📎 Start new development cycle for 2.5

not only index.html

.circleci/config.yml

@@ -1,6 +1,124 @@
-version: 2
+version: 2.1
 jobs:
-  build:
+  test-common:
+    docker:
+      - image: penpotapp/devenv:latest
+
+    working_directory: ~/repo
+    resource_class: medium+
+
+    environment:
+      JAVA_OPTS: -Xmx4g -Xms100m -XX:+UseSerialGC
+      NODE_OPTIONS: --max-old-space-size=4096
+
+    steps:
+      - checkout
+
+      # Download and cache dependencies
+      - restore_cache:
+          keys:
+            - v1-dependencies-{{ checksum "common/deps.edn"}}
+
+      - run:
+          name: "fmt check & linter"
+          working_directory: "./common"
+          command: |
+            yarn install
+            yarn run fmt:clj:check
+            yarn run lint:clj
+
+      - run:
+          name: "JVM tests"
+          working_directory: "./common"
+          command: |
+            clojure -M:dev:test
+
+      - save_cache:
+          paths:
+            - ~/.m2
+          key: v1-dependencies-{{ checksum "common/deps.edn"}}
+
+
+  test-frontend:
+    docker:
+      - image: penpotapp/devenv:latest
+
+    working_directory: ~/repo
+    resource_class: medium+
+
+    environment:
+      JAVA_OPTS: -Xmx4g -Xms100m -XX:+UseSerialGC
+      NODE_OPTIONS: --max-old-space-size=4096
+
+    steps:
+      - checkout
+
+      # Download and cache dependencies
+      - restore_cache:
+          keys:
+            - v1-dependencies-{{ checksum "frontend/deps.edn"}}
+
+      - run:
+          name: "prepopulate linter cache"
+          working_directory: "./common"
+          command: |
+            yarn install
+            yarn run lint:clj
+
+      - run:
+          name: "fmt check & linter"
+          working_directory: "./frontend"
+          command: |
+            yarn install
+            yarn run fmt:clj:check
+            yarn run fmt:js:check
+            yarn run lint:scss
+            yarn run lint:clj
+
+      - run:
+          name: "unit tests"
+          working_directory: "./frontend"
+          command: |
+            yarn install
+            yarn run test
+
+      - save_cache:
+          paths:
+            - ~/.m2
+          key: v1-dependencies-{{ checksum "frontend/deps.edn"}}
+
+
+  test-integration:
+    docker:
+      - image: penpotapp/devenv:latest
+
+    working_directory: ~/repo
+    resource_class: large
+
+    environment:
+      JAVA_OPTS: -Xmx6g -Xms2g
+      NODE_OPTIONS: --max-old-space-size=4096
+
+    steps:
+      - checkout
+
+      # Download and cache dependencies
+      - restore_cache:
+          keys:
+            - v1-dependencies-{{ checksum "frontend/deps.edn"}}
+
+      - run:
+          name: "integration tests"
+          working_directory: "./frontend"
+          command: |
+            yarn install
+            yarn run build:app:assets
+            yarn run build:app
+            yarn run build:app:libs
+            yarn run playwright install --with-deps chromium
+            yarn run test:e2e -x --workers=4
+
+  test-backend:
     docker:
       - image: penpotapp/devenv:latest
       - image: cimg/postgres:14.5
@@ -11,91 +129,86 @@ jobs:
       - image: cimg/redis:7.0.5
 
     working_directory: ~/repo
-    resource_class: large
+    resource_class: medium+
 
     environment:
-      # Customize the JVM maximum heap limit
-      JVM_OPTS: -Xmx4g
+      JAVA_OPTS: -Xmx4g -Xms100m -XX:+UseSerialGC
+      NODE_OPTIONS: --max-old-space-size=4096
 
     steps:
       - checkout
 
-      # Download and cache dependencies
       - restore_cache:
-         keys:
-           - v1-dependencies-{{ checksum "backend/deps.edn" }}-{{ checksum "frontend/deps.edn"}}-{{ checksum "common/deps.edn"}}
-           # fallback to using the latest cache if no exact match is found
-           - v1-dependencies-
-
-      - run: cd .clj-kondo && cat config.edn
+          keys:
+            - v1-dependencies-{{ checksum "backend/deps.edn" }}
 
       - run:
-          name: frontend styles prettier
-          working_directory: "./frontend"
-          command: |
-            yarn install
-            yarn run lint-scss
-
-      - run:
-          name: common lint
+          name: "prepopulate linter cache"
           working_directory: "./common"
           command: |
-            clj-kondo --version
-            clj-kondo --parallel --lint src/
+            yarn install
+            yarn run lint:clj
 
       - run:
-          name: frontend lint
-          working_directory: "./frontend"
-          command: |
-            clj-kondo --version
-            clj-kondo --parallel --lint src/
-
-      - run:
-          name: backend lint
+          name: "fmt check & linter"
           working_directory: "./backend"
-          command: |
-            clj-kondo --version
-            clj-kondo --parallel --lint src/
-
-      - run:
-          working_directory: "./common"
-          name: common tests
           command: |
             yarn install
-            yarn test
-            clojure -X:dev:test :patterns '["common-tests.*-test"]'
-
-          environment:
-            PATH: /usr/local/nodejs/bin/:/usr/local/bin:/bin:/usr/bin
-            JVM_OPTS: -Xmx4g
-            NODE_OPTIONS: --max-old-space-size=4096
+            yarn run fmt:clj:check
+            yarn run lint:clj
 
       - run:
-          name: backend test
+          name: "tests"
           working_directory: "./backend"
           command: |
-            clojure -X:dev:test :patterns '["backend-tests.*-test"]'
+            clojure -M:dev:test --reporter kaocha.report/documentation
 
           environment:
             PENPOT_TEST_DATABASE_URI: "postgresql://localhost/penpot_test"
             PENPOT_TEST_DATABASE_USERNAME: penpot_test
             PENPOT_TEST_DATABASE_PASSWORD: penpot_test
             PENPOT_TEST_REDIS_URI: "redis://localhost/1"
-            JVM_OPTS: -Xmx4g
-
-      - run:
-          name: frontend tests
-          working_directory: "./frontend"
-          command: |
-            yarn install
-            yarn test
-
-          environment:
-            PATH: /usr/local/nodejs/bin/:/usr/local/bin:/bin:/usr/bin
-            NODE_OPTIONS: --max-old-space-size=4096
 
       - save_cache:
-         paths:
-           - ~/.m2
-         key: v1-dependencies-{{ checksum "backend/deps.edn" }}-{{ checksum "frontend/deps.edn"}}-{{ checksum "common/deps.edn"}}
+          paths:
+            - ~/.m2
+          key: v1-dependencies-{{ checksum "backend/deps.edn" }}
 
+
+  test-exporter:
+    docker:
+      - image: penpotapp/devenv:latest
+
+    working_directory: ~/repo
+    resource_class: medium+
+
+    environment:
+      JAVA_OPTS: -Xmx4g -Xms100m -XX:+UseSerialGC
+      NODE_OPTIONS: --max-old-space-size=4096
+
+    steps:
+      - checkout
+
+      - run:
+          name: "prepopulate linter cache"
+          working_directory: "./common"
+          command: |
+            yarn install
+            yarn run lint:clj
+
+      - run:
+          name: "fmt check & linter"
+          working_directory: "./exporter"
+          command: |
+            yarn install
+            yarn run fmt:clj:check
+            yarn run lint:clj
+
+workflows:
+  penpot:
+    jobs:
+      - test-frontend
+      - test-integration
+      - test-backend
+      - test-common
+      - test-exporter

.clj-kondo/config.edn

@@ -3,10 +3,9 @@
   promesa.core/->> clojure.core/->>
   promesa.core/-> clojure.core/->
   promesa.exec.csp/go-loop clojure.core/loop
-  rumext.v2/defc clojure.core/defn
-  rumext.v2/fnc clojure.core/fn
+  promesa.util/with-open clojure.core/with-open
+  app.common.schema.generators/let clojure.core/let
   app.common.data/export clojure.core/def
-  app.db/with-atomic clojure.core/with-open
   app.common.data.macros/get-in clojure.core/get-in
   app.common.data.macros/with-open clojure.core/with-open
   app.common.data.macros/select-keys clojure.core/select-keys
@@ -15,16 +14,29 @@
  :hooks
  {:analyze-call
   {app.common.data.macros/export hooks.export/export
-   potok.core/reify hooks.export/potok-reify
    app.util.services/defmethod hooks.export/service-defmethod
+   app.common.record/defrecord hooks.export/penpot-defrecord
+   app.db/with-atomic hooks.export/penpot-with-atomic
+   potok.v2.core/reify hooks.export/potok-reify
+   rumext.v2/fnc hooks.export/rumext-fnc
+   rumext.v2/defc hooks.export/rumext-defc
+   rumext.v2/lazy-component hooks.export/rumext-lazycomponent
+   shadow.lazy/loadable hooks.export/rumext-lazycomponent
    }}
 
  :output
  {:exclude-files
   ["data_readers.clj"
-   "app/util/perf.cljs"
-   "app/common/logging.cljc"
-   "app/common/exceptions.cljc"]}
+   "src/app/util/perf.cljs"
+   "src/app/common/logging.cljc"
+   "src/app/common/exceptions.cljc"
+   "^(?:backend|frontend|exporter|common)/build.clj"
+   "^(?:backend|frontend|exporter|common)/deps.edn"
+   "^(?:backend|frontend|exporter|common)/scripts/"
+   "^(?:backend|frontend|exporter|common)/dev/"
+   "^(?:backend|frontend|exporter|common)/test/"]
+
+  :linter-name true}
 
  :linters
  {:unsorted-required-namespaces
@@ -60,4 +72,3 @@
    :exclude-destructured-keys-in-fn-args false
    }
   }}
-

.clj-kondo/hooks/export.clj

@@ -12,6 +12,7 @@
 
 (def registry (atom {}))
 
+
 (defn potok-reify
   [{:keys [:node :filename] :as params}]
   (let [[rnode rtype & other] (:children node)
@@ -37,8 +38,150 @@
                           (api/token-node rsym)
                           (api/vector-node [])]
                          other))]
+
+      ;; (prn (api/sexpr result))
+
       {:node result})))
 
+(defn penpot-with-atomic
+  [{:keys [node]}]
+  (let [[params & body] (rest (:children node))]
+    (if (api/vector-node? params)
+      (let [[sym val opts] (:children params)]
+        (when-not (and sym val)
+          (throw (ex-info "No sym and val provided" {})))
+        {:node (api/list-node
+                (list*
+                 (api/token-node 'let)
+                 (api/vector-node [sym val])
+                 opts
+                 body))})
+
+      {:node (api/list-node
+              (into [(api/token-node 'let)
+                     (api/vector-node [params params])]
+                    body))})))
+
+(defn rumext-fnc
+  [{:keys [node]}]
+  (let [[cname mdata params & body] (rest (:children node))
+        [params body] (if (api/vector-node? mdata)
+                        [mdata (cons params body)]
+                        [params body])
+
+        result (api/list-node
+                (into [(api/token-node 'fn) params]
+                      (cons mdata body)))]
+
+    {:node result}))
+
+
+(defn- parse-defc
+  [{:keys [children] :as node}]
+  (let [args (rest children)
+
+        [cname args]
+        (if (api/token-node? (first args))
+          [(first args) (rest args)]
+          (throw (ex-info "unexpected1" {})))
+
+        [docs args]
+        (if (api/string-node? (first args))
+          [(first args) (rest args)]
+          ["" args])
+
+        [mdata args]
+        (if (api/map-node? (first args))
+          [(first args) (rest args)]
+          [(api/map-node []) args])
+
+        [params body]
+        (if (api/vector-node? (first args))
+          [(first args) (rest args)]
+          (throw (ex-info "unexpected2" {})))]
+
+    [cname docs mdata params body]))
+
+(defn rumext-defc
+  [{:keys [node]}]
+  (let [[cname docs mdata params body] (parse-defc node)
+
+        param1        (first (:children params))
+        paramN        (rest (:children params))
+
+        param1        (if (api/map-node? param1)
+                        (let [param1    (into {} (comp
+                                                  (partition-all 2)
+                                                  (map (fn [[k v]]
+                                                         [(if (api/keyword-node? k)
+                                                            (:k k)
+                                                            k)
+                                                          (if (api/vector-node? v)
+                                                            (vec (:children v))
+                                                            v)])))
+                                              (:children param1))
+
+                              binding   (:rest param1)
+                              param1    (if binding
+                                          (if (contains? param1 :as)
+                                            (update param1 :keys (fnil conj []) binding)
+                                            (assoc param1 :as binding))
+                                          param1)]
+                          (->> (dissoc param1 :rest)
+                               (mapcat (fn [[k v]]
+                                         [(if (keyword? k)
+                                            (api/keyword-node k)
+                                            k)
+                                          (if (vector? v)
+                                            (api/vector-node v)
+                                            v)]))
+                               (api/map-node)))
+                        param1)
+
+        result (api/list-node
+                (into [(api/token-node 'defn)
+                       cname
+                       (api/vector-node (filter some? (cons param1 paramN)))]
+                      (cons mdata body)))]
+
+    ;; (prn (api/sexpr result))
+
+    {:node result}))
+
+
+(defn rumext-lazycomponent
+  [{:keys [node]}]
+  (let [[cname mdata params & body] (rest (:children node))
+        [params body] (if (api/vector-node? mdata)
+                        [mdata (cons params body)]
+                        [params body])]
+    (let [result (api/list-node [(api/token-node 'constantly) nil])]
+      ;; (prn (api/sexpr result))
+      {:node result})))
+
+
+(defn penpot-defrecord
+  [{:keys [:node]}]
+  (let [[rnode rtype rparams & other] (:children node)
+
+        nodes [(api/token-node (symbol "do"))
+               (api/list-node
+                (into [(api/token-node (symbol (name (:value rnode)))) rtype rparams] other))
+               (api/list-node
+                [(api/token-node (symbol "defn"))
+                 (api/token-node (symbol (str "pos->" (:string-value rtype))))
+                 (api/vector-node
+                  (->> (:children rparams)
+                       (mapv (fn [t]
+                               (api/token-node (symbol (str "_" (:string-value t))))))))
+                 (api/token-node nil)])]
+
+        result (api/list-node nodes)]
+
+    ;; (prn "=====>" (into {} rparams))
+    ;; (prn (api/sexpr result))
+    {:node result}))
+
 (defn clojure-specify
   [{:keys [:node]}]
   (let [[rnode rtype & other] (:children node)
@@ -48,7 +191,6 @@
                        other))]
     {:node result}))
 
-
 (defn service-defmethod
   [{:keys [:node]}]
   (let [[rnode rtype ?meta & other] (:children node)

.cljfmt.edn

@@ -0,0 +1,9 @@
+{:sort-ns-references? true
+ :remove-multiple-non-indenting-spaces? false
+ :remove-surrounding-whitespace? true
+ :remove-consecutive-blank-lines? false
+ :extra-indents {rumext.v2/fnc [[:inner 0]]
+                 cljs.test/async [[:inner 0]]
+                 promesa.exec/thread [[:inner 0]]
+                 specify! [[:inner 0] [:inner 1]]}
+ }

.editorconfig

@@ -0,0 +1,13 @@
+root = true
+
+[*.{cljs,cljc,clj,js,css,scss,html,yml,yaml,json,mustache}]
+charset = utf-8
+
+indent_size = 2
+indent_style = space
+
+end_of_line = lf
+
+insert_final_newline = true
+
+trim_trailing_whitespace = true

.gitignore

@@ -1,7 +1,16 @@
+.pnp.*
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/sdks
+!.yarn/versions
 *-init.clj
+*.css.json
 *.jar
 *.orig
 *.penpot
+*.css.json
 .calva
 .clj-kondo
 .cpcache
@@ -14,6 +23,7 @@
 /*.jpg
 /*.md
 /*.png
+/*.svg
 /*.sql
 /*.txt
 /*.yml
@@ -38,6 +48,8 @@
 /deploy
 /docker/images/bundle*
 /exporter/target
+/frontend/.storybook/preview-body.html
+/frontend/.storybook/preview-head.html
 /frontend/cypress/fixtures/validuser.json
 /frontend/cypress/videos/*/
 /frontend/cypress/videos/*/
@@ -47,6 +59,7 @@
 /frontend/package-lock.json
 /frontend/resources/fonts/experiments
 /frontend/resources/public/*
+/frontend/storybook-static/
 /frontend/target/
 /other/
 /scripts/
@@ -57,3 +70,9 @@
 /web
 clj-profiler/
 node_modules
+/test-results/
+/playwright-report/
+/blob-report/
+/playwright/.cache/
+/render-wasm/target/
+/**/.yarn/*

.nvmrc

@@ -0,0 +1 @@
+v20.11.1

.vscode/settings.json

@@ -0,0 +1,9 @@
+{
+  "files.exclude": {
+    "**/.clj-kondo": true,
+    "**/.cpcache": true,
+    "**/.lsp": true,
+    "**/.shadow-cljs": true,
+    "**/node_modules": true
+  }
+}

.yarnrc.yml

@@ -0,0 +1,11 @@
+enableGlobalCache: true
+
+enableImmutableCache: false
+
+enableImmutableInstalls: false
+
+enableTelemetry: false
+
+httpTimeout: 600000
+
+nodeLinker: node-modules

