Merge pull request #5114 from penpot/superalex-fix-fetch-profile-exception

🐛 Fix fetch profile exception
2025-12-24 06:58:34 -05:00 · 2024-09-24 14:24:56 +02:00 · 2024-09-24 14:13:46 +02:00 · 2024-09-24 11:27:04 +02:00 · 2024-09-24 10:32:57 +02:00 · 2024-09-24 09:38:32 +02:00
913 changed files with 139820 additions and 75954 deletions
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -22,52 +22,53 @@ jobs:

      # Download and cache dependencies
      - restore_cache:
-         keys:
-           - v1-dependencies-{{ checksum "backend/deps.edn" }}-{{ checksum "frontend/deps.edn"}}-{{ checksum "common/deps.edn"}}
-           # fallback to using the latest cache if no exact match is found
-           - v1-dependencies-
+          keys:
+            - v1-dependencies-{{ checksum "backend/deps.edn" }}-{{ checksum "frontend/deps.edn"}}-{{ checksum "common/deps.edn"}}
+            # fallback to using the latest cache if no exact match is found
+            - v1-dependencies-

      - run: cd .clj-kondo && cat config.edn
      - run: cat .cljfmt.edn
      - run: clj-kondo --version

      - run:
-          name: "fmt check backend [clj]"
+          name: "backend fmt check"
          working_directory: "./backend"
          command: |
            yarn install
            yarn run fmt:clj:check

      - run:
-          name: "fmt check exporter [clj]"
+          name: "exporter fmt check"
          working_directory: "./exporter"
          command: |
            yarn install
            yarn run fmt:clj:check

      - run:
-          name: "fmt check common [clj]"
+          name: "common fmt check"
          working_directory: "./common"
          command: |
            yarn install
            yarn run fmt:clj:check

      - run:
-          name: "fmt check frontend [clj]"
+          name: "frontend fmt check"
          working_directory: "./frontend"
          command: |
            yarn install
            yarn run fmt:clj:check
+            yarn run fmt:js:check

      - run:
-          name: common lint
+          name: "common linter check"
          working_directory: "./common"
          command: |
            yarn install
            yarn run lint:clj

      - run:
-          name: frontend lint
+          name: "frontend linter check"
          working_directory: "./frontend"
          command: |
            yarn install
@@ -75,14 +76,14 @@ jobs:
            yarn run lint:clj

      - run:
-          name: backend lint
+          name: "backend linter check"
          working_directory: "./backend"
          command: |
            yarn install
            yarn run lint:clj

      - run:
-          name: exporter lint
+          name: "exporter linter check"
          working_directory: "./exporter"
          command: |
            yarn install
@@ -93,7 +94,7 @@ jobs:
          working_directory: "./common"
          command: |
            yarn test
-            clojure -X:dev:test :patterns '["common-tests.*-test"]'
+            clojure -M:dev:test

      - run:
          name: "frontend tests"
@@ -102,11 +103,21 @@ jobs:
            yarn install
            yarn test

+      - run:
+          name: "frontend integration tests"
+          working_directory: "./frontend"
+          command: |
+            yarn install
+            yarn run build:app:assets
+            clojure -M:dev:shadow-cljs release main
+            yarn playwright install --with-deps chromium
+            yarn e2e:test
+
      - run:
          name: "backend tests"
          working_directory: "./backend"
          command: |
-            clojure -X:dev:test :patterns '["backend-tests.*-test"]'
+            clojure -M:dev:test

          environment:
            PENPOT_TEST_DATABASE_URI: "postgresql://localhost/penpot_test"
@@ -115,7 +126,6 @@ jobs:
            PENPOT_TEST_REDIS_URI: "redis://localhost/1"

      - save_cache:
-         paths:
-           - ~/.m2
-         key: v1-dependencies-{{ checksum "backend/deps.edn" }}-{{ checksum "frontend/deps.edn"}}-{{ checksum "common/deps.edn"}}
-
+          paths:
+            - ~/.m2
+          key: v1-dependencies-{{ checksum "backend/deps.edn" }}-{{ checksum "frontend/deps.edn"}}-{{ checksum "common/deps.edn"}}
--- a/.clj-kondo/config.edn
+++ b/.clj-kondo/config.edn
@@ -3,7 +3,6 @@
  promesa.core/->> clojure.core/->>
  promesa.core/-> clojure.core/->
  promesa.exec.csp/go-loop clojure.core/loop
-  rumext.v2/defc clojure.core/defn
  promesa.util/with-open clojure.core/with-open
  app.common.schema.generators/let clojure.core/let
  app.common.data/export clojure.core/def
@@ -20,6 +19,7 @@
   app.db/with-atomic hooks.export/penpot-with-atomic
   potok.v2.core/reify hooks.export/potok-reify
   rumext.v2/fnc hooks.export/rumext-fnc
+   rumext.v2/defc hooks.export/rumext-defc
   rumext.v2/lazy-component hooks.export/rumext-lazycomponent
   shadow.lazy/loadable hooks.export/rumext-lazycomponent
   }}
--- a/.clj-kondo/hooks/export.clj
+++ b/.clj-kondo/hooks/export.clj
@@ -12,6 +12,7 @@

 (def registry (atom {}))

+
 (defn potok-reify
  [{:keys [:node :filename] :as params}]
  (let [[rnode rtype & other] (:children node)
@@ -66,12 +67,86 @@
  (let [[cname mdata params & body] (rest (:children node))
        [params body] (if (api/vector-node? mdata)
                        [mdata (cons params body)]
-                        [params body])]
-    (let [result (api/list-node
-                  (into [(api/token-node 'fn)
-                         params]
-                        (cons mdata body)))]
-      {:node result})))
+                        [params body])
+
+        result (api/list-node
+                (into [(api/token-node 'fn) params]
+                      (cons mdata body)))]
+
+    {:node result}))
+
+
+(defn- parse-defc
+  [{:keys [children] :as node}]
+  (let [args (rest children)
+
+        [cname args]
+        (if (api/token-node? (first args))
+          [(first args) (rest args)]
+          (throw (ex-info "unexpected1" {})))
+
+        [docs args]
+        (if (api/string-node? (first args))
+          [(first args) (rest args)]
+          ["" args])
+
+        [mdata args]
+        (if (api/map-node? (first args))
+          [(first args) (rest args)]
+          [(api/map-node []) args])
+
+        [params body]
+        (if (api/vector-node? (first args))
+          [(first args) (rest args)]
+          (throw (ex-info "unexpected2" {})))]
+
+    [cname docs mdata params body]))
+
+(defn rumext-defc
+  [{:keys [node]}]
+  (let [[cname docs mdata params body] (parse-defc node)
+
+        param1        (first (:children params))
+        paramN        (rest (:children params))
+
+        param1        (if (api/map-node? param1)
+                        (let [param1    (into {} (comp
+                                                  (partition-all 2)
+                                                  (map (fn [[k v]]
+                                                         [(if (api/keyword-node? k)
+                                                            (:k k)
+                                                            k)
+                                                          (if (api/vector-node? v)
+                                                            (vec (:children v))
+                                                            v)])))
+                                              (:children param1))
+
+                              binding   (:rest param1)
+                              param1    (if binding
+                                          (if (contains? param1 :as)
+                                            (update param1 :keys (fnil conj []) binding)
+                                            (assoc param1 :as binding))
+                                          param1)]
+                          (->> (dissoc param1 :rest)
+                               (mapcat (fn [[k v]]
+                                         [(if (keyword? k)
+                                            (api/keyword-node k)
+                                            k)
+                                          (if (vector? v)
+                                            (api/vector-node v)
+                                            v)]))
+                               (api/map-node)))
+                        param1)
+
+        result (api/list-node
+                (into [(api/token-node 'defn)
+                       cname
+                       (api/vector-node (filter some? (cons param1 paramN)))]
+                      (cons mdata body)))]
+
+    ;; (prn (api/sexpr result))
+
+    {:node result}))


 (defn rumext-lazycomponent
--- a/.cljfmt.edn
+++ b/.cljfmt.edn
@@ -4,6 +4,7 @@
 :remove-consecutive-blank-lines? false
 :extra-indents {rumext.v2/fnc [[:inner 0]]
                 cljs.test/async [[:inner 0]]
+                 app.common.schema/register! [[:inner 0] [:inner 1]]
                 promesa.exec/thread [[:inner 0]]
                 specify! [[:inner 0] [:inner 1]]}
 }
--- a/.gitignore
+++ b/.gitignore
@@ -48,6 +48,8 @@
 /deploy
 /docker/images/bundle*
 /exporter/target
+/frontend/.storybook/preview-body.html
+/frontend/.storybook/preview-head.html
 /frontend/cypress/fixtures/validuser.json
 /frontend/cypress/videos/*/
 /frontend/cypress/videos/*/
@@ -57,6 +59,7 @@
 /frontend/package-lock.json
 /frontend/resources/fonts/experiments
 /frontend/resources/public/*
+/frontend/storybook-static/
 /frontend/target/
 /other/
 /scripts/
@@ -67,4 +70,7 @@
 /web
 clj-profiler/
 node_modules
-frontend/.storybook/preview-body.html
+/test-results/
+/playwright-report/
+/blob-report/
+/playwright/.cache/
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,5 +1,198 @@
 # CHANGELOG

+## 2.2.0
+
+### :rocket: Epics and highlights
+
+### :boom: Breaking changes & Deprecations
+
+- Removed "merge assets" option when exporting ".svg + .json" files. After the components changes the option wasn't
+working properly and we're planning to change the format soon. We think it's better to deprecate the option for the
+time being.
+
+### :heart: Community contributions (Thank you!)
+
+- Set proper default tenant on exporter (by @june128) [#4946](https://github.com/penpot/penpot/pull/4946)
+- Correct a spelling in onboarding.edn (by @n-stha) [#4936](https://github.com/penpot/penpot/pull/4936)
+
+### :sparkles: New features
+
+- **Tiered File Data Storage** [Taiga #8376](https://tree.taiga.io/project/penpot/us/8376)
+
+  This feature allows offloading file data that is not actively used
+  from the database to object storage (e.g., filesystem, S3), thereby
+  freeing up space in the database. It can be enabled with the
+  `enable-enable-tiered-file-data-storage` flag.
+
+  *(On-Premise feature, EXPERIMENTAL).*
+
+- **JSON Interoperability for HTTP API** [Taiga #8372](https://tree.taiga.io/project/penpot/us/8372)
+
+  Enables full JSON interoperability for our HTTP API. Previously,
+  JSON was only barely supported for output when the
+  `application/json` media type was specified in the `Accept` header,
+  or when `_fmt=json` was passed as a query parameter. With this
+  update, we now offer proper bi-directional support for using our API
+  with plain JSON, instead of Transit.
+
+- **Automatic File Snapshotting**
+
+  Adds the ability to automatically take and maintain a limited set of
+  snapshots of active files without explicit user intervention. This
+  feature allows on-premise administrators to recover the state of a
+  file from a past point in time in a limited manner.
+
+  It can be enabled with the `enable-auto-file-snapshot` flag and
+  configured with the following settings:
+
+  ```bash
+  # Take snapshots every 10 update operations
+  PENPOT_AUTO_FILE_SNAPSHOT_EVERY=10
+
+  # Take a snapshot if it has been more than 3 hours since the file was last modified
+  PENPOT_AUTO_FILE_SNAPSHOT_TIMEOUT=3h
+
+  # The total number of snapshots to keep
+  PENPOT_AUTO_FILE_SNAPSHOT_TOTAL=10
+  ```
+
+  Snapshots are only taken during update operations; there is NO
+  active background process for this.
+
+- Add separated flag `enable-oidc-registration` for enable the
+  registration only for OIDC authentication backend [Github
+  #4882](https://github.com/penpot/penpot/issues/4882)
+
+- Update templates in libraries & templates in dashboard modal [Taiga #8145](https://tree.taiga.io/project/penpot/us/8145)
+
+- **Design System**
+
+  We implemented and subbed in new components from our Design System: `loader*` ([Taiga #8355](https://tree.taiga.io/project/penpot/task/8355))  and `tab-switcher*` ([Taiga #8518](https://tree.taiga.io/project/penpot/task/8518)).
+
+- **Storybook** [Taiga #6329](https://tree.taiga.io/project/penpot/us/6329)
+
+  The Design System components are now published in a Storybook, available at `/storybook`.
+
+### :bug: Bugs fixed
+
+- Fix webhook checkbox position [Taiga #8634](https://tree.taiga.io/project/penpot/issue/8634)
+- Fix wrong props on padding input [Taiga #8254](https://tree.taiga.io/project/penpot/issue/8254)
+- Fix fill collapsed options [Taiga #8351](https://tree.taiga.io/project/penpot/issue/8351)
+- Fix scroll on color picker modal [Taiga #8353](https://tree.taiga.io/project/penpot/issue/8353)
+- Fix components are not dragged from the group to the assets tab [Taiga #8273](https://tree.taiga.io/project/penpot/issue/8273)
+- Fix problem with SVG import [Github #4888](https://github.com/penpot/penpot/issues/4888)
+- Fix problem with overlay positions in viewer [Taiga #8464](https://tree.taiga.io/project/penpot/issue/8464)
+- Fix layer panel overflowing [Taiga #8665](https://tree.taiga.io/project/penpot/issue/8665)
+- Fix problem when creating a component instance from grid layout [Github #4881](https://github.com/penpot/penpot/issues/4881)
+- Fix problem when dismissing shared library update [Taiga #8669](https://tree.taiga.io/project/penpot/issue/8669)
+- Fix visual problem with stroke cap menu [Taiga #8730](https://tree.taiga.io/project/penpot/issue/8730)
+- Fix issue when exporting libraries when merging libraries [Taiga #8758](https://tree.taiga.io/project/penpot/issue/8758)
+- Fix problem with comments max length [Taiga #8778](https://tree.taiga.io/project/penpot/issue/8778)
+- Fix copy/paste images in Safari [Taiga #8771](https://tree.taiga.io/project/penpot/issue/8771)
+- Fix swap when the copy is the only child of a group [#5075](https://github.com/penpot/penpot/issues/5075)
+
+## 2.1.5
+
+### :bug: Bugs fixed
+
+- Fix broken webhooks [Taiga #8370](https://tree.taiga.io/project/penpot/issue/8370)
+
+## 2.1.4
+
+### :bug: Bugs fixed
+
+- Fix json encoding on zip encoding decoding.
+- Add schema validation for color changes.
+- Fix render of some texts without position data.
+
+## 2.1.3
+
+- Don't allow registration when registration is disabled and invitation token is used [Github #4975](https://github.com/penpot/penpot/issues/4975)
+
+## 2.1.2
+
+### :bug: Bugs fixed
+
+- User switch language to "zh_hant" will get 400 [Github #4884](https://github.com/penpot/penpot/issues/4884)
+- Smtp config ignoring port if ssl is set [Github #4872](https://github.com/penpot/penpot/issues/4872)
+- Ability to let users to authenticate with a private oidc provider only [Github #4963](https://github.com/penpot/penpot/issues/4963)
+
+## 2.1.1
+
+### :sparkles: New features
+
+- Consolidate templates new order and naming  [Taiga #8392](https://tree.taiga.io/project/penpot/task/8392)
+
+### :bug: Bugs fixed
+
+- Fix the “search” label in translations [Taiga #8402](https://tree.taiga.io/project/penpot/issue/8402)
+- Fix pencil loader [Taiga #8348](https://tree.taiga.io/project/penpot/issue/8348)
+- Fix several issues on the OIDC.
+- Fix regression on the `email-verification` flag [Taiga #8398](https://tree.taiga.io/project/penpot/issue/8398)
+
+## 2.1.0 - Things can only get better!
+
+### :rocket: Epics and highlights
+
+### :boom: Breaking changes & Deprecations
+
+### :heart: Community contributions (Thank you!)
+
+### :sparkles: New features
+
+- Improve auth process [Taiga #7094](https://tree.taiga.io/project/penpot/us/7094)
+- Add locking degrees increment (hold shift) on path edition [Taiga #7761](https://tree.taiga.io/project/penpot/issue/7761)
+- Persistence & Concurrent Edition Enhancements [Taiga #5657](https://tree.taiga.io/project/penpot/us/5657)
+- Allow library colors as recent colors [Taiga #7640](https://tree.taiga.io/project/penpot/issue/7640)
+- Missing scroll in viewmode comments [Taiga #7427](https://tree.taiga.io/project/penpot/issue/7427)
+- Comments in View mode should mimic the positioning behavior of the Workspace [Taiga #7346](https://tree.taiga.io/project/penpot/issue/7346)
+- Misaligned input on comments [Taiga #7461](https://tree.taiga.io/project/penpot/issue/7461)
+
+### :bug: Bugs fixed
+
+- Fix selection rectangle appears on scroll [Taiga #7525](https://tree.taiga.io/project/penpot/issue/7525)
+- Fix layer tree not expanding to the bottom edge [Taiga #7466](https://tree.taiga.io/project/penpot/issue/7466)
+- Fix guides move when board is moved by inputs [Taiga #8010](https://tree.taiga.io/project/penpot/issue/8010)
+- Fix clickable area of Penptot logo in the viewer [Taiga #7988](https://tree.taiga.io/project/penpot/issue/7988)
+- Fix constraints dropdown when selecting multiple shapes [Taiga #7686](https://tree.taiga.io/project/penpot/issue/7686)
+- Layout and scrollign fixes for the bottom palette [Taiga #7559](https://tree.taiga.io/project/penpot/issue/7559)
+- Fix expand libraries when search results are present [Taiga #7876](https://tree.taiga.io/project/penpot/issue/7876)
+- Fix color palette default library [Taiga #8029](https://tree.taiga.io/project/penpot/issue/8029)
+- Component Library is lost after exporting/importing in .zip format [Github #4672](https://github.com/penpot/penpot/issues/4672)
+- Fix problem with moving+selection not working properly [Taiga #7943](https://tree.taiga.io/project/penpot/issue/7943)
+- Fix problem with flex layout fit to content not positioning correctly children [Taiga #7537](https://tree.taiga.io/project/penpot/issue/7537)
+- Fix black line is displaying after show main [Taiga #7653](https://tree.taiga.io/project/penpot/issue/7653)
+- Fix "Share prototypes" modal remains open [Taiga #7442](https://tree.taiga.io/project/penpot/issue/7442)
+- Fix "Components visibility and opacity" [#4694](https://github.com/penpot/penpot/issues/4694)
+- Fix "Attribute overrides in copies are not exported in zip file" [Taiga #8072](https://tree.taiga.io/project/penpot/issue/8072)
+- Fix group not automatically selected in the Layers panel after creation [Taiga #8078](https://tree.taiga.io/project/penpot/issue/8078)
+- Fix export boards loses opacity [Taiga #7592](https://tree.taiga.io/project/penpot/issue/7592)
+- Fix change color on imported svg also changes the stroke alignment[Taiga #7673](https://github.com/penpot/penpot/pull/7673)
+- Fix show in view mode and interactions workflow [Taiga #4711](https://github.com/penpot/penpot/pull/4711)
+- Fix internal error when I set up a stroke for some objects without and with stroke [Taiga #7558](https://tree.taiga.io/project/penpot/issue/7558)
+- Toolbar keeps toggling on and off on spacebar press [Taiga #7654](https://github.com/penpot/penpot/pull/7654)
+- Fix toolbar keeps hiding when click outside workspace [Taiga #7776](https://tree.taiga.io/project/penpot/issue/7776)
+- Fix open overlay relative to a frame [Taiga #7563](https://tree.taiga.io/project/penpot/issue/7563)
+- Workspace-palette items stay hidden when opening with keyboard-shortcut [Taiga #7489](https://tree.taiga.io/project/penpot/issue/7489)
+- Fix SVG attrs are not handled correctly when exporting/importing in .zip [Taiga #7920](https://tree.taiga.io/project/penpot/issue/7920)
+- Fix validation error when detaching with two nested copies and a swap [Taiga #8095](https://tree.taiga.io/project/penpot/issue/8095)
+- Export shapes that are rotated act a bit strange when reimported [Taiga #7585](https://tree.taiga.io/project/penpot/issue/7585)
+- Penpot crashes when a new colorpicker is created while uploading an image to another instance [Taiga #8119](https://tree.taiga.io/project/penpot/issue/8119)
+- Removing Underline and Strikethrough Affects the Previous Text Object [Taiga #8103](https://tree.taiga.io/project/penpot/issue/8103)
+- Color library loses association with shapes when exporting/importing the document [Taiga #8132](https://tree.taiga.io/project/penpot/issue/8132)
+- Fix can't collapse groups when searching in the assets tab [Taiga #8125](https://tree.taiga.io/project/penpot/issue/8125)
+- Fix 'Detach instance' shortcut is not working [Taiga #8102](https://tree.taiga.io/project/penpot/issue/8102)
+- Fix import file message does not detect 0 as error [Taiga #6824](https://tree.taiga.io/project/penpot/issue/6824)
+- Image Color Library is not persisted when exporting/importing in .zip [Taiga #8131](https://tree.taiga.io/project/penpot/issue/8131)
+- Fix export files including libraries [Taiga #8266](https://tree.taiga.io/project/penpot/issue/8266)
+
+## 2.0.3
+
+### :bug: Bugs fixed
+
+- Fix chrome scrollbar styling [Taiga #7852](https://tree.taiga.io/project/penpot/issue/7852)
+- Fix incorrect password encoding on create-profile manage scritp [Github #3651](https://github.com/penpot/penpot/issues/3651)
+
 ## 2.0.2

 ### :sparkles: Enhancements
@@ -7,6 +200,11 @@
 - Fix locking contention on cron subsystem (causes backend start blocking)
 - Fix locking contention on file object thumbails backend RPC calls

+### :bug: Bugs fixed
+
+- Fix color palette sorting [Taiga #7458](https://tree.taiga.io/project/penpot/issue/7458)
+- Fix style scoping problem with imported SVG [Taiga #7671](https://tree.taiga.io/project/penpot/issue/7671)
+

 ## 2.0.1

@@ -14,6 +212,7 @@

 - Fix different issues related to components v2 migrations including [Github #4443](https://github.com/penpot/penpot/issues/4443)

+
 ## 2.0.0 - I Just Can't Get Enough

 ### :rocket: Epics and highlights
@@ -28,6 +227,8 @@
 ### :boom: Breaking changes & Deprecations

 - New strokes default to inside border [Taiga #6847](https://tree.taiga.io/project/penpot/issue/6847)
+- Change default z ordering on layers in flex layout. The previous behavior was inconsistent with how HTML works and we changed it to be more consistent. Previous layers that overlapped could be hidden, the fastest way to fix this is changing the z-index property but a better way is to change the order of your layers.
+

 ### :heart: Community contributions (Thank you!)
 - New Hausa, Yoruba and Igbo translations and  update translation files (by All For Tech Empowerment Foundation) [Taiga #6950](https://tree.taiga.io/project/penpot/us/6950), [Taiga #6534](https://tree.taiga.io/project/penpot/us/6534)
@@ -105,7 +306,7 @@
 - [REDESIGN] Panels visual separations [Taiga #6692](https://tree.taiga.io/project/penpot/us/6692)
 - [REDESIGN] Onboarding slides [Taiga #6678](https://tree.taiga.io/project/penpot/us/6678)

-### :bug Bugs fixed
+### :bug: Bugs fixed
 - Fix pixelated thumbnails [Github #3681](https://github.com/penpot/penpot/issues/3681), [Github #3661](https://github.com/penpot/penpot/issues/3661)
 - Fix problem with not applying colors to boards [Github #3941](https://github.com/penpot/penpot/issues/3941)
 - Fix problem with path editor undoing changes [Github #3998](https://github.com/penpot/penpot/issues/3998)
@@ -146,7 +347,7 @@
 - Fix problem when changing typography assets [Github #3683](https://github.com/penpot/penpot/issues/3683)
 - Internal error when you copy and paste some main components between files [Taiga #7397](https://tree.taiga.io/project/penpot/issue/7397)
 - Fix toolbar disappearing [Taiga #7411](https://tree.taiga.io/project/penpot/issue/7411)
- Fix long text on tab breaks UI [Taiga Issue #7421](https://tree.taiga.io/project/penpot/issue/7421)
+- Fix long text on tab breaks UI [Taiga #7421](https://tree.taiga.io/project/penpot/issue/7421)

 ## 1.19.5

--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -48,7 +48,7 @@ quick win.
 If is going to be your first pull request, You can learn how from this
 free video series:

-https://egghead.io/series/how-to-contribute-to-an-open-source-project-on-github
+https://egghead.io/courses/how-to-contribute-to-an-open-source-project-on-github

 We will use the `easy fix` mark for tag for indicate issues that are
 easy for beginners.
--- a/README.md
+++ b/README.md
@@ -2,10 +2,11 @@
 [uri_license]: https://www.mozilla.org/en-US/MPL/2.0
 [uri_license_image]: https://img.shields.io/badge/MPL-2.0-blue.svg

-<h1 align="center">
-  <br>
-  <img src="https://penpot.app/images/readme/git-readme-header.png" alt="PENPOT">
-</h1>
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://penpot.app/images/readme/github-dark-mode.png">
+  <source media="(prefers-color-scheme: light)" srcset="https://penpot.app/images/readme/github-light-mode.png">
+  <img alt="penpot header image" src="https://penpot.app/images/readme/github-light-mode.png">
+</picture>

 <p align="center"><a href="https://www.mozilla.org/en-US/MPL/2.0" rel="nofollow"><img src="https://camo.githubusercontent.com/3fcf3d6b678ea15fde3cf7d6af0e242160366282d62a7c182d83a50bfee3f45e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4d504c2d322e302d626c75652e737667" alt="License: MPL-2.0" data-canonical-src="https://img.shields.io/badge/MPL-2.0-blue.svg" style="max-width:100%;"></a>
 <a href="https://gitter.im/penpot/community" rel="nofollow"><img src="https://camo.githubusercontent.com/5b0aecb33434f82a7b158eab7247544235ada0cf7eeb9ce8e52562dd67f614b7/68747470733a2f2f6261646765732e6769747465722e696d2f736572656e6f2d78797a2f636f6d6d756e6974792e737667" alt="Gitter" data-canonical-src="https://badges.gitter.im/sereno-xyz/community.svg" style="max-width:100%;"></a>
@@ -13,75 +14,89 @@
 <a href="https://gitpod.io/#https://github.com/penpot/penpot" rel="nofollow"><img src="https://camo.githubusercontent.com/daadb4894128d1e19b72d80236f5959f1f2b47f9fe081373f3246131f0189f6c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f476974706f642d72656164792d2d746f2d2d636f64652d626c75653f6c6f676f3d676974706f64" alt="Gitpod ready-to-code" data-canonical-src="https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod" style="max-width:100%;"></a></p>

 <p align="center">
-    <a href="https://penpot.app/"><b>Website</b></a> •
-    <a href="https://help.penpot.app/technical-guide/getting-started/"><b>Getting Started</b></a> •
-    <a href="https://help.penpot.app/user-guide/"><b>User Guide</b></a> •
-    <a href="https://help.penpot.app/user-guide/introduction/info/"><b>Tutorials & Info</b></a> •
-    <a href="https://community.penpot.app/"><b>Community</b></a> •
-    <a href="https://twitter.com/penpotapp"><b>Twitter</b></a> •
-    <a href="https://instagram.com/penpot.app"><b>Instagram</b></a> •
-    <a href="https://fosstodon.org/@penpot/"><b>Mastodon</b></a> •
-    <a href="https://www.youtube.com/channel/UCAqS8G72uv9P5HG1IfgnQ9g"><b>Youtube</b></a>
+    <a href="https://penpot.app/"><b>Website</b></a>  •  
+    <a href="https://help.penpot.app/technical-guide/getting-started/"><b>Getting Started</b></a>  •  
+    <a href="https://help.penpot.app/user-guide/"><b>User Guide</b></a>  •  
+    <a href="https://help.penpot.app/user-guide/introduction/info/"><b>Tutorials & Info</b></a>  •  
+    <a href="https://community.penpot.app/"><b>Community</b></a>
+</p>
+<p align="center">
+    <a href="https://www.youtube.com/@Penpot"><b>Youtube</b></a>  •  
+    <a href="https://peertube.kaleidos.net/a/penpot_app/video-channels"><b>Peertube</b></a>  •  
+    <a href="https://www.linkedin.com/company/penpot/"><b>Linkedin</b></a>  •  
+    <a href="https://instagram.com/penpot.app"><b>Instagram</b></a>  •  
+    <a href="https://fosstodon.org/@penpot/"><b>Mastodon</b></a>  •  
+    <a href="https://twitter.com/penpotapp"><b>X</b></a>
+
 </p>

-![feature-readme](https://user-images.githubusercontent.com/1045247/189871786-0b44f7cf-3a0a-4445-a87b-9919ec398bf7.gif)
+<br />

-🎇 **Penpot Fest exceeded all expectations - it was a complete success!** 🎇 Penpot Fest is our first Design event that brought designers and developers from the Open Source communities and beyond. Watch the replay of the talks on our [Youtube channel](https://www.youtube.com/playlist?list=PLgcCPfOv5v56-fghJo2dHNBqL9zlDTslh) or [Peertube channel](https://peertube.kaleidos.net/w/p/1tWgyJTt8sKbWwCEcBimZW)
+[Penpot video](https://github.com/penpot/penpot/assets/5446186/b8ad0764-585e-4ddc-b098-9b4090d337cc)

-Penpot is the first **Open Source** design and prototyping platform meant for cross-domain teams. Non dependent on operating systems, Penpot is web based and works with open standards (SVG). Penpot invites designers all over the world to fall in love with open source while getting developers excited about the design process in return.
+<br />
+
+Penpot is the first **open-source** design tool for design and code collaboration. Designers can create stunning designs, interactive prototypes, design systems at scale, while developers enjoy ready-to-use code and make their workflow easy and fast. And all of this with no handoff drama.
+
+Penpot is available on browser and [self host](https://penpot.app/self-host). It’s web-based and works with open standards (SVG, CSS and HTML). And last but not least, it’s free! 
+
+Penpot’s latest [huge release 2.0](https://penpot.app/dev-diaries), takes the platform to a whole new level. This update introduces the ground-breaking [CSS Grid Layout feature](https://penpot.app/penpot-2.0), a complete UI redesign, a new Components system, and much more. Plus, it's faster and more accessible. 
+
+
+🎇 **Penpot Fest** is our design, code & Open Source event. Check out the highlights from [Penpot Fest 2023 edition](https://www.youtube.com/watch?v=sOpLZaK5mDc)!

 ## Table of contents ##

 - [Why Penpot](#why-penpot)
 - [Getting Started](#getting-started)
 - [Community](#community)
+- [Contributing](#contributing)
 - [Resources](#resources)
 - [License](#license)

 ## Why Penpot ##

-Penpot makes design and prototyping accessible to every team in the world.
+Penpot expresses designs as code. Designers can do their best work and see it will be beautifully implemented by developers in a two-way collaboration.

-### For cross-domain teams ###
-We have a clear focus on design and code teams and our capabilities reflect exactly that. The less hand-off mindset, the more fun for everyone.
+### Designed for developers ###
+Penpot was built to serve both designers and developers and create a fluid design-code process. You have the choice to enjoy real-time collaboration or play "solo".

-### Multiplatform ###
-Being web based, Penpot is not dependent on operating systems or local installations, you will only need to run a modern browser.
+### Inspect mode ###
+Work with ready-to-use code and make your workflow easy and fast. The inspect tab gives instant access to SVG, CSS and HTML code.

-### Open Standards ###
-Using SVG as no other design and prototyping tool does, Penpot files sport compatibility with most of the vectorial tools, are tech friendly and extremely easy to use on the web. We make sure you will always own your work.
+### Self host your own instance ###
+Provide your team or organization with a completely owned collaborative design tool. Use Penpot's cloud service or deploy your own Penpot server.
+
+### Integrations ###
+Penpot offers integration into the development toolchain, thanks to its support for webhooks and an API accessible through access tokens.
+
+### What’s great for design ###
+With Penpot you can design libraries to share and reuse; turn design elements into components and tokens to allow reusability and scalability; and build realistic user flows and interactions.
+
+<br />

 <p align="center">
-  <img src="https://penpot.app/images/readme/git-open.png" alt="Open Source" style="width: 65%;">
+  <img src="https://img.plasmic.app/img-optimizer/v1/img?src=https%3A%2F%2Fimg.plasmic.app%2Fimg-optimizer%2Fv1%2Fimg%2F9dd677c36afb477e9666ccd1d3f009ad.png" alt="Open Source" style="width: 65%;">
 </p>

+<br />

 ## Getting started ##

 ### Install with Elestio ###
-[Elestio](https://elest.io/) offers a fully managed service for on-premise instances of a selection of open-source software! This means you can deploy a dedicated instance of Penpot in just 3 minutes with no technical knowledge needed.
+Penpot is the only design & prototype platform that is deployment agnostic. You can use it or deploy it anywhere.

-You don’t need to worry about DNS configuration, SMTP, backups, SSL certificates, OS & Penpot upgrades, and much more.
-
-[Get started with Elestio.](https://help.penpot.app/technical-guide/getting-started/#install-with-elestio)
-
-### Install with Docker ###
-
-You can also get started with Penpot locally or self-host it with **docker** and **docker-compose**.
-
-Here’s a step-by-step guide on [getting started with Docker.](https://help.penpot.app/technical-guide/getting-started/#install-with-docker)
-
-### Penpot cloud app ###
-
-If you prefer not to install Penpot in a local environment, [login or register on our Penpot cloud app](https://design.penpot.app). Create a team to work together on projects and share design assets or jump right away into Penpot and **start designing** on your own.
+Learn how to install it with Elestio and Docker, or other options on [our website](https://penpot.app/self-host).
+<br />

 <p align="center">
-  <img src="https://penpot.app/images/readme/git-self-host.png" alt="Getting started" style="width: 65%;">
+  <img src="https://site-assets.plasmic.app/2168cf524dd543caeff32384eb9ea0a1.svg" alt="Open Source" style="width: 65%;">
 </p>
+<br />

 ## Community ##

-We love the open source software community. Contributing is our passion and if it’s yours too, [participate](https://community.penpot.app/) and [improve](https://community.penpot.app/c/help-us-improve-penpot/7) Penpot. All your ideas and code are welcome!
+We love the Open Source software community. Contributing is our passion and if it’s yours too, participate and [improve](https://community.penpot.app/c/help-us-improve-penpot/7) Penpot. All your designs, code and ideas are welcome!

 If you need help or have any questions; if you’d like to share your experience using Penpot or get inspired; if you’d rather meet our community of developers and designers, [join our Community](https://community.penpot.app/)!

@@ -93,30 +108,41 @@ You will find the following categories:
 - [Events and Announcements](https://community.penpot.app/c/announcements/5)
 - [Inside Penpot](https://community.penpot.app/c/inside-penpot/21)
 - [Penpot in your language](https://community.penpot.app/c/penpot-in-your-language/12)
+- [Design and Code Essentials](https://community.penpot.app/c/design-and-code-essentials/22)
+
+
+<br />

 <p align="center">
-  <img src="https://penpot.app/images/readme/git-collaborate.png" alt="Communnity" style="width: 65%;">
+  <img src="https://github.com/penpot/penpot/assets/5446186/6ac62220-a16c-46c9-ab21-d24ae357ed03" alt="Community" style="width: 65%;">
 </p>
+<br />

 ## Contributing ##

-Every sort of contribution will be very helpful to enhance Penpot. How you’ll participate? All your ideas, designs and code are welcome:
+Any contribution will make a difference to improve Penpot. How can you get involved? 

+Choose your way: 
+
+- Create and [share Libraries & Templates](https://penpot.app/libraries-templates.html) that will be helpful for the community
 - Invite your [team to join](https://design.penpot.app/#/auth/register)
- Star this repo and follow us on Social Media:  [Twitter](https://twitter.com/penpotapp), [Instagram](https://instagram.com/penpot.app), [Youtube](https://www.youtube.com/c/Penpot) or [Mastodon](https://fosstodon.org/@penpot/).
- Participate in the [Community](https://community.penpot.app/) asking and answering questions, reacting to others’ articles or opening your own conversations.
+- Star this repo and follow us on Social Media: [Mastodon](https://fosstodon.org/@penpot/), [Youtube](https://www.youtube.com/c/Penpot), [Instagram](https://instagram.com/penpot.app), [Linkedin](https://www.linkedin.com/company/penpotdesign),  [Peertube](https://peertube.kaleidos.net/a/penpot_app) and [X](https://twitter.com/penpotapp).
+- Participate in the [Community](https://community.penpot.app/) space by asking and answering questions; reacting to others’ articles;  opening your own conversations and following along on decisions affecting the project.
 - Report bugs with our easy [guide for bugs hunting](https://help.penpot.app/contributing-guide/reporting-bugs/) or [GitHub issues](https://github.com/penpot/penpot/issues)
- Create and [share Libraries & templates](https://penpot.app/libraries-templates.html) that will be helpful for the community
 - Become a [translator](https://help.penpot.app/contributing-guide/translations)
- Give feedback: [Mail us](mailto:support@penpot.app)
+- Give feedback: [Email us](mailto:support@penpot.app)
 - **Contribute to Penpot's code:** [Watch this video](https://www.youtube.com/watch?v=TpN0osiY-8k) by Alejandro Alonso, CIO and developer at Penpot, where he gives us a hands-on demo of how to use Penpot’s repository and make changes in both front and back end

-To find (almost) everything you need to know on how to contribute to Penpot, refer to the [contributing-guide](https://help.penpot.app/contributing-guide/).
+To find (almost) everything you need to know on how to contribute to Penpot, refer to the [contributing guide](https://help.penpot.app/contributing-guide/).
+
+<br />

 <p align="center">
-  <img src="https://penpot.app/images/readme/git-community.png" alt="Contributing" style="width: 65%;">
+  <img src="https://github.com/penpot/penpot/assets/5446186/fea18923-dc06-49be-86ad-c3496a7956e6" alt="Libraries and templates" style="width: 65%;">
 </p>

+<br />
+
 ## Resources ##

 You can ask and answer questions, have open-ended conversations, and follow along on decisions affecting the project.
@@ -141,4 +167,4 @@ file, You can obtain one at http://mozilla.org/MPL/2.0/.

