + '\packages\frontend\electron\out\', '') + '"' }) -join ' ')
+          Set-Variable -Name FILES_TO_BE_SIGNED -Value ((Get-ChildItem -Path packages/frontend/apps/electron/out -Recurse -File | Where-Object { $_.Extension -in @(".exe", ".node", ".dll", ".msi") } | ForEach-Object { '"' + $_.FullName.Replace((Get-Location).Path + '\packages\frontend\apps\electron\out\', '') + '"' }) -join ' ')
           "FILES_TO_BE_SIGNED=$FILES_TO_BE_SIGNED" >> $env:GITHUB_OUTPUT
           echo $FILES_TO_BE_SIGNED
 
       - name: Zip artifacts for faster upload
-        run: Compress-Archive -CompressionLevel Fastest -Path packages/frontend/electron/out/* -DestinationPath archive.zip
+        run: Compress-Archive -CompressionLevel Fastest -Path packages/frontend/apps/electron/out/* -DestinationPath archive.zip
 
       - name: Save packaged artifacts for signing
         uses: actions/upload-artifact@v4
@@ -287,7 +287,7 @@ jobs:
           name: signed-packaged-${{ matrix.spec.platform }}-${{ matrix.spec.arch }}
           path: .
       - name: unzip file
-        run: Expand-Archive -Path signed.zip -DestinationPath packages/frontend/electron/out
+        run: Expand-Archive -Path signed.zip -DestinationPath packages/frontend/apps/electron/out
 
       - name: Make squirrel.windows installer
         run: yarn workspace @affine/electron make-squirrel --platform=${{ matrix.spec.platform }} --arch=${{ matrix.spec.arch }}
@@ -296,12 +296,12 @@ jobs:
         run: yarn workspace @affine/electron make-nsis --platform=${{ matrix.spec.platform }} --arch=${{ matrix.spec.arch }}
 
       - name: Zip artifacts for faster upload
-        run: Compress-Archive -CompressionLevel Fastest -Path packages/frontend/electron/out/${{ env.BUILD_TYPE }}/make/* -DestinationPath archive.zip
+        run: Compress-Archive -CompressionLevel Fastest -Path packages/frontend/apps/electron/out/${{ env.BUILD_TYPE }}/make/* -DestinationPath archive.zip
 
       - name: get all files to be signed
         id: get_files_to_be_signed
         run: |
-          Set-Variable -Name FILES_TO_BE_SIGNED -Value ((Get-ChildItem -Path packages/frontend/electron/out/${{ env.BUILD_TYPE }}/make -Recurse -File | Where-Object { $_.Extension -in @(".exe", ".node", ".dll", ".msi") } | ForEach-Object { '"' + $_.FullName.Replace((Get-Location).Path + '\packages\frontend\electron\out\${{ env.BUILD_TYPE }}\make\', '') + '"' }) -join ' ')
+          Set-Variable -Name FILES_TO_BE_SIGNED -Value ((Get-ChildItem -Path packages/frontend/apps/electron/out/${{ env.BUILD_TYPE }}/make -Recurse -File | Where-Object { $_.Extension -in @(".exe", ".node", ".dll", ".msi") } | ForEach-Object { '"' + $_.FullName.Replace((Get-Location).Path + '\packages\frontend\apps\electron\out\${{ env.BUILD_TYPE }}\make\', '') + '"' }) -join ' ')
           "FILES_TO_BE_SIGNED=$FILES_TO_BE_SIGNED" >> $env:GITHUB_OUTPUT
           echo $FILES_TO_BE_SIGNED
 
@@ -335,14 +335,14 @@ jobs:
           name: signed-installer-${{ matrix.spec.platform }}-${{ matrix.spec.arch }}
           path: .
       - name: unzip file
-        run: Expand-Archive -Path signed.zip -DestinationPath packages/frontend/electron/out/${{ env.BUILD_TYPE }}/make
+        run: Expand-Archive -Path signed.zip -DestinationPath packages/frontend/apps/electron/out/${{ env.BUILD_TYPE }}/make
 
       - name: Save artifacts
         run: |
           mkdir -p builds
-          mv packages/frontend/electron/out/*/make/zip/win32/x64/AFFiNE*-win32-x64-*.zip ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-windows-x64.zip
-          mv packages/frontend/electron/out/*/make/squirrel.windows/x64/*.exe ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-windows-x64.exe
-          mv packages/frontend/electron/out/*/make/nsis.windows/x64/*.exe ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-windows-x64.nsis.exe
+          mv packages/frontend/apps/electron/out/*/make/zip/win32/x64/AFFiNE*-win32-x64-*.zip ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-windows-x64.zip
+          mv packages/frontend/apps/electron/out/*/make/squirrel.windows/x64/*.exe ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-windows-x64.exe
+          mv packages/frontend/apps/electron/out/*/make/nsis.windows/x64/*.exe ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-windows-x64.nsis.exe
 
       - uses: actions/attest-build-provenance@v1
         with:
@@ -394,7 +394,7 @@ jobs:
           node-version: 20
       - name: Generate Release yml
         run: |
-          node ./packages/frontend/electron/scripts/generate-yml.js
+          node ./packages/frontend/apps/electron/scripts/generate-yml.js
         env:
           RELEASE_VERSION: ${{ needs.before-make.outputs.RELEASE_VERSION }}
       - name: Create Release Draft

.github/workflows/sync-i18n.yml

@@ -0,0 +1,42 @@
+name: Sync I18n with Crowdin
+
+on:
+  push:
+    branches:
+      - canary
+    paths:
+      - 'packages/frontend/i18n/**'
+  workflow_dispatch:
+
+jobs:
+  synchronize-with-crowdin:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Crowdin action
+        uses: crowdin/github-action@v2
+        with:
+          upload_sources: true
+          upload_translations: true
+          download_translations: true
+          auto_approve_imported: true
+          import_eq_suggestions: true
+          export_only_approved: true
+          skip_untranslated_strings: true
+          localization_branch_name: l10n_crowdin_translations
+          create_pull_request: true
+          pull_request_title: 'New Crowdin Translations'
+          pull_request_body: 'New Crowdin translations by [Crowdin GH Action](https://github.com/crowdin/github-action)'
+          pull_request_base_branch_name: 'canary'
+          config: packages/frontend/i18n/crowdin.yml
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}

.yarnrc.yml

@@ -12,4 +12,4 @@ npmPublishAccess: public
 
 npmPublishRegistry: "https://registry.npmjs.org"
 
-yarnPath: .yarn/releases/yarn-4.4.0.cjs
+yarnPath: .yarn/releases/yarn-4.5.0.cjs

Cargo.toml

@@ -3,26 +3,27 @@ members  = ["./packages/backend/native", "./packages/frontend/native", "./packag
 resolver = "2"
 
 [workspace.dependencies]
-anyhow      = "1"
-chrono      = "0.4"
-dotenv      = "0.15"
-file-format = { version = "0.25", features = ["reader"] }
-mimalloc    = "0.1"
-napi        = { version = "3.0.0-alpha.1", features = ["async", "chrono_date", "error_anyhow", "napi9", "serde"] }
-napi-build  = { version = "2" }
-napi-derive = { version = "3.0.0-alpha.1" }
-notify      = { version = "6", features = ["serde"] }
-once_cell   = "1"
-parking_lot = "0.12"
-rand        = "0.8"
-serde       = "1"
-serde_json  = "1"
-sha3        = "0.10"
-sqlx        = { version = "0.8", default-features = false, features = ["chrono", "macros", "migrate", "runtime-tokio", "sqlite", "tls-rustls"] }
-tiktoken-rs = "0.5"
-tokio       = "1.37"
-uuid        = "1.8"
-y-octo      = { git = "https://github.com/y-crdt/y-octo.git", branch = "main" }
+anyhow       = "1"
+chrono       = "0.4"
+dotenv       = "0.15"
+file-format  = { version = "0.25", features = ["reader"] }
+mimalloc     = "0.1"
+napi         = { version = "3.0.0-alpha.1", features = ["async", "chrono_date", "error_anyhow", "napi9", "serde"] }
+napi-build   = { version = "2" }
+napi-derive  = { version = "3.0.0-alpha.1" }
+notify       = { version = "6", features = ["serde"] }
+once_cell    = "1"
+parking_lot  = "0.12"
+rand         = "0.8"
+serde        = "1"
+serde_json   = "1"
+sha3         = "0.10"
+sqlx         = { version = "0.8", default-features = false, features = ["chrono", "macros", "migrate", "runtime-tokio", "sqlite", "tls-rustls"] }
+tiktoken-rs  = "0.5"
+tokio        = "1.37"
+uuid         = "1.8"
+v_htmlescape = "0.15"
+y-octo       = { git = "https://github.com/y-crdt/y-octo.git", branch = "main" }
 
 [profile.dev.package.sqlx-macros]
 opt-level = 3

docs/reference/package.json

@@ -19,5 +19,5 @@
     ],
     "ext": "ts,md,json"
   },
-  "version": "0.16.0"
+  "version": "0.17.0"
 }

nx.json

@@ -81,9 +81,6 @@
     "test": {
       "outputs": ["{workspaceRoot}/.nyc_output"],
       "inputs": [
-        {
-          "env": "ENABLE_PRELOADING"
-        },
         {
           "env": "COVERAGE"
         }
@@ -92,9 +89,6 @@
     "test:ui": {
       "outputs": ["{workspaceRoot}/.nyc_output"],
       "inputs": [
-        {
-          "env": "ENABLE_PRELOADING"
-        },
         {
           "env": "COVERAGE"
         }
@@ -102,11 +96,7 @@
     },
     "test:coverage": {
       "outputs": ["{workspaceRoot}/.nyc_output"],
-      "inputs": [
-        {
-          "env": "ENABLE_PRELOADING"
-        }
-      ]
+      "inputs": []
     }
   }
 }

package.json

@@ -1,12 +1,13 @@
 {
   "name": "@affine/monorepo",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "private": true,
   "author": "toeverything",
   "license": "MIT",
   "workspaces": [
     ".",
     "packages/*/*",
+    "packages/frontend/apps/*",
     "tools/*",
     "docs/reference",
     "tools/@types/*",
@@ -18,8 +19,8 @@
   },
   "scripts": {
     "dev": "yarn workspace @affine/cli dev",
+    "build": "yarn workspace @affine/cli bundle",
     "dev:electron": "yarn workspace @affine/electron dev",
-    "build": "yarn nx build @affine/web",
     "build:electron": "yarn nx build @affine/electron",
     "build:server-native": "yarn nx run-many -t build -p @affine/server-native",
     "start:web-static": "yarn workspace @affine/web static-server",
@@ -52,28 +53,21 @@
     ]
   },
   "devDependencies": {
-    "@affine-test/kit": "workspace:*",
     "@affine/cli": "workspace:*",
-    "@commitlint/cli": "^19.2.1",
-    "@commitlint/config-conventional": "^19.1.0",
-    "@faker-js/faker": "^8.4.1",
+    "@faker-js/faker": "^9.0.0",
     "@istanbuljs/schema": "^0.1.3",
     "@magic-works/i18n-codegen": "^0.6.0",
-    "@nx/vite": "^19.5.3",
-    "@playwright/test": "=1.46.1",
+    "@playwright/test": "=1.47.1",
     "@taplo/cli": "^0.7.0",
-    "@testing-library/react": "^16.0.0",
     "@toeverything/infra": "workspace:*",
     "@types/affine__env": "workspace:*",
-    "@types/eslint": "^8.56.7",
+    "@types/eslint": "^9.0.0",
     "@types/node": "^20.12.7",
     "@typescript-eslint/eslint-plugin": "^7.6.0",
     "@typescript-eslint/parser": "^7.6.0",
     "@vanilla-extract/vite-plugin": "^4.0.7",
-    "@vanilla-extract/webpack-plugin": "^2.3.7",
-    "@vitejs/plugin-react-swc": "^3.6.0",
-    "@vitest/coverage-istanbul": "1.6.0",
-    "@vitest/ui": "1.6.0",
+    "@vitest/coverage-istanbul": "2.1.1",
+    "@vitest/ui": "2.1.1",
     "cross-env": "^7.0.3",
     "electron": "^32.0.0",
     "eslint": "^8.57.0",
@@ -86,31 +80,21 @@
     "eslint-plugin-sonarjs": "^0.25.1",
     "eslint-plugin-unicorn": "^52.0.0",
     "eslint-plugin-unused-imports": "^3.1.0",
-    "eslint-plugin-vue": "^9.24.1",
-    "fake-indexeddb": "6.0.0",
     "happy-dom": "^15.0.0",
     "husky": "^9.0.11",
     "lint-staged": "^15.2.2",
     "msw": "^2.3.0",
-    "nanoid": "^5.0.7",
     "nx": "^19.0.0",
-    "nyc": "^17.0.0",
-    "oxlint": "0.8.0",
+    "oxlint": "0.9.6",
     "prettier": "^3.3.3",
     "semver": "^7.6.0",
     "serve": "^14.2.1",
-    "string-width": "^7.1.0",
-    "ts-node": "^10.9.2",
     "typescript": "^5.4.5",
     "unplugin-swc": "^1.4.5",
     "vite": "^5.2.8",
-    "vite-plugin-istanbul": "^6.0.0",
-    "vite-plugin-static-copy": "^1.0.2",
-    "vitest": "1.6.0",
-    "vitest-fetch-mock": "^0.3.0",
-    "vitest-mock-extended": "^2.0.0"
+    "vitest": "2.1.1"
   },
-  "packageManager": "yarn@4.4.0",
+  "packageManager": "yarn@4.5.0",
   "resolutions": {
     "array-buffer-byte-length": "npm:@nolyfill/array-buffer-byte-length@latest",
     "array-includes": "npm:@nolyfill/array-includes@latest",

packages/backend/native/Cargo.toml

@@ -7,14 +7,15 @@ version = "1.0.0"
 crate-type = ["cdylib"]
 
 [dependencies]
-chrono      = { workspace = true }
-file-format = { workspace = true }
-napi        = { workspace = true }
-napi-derive = { workspace = true }
-rand        = { workspace = true }
-sha3        = { workspace = true }
-tiktoken-rs = { workspace = true }
-y-octo      = { workspace = true }
+chrono       = { workspace = true }
+file-format  = { workspace = true }
+napi         = { workspace = true }
+napi-derive  = { workspace = true }
+rand         = { workspace = true }
+sha3         = { workspace = true }
+tiktoken-rs  = { workspace = true }
+v_htmlescape = { workspace = true }
+y-octo       = { workspace = true }
 
 [target.'cfg(not(target_os = "linux"))'.dependencies]
 mimalloc = { workspace = true }

packages/backend/native/index.d.ts

@@ -8,6 +8,8 @@ export declare function fromModelName(modelName: string): Tokenizer | null
 
 export declare function getMime(input: Uint8Array): string
 
+export declare function htmlSanitize(input: string): string
+
 /**
  * Merge updates in form like `Y.applyUpdate(doc, update)` way and return the
  * result binary.