CHANGES.md

@@ -1,23 +1,644 @@
 # CHANGELOG
 
-## :rocket: 1.19.0
+## 2.5.0
+
+### :rocket: Epics and highlights
+
+### :boom: Breaking changes & Deprecations
+
+### :heart: Community contributions (Thank you!)
+
+### :sparkles: New features
+
+### :bug: Bugs fixed
+
+
+## 2.4.0
+
+### :rocket: Epics and highlights
+
+### :boom: Breaking changes & Deprecations
+
+- Use [nginx-unprivileged](https://hub.docker.com/r/nginxinc/nginx-unprivileged) as base image for
+  Penpot's frontend docker image. Now all the docker images runs with the same unprivileged user
+  (penpot). Because of that, the default NGINX listen port is now 8080 instead of 80, so
+  you will have to modify your infrastructure to apply this change.
+
+- Redis 7.2 is explicitly pinned in our example docker-compose.yml file. This is done because, 
+  starting with the next versions, Redis is no longer distributed under an open-source license. 
+  On-premise users are obviously free to upgrade to the version they are using or a more modern one. 
+  Keep in mind that if you were using a version other than 7.2, you may have to recreate the volume 
+  associated with the Redis container because the 7.2 storage format may not be compatible with what 
+  you already have stored on the volume, and Redis may not start. In the near future, we will evaluate 
+  whether to move to an open-source version of Redis (such as https://valkey.io/).
+
+### :heart: Community contributions (Thank you!)
+
+### :sparkles: New features
+
+- Viewer role for team members  [Taiga #1056 & #6590](https://tree.taiga.io/project/penpot/us/1056 & https://tree.taiga.io/project/penpot/us/6590)
+- File history versions management [Taiga](https://tree.taiga.io/project/penpot/us/187?milestone=411120)
+- Rename selected layer via keyboard shortcut and context menu option [Taiga #8882](https://tree.taiga.io/project/penpot/us/8882)
+
+### :bug: Bugs fixed
+
+
+## 2.3.3
+
+### :bug: Bugs fixed
+
+- Fix problem creating manual overlay interactions [Taiga #9146](https://tree.taiga.io/project/penpot/issue/9146)
+
+## 2.3.2
+
+### :bug: Bugs fixed
+
+- Fix null pointer exception on number checking functions
+- Fix problem with grid layout ordering after moving [Taiga #9179](https://tree.taiga.io/project/penpot/issue/9179)
+
+### :books: Documentation
+
+- Add initial documentation for Kubernetes
+
+
+## 2.3.1
+
+### :bug: Bugs fixed
+
+- Fix unexpected issue on interaction between plugins sandbox and
+  internal impl of promise
+
+
+## 2.3.0
+
+### :rocket: Epics and highlights
+
+- **New plugin system.**
+
+  Penpot now supports custom plugins. Read everything about developing your plugins [HERE](https://help.penpot.app/plugins/)
+
+### :boom: Breaking changes & Deprecations
+
+### :heart: Community contributions (Thank you!)
+
+- All our plugins beta testers :heart:.
+- Fix problem when translating multiple path points by @eeropic [#4459](https://github.com/penpot/penpot/issues/4459)
+
+### :sparkles: New features
+
+- **Replace Draft.js completely with a custom editor** [Taiga #7706](https://tree.taiga.io/project/penpot/us/7706)
+
+  This refactor adds better IME support, more performant text editing
+  experience and a better clipboard support while keeping full
+  retrocompatibility with previous editor.
+
+  You can enable it with the `enable-feature-text-editor-v2` configuration flag.
+
+
+### :bug: Bugs fixed
+
+- Fix problem with constraints buttons [Taiga #8465](https://tree.taiga.io/project/penpot/issue/8465)
+- Fix problem with go back button on error page [Taiga #8887](https://tree.taiga.io/project/penpot/issue/8887)
+- Fix problem with shadows in text for Safari [Taiga #8770](https://tree.taiga.io/project/penpot/issue/8770)
+- Fix a regression with feedback form subject and content limits [Taiga #8908](https://tree.taiga.io/project/penpot/issue/8908)
+- Fix problem with stroke and filter ordering in frames [Github #5058](https://github.com/penpot/penpot/issues/5058)
+- Fix problem with hover layers when hidden/blocked [Github #5074](https://github.com/penpot/penpot/issues/5074)
+- Fix problem with precision on boolean calculation [Taiga #8482](https://tree.taiga.io/project/penpot/issue/8482)
+- Fix problem when translating multiple path points [Github #4459](https://github.com/penpot/penpot/issues/4459)
+- Fix problem on importing (and exporting) files with flows [Taiga #8914](https://tree.taiga.io/project/penpot/issue/8914)
+- Fix Internal Error page: "go to your penpot" wrong design [Taiga #8922](https://tree.taiga.io/project/penpot/issue/8922)
+- Fix problem updating layout when toggle visibility in component copy [Github #5143](https://github.com/penpot/penpot/issues/5143)
+- Fix "Done" button on toolbar on inspect mode should go to design mode [Taiga #8933](https://tree.taiga.io/project/penpot/issue/8933)
+- Fix problem with shortcuts in text editor [Github #5078](https://github.com/penpot/penpot/issues/5078)
+- Fix problems with show in viewer and interactions [Github #4868](https://github.com/penpot/penpot/issues/4868)
+- Add visual feedback when moving an element into a board [Github #3210](https://github.com/penpot/penpot/issues/3210)
+- Fix percent calculation on grid layout tracks [Github #4688](https://github.com/penpot/penpot/issues/4688)
+- Fix problem with caps and inner shadows [Github #4517](https://github.com/penpot/penpot/issues/4517)
+- Fix problem with horizontal/vertical lines and shadows [Github #4516](https://github.com/penpot/penpot/issues/4516)
+- Fix problem with layers overflowing panel [Taiga #9021](https://tree.taiga.io/project/penpot/issue/9021)
+- Fix in workspace you can manage rulers on view mode [Taiga #8966](https://tree.taiga.io/project/penpot/issue/8966)
+- Fix problem with swap components in grid layout [Taiga #9066](https://tree.taiga.io/project/penpot/issue/9066)
+
+## 2.2.1
+
+### :bug: Bugs fixed
+
+- Fix problem with Ctrl+F shortcut on the dashboard [Taiga #8876](https://tree.taiga.io/project/penpot/issue/8876)
+- Fix visual problem with the font-size dropdown in assets [Taiga #8872](https://tree.taiga.io/project/penpot/issue/8872)
+- Add limits for invitation RPC methods (hard limit 25 emails per request)
+
+## 2.2.0
+
+### :rocket: Epics and highlights
+
+### :boom: Breaking changes & Deprecations
+
+- Removed "merge assets" option when exporting ".svg + .json" files. After the components changes the option wasn't
+working properly and we're planning to change the format soon. We think it's better to deprecate the option for the
+time being.
+
+### :heart: Community contributions (Thank you!)
+
+- Set proper default tenant on exporter (by @june128) [#4946](https://github.com/penpot/penpot/pull/4946)
+- Correct a spelling in onboarding.edn (by @n-stha) [#4936](https://github.com/penpot/penpot/pull/4936)
+
+### :sparkles: New features
+
+- **Tiered File Data Storage** [Taiga #8376](https://tree.taiga.io/project/penpot/us/8376)
+
+  This feature allows offloading file data that is not actively used
+  from the database to object storage (e.g., filesystem, S3), thereby
+  freeing up space in the database. It can be enabled with the
+  `enable-enable-tiered-file-data-storage` flag.
+
+  *(On-Premise feature, EXPERIMENTAL).*
+
+- **JSON Interoperability for HTTP API** [Taiga #8372](https://tree.taiga.io/project/penpot/us/8372)
+
+  Enables full JSON interoperability for our HTTP API. Previously,
+  JSON was only barely supported for output when the
+  `application/json` media type was specified in the `Accept` header,
+  or when `_fmt=json` was passed as a query parameter. With this
+  update, we now offer proper bi-directional support for using our API
+  with plain JSON, instead of Transit.
+
+- **Automatic File Snapshotting**
+
+  Adds the ability to automatically take and maintain a limited set of
+  snapshots of active files without explicit user intervention. This
+  feature allows on-premise administrators to recover the state of a
+  file from a past point in time in a limited manner.
+
+  It can be enabled with the `enable-auto-file-snapshot` flag and
+  configured with the following settings:
+
+  ```bash
+  # Take snapshots every 10 update operations
+  PENPOT_AUTO_FILE_SNAPSHOT_EVERY=10
+
+  # Take a snapshot if it has been more than 3 hours since the file was last modified
+  PENPOT_AUTO_FILE_SNAPSHOT_TIMEOUT=3h
+
+  # The total number of snapshots to keep
+  PENPOT_AUTO_FILE_SNAPSHOT_TOTAL=10
+  ```
+
+  Snapshots are only taken during update operations; there is NO
+  active background process for this.
+
+- Add separated flag `enable-oidc-registration` for enable the
+  registration only for OIDC authentication backend [Github
+  #4882](https://github.com/penpot/penpot/issues/4882)
+
+- Update templates in libraries & templates in dashboard modal [Taiga #8145](https://tree.taiga.io/project/penpot/us/8145)
+
+- **Design System**
+
+  We implemented and subbed in new components from our Design System: `loader*` ([Taiga #8355](https://tree.taiga.io/project/penpot/task/8355))  and `tab-switcher*` ([Taiga #8518](https://tree.taiga.io/project/penpot/task/8518)).
+
+- **Storybook** [Taiga #6329](https://tree.taiga.io/project/penpot/us/6329)
+
+  The Design System components are now published in a Storybook, available at `/storybook`.
+
+### :bug: Bugs fixed
+
+- Fix webhook checkbox position [Taiga #8634](https://tree.taiga.io/project/penpot/issue/8634)
+- Fix wrong props on padding input [Taiga #8254](https://tree.taiga.io/project/penpot/issue/8254)
+- Fix fill collapsed options [Taiga #8351](https://tree.taiga.io/project/penpot/issue/8351)
+- Fix scroll on color picker modal [Taiga #8353](https://tree.taiga.io/project/penpot/issue/8353)
+- Fix components are not dragged from the group to the assets tab [Taiga #8273](https://tree.taiga.io/project/penpot/issue/8273)
+- Fix problem with SVG import [Github #4888](https://github.com/penpot/penpot/issues/4888)
+- Fix problem with overlay positions in viewer [Taiga #8464](https://tree.taiga.io/project/penpot/issue/8464)
+- Fix layer panel overflowing [Taiga #8665](https://tree.taiga.io/project/penpot/issue/8665)
+- Fix problem when creating a component instance from grid layout [Github #4881](https://github.com/penpot/penpot/issues/4881)
+- Fix problem when dismissing shared library update [Taiga #8669](https://tree.taiga.io/project/penpot/issue/8669)
+- Fix visual problem with stroke cap menu [Taiga #8730](https://tree.taiga.io/project/penpot/issue/8730)
+- Fix issue when exporting libraries when merging libraries [Taiga #8758](https://tree.taiga.io/project/penpot/issue/8758)
+- Fix problem with comments max length [Taiga #8778](https://tree.taiga.io/project/penpot/issue/8778)
+- Fix copy/paste images in Safari [Taiga #8771](https://tree.taiga.io/project/penpot/issue/8771)
+- Fix swap when the copy is the only child of a group [#5075](https://github.com/penpot/penpot/issues/5075)
+- Fix file builder hangs when exporting [#5099](https://github.com/penpot/penpot/issues/5099)
+
+## 2.1.5
+
+### :bug: Bugs fixed
+
+- Fix broken webhooks [Taiga #8370](https://tree.taiga.io/project/penpot/issue/8370)
+
+## 2.1.4
+
+### :bug: Bugs fixed
+
+- Fix json encoding on zip encoding decoding.
+- Add schema validation for color changes.
+- Fix render of some texts without position data.
+
+## 2.1.3
+
+- Don't allow registration when registration is disabled and invitation token is used [Github #4975](https://github.com/penpot/penpot/issues/4975)
+
+## 2.1.2
+
+### :bug: Bugs fixed
+
+- User switch language to "zh_hant" will get 400 [Github #4884](https://github.com/penpot/penpot/issues/4884)
+- Smtp config ignoring port if ssl is set [Github #4872](https://github.com/penpot/penpot/issues/4872)
+- Ability to let users to authenticate with a private oidc provider only [Github #4963](https://github.com/penpot/penpot/issues/4963)
+
+## 2.1.1
+
+### :sparkles: New features
+
+- Consolidate templates new order and naming  [Taiga #8392](https://tree.taiga.io/project/penpot/task/8392)
+
+### :bug: Bugs fixed
+
+- Fix the “search” label in translations [Taiga #8402](https://tree.taiga.io/project/penpot/issue/8402)
+- Fix pencil loader [Taiga #8348](https://tree.taiga.io/project/penpot/issue/8348)
+- Fix several issues on the OIDC.
+- Fix regression on the `email-verification` flag [Taiga #8398](https://tree.taiga.io/project/penpot/issue/8398)
+
+## 2.1.0 - Things can only get better!
+
+### :rocket: Epics and highlights
+
+### :boom: Breaking changes & Deprecations
+
+### :heart: Communityq contributions (Thank you!)
+
+### :sparkles: New features
+
+- Improve auth process [Taiga #7094](https://tree.taiga.io/project/penpot/us/7094)
+- Add locking degrees increment (hold shift) on path edition [Taiga #7761](https://tree.taiga.io/project/penpot/issue/7761)
+- Persistence & Concurrent Edition Enhancements [Taiga #5657](https://tree.taiga.io/project/penpot/us/5657)
+- Allow library colors as recent colors [Taiga #7640](https://tree.taiga.io/project/penpot/issue/7640)
+- Missing scroll in viewmode comments [Taiga #7427](https://tree.taiga.io/project/penpot/issue/7427)
+- Comments in View mode should mimic the positioning behavior of the Workspace [Taiga #7346](https://tree.taiga.io/project/penpot/issue/7346)
+- Misaligned input on comments [Taiga #7461](https://tree.taiga.io/project/penpot/issue/7461)
+
+### :bug: Bugs fixed
+
+- Fix selection rectangle appears on scroll [Taiga #7525](https://tree.taiga.io/project/penpot/issue/7525)
+- Fix layer tree not expanding to the bottom edge [Taiga #7466](https://tree.taiga.io/project/penpot/issue/7466)
+- Fix guides move when board is moved by inputs [Taiga #8010](https://tree.taiga.io/project/penpot/issue/8010)
+- Fix clickable area of Penptot logo in the viewer [Taiga #7988](https://tree.taiga.io/project/penpot/issue/7988)
+- Fix constraints dropdown when selecting multiple shapes [Taiga #7686](https://tree.taiga.io/project/penpot/issue/7686)
+- Layout and scrollign fixes for the bottom palette [Taiga #7559](https://tree.taiga.io/project/penpot/issue/7559)
+- Fix expand libraries when search results are present [Taiga #7876](https://tree.taiga.io/project/penpot/issue/7876)
+- Fix color palette default library [Taiga #8029](https://tree.taiga.io/project/penpot/issue/8029)
+- Component Library is lost after exporting/importing in .zip format [Github #4672](https://github.com/penpot/penpot/issues/4672)
+- Fix problem with moving+selection not working properly [Taiga #7943](https://tree.taiga.io/project/penpot/issue/7943)
+- Fix problem with flex layout fit to content not positioning correctly children [Taiga #7537](https://tree.taiga.io/project/penpot/issue/7537)
+- Fix black line is displaying after show main [Taiga #7653](https://tree.taiga.io/project/penpot/issue/7653)
+- Fix "Share prototypes" modal remains open [Taiga #7442](https://tree.taiga.io/project/penpot/issue/7442)
+- Fix "Components visibility and opacity" [#4694](https://github.com/penpot/penpot/issues/4694)
+- Fix "Attribute overrides in copies are not exported in zip file" [Taiga #8072](https://tree.taiga.io/project/penpot/issue/8072)
+- Fix group not automatically selected in the Layers panel after creation [Taiga #8078](https://tree.taiga.io/project/penpot/issue/8078)
+- Fix export boards loses opacity [Taiga #7592](https://tree.taiga.io/project/penpot/issue/7592)
+- Fix change color on imported svg also changes the stroke alignment[Taiga #7673](https://github.com/penpot/penpot/pull/7673)
+- Fix show in view mode and interactions workflow [Taiga #4711](https://github.com/penpot/penpot/pull/4711)
+- Fix internal error when I set up a stroke for some objects without and with stroke [Taiga #7558](https://tree.taiga.io/project/penpot/issue/7558)
+- Toolbar keeps toggling on and off on spacebar press [Taiga #7654](https://github.com/penpot/penpot/pull/7654)
+- Fix toolbar keeps hiding when click outside workspace [Taiga #7776](https://tree.taiga.io/project/penpot/issue/7776)
+- Fix open overlay relative to a frame [Taiga #7563](https://tree.taiga.io/project/penpot/issue/7563)
+- Workspace-palette items stay hidden when opening with keyboard-shortcut [Taiga #7489](https://tree.taiga.io/project/penpot/issue/7489)
+- Fix SVG attrs are not handled correctly when exporting/importing in .zip [Taiga #7920](https://tree.taiga.io/project/penpot/issue/7920)
+- Fix validation error when detaching with two nested copies and a swap [Taiga #8095](https://tree.taiga.io/project/penpot/issue/8095)
+- Export shapes that are rotated act a bit strange when reimported [Taiga #7585](https://tree.taiga.io/project/penpot/issue/7585)
+- Penpot crashes when a new colorpicker is created while uploading an image to another instance [Taiga #8119](https://tree.taiga.io/project/penpot/issue/8119)
+- Removing Underline and Strikethrough Affects the Previous Text Object [Taiga #8103](https://tree.taiga.io/project/penpot/issue/8103)
+- Color library loses association with shapes when exporting/importing the document [Taiga #8132](https://tree.taiga.io/project/penpot/issue/8132)
+- Fix can't collapse groups when searching in the assets tab [Taiga #8125](https://tree.taiga.io/project/penpot/issue/8125)
+- Fix 'Detach instance' shortcut is not working [Taiga #8102](https://tree.taiga.io/project/penpot/issue/8102)
+- Fix import file message does not detect 0 as error [Taiga #6824](https://tree.taiga.io/project/penpot/issue/6824)
+- Image Color Library is not persisted when exporting/importing in .zip [Taiga #8131](https://tree.taiga.io/project/penpot/issue/8131)
+- Fix export files including libraries [Taiga #8266](https://tree.taiga.io/project/penpot/issue/8266)
+
+## 2.0.3
+
+### :bug: Bugs fixed
+
+- Fix chrome scrollbar styling [Taiga #7852](https://tree.taiga.io/project/penpot/issue/7852)
+- Fix incorrect password encoding on create-profile manage scritp [Github #3651](https://github.com/penpot/penpot/issues/3651)
+
+## 2.0.2
+
+### :sparkles: Enhancements
+
+- Fix locking contention on cron subsystem (causes backend start blocking)
+- Fix locking contention on file object thumbails backend RPC calls
+
+### :bug: Bugs fixed
+
+- Fix color palette sorting [Taiga #7458](https://tree.taiga.io/project/penpot/issue/7458)
+- Fix style scoping problem with imported SVG [Taiga #7671](https://tree.taiga.io/project/penpot/issue/7671)
+
+
+## 2.0.1
+
+### :bug: Bugs fixed
+
+- Fix different issues related to components v2 migrations including [Github #4443](https://github.com/penpot/penpot/issues/4443)
+
+
+## 2.0.0 - I Just Can't Get Enough
+
+### :rocket: Epics and highlights
+- Grid CSS layout [Taiga #4915](https://tree.taiga.io/project/penpot/epic/4915)
+- UI redesign [Taiga #4958](https://tree.taiga.io/project/penpot/epic/4958)
+- New components System [Taiga #2662](https://tree.taiga.io/project/penpot/epic/2662)
+- Swap components [Taiga #1331](https://tree.taiga.io/project/penpot/us/1331)
+- Images as fill  [Taiga #2983](https://tree.taiga.io/project/penpot/us/2983)
+- HTML code generation [Taiga #5277](https://tree.taiga.io/project/penpot/us/5277)
+- Light and dark themes [Taiga #2287](https://tree.taiga.io/project/penpot/us/2287)
+
+### :boom: Breaking changes & Deprecations
+
+- New strokes default to inside border [Taiga #6847](https://tree.taiga.io/project/penpot/issue/6847)
+- Change default z ordering on layers in flex layout. The previous behavior was inconsistent with how HTML works and we changed it to be more consistent. Previous layers that overlapped could be hidden, the fastest way to fix this is changing the z-index property but a better way is to change the order of your layers.
+
+
+### :heart: Community contributions (Thank you!)
+- New Hausa, Yoruba and Igbo translations and  update translation files (by All For Tech Empowerment Foundation) [Taiga #6950](https://tree.taiga.io/project/penpot/us/6950), [Taiga #6534](https://tree.taiga.io/project/penpot/us/6534)
+- Hide bounding-box when editing shape (by @VasilevsVV) [#3930](https://github.com/penpot/penpot/pull/3930)
+- CTRL + "+" to zoom into canvas instead of browser (by @audriu) [#3848](https://github.com/penpot/penpot/pull/3848)
+- Add dev deps.edn in the project root (by @PEZ) [#3794](https://github.com/penpot/penpot/pull/3794)
+- Allow passing overrides to frontend nginx config (by @m90) [#3602](https://github.com/penpot/penpot/pull/3602)
+- Update index.njk to remove typo (by @fdvmoreira) [#155](https://github.com/penpot/penpot-docs/pull/155)
+- Typo (by StephanEggermont) [#157](https://github.com/penpot/penpot-docs/pull/157)
+
+### :sparkles: New features
+- Send comments with Ctrl+Enter / Cmd + Enter [Taiga #6085](https://tree.taiga.io/project/penpot/issue/6085)
+- Select through stroke only rectangle [Taiga #5484](https://tree.taiga.io/project/penpot/issue/5484)
+- Stroke default position [Taiga #6847](https://tree.taiga.io/project/penpot/issue/6847)
+- Override browser Ctrl+ and Ctrl- zoom with Penpot Zoom [Taiga #3200](https://tree.taiga.io/project/penpot/us/3200)
+- Improve the way handlers work on flex layouts [Taiga #6598](https://tree.taiga.io/project/penpot/us/6598)
+- Add menu entry for toggle between light/dark theme [Taiga #6829](https://tree.taiga.io/project/penpot/issue/6829)
+- Switch themes shortcut [Taiga #6644](https://tree.taiga.io/project/penpot/us/6644)
+- Constraints section at design tab new position [Taiga #6830](https://tree.taiga.io/project/penpot/issue/6830)
+- [PICKER] File library colors order [Taiga #5399](https://tree.taiga.io/project/penpot/us/5399)
+- Onboarding invitations improvements [Taiga #5974](https://tree.taiga.io/project/penpot/us/5974)
+- [PERFORMANCE] Workspace thumbnails refactor [Taiga #5828](https://tree.taiga.io/project/penpot/us/5828)
+- [PERFORMANCE] Add performance optimizations to shape rendering [Taiga #5835](https://tree.taiga.io/project/penpot/us/5835)
+- [PERFORMANCE] Optimize SVG output [Taiga #4134](https://tree.taiga.io/project/penpot/us/4134)
+- [PERFORMANCE] Optimize svg on importation [Taiga #5879](https://tree.taiga.io/project/penpot/us/5879)
+- [PERFORMANCE] Optimization tasks related to design tab file [Taiga #5760](https://tree.taiga.io/project/penpot/us/5760)
+- [INSTALL] Ability to setup features by team [Taiga #6108](https://tree.taiga.io/project/penpot/us/6108)
+- [IMAGES] Keep aspect ratio option [Taiga #6933](https://tree.taiga.io/project/penpot/us/6933)
+- [INSPECT] UI review [Taiga #5687](https://tree.taiga.io/project/penpot/us/5687)
+- [GRID LAYOUT] Phase 1 [Taiga #4303](https://tree.taiga.io/project/penpot/us/4303)
+- [GRID LAYOUT] Inspect code for Grid [Taiga #5277](https://tree.taiga.io/project/penpot/us/5277)
+- [GRID LAYOUT] Phase 1 polishing [Taiga #5612](https://tree.taiga.io/project/penpot/us/5612)
+- [GRID LAYOUT] Improvements & Feedback [Taiga #6047](https://tree.taiga.io/project/penpot/us/6047)
+- [COMPONENTS] Naming of the main component [Taiga #5291](https://tree.taiga.io/project/penpot/us/5291)
+- [COMPONENTS] Rework inside of components - Library page [Taiga #2918](https://tree.taiga.io/project/penpot/us/2918)
+- [COMPONENTS] Update component when updating main instance [Taiga #3794](https://tree.taiga.io/project/penpot/us/3794)
+- [COMPONENTS] Main component new behavior [Taiga #3796](https://tree.taiga.io/project/penpot/us/3796)
+- [COMPONENTS] Main component look & feel [Taiga #5290](https://tree.taiga.io/project/penpot/us/5290)
+- [COMPONENTS] Library view [Taiga #2880](https://tree.taiga.io/project/penpot/us/2880)
+- [COMPONENTS] Positioning inside a component should relative, as in boards [Taiga #2826](https://tree.taiga.io/project/penpot/us/2826)
+- [COMPONENTS] Update message should show only if affecting at components that are being used at a file [Taiga #1397](https://tree.taiga.io/project/penpot/us/1397)
+- [COMPONENTS] Annotations [Taiga #4957](https://tree.taiga.io/project/penpot/us/4957)
+- [COMPONENTS] Synchronization order for nested components [Taiga #5439](https://tree.taiga.io/project/penpot/us/5439)
+- [COMPONENTS] Libraries modal zero case [Taiga #5294](https://tree.taiga.io/project/penpot/us/5294)
+- [COMPONENTS] Contextual menu casuistics [Taiga #5292](https://tree.taiga.io/project/penpot/us/5292)
+- [COMPONENTS] Libraries publishing flow review [Taiga #5293](https://tree.taiga.io/project/penpot/us/5293)
+- [COMPONENTS] Add loading text to Libraries modal [Taiga #6702](https://tree.taiga.io/project/penpot/us/6702)
+- [COMPONENTS] Components rename and organization in bulk [Taiga #2877](https://tree.taiga.io/project/penpot/us/2877)
+- [COMPONENTS] Info overlay about components V2 [Taiga #6276](https://tree.taiga.io/project/penpot/us/6276)
+- [REDESIGN] New styles basics [Taiga #4967](https://tree.taiga.io/project/penpot/us/4967)
+- [REDESIGN] Layers tab redesign [Taiga #4966](https://tree.taiga.io/project/penpot/us/4966)
+- [REDESIGN] Design tab phase 1 [Taiga #4982](https://tree.taiga.io/project/penpot/us/4966)
+- [REDESIGN] Assets tab redesign [Taiga #4984](https://tree.taiga.io/project/penpot/us/4984)
+- [REDESIGN] Palette panels (colors, typographies...) [Taiga #4983](https://tree.taiga.io/project/penpot/us/4983)
+- [REDESIGN] Workspace structure [Taiga #4988](https://tree.taiga.io/project/penpot/us/4988)
+- [REDESIGN] Shortcut tab [Taiga #4989](https://tree.taiga.io/project/penpot/us/4989)
+- [REDESIGN] Toolbar [Taiga #5500](https://tree.taiga.io/project/penpot/us/5500)
+- [REDESIGN] History tab [Taiga #5481](https://tree.taiga.io/project/penpot/us/5481)
+- [REDESIGN] Path options/toolbar [Taiga #5815](https://tree.taiga.io/project/penpot/us/5815)
+- [REDESIGN] Design tab phase 2 [Taiga #5814](https://tree.taiga.io/project/penpot/us/5814)
+- [REDESIGN] Design tab phase 3 and dashboard details [Taiga #5920](https://tree.taiga.io/project/penpot/us/5920)
+- [REDESIGN] Dashboard [Taiga #5164](https://tree.taiga.io/project/penpot/us/5164)
+- [REDESIGN] New Dashboard UI [Taiga #5869](https://tree.taiga.io/project/penpot/us/5869)
+- [REDESIGN] Prototype tab [Taiga #4985](https://tree.taiga.io/project/penpot/us/4985)
+- [REDESIGN] Code tab [Taiga #4986](https://tree.taiga.io/project/penpot/us/4986)
+- [REDESIGN] Modals and alert messages [Taiga #5915](https://tree.taiga.io/project/penpot/us/5915)
+- [REDESIGN] Comments page [Taiga #5917](https://tree.taiga.io/project/penpot/us/5917)
+- [REDESIGN] View Mode [Taiga #5163](https://tree.taiga.io/project/penpot/us/5163)
+- [REDESIGN] Miscellaneous tasks [Taiga #6050](https://tree.taiga.io/project/penpot/us/6050)
+- [REDESIGN] Swap components [Taiga #6739](https://tree.taiga.io/project/penpot/us/6739)
+- [REDESIGN] Font selector [Taiga #6677](https://tree.taiga.io/project/penpot/us/6677)
+- [REDESIGN] Colour system of alerts and notifications [Taiga #6746](https://tree.taiga.io/project/penpot/us/6746)
+- [REDESIGN] Review text in paragraphs for accessibility [Taiga #6703](https://tree.taiga.io/project/penpot/us/6703)
+- [REDESIGN] Interaction icons [Taiga #6880](https://tree.taiga.io/project/penpot/us/6880)
+- [REDESIGN] Panels visual separations [Taiga #6692](https://tree.taiga.io/project/penpot/us/6692)
+- [REDESIGN] Onboarding slides [Taiga #6678](https://tree.taiga.io/project/penpot/us/6678)
+
+### :bug: Bugs fixed
+- Fix pixelated thumbnails [Github #3681](https://github.com/penpot/penpot/issues/3681), [Github #3661](https://github.com/penpot/penpot/issues/3661)
+- Fix problem with not applying colors to boards [Github #3941](https://github.com/penpot/penpot/issues/3941)
+- Fix problem with path editor undoing changes [Github #3998](https://github.com/penpot/penpot/issues/3998)
+- [View mode] Open overlay places frame in the wrong position when paired with a fixed element [Taiga #6385](https://tree.taiga.io/project/penpot/issue/6385)
+- Flex Layout: Fit-content not recalculated after deleting an element [Taiga #5968](https://tree.taiga.io/project/penpot/issue/5968)
+- Selecting from Color Palette does not work for board when there is no existing fill [Taiga #6464](https://tree.taiga.io/project/penpot/issue/6464)
+- Color thumbnails are consistently rounded in the inspect code mode [Taiga #5886](https://tree.taiga.io/project/penpot/issue/5886)
+- Adding vector path points before first point of existing open path not working [Taiga #6593](https://tree.taiga.io/project/penpot/issue/6593)
+- Some image formats include the extension when importing  [Taiga #5485](https://tree.taiga.io/project/penpot/issue/5485)
+- Gradient color tool doesn't work properly with flipped items [Taiga #6485](https://tree.taiga.io/project/penpot/issue/6485)
+- [TEXT] Align options are not shown when several text are selected [Taiga #5948](https://tree.taiga.io/project/penpot/issue/5948)
+- [VIEW MODE] Comments not working properly on multiple pages [Taiga #6281](https://tree.taiga.io/project/penpot/issue/6281)
+- [PERFORMANCE] Alignments are slow [Taiga #5865](https://tree.taiga.io/project/penpot/issue/5865)
+- [EXPORT] Exporting an element with a non-visible drop shadow displays the shadow either way [Taiga #6768](https://tree.taiga.io/project/penpot/issue/6768)
+- [SAFARI] Color picker cursor is not pointing correctly [Taiga #6733](https://tree.taiga.io/project/penpot/issue/6733)
+- [Import Files] When user has imported .penpot file with new file name of previously downloaded library file the default library file name is set for it [Taiga #5596](https://tree.taiga.io/project/penpot/issue/5596)
+- Issue when resizing a duotone FA icon [Taiga #5935](https://tree.taiga.io/project/penpot/issue/5935)
+- "Hide grid" keyboard shortcut broken [Taiga #5102](https://tree.taiga.io/project/penpot/issue/5102)
+- Picking a gradient color in recent colors for a new color in the assets tab crashes Penpot [Taiga #5601](https://tree.taiga.io/project/penpot/issue/5601)
+- Thumbnails not loading [Taiga #6012](https://tree.taiga.io/project/penpot/issue/6012)
+- Don't show signup link/form when registration is disabled. [Taiga #1196](https://tree.taiga.io/project/penpot/issue/1196)
+- Registration Page UI UX issue with small resolutions [Taiga #1693](https://tree.taiga.io/project/penpot/issue/1693)
+- [LOGIN] "E-Mail-Adress" input field is set to type 'text' instead of 'eMail [Taiga #1921](https://tree.taiga.io/project/penpot/issue/1921)
+- Handling correctly slashes "/" in emails [Taiga #4906](https://tree.taiga.io/project/penpot/issue/4906)
+- Tab character in texts crashes the app [Taiga #4418](https://tree.taiga.io/project/penpot/issue/4418)
+- Text does not match export [Taiga #4129](https://tree.taiga.io/project/penpot/issue/4129)
+- Scrollbars cover the layers carets [Taiga #4431](https://tree.taiga.io/project/penpot/issue/4431)
+- Horizontal ruler disappear when overlapping a board [Taiga #4138](https://tree.taiga.io/project/penpot/issue/4138)
+- Resize shape + Alt key is not working [Taiga #3447](https://tree.taiga.io/project/penpot/issue/3447)
+- Libraries images broken on premise [Taiga #4573](https://tree.taiga.io/project/penpot/issue/4573)
+- [VIEWER] Cannot scroll down in code </> mode [Taiga #4655](https://tree.taiga.io/project/penpot/issue/4655)
+- Strange cursor behavior after clicking viewport with text tool [Taiga #4363](https://tree.taiga.io/project/penpot/issue/4363)
+- Selected color affects all of them [Taiga #5285](https://tree.taiga.io/project/penpot/issue/5285)
+- Fix problem with shadow negative spread [Github #3421](https://github.com/penpot/penpot/issues/3421)
+- Fix problem with linked colors to strokes [Github #3522](https://github.com/penpot/penpot/issues/3522)
+- Fix problem with hand tool stuck [Github #3318](https://github.com/penpot/penpot/issues/3318)
+- Fix problem with fix scrolling on nested elements [Github #3508](https://github.com/penpot/penpot/issues/3508)
+- Fix problem when changing typography assets [Github #3683](https://github.com/penpot/penpot/issues/3683)
+- Internal error when you copy and paste some main components between files [Taiga #7397](https://tree.taiga.io/project/penpot/issue/7397)
+- Fix toolbar disappearing [Taiga #7411](https://tree.taiga.io/project/penpot/issue/7411)
+- Fix long text on tab breaks UI [Taiga #7421](https://tree.taiga.io/project/penpot/issue/7421)
+
+## 1.19.5
+
+### :bug: New features
+
+- Fix problem with alignment performance
+
+## 1.19.4
+
+### :sparkles: New features
+
+- Improve selected colors [Taiga #5805]( https://tree.taiga.io/project/penpot/us/5805)
+
+### :bug: Bugs fixed
+
+- Fix problem with z-index field in non-absolute items
+
+## 1.19.3
+
+### :sparkles: New features
+
+- Remember last color mode in colorpicker [Taiga #5508](https://tree.taiga.io/project/penpot/issue/5508)
+- Improve layers multiselection behaviour [Github #5741](https://github.com/penpot/penpot/issues/5741)
+- Remember last active team across logouts / sessions [Github #3325](https://github.com/penpot/penpot/issues/3325)
+
+### :bug: Bugs fixed
+
+- List view is discarded on tab change on Workspace Assets Sidebar tab [Github #3547](https://github.com/penpot/penpot/issues/3547)
+- Fix message popup remains open when exiting workspace with browser back button [Taiga #5747](https://tree.taiga.io/project/penpot/issue/5747)
+- When editing text if font is changed, the proportions of the rendered shape are wrong [Taiga #5786](https://tree.taiga.io/project/penpot/issue/5786)
+
+## 1.19.2
+
+### :sparkles: New features
+
+- Navigate up in layer hierarchy with Shift+Enter shortcut [Taiga #5734](https://tree.taiga.io/project/penpot/us/5734)
+- Click on the flow tags open viewer with the selected frame [Taiga #5044](https://tree.taiga.io/project/penpot/us/5044)
+- Add Dutch language & update translation files with weblate
+
+### :bug: Bugs fixed
+
+- Fix unexpected output on get-page rpc method when invalid object-id is provided [Github #3546](https://github.com/penpot/penpot/issues/3546)
+- Fix Invalid files amount after moving file from Project to Drafts [Taiga #5638](https://tree.taiga.io/project/penpot/us/5638)
+- Fix deleted pages comments shown in right sidebar [Taiga #5648](https://tree.taiga.io/project/penpot/us/5648)
+- Fix tooltip on toggle visibility and toggle lock buttons [Taiga #5141](https://tree.taiga.io/project/penpot/issue/5141)
+
+
+## 1.19.1
+
+### :bug: Bugs fixed
+
+- Fix components not registered as updated [Taiga #5725](https://tree.taiga.io/project/penpot/issue/5725)
+
+## 1.19.0
 