 Copyright (c) KALEIDOS INC
 ```
-Penpot is a Kaleidos’ [open source project](https://kaleidos.net/products)
+Penpot is a Kaleidos’ [open source project](https://kaleidos.net/)
--- a/THANKYOU.md
+++ b/THANKYOU.md
@@ -2,12 +2,19 @@

 We want to thank to the amazing people that help us! Thank you! You're the best!

+Feel free you make a PR updating this file if you miss you in the
+list.
+
 ## Security
+
 * Husnain Iqbal (CEO OF ALPHA INFERNO PVT LTD)
 * [Shiraz Ali Khan](https://www.linkedin.com/in/shiraz-ali-khan-1ba508180/)
 * Vaibhav Shukla
+* Hassan Ahmed (Alias Xen Lee)
+* Michal Biesiada (@mbiesiad)

 ## Internationalization
+
 * [00ff88](https://hosted.weblate.org/user/00ff88)
 * [AhmadHB](https://hosted.weblate.org/user/AhmadHB)
 * [Aimee](https://hosted.weblate.org/user/Aimee)
@@ -89,6 +96,7 @@ We want to thank to the amazing people that help us! Thank you! You're the best!
 * [zcraber](https://hosted.weblate.org/user/zcraber)

 ## Libraries & templates
+
 * systxema
 * plumilla
 * victor crespo
--- a/backend/deps.edn
+++ b/backend/deps.edn
@@ -3,10 +3,10 @@

 :deps
 {penpot/common {:local/root "../common"}
-  org.clojure/clojure {:mvn/version "1.12.0-alpha5"}
-  org.clojure/tools.namespace {:mvn/version "1.4.4"}
+  org.clojure/clojure {:mvn/version "1.12.0-alpha12"}
+  org.clojure/tools.namespace {:mvn/version "1.5.0"}

-  com.github.luben/zstd-jni {:mvn/version "1.5.5-11"}
+  com.github.luben/zstd-jni {:mvn/version "1.5.6-3"}

  io.prometheus/simpleclient {:mvn/version "0.16.0"}
  io.prometheus/simpleclient_hotspot {:mvn/version "0.16.0"}
@@ -17,7 +17,7 @@

  io.prometheus/simpleclient_httpserver {:mvn/version "0.16.0"}

-  io.lettuce/lettuce-core {:mvn/version "6.3.0.RELEASE"}
+  io.lettuce/lettuce-core {:mvn/version "6.3.2.RELEASE"}
  java-http-clj/java-http-clj {:mvn/version "0.4.3"}

  funcool/yetti
@@ -26,13 +26,13 @@
   :git/url "https://github.com/funcool/yetti.git"
   :exclusions [org.slf4j/slf4j-api]}

-  com.github.seancorfield/next.jdbc {:mvn/version "1.3.909"}
-  metosin/reitit-core {:mvn/version "0.6.0"}
-  nrepl/nrepl {:mvn/version "1.1.0"}
-  cider/cider-nrepl {:mvn/version "0.44.0"}
+  com.github.seancorfield/next.jdbc {:mvn/version "1.3.939"}
+  metosin/reitit-core {:mvn/version "0.7.0"}
+  nrepl/nrepl {:mvn/version "1.1.2"}
+  cider/cider-nrepl {:mvn/version "0.48.0"}

-  org.postgresql/postgresql {:mvn/version "42.7.1"}
-  org.xerial/sqlite-jdbc {:mvn/version "3.44.1.0"}
+  org.postgresql/postgresql {:mvn/version "42.7.3"}
+  org.xerial/sqlite-jdbc {:mvn/version "3.46.0.0"}

  com.zaxxer/HikariCP {:mvn/version "5.1.0"}

@@ -54,11 +54,11 @@
  org.clojars.pntblnk/clj-ldap {:mvn/version "0.0.17"}

  dawran6/emoji {:mvn/version "0.1.5"}
-  markdown-clj/markdown-clj {:mvn/version "1.11.7"}
+  markdown-clj/markdown-clj {:mvn/version "1.12.1"}

  ;; Pretty Print specs
  pretty-spec/pretty-spec {:mvn/version "0.1.4"}
-  software.amazon.awssdk/s3 {:mvn/version "2.22.12"}
+  software.amazon.awssdk/s3 {:mvn/version "2.25.63"}
  }

 :paths ["src" "resources" "target/classes"]
@@ -74,16 +74,13 @@

  :build
  {:extra-deps
-   {io.github.clojure/tools.build {:git/tag "v0.9.5" :git/sha "24f2894"}}
+   {io.github.clojure/tools.build {:git/tag "v0.10.3" :git/sha "15ead66"}}
   :ns-default build}

  :test
-  {:extra-paths ["test"]
-   :extra-deps
-   {io.github.cognitect-labs/test-runner
-    {:git/tag "v0.5.1" :git/sha "dfb30dd"}}
-   :main-opts ["-m" "cognitect.test-runner"]
-   :exec-fn cognitect.test-runner.api/test}
+  {:main-opts ["-m" "kaocha.runner"]
+   :jvm-opts ["-Dlog4j2.configurationFile=log4j2-devenv-repl.xml"]
+   :extra-deps {lambdaisland/kaocha {:mvn/version "1.91.1392"}}}

  :outdated
  {:extra-deps {com.github.liquidz/antq {:mvn/version "RELEASE"}}
--- a/backend/dev/user.clj
+++ b/backend/dev/user.clj
@@ -20,6 +20,7 @@
   [app.common.schema.desc-native :as smdn]
   [app.common.schema.generators :as sg]
   [app.common.spec :as us]
+   [app.common.json :as json]
   [app.common.transit :as t]
   [app.common.types.file :as ctf]
   [app.common.uuid :as uuid]
@@ -29,7 +30,6 @@
   [app.srepl.helpers :as srepl.helpers]
   [app.srepl.main :as srepl]
   [app.util.blob :as blob]
-   [app.util.json :as json]
   [app.util.time :as dt]
   [clj-async-profiler.core :as prof]
   [clojure.contrib.humanize :as hum]
--- a/backend/package.json
+++ b/backend/package.json
@@ -4,19 +4,19 @@
  "license": "MPL-2.0",
  "author": "Kaleidos INC",
  "private": true,
-  "packageManager": "yarn@4.0.2",
+  "packageManager": "yarn@4.3.1",
  "repository": {
    "type": "git",
    "url": "https://github.com/penpot/penpot"
  },
  "dependencies": {
-    "luxon": "^3.4.2",
-    "sax": "^1.2.4"
+    "luxon": "^3.4.4",
+    "sax": "^1.4.1"
  },
  "devDependencies": {
-    "nodemon": "^3.0.1",
+    "nodemon": "^3.1.2",
    "source-map-support": "^0.5.21",
-    "ws": "^8.13.0"
+    "ws": "^8.17.0"
  },
  "scripts": {
    "fmt:clj:check": "cljfmt check --parallel=false src/ test/",
--- a/backend/resources/app/email/change-email/en.html
+++ b/backend/resources/app/email/change-email/en.html
@@ -168,7 +168,7 @@
                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
                  <tr>
                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">Hello {{name}}!</div>
+                      <div style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">Hello {{name|abbreviate:25}}!</div>
                    </td>
                  </tr>
                  <tr>
@@ -475,4 +475,4 @@
  </div>
 </body>

-</html>
+</html>
--- a/backend/resources/app/email/change-email/en.txt
+++ b/backend/resources/app/email/change-email/en.txt
@@ -1,4 +1,4 @@
-Hello {{name}}!
+Hello {{name|abbreviate:25}}!

 We received a request to change your current email to {{ pending-email }}.

--- a/backend/resources/app/email/feedback/en.html
+++ b/backend/resources/app/email/feedback/en.html
@@ -11,7 +11,7 @@
      {% if profile %}
        <span>
          <span>Name: </span>
-          <span><code>{{profile.fullname}}</code></span>
+          <span><code>{{profile.fullname|abbreviate:25}}</code></span>
        </span>
        <br />

@@ -34,7 +34,7 @@
    </p>
    <p>
      <strong>Subject:</strong><br />
-      <span>{{subject}}</span>
+      <span>{{subject|abbreviate:300}}</span>
    </p>

    <p>
--- a/backend/resources/app/email/invite-to-team/en.html
+++ b/backend/resources/app/email/invite-to-team/en.html
@@ -173,7 +173,7 @@
                  </tr>
                  <tr>
                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">{{invited-by}} has invited you to join the team “{{ team }}”.</div>
+                      <div style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">{{invited-by|abbreviate:25}} has invited you to join the team “{{ team|abbreviate:25 }}”.</div>
                    </td>
                  </tr>
                  <tr>
@@ -465,4 +465,4 @@
  </div>
 </body>

-</html>
+</html>
--- a/backend/resources/app/email/invite-to-team/en.txt
+++ b/backend/resources/app/email/invite-to-team/en.txt
@@ -1,6 +1,6 @@
 Hello!

-{{invited-by}} has invited you to join the team “{{ team }}”.
+{{invited-by|abbreviate:25}} has invited you to join the team “{{ team|abbreviate:25 }}”.

 Accept invitation using this link:

--- a/backend/resources/app/email/join-team/en.html
+++ b/backend/resources/app/email/join-team/en.html
@@ -0,0 +1,518 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml"
+  xmlns:o="urn:schemas-microsoft-com:office:office">
+
+<head>
+  <title>
+  </title>
+  <!--[if !mso]><!-- -->
+  <meta http-equiv="X-UA-Compatible" content="IE=edge">
+  <!--<![endif]-->
+  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <style type="text/css">
+    #outlook a {
+      padding: 0;
+    }
+
+    body {
+      margin: 0;
+      padding: 0;
+      -webkit-text-size-adjust: 100%;
+      -ms-text-size-adjust: 100%;
+    }
+
+    table,
+    td {
+      border-collapse: collapse;
+      mso-table-lspace: 0pt;
+      mso-table-rspace: 0pt;
+    }
+
+    img {
+      border: 0;
+      height: auto;
+      line-height: 100%;
+      outline: none;
+      text-decoration: none;
+      -ms-interpolation-mode: bicubic;
+    }
+
+    p {
+      display: block;
+      margin: 13px 0;
+    }
+  </style>
+  <!--[if mso]>
+        <xml>
+        <o:OfficeDocumentSettings>
+          <o:AllowPNG/>
+          <o:PixelsPerInch>96</o:PixelsPerInch>
+        </o:OfficeDocumentSettings>
+        </xml>
+        <![endif]-->
+  <!--[if lte mso 11]>
+        <style type="text/css">
+          .mj-outlook-group-fix { width:100% !important; }
+        </style>
+        <![endif]-->
+  <!--[if !mso]><!-->
+  <link href="https://fonts.googleapis.com/css?family=Source%20Sans%20Pro" rel="stylesheet" type="text/css">
+  <style type="text/css">
+    @import url(https://fonts.googleapis.com/css?family=Source%20Sans%20Pro);
+  </style>
+  <!--<![endif]-->
+  <style type="text/css">
+    @media only screen and (min-width:480px) {
+      .mj-column-per-100 {
+        width: 100% !important;
+        max-width: 100%;
+      }
+
+      .mj-column-px-425 {
+        width: 425px !important;
+        max-width: 425px;
+      }
+    }
+  </style>
+  <style type="text/css">
+    @media only screen and (max-width:480px) {
+      table.mj-full-width-mobile {
+        width: 100% !important;
+      }
+
+      td.mj-full-width-mobile {
+        width: auto !important;
+      }
+    }
+  </style>
+</head>
+
+<body style="background-color:#E5E5E5;">
+  <div style="background-color:#E5E5E5;">
+    <!--[if mso | IE]>
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:16px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:collapse;border-spacing:0px;">
+                        <tbody>
+                          <tr>
+                            <td style="width:97px;">
+                              <img height="32" src="{{ public-uri }}/images/email/uxbox-title.png"
+                                style="border:0;display:block;outline:none;text-decoration:none;height:32px;width:100%;font-size:13px;"
+                                width="97" />
+                            </td>
+                          </tr>
+                        </tbody>
+                      </table>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="background:#FFFFFF;background-color:#FFFFFF;margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+        style="background:#FFFFFF;background-color:#FFFFFF;width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">
+                        Hello!</div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        As you requested, {{invited-by|abbreviate:25}} has added you to the team “{{
+                        team|abbreviate:25}}”.</div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="center" vertical-align="middle"
+                      style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:separate;line-height:100%;">
+                        <tr>
+                          <td align="center" bgcolor="#31EFB8" role="presentation"
+                            style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#31EFB8;"
+                            valign="middle">
+                            <a href="{{ public-uri }}/#/dashboard/team/{{team-id}}/projects"
+                              style="display:inline-block;background:#31EFB8;color:#1F1F1F;font-family:Source Sans Pro, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;"
+                              target="_blank"> Go to the Team </a>
+                          </td>
+                        </tr>
+                      </table>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        Enjoy!</div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        The Penpot team.</div>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:24px 0 0 0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:425px;"
+            >
+          <![endif]-->
+              <div class="mj-column-px-425 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:14px;line-height:150%;text-align:center;color:#64666A;">
+                        Penpot is the first Open Source design and prototyping platform meant for cross-domain teams.
+                      </div>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <!--[if mso | IE]>
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+      >
+        <tr>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://penpot.app/" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-uxbox.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://twitter.com/penpotapp" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-twitter.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://github.com/penpot/" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-github.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://www.instagram.com/penpot.app/" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-instagram.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://tree.taiga.io/project/penpot" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-taiga.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+          </tr>
+        </table>
+      <![endif]-->
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:0 0 24px 0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:14px;line-height:150%;text-align:center;color:#64666A;">
+                        Penpot | Made with &lt;3 and Open Source</div>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+      <![endif]-->
+  </div>
+</body>
+
+</html>
--- a/backend/resources/app/email/join-team/en.subj
+++ b/backend/resources/app/email/join-team/en.subj
@@ -0,0 +1 @@
+You have joined {{team}}
--- a/backend/resources/app/email/join-team/en.txt
+++ b/backend/resources/app/email/join-team/en.txt
@@ -0,0 +1,10 @@
+Hello!
+
+As you requested, {{invited-by|abbreviate:25}} has added you to the team “{{ team|abbreviate:25}}”.
+
+Go to the team with this link:
+
+{{ public-uri }}/#/dashboard/team/{{team-id}}
+
+Enjoy!
+The Penpot team.
--- a/backend/resources/app/email/password-recovery/en.html
+++ b/backend/resources/app/email/password-recovery/en.html
@@ -168,7 +168,7 @@
                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
                  <tr>
                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">Hello {{name}}!</div>
+                      <div style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">Hello {{name|abbreviate:25}}!</div>
                    </td>
                  </tr>
                  <tr>
@@ -470,4 +470,4 @@
  </div>
 </body>

-</html>
+</html>
--- a/backend/resources/app/email/password-recovery/en.txt
+++ b/backend/resources/app/email/password-recovery/en.txt
@@ -1,4 +1,4 @@
-Hello {{name}}!
+Hello {{name|abbreviate:25}}!

 We received a request to reset your password. Click the link below to choose a
 new one:
--- a/backend/resources/app/email/register/en.html
+++ b/backend/resources/app/email/register/en.html
@@ -168,7 +168,7 @@
                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
                  <tr>
                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">Hello {{name}}!</div>
+                      <div style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">Hello {{name|abbreviate:25}}!</div>
                    </td>
                  </tr>
                  <tr>
--- a/backend/resources/app/email/register/en.txt
+++ b/backend/resources/app/email/register/en.txt
@@ -1,4 +1,4 @@
-Hello {{name}}!
+Hello {{name|abbreviate:25}}!

 Thanks for signing up for your Penpot account! Please verify your email using the
 link below and get started building mockups and prototypes today!
--- a/backend/resources/app/email/request-file-access-yourpenpot-view/en.html
+++ b/backend/resources/app/email/request-file-access-yourpenpot-view/en.html
@@ -0,0 +1,528 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml"
+  xmlns:o="urn:schemas-microsoft-com:office:office">
+
+<head>
+  <title>
+  </title>
+  <!--[if !mso]><!-- -->
+  <meta http-equiv="X-UA-Compatible" content="IE=edge">
+  <!--<![endif]-->
+  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <style type="text/css">
+    #outlook a {
+      padding: 0;
+    }
+
+    body {
+      margin: 0;
+      padding: 0;
+      -webkit-text-size-adjust: 100%;
+      -ms-text-size-adjust: 100%;
+    }
+
+    table,
+    td {
+      border-collapse: collapse;
+      mso-table-lspace: 0pt;
+      mso-table-rspace: 0pt;
+    }
+
+    img {
+      border: 0;
+      height: auto;
+      line-height: 100%;
+      outline: none;
+      text-decoration: none;
+      -ms-interpolation-mode: bicubic;
+    }
+
+    p {
+      display: block;
+      margin: 13px 0;
+    }
+  </style>
+  <!--[if mso]>
+        <xml>
+        <o:OfficeDocumentSettings>
+          <o:AllowPNG/>
+          <o:PixelsPerInch>96</o:PixelsPerInch>
+        </o:OfficeDocumentSettings>
+        </xml>
+        <![endif]-->
+  <!--[if lte mso 11]>
+        <style type="text/css">
+          .mj-outlook-group-fix { width:100% !important; }
+        </style>
+        <![endif]-->
+  <!--[if !mso]><!-->
+  <link href="https://fonts.googleapis.com/css?family=Source%20Sans%20Pro" rel="stylesheet" type="text/css">
+  <style type="text/css">
+    @import url(https://fonts.googleapis.com/css?family=Source%20Sans%20Pro);
+  </style>
+  <!--<![endif]-->
+  <style type="text/css">
+    @media only screen and (min-width:480px) {
+      .mj-column-per-100 {
+        width: 100% !important;
+        max-width: 100%;
+      }
+
+      .mj-column-px-425 {
+        width: 425px !important;
+        max-width: 425px;
+      }
+    }
+  </style>
+  <style type="text/css">
+    @media only screen and (max-width:480px) {
+      table.mj-full-width-mobile {
+        width: 100% !important;
+      }
+
+      td.mj-full-width-mobile {
+        width: auto !important;
+      }
+    }
+  </style>
+</head>
+
+<body style="background-color:#E5E5E5;">
+  <div style="background-color:#E5E5E5;">
+    <!--[if mso | IE]>
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:16px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:collapse;border-spacing:0px;">
+                        <tbody>
+                          <tr>
+                            <td style="width:97px;">
+                              <img height="32" src="{{ public-uri }}/images/email/uxbox-title.png"
+                                style="border:0;display:block;outline:none;text-decoration:none;height:32px;width:100%;font-size:13px;"
+                                width="97" />
+                            </td>
+                          </tr>
+                        </tbody>
+                      </table>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="background:#FFFFFF;background-color:#FFFFFF;margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+        style="background:#FFFFFF;background-color:#FFFFFF;width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">
+                        Hello!</div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        <p>
+                          {{requested-by|abbreviate:25}} ({{requested-by-email}}) wants to have view-only access to the
+                          file named “{{file-name|abbreviate:25}}”.
+                        </p>
+                        <p>
+                          Since this file is in your Penpot team, you can provide access by sending a view-only link.
+                          This will allow {{requested-by|abbreviate:25}} to view the content without making any changes.
+                        </p>
+                        <p>To proceed, please click the button below to generate and send the view-only link:</p>
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="center" vertical-align="middle"
+                      style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:separate;line-height:100%">
+                        <tr>
+                          <td align="center" bgcolor="#31EFB8" role="presentation"
+                            style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#31EFB8;"
+                            valign="middle">
+                            <a href="{{ public-uri }}/#/view/{{file-id}}?page-id={{page-id}}&section=interactions&index=0&share=true"
+                              style="display:inline-block;background:#31EFB8;color:#1F1F1F;font-family:Source Sans Pro, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;"
+                              target="_blank"> Send a View-Only link </a>
+                          </td>
+                        </tr>
+                      </table>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        <p>If you do not wish to grant access at this time, you can simply disregard this email.</p>
+                        <p>Thank you</p>
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        The Penpot team.</div>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:24px 0 0 0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:425px;"
+            >
+          <![endif]-->
+              <div class="mj-column-px-425 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:14px;line-height:150%;text-align:center;color:#64666A;">
+                        Penpot is the first Open Source design and prototyping platform meant for cross-domain teams.
+                      </div>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <!--[if mso | IE]>
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+      >
+        <tr>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://penpot.app/" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-uxbox.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://twitter.com/penpotapp" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-twitter.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://github.com/penpot/" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-github.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://www.instagram.com/penpot.app/" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-instagram.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://tree.taiga.io/project/penpot" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-taiga.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+          </tr>
+        </table>
+      <![endif]-->
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:0 0 24px 0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:14px;line-height:150%;text-align:center;color:#64666A;">
+                        Penpot | Made with &lt;3 and Open Source</div>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+      <![endif]-->
+  </div>
+</body>
+
+</html>
--- a/backend/resources/app/email/request-file-access-yourpenpot-view/en.subj
+++ b/backend/resources/app/email/request-file-access-yourpenpot-view/en.subj
@@ -0,0 +1 @@
+Request View-Only Access to “{{file-name|abbreviate:25}}”
--- a/backend/resources/app/email/request-file-access-yourpenpot-view/en.txt
+++ b/backend/resources/app/email/request-file-access-yourpenpot-view/en.txt
@@ -0,0 +1,17 @@
+Hello!
+
+{{requested-by|abbreviate:25}} ({{requested-by-email}}) wants to have view-only access to the file named “{{file-name|abbreviate:25}}”.
+
+Since this file is in your Penpot team, you can provide access by sending a view-only link. This will allow {{requested-by|abbreviate:25}} to view the content without making any changes.
+
+To proceed, please click the link below to generate and send the view-only link:
+
+{{ public-uri }}/#/view/{{file-id}}?page-id={{page-id}}&section=interactions&index=0&share=true
+
+
+
+If you do not wish to grant access at this time, you can simply disregard this email.
+Thank you
+
+
+The Penpot team.
--- a/backend/resources/app/email/request-file-access-yourpenpot/en.html
+++ b/backend/resources/app/email/request-file-access-yourpenpot/en.html
@@ -0,0 +1,551 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml"
+  xmlns:o="urn:schemas-microsoft-com:office:office">
+
+<head>
+  <title>
+  </title>
+  <!--[if !mso]><!-- -->
+  <meta http-equiv="X-UA-Compatible" content="IE=edge">
+  <!--<![endif]-->
+  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <style type="text/css">
+    #outlook a {
+      padding: 0;
+    }
+
+    body {
+      margin: 0;
+      padding: 0;
+      -webkit-text-size-adjust: 100%;
+      -ms-text-size-adjust: 100%;
+    }
+
+    table,
+    td {
+      border-collapse: collapse;
+      mso-table-lspace: 0pt;
+      mso-table-rspace: 0pt;
+    }
+
+    img {
+      border: 0;
+      height: auto;
+      line-height: 100%;
+      outline: none;
+      text-decoration: none;
+      -ms-interpolation-mode: bicubic;
+    }
+
+    p {
+      display: block;
+      margin: 13px 0;
+    }
+  </style>
+  <!--[if mso]>
+        <xml>
+        <o:OfficeDocumentSettings>
+          <o:AllowPNG/>
+          <o:PixelsPerInch>96</o:PixelsPerInch>
+        </o:OfficeDocumentSettings>
+        </xml>
+        <![endif]-->
+  <!--[if lte mso 11]>
+        <style type="text/css">
+          .mj-outlook-group-fix { width:100% !important; }
+        </style>
+        <![endif]-->
+  <!--[if !mso]><!-->
+  <link href="https://fonts.googleapis.com/css?family=Source%20Sans%20Pro" rel="stylesheet" type="text/css">
+  <style type="text/css">
+    @import url(https://fonts.googleapis.com/css?family=Source%20Sans%20Pro);
+  </style>
+  <!--<![endif]-->
+  <style type="text/css">
+    @media only screen and (min-width:480px) {
+      .mj-column-per-100 {
+        width: 100% !important;
+        max-width: 100%;
+      }
+
+      .mj-column-px-425 {
+        width: 425px !important;
+        max-width: 425px;
+      }
+    }
+  </style>
+  <style type="text/css">
+    @media only screen and (max-width:480px) {
+      table.mj-full-width-mobile {
+        width: 100% !important;
+      }
+
+      td.mj-full-width-mobile {
+        width: auto !important;
+      }
+    }
+  </style>
+</head>
+
+<body style="background-color:#E5E5E5;">
+  <div style="background-color:#E5E5E5;">
+    <!--[if mso | IE]>
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:16px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:collapse;border-spacing:0px;">
+                        <tbody>
+                          <tr>
+                            <td style="width:97px;">
+                              <img height="32" src="{{ public-uri }}/images/email/uxbox-title.png"
+                                style="border:0;display:block;outline:none;text-decoration:none;height:32px;width:100%;font-size:13px;"
+                                width="97" />
+                            </td>
+                          </tr>
+                        </tbody>
+                      </table>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="background:#FFFFFF;background-color:#FFFFFF;margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+        style="background:#FFFFFF;background-color:#FFFFFF;width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">
+                        Hello!</div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        <p>
+                          {{requested-by|abbreviate:25}} ({{requested-by-email}}) has requested access to the file named
+                          “{{file-name|abbreviate:25}}”.
+                        </p>
+                        <p>
+                          Please note that the file is currently in Your Penpot 's team, so direct access cannot be
+                          granted. However, you have two options to provide the requested access:
+                        </p>
+                        <ul>
+                          <li>
+                            <p>Move the File to Another Team:</p>
+                            <p>You can move the file to another team and then give access to that team, inviting
+                              {{requested-by|abbreviate:25}}.</p>
+                          </li>
+                        </ul>
+                        </p>
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        <ul>
+                          <li>
+                            <p>Send a View-Only Link:</p>
+                            <p>Alternatively, you can create and share a view-only link to the file. This will allow
+                              {{requested-by|abbreviate:25}} to view the content without making any changes.</p>
+                            <p>Click the button below to generate and send the link:</p>
+                          </li>
+                        </ul>
+                        </p>
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="center" vertical-align="middle"
+                      style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:separate;line-height:100%">
+                        <tr>
+                          <td align="center" bgcolor="#31EFB8" role="presentation"
+                            style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#31EFB8;"
+                            valign="middle">
+                            <a href="{{ public-uri }}/#/view/{{file-id}}?page-id={{page-id}}&section=interactions&index=0&share=true"
+                              style="display:inline-block;background:#31EFB8;color:#1F1F1F;font-family:Source Sans Pro, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;"
+                              target="_blank"> Send a View-Only link </a>
+                          </td>
+                        </tr>
+                      </table>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        <p>If you do not wish to grant access at this time, you can simply disregard this email.</p>
+                        <p>Thank you</p>
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        The Penpot team.</div>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:24px 0 0 0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:425px;"
+            >
+          <![endif]-->
+              <div class="mj-column-px-425 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:14px;line-height:150%;text-align:center;color:#64666A;">
+                        Penpot is the first Open Source design and prototyping platform meant for cross-domain teams.
+                      </div>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <!--[if mso | IE]>
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+      >
+        <tr>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://penpot.app/" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-uxbox.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://twitter.com/penpotapp" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-twitter.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://github.com/penpot/" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-github.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://www.instagram.com/penpot.app/" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-instagram.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://tree.taiga.io/project/penpot" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-taiga.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+          </tr>
+        </table>
+      <![endif]-->
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:0 0 24px 0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:14px;line-height:150%;text-align:center;color:#64666A;">
+                        Penpot | Made with &lt;3 and Open Source</div>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+      <![endif]-->
+  </div>
+</body>
+
+</html>
--- a/backend/resources/app/email/request-file-access-yourpenpot/en.subj
+++ b/backend/resources/app/email/request-file-access-yourpenpot/en.subj
@@ -0,0 +1 @@
+Request Access to “{{file-name|abbreviate:25}}”
--- a/backend/resources/app/email/request-file-access-yourpenpot/en.txt
+++ b/backend/resources/app/email/request-file-access-yourpenpot/en.txt
@@ -0,0 +1,30 @@
+Hello!
+
+
+Hello!
+
+{{requested-by|abbreviate:25}} ({{requested-by-email}}) has requested access to the file named “{{file-name|abbreviate:25}}”.
+
+Please note that the file is currently in Your Penpot 's team, so direct access cannot be granted. However, you have two options to provide the requested access:
+
+- Move the File to Another Team:
+
+You can move the file to another team and then give access to that team, inviting {{requested-by|abbreviate:25}}.
+
+
+
+- Send a View-Only Link:
+
+Alternatively, you can create and share a view-only link to the file. This will allow {{requested-by|abbreviate:25}} to view the content without making any changes.
+
+Click the link below to generate and send the link:
+
+{{ public-uri }}/#/view/{{file-id}}?page-id={{page-id}}&section=interactions&index=0&share=true
+
+
+
+If you do not wish to grant access at this time, you can simply disregard this email.
+Thank you
+
+
+The Penpot team.
--- a/backend/resources/app/email/request-file-access/en.html
+++ b/backend/resources/app/email/request-file-access/en.html
@@ -0,0 +1,568 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml"
+  xmlns:o="urn:schemas-microsoft-com:office:office">
+
+<head>
+  <title>
+  </title>
+  <!--[if !mso]><!-- -->
+  <meta http-equiv="X-UA-Compatible" content="IE=edge">
+  <!--<![endif]-->
+  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <style type="text/css">
+    #outlook a {
+      padding: 0;
+    }
+
+    body {
+      margin: 0;
+      padding: 0;
+      -webkit-text-size-adjust: 100%;
+      -ms-text-size-adjust: 100%;
+    }
+
+    table,
+    td {
+      border-collapse: collapse;
+      mso-table-lspace: 0pt;
+      mso-table-rspace: 0pt;
+    }
+
+    img {
+      border: 0;
+      height: auto;
+      line-height: 100%;
+      outline: none;
+      text-decoration: none;
+      -ms-interpolation-mode: bicubic;
+    }
+
+    p {
+      display: block;
+      margin: 13px 0;
+    }
+  </style>
+  <!--[if mso]>
+        <xml>
+        <o:OfficeDocumentSettings>
+          <o:AllowPNG/>
+          <o:PixelsPerInch>96</o:PixelsPerInch>
+        </o:OfficeDocumentSettings>
+        </xml>
+        <![endif]-->
+  <!--[if lte mso 11]>
+        <style type="text/css">
+          .mj-outlook-group-fix { width:100% !important; }
+        </style>
+        <![endif]-->
+  <!--[if !mso]><!-->
+  <link href="https://fonts.googleapis.com/css?family=Source%20Sans%20Pro" rel="stylesheet" type="text/css">
+  <style type="text/css">
+    @import url(https://fonts.googleapis.com/css?family=Source%20Sans%20Pro);
+  </style>
+  <!--<![endif]-->
+  <style type="text/css">
+    @media only screen and (min-width:480px) {
+      .mj-column-per-100 {
+        width: 100% !important;
+        max-width: 100%;
+      }
+
+      .mj-column-px-425 {
+        width: 425px !important;
+        max-width: 425px;
+      }
+    }
+  </style>
+  <style type="text/css">
+    @media only screen and (max-width:480px) {
+      table.mj-full-width-mobile {
+        width: 100% !important;
+      }
+
+      td.mj-full-width-mobile {
+        width: auto !important;
+      }
+    }
+  </style>
+</head>
+
+<body style="background-color:#E5E5E5;">
+  <div style="background-color:#E5E5E5;">
+    <!--[if mso | IE]>
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:16px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:collapse;border-spacing:0px;">
+                        <tbody>
+                          <tr>
+                            <td style="width:97px;">
+                              <img height="32" src="{{ public-uri }}/images/email/uxbox-title.png"
+                                style="border:0;display:block;outline:none;text-decoration:none;height:32px;width:100%;font-size:13px;"
+                                width="97" />
+                            </td>
+                          </tr>
+                        </tbody>
+                      </table>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="background:#FFFFFF;background-color:#FFFFFF;margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+        style="background:#FFFFFF;background-color:#FFFFFF;width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">
+                        Hello!</div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        <p>
+                          {{requested-by|abbreviate:25}} ({{requested-by-email}}) has requested access to the file named
+                          “{{file-name|abbreviate:25}}”.
+                        </p>
+                        <p>
+                          To provide this access, you have the following options:
+                        </p>
+                        <ul>
+                          <li>
+                            <p>Give Access to the “{{team-name|abbreviate:25}}” Team:</p>
+                            <p>This will automatically include {{requested-by|abbreviate:25}} in the team, so the user
+                              can see all the projects and files in it.</p>
+                            <p>Click the button below to provide team access:</p>
+                          </li>
+                        </ul>
+                        </p>
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="center" vertical-align="middle"
+                      style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:separate;line-height:100%">
+                        <tr>
+                          <td align="center" bgcolor="#31EFB8" role="presentation"
+                            style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#31EFB8;"
+                            valign="middle">
+                            <a href="{{ public-uri }}/#/dashboard/team/{{team-id}}/members?invite-email={{requested-by-email|urlescape }}"
+                              style="display:inline-block;background:#31EFB8;color:#1F1F1F;font-family:Source Sans Pro, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;"
+                              target="_blank"> Give access to “{{team-name|abbreviate:25}}” Team </a>
+                          </td>
+                        </tr>
+                      </table>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        <ul>
+                          <li>
+                            <p>Send a View-Only Link:</p>
+                            <p>Alternatively, you can create and share a view-only link to the file. This will allow
+                              {{requested-by|abbreviate:25}} to view the content without making any changes.</p>
+                            <p>Click the button below to generate and send the link:</p>
+                          </li>
+                        </ul>
+                        </p>
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="center" vertical-align="middle"
+                      style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:separate;line-height:100%">
+                        <tr>
+                          <td align="center" bgcolor="#31EFB8" role="presentation"
+                            style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#31EFB8;"
+                            valign="middle">
+                            <a href="{{ public-uri }}/#/view/{{file-id}}?page-id={{page-id}}&section=interactions&index=0&share=true"
+                              style="display:inline-block;background:#31EFB8;color:#1F1F1F;font-family:Source Sans Pro, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;"
+                              target="_blank"> Send a View-Only link </a>
+                          </td>
+                        </tr>
+                      </table>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        <p>If you do not wish to grant access at this time, you can simply disregard this email.</p>
+                        <p>Thank you</p>
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        The Penpot team.</div>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:24px 0 0 0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:425px;"
+            >
+          <![endif]-->
+              <div class="mj-column-px-425 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:14px;line-height:150%;text-align:center;color:#64666A;">
+                        Penpot is the first Open Source design and prototyping platform meant for cross-domain teams.
+                      </div>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <!--[if mso | IE]>
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+      >
+        <tr>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://penpot.app/" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-uxbox.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://twitter.com/penpotapp" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-twitter.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://github.com/penpot/" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-github.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://www.instagram.com/penpot.app/" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-instagram.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://tree.taiga.io/project/penpot" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-taiga.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+          </tr>
+        </table>
+      <![endif]-->
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:0 0 24px 0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:14px;line-height:150%;text-align:center;color:#64666A;">
+                        Penpot | Made with &lt;3 and Open Source</div>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+      <![endif]-->
+  </div>
+</body>
+
+</html>
--- a/backend/resources/app/email/request-file-access/en.subj
+++ b/backend/resources/app/email/request-file-access/en.subj
@@ -0,0 +1 @@
+Request Access to “{{file-name|abbreviate:25}}”
--- a/backend/resources/app/email/request-file-access/en.txt
+++ b/backend/resources/app/email/request-file-access/en.txt