packages/backend/native/index.js

@@ -11,3 +11,4 @@ export const mintChallengeResponse = binding.mintChallengeResponse;
 export const getMime = binding.getMime;
 export const Tokenizer = binding.Tokenizer;
 export const fromModelName = binding.fromModelName;
+export const htmlSanitize = binding.htmlSanitize;

packages/backend/native/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@affine/server-native",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "engines": {
     "node": ">= 10.16.0 < 11 || >= 11.8.0"
   },

packages/backend/native/project.json

@@ -12,12 +12,12 @@
         "script": "build"
       },
       "inputs": [
-        { "runtime": "rustc --version" },
-        { "runtime": "node -v" },
-        { "runtime": "clang --version" },
-        { "runtime": "cargo tree" }
+        { "fileset": "{workspaceRoot}/rust-toolchain.toml" },
+        { "fileset": "{workspaceRoot}/Cargo.lock" },
+        { "fileset": "{workspaceRoot}/packages/backend/native/**/*.rs" },
+        { "fileset": "{workspaceRoot}/packages/backend/native/Cargo.toml" }
       ],
-      "outputs": ["{projectRoot}/*.node", "{workspaceRoot}/*.node"]
+      "outputs": ["{projectRoot}/*.node"]
     }
   }
 }

packages/backend/native/src/html_sanitize.rs

@@ -0,0 +1,4 @@
+#[napi]
+pub fn html_sanitize(input: String) -> String {
+  v_htmlescape::escape(&input).to_string()
+}

packages/backend/native/src/lib.rs

@@ -2,6 +2,7 @@
 
 pub mod file_type;
 pub mod hashcash;
+pub mod html_sanitize;
 pub mod tiktoken;
 
 use std::fmt::{Debug, Display};

packages/backend/server/migrations/20240826033024_editor_record/migration.sql

@@ -0,0 +1,21 @@
+-- AlterTable
+ALTER TABLE "snapshot_histories" ADD COLUMN     "created_by" VARCHAR;
+
+-- AlterTable
+ALTER TABLE "snapshots" ADD COLUMN     "created_by" VARCHAR,
+ADD COLUMN     "updated_by" VARCHAR;
+
+-- AlterTable
+ALTER TABLE "updates" ADD COLUMN     "created_by" VARCHAR;
+
+-- AddForeignKey
+ALTER TABLE "snapshots" ADD CONSTRAINT "snapshots_created_by_fkey" FOREIGN KEY ("created_by") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "snapshots" ADD CONSTRAINT "snapshots_updated_by_fkey" FOREIGN KEY ("updated_by") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "updates" ADD CONSTRAINT "updates_created_by_fkey" FOREIGN KEY ("created_by") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "snapshot_histories" ADD CONSTRAINT "snapshot_histories_created_by_fkey" FOREIGN KEY ("created_by") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;

packages/backend/server/migrations/20240903033137_workspace_url_preview/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "workspaces" ADD COLUMN     "enable_url_preview" BOOLEAN NOT NULL DEFAULT false;

packages/backend/server/migrations/20240908111944_index_permission_user_id/migration.sql

@@ -0,0 +1,2 @@
+-- CreateIndex
+CREATE INDEX "workspace_user_permissions_user_id_idx" ON "workspace_user_permissions"("user_id");

packages/backend/server/migrations/20240908130725_add_workspace_level_snapshot_index/migration.sql

@@ -0,0 +1,12 @@
+/*
+  Warnings:
+
+  - The primary key for the `snapshots` table will be changed. If it partially fails, the table could be left without primary key constraint.
+
+*/
+-- AlterTable
+ALTER TABLE "snapshots" DROP CONSTRAINT "snapshots_pkey",
+ADD CONSTRAINT "snapshots_pkey" PRIMARY KEY ("workspace_id", "guid");
+
+-- CreateIndex
+CREATE INDEX "snapshots_workspace_id_updated_at_idx" ON "snapshots"("workspace_id", "updated_at");

packages/backend/server/migrations/20240909090850_ai_table_index/migration.sql

@@ -0,0 +1,8 @@
+-- CreateIndex
+CREATE INDEX "ai_sessions_messages_session_id_idx" ON "ai_sessions_messages"("session_id");
+
+-- CreateIndex
+CREATE INDEX "ai_sessions_metadata_user_id_idx" ON "ai_sessions_metadata"("user_id");
+
+-- CreateIndex
+CREATE INDEX "ai_sessions_metadata_user_id_workspace_id_idx" ON "ai_sessions_metadata"("user_id", "workspace_id");

packages/backend/server/migrations/20240909100000_lower_index_user_email/migration.sql

@@ -0,0 +1,2 @@
+-- CreateIndex
+CREATE INDEX "users_email_lowercase_idx" ON "users"(lower("email"))

packages/backend/server/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@affine/server",
   "private": true,
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Affine Node.js server",
   "type": "module",
   "bin": {
@@ -25,7 +25,6 @@
     "@google-cloud/opentelemetry-cloud-monitoring-exporter": "^0.19.0",
     "@google-cloud/opentelemetry-cloud-trace-exporter": "^2.2.0",
     "@google-cloud/opentelemetry-resource-util": "^2.2.0",
-    "@keyv/redis": "^3.0.0",
     "@nestjs/apollo": "^12.1.0",
     "@nestjs/common": "^10.3.7",
     "@nestjs/core": "^10.3.7",
@@ -38,21 +37,20 @@
     "@nestjs/websockets": "^10.3.7",
     "@node-rs/argon2": "^1.8.0",
     "@node-rs/crc32": "^1.10.0",
-    "@node-rs/jsonwebtoken": "^0.5.2",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "^1.25.0",
-    "@opentelemetry/exporter-prometheus": "^0.52.0",
+    "@opentelemetry/exporter-prometheus": "^0.53.0",
     "@opentelemetry/exporter-zipkin": "^1.25.0",
     "@opentelemetry/host-metrics": "^0.35.2",
-    "@opentelemetry/instrumentation": "^0.52.0",
-    "@opentelemetry/instrumentation-graphql": "^0.42.0",
-    "@opentelemetry/instrumentation-http": "^0.52.0",
-    "@opentelemetry/instrumentation-ioredis": "^0.42.0",
-    "@opentelemetry/instrumentation-nestjs-core": "^0.39.0",
-    "@opentelemetry/instrumentation-socket.io": "^0.41.0",
+    "@opentelemetry/instrumentation": "^0.53.0",
+    "@opentelemetry/instrumentation-graphql": "^0.43.0",
+    "@opentelemetry/instrumentation-http": "^0.53.0",
+    "@opentelemetry/instrumentation-ioredis": "^0.43.0",
+    "@opentelemetry/instrumentation-nestjs-core": "^0.40.0",
+    "@opentelemetry/instrumentation-socket.io": "^0.42.0",
     "@opentelemetry/resources": "^1.25.0",
     "@opentelemetry/sdk-metrics": "^1.25.0",
-    "@opentelemetry/sdk-node": "^0.52.0",
+    "@opentelemetry/sdk-node": "^0.53.0",
     "@opentelemetry/sdk-trace-node": "^1.25.0",
     "@opentelemetry/semantic-conventions": "^1.25.0",
     "@prisma/client": "^5.15.0",
@@ -60,17 +58,16 @@
     "@socket.io/redis-adapter": "^8.3.0",
     "cookie-parser": "^1.4.6",
     "dotenv": "^16.4.5",
-    "dotenv-cli": "^7.4.1",
     "express": "^4.19.2",
     "fast-xml-parser": "^4.4.0",
     "get-stream": "^9.0.1",
     "graphql": "^16.8.1",
     "graphql-scalars": "^1.23.0",
-    "graphql-type-json": "^0.3.2",
     "graphql-upload": "^16.0.2",
     "html-validate": "^8.20.1",
     "ioredis": "^5.3.2",
-    "keyv": "^4.5.4",
+    "is-mobile": "^4.0.0",
+    "keyv": "^5.0.0",
     "lodash-es": "^4.17.21",
     "mixpanel": "^0.18.0",
     "mustache": "^4.2.0",
@@ -80,30 +77,23 @@
     "nodemailer": "^6.9.13",
     "on-headers": "^1.0.2",
     "openai": "^4.33.0",
-    "parse-duration": "^1.1.0",
     "piscina": "^4.5.1",
-    "pretty-time": "^1.1.0",
     "prisma": "^5.12.1",
-    "prom-client": "^15.1.1",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.1",
-    "semver": "^7.6.0",
     "ses": "^1.4.1",
     "socket.io": "^4.7.5",
     "stripe": "^16.0.0",
     "ts-node": "^10.9.2",
     "typescript": "^5.4.5",
-    "ws": "^8.16.0",
     "yjs": "patch:yjs@npm%3A13.6.18#~/.yarn/patches/yjs-npm-13.6.18-ad0d5f7c43.patch",
     "zod": "^3.22.4"
   },
   "devDependencies": {
     "@affine-test/kit": "workspace:*",
     "@affine/server-native": "workspace:*",
-    "@napi-rs/image": "^1.9.1",
     "@nestjs/testing": "^10.3.7",
     "@types/cookie-parser": "^1.4.7",
-    "@types/engine.io": "^3.1.10",
     "@types/express": "^4.17.21",
     "@types/graphql-upload": "^16.0.7",
     "@types/keyv": "^4.2.0",
@@ -113,14 +103,12 @@
     "@types/node": "^20.12.7",
     "@types/nodemailer": "^6.4.14",
     "@types/on-headers": "^1.0.3",
-    "@types/pretty-time": "^1.1.5",
     "@types/sinon": "^17.0.3",
     "@types/supertest": "^6.0.2",
-    "@types/ws": "^8.5.10",
     "ava": "^6.1.2",
     "c8": "^10.0.0",
     "nodemon": "^3.1.0",
-    "sinon": "^18.0.0",
+    "sinon": "^19.0.0",
     "supertest": "^7.0.0"
   },
   "ava": {

packages/backend/server/schema.prisma

@@ -33,6 +33,10 @@ model User {
   aiSessions            AiSession[]
   updatedRuntimeConfigs RuntimeConfig[]
   userSnapshots         UserSnapshot[]
+  createdSnapshot       Snapshot[]                    @relation("createdSnapshot")
+  updatedSnapshot       Snapshot[]                    @relation("updatedSnapshot")
+  createdUpdate         Update[]                      @relation("createdUpdate")
+  createdHistory        SnapshotHistory[]             @relation("createdHistory")
 
   @@index([email])
   @@map("users")
@@ -58,12 +62,13 @@ model ConnectedAccount {
 }
 
 model Session {
-  id        String    @id @default(uuid()) @db.VarChar
-  expiresAt DateTime? @map("expires_at") @db.Timestamptz(3)
-  createdAt DateTime  @default(now()) @map("created_at") @db.Timestamptz(3)
-
+  id           String        @id @default(uuid()) @db.VarChar
+  createdAt    DateTime      @default(now()) @map("created_at") @db.Timestamptz(3)
   userSessions UserSession[]
 
+  // @deprecated use [UserSession.expiresAt]
+  deprecated_expiresAt DateTime? @map("expires_at") @db.Timestamptz(3)
+
   @@map("multiple_users_sessions")
 }
 
@@ -92,9 +97,10 @@ model VerificationToken {
 }
 
 model Workspace {
-  id        String   @id @default(uuid()) @db.VarChar
-  public    Boolean
-  createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz(3)
+  id               String   @id @default(uuid()) @db.VarChar
+  public           Boolean
+  enableUrlPreview Boolean  @default(false) @map("enable_url_preview")
+  createdAt        DateTime @default(now()) @map("created_at") @db.Timestamptz(3)
 
   pages           WorkspacePage[]
   permissions     WorkspaceUserPermission[]
@@ -136,6 +142,8 @@ model WorkspaceUserPermission {
   workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
 
   @@unique([workspaceId, userId])
+  // optimize for quering user's workspace permissions
+  @@index(userId)
   @@map("workspace_user_permissions")
 }
 
@@ -241,14 +249,22 @@ model Snapshot {
   // the `updated_at` field will not record the time of record changed,
   // but the created time of last seen update that has been merged into snapshot.
   updatedAt   DateTime @map("updated_at") @db.Timestamptz(3)
+  createdBy   String?  @map("created_by") @db.VarChar
+  updatedBy   String?  @map("updated_by") @db.VarChar
+
+  // should not delete origin snapshot even if user is deleted
+  // we only delete the snapshot if the workspace is deleted
+  createdByUser User? @relation(name: "createdSnapshot", fields: [createdBy], references: [id], onDelete: SetNull)
+  updatedByUser User? @relation(name: "updatedSnapshot", fields: [updatedBy], references: [id], onDelete: SetNull)
 
   // @deprecated use updatedAt only
-  seq         Int?      @default(0) @db.Integer
+  seq Int? @default(0) @db.Integer
 
   // we need to clear all hanging updates and snapshots before enable the foreign key on workspaceId
   // workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
 
-  @@id([id, workspaceId])
+  @@id([workspaceId, id])
+  @@index([workspaceId, updatedAt])
   @@map("snapshots")
 }
 
@@ -274,9 +290,13 @@ model Update {
   id          String   @map("guid") @db.VarChar
   blob        Bytes    @db.ByteA
   createdAt   DateTime @map("created_at") @db.Timestamptz(3)
+  createdBy   String?  @map("created_by") @db.VarChar
+
+  // will delete createor record if createor's account is deleted
+  createdByUser User? @relation(name: "createdUpdate", fields: [createdBy], references: [id], onDelete: SetNull)
 
   // @deprecated use createdAt only
-  seq         Int?      @db.Integer
+  seq Int? @db.Integer
 
   @@id([workspaceId, id, createdAt])
   @@map("updates")
@@ -289,6 +309,10 @@ model SnapshotHistory {
   blob        Bytes    @db.ByteA
   state       Bytes?   @db.ByteA
   expiredAt   DateTime @map("expired_at") @db.Timestamptz(3)
+  createdBy   String?  @map("created_by") @db.VarChar
+
+  // will delete createor record if creator's account is deleted
+  createdByUser User? @relation(name: "createdHistory", fields: [createdBy], references: [id], onDelete: SetNull)
 
   @@id([workspaceId, id, timestamp])
   @@map("snapshot_histories")
@@ -414,6 +438,7 @@ model AiSessionMessage {
 
   session AiSession @relation(fields: [sessionId], references: [id], onDelete: Cascade)
 
+  @@index([sessionId])
   @@map("ai_sessions_messages")
 }
 
@@ -434,6 +459,8 @@ model AiSession {
   prompt   AiPrompt           @relation(fields: [promptName], references: [name], onDelete: Cascade)
   messages AiSessionMessage[]
 