 ### :boom: Breaking changes & Deprecations
 
 ### :sparkles: New features
+
 - Default naming of text layers [Taiga #2836](https://tree.taiga.io/project/penpot/us/2836)
-- Create typography style from a selected text layer[Taiga #3041](https://tree.taiga.io/project/penpot/us/3041)
+- Create typography style from a selected text layer [Taiga #3041](https://tree.taiga.io/project/penpot/us/3041)
 - Board as ruler origin [Taiga #4833](https://tree.taiga.io/project/penpot/us/4833)
 - Access tokens support [Taiga #4460](https://tree.taiga.io/project/penpot/us/4460)
 - Show interactions setting at the view mode [Taiga #1330](https://tree.taiga.io/project/penpot/issue/1330)
+- Improve dashboard performance related to thumbnails; now the thumbnails are
+  rendered as bitmap images.
+- Add the ability to disable google fonts provider with the `disable-google-fonts-provider` flag
+- Add the ability to disable dashboard templates section with the `disable-dashboard-templates-section` flag
+- Add the ability to use the registration whitelist with OICD [Github #3348](https://github.com/penpot/penpot/issues/3348)
+- Add support for local caching of google fonts (this avoids exposing the final user IP to
+  goolge and reduces the amount of request sent to google)
+- Set smooth/instant autoscroll depending on distance [GitHub #3377](https://github.com/penpot/penpot/issues/3377)
+- New component icon [Taiga #5290](https://tree.taiga.io/project/penpot/us/5290)
+- Show a confirmation dialog when an user tries to publish an empty library [Taiga #5294](https://tree.taiga.io/project/penpot/us/5294)
 
 ### :bug: Bugs fixed
+
 - Fix files can be opened from multiple urls [Taiga #5310](https://tree.taiga.io/project/penpot/issue/5310)
 - Fix asset color item was created from the selected layer [Taiga #5180](https://tree.taiga.io/project/penpot/issue/5180)
+- Fix unpublish more than one library at the same time [Taiga #5532](https://tree.taiga.io/project/penpot/issue/5532)
+- Fix drag projects on dahsboard [Taiga #5531](https://tree.taiga.io/project/penpot/issue/5531)
+- Fix allow team name to be all blank [Taiga #5527](https://tree.taiga.io/project/penpot/issue/5527)
+- Fix search font visualitation [Taiga #5523](https://tree.taiga.io/project/penpot/issue/5523)
+- Fix create and account only with spaces [Taiga #5518](https://tree.taiga.io/project/penpot/issue/5518)
+- Fix context menu outside screen [Taiga #5524](https://tree.taiga.io/project/penpot/issue/5524)
+- Fix graphic item rename on assets pannel [Taiga #5556](https://tree.taiga.io/project/penpot/issue/5556)
+- Fix component and media name validation on assets panel [Taiga #5555](https://tree.taiga.io/project/penpot/issue/5555)
+- Fix problem with selection shortcuts [Taiga #5492](https://tree.taiga.io/project/penpot/issue/5492)
+- Fix issue with paths line to curve and concurrent editing [Taiga #5191](https://tree.taiga.io/project/penpot/issue/5191)
+- Fix problems with locked layers [Taiga #5139](https://tree.taiga.io/project/penpot/issue/5139)
+- Fix export from shared prototype [Taiga #5565](https://tree.taiga.io/project/penpot/issue/5565)
+- Fix email change: validation error displaying even after both fields are identical [Taiga #5514](https://tree.taiga.io/project/penpot/issue/5514)
+- Fix scroll on viewer comment list [Taiga #5563](https://tree.taiga.io/project/penpot/issue/5563)
+- Fix context menu z-index [Taiga #5561](https://tree.taiga.io/project/penpot/issue/5561)
+- Fix select all checkbox on shared link config [Taiga #5566](https://tree.taiga.io/project/penpot/issue/5566)
+- Fix validation on full name input on account creation [Taiga #5516](https://tree.taiga.io/project/penpot/issue/5516)
+- Fix validation on team name input [Taiga #5510](https://tree.taiga.io/project/penpot/issue/5510)
+- Fix incorrect uri generation issues on share-link modal [Taiga #5564](https://tree.taiga.io/project/penpot/issue/5564)
+- Fix cache issues with share-links [Taiga #5559](https://tree.taiga.io/project/penpot/issue/5559)
+- Makes height priority for the rows/columns grids [#2774](https://github.com/penpot/penpot/issues/2774)
+- Fix problem with comments mode not staying [#3363](https://github.com/penpot/penpot/issues/3363)
+- Fix problem with comments when user left the team [Taiga #5562](https://tree.taiga.io/project/penpot/issue/5562)
+- Fix problem with images patterns repeating [#3372](https://github.com/penpot/penpot/issues/3372)
+- Fix grid not being clipped in frames [#3365](https://github.com/penpot/penpot/issues/3365)
+- Fix cut/delete text layer when while creating text [Taiga #5602](https://tree.taiga.io/project/penpot/issue/5602)
+- Fix picking a gradient color in recent colors for a new color in the assets tab [Taiga #5601](https://tree.taiga.io/project/penpot/issue/5601)
+- Fix problem with importation process [Taiga #5597](https://tree.taiga.io/project/penpot/issue/5597)
+- Fix problem with HSV color picker [#3317](https://github.com/penpot/penpot/issues/3317)
+- Fix problem with slashes in layers names for exporter [#3276](https://github.com/penpot/penpot/issues/3276)
+- Fix incorrect modified data on moving files on dashboard [Taiga #5530](https://tree.taiga.io/project/penpot/issue/5530)
+- Fix focus handling on comments edition [Taiga #5560](https://tree.taiga.io/project/penpot/issue/5560)
+- Fix incorrect fullname use on registring user after OIDC authentication [Taiga #5517](https://tree.taiga.io/project/penpot/issue/5517)
+- Fix incorrect modified-at on project after import file [Taiga #5268](https://tree.taiga.io/project/penpot/issue/5268)
+- Fix incorrect message after sending invitation to already member [Taiga 5599](https://tree.taiga.io/project/penpot/issue/5599)
+- Fix text decoration on button [Taiga #5301](https://tree.taiga.io/project/penpot/issue/5301)
+- Fix menu order on design tab [Taiga #5195](https://tree.taiga.io/project/penpot/issue/5195)
+- Fix search bar width on layer tab [Taiga #5445](https://tree.taiga.io/project/penpot/issue/5445)
+- Fix border radius values with decimals [Taiga #5283](https://tree.taiga.io/project/penpot/issue/5283)
+- Fix shortcuts translations not homogenized [Taiga #5141](https://tree.taiga.io/project/penpot/issue/5141)
+- Fix overlay manual position in nested boards [Taiga #5135](https://tree.taiga.io/project/penpot/issue/5135)
+- Fix close overlay from a nested board [Taiga #5587](https://tree.taiga.io/project/penpot/issue/5587)
+- Fix overlay position when it has shadow or blur [Taiga #4752](https://tree.taiga.io/project/penpot/issue/4752)
+- Fix overlay position when there are elements fixed when scrolling [Taiga #4383](https://tree.taiga.io/project/penpot/issue/4383)
+- Fix problem when sliding color picker in selected-colors [#3150](https://github.com/penpot/penpot/issues/3150)
+- Fix error screen on upload image error [Taiga #5608](https://tree.taiga.io/project/penpot/issue/5608)
+- Fix bad frame-id for certain componentes [#3205](https://github.com/penpot/penpot/issues/3205)
+- Fix paste elements at bottom of frame [Taig #5253](https://tree.taiga.io/project/penpot/issue/5253)
+- Fix new-file button on project not redirecting to the new file [Taiga #5610](https://tree.taiga.io/project/penpot/issue/5610)
+- Fix retrieve user comments in dashboard [Taiga #5607](https://tree.taiga.io/project/penpot/issue/5607)
+- Locks shapes when moved inside a locked parent [Taiga #5252](https://tree.taiga.io/project/penpot/issue/5252)
+- Fix rotate several elements in bulk [Taiga #5165](https://tree.taiga.io/project/penpot/issue/5165)
+- Fix onboarding slides height [Taiga #5373](https://tree.taiga.io/project/penpot/issue/5373)
+- Fix create typography with section closed [Taiga #5574](https://tree.taiga.io/project/penpot/issue/5574)
+- Fix exports menu on viewer mode [Taiga #5568](https://tree.taiga.io/project/penpot/issue/5568)
+- Fix create empty comments [Taiga #5536](https://tree.taiga.io/project/penpot/issue/5536)
+- Fix text changes not propagated to copy [Taiga #5364](https://tree.taiga.io/project/penpot/issue/5364)
+- Fix position of text cursor is a bit too high in Invitations section [Taiga #5511](https://tree.taiga.io/project/penpot/issue/5511)
+- Fix undo when updating several texts [Taiga #5197](https://tree.taiga.io/project/penpot/issue/5197)
+- Fix assets right click button for multiple selection [Taiga #5545](https://tree.taiga.io/project/penpot/issue/5545)
+- Fix problem with precision in resizes [Taiga #5623](https://tree.taiga.io/project/penpot/issue/5623)
+- Fix absolute positioned layouts not showing flex properties [Taiga #5630](https://tree.taiga.io/project/penpot/issue/5630)
+- Fix text gradient handlers [Taiga #4047](https://tree.taiga.io/project/penpot/issue/4047)
+- Fix when user deletes one file during import it is impossible to finish importing of second file [Taiga #5656](https://tree.taiga.io/project/penpot/issue/5656)
+- Fix export multiple images when only one of them has export settings [Taiga #5649](https://tree.taiga.io/project/penpot/issue/5649)
+- Fix error when a user different than the thread creator edits a comment [Taiga #5647](https://tree.taiga.io/project/penpot/issue/5647)
+- Fix unnecessary button [Taiga #3312](https://tree.taiga.io/project/penpot/issue/3312)
+- Fix copy color information in several formats [Taiga #4723](https://tree.taiga.io/project/penpot/issue/4723)
+- Fix dropdown width [Taiga #5541](https://tree.taiga.io/project/penpot/issue/5541)
+- Fix enable comment mode and insert image keeps on comment mode [Taiga #5678](https://tree.taiga.io/project/penpot/issue/5678)
+- Fix enable undo just after using pencil [Taiga #5674](https://tree.taiga.io/project/penpot/issue/5674)
+- Fix 400 error when user changes password [Taiga #5643](https://tree.taiga.io/project/penpot/issue/5643)
+- Fix cannot undo layer styles [Taiga #5676](https://tree.taiga.io/project/penpot/issue/5676)
+- Fix unexpected exception on boolean shapes [Taiga #5685](https://tree.taiga.io/project/penpot/issue/5685)
+- Fix ctrl+z on select not working [Taiga #5677](https://tree.taiga.io/project/penpot/issue/5677)
+- Fix thubmnail rendering flashing [Taiga #5675](https://tree.taiga.io/project/penpot/issue/5675)
 
 ### :arrow_up: Deps updates
 
+- Update google fonts catalog (at 2023/07/06) [Taiga #5592](https://tree.taiga.io/project/penpot/issue/5592)
+
+
 ### :heart: Community contributions by (Thank you!)
+
 - Update Typography palette order (by @akshay-gupta7) [Github #3156](https://github.com/penpot/penpot/pull/3156)
 - Palettes (color, typographies) empty state (by @akshay-gupta7) [Github #3160](https://github.com/penpot/penpot/pull/3160)
 - Duplicate objects via drag + alt (by @akshay-gupta7) [Github #3147](https://github.com/penpot/penpot/pull/3147)
@@ -31,6 +652,7 @@
 - Open project in new tab from workspace (by @akshay-gupta7) [Github #3246](https://github.com/penpot/penpot/pull/3246)
 - Distribute fix enabled when two elements were selected (by @dfelinto) [Github #3266](https://github.com/penpot/penpot/pull/3266)
 - Distribute vertical spacing failing for overlapped text (by @dfelinto) [Github #3267](https://github.com/penpot/penpot/pull/3267)
+- bug Change independent corner radius input tooltips #3332 (by @astudentinearth) [Github #3332](https://github.com/penpot/penpot/pull/3332)
 
 ## 1.18.6
 

CONTRIBUTING.md

@@ -48,7 +48,7 @@ quick win.
 If is going to be your first pull request, You can learn how from this
 free video series:
 
-https://egghead.io/series/how-to-contribute-to-an-open-source-project-on-github
+https://egghead.io/courses/how-to-contribute-to-an-open-source-project-on-github
 
 We will use the `easy fix` mark for tag for indicate issues that are
 easy for beginners.

README.md

@@ -2,86 +2,106 @@
 [uri_license]: https://www.mozilla.org/en-US/MPL/2.0
 [uri_license_image]: https://img.shields.io/badge/MPL-2.0-blue.svg
 
-<h1 align="center">
-  <br>
-  <img src="https://penpot.app/images/readme/git-readme-header.png" alt="PENPOT">
-</h1>
-
-<p align="center"><a href="https://www.mozilla.org/en-US/MPL/2.0" rel="nofollow"><img src="https://camo.githubusercontent.com/3fcf3d6b678ea15fde3cf7d6af0e242160366282d62a7c182d83a50bfee3f45e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4d504c2d322e302d626c75652e737667" alt="License: MPL-2.0" data-canonical-src="https://img.shields.io/badge/MPL-2.0-blue.svg" style="max-width:100%;"></a>
-<a href="https://gitter.im/penpot/community" rel="nofollow"><img src="https://camo.githubusercontent.com/5b0aecb33434f82a7b158eab7247544235ada0cf7eeb9ce8e52562dd67f614b7/68747470733a2f2f6261646765732e6769747465722e696d2f736572656e6f2d78797a2f636f6d6d756e6974792e737667" alt="Gitter" data-canonical-src="https://badges.gitter.im/sereno-xyz/community.svg" style="max-width:100%;"></a>
-<a href="https://tree.taiga.io/project/penpot/" title="Managed with Taiga.io" rel="nofollow"><img src="https://camo.githubusercontent.com/4a1d1112f0272e3393b1e8da312ff4435418e9e2eb4c0964881e3680f90a653c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6d616e61676564253230776974682d54414947412e696f2d3730396631342e737667" alt="Managed with Taiga.io" data-canonical-src="https://img.shields.io/badge/managed%20with-TAIGA.io-709f14.svg" style="max-width:100%;"></a>
-<a href="https://gitpod.io/#https://github.com/penpot/penpot" rel="nofollow"><img src="https://camo.githubusercontent.com/daadb4894128d1e19b72d80236f5959f1f2b47f9fe081373f3246131f0189f6c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f476974706f642d72656164792d2d746f2d2d636f64652d626c75653f6c6f676f3d676974706f64" alt="Gitpod ready-to-code" data-canonical-src="https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod" style="max-width:100%;"></a></p>
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://penpot.app/images/readme/github-dark-mode.png">
+  <source media="(prefers-color-scheme: light)" srcset="https://penpot.app/images/readme/github-light-mode.png">
+  <img alt="penpot header image" src="https://penpot.app/images/readme/github-light-mode.png">
+</picture>
 
 <p align="center">
-    <a href="https://penpot.app/"><b>Website</b></a> •
-    <a href="https://help.penpot.app/technical-guide/getting-started/"><b>Getting Started</b></a> •
-    <a href="https://help.penpot.app/user-guide/"><b>User Guide</b></a> •
-    <a href="https://help.penpot.app/user-guide/introduction/info/"><b>Tutorials & Info</b></a> •
-    <a href="https://community.penpot.app/"><b>Community</b></a> •
-    <a href="https://twitter.com/penpotapp"><b>Twitter</b></a> •
-    <a href="https://instagram.com/penpot.app"><b>Instagram</b></a> •
-    <a href="https://fosstodon.org/@penpot/"><b>Mastodon</b></a> •
-    <a href="https://www.youtube.com/channel/UCAqS8G72uv9P5HG1IfgnQ9g"><b>Youtube</b></a>
+<a href="https://www.mozilla.org/en-US/MPL/2.0" rel="nofollow"><img alt="License: MPL-2.0" src="https://img.shields.io/badge/MPL-2.0-blue.svg" style="max-width:100%;"></a>
+<a href="https://community.penpot.app" rel="nofollow"><img alt="Penpot Community" src="https://img.shields.io/discourse/posts?server=https%3A%2F%2Fcommunity.penpot.app" style="max-width:100%;"></a>
+<a href="https://tree.taiga.io/project/penpot/" title="Managed with Taiga.io" rel="nofollow"><img alt="Managed with Taiga.io" src="https://img.shields.io/badge/managed%20with-TAIGA.io-709f14.svg" style="max-width:100%;"></a>
+<a href="https://gitpod.io/#https://github.com/penpot/penpot" rel="nofollow"><img alt="Gitpod ready-to-code" src="https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod" style="max-width:100%;"></a>
 </p>
 
-![feature-readme](https://user-images.githubusercontent.com/1045247/189871786-0b44f7cf-3a0a-4445-a87b-9919ec398bf7.gif)
+<p align="center">
+    <a href="https://penpot.app/"><b>Website</b></a>  •  
+    <a href="https://help.penpot.app/technical-guide/getting-started/"><b>Getting Started</b></a>  •  
+    <a href="https://help.penpot.app/user-guide/"><b>User Guide</b></a>  •  
+    <a href="https://help.penpot.app/user-guide/introduction/info/"><b>Tutorials & Info</b></a>  •  
+    <a href="https://community.penpot.app/"><b>Community</b></a>
+</p>
+<p align="center">
+    <a href="https://www.youtube.com/@Penpot"><b>Youtube</b></a>  •  
+    <a href="https://peertube.kaleidos.net/a/penpot_app/video-channels"><b>Peertube</b></a>  •  
+    <a href="https://www.linkedin.com/company/penpot/"><b>Linkedin</b></a>  •  
+    <a href="https://instagram.com/penpot.app"><b>Instagram</b></a>  •  
+    <a href="https://fosstodon.org/@penpot/"><b>Mastodon</b></a>  •  
+    <a href="https://twitter.com/penpotapp"><b>X</b></a>
 
-**:tada: [Important Notice!] :tada:** Our very first **Penpot Fest** is happening on June 28-30, Barcelona (Spain). **Secure yourself a ticket** to know everything about the present and future of Penpot and be part of the conversation! See details on the amazing venue and speakers lineup at [penpotfest.org](https://penpotfest.org)! :zap:
+</p>
 
-Penpot is the first **Open Source** design and prototyping platform meant for cross-domain teams. Non dependent on operating systems, Penpot is web based and works with open standards (SVG). Penpot invites designers all over the world to fall in love with open source while getting developers excited about the design process in return.
+<br />
+
+[Penpot video](https://github.com/penpot/penpot/assets/5446186/b8ad0764-585e-4ddc-b098-9b4090d337cc)
+
+<br />
+
+Penpot is the first **open-source** design tool for design and code collaboration. Designers can create stunning designs, interactive prototypes, design systems at scale, while developers enjoy ready-to-use code and make their workflow easy and fast. And all of this with no handoff drama.
+
+Penpot is available on browser and [self host](https://penpot.app/self-host). It’s web-based and works with open standards (SVG, CSS and HTML). And last but not least, it’s free! 
+
+Penpot’s latest [huge release 2.0](https://penpot.app/dev-diaries), takes the platform to a whole new level. This update introduces the ground-breaking [CSS Grid Layout feature](https://penpot.app/penpot-2.0), a complete UI redesign, a new Components system, and much more. Plus, it's faster and more accessible. 
+
+
+🎇 **Penpot Fest** is our design, code & Open Source event. Check out the highlights from [Penpot Fest 2023 edition](https://www.youtube.com/watch?v=sOpLZaK5mDc)!
 