@@ -0,0 +1,34 @@
+Hello!
+
+
+Hello!
+
+{{requested-by|abbreviate:25}} ({{requested-by-email}}) has requested access to the file named “{{file-name|abbreviate:25}}”.
+
+To provide this access, you have the following options:
+
+- Give Access to the “{{team-name|abbreviate:25}}” Team:
+
+This will automatically include {{requested-by|abbreviate:25}} in the team, so the user can see all the projects and files in it.
+
+Click the link below to provide team access:
+
+{{ public-uri }}/#/dashboard/team/{{team-id}}/members?invite-email={{requested-by-email|urlescape}}
+
+
+
+- Send a View-Only Link:
+
+Alternatively, you can create and share a view-only link to the file. This will allow {{requested-by|abbreviate:25}} to view the content without making any changes.
+
+Click the link below to generate and send the link:
+
+{{ public-uri }}/#/view/{{file-id}}?page-id={{page-id}}&section=interactions&index=0&share=true
+
+
+
+If you do not wish to grant access at this time, you can simply disregard this email.
+Thank you
+
+
+The Penpot team.
--- a/backend/resources/app/email/request-team-access/en.html
+++ b/backend/resources/app/email/request-team-access/en.html
@@ -0,0 +1,526 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml"
+  xmlns:o="urn:schemas-microsoft-com:office:office">
+
+<head>
+  <title>
+  </title>
+  <!--[if !mso]><!-- -->
+  <meta http-equiv="X-UA-Compatible" content="IE=edge">
+  <!--<![endif]-->
+  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <style type="text/css">
+    #outlook a {
+      padding: 0;
+    }
+
+    body {
+      margin: 0;
+      padding: 0;
+      -webkit-text-size-adjust: 100%;
+      -ms-text-size-adjust: 100%;
+    }
+
+    table,
+    td {
+      border-collapse: collapse;
+      mso-table-lspace: 0pt;
+      mso-table-rspace: 0pt;
+    }
+
+    img {
+      border: 0;
+      height: auto;
+      line-height: 100%;
+      outline: none;
+      text-decoration: none;
+      -ms-interpolation-mode: bicubic;
+    }
+
+    p {
+      display: block;
+      margin: 13px 0;
+    }
+  </style>
+  <!--[if mso]>
+        <xml>
+        <o:OfficeDocumentSettings>
+          <o:AllowPNG/>
+          <o:PixelsPerInch>96</o:PixelsPerInch>
+        </o:OfficeDocumentSettings>
+        </xml>
+        <![endif]-->
+  <!--[if lte mso 11]>
+        <style type="text/css">
+          .mj-outlook-group-fix { width:100% !important; }
+        </style>
+        <![endif]-->
+  <!--[if !mso]><!-->
+  <link href="https://fonts.googleapis.com/css?family=Source%20Sans%20Pro" rel="stylesheet" type="text/css">
+  <style type="text/css">
+    @import url(https://fonts.googleapis.com/css?family=Source%20Sans%20Pro);
+  </style>
+  <!--<![endif]-->
+  <style type="text/css">
+    @media only screen and (min-width:480px) {
+      .mj-column-per-100 {
+        width: 100% !important;
+        max-width: 100%;
+      }
+
+      .mj-column-px-425 {
+        width: 425px !important;
+        max-width: 425px;
+      }
+    }
+  </style>
+  <style type="text/css">
+    @media only screen and (max-width:480px) {
+      table.mj-full-width-mobile {
+        width: 100% !important;
+      }
+
+      td.mj-full-width-mobile {
+        width: auto !important;
+      }
+    }
+  </style>
+</head>
+
+<body style="background-color:#E5E5E5;">
+  <div style="background-color:#E5E5E5;">
+    <!--[if mso | IE]>
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:16px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:collapse;border-spacing:0px;">
+                        <tbody>
+                          <tr>
+                            <td style="width:97px;">
+                              <img height="32" src="{{ public-uri }}/images/email/uxbox-title.png"
+                                style="border:0;display:block;outline:none;text-decoration:none;height:32px;width:100%;font-size:13px;"
+                                width="97" />
+                            </td>
+                          </tr>
+                        </tbody>
+                      </table>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="background:#FFFFFF;background-color:#FFFFFF;margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+        style="background:#FFFFFF;background-color:#FFFFFF;width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">
+                        Hello!</div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        <p>
+                          {{requested-by|abbreviate:25}} ({{requested-by-email}}) wants to have access to the
+                          “{{team-name|abbreviate:25}}” Team.
+                        </p>
+                        <p>
+                          To provide access, please click the button below:
+                        </p>
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="center" vertical-align="middle"
+                      style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:separate;line-height:100%;">
+                        <tr>
+                          <td align="center" bgcolor="#31EFB8" role="presentation"
+                            style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#31EFB8;"
+                            valign="middle">
+                            <a href="{{ public-uri }}/#/dashboard/team/{{team-id}}/members?invite-email={{requested-by-email|urlescape}}"
+                              style="display:inline-block;background:#31EFB8;color:#1F1F1F;font-family:Source Sans Pro, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;"
+                              target="_blank"> Give access to “{{team-name|abbreviate:25}}” </a>
+                          </td>
+                        </tr>
+                      </table>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        <p>If you do not wish to grant access at this time, you can simply disregard this email.</p>
+                        <p>Thank you</p>
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        The Penpot team.</div>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:24px 0 0 0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:425px;"
+            >
+          <![endif]-->
+              <div class="mj-column-px-425 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:14px;line-height:150%;text-align:center;color:#64666A;">
+                        Penpot is the first Open Source design and prototyping platform meant for cross-domain teams.
+                      </div>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <!--[if mso | IE]>
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+      >
+        <tr>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://penpot.app/" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-uxbox.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://twitter.com/penpotapp" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-twitter.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://github.com/penpot/" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-github.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://www.instagram.com/penpot.app/" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-instagram.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+              <td>
+            <![endif]-->
+                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="float:none;display:inline-table;">
+                        <tr>
+                          <td style="padding:0 8px;">
+                            <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                              style="border-radius:3px;width:24px;">
+                              <tr>
+                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                  <a href="https://tree.taiga.io/project/penpot" target="_blank">
+                                    <img height="24" src="{{ public-uri }}/images/email/logo-taiga.png"
+                                      style="border-radius:3px;display:block;" width="24" />
+                                  </a>
+                                </td>
+                              </tr>
+                            </table>
+                          </td>
+                        </tr>
+                      </table>
+                      <!--[if mso | IE]>
+              </td>
+
+          </tr>
+        </table>
+      <![endif]-->
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:0 0 24px 0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:14px;line-height:150%;text-align:center;color:#64666A;">
+                        Penpot | Made with &lt;3 and Open Source</div>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+      <![endif]-->
+  </div>
+</body>
+
+</html>
--- a/backend/resources/app/email/request-team-access/en.subj
+++ b/backend/resources/app/email/request-team-access/en.subj
@@ -0,0 +1 @@
+Request Access to “{{team-name|abbreviate:25}}”
--- a/backend/resources/app/email/request-team-access/en.txt
+++ b/backend/resources/app/email/request-team-access/en.txt
@@ -0,0 +1,14 @@
+Hello!
+
+{{requested-by|abbreviate:25}} ({{requested-by-email}}) wants to have access to the “{{team-name|abbreviate:25}}” Team.
+
+To provide access, please click the link below:
+
+{{ public-uri }}/#/dashboard/team/{{team-id}}/members?invite-email={{requested-by-email|urlescape}}
+
+
+If you do not wish to grant access at this time, you can simply disregard this email.
+Thank you
+
+
+The Penpot team.
--- a/backend/resources/app/onboarding.edn
+++ b/backend/resources/app/onboarding.edn
@@ -1,33 +1,42 @@
-[{:id "tutorial-for-beginners"
+[{:id "wireframing-kit"
+  :name "Wireframe library"
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/wireframing-kit.penpot"}
+ {:id "prototype-examples"
+  :name "Prototype template"
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/prototype-examples.penpot"}
+ {:id "plants-app"
+  :name "UI mockup example"
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/Plants-app.penpot"}
+ {:id "penpot-design-system"
+  :name "Design system example"
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/Penpot-Design-system.penpot"}
+ {:id "tutorial-for-beginners"
  :name "Tutorial for beginners"
-  :file-uri "https://github.com/penpot/penpot-files/raw/binary-files/tutorial-for-beginners.penpot"}
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/tutorial-for-beginners.penpot"}
 {:id "lucide-icons"
  :name "Lucide Icons"
-  :file-uri "https://github.com/penpot/penpot-files/raw/binary-files/Lucide-icons.penpot"}
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/Lucide-icons.penpot"}
 {:id "font-awesome"
  :name "Font Awesome"
-  :file-uri "https://github.com/penpot/penpot-files/raw/binary-files/Font-Awesome.penpot"}
- {:id "plants-app"
-  :name "Plants app"
-  :file-uri "https://github.com/penpot/penpot-files/raw/binary-files/Plants-app.penpot"}
- {:id "wireframing-kit"
-  :name "Wireframing Kit"
-  :file-uri "https://github.com/penpot/penpot-files/raw/binary-files/wireframing-kit.penpot"}
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/FontAwesome.penpot"}
 {:id "black-white-mobile-templates"
  :name "Black & White Mobile Templates"
-  :file-uri "https://github.com/penpot/penpot-files/raw/binary-files/Black-White-Mobile-Templates.penpot"}
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/Black-&-White-Mobile-Templates.penpot"}
 {:id "avataaars"
  :name "Avataaars"
-  :file-uri "https://github.com/penpot/penpot-files/raw/binary-files/Avataaars-by-Pablo-Stanley.penpot"}
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/Avataaars-by-Pablo-Stanley.penpot"}
 {:id "ux-notes"
  :name "UX Notes"
-  :file-uri "https://github.com/penpot/penpot-files/raw/binary-files/UX-Notes.penpot"}
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/UX-Notes.penpot"}
 {:id "whiteboarding-kit"
  :name "Whiteboarding Kit"
-  :file-uri "https://github.com/penpot/penpot-files/raw/binary-files/Whiteboarding-mapping-kit.penpot"}
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/Whiteboarding-mapping-kit.penpot"}
 {:id "open-color-scheme"
  :name "Open Color Scheme"
-  :file-uri "https://github.com/penpot/penpot-files/raw/binary-files/Open-Color-Scheme.penpot"}
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/Open%20Color%20Scheme%20(v1.9.1).penpot"}
 {:id "flex-layout-playground"
  :name "Flex Layout Playground"
-  :file-uri "https://github.com/penpot/penpot-files/raw/binary-files/Flex-Layout-Playground.penpot"}]
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/Flex%20Layout%20Playground.penpot"}
+ {:id "welcome"
+  :name "Welcome"
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/welcome.penpot"}]
--- a/backend/resources/app/templates/api-doc-entry.tmpl
+++ b/backend/resources/app/templates/api-doc-entry.tmpl
@@ -20,12 +20,19 @@
          <span>WEBHOOK</span>
        </span>
      {% endif %}
+
      {% if item.params-schema-js %}
        <span class="tag">
          <span>SCHEMA</span>
        </span>
      {% endif %}

+      {% if item.spec %}
+        <span class="tag">
+          <span>SPEC</span>
+        </span>
+      {% endif %}
+
      {% if item.sse %}
        <span class="tag">
          <span>SSE</span>
--- a/backend/scripts/repl
+++ b/backend/scripts/repl
@@ -24,8 +24,10 @@ export PENPOT_FLAGS="\
       enable-rpc-climit \
       enable-rpc-rlimit \
       enable-soft-rpc-rlimit \
+       enable-auto-file-snapshot \
       enable-webhooks \
       enable-access-tokens \
+       enable-tiered-file-data-storage \
       enable-file-validation \
       enable-file-schema-validation";

@@ -61,9 +63,10 @@ mc mb penpot-s3/penpot -p -q

 export AWS_ACCESS_KEY_ID=penpot-devenv
 export AWS_SECRET_ACCESS_KEY=penpot-devenv
-export PENPOT_ASSETS_STORAGE_BACKEND=assets-s3
-export PENPOT_STORAGE_ASSETS_S3_ENDPOINT=http://minio:9000
-export PENPOT_STORAGE_ASSETS_S3_BUCKET=penpot
+
+export PENPOT_OBJECTS_STORAGE_BACKEND=s3
+export PENPOT_OBJECTS_STORAGE_S3_ENDPOINT=http://minio:9000
+export PENPOT_OBJECTS_STORAGE_S3_BUCKET=penpot

 export OPTIONS="
       -A:jmx-remote -A:dev \
--- a/backend/scripts/start-dev
+++ b/backend/scripts/start-dev
@@ -17,7 +17,9 @@ export PENPOT_FLAGS="\
       disable-secure-session-cookies \
       enable-rpc-climit \
       enable-smtp \
+       enable-file-snapshot \
       enable-access-tokens \
+       enable-tiered-file-data-storage \
       enable-file-validation \
       enable-file-schema-validation";

@@ -55,9 +57,9 @@ mc mb penpot-s3/penpot -p -q

 export AWS_ACCESS_KEY_ID=penpot-devenv
 export AWS_SECRET_ACCESS_KEY=penpot-devenv
-export PENPOT_ASSETS_STORAGE_BACKEND=assets-s3
-export PENPOT_STORAGE_ASSETS_S3_ENDPOINT=http://minio:9000
-export PENPOT_STORAGE_ASSETS_S3_BUCKET=penpot
+export PENPOT_OBJECTS_STORAGE_BACKEND=s3
+export PENPOT_OBJECTS_STORAGE_S3_ENDPOINT=http://minio:9000
+export PENPOT_OBJECTS_STORAGE_S3_BUCKET=penpot

 entrypoint=${1:-app.main};

--- a/backend/src/app/auth.clj
+++ b/backend/src/app/auth.clj
@@ -6,9 +6,7 @@

 (ns app.auth
  (:require
-   [app.config :as cf]
-   [buddy.hashers :as hashers]
-   [cuerdas.core :as str]))
+   [buddy.hashers :as hashers]))

 (def default-params
  {:alg :argon2id
@@ -27,17 +25,3 @@
    (catch Throwable _
      {:update false
       :valid false})))
-
-(defn email-domain-in-whitelist?
-  "Returns true if email's domain is in the given whitelist or if
-  given whitelist is an empty string."
-  ([email]
-   (let [domains (cf/get :registration-domain-whitelist)]
-     (email-domain-in-whitelist? domains email)))
-  ([domains email]
-   (if (or (nil? domains) (empty? domains))
-     true
-     (let [[_ candidate] (-> (str/lower email)
-                             (str/split #"@" 2))]
-       (contains? domains candidate)))))
-
--- a/backend/src/app/auth/ldap.clj
+++ b/backend/src/app/auth/ldap.clj
@@ -9,7 +9,6 @@
   [app.common.exceptions :as ex]
   [app.common.logging :as l]
   [app.common.spec :as us]
-   [app.config :as cf]
   [clj-ldap.client :as ldap]
   [clojure.spec.alpha :as s]
   [clojure.string]
@@ -104,17 +103,17 @@
        nil))))

 (s/def ::enabled? ::us/boolean)
-(s/def ::host ::cf/ldap-host)
-(s/def ::port ::cf/ldap-port)
-(s/def ::ssl ::cf/ldap-ssl)
-(s/def ::tls ::cf/ldap-starttls)
-(s/def ::query ::cf/ldap-user-query)
-(s/def ::base-dn ::cf/ldap-base-dn)
-(s/def ::bind-dn ::cf/ldap-bind-dn)
-(s/def ::bind-password ::cf/ldap-bind-password)
-(s/def ::attrs-email ::cf/ldap-attrs-email)
-(s/def ::attrs-fullname ::cf/ldap-attrs-fullname)
-(s/def ::attrs-username ::cf/ldap-attrs-username)
+(s/def ::host ::us/string)
+(s/def ::port ::us/integer)
+(s/def ::ssl ::us/boolean)
+(s/def ::tls ::us/boolean)
+(s/def ::query ::us/string)
+(s/def ::base-dn ::us/string)
+(s/def ::bind-dn ::us/string)
+(s/def ::bind-password ::us/string)
+(s/def ::attrs-email ::us/string)
+(s/def ::attrs-fullname ::us/string)
+(s/def ::attrs-username ::us/string)

 (s/def ::provider-params
  (s/keys :opt-un [::host ::port
@@ -126,6 +125,7 @@
                   ::attrs-email
                   ::attrs-username
                   ::attrs-fullname]))
+
 (s/def ::provider
  (s/nilable ::provider-params))

--- a/backend/src/app/auth/oidc.clj
+++ b/backend/src/app/auth/oidc.clj
@@ -7,7 +7,6 @@
 (ns app.auth.oidc
  "OIDC client implementation."
  (:require
-   [app.auth :as auth]
   [app.auth.oidc.providers :as-alias providers]
   [app.common.data :as d]
   [app.common.data.macros :as dm]
@@ -17,13 +16,17 @@
   [app.common.uri :as u]
   [app.config :as cf]
   [app.db :as db]
+   [app.email.blacklist :as email.blacklist]
+   [app.email.whitelist :as email.whitelist]
   [app.http.client :as http]
+   [app.http.errors :as errors]
   [app.http.session :as session]
   [app.loggers.audit :as audit]
-   [app.main :as-alias main]
+   [app.rpc :as rpc]
   [app.rpc.commands.profile :as profile]
   [app.setup :as-alias setup]
   [app.tokens :as tokens]
+   [app.util.inet :as inet]
   [app.util.json :as json]
   [app.util.time :as dt]
   [buddy.sign.jwk :as jwk]
@@ -32,6 +35,7 @@
   [clojure.spec.alpha :as s]
   [cuerdas.core :as str]
   [integrant.core :as ig]
+   [ring.request :as rreq]
   [ring.response :as-alias rres]))

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -129,8 +133,8 @@
          (-> body json/decode :keys process-oidc-jwks)
          (do
            (l/warn :hint "unable to retrieve JWKs (unexpected response status code)"
-                    :http-status status
-                    :http-body  body)
+                    :response-status status
+                    :response-body  body)
            nil)))
      (catch Throwable cause
        (l/warn :hint "unable to retrieve JWKs (unexpected exception)"
@@ -144,18 +148,18 @@
  (when (contains? cf/flags :login-with-oidc)
    (if-let [opts (prepare-oidc-opts cfg)]
      (let [jwks (fetch-oidc-jwks cfg opts)]
-        (l/info :hint "provider initialized"
-                :provider "oidc"
-                :method (if (:discover? opts) "discover" "manual")
-                :client-id (:client-id opts)
-                :client-secret (obfuscate-string (:client-secret opts))
-                :scopes     (str/join "," (:scopes opts))
-                :auth-uri   (:auth-uri opts)
-                :user-uri   (:user-uri opts)
-                :token-uri  (:token-uri opts)
-                :roles-attr (:roles-attr opts)
-                :roles      (:roles opts)
-                :keys       (str/join "," (map str (keys jwks))))
+        (l/inf :hint "provider initialized"
+               :provider "oidc"
+               :method (if (:discover? opts) "discover" "manual")
+               :client-id (:client-id opts)
+               :client-secret (obfuscate-string (:client-secret opts))
+               :scopes     (str/join "," (:scopes opts))
+               :auth-uri   (:auth-uri opts)
+               :user-uri   (:user-uri opts)
+               :token-uri  (:token-uri opts)
+               :roles-attr (:roles-attr opts)
+               :roles      (:roles opts)
+               :keys       (str/join "," (map str (keys jwks))))
        (assoc opts :jwks jwks))
      (do
        (l/warn :hint "unable to initialize auth provider, missing configuration" :provider "oidc")
@@ -179,10 +183,10 @@
      (if (and (string? (:client-id opts))
               (string? (:client-secret opts)))
        (do
-          (l/info :hint "provider initialized"
-                  :provider "google"
-                  :client-id (:client-id opts)
-                  :client-secret (obfuscate-string (:client-secret opts)))
+          (l/inf :hint "provider initialized"
+                 :provider "google"
+                 :client-id (:client-id opts)
+                 :client-secret (obfuscate-string (:client-secret opts)))
          opts)

        (do
@@ -207,8 +211,9 @@
          (ex/raise :type :internal
                    :code :unable-to-retrieve-github-emails
                    :hint "unable to retrieve github emails"
-                    :http-status status
-                    :http-body body))
+                    :request-uri (:uri params)
+                    :response-status status
+                    :response-body body))

        (->> body json/decode (filter :primary) first :email))))

@@ -233,10 +238,10 @@
      (if (and (string? (:client-id opts))
               (string? (:client-secret opts)))
        (do
-          (l/info :hint "provider initialized"
-                  :provider "github"
-                  :client-id (:client-id opts)
-                  :client-secret (obfuscate-string (:client-secret opts)))
+          (l/inf :hint "provider initialized"
+                 :provider "github"
+                 :client-id (:client-id opts)
+                 :client-secret (obfuscate-string (:client-secret opts)))
          opts)

        (do
@@ -248,7 +253,7 @@
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

 (defmethod ig/init-key ::providers/gitlab
-  [_ _]
+  [_ cfg]
  (let [base (cf/get :gitlab-base-uri "https://gitlab.com")
        opts {:base-uri      base
              :client-id     (cf/get :gitlab-client-id)
@@ -257,17 +262,18 @@
              :auth-uri      (str base "/oauth/authorize")
              :token-uri     (str base "/oauth/token")
              :user-uri      (str base "/oauth/userinfo")
+              :jwks-uri      (str base "/oauth/discovery/keys")
              :name          "gitlab"}]
    (when (contains? cf/flags :login-with-gitlab)
      (if (and (string? (:client-id opts))
               (string? (:client-secret opts)))
-        (do
-          (l/info :hint "provider initialized"
-                  :provider "gitlab"
-                  :base-uri base
-                  :client-id (:client-id opts)
-                  :client-secret (obfuscate-string (:client-secret opts)))
-          opts)
+        (let [jwks (fetch-oidc-jwks cfg opts)]
+          (l/inf :hint "provider initialized"
+                 :provider "gitlab"
+                 :base-uri base
+                 :client-id (:client-id opts)
+                 :client-secret (obfuscate-string (:client-secret opts)))
+          (assoc opts :jwks jwks))

        (do
          (l/warn :hint "unable to initialize auth provider, missing configuration" :provider "gitlab")
@@ -283,12 +289,12 @@
    (into [(keyword (:name provider) fitem)] (map keyword) items)))

 (defn- build-redirect-uri
-  [{:keys [provider] :as cfg}]
+  [{:keys [::provider] :as cfg}]
  (let [public (u/uri (cf/get :public-uri))]
    (str (assoc public :path (str "/api/auth/oauth/" (:name provider) "/callback")))))

 (defn- build-auth-uri
-  [{:keys [provider] :as cfg} state]
+  [{:keys [::provider] :as cfg} state]
  (let [params {:client_id (:client-id provider)
                :redirect_uri (build-redirect-uri cfg)
                :response_type "code"
@@ -299,15 +305,19 @@
        (assoc :query query)
        (str))))

+(defn- qualify-prop-key
+  [provider k]
+  (keyword (:name provider) (name k)))
+
 (defn- qualify-props
  [provider props]
  (reduce-kv (fn [result k v]
-               (assoc result (keyword (:name provider) (name k)) v))
+               (assoc result (qualify-prop-key provider k) v))
             {}
             props))

-(defn fetch-access-token
-  [{:keys [provider] :as cfg} code]
+(defn- fetch-access-token
+  [{:keys [::provider] :as cfg} code]
  (let [params {:client_id (:client-id provider)
                :client_secret (:client-secret provider)
                :code code
@@ -319,26 +329,31 @@
                :uri (:token-uri provider)
                :body (u/map->query-string params)}]

-    (l/trace :hint "request access token"
-             :provider (:name provider)
-             :client-id (:client-id provider)
-             :client-secret (obfuscate-string (:client-secret provider))
-             :grant-type (:grant_type params)
-             :redirect-uri (:redirect_uri params))
+    (l/trc :hint "fetch access token"
+           :provider (:name provider)
+           :client-id (:client-id provider)
+           :client-secret (obfuscate-string (:client-secret provider))
+           :grant-type (:grant_type params)
+           :redirect-uri (:redirect_uri params))

    (let [{:keys [status body]} (http/req! cfg req {:sync? true})]
-      (l/trace :hint "access token response" :status status :body body)
+      (l/trc :hint "access token fetched" :status status :body body)
      (if (= status 200)
-        (let [data (json/decode body)]
-          {:token/access (get data :access_token)
-           :token/id     (get data :id_token)
-           :token/type   (get data :token_type)})
-
+        (let [data (json/decode body)
+              data {:token/access (get data :access_token)
+                    :token/id     (get data :id_token)
+                    :token/type   (get data :token_type)}]
+          (l/trc :hint "access token fetched"
+                 :token-id (:token/id data)
+                 :token-type (:token/type data)
+                 :token (:token/access data))
+          data)
        (ex/raise :type :internal
-                  :code :unable-to-retrieve-token
-                  :hint "unable to retrieve token"
-                  :http-status status
-                  :http-body body)))))
+                  :code :unable-to-fetch-access-token
+                  :hint "unable to fetch access token"
+                  :request-uri (:uri req)
+                  :response-status status
+                  :response-body body)))))

 (defn- process-user-info
  [provider tdata info]
@@ -364,10 +379,10 @@
       :props    props})))

 (defn- fetch-user-info
-  [{:keys [provider] :as cfg} tdata]
-  (l/trace :hint "fetch user info"
-           :uri (:user-uri provider)
-           :token (obfuscate-string (:token/access tdata)))
+  [{:keys [::provider] :as cfg} tdata]
+  (l/trc :hint "fetch user info"
+         :uri (:user-uri provider)
+         :token (obfuscate-string (:token/access tdata)))

  (let [params   {:uri (:user-uri provider)
                  :headers {"Authorization" (str (:token/type tdata) " " (:token/access tdata))}
@@ -375,9 +390,9 @@
                  :method :get}
        response (http/req! cfg params {:sync? true})]

-    (l/trace :hint "user info response"
-             :status (:status response)
-             :body   (:body response))
+    (l/trc :hint "user info response"
+           :status (:status response)
+           :body   (:body response))

    (when-not (s/int-in-range? 200 300 (:status response))
      (ex/raise :type :internal
@@ -389,7 +404,7 @@
    (-> response :body json/decode)))

 (defn- get-user-info
-  [{:keys [provider]} tdata]
+  [{:keys [::provider]} tdata]
  (try
    (when (:token/id tdata)
      (let [{:keys [kid alg] :as theader} (jwt/decode-header (:token/id tdata))]
@@ -413,14 +428,8 @@
                   ::fullname
                   ::props]))

-(defn get-info
-  [{:keys [provider ::setup/props] :as cfg} {:keys [params] :as request}]
-  (when-let [error (get params :error)]
-    (ex/raise :type :internal
-              :code :error-on-retrieving-code
-              :error-id error
-              :error-desc (get params :error_description)))
-
+(defn- get-info
+  [{:keys [::provider ::setup/props] :as cfg} {:keys [params] :as request}]
  (let [state  (get params :state)
        code   (get params :code)
        state  (tokens/verify props {:token state :iss :oauth})
@@ -433,7 +442,7 @@

        info   (process-user-info provider tdata info)]

-    (l/trace :hint "user info" :info info)
+    (l/trc :hint "user info" :info info)

    (when-not (s/valid? ::info info)
      (l/warn :hint "received incomplete profile info object (please set correct scopes)" :info info)
@@ -466,110 +475,172 @@
      (some? (:invitation-token state))
      (assoc :invitation-token (:invitation-token state))

+      (some? (:external-session-id state))
+      (assoc :external-session-id (:external-session-id state))
+
      ;; If state token comes with props, merge them. The state token
      ;; props can contain pm_ and utm_ prefixed query params.
      (map? (:props state))
      (update :props merge (:props state)))))

 (defn- get-profile
-  [{:keys [::db/pool] :as cfg} info]
-  (dm/with-open [conn (db/open pool)]
-    (some->> (:email info)
-             (profile/clean-email)
-             (profile/get-profile-by-email conn))))
+  [cfg info]
+  (db/run! cfg (fn [{:keys [::db/conn]}]
+                 (some->> (:email info)
+                          (profile/clean-email)
+                          (profile/get-profile-by-email conn)))))

 (defn- redirect-response
  [uri]
  {::rres/status 302
   ::rres/headers {"location" (str uri)}})

-(defn- generate-error-redirect
-  [_ cause]
-  (let [data   (if (ex/error? cause) (ex-data cause) nil)
-        code   (or (:code data) :unexpected)
-        type   (or (:type data) :internal)
-        hint   (or (:hint data)
-                   (if (ex/exception? cause)
-                     (ex-message cause)
-                     (str cause)))
+(defn- redirect-with-error
+  ([error] (redirect-with-error error nil))
+  ([error hint]
+   (let [params {:error error :hint hint}
+         params (d/without-nils params)
+         uri    (-> (u/uri (cf/get :public-uri))
+                    (assoc :path "/#/auth/login")
+                    (assoc :query (u/map->query-string params)))]
+     (redirect-response uri))))

-        params {:error "unable-to-auth"
-                :hint hint
-                :type type
-                :code code}
+(defn- redirect-to-register
+  [cfg info request]
+  (let [info   (assoc info
+                      :iss :prepared-register
+                      :exp (dt/in-future {:hours 48}))

+        params {:token (tokens/generate (::setup/props cfg) info)
+                :provider (:provider (:path-params request))
+                :fullname (:fullname info)}
+        params (d/without-nils params)]
+
+    (redirect-response
+     (-> (u/uri (cf/get :public-uri))
+         (assoc :path "/#/auth/register/validate")
+         (assoc :query (u/map->query-string params))))))
+
+(defn- redirect-to-verify-token
+  [token]
+  (let [params {:token token}
        uri    (-> (u/uri (cf/get :public-uri))
-                   (assoc :path "/#/auth/login")
+                   (assoc :path "/#/auth/verify-token")
                   (assoc :query (u/map->query-string params)))]

    (redirect-response uri)))

-(defn- generate-redirect
+(defn- provider-has-email-verified?
+  [{:keys [::provider] :as cfg} {:keys [props] :as info}]
+  (let [prop (qualify-prop-key provider :email_verified)]
+    (true? (get props prop))))
+
+(defn- profile-has-provider-props?
+  [{:keys [::provider] :as cfg} profile]
+  (let [prop (qualify-prop-key provider :email)]
+    (contains? (:props profile) prop)))
+
+(defn- provider-matches-profile?
+  [{:keys [::provider] :as cfg} profile info]
+  (or (= (:auth-backend profile) (:name provider))
+      (profile-has-provider-props? cfg profile)
+      (provider-has-email-verified? cfg info)))
+
+(defn- process-callback
  [cfg request info profile]
-  (if profile
-    (let [sxf    (session/create-fn cfg (:id profile))
-          token  (or (:invitation-token info)
-                     (tokens/generate (::setup/props cfg)
-                                      {:iss :auth
-                                       :exp (dt/in-future "15m")
-                                       :profile-id (:id profile)}))
-          params {:token token}
-          uri    (-> (u/uri (cf/get :public-uri))
-                     (assoc :path "/#/auth/verify-token")
-                     (assoc :query (u/map->query-string params)))]
+  (cond
+    (some? profile)
+    (cond
+      (:is-blocked profile)
+      (redirect-with-error "profile-blocked")

-      (when (:is-blocked profile)
-        (ex/raise :type :restriction
-                  :code :profile-blocked))
+      (not (provider-matches-profile? cfg profile info))
+      (redirect-with-error "auth-provider-not-allowed")

-      (audit/submit! cfg {::audit/type "command"
-                          ::audit/name "login-with-oidc"
-                          ::audit/profile-id (:id profile)
-                          ::audit/ip-addr (audit/parse-client-ip request)
-                          ::audit/props (audit/profile->props profile)})
+      (not (:is-active profile))
+      (let [info (assoc info :profile-id (:id profile))]
+        (redirect-to-register cfg info request))

-      (->> (redirect-response uri)
-           (sxf request)))
+      :else
+      (let [sxf     (session/create-fn cfg (:id profile))
+            token   (or (:invitation-token info)
+                        (tokens/generate (::setup/props cfg)
+                                         {:iss :auth
+                                          :exp (dt/in-future "15m")
+                                          :profile-id (:id profile)}))
+            props   (audit/profile->props profile)
+            context (d/without-nils {:external-session-id (:external-session-id info)})]

+        (audit/submit! cfg {::audit/type "action"
+                            ::audit/name "login-with-oidc"
+                            ::audit/profile-id (:id profile)
+                            ::audit/ip-addr (inet/parse-request request)
+                            ::audit/props props
+                            ::audit/context context})

-    (if (auth/email-domain-in-whitelist? (:email info))
-      (let [info   (assoc info
-                          :iss :prepared-register
-                          :is-active true
-                          :exp (dt/in-future {:hours 48}))
-            token  (tokens/generate (::setup/props cfg) info)
-            params (d/without-nils
-                    {:token token
-                     :fullname (:fullname info)})
-            uri    (-> (u/uri (cf/get :public-uri))
-                       (assoc :path "/#/auth/register/validate")
-                       (assoc :query (u/map->query-string params)))]
+        (->> (redirect-to-verify-token token)
+             (sxf request))))

-        (redirect-response uri))
-      (generate-error-redirect cfg "email-domain-not-allowed"))))
+    (and (email.blacklist/enabled? cfg)
+         (email.blacklist/contains? cfg (:email info)))
+    (redirect-with-error "email-domain-not-allowed")

+    (and (email.whitelist/enabled? cfg)
+         (not (email.whitelist/contains? cfg (:email info))))
+    (redirect-with-error "email-domain-not-allowed")
+
+    :else
+    (let [info (assoc info :is-active (provider-has-email-verified? cfg info))]
+      (if (or (contains? cf/flags :registration)
+              (contains? cf/flags :oidc-registration))
+        (redirect-to-register cfg info request)
+        (redirect-with-error "registration-disabled")))))
+
+(defn- get-external-session-id
+  [request]
+  (let [session-id (rreq/get-header request "x-external-session-id")]
+    (when (string? session-id)
+      (if (or (> (count session-id) 256)
+              (= session-id "null")
+              (str/blank? session-id))
+        nil
+        session-id))))

 (defn- auth-handler
  [cfg {:keys [params] :as request}]
-  (let [props (audit/extract-utm-params params)
-        state (tokens/generate (::setup/props cfg)
-                               {:iss :oauth
-                                :invitation-token (:invitation-token params)
-                                :props props
-                                :exp (dt/in-future "4h")})
-        uri   (build-auth-uri cfg state)]
+  (let [props  (audit/extract-utm-params params)
+        esid   (rpc/get-external-session-id request)
+        params {:iss :oauth
+                :invitation-token (:invitation-token params)
+                :external-session-id esid
+                :props props
+                :exp (dt/in-future "4h")}
+        state  (tokens/generate (::setup/props cfg)
+                                (d/without-nils params))
+        uri    (build-auth-uri cfg state)]
    {::rres/status 200
     ::rres/body {:redirect-uri uri}}))

 (defn- callback-handler
-  [cfg request]
+  [{:keys [::provider] :as cfg} request]
  (try
-    (let [info    (get-info cfg request)
-          profile (get-profile cfg info)]
-      (generate-redirect cfg request info profile))
+    (if-let [error (dm/get-in request [:params :error])]
+      (redirect-with-error "unable-to-auth" error)
+      (let [info    (get-info cfg request)
+            profile (get-profile cfg info)]
+        (process-callback cfg request info profile)))
    (catch Throwable cause
-      (l/warn :hint "error on oauth process" :cause cause)
-      (generate-error-redirect cfg cause))))
+      (binding [l/*context* (-> (errors/request->context request)
+                                (assoc :auth/provider (:name provider)))]
+        (let [edata (ex-data cause)]
+          (cond
+            (= :validation (:type edata))
+            (l/wrn :hint "invalid token received" :cause cause)
+
+            :else
+            (l/err :hint "error on oauth process" :cause cause))))
+
+      (redirect-with-error "unable-to-auth" (ex-message cause)))))

 (def provider-lookup
  {:compile
@@ -578,26 +649,24 @@
       (fn [request]
         (let [provider (some-> request :path-params :provider keyword)]
           (if-let [provider (get providers provider)]
-             (handler (assoc cfg :provider provider) request)
+             (handler (assoc cfg ::provider provider) request)
             (ex/raise :type :restriction
                       :code :provider-not-configured
                       :provider provider
                       :hint "provider not configured"))))))})

+(s/def ::client-id ::us/string)
+(s/def ::client-secret ::us/string)
+(s/def ::base-uri ::us/string)
+(s/def ::token-uri ::us/string)
+(s/def ::auth-uri ::us/string)
+(s/def ::user-uri ::us/string)
+(s/def ::scopes ::us/set-of-strings)
+(s/def ::roles ::us/set-of-strings)
+(s/def ::roles-attr ::us/string)
+(s/def ::email-attr ::us/string)
+(s/def ::name-attr ::us/string)

-(s/def ::client-id ::cf/oidc-client-id)
-(s/def ::client-secret ::cf/oidc-client-secret)
-(s/def ::base-uri ::cf/oidc-base-uri)
-(s/def ::token-uri ::cf/oidc-token-uri)
-(s/def ::auth-uri ::cf/oidc-auth-uri)
-(s/def ::user-uri ::cf/oidc-user-uri)
-(s/def ::scopes ::cf/oidc-scopes)
-(s/def ::roles ::cf/oidc-roles)
-(s/def ::roles-attr ::cf/oidc-roles-attr)
-(s/def ::email-attr ::cf/oidc-email-attr)
-(s/def ::name-attr ::cf/oidc-name-attr)
-
-;; FIXME: migrate to qualified-keywords
 (s/def ::provider
  (s/keys :req-un [::client-id
                   ::client-secret]
--- a/backend/src/app/binfile/common.clj
+++ b/backend/src/app/binfile/common.clj
@@ -15,6 +15,7 @@
   [app.common.files.migrations :as fmg]
   [app.common.files.validate :as fval]
   [app.common.logging :as l]
+   [app.common.types.file :as ctf]
   [app.common.uuid :as uuid]
   [app.config :as cf]
   [app.db :as db]
@@ -331,54 +332,12 @@

 (defn embed-assets
  [cfg data file-id]
-  (letfn [(walk-map-form [form state]
-            (cond
-              (uuid? (:fill-color-ref-file form))
-              (do
-                (vswap! state conj [(:fill-color-ref-file form) :colors (:fill-color-ref-id form)])
-                (assoc form :fill-color-ref-file file-id))
-
-              (uuid? (:stroke-color-ref-file form))
-              (do
-                (vswap! state conj [(:stroke-color-ref-file form) :colors (:stroke-color-ref-id form)])
-                (assoc form :stroke-color-ref-file file-id))
-
-              (uuid? (:typography-ref-file form))
-              (do
-                (vswap! state conj [(:typography-ref-file form) :typographies (:typography-ref-id form)])
-                (assoc form :typography-ref-file file-id))
-
-              (uuid? (:component-file form))
-              (do
-                (vswap! state conj [(:component-file form) :components (:component-id form)])
-                (assoc form :component-file file-id))
-
-              :else
-              form))
-
-          (process-group-of-assets [data [lib-id items]]
-            ;; NOTE: there is a possibility that shape refers to an
-            ;; non-existant file because the file was removed. In this
-            ;; case we just ignore the asset.
-            (if-let [lib (get-file cfg lib-id)]
-              (reduce (partial process-asset lib) data items)
-              data))
-
-          (process-asset [lib data [bucket asset-id]]
-            (let [asset (get-in lib [:data bucket asset-id])
-                  ;; Add a special case for colors that need to have
-                  ;; correctly set the :file-id prop (pending of the
-                  ;; refactor that will remove it).
-                  asset (cond-> asset
-                          (= bucket :colors) (assoc :file-id file-id))]
-              (update data bucket assoc asset-id asset)))]
-
-    (let [assets (volatile! [])]
-      (walk/postwalk #(cond-> % (map? %) (walk-map-form assets)) data)