+  @@index([userId])
+  @@index([userId, workspaceId])
   @@map("ai_sessions_metadata")
 }
 

packages/backend/server/src/app.module.ts

@@ -11,6 +11,7 @@ import { AppController } from './app.controller';
 import { AuthModule } from './core/auth';
 import { ADD_ENABLED_FEATURES, ServerConfigModule } from './core/config';
 import { DocStorageModule } from './core/doc';
+import { DocRendererModule } from './core/doc-renderer';
 import { FeatureModule } from './core/features';
 import { PermissionModule } from './core/permission';
 import { QuotaModule } from './core/quota';
@@ -42,7 +43,6 @@ import { ENABLED_PLUGINS } from './plugins/registry';
 
 export const FunctionalityModules = [
   ConfigModule.forRoot(),
-  ScheduleModule.forRoot(),
   EventModule,
   CacheModule,
   MutexModule,
@@ -156,7 +156,7 @@ export function buildAppModule() {
     .use(UserModule, AuthModule, PermissionModule)
 
     // business modules
-    .use(DocStorageModule)
+    .use(FeatureModule, QuotaModule, DocStorageModule)
 
     // sync server only
     .useIf(config => config.flavor.sync, SyncModule)
@@ -164,16 +164,16 @@ export function buildAppModule() {
     // graphql server only
     .useIf(
       config => config.flavor.graphql,
+      ScheduleModule.forRoot(),
       GqlModule,
       StorageModule,
       ServerConfigModule,
-      WorkspaceModule,
-      FeatureModule,
-      QuotaModule
+      WorkspaceModule
     )
 
     // self hosted server only
-    .useIf(config => config.isSelfhosted, SelfhostModule);
+    .useIf(config => config.isSelfhosted, SelfhostModule)
+    .useIf(config => config.flavor.renderer, DocRendererModule);
 
   // plugin modules
   ENABLED_PLUGINS.forEach(name => {

packages/backend/server/src/config/affine.env.ts

@@ -25,6 +25,7 @@ AFFiNE.ENV_MAP = {
   OAUTH_OIDC_CLAIM_MAP_EMAIL: 'plugins.oauth.providers.oidc.args.claim_email',
   OAUTH_OIDC_CLAIM_MAP_NAME: 'plugins.oauth.providers.oidc.args.claim_name',
   METRICS_CUSTOMER_IO_TOKEN: ['metrics.customerIo.token', 'string'],
+  CAPTCHA_TURNSTILE_SECRET: ['plugins.captcha.turnstile.secret', 'string'],
   COPILOT_OPENAI_API_KEY: 'plugins.copilot.openai.apiKey',
   COPILOT_FAL_API_KEY: 'plugins.copilot.fal.apiKey',
   COPILOT_UNSPLASH_API_KEY: 'plugins.copilot.unsplashKey',

packages/backend/server/src/config/affine.self.ts

@@ -71,6 +71,14 @@ AFFiNE.use('payment', {
 });
 AFFiNE.use('oauth');
 
+/* Captcha Plugin Default Config */
+AFFiNE.use('captcha', {
+  turnstile: {},
+  challenge: {
+    bits: 20,
+  },
+});
+
 if (AFFiNE.deploy) {
   AFFiNE.mailer = {
     service: 'gmail',

packages/backend/server/src/config/affine.ts

@@ -95,6 +95,15 @@ AFFiNE.server.port = 3010;
 // });
 //
 //
+// /* Captcha Plugin Default Config */
+// AFFiNE.plugins.use('captcha', {
+//   turnstile: {},
+//   challenge: {
+//     bits: 20,
+//   },
+// });
+//
+//
 // /* Cloudflare R2 Plugin */
 // /* Enable if you choose to store workspace blobs or user avatars in Cloudflare R2 Storage Service */
 // AFFiNE.use('cloudflare-r2', {

packages/backend/server/src/core/auth/controller.ts

@@ -1,5 +1,3 @@
-import { randomUUID } from 'node:crypto';
-
 import {
   Body,
   Controller,
@@ -18,26 +16,34 @@ import {
   EarlyAccessRequired,
   EmailTokenNotFound,
   InternalServerError,
+  InvalidEmail,
   InvalidEmailToken,
   SignUpForbidden,
   Throttle,
   URLHelper,
+  UseNamedGuard,
 } from '../../fundamentals';
 import { UserService } from '../user';
 import { validators } from '../utils/validators';
-import { CurrentUser } from './current-user';
 import { Public } from './guard';
-import { AuthService, parseAuthUserSeqNum } from './service';
+import { AuthService } from './service';
+import { CurrentUser, Session } from './session';
 import { TokenService, TokenType } from './token';
 
-class SignInCredential {
-  email!: string;
-  password?: string;
+interface PreflightResponse {
+  registered: boolean;
+  hasPassword: boolean;
 }
 
-class MagicLinkCredential {
-  email!: string;
-  token!: string;
+interface SignInCredential {
+  email: string;
+  password?: string;
+  callbackUrl?: string;
+}
+
+interface MagicLinkCredential {
+  email: string;
+  token: string;
 }
 
 @Throttle('strict')
@@ -52,13 +58,44 @@ export class AuthController {
   ) {}
 
   @Public()
+  @Post('/preflight')
+  async preflight(
+    @Body() params?: { email: string }
+  ): Promise<PreflightResponse> {
+    if (!params?.email) {
+      throw new InvalidEmail();
+    }
+    validators.assertValidEmail(params.email);
+
+    const user = await this.user.findUserWithHashedPasswordByEmail(
+      params.email
+    );
+
+    if (!user) {
+      return {
+        registered: false,
+        hasPassword: false,
+      };
+    }
+
+    return {
+      registered: user.registered,
+      hasPassword: !!user.password,
+    };
+  }
+
+  @Public()
+  @UseNamedGuard('captcha')
   @Post('/sign-in')
   @Header('content-type', 'application/json')
   async signIn(
     @Req() req: Request,
     @Res() res: Response,
     @Body() credential: SignInCredential,
-    @Query('redirect_uri') redirectUri = this.url.home
+    /**
+     * @deprecated
+     */
+    @Query('redirect_uri') redirectUri?: string
   ) {
     validators.assertValidEmail(credential.email);
     const canSignIn = await this.auth.canSignIn(credential.email);
@@ -67,80 +104,89 @@ export class AuthController {
     }
 
     if (credential.password) {
-      const user = await this.auth.signIn(
+      await this.passwordSignIn(
+        req,
+        res,
         credential.email,
         credential.password
       );
-
-      await this.auth.setCookie(req, res, user);
-      res.status(HttpStatus.OK).send(user);
     } else {
-      // send email magic link
-      const user = await this.user.findUserByEmail(credential.email);
-      if (!user) {
-        const allowSignup = await this.config.runtime.fetch('auth/allowSignup');
-        if (!allowSignup) {
-          throw new SignUpForbidden();
-        }
-      }
-
-      const result = await this.sendSignInEmail(
-        { email: credential.email, signUp: !user },
+      await this.sendMagicLink(
+        req,
+        res,
+        credential.email,
+        credential.callbackUrl,
         redirectUri
       );
-
-      if (result.rejected.length) {
-        throw new InternalServerError('Failed to send sign-in email.');
-      }
-
-      res.status(HttpStatus.OK).send({
-        email: credential.email,
-      });
     }
   }
 
-  async sendSignInEmail(
-    { email, signUp }: { email: string; signUp: boolean },
-    redirectUri: string
+  async passwordSignIn(
+    req: Request,
+    res: Response,
+    email: string,
+    password: string
   ) {
+    const user = await this.auth.signIn(email, password);
+
+    await this.auth.setCookies(req, res, user.id);
+    res.status(HttpStatus.OK).send(user);
+  }
+
+  async sendMagicLink(
+    _req: Request,
+    res: Response,
+    email: string,
+    callbackUrl = '/magic-link',
+    redirectUrl?: string
+  ) {
+    // send email magic link
+    const user = await this.user.findUserByEmail(email);
+    if (!user) {
+      const allowSignup = await this.config.runtime.fetch('auth/allowSignup');
+      if (!allowSignup) {
+        throw new SignUpForbidden();
+      }
+    }
+
     const token = await this.token.createToken(TokenType.SignIn, email);
 
-    const magicLink = this.url.link('/magic-link', {
+    const magicLink = this.url.link(callbackUrl, {
       token,
       email,
-      redirect_uri: redirectUri,
+      ...(redirectUrl
+        ? {
+            redirect_uri: redirectUrl,
+          }
+        : {}),
     });
 
-    const result = await this.auth.sendSignInEmail(email, magicLink, signUp);
+    const result = await this.auth.sendSignInEmail(email, magicLink, !user);
 
-    return result;
+    if (result.rejected.length) {
+      throw new InternalServerError('Failed to send sign-in email.');
+    }
+
+    res.status(HttpStatus.OK).send({
+      email: email,
+    });
   }
 
+  @Public()
   @Get('/sign-out')
   async signOut(
-    @Req() req: Request,
     @Res() res: Response,
-    @Query('redirect_uri') redirectUri?: string
+    @Session() session: Session | undefined,
+    @Query('user_id') userId: string | undefined
   ) {
-    const session = await this.auth.signOut(
-      req.cookies[AuthService.sessionCookieName],
-      parseAuthUserSeqNum(req.headers[AuthService.authUserSeqHeaderName])
-    );
-
-    if (session) {
-      res.cookie(AuthService.sessionCookieName, session.id, {
-        expires: session.expiresAt ?? void 0, // expiredAt is `string | null`
-        ...this.auth.cookieOptions,
-      });
-    } else {
-      res.clearCookie(AuthService.sessionCookieName);
+    if (!session) {
+      return;
     }
 
-    if (redirectUri) {
-      return this.url.safeRedirect(res, redirectUri);
-    } else {
-      return res.send(null);
-    }
+    await this.auth.signOut(session.sessionId, userId);
+    await this.auth.refreshCookies(res, session.sessionId);
+
+    res.status(HttpStatus.OK).send({});
   }
 
   @Public()
@@ -156,11 +202,11 @@ export class AuthController {
 
     validators.assertValidEmail(email);
 
-    const valid = await this.token.verifyToken(TokenType.SignIn, token, {
+    const tokenRecord = await this.token.verifyToken(TokenType.SignIn, token, {
       credential: email,
     });
 
-    if (!valid) {
+    if (!tokenRecord) {
       throw new InvalidEmailToken();
     }
 
@@ -169,9 +215,8 @@ export class AuthController {
       registered: true,
     });
 
-    await this.auth.setCookie(req, res, user);
-
-    res.send({ id: user.id, email: user.email, name: user.name });
+    await this.auth.setCookies(req, res, user.id);
+    res.send({ id: user.id });
   }
 
   @Throttle('default', { limit: 1200 })
@@ -198,14 +243,4 @@ export class AuthController {
       users: await this.auth.getUserList(token),
     };
   }
-
-  @Public()
-  @Get('/challenge')
-  async challenge() {
-    // TODO(@darksky): impl in following PR
-    return {
-      challenge: randomUUID(),
-      resource: randomUUID(),
-    };
-  }
 }

packages/backend/server/src/core/auth/guard.ts

@@ -4,9 +4,9 @@ import type {
   FactoryProvider,
   OnModuleInit,
 } from '@nestjs/common';
-import { Injectable, SetMetadata, UseGuards } from '@nestjs/common';
+import { Injectable, SetMetadata } from '@nestjs/common';
 import { ModuleRef, Reflector } from '@nestjs/core';
-import type { Request } from 'express';
+import type { Request, Response } from 'express';
 
 import {
   AuthenticationRequired,
@@ -16,16 +16,8 @@ import {
   parseCookies,
 } from '../../fundamentals';
 import { WEBSOCKET_OPTIONS } from '../../fundamentals/websocket';
-import { CurrentUser, UserSession } from './current-user';
-import { AuthService, parseAuthUserSeqNum } from './service';
-
-function extractTokenFromHeader(authorization: string) {
-  if (!/^Bearer\s/i.test(authorization)) {
-    return;
-  }
-
-  return authorization.substring(7);
-}
+import { AuthService } from './service';
+import { Session } from './session';
 
 const PUBLIC_ENTRYPOINT_SYMBOL = Symbol('public');
 
@@ -45,9 +37,9 @@ export class AuthGuard implements CanActivate, OnModuleInit {
   async canActivate(context: ExecutionContext) {
     const { req, res } = getRequestResponseFromContext(context);
 
-    const userSession = await this.signIn(req);
-    if (res && userSession && userSession.session.expiresAt) {
-      await this.auth.refreshUserSessionIfNeeded(req, res, userSession.session);
+    const userSession = await this.signIn(req, res);
+    if (res && userSession && userSession.expiresAt) {
+      await this.auth.refreshUserSessionIfNeeded(res, userSession);
     }
 
     // api is public
@@ -60,43 +52,31 @@ export class AuthGuard implements CanActivate, OnModuleInit {
       return true;
     }
 
-    if (!req.user) {
+    if (!userSession) {
       throw new AuthenticationRequired();
     }
+
     return true;
   }
 
-  async signIn(
-    req: Request
-  ): Promise<{ user: CurrentUser; session: UserSession } | null> {
-    if (req.user && req.session) {
-      return {
-        user: req.user,
-        session: req.session,
-      };
+  async signIn(req: Request, res?: Response): Promise<Session | null> {
+    if (req.session) {
+      return req.session;
     }
 
+    // compatibility with websocket request
     parseCookies(req);
-    let sessionToken: string | undefined =
-      req.cookies[AuthService.sessionCookieName];
 
-    if (!sessionToken && req.headers.authorization) {
-      sessionToken = extractTokenFromHeader(req.headers.authorization);
-    }
+    // TODO(@forehalo): a cache for user session
+    const userSession = await this.auth.getUserSessionFromRequest(req, res);
 
-    if (sessionToken) {
-      const userSeq = parseAuthUserSeqNum(
-        req.headers[AuthService.authUserSeqHeaderName]
-      );
+    if (userSession) {
+      req.session = {
+        ...userSession.session,
+        user: userSession.user,
+      };
 
-      const userSession = await this.auth.getUserSession(sessionToken, userSeq);
-
-      if (userSession) {
-        req.session = userSession.session;
-        req.user = userSession.user;
-      }
-
-      return userSession;
+      return req.session;
     }
 
     return null;
@@ -104,26 +84,8 @@ export class AuthGuard implements CanActivate, OnModuleInit {
 }
 
 /**
- * This guard is used to protect routes/queries/mutations that require a user to be logged in.
- *
- * The `@CurrentUser()` parameter decorator used in a `Auth` guarded queries would always give us the user because the `Auth` guard will
- * fast throw if user is not logged in.
- *
- * @example
- *
- * ```typescript
- * \@Auth()
- * \@Query(() => UserType)
- * user(@CurrentUser() user: CurrentUser) {
- *   return user;
- * }
- * ```
+ * Mark api to be public accessible
  */
-export const Auth = () => {
-  return UseGuards(AuthGuard);
-};
-
-// api is public accessible
 export const Public = () => SetMetadata(PUBLIC_ENTRYPOINT_SYMBOL, true);
 
 export const AuthWebsocketOptionsProvider: FactoryProvider = {

packages/backend/server/src/core/auth/index.ts

@@ -20,7 +20,7 @@ import { TokenService, TokenType } from './token';
     AuthGuard,
     AuthWebsocketOptionsProvider,
   ],
-  exports: [AuthService, AuthGuard, AuthWebsocketOptionsProvider],
+  exports: [AuthService, AuthGuard, AuthWebsocketOptionsProvider, TokenService],
   controllers: [AuthController],
 })
 export class AuthModule {}
@@ -28,4 +28,4 @@ export class AuthModule {}
 export * from './guard';
 export { ClientTokenType } from './resolver';
 export { AuthService, TokenService, TokenType };
-export * from './current-user';
+export * from './session';

packages/backend/server/src/core/auth/resolver.ts

@@ -11,7 +11,6 @@ import {
 
 import {
   ActionForbidden,
-  Config,
   EmailAlreadyUsed,
   EmailTokenNotFound,
   EmailVerificationRequired,
@@ -26,9 +25,9 @@ import { Admin } from '../common';
 import { UserService } from '../user';
 import { UserType } from '../user/types';
 import { validators } from '../utils/validators';
-import { CurrentUser } from './current-user';
 import { Public } from './guard';
 import { AuthService } from './service';
+import { CurrentUser } from './session';
 import { TokenService, TokenType } from './token';
 