 ## Table of contents ##
 
 - [Why Penpot](#why-penpot)
 - [Getting Started](#getting-started)
 - [Community](#community)
+- [Contributing](#contributing)
 - [Resources](#resources)
 - [License](#license)
 
 ## Why Penpot ##
 
-Penpot makes design and prototyping accessible to every team in the world.
+Penpot expresses designs as code. Designers can do their best work and see it will be beautifully implemented by developers in a two-way collaboration.
 
-### For cross-domain teams ###
-We have a clear focus on design and code teams and our capabilities reflect exactly that. The less hand-off mindset, the more fun for everyone.
+### Plugin system ###
+[Penpot plugins](https://penpot.app/penpothub/plugins) let you expand the platform's capabilities, give you the flexibility to integrate it with other apps, and design custom solutions. 
 
-### Multiplatform ###
-Being web based, Penpot is not dependent on operating systems or local installations, you will only need to run a modern browser.
+### Designed for developers ###
+Penpot was built to serve both designers and developers and create a fluid design-code process. You have the choice to enjoy real-time collaboration or play "solo".
 
-### Open Standards ###
-Using SVG as no other design and prototyping tool does, Penpot files sport compatibility with most of the vectorial tools, are tech friendly and extremely easy to use on the web. We make sure you will always own your work.
+### Inspect mode ###
+Work with ready-to-use code and make your workflow easy and fast. The inspect tab gives instant access to SVG, CSS and HTML code.
+
+### Self host your own instance ###
+Provide your team or organization with a completely owned collaborative design tool. Use Penpot's cloud service or deploy your own Penpot server.
+
+### Integrations ###
+Penpot offers integration into the development toolchain, thanks to its support for webhooks and an API accessible through access tokens.
+
+### What’s great for design ###
+With Penpot you can design libraries to share and reuse; turn design elements into components and tokens to allow reusability and scalability; and build realistic user flows and interactions.
+
+<br />
 
 <p align="center">
-  <img src="https://penpot.app/images/readme/git-open.png" alt="Open Source" style="width: 65%;">
+  <img src="https://img.plasmic.app/img-optimizer/v1/img?src=https%3A%2F%2Fimg.plasmic.app%2Fimg-optimizer%2Fv1%2Fimg%2F9dd677c36afb477e9666ccd1d3f009ad.png" alt="Open Source" style="width: 65%;">
 </p>
 
+<br />
 
 ## Getting started ##
 
 ### Install with Elestio ###
-[Elestio](https://elest.io/) offers a fully managed service for on-premise instances of a selection of open-source software! This means you can deploy a dedicated instance of Penpot in just 3 minutes with no technical knowledge needed.
+Penpot is the only design & prototype platform that is deployment agnostic. You can use it or deploy it anywhere.
 
-You don’t need to worry about DNS configuration, SMTP, backups, SSL certificates, OS & Penpot upgrades, and much more.
-
-[Get started with Elestio.](https://help.penpot.app/technical-guide/getting-started/#install-with-elestio)
-
-### Install with Docker ###
-
-You can also get started with Penpot locally or self-host it with **docker** and **docker-compose**.
-
-Here’s a step-by-step guide on [getting started with Docker.](https://help.penpot.app/technical-guide/getting-started/#install-with-docker)
-
-### Penpot cloud app ###
-
-If you prefer not to install Penpot in a local environment, [login or register on our Penpot cloud app](https://design.penpot.app). Create a team to work together on projects and share design assets or jump right away into Penpot and **start designing** on your own.
+Learn how to install it with Elestio and Docker, or other options on [our website](https://penpot.app/self-host).
+<br />
 
 <p align="center">
-  <img src="https://penpot.app/images/readme/git-self-host.png" alt="Getting started" style="width: 65%;">
+  <img src="https://site-assets.plasmic.app/2168cf524dd543caeff32384eb9ea0a1.svg" alt="Open Source" style="width: 65%;">
 </p>
+<br />
 
 ## Community ##
 
-We love the open source software community. Contributing is our passion and if it’s yours too, [participate](https://community.penpot.app/) and [improve](https://community.penpot.app/c/help-us-improve-penpot/7) Penpot. All your ideas and code are welcome!
+We love the Open Source software community. Contributing is our passion and if it’s yours too, participate and [improve](https://community.penpot.app/c/help-us-improve-penpot/7) Penpot. All your designs, code and ideas are welcome!
 
 If you need help or have any questions; if you’d like to share your experience using Penpot or get inspired; if you’d rather meet our community of developers and designers, [join our Community](https://community.penpot.app/)!
 
@@ -93,29 +113,41 @@ You will find the following categories:
 - [Events and Announcements](https://community.penpot.app/c/announcements/5)
 - [Inside Penpot](https://community.penpot.app/c/inside-penpot/21)
 - [Penpot in your language](https://community.penpot.app/c/penpot-in-your-language/12)
+- [Design and Code Essentials](https://community.penpot.app/c/design-and-code-essentials/22)
+
+
+<br />
 
 <p align="center">
-  <img src="https://penpot.app/images/readme/git-collaborate.png" alt="Communnity" style="width: 65%;">
+  <img src="https://github.com/penpot/penpot/assets/5446186/6ac62220-a16c-46c9-ab21-d24ae357ed03" alt="Community" style="width: 65%;">
 </p>
+<br />
 
 ## Contributing ##
 
-Every sort of contribution will be very helpful to enhance Penpot. How you’ll participate? All your ideas, designs and code are welcome:
+Any contribution will make a difference to improve Penpot. How can you get involved? 
 
+Choose your way: 
+
+- Create and [share Libraries & Templates](https://penpot.app/libraries-templates.html) that will be helpful for the community
 - Invite your [team to join](https://design.penpot.app/#/auth/register)
-- Star this repo and follow us on Social Media:  [Twitter](https://twitter.com/penpotapp), [Instagram](https://instagram.com/penpot.app), [Youtube](https://www.youtube.com/c/Penpot) or [Mastodon](https://fosstodon.org/@penpot/).
-- Participate in the [Community](https://community.penpot.app/) asking and answering questions, reacting to others’ articles or opening your own conversations.
+- Star this repo and follow us on Social Media: [Mastodon](https://fosstodon.org/@penpot/), [Youtube](https://www.youtube.com/c/Penpot), [Instagram](https://instagram.com/penpot.app), [Linkedin](https://www.linkedin.com/company/penpotdesign),  [Peertube](https://peertube.kaleidos.net/a/penpot_app) and [X](https://twitter.com/penpotapp).
+- Participate in the [Community](https://community.penpot.app/) space by asking and answering questions; reacting to others’ articles;  opening your own conversations and following along on decisions affecting the project.
 - Report bugs with our easy [guide for bugs hunting](https://help.penpot.app/contributing-guide/reporting-bugs/) or [GitHub issues](https://github.com/penpot/penpot/issues)
-- Create and [share Libraries & templates](https://penpot.app/libraries-templates.html) that will be helpful for the community
 - Become a [translator](https://help.penpot.app/contributing-guide/translations)
-- Give feedback: [Mail us](mailto:support@penpot.app)
+- Give feedback: [Email us](mailto:support@penpot.app)
+- **Contribute to Penpot's code:** [Watch this video](https://www.youtube.com/watch?v=TpN0osiY-8k) by Alejandro Alonso, CIO and developer at Penpot, where he gives us a hands-on demo of how to use Penpot’s repository and make changes in both front and back end
 
-To find (almost) everything you need to know on how to contribute to Penpot, refer to the [contributing-guide](https://help.penpot.app/contributing-guide/).
+To find (almost) everything you need to know on how to contribute to Penpot, refer to the [contributing guide](https://help.penpot.app/contributing-guide/).
+
+<br />
 
 <p align="center">
-  <img src="https://penpot.app/images/readme/git-community.png" alt="Contributing" style="width: 65%;">
+  <img src="https://github.com/penpot/penpot/assets/5446186/fea18923-dc06-49be-86ad-c3496a7956e6" alt="Libraries and templates" style="width: 65%;">
 </p>
 