-      (->> (deref assets)
-           (filter #(as-> (first %) $ (and (uuid? $) (not= $ file-id))))
-           (d/group-by first rest)
-           (reduce (partial process-group-of-assets) data)))))
+  (let [library-ids (get-libraries cfg [file-id])]
+    (reduce (fn [data library-id]
+              (let [library (get-file cfg library-id)]
+                (ctf/absorb-assets data (:data library))))
+            data
+            library-ids)))

 (defn- fix-version
  [file]
--- a/backend/src/app/binfile/v1.clj
+++ b/backend/src/app/binfile/v1.clj
@@ -22,7 +22,6 @@
   [app.db :as db]
   [app.loggers.audit :as-alias audit]
   [app.loggers.webhooks :as-alias webhooks]
-   [app.media :as media]
   [app.rpc :as-alias rpc]
   [app.rpc.commands.teams :as teams]
   [app.rpc.doc :as-alias doc]
@@ -130,7 +129,6 @@
  (.writeLong output (long data))
  (swap! *position* + 8))

-
 (defn read-long!
  [^DataInputStream input]
  (let [v (.readLong input)]
@@ -404,9 +402,9 @@
    (write-obj! output rels)))

 (defmethod write-section :v1/sobjects
-  [{:keys [::sto/storage ::output]}]
+  [{:keys [::output] :as cfg}]
  (let [sids    (-> bfc/*state* deref :sids)
-        storage (media/configure-assets-storage storage)]
+        storage (sto/resolve cfg)]

    (l/dbg :hint "found sobjects"
           :items (count sids)
@@ -621,8 +619,8 @@
                  ::l/sync? true))))))

 (defmethod read-section :v1/sobjects
-  [{:keys [::sto/storage ::db/conn ::input ::bfc/overwrite ::bfc/timestamp]}]
-  (let [storage (media/configure-assets-storage storage)
+  [{:keys [::db/conn ::input ::bfc/overwrite ::bfc/timestamp] :as cfg}]
+  (let [storage (sto/resolve cfg)
        ids     (read-obj! input)
        thumb?  (into #{} (map :media-id) (:thumbnails @bfc/*state*))]

--- a/backend/src/app/binfile/v2.clj
+++ b/backend/src/app/binfile/v2.clj
@@ -20,7 +20,6 @@
   [app.db.sql :as sql]
   [app.loggers.audit :as-alias audit]
   [app.loggers.webhooks :as-alias webhooks]
-   [app.media :as media]
   [app.storage :as sto]
   [app.storage.tmp :as tmp]
   [app.util.events :as events]
@@ -347,9 +346,7 @@
  [cfg team-id]
  (let [id  (uuid/next)
        tp  (dt/tpoint)
-
-        cfg (-> (create-database cfg)
-                (update ::sto/storage media/configure-assets-storage))]
+        cfg (create-database cfg)]

    (l/inf :hint "start"
           :operation "export"
@@ -390,7 +387,6 @@
        tp  (dt/tpoint)

        cfg (-> (create-database cfg path)
-                (update ::sto/storage media/configure-assets-storage)
                (assoc ::bfc/timestamp (dt/now)))]

    (l/inf :hint "start"
--- a/backend/src/app/config.clj
+++ b/backend/src/app/config.clj
@@ -11,30 +11,17 @@
   [app.common.data :as d]
   [app.common.exceptions :as ex]
   [app.common.flags :as flags]
-   [app.common.spec :as us]
+   [app.common.schema :as sm]
   [app.common.version :as v]
+   [app.util.overrides]
   [app.util.time :as dt]
   [clojure.core :as c]
   [clojure.java.io :as io]
-   [clojure.pprint :as pprint]
-   [clojure.spec.alpha :as s]
   [cuerdas.core :as str]
   [datoteka.fs :as fs]
   [environ.core :refer [env]]
   [integrant.core :as ig]))

-(prefer-method print-method
-               clojure.lang.IRecord
-               clojure.lang.IDeref)
-
-(prefer-method print-method
-               clojure.lang.IPersistentMap
-               clojure.lang.IDeref)
-
-(prefer-method pprint/simple-dispatch
-               clojure.lang.IPersistentMap
-               clojure.lang.IDeref)
-
 (defmethod ig/init-key :default
  [_ data]
  (d/without-nils data))
@@ -45,18 +32,19 @@
    (d/without-nils data)
    data))

-(def defaults
+(def default
  {:database-uri "postgresql://postgres/penpot"
   :database-username "penpot"
   :database-password "penpot"

-   :default-blob-version 5
+   :default-blob-version 4

-   :rpc-rlimit-config (fs/path "resources/rlimit.edn")
-   :rpc-climit-config (fs/path "resources/climit.edn")
+   :rpc-rlimit-config "resources/rlimit.edn"
+   :rpc-climit-config "resources/climit.edn"

-   :file-change-snapshot-every 5
-   :file-change-snapshot-timeout "3h"
+   :auto-file-snapshot-total 10
+   :auto-file-snapshot-every 5
+   :auto-file-snapshot-timeout "3h"

   :public-uri "http://localhost:3449"
   :host "localhost"
@@ -64,8 +52,8 @@

   :redis-uri "redis://redis/0"

-   :assets-storage-backend :assets-fs
-   :storage-assets-fs-directory "assets"
+   :objects-storage-backend "fs"
+   :objects-storage-fs-directory "assets"

   :assets-path "/internal/assets/"
   :smtp-default-reply-to "Penpot <no-reply@example.com>"
@@ -87,251 +75,156 @@
   :ldap-attrs-fullname "cn"

   ;; a server prop key where initial project is stored.
-   :initial-project-skey "initial-project"})
+   :initial-project-skey "initial-project"

-(s/def ::default-rpc-rlimit ::us/vector-of-strings)
-(s/def ::rpc-rlimit-config ::fs/path)
-(s/def ::rpc-climit-config ::fs/path)
+   ;; time to avoid email sending after profile modification
+   :email-verify-threshold "15m"})

-(s/def ::media-max-file-size ::us/integer)
+(def schema:config
+  (do #_sm/optional-keys
+   [:map {:title "config"}
+    [:flags {:optional true} [::sm/set :string]]
+    [:admins {:optional true} [::sm/set ::sm/email]]
+    [:secret-key {:optional true} :string]

-(s/def ::flags ::us/vector-of-keywords)
-(s/def ::telemetry-enabled ::us/boolean)
+    [:tenant {:optional false} :string]
+    [:public-uri {:optional false} :string]
+    [:host {:optional false} :string]

-(s/def ::audit-log-archive-uri ::us/string)
-(s/def ::audit-log-http-handler-concurrency ::us/integer)
+    [:http-server-port {:optional true} ::sm/int]
+    [:http-server-host {:optional true} :string]
+    [:http-server-max-body-size {:optional true} ::sm/int]
+    [:http-server-max-multipart-body-size {:optional true} ::sm/int]
+    [:http-server-io-threads {:optional true} ::sm/int]
+    [:http-server-worker-threads {:optional true} ::sm/int]

-(s/def ::deletion-delay ::dt/duration)
+    [:telemetry-uri {:optional true} :string]
+    [:telemetry-with-taiga {:optional true} ::sm/boolean] ;; DELETE

-(s/def ::admins ::us/set-of-valid-emails)
-(s/def ::file-change-snapshot-every ::us/integer)
-(s/def ::file-change-snapshot-timeout ::dt/duration)
+    [:auto-file-snapshot-total {:optional true} ::sm/int]
+    [:auto-file-snapshot-every {:optional true} ::sm/int]
+    [:auto-file-snapshot-timeout {:optional true} ::dt/duration]

-(s/def ::default-executor-parallelism ::us/integer)
-(s/def ::scheduled-executor-parallelism ::us/integer)
+    [:media-max-file-size {:optional true} ::sm/int]
+    [:deletion-delay {:optional true} ::dt/duration] ;; REVIEW
+    [:telemetry-enabled {:optional true} ::sm/boolean]
+    [:default-blob-version {:optional true} ::sm/int]
+    [:allow-demo-users {:optional true} ::sm/boolean]
+    [:error-report-webhook {:optional true} :string]
+    [:user-feedback-destination {:optional true} :string]

-(s/def ::worker-default-parallelism ::us/integer)
-(s/def ::worker-webhook-parallelism ::us/integer)
+    [:default-rpc-rlimit {:optional true} [::sm/vec :string]]
+    [:rpc-rlimit-config {:optional true} ::fs/path]
+    [:rpc-climit-config {:optional true} ::fs/path]

-(s/def ::authenticated-cookie-domain ::us/string)
-(s/def ::authenticated-cookie-name ::us/string)
-(s/def ::auth-token-cookie-name ::us/string)
-(s/def ::auth-token-cookie-max-age ::dt/duration)
+    [:audit-log-archive-uri {:optional true} :string]
+    [:audit-log-http-handler-concurrency {:optional true} ::sm/int]

-(s/def ::secret-key ::us/string)
-(s/def ::allow-demo-users ::us/boolean)
-(s/def ::assets-path ::us/string)
-(s/def ::database-password (s/nilable ::us/string))
-(s/def ::database-uri ::us/string)
-(s/def ::database-username (s/nilable ::us/string))
-(s/def ::database-readonly ::us/boolean)
-(s/def ::database-min-pool-size ::us/integer)
-(s/def ::database-max-pool-size ::us/integer)
+    [:default-executor-parallelism {:optional true} ::sm/int] ;; REVIEW
+    [:scheduled-executor-parallelism {:optional true} ::sm/int] ;; REVIEW
+    [:worker-default-parallelism {:optional true} ::sm/int]
+    [:worker-webhook-parallelism {:optional true} ::sm/int]

-(s/def ::quotes-teams-per-profile ::us/integer)
-(s/def ::quotes-access-tokens-per-profile ::us/integer)
-(s/def ::quotes-projects-per-team ::us/integer)
-(s/def ::quotes-invitations-per-team ::us/integer)
-(s/def ::quotes-profiles-per-team ::us/integer)
-(s/def ::quotes-files-per-project ::us/integer)
-(s/def ::quotes-files-per-team ::us/integer)
-(s/def ::quotes-font-variants-per-team ::us/integer)
-(s/def ::quotes-comment-threads-per-file ::us/integer)
-(s/def ::quotes-comments-per-file ::us/integer)
+    [:database-password {:optional true} [:maybe :string]]
+    [:database-uri {:optional true} :string]
+    [:database-username {:optional true} [:maybe :string]]
+    [:database-readonly {:optional true} ::sm/boolean]
+    [:database-min-pool-size {:optional true} ::sm/int]
+    [:database-max-pool-size {:optional true} ::sm/int]

-(s/def ::default-blob-version ::us/integer)
-(s/def ::error-report-webhook ::us/string)
-(s/def ::user-feedback-destination ::us/string)
-(s/def ::github-client-id ::us/string)
-(s/def ::github-client-secret ::us/string)
-(s/def ::gitlab-base-uri ::us/string)
-(s/def ::gitlab-client-id ::us/string)
-(s/def ::gitlab-client-secret ::us/string)
-(s/def ::google-client-id ::us/string)
-(s/def ::google-client-secret ::us/string)
-(s/def ::oidc-client-id ::us/string)
-(s/def ::oidc-user-info-source ::us/keyword)
-(s/def ::oidc-client-secret ::us/string)
-(s/def ::oidc-base-uri ::us/string)
-(s/def ::oidc-token-uri ::us/string)
-(s/def ::oidc-auth-uri ::us/string)
-(s/def ::oidc-user-uri ::us/string)
-(s/def ::oidc-jwks-uri ::us/string)
-(s/def ::oidc-scopes ::us/set-of-strings)
-(s/def ::oidc-roles ::us/set-of-strings)
-(s/def ::oidc-roles-attr ::us/string)
-(s/def ::oidc-email-attr ::us/string)
-(s/def ::oidc-name-attr ::us/string)
-(s/def ::host ::us/string)
-(s/def ::http-server-port ::us/integer)
-(s/def ::http-server-host ::us/string)
-(s/def ::http-server-max-body-size ::us/integer)
-(s/def ::http-server-max-multipart-body-size ::us/integer)
-(s/def ::http-server-io-threads ::us/integer)
-(s/def ::http-server-worker-threads ::us/integer)
-(s/def ::ldap-attrs-email ::us/string)
-(s/def ::ldap-attrs-fullname ::us/string)
-(s/def ::ldap-attrs-username ::us/string)
-(s/def ::ldap-base-dn ::us/string)
-(s/def ::ldap-bind-dn ::us/string)
-(s/def ::ldap-bind-password ::us/string)
-(s/def ::ldap-host ::us/string)
-(s/def ::ldap-port ::us/integer)
-(s/def ::ldap-ssl ::us/boolean)
-(s/def ::ldap-starttls ::us/boolean)
-(s/def ::ldap-user-query ::us/string)
-(s/def ::media-directory ::us/string)
-(s/def ::media-uri ::us/string)
-(s/def ::profile-bounce-max-age ::dt/duration)
-(s/def ::profile-bounce-threshold ::us/integer)
-(s/def ::profile-complaint-max-age ::dt/duration)
-(s/def ::profile-complaint-threshold ::us/integer)
-(s/def ::public-uri ::us/string)
-(s/def ::redis-uri ::us/string)
-(s/def ::registration-domain-whitelist ::us/set-of-strings)
+    [:quotes-teams-per-profile {:optional true} ::sm/int]
+    [:quotes-access-tokens-per-profile {:optional true} ::sm/int]
+    [:quotes-projects-per-team {:optional true} ::sm/int]
+    [:quotes-invitations-per-team {:optional true} ::sm/int]
+    [:quotes-profiles-per-team {:optional true} ::sm/int]
+    [:quotes-files-per-project {:optional true} ::sm/int]
+    [:quotes-files-per-team {:optional true} ::sm/int]
+    [:quotes-font-variants-per-team {:optional true} ::sm/int]
+    [:quotes-comment-threads-per-file {:optional true} ::sm/int]
+    [:quotes-comments-per-file {:optional true} ::sm/int]

-(s/def ::smtp-default-from ::us/string)
-(s/def ::smtp-default-reply-to ::us/string)
-(s/def ::smtp-host ::us/string)
-(s/def ::smtp-password (s/nilable ::us/string))
-(s/def ::smtp-port ::us/integer)
-(s/def ::smtp-ssl ::us/boolean)
-(s/def ::smtp-tls ::us/boolean)
-(s/def ::smtp-username (s/nilable ::us/string))
-(s/def ::urepl-host ::us/string)
-(s/def ::urepl-port ::us/integer)
-(s/def ::prepl-host ::us/string)
-(s/def ::prepl-port ::us/integer)
-(s/def ::assets-storage-backend ::us/keyword)
-(s/def ::storage-assets-fs-directory ::us/string)
-(s/def ::storage-assets-s3-bucket ::us/string)
-(s/def ::storage-assets-s3-region ::us/keyword)
-(s/def ::storage-assets-s3-endpoint ::us/string)
-(s/def ::storage-assets-s3-io-threads ::us/integer)
-(s/def ::telemetry-uri ::us/string)
-(s/def ::telemetry-with-taiga ::us/boolean)
-(s/def ::tenant ::us/string)
+    [:auth-data-cookie-domain {:optional true} :string]
+    [:auth-token-cookie-name {:optional true} :string]
+    [:auth-token-cookie-max-age {:optional true} ::dt/duration]

-(s/def ::config
-  (s/keys :opt-un [::secret-key
-                   ::flags
-                   ::admins
-                   ::deletion-delay
-                   ::allow-demo-users
-                   ::audit-log-archive-uri
-                   ::audit-log-http-handler-concurrency
-                   ::auth-token-cookie-name
-                   ::auth-token-cookie-max-age
-                   ::authenticated-cookie-name
-                   ::authenticated-cookie-domain
-                   ::database-password
-                   ::database-uri
-                   ::database-username
-                   ::database-readonly
-                   ::database-min-pool-size
-                   ::database-max-pool-size
-                   ::default-blob-version
-                   ::default-rpc-rlimit
-                   ::error-report-webhook
-                   ::default-executor-parallelism
-                   ::scheduled-executor-parallelism
-                   ::worker-default-parallelism
-                   ::worker-webhook-parallelism
-                   ::file-change-snapshot-every
-                   ::file-change-snapshot-timeout
-                   ::user-feedback-destination
-                   ::github-client-id
-                   ::github-client-secret
-                   ::gitlab-base-uri
-                   ::gitlab-client-id
-                   ::gitlab-client-secret
-                   ::google-client-id
-                   ::google-client-secret
-                   ::oidc-client-id
-                   ::oidc-client-secret
-                   ::oidc-user-info-source
-                   ::oidc-base-uri
-                   ::oidc-token-uri
-                   ::oidc-auth-uri
-                   ::oidc-user-uri
-                   ::oidc-jwks-uri
-                   ::oidc-scopes
-                   ::oidc-roles-attr
-                   ::oidc-email-attr
-                   ::oidc-name-attr
-                   ::oidc-roles
-                   ::host
-                   ::http-server-host
-                   ::http-server-port
-                   ::http-server-max-body-size
-                   ::http-server-max-multipart-body-size
-                   ::http-server-io-threads
-                   ::http-server-worker-threads
-                   ::ldap-attrs-email
-                   ::ldap-attrs-fullname
-                   ::ldap-attrs-username
-                   ::ldap-base-dn
-                   ::ldap-bind-dn
-                   ::ldap-bind-password
-                   ::ldap-host
-                   ::ldap-port
-                   ::ldap-ssl
-                   ::ldap-starttls
-                   ::ldap-user-query
-                   ::local-assets-uri
-                   ::media-max-file-size
-                   ::profile-bounce-max-age
-                   ::profile-bounce-threshold
-                   ::profile-complaint-max-age
-                   ::profile-complaint-threshold
-                   ::public-uri
+    [:registration-domain-whitelist {:optional true} [::sm/set :string]]
+    [:email-verify-threshold {:optional true} ::dt/duration]

-                   ::quotes-teams-per-profile
-                   ::quotes-access-tokens-per-profile
-                   ::quotes-projects-per-team
-                   ::quotes-invitations-per-team
-                   ::quotes-profiles-per-team
-                   ::quotes-files-per-project
-                   ::quotes-files-per-team
-                   ::quotes-font-variants-per-team
-                   ::quotes-comment-threads-per-file
-                   ::quotes-comments-per-file
+    [:github-client-id {:optional true} :string]
+    [:github-client-secret {:optional true} :string]
+    [:gitlab-base-uri {:optional true} :string]
+    [:gitlab-client-id {:optional true} :string]
+    [:gitlab-client-secret {:optional true} :string]
+    [:google-client-id {:optional true} :string]
+    [:google-client-secret {:optional true} :string]
+    [:oidc-client-id {:optional true} :string]
+    [:oidc-user-info-source {:optional true} :keyword]
+    [:oidc-client-secret {:optional true} :string]
+    [:oidc-base-uri {:optional true} :string]
+    [:oidc-token-uri {:optional true} :string]
+    [:oidc-auth-uri {:optional true} :string]
+    [:oidc-user-uri {:optional true} :string]
+    [:oidc-jwks-uri {:optional true} :string]
+    [:oidc-scopes {:optional true} [::sm/set :string]]
+    [:oidc-roles {:optional true} [::sm/set :string]]
+    [:oidc-roles-attr {:optional true} :string]
+    [:oidc-email-attr {:optional true} :string]
+    [:oidc-name-attr {:optional true} :string]

-                   ::redis-uri
-                   ::registration-domain-whitelist
-                   ::rpc-rlimit-config
-                   ::rpc-climit-config
+    [:ldap-attrs-email {:optional true} :string]
+    [:ldap-attrs-fullname {:optional true} :string]
+    [:ldap-attrs-username {:optional true} :string]
+    [:ldap-base-dn {:optional true} :string]
+    [:ldap-bind-dn {:optional true} :string]
+    [:ldap-bind-password {:optional true} :string]
+    [:ldap-host {:optional true} :string]
+    [:ldap-port {:optional true} ::sm/int]
+    [:ldap-ssl {:optional true} ::sm/boolean]
+    [:ldap-starttls {:optional true} ::sm/boolean]
+    [:ldap-user-query {:optional true} :string]

-                   ::semaphore-process-font
-                   ::semaphore-process-image
-                   ::semaphore-update-file
-                   ::semaphore-auth
+    [:profile-bounce-max-age {:optional true} ::dt/duration]
+    [:profile-bounce-threshold {:optional true} ::sm/int]
+    [:profile-complaint-max-age {:optional true} ::dt/duration]
+    [:profile-complaint-threshold {:optional true} ::sm/int]

-                   ::smtp-default-from
-                   ::smtp-default-reply-to
-                   ::smtp-host
-                   ::smtp-password
-                   ::smtp-port
-                   ::smtp-ssl
-                   ::smtp-tls
-                   ::smtp-username
+    [:redis-uri {:optional true} :string]

-                   ::urepl-host
-                   ::urepl-port
-                   ::prepl-host
-                   ::prepl-port
+    [:email-domain-blacklist {:optional true} ::fs/path]
+    [:email-domain-whitelist {:optional true} ::fs/path]

-                   ::assets-storage-backend
-                   ::storage-assets-fs-directory
-                   ::storage-assets-s3-bucket
-                   ::storage-assets-s3-region
-                   ::storage-assets-s3-endpoint
-                   ::storage-assets-s3-io-threads
-                   ::telemetry-enabled
-                   ::telemetry-uri
-                   ::telemetry-referer
-                   ::telemetry-with-taiga
-                   ::tenant]))
+    [:smtp-default-from {:optional true} :string]
+    [:smtp-default-reply-to {:optional true} :string]
+    [:smtp-host {:optional true} :string]
+    [:smtp-password {:optional true} [:maybe :string]]
+    [:smtp-port {:optional true} ::sm/int]
+    [:smtp-ssl {:optional true} ::sm/boolean]
+    [:smtp-tls {:optional true} ::sm/boolean]
+    [:smtp-username {:optional true} [:maybe :string]]
+
+    [:urepl-host {:optional true} :string]
+    [:urepl-port {:optional true} ::sm/int]
+    [:prepl-host {:optional true} :string]
+    [:prepl-port {:optional true} ::sm/int]
+
+    [:media-directory {:optional true} :string] ;; REVIEW
+    [:media-uri {:optional true} :string]
+    [:assets-path {:optional true} :string]
+
+    ;; Legacy, will be removed in 2.5
+    [:assets-storage-backend {:optional true} :keyword]
+    [:storage-assets-fs-directory {:optional true} :string]
+    [:storage-assets-s3-bucket {:optional true} :string]
+    [:storage-assets-s3-region {:optional true} :keyword]
+    [:storage-assets-s3-endpoint {:optional true} :string]
+    [:storage-assets-s3-io-threads {:optional true} ::sm/int]
+
+    [:objects-storage-backend {:optional true} :keyword]
+    [:objects-storage-fs-directory {:optional true} :string]
+    [:objects-storage-s3-bucket {:optional true} :string]
+    [:objects-storage-s3-region {:optional true} :keyword]
+    [:objects-storage-s3-endpoint {:optional true} :string]
+    [:objects-storage-s3-io-threads {:optional true} ::sm/int]]))

 (def default-flags
  [:enable-backend-api-doc
@@ -359,20 +252,22 @@
     {}
     env)))

-(defn- read-config
-  []
-  (try
-    (->> (read-env "penpot")
-         (merge defaults)
-         (us/conform ::config))
-    (catch Throwable e
-      (when (ex/error? e)
-        (println ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;")
-        (println "Error on validating configuration:")
-        (println (some-> e ex-data ex/explain))
-        (println (ex/explain (ex-data e)))
-        (println ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"))
-      (throw e))))
+(def decode-config
+  (sm/decoder schema:config sm/string-transformer))
+
+(def validate-config
+  (sm/validator schema:config))
+
+(def explain-config
+  (sm/explainer schema:config))
+
+(defn read-config
+  "Reads the configuration from enviroment variables and decodes all
+  known values."
+  [& {:keys [prefix default] :or {prefix "penpot"}}]
+  (->> (read-env prefix)
+       (merge default)
+       (decode-config)))

 (def version
  (v/parse (or (some-> (io/resource "version.txt")
@@ -380,10 +275,28 @@
                       (str/trim))
               "%version%")))

-(defonce ^:dynamic config (read-config))
+(defonce ^:dynamic config (read-config :default default))
 (defonce ^:dynamic flags (parse-flags config))

-(def deletion-delay
+(defn validate!
+  "Validate the currently loaded configuration data."
+  [& {:keys [exit-on-error?] :or {exit-on-error? true}}]
+  (if (validate-config config)
+    true
+    (let [explain (explain-config config)]
+      (println "Error on validating configuration:")
+      (sm/pretty-explain explain
+                         :variant ::sm/schemaless-explain
+                         :message "Configuration Validation Error")
+      (flush)
+      (if exit-on-error?
+        (System/exit -1)
+        (ex/raise :type :validation
+                  :code :config-validaton
+                  ::sm/explain explain)))))
+
+(defn get-deletion-delay
+  []
  (or (c/get config :deletion-delay)
      (dt/duration {:days 7})))

--- a/backend/src/app/db.clj
+++ b/backend/src/app/db.clj
@@ -153,7 +153,7 @@
 (s/def ::conn some?)
 (s/def ::nilable-pool (s/nilable ::pool))
 (s/def ::pool pool?)
-(s/def ::pool-or-conn some?)
+(s/def ::connectable some?)

 (defn closed?
  [pool]
@@ -407,6 +407,7 @@
      (ex/raise :type :not-found
                :code :object-not-found
                :table table
+                :params params
                :hint "database object not found"))
    row))

--- a/backend/src/app/email.clj
+++ b/backend/src/app/email.clj
@@ -7,14 +7,18 @@
 (ns app.email
  "Main api for send emails."
  (:require
+   [app.common.data.macros :as dm]
   [app.common.exceptions :as ex]
   [app.common.logging :as l]
   [app.common.pprint :as pp]
+   [app.common.schema :as sm]
   [app.common.spec :as us]
   [app.config :as cf]
   [app.db :as db]
   [app.db.sql :as sql]
   [app.email.invite-to-team :as-alias email.invite-to-team]
+   [app.email.join-team :as-alias email.join-team]
+   [app.email.request-team-access :as-alias email.request-team-access]
   [app.metrics :as mtx]
   [app.util.template :as tmpl]
   [app.worker :as wrk]
@@ -149,9 +153,27 @@
    "mail.smtp.timeout" timeout
    "mail.smtp.connectiontimeout" timeout}))

+(def ^:private schema:smtp-config
+  [:map
+   [::username {:optional true} :string]
+   [::password {:optional true} :string]
+   [::tls {:optional true} ::sm/boolean]
+   [::ssl {:optional true} ::sm/boolean]
+   [::host {:optional true} :string]
+   [::port {:optional true} ::sm/int]
+   [::default-from {:optional true} :string]
+   [::default-reply-to {:optional true} :string]])
+
+(def valid-smtp-config?
+  (sm/check-fn schema:smtp-config))
+
 (defn- create-smtp-session
  ^Session
  [cfg]
+  (dm/assert!
+   "expected valid smtp config"
+   (valid-smtp-config? cfg))
+
  (let [props (opts->props cfg)]
    (Session/getInstance props)))

@@ -262,44 +284,21 @@
  (let [email (if factory
                (factory context)
                (dissoc context ::conn))]
-    (wrk/submit! (merge
-                  {::wrk/task :sendmail
-                   ::wrk/delay 0
-                   ::wrk/max-retries 4
-                   ::wrk/priority 200
-                   ::wrk/conn conn}
-                  email))))
+    (wrk/submit! {::wrk/task :sendmail
+                  ::wrk/delay 0
+                  ::wrk/max-retries 4
+                  ::wrk/priority 200
+                  ::db/conn conn
+                  ::wrk/params email})))

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; SENDMAIL FN / TASK HANDLER
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

-(s/def ::username ::cf/smtp-username)
-(s/def ::password ::cf/smtp-password)
-(s/def ::tls ::cf/smtp-tls)
-(s/def ::ssl ::cf/smtp-ssl)
-(s/def ::host ::cf/smtp-host)
-(s/def ::port ::cf/smtp-port)
-(s/def ::default-reply-to ::cf/smtp-default-reply-to)
-(s/def ::default-from ::cf/smtp-default-from)
-
-(s/def ::smtp-config
-  (s/keys :opt [::username
-                ::password
-                ::tls
-                ::ssl
-                ::host
-                ::port
-                ::default-from
-                ::default-reply-to]))
-
 (declare send-to-logger!)

 (s/def ::sendmail fn?)

-(defmethod ig/pre-init-spec ::sendmail [_]
-  (s/spec ::smtp-config))
-
 (defmethod ig/init-key ::sendmail
  [_ cfg]
  (fn [params]
@@ -307,6 +306,8 @@
      (let [session (create-smtp-session cfg)]
        (with-open [transport (.getTransport session (if (::ssl cfg) "smtps" "smtp"))]
          (.connect ^Transport transport
+                    ^String (::host cfg)
+                    ^String (::port cfg)
                    ^String (::username cfg)
                    ^String (::password cfg))

@@ -400,6 +401,79 @@
  "Teams member invitation email."
  (template-factory ::invite-to-team))

+
+(s/def ::email.join-team/invited-by ::us/string)
+(s/def ::email.join-team/team ::us/string)
+(s/def ::email.join-team/team-id ::us/uuid)
+
+(s/def ::join-team
+  (s/keys :req-un [::email.join-team/invited-by
+                   ::email.join-team/team-id
+                   ::email.join-team/team]))
+
+(def join-team
+  "Teams member joined after request email."
+  (template-factory ::join-team))
+
+(s/def ::email.request-team-access/requested-by ::us/string)
+(s/def ::email.request-team-access/requested-by-email ::us/string)
+(s/def ::email.request-team-access/team-name ::us/string)
+(s/def ::email.request-team-access/team-id ::us/uuid)
+(s/def ::email.request-team-access/file-name ::us/string)
+(s/def ::email.request-team-access/file-id ::us/uuid)
+(s/def ::email.request-team-access/page-id ::us/uuid)
+
+(s/def ::request-file-access
+  (s/keys :req-un [::email.request-team-access/requested-by
+                   ::email.request-team-access/requested-by-email
+                   ::email.request-team-access/team-name
+                   ::email.request-team-access/team-id
+                   ::email.request-team-access/file-name
+                   ::email.request-team-access/file-id
+                   ::email.request-team-access/page-id]))
+
+(def request-file-access
+  "File access request email."
+  (template-factory ::request-file-access))
+
+
+(s/def ::request-file-access-yourpenpot
+  (s/keys :req-un [::email.request-team-access/requested-by
+                   ::email.request-team-access/requested-by-email
+                   ::email.request-team-access/team-name
+                   ::email.request-team-access/team-id
+                   ::email.request-team-access/file-name
+                   ::email.request-team-access/file-id
+                   ::email.request-team-access/page-id]))
+
+(def request-file-access-yourpenpot
+  "File access on Your Penpot request email."
+  (template-factory ::request-file-access-yourpenpot))
+
+(s/def ::request-file-access-yourpenpot-view
+  (s/keys :req-un [::email.request-team-access/requested-by
+                   ::email.request-team-access/requested-by-email
+                   ::email.request-team-access/team-name
+                   ::email.request-team-access/team-id
+                   ::email.request-team-access/file-name
+                   ::email.request-team-access/file-id
+                   ::email.request-team-access/page-id]))
+
+(def request-file-access-yourpenpot-view
+  "File access on Your Penpot view mode request email."
+  (template-factory ::request-file-access-yourpenpot-view))
+
+(s/def ::request-team-access
+  (s/keys :req-un [::email.request-team-access/requested-by
+                   ::email.request-team-access/requested-by-email
+                   ::email.request-team-access/team-name
+                   ::email.request-team-access/team-id]))
+
+(def request-team-access
+  "Team access request email."
+  (template-factory ::request-team-access))
+
+
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; BOUNCE/COMPLAINS HELPERS
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -449,3 +523,11 @@
                                            {:email email :type "bounce"}
                                            {:limit 10}))]
     (>= (count reports) threshold))))
+
+(defn has-reports?
+  ([conn email] (has-reports? conn email nil))
+  ([conn email {:keys [threshold] :or {threshold 1}}]
+   (let [reports (db/exec! conn (sql/select :global-complaint-report
+                                            {:email email}
+                                            {:limit 10}))]
+     (>= (count reports) threshold))))
--- a/backend/src/app/email/blacklist.clj
+++ b/backend/src/app/email/blacklist.clj
@@ -0,0 +1,47 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS INC
+
+(ns app.email.blacklist
+  "Email blacklist provider"
+  (:refer-clojure :exclude [contains?])
+  (:require
+   [app.common.logging :as l]
+   [app.config :as cf]
+   [app.email :as-alias email]
+   [clojure.core :as c]
+   [clojure.java.io :as io]
+   [cuerdas.core :as str]
+   [integrant.core :as ig]))
+
+(defmethod ig/init-key ::email/blacklist
+  [_ _]
+  (when (c/contains? cf/flags :email-blacklist)
+    (try
+      (let [path   (cf/get :email-domain-blacklist)
+            result (with-open [reader (io/reader path)]
+                     (reduce (fn [result line]
+                               (if (str/starts-with? line "#")
+                                 result
+                                 (conj result (-> line str/trim str/lower))))
+                             #{}
+                             (line-seq reader)))]
+        (l/inf :hint "initializing email blacklist" :domains (count result))
+        (not-empty result))
+
+      (catch Throwable cause
+        (l/wrn :hint "unexpected exception on initializing email blacklist"
+               :cause cause)))))
+
+(defn contains?
+  "Check if email is in the blacklist."
+  [{:keys [::email/blacklist]} email]
+  (let [[_ domain] (str/split email "@" 2)]
+    (c/contains? blacklist (str/lower domain))))
+
+(defn enabled?
+  "Check if the blacklist is enabled"
+  [{:keys [::email/blacklist]}]
+  (some? blacklist))
--- a/backend/src/app/email/whitelist.clj
+++ b/backend/src/app/email/whitelist.clj
@@ -0,0 +1,59 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS INC
+
+(ns app.email.whitelist
+  "Email whitelist provider"
+  (:refer-clojure :exclude [contains?])
+  (:require
+   [app.common.logging :as l]
+   [app.config :as cf]
+   [app.email :as-alias email]
+   [clojure.core :as c]
+   [clojure.java.io :as io]
+   [cuerdas.core :as str]
+   [datoteka.fs :as fs]
+   [integrant.core :as ig]))
+
+(defn- read-whitelist
+  [path]
+  (when (and path (fs/exists? path))
+    (try
+      (with-open [reader (io/reader path)]
+        (reduce (fn [result line]
+                  (if (str/starts-with? line "#")
+                    result
+                    (conj result (-> line str/trim str/lower))))
+                #{}
+                (line-seq reader)))
+
+      (catch Throwable cause
+        (l/wrn :hint "unexpected exception on reading email whitelist"
+               :cause cause)))))
+
+(defmethod ig/init-key ::email/whitelist
+  [_ _]
+  (let [whitelist (or (cf/get :registration-domain-whitelist) #{})
+        whitelist (if (c/contains? cf/flags :email-whitelist)
+                    (into whitelist (read-whitelist (cf/get :email-domain-whitelist)))
+                    whitelist)
+        whitelist (not-empty whitelist)]
+
+
+    (when whitelist
+      (l/inf :hint "initializing email whitelist" :domains (count whitelist)))
+
+    whitelist))
+
+(defn contains?
+  "Check if email is in the whitelist."
+  [{:keys [::email/whitelist]} email]
+  (let [[_ domain] (str/split email "@" 2)]
+    (c/contains? whitelist (str/lower domain))))
+
+(defn enabled?
+  "Check if the whitelist is enabled"
+  [{:keys [::email/whitelist]}]
+  (some? whitelist))
--- a/backend/src/app/features/components_v2.clj
+++ b/backend/src/app/features/components_v2.clj
@@ -12,7 +12,6 @@
   [app.common.files.changes :as cp]
   [app.common.files.changes-builder :as fcb]
   [app.common.files.helpers :as cfh]
-   [app.common.files.libraries-helpers :as cflh]
   [app.common.files.migrations :as fmg]
   [app.common.files.shapes-helpers :as cfsh]
   [app.common.files.validate :as cfv]
@@ -23,6 +22,7 @@
   [app.common.geom.shapes :as gsh]
   [app.common.geom.shapes.path :as gshp]
   [app.common.logging :as l]
+   [app.common.logic.libraries :as cll]
   [app.common.math :as mth]
   [app.common.schema :as sm]
   [app.common.svg :as csvg]
@@ -62,6 +62,7 @@
   [datoteka.io :as io]
   [promesa.util :as pu]))

+
 (def ^:dynamic *stats*
  "A dynamic var for setting up state for collect stats globally."
  nil)
@@ -113,7 +114,7 @@
  (sm/lazy-validator ::ctc/color))

 (def valid-fill?
-  (sm/lazy-validator ::cts/fill))
+  (sm/lazy-validator cts/schema:fill))

 (def valid-stroke?
  (sm/lazy-validator ::cts/stroke))
@@ -134,10 +135,10 @@
  (sm/lazy-validator ::ctc/rgb-color))

 (def valid-shape-points?
-  (sm/lazy-validator ::cts/points))
+  (sm/lazy-validator cts/schema:points))

 (def valid-image-attrs?
-  (sm/lazy-validator ::cts/image-attrs))
+  (sm/lazy-validator cts/schema:image-attrs))

 (def valid-column-grid-params?
  (sm/lazy-validator ::ctg/column-params))
@@ -1450,16 +1451,15 @@
                page
                (cons shape children))

-        [_ _ changes2]
-        (cflh/generate-add-component nil
-                                     [shape]
-                                     (:objects page)
-                                     (:id page)
-                                     file-id
-                                     true
-                                     nil
-                                     cfsh/prepare-create-artboard-from-selection)
-        changes (fcb/concat-changes changes changes2)]
+        [_ _ changes]
+        (cll/generate-add-component changes
+                                    [shape]
+                                    (:objects page)
+                                    (:id page)
+                                    file-id
+                                    true
+                                    nil
+                                    cfsh/prepare-create-artboard-from-selection)]

    (shape-cb shape)
    (:redo-changes changes)))
@@ -1743,7 +1743,7 @@
               :validate validate?
               :skip-on-graphic-error skip-on-graphic-error?)

-        (db/tx-run! (update system ::sto/storage media/configure-assets-storage)
+        (db/tx-run! system
                    (fn [system]
                      (binding [*system* system]
                        (when (string? label)
--- a/backend/src/app/features/fdata.clj
+++ b/backend/src/app/features/fdata.clj
@@ -12,10 +12,19 @@
   [app.common.logging :as l]
   [app.db :as db]
   [app.db.sql :as-alias sql]
+   [app.storage :as sto]
   [app.util.blob :as blob]
   [app.util.objects-map :as omap]
   [app.util.pointer-map :as pmap]))

+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; OFFLOAD
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+(defn offloaded?
+  [file]
+  (= "objects-storage" (:data-backend file)))
+
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; OBJECTS-MAP
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -55,31 +64,45 @@
 ;; POINTER-MAP
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

+(defn get-file-data
+  "Get file data given a file instance."
+  [system file]
+  (if (offloaded? file)
+    (let [storage (sto/resolve system ::db/reuse-conn true)]
+      (->> (sto/get-object storage (:data-ref-id file))
+           (sto/get-object-bytes storage)))
+    (:data file)))
+
+(defn resolve-file-data
+  [system file]
+  (let [data (get-file-data system file)]
+    (assoc file :data data)))
+
 (defn load-pointer
  "A database loader pointer helper"
  [system file-id id]
-  (let [{:keys [content]} (db/get system :file-data-fragment
-                                  {:id id :file-id file-id}
-                                  {::sql/columns [:content]
-                                   ::db/check-deleted false})]
+  (let [fragment (db/get* system :file-data-fragment
+                          {:id id :file-id file-id}
+                          {::sql/columns [:data :data-backend :data-ref-id :id]})]

    (l/trc :hint "load pointer"
           :file-id (str file-id)
           :id (str id)
-           :found (some? content))
+           :found (some? fragment))

-    (when-not content
+    (when-not fragment
      (ex/raise :type :internal
                :code :fragment-not-found
                :hint "fragment not found"
                :file-id file-id
                :fragment-id id))

-    (blob/decode content)))
+    (let [data (get-file-data system fragment)]
+      ;; FIXME: conditional thread scheduling for decoding big objects
+      (blob/decode data))))

 (defn persist-pointers!
-  "Given a database connection and the final file-id, persist all
-  pointers to the underlying storage (the database)."
+  "Persist all currently tracked pointer objects"
  [system file-id]
  (let [conn (db/get-connection system)]
    (doseq [[id item] @pmap/*tracked*]
@@ -89,7 +112,7 @@
          (db/insert! conn :file-data-fragment
                      {:id id
                       :file-id file-id
-                       :content content}))))))
+                       :data content}))))))

 (defn process-pointers
  "Apply a function to all pointers on the file. Usuly used for
--- a/backend/src/app/http.clj
+++ b/backend/src/app/http.clj
@@ -114,7 +114,7 @@
              (partial not-found-handler request)))

          (on-error [cause request]
-            (let [{:keys [body] :as response} (errors/handle cause request)]
+            (let [{:keys [::rres/body] :as response} (errors/handle cause request)]
              (cond-> response
                (map? body)
                (-> (update ::rres/headers assoc "content-type" "application/transit+json")
@@ -151,9 +151,9 @@
                      [mw/params]
                      [mw/format-response]
                      [mw/parse-request]
+                      [mw/errors errors/handle]
                      [session/soft-auth cfg]
                      [actoken/soft-auth cfg]
-                      [mw/errors errors/handle]
                      [mw/restrict-methods]]}

     (::mtx/routes cfg)
--- a/backend/src/app/http/assets.clj
+++ b/backend/src/app/http/assets.clj
@@ -57,11 +57,10 @@
 (defn- serve-object
  "Helper function that returns the appropriate response depending on
  the storage object backend type."
-  [{:keys [::sto/storage] :as cfg} {:keys [backend] :as obj}]
-  (let [backend (sto/resolve-backend storage backend)]
-    (case (::sto/type backend)
-      :s3 (serve-object-from-s3 cfg obj)
-      :fs (serve-object-from-fs cfg obj))))
+  [cfg {:keys [backend] :as obj}]
+  (case backend
+    (:s3 :assets-s3) (serve-object-from-s3 cfg obj)
+    (:fs :assets-fs) (serve-object-from-fs cfg obj)))

 (defn objects-handler
  "Handler that servers storage objects by id."
--- a/backend/src/app/http/awsns.clj
+++ b/backend/src/app/http/awsns.clj
@@ -9,6 +9,7 @@
  (:require
   [app.common.exceptions :as ex]
   [app.common.logging :as l]
+   [app.common.pprint :as pp]
   [app.db :as db]
   [app.db.sql :as sql]
   [app.http.client :as http]
@@ -16,10 +17,10 @@
   [app.setup :as-alias setup]
   [app.tokens :as tokens]
   [app.worker :as-alias wrk]
+   [clojure.data.json :as j]
   [clojure.spec.alpha :as s]
   [cuerdas.core :as str]
   [integrant.core :as ig]
-   [jsonista.core :as j]
   [promesa.exec :as px]
   [ring.request :as rreq]
   [ring.response :as-alias rres]))
@@ -136,83 +137,110 @@

 (defn- parse-json
  [v]
-  (ex/ignoring
-   (j/read-value v)))
+  (try
+    (j/read-str v)
+    (catch Throwable cause
+      (l/wrn :hint "unable to decode request body"
+             :cause cause))))

 (defn- register-bounce-for-profile
  [{:keys [::db/pool]} {:keys [type kind profile-id] :as report}]
  (when (= kind "permanent")