 @ObjectType('tokenType')
@@ -47,7 +46,6 @@ export class ClientTokenType {
 @Resolver(() => UserType)
 export class AuthResolver {
   constructor(
-    private readonly config: Config,
     private readonly url: URLHelper,
     private readonly auth: AuthService,
     private readonly user: UserService,
@@ -67,7 +65,7 @@ export class AuthResolver {
 
   @ResolveField(() => ClientTokenType, {
     name: 'token',
-    deprecationReason: 'use [/api/auth/authorize]',
+    deprecationReason: 'use [/api/auth/sign-in?native=true] instead',
   })
   async clientToken(
     @CurrentUser() currentUser: CurrentUser,
@@ -77,15 +75,11 @@ export class AuthResolver {
       throw new ActionForbidden();
     }
 
-    const session = await this.auth.createUserSession(
-      user,
-      undefined,
-      this.config.auth.accessToken.ttl
-    );
+    const userSession = await this.auth.createUserSession(user.id);
 
     return {
-      sessionToken: session.sessionId,
-      token: session.sessionId,
+      sessionToken: userSession.sessionId,
+      token: userSession.sessionId,
       refresh: '',
     };
   }
@@ -101,14 +95,6 @@ export class AuthResolver {
       throw new LinkExpired();
     }
 
-    const config = await this.config.runtime.fetchAll({
-      'auth/password.max': true,
-      'auth/password.min': true,
-    });
-    validators.assertValidPassword(newPassword, {
-      min: config['auth/password.min'],
-      max: config['auth/password.max'],
-    });
     // NOTE: Set & Change password are using the same token type.
     const valid = await this.token.verifyToken(
       TokenType.ChangePassword,
@@ -134,7 +120,6 @@ export class AuthResolver {
     @Args('token') token: string,
     @Args('email') email: string
   ) {
-    validators.assertValidEmail(email);
     // @see [sendChangeEmail]
     const valid = await this.token.verifyToken(TokenType.VerifyEmail, token, {
       credential: user.id,
@@ -157,8 +142,11 @@ export class AuthResolver {
   async sendChangePasswordEmail(
     @CurrentUser() user: CurrentUser,
     @Args('callbackUrl') callbackUrl: string,
-    // @deprecated
-    @Args('email', { nullable: true }) _email?: string
+    @Args('email', {
+      nullable: true,
+      deprecationReason: 'fetched from signed in user',
+    })
+    _email?: string
   ) {
     if (!user.emailVerified) {
       throw new EmailVerificationRequired();
@@ -180,7 +168,11 @@ export class AuthResolver {
   async sendSetPasswordEmail(
     @CurrentUser() user: CurrentUser,
     @Args('callbackUrl') callbackUrl: string,
-    @Args('email', { nullable: true }) _email?: string
+    @Args('email', {
+      nullable: true,
+      deprecationReason: 'fetched from signed in user',
+    })
+    _email?: string
   ) {
     return this.sendChangePasswordEmail(user, callbackUrl);
   }

packages/backend/server/src/core/auth/service.ts

@@ -5,35 +5,12 @@ import { PrismaClient } from '@prisma/client';
 import type { CookieOptions, Request, Response } from 'express';
 import { assign, pick } from 'lodash-es';
 
-import { Config, EmailAlreadyUsed, MailService } from '../../fundamentals';
+import { Config, MailService, SignUpForbidden } from '../../fundamentals';
 import { FeatureManagementService } from '../features/management';
 import { QuotaService } from '../quota/service';
 import { QuotaType } from '../quota/types';
 import { UserService } from '../user/service';
-import type { CurrentUser } from './current-user';
-
-export function parseAuthUserSeqNum(value: any) {
-  let seq: number = 0;
-  switch (typeof value) {
-    case 'number': {
-      seq = value;
-      break;
-    }
-    case 'string': {
-      const result = value.match(/^([\d{0, 10}])$/);
-      if (result?.[1]) {
-        seq = Number(result[1]);
-      }
-      break;
-    }
-
-    default: {
-      seq = 0;
-    }
-  }
-
-  return Math.max(0, seq);
-}
+import type { CurrentUser } from './session';
 
 export function sessionUser(
   user: Pick<
@@ -48,6 +25,14 @@ export function sessionUser(
   });
 }
 
+function extractTokenFromHeader(authorization: string) {
+  if (!/^Bearer\s/i.test(authorization)) {
+    return;
+  }
+
+  return authorization.substring(7);
+}
+
 @Injectable()
 export class AuthService implements OnApplicationBootstrap {
   readonly cookieOptions: CookieOptions = {
@@ -57,7 +42,7 @@ export class AuthService implements OnApplicationBootstrap {
     secure: this.config.server.https,
   };
   static readonly sessionCookieName = 'affine_session';
-  static readonly authUserSeqHeaderName = 'x-auth-user';
+  static readonly userCookieName = 'affine_user_id';
 
   constructor(
     private readonly config: Config,
@@ -93,58 +78,71 @@ export class AuthService implements OnApplicationBootstrap {
     return this.feature.canEarlyAccess(email);
   }
 
-  async signUp(
-    name: string,
-    email: string,
-    password: string
-  ): Promise<CurrentUser> {
-    const user = await this.user.findUserByEmail(email);
-
-    if (user) {
-      throw new EmailAlreadyUsed();
+  /**
+   * This is a test only helper to quickly signup a user, do not use in production
+   */
+  async signUp(email: string, password: string): Promise<CurrentUser> {
+    if (!this.config.node.test) {
+      throw new SignUpForbidden(
+        'sign up helper is forbidden for non-test environment'
+      );
     }
 
     return this.user
-      .createUser({
-        name,
+      .createUser_without_verification({
         email,
         password,
       })
       .then(sessionUser);
   }
 
-  async signIn(email: string, password: string) {
-    const user = await this.user.signIn(email, password);
+  async signIn(email: string, password: string): Promise<CurrentUser> {
+    return this.user.signIn(email, password).then(sessionUser);
+  }
 
-    return sessionUser(user);
+  async signOut(sessionId: string, userId?: string) {
+    // sign out all users in the session
+    if (!userId) {
+      await this.db.session.deleteMany({
+        where: {
+          id: sessionId,
+        },
+      });
+    } else {
+      await this.db.userSession.deleteMany({
+        where: {
+          sessionId,
+          userId,
+        },
+      });
+    }
   }
 
   async getUserSession(
-    token: string,
-    seq = 0
+    sessionId: string,
+    userId?: string
   ): Promise<{ user: CurrentUser; session: UserSession } | null> {
-    const session = await this.getSession(token);
+    const sessions = await this.getUserSessions(sessionId);
 
-    // no such session
-    if (!session) {
+    if (!sessions.length) {
       return null;
     }
 
-    const userSession = session.userSessions.at(seq);
+    let userSession: UserSession | undefined;
 
-    // no such user session
+    // try read from user provided cookies.userId
+    if (userId) {
+      userSession = sessions.find(s => s.userId === userId);
+    }
+
+    // fallback to the first valid session if user provided userId is invalid
     if (!userSession) {
-      return null;
+      // checked
+      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+      userSession = sessions.at(-1)!;
     }
 
-    // user session expired
-    if (userSession.expiresAt && userSession.expiresAt <= new Date()) {
-      return null;
-    }
-
-    const user = await this.db.user.findUnique({
-      where: { id: userSession.userId },
-    });
+    const user = await this.user.findUserById(userSession.userId);
 
     if (!user) {
       return null;
@@ -153,101 +151,102 @@ export class AuthService implements OnApplicationBootstrap {
     return { user: sessionUser(user), session: userSession };
   }
 
-  async getUserList(token: string) {
-    const session = await this.getSession(token);
-
-    if (!session || !session.userSessions.length) {
-      return [];
-    }
-
-    const users = await this.db.user.findMany({
+  async getUserSessions(sessionId: string) {
+    return this.db.userSession.findMany({
       where: {
-        id: {
-          in: session.userSessions.map(({ userId }) => userId),
-        },
+        sessionId,
+        OR: [{ expiresAt: { gt: new Date() } }, { expiresAt: null }],
+      },
+      orderBy: {
+        createdAt: 'asc',
       },
     });
-
-    // TODO(@forehalo): need to separate expired session, same for [getUser]
-    // Session
-    //   | { user: LimitedUser { email, avatarUrl }, expired: true }
-    //   | { user: User, expired: false }
-    return session.userSessions
-      .map(userSession => {
-        // keep users in the same order as userSessions
-        const user = users.find(({ id }) => id === userSession.userId);
-        if (!user) {
-          return null;
-        }
-        return sessionUser(user);
-      })
-      .filter(Boolean) as CurrentUser[];
   }
 
-  async signOut(token: string, seq = 0) {
-    const session = await this.getSession(token);
-
-    if (session) {
-      // overflow the logged in user
-      if (session.userSessions.length <= seq) {
-        return session;
-      }
-
-      await this.db.userSession.deleteMany({
-        where: { id: session.userSessions[seq].id },
-      });
-
-      // no more user session active, delete the whole session
-      if (session.userSessions.length === 1) {
-        await this.db.session.delete({ where: { id: session.id } });
-        return null;
-      }
-
-      return session;
-    }
-
-    return null;
-  }
-
-  async getSession(token: string) {
-    if (!token) {
-      return null;
-    }
-
-    return this.db.$transaction(async tx => {
-      const session = await tx.session.findUnique({
+  async createUserSession(
+    userId: string,
+    sessionId?: string,
+    ttl = this.config.auth.session.ttl
+  ) {
+    // check whether given session is valid
+    if (sessionId) {
+      const session = await this.db.session.findFirst({
         where: {
-          id: token,
-        },
-        include: {
-          userSessions: {
-            orderBy: {
-              createdAt: 'asc',
-            },
-          },
+          id: sessionId,
         },
       });
 
       if (!session) {
-        return null;
+        sessionId = undefined;
       }
+    }
 
-      if (session.expiresAt && session.expiresAt <= new Date()) {
-        await tx.session.delete({
-          where: {
-            id: session.id,
+    if (!sessionId) {
+      const session = await this.createSession();
+      sessionId = session.id;
+    }
+
+    const expiresAt = new Date(Date.now() + ttl * 1000);
+
+    return this.db.userSession.upsert({
+      where: {
+        sessionId_userId: {
+          sessionId,
+          userId,
+        },
+      },
+      update: {
+        expiresAt,
+      },
+      create: {
+        sessionId,
+        userId,
+        expiresAt,
+      },
+    });
+  }
+
+  async getUserList(sessionId: string) {
+    const sessions = await this.db.userSession.findMany({
+      where: {
+        sessionId,
+        OR: [
+          {
+            expiresAt: null,
           },
-        });
+          {
+            expiresAt: {
+              gt: new Date(),
+            },
+          },
+        ],
+      },
+      include: {
+        user: true,
+      },
+      orderBy: {
+        createdAt: 'asc',
+      },
+    });
 
-        return null;
-      }
+    return sessions.map(({ user }) => sessionUser(user));
+  }
 
-      return session;
+  async createSession() {
+    return this.db.session.create({
+      data: {},
+    });
+  }
+
+  async getSession(sessionId: string) {
+    return this.db.session.findFirst({
+      where: {
+        id: sessionId,
+      },
     });
   }
 
   async refreshUserSessionIfNeeded(
-    _req: Request,
     res: Response,
     session: UserSession,
     ttr = this.config.auth.session.ttr
@@ -281,70 +280,96 @@ export class AuthService implements OnApplicationBootstrap {
     return true;
   }
 
-  async createUserSession(
-    user: { id: string },
-    existingSession?: string,
-    ttl = this.config.auth.session.ttl
-  ) {
-    const session = existingSession
-      ? await this.getSession(existingSession)
-      : null;
-
-    const expiresAt = new Date(Date.now() + ttl * 1000);
-    if (session) {
-      return this.db.userSession.upsert({
-        where: {
-          sessionId_userId: {
-            sessionId: session.id,
-            userId: user.id,
-          },
-        },
-        update: {
-          expiresAt,
-        },
-        create: {
-          sessionId: session.id,
-          userId: user.id,
-          expiresAt,
-        },
-      });
-    } else {
-      return this.db.userSession.create({
-        data: {
-          expiresAt,
-          session: {
-            create: {},
-          },
-          user: {
-            connect: {
-              id: user.id,
-            },
-          },
-        },
-      });
-    }
-  }
-
-  async revokeUserSessions(userId: string, sessionId?: string) {
+  async revokeUserSessions(userId: string) {
     return this.db.userSession.deleteMany({
       where: {
         userId,
-        sessionId,
       },
     });
   }
 
-  async setCookie(_req: Request, res: Response, user: { id: string }) {
-    const session = await this.createUserSession(
-      user
-      // TODO(@forehalo): enable multi user session
-      // req.cookies[AuthService.sessionCookieName]
-    );
+  getSessionOptionsFromRequest(req: Request) {
+    let sessionId: string | undefined =
+      req.cookies[AuthService.sessionCookieName];
 