+<br />
+
 ## Resources ##
 
 You can ask and answer questions, have open-ended conversations, and follow along on decisions affecting the project.
@@ -140,4 +172,4 @@ file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 Copyright (c) KALEIDOS INC
 ```
-Penpot is a Kaleidos’ [open source project](https://kaleidos.net/products)
+Penpot is a Kaleidos’ [open source project](https://kaleidos.net/)

THANKYOU.md

@@ -2,12 +2,19 @@
 
 We want to thank to the amazing people that help us! Thank you! You're the best!
 
+Feel free you make a PR updating this file if you miss you in the
+list.
+
 ## Security
+
 * Husnain Iqbal (CEO OF ALPHA INFERNO PVT LTD)
 * [Shiraz Ali Khan](https://www.linkedin.com/in/shiraz-ali-khan-1ba508180/)
 * Vaibhav Shukla
+* Hassan Ahmed (Alias Xen Lee)
+* Michal Biesiada (@mbiesiad)
 
 ## Internationalization
+
 * [00ff88](https://hosted.weblate.org/user/00ff88)
 * [AhmadHB](https://hosted.weblate.org/user/AhmadHB)
 * [Aimee](https://hosted.weblate.org/user/Aimee)
@@ -89,6 +96,7 @@ We want to thank to the amazing people that help us! Thank you! You're the best!
 * [zcraber](https://hosted.weblate.org/user/zcraber)
 
 ## Libraries & templates
+
 * systxema
 * plumilla
 * victor crespo

backend/.gitignore

@@ -0,0 +1,7 @@
+.pnp.*
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/sdks
+!.yarn/versions

backend/deps.edn

@@ -3,10 +3,10 @@
 
  :deps
  {penpot/common {:local/root "../common"}
-  org.clojure/clojure {:mvn/version "1.11.1"}
-  org.clojure/core.async {:mvn/version "1.6.673"}
+  org.clojure/clojure {:mvn/version "1.12.0"}
+  org.clojure/tools.namespace {:mvn/version "1.5.0"}
 
-  com.github.luben/zstd-jni {:mvn/version "1.5.2-5"}
+  com.github.luben/zstd-jni {:mvn/version "1.5.6-6"}
 
   io.prometheus/simpleclient {:mvn/version "0.16.0"}
   io.prometheus/simpleclient_hotspot {:mvn/version "0.16.0"}
@@ -17,30 +17,33 @@
 
   io.prometheus/simpleclient_httpserver {:mvn/version "0.16.0"}
 
-  io.lettuce/lettuce-core {:mvn/version "6.2.2.RELEASE"}
+  io.lettuce/lettuce-core {:mvn/version "6.4.0.RELEASE"}
   java-http-clj/java-http-clj {:mvn/version "0.4.3"}
 
   funcool/yetti
-  {:git/tag "v9.15"
-   :git/sha "aa9b967"
+  {:git/tag "v11.4"
+   :git/sha "ce50d42"
    :git/url "https://github.com/funcool/yetti.git"
    :exclusions [org.slf4j/slf4j-api]}
 
-  com.github.seancorfield/next.jdbc {:mvn/version "1.3.847"}
-  metosin/reitit-core {:mvn/version "0.5.18"}
+  com.github.seancorfield/next.jdbc {:mvn/version "1.3.955"}
+  metosin/reitit-core {:mvn/version "0.7.2"}
+  nrepl/nrepl {:mvn/version "1.3.0"}
+  cider/cider-nrepl {:mvn/version "0.50.2"}
 
-  org.postgresql/postgresql {:mvn/version "42.6.0"}
+  org.postgresql/postgresql {:mvn/version "42.7.4"}
+  org.xerial/sqlite-jdbc {:mvn/version "3.46.1.3"}
 
-  com.zaxxer/HikariCP {:mvn/version "5.0.1"}
+  com.zaxxer/HikariCP {:mvn/version "6.0.0"}
 
   io.whitfin/siphash {:mvn/version "2.0.0"}
 
-  buddy/buddy-hashers {:mvn/version "1.8.158"}
-  buddy/buddy-sign {:mvn/version "3.4.333"}
+  buddy/buddy-hashers {:mvn/version "2.0.167"}
+  buddy/buddy-sign {:mvn/version "3.6.1-359"}
 
-  com.github.ben-manes.caffeine/caffeine {:mvn/version "3.1.5"}
+  com.github.ben-manes.caffeine/caffeine {:mvn/version "3.1.8"}
 
-  org.jsoup/jsoup {:mvn/version "1.15.3"}
+  org.jsoup/jsoup {:mvn/version "1.18.1"}
   org.im4java/im4java
   {:git/tag "1.4.0-penpot-2"
    :git/sha "e2b3e16"
@@ -49,14 +52,13 @@
   org.lz4/lz4-java {:mvn/version "1.8.0"}
 
   org.clojars.pntblnk/clj-ldap {:mvn/version "0.0.17"}
-  integrant/integrant {:mvn/version "0.8.0"}
 
   dawran6/emoji {:mvn/version "0.1.5"}
-  markdown-clj/markdown-clj {:mvn/version "1.11.4"}
+  markdown-clj/markdown-clj {:mvn/version "1.12.1"}
 
   ;; Pretty Print specs
   pretty-spec/pretty-spec {:mvn/version "0.1.4"}
-  software.amazon.awssdk/s3 {:mvn/version "2.19.29"}
+  software.amazon.awssdk/s3 {:mvn/version "2.28.26"}
   }
 
  :paths ["src" "resources" "target/classes"]
@@ -64,7 +66,6 @@
  {:dev
   {:extra-deps
    {com.bhauman/rebel-readline {:mvn/version "RELEASE"}
-    org.clojure/tools.namespace {:mvn/version "RELEASE"}
     clojure-humanize/clojure-humanize {:mvn/version "0.2.2"}
     org.clojure/data.csv {:mvn/version "RELEASE"}
     com.clojure-goes-fast/clj-async-profiler {:mvn/version "RELEASE"}
@@ -73,16 +74,13 @@
 
   :build
   {:extra-deps
-   {io.github.clojure/tools.build {:git/tag "v0.9.3" :git/sha "e537cd1"}}
+   {io.github.clojure/tools.build {:git/tag "v0.10.5" :git/sha "2a21b7a"}}
    :ns-default build}
 
   :test
-  {:extra-paths ["test"]
-   :extra-deps
-   {io.github.cognitect-labs/test-runner
-    {:git/tag "v0.5.1" :git/sha "dfb30dd"}}
-   :main-opts ["-m" "cognitect.test-runner"]
-   :exec-fn cognitect.test-runner.api/test}
+  {:main-opts ["-m" "kaocha.runner"]
+   :jvm-opts ["-Dlog4j2.configurationFile=log4j2-devenv-repl.xml"]
+   :extra-deps {lambdaisland/kaocha {:mvn/version "1.91.1392"}}}
 
   :outdated
   {:extra-deps {com.github.liquidz/antq {:mvn/version "RELEASE"}}
@@ -90,8 +88,8 @@
 
   :jmx-remote
   {:jvm-opts ["-Dcom.sun.management.jmxremote"
-              "-Dcom.sun.management.jmxremote.port=9090"
-              "-Dcom.sun.management.jmxremote.rmi.port=9090"
+              "-Dcom.sun.management.jmxremote.port=9091"
+              "-Dcom.sun.management.jmxremote.rmi.port=9091"
               "-Dcom.sun.management.jmxremote.local.only=false"
               "-Dcom.sun.management.jmxremote.authenticate=false"
               "-Dcom.sun.management.jmxremote.ssl=false"

backend/dev/user.clj

@@ -7,7 +7,9 @@
 (ns user
   (:require
    [app.common.data :as d]
+   [app.common.debug :as debug]
    [app.common.exceptions :as ex]
+   [app.common.files.helpers :as cfh]
    [app.common.fressian :as fres]
    [app.common.geom.matrix :as gmt]
    [app.common.logging :as l]
@@ -18,14 +20,16 @@
    [app.common.schema.desc-native :as smdn]
    [app.common.schema.generators :as sg]
    [app.common.spec :as us]
+   [app.common.json :as json]
    [app.common.transit :as t]
+   [app.common.types.file :as ctf]
    [app.common.uuid :as uuid]
-   [app.config :as cfg]
+   [app.config :as cf]
+   [app.db :as db]
    [app.main :as main]
-   [app.srepl.helpers]
+   [app.srepl.helpers :as srepl.helpers]
    [app.srepl.main :as srepl]
    [app.util.blob :as blob]
-   [app.util.json :as json]
    [app.util.time :as dt]
    [clj-async-profiler.core :as prof]
    [clojure.contrib.humanize :as hum]
@@ -40,7 +44,7 @@
    [clojure.walk :refer [macroexpand-all]]
    [criterium.core  :as crit]
    [cuerdas.core :as str]
-   [datoteka.core]
+   [datoteka.fs :as fs]
    [integrant.core :as ig]
    [malli.core :as m]
    [malli.dev.pretty :as mdp]
@@ -48,12 +52,15 @@
    [malli.generator :as mg]
    [malli.registry :as mr]
    [malli.transform :as mt]
-   [malli.util :as mu]))
+   [malli.util :as mu]
+   [promesa.exec :as px]))
 
 (repl/disable-reload! (find-ns 'integrant.core))
+(repl/disable-reload! (find-ns 'app.common.debug))
+
 (set! *warn-on-reflection* true)
 
-(defonce system nil)
+(add-tap #'debug/tap-handler)
 
 ;; --- Benchmarking Tools
 
@@ -92,20 +99,14 @@
 (defn- start
   []
   (try
-    (alter-var-root #'system (fn [sys]
-                               (when sys (ig/halt! sys))
-                               (-> (merge main/system-config main/worker-config)
-                                   (ig/prep)
-                                   (ig/init))))
+    (main/start)
     :started
     (catch Throwable cause
       (ex/print-throwable cause))))
 
 (defn- stop
   []
-  (alter-var-root #'system (fn [sys]
-                             (when sys (ig/halt! sys))
-                             nil))
+  (main/stop)
   :stopped)
 
 (defn restart
@@ -118,62 +119,28 @@
   (stop)
   (repl/refresh-all :after 'user/start))
 
-(defn compression-bench
-  [data]
-  (let [humanize (fn [v] (hum/filesize v :binary true :format " %.4f "))
-        v1 (time (humanize (alength (blob/encode data {:version 1}))))
-        v3 (time (humanize (alength (blob/encode data {:version 3}))))
-        v4 (time (humanize (alength (blob/encode data {:version 4}))))
-        v5 (time (humanize (alength (blob/encode data {:version 5}))))
-        v6 (time (humanize (alength (blob/encode data {:version 6}))))
-        ]
-    (print-table
-     [{
-       :v1 v1
-       :v3 v3
-       :v4 v4
-       :v5 v5
-       :v6 v6
-       }])))
-
-(defonce debug-tap
-  (do
-    (add-tap #(locking debug-tap
-                (prn "tap debug:" %)))
-    1))
-
-
-(sm/def! ::test
-  [:map {:title "Foo"}
-   [:x :int]
-   [:y {:min 0} :double]
-   [:bar
-    [:map {:title "Bar"}
-     [:z :string]
-     [:v ::sm/uuid]]]
-   [:items
-    [:vector ::dt/instant]]])
-
-(sm/def! ::test2
-  [:multi {:title "Foo" :dispatch :type}
-   [:x
-    [:map {:title "FooX"}
-     [:type [:= :x]]
-     [:x :int]]]
-   [:y
-    [:map
-     [:type [:= :x]]
-     [:y [::sm/one-of #{:a :b :c}]]]]
-   [:z
-    [:map {:title "FooZ"}
-     [:z
-      [:multi {:title "Bar" :dispatch :type}
-       [:a
-        [:map
-         [:type [:= :a]]
-         [:a :int]]]
-       [:b
-        [:map
-         [:type [:= :b]]
-         [:b :int]]]]]]]])
+;; (defn compression-bench
+;;   [data]
+;;   (let [humanize (fn [v] (hum/filesize v :binary true :format " %.4f "))
+;;         v1 (time (humanize (alength (blob/encode data {:version 1}))))
+;;         v3 (time (humanize (alength (blob/encode data {:version 3}))))
+;;         v4 (time (humanize (alength (blob/encode data {:version 4}))))
+;;         v5 (time (humanize (alength (blob/encode data {:version 5}))))
+;;         v6 (time (humanize (alength (blob/encode data {:version 6}))))
+;;         ]
+;;     (print-table
+;;      [{
+;;        :v1 v1
+;;        :v3 v3
+;;        :v4 v4
+;;        :v5 v5
+;;        :v6 v6
+;;        }])))
 
+(defn calculate-frames
+  [{:keys [data]}]
+  (->> (vals (:pages-index data))
+       (mapcat (comp vals :objects))
+       (filter cfh/is-direct-child-of-root?)
+       (filter cfh/frame-shape?)
+       (count)))

backend/package.json

@@ -1,18 +1,26 @@
 {
-  "name": "uxbox-back",
-  "version": "0.1.0",
-  "description": "The Open-Source prototyping tool",
-  "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1",
-    "build-emails": "./scripts/build-email-templates.sh"
-  },
+  "name": "backend",
+  "version": "1.0.0",
+  "license": "MPL-2.0",
+  "author": "Kaleidos INC",
+  "private": true,
+  "packageManager": "yarn@4.3.1",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/uxbox/uxbox.git"
+    "url": "https://github.com/penpot/penpot"
+  },
+  "dependencies": {
+    "luxon": "^3.4.4",
+    "sax": "^1.4.1"
   },
-  "author": "Uxbox",
-  "license": "SEE LICENSE IN <LICENSE>",
   "devDependencies": {
-    "mjml": "^4.6.3"
+    "nodemon": "^3.1.2",
+    "source-map-support": "^0.5.21",
+    "ws": "^8.17.0"
+  },
+  "scripts": {
+    "fmt:clj:check": "cljfmt check --parallel=false src/ test/",
+    "fmt:clj": "cljfmt fix --parallel=true src/ test/",
+    "lint:clj": "clj-kondo --parallel --lint src/"
   }
 }

backend/resources/app/email/change-email/en.html

@@ -1,5 +1,6 @@
 <!doctype html>
-<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml"
+  xmlns:o="urn:schemas-microsoft-com:office:office">
 
 <head>
   <title>
@@ -110,15 +111,20 @@
                class="" style="vertical-align:top;width:600px;"
             >
           <![endif]-->
-              <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
                   <tr>
                     <td align="left" style="font-size:0px;padding:16px;word-break:break-word;">
-                      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:collapse;border-spacing:0px;">
                         <tbody>
                           <tr>
                             <td style="width:97px;">
-                              <img height="32" src="{{ public-uri }}/images/email/uxbox-title.png" style="border:0;display:block;outline:none;text-decoration:none;height:32px;width:100%;font-size:13px;" width="97" />
+                              <img height="32" src="{{ public-uri }}/images/email/uxbox-title.png"
+                                style="border:0;display:block;outline:none;text-decoration:none;height:32px;width:100%;font-size:13px;"
+                                width="97" />
                             </td>
                           </tr>
                         </tbody>
@@ -151,7 +157,8 @@
           <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
       <![endif]-->
     <div style="background:#FFFFFF;background-color:#FFFFFF;margin:0px auto;max-width:600px;">
-      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="background:#FFFFFF;background-color:#FFFFFF;width:100%;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+        style="background:#FFFFFF;background-color:#FFFFFF;width:100%;">
         <tbody>
           <tr>
             <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
@@ -164,29 +171,43 @@
                class="" style="vertical-align:top;width:600px;"
             >
           <![endif]-->
-              <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
                   <tr>
                     <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">Hello {{name}}!</div>
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">
+                        Hello {{name|abbreviate:25}}!</div>
                     </td>
                   </tr>
                   <tr>
                     <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">We received a request to change your current email to {{ pending-email }}.</div>
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        We received a request to change your current email to {{ pending-email }}.</div>
                     </td>
                   </tr>
                   <tr>
                     <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">Click to the link below to confirm the change:</div>
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        Click to the link below to confirm the change:</div>
                     </td>
                   </tr>
                   <tr>
-                    <td align="center" vertical-align="middle" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:separate;line-height:100%;">
+                    <td align="center" vertical-align="middle"
+                      style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:separate;line-height:100%;">
                         <tr>
-                          <td align="center" bgcolor="#31EFB8" role="presentation" style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#31EFB8;" valign="middle">
-                            <a href="{{ public-uri }}/#/auth/verify-token?token={{token}}" style="display:inline-block;background:#31EFB8;color:#1F1F1F;font-family:Source Sans Pro, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;" target="_blank"> Confirm email change </a>
+                          <td align="center" bgcolor="#31EFB8" role="presentation"
+                            style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#31EFB8;"
+                            valign="middle">
+                            <a href="{{ public-uri }}/#/auth/verify-token?token={{token}}"
+                              style="display:inline-block;background:#31EFB8;color:#1F1F1F;font-family:Source Sans Pro, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;"
+                              target="_blank"> Confirm email change </a>
                           </td>
                         </tr>
                       </table>
@@ -194,17 +215,24 @@
                   </tr>
                   <tr>
                     <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">If you received this email by mistake, please consider changing your password for security reasons.</div>
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        If you received this email by mistake, please consider changing your password for security
+                        reasons.</div>
                     </td>
                   </tr>
                   <tr>
                     <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">Enjoy!</div>
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        Enjoy!</div>
                     </td>
                   </tr>
                   <tr>
                     <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">The Penpot team.</div>
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        The Penpot team.</div>
                     </td>
                   </tr>
                 </table>
@@ -221,257 +249,9 @@
         </tbody>
       </table>
     </div>
-    <!--[if mso | IE]>
-          </td>
-        </tr>
-      </table>
 
-      <table
-         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
-      >
-        <tr>
-          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
-      <![endif]-->
-    <div style="margin:0px auto;max-width:600px;">
-      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
-        <tbody>
-          <tr>
-            <td style="direction:ltr;font-size:0px;padding:24px 0 0 0;text-align:center;">
-              <!--[if mso | IE]>
-                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+    {% include "app/email/includes/footer.html" %}
 
-        <tr>
-
-            <td
-               class="" style="vertical-align:top;width:425px;"
-            >
-          <![endif]-->
-              <div class="mj-column-px-425 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
-                  <tr>
-                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:14px;line-height:150%;text-align:center;color:#64666A;">Penpot is the first Open Source design and prototyping platform meant for cross-domain teams.</div>
-                    </td>
-                  </tr>
-                </table>
-              </div>
-              <!--[if mso | IE]>
-            </td>
-
-        </tr>
-
-                  </table>
-                <![endif]-->
-            </td>
-          </tr>
-        </tbody>
-      </table>
-    </div>
-    <!--[if mso | IE]>
-          </td>
-        </tr>
-      </table>
-
-      <table
-         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
-      >
-        <tr>
-          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
-      <![endif]-->
-    <div style="margin:0px auto;max-width:600px;">
-      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
-        <tbody>
-          <tr>
-            <td style="direction:ltr;font-size:0px;padding:0;text-align:center;">
-              <!--[if mso | IE]>
-                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
-
-        <tr>
-
-            <td
-               class="" style="vertical-align:top;width:600px;"
-            >
-          <![endif]-->
-              <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
-                  <tr>
-                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <!--[if mso | IE]>
-      <table
-         align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
-      >
-        <tr>
-
-              <td>
-            <![endif]-->
-                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
-                        <tr>
-                          <td style="padding:0 8px;">
-                            <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:24px;">
-                              <tr>
-                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
-                                  <a href="https://penpot.app/" target="_blank">
-                                    <img height="24" src="{{ public-uri }}/images/email/logo-uxbox.png" style="border-radius:3px;display:block;" width="24" />
-                                  </a>
-                                </td>
-                              </tr>
-                            </table>
-                          </td>
-                        </tr>
-                      </table>
-                      <!--[if mso | IE]>
-              </td>
-
-              <td>
-            <![endif]-->
-                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
-                        <tr>
-                          <td style="padding:0 8px;">
-                            <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:24px;">
-                              <tr>
-                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
-                                  <a href="https://twitter.com/penpotapp" target="_blank">
-                                    <img height="24" src="{{ public-uri }}/images/email/logo-twitter.png" style="border-radius:3px;display:block;" width="24" />
-                                  </a>
-                                </td>
-                              </tr>
-                            </table>
-                          </td>
-                        </tr>
-                      </table>
-                      <!--[if mso | IE]>
-              </td>
-
-              <td>
-            <![endif]-->
-                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
-                        <tr>
-                          <td style="padding:0 8px;">
-                            <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:24px;">
-                              <tr>
-                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
-                                  <a href="https://github.com/penpot/" target="_blank">
-                                    <img height="24" src="{{ public-uri }}/images/email/logo-github.png" style="border-radius:3px;display:block;" width="24" />
-                                  </a>
-                                </td>
-                              </tr>
-                            </table>
-                          </td>
-                        </tr>
-                      </table>
-                      <!--[if mso | IE]>
-              </td>
-
-              <td>
-            <![endif]-->
-                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
-                        <tr>
-                          <td style="padding:0 8px;">
-                            <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:24px;">
-                              <tr>
-                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
-                                  <a href="https://www.instagram.com/penpot.app/" target="_blank">
-                                    <img height="24" src="{{ public-uri }}/images/email/logo-instagram.png" style="border-radius:3px;display:block;" width="24" />
-                                  </a>
-                                </td>
-                              </tr>
-                            </table>
-                          </td>
-                        </tr>
-                      </table>
-                      <!--[if mso | IE]>
-              </td>
-
-              <td>
-            <![endif]-->
-                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
-                        <tr>
-                          <td style="padding:0 8px;">
-                            <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:24px;">
-                              <tr>
-                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
-                                  <a href="https://tree.taiga.io/project/penpot" target="_blank">
-                                    <img height="24" src="{{ public-uri }}/images/email/logo-taiga.png" style="border-radius:3px;display:block;" width="24" />
-                                  </a>
-                                </td>
-                              </tr>
-                            </table>
-                          </td>
-                        </tr>
-                      </table>
-                      <!--[if mso | IE]>
-              </td>
-
-          </tr>
-        </table>
-      <![endif]-->
-                    </td>
-                  </tr>
-                </table>
-              </div>
-              <!--[if mso | IE]>
-            </td>
-
-        </tr>
-
-                  </table>
-                <![endif]-->
-            </td>
-          </tr>
-        </tbody>
-      </table>
-    </div>
-    <!--[if mso | IE]>
-          </td>
-        </tr>
-      </table>
-
-      <table
-         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
-      >
-        <tr>
-          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
-      <![endif]-->
-    <div style="margin:0px auto;max-width:600px;">
-      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
-        <tbody>
-          <tr>
-            <td style="direction:ltr;font-size:0px;padding:0 0 24px 0;text-align:center;">
-              <!--[if mso | IE]>
-                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
-
-        <tr>
-
-            <td
-               class="" style="vertical-align:top;width:600px;"
-            >
-          <![endif]-->
-              <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
-                  <tr>
-                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:14px;line-height:150%;text-align:center;color:#64666A;">Penpot | Made with &lt;3 and Open Source</div>
-                    </td>
-                  </tr>
-                </table>
-              </div>
-              <!--[if mso | IE]>
-            </td>
-
-        </tr>
-
-                  </table>
-                <![endif]-->
-            </td>
-          </tr>
-        </tbody>
-      </table>
-    </div>
-    <!--[if mso | IE]>
-          </td>
-        </tr>
-      </table>
-      <![endif]-->
   </div>
 </body>
 

backend/resources/app/email/change-email/en.txt

@@ -1,4 +1,4 @@
-Hello {{name}}!
+Hello {{name|abbreviate:25}}!
 
 We received a request to change your current email to {{ pending-email }}.
 

backend/resources/app/email/feedback/en.html

@@ -11,7 +11,7 @@
       {% if profile %}
         <span>
           <span>Name: </span>
-          <span><code>{{profile.fullname}}</code></span>
+          <span><code>{{profile.fullname|abbreviate:25}}</code></span>
         </span>
         <br />
 
@@ -34,7 +34,7 @@
     </p>
     <p>
       <strong>Subject:</strong><br />
-      <span>{{subject}}</span>
+      <span>{{subject|abbreviate:300}}</span>
     </p>
 
     <p>

backend/resources/app/email/includes/footer.html

@@ -0,0 +1,323 @@
+<!--[if mso | IE]>
+        </td>
+    </tr>
+    </table>
+
+    <table
+        align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+    >
+    <tr>
+        <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+    <![endif]-->
+<div style="margin:0px auto;max-width:600px;">
+    <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+            <tr>
+                <td style="direction:ltr;font-size:0px;padding:24px 0 0 0;text-align:center;">
+                    <!--[if mso | IE]>
+                <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+                class="" style="vertical-align:top;width:425px;"
+            >
+        <![endif]-->
+                    <div class="mj-column-px-425 mj-outlook-group-fix"
+                        style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                        <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                            style="vertical-align:top;" width="100%">
+                            <tr>
+                                <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                                    <div
+                                        style="font-family:Source Sans Pro, sans-serif;font-size:14px;line-height:150%;text-align:center;color:#64666A;">
+                                        Penpot is the first Open Source design and prototyping platform meant for
+                                        cross-domain teams.
+                                    </div>
+                                </td>
+                            </tr>
+                        </table>
+                    </div>
+                    <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                </table>
+                <![endif]-->
+                </td>
+            </tr>
+        </tbody>
+    </table>
+</div>
+<!--[if mso | IE]>
+        </td>
+        </tr>
+    </table>
+
+
+
+    <table
+        align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+    >
+        <tr>
+        <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+    <![endif]-->
+<div style="margin:0px auto;max-width:600px;">
+    <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+            <tr>
+                <td style="direction:ltr;font-size:0px;padding:0;text-align:center;">
+                    <!--[if mso | IE]>
+                <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+                class="" style="vertical-align:top;width:600px;"
+            >
+        <![endif]-->
+                    <div class="mj-column-per-100 mj-outlook-group-fix"
+                        style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                        <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                            style="vertical-align:top;" width="100%">
+                            <tr>
+                                <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                                    <!--[if mso | IE]>
+    <table
+        align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+    >
+        <tr>
+
+            <td>
+            <![endif]-->
+                                    <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                                        style="float:none;display:inline-table;">
+                                        <tr>
+                                            <td style="padding:0 8px;">
+                                                <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                                                    style="border-radius:3px;width:24px;">
+                                                    <tr>
+                                                        <td
+                                                            style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                                            <a href="https://penpot.app/" target="_blank">
+                                                                <img height="24"
+                                                                    src="{{ public-uri }}/images/email/logo-uxbox.png"
+                                                                    style="border-radius:3px;display:block;"
+                                                                    width="24" />
+                                                            </a>
+                                                        </td>
+                                                    </tr>
+                                                </table>
+                                            </td>
+                                        </tr>
+                                    </table>
+                                    <!--[if mso | IE]>
+            </td>
+
+            <td>
+            <![endif]-->
+                                    <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                                        style="float:none;display:inline-table;">
+                                        <tr>
+                                            <td style="padding:0 8px;">
+                                                <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                                                    style="border-radius:3px;width:24px;">
+                                                    <tr>
+                                                        <td
+                                                            style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                                            <a href="https://x.com/penpotapp" target="_blank">
+                                                                <img height="24"
+                                                                    src="{{ public-uri }}/images/email/logo-x.png"
+                                                                    style="border-radius:3px;display:block;"
+                                                                    width="24" />
+                                                            </a>
+                                                        </td>
+                                                    </tr>
+                                                </table>
+                                            </td>
+                                        </tr>
+                                    </table>
+                                    <!--[if mso | IE]>
+            </td>
+
+            <td>
+            <![endif]-->
+                                    <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                                        style="float:none;display:inline-table;">
+                                        <tr>
+                                            <td style="padding:0 8px;">
+                                                <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                                                    style="border-radius:3px;width:24px;">
+                                                    <tr>
+                                                        <td
+                                                            style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                                            <a href="https://github.com/penpot/" target="_blank">
+                                                                <img height="24"
+                                                                    src="{{ public-uri }}/images/email/logo-github.png"
+                                                                    style="border-radius:3px;display:block;"
+                                                                    width="24" />
+                                                            </a>
+                                                        </td>
+                                                    </tr>
+                                                </table>
+                                            </td>
+                                        </tr>
+                                    </table>
+                                    <!--[if mso | IE]>
+            </td>
+
+            <td>
+            <![endif]-->
+                                    <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                                        style="float:none;display:inline-table;">
+                                        <tr>
+                                            <td style="padding:0 8px;">
+                                                <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                                                    style="border-radius:3px;width:24px;">