-    (db/with-atomic [conn pool]
-      (db/insert! conn :profile-complaint-report
+    (try
+      (db/insert! pool :profile-complaint-report
                  {:profile-id profile-id
                   :type (name type)
                   :content (db/tjson report)})

-      ;; TODO: maybe also try to find profiles by mail and if exists
-      ;; register profile reports for them?
-      (doseq [recipient (:recipients report)]
-        (db/insert! conn :global-complaint-report
-                    {:email (:email recipient)
-                     :type (name type)
-                     :content (db/tjson report)}))
+      (catch Throwable cause
+        (l/warn :hint "unable to persist profile complaint"
+                :cause cause)))

-      (let [profile (db/exec-one! conn (sql/select :profile {:id profile-id}))]
-        (when (some #(= (:email profile) (:email %)) (:recipients report))
-          ;; If the report matches the profile email, this means that
-          ;; the report is for itself, can be caused when a user
-          ;; registers with an invalid email or the user email is
-          ;; permanently rejecting receiving the email. In this case we
-          ;; have no option to mark the user as muted (and in this case
-          ;; the profile will be also inactive.
-          (db/update! conn :profile
-                      {:is-muted true}
-                      {:id profile-id}))))))
-
-(defn- register-complaint-for-profile
-  [{:keys [::db/pool]} {:keys [type profile-id] :as report}]
-  (db/with-atomic [conn pool]
-    (db/insert! conn :profile-complaint-report
-                {:profile-id profile-id
-                 :type (name type)
-                 :content (db/tjson report)})
-
-    ;; TODO: maybe also try to find profiles by email and if exists
-    ;; register profile reports for them?
-    (doseq [email (:recipients report)]
-      (db/insert! conn :global-complaint-report
-                  {:email email
+    (doseq [recipient (:recipients report)]
+      (db/insert! pool :global-complaint-report
+                  {:email (:email recipient)
                   :type (name type)
                   :content (db/tjson report)}))

-    (let [profile (db/exec-one! conn (sql/select :profile {:id profile-id}))]
-      (when (some #(= % (:email profile)) (:recipients report))
+    (let [profile (db/exec-one! pool (sql/select :profile {:id profile-id}))]
+      (when (some #(= (:email profile) (:email %)) (:recipients report))
        ;; If the report matches the profile email, this means that
-        ;; the report is for itself, rare case but can happen; In this
-        ;; case just mark profile as muted (very rare case).
-        (db/update! conn :profile
+        ;; the report is for itself, can be caused when a user
+        ;; registers with an invalid email or the user email is
+        ;; permanently rejecting receiving the email. In this case we
+        ;; have no option to mark the user as muted (and in this case
+        ;; the profile will be also inactive.
+
+        (l/inf :hint "mark profile: muted"
+               :profile-id (str (:id profile))
+               :email (:email profile)
+               :reason "bounce report"
+               :report-id (:feedback-id report))
+
+        (db/update! pool :profile
                    {:is-muted true}
-                    {:id profile-id})))))
+                    {:id profile-id}
+                    {::db/return-keys false})))))
+
+(defn- register-complaint-for-profile
+  [{:keys [::db/pool]} {:keys [type profile-id] :as report}]
+
+  (try
+    (db/insert! pool :profile-complaint-report
+                {:profile-id profile-id
+                 :type (name type)
+                 :content (db/tjson report)})
+    (catch Throwable cause
+      (l/warn :hint "unable to persist profile complaint"
+              :cause cause)))
+
+  ;; TODO: maybe also try to find profiles by email and if exists
+  ;; register profile reports for them?
+  (doseq [email (:recipients report)]
+    (db/insert! pool :global-complaint-report
+                {:email email
+                 :type (name type)
+                 :content (db/tjson report)}))
+
+  (let [profile (db/exec-one! pool (sql/select :profile {:id profile-id}))]
+    (when (some #(= % (:email profile)) (:recipients report))
+      ;; If the report matches the profile email, this means that
+      ;; the report is for itself, rare case but can happen; In this
+      ;; case just mark profile as muted (very rare case).
+      (l/inf :hint "mark profile: muted"
+             :profile-id (str (:id profile))
+             :email (:email profile)
+             :reason "complaint report"
+             :report-id (:feedback-id report))
+
+      (db/update! pool :profile
+                  {:is-muted true}
+                  {:id profile-id}
+                  {::db/return-keys false}))))

 (defn- process-report
  [cfg {:keys [type profile-id] :as report}]
-  (l/trace :action "processing report" :report (pr-str report))
  (cond
    ;; In this case we receive a bounce/complaint notification without
    ;; confirmed identity, we just emit a warning but do nothing about
    ;; it because this is not a normal case. All notifications should
    ;; come with profile identity.
    (nil? profile-id)
-    (l/warn :msg "a notification without identity received from AWS"
-            :report (pr-str report))
+    (l/wrn :hint "not-identified report"
+           ::l/body (pp/pprint-str report {:length 40 :level 6}))

    (= "bounce" type)
-    (register-bounce-for-profile cfg report)
+    (do
+      (l/trc :hint "bounce report"
+             ::l/body (pp/pprint-str report {:length 40 :level 6}))
+      (register-bounce-for-profile cfg report))

    (= "complaint" type)
-    (register-complaint-for-profile cfg report)
+    (do
+      (l/trc :hint "complaint report"
+             ::l/body (pp/pprint-str report {:length 40 :level 6}))
+      (register-complaint-for-profile cfg report))

    :else
-    (l/warn :msg "unrecognized report received from AWS"
-            :report (pr-str report))))
-
-
+    (l/wrn :hint "unrecognized report"
+           ::l/body (pp/pprint-str report {:length 20 :level 4}))))
--- a/backend/src/app/http/client.clj
+++ b/backend/src/app/http/client.clj
@@ -54,9 +54,10 @@
  "A convencience toplevel function for gradual migration to a new API
  convention."
  ([cfg-or-client request]
-   (let [client (resolve-client cfg-or-client)]
+   (let [client  (resolve-client cfg-or-client)
+         request (update request :uri str)]
     (send! client request {:sync? true})))
  ([cfg-or-client request options]
-   (let [client (resolve-client cfg-or-client)]
+   (let [client  (resolve-client cfg-or-client)
+         request (update request :uri str)]
     (send! client request (merge {:sync? true} options)))))
-
--- a/backend/src/app/http/debug.clj
+++ b/backend/src/app/http/debug.clj
@@ -16,7 +16,6 @@
   [app.config :as cf]
   [app.db :as db]
   [app.http.session :as session]
-   [app.main :as-alias main]
   [app.rpc.commands.auth :as auth]
   [app.rpc.commands.files-create :refer [create-file]]
   [app.rpc.commands.profile :as profile]
@@ -341,57 +340,57 @@
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

 (defn- resend-email-notification
-  [{:keys [::db/pool ::setup/props] :as cfg} {:keys [params] :as request}]
+  [cfg {:keys [params] :as request}]
+  (db/tx-run! cfg (fn [{:keys [::db/conn] :as cfg}]
+                    (when-not (contains? params :force)
+                      (ex/raise :type :validation
+                                :code :missing-force
+                                :hint "missing force checkbox"))

-  (when-not (contains? params :force)
-    (ex/raise :type :validation
-              :code :missing-force
-              :hint "missing force checkbox"))
+                    (let [profile (some->> params
+                                           :email
+                                           (profile/clean-email)
+                                           (profile/get-profile-by-email conn))]

-  (let [profile (some->> params
-                         :email
-                         (profile/clean-email)
-                         (profile/get-profile-by-email pool))]
+                      (when-not profile
+                        (ex/raise :type :validation
+                                  :code :missing-profile
+                                  :hint "unable to find profile by email"))

-    (when-not profile
-      (ex/raise :type :validation
-                :code :missing-profile
-                :hint "unable to find profile by email"))
+                      (cond
+                        (contains? params :block)
+                        (do
+                          (db/update! conn :profile {:is-blocked true} {:id (:id profile)})
+                          (db/delete! conn :http-session {:profile-id (:id profile)})

-    (cond
-      (contains? params :block)
-      (do
-        (db/update! pool :profile {:is-blocked true} {:id (:id profile)})
-        (db/delete! pool :http-session {:profile-id (:id profile)})
+                          {::rres/status  200
+                           ::rres/headers {"content-type" "text/plain"}
+                           ::rres/body    (str/ffmt "PROFILE '%' BLOCKED" (:email profile))})

-        {::rres/status  200
-         ::rres/headers {"content-type" "text/plain"}
-         ::rres/body    (str/ffmt "PROFILE '%' BLOCKED" (:email profile))})
+                        (contains? params :unblock)
+                        (do
+                          (db/update! conn :profile {:is-blocked false} {:id (:id profile)})
+                          {::rres/status  200
+                           ::rres/headers {"content-type" "text/plain"}
+                           ::rres/body    (str/ffmt "PROFILE '%' UNBLOCKED" (:email profile))})

-      (contains? params :unblock)
-      (do
-        (db/update! pool :profile {:is-blocked false} {:id (:id profile)})
-        {::rres/status  200
-         ::rres/headers {"content-type" "text/plain"}
-         ::rres/body    (str/ffmt "PROFILE '%' UNBLOCKED" (:email profile))})
+                        (contains? params :resend)
+                        (if (:is-blocked profile)
+                          {::rres/status  200
+                           ::rres/headers {"content-type" "text/plain"}
+                           ::rres/body    "PROFILE ALREADY BLOCKED"}
+                          (do
+                            (#'auth/send-email-verification! cfg profile)
+                            {::rres/status  200
+                             ::rres/headers {"content-type" "text/plain"}
+                             ::rres/body    (str/ffmt "RESENDED FOR '%'" (:email profile))}))

-      (contains? params :resend)
-      (if (:is-blocked profile)
-        {::rres/status  200
-         ::rres/headers {"content-type" "text/plain"}
-         ::rres/body    "PROFILE ALREADY BLOCKED"}
-        (do
-          (auth/send-email-verification! pool props profile)
-          {::rres/status  200
-           ::rres/headers {"content-type" "text/plain"}
-           ::rres/body    (str/ffmt "RESENDED FOR '%'" (:email profile))}))
-
-      :else
-      (do
-        (db/update! pool :profile {:is-active true} {:id (:id profile)})
-        {::rres/status  200
-         ::rres/headers {"content-type" "text/plain"}
-         ::rres/body    (str/ffmt "PROFILE '%' ACTIVATED" (:email profile))}))))
+                        :else
+                        (do
+                          (db/update! conn :profile {:is-active true} {:id (:id profile)})
+                          {::rres/status  200
+                           ::rres/headers {"content-type" "text/plain"}
+                           ::rres/body    (str/ffmt "PROFILE '%' ACTIVATED" (:email profile))}))))))


 (defn- reset-file-version
--- a/backend/src/app/http/errors.clj
+++ b/backend/src/app/http/errors.clj
@@ -14,32 +14,28 @@
   [app.http :as-alias http]
   [app.http.access-token :as-alias actoken]
   [app.http.session :as-alias session]
+   [app.util.inet :as inet]
   [clojure.spec.alpha :as s]
-   [cuerdas.core :as str]
   [ring.request :as rreq]
   [ring.response :as rres]))

-(defn- parse-client-ip
-  [request]
-  (or (some-> (rreq/get-header request "x-forwarded-for") (str/split ",") first)
-      (rreq/get-header request "x-real-ip")
-      (rreq/remote-addr request)))
-
 (defn request->context
  "Extracts error report relevant context data from request."
  [request]
  (let [claims (-> {}
                   (into (::session/token-claims request))
                   (into (::actoken/token-claims request)))]
+
    {:request/path       (:path request)
     :request/method     (:method request)
     :request/params     (:params request)
     :request/user-agent (rreq/get-header request "user-agent")
-     :request/ip-addr    (parse-client-ip request)
+     :request/ip-addr    (inet/parse-request request)
     :request/profile-id (:uid claims)
     :version/frontend   (or (rreq/get-header request "x-frontend-version") "unknown")
     :version/backend    (:full cf/version)}))

+
 (defmulti handle-error
  (fn [cause _ _]
    (-> cause ex-data :type)))
--- a/backend/src/app/http/middleware.clj
+++ b/backend/src/app/http/middleware.clj
@@ -7,19 +7,19 @@
 (ns app.http.middleware
  (:require
   [app.common.exceptions :as ex]
+   [app.common.json :as json]
   [app.common.logging :as l]
+   [app.common.schema :as-alias sm]
   [app.common.transit :as t]
   [app.config :as cf]
-   [app.util.json :as json]
+   [app.http.errors :as errors]
+   [app.util.pointer-map :as pmap]
   [cuerdas.core :as str]
   [ring.request :as rreq]
   [ring.response :as rres]
   [yetti.adapter :as yt]
   [yetti.middleware :as ymw])
  (:import
-   com.fasterxml.jackson.core.JsonParseException
-   com.fasterxml.jackson.core.io.JsonEOFException
-   com.fasterxml.jackson.databind.exc.MismatchedInputException
   io.undertow.server.RequestTooBigException
   java.io.InputStream
   java.io.OutputStream))
@@ -34,11 +34,12 @@
  {:name ::params
   :compile (constantly ymw/wrap-params)})

-(def ^:private json-mapper
-  (json/mapper
-   {:encode-key-fn str/camel
-    :decode-key-fn (comp keyword str/kebab)
-    :pretty true}))
+(defn- get-reader
+  ^java.io.BufferedReader
+  [request]
+  (let [^InputStream body (rreq/body request)]
+    (java.io.BufferedReader.
+     (java.io.InputStreamReader. body))))

 (defn wrap-parse-request
  [handler]
@@ -53,8 +54,8 @@
                        (update :params merge params))))

                (str/starts-with? header "application/json")
-                (with-open [^InputStream is (rreq/body request)]
-                  (let [params (json/decode is json-mapper)]
+                (with-open [reader (get-reader request)]
+                  (let [params (json/read reader :key-fn json/read-kebab-key)]
                    (-> request
                        (assoc :body-params params)
                        (update :params merge params))))
@@ -62,35 +63,33 @@
                :else
                request)))

-          (handle-error [cause]
+          (handle-error [cause request]
            (cond
              (instance? RuntimeException cause)
              (if-let [cause (ex-cause cause)]
-                (handle-error cause)
-                (throw cause))
+                (handle-error cause request)
+                (errors/handle cause request))

              (instance? RequestTooBigException cause)
              (ex/raise :type :validation
                        :code :request-body-too-large
                        :hint (ex-message cause))

-              (or (instance? JsonEOFException cause)
-                  (instance? JsonParseException cause)
-                  (instance? MismatchedInputException cause))
+              (instance? java.io.EOFException cause)
              (ex/raise :type :validation
                        :code :malformed-json
                        :hint (ex-message cause)
                        :cause cause)

              :else
-              (throw cause)))]
+              (errors/handle cause request)))]

    (fn [request]
      (if (= (rreq/method request) :post)
-        (let [request (ex/try! (process-request request))]
-          (if (ex/exception? request)
-            (handle-error request)
-            (handler request)))
+        (try
+          (-> request process-request handler)
+          (catch Throwable cause
+            (handle-error cause request)))
        (handler request)))))

 (def parse-request
@@ -106,6 +105,12 @@

 (def ^:const buffer-size (:xnio/buffer-size yt/defaults))

+(defn- write-json-value
+  [_ val]
+  (if (pmap/pointer-map? val)
+    [(pmap/get-id val) (meta val)]
+    val))
+
 (defn wrap-format-response
  [handler]
  (letfn [(transit-streamable-body [data opts]
@@ -127,9 +132,11 @@
            (reify rres/StreamableResponseBody
              (-write-body-to-stream [_ _ output-stream]
                (try
-                  (with-open [^OutputStream bos (buffered-output-stream output-stream buffer-size)]
-                    (json/write! bos data json-mapper))
-
+                  (let [encode (or (-> data meta :encode/json) identity)
+                        data   (encode data)]
+                    (with-open [^OutputStream bos (buffered-output-stream output-stream buffer-size)]
+                      (with-open [^java.io.OutputStreamWriter writer (java.io.OutputStreamWriter. bos)]
+                        (json/write writer data :key-fn json/write-camel-key :value-fn write-json-value))))
                  (catch java.io.IOException _)
                  (catch Throwable cause
                    (binding [l/*context* {:value data}]
--- a/backend/src/app/http/session.clj
+++ b/backend/src/app/http/session.clj
@@ -10,6 +10,7 @@
   [app.common.data :as d]
   [app.common.logging :as l]
   [app.common.spec :as us]
+   [app.common.uri :as u]
   [app.config :as cf]
   [app.db :as db]
   [app.db.sql :as sql]
@@ -33,7 +34,7 @@

 ;; A cookie that we can use to check from other sites of the same
 ;; domain if a user is authenticated.
-(def default-authenticated-cookie-name "authenticated")
+(def default-auth-data-cookie-name "auth-data")

 ;; Default value for cookie max-age
 (def default-cookie-max-age (dt/duration {:days 7}))
@@ -133,9 +134,9 @@
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

 (declare ^:private assign-auth-token-cookie)
-(declare ^:private assign-authenticated-cookie)
+(declare ^:private assign-auth-data-cookie)
 (declare ^:private clear-auth-token-cookie)
-(declare ^:private clear-authenticated-cookie)
+(declare ^:private clear-auth-data-cookie)
 (declare ^:private gen-token)

 (defn create-fn
@@ -153,7 +154,7 @@
      (l/trace :hint "create" :profile-id (str profile-id))
      (-> response
          (assign-auth-token-cookie session)
-          (assign-authenticated-cookie session)))))
+          (assign-auth-data-cookie session)))))

 (defn delete-fn
  [{:keys [::manager]}]
@@ -167,7 +168,7 @@
          (assoc :status 204)
          (assoc :body nil)
          (clear-auth-token-cookie)
-          (clear-authenticated-cookie)))))
+          (clear-auth-data-cookie)))))

 (defn- gen-token
  [props {:keys [profile-id created-at]}]
@@ -229,7 +230,7 @@
        (let [session (update! manager session)]
          (-> response
              (assign-auth-token-cookie session)
-              (assign-authenticated-cookie session)))
+              (assign-auth-data-cookie session)))
        response))))

 (def soft-auth
@@ -262,11 +263,11 @@
                    :secure secure?}]
    (update response :cookies assoc name cookie)))

-(defn- assign-authenticated-cookie
-  [response {updated-at :updated-at}]
+(defn- assign-auth-data-cookie
+  [response {profile-id :profile-id updated-at :updated-at}]
  (let [max-age    (cf/get :auth-token-cookie-max-age default-cookie-max-age)
-        domain     (cf/get :authenticated-cookie-domain)
-        cname      (cf/get :authenticated-cookie-name "authenticated")
+        domain     (cf/get :auth-data-cookie-domain)
+        cname      default-auth-data-cookie-name

        created-at (or updated-at (dt/now))
        renewal    (dt/plus created-at default-renewal-max-age)
@@ -274,14 +275,17 @@

        comment    (str "Renewal at: " (dt/format-instant renewal :rfc1123))
        secure?    (contains? cf/flags :secure-session-cookies)
+        strict?    (contains? cf/flags :strict-session-cookies)
+        cors?      (contains? cf/flags :cors)

        cookie     {:domain domain
                    :expires expires
                    :path "/"
                    :comment comment
-                    :value true
-                    :same-site :strict
+                    :value (u/map->query-string {:profile-id profile-id})
+                    :same-site (if cors? :none (if strict? :strict :lax))
                    :secure secure?}]
+
    (cond-> response
      (string? domain)
      (update :cookies assoc cname cookie))))
@@ -291,10 +295,10 @@
  (let [cname (cf/get :auth-token-cookie-name default-auth-token-cookie-name)]
    (update response :cookies assoc cname {:path "/" :value "" :max-age 0})))

-(defn- clear-authenticated-cookie
+(defn- clear-auth-data-cookie
  [response]
-  (let [cname  (cf/get :authenticated-cookie-name default-authenticated-cookie-name)
-        domain (cf/get :authenticated-cookie-domain)]
+  (let [cname  default-auth-data-cookie-name
+        domain (cf/get :auth-data-cookie-domain)]
    (cond-> response
      (string? domain)
      (update :cookies assoc cname {:domain domain :path "/" :value "" :max-age 0}))))
--- a/backend/src/app/http/sse.clj
+++ b/backend/src/app/http/sse.clj
@@ -61,6 +61,8 @@
                           (let [result (handler)]
                             (events/tap :end result))
                           (catch Throwable cause
+                             (l/err :hint "unexpected error on processing sse response"
+                                    :cause cause)
                             (events/tap :error (errors/handle' cause request)))
                           (finally
                             (sp/close! events/*channel*)
--- a/backend/src/app/loggers/audit.clj
+++ b/backend/src/app/loggers/audit.clj
@@ -21,24 +21,18 @@
   [app.rpc :as-alias rpc]
   [app.rpc.retry :as rtry]
   [app.setup :as-alias setup]
+   [app.util.inet :as inet]
   [app.util.services :as-alias sv]
   [app.util.time :as dt]
   [app.worker :as wrk]
   [clojure.spec.alpha :as s]
   [cuerdas.core :as str]
-   [integrant.core :as ig]
-   [ring.request :as rreq]))
+   [integrant.core :as ig]))

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; HELPERS
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

-(defn parse-client-ip
-  [request]
-  (or (some-> (rreq/get-header request "x-forwarded-for") (str/split ",") first)
-      (rreq/get-header request "x-real-ip")
-      (some-> (rreq/remote-addr request) str)))
-
 (defn extract-utm-params
  "Extracts additional data from params and namespace them under
  `penpot` ns."
@@ -53,8 +47,7 @@
                (assoc (->> sk str/kebab (keyword "penpot")) v))))]
    (reduce-kv process-param {} params)))

-(def ^:private
-  profile-props
+(def profile-props
  [:id
   :is-active
   :is-muted
@@ -87,8 +80,19 @@
         (remove #(contains? reserved-props (key %))))
        props))

-;; --- SPECS
+(defn event-from-rpc-params
+  "Create a base event skeleton with pre-filled some important
+  data that can be extracted from RPC params object"
+  [params]
+  (let [context {:external-session-id (::rpc/external-session-id params)
+                 :external-event-origin (::rpc/external-event-origin params)
+                 :triggered-by (::rpc/handler-name params)}]
+    {::type "action"
+     ::profile-id (::rpc/profile-id params)
+     ::ip-addr (::rpc/ip-addr params)
+     ::context (d/without-nils context)}))

+;; --- SPECS

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; COLLECTOR
@@ -141,24 +145,31 @@
                       (::rpc/profile-id params)
                       uuid/zero)

-        props      (-> (or (::replace-props resultm)
-                           (-> params
-                               (merge (::props resultm))
-                               (dissoc :profile-id)
-                               (dissoc :type)))
+        session-id   (get params ::rpc/external-session-id)
+        event-origin (get params ::rpc/external-event-origin)
+        props        (-> (or (::replace-props resultm)
+                             (-> params
+                                 (merge (::props resultm))
+                                 (dissoc :profile-id)
+                                 (dissoc :type)))

-                       (clean-props))
+                         (clean-props))

        token-id  (::actoken/id request)
-        context   (d/without-nils
-                   {:access-token-id (some-> token-id str)})]
+        context   (-> (::context resultm)
+                      (assoc :external-session-id session-id)
+                      (assoc :external-event-origin event-origin)
+                      (assoc :access-token-id (some-> token-id str))
+                      (d/without-nils))
+
+        ip-addr   (inet/parse-request request)]

    {::type (or (::type resultm)
                (::rpc/type cfg))
     ::name (or (::name resultm)
                (::sv/name mdata))
     ::profile-id profile-id
-     ::ip-addr (some-> request parse-client-ip)
+     ::ip-addr ip-addr
     ::props props
     ::context context

@@ -180,15 +191,33 @@
         (::webhooks/event? resultm)
         false)}))

-(defn- handle-event!
-  [cfg event]
+(defn- event->params
+  [event]
  (let [params {:id (uuid/next)
                :name (::name event)
                :type (::type event)
                :profile-id (::profile-id event)
                :ip-addr (::ip-addr event)
-                :context (::context event)
-                :props (::props event)}
+                :context (::context event {})
+                :props (::props event {})
+                :source "backend"}
+        tnow   (::tracked-at event)]
+
+    (cond-> params
+      (some? tnow)
+      (assoc :tracked-at tnow))))
+
+(defn- append-audit-entry!
+  [cfg params]
+  (let [params (-> params
+                   (update :props db/tjson)
+                   (update :context db/tjson)
+                   (update :ip-addr db/inet))]
+    (db/insert! cfg :audit-log params)))
+
+(defn- handle-event!
+  [cfg event]
+  (let [params (event->params event)
        tnow   (dt/now)]

    (when (contains? cf/flags :audit-log)
@@ -197,12 +226,8 @@
      ;; this case we just retry the operation.
      (let [params (-> params
                       (assoc :created-at tnow)
-                       (assoc :tracked-at tnow)
-                       (update :props db/tjson)
-                       (update :context db/tjson)
-                       (update :ip-addr db/inet)
-                       (assoc :source "backend"))]
-        (db/insert! cfg :audit-log params)))
+                       (update :tracked-at #(or % tnow)))]
+        (append-audit-entry! cfg params)))

    (when (and (or (contains? cf/flags :telemetry)
                   (cf/get :telemetry-enabled))
@@ -214,12 +239,10 @@
      ;; NOTE: this is only executed when general audit log is disabled
      (let [params (-> params
                       (assoc :created-at tnow)
-                       (assoc :tracked-at tnow)
-                       (assoc :props (db/tjson {}))
-                       (assoc :context (db/tjson {}))
-                       (assoc :ip-addr (db/inet "0.0.0.0"))
-                       (assoc :source "backend"))]
-        (db/insert! cfg :audit-log params)))
+                       (update :tracked-at #(or % tnow))
+                       (assoc :props {})
+                       (assoc :context {}))]
+        (append-audit-entry! cfg params)))

    (when (and (contains? cf/flags :webhooks)
               (::webhooks/event? event))
@@ -232,25 +255,25 @@
                            :else               label)
            dedupe?       (boolean (and batch-key batch-timeout))]

-        (wrk/submit! ::wrk/conn (::db/conn cfg)
-                     ::wrk/task :process-webhook-event
-                     ::wrk/queue :webhooks
-                     ::wrk/max-retries 0
-                     ::wrk/delay (or batch-timeout 0)
-                     ::wrk/dedupe dedupe?
-                     ::wrk/label label
-
-                     ::webhooks/event
-                     (-> params
-                         (dissoc :ip-addr)
-                         (dissoc :type)))))
+        (wrk/submit! (-> cfg
+                         (assoc ::wrk/task :process-webhook-event)
+                         (assoc ::wrk/queue :webhooks)
+                         (assoc ::wrk/max-retries 0)
+                         (assoc ::wrk/delay (or batch-timeout 0))
+                         (assoc ::wrk/dedupe dedupe?)
+                         (assoc ::wrk/label label)
+                         (assoc ::wrk/params (-> params
+                                                 (dissoc :source)
+                                                 (dissoc :context)
+                                                 (dissoc :ip-addr)
+                                                 (dissoc :type)))))))
    params))

 (defn submit!
  "Submit audit event to the collector."
-  [cfg params]
+  [cfg event]
  (try
-    (let [event (d/without-nils params)
+    (let [event (d/without-nils event)
          cfg   (-> cfg
                    (assoc ::rtry/when rtry/conflict-exception?)
                    (assoc ::rtry/max-retries 6)
@@ -259,3 +282,18 @@
      (rtry/invoke! cfg db/tx-run! handle-event! event))
    (catch Throwable cause
      (l/error :hint "unexpected error processing event" :cause cause))))
+
+(defn insert!
+  "Submit audit event to the collector, intended to be used only from
+  command line helpers because this skips all webhooks and telemetry
+  logic."
+  [cfg event]
+  (when (contains? cf/flags :audit-log)
+    (let [event (d/without-nils event)]
+      (us/verify! ::event event)
+      (db/run! cfg (fn [cfg]
+                     (let [tnow   (dt/now)
+                           params (-> (event->params event)
+                                      (assoc :created-at tnow)
+                                      (update :tracked-at #(or % tnow)))]
+                       (append-audit-entry! cfg params)))))))
--- a/backend/src/app/loggers/webhooks.clj
+++ b/backend/src/app/loggers/webhooks.clj
@@ -64,23 +64,20 @@
  (s/keys :req [::db/pool]))

 (defmethod ig/init-key ::process-event-handler
-  [_ {:keys [::db/pool] :as cfg}]
+  [_ cfg]
  (fn [{:keys [props] :as task}]
-    (let [event (::event props)]
-      (l/dbg :hint "process webhook event" :name (:name event))
-
-      (when-let [items (lookup-webhooks cfg event)]
-        (l/trc :hint "webhooks found for event" :total (count items))
-
-        (db/with-atomic [conn pool]
-          (doseq [item items]
-            (wrk/submit! ::wrk/conn conn
-                         ::wrk/task :run-webhook
-                         ::wrk/queue :webhooks
-                         ::wrk/max-retries 3
-                         ::event event
-                         ::config item)))))))
+    (l/dbg :hint "process webhook event" :name (:name props))

+    (when-let [items (lookup-webhooks cfg props)]
+      (l/trc :hint "webhooks found for event" :total (count items))
+      (db/tx-run! cfg (fn [cfg]
+                        (doseq [item items]
+                          (wrk/submit! (-> cfg
+                                           (assoc ::wrk/task :run-webhook)
+                                           (assoc ::wrk/queue :webhooks)
+                                           (assoc ::wrk/max-retries 3)
+                                           (assoc ::wrk/params {:event props
+                                                                :config item})))))))))
 ;; --- RUN

 (declare interpret-exception)
@@ -128,8 +125,8 @@
                         :rsp-data (db/tjson rsp)}))]

    (fn [{:keys [props] :as task}]
-      (let [event (::event props)
-            whook (::config props)
+      (let [event (:event props)
+            whook (:config props)

            body  (case (:mtype whook)
                    "application/json" (json/write-str event json-write-opts)
--- a/backend/src/app/main.clj
+++ b/backend/src/app/main.clj
@@ -102,13 +102,13 @@
   {::mdef/name "penpot_tasks_timing"
    ::mdef/help "Background tasks timing (milliseconds)."
    ::mdef/labels ["name"]
-    ::mdef/type :summary}
+    ::mdef/type :histogram}

   :redis-eval-timing
   {::mdef/name "penpot_redis_eval_timing"
    ::mdef/help "Redis EVAL commands execution timings (ms)"
    ::mdef/labels ["name"]
-    ::mdef/type :summary}
+    ::mdef/type :histogram}

   :rpc-climit-queue
   {::mdef/name "penpot_rpc_climit_queue"
@@ -126,7 +126,7 @@
   {::mdef/name "penpot_rpc_climit_timing"
    ::mdef/help "Summary of the time between queuing and executing on the CLIMIT"
    ::mdef/labels ["name"]
-    ::mdef/type :summary}
+    ::mdef/type :histogram}

   :audit-http-handler-queue-size
   {::mdef/name "penpot_audit_http_handler_queue_size"
@@ -144,7 +144,7 @@
   {::mdef/name "penpot_audit_http_handler_timing"
    ::mdef/help "Summary of the time between queuing and executing on the audit log http handler"
    ::mdef/labels []
-    ::mdef/type :summary}
+    ::mdef/type :histogram}

   :executors-active-threads
   {::mdef/name "penpot_executors_active_threads"
@@ -254,7 +254,7 @@
   {::http.client/client (ig/ref ::http.client/client)}

   ::oidc.providers/gitlab
-   {}
+   {::http.client/client (ig/ref ::http.client/client)}

   ::oidc.providers/generic
   {::http.client/client (ig/ref ::http.client/client)}
@@ -267,7 +267,9 @@
                          :github (ig/ref ::oidc.providers/github)
                          :gitlab (ig/ref ::oidc.providers/gitlab)
                          :oidc   (ig/ref ::oidc.providers/generic)}
-    ::session/manager    (ig/ref ::session/manager)}
+    ::session/manager    (ig/ref ::session/manager)
+    ::email/blacklist    (ig/ref ::email/blacklist)
+    ::email/whitelist    (ig/ref ::email/whitelist)}

   :app.http/router
   {::session/manager    (ig/ref ::session/manager)
@@ -322,7 +324,10 @@
    ::rpc/climit         (ig/ref ::rpc/climit)
    ::rpc/rlimit         (ig/ref ::rpc/rlimit)
    ::setup/templates    (ig/ref ::setup/templates)
-    ::setup/props        (ig/ref ::setup/props)}
+    ::setup/props        (ig/ref ::setup/props)
+
+    ::email/blacklist    (ig/ref ::email/blacklist)
+    ::email/whitelist    (ig/ref ::email/whitelist)}

   :app.rpc.doc/routes
   {:methods (ig/ref :app.rpc/methods)}
@@ -338,8 +343,9 @@
    ::wrk/tasks
    {:sendmail           (ig/ref ::email/handler)
     :objects-gc         (ig/ref :app.tasks.objects-gc/handler)
-     :orphan-teams-gc    (ig/ref :app.tasks.orphan-teams-gc/handler)
     :file-gc            (ig/ref :app.tasks.file-gc/handler)
+     :file-gc-scheduler  (ig/ref :app.tasks.file-gc-scheduler/handler)
+     :offload-file-data  (ig/ref :app.tasks.offload-file-data/handler)
     :file-xlog-gc       (ig/ref :app.tasks.file-xlog-gc/handler)
     :tasks-gc           (ig/ref :app.tasks.tasks-gc/handler)
     :telemetry          (ig/ref :app.tasks.telemetry/handler)
@@ -349,11 +355,19 @@
     :audit-log-archive  (ig/ref :app.loggers.audit.archive-task/handler)
     :audit-log-gc       (ig/ref :app.loggers.audit.gc-task/handler)

+     :delete-object
+     (ig/ref :app.tasks.delete-object/handler)
     :process-webhook-event
     (ig/ref ::webhooks/process-event-handler)
     :run-webhook
     (ig/ref ::webhooks/run-webhook-handler)}}

+   ::email/blacklist
+   {}
+
+   ::email/whitelist
+   {}
+
   ::email/sendmail
   {::email/host             (cf/get :smtp-host)
    ::email/port             (cf/get :smtp-port)
@@ -375,16 +389,24 @@
   {::db/pool     (ig/ref ::db/pool)
    ::sto/storage (ig/ref ::sto/storage)}

-   :app.tasks.orphan-teams-gc/handler
-   {::db/pool     (ig/ref ::db/pool)}
+   :app.tasks.delete-object/handler
+   {::db/pool (ig/ref ::db/pool)}

   :app.tasks.file-gc/handler
   {::db/pool     (ig/ref ::db/pool)
    ::sto/storage (ig/ref ::sto/storage)}

-   :app.tasks.file-xlog-gc/handler
+   :app.tasks.file-gc-scheduler/handler
   {::db/pool (ig/ref ::db/pool)}

+   :app.tasks.offload-file-data/handler
+   {::db/pool     (ig/ref ::db/pool)
+    ::sto/storage (ig/ref ::sto/storage)}
+
+   :app.tasks.file-xlog-gc/handler
+   {::db/pool     (ig/ref ::db/pool)
+    ::sto/storage (ig/ref ::sto/storage)}
+
   :app.tasks.telemetry/handler
   {::db/pool            (ig/ref ::db/pool)
    ::http.client/client (ig/ref ::http.client/client)
@@ -436,17 +458,28 @@
   ::sto/storage
   {::db/pool      (ig/ref ::db/pool)
    ::sto/backends
-    {:assets-s3 (ig/ref [::assets :app.storage.s3/backend])
-     :assets-fs (ig/ref [::assets :app.storage.fs/backend])}}
+    {:s3 (ig/ref :app.storage.s3/backend)
+     :fs (ig/ref :app.storage.fs/backend)

-   [::assets :app.storage.s3/backend]
-   {::sto.s3/region     (cf/get :storage-assets-s3-region)
-    ::sto.s3/endpoint   (cf/get :storage-assets-s3-endpoint)
-    ::sto.s3/bucket     (cf/get :storage-assets-s3-bucket)
-    ::sto.s3/io-threads (cf/get :storage-assets-s3-io-threads)}
+     ;; LEGACY (should not be removed, can only be removed after an
+     ;; explicit migration because the database objects/rows will
+     ;; still reference the old names).
+     :assets-s3 (ig/ref :app.storage.s3/backend)
+     :assets-fs (ig/ref :app.storage.fs/backend)}}

-   [::assets :app.storage.fs/backend]
-   {::sto.fs/directory (cf/get :storage-assets-fs-directory)}})
+   :app.storage.s3/backend
+   {::sto.s3/region     (or (cf/get :storage-assets-s3-region)
+                            (cf/get :objects-storage-s3-region))
+    ::sto.s3/endpoint   (or (cf/get :storage-assets-s3-endpoint)
+                            (cf/get :objects-storage-s3-endpoint))
+    ::sto.s3/bucket     (or (cf/get :storage-assets-s3-bucket)
+                            (cf/get :objects-storage-s3-bucket))
+    ::sto.s3/io-threads (or (cf/get :storage-assets-s3-io-threads)
+                            (cf/get :objects-storage-s3-io-threads))}
+
+   :app.storage.fs/backend
+   {::sto.fs/directory (or (cf/get :storage-assets-fs-directory)
+                           (cf/get :objects-storage-fs-directory))}})


 (def worker-config
@@ -463,9 +496,6 @@
     {:cron #app/cron "0 0 0 * * ?" ;; daily
      :task :objects-gc}

-     {:cron #app/cron "0 0 0 * * ?" ;; daily
-      :task :orphan-teams-gc}
-
     {:cron #app/cron "0 0 0 * * ?" ;; daily
      :task :storage-gc-deleted}

@@ -476,7 +506,7 @@
      :task :tasks-gc}

     {:cron #app/cron "0 0 2 * * ?" ;; daily
-      :task :file-gc}
+      :task :file-gc-scheduler}

     {:cron #app/cron "0 30 */3,23 * * ?"
      :task :telemetry}
@@ -515,6 +545,7 @@

 (defn start
  []
+  (cf/validate!)
  (ig/load-namespaces (merge system-config worker-config))
  (alter-var-root #'system (fn [sys]
                             (when sys (ig/halt! sys))
--- a/backend/src/app/media.clj
+++ b/backend/src/app/media.clj
@@ -11,7 +11,6 @@
   [app.common.exceptions :as ex]
   [app.common.media :as cm]
   [app.common.schema :as sm]
-   [app.common.schema.generators :as sg]
   [app.common.schema.openapi :as-alias oapi]
   [app.common.spec :as us]
   [app.common.svg :as csvg]
@@ -47,22 +46,10 @@
  (s/keys :req-un [::path]
          :opt-un [::mtype]))

-(sm/def! ::fs/path
-  {:type ::fs/path
-   :pred fs/path?
-   :type-properties
-   {:title "path"
-    :description "filesystem path"
-    :error/message "expected a valid fs path instance"
-    :gen/gen (sg/generator :string)
-    ::oapi/type "string"
-    ::oapi/format "unix-path"
-    ::oapi/decode fs/path}})
-
-(sm/def! ::upload
+(sm/register! ::upload
  [:map {:title "Upload"}
   [:filename :string]
-   [:size :int]
+   [:size ::sm/int]
   [:path ::fs/path]
   [:mtype {:optional true} :string]
   [:headers {:optional true}
@@ -326,17 +313,3 @@
              (= stype :ttf)
              (-> (assoc "font/otf" (ttf->otf sfnt))
                  (assoc "font/ttf" sfnt)))))))))
-
-
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; Utility functions
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-
-(defn configure-assets-storage
-  "Given storage map, returns a storage configured with the appropriate
-  backend for assets and optional connection attached."
-  ([storage]
-   (assoc storage ::sto/backend (cf/get :assets-storage-backend :assets-fs)))
-  ([storage pool-or-conn]
-   (-> (configure-assets-storage storage)
-       (assoc ::db/pool-or-conn pool-or-conn))))
--- a/backend/src/app/migrations.clj
+++ b/backend/src/app/migrations.clj
@@ -379,7 +379,40 @@
    :fn (mg/resource "app/migrations/sql/0119-mod-file-table.sql")}

   {:name "0120-mod-audit-log-table"
-    :fn (mg/resource "app/migrations/sql/0120-mod-audit-log-table.sql")}])
+    :fn (mg/resource "app/migrations/sql/0120-mod-audit-log-table.sql")}
+
+   {:name "0121-mod-file-data-fragment-table"
+    :fn (mg/resource "app/migrations/sql/0121-mod-file-data-fragment-table.sql")}
+
+   {:name "0122-mod-file-table"
+    :fn (mg/resource "app/migrations/sql/0122-mod-file-table.sql")}
+
+   {:name "0122-mod-file-data-fragment-table"
+    :fn (mg/resource "app/migrations/sql/0122-mod-file-data-fragment-table.sql")}
+
+   {:name "0123-mod-file-change-table"
+    :fn (mg/resource "app/migrations/sql/0123-mod-file-change-table.sql")}
+
+   {:name "0124-mod-profile-table"
+    :fn (mg/resource "app/migrations/sql/0124-mod-profile-table.sql")}
+
+   {:name "0125-mod-file-table"
+    :fn (mg/resource "app/migrations/sql/0125-mod-file-table.sql")}