-    res.cookie(AuthService.sessionCookieName, session.sessionId, {
-      expires: session.expiresAt ?? void 0,
+    if (!sessionId && req.headers.authorization) {
+      sessionId = extractTokenFromHeader(req.headers.authorization);
+    }
+
+    const userId: string | undefined =
+      req.cookies[AuthService.userCookieName] ||
+      req.headers[AuthService.userCookieName];
+
+    return {
+      sessionId,
+      userId,
+    };
+  }
+
+  async setCookies(req: Request, res: Response, userId: string) {
+    const { sessionId } = this.getSessionOptionsFromRequest(req);
+
+    const userSession = await this.createUserSession(userId, sessionId);
+
+    res.cookie(AuthService.sessionCookieName, userSession.sessionId, {
       ...this.cookieOptions,
+      expires: userSession.expiresAt ?? void 0,
     });
+
+    this.setUserCookie(res, userId);
+  }
+
+  async refreshCookies(res: Response, sessionId?: string) {
+    if (sessionId) {
+      const users = await this.getUserList(sessionId);
+      const candidateUser = users.at(-1);
+
+      if (candidateUser) {
+        this.setUserCookie(res, candidateUser.id);
+        return;
+      }
+    }
+
+    this.clearCookies(res);
+  }
+
+  private clearCookies(res: Response<any, Record<string, any>>) {
+    res.clearCookie(AuthService.sessionCookieName);
+    res.clearCookie(AuthService.userCookieName);
+  }
+
+  setUserCookie(res: Response, userId: string) {
+    res.cookie(AuthService.userCookieName, userId, {
+      ...this.cookieOptions,
+      // user cookie is client readable & writable for fast user switch if there are multiple users in one session
+      // it safe to be non-secure & non-httpOnly because server will validate it by `cookie[AuthService.sessionCookieName]`
+      httpOnly: false,
+      secure: false,
+    });
+  }
+
+  async getUserSessionFromRequest(req: Request, res?: Response) {
+    const { sessionId, userId } = this.getSessionOptionsFromRequest(req);
+
+    if (!sessionId) {
+      return null;
+    }
+
+    const session = await this.getUserSession(sessionId, userId);
+
+    if (res) {
+      if (session) {
+        // set user id cookie for fast authentication
+        if (!userId || userId !== session.user.id) {
+          this.setUserCookie(res, session.user.id);
+        }
+      } else if (sessionId) {
+        // clear invalid cookies.session and cookies.userId
+        this.clearCookies(res);
+      }
+    }
+
+    return session;
   }
 
   async changePassword(
@@ -393,24 +418,16 @@ export class AuthService implements OnApplicationBootstrap {
 
   async sendSignInEmail(email: string, link: string, signUp: boolean) {
     return signUp
-      ? await this.mailer.sendSignUpMail(link.toString(), {
+      ? await this.mailer.sendSignUpMail(link, {
           to: email,
         })
-      : await this.mailer.sendSignInMail(link.toString(), {
+      : await this.mailer.sendSignInMail(link, {
           to: email,
         });
   }
 
   @Cron(CronExpression.EVERY_DAY_AT_MIDNIGHT)
   async cleanExpiredSessions() {
-    await this.db.session.deleteMany({
-      where: {
-        expiresAt: {
-          lte: new Date(),
-        },
-      },
-    });
-
     await this.db.userSession.deleteMany({
       where: {
         expiresAt: {

packages/backend/server/src/core/auth/session.ts

@@ -4,10 +4,6 @@ import { User, UserSession } from '@prisma/client';
 
 import { getRequestResponseFromContext } from '../../fundamentals';
 
-function getUserFromContext(context: ExecutionContext) {
-  return getRequestResponseFromContext(context).req.user;
-}
-
 /**
  * Used to fetch current user from the request context.
  *
@@ -44,7 +40,7 @@ function getUserFromContext(context: ExecutionContext) {
 // eslint-disable-next-line no-redeclare
 export const CurrentUser = createParamDecorator(
   (_: unknown, context: ExecutionContext) => {
-    return getUserFromContext(context);
+    return getRequestResponseFromContext(context).req.session?.user;
   }
 );
 
@@ -54,4 +50,14 @@ export interface CurrentUser
   emailVerified: boolean;
 }
 
-export { type UserSession };
+// interface and variable don't conflict
+// eslint-disable-next-line no-redeclare
+export const Session = createParamDecorator(
+  (_: unknown, context: ExecutionContext) => {
+    return getRequestResponseFromContext(context).req.session;
+  }
+);
+
+export type Session = UserSession & {
+  user: CurrentUser;
+};

packages/backend/server/src/core/auth/token.ts

@@ -40,6 +40,48 @@ export class TokenService {
     return this.crypto.encrypt(token);
   }
 
+  /**
+   * get token by type
+   *
+   * token will be revoked if expired or keep is not set
+   */
+  async getToken(type: TokenType, token: string, keep?: boolean) {
+    token = this.crypto.decrypt(token);
+    const record = await this.db.verificationToken.findUnique({
+      where: {
+        type_token: {
+          token,
+          type,
+        },
+      },
+    });
+
+    if (!record) {
+      return null;
+    }
+
+    const expired = record.expiresAt <= new Date();
+
+    // always revoke expired token
+    if (expired || !keep) {
+      const deleted = await this.revokeToken(type, token);
+
+      // already deleted, means token has been used
+      if (!deleted.count) {
+        return null;
+      }
+    }
+
+    return !expired ? record : null;
+  }
+
+  /**
+   * get token and verify credential
+   *
+   * if credential is not provided, it will be failed
+   *
+   * token will be revoked if expired or keep is not set
+   */
   async verifyToken(
     type: TokenType,
     token: string,
@@ -69,13 +111,9 @@ export class TokenService {
     const valid =
       !expired && (!record.credential || record.credential === credential);
 
-    if ((expired || valid) && !keep) {
-      const deleted = await this.db.verificationToken.deleteMany({
-        where: {
-          token,
-          type,
-        },
-      });
+    // always revoke expired token
+    if (expired || (valid && !keep)) {
+      const deleted = await this.revokeToken(type, token);
 
       // already deleted, means token has been used
       if (!deleted.count) {
@@ -86,6 +124,15 @@ export class TokenService {
     return valid ? record : null;
   }
 
+  async revokeToken(type: TokenType, token: string) {
+    return await this.db.verificationToken.deleteMany({
+      where: {
+        token,
+        type,
+      },
+    });
+  }
+
   @Cron(CronExpression.EVERY_DAY_AT_MIDNIGHT)
   async cleanExpiredTokens() {
     await this.db.verificationToken.deleteMany({

packages/backend/server/src/core/common/admin-guard.ts

@@ -25,8 +25,8 @@ export class AdminGuard implements CanActivate, OnModuleInit {
   async canActivate(context: ExecutionContext) {
     const { req } = getRequestResponseFromContext(context);
     let allow = false;
-    if (req.user) {
-      allow = await this.feature.isAdmin(req.user.id);
+    if (req.session) {
+      allow = await this.feature.isAdmin(req.session.user.id);
     }
 
     if (!allow) {

packages/backend/server/src/core/config/types.ts

@@ -3,6 +3,7 @@ import { Field, ObjectType, registerEnumType } from '@nestjs/graphql';
 import { DeploymentType } from '../../fundamentals';
 
 export enum ServerFeature {
+  Captcha = 'captcha',
   Copilot = 'copilot',
   Payment = 'payment',
   OAuth = 'oauth',

packages/backend/server/src/core/doc-renderer/controller.ts

@@ -0,0 +1,231 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { Controller, Get, Logger, Req, Res } from '@nestjs/common';
+import type { Request, Response } from 'express';
+import isMobile from 'is-mobile';
+
+import { Config, metrics, URLHelper } from '../../fundamentals';
+import { htmlSanitize } from '../../native';
+import { Public } from '../auth';
+import { PermissionService } from '../permission';
+import { DocContentService } from './service';
+
+interface RenderOptions {
+  title: string;
+  summary: string;
+  avatar?: string;
+}
+
+interface HtmlAssets {
+  html: string;
+  css: string[];
+  js: string[];
+  publicPath: string;
+  gitHash: string;
+  description: string;
+}
+
+const defaultAssets: HtmlAssets = {
+  html: '',
+  css: [],
+  js: [],
+  publicPath: '/',
+  gitHash: '',
+  description: '',
+};
+
+// TODO(@forehalo): reuse routes with frontend
+const staticPaths = new Set([
+  'all',
+  'home',
+  'search',
+  'collection',
+  'tag',
+  'trash',
+]);
+
+@Controller('/workspace')
+export class DocRendererController {
+  private readonly logger = new Logger(DocRendererController.name);
+  private readonly webAssets: HtmlAssets = defaultAssets;
+  private readonly mobileAssets: HtmlAssets = defaultAssets;
+
+  constructor(
+    private readonly doc: DocContentService,
+    private readonly permission: PermissionService,
+    private readonly config: Config,
+    private readonly url: URLHelper
+  ) {
+    this.webAssets = this.readHtmlAssets(
+      join(
+        this.config.projectRoot,
+        this.config.isSelfhosted ? 'static/selfhost' : 'static'
+      )
+    );
+    this.mobileAssets = this.readHtmlAssets(
+      join(
+        this.config.projectRoot,
+        this.config.isSelfhosted ? 'static/mobile/selfhost' : 'static/mobile'
+      )
+    );
+  }
+
+  @Public()
+  @Get('/*')
+  async render(@Req() req: Request, @Res() res: Response) {
+    const assets: HtmlAssets =
+      this.config.affine.canary &&
+      isMobile({
+        ua: req.headers['user-agent'] ?? undefined,
+      })
+        ? this.mobileAssets
+        : this.webAssets;
+
+    let opts: RenderOptions | null = null;
+    // /workspace/:workspaceId/{:docId | staticPaths}
+    const [, , workspaceId, subPath, ...restPaths] = req.path.split('/');
+
+    // /:workspaceId/:docId
+    if (workspaceId && !staticPaths.has(subPath) && restPaths.length === 0) {
+      try {
+        opts =
+          workspaceId === subPath
+            ? await this.getWorkspaceContent(workspaceId)
+            : await this.getPageContent(workspaceId, subPath);
+        metrics.doc.counter('render').add(1);
+      } catch (e) {
+        this.logger.error('failed to render page', e);
+      }
+    }
+
+    res.setHeader('Content-Type', 'text/html');
+    if (!opts) {
+      res.setHeader('X-Robots-Tag', 'noindex');
+    }
+
+    res.send(this._render(opts, assets));
+  }
+
+  private async getPageContent(
+    workspaceId: string,
+    docId: string
+  ): Promise<RenderOptions | null> {
+    let allowUrlPreview = await this.permission.isPublicPage(
+      workspaceId,
+      docId
+    );
+
+    if (!allowUrlPreview) {
+      // if page is private, but workspace url preview is on
+      allowUrlPreview = await this.permission.allowUrlPreview(workspaceId);
+    }
+
+    if (allowUrlPreview) {
+      return this.doc.getPageContent(workspaceId, docId);
+    }
+
+    return null;
+  }
+
+  private async getWorkspaceContent(
+    workspaceId: string
+  ): Promise<RenderOptions | null> {
+    const allowUrlPreview = await this.permission.allowUrlPreview(workspaceId);
+
+    if (allowUrlPreview) {
+      const workspaceContent = await this.doc.getWorkspaceContent(workspaceId);
+
+      if (workspaceContent) {
+        return {
+          title: workspaceContent.name,
+          summary: '',
+          avatar: workspaceContent.avatarKey
+            ? this.url.link(
+                `/api/workspaces/${workspaceId}/blobs/${workspaceContent.avatarKey}`
+              )
+            : undefined,
+        };
+      }
+    }
+
+    return null;
+  }
+
+  _render(opts: RenderOptions | null, assets: HtmlAssets): string {
+    if (!opts && assets.html) {
+      return assets.html;
+    }
+
+    const title = opts?.title
+      ? htmlSanitize(`${opts.title} | AFFiNE`)
+      : 'AFFiNE';
+    const summary = opts ? htmlSanitize(opts.summary) : assets.description;
+    const image = opts?.avatar ?? 'https://affine.pro/og.jpeg';
+
+    // TODO(@forehalo): parse assets/index.html
+    return `<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <meta
+      name="viewport"
+      content="width=device-width, initial-scale=1, maximum-scale=1"
+    />
+
+    <meta name="mobile-web-app-capable" content="yes" />
+    <meta name="apple-mobile-web-app-capable" content="yes" />
+    <meta
+      name="apple-mobile-web-app-status-bar-style"
+      content="black-translucent"
+    />
+
+    <title>${title}</title>
+    <meta name="theme-color" content="#fafafa" />
+    <link rel="preconnect" href="${assets.publicPath}">
+    <link rel="manifest" href="/manifest.json" />
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
+    <link rel="icon" sizes="192x192" href="/favicon-192.png" />
+    <link rel="shortcut icon" href="/favicon.ico" />
+    <meta name="emotion-insertion-point" content="" />
+    ${!opts ? '<meta name="robots" content="noindex, nofollow" />' : ''}
+    <meta
+      name="twitter:title"
+      content="${title}"
+    />
+    <meta name="twitter:description" content="${summary}" />
+    <meta name="twitter:site" content="@AffineOfficial" />
+    <meta name="twitter:image" content="${image}" />
+    <meta property="og:title" content="${title}" />
+    <meta property="og:description" content="${summary}" />
+    <meta property="og:image" content="${image}" />
+    ${assets.css.map(url => `<link rel="stylesheet" href="${url}" />`).join('\n')}
+  </head>
+  <body>
+    <div id="app" data-version="${assets.gitHash}"></div>
+    ${assets.js.map(url => `<script src="${url}"></script>`).join('\n')}
+  </body>
+</html>
+    `;
+  }
+
+  /**
+   * Should only be called at startup time
+   */
+  private readHtmlAssets(path: string): HtmlAssets {
+    const manifestPath = join(path, 'assets-manifest.json');
+    const htmlPath = join(path, 'index.html');
+
+    try {
+      const assets = JSON.parse(readFileSync(manifestPath, 'utf-8'));
+      assets.html = readFileSync(htmlPath, 'utf-8');
+      return assets;
+    } catch (e) {
+      if (this.config.node.prod) {
+        throw e;
+      } else {
+        return defaultAssets;
+      }
+    }
+  }
+}

packages/backend/server/src/core/doc-renderer/index.ts

@@ -0,0 +1,16 @@
+import { Module } from '@nestjs/common';
+
+import { DocStorageModule } from '../doc';
+import { PermissionModule } from '../permission';
+import { DocRendererController } from './controller';
+import { DocContentService } from './service';
+
+@Module({
+  imports: [DocStorageModule, PermissionModule],
+  providers: [DocContentService],
+  controllers: [DocRendererController],
+  exports: [DocContentService],
+})
+export class DocRendererModule {}
+
+export { DocContentService };

packages/backend/server/src/core/doc-renderer/service.ts

@@ -0,0 +1,92 @@
+import { Injectable } from '@nestjs/common';
+import { applyUpdate, Doc } from 'yjs';
+
+import { Cache, type EventPayload, OnEvent } from '../../fundamentals';
+import { PgWorkspaceDocStorageAdapter } from '../doc';
+import {
+  type PageDocContent,
+  parsePageDoc,
+  parseWorkspaceDoc,
+  type WorkspaceDocContent,
+} from '../utils/blocksuite';
+
+@Injectable()
+export class DocContentService {
+  constructor(
+    private readonly cache: Cache,
+    private readonly workspace: PgWorkspaceDocStorageAdapter
+  ) {}
+
+  async getPageContent(
+    workspaceId: string,
+    guid: string
+  ): Promise<PageDocContent | null> {
+    const cacheKey = `workspace:${workspaceId}:doc:${guid}:content`;
+    const cachedResult = await this.cache.get<PageDocContent>(cacheKey);
+
+    if (cachedResult) {
+      return cachedResult;
+    }
+
+    const docRecord = await this.workspace.getDoc(workspaceId, guid);
+    if (!docRecord) {
+      return null;
+    }
+
+    const doc = new Doc();
+    applyUpdate(doc, docRecord.bin);
+
+    const content = parsePageDoc(doc);
+
+    if (content) {
+      await this.cache.set(cacheKey, content, {
+        ttl:
+          7 *
+          24 *
+          60 *
+          60 *
+          1000 /* TODO(@forehalo): we need time constants helper */,
+      });
+    }
+    return content;
+  }
+
+  async getWorkspaceContent(
+    workspaceId: string
+  ): Promise<WorkspaceDocContent | null> {
+    const cacheKey = `workspace:${workspaceId}:content`;
+    const cachedResult = await this.cache.get<WorkspaceDocContent>(cacheKey);
+
+    if (cachedResult) {
+      return cachedResult;
+    }
+
+    const docRecord = await this.workspace.getDoc(workspaceId, workspaceId);
+    if (!docRecord) {
+      return null;
+    }
+
+    const doc = new Doc();
+    applyUpdate(doc, docRecord.bin);
+
+    const content = parseWorkspaceDoc(doc);
+
+    if (content) {
+      await this.cache.set(cacheKey, content);
+    }
+
+    return content;
+  }
+
+  @OnEvent('snapshot.updated')
+  async markDocContentCacheStale({
+    workspaceId,
+    id,
+  }: EventPayload<'snapshot.updated'>) {
+    const key =
+      workspaceId === id
+        ? `workspace:${workspaceId}:content`
+        : `workspace:${workspaceId}:doc:${id}:content`;
+    await this.cache.delete(key);
+  }
+}

packages/backend/server/src/core/doc/adapters/userspace.ts

@@ -45,7 +45,12 @@ export class PgUserspaceDocStorageAdapter extends DocStorageAdapter {
     return this.getDocSnapshot(spaceId, docId);
   }
 