+                                                    <tr>
+                                                        <td
+                                                            style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                                            <a href="https://www.linkedin.com/company/penpotdesign/"
+                                                                target="_blank">
+                                                                <img height="24"
+                                                                    src="{{ public-uri }}/images/email/logo-linkedin.png"
+                                                                    style="border-radius:3px;display:block;"
+                                                                    width="24" />
+                                                            </a>
+                                                        </td>
+                                                    </tr>
+                                                </table>
+                                            </td>
+                                        </tr>
+                                    </table>
+                                    <!--[if mso | IE]>
+            </td>
+
+            <td>
+            <![endif]-->
+                                    <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                                        style="float:none;display:inline-table;">
+                                        <tr>
+                                            <td style="padding:0 8px;">
+                                                <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                                                    style="border-radius:3px;width:24px;">
+                                                    <tr>
+                                                        <td
+                                                            style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                                            <a href="https://fosstodon.org/@penpot/" target="_blank">
+                                                                <img height="24"
+                                                                    src="{{ public-uri }}/images/email/logo-mastodon.png"
+                                                                    style="border-radius:3px;display:block;"
+                                                                    width="24" />
+                                                            </a>
+                                                        </td>
+                                                    </tr>
+                                                </table>
+                                            </td>
+                                        </tr>
+                                    </table>
+                                    <!--[if mso | IE]>
+            </td>
+
+            <td>
+            <![endif]-->
+                                    <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+                                        style="float:none;display:inline-table;">
+                                        <tr>
+                                            <td style="padding:0 8px;">
+                                                <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                                                    style="border-radius:3px;width:24px;">
+                                                    <tr>
+                                                        <td
+                                                            style="font-size:0;height:24px;vertical-align:middle;width:24px;">
+                                                            <a href="https://tree.taiga.io/project/penpot"
+                                                                target="_blank">
+                                                                <img height="24"
+                                                                    src="{{ public-uri }}/images/email/logo-taiga.png"
+                                                                    style="border-radius:3px;display:block;"
+                                                                    width="24" />
+                                                            </a>
+                                                        </td>
+                                                    </tr>
+                                                </table>
+                                            </td>
+                                        </tr>
+                                    </table>
+                                    <!--[if mso | IE]>
+            </td>
+
+        </tr>
+        </table>
+    <![endif]-->
+                                </td>
+                            </tr>
+                        </table>
+                    </div>
+                    <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                </table>
+                <![endif]-->
+                </td>
+            </tr>
+        </tbody>
+    </table>
+</div>
+<!--[if mso | IE]>
+        </td>
+        </tr>
+    </table>
+
+    <table
+        align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+    >
+        <tr>
+        <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+    <![endif]-->
+<div style="margin:0px auto;max-width:600px;">
+    <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+            <tr>
+                <td style="direction:ltr;font-size:0px;padding:0 0 24px 0;text-align:center;">
+                    <!--[if mso | IE]>
+                <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+                class="" style="vertical-align:top;width:600px;"
+            >
+        <![endif]-->
+                    <div class="mj-column-per-100 mj-outlook-group-fix"
+                        style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                        <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                            style="vertical-align:top;" width="100%">
+                            <tr>
+                                <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                                    <div
+                                        style="font-family:Source Sans Pro, sans-serif;font-size:14px;line-height:150%;text-align:center;color:#64666A;">
+                                        Penpot | Made with &lt;3 and Open Source</div>
+                                </td>
+                            </tr>
+                        </table>
+                    </div>
+                    <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                </table>
+                <![endif]-->
+                </td>
+            </tr>
+        </tbody>
+    </table>
+</div>
+<!--[if mso | IE]>
+        </td>
+        </tr>
+    </table>
+    <![endif]-->

backend/resources/app/email/invite-to-team/en.html

@@ -1,5 +1,6 @@
 <!doctype html>
-<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml"
+  xmlns:o="urn:schemas-microsoft-com:office:office">
 
 <head>
   <title>
@@ -110,15 +111,20 @@
                class="" style="vertical-align:top;width:600px;"
             >
           <![endif]-->
-              <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
                   <tr>
                     <td align="left" style="font-size:0px;padding:16px;word-break:break-word;">
-                      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:collapse;border-spacing:0px;">
                         <tbody>
                           <tr>
                             <td style="width:97px;">
-                              <img height="32" src="{{ public-uri }}/images/email/uxbox-title.png" style="border:0;display:block;outline:none;text-decoration:none;height:32px;width:100%;font-size:13px;" width="97" />
+                              <img height="32" src="{{ public-uri }}/images/email/uxbox-title.png"
+                                style="border:0;display:block;outline:none;text-decoration:none;height:32px;width:100%;font-size:13px;"
+                                width="97" />
                             </td>
                           </tr>
                         </tbody>
@@ -151,7 +157,8 @@
           <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
       <![endif]-->
     <div style="background:#FFFFFF;background-color:#FFFFFF;margin:0px auto;max-width:600px;">
-      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="background:#FFFFFF;background-color:#FFFFFF;width:100%;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+        style="background:#FFFFFF;background-color:#FFFFFF;width:100%;">
         <tbody>
           <tr>
             <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
@@ -164,24 +171,36 @@
                class="" style="vertical-align:top;width:600px;"
             >
           <![endif]-->
-              <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
                   <tr>
                     <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">Hello!</div>
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">
+                        Hello!</div>
                     </td>
                   </tr>
                   <tr>
                     <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">{{invited-by}} has invited you to join the team “{{ team }}”.</div>
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        {{invited-by|abbreviate:25}} has invited you to join the team “{{ team|abbreviate:25 }}”.</div>
                     </td>
                   </tr>
                   <tr>
-                    <td align="center" vertical-align="middle" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:separate;line-height:100%;">
+                    <td align="center" vertical-align="middle"
+                      style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:separate;line-height:100%;">
                         <tr>
-                          <td align="center" bgcolor="#31EFB8" role="presentation" style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#31EFB8;" valign="middle">
-                            <a href="{{ public-uri }}/#/auth/verify-token?token={{token}}" style="display:inline-block;background:#31EFB8;color:#1F1F1F;font-family:Source Sans Pro, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;" target="_blank"> Accept invite </a>
+                          <td align="center" bgcolor="#31EFB8" role="presentation"
+                            style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#31EFB8;"
+                            valign="middle">
+                            <a href="{{ public-uri }}/#/auth/verify-token?token={{token}}"
+                              style="display:inline-block;background:#31EFB8;color:#1F1F1F;font-family:Source Sans Pro, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;"
+                              target="_blank"> Accept invite </a>
                           </td>
                         </tr>
                       </table>
@@ -189,12 +208,16 @@
                   </tr>
                   <tr>
                     <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">Enjoy!</div>
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        Enjoy!</div>
                     </td>
                   </tr>
                   <tr>
                     <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">The Penpot team.</div>
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        The Penpot team.</div>
                     </td>
                   </tr>
                 </table>
@@ -211,257 +234,9 @@
         </tbody>
       </table>
     </div>
-    <!--[if mso | IE]>
-          </td>
-        </tr>
-      </table>
 
-      <table
-         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
-      >
-        <tr>
-          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
-      <![endif]-->
-    <div style="margin:0px auto;max-width:600px;">
-      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
-        <tbody>
-          <tr>
-            <td style="direction:ltr;font-size:0px;padding:24px 0 0 0;text-align:center;">
-              <!--[if mso | IE]>
-                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+    {% include "app/email/includes/footer.html" %}
 
-        <tr>
-
-            <td
-               class="" style="vertical-align:top;width:425px;"
-            >
-          <![endif]-->
-              <div class="mj-column-px-425 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
-                  <tr>
-                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:14px;line-height:150%;text-align:center;color:#64666A;">Penpot is the first Open Source design and prototyping platform meant for cross-domain teams.</div>
-                    </td>
-                  </tr>
-                </table>
-              </div>
-              <!--[if mso | IE]>
-            </td>
-
-        </tr>
-
-                  </table>
-                <![endif]-->
-            </td>
-          </tr>
-        </tbody>
-      </table>
-    </div>
-    <!--[if mso | IE]>
-          </td>
-        </tr>
-      </table>
-
-      <table
-         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
-      >
-        <tr>
-          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
-      <![endif]-->
-    <div style="margin:0px auto;max-width:600px;">
-      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
-        <tbody>
-          <tr>
-            <td style="direction:ltr;font-size:0px;padding:0;text-align:center;">
-              <!--[if mso | IE]>
-                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
-
-        <tr>
-
-            <td
-               class="" style="vertical-align:top;width:600px;"
-            >
-          <![endif]-->
-              <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
-                  <tr>
-                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <!--[if mso | IE]>
-      <table
-         align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
-      >
-        <tr>
-
-              <td>
-            <![endif]-->
-                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
-                        <tr>
-                          <td style="padding:0 8px;">
-                            <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:24px;">
-                              <tr>
-                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
-                                  <a href="https://penpot.app/" target="_blank">
-                                    <img height="24" src="{{ public-uri }}/images/email/logo-uxbox.png" style="border-radius:3px;display:block;" width="24" />
-                                  </a>
-                                </td>
-                              </tr>
-                            </table>
-                          </td>
-                        </tr>
-                      </table>
-                      <!--[if mso | IE]>
-              </td>
-
-              <td>
-            <![endif]-->
-                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
-                        <tr>
-                          <td style="padding:0 8px;">
-                            <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:24px;">
-                              <tr>
-                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
-                                  <a href="https://twitter.com/penpotapp" target="_blank">
-                                    <img height="24" src="{{ public-uri }}/images/email/logo-twitter.png" style="border-radius:3px;display:block;" width="24" />
-                                  </a>
-                                </td>
-                              </tr>
-                            </table>
-                          </td>
-                        </tr>
-                      </table>
-                      <!--[if mso | IE]>
-              </td>
-
-              <td>
-            <![endif]-->
-                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
-                        <tr>
-                          <td style="padding:0 8px;">
-                            <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:24px;">
-                              <tr>
-                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
-                                  <a href="https://github.com/penpot/" target="_blank">
-                                    <img height="24" src="{{ public-uri }}/images/email/logo-github.png" style="border-radius:3px;display:block;" width="24" />
-                                  </a>
-                                </td>
-                              </tr>
-                            </table>
-                          </td>
-                        </tr>
-                      </table>
-                      <!--[if mso | IE]>
-              </td>
-
-              <td>
-            <![endif]-->
-                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
-                        <tr>
-                          <td style="padding:0 8px;">
-                            <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:24px;">
-                              <tr>
-                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
-                                  <a href="https://www.instagram.com/penpot.app/" target="_blank">
-                                    <img height="24" src="{{ public-uri }}/images/email/logo-instagram.png" style="border-radius:3px;display:block;" width="24" />
-                                  </a>
-                                </td>
-                              </tr>
-                            </table>
-                          </td>
-                        </tr>
-                      </table>
-                      <!--[if mso | IE]>
-              </td>
-
-              <td>
-            <![endif]-->
-                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
-                        <tr>
-                          <td style="padding:0 8px;">
-                            <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:24px;">
-                              <tr>
-                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
-                                  <a href="https://tree.taiga.io/project/penpot" target="_blank">
-                                    <img height="24" src="{{ public-uri }}/images/email/logo-taiga.png" style="border-radius:3px;display:block;" width="24" />
-                                  </a>
-                                </td>
-                              </tr>
-                            </table>
-                          </td>
-                        </tr>
-                      </table>
-                      <!--[if mso | IE]>
-              </td>
-
-          </tr>
-        </table>
-      <![endif]-->
-                    </td>
-                  </tr>
-                </table>
-              </div>
-              <!--[if mso | IE]>
-            </td>
-
-        </tr>
-
-                  </table>
-                <![endif]-->
-            </td>
-          </tr>
-        </tbody>
-      </table>
-    </div>
-    <!--[if mso | IE]>
-          </td>
-        </tr>
-      </table>
-
-      <table
-         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
-      >
-        <tr>
-          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
-      <![endif]-->
-    <div style="margin:0px auto;max-width:600px;">
-      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
-        <tbody>
-          <tr>
-            <td style="direction:ltr;font-size:0px;padding:0 0 24px 0;text-align:center;">
-              <!--[if mso | IE]>
-                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
-
-        <tr>
-
-            <td
-               class="" style="vertical-align:top;width:600px;"
-            >
-          <![endif]-->
-              <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
-                  <tr>
-                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:14px;line-height:150%;text-align:center;color:#64666A;">Penpot | Made with &lt;3 and Open Source</div>
-                    </td>
-                  </tr>
-                </table>
-              </div>
-              <!--[if mso | IE]>
-            </td>
-
-        </tr>
-
-                  </table>
-                <![endif]-->
-            </td>
-          </tr>
-        </tbody>
-      </table>
-    </div>
-    <!--[if mso | IE]>
-          </td>
-        </tr>
-      </table>
-      <![endif]-->
   </div>
 </body>
 

backend/resources/app/email/invite-to-team/en.txt

@@ -1,6 +1,6 @@
 Hello!
 
-{{invited-by}} has invited you to join the team “{{ team }}”.
+{{invited-by|abbreviate:25}} has invited you to join the team “{{ team|abbreviate:25 }}”.
 
 Accept invitation using this link:
 

backend/resources/app/email/join-team/en.html

@@ -0,0 +1,244 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml"
+  xmlns:o="urn:schemas-microsoft-com:office:office">
+
+<head>
+  <title>
+  </title>
+  <!--[if !mso]><!-- -->
+  <meta http-equiv="X-UA-Compatible" content="IE=edge">
+  <!--<![endif]-->
+  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <style type="text/css">
+    #outlook a {
+      padding: 0;
+    }
+
+    body {
+      margin: 0;
+      padding: 0;
+      -webkit-text-size-adjust: 100%;
+      -ms-text-size-adjust: 100%;
+    }
+
+    table,
+    td {
+      border-collapse: collapse;
+      mso-table-lspace: 0pt;
+      mso-table-rspace: 0pt;
+    }
+
+    img {
+      border: 0;
+      height: auto;
+      line-height: 100%;
+      outline: none;
+      text-decoration: none;
+      -ms-interpolation-mode: bicubic;
+    }
+
+    p {
+      display: block;
+      margin: 13px 0;
+    }
+  </style>
+  <!--[if mso]>
+        <xml>
+        <o:OfficeDocumentSettings>
+          <o:AllowPNG/>
+          <o:PixelsPerInch>96</o:PixelsPerInch>
+        </o:OfficeDocumentSettings>
+        </xml>
+        <![endif]-->
+  <!--[if lte mso 11]>
+        <style type="text/css">
+          .mj-outlook-group-fix { width:100% !important; }
+        </style>
+        <![endif]-->
+  <!--[if !mso]><!-->
+  <link href="https://fonts.googleapis.com/css?family=Source%20Sans%20Pro" rel="stylesheet" type="text/css">
+  <style type="text/css">
+    @import url(https://fonts.googleapis.com/css?family=Source%20Sans%20Pro);
+  </style>
+  <!--<![endif]-->
+  <style type="text/css">
+    @media only screen and (min-width:480px) {
+      .mj-column-per-100 {
+        width: 100% !important;
+        max-width: 100%;
+      }
+
+      .mj-column-px-425 {
+        width: 425px !important;
+        max-width: 425px;
+      }
+    }
+  </style>
+  <style type="text/css">
+    @media only screen and (max-width:480px) {
+      table.mj-full-width-mobile {
+        width: 100% !important;
+      }
+
+      td.mj-full-width-mobile {
+        width: auto !important;
+      }
+    }
+  </style>
+</head>
+
+<body style="background-color:#E5E5E5;">
+  <div style="background-color:#E5E5E5;">
+    <!--[if mso | IE]>
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:16px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:collapse;border-spacing:0px;">
+                        <tbody>
+                          <tr>
+                            <td style="width:97px;">
+                              <img height="32" src="{{ public-uri }}/images/email/uxbox-title.png"
+                                style="border:0;display:block;outline:none;text-decoration:none;height:32px;width:100%;font-size:13px;"
+                                width="97" />
+                            </td>
+                          </tr>
+                        </tbody>
+                      </table>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="background:#FFFFFF;background-color:#FFFFFF;margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+        style="background:#FFFFFF;background-color:#FFFFFF;width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">
+                        Hello!</div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        As you requested, {{invited-by|abbreviate:25}} has added you to the team “{{
+                        team|abbreviate:25}}”.</div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="center" vertical-align="middle"
+                      style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:separate;line-height:100%;">
+                        <tr>
+                          <td align="center" bgcolor="#31EFB8" role="presentation"
+                            style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#31EFB8;"
+                            valign="middle">
+                            <a href="{{ public-uri }}/#/dashboard/team/{{team-id}}/projects"
+                              style="display:inline-block;background:#31EFB8;color:#1F1F1F;font-family:Source Sans Pro, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;"
+                              target="_blank"> Go to the Team </a>
+                          </td>
+                        </tr>
+                      </table>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        Enjoy!</div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        The Penpot team.</div>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+
+    {% include "app/email/includes/footer.html" %}
+
+  </div>
+</body>
+
+</html>

backend/resources/app/email/join-team/en.subj

@@ -0,0 +1 @@
+You have joined {{team}}

backend/resources/app/email/join-team/en.txt

@@ -0,0 +1,10 @@
+Hello!
+
+As you requested, {{invited-by|abbreviate:25}} has added you to the team “{{ team|abbreviate:25}}”.
+
+Go to the team with this link:
+
+{{ public-uri }}/#/dashboard/team/{{team-id}}
+
+Enjoy!
+The Penpot team.

backend/resources/app/email/password-recovery/en.html

@@ -1,5 +1,6 @@
 <!doctype html>
-<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml"
+  xmlns:o="urn:schemas-microsoft-com:office:office">
 
 <head>
   <title>
@@ -110,15 +111,20 @@
                class="" style="vertical-align:top;width:600px;"
             >
           <![endif]-->
-              <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
                   <tr>
                     <td align="left" style="font-size:0px;padding:16px;word-break:break-word;">
-                      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:collapse;border-spacing:0px;">
                         <tbody>
                           <tr>
                             <td style="width:97px;">
-                              <img height="32" src="{{ public-uri }}/images/email/uxbox-title.png" style="border:0;display:block;outline:none;text-decoration:none;height:32px;width:100%;font-size:13px;" width="97" />
+                              <img height="32" src="{{ public-uri }}/images/email/uxbox-title.png"
+                                style="border:0;display:block;outline:none;text-decoration:none;height:32px;width:100%;font-size:13px;"
+                                width="97" />
                             </td>
                           </tr>
                         </tbody>
@@ -151,7 +157,8 @@
           <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
       <![endif]-->
     <div style="background:#FFFFFF;background-color:#FFFFFF;margin:0px auto;max-width:600px;">
-      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="background:#FFFFFF;background-color:#FFFFFF;width:100%;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+        style="background:#FFFFFF;background-color:#FFFFFF;width:100%;">
         <tbody>
           <tr>
             <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
@@ -164,24 +171,37 @@
                class="" style="vertical-align:top;width:600px;"
             >
           <![endif]-->
-              <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
                   <tr>
                     <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">Hello {{name}}!</div>
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">
+                        Hello {{name|abbreviate:25}}!</div>
                     </td>
                   </tr>
                   <tr>
                     <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">We have received a request to reset your password. Click the link below to choose a new one:</div>
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        We have received a request to reset your password. Click the link below to choose a new one:
+                      </div>
                     </td>
                   </tr>
                   <tr>
-                    <td align="center" vertical-align="middle" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:separate;line-height:100%;">
+                    <td align="center" vertical-align="middle"
+                      style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:separate;line-height:100%;">
                         <tr>
-                          <td align="center" bgcolor="#31EFB8" role="presentation" style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#31EFB8;" valign="middle">
-                            <a href="{{ public-uri }}/#/auth/recovery?token={{token}}" style="display:inline-block;background:#31EFB8;color:#1F1F1F;font-family:Source Sans Pro, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;" target="_blank"> Reset password </a>
+                          <td align="center" bgcolor="#31EFB8" role="presentation"
+                            style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#31EFB8;"
+                            valign="middle">
+                            <a href="{{ public-uri }}/#/auth/recovery?token={{token}}"
+                              style="display:inline-block;background:#31EFB8;color:#1F1F1F;font-family:Source Sans Pro, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;"
+                              target="_blank"> Reset password </a>
                           </td>
                         </tr>
                       </table>
@@ -189,17 +209,24 @@
                   </tr>
                   <tr>
                     <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">If you received this email by mistake, you can safely ignore it. Your password won't be changed.</div>
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        If you received this email by mistake, you can safely ignore it. Your password won't be changed.
+                      </div>
                     </td>
                   </tr>
                   <tr>
                     <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">Enjoy!</div>
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        Enjoy!</div>
                     </td>
                   </tr>
                   <tr>
                     <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">The Penpot team.</div>
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        The Penpot team.</div>
                     </td>
                   </tr>
                 </table>
@@ -216,257 +243,9 @@
         </tbody>
       </table>
     </div>
-    <!--[if mso | IE]>
-          </td>
-        </tr>
-      </table>
 
-      <table
-         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
-      >
-        <tr>
-          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
-      <![endif]-->
-    <div style="margin:0px auto;max-width:600px;">
-      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
-        <tbody>
-          <tr>
-            <td style="direction:ltr;font-size:0px;padding:24px 0 0 0;text-align:center;">
-              <!--[if mso | IE]>
-                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+    {% include "app/email/includes/footer.html" %}
 
-        <tr>
-
-            <td
-               class="" style="vertical-align:top;width:425px;"
-            >
-          <![endif]-->
-              <div class="mj-column-px-425 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
-                  <tr>
-                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:14px;line-height:150%;text-align:center;color:#64666A;">Penpot is the first Open Source design and prototyping platform meant for cross-domain teams.</div>
-                    </td>
-                  </tr>
-                </table>
-              </div>
-              <!--[if mso | IE]>
-            </td>
-
-        </tr>
-
-                  </table>
-                <![endif]-->
-            </td>
-          </tr>
-        </tbody>
-      </table>
-    </div>
-    <!--[if mso | IE]>
-          </td>
-        </tr>
-      </table>
-
-      <table
-         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
-      >
-        <tr>
-          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
-      <![endif]-->
-    <div style="margin:0px auto;max-width:600px;">
-      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
-        <tbody>
-          <tr>
-            <td style="direction:ltr;font-size:0px;padding:0;text-align:center;">
-              <!--[if mso | IE]>
-                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
-
-        <tr>
-
-            <td
-               class="" style="vertical-align:top;width:600px;"
-            >
-          <![endif]-->
-              <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
-                  <tr>
-                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <!--[if mso | IE]>
-      <table
-         align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
-      >
-        <tr>
-
-              <td>
-            <![endif]-->
-                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
-                        <tr>
-                          <td style="padding:0 8px;">
-                            <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:24px;">
-                              <tr>
-                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
-                                  <a href="https://penpot.app/" target="_blank">
-                                    <img height="24" src="{{ public-uri }}/images/email/logo-uxbox.png" style="border-radius:3px;display:block;" width="24" />
-                                  </a>
-                                </td>
-                              </tr>
-                            </table>
-                          </td>
-                        </tr>
-                      </table>
-                      <!--[if mso | IE]>
-              </td>
-
-              <td>
-            <![endif]-->
-                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
-                        <tr>
-                          <td style="padding:0 8px;">