+
+   {:name "0126-add-team-access-request-table"
+    :fn (mg/resource "app/migrations/sql/0126-add-team-access-request-table.sql")}
+
+   {:name "0127-mod-storage-object-table"
+    :fn (mg/resource "app/migrations/sql/0127-mod-storage-object-table.sql")}
+
+   {:name "0128-mod-task-table"
+    :fn (mg/resource "app/migrations/sql/0128-mod-task-table.sql")}
+
+   {:name "0129-mod-file-change-table"
+    :fn (mg/resource "app/migrations/sql/0129-mod-file-change-table.sql")}
+
+   {:name "0130-mod-file-change-table"
+    :fn (mg/resource "app/migrations/sql/0130-mod-file-change-table.sql")}])

 (defn apply-migrations!
  [pool name migrations]
--- a/backend/src/app/migrations/sql/0121-mod-file-data-fragment-table.sql
+++ b/backend/src/app/migrations/sql/0121-mod-file-data-fragment-table.sql
@@ -0,0 +1,8 @@
+ALTER TABLE file_data_fragment
+  ADD COLUMN data bytea NULL;
+
+UPDATE file_data_fragment
+   SET data = content;
+
+ALTER TABLE file_data_fragment
+ DROP COLUMN content;
--- a/backend/src/app/migrations/sql/0122-mod-file-data-fragment-table.sql
+++ b/backend/src/app/migrations/sql/0122-mod-file-data-fragment-table.sql
@@ -0,0 +1,6 @@
+ALTER TABLE file_data_fragment
+  ADD COLUMN data_backend text NULL,
+  ADD COLUMN data_ref_id uuid NULL;
+
+CREATE INDEX IF NOT EXISTS file_data_fragment__data_ref_id__idx
+    ON file_data_fragment (data_ref_id);
--- a/backend/src/app/migrations/sql/0122-mod-file-fragment-table.sql
+++ b/backend/src/app/migrations/sql/0122-mod-file-fragment-table.sql
@@ -0,0 +1,6 @@
+ALTER TABLE file_data_fragment
+  ADD COLUMN data_backend text NULL,
+  ADD COLUMN data_ref_id uuid NULL;
+
+CREATE INDEX IF NOT EXISTS file_data_fragment__data_ref_id__idx
+    ON file_data_fragment (data_ref_id);
--- a/backend/src/app/migrations/sql/0122-mod-file-table.sql
+++ b/backend/src/app/migrations/sql/0122-mod-file-table.sql
@@ -0,0 +1,4 @@
+ALTER TABLE file ADD COLUMN data_ref_id uuid NULL;
+
+CREATE INDEX IF NOT EXISTS file__data_ref_id__idx
+    ON file (data_ref_id);
--- a/backend/src/app/migrations/sql/0123-mod-file-change-table.sql
+++ b/backend/src/app/migrations/sql/0123-mod-file-change-table.sql
@@ -0,0 +1,2 @@
+CREATE INDEX IF NOT EXISTS file_change__created_at__label__idx
+    ON file_change (created_at, label);
--- a/backend/src/app/migrations/sql/0124-mod-profile-table.sql
+++ b/backend/src/app/migrations/sql/0124-mod-profile-table.sql
@@ -0,0 +1,2 @@
+CREATE INDEX profile__props__newsletter1__idx ON profile (email) WHERE props->>'~:newsletter-news' = 'true';
+CREATE INDEX profile__props__newsletter2__idx ON profile (email) WHERE props->>'~:newsletter-updates' = 'true';
--- a/backend/src/app/migrations/sql/0125-mod-file-table.sql
+++ b/backend/src/app/migrations/sql/0125-mod-file-table.sql
@@ -0,0 +1,3 @@
+--- This setting allow to optimize the table for heavy write workload
+--- leaving space on the page for HOT updates
+ALTER TABLE file SET (FILLFACTOR=50);
--- a/backend/src/app/migrations/sql/0126-add-team-access-request-table.sql
+++ b/backend/src/app/migrations/sql/0126-add-team-access-request-table.sql
@@ -0,0 +1,10 @@
+CREATE TABLE team_access_request (
+  id uuid PRIMARY KEY DEFAULT uuid_generate_v4(),
+  team_id uuid NOT NULL REFERENCES team(id) ON DELETE CASCADE DEFERRABLE,
+  requester_id uuid NULL REFERENCES profile(id) ON DELETE CASCADE DEFERRABLE,
+  valid_until timestamptz NOT NULL,
+  auto_join_until timestamptz NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (team_id, requester_id)
+);
--- a/backend/src/app/migrations/sql/0127-mod-storage-object-table.sql
+++ b/backend/src/app/migrations/sql/0127-mod-storage-object-table.sql
@@ -0,0 +1,3 @@
+--- This setting allow to optimize the table for heavy write workload
+--- leaving space on the page for HOT updates
+ALTER TABLE storage_object SET (FILLFACTOR=60);
--- a/backend/src/app/migrations/sql/0128-mod-task-table.sql
+++ b/backend/src/app/migrations/sql/0128-mod-task-table.sql
@@ -0,0 +1,3 @@
+--- This setting allow to optimize the table for heavy write workload
+--- leaving space on the page for HOT updates
+ALTER TABLE task SET (FILLFACTOR=60);
--- a/backend/src/app/migrations/sql/0129-mod-file-change-table.sql
+++ b/backend/src/app/migrations/sql/0129-mod-file-change-table.sql
@@ -0,0 +1,6 @@
+ALTER TABLE file_change
+  ADD COLUMN data_backend text NULL,
+  ADD COLUMN data_ref_id uuid NULL;
+
+CREATE INDEX IF NOT EXISTS file_change__data_ref_id__idx
+    ON file_change (data_ref_id);
--- a/backend/src/app/migrations/sql/0130-mod-file-change-table.sql
+++ b/backend/src/app/migrations/sql/0130-mod-file-change-table.sql
@@ -0,0 +1,2 @@
+ALTER TABLE file_change
+  ADD COLUMN version integer NULL;
--- a/backend/src/app/rpc.clj
+++ b/backend/src/app/rpc.clj
@@ -29,6 +29,7 @@
   [app.rpc.rlimit :as rlimit]
   [app.setup :as-alias setup]
   [app.storage :as-alias sto]
+   [app.util.inet :as inet]
   [app.util.services :as sv]
   [app.util.time :as dt]
   [clojure.spec.alpha :as s]
@@ -70,6 +71,22 @@
        (handle-response-transformation request mdata)
        (handle-before-comple-hook mdata))))

+(defn get-external-session-id
+  [request]
+  (when-let [session-id (rreq/get-header request "x-external-session-id")]
+    (when-not (or (> (count session-id) 256)
+                  (= session-id "null")
+                  (str/blank? session-id))
+      session-id)))
+
+(defn- get-external-event-origin
+  [request]
+  (when-let [origin (rreq/get-header request "x-event-origin")]
+    (when-not (or (> (count origin) 256)
+                  (= origin "null")
+                  (str/blank? origin))
+      origin)))
+
 (defn- rpc-handler
  "Ring handler that dispatches cmd requests and convert between
  internal async flow into ring async flow."
@@ -79,8 +96,16 @@
        profile-id   (or (::session/profile-id request)
                         (::actoken/profile-id request))

+        ip-addr      (inet/parse-request request)
+        session-id   (get-external-session-id request)
+        event-origin (get-external-event-origin request)
+
        data         (-> params
+                         (assoc ::handler-name handler-name)
+                         (assoc ::ip-addr ip-addr)
                         (assoc ::request-at (dt/now))
+                         (assoc ::external-session-id session-id)
+                         (assoc ::external-event-origin event-origin)
                         (assoc ::session/id (::session/id request))
                         (assoc ::cond/key etag)
                         (cond-> (uuid? profile-id)
@@ -153,49 +178,31 @@
  (if-let [schema (::sm/params mdata)]
    (let [validate (sm/validator schema)
          explain  (sm/explainer schema)
-          decode   (sm/decoder schema)]
+          decode   (sm/decoder schema sm/json-transformer)
+          encode   (sm/encoder schema sm/json-transformer)]
      (fn [cfg params]
        (let [params (decode params)]
          (if (validate params)
-            (f cfg params)
-
+            (let [result (f cfg params)]
+              (if (instance? clojure.lang.IObj result)
+                (vary-meta result assoc :encode/json encode)
+                result))
            (let [params (d/without-qualified params)]
              (ex/raise :type :validation
                        :code :params-validation
                        ::sm/explain (explain params)))))))
    f))

-(defn- wrap-output-validation
-  [_ f mdata]
-  (if (contains? cf/flags :rpc-output-validation)
-    (or (when-let [schema (::sm/result mdata)]
-          (let [schema   (if (sm/lazy-schema? schema)
-                           schema
-                           (sm/define schema))
-                validate (sm/validator schema)
-                explain  (sm/explainer schema)]
-            (fn [cfg params]
-              (let [response (f cfg params)]
-                (when (map? response)
-                  (when-not (validate response)
-                    (ex/raise :type :validation
-                              :code :data-validation
-                              ::sm/explain (explain response))))
-                response))))
-        f)
-    f))
-
 (defn- wrap-all
  [cfg f mdata]
  (as-> f $
-    (wrap-metrics cfg $ mdata)
    (cond/wrap cfg $ mdata)
    (retry/wrap-retry cfg $ mdata)
    (climit/wrap cfg $ mdata)
+    (wrap-metrics cfg $ mdata)
    (rlimit/wrap cfg $ mdata)
    (wrap-audit cfg $ mdata)
    (wrap-spec-conform cfg $ mdata)
-    (wrap-output-validation cfg $ mdata)
    (wrap-params-validation cfg $ mdata)
    (wrap-authentication cfg $ mdata)))

--- a/backend/src/app/rpc/commands/access_token.clj
+++ b/backend/src/app/rpc/commands/access_token.clj
@@ -6,7 +6,7 @@

 (ns app.rpc.commands.access-token
  (:require
-   [app.common.spec :as us]
+   [app.common.schema :as sm]
   [app.common.uuid :as uuid]
   [app.db :as db]
   [app.main :as-alias main]
@@ -16,8 +16,7 @@
   [app.setup :as-alias setup]
   [app.tokens :as tokens]
   [app.util.services :as sv]
-   [app.util.time :as dt]
-   [clojure.spec.alpha :as s]))
+   [app.util.time :as dt]))

 (defn- decode-row
  [row]
@@ -44,7 +43,7 @@
                 :perms (db/create-array conn "text" [])})))


-(defn repl-create-access-token
+(defn repl:create-access-token
  [{:keys [::db/pool] :as system} profile-id name expiration]
  (db/with-atomic [conn pool]
    (let [props (:app.setup/props system)]
@@ -53,16 +52,14 @@
                           name
                           expiration))))

-(s/def ::name ::us/not-empty-string)
-(s/def ::expiration ::dt/duration)
-
-(s/def ::create-access-token
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::name]
-          :opt-un [::expiration]))
+(def ^:private schema:create-access-token
+  [:map {:title "create-access-token"}
+   [:name [:string {:max 250 :min 1}]]
+   [:expiration {:optional true} ::dt/duration]])

 (sv/defmethod ::create-access-token
-  {::doc/added "1.18"}
+  {::doc/added "1.18"
+   ::sm/params schema:create-access-token}
  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id name expiration]}]
  (db/with-atomic [conn pool]
    (let [cfg (assoc cfg ::db/conn conn)]
@@ -72,21 +69,23 @@
      (-> (create-access-token cfg profile-id name expiration)
          (decode-row)))))

-(s/def ::delete-access-token
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::us/id]))
+(def ^:private schema:delete-access-token
+  [:map {:title "delete-access-token"}
+   [:id ::sm/uuid]])

 (sv/defmethod ::delete-access-token
-  {::doc/added "1.18"}
+  {::doc/added "1.18"
+   ::sm/params schema:delete-access-token}
  [{:keys [::db/pool]} {:keys [::rpc/profile-id id]}]
  (db/delete! pool :access-token {:id id :profile-id profile-id})
  nil)

-(s/def ::get-access-tokens
-  (s/keys :req [::rpc/profile-id]))
+(def ^:private schema:get-access-tokens
+  [:map {:title "get-access-tokens"}])

 (sv/defmethod ::get-access-tokens
-  {::doc/added "1.18"}
+  {::doc/added "1.18"
+   ::sm/params schema:get-access-tokens}
  [{:keys [::db/pool]} {:keys [::rpc/profile-id]}]
  (->> (db/query pool :access-token
                 {:profile-id profile-id}
--- a/backend/src/app/rpc/commands/audit.clj
+++ b/backend/src/app/rpc/commands/audit.clj
@@ -14,11 +14,12 @@
   [app.config :as cf]
   [app.db :as db]
   [app.http :as-alias http]
-   [app.loggers.audit :as audit]
+   [app.loggers.audit :as-alias audit]
   [app.rpc :as-alias rpc]
   [app.rpc.climit :as-alias climit]
   [app.rpc.doc :as-alias doc]
   [app.rpc.helpers :as rph]
+   [app.util.inet :as inet]
   [app.util.services :as sv]
   [app.util.time :as dt]))

@@ -61,7 +62,7 @@
 (defn- handle-events
  [{:keys [::db/pool]} {:keys [::rpc/profile-id events] :as params}]
  (let [request (-> params meta ::http/request)
-        ip-addr (audit/parse-client-ip request)
+        ip-addr (inet/parse-request request)
        tnow    (dt/now)
        xform   (comp
                 (map (fn [event]
@@ -77,10 +78,19 @@
    (when (seq events)
      (db/insert-many! pool :audit-log event-columns events))))

+(def valid-event-types
+  #{"action" "identify"})
+
 (def schema:event
  [:map {:title "Event"}
-   [:name [:string {:max 250}]]
-   [:type [:string {:max 250}]]
+   [:name
+    [:and {:gen/elements ["update-file", "get-profile"]}
+     [:string {:max 250}]
+     [:re #"[\d\w-]{1,50}"]]]
+   [:type
+    [:and {:gen/elements valid-event-types}
+     [:string {:max 250}]
+     [::sm/one-of {:format "string"} valid-event-types]]]
   [:props
    [:map-of :keyword :any]]
   [:context {:optional true}
--- a/backend/src/app/rpc/commands/auth.clj
+++ b/backend/src/app/rpc/commands/auth.clj
@@ -6,7 +6,6 @@

 (ns app.rpc.commands.auth
  (:require
-   [app.auth :as auth]
   [app.common.data :as d]
   [app.common.data.macros :as dm]
   [app.common.exceptions :as ex]
@@ -17,9 +16,10 @@
   [app.config :as cf]
   [app.db :as db]
   [app.email :as eml]
+   [app.email.blacklist :as email.blacklist]
+   [app.email.whitelist :as email.whitelist]
   [app.http.session :as session]
   [app.loggers.audit :as audit]
-   [app.main :as-alias main]
   [app.rpc :as-alias rpc]
   [app.rpc.climit :as-alias climit]
   [app.rpc.commands.profile :as profile]
@@ -27,9 +27,11 @@
   [app.rpc.doc :as-alias doc]
   [app.rpc.helpers :as rph]
   [app.setup :as-alias setup]
+   [app.setup.welcome-file :refer [create-welcome-file]]
   [app.tokens :as tokens]
   [app.util.services :as sv]
   [app.util.time :as dt]
+   [app.worker :as wrk]
   [cuerdas.core :as str]))

 (def schema:password
@@ -38,6 +40,12 @@
 (def schema:token
  [::sm/word-string {:max 6000}])

+(defn- elapsed-verify-threshold?
+  [profile]
+  (let [elapsed (dt/diff (:modified-at profile) (dt/now))
+        verify-threshold (cf/get :email-verify-threshold)]
+    (pos? (compare elapsed verify-threshold))))
+
 ;; ---- COMMAND: login with password

 (defn login-with-password
@@ -122,12 +130,21 @@

 ;; ---- COMMAND: Logout

+(def ^:private schema:logout
+  [:map {:title "logoug"}
+   [:profile-id {:optional true} ::sm/uuid]])
+
 (sv/defmethod ::logout
  "Clears the authentication cookie and logout the current session."
  {::rpc/auth false
-   ::doc/added "1.15"}
-  [cfg _]
-  (rph/with-transform {} (session/delete-fn cfg)))
+   ::doc/changes [["2.1" "Now requires profile-id passed in the body"]]
+   ::doc/added "1.0"
+   ::sm/params schema:logout}
+  [cfg params]
+  (if (= (:profile-id params)
+         (::rpc/profile-id params))
+    (rph/with-transform {} (session/delete-fn cfg))
+    {}))

 ;; ---- COMMAND: Recover Profile

@@ -139,7 +156,7 @@

          (update-password [conn profile-id]
            (let [pwd (profile/derive-password cfg password)]
-              (db/update! conn :profile {:password pwd} {:id profile-id})
+              (db/update! conn :profile {:password pwd :is-active true} {:id profile-id})
              nil))]

    (db/with-atomic [conn pool]
@@ -162,46 +179,52 @@

 ;; ---- COMMAND: Prepare Register

-(defn validate-register-attempt!
-  [{:keys [::db/pool] :as cfg} params]
+(defn- validate-register-attempt!
+  [cfg params]

-  (when-not (contains? cf/flags :registration)
-    (when-not (contains? params :invitation-token)
-      (ex/raise :type :restriction
-                :code :registration-disabled)))
+  (when (or
+         (not (contains? cf/flags :registration))
+         (not (contains? cf/flags :login-with-password)))
+    (ex/raise :type :restriction
+              :code :registration-disabled))

  (when (contains? params :invitation-token)
-    (let [invitation (tokens/verify (::setup/props cfg) {:token (:invitation-token params) :iss :team-invitation})]
+    (let [invitation (tokens/verify (::setup/props cfg)
+                                    {:token (:invitation-token params)
+                                     :iss :team-invitation})]
      (when-not (= (:email params) (:member-email invitation))
        (ex/raise :type :restriction
                  :code :email-does-not-match-invitation
                  :hint "email should match the invitation"))))

-  (when-not (auth/email-domain-in-whitelist? (:email params))
-    (ex/raise :type :validation
+  (when (and (email.blacklist/enabled? cfg)
+             (email.blacklist/contains? cfg (:email params)))
+    (ex/raise :type :restriction
              :code :email-domain-is-not-allowed))

-  ;; Don't allow proceed in preparing registration if the profile is
-  ;; already reported as spammer.
-  (when (eml/has-bounce-reports? pool (:email params))
-    (ex/raise :type :validation
-              :code :email-has-permanent-bounces
-              :hint "looks like the email has one or many bounces reported"))
+  (when (and (email.whitelist/enabled? cfg)
+             (not (email.whitelist/contains? cfg (:email params))))
+    (ex/raise :type :restriction
+              :code :email-domain-is-not-allowed))

  ;; Perform a basic validation of email & password
  (when (= (str/lower (:email params))
           (str/lower (:password params)))
    (ex/raise :type :validation
              :code :email-as-password
-              :hint "you can't use your email as password")))
+              :hint "you can't use your email as password"))

-(def register-retry-threshold
-  (dt/duration "15m"))
+  (when (eml/has-bounce-reports? cfg (:email params))
+    (ex/raise :type :restriction
+              :code :email-has-permanent-bounces
+              :email (:email params)
+              :hint "looks like the email has bounce reports"))

-(defn- elapsed-register-retry-threshold?
-  [profile]
-  (let [elapsed (dt/diff (:modified-at profile) (dt/now))]
-    (pos? (compare elapsed register-retry-threshold))))
+  (when (eml/has-complaint-reports? cfg (:email params))
+    (ex/raise :type :restriction
+              :code :email-has-complaints
+              :email (:email params)
+              :hint "looks like the email has complaint reports")))

 (defn prepare-register
  [{:keys [::db/pool] :as cfg} {:keys [email] :as params}]
@@ -209,21 +232,7 @@
  (validate-register-attempt! cfg params)

  (let [email   (profile/clean-email email)
-        profile (when-let [profile (profile/get-profile-by-email pool email)]
-                  (cond
-                    (:is-blocked profile)
-                    (ex/raise :type :restriction
-                              :code :profile-blocked)
-
-                    (and (not (:is-active profile))
-                         (elapsed-register-retry-threshold? profile))
-                    profile
-
-                    :else
-                    (ex/raise :type :validation
-                              :code :email-already-exists
-                              :hint "profile already exists")))
-
+        profile (profile/get-profile-by-email pool email)
        params  {:email email
                 :password (:password params)
                 :invitation-token (:invitation-token params)
@@ -233,8 +242,8 @@
                 :exp (dt/in-future {:days 7})}

        params (d/without-nils params)
-
        token  (tokens/generate (::setup/props cfg) params)]
+
    (with-meta {:token token}
      {::audit/profile-id uuid/zero})))

@@ -277,6 +286,7 @@
        is-demo   (:is-demo params false)
        is-muted  (:is-muted params false)
        is-active (:is-active params false)
+        theme     (:theme params nil)
        email     (str/lower email)

        params    {:id id
@@ -287,20 +297,24 @@
                   :password password
                   :deleted-at (:deleted-at params)
                   :props props
+                   :theme theme
                   :is-active is-active
                   :is-muted is-muted
                   :is-demo is-demo}]
    (try
      (-> (db/insert! conn :profile params)
          (profile/decode-row))
-      (catch org.postgresql.util.PSQLException e
-        (let [state (.getSQLState e)]
+      (catch org.postgresql.util.PSQLException cause
+        (let [state (.getSQLState cause)]
          (if (not= state "23505")
-            (throw e)
-            (ex/raise :type :validation
-                      :code :email-already-exists
-                      :hint "email already exists"
-                      :cause e)))))))
+            (throw cause)
+
+            (do
+              (l/error :hint "not an error" :cause cause)
+              (ex/raise :type :validation
+                        :code :email-already-exists
+                        :hint "email already exists"
+                        :cause cause))))))))

 (defn create-profile-rels!
  [conn {:keys [id] :as profile}]
@@ -317,17 +331,16 @@
                    {::db/return-keys true})
        (profile/decode-row))))

-
 (defn send-email-verification!
-  [conn props profile]
-  (let [vtoken (tokens/generate props
+  [{:keys [::db/conn] :as cfg} profile]
+  (let [vtoken (tokens/generate (::setup/props cfg)
                                {:iss :verify-email
                                 :exp (dt/in-future "72h")
                                 :profile-id (:id profile)
                                 :email (:email profile)})
        ;; NOTE: this token is mainly used for possible complains
        ;; identification on the sns webhook
-        ptoken (tokens/generate props
+        ptoken (tokens/generate (::setup/props cfg)
                                {:iss :profile-identity
                                 :profile-id (:id profile)
                                 :exp (dt/in-future {:days 30})})]
@@ -340,95 +353,141 @@
                :extra-data ptoken})))

 (defn register-profile
-  [{:keys [::db/conn] :as cfg} {:keys [token fullname] :as params}]
-  (let [claims     (tokens/verify (::setup/props cfg) {:token token :iss :prepared-register})
+  [{:keys [::db/conn ::wrk/executor] :as cfg} {:keys [token fullname theme] :as params}]
+  (let [theme      (when (= theme "light") theme)
+        claims     (tokens/verify (::setup/props cfg) {:token token :iss :prepared-register})
        params     (-> claims
                       (into params)
-                       (assoc :fullname fullname))
-
-        is-active  (or (:is-active params)
-                       (not (contains? cf/flags :email-verification)))
+                       (assoc :fullname fullname)
+                       (assoc :theme theme))

        profile    (if-let [profile-id (:profile-id claims)]
                     (profile/get-profile conn profile-id)
-                     (let [params (-> params
-                                      (assoc :is-active is-active)
-                                      (update :password #(profile/derive-password cfg %)))]
-                       (->> (create-profile! conn params)
-                            (create-profile-rels! conn))))
+                     ;; NOTE: we first try to match existing profile
+                     ;; by email, that in normal circumstances will
+                     ;; not return anything, but when a user tries to
+                     ;; reuse the same token multiple times, we need
+                     ;; to detect if the profile is already registered
+                     (or (profile/get-profile-by-email conn (:email claims))
+                         (let [is-active (or (boolean (:is-active claims))
+                                             (not (contains? cf/flags :email-verification)))
+                               params    (-> params
+                                             (assoc :is-active is-active)
+                                             (update :password #(profile/derive-password cfg %)))
+                               profile   (->> (create-profile! conn params)
+                                              (create-profile-rels! conn))]
+                           (vary-meta profile assoc :created true))))
+
+        created?   (-> profile meta :created true?)

        invitation (when-let [token (:invitation-token params)]
-                     (tokens/verify (::setup/props cfg) {:token token :iss :team-invitation}))]
+                     (tokens/verify (::setup/props cfg) {:token token :iss :team-invitation}))

-    ;; If profile is filled in claims, means it tries to register
-    ;; again, so we proceed to update the modified-at attr
-    ;; accordingly.
-    (when-let [id (:profile-id claims)]
-      (db/update! conn :profile {:modified-at (dt/now)} {:id id})
-      (audit/submit! cfg
-                     {::audit/type "fact"
-                      ::audit/name "register-profile-retry"
-                      ::audit/profile-id id}))
+        props      (audit/profile->props profile)
+
+        create-welcome-file-when-needed
+        (fn []
+          (when (:create-welcome-file params)
+            (let [cfg (dissoc cfg ::db/conn)]
+              (wrk/submit! executor (create-welcome-file cfg profile)))))]
    (cond
-      ;; If invitation token comes in params, this is because the
-      ;; user comes from team-invitation process; in this case,
-      ;; regenerate token and send back to the user a new invitation
-      ;; token (and mark current session as logged). This happens
-      ;; only if the invitation email matches with the register
-      ;; email.
-      (and (some? invitation) (= (:email profile) (:member-email invitation)))
+      ;; When profile is blocked, we just ignore it and return plain data
+      (:is-blocked profile)
+      (do
+        (l/wrn :hint "register attempt for already blocked profile"
+               :profile-id (str  (:id profile))
+               :profile-email (:email profile))
+        (rph/with-meta {:email (:email profile)}
+          {::audit/replace-props props
+           ::audit/context {:action "ignore-because-blocked"}
+           ::audit/profile-id (:id profile)
+           ::audit/name "register-profile-retry"}))
+
+      ;; If invitation token comes in params, this is because the user
+      ;; comes from team-invitation process; in this case, regenerate
+      ;; token and send back to the user a new invitation token (and
+      ;; mark current session as logged). This happens only if the
+      ;; invitation email matches with the register email.
+      (and (some? invitation)
+           (= (:email profile)
+              (:member-email invitation)))
      (let [claims (assoc invitation :member-id  (:id profile))
-            token  (tokens/generate (::setup/props cfg) claims)
-            resp   {:invitation-token token}]
-        (-> resp
+            token  (tokens/generate (::setup/props cfg) claims)]
+        (-> {:invitation-token token}
            (rph/with-transform (session/create-fn cfg (:id profile)))
-            (rph/with-meta {::audit/replace-props (audit/profile->props profile)
+            (rph/with-meta {::audit/replace-props props
+                            ::audit/context {:action "accept-invitation"}
                            ::audit/profile-id (:id profile)})))

-      ;; If auth backend is different from "penpot" means user is
-      ;; registering using third party auth mechanism; in this case
-      ;; we need to mark this session as logged.
-      (not= "penpot" (:auth-backend profile))
-      (-> (profile/strip-private-attrs profile)
-          (rph/with-transform (session/create-fn cfg (:id profile)))
-          (rph/with-meta {::audit/replace-props (audit/profile->props profile)
-                          ::audit/profile-id (:id profile)}))
+      ;; When a new user is created and it is already activated by
+      ;; configuration or specified by OIDC, we just mark the profile
+      ;; as logged-in
+      created?
+      (if (:is-active profile)
+        (-> (profile/strip-private-attrs profile)
+            (rph/with-transform (session/create-fn cfg (:id profile)))
+            (rph/with-defer create-welcome-file-when-needed)
+            (rph/with-meta
+              {::audit/replace-props props
+               ::audit/context {:action "login"}
+               ::audit/profile-id (:id profile)}))

-      ;; If the `:enable-insecure-register` flag is set, we proceed
-      ;; to sign in the user directly, without email verification.
-      (true? is-active)
-      (-> (profile/strip-private-attrs profile)
-          (rph/with-transform (session/create-fn cfg (:id profile)))
-          (rph/with-meta {::audit/replace-props (audit/profile->props profile)
-                          ::audit/profile-id (:id profile)}))
+        (do
+          (when-not (eml/has-reports? conn (:email profile))
+            (send-email-verification! cfg profile))
+
+          (-> {:email (:email profile)}
+              (rph/with-defer create-welcome-file-when-needed)
+              (rph/with-meta
+                {::audit/replace-props props
+                 ::audit/context {:action "email-verification"}
+                 ::audit/profile-id (:id profile)}))))

-      ;; In all other cases, send a verification email.
      :else
-      (do
-        (send-email-verification! conn (::setup/props cfg) profile)
-        (rph/with-meta profile
+      (let [elapsed? (elapsed-verify-threshold? profile)
+            reports? (eml/has-reports? conn (:email profile))
+            action   (if reports?
+                       "ignore-because-complaints"
+                       (if elapsed?
+                         "resend-email-verification"
+                         "ignore"))]
+
+        (l/wrn :hint "repeated registry detected"
+               :profile-id (str (:id profile))
+               :profile-email (:email profile)
+               :context-action action)
+
+        (when (= action "resend-email-verification")
+          (db/update! conn :profile
+                      {:modified-at (dt/now)}
+                      {:id (:id profile)})
+          (send-email-verification! cfg profile))
+
+        (rph/with-meta {:email (:email profile)}
          {::audit/replace-props (audit/profile->props profile)
-           ::audit/profile-id (:id profile)})))))
+           ::audit/context {:action action}
+           ::audit/profile-id (:id profile)
+           ::audit/name "register-profile-retry"})))))

 (def schema:register-profile
  [:map {:title "register-profile"}
   [:token schema:token]
-   [:fullname [::sm/word-string {:max 100}]]])
+   [:fullname [::sm/word-string {:max 100}]]
+   [:theme {:optional true} [:string {:max 10}]]
+   [:create-welcome-file {:optional true} :boolean]])

 (sv/defmethod ::register-profile
  {::rpc/auth false
   ::doc/added "1.15"
   ::sm/params schema:register-profile
   ::climit/id :auth/global}
-  [{:keys [::db/pool] :as cfg} params]
-  (db/with-atomic [conn pool]
-    (-> (assoc cfg ::db/conn conn)
-        (register-profile params))))
+  [cfg params]
+  (db/tx-run! cfg register-profile params))

 ;; ---- COMMAND: Request Profile Recovery

-(defn request-profile-recovery
-  [{:keys [::db/pool] :as cfg} {:keys [email] :as params}]
+(defn- request-profile-recovery
+  [{:keys [::db/conn] :as cfg} {:keys [email] :as params}]
  (letfn [(create-recovery-token [{:keys [id] :as profile}]
            (let [token (tokens/generate (::setup/props cfg)
                                         {:iss :password-recovery
@@ -450,28 +509,42 @@
                          :extra-data ptoken})
              nil))]

-    (db/with-atomic [conn pool]
-      (when-let [profile (->> (profile/clean-email email)
-                              (profile/get-profile-by-email conn))]
-        (when-not (eml/allow-send-emails? conn profile)
-          (ex/raise :type :validation
-                    :code :profile-is-muted
-                    :hint "looks like the profile has reported repeatedly as spam or has permanent bounces."))
+    (let [profile (->> (profile/clean-email email)
+                       (profile/get-profile-by-email conn))]

-        (when-not (:is-active profile)
-          (ex/raise :type :validation
-                    :code :profile-not-verified
-                    :hint "the user need to validate profile before recover password"))
+      (cond
+        (not profile)
+        (l/wrn :hint "attempt of profile recovery: no profile found"
+               :profile-email email)

-        (when (eml/has-bounce-reports? conn (:email profile))
-          (ex/raise :type :validation
-                    :code :email-has-permanent-bounces
-                    :hint "looks like the email you invite has been repeatedly reported as spam or permanent bounce"))
+        (not (eml/allow-send-emails? conn profile))
+        (l/wrn :hint "attempt of profile recovery: profile is muted"
+               :profile-id (str (:id profile))
+               :profile-email (:email profile))

-        (->> profile
-             (create-recovery-token)
-             (send-email-notification conn))))))
+        (eml/has-bounce-reports? conn (:email profile))
+        (l/wrn :hint "attempt of profile recovery: email has bounces"
+               :profile-id (str (:id profile))
+               :profile-email (:email profile))

+        (eml/has-complaint-reports? conn (:email profile))
+        (l/wrn :hint "attempt of profile recovery: email has complaints"
+               :profile-id (str (:id profile))
+               :profile-email (:email profile))
+
+        (not (elapsed-verify-threshold? profile))
+        (l/wrn :hint "attempt of profile recovery: retry attempt threshold not elapsed"
+               :profile-id (str (:id profile))
+               :profile-email (:email profile))
+
+        :else
+        (do
+          (db/update! conn :profile
+                      {:modified-at (dt/now)}
+                      {:id (:id profile)})
+          (->> profile
+               (create-recovery-token)
+               (send-email-notification conn)))))))

 (def schema:request-profile-recovery
  [:map {:title "request-profile-recovery"}
@@ -482,6 +555,6 @@
   ::doc/added "1.15"
   ::sm/params schema:request-profile-recovery}
  [cfg params]
-  (request-profile-recovery cfg params))
+  (db/tx-run! cfg request-profile-recovery params))


--- a/backend/src/app/rpc/commands/binfile.clj
+++ b/backend/src/app/rpc/commands/binfile.clj
@@ -32,12 +32,11 @@

 (def ^:private
  schema:export-binfile
-  (sm/define
-    [:map {:title "export-binfile"}
-     [:name :string]
-     [:file-id ::sm/uuid]
-     [:include-libraries :boolean]
-     [:embed-assets :boolean]]))
+  [:map {:title "export-binfile"}
+   [:name [:string {:max 250}]]
+   [:file-id ::sm/uuid]
+   [:include-libraries :boolean]
+   [:embed-assets :boolean]])

 (sv/defmethod ::export-binfile
  "Export a penpot file in a binary format."
@@ -78,11 +77,10 @@

 (def ^:private
  schema:import-binfile
-  (sm/define
-    [:map {:title "import-binfile"}
-     [:name :string]
-     [:project-id ::sm/uuid]
-     [:file ::media/upload]]))
+  [:map {:title "import-binfile"}
+   [:name [:string {:max 250}]]
+   [:project-id ::sm/uuid]
+   [:file ::media/upload]])

 (sv/defmethod ::import-binfile
  "Import a penpot file in a binary format."
--- a/backend/src/app/rpc/commands/comments.clj
+++ b/backend/src/app/rpc/commands/comments.clj
@@ -292,7 +292,7 @@
  [:map {:title "create-comment-thread"}
   [:file-id ::sm/uuid]
   [:position ::gpt/point]
-   [:content :string]
+   [:content [:string {:max 750}]]
   [:page-id ::sm/uuid]
   [:frame-id ::sm/uuid]
   [:share-id {:optional true} [:maybe ::sm/uuid]]])
@@ -418,7 +418,7 @@
  schema:create-comment
  [:map {:title "create-comment"}
   [:thread-id ::sm/uuid]
-   [:content :string]
+   [:content [:string {:max 250}]]
   [:share-id {:optional true} [:maybe ::sm/uuid]]])

 (sv/defmethod ::create-comment
@@ -477,7 +477,7 @@
  schema:update-comment
  [:map {:title "update-comment"}
   [:id ::sm/uuid]
-   [:content :string]
+   [:content [:string {:max 250}]]
   [:share-id {:optional true} [:maybe ::sm/uuid]]])

 (sv/defmethod ::update-comment
--- a/backend/src/app/rpc/commands/demo.clj
+++ b/backend/src/app/rpc/commands/demo.clj
@@ -18,10 +18,7 @@
   [app.util.services :as sv]
   [app.util.time :as dt]
   [buddy.core.codecs :as bc]
-   [buddy.core.nonce :as bn]
-   [clojure.spec.alpha :as s]))
-
-(s/def ::create-demo-profile any?)
+   [buddy.core.nonce :as bn]))

 (sv/defmethod ::create-demo-profile
  "A command that is responsible of creating a demo purpose
@@ -48,7 +45,7 @@
        params   {:email email
                  :fullname fullname
                  :is-active true
-                  :deleted-at (dt/in-future cf/deletion-delay)
+                  :deleted-at (dt/in-future (cf/get-deletion-delay))
                  :password (profile/derive-password cfg password)
                  :props {}}]

--- a/backend/src/app/rpc/commands/feedback.clj
+++ b/backend/src/app/rpc/commands/feedback.clj
@@ -8,29 +8,25 @@
  "A general purpose feedback module."
  (:require
   [app.common.exceptions :as ex]
-   [app.common.spec :as us]
+   [app.common.schema :as sm]
   [app.config :as cf]
   [app.db :as db]
   [app.email :as eml]
   [app.rpc :as-alias rpc]
   [app.rpc.commands.profile :as profile]
   [app.rpc.doc :as-alias doc]
-   [app.util.services :as sv]
-   [clojure.spec.alpha :as s]))
+   [app.util.services :as sv]))

 (declare ^:private send-feedback!)

-(s/def ::content ::us/string)
-(s/def ::from    ::us/email)
-(s/def ::subject ::us/string)
-
-(s/def ::send-user-feedback
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::subject
-                   ::content]))
+(def ^:private schema:send-user-feedback
+  [:map {:title "send-user-feedback"}
+   [:subject [:string {:max 250}]]
+   [:content [:string {:max 250}]]])

 (sv/defmethod ::send-user-feedback
-  {::doc/added "1.18"}
+  {::doc/added "1.18"
+   ::sm/params schema:send-user-feedback}
  [{:keys [::db/pool]} {:keys [::rpc/profile-id] :as params}]
  (when-not (contains? cf/flags :user-feedback)
    (ex/raise :type :restriction
--- a/backend/src/app/rpc/commands/files.clj
+++ b/backend/src/app/rpc/commands/files.clj
@@ -15,7 +15,6 @@
   [app.common.logging :as l]
   [app.common.schema :as sm]
   [app.common.schema.desc-js-like :as-alias smdj]
-   [app.common.spec :as us]
   [app.common.types.components-list :as ctkl]
   [app.common.types.file :as ctf]
   [app.config :as cf]
@@ -35,7 +34,7 @@
   [app.util.pointer-map :as pmap]
   [app.util.services :as sv]
   [app.util.time :as dt]
-   [clojure.spec.alpha :as s]
+   [app.worker :as wrk]
   [cuerdas.core :as str]))

 ;; --- FEATURES
@@ -45,18 +44,6 @@
  (when media-id
    (str (cf/get :public-uri) "/assets/by-id/" media-id)))

-;; --- SPECS
-
-(s/def ::features ::us/set-of-strings)
-(s/def ::file-id ::us/uuid)
-(s/def ::frame-id ::us/uuid)
-(s/def ::id ::us/uuid)
-(s/def ::is-shared ::us/boolean)
-(s/def ::name ::us/string)
-(s/def ::project-id ::us/uuid)
-(s/def ::search-term ::us/string)
-(s/def ::team-id ::us/uuid)
-
 ;; --- HELPERS

 (def long-cache-duration
@@ -81,6 +68,9 @@
                :max-version fmg/version))
    file))

+
+;; --- FILE DATA
+
 ;; --- FILE PERMISSIONS

 (def ^:private sql:file-permissions
@@ -188,12 +178,12 @@
    [:map {:title "File"}
     [:id ::sm/uuid]
     [:features ::cfeat/features]
-     [:has-media-trimmed :boolean]
-     [:comment-thread-seqn {:min 0} :int]
-     [:name :string]
-     [:revn {:min 0} :int]
+     [:has-media-trimmed ::sm/boolean]
+     [:comment-thread-seqn [::sm/int {:min 0}]]
+     [:name [:string {:max 250}]]
+     [:revn [::sm/int {:min 0}]]
     [:modified-at ::dt/instant]
-     [:is-shared :boolean]
+     [:is-shared ::sm/boolean]
     [:project-id ::sm/uuid]
     [:created-at ::dt/instant]
     [:data {:optional true} :any]]))
@@ -271,18 +261,19 @@
  (let [params (merge {:id id}
                      (when (some? project-id)
                        {:project-id project-id}))
-        file   (-> (db/get conn :file params
-                           {::db/check-deleted (not include-deleted?)
-                            ::db/remove-deleted (not include-deleted?)
-                            ::sql/for-update lock-for-update?})
-                   (decode-row))]
+        file   (->> (db/get conn :file params
+                            {::db/check-deleted (not include-deleted?)
+                             ::db/remove-deleted (not include-deleted?)
+                             ::sql/for-update lock-for-update?})
+                    (feat.fdata/resolve-file-data cfg)
+                    (decode-row))]
    (if (and migrate? (fmg/need-migration? file))
      (migrate-file cfg file)
      file)))

 (defn get-minimal-file
  [cfg id & {:as opts}]
-  (let [opts (assoc opts ::sql/columns [:id :modified-at :revn])]
+  (let [opts (assoc opts ::sql/columns [:id :modified-at :deleted-at :revn :data-ref-id :data-backend])]
    (db/get cfg :file {:id id} opts)))

 (defn get-file-etag
@@ -340,9 +331,11 @@
   [:share-id {:optional true} ::sm/uuid]])

 (defn- get-file-fragment
-  [conn file-id fragment-id]
-  (some-> (db/get conn :file-data-fragment {:file-id file-id :id fragment-id})
-          (update :content blob/decode)))
+  [cfg file-id fragment-id]
+  (let [resolve-file-data (partial feat.fdata/resolve-file-data cfg)]
+    (some-> (db/get cfg :file-data-fragment {:file-id file-id :id fragment-id})
+            (resolve-file-data)
+            (update :data blob/decode))))

 (sv/defmethod ::get-file-fragment
  "Retrieve a file fragment by its ID. Only authenticated users."
@@ -350,12 +343,12 @@
   ::rpc/auth false
   ::sm/params schema:get-file-fragment
   ::sm/result schema:file-fragment}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id file-id fragment-id share-id]}]
-  (dm/with-open [conn (db/open pool)]
-    (let [perms (get-permissions conn profile-id file-id share-id)]
-      (check-read-permissions! perms)
-      (-> (get-file-fragment conn file-id fragment-id)
-          (rph/with-http-cache long-cache-duration)))))
+  [cfg {:keys [::rpc/profile-id file-id fragment-id share-id]}]
+  (db/run! cfg (fn [cfg]
+                 (let [perms (get-permissions cfg profile-id file-id share-id)]
+                   (check-read-permissions! perms)
+                   (-> (get-file-fragment cfg file-id fragment-id)
+                       (rph/with-http-cache long-cache-duration))))))