-  async pushDocUpdates(userId: string, docId: string, updates: Uint8Array[]) {
+  async pushDocUpdates(
+    userId: string,
+    docId: string,
+    updates: Uint8Array[],
+    editorId?: string
+  ) {
     if (!updates.length) {
       return 0;
     }
@@ -67,6 +72,7 @@ export class PgUserspaceDocStorageAdapter extends DocStorageAdapter {
       docId,
       bin,
       timestamp,
+      editor: editorId,
     });
 
     return timestamp;
@@ -135,6 +141,7 @@ export class PgUserspaceDocStorageAdapter extends DocStorageAdapter {
       docId,
       bin: snapshot.blob,
       timestamp: snapshot.updatedAt.getTime(),
+      editor: snapshot.userId,
     };
   }
 

packages/backend/server/src/core/doc/adapters/workspace.ts

@@ -6,6 +6,7 @@ import {
   Cache,
   DocHistoryNotFound,
   DocNotFound,
+  EventEmitter,
   FailedToSaveUpdates,
   FailedToUpsertSnapshot,
   metrics,
@@ -30,6 +31,7 @@ export class PgWorkspaceDocStorageAdapter extends DocStorageAdapter {
     private readonly db: PrismaClient,
     private readonly mutex: Mutex,
     private readonly cache: Cache,
+    private readonly event: EventEmitter,
     protected override readonly options: DocStorageOptions
   ) {
     super(options);
@@ -38,7 +40,8 @@ export class PgWorkspaceDocStorageAdapter extends DocStorageAdapter {
   async pushDocUpdates(
     workspaceId: string,
     docId: string,
-    updates: Uint8Array[]
+    updates: Uint8Array[],
+    editorId?: string
   ) {
     if (!updates.length) {
       return 0;
@@ -82,6 +85,7 @@ export class PgWorkspaceDocStorageAdapter extends DocStorageAdapter {
                 blob: Buffer.from(update),
                 seq,
                 createdAt: new Date(createdAt),
+                createdBy: editorId || null,
               };
             }),
           });
@@ -95,7 +99,6 @@ export class PgWorkspaceDocStorageAdapter extends DocStorageAdapter {
       metrics.doc.counter('doc_update_insert_failed').add(1);
       throw new FailedToSaveUpdates();
     }
-
     return timestamp;
   }
 
@@ -113,6 +116,7 @@ export class PgWorkspaceDocStorageAdapter extends DocStorageAdapter {
     return rows.map(row => ({
       bin: row.blob,
       timestamp: row.createdAt.getTime(),
+      editor: row.createdBy || undefined,
     }));
   }
 
@@ -162,6 +166,7 @@ export class PgWorkspaceDocStorageAdapter extends DocStorageAdapter {
         workspaceId,
         ...(after
           ? {
+              // [createdAt] in updates table is indexed, so it's fast
               createdAt: {
                 gt: new Date(after),
               },
@@ -216,6 +221,12 @@ export class PgWorkspaceDocStorageAdapter extends DocStorageAdapter {
     const histories = await this.db.snapshotHistory.findMany({
       select: {
         timestamp: true,
+        createdByUser: {
+          select: {
+            name: true,
+            avatarUrl: true,
+          },
+        },
       },
       where: {
         workspaceId,
@@ -230,7 +241,10 @@ export class PgWorkspaceDocStorageAdapter extends DocStorageAdapter {
       take: query.limit,
     });
 
-    return histories.map(h => h.timestamp.getTime());
+    return histories.map(h => ({
+      timestamp: h.timestamp.getTime(),
+      editor: h.createdByUser,
+    }));
   }
 
   async getDocHistory(workspaceId: string, docId: string, timestamp: number) {
@@ -253,13 +267,15 @@ export class PgWorkspaceDocStorageAdapter extends DocStorageAdapter {
       docId,
       bin: history.blob,
       timestamp,
+      editor: history.createdBy || undefined,
     };
   }
 
   override async rollbackDoc(
     spaceId: string,
     docId: string,
-    timestamp: number
+    timestamp: number,
+    editorId?: string
   ): Promise<void> {
     await using _lock = await this.lockDocForUpdate(spaceId, docId);
     const toSnapshot = await this.getDocHistory(spaceId, docId, timestamp);
@@ -274,7 +290,14 @@ export class PgWorkspaceDocStorageAdapter extends DocStorageAdapter {
     }
 
     // force create a new history record after rollback
-    await this.createDocHistory(fromSnapshot, true);
+    await this.createDocHistory(
+      {
+        ...fromSnapshot,
+        // override the editor to the one who requested the rollback
+        editor: editorId,
+      },
+      true
+    );
     // WARN:
     //  we should never do the snapshot updating in recovering,
     //  which is not the solution in CRDT.
@@ -331,6 +354,7 @@ export class PgWorkspaceDocStorageAdapter extends DocStorageAdapter {
             id: snapshot.docId,
             timestamp: new Date(snapshot.timestamp),
             blob: Buffer.from(snapshot.bin),
+            createdBy: snapshot.editor,
             expiredAt: new Date(
               Date.now() + (await this.options.historyMaxAge(snapshot.spaceId))
             ),
@@ -358,7 +382,7 @@ export class PgWorkspaceDocStorageAdapter extends DocStorageAdapter {
   protected async getDocSnapshot(workspaceId: string, docId: string) {
     const snapshot = await this.db.snapshot.findUnique({
       where: {
-        id_workspaceId: {
+        workspaceId_id: {
           workspaceId,
           id: docId,
         },
@@ -374,6 +398,8 @@ export class PgWorkspaceDocStorageAdapter extends DocStorageAdapter {
       docId,
       bin: snapshot.blob,
       timestamp: snapshot.updatedAt.getTime(),
+      // creator and editor may null if their account is deleted
+      editor: snapshot.updatedBy || snapshot.createdBy || undefined,
     };
   }
 
@@ -392,14 +418,14 @@ export class PgWorkspaceDocStorageAdapter extends DocStorageAdapter {
     //
     //  ii. Prisma doesn't support `upsert` with additional `where` condition along side unique constraint.
     //      In our case, we need to manually check the `updatedAt` to avoid overriding the newer snapshot.
-    //      where: { id_workspaceId: {}, updatedAt: { lt: updatedAt } }
+    //      where: { workspaceId_id: {}, updatedAt: { lt: updatedAt } }
     //                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     try {
       const result: { updatedAt: Date }[] = await this.db.$queryRaw`
-        INSERT INTO "snapshots" ("workspace_id", "guid", "blob", "created_at", "updated_at")
-        VALUES (${spaceId}, ${docId}, ${bin}, DEFAULT, ${updatedAt})
+        INSERT INTO "snapshots" ("workspace_id", "guid", "blob", "created_at", "updated_at", "created_by", "updated_by")
+        VALUES (${spaceId}, ${docId}, ${bin}, DEFAULT, ${updatedAt}, ${snapshot.editor}, ${snapshot.editor})
         ON CONFLICT ("workspace_id", "guid")
-        DO UPDATE SET "blob" = ${bin}, "updated_at" = ${updatedAt}
+        DO UPDATE SET "blob" = ${bin}, "updated_at" = ${updatedAt}, "updated_by" = ${snapshot.editor}
         WHERE "snapshots"."workspace_id" = ${spaceId} AND "snapshots"."guid" = ${docId} AND "snapshots"."updated_at" <= ${updatedAt}
         RETURNING "snapshots"."workspace_id" as "workspaceId", "snapshots"."guid" as "id", "snapshots"."updated_at" as "updatedAt"
       `;
@@ -410,7 +436,7 @@ export class PgWorkspaceDocStorageAdapter extends DocStorageAdapter {
       //     seq: true,
       //   },
       //   where: {
-      //     id_workspaceId: {
+      //     workspaceId_id: {
       //       workspaceId,
       //       id: guid,
       //     },
@@ -438,6 +464,14 @@ export class PgWorkspaceDocStorageAdapter extends DocStorageAdapter {
       // the updates has been applied to current `doc` must have been seen by the other process as well.
       // The `updatedSnapshot` will be `undefined` in this case.
       const updatedSnapshot = result.at(0);
+
+      if (updatedSnapshot) {
+        this.event.emit('snapshot.updated', {
+          workspaceId: snapshot.spaceId,
+          id: snapshot.docId,
+        });
+      }
+
       return !!updatedSnapshot;
     } catch (e) {
       metrics.doc.counter('snapshot_upsert_failed').add(1);
@@ -549,7 +583,7 @@ export class PgWorkspaceDocStorageAdapter extends DocStorageAdapter {
           seq: true,
         },
         where: {
-          id_workspaceId: {
+          workspaceId_id: {
             workspaceId,
             id: guid,
           },
@@ -572,7 +606,7 @@ export class PgWorkspaceDocStorageAdapter extends DocStorageAdapter {
             seq: true,
           },
           where: {
-            id_workspaceId: {
+            workspaceId_id: {
               workspaceId,
               id: guid,
             },

packages/backend/server/src/core/doc/index.ts

@@ -22,4 +22,4 @@ import { DocStorageOptions } from './options';
 export class DocStorageModule {}
 export { PgUserspaceDocStorageAdapter, PgWorkspaceDocStorageAdapter };
 
-export { DocStorageAdapter } from './storage';
+export { DocStorageAdapter, type Editor } from './storage';

packages/backend/server/src/core/doc/job.ts

@@ -1,4 +1,4 @@
-import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
+import { Injectable, Logger, OnModuleInit, Optional } from '@nestjs/common';
 import { Cron, CronExpression, SchedulerRegistry } from '@nestjs/schedule';
 import { PrismaClient } from '@prisma/client';
 
@@ -11,14 +11,14 @@ export class DocStorageCronJob implements OnModuleInit {
   private busy = false;
 
   constructor(
-    private readonly registry: SchedulerRegistry,
     private readonly config: Config,
     private readonly db: PrismaClient,
-    private readonly workspace: PgWorkspaceDocStorageAdapter
+    private readonly workspace: PgWorkspaceDocStorageAdapter,
+    @Optional() private readonly registry?: SchedulerRegistry
   ) {}
 
   onModuleInit() {
-    if (this.config.doc.manager.enableUpdateAutoMerging) {
+    if (this.registry && this.config.doc.manager.enableUpdateAutoMerging) {
       this.registry.addInterval(
         this.autoMergePendingDocUpdates.name,
         // scheduler registry will clean up the interval when the app is stopped

packages/backend/server/src/core/doc/storage/doc.ts

@@ -16,11 +16,13 @@ export interface DocRecord {
   docId: string;
   bin: Uint8Array;
   timestamp: number;
+  editor?: string;
 }
 
 export interface DocUpdate {
   bin: Uint8Array;
   timestamp: number;
+  editor?: string;
 }
 
 export interface HistoryFilter {
@@ -28,6 +30,11 @@ export interface HistoryFilter {
   limit?: number;
 }
 
+export interface Editor {
+  name: string;
+  avatarUrl: string | null;
+}
+
 export interface DocStorageOptions {
   mergeUpdates?: (updates: Uint8Array[]) => Promise<Uint8Array> | Uint8Array;
 }
@@ -61,7 +68,7 @@ export abstract class DocStorageAdapter extends Connection {
     const updates = await this.getDocUpdates(spaceId, docId);
 
     if (updates.length) {
-      const { timestamp, bin } = await this.squash(
+      const { timestamp, bin, editor } = await this.squash(
         snapshot ? [snapshot, ...updates] : updates
       );
 
@@ -70,6 +77,7 @@ export abstract class DocStorageAdapter extends Connection {
         docId,
         bin,
         timestamp,
+        editor,
       };
 
       const success = await this.setDocSnapshot(newSnapshot);
@@ -91,7 +99,8 @@ export abstract class DocStorageAdapter extends Connection {
   abstract pushDocUpdates(
     spaceId: string,
     docId: string,
-    updates: Uint8Array[]
+    updates: Uint8Array[],
+    editorId?: string
   ): Promise<number>;
 
   abstract deleteDoc(spaceId: string, docId: string): Promise<void>;
@@ -99,7 +108,8 @@ export abstract class DocStorageAdapter extends Connection {
   async rollbackDoc(
     spaceId: string,
     docId: string,
-    timestamp: number
+    timestamp: number,
+    editorId?: string
   ): Promise<void> {
     await using _lock = await this.lockDocForUpdate(spaceId, docId);
     const toSnapshot = await this.getDocHistory(spaceId, docId, timestamp);
@@ -114,7 +124,7 @@ export abstract class DocStorageAdapter extends Connection {
     }
 
     const change = this.generateChangeUpdate(fromSnapshot.bin, toSnapshot.bin);
-    await this.pushDocUpdates(spaceId, docId, [change]);
+    await this.pushDocUpdates(spaceId, docId, [change], editorId);
     // force create a new history record after rollback
     await this.createDocHistory(fromSnapshot, true);
   }
@@ -127,7 +137,7 @@ export abstract class DocStorageAdapter extends Connection {
     spaceId: string,
     docId: string,
     query: { skip?: number; limit?: number }
-  ): Promise<number[]>;
+  ): Promise<{ timestamp: number; editor: Editor | null }[]>;
   abstract getDocHistory(
     spaceId: string,
     docId: string,
@@ -173,6 +183,7 @@ export abstract class DocStorageAdapter extends Connection {
     return {
       bin: finalUpdate,
       timestamp: lastUpdate.timestamp,
+      editor: lastUpdate.editor,
     };
   }
 

packages/backend/server/src/core/doc/storage/index.ts

@@ -28,5 +28,6 @@ export {
   DocStorageAdapter,
   type DocStorageOptions,
   type DocUpdate,
+  type Editor,
   type HistoryFilter,
 } from './doc';

packages/backend/server/src/core/permission/service.ts

@@ -75,6 +75,14 @@ export class PermissionService {
     return owner.user;
   }
 
+  async getWorkspaceMemberCount(workspaceId: string) {
+    return this.prisma.workspaceUserPermission.count({
+      where: {
+        workspaceId,
+      },
+    });
+  }
+
   async tryGetWorkspaceOwner(workspaceId: string) {
     return this.prisma.workspaceUserPermission.findFirst({
       where: {
@@ -204,7 +212,7 @@ export class PermissionService {
     const count = await this.prisma.workspace.count({
       where: {
         id: ws,
-        public: true,
+        enableUrlPreview: true,
       },
     });
 

packages/backend/server/src/core/quota/resolver.ts

@@ -7,7 +7,7 @@ import {
 } from '@nestjs/graphql';
 import { SafeIntResolver } from 'graphql-scalars';
 