-                            <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:24px;">
-                              <tr>
-                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
-                                  <a href="https://twitter.com/penpotapp" target="_blank">
-                                    <img height="24" src="{{ public-uri }}/images/email/logo-twitter.png" style="border-radius:3px;display:block;" width="24" />
-                                  </a>
-                                </td>
-                              </tr>
-                            </table>
-                          </td>
-                        </tr>
-                      </table>
-                      <!--[if mso | IE]>
-              </td>
-
-              <td>
-            <![endif]-->
-                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
-                        <tr>
-                          <td style="padding:0 8px;">
-                            <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:24px;">
-                              <tr>
-                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
-                                  <a href="https://github.com/penpot/" target="_blank">
-                                    <img height="24" src="{{ public-uri }}/images/email/logo-github.png" style="border-radius:3px;display:block;" width="24" />
-                                  </a>
-                                </td>
-                              </tr>
-                            </table>
-                          </td>
-                        </tr>
-                      </table>
-                      <!--[if mso | IE]>
-              </td>
-
-              <td>
-            <![endif]-->
-                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
-                        <tr>
-                          <td style="padding:0 8px;">
-                            <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:24px;">
-                              <tr>
-                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
-                                  <a href="https://www.instagram.com/penpot.app/" target="_blank">
-                                    <img height="24" src="{{ public-uri }}/images/email/logo-instagram.png" style="border-radius:3px;display:block;" width="24" />
-                                  </a>
-                                </td>
-                              </tr>
-                            </table>
-                          </td>
-                        </tr>
-                      </table>
-                      <!--[if mso | IE]>
-              </td>
-
-              <td>
-            <![endif]-->
-                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
-                        <tr>
-                          <td style="padding:0 8px;">
-                            <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:24px;">
-                              <tr>
-                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
-                                  <a href="https://tree.taiga.io/project/penpot" target="_blank">
-                                    <img height="24" src="{{ public-uri }}/images/email/logo-taiga.png" style="border-radius:3px;display:block;" width="24" />
-                                  </a>
-                                </td>
-                              </tr>
-                            </table>
-                          </td>
-                        </tr>
-                      </table>
-                      <!--[if mso | IE]>
-              </td>
-
-          </tr>
-        </table>
-      <![endif]-->
-                    </td>
-                  </tr>
-                </table>
-              </div>
-              <!--[if mso | IE]>
-            </td>
-
-        </tr>
-
-                  </table>
-                <![endif]-->
-            </td>
-          </tr>
-        </tbody>
-      </table>
-    </div>
-    <!--[if mso | IE]>
-          </td>
-        </tr>
-      </table>
-
-      <table
-         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
-      >
-        <tr>
-          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
-      <![endif]-->
-    <div style="margin:0px auto;max-width:600px;">
-      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
-        <tbody>
-          <tr>
-            <td style="direction:ltr;font-size:0px;padding:0 0 24px 0;text-align:center;">
-              <!--[if mso | IE]>
-                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
-
-        <tr>
-
-            <td
-               class="" style="vertical-align:top;width:600px;"
-            >
-          <![endif]-->
-              <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
-                  <tr>
-                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:14px;line-height:150%;text-align:center;color:#64666A;">Penpot | Made with &lt;3 and Open Source</div>
-                    </td>
-                  </tr>
-                </table>
-              </div>
-              <!--[if mso | IE]>
-            </td>
-
-        </tr>
-
-                  </table>
-                <![endif]-->
-            </td>
-          </tr>
-        </tbody>
-      </table>
-    </div>
-    <!--[if mso | IE]>
-          </td>
-        </tr>
-      </table>
-      <![endif]-->
   </div>
 </body>
 

backend/resources/app/email/password-recovery/en.txt

@@ -1,4 +1,4 @@
-Hello {{name}}!
+Hello {{name|abbreviate:25}}!
 
 We received a request to reset your password. Click the link below to choose a
 new one:

backend/resources/app/email/register/en.html

@@ -1,5 +1,6 @@
 <!doctype html>
-<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml"
+  xmlns:o="urn:schemas-microsoft-com:office:office">
 
 <head>
   <title>
@@ -110,15 +111,20 @@
                class="" style="vertical-align:top;width:600px;"
             >
           <![endif]-->
-              <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
                   <tr>
                     <td align="left" style="font-size:0px;padding:16px;word-break:break-word;">
-                      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:collapse;border-spacing:0px;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:collapse;border-spacing:0px;">
                         <tbody>
                           <tr>
                             <td style="width:97px;">
-                              <img height="32" src="{{ public-uri }}/images/email/uxbox-title.png" style="border:0;display:block;outline:none;text-decoration:none;height:32px;width:100%;font-size:13px;" width="97" />
+                              <img height="32" src="{{ public-uri }}/images/email/uxbox-title.png"
+                                style="border:0;display:block;outline:none;text-decoration:none;height:32px;width:100%;font-size:13px;"
+                                width="97" />
                             </td>
                           </tr>
                         </tbody>
@@ -151,7 +157,8 @@
           <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
       <![endif]-->
     <div style="background:#FFFFFF;background-color:#FFFFFF;margin:0px auto;max-width:600px;">
-      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="background:#FFFFFF;background-color:#FFFFFF;width:100%;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+        style="background:#FFFFFF;background-color:#FFFFFF;width:100%;">
         <tbody>
           <tr>
             <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
@@ -164,24 +171,37 @@
                class="" style="vertical-align:top;width:600px;"
             >
           <![endif]-->
-              <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
                   <tr>
                     <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">Hello {{name}}!</div>
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">
+                        Hello {{name|abbreviate:25}}!</div>
                     </td>
                   </tr>
                   <tr>
                     <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">Thanks for signing up for your Penpot account! Please verify your email using the link below and get started building mockups and prototypes today!</div>
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        Thanks for signing up for your Penpot account! Please verify your email using the link below and
+                        get started building mockups and prototypes today!</div>
                     </td>
                   </tr>
                   <tr>
-                    <td align="center" vertical-align="middle" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:separate;line-height:100%;">
+                    <td align="center" vertical-align="middle"
+                      style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:separate;line-height:100%;">
                         <tr>
-                          <td align="center" bgcolor="#31EFB8" role="presentation" style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#31EFB8;" valign="middle">
-                            <a href="{{ public-uri }}/#/auth/verify-token?token={{token}}" style="display:inline-block;background:#31EFB8;color:#1F1F1F;font-family:Source Sans Pro, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;" target="_blank"> Verify email </a>
+                          <td align="center" bgcolor="#31EFB8" role="presentation"
+                            style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#31EFB8;"
+                            valign="middle">
+                            <a href="{{ public-uri }}/#/auth/verify-token?token={{token}}"
+                              style="display:inline-block;background:#31EFB8;color:#1F1F1F;font-family:Source Sans Pro, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;"
+                              target="_blank"> Verify email </a>
                           </td>
                         </tr>
                       </table>
@@ -189,12 +209,16 @@
                   </tr>
                   <tr>
                     <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">Enjoy!</div>
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        Enjoy!</div>
                     </td>
                   </tr>
                   <tr>
                     <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">The Penpot team.</div>
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        The Penpot team.</div>
                     </td>
                   </tr>
                 </table>
@@ -211,258 +235,10 @@
         </tbody>
       </table>
     </div>
-    <!--[if mso | IE]>
-          </td>
-        </tr>
-      </table>
 
-      <table
-         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
-      >
-        <tr>
-          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
-      <![endif]-->
-    <div style="margin:0px auto;max-width:600px;">
-      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
-        <tbody>
-          <tr>
-            <td style="direction:ltr;font-size:0px;padding:24px 0 0 0;text-align:center;">
-              <!--[if mso | IE]>
-                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+    {% include "app/email/includes/footer.html" %}
 
-        <tr>
-
-            <td
-               class="" style="vertical-align:top;width:425px;"
-            >
-          <![endif]-->
-              <div class="mj-column-px-425 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
-                  <tr>
-                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:14px;line-height:150%;text-align:center;color:#64666A;">Penpot is the first Open Source design and prototyping platform meant for cross-domain teams.</div>
-                    </td>
-                  </tr>
-                </table>
-              </div>
-              <!--[if mso | IE]>
-            </td>
-
-        </tr>
-
-                  </table>
-                <![endif]-->
-            </td>
-          </tr>
-        </tbody>
-      </table>
-    </div>
-    <!--[if mso | IE]>
-          </td>
-        </tr>
-      </table>
-
-      <table
-         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
-      >
-        <tr>
-          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
-      <![endif]-->
-    <div style="margin:0px auto;max-width:600px;">
-      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
-        <tbody>
-          <tr>
-            <td style="direction:ltr;font-size:0px;padding:0;text-align:center;">
-              <!--[if mso | IE]>
-                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
-
-        <tr>
-
-            <td
-               class="" style="vertical-align:top;width:600px;"
-            >
-          <![endif]-->
-              <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
-                  <tr>
-                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <!--[if mso | IE]>
-      <table
-         align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
-      >
-        <tr>
-
-              <td>
-            <![endif]-->
-                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
-                        <tr>
-                          <td style="padding:0 8px;">
-                            <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:24px;">
-                              <tr>
-                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
-                                  <a href="https://penpot.app/" target="_blank">
-                                    <img height="24" src="{{ public-uri }}/images/email/logo-uxbox.png" style="border-radius:3px;display:block;" width="24" />
-                                  </a>
-                                </td>
-                              </tr>
-                            </table>
-                          </td>
-                        </tr>
-                      </table>
-                      <!--[if mso | IE]>
-              </td>
-
-              <td>
-            <![endif]-->
-                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
-                        <tr>
-                          <td style="padding:0 8px;">
-                            <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:24px;">
-                              <tr>
-                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
-                                  <a href="https://twitter.com/penpotapp" target="_blank">
-                                    <img height="24" src="{{ public-uri }}/images/email/logo-twitter.png" style="border-radius:3px;display:block;" width="24" />
-                                  </a>
-                                </td>
-                              </tr>
-                            </table>
-                          </td>
-                        </tr>
-                      </table>
-                      <!--[if mso | IE]>
-              </td>
-
-              <td>
-            <![endif]-->
-                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
-                        <tr>
-                          <td style="padding:0 8px;">
-                            <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:24px;">
-                              <tr>
-                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
-                                  <a href="https://github.com/penpot/" target="_blank">
-                                    <img height="24" src="{{ public-uri }}/images/email/logo-github.png" style="border-radius:3px;display:block;" width="24" />
-                                  </a>
-                                </td>
-                              </tr>
-                            </table>
-                          </td>
-                        </tr>
-                      </table>
-                      <!--[if mso | IE]>
-              </td>
-
-              <td>
-            <![endif]-->
-                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
-                        <tr>
-                          <td style="padding:0 8px;">
-                            <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:24px;">
-                              <tr>
-                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
-                                  <a href="https://www.instagram.com/penpot.app/" target="_blank">
-                                    <img height="24" src="{{ public-uri }}/images/email/logo-instagram.png" style="border-radius:3px;display:block;" width="24" />
-                                  </a>
-                                </td>
-                              </tr>
-                            </table>
-                          </td>
-                        </tr>
-                      </table>
-                      <!--[if mso | IE]>
-              </td>
-
-              <td>
-            <![endif]-->
-                      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="float:none;display:inline-table;">
-                        <tr>
-                          <td style="padding:0 8px;">
-                            <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-radius:3px;width:24px;">
-                              <tr>
-                                <td style="font-size:0;height:24px;vertical-align:middle;width:24px;">
-                                  <a href="https://tree.taiga.io/project/penpot" target="_blank">
-                                    <img height="24" src="{{ public-uri }}/images/email/logo-taiga.png" style="border-radius:3px;display:block;" width="24" />
-                                  </a>
-                                </td>
-                              </tr>
-                            </table>
-                          </td>
-                        </tr>
-                      </table>
-                      <!--[if mso | IE]>
-              </td>
-
-          </tr>
-        </table>
-      <![endif]-->
-                    </td>
-                  </tr>
-                </table>
-              </div>
-              <!--[if mso | IE]>
-            </td>
-
-        </tr>
-
-                  </table>
-                <![endif]-->
-            </td>
-          </tr>
-        </tbody>
-      </table>
-    </div>
-    <!--[if mso | IE]>
-          </td>
-        </tr>
-      </table>
-
-      <table
-         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
-      >
-        <tr>
-          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
-      <![endif]-->
-    <div style="margin:0px auto;max-width:600px;">
-      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
-        <tbody>
-          <tr>
-            <td style="direction:ltr;font-size:0px;padding:0 0 24px 0;text-align:center;">
-              <!--[if mso | IE]>
-                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
-
-        <tr>
-
-            <td
-               class="" style="vertical-align:top;width:600px;"
-            >
-          <![endif]-->
-              <div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
-                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
-                  <tr>
-                    <td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
-                      <div style="font-family:Source Sans Pro, sans-serif;font-size:14px;line-height:150%;text-align:center;color:#64666A;">Penpot | Made with &lt;3 and Open Source</div>
-                    </td>
-                  </tr>
-                </table>
-              </div>
-              <!--[if mso | IE]>
-            </td>
-
-        </tr>
-
-                  </table>
-                <![endif]-->
-            </td>
-          </tr>
-        </tbody>
-      </table>
-    </div>
-    <!--[if mso | IE]>
-          </td>
-        </tr>
-      </table>
-      <![endif]-->
   </div>
 </body>
 
-</html>
+</html>

backend/resources/app/email/register/en.txt

@@ -1,4 +1,4 @@
-Hello {{name}}!
+Hello {{name|abbreviate:25}}!
 
 Thanks for signing up for your Penpot account! Please verify your email using the
 link below and get started building mockups and prototypes today!

backend/resources/app/email/request-file-access-yourpenpot-view/en.html

@@ -0,0 +1,254 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml"
+  xmlns:o="urn:schemas-microsoft-com:office:office">
+
+<head>
+  <title>
+  </title>
+  <!--[if !mso]><!-- -->
+  <meta http-equiv="X-UA-Compatible" content="IE=edge">
+  <!--<![endif]-->
+  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <style type="text/css">
+    #outlook a {
+      padding: 0;
+    }
+
+    body {
+      margin: 0;
+      padding: 0;
+      -webkit-text-size-adjust: 100%;
+      -ms-text-size-adjust: 100%;
+    }
+
+    table,
+    td {
+      border-collapse: collapse;
+      mso-table-lspace: 0pt;
+      mso-table-rspace: 0pt;
+    }
+
+    img {
+      border: 0;
+      height: auto;
+      line-height: 100%;
+      outline: none;
+      text-decoration: none;
+      -ms-interpolation-mode: bicubic;
+    }
+
+    p {
+      display: block;
+      margin: 13px 0;
+    }
+  </style>
+  <!--[if mso]>
+        <xml>
+        <o:OfficeDocumentSettings>
+          <o:AllowPNG/>
+          <o:PixelsPerInch>96</o:PixelsPerInch>
+        </o:OfficeDocumentSettings>
+        </xml>
+        <![endif]-->
+  <!--[if lte mso 11]>
+        <style type="text/css">
+          .mj-outlook-group-fix { width:100% !important; }
+        </style>
+        <![endif]-->
+  <!--[if !mso]><!-->
+  <link href="https://fonts.googleapis.com/css?family=Source%20Sans%20Pro" rel="stylesheet" type="text/css">
+  <style type="text/css">
+    @import url(https://fonts.googleapis.com/css?family=Source%20Sans%20Pro);
+  </style>
+  <!--<![endif]-->
+  <style type="text/css">
+    @media only screen and (min-width:480px) {
+      .mj-column-per-100 {
+        width: 100% !important;
+        max-width: 100%;
+      }
+
+      .mj-column-px-425 {
+        width: 425px !important;
+        max-width: 425px;
+      }
+    }
+  </style>
+  <style type="text/css">
+    @media only screen and (max-width:480px) {
+      table.mj-full-width-mobile {
+        width: 100% !important;
+      }
+
+      td.mj-full-width-mobile {
+        width: auto !important;
+      }
+    }
+  </style>
+</head>
+
+<body style="background-color:#E5E5E5;">
+  <div style="background-color:#E5E5E5;">
+    <!--[if mso | IE]>
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:16px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:collapse;border-spacing:0px;">
+                        <tbody>
+                          <tr>
+                            <td style="width:97px;">
+                              <img height="32" src="{{ public-uri }}/images/email/uxbox-title.png"
+                                style="border:0;display:block;outline:none;text-decoration:none;height:32px;width:100%;font-size:13px;"
+                                width="97" />
+                            </td>
+                          </tr>
+                        </tbody>
+                      </table>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="background:#FFFFFF;background-color:#FFFFFF;margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+        style="background:#FFFFFF;background-color:#FFFFFF;width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">
+                        Hello!</div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        <p>
+                          {{requested-by|abbreviate:25}} ({{requested-by-email}}) wants to have view-only access to the
+                          file named “{{file-name|abbreviate:25}}”.
+                        </p>
+                        <p>
+                          Since this file is in your Penpot team, you can provide access by sending a view-only link.
+                          This will allow {{requested-by|abbreviate:25}} to view the content without making any changes.
+                        </p>
+                        <p>To proceed, please click the button below to generate and send the view-only link:</p>
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="center" vertical-align="middle"
+                      style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:separate;line-height:100%">
+                        <tr>
+                          <td align="center" bgcolor="#31EFB8" role="presentation"
+                            style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#31EFB8;"
+                            valign="middle">
+                            <a href="{{ public-uri }}/#/view/{{file-id}}?page-id={{page-id}}&section=interactions&index=0&share=true"
+                              style="display:inline-block;background:#31EFB8;color:#1F1F1F;font-family:Source Sans Pro, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;"
+                              target="_blank"> Send a View-Only link </a>
+                          </td>
+                        </tr>
+                      </table>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        <p>If you do not wish to grant access at this time, you can simply disregard this email.</p>
+                        <p>Thank you</p>
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        The Penpot team.</div>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+
+    {% include "app/email/includes/footer.html" %}
+
+  </div>
+</body>
+
+</html>

backend/resources/app/email/request-file-access-yourpenpot-view/en.subj

@@ -0,0 +1 @@
+Request View-Only Access to “{{file-name|abbreviate:25}}”

backend/resources/app/email/request-file-access-yourpenpot-view/en.txt

@@ -0,0 +1,17 @@
+Hello!
+
+{{requested-by|abbreviate:25}} ({{requested-by-email}}) wants to have view-only access to the file named “{{file-name|abbreviate:25}}”.
+
+Since this file is in your Penpot team, you can provide access by sending a view-only link. This will allow {{requested-by|abbreviate:25}} to view the content without making any changes.
+
+To proceed, please click the link below to generate and send the view-only link:
+
+{{ public-uri }}/#/view/{{file-id}}?page-id={{page-id}}&section=interactions&index=0&share=true
+
+
+
+If you do not wish to grant access at this time, you can simply disregard this email.
+Thank you
+
+
+The Penpot team.

backend/resources/app/email/request-file-access-yourpenpot/en.html

@@ -0,0 +1,277 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml"
+  xmlns:o="urn:schemas-microsoft-com:office:office">
+
+<head>
+  <title>
+  </title>
+  <!--[if !mso]><!-- -->
+  <meta http-equiv="X-UA-Compatible" content="IE=edge">
+  <!--<![endif]-->
+  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <style type="text/css">
+    #outlook a {
+      padding: 0;
+    }
+
+    body {
+      margin: 0;
+      padding: 0;
+      -webkit-text-size-adjust: 100%;
+      -ms-text-size-adjust: 100%;
+    }
+
+    table,
+    td {
+      border-collapse: collapse;
+      mso-table-lspace: 0pt;
+      mso-table-rspace: 0pt;
+    }
+
+    img {
+      border: 0;
+      height: auto;
+      line-height: 100%;
+      outline: none;
+      text-decoration: none;
+      -ms-interpolation-mode: bicubic;
+    }
+
+    p {
+      display: block;
+      margin: 13px 0;
+    }
+  </style>
+  <!--[if mso]>
+        <xml>
+        <o:OfficeDocumentSettings>
+          <o:AllowPNG/>
+          <o:PixelsPerInch>96</o:PixelsPerInch>
+        </o:OfficeDocumentSettings>
+        </xml>
+        <![endif]-->
+  <!--[if lte mso 11]>
+        <style type="text/css">
+          .mj-outlook-group-fix { width:100% !important; }
+        </style>
+        <![endif]-->
+  <!--[if !mso]><!-->
+  <link href="https://fonts.googleapis.com/css?family=Source%20Sans%20Pro" rel="stylesheet" type="text/css">
+  <style type="text/css">
+    @import url(https://fonts.googleapis.com/css?family=Source%20Sans%20Pro);
+  </style>
+  <!--<![endif]-->
+  <style type="text/css">
+    @media only screen and (min-width:480px) {
+      .mj-column-per-100 {
+        width: 100% !important;
+        max-width: 100%;
+      }
+
+      .mj-column-px-425 {
+        width: 425px !important;
+        max-width: 425px;
+      }
+    }
+  </style>
+  <style type="text/css">
+    @media only screen and (max-width:480px) {
+      table.mj-full-width-mobile {
+        width: 100% !important;
+      }
+
+      td.mj-full-width-mobile {
+        width: auto !important;
+      }
+    }
+  </style>
+</head>
+
+<body style="background-color:#E5E5E5;">
+  <div style="background-color:#E5E5E5;">
+    <!--[if mso | IE]>
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:16px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:collapse;border-spacing:0px;">
+                        <tbody>
+                          <tr>
+                            <td style="width:97px;">
+                              <img height="32" src="{{ public-uri }}/images/email/uxbox-title.png"
+                                style="border:0;display:block;outline:none;text-decoration:none;height:32px;width:100%;font-size:13px;"
+                                width="97" />
+                            </td>
+                          </tr>
+                        </tbody>
+                      </table>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="background:#FFFFFF;background-color:#FFFFFF;margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+        style="background:#FFFFFF;background-color:#FFFFFF;width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">
+                        Hello!</div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        <p>
+                          {{requested-by|abbreviate:25}} ({{requested-by-email}}) has requested access to the file named
+                          “{{file-name|abbreviate:25}}”.
+                        </p>
+                        <p>
+                          Please note that the file is currently in Your Penpot 's team, so direct access cannot be
+                          granted. However, you have two options to provide the requested access:
+                        </p>
+                        <ul>
+                          <li>
+                            <p>Move the File to Another Team:</p>
+                            <p>You can move the file to another team and then give access to that team, inviting
+                              {{requested-by|abbreviate:25}}.</p>
+                          </li>
+                        </ul>
+                        </p>
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        <ul>
+                          <li>
+                            <p>Send a View-Only Link:</p>
+                            <p>Alternatively, you can create and share a view-only link to the file. This will allow
+                              {{requested-by|abbreviate:25}} to view the content without making any changes.</p>
+                            <p>Click the button below to generate and send the link:</p>
+                          </li>
+                        </ul>
+                        </p>
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="center" vertical-align="middle"
+                      style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:separate;line-height:100%">
+                        <tr>
+                          <td align="center" bgcolor="#31EFB8" role="presentation"
+                            style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#31EFB8;"
+                            valign="middle">
+                            <a href="{{ public-uri }}/#/view/{{file-id}}?page-id={{page-id}}&section=interactions&index=0&share=true"
+                              style="display:inline-block;background:#31EFB8;color:#1F1F1F;font-family:Source Sans Pro, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;"
+                              target="_blank"> Send a View-Only link </a>
+                          </td>
+                        </tr>
+                      </table>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        <p>If you do not wish to grant access at this time, you can simply disregard this email.</p>
+                        <p>Thank you</p>
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        The Penpot team.</div>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+
+    {% include "app/email/includes/footer.html" %}
+
+  </div>
+</body>
+
+</html>

backend/resources/app/email/request-file-access-yourpenpot/en.subj

@@ -0,0 +1 @@
+Request Access to “{{file-name|abbreviate:25}}”

backend/resources/app/email/request-file-access-yourpenpot/en.txt

@@ -0,0 +1,30 @@
+Hello!
+
+
+Hello!
+
+{{requested-by|abbreviate:25}} ({{requested-by-email}}) has requested access to the file named “{{file-name|abbreviate:25}}”.
+
+Please note that the file is currently in Your Penpot 's team, so direct access cannot be granted. However, you have two options to provide the requested access:
+
+- Move the File to Another Team:
+
+You can move the file to another team and then give access to that team, inviting {{requested-by|abbreviate:25}}.
+
+
+
+- Send a View-Only Link:
+
+Alternatively, you can create and share a view-only link to the file. This will allow {{requested-by|abbreviate:25}} to view the content without making any changes.
+
+Click the link below to generate and send the link:
+
+{{ public-uri }}/#/view/{{file-id}}?page-id={{page-id}}&section=interactions&index=0&share=true
+
+
+
+If you do not wish to grant access at this time, you can simply disregard this email.
+Thank you
+
+
+The Penpot team.

backend/resources/app/email/request-file-access/en.html

@@ -0,0 +1,295 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml"
+  xmlns:o="urn:schemas-microsoft-com:office:office">
+
+<head>
+  <title>
+  </title>
+  <!--[if !mso]><!-- -->
+  <meta http-equiv="X-UA-Compatible" content="IE=edge">
+  <!--<![endif]-->
+  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <style type="text/css">
+    #outlook a {
+      padding: 0;
+    }
+
+    body {
+      margin: 0;
+      padding: 0;
+      -webkit-text-size-adjust: 100%;
+      -ms-text-size-adjust: 100%;
+    }
+
+    table,
+    td {
+      border-collapse: collapse;
+      mso-table-lspace: 0pt;
+      mso-table-rspace: 0pt;
+    }
+
+    img {
+      border: 0;
+      height: auto;
+      line-height: 100%;
+      outline: none;
+      text-decoration: none;
+      -ms-interpolation-mode: bicubic;
+    }
+
+    p {
+      display: block;
+      margin: 13px 0;
+    }
+  </style>
+  <!--[if mso]>
+        <xml>
+        <o:OfficeDocumentSettings>
+          <o:AllowPNG/>
+          <o:PixelsPerInch>96</o:PixelsPerInch>
+        </o:OfficeDocumentSettings>
+        </xml>
+        <![endif]-->
+  <!--[if lte mso 11]>
+        <style type="text/css">
+          .mj-outlook-group-fix { width:100% !important; }
+        </style>
+        <![endif]-->
+  <!--[if !mso]><!-->