 ;; --- COMMAND QUERY: get-project-files

@@ -415,7 +408,7 @@
  "Checks if the file has libraries. Returns a boolean"
  {::doc/added "1.15.1"
   ::sm/params schema:has-file-libraries
-   ::sm/result :boolean}
+   ::sm/result ::sm/boolean}
  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id file-id]}]
  (dm/with-open [conn (db/open pool)]
    (check-read-permissions! pool profile-id file-id)
@@ -494,7 +487,7 @@
   [:file-id ::sm/uuid]
   [:page-id {:optional true} ::sm/uuid]
   [:share-id {:optional true} ::sm/uuid]
-   [:object-id {:optional true} [:or ::sm/uuid ::sm/coll-of-uuid]]
+   [:object-id {:optional true} [:or ::sm/uuid [::sm/set ::sm/uuid]]]
   [:features {:optional true} ::cfeat/features]])

 (sv/defmethod ::get-page
@@ -670,7 +663,7 @@
            f.modified_at,
            f.name,
            f.is_shared,
-            ft.media_id,
+            ft.media_id AS thumbnail_id,
            row_number() over w as row_num
       from file as f
      inner join project as p on (p.id = f.project_id)
@@ -689,10 +682,8 @@
  [conn team-id]
  (->> (db/exec! conn [sql:team-recent-files team-id])
       (mapv (fn [row]
-               (if-let [media-id (:media-id row)]
-                 (-> row
-                     (dissoc :media-id)
-                     (assoc :thumbnail-uri (resolve-public-uri media-id)))
+               (if-let [media-id (:thumbnail-id row)]
+                 (assoc row :thumbnail-uri (resolve-public-uri media-id))
                 (dissoc row :media-id))))))

 (def ^:private schema:get-team-recent-files
@@ -738,6 +729,23 @@
  [cfg {:keys [::rpc/profile-id] :as params}]
  (db/tx-run! cfg get-file-summary (assoc params :profile-id profile-id)))

+
+;; --- COMMAND QUERY: get-file-info
+
+(defn- get-file-info
+  [{:keys [::db/conn] :as cfg} {:keys [id] :as params}]
+  (db/get* conn :file
+           {:id id}
+           {::sql/columns [:id]}))
+
+(sv/defmethod ::get-file-info
+  "Retrieve minimal file info by its ID."
+  {::rpc/auth false
+   ::doc/added "2.2.0"
+   ::sm/params schema:get-file}
+  [cfg params]
+  (db/tx-run! cfg get-file-info params))
+
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; MUTATION COMMANDS
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -760,19 +768,19 @@
   [:map {:title "RenameFileEvent"}
    [:id ::sm/uuid]
    [:project-id ::sm/uuid]
-    [:name :string]
+    [:name [:string {:max 250}]]
    [:created-at ::dt/instant]
    [:modified-at ::dt/instant]]

   ::sm/params
   [:map {:title "RenameFileParams"}
-    [:name {:min 1} :string]
+    [:name [:string {:min 1 :max 250}]]
    [:id ::sm/uuid]]

   ::sm/result
   [:map {:title "SimplifiedFile"}
    [:id ::sm/uuid]
-    [:name :string]
+    [:name [:string {:max 250}]]
    [:created-at ::dt/instant]
    [:modified-at ::dt/instant]]}

@@ -817,12 +825,13 @@
      (db/update! cfg :file
                  {:revn (inc (:revn file))
                   :data (blob/encode (:data file))
-                   :modified-at (dt/now)}
+                   :modified-at (dt/now)
+                   :has-media-trimmed false}
                  {:id file-id})

      (feat.fdata/persist-pointers! cfg file-id))))

-(defn- absorb-library!
+(defn- absorb-library
  "Find all files using a shared library, and absorb all library assets
  into the file local libraries"
  [cfg {:keys [id] :as library}]
@@ -840,7 +849,26 @@
           :library-id (str id)
           :files (str/join "," (map str ids)))

-    (run! (partial absorb-library-by-file! cfg ldata) ids)))
+    (run! (partial absorb-library-by-file! cfg ldata) ids)
+    library))
+
+(defn absorb-library!
+  [{:keys [::db/conn] :as cfg} id]
+  (let [file (-> (get-file cfg id
+                           :lock-for-update? true
+                           :include-deleted? true)
+                 (check-version!))
+
+        proj (db/get* conn :project {:id (:project-id file)}
+                      {::db/remove-deleted false})
+        team (-> (db/get* conn :team {:id (:team-id proj)}
+                          {::db/remove-deleted false})
+                 (teams/decode-row))]
+
+    (-> (cfeat/get-team-enabled-features cf/flags team)
+        (cfeat/check-file-features! (:features file)))
+
+    (absorb-library cfg file)))

 (defn- set-file-shared
  [{:keys [::db/conn] :as cfg} {:keys [profile-id id] :as params}]
@@ -853,25 +881,14 @@
               ;; file, we need to perform more complex operation,
               ;; so in this case we retrieve the complete file and
               ;; perform all required validations.
-               (let [file (-> (get-file cfg id :lock-for-update? true)
-                              (check-version!)
-                              (assoc :is-shared false))
-                     team (teams/get-team conn
-                                          :profile-id profile-id
-                                          :project-id (:project-id file))]
-
-                 (-> (cfeat/get-team-enabled-features cf/flags team)
-                     (cfeat/check-client-features! (:features params))
-                     (cfeat/check-file-features! (:features file)))
-
-                 (absorb-library! cfg file)
-
+               (let [file (-> (absorb-library! cfg id)
+                              (assoc :is-shared false))]
                 (db/delete! conn :file-library-rel {:library-file-id id})
                 (db/update! conn :file
                             {:is-shared false
                              :modified-at (dt/now)}
                             {:id id})
-                 file)
+                 (select-keys file [:id :name :is-shared]))

               (and (false? (:is-shared file))
                    (true? (:is-shared params)))
@@ -900,7 +917,7 @@
  (sm/define
    [:map {:title "set-file-shared"}
     [:id ::sm/uuid]
-     [:is-shared :boolean]]))
+     [:is-shared ::sm/boolean]]))

 (sv/defmethod ::set-file-shared
  {::doc/added "1.17"
@@ -911,12 +928,19 @@

 ;; --- MUTATION COMMAND: delete-file

-(defn- mark-file-deleted!
+(defn- mark-file-deleted
  [conn file-id]
-  (db/update! conn :file
-              {:deleted-at (dt/now)}
-              {:id file-id}
-              {::db/return-keys [:id :name :is-shared :project-id :created-at :modified-at]}))
+  (let [file (db/update! conn :file
+                         {:deleted-at (dt/now)}
+                         {:id file-id}
+                         {::db/return-keys [:id :name :is-shared :deleted-at
+                                            :project-id :created-at :modified-at]})]
+    (wrk/submit! {::db/conn conn
+                  ::wrk/task :delete-object
+                  ::wrk/params {:object :file
+                                :deleted-at (:deleted-at file)
+                                :id file-id}})
+    file))

 (def ^:private
  schema:delete-file
@@ -927,29 +951,7 @@
 (defn- delete-file
  [{:keys [::db/conn] :as cfg} {:keys [profile-id id] :as params}]
  (check-edition-permissions! conn profile-id id)
-  (let [file (mark-file-deleted! conn id)]
-
-    ;; NOTE: when a file is a shared library, then we proceed to load
-    ;; the whole file, proceed with feature checking and properly execute
-    ;; the absorb-library procedure
-    (when (:is-shared file)
-      (let [file (-> (get-file cfg id
-                               :lock-for-update? true
-                               :include-deleted? true)
-                     (check-version!))
-
-            team (teams/get-team conn
-                                 :profile-id profile-id
-                                 :project-id (:project-id file))]
-
-
-
-        (-> (cfeat/get-team-enabled-features cf/flags team)
-            (cfeat/check-client-features! (:features params))
-            (cfeat/check-file-features! (:features file)))
-
-        (absorb-library! cfg file)))
-
+  (let [file (mark-file-deleted conn id)]
    (rph/with-meta (rph/wrap)
      {::audit/props {:project-id (:project-id file)
                      :name (:name file)
@@ -1053,14 +1055,16 @@
              {:id file-id}
              {::db/return-keys true}))

-(s/def ::ignore-file-library-sync-status
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::file-id ::date]))
+(def ^:private schema:ignore-file-library-sync-status
+  [:map {:title "ignore-file-library-sync-status"}
+   [:file-id ::sm/uuid]
+   [:date ::dt/instant]])

 ;; TODO: improve naming
 (sv/defmethod ::ignore-file-library-sync-status
  "Ignore updates in linked files"
-  {::doc/added "1.17"}
+  {::doc/added "1.17"
+   ::sm/params schema:ignore-file-library-sync-status}
  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id file-id] :as params}]
  (db/with-atomic [conn pool]
    (check-edition-permissions! conn profile-id file-id)
--- a/backend/src/app/rpc/commands/files_create.clj
+++ b/backend/src/app/rpc/commands/files_create.clj
@@ -6,13 +6,10 @@

 (ns app.rpc.commands.files-create
  (:require
-   [app.common.data :as d]
   [app.common.data.macros :as dm]
   [app.common.features :as cfeat]
-   [app.common.files.defaults :refer [version]]
   [app.common.schema :as sm]
   [app.common.types.file :as ctf]
-   [app.common.uuid :as uuid]
   [app.config :as cf]
   [app.db :as db]
   [app.features.fdata :as feat.fdata]
@@ -40,7 +37,7 @@
 (defn create-file
  [{:keys [::db/conn] :as cfg}
   {:keys [id name project-id is-shared revn
-           modified-at deleted-at create-page
+           modified-at deleted-at create-page page-id
           ignore-sync-until features]
    :or {is-shared false revn 0 create-page true}
    :as params}]
@@ -51,23 +48,17 @@

  (binding [pmap/*tracked* (pmap/create-tracked)
            cfeat/*current* features]
-    (let [id       (or id (uuid/next))
-
-          data     (if create-page
-                     (ctf/make-file-data id)
-                     (ctf/make-file-data id nil))
-
-          file     {:id id
-                    :project-id project-id
-                    :name name
-                    :revn revn
-                    :is-shared is-shared
-                    :version version
-                    :data data
-                    :features features
-                    :ignore-sync-until ignore-sync-until
-                    :modified-at modified-at
-                    :deleted-at deleted-at}
+    (let [file     (ctf/make-file {:id id
+                                   :project-id project-id
+                                   :name name
+                                   :revn revn
+                                   :is-shared is-shared
+                                   :features features
+                                   :ignore-sync-until ignore-sync-until
+                                   :modified-at modified-at
+                                   :deleted-at deleted-at
+                                   :create-page create-page
+                                   :page-id page-id})

          file     (if (contains? features "fdata/objects-map")
                     (feat.fdata/enable-objects-map file)
@@ -75,9 +66,7 @@

          file     (if (contains? features "fdata/pointer-map")
                     (feat.fdata/enable-pointer-map file)
-                     file)
-
-          file     (d/without-nils file)]
+                     file)]

      (db/insert! conn :file
                  (-> file
@@ -86,9 +75,9 @@
                  {::db/return-keys false})

      (when (contains? features "fdata/pointer-map")
-        (feat.fdata/persist-pointers! cfg id))
+        (feat.fdata/persist-pointers! cfg (:id file)))

-      (->> (assoc params :file-id id :role :owner)
+      (->> (assoc params :file-id (:id file) :role :owner)
           (create-file-role! conn))

      (db/update! conn :project
@@ -99,10 +88,10 @@

 (def ^:private schema:create-file
  [:map {:title "create-file"}
-   [:name :string]
+   [:name [:string {:max 250}]]
   [:project-id ::sm/uuid]
   [:id {:optional true} ::sm/uuid]
-   [:is-shared {:optional true} :boolean]
+   [:is-shared {:optional true} ::sm/boolean]
   [:features {:optional true} ::cfeat/features]])

 (sv/defmethod ::create-file
--- a/backend/src/app/rpc/commands/files_share.clj
+++ b/backend/src/app/rpc/commands/files_share.clj
@@ -7,29 +7,24 @@
 (ns app.rpc.commands.files-share
  "Share link related rpc mutation methods."
  (:require
-   [app.common.spec :as us]
+   [app.common.schema :as sm]
   [app.common.uuid :as uuid]
   [app.db :as db]
   [app.rpc :as-alias rpc]
   [app.rpc.commands.files :as files]
   [app.rpc.doc :as-alias doc]
-   [app.util.services :as sv]
-   [clojure.spec.alpha :as s]))
-
-;; --- Helpers & Specs
-
-(s/def ::file-id ::us/uuid)
-(s/def ::who-comment ::us/string)
-(s/def ::who-inspect ::us/string)
-(s/def ::pages (s/every ::us/uuid :kind set?))
+   [app.util.services :as sv]))

 ;; --- MUTATION: Create Share Link

 (declare create-share-link)

-(s/def ::create-share-link
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::file-id ::who-comment ::who-inspect ::pages]))
+(def ^:private schema:create-share-link
+  [:map {:title "create-share-link"}
+   [:file-id ::sm/uuid]
+   [:who-comment [:string {:max 250}]]
+   [:who-inspect [:string {:max 250}]]
+   [:pages [:set ::sm/uuid]]])

 (sv/defmethod ::create-share-link
  "Creates a share-link object.
@@ -37,7 +32,8 @@
  Share links are resources that allows external users access to specific
  pages of a file with specific permissions (who-comment and who-inspect)."
  {::doc/added "1.18"
-   ::doc/module :files}
+   ::doc/module :files
+   ::sm/params schema:create-share-link}
  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id file-id] :as params}]
  (db/with-atomic [conn pool]
    (files/check-edition-permissions! conn profile-id file-id)
@@ -58,13 +54,14 @@

 ;; --- MUTATION: Delete Share Link

-(s/def ::delete-share-link
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::us/id]))
+(def ^:private schema:delete-share-link
+  [:map {:title "delete-share-link"}
+   [:id ::sm/uuid]])

 (sv/defmethod ::delete-share-link
  {::doc/added "1.18"
-   ::doc/module ::files}
+   ::doc/module ::files
+   ::sm/params schema:delete-share-link}
  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id id] :as params}]
  (db/with-atomic [conn pool]
    (let [slink (db/get-by-id conn :share-link id)]
--- a/backend/src/app/rpc/commands/files_snapshot.clj
+++ b/backend/src/app/rpc/commands/files_snapshot.clj
@@ -13,13 +13,15 @@
   [app.config :as cf]
   [app.db :as db]
   [app.db.sql :as-alias sql]
+   [app.features.fdata :as feat.fdata]
   [app.main :as-alias main]
-   [app.media :as media]
   [app.rpc :as-alias rpc]
   [app.rpc.commands.files :as files]
   [app.rpc.commands.profile :as profile]
   [app.rpc.doc :as-alias doc]
   [app.storage :as sto]
+   [app.util.blob :as blob]
+   [app.util.pointer-map :as pmap]
   [app.util.services :as sv]
   [app.util.time :as dt]
   [cuerdas.core :as str]))
@@ -34,20 +36,21 @@
              :code :authentication-required
              :hint "only admins allowed")))

+(def sql:get-file-snapshots
+  "SELECT id, label, revn, created_at
+     FROM file_change
+    WHERE file_id = ?
+      AND created_at < ?
+      AND label IS NOT NULL
+    ORDER BY created_at DESC
+    LIMIT ?")
+
 (defn get-file-snapshots
  [{:keys [::db/conn]} {:keys [file-id limit start-at]
                        :or {limit Long/MAX_VALUE}}]
-  (let [query    (str "select id, label, revn, created_at "
-                      "  from file_change "
-                      " where file_id = ? "
-                      "   and created_at < ? "
-                      "   and data is not null "
-                      " order by created_at desc "
-                      " limit ?")
-        start-at (or start-at (dt/now))
+  (let [start-at (or start-at (dt/now))
        limit    (min limit 20)]
-
-    (->> (db/exec! conn [query file-id start-at limit])
+    (->> (db/exec! conn [sql:get-file-snapshots file-id start-at limit])
         (mapv (fn [row]
                 (update row :created-at dt/format-instant :rfc1123))))))

@@ -63,8 +66,8 @@
  (db/run! cfg get-file-snapshots params))

 (defn restore-file-snapshot!
-  [{:keys [::db/conn ::sto/storage] :as cfg} {:keys [file-id id]}]
-  (let [storage  (media/configure-assets-storage storage conn)
+  [{:keys [::db/conn] :as cfg} {:keys [file-id id]}]
+  (let [storage  (sto/resolve cfg {::db/reuse-conn true})
        file     (files/get-minimal-file conn file-id {::db/for-update true})
        snapshot (db/get* conn :file-change
                          {:file-id file-id
@@ -78,43 +81,53 @@
                :id id
                :file-id file-id))

-    (when-not (:data snapshot)
-      (ex/raise :type :precondition
-                :code :snapshot-without-data
-                :hint "snapshot has no data"
-                :label (:label snapshot)
-                :file-id file-id))
+    (let [snapshot (feat.fdata/resolve-file-data cfg snapshot)]
+      (when-not (:data snapshot)
+        (ex/raise :type :precondition
+                  :code :snapshot-without-data
+                  :hint "snapshot has no data"
+                  :label (:label snapshot)
+                  :file-id file-id))

-    (l/dbg :hint "restoring snapshot"
-           :file-id (str file-id)
-           :label (:label snapshot)
-           :snapshot-id (str (:id snapshot)))
+      (l/dbg :hint "restoring snapshot"
+             :file-id (str file-id)
+             :label (:label snapshot)
+             :snapshot-id (str (:id snapshot)))

-    (db/update! conn :file
-                {:data (:data snapshot)
-                 :revn (inc (:revn file))
-                 :features (:features snapshot)}
-                {:id file-id})
+      ;; If the file was already offloaded, on restring the snapshot
+      ;; we are going to replace the file data, so we need to touch
+      ;; the old referenced storage object and avoid possible leaks
+      (when (feat.fdata/offloaded? file)
+        (sto/touch-object! storage (:data-ref-id file)))

-    ;; clean object thumbnails
-    (let [sql (str "update file_tagged_object_thumbnail "
-                   "   set deleted_at = now() "
-                   " where file_id=? returning media_id")
-          res (db/exec! conn [sql file-id])]
+      (db/update! conn :file
+                  {:data (:data snapshot)
+                   :revn (inc (:revn file))
+                   :version (:version snapshot)
+                   :data-backend nil
+                   :data-ref-id nil
+                   :has-media-trimmed false
+                   :features (:features snapshot)}
+                  {:id file-id})

-      (doseq [media-id (into #{} (keep :media-id) res)]
-        (sto/touch-object! storage media-id)))
+      ;; clean object thumbnails
+      (let [sql (str "update file_tagged_object_thumbnail "
+                     "   set deleted_at = now() "
+                     " where file_id=? returning media_id")
+            res (db/exec! conn [sql file-id])]
+        (doseq [media-id (into #{} (keep :media-id) res)]
+          (sto/touch-object! storage media-id)))

-    ;; clean object thumbnails
-    (let [sql (str "update file_thumbnail "
-                   "   set deleted_at = now() "
-                   " where file_id=? returning media_id")
-          res (db/exec! conn [sql file-id])]
-      (doseq [media-id (into #{} (keep :media-id) res)]
-        (sto/touch-object! storage media-id)))
+      ;; clean file thumbnails
+      (let [sql (str "update file_thumbnail "
+                     "   set deleted_at = now() "
+                     " where file_id=? returning media_id")
+            res (db/exec! conn [sql file-id])]
+        (doseq [media-id (into #{} (keep :media-id) res)]
+          (sto/touch-object! storage media-id)))

-    {:id (:id snapshot)
-     :label (:label snapshot)}))
+      {:id (:id snapshot)
+       :label (:label snapshot)})))

 (defn- resolve-snapshot-by-label
  [conn file-id label]
@@ -146,21 +159,33 @@
                                   (merge (resolve-snapshot-by-label conn file-id label)))]
                      (restore-file-snapshot! cfg params)))))

+(defn- get-file
+  [cfg file-id]
+  (let [file (->> (db/get cfg :file {:id file-id})
+                  (feat.fdata/resolve-file-data cfg))]
+    (binding [pmap/*load-fn* (partial feat.fdata/load-pointer cfg file-id)]
+      (-> file
+          (update :data blob/decode)
+          (update :data feat.fdata/process-pointers deref)
+          (update :data feat.fdata/process-objects (partial into {}))
+          (update :data blob/encode)))))
+
 (defn take-file-snapshot!
-  [cfg {:keys [file-id label]}]
-  (let [conn  (db/get-connection cfg)
-        file  (db/get conn :file {:id file-id})
+  [cfg {:keys [file-id label ::rpc/profile-id]}]
+  (let [file  (get-file cfg file-id)
        id    (uuid/next)]

    (l/debug :hint "creating file snapshot"
             :file-id (str file-id)
             :label label)

-    (db/insert! conn :file-change
+    (db/insert! cfg :file-change
                {:id id
                 :revn (:revn file)
                 :data (:data file)
+                 :version (:version file)
                 :features (:features file)
+                 :profile-id profile-id
                 :file-id (:id file)
                 :label label}
                {::db/return-keys false})
--- a/backend/src/app/rpc/commands/files_temp.clj
+++ b/backend/src/app/rpc/commands/files_temp.clj
@@ -16,6 +16,7 @@
   [app.db.sql :as sql]
   [app.features.components-v2 :as feat.compv2]
   [app.features.fdata :as fdata]
+   [app.loggers.audit :as audit]
   [app.rpc :as-alias rpc]
   [app.rpc.commands.files :as files]
   [app.rpc.commands.files-create :as files.create]
@@ -23,6 +24,7 @@
   [app.rpc.commands.projects :as projects]
   [app.rpc.commands.teams :as teams]
   [app.rpc.doc :as-alias doc]
+   [app.rpc.helpers :as rph]
   [app.util.blob :as blob]
   [app.util.pointer-map :as pmap]
   [app.util.services :as sv]
@@ -33,12 +35,12 @@

 (def ^:private schema:create-temp-file
  [:map {:title "create-temp-file"}
-   [:name :string]
+   [:name [:string {:max 250}]]
   [:project-id ::sm/uuid]
   [:id {:optional true} ::sm/uuid]
-   [:is-shared :boolean]
+   [:is-shared ::sm/boolean]
   [:features ::cfeat/features]
-   [:create-page :boolean]])
+   [:create-page ::sm/boolean]])

 (sv/defmethod ::create-temp-file
  {::doc/added "1.17"
@@ -81,7 +83,7 @@
 (def ^:private schema:update-temp-file
  [:map {:title "update-temp-file"}
   [:changes [:vector ::cpc/change]]
-   [:revn {:min 0} :int]
+   [:revn [::sm/int {:min 0}]]
   [:session-id ::sm/uuid]
   [:id ::sm/uuid]])

@@ -100,7 +102,9 @@
                                 :revn revn
                                 :data nil
                                 :changes (blob/encode changes)})
-                    nil)))
+                    (rph/with-meta (rph/wrap nil)
+                      {::audit/replace-props {:file-id id
+                                              :revn revn}}))))

 ;; --- MUTATION COMMAND: persist-temp-file

--- a/backend/src/app/rpc/commands/files_thumbnails.clj
+++ b/backend/src/app/rpc/commands/files_thumbnails.clj
@@ -33,7 +33,6 @@
   [app.util.pointer-map :as pmap]
   [app.util.services :as sv]
   [app.util.time :as dt]
-   [clojure.spec.alpha :as s]
   [cuerdas.core :as str]))

 ;; --- FEATURES
@@ -86,11 +85,8 @@
   ::doc/module :files
   ::sm/params [:map {:title "get-file-object-thumbnails"}
                [:file-id ::sm/uuid]
-                [:tag {:optional true} :string]]
-   ::sm/result [:map-of :string :string]
-   ::cond/get-object #(files/get-minimal-file %1 (:file-id %2))
-   ::cond/reuse-key? true
-   ::cond/key-fn files/get-file-etag}
+                [:tag {:optional true} [:string {:max 50}]]]
+   ::sm/result [:map-of [:string {:max 250}] [:string {:max 250}]]}
  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id file-id tag] :as params}]
  (dm/with-open [conn (db/open pool)]
    (files/check-read-permissions! conn profile-id file-id)
@@ -193,7 +189,7 @@
  (sm/define
    [:map {:title "PartialFile"}
     [:id ::sm/uuid]
-     [:revn {:min 0} :int]
+     [:revn {:min 0} ::sm/int]
     [:page :any]]))

 (sv/defmethod ::get-file-data-for-thumbnail
@@ -237,7 +233,7 @@
  "INSERT INTO file_tagged_object_thumbnail (file_id, object_id, tag, media_id)
   VALUES (?, ?, ?, ?)
       ON CONFLICT (file_id, object_id, tag)
-       DO UPDATE SET updated_at=?, media_id=?, deleted_at=null
+       DO UPDATE SET updated_at=?, media_id=?, deleted_at=?
   RETURNING *")

 (defn- persist-thumbnail!
@@ -255,17 +251,19 @@
                      :content-type mtype
                      :bucket "file-object-thumbnail"})))

-
-
 (defn- create-file-object-thumbnail!
-  [{:keys [::sto/storage] :as cfg} file-id object-id media tag]
-  (let [tsnow     (dt/now)
-        media     (persist-thumbnail! storage media tsnow)
+  [{:keys [::sto/storage] :as cfg} file object-id media tag]
+  (let [file-id   (:id file)
+        timestamp (dt/now)
+        media     (persist-thumbnail! storage media timestamp)
        [th1 th2] (db/tx-run! cfg (fn [{:keys [::db/conn]}]
                                    (let [th1 (db/exec-one! conn [sql:get-file-object-thumbnail file-id object-id tag])
                                          th2 (db/exec-one! conn [sql:create-file-object-thumbnail
-                                                                  file-id object-id tag (:id media)
-                                                                  tsnow (:id media)])]
+                                                                  file-id object-id tag
+                                                                  (:id media)
+                                                                  timestamp
+                                                                  (:id media)
+                                                                  (:deleted-at file)])]
                                      [th1 th2])))]

    (when (and (some? th1)
@@ -279,9 +277,9 @@
  schema:create-file-object-thumbnail
  [:map {:title "create-file-object-thumbnail"}
   [:file-id ::sm/uuid]
-   [:object-id :string]
+   [:object-id [:string {:max 250}]]
   [:media ::media/upload]
-   [:tag {:optional true} :string]])
+   [:tag {:optional true} [:string {:max 50}]]])

 (sv/defmethod ::create-file-object-thumbnail
  {::doc/added "1.19"
@@ -298,9 +296,8 @@
  (media/validate-media-size! media)

  (db/run! cfg files/check-edition-permissions! profile-id file-id)
-
-  (let [cfg (update cfg ::sto/storage media/configure-assets-storage)]
-    (create-file-object-thumbnail! cfg file-id object-id media (or tag "frame"))))
+  (when-let [file (files/get-minimal-file cfg file-id {::db/check-deleted false})]
+    (create-file-object-thumbnail! cfg file object-id media (or tag "frame"))))

 ;; --- MUTATION COMMAND: delete-file-object-thumbnail

@@ -317,25 +314,23 @@
                 :object-id object-id
                 :tag tag})))

-(s/def ::delete-file-object-thumbnail
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::file-id ::object-id]))
+(def ^:private schema:delete-file-object-thumbnail
+  [:map {:title "delete-file-object-thumbnail"}
+   [:file-id ::sm/uuid]
+   [:object-id [:string {:max 250}]]])

 (sv/defmethod ::delete-file-object-thumbnail
  {::doc/added "1.19"
   ::doc/module :files
-   ::doc/deprecated "1.20"
-   ::climit/id [[:file-thumbnail-ops/by-profile ::rpc/profile-id]
-                [:file-thumbnail-ops/global]]
+   ::sm/params schema:delete-file-object-thumbnail
   ::audit/skip true}
  [cfg {:keys [::rpc/profile-id file-id object-id]}]
+  (files/check-edition-permissions! cfg profile-id file-id)
  (db/tx-run! cfg (fn [{:keys [::db/conn] :as cfg}]
-                    (files/check-edition-permissions! conn profile-id file-id)
-                    (when-not (db/read-only? conn)
-                      (-> cfg
-                          (update ::sto/storage media/configure-assets-storage conn)
-                          (delete-file-object-thumbnail! file-id object-id))
-                      nil))))
+                    (-> cfg
+                        (update ::sto/storage sto/configure conn)
+                        (delete-file-object-thumbnail! file-id object-id))
+                    nil)))

 ;; --- MUTATION COMMAND: create-file-thumbnail

@@ -392,7 +387,7 @@
  schema:create-file-thumbnail
  [:map {:title "create-file-thumbnail"}
   [:file-id ::sm/uuid]
-   [:revn :int]
+   [:revn ::sm/int]
   [:media ::media/upload]])

 (sv/defmethod ::create-file-thumbnail
@@ -411,6 +406,6 @@
  (db/tx-run! cfg (fn [{:keys [::db/conn] :as cfg}]
                    (files/check-edition-permissions! conn profile-id file-id)
                    (when-not (db/read-only? conn)
-                      (let [cfg   (update cfg ::sto/storage media/configure-assets-storage)
-                            media (create-file-thumbnail! cfg params)]
-                        {:uri (files/resolve-public-uri (:id media))})))))
+                      (let [media (create-file-thumbnail! cfg params)]
+                        {:uri (files/resolve-public-uri (:id media))
+                         :id (:id media)})))))
--- a/backend/src/app/rpc/commands/files_update.clj
+++ b/backend/src/app/rpc/commands/files_update.clj
@@ -29,6 +29,7 @@
   [app.rpc.commands.teams :as teams]
   [app.rpc.doc :as-alias doc]
   [app.rpc.helpers :as rph]
+   [app.storage :as sto]
   [app.util.blob :as blob]
   [app.util.pointer-map :as pmap]
   [app.util.services :as sv]
@@ -37,6 +38,20 @@
   [clojure.set :as set]
   [promesa.exec :as px]))

+(declare ^:private get-lagged-changes)
+(declare ^:private send-notifications!)
+(declare ^:private update-file)
+(declare ^:private update-file*)
+(declare ^:private process-changes-and-validate)
+(declare ^:private take-snapshot?)
+(declare ^:private delete-old-snapshots!)
+
+;; PUBLIC API; intended to be used outside of this module
+(declare update-file!)
+(declare update-file-data!)
+(declare persist-file!)
+(declare get-file)
+
 ;; --- SCHEMA

 (def ^:private
@@ -44,15 +59,15 @@
  [:map {:title "update-file"}
   [:id ::sm/uuid]
   [:session-id ::sm/uuid]
-   [:revn {:min 0} :int]
+   [:revn {:min 0} ::sm/int]
   [:features {:optional true} ::cfeat/features]
   [:changes {:optional true} [:vector ::cpc/change]]
   [:changes-with-metadata {:optional true}
    [:vector [:map
              [:changes [:vector ::cpc/change]]
              [:hint-origin {:optional true} :keyword]
-              [:hint-events {:optional true} [:vector :string]]]]]
-   [:skip-validate {:optional true} :boolean]])
+              [:hint-events {:optional true} [:vector [:string {:max 250}]]]]]]
+   [:skip-validate {:optional true} ::sm/boolean]])

 (def ^:private
  schema:update-file-result
@@ -61,7 +76,7 @@
    [:changes [:vector ::cpc/change]]
    [:file-id ::sm/uuid]
    [:id ::sm/uuid]
-    [:revn {:min 0} :int]
+    [:revn {:min 0} ::sm/int]
    [:session-id ::sm/uuid]]])

 ;; --- HELPERS
@@ -96,40 +111,6 @@
  (or (contains? library-change-types type)
      (contains? file-change-types type)))

-(def ^:private sql:get-file
-  "SELECT f.*, p.team_id
-     FROM file AS f
-     JOIN project AS p ON (p.id = f.project_id)
-    WHERE f.id = ?
-      AND (f.deleted_at IS NULL OR
-           f.deleted_at > now())
-      FOR KEY SHARE")
-
-(defn get-file
-  [conn id]
-  (let [file (db/exec-one! conn [sql:get-file id])]
-    (when-not file
-      (ex/raise :type :not-found
-                :code :object-not-found
-                :hint (format "file with id '%s' does not exists" id)))
-    (update file :features db/decode-pgarray #{})))
-
-(defn- wrap-with-pointer-map-context
-  [f]
-  (fn [cfg {:keys [id] :as file}]
-    (binding [pmap/*tracked* (pmap/create-tracked)
-              pmap/*load-fn* (partial feat.fdata/load-pointer cfg id)]
-      (let [result (f cfg file)]
-        (feat.fdata/persist-pointers! cfg id)
-        result))))
-
-(declare get-lagged-changes)
-(declare send-notifications!)
-(declare update-file)
-(declare update-file*)
-(declare update-file-data)
-(declare take-snapshot?)
-
 ;; If features are specified from params and the final feature
 ;; set is different than the persisted one, update it on the
 ;; database.
@@ -145,7 +126,8 @@
   ::sm/result schema:update-file-result
   ::doc/module :files
   ::doc/added "1.17"}
-  [cfg {:keys [::rpc/profile-id id] :as params}]
+  [{:keys [::mtx/metrics] :as cfg}
+   {:keys [::rpc/profile-id id changes changes-with-metadata] :as params}]
  (db/tx-run! cfg (fn [{:keys [::db/conn] :as cfg}]
                    (files/check-edition-permissions! conn profile-id id)
                    (db/xact-lock! conn id)
@@ -159,14 +141,30 @@
                                       (cfeat/check-client-features! (:features params))
                                       (cfeat/check-file-features! (:features file) (:features params)))

-                          params   (assoc params
-                                          :profile-id profile-id
-                                          :features features
-                                          :team team
-                                          :file file)
+                          changes  (if changes-with-metadata
+                                     (->> changes-with-metadata (mapcat :changes) vec)
+                                     (vec changes))
+
+                          params   (-> params
+                                       (assoc :profile-id profile-id)
+                                       (assoc :features features)
+                                       (assoc :team team)
+                                       (assoc :file file)
+                                       (assoc :changes changes))
+
+                          cfg      (assoc cfg ::timestamp (dt/now))

                          tpoint   (dt/tpoint)]

+
+                      (when (> (:revn params)
+                               (:revn file))
+                        (ex/raise :type :validation
+                                  :code :revn-conflict
+                                  :hint "The incoming revision number is greater that stored version."
+                                  :context {:incoming-revn (:revn params)
+                                            :stored-revn (:revn file)}))
+
                      ;; When newly computed features does not match exactly with
                      ;; the features defined on team row, we update it.
                      (when (not= features (:features team))
@@ -175,73 +173,124 @@
                                      {:features features}
                                      {:id (:id team)})))

+                      (mtx/run! metrics {:id :update-file-changes :inc (count changes)})
+
                      (binding [l/*context* (some-> (meta params)
                                                    (get :app.http/request)
                                                    (errors/request->context))]
-                        (-> (update-file cfg params)
+                        (-> (update-file* cfg params)
                            (rph/with-defer #(let [elapsed (tpoint)]
                                               (l/trace :hint "update-file" :time (dt/format-duration elapsed))))))))))

-(defn update-file
-  [{:keys [::mtx/metrics] :as cfg}
-   {:keys [file features changes changes-with-metadata] :as params}]
-  (let [features  (-> features
-                      (set/difference cfeat/frontend-only-features)
-                      (set/union (:features file)))
-
-        update-fn (cond-> update-file*
-                    (contains? features "fdata/pointer-map")
-                    (wrap-with-pointer-map-context))
-
-        changes   (if changes-with-metadata
-                    (->> changes-with-metadata (mapcat :changes) vec)
-                    (vec changes))]
-
-    (when (> (:revn params)
-             (:revn file))
-      (ex/raise :type :validation
-                :code :revn-conflict
-                :hint "The incoming revision number is greater that stored version."
-                :context {:incoming-revn (:revn params)
-                          :stored-revn (:revn file)}))
-
-    (mtx/run! metrics {:id :update-file-changes :inc (count changes)})
-
-    (binding [cfeat/*current*  features
-              cfeat/*previous* (:features file)]
-      (let [file   (assoc file :features features)
-            params (-> params
-                       (assoc :file file)
-                       (assoc :changes changes)
-                       (assoc ::created-at (dt/now)))]
-
-        (-> (update-fn cfg params)
-            (vary-meta assoc ::audit/replace-props
-                       {:id         (:id file)
-                        :name       (:name file)
-                        :features   (:features file)
-                        :project-id (:project-id file)
-                        :team-id    (:team-id file)}))))))
-
 (defn- update-file*
-  [{:keys [::db/conn ::wrk/executor] :as cfg}
-   {:keys [profile-id file changes session-id ::created-at skip-validate] :as params}]
-  (let [;; Process the file data on separated thread for avoid to do
-        ;; the CPU intensive operation on vthread.
-        file     (px/invoke! executor (partial update-file-data cfg file changes skip-validate))
-        features (db/create-array conn "text" (:features file))]
+  "Internal function, part of the update-file process, that encapsulates
+  the changes application offload to a separated thread and emit all
+  corresponding notifications.

-    (db/insert! conn :file-change
-                {:id (uuid/next)
-                 :session-id session-id
-                 :profile-id profile-id
-                 :created-at created-at
-                 :file-id (:id file)
-                 :revn (:revn file)
-                 :features (db/create-array conn "text" (:features file))
-                 :data (when (take-snapshot? file)
-                         (:data file))
-                 :changes (blob/encode changes)}
+  Follow the inner implementation to `update-file-data!` function.
+
+  Only intended for internal use on this module."
+  [{:keys [::db/conn ::wrk/executor ::timestamp] :as cfg}
+   {:keys [profile-id file features changes session-id skip-validate] :as params}]
+
+  (let [;; Retrieve the file data
+        file (feat.fdata/resolve-file-data cfg file)
+
+        file (assoc file :features
+                    (-> features
+                        (set/difference cfeat/frontend-only-features)
+                        (set/union (:features file))))
+
+        ;; Process the file data on separated thread for avoid to do
+        ;; the CPU intensive operation on vthread.
+        file  (px/invoke! executor
+                          (fn []
+                            (binding [cfeat/*current*  features
+                                      cfeat/*previous* (:features file)]
+                              (update-file-data! cfg file
+                                                 process-changes-and-validate
+                                                 changes skip-validate))))]
+
+    (when (feat.fdata/offloaded? file)
+      (let [storage (sto/resolve cfg ::db/reuse-conn true)]
+        (some->> (:data-ref-id file) (sto/touch-object! storage))))
+
+    ;; TODO: move this to asynchronous task
+    (when (::snapshot-data file)
+      (delete-old-snapshots! cfg file))
+
+    (persist-file! cfg file)
+
+    (let [params   (assoc params :file file)
+          response {:revn (:revn file)
+                    :lagged (get-lagged-changes conn params)}
+          features (db/create-array conn "text" (:features file))]
+
+      ;; Insert change (xlog)
+      (db/insert! conn :file-change
+                  {:id (uuid/next)
+                   :session-id session-id
+                   :profile-id profile-id
+                   :created-at timestamp
+                   :file-id (:id file)
+                   :revn (:revn file)
+                   :version (:version file)
+                   :features features
+                   :label (::snapshot-label file)
+                   :data (::snapshot-data file)
+                   :changes (blob/encode changes)}
+                  {::db/return-keys false})
+
+      ;; Send asynchronous notifications
+      (send-notifications! cfg params)
+
+      (vary-meta response assoc ::audit/replace-props
+                 {:id         (:id file)
+                  :name       (:name file)
+                  :features   (:features file)
+                  :project-id (:project-id file)
+                  :team-id    (:team-id file)}))))
+
+(defn update-file!
+  "A public api that allows apply a transformation to a file with all context setup."
+  [cfg file-id update-fn & args]
+  (let [file (get-file cfg file-id)
+        file (apply update-file-data! cfg file update-fn args)]
+    (persist-file! cfg file)))
+
+(def ^:private sql:get-file
+  "SELECT f.*, p.team_id
+     FROM file AS f
+     JOIN project AS p ON (p.id = f.project_id)
+    WHERE f.id = ?
+      AND (f.deleted_at IS NULL OR
+           f.deleted_at > now())
+      FOR KEY SHARE")
+
+(defn get-file
+  "Get not-decoded file, only decodes the features set."
+  [conn id]
+  (let [file (db/exec-one! conn [sql:get-file id])]
+    (when-not file
+      (ex/raise :type :not-found
+                :code :object-not-found
+                :hint (format "file with id '%s' does not exists" id)))
+    (update file :features db/decode-pgarray #{})))
+
+(defn persist-file!
+  "Function responsible of persisting already encoded file. Should be
+  used together with `get-file` and `update-file-data!`.
+
+  It also updates the project modified-at attr."
+  [{:keys [::db/conn ::timestamp]} file]
+  (let [features (db/create-array conn "text" (:features file))
+        ;; The timestamp can be nil because this function is also