-import { CurrentUser } from '../auth/current-user';
+import { CurrentUser } from '../auth/session';
 import { EarlyAccessType } from '../features';
 import { UserType } from '../user';
 import { QuotaService } from './service';

packages/backend/server/src/core/quota/storage.ts

@@ -113,6 +113,8 @@ export class QuotaManagementService {
   // quota was apply to owner's account
   async getWorkspaceUsage(workspaceId: string): Promise<QuotaBusinessType> {
     const owner = await this.permissions.getWorkspaceOwner(workspaceId);
+    const memberCount =
+      await this.permissions.getWorkspaceMemberCount(workspaceId);
     const {
       feature: {
         name,
@@ -145,6 +147,7 @@ export class QuotaManagementService {
       humanReadable,
       usedSize,
       unlimited,
+      memberCount,
     };
 
     if (quota.unlimited) {

packages/backend/server/src/core/quota/types.ts

@@ -87,6 +87,9 @@ export class QuotaQueryType {
   @Field(() => SafeIntResolver)
   memberLimit!: number;
 
+  @Field(() => SafeIntResolver)
+  memberCount!: number;
+
   @Field(() => SafeIntResolver)
   storageQuota!: number;
 

packages/backend/server/src/core/selfhost/controller.ts

@@ -56,7 +56,7 @@ export class CustomSetupController {
 
     try {
       await this.event.emitAsync('user.admin.created', user);
-      await this.auth.setCookie(req, res, user);
+      await this.auth.setCookies(req, res, user.id);
       res.send({ id: user.id, email: user.email, name: user.name });
     } catch (e) {
       await this.user.deleteUser(user.id);

packages/backend/server/src/core/selfhost/index.ts

@@ -22,7 +22,6 @@ export class SetupMiddleware implements NestMiddleware {
 
   use = (req: Request, res: Response, next: (error?: Error | any) => void) => {
     // never throw
-    // eslint-disable-next-line @typescript-eslint/no-floating-promises
     this.server
       .initialized()
       .then(initialized => {
@@ -59,6 +58,10 @@ export class SelfhostModule implements OnModuleInit {
   ) {}
 
   onModuleInit() {
+    // selfhost static file location
+    // web => 'static/selfhost'
+    // admin => 'static/admin/selfhost'
+    // mobile => 'static/mobile/selfhost'
     const staticPath = join(this.config.projectRoot, 'static');
     // in command line mode
     if (!this.adapterHost.httpAdapter) {
@@ -73,7 +76,7 @@ export class SelfhostModule implements OnModuleInit {
     });
     app.use(
       basePath + '/admin',
-      serveStatic(join(staticPath, 'admin'), {
+      serveStatic(join(staticPath, 'admin', 'selfhost'), {
         redirect: false,
         index: false,
       })
@@ -83,7 +86,7 @@ export class SelfhostModule implements OnModuleInit {
       [basePath + '/admin', basePath + '/admin/*'],
       this.check.use,
       (_req, res) => {
-        res.sendFile(join(staticPath, 'admin', 'index.html'));
+        res.sendFile(join(staticPath, 'admin', 'selfhost', 'index.html'));
       }
     );
 
@@ -92,13 +95,13 @@ export class SelfhostModule implements OnModuleInit {
     });
     app.use(
       basePath,
-      serveStatic(staticPath, {
+      serveStatic(join(staticPath, 'selfhost'), {
         redirect: false,
         index: false,
       })
     );
     app.get('*', this.check.use, (_req, res) => {
-      res.sendFile(join(staticPath, 'index.html'));
+      res.sendFile(join(staticPath, 'selfhost', 'index.html'));
     });
   }
 }

packages/backend/server/src/core/sync/gateway.ts

@@ -21,7 +21,7 @@ import {
   SpaceAccessDenied,
   VersionRejected,
 } from '../../fundamentals';
-import { Auth, CurrentUser } from '../auth';
+import { CurrentUser } from '../auth';
 import {
   DocStorageAdapter,
   PgUserspaceDocStorageAdapter,
@@ -203,7 +203,6 @@ export class SpaceSyncGateway
   }
 
   // v3
-  @Auth()
   @SubscribeMessage('space:join')
   async onJoinSpace(
     @CurrentUser() user: CurrentUser,
@@ -267,6 +266,7 @@ export class SpaceSyncGateway
   @SubscribeMessage('space:push-doc-updates')
   async onReceiveDocUpdates(
     @ConnectedSocket() client: Socket,
+    @CurrentUser() user: CurrentUser,
     @MessageBody()
     message: PushDocUpdatesMessage
   ): Promise<EventResponse<{ accepted: true; timestamp?: number }>> {
@@ -277,7 +277,8 @@ export class SpaceSyncGateway
     const timestamp = await adapter.push(
       spaceId,
       docId,
-      updates.map(update => Buffer.from(update, 'base64'))
+      updates.map(update => Buffer.from(update, 'base64')),
+      user.id
     );
 
     // could be put in [adapter.push]
@@ -321,7 +322,6 @@ export class SpaceSyncGateway
     };
   }
 
-  @Auth()
   @SubscribeMessage('space:join-awareness')
   async onJoinAwareness(
     @ConnectedSocket() client: Socket,
@@ -407,7 +407,6 @@ export class SpaceSyncGateway
 
   // TODO(@forehalo): remove
   // deprecated section
-  @Auth()
   @SubscribeMessage('client-handshake-sync')
   async handleClientHandshakeSync(
     @CurrentUser() user: CurrentUser,
@@ -450,6 +449,7 @@ export class SpaceSyncGateway
 
   @SubscribeMessage('client-update-v2')
   async handleClientUpdateV2(
+    @CurrentUser() user: CurrentUser,
     @MessageBody()
     {
       workspaceId,
@@ -462,7 +462,7 @@ export class SpaceSyncGateway
     },
     @ConnectedSocket() client: Socket
   ): Promise<EventResponse<{ accepted: true; timestamp?: number }>> {
-    return this.onReceiveDocUpdates(client, {
+    return this.onReceiveDocUpdates(client, user, {
       spaceType: SpaceType.Workspace,
       spaceId: workspaceId,
       docId: guid,
@@ -494,7 +494,6 @@ export class SpaceSyncGateway
     });
   }
 
-  @Auth()
   @SubscribeMessage('client-handshake-awareness')
   async handleClientHandshakeAwareness(
     @ConnectedSocket() client: Socket,
@@ -596,9 +595,9 @@ abstract class SyncSocketAdapter {
     permission?: Permission
   ): Promise<void>;
 
-  push(spaceId: string, docId: string, updates: Buffer[]) {
+  push(spaceId: string, docId: string, updates: Buffer[], editorId: string) {
     this.assertIn(spaceId);
-    return this.storage.pushDocUpdates(spaceId, docId, updates);
+    return this.storage.pushDocUpdates(spaceId, docId, updates, editorId);
   }
 
   get(spaceId: string, docId: string) {
@@ -621,9 +620,14 @@ class WorkspaceSyncAdapter extends SyncSocketAdapter {
     super(SpaceType.Workspace, client, storage);
   }
 
-  override push(spaceId: string, docId: string, updates: Buffer[]) {
+  override push(
+    spaceId: string,
+    docId: string,
+    updates: Buffer[],
+    editorId: string
+  ) {
     const id = new DocID(docId, spaceId);
-    return super.push(spaceId, id.guid, updates);
+    return super.push(spaceId, id.guid, updates, editorId);
   }
 
   override get(spaceId: string, docId: string) {

packages/backend/server/src/core/user/resolver.ts

@@ -18,9 +18,9 @@ import {
   Throttle,
   UserNotFound,
 } from '../../fundamentals';
-import { CurrentUser } from '../auth/current-user';
 import { Public } from '../auth/guard';
 import { sessionUser } from '../auth/service';
+import { CurrentUser } from '../auth/session';
 import { Admin } from '../common';
 import { AvatarStorage } from '../storage';
 import { validators } from '../utils/validators';

packages/backend/server/src/core/user/service.ts

@@ -1,5 +1,5 @@
 import { Injectable, Logger } from '@nestjs/common';
-import { Prisma, PrismaClient } from '@prisma/client';
+import { Prisma, PrismaClient, User } from '@prisma/client';
 
 import {
   Config,
@@ -56,11 +56,6 @@ export class UserService {
 
   async createUser(data: CreateUserInput) {
     validators.assertValidEmail(data.email);
-    const user = await this.findUserByEmail(data.email);
-
-    if (user) {
-      throw new EmailAlreadyUsed();
-    }
 
     if (data.password) {
       const config = await this.config.runtime.fetchAll({
@@ -77,6 +72,12 @@ export class UserService {
   }
 
   async createUser_without_verification(data: CreateUserInput) {
+    const user = await this.findUserByEmail(data.email);
+
+    if (user) {
+      throw new EmailAlreadyUsed();
+    }
+
     if (data.password) {
       data.password = await this.crypto.encryptPassword(data.password);
     }
@@ -105,32 +106,76 @@ export class UserService {
       });
   }
 
-  async findUserByEmail(email: string) {
+  async findUserByEmail(
+    email: string
+  ): Promise<Pick<User, keyof typeof this.defaultUserSelect> | null> {
     validators.assertValidEmail(email);
-    return this.prisma.user.findFirst({
-      where: {
-        email: {
-          equals: email,
-          mode: 'insensitive',
-        },
-      },
-      select: this.defaultUserSelect,
-    });
+    const rows = await this.prisma.$queryRaw<
+      // see [this.defaultUserSelect]
+      {
+        id: string;
+        name: string;
+        email: string;
+        email_verified: Date | null;
+        avatar_url: string | null;
+        registered: boolean;
+        created_at: Date;
+      }[]
+    >`
+      SELECT "id", "name", "email", "email_verified", "avatar_url", "registered", "created_at"
+      FROM "users"
+      WHERE lower("email") = lower(${email})
+    `;
+
+    const user = rows[0];
+
+    if (!user) {
+      return null;
+    }
+
+    return {
+      ...user,
+      emailVerifiedAt: user.email_verified,
+      avatarUrl: user.avatar_url,
+      createdAt: user.created_at,
+    };
   }
 
   /**
    * supposed to be used only for `Credential SignIn`
    */
-  async findUserWithHashedPasswordByEmail(email: string) {
+  async findUserWithHashedPasswordByEmail(email: string): Promise<User | null> {
     validators.assertValidEmail(email);
-    return this.prisma.user.findFirst({
-      where: {
-        email: {
-          equals: email,
-          mode: 'insensitive',
-        },
-      },
-    });
+
+    // see https://www.prisma.io/docs/orm/prisma-client/using-raw-sql/raw-queries#typing-queryraw-results
+    const rows = await this.prisma.$queryRaw<
+      {
+        id: string;
+        name: string;
+        email: string;
+        password: string | null;
+        email_verified: Date | null;
+        avatar_url: string | null;
+        registered: boolean;
+        created_at: Date;
+      }[]
+    >`
+      SELECT *
+      FROM "users"
+      WHERE lower("email") = lower(${email})
+    `;
+
+    const user = rows[0];
+    if (!user) {
+      return null;
+    }
+
+    return {
+      ...user,
+      emailVerifiedAt: user.email_verified,
+      avatarUrl: user.avatar_url,
+      createdAt: user.created_at,
+    };
   }
 
   async signIn(email: string, password: string) {
@@ -158,9 +203,7 @@ export class UserService {
 
   async fulfillUser(
     email: string,
-    data: Partial<
-      Pick<Prisma.UserCreateInput, 'emailVerifiedAt' | 'registered'>
-    >
+    data: Omit<Partial<Prisma.UserCreateInput>, 'id'>
   ) {
     const user = await this.findUserByEmail(email);
     if (!user) {
@@ -180,7 +223,6 @@ export class UserService {
 
       if (Object.keys(data).length) {
         return await this.prisma.user.update({
-          select: this.defaultUserSelect,
           where: { id: user.id },
           data,
         });

packages/backend/server/src/core/user/types.ts

@@ -8,7 +8,7 @@ import {
 import type { User } from '@prisma/client';
 
 import type { Payload } from '../../fundamentals/event/def';
-import { CurrentUser } from '../auth/current-user';
+import { type CurrentUser } from '../auth/session';
 