+        ;; intended to be used outside of this module
+        modified-at (or timestamp (dt/now))]
+
+    (db/update! conn :project
+                {:modified-at modified-at}
+                {:id (:project-id file)}
                {::db/return-keys false})

    (db/update! conn :file
@@ -250,20 +299,96 @@
                 :version (:version file)
                 :features features
                 :data-backend nil
-                 :modified-at created-at
+                 :data-ref-id nil
+                 :modified-at modified-at
                 :has-media-trimmed false}
-                {:id (:id file)})
+                {:id (:id file)}
+                {::db/return-keys false})))

-    (db/update! conn :project
-                {:modified-at created-at}
-                {:id (:project-id file)})
+(defn- update-file-data!
+  "Perform a file data transformation in with all update context setup.

-    (let [params (assoc params :file file)]
-      ;; Send asynchronous notifications
-      (send-notifications! cfg params)
+  This function expected not-decoded file and transformation function. Returns
+  an encoded file.

-      ;; Retrieve and return lagged data
-      (get-lagged-changes conn params))))
+  This function is not responsible of saving the file. It only saves
+  fdata/pointer-map modified fragments."
+
+  [cfg {:keys [id] :as file} update-fn & args]
+  (binding [pmap/*tracked* (pmap/create-tracked)
+            pmap/*load-fn* (partial feat.fdata/load-pointer cfg id)]
+    (let [file (update file :data (fn [data]
+                                    (-> data
+                                        (blob/decode)
+                                        (assoc :id (:id file)))))
+
+          ;; For avoid unnecesary overhead of creating multiple pointers
+          ;; and handly internally with objects map in their worst
+          ;; case (when probably all shapes and all pointers will be
+          ;; readed in any case), we just realize/resolve them before
+          ;; applying the migration to the file
+          file (if (fmg/need-migration? file)
+                 (-> file
+                     (update :data feat.fdata/process-pointers deref)
+                     (update :data feat.fdata/process-objects (partial into {}))
+                     (fmg/migrate-file))
+                 file)
+
+          file (apply update-fn cfg file args)
+
+          ;; TODO: reuse operations if file is migrated
+          ;; TODO: move encoding to a separated thread
+          file (if (take-snapshot? file)
+                 (let [tpoint   (dt/tpoint)
+                       snapshot (-> (:data file)
+                                    (feat.fdata/process-pointers deref)
+                                    (feat.fdata/process-objects (partial into {}))
+                                    (blob/encode))
+                       elapsed (tpoint)
+                       label   (str "internal/snapshot/" (:revn file))]
+
+                   (l/trc :hint "take snapshot"
+                          :file-id (str (:id file))
+                          :revn (:revn file)
+                          :label label
+                          :elapsed (dt/format-duration elapsed))
+
+                   (-> file
+                       (assoc ::snapshot-data snapshot)
+                       (assoc ::snapshot-label label)))
+                 file)
+
+          file (cond-> file
+                 (contains? cfeat/*current* "fdata/objects-map")
+                 (feat.fdata/enable-objects-map)
+
+                 (contains? cfeat/*current* "fdata/pointer-map")
+                 (feat.fdata/enable-pointer-map)
+
+                 :always
+                 (update :data blob/encode))]
+
+      (feat.fdata/persist-pointers! cfg id)
+
+      file)))
+
+(defn- get-file-libraries
+  "A helper for preload file libraries, mainly used for perform file
+  semantical and structural validation"
+  [{:keys [::db/conn] :as cfg} file]
+  (->> (files/get-file-libraries conn (:id file))
+       (into [file] (map (fn [{:keys [id]}]
+                           (binding [pmap/*load-fn* (partial feat.fdata/load-pointer cfg id)
+                                     pmap/*tracked* nil]
+                             ;; We do not resolve the objects maps here
+                             ;; because there is a lower probability that all
+                             ;; shapes needed to be loded into memory, so we
+                             ;; leeave it on lazy status
+                             (-> (files/get-file cfg id :migrate? false)
+                                 (update :data feat.fdata/process-pointers deref) ; ensure all pointers resolved
+                                 (update :data feat.fdata/process-objects (partial into {}))
+                                 (fmg/migrate-file))))))
+       (d/index-by :id)))

 (defn- soft-validate-file-schema!
  [file]
@@ -280,87 +405,78 @@
      (l/error :hint "file validation error"
               :cause cause))))

-(defn- update-file-data
-  [{:keys [::db/conn] :as cfg} file changes skip-validate]
-  (let [file (update file :data (fn [data]
-                                  (-> data
-                                      (blob/decode)
-                                      (assoc :id (:id file)))))
-
-        ;; For avoid unnecesary overhead of creating multiple pointers
-        ;; and handly internally with objects map in their worst
-        ;; case (when probably all shapes and all pointers will be
-        ;; readed in any case), we just realize/resolve them before
-        ;; applying the migration to the file
-        file (if (fmg/need-migration? file)
-               (-> file
-                   (update :data feat.fdata/process-pointers deref)
-                   (update :data feat.fdata/process-objects (partial into {}))
-                   (fmg/migrate-file))
-               file)
-
-        ;; WARNING: this ruins performance; maybe we need to find
+(defn- process-changes-and-validate
+  [cfg file changes skip-validate]
+  (let [;; WARNING: this ruins performance; maybe we need to find
        ;; some other way to do general validation
        libs (when (and (or (contains? cf/flags :file-validation)
                            (contains? cf/flags :soft-file-validation))
                        (not skip-validate))
-               (->> (files/get-file-libraries conn (:id file))
-                    (into [file] (map (fn [{:keys [id]}]
-                                        (binding [pmap/*load-fn* (partial feat.fdata/load-pointer cfg id)
-                                                  pmap/*tracked* nil]
-                                          ;; We do not resolve the objects maps here
-                                          ;; because there is a lower probability that all
-                                          ;; shapes needed to be loded into memory, so we
-                                          ;; leeave it on lazy status
-                                          (-> (files/get-file cfg id :migrate? false)
-                                              (update :data feat.fdata/process-pointers deref) ; ensure all pointers resolved
-                                              (update :data feat.fdata/process-objects (partial into {}))
-                                              (fmg/migrate-file))))))
-                    (d/index-by :id)))
-
+               (get-file-libraries cfg file))

        file (-> (files/check-version! file)
                 (update :revn inc)
                 (update :data cpc/process-changes changes)
                 (update :data d/without-nils))]

-    (when (contains? cf/flags :soft-file-validation)
-      (soft-validate-file! file libs))
+    (binding [pmap/*tracked* nil]
+      (when (contains? cf/flags :soft-file-validation)
+        (soft-validate-file! file libs))

-    (when (contains? cf/flags :soft-file-schema-validation)
-      (soft-validate-file-schema! file))
+      (when (contains? cf/flags :soft-file-schema-validation)
+        (soft-validate-file-schema! file))

-    (when (and (contains? cf/flags :file-validation)
-               (not skip-validate))
-      (val/validate-file! file libs))
+      (when (and (contains? cf/flags :file-validation)
+                 (not skip-validate))
+        (val/validate-file! file libs))

-    (when (and (contains? cf/flags :file-schema-validation)
-               (not skip-validate))
-      (val/validate-file-schema! file))
+      (when (and (contains? cf/flags :file-schema-validation)
+                 (not skip-validate))
+        (val/validate-file-schema! file)))

-    (cond-> file
-      (contains? cfeat/*current* "fdata/objects-map")
-      (feat.fdata/enable-objects-map)
-
-      (contains? cfeat/*current* "fdata/pointer-map")
-      (feat.fdata/enable-pointer-map)
-
-      :always
-      (update :data blob/encode))))
+    file))

 (defn- take-snapshot?
  "Defines the rule when file `data` snapshot should be saved."
  [{:keys [revn modified-at] :as file}]
-  (let [freq    (or (cf/get :file-change-snapshot-every) 20)
-        timeout (or (cf/get :file-change-snapshot-timeout)
-                    (dt/duration {:hours 1}))]
-    (or (= 1 freq)
-        (zero? (mod revn freq))
-        (> (inst-ms (dt/diff modified-at (dt/now)))
-           (inst-ms timeout)))))
+  (when (contains? cf/flags :auto-file-snapshot)
+    (let [freq    (or (cf/get :auto-file-snapshot-every) 20)
+          timeout (or (cf/get :auto-file-snapshot-timeout)
+                      (dt/duration {:hours 1}))]

-(def ^:private
-  sql:lagged-changes
+      (or (= 1 freq)
+          (zero? (mod revn freq))
+          (> (inst-ms (dt/diff modified-at (dt/now)))
+             (inst-ms timeout))))))
+
+;; Get the latest available snapshots without exceeding the total
+;; snapshot limit.
+(def ^:private sql:get-latest-snapshots
+  "SELECT fch.id, fch.created_at
+     FROM file_change AS fch
+    WHERE fch.file_id = ?
+      AND fch.label LIKE 'internal/%'
+    ORDER BY fch.created_at DESC
+    LIMIT ?")
+
+;; Mark all snapshots that are outside the allowed total threshold
+;; available for the GC.
+(def ^:private sql:delete-snapshots
+  "UPDATE file_change
+      SET label = NULL
+    WHERE file_id = ?
+      AND label LIKE 'internal/%'
+      AND created_at < ?")
+
+(defn- delete-old-snapshots!
+  [{:keys [::db/conn] :as cfg} {:keys [id] :as file}]
+  (when-let [snapshots (not-empty (db/exec! conn [sql:get-latest-snapshots id
+                                                  (cf/get :auto-file-snapshot-total 10)]))]
+    (let [last-date (-> snapshots peek :created-at)
+          result    (db/exec-one! conn [sql:delete-snapshots id last-date])]
+      (l/trc :hint "delete old snapshots" :file-id (str id) :total (db/get-update-count result)))))
+
+(def ^:private sql:lagged-changes
  "select s.id, s.revn, s.file_id,
          s.session_id, s.changes
     from file_change as s
--- a/backend/src/app/rpc/commands/fonts.clj
+++ b/backend/src/app/rpc/commands/fonts.clj
@@ -95,12 +95,11 @@
  [cfg {:keys [::rpc/profile-id team-id] :as params}]
  (db/tx-run! cfg
              (fn [{:keys [::db/conn] :as cfg}]
-                (let [cfg (update cfg ::sto/storage media/configure-assets-storage)]
-                  (teams/check-edition-permissions! conn profile-id team-id)
-                  (quotes/check-quote! conn {::quotes/id ::quotes/font-variants-per-team
-                                             ::quotes/profile-id profile-id
-                                             ::quotes/team-id team-id})
-                  (create-font-variant cfg (assoc params :profile-id profile-id))))))
+                (teams/check-edition-permissions! conn profile-id team-id)
+                (quotes/check-quote! conn {::quotes/id ::quotes/font-variants-per-team
+                                           ::quotes/profile-id profile-id
+                                           ::quotes/team-id team-id})
+                (create-font-variant cfg (assoc params :profile-id profile-id)))))

 (defn create-font-variant
  [{:keys [::sto/storage ::db/conn ::wrk/executor]} {:keys [data] :as params}]
@@ -203,14 +202,13 @@
   ::sm/params schema:delete-font}
  [cfg {:keys [::rpc/profile-id id team-id]}]
  (db/tx-run! cfg
-              (fn [{:keys [::db/conn ::sto/storage] :as cfg}]
+              (fn [{:keys [::db/conn] :as cfg}]
                (teams/check-edition-permissions! conn profile-id team-id)
                (let [fonts   (db/query conn :team-font-variant
                                        {:team-id team-id
                                         :font-id id
                                         :deleted-at nil}
                                        {::sql/for-update true})
-                      storage (media/configure-assets-storage storage conn)
                      tnow    (dt/now)]

                  (when-not (seq fonts)
@@ -220,11 +218,7 @@
                  (doseq [font fonts]
                    (db/update! conn :team-font-variant
                                {:deleted-at tnow}
-                                {:id (:id font)})
-                    (some->> (:woff1-file-id font) (sto/touch-object! storage))
-                    (some->> (:woff2-file-id font) (sto/touch-object! storage))
-                    (some->> (:ttf-file-id font) (sto/touch-object! storage))
-                    (some->> (:otf-file-id font) (sto/touch-object! storage)))
+                                {:id (:id font)}))

                  (rph/with-meta (rph/wrap)
                    {::audit/props {:id id
@@ -245,22 +239,16 @@
   ::sm/params schema:delete-font-variant}
  [cfg {:keys [::rpc/profile-id id team-id]}]
  (db/tx-run! cfg
-              (fn [{:keys [::db/conn ::sto/storage] :as cfg}]
+              (fn [{:keys [::db/conn] :as cfg}]
                (teams/check-edition-permissions! conn profile-id team-id)
                (let [variant (db/get conn :team-font-variant
                                      {:id id :team-id team-id}
-                                      {::sql/for-update true})
-                      storage (media/configure-assets-storage storage conn)]
+                                      {::sql/for-update true})]

                  (db/update! conn :team-font-variant
                              {:deleted-at (dt/now)}
                              {:id (:id variant)})

-                  (some->> (:woff1-file-id variant) (sto/touch-object! storage))
-                  (some->> (:woff2-file-id variant) (sto/touch-object! storage))
-                  (some->> (:ttf-file-id variant) (sto/touch-object! storage))
-                  (some->> (:otf-file-id variant) (sto/touch-object! storage))
-
                  (rph/with-meta (rph/wrap)
                    {::audit/props {:font-family (:font-family variant)
                                    :font-id (:font-id variant)}})))))
--- a/backend/src/app/rpc/commands/ldap.clj
+++ b/backend/src/app/rpc/commands/ldap.clj
@@ -8,11 +8,10 @@
  (:require
   [app.auth.ldap :as ldap]
   [app.common.exceptions :as ex]
-   [app.common.spec :as us]
+   [app.common.schema :as sm]
   [app.db :as db]
   [app.http.session :as session]
   [app.loggers.audit :as-alias audit]
-   [app.main :as-alias main]
   [app.rpc :as-alias rpc]
   [app.rpc.commands.auth :as auth]
   [app.rpc.commands.profile :as profile]
@@ -20,27 +19,25 @@
   [app.rpc.helpers :as rph]
   [app.setup :as-alias setup]
   [app.tokens :as tokens]
-   [app.util.services :as sv]
-   [clojure.spec.alpha :as s]))
+   [app.util.services :as sv]))

 ;; --- COMMAND: login-with-ldap

 (declare login-or-register)

-(s/def ::email ::us/email)
-(s/def ::password ::us/string)
-(s/def ::invitation-token ::us/string)
-
-(s/def ::login-with-ldap
-  (s/keys :req-un [::email ::password]
-          :opt-un [::invitation-token]))
+(def schema:login-with-ldap
+  [:map {:title "login-with-ldap"}
+   [:email ::sm/email]
+   [:password auth/schema:password]
+   [:invitation-token {:optional true} auth/schema:token]])

 (sv/defmethod ::login-with-ldap
  "Performs the authentication using LDAP backend. Only works if LDAP
  is properly configured and enabled with `login-with-ldap` flag."
  {::rpc/auth false
   ::doc/added "1.15"
-   ::doc/module :auth}
+   ::doc/module :auth
+   ::sm/params schema:login-with-ldap}
  [{:keys [::setup/props ::ldap/provider] :as cfg} params]
  (when-not provider
    (ex/raise :type :restriction
@@ -73,7 +70,7 @@
              (rph/with-meta {::audit/props (:props profile)
                              ::audit/profile-id (:id profile)})))

-        (-> profile
+        (-> (profile/strip-private-attrs profile)
            (rph/with-transform (session/create-fn cfg (:id profile)))
            (rph/with-meta {::audit/props (:props profile)
                            ::audit/profile-id (:id profile)}))))))
--- a/backend/src/app/rpc/commands/management.clj
+++ b/backend/src/app/rpc/commands/management.clj
@@ -16,6 +16,7 @@
   [app.config :as cf]
   [app.db :as db]
   [app.http.sse :as sse]
+   [app.loggers.audit :as audit]
   [app.loggers.webhooks :as-alias webhooks]
   [app.rpc :as-alias rpc]
   [app.rpc.commands.files :as files]
@@ -90,7 +91,7 @@
  (sm/define
    [:map {:title "duplicate-file"}
     [:file-id ::sm/uuid]
-     [:name {:optional true} :string]]))
+     [:name {:optional true} [:string {:max 250}]]]))

 (sv/defmethod ::duplicate-file
  "Duplicate a single file in the same team."
@@ -152,7 +153,7 @@
  (sm/define
    [:map {:title "duplicate-project"}
     [:project-id ::sm/uuid]
-     [:name {:optional true} :string]]))
+     [:name {:optional true} [:string {:max 250}]]]))

 (sv/defmethod ::duplicate-project
  "Duplicate an entire project with all the files"
@@ -381,10 +382,9 @@

 (def ^:private
  schema:move-project
-  (sm/define
-    [:map {:title "move-project"}
-     [:team-id ::sm/uuid]
-     [:project-id ::sm/uuid]]))
+  [:map {:title "move-project"}
+   [:team-id ::sm/uuid]
+   [:project-id ::sm/uuid]])

 (sv/defmethod ::move-project
  "Move projects between teams"
@@ -396,25 +396,38 @@

 ;; --- COMMAND: Clone Template

-(defn- clone-template
-  [{:keys [::wrk/executor ::bf.v1/project-id] :as cfg} template]
-  (db/tx-run! cfg (fn [{:keys [::db/conn] :as cfg}]
+(defn clone-template
+  [cfg {:keys [project-id profile-id] :as params} template]
+  (db/tx-run! cfg (fn [{:keys [::db/conn ::wrk/executor] :as cfg}]
                    ;; NOTE: the importation process performs some operations that
                    ;; are not very friendly with virtual threads, and for avoid
                    ;; unexpected blocking of other concurrent operations we
                    ;; dispatch that operation to a dedicated executor.
-                    (let [result (px/submit! executor (partial bf.v1/import-files! cfg template))]
+                    (let [cfg    (-> cfg
+                                     (assoc ::bf.v1/project-id project-id)
+                                     (assoc ::bf.v1/profile-id profile-id))
+                          result (px/invoke! executor (partial bf.v1/import-files! cfg template))]
+
                      (db/update! conn :project
                                  {:modified-at (dt/now)}
                                  {:id project-id})
-                      (deref result)))))
+
+                      (let [props (audit/clean-props params)]
+                        (doseq [file-id result]
+                          (let [props (assoc props :id file-id)
+                                event (-> (audit/event-from-rpc-params params)
+                                          (assoc ::audit/profile-id profile-id)
+                                          (assoc ::audit/name "create-file")
+                                          (assoc ::audit/props props))]
+                            (audit/submit! cfg event))))
+
+                      result))))

 (def ^:private
  schema:clone-template
-  (sm/define
-    [:map {:title "clone-template"}
-     [:project-id ::sm/uuid]
-     [:template-id ::sm/word-string]]))
+  [:map {:title "clone-template"}
+   [:project-id ::sm/uuid]
+   [:template-id ::sm/word-string]])

 (sv/defmethod ::clone-template
  "Clone into the specified project the template by its id."
@@ -426,15 +439,14 @@
  (let [project   (db/get-by-id pool :project project-id {:columns [:id :team-id]})
        _         (teams/check-edition-permissions! pool profile-id (:team-id project))
        template  (tmpl/get-template-stream cfg template-id)
-        params    (-> cfg
-                      (assoc ::bf.v1/project-id (:id project))
-                      (assoc ::bf.v1/profile-id profile-id))]
+        params    (assoc params :profile-id profile-id)]
+
    (when-not template
      (ex/raise :type :not-found
                :code :template-not-found
                :hint "template not found"))

-    (sse/response #(clone-template params template))))
+    (sse/response #(clone-template cfg params template))))

 ;; --- COMMAND: Get list of builtin templates

--- a/backend/src/app/rpc/commands/media.clj
+++ b/backend/src/app/rpc/commands/media.clj
@@ -9,7 +9,7 @@
   [app.common.data :as d]
   [app.common.exceptions :as ex]
   [app.common.media :as cm]
-   [app.common.spec :as us]
+   [app.common.schema :as sm]
   [app.common.uuid :as uuid]
   [app.config :as cf]
   [app.db :as db]
@@ -25,7 +25,6 @@
   [app.util.services :as sv]
   [app.util.time :as dt]
   [app.worker :as-alias wrk]
-   [clojure.spec.alpha :as s]
   [cuerdas.core :as str]
   [datoteka.io :as io]
   [promesa.exec :as px]))
@@ -39,43 +38,37 @@
   :quality 85
   :format :jpeg})

-(s/def ::id ::us/uuid)
-(s/def ::name ::us/string)
-(s/def ::file-id ::us/uuid)
-(s/def ::team-id ::us/uuid)
-
 ;; --- Create File Media object (upload)

 (declare create-file-media-object)

-(s/def ::content ::media/upload)
-(s/def ::is-local ::us/boolean)
-
-(s/def ::upload-file-media-object
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::file-id ::is-local ::name ::content]
-          :opt-un [::id]))
+(def ^:private schema:upload-file-media-object
+  [:map {:title "upload-file-media-object"}
+   [:id {:optional true} ::sm/uuid]
+   [:file-id ::sm/uuid]
+   [:is-local ::sm/boolean]
+   [:name [:string {:max 250}]]
+   [:content ::media/upload]])

 (sv/defmethod ::upload-file-media-object
  {::doc/added "1.17"
+   ::sm/params schema:upload-file-media-object
   ::climit/id [[:process-image/by-profile ::rpc/profile-id]
                [:process-image/global]]}
  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id file-id content] :as params}]
-  (let [cfg (update cfg ::sto/storage media/configure-assets-storage)]
+  (files/check-edition-permissions! pool profile-id file-id)
+  (media/validate-media-type! content)
+  (media/validate-media-size! content)

-    (files/check-edition-permissions! pool profile-id file-id)
-    (media/validate-media-type! content)
-    (media/validate-media-size! content)
-
-    (db/run! cfg (fn [cfg]
-                   (let [object (create-file-media-object cfg params)
-                         props  {:name (:name params)
-                                 :file-id file-id
-                                 :is-local (:is-local params)
-                                 :size (:size content)
-                                 :mtype (:mtype content)}]
-                     (with-meta object
-                       {::audit/replace-props props}))))))
+  (db/run! cfg (fn [cfg]
+                 (let [object (create-file-media-object cfg params)
+                       props  {:name (:name params)
+                               :file-id file-id
+                               :is-local (:is-local params)
+                               :size (:size content)
+                               :mtype (:mtype content)}]
+                   (with-meta object
+                     {::audit/replace-props props})))))

 (defn- big-enough-for-thumbnail?
  "Checks if the provided image info is big enough for
@@ -176,18 +169,20 @@

 (declare ^:private create-file-media-object-from-url)

-(s/def ::create-file-media-object-from-url
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::file-id ::is-local ::url]
-          :opt-un [::id ::name]))
+(def ^:private schema:create-file-media-object-from-url
+  [:map {:title "create-file-media-object-from-url"}
+   [:file-id ::sm/uuid]
+   [:is-local ::sm/boolean]
+   [:url ::sm/uri]
+   [:id {:optional true} ::sm/uuid]
+   [:name {:optional true} [:string {:max 250}]]])

 (sv/defmethod ::create-file-media-object-from-url
  {::doc/added "1.17"
-   ::doc/deprecated "1.19"}
+   ::sm/params schema:create-file-media-object-from-url}
  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id file-id] :as params}]
-  (let [cfg (update cfg ::sto/storage media/configure-assets-storage)]
-    (files/check-edition-permissions! pool profile-id file-id)
-    (create-file-media-object-from-url cfg (assoc params :profile-id profile-id))))
+  (files/check-edition-permissions! pool profile-id file-id)
+  (create-file-media-object-from-url cfg (assoc params :profile-id profile-id)))

 (defn download-image
  [{:keys [::http/client]} uri]
@@ -255,12 +250,15 @@

 (declare clone-file-media-object)

-(s/def ::clone-file-media-object
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::file-id ::is-local ::id]))
+(def ^:private schema:clone-file-media-object
+  [:map {:title "clone-file-media-object"}
+   [:file-id ::sm/uuid]
+   [:is-local ::sm/boolean]
+   [:id ::sm/uuid]])

 (sv/defmethod ::clone-file-media-object
-  {::doc/added "1.17"}
+  {::doc/added "1.17"
+   ::sm/params schema:clone-file-media-object}
  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id file-id] :as params}]
  (db/with-atomic [conn pool]
    (files/check-edition-permissions! conn profile-id file-id)
--- a/backend/src/app/rpc/commands/profile.clj
+++ b/backend/src/app/rpc/commands/profile.clj
@@ -28,7 +28,7 @@
   [app.tokens :as tokens]
   [app.util.services :as sv]
   [app.util.time :as dt]
-   [app.worker :as-alias wrk]
+   [app.worker :as wrk]
   [cuerdas.core :as str]
   [promesa.exec :as px]))

@@ -46,6 +46,10 @@
  (let [email (str/lower email)
        email (if (str/starts-with? email "mailto:")
                (subs email 7)
+                email)
+        email (if (or (str/starts-with? email "<")
+                      (str/ends-with? email ">"))
+                (str/trim email "<>")
                email)]
    email))

@@ -56,10 +60,10 @@
     [:id ::sm/uuid]
     [:fullname [::sm/word-string {:max 250}]]
     [:email ::sm/email]
-     [:is-active {:optional true} :boolean]
-     [:is-blocked {:optional true} :boolean]
-     [:is-demo {:optional true} :boolean]
-     [:is-muted {:optional true} :boolean]
+     [:is-active {:optional true} ::sm/boolean]
+     [:is-blocked {:optional true} ::sm/boolean]
+     [:is-demo {:optional true} ::sm/boolean]
+     [:is-muted {:optional true} ::sm/boolean]
     [:created-at {:optional true} ::sm/inst]
     [:modified-at {:optional true} ::sm/inst]
     [:default-project-id {:optional true} ::sm/uuid]
@@ -87,8 +91,8 @@

 (defn get-profile
  "Get profile by id. Throws not-found exception if no profile found."
-  [conn id & {:as attrs}]
-  (-> (db/get-by-id conn :profile id attrs)
+  [conn id & {:as opts}]
+  (-> (db/get-by-id conn :profile id opts)
      (decode-row)))

 ;; --- MUTATION: Update Profile (own)
@@ -98,7 +102,7 @@
  (sm/define
    [:map {:title "update-profile"}
     [:fullname [::sm/word-string {:max 250}]]
-     [:lang {:optional true} [:string {:max 5}]]
+     [:lang {:optional true} [:string {:max 8}]]
     [:theme {:optional true} [:string {:max 250}]]]))

 (sv/defmethod ::update-profile
@@ -106,7 +110,6 @@
   ::sm/params schema:update-profile
   ::sm/result schema:profile}
  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id fullname lang theme] :as params}]
-
  (db/with-atomic [conn pool]
    ;; NOTE: we need to retrieve the profile independently if we use
    ;; it or not for explicit locking and avoid concurrent updates of
@@ -207,8 +210,7 @@
  [cfg {:keys [::rpc/profile-id file] :as params}]
  ;; Validate incoming mime type
  (media/validate-media-type! file #{"image/jpeg" "image/png" "image/webp"})
-  (let [cfg (update cfg ::sto/storage media/configure-assets-storage)]
-    (update-profile-photo cfg (assoc params :profile-id profile-id))))
+  (update-profile-photo cfg (assoc params :profile-id profile-id)))

 (defn update-profile-photo
  [{:keys [::db/pool ::sto/storage] :as cfg} {:keys [profile-id file] :as params}]
@@ -273,19 +275,19 @@
 (sv/defmethod ::request-email-change
  {::doc/added "1.0"
   ::sm/params schema:request-email-change}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id email] :as params}]
-  (db/with-atomic [conn pool]
-    (let [profile (db/get-by-id conn :profile profile-id)
-          cfg     (assoc cfg ::conn conn)
-          params  (assoc params
-                         :profile profile
-                         :email (clean-email email))]
-      (if (contains? cf/flags :smtp)
-        (request-email-change! cfg params)
-        (change-email-immediately! cfg params)))))
+  [cfg {:keys [::rpc/profile-id email] :as params}]
+  (db/tx-run! cfg
+              (fn [cfg]
+                (let [profile (db/get-by-id cfg :profile profile-id)
+                      params  (assoc params
+                                     :profile profile
+                                     :email (clean-email email))]
+                  (if (contains? cf/flags :smtp)
+                    (request-email-change! cfg params)
+                    (change-email-immediately! cfg params))))))

 (defn- change-email-immediately!
-  [{:keys [::conn]} {:keys [profile email] :as params}]
+  [{:keys [::db/conn]} {:keys [profile email] :as params}]
  (when (not= email (:email profile))
    (check-profile-existence! conn params))

@@ -296,7 +298,7 @@
  {:changed true})

 (defn- request-email-change!
-  [{:keys [::conn] :as cfg} {:keys [profile email] :as params}]
+  [{:keys [::db/conn] :as cfg} {:keys [profile email] :as params}]
  (let [token   (tokens/generate (::setup/props cfg)
                                 {:iss :change-email
                                  :exp (dt/in-future "15m")
@@ -316,9 +318,28 @@
                :hint "looks like the profile has reported repeatedly as spam or has permanent bounces."))

    (when (eml/has-bounce-reports? conn email)
-      (ex/raise :type :validation
+      (ex/raise :type :restriction
                :code :email-has-permanent-bounces
-                :hint "looks like the email you invite has been repeatedly reported as spam or permanent bounce"))
+                :email email
+                :hint "looks like the email has bounce reports"))
+
+    (when (eml/has-complaint-reports? conn email)
+      (ex/raise :type :restriction
+                :code :email-has-complaints
+                :email email
+                :hint "looks like the email has spam complaint reports"))
+
+    (when (eml/has-bounce-reports? conn (:email profile))
+      (ex/raise :type :restriction
+                :code :email-has-permanent-bounces
+                :email (:email profile)
+                :hint "looks like the email has bounce reports"))
+
+    (when (eml/has-complaint-reports? conn (:email profile))
+      (ex/raise :type :restriction
+                :code :email-has-complaints
+                :email (:email profile)
+                :hint "looks like the email has spam complaint reports"))

    (eml/send! {::eml/conn conn
                ::eml/factory eml/change-email
@@ -339,37 +360,41 @@
    [:map {:title "update-profile-props"}
     [:props [:map-of :keyword :any]]]))

+(defn update-profile-props
+  [{:keys [::db/conn] :as cfg} profile-id props]
+  (let [profile (get-profile conn profile-id ::sql/for-update true)
+        props   (reduce-kv (fn [props k v]
+                             ;; We don't accept namespaced keys
+                             (if (simple-ident? k)
+                               (if (nil? v)
+                                 (dissoc props k)
+                                 (assoc props k v))
+                               props))
+                           (:props profile)
+                           props)]
+
+    (db/update! conn :profile
+                {:props (db/tjson props)}
+                {:id profile-id})
+
+    (filter-props props)))
+
 (sv/defmethod ::update-profile-props
  {::doc/added "1.0"
   ::sm/params schema:update-profile-props}
-  [{:keys [::db/pool]} {:keys [::rpc/profile-id props]}]
-  (db/with-atomic [conn pool]
-    (let [profile (get-profile conn profile-id ::sql/for-update true)
-          props   (reduce-kv (fn [props k v]
-                               ;; We don't accept namespaced keys
-                               (if (simple-ident? k)
-                                 (if (nil? v)
-                                   (dissoc props k)
-                                   (assoc props k v))
-                                 props))
-                             (:props profile)
-                             props)]
-
-      (db/update! conn :profile
-                  {:props (db/tjson props)}
-                  {:id profile-id})
-
-      (filter-props props))))
+  [cfg {:keys [::rpc/profile-id props]}]
+  (db/tx-run! cfg (fn [cfg]
+                    (update-profile-props cfg profile-id props))))

 ;; --- MUTATION: Delete Profile

-(declare ^:private get-owned-teams-with-participants)
+(declare ^:private get-owned-teams)

 (sv/defmethod ::delete-profile
  {::doc/added "1.0"}
  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id] :as params}]
  (db/with-atomic [conn pool]
-    (let [teams      (get-owned-teams-with-participants conn profile-id)
+    (let [teams      (get-owned-teams conn profile-id)
          deleted-at (dt/now)]

      ;; If we found owned teams with participants, we don't allow
@@ -381,37 +406,39 @@
                  :hint "The user need to transfer ownership of owned teams."
                  :context {:teams (mapv :id teams)}))

-      (doseq [{:keys [id]} teams]
-        (db/update! conn :team
-                    {:deleted-at deleted-at}
-                    {:id id}))
-
+      ;; Mark profile deleted immediatelly
      (db/update! conn :profile
                  {:deleted-at deleted-at}
                  {:id profile-id})

+      ;; Schedule cascade deletion to a worker
+      (wrk/submit! {::db/conn conn
+                    ::wrk/task :delete-object
+                    ::wrk/params {:object :profile
+                                  :deleted-at deleted-at
+                                  :id profile-id}})
+
      (rph/with-transform {} (session/delete-fn cfg)))))


 ;; --- HELPERS

 (def sql:owned-teams
-  "with owner_teams as (
-      select tpr.team_id as id
-        from team_profile_rel as tpr
-       where tpr.is_owner is true
-         and tpr.profile_id = ?
+  "WITH owner_teams AS (
+      SELECT tpr.team_id AS id
+        FROM team_profile_rel AS tpr
+       WHERE tpr.is_owner IS TRUE
+         AND tpr.profile_id = ?
   )
-   select tpr.team_id as id,
-          count(tpr.profile_id) - 1 as participants
-     from team_profile_rel as tpr
-    where tpr.team_id in (select id from owner_teams)
-      and tpr.profile_id != ?
-    group by 1")
+   SELECT tpr.team_id AS id,
+          count(tpr.profile_id) - 1 AS participants
+     FROM team_profile_rel AS tpr
+    WHERE tpr.team_id IN (SELECT id from owner_teams)
+    GROUP BY 1")

-(defn- get-owned-teams-with-participants
+(defn get-owned-teams
  [conn profile-id]
-  (db/exec! conn [sql:owned-teams profile-id profile-id]))
+  (db/exec! conn [sql:owned-teams profile-id]))

 (def ^:private sql:profile-existence
  "select exists (select * from profile
--- a/backend/src/app/rpc/commands/projects.clj
+++ b/backend/src/app/rpc/commands/projects.clj
@@ -7,7 +7,8 @@
 (ns app.rpc.commands.projects
  (:require
   [app.common.data.macros :as dm]
-   [app.common.spec :as us]
+   [app.common.exceptions :as ex]
+   [app.common.schema :as sm]
   [app.db :as db]
   [app.db.sql :as-alias sql]
   [app.loggers.audit :as-alias audit]
@@ -20,10 +21,7 @@
   [app.rpc.quotes :as quotes]
   [app.util.services :as sv]
   [app.util.time :as dt]
-   [clojure.spec.alpha :as s]))
-
-(s/def ::id ::us/uuid)
-(s/def ::name ::us/string)
+   [app.worker :as wrk]))

 ;; --- Check Project Permissions

@@ -73,13 +71,13 @@

 (declare get-projects)

-(s/def ::team-id ::us/uuid)
-(s/def ::get-projects
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id]))
+(def ^:private schema:get-projects
+  [:map {:title "get-projects"}
+   [:team-id ::sm/uuid]])

 (sv/defmethod ::get-projects
-  {::doc/added "1.18"}
+  {::doc/added "1.18"
+   ::sm/params schema:get-projects}
  [{:keys [::db/pool]} {:keys [::rpc/profile-id team-id]}]
  (dm/with-open [conn (db/open pool)]
    (teams/check-read-permissions! conn profile-id team-id)
@@ -110,11 +108,12 @@

 (declare get-all-projects)

-(s/def ::get-all-projects
-  (s/keys :req [::rpc/profile-id]))
+(def ^:private schema:get-all-projects
+  [:map {:title "get-all-projects"}])

 (sv/defmethod ::get-all-projects
-  {::doc/added "1.18"}
+  {::doc/added "1.18"
+   ::sm/params schema:get-all-projects}
  [{:keys [::db/pool]} {:keys [::rpc/profile-id]}]
  (dm/with-open [conn (db/open pool)]
    (get-all-projects conn profile-id)))
@@ -152,12 +151,13 @@

 ;; --- QUERY: Get project

-(s/def ::get-project
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::id]))
+(def ^:private schema:get-project
+  [:map {:title "get-project"}
+   [:id ::sm/uuid]])

 (sv/defmethod ::get-project
-  {::doc/added "1.18"}
+  {::doc/added "1.18"
+   ::sm/params schema:get-project}
  [{:keys [::db/pool]} {:keys [::rpc/profile-id id]}]
  (dm/with-open [conn (db/open pool)]
    (let [project (db/get-by-id conn :project id)]
@@ -168,14 +168,16 @@

 ;; --- MUTATION: Create Project

-(s/def ::create-project
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id ::name]
-          :opt-un [::id]))
+(def ^:private schema:create-project
+  [:map {:title "create-project"}
+   [:team-id ::sm/uuid]
+   [:name [:string {:max 250 :min 1}]]
+   [:id {:optional true} ::sm/uuid]])

 (sv/defmethod ::create-project
  {::doc/added "1.18"
-   ::webhooks/event? true}
+   ::webhooks/event? true
+   ::sm/params schema:create-project}
  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id team-id] :as params}]
  (db/with-atomic [conn pool]
    (teams/check-edition-permissions! conn profile-id team-id)
@@ -203,14 +205,15 @@
       on conflict (team_id, project_id, profile_id)
       do update set is_pinned=?")

-(s/def ::is-pinned ::us/boolean)
-(s/def ::project-id ::us/uuid)
-(s/def ::update-project-pin
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::id ::team-id ::is-pinned]))
+(def ^:private schema:update-project-pin
+  [:map {:title "update-project-pin"}
+   [:team-id ::sm/uuid]
+   [:is-pinned ::sm/boolean]
+   [:id ::sm/uuid]])

 (sv/defmethod ::update-project-pin
  {::doc/added "1.18"
+   ::sm/params schema:update-project-pin
   ::webhooks/batch-timeout (dt/duration "5s")
   ::webhooks/batch-key (webhooks/key-fn ::rpc/profile-id :id)
   ::webhooks/event? true}
@@ -224,12 +227,14 @@

 (declare rename-project)

-(s/def ::rename-project
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::name ::id]))
+(def ^:private schema:rename-project
+  [:map {:title "rename-project"}
+   [:name [:string {:max 250 :min 1}]]
+   [:id ::sm/uuid]])

 (sv/defmethod ::rename-project
  {::doc/added "1.18"
+   ::sm/params schema:rename-project
   ::webhooks/event? true}
  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id id name] :as params}]
  (db/with-atomic [conn pool]
@@ -244,28 +249,41 @@

 ;; --- MUTATION: Delete Project

-(s/def ::delete-project
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::id]))
+(defn- delete-project
+  [conn project-id]
+  (let [project (db/update! conn :project
+                            {:deleted-at (dt/now)}
+                            {:id project-id}
+                            {::db/return-keys true})]

-;; TODO: right now, we just don't allow delete default projects, in a
-;; future we need to ensure raise a correct exception signaling that
-;; this is not allowed.
+    (when (:is-default project)
+      (ex/raise :type :validation
+                :code :non-deletable-project
+                :hint "impossible to delete default project"))
+
+    (wrk/submit! {::db/conn conn
+                  ::wrk/task :delete-object
+                  ::wrk/params {:object :project
+                                :deleted-at (:deleted-at project)
+                                :id project-id}})
+
+    project))
+
+
+(def ^:private schema:delete-project
+  [:map {:title "delete-project"}
+   [:id ::sm/uuid]])

 (sv/defmethod ::delete-project
  {::doc/added "1.18"
+   ::sm/params schema:delete-project
   ::webhooks/event? true}
  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id id] :as params}]
  (db/with-atomic [conn pool]
    (check-edition-permissions! conn profile-id id)
-    (let [project (db/update! conn :project
-                              {:deleted-at (dt/now)}
-                              {:id id :is-default false}
-                              {::db/return-keys true})]
+    (let [project (delete-project conn id)]
      (rph/with-meta (rph/wrap)
        {::audit/props {:team-id (:team-id project)
                        :name (:name project)
                        :created-at (:created-at project)
                        :modified-at (:modified-at project)}}))))
-
-
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`Request View-Only Access to “{{file-name\|abbreviate:25}}”`
				`@@ -0,0 +1 @@`
				`Request Access to “{{file-name\|abbreviate:25}}”`
				`@@ -0,0 +1 @@`
				`Request Access to “{{team-name\|abbreviate:25}}”`