 @ObjectType()
 export class UserType implements CurrentUser {

packages/backend/server/src/core/utils/blocksuite.ts

@@ -0,0 +1,129 @@
+// TODO(@forehalo):
+//   Because of the `@affine/server` package can't import directly from workspace packages,
+//   this is a temprory solution to get the block suite data(title, description) from given yjs binary or yjs doc.
+//   The logic is mainly copied from
+//     - packages/frontend/core/src/modules/docs-search/worker/in-worker.ts
+//     - packages/frontend/core/src/components/page-list/use-block-suite-page-preview.ts
+//   and it's better to be provided by blocksuite
+
+import { Array, Doc, Map } from 'yjs';
+
+export interface PageDocContent {
+  title: string;
+  summary: string;
+}
+
+export interface WorkspaceDocContent {
+  name: string;
+  avatarKey: string;
+}
+
+type KnownFlavour =
+  | 'affine:page'
+  | 'affine:note'
+  | 'affine:surface'
+  | 'affine:paragraph'
+  | 'affine:list'
+  | 'affine:code'
+  | 'affine:image';
+
+export function parseWorkspaceDoc(doc: Doc): WorkspaceDocContent | null {
+  // not a workspace doc
+  if (!doc.share.has('meta')) {
+    return null;
+  }
+
+  const meta = doc.getMap('meta');
+
+  return {
+    name: meta.get('name') as string,
+    avatarKey: meta.get('avatar') as string,
+  };
+}
+
+export interface ParsePageOptions {
+  maxSummaryLength: number;
+}
+
+export function parsePageDoc(
+  doc: Doc,
+  opts: ParsePageOptions = { maxSummaryLength: 150 }
+): PageDocContent | null {
+  // not a page doc
+  if (!doc.share.has('blocks')) {
+    return null;
+  }
+
+  const blocks = doc.getMap<Map<any>>('blocks');
+
+  if (!blocks.size) {
+    return null;
+  }
+
+  const content: PageDocContent = {
+    title: '',
+    summary: '',
+  };
+
+  let summaryLenNeeded = opts.maxSummaryLength;
+
+  let root: Map<any> | null = null;
+  for (const block of blocks.values()) {
+    const flavour = block.get('sys:flavour') as KnownFlavour;
+    if (flavour === 'affine:page') {
+      content.title = block.get('prop:title') as string;
+      root = block;
+    }
+  }
+
+  if (!root) {
+    return null;
+  }
+
+  const queue: string[] = [root.get('sys:id')];
+
+  function pushChildren(block: Map<any>) {
+    const children = block.get('sys:children') as Array<string> | undefined;
+    if (children?.length) {
+      for (let i = children.length - 1; i >= 0; i--) {
+        queue.push(children.get(i));
+      }
+    }
+  }
+
+  while (queue.length) {
+    const blockId = queue.pop();
+    const block = blockId ? blocks.get(blockId) : null;
+    if (!block) {
+      break;
+    }
+
+    const flavour = block.get('sys:flavour') as KnownFlavour;
+
+    switch (flavour) {
+      case 'affine:page':
+      case 'affine:note': {
+        pushChildren(block);
+        break;
+      }
+      case 'affine:paragraph':
+      case 'affine:list':
+      case 'affine:code': {
+        pushChildren(block);
+        const text = block.get('prop:text');
+        if (!text) {
+          continue;
+        }
+
+        if (summaryLenNeeded > 0) {
+          content.summary += text.toString();
+          summaryLenNeeded -= text.length;
+        } else {
+          break;
+        }
+      }
+    }
+  }
+
+  return content;
+}

packages/backend/server/src/core/workspaces/index.ts

@@ -1,6 +1,7 @@
 import { Module } from '@nestjs/common';
 
 import { DocStorageModule } from '../doc';
+import { DocRendererModule } from '../doc-renderer';
 import { FeatureModule } from '../features';
 import { PermissionModule } from '../permission';
 import { QuotaModule } from '../quota';
@@ -18,6 +19,7 @@ import {
 @Module({
   imports: [
     DocStorageModule,
+    DocRendererModule,
     FeatureModule,
     QuotaModule,
     StorageModule,

packages/backend/server/src/core/workspaces/resolvers/history.ts

@@ -16,6 +16,7 @@ import { PgWorkspaceDocStorageAdapter } from '../../doc';
 import { Permission, PermissionService } from '../../permission';
 import { DocID } from '../../utils/doc';
 import { WorkspaceType } from '../types';
+import { EditorType } from './workspace';
 
 @ObjectType()
 class DocHistoryType implements Partial<SnapshotHistory> {
@@ -27,6 +28,9 @@ class DocHistoryType implements Partial<SnapshotHistory> {
 
   @Field(() => GraphQLISODateTime)
   timestamp!: Date;
+
+  @Field(() => EditorType, { nullable: true })
+  editor!: EditorType | null;
 }
 
 @Resolver(() => WorkspaceType)
@@ -47,17 +51,18 @@ export class DocHistoryResolver {
   ): Promise<DocHistoryType[]> {
     const docId = new DocID(guid, workspace.id);
 
-    const timestamps = await this.workspace.listDocHistories(
+    const histories = await this.workspace.listDocHistories(
       workspace.id,
       docId.guid,
       { before: timestamp.getTime(), limit: take }
     );
 
-    return timestamps.map(timestamp => {
+    return histories.map(history => {
       return {
         workspaceId: workspace.id,
         id: docId.guid,
-        timestamp: new Date(timestamp),
+        timestamp: new Date(history.timestamp),
+        editor: history.editor,
       };
     });
   }
@@ -81,7 +86,8 @@ export class DocHistoryResolver {
     await this.workspace.rollbackDoc(
       docId.workspace,
       docId.guid,
-      timestamp.getTime()
+      timestamp.getTime(),
+      user.id
     );
 
     return timestamp;

packages/backend/server/src/core/workspaces/resolvers/workspace.ts

@@ -1,8 +1,10 @@
 import { Logger } from '@nestjs/common';
 import {
   Args,
+  Field,
   Int,
   Mutation,
+  ObjectType,
   Parent,
   Query,
   ResolveField,
@@ -11,11 +13,11 @@ import {
 import { PrismaClient } from '@prisma/client';
 import { getStreamAsBuffer } from 'get-stream';
 import GraphQLUpload from 'graphql-upload/GraphQLUpload.mjs';
-import { applyUpdate, Doc } from 'yjs';
 
 import type { FileUpload } from '../../../fundamentals';
 import {
   CantChangeSpaceOwner,
+  DocNotFound,
   EventEmitter,
   InternalServerError,
   MailService,
@@ -28,6 +30,8 @@ import {
   UserNotFound,
 } from '../../../fundamentals';
 import { CurrentUser, Public } from '../../auth';
+import type { Editor } from '../../doc';
+import { DocContentService } from '../../doc-renderer';
 import { Permission, PermissionService } from '../../permission';
 import { QuotaManagementService, QuotaQueryType } from '../../quota';
 import { WorkspaceBlobStorage } from '../../storage';
@@ -40,6 +44,30 @@ import {
 } from '../types';
 import { defaultWorkspaceAvatar } from '../utils';
 
+@ObjectType()
+export class EditorType implements Partial<Editor> {
+  @Field()
+  name!: string;
+
+  @Field(() => String, { nullable: true })
+  avatarUrl!: string | null;
+}
+
+@ObjectType()
+class WorkspacePageMeta {
+  @Field(() => Date)
+  createdAt!: Date;
+
+  @Field(() => Date)
+  updatedAt!: Date;
+
+  @Field(() => EditorType, { nullable: true })
+  createdBy!: EditorType | null;
+
+  @Field(() => EditorType, { nullable: true })
+  updatedBy!: EditorType | null;
+}
+
 /**
  * Workspace resolver
  * Public apis rate limit: 10 req/m
@@ -57,7 +85,8 @@ export class WorkspaceResolver {
     private readonly users: UserService,
     private readonly event: EventEmitter,
     private readonly blobStorage: WorkspaceBlobStorage,
-    private readonly mutex: RequestMutex
+    private readonly mutex: RequestMutex,
+    private readonly doc: DocContentService
   ) {}
 
   @ResolveField(() => Permission, {
@@ -87,11 +116,7 @@ export class WorkspaceResolver {
     complexity: 2,
   })
   memberCount(@Parent() workspace: WorkspaceType) {
-    return this.prisma.workspaceUserPermission.count({
-      where: {
-        workspaceId: workspace.id,
-      },
-    });
+    return this.permissions.getWorkspaceMemberCount(workspace.id);
   }
 
   @ResolveField(() => Boolean, {
@@ -155,6 +180,35 @@ export class WorkspaceResolver {
       }));
   }
 
+  @ResolveField(() => WorkspacePageMeta, {
+    description: 'Cloud page metadata of workspace',
+    complexity: 2,
+  })
+  async pageMeta(
+    @Parent() workspace: WorkspaceType,
+    @Args('pageId') pageId: string
+  ) {
+    const metadata = await this.prisma.snapshot.findFirst({
+      where: { workspaceId: workspace.id, id: pageId },
+      select: {
+        createdAt: true,
+        updatedAt: true,
+        createdByUser: { select: { name: true, avatarUrl: true } },
+        updatedByUser: { select: { name: true, avatarUrl: true } },
+      },
+    });
+    if (!metadata) {
+      throw new DocNotFound({ spaceId: workspace.id, docId: pageId });
+    }
+
+    return {
+      createdAt: metadata.createdAt,
+      updatedAt: metadata.updatedAt,
+      createdBy: metadata.createdByUser || null,
+      updatedBy: metadata.updatedByUser || null,
+    };
+  }
+
   @ResolveField(() => QuotaQueryType, {
     name: 'quota',
     description: 'quota of workspace',
@@ -331,13 +385,8 @@ export class WorkspaceResolver {
       }
 
       // member limit check
-      const [memberCount, quota] = await Promise.all([
-        this.prisma.workspaceUserPermission.count({
-          where: { workspaceId },
-        }),
-        this.quota.getWorkspaceUsage(workspaceId),
-      ]);
-      if (memberCount >= quota.memberLimit) {
+      const quota = await this.quota.getWorkspaceUsage(workspaceId);
+      if (quota.memberCount >= quota.memberLimit) {
         return new MemberQuotaExceeded();
       }
 
@@ -423,17 +472,7 @@ export class WorkspaceResolver {
       })
       .then(({ workspaceId }) => workspaceId);
 
-    const snapshot = await this.prisma.snapshot.findFirstOrThrow({
-      where: {
-        id: workspaceId,
-        workspaceId,
-      },
-    });
-
-    const doc = new Doc();
-
-    applyUpdate(doc, new Uint8Array(snapshot.blob));
-    const metaJSON = doc.getMap('meta').toJSON();
+    const workspaceContent = await this.doc.getWorkspaceContent(workspaceId);
 
     const owner = await this.permissions.getWorkspaceOwner(workspaceId);
     const invitee = await this.permissions.getWorkspaceInvitation(
@@ -442,11 +481,10 @@ export class WorkspaceResolver {
     );
 
     let avatar = '';
-
-    if (metaJSON.avatar) {
+    if (workspaceContent?.avatarKey) {
       const avatarBlob = await this.blobStorage.get(
         workspaceId,
-        metaJSON.avatar
+        workspaceContent.avatarKey
       );
 
       if (avatarBlob.body) {
@@ -456,7 +494,7 @@ export class WorkspaceResolver {
 
     return {
       workspace: {
-        name: metaJSON.name || '',
+        name: workspaceContent?.name ?? '',
         avatar: avatar || defaultWorkspaceAvatar,
         id: workspaceId,
       },

packages/backend/server/src/core/workspaces/types.ts

@@ -46,6 +46,9 @@ export class WorkspaceType implements Partial<Workspace> {
   @Field({ description: 'is Public workspace' })
   public!: boolean;
 
+  @Field({ description: 'Enable url previous when sharing' })
+  enableUrlPreview!: boolean;
+
   @Field({ description: 'Workspace created date' })
   createdAt!: Date;
 
@@ -89,7 +92,7 @@ export class InvitationType {
 @InputType()
 export class UpdateWorkspaceInput extends PickType(
   PartialType(WorkspaceType),
-  ['public'],
+  ['public', 'enableUrlPreview'],
   InputType
 ) {
   @Field(() => ID)

packages/backend/server/src/data/migrations/1698398506533-guid.ts

@@ -78,7 +78,7 @@ export class Guid1698398506533 {
               }),
               db.snapshot.update({
                 where: {
-                  id_workspaceId: {
+                  workspaceId_id: {
                     id: docId.guid,
                     workspaceId: doc.workspaceId,
                   },
@@ -93,7 +93,7 @@ export class Guid1698398506533 {
             // just modify the id the required one
             await db.snapshot.update({
               where: {
-                id_workspaceId: {
+                workspaceId_id: {
                   id: doc.id,
                   workspaceId: doc.workspaceId,
                 },

packages/backend/server/src/fundamentals/cache/local.ts

@@ -1,17 +1,17 @@
-import Keyv from 'keyv';
+import Keyv, { KeyvOptions } from 'keyv';
 
 import type { Cache, CacheSetOptions } from './def';
 
 export class LocalCache implements Cache {
   private readonly kv: Keyv;
 
-  constructor(opts: Keyv.Options<any> = {}) {
+  constructor(opts: KeyvOptions = {}) {
     this.kv = new Keyv(opts);
   }
 
   // standard operation
   async get<T = unknown>(key: string): Promise<T | undefined> {
-    return this.kv.get(key).catch(() => undefined);
+    return this.kv.get<T>(key).catch(() => undefined);
   }
 
   async set<T = unknown>(
@@ -74,14 +74,14 @@ export class LocalCache implements Cache {
 
   // list operations
   private async getArray<T = unknown>(key: string) {
-    const raw = await this.kv.get(key, { raw: true });
+    const raw = await this.kv.get<T[]>(key, { raw: true });
     if (raw && !Array.isArray(raw.value)) {
       throw new Error(
         `Expect an Array keyed by ${key}, but found ${raw.value}`
       );
     }
 
-    return raw as Keyv.DeserializedData<T[]>;
+    return raw;
   }
 
   private async setArray<T = unknown>(
@@ -97,7 +97,9 @@ export class LocalCache implements Cache {
     let ttl: number | undefined = undefined;
     const raw = await this.getArray(key);
     if (raw) {
-      list = raw.value;
+      if (raw.value) {
+        list = raw.value;
+      }
       if (raw.expires) {
         ttl = raw.expires - Date.now();
       }
@@ -112,7 +114,9 @@ export class LocalCache implements Cache {
     let ttl: number | undefined = undefined;
     const raw = await this.getArray(key);
     if (raw) {
-      list = raw.value;
+      if (raw.value) {
+        list = raw.value;
+      }
       if (raw.expires) {
         ttl = raw.expires - Date.now();
       }
@@ -123,7 +127,7 @@ export class LocalCache implements Cache {
   }
 
   async len(key: string): Promise<number> {
-    return this.getArray(key).then(v => v?.value.length ?? 0);
+    return this.getArray<any[]>(key).then(v => v?.value?.length ?? 0);
   }
 
   /**
@@ -147,7 +151,7 @@ export class LocalCache implements Cache {
 
   private async trim<T = unknown>(key: string, start: number, end: number) {
     const raw = await this.getArray<T>(key);
-    if (raw) {
+    if (raw && raw.value) {
       start = (raw.value.length + start) % raw.value.length;
       // make negative end index work, and end indice is inclusive
       end = ((raw.value.length + end) % raw.value.length) + 1;
@@ -173,7 +177,7 @@ export class LocalCache implements Cache {
 
   // map operations
   private async getMap<T = unknown>(map: string) {
-    const raw = await this.kv.get(map, { raw: true });
+    const raw = await this.kv.get<Record<string, T>>(map, { raw: true });
 
     if (raw) {
       if (typeof raw.value !== 'object') {
@@ -187,7 +191,7 @@ export class LocalCache implements Cache {
       }
     }
 
-    return raw as Keyv.DeserializedData<Record<string, T>>;
+    return raw;
   }
 
   private async setMap<T = unknown>(
@@ -263,7 +267,7 @@ export class LocalCache implements Cache {
 
   async mapKeys(map: string): Promise<string[]> {
     const raw = await this.getMap(map);
-    if (raw) {
+    if (raw?.value) {
       return Object.keys(raw.value);
     }
 
@@ -277,6 +281,6 @@ export class LocalCache implements Cache {
 
   async mapLen(map: string): Promise<number> {
     const raw = await this.getMap(map);
-    return raw ? Object.keys(raw.value).length : 0;
+    return raw?.value ? Object.keys(raw.value).length : 0;
   }
 }