+  <link href="https://fonts.googleapis.com/css?family=Source%20Sans%20Pro" rel="stylesheet" type="text/css">
+  <style type="text/css">
+    @import url(https://fonts.googleapis.com/css?family=Source%20Sans%20Pro);
+  </style>
+  <!--<![endif]-->
+  <style type="text/css">
+    @media only screen and (min-width:480px) {
+      .mj-column-per-100 {
+        width: 100% !important;
+        max-width: 100%;
+      }
+
+      .mj-column-px-425 {
+        width: 425px !important;
+        max-width: 425px;
+      }
+    }
+  </style>
+  <style type="text/css">
+    @media only screen and (max-width:480px) {
+      table.mj-full-width-mobile {
+        width: 100% !important;
+      }
+
+      td.mj-full-width-mobile {
+        width: auto !important;
+      }
+    }
+  </style>
+</head>
+
+<body style="background-color:#E5E5E5;">
+  <div style="background-color:#E5E5E5;">
+    <!--[if mso | IE]>
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:16px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:collapse;border-spacing:0px;">
+                        <tbody>
+                          <tr>
+                            <td style="width:97px;">
+                              <img height="32" src="{{ public-uri }}/images/email/uxbox-title.png"
+                                style="border:0;display:block;outline:none;text-decoration:none;height:32px;width:100%;font-size:13px;"
+                                width="97" />
+                            </td>
+                          </tr>
+                        </tbody>
+                      </table>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="background:#FFFFFF;background-color:#FFFFFF;margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+        style="background:#FFFFFF;background-color:#FFFFFF;width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">
+                        Hello!</div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        <p>
+                          {{requested-by|abbreviate:25}} ({{requested-by-email}}) has requested access to the file named
+                          “{{file-name|abbreviate:25}}”.
+                        </p>
+                        <p>
+                          To provide this access, you have the following options:
+                        </p>
+                        <ul>
+                          <li>
+                            <p>Give Access to the “{{team-name|abbreviate:25}}” Team:</p>
+                            <p>This will automatically include {{requested-by|abbreviate:25}} in the team, so the user
+                              can see all the projects and files in it.</p>
+                            <p>Click the button below to provide team access:</p>
+                          </li>
+                        </ul>
+                        </p>
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="center" vertical-align="middle"
+                      style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:separate;line-height:100%">
+                        <tr>
+                          <td align="center" bgcolor="#31EFB8" role="presentation"
+                            style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#31EFB8;"
+                            valign="middle">
+                            <a href="{{ public-uri }}/#/dashboard/team/{{team-id}}/members?invite-email={{requested-by-email|urlescape }}"
+                              style="display:inline-block;background:#31EFB8;color:#1F1F1F;font-family:Source Sans Pro, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;"
+                              target="_blank"> Give access to “{{team-name|abbreviate:25}}” Team </a>
+                          </td>
+                        </tr>
+                      </table>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        <ul>
+                          <li>
+                            <p>Send a View-Only Link:</p>
+                            <p>Alternatively, you can create and share a view-only link to the file. This will allow
+                              {{requested-by|abbreviate:25}} to view the content without making any changes.</p>
+                            <p>Click the button below to generate and send the link:</p>
+                          </li>
+                        </ul>
+                        </p>
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="center" vertical-align="middle"
+                      style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:separate;line-height:100%">
+                        <tr>
+                          <td align="center" bgcolor="#31EFB8" role="presentation"
+                            style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#31EFB8;"
+                            valign="middle">
+                            <a href="{{ public-uri }}/#/view/{{file-id}}?page-id={{page-id}}&section=interactions&index=0&share=true"
+                              style="display:inline-block;background:#31EFB8;color:#1F1F1F;font-family:Source Sans Pro, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;"
+                              target="_blank"> Send a View-Only link </a>
+                          </td>
+                        </tr>
+                      </table>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        <p>If you do not wish to grant access at this time, you can simply disregard this email.</p>
+                        <p>Thank you</p>
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        The Penpot team.</div>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+
+    {% include "app/email/includes/footer.html" %}
+
+
+  </div>
+</body>
+
+</html>

backend/resources/app/email/request-file-access/en.subj

@@ -0,0 +1 @@
+Request Access to “{{file-name|abbreviate:25}}”

backend/resources/app/email/request-file-access/en.txt

@@ -0,0 +1,34 @@
+Hello!
+
+
+Hello!
+
+{{requested-by|abbreviate:25}} ({{requested-by-email}}) has requested access to the file named “{{file-name|abbreviate:25}}”.
+
+To provide this access, you have the following options:
+
+- Give Access to the “{{team-name|abbreviate:25}}” Team:
+
+This will automatically include {{requested-by|abbreviate:25}} in the team, so the user can see all the projects and files in it.
+
+Click the link below to provide team access:
+
+{{ public-uri }}/#/dashboard/team/{{team-id}}/members?invite-email={{requested-by-email|urlescape}}
+
+
+
+- Send a View-Only Link:
+
+Alternatively, you can create and share a view-only link to the file. This will allow {{requested-by|abbreviate:25}} to view the content without making any changes.
+
+Click the link below to generate and send the link:
+
+{{ public-uri }}/#/view/{{file-id}}?page-id={{page-id}}&section=interactions&index=0&share=true
+
+
+
+If you do not wish to grant access at this time, you can simply disregard this email.
+Thank you
+
+
+The Penpot team.

backend/resources/app/email/request-team-access/en.html

@@ -0,0 +1,252 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml"
+  xmlns:o="urn:schemas-microsoft-com:office:office">
+
+<head>
+  <title>
+  </title>
+  <!--[if !mso]><!-- -->
+  <meta http-equiv="X-UA-Compatible" content="IE=edge">
+  <!--<![endif]-->
+  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <style type="text/css">
+    #outlook a {
+      padding: 0;
+    }
+
+    body {
+      margin: 0;
+      padding: 0;
+      -webkit-text-size-adjust: 100%;
+      -ms-text-size-adjust: 100%;
+    }
+
+    table,
+    td {
+      border-collapse: collapse;
+      mso-table-lspace: 0pt;
+      mso-table-rspace: 0pt;
+    }
+
+    img {
+      border: 0;
+      height: auto;
+      line-height: 100%;
+      outline: none;
+      text-decoration: none;
+      -ms-interpolation-mode: bicubic;
+    }
+
+    p {
+      display: block;
+      margin: 13px 0;
+    }
+  </style>
+  <!--[if mso]>
+        <xml>
+        <o:OfficeDocumentSettings>
+          <o:AllowPNG/>
+          <o:PixelsPerInch>96</o:PixelsPerInch>
+        </o:OfficeDocumentSettings>
+        </xml>
+        <![endif]-->
+  <!--[if lte mso 11]>
+        <style type="text/css">
+          .mj-outlook-group-fix { width:100% !important; }
+        </style>
+        <![endif]-->
+  <!--[if !mso]><!-->
+  <link href="https://fonts.googleapis.com/css?family=Source%20Sans%20Pro" rel="stylesheet" type="text/css">
+  <style type="text/css">
+    @import url(https://fonts.googleapis.com/css?family=Source%20Sans%20Pro);
+  </style>
+  <!--<![endif]-->
+  <style type="text/css">
+    @media only screen and (min-width:480px) {
+      .mj-column-per-100 {
+        width: 100% !important;
+        max-width: 100%;
+      }
+
+      .mj-column-px-425 {
+        width: 425px !important;
+        max-width: 425px;
+      }
+    }
+  </style>
+  <style type="text/css">
+    @media only screen and (max-width:480px) {
+      table.mj-full-width-mobile {
+        width: 100% !important;
+      }
+
+      td.mj-full-width-mobile {
+        width: auto !important;
+      }
+    }
+  </style>
+</head>
+
+<body style="background-color:#E5E5E5;">
+  <div style="background-color:#E5E5E5;">
+    <!--[if mso | IE]>
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:16px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:collapse;border-spacing:0px;">
+                        <tbody>
+                          <tr>
+                            <td style="width:97px;">
+                              <img height="32" src="{{ public-uri }}/images/email/uxbox-title.png"
+                                style="border:0;display:block;outline:none;text-decoration:none;height:32px;width:100%;font-size:13px;"
+                                width="97" />
+                            </td>
+                          </tr>
+                        </tbody>
+                      </table>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <!--[if mso | IE]>
+          </td>
+        </tr>
+      </table>
+
+      <table
+         align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"
+      >
+        <tr>
+          <td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;">
+      <![endif]-->
+    <div style="background:#FFFFFF;background-color:#FFFFFF;margin:0px auto;max-width:600px;">
+      <table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation"
+        style="background:#FFFFFF;background-color:#FFFFFF;width:100%;">
+        <tbody>
+          <tr>
+            <td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
+              <!--[if mso | IE]>
+                  <table role="presentation" border="0" cellpadding="0" cellspacing="0">
+
+        <tr>
+
+            <td
+               class="" style="vertical-align:top;width:600px;"
+            >
+          <![endif]-->
+              <div class="mj-column-per-100 mj-outlook-group-fix"
+                style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
+                <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;"
+                  width="100%">
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:24px;font-weight:600;line-height:150%;text-align:left;color:#000000;">
+                        Hello!</div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        <p>
+                          {{requested-by|abbreviate:25}} ({{requested-by-email}}) wants to have access to the
+                          “{{team-name|abbreviate:25}}” Team.
+                        </p>
+                        <p>
+                          To provide access, please click the button below:
+                        </p>
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="center" vertical-align="middle"
+                      style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <table border="0" cellpadding="0" cellspacing="0" role="presentation"
+                        style="border-collapse:separate;line-height:100%;">
+                        <tr>
+                          <td align="center" bgcolor="#31EFB8" role="presentation"
+                            style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#31EFB8;"
+                            valign="middle">
+                            <a href="{{ public-uri }}/#/dashboard/team/{{team-id}}/members?invite-email={{requested-by-email|urlescape}}"
+                              style="display:inline-block;background:#31EFB8;color:#1F1F1F;font-family:Source Sans Pro, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;"
+                              target="_blank"> Give access to “{{team-name|abbreviate:25}}” </a>
+                          </td>
+                        </tr>
+                      </table>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        <p>If you do not wish to grant access at this time, you can simply disregard this email.</p>
+                        <p>Thank you</p>
+                      </div>
+                    </td>
+                  </tr>
+                  <tr>
+                    <td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
+                      <div
+                        style="font-family:Source Sans Pro, sans-serif;font-size:16px;line-height:150%;text-align:left;color:#000000;">
+                        The Penpot team.</div>
+                    </td>
+                  </tr>
+                </table>
+              </div>
+              <!--[if mso | IE]>
+            </td>
+
+        </tr>
+
+                  </table>
+                <![endif]-->
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+
+    {% include "app/email/includes/footer.html" %}
+
+  </div>
+</body>
+
+</html>

backend/resources/app/email/request-team-access/en.subj

@@ -0,0 +1 @@
+Request Access to “{{team-name|abbreviate:25}}”

backend/resources/app/email/request-team-access/en.txt

@@ -0,0 +1,14 @@
+Hello!
+
+{{requested-by|abbreviate:25}} ({{requested-by-email}}) wants to have access to the “{{team-name|abbreviate:25}}” Team.
+
+To provide access, please click the link below:
+
+{{ public-uri }}/#/dashboard/team/{{team-id}}/members?invite-email={{requested-by-email|urlescape}}
+
+
+If you do not wish to grant access at this time, you can simply disregard this email.
+Thank you
+
+
+The Penpot team.

backend/resources/app/onboarding.edn

@@ -1,36 +1,42 @@
-[{:id "material-design-3"
-  :name "Material Design 3"
-  :thumbnail-uri "https://penpot.app/images/libraries/cover-md3.jpg"
-  :file-uri "https://github.com/penpot/penpot-files/raw/main/Material%20Design%203.penpot"}
+[{:id "wireframing-kit"
+  :name "Wireframe library"
+  :file-uri "https://github.com/penpot/penpot-files/raw/refs/heads/main/Wireframing%20kit%20v1.1.penpot"}
+ {:id "prototype-examples"
+  :name "Prototype template"
+  :file-uri "https://github.com/penpot/penpot-files/raw/refs/heads/main/Prototype%20examples%20v1.1.penpot"}
+ {:id "plants-app"
+  :name "UI mockup example"
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/Plants-app.penpot"}
+ {:id "penpot-design-system"
+  :name "Design system example"
+  :file-uri "https://github.com/penpot/penpot-files/raw/refs/heads/main/Penpot%20-%20Design%20System%20v2.1.penpot"}
  {:id "tutorial-for-beginners"
   :name "Tutorial for beginners"
-  :thumbnail-uri "https://penpot.app/images/libraries/tutorial-for-beginners.jpg"
-  :file-uri "https://github.com/penpot/penpot-files/raw/binary-files/tutorial-for-beginners.penpot"}
- {:id "penpot-design-system"
-  :name "Penpot Design System"
-  :thumbnail-uri "https://penpot.app/images/libraries/cover-ds-penpot.jpg"
-  :file-uri "https://github.com/penpot/penpot-files/raw/binary-files/Penpot-Design-system.penpot"}
- {:id "wireframing-kit"
-  :name "Wireframing Kit"
-  :thumbnail-uri "https://penpot.app/images/libraries/cover-wireframes.jpg"
-  :file-uri "https://github.com/penpot/penpot-files/raw/binary-files/wireframing-kit.penpot"}
- {:id "ant-design"
-  :name "Ant Design UI Kit (lite)"
-  :thumbnail-uri "https://penpot.app/images/libraries/cover-ant-design.jpg"
-  :file-uri "https://github.com/penpot/penpot-files/raw/binary-files/Ant-Design-UI-Kit-Lite.penpot"}
- {:id "cocomaterial"
-  :name "Cocomaterial"
-  :thumbnail-uri "https://penpot.app/images/libraries/cover-cocomaterial.jpg"
-  :file-uri "https://github.com/penpot/penpot-files/raw/binary-files/Cocomaterial.penpot"}
- {:id "circum-icons"
-  :name "Circum Icons pack"
-  :thumbnail-uri "https://penpot.app/images/libraries/cover-circum.jpg"
-  :file-uri "https://github.com/penpot/penpot-files/raw/binary-files/CircumIcons.penpot"}
- {:id "coreui"
-  :name "CoreUI"
-  :thumbnail-uri "https://penpot.app/images/libraries/cover-coreui.jpg"
-  :file-uri "https://github.com/penpot/penpot-files/raw/main/CoreUI%20DesignSystem%20(DEMO).penpot"}
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/tutorial-for-beginners.penpot"}
+ {:id "lucide-icons"
+  :name "Lucide Icons"
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/Lucide-icons.penpot"}
+ {:id "font-awesome"
+  :name "Font Awesome"
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/FontAwesome.penpot"}
+ {:id "black-white-mobile-templates"
+  :name "Black & White Mobile Templates"
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/Black-&-White-Mobile-Templates.penpot"}
+ {:id "avataaars"
+  :name "Avataaars"
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/Avataaars-by-Pablo-Stanley.penpot"}
+ {:id "ux-notes"
+  :name "UX Notes"
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/UX-Notes.penpot"}
  {:id "whiteboarding-kit"
   :name "Whiteboarding Kit"
-  :thumbnail-uri "https://penpot.app/images/libraries/cover-whiteboards.jpg"
-  :file-uri "https://github.com/penpot/penpot-files/raw/binary-files/Whiteboarding-mapping-kit.penpot"}]
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/Whiteboarding-mapping-kit.penpot"}
+ {:id "open-color-scheme"
+  :name "Open Color Scheme"
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/Open%20Color%20Scheme%20(v1.9.1).penpot"}
+ {:id "flex-layout-playground"
+  :name "Flex Layout Playground"
+  :file-uri "https://github.com/penpot/penpot-files/raw/refs/heads/main/Flex%20Layout%20Playground%20v2.0.penpot"}
+ {:id "welcome"
+  :name "Welcome"
+  :file-uri "https://github.com/penpot/penpot-files/raw/main/welcome.penpot"}]

backend/resources/app/templates/api-doc-entry.tmpl

@@ -20,13 +20,22 @@
           <span>WEBHOOK</span>
         </span>
       {% endif %}
+
       {% if item.params-schema-js %}
         <span class="tag">
-          <span>SC</span>
+          <span>SCHEMA</span>
         </span>
-      {% else %}
+      {% endif %}
+
+      {% if item.spec %}
         <span class="tag">
-          <span>SP</span>
+          <span>SPEC</span>
+        </span>
+      {% endif %}
+
+      {% if item.sse %}
+        <span class="tag">
+          <span>SSE</span>
         </span>
       {% endif %}
     </div>

backend/resources/app/templates/api-doc.css

@@ -156,7 +156,7 @@ h4 {
 }
 
 .rpc-row-info > .module {
-  width: 120px;
+  width: 150px;
   font-weight: bold;
   border-right: 1px dotted #777;
   text-align: right;

backend/resources/app/templates/api-doc.tmpl

@@ -37,8 +37,15 @@
 
         <h2>GENERAL NOTES</h2>
 
+        <h3>HTTP Transport & Methods</h3>
+        <p>The HTTP is the transport method for accesing this API; all
+        functions can be called using POST HTTP method; the functions
+        that starts with <b>get-</b> in the name, can use GET HTTP
+        method which in many cases benefits from the HTTP cache.</p>
+
+
         <h3>Authentication</h3>
-        <p>The penpot backend right now offerts two way for authenticate the request:
+        <p>The penpot backend right now offers two way for authenticate the request:
         <b>cookies</b> (the same mechanism that we use ourselves on accessing the API from the
         web application) and <b>access tokens</b>.</p>
 
@@ -56,6 +63,17 @@
         desired content-type on the <b>`Accept`</b> header, the transit encoding is used
         by default.</p>
 
+        <h3>SSE (Server-Sent Events)</h3>
+        <p>The methods marked with <b>SSE</b> returns
+        a <a href="https://html.spec.whatwg.org/multipage/server-sent-events.html"> SSE
+        formatted</a> stream on the response body, always with status 200. The events are
+        always encoded using `application/transit+json` encoding (for now no content
+        negotiation is possible on methods that return SSE streams). </p>
+        <p>On the javascript side you can use
+        the <a href="https://github.com/rexxars/eventsource-parser">eventsoure-parser</a>
+        library for propertly parsing the response body using the
+        standard <a href="https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API">Fetch
+        API</a></p>
 
         <h3>Limits</h3>
         <p>The rate limit work per user basis (this means that different api keys share

backend/resources/app/templates/debug.tmpl

@@ -6,11 +6,17 @@ Debug Main Page
 
 {% block content %}
 <nav>
-  <h1>Debug INDEX:</h1>
-  <div>[<a href="/dbg/error">ERRORS</a>]</div>
+  <div class="title">
+    <h1>ADMIN DEBUG INTERFACE (VERSION: {{version}})</h1>
+  </div>
 </nav>
-<main class="index">
+<main class="dashboard">
   <section class="widget">
+    <fieldset>
+      <legend>Error reports</legend>
+      <desc><a href="/dbg/error">CLICK HERE TO SEE THE ERROR REPORTS</a> </desc>
+    </fieldset>
+
     <fieldset>
       <legend>Download file data:</legend>
       <desc>Given an FILE-ID, downloads the file data as file. The file data is encoded using transit.</desc>
@@ -37,9 +43,42 @@ Debug Main Page
           <input type="checkbox" name="reuseid" />
         </div>
 
-        <input type="submit" value="Upload" />
+        <div class="row">
+          <input type="submit" value="Upload" />
+        </div>
       </form>
     </fieldset>
+
+    <fieldset>
+      <legend>Profile Management</legend>
+      <form method="post" action="/dbg/actions/resend-email-verification">
+        <div class="row">
+          <input type="email" name="email" placeholder="example@example.com" value="" />
+        </div>
+
+        <div class="row">
+          <label for="force-verify">Are you sure?</label>
+          <input id="force-verify" type="checkbox" name="force" />
+          <br />
+          <small>
+            This is a just a security double check for prevent non intentional submits.
+          </small>
+        </div>
+
+        <div class="row">
+          <input type="submit" name="resend" value="Resend Verification" />
+          <input type="submit" name="verify" value="Verify" />
+        </div>
+
+        <div class="row">
+          <input type="submit" class="danger" name="block" value="Block" />
+          <input type="submit" class="danger" name="unblock" value="Unblock" />
+        </div>
+      </form>
+    </fieldset>
+
+
+
   </section>
 
   <section class="widget">
@@ -107,18 +146,37 @@ Debug Main Page
         </div>
 
         <div class="row">
-          <label>Ignore index errors?</label>
-          <input type="checkbox" name="ignore-index-errors" checked/>
-          <br />
-          <small>
-            Do not break on index lookup errors (remap operation).
-            Useful when importing a broken file that has broken
-            relations or missing pieces.
-          </small>
+          <input type="submit" name="upload" value="Upload" />
+        </div>
+      </form>
+    </fieldset>
+  </section>
+
+  <section class="widget">
+    <fieldset>
+      <legend>Reset file version</legend>
+      <desc>Allows reset file data version to a specific number/</desc>
+
+      <form method="post" action="/dbg/actions/reset-file-version">
+        <div class="row">
+          <input type="text" style="width:300px" name="file-id" placeholder="file-id" />
+        </div>
+        <div class="row">
+          <input type="number" style="width:100px" name="version" placeholder="version" value="32" />
         </div>
 
         <div class="row">
-          <input type="submit" name="upload" value="Upload" />
+          <label for="force-version">Are you sure?</label>
+          <input id="force-version" type="checkbox" name="force" />
+          <br />
+          <small>
+            This is a just a security double check for prevent non intentional submits.
+          </small>
+        </div>
+
+
+        <div class="row">
+          <input type="submit" value="Submit" />
         </div>
       </form>
     </fieldset>

backend/resources/app/templates/error-list.tmpl

@@ -6,13 +6,19 @@ penpot - error list
 
 {% block content %}
 <nav>
-  <h1>Latest error reports:</h1>
+  <div class="title">
+    <h1>Error reports (last 200)</h1>
+  </div>
 </nav>
 <main class="horizontal-list">
   <ul>
     {% for item in items %}
-    <li><a class="date" href="/dbg/error/{{item.id}}">{{item.created-at}}</a> 
-        <span class="title">{{item.hint|abbreviate:150}}</span></li>
+      <li>
+        <a class="date" href="/dbg/error/{{item.id}}">{{item.created-at}}</a>
+        <a class="hint" href="/dbg/error/{{item.id}}">
+          <span class="title">{{item.hint|abbreviate:150}}</span>
+        </a>
+      </li>
     {% endfor %}
   </ul>
 </main>

backend/resources/app/templates/error-report.v3.tmpl

@@ -1,13 +1,13 @@
  {% extends "app/templates/base.tmpl" %}
 
 {% block title %}
-penpot - error report v2 {{id}}
+Report: {{hint|abbreviate:150}} - {{id}} - Penpot Error Report (v3)
 {% endblock %}
 
 {% block content %}
 <nav>
   <div>[<a href="/dbg/error">⮜</a>]</div>
-  <div>[<a href="#message">message</a>]</div>
+  <div>[<a href="#head">head</a>]</div>
   <div>[<a href="#props">props</a>]</div>
   <div>[<a href="#context">context</a>]</div>
   {% if params %}
@@ -29,10 +29,11 @@ penpot - error report v2 {{id}}
 <main>
   <div class="table">
     <div class="table-row multiline">
-      <div id="message" class="table-key">MESSAGE: </div>
-
+      <div id="head" class="table-key">HEAD</div>
       <div class="table-val">
-        <h1>{{hint}}</h1>
+        <h1><span class="not-important">Hint:</span> <br/> {{hint}}</h1>
+        <h2><span class="not-important">Reported at:</span> <br/> {{created-at}}</h2>
+        <h2><span class="not-important">Report ID:</span> <br/> {{id}}</h2>
       </div>
     </div>
 
@@ -71,7 +72,7 @@ penpot - error report v2 {{id}}
 
     {% if value %}
     <div class="table-row multiline">
-      <div id="value" class="table-key">VALIDATION VALUE: </div>
+      <div id="value" class="table-key">VALUE: </div>
       <div class="table-val">
         <pre>{{value}}</pre>
       </div>

backend/resources/app/templates/styles.css

@@ -36,6 +36,11 @@ small {
   color: #888;
 }
 
+.not-important {
+  color: #888;
+  font-weight: 200;
+}
+
 small > strong {
   font-size: 9px;
 }
@@ -50,7 +55,13 @@ nav {
   background: #e3e3e3;
 }
 
-nav > h1 {
+nav > .title {
+  display: flex;
+  justify-content: center;
+  width: 100%;
+}
+
+nav > .title > h1 {
   padding: 0px;
   margin: 0px;
   font-size: 11px;
@@ -105,29 +116,50 @@ nav > div:not(:last-child) {
   width: unset;
 }
 
-.index {
+.dashboard {
   margin-top: 40px;
   display: flex;
 }
 
-.index > section {
-  padding: 10px;
-  background-color: #e3e3e3;
+.widget {
   max-width: 400px;
   margin: 5px;
   height: fit-content;
 }
 
-.index fieldset:not(:first-child) {
+.widget input[type=submit] {
+  outline: none;
+  border: 1px solid gray;
+  border-radius: 2px;
+  padding: 3px 5px;
+}
+
+.widget input[type=submit].danger {
+  outline: none;
+  border: 1px solid red;
+  border-radius: 2px;
+  padding: 3px 5px;
+}
+
+
+
+.widget > fieldset {
+  padding: 10px;
+  background-color: #f9f9f9;
+}
+
+.widget > fieldset:not(:last-child) {
+  margin-bottom: 10px;
+}
+
+
+
+.dashboard fieldset:not(:first-child) {
   margin-top: 15px;
 }
 
-/* .index > section:not(:last-child) { */
-/*   margin-bottom: 10px; */
-/* } */
 
-
-.index > section > h2 {
+.widget > h2 {
   margin-top: 0px;
 }
 
@@ -151,7 +183,6 @@ nav > div:not(:last-child) {
   line-height: 18px;
   min-width: 210px;
   margin: 0px 20px;
-  cursor: pointer;
   display: flex;
   border-radius: 3px;
 }

backend/resources/climit.edn

@@ -3,12 +3,28 @@
 ;; Optional: queue, ommited means Integer/MAX_VALUE
 ;; Optional: timeout, ommited means no timeout
 ;; Note: queue and timeout are excluding
-{:update-file-by-id {:permits 1 :queue 3}
- :update-file {:permits 20}
+{:update-file/global {:permits 20}
+ :update-file/by-profile
+ {:permits 1 :queue 5}
 
- :derive-password {:permits 8}
- :process-font  {:permits 4 :queue 32}
- :process-image {:permits 8 :queue 32}
+ :process-font/global {:permits 4}
+ :process-font/by-profile {:permits 1}
 
- :submit-audit-events-by-profile
+ :process-image/global {:permits 8}
+ :process-image/by-profile {:permits 1}
+
+ :auth/global {:permits 8}
+
+ :root/global
+ {:permits 40}
+
+ :root/by-profile
+ {:permits 10}
+
+ :file-thumbnail-ops/global
+ {:permits 20}
+ :file-thumbnail-ops/by-profile
+ {:permits 2}
+
+ :submit-audit-events/by-profile
  {:permits 1 :queue 3}}

backend/resources/log4j2-devenv-repl.xml

@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Configuration status="fatal" monitorInterval="30">
+  <Appenders>
+    <Console name="console" target="SYSTEM_OUT">
+      <PatternLayout pattern="[%d{YYYY-MM-dd HH:mm:ss.SSS}] %level{length=1} %logger{36} - %msg%n"
+                     alwaysWriteExceptions="true" />
+    </Console>
+
+    <RollingFile name="main" fileName="logs/main-latest.log" filePattern="logs/main-%i.log">
+      <PatternLayout pattern="[%d{YYYY-MM-dd HH:mm:ss.SSS}] %level{length=1} %logger{36} - %msg%n"
+                     alwaysWriteExceptions="true" />
+      <Policies>
+        <SizeBasedTriggeringPolicy size="50M"/>
+      </Policies>
+      <DefaultRolloverStrategy max="20"/>
+    </RollingFile>
+  </Appenders>
+
+  <Loggers>
+    <Logger name="io.lettuce" level="error" />
+    <Logger name="com.zaxxer.hikari" level="error"/>
+    <Logger name="org.postgresql" level="error" />
+
+    <Logger name="app.binfile" level="debug" />
+    <Logger name="app.storage.tmp" level="info" />
+    <Logger name="app.worker" level="trace" />
+    <Logger name="app.msgbus" level="info" />
+    <Logger name="app.http.websocket" level="info" />
+    <Logger name="app.http.sse" level="info" />
+    <Logger name="app.util.websocket" level="info" />
+    <Logger name="app.redis" level="info" />
+    <Logger name="app.rpc.rlimit" level="info" />
+    <Logger name="app.rpc.climit" level="debug" />
+    <Logger name="app.common.files.migrations" level="debug" />
+
+    <Logger name="app.loggers" level="debug" additivity="false">
+      <AppenderRef ref="main" level="debug" />
+    </Logger>
+
+    <Logger name="app" level="all" additivity="false">
+      <AppenderRef ref="main" level="trace" />
+    </Logger>
+
+    <Logger name="user" level="trace" additivity="false">
+      <AppenderRef ref="main" level="trace" />
+    </Logger>
+
+    <Root level="info">
+      <AppenderRef ref="main" />
+    </Root>
+  </Loggers>
+</Configuration>

backend/resources/log4j2-devenv.xml

@@ -1,18 +1,18 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<Configuration status="info" monitorInterval="30">
+<Configuration status="fatal" monitorInterval="30">
   <Appenders>
     <Console name="console" target="SYSTEM_OUT">
       <PatternLayout pattern="[%d{YYYY-MM-dd HH:mm:ss.SSS}] %level{length=1} %logger{36} - %msg%n"
                      alwaysWriteExceptions="true" />
     </Console>
 
-    <RollingFile name="main" fileName="logs/main.log" filePattern="logs/main-%i.log">
+    <RollingFile name="main" fileName="logs/main-latest.log" filePattern="logs/main-%i.log">
       <PatternLayout pattern="[%d{YYYY-MM-dd HH:mm:ss.SSS}] %level{length=1} %logger{36} - %msg%n"
                      alwaysWriteExceptions="true" />
       <Policies>
         <SizeBasedTriggeringPolicy size="50M"/>
       </Policies>
-      <DefaultRolloverStrategy max="9"/>
+      <DefaultRolloverStrategy max="20"/>
     </RollingFile>
   </Appenders>
 
@@ -21,31 +21,36 @@
     <Logger name="com.zaxxer.hikari" level="error"/>
     <Logger name="org.postgresql" level="error" />
 
-    <Logger name="app.rpc.commands.binfile" level="debug" />
-    <Logger name="app.storage.tmp" level="debug" />
-    <Logger name="app.worker" level="info" />
+    <Logger name="app.binfile" level="debug" />
+    <Logger name="app.storage.tmp" level="info" />
+    <Logger name="app.worker" level="trace" />
     <Logger name="app.msgbus" level="info" />
     <Logger name="app.http.websocket" level="info" />
+    <Logger name="app.http.sse" level="info" />
     <Logger name="app.util.websocket" level="info" />
     <Logger name="app.redis" level="info" />
     <Logger name="app.rpc.rlimit" level="info" />
-    <Logger name="app.rpc.climit" level="info" />
-    <Logger name="app.rpc.mutations.files" level="info" />
+    <Logger name="app.rpc.climit" level="debug" />
+    <Logger name="app.common.files.migrations" level="debug" />
 
     <Logger name="app.loggers" level="debug" additivity="false">
+      <AppenderRef ref="console" level="info" />
       <AppenderRef ref="main" level="debug" />
     </Logger>
 
     <Logger name="app" level="all" additivity="false">
       <AppenderRef ref="main" level="trace" />
+      <AppenderRef ref="console" level="debug" />
     </Logger>
 
     <Logger name="user" level="trace" additivity="false">
       <AppenderRef ref="main" level="trace" />
+      <AppenderRef ref="console" level="info" />
     </Logger>
 
     <Root level="info">
       <AppenderRef ref="main" />
+      <AppenderRef ref="console" level="info" />
     </Root>
   </Loggers>
 </Configuration>

backend/resources/log4j2-experiments.xml

@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Configuration status="fatal" monitorInterval="30">
+  <Appenders>
+    <Console name="console" target="SYSTEM_OUT">
+      <PatternLayout pattern="[%d{YYYY-MM-dd HH:mm:ss.SSS}] %level{length=1} %logger{36} - %msg%n"
+                     alwaysWriteExceptions="true" />
+    </Console>
+
+    <RollingFile name="main" fileName="logs/main-latest.log" filePattern="logs/main-%i.log">
+      <PatternLayout pattern="[%d{YYYY-MM-dd HH:mm:ss.SSS}] %level{length=1} %logger{36} - %msg%n"
+                     alwaysWriteExceptions="true" />
+      <Policies>
+        <SizeBasedTriggeringPolicy size="50M"/>
+      </Policies>
+      <DefaultRolloverStrategy max="9"/>
+    </RollingFile>
+
+    <RollingFile name="reports" fileName="logs/reports-latest.log" filePattern="logs/reports-%i.log">
+      <PatternLayout pattern="[%d{YYYY-MM-dd HH:mm:ss.SSS}] %level{length=1} %logger{36} - %msg%n"
+                     alwaysWriteExceptions="true" />
+      <Policies>
+        <SizeBasedTriggeringPolicy size="100M"/>
+      </Policies>
+      <DefaultRolloverStrategy max="9"/>
+    </RollingFile>
+  </Appenders>
+
+  <Loggers>
+    <Logger name="io.lettuce" level="error" />
+    <Logger name="com.zaxxer.hikari" level="error"/>
+    <Logger name="org.postgresql" level="error" />
+
+    <Logger name="app.rpc.commands.binfile" level="debug" />
+    <Logger name="app.storage.tmp" level="info" />
+    <Logger name="app.worker" level="trace" />
+    <Logger name="app.msgbus" level="info" />
+    <Logger name="app.http.websocket" level="info" />
+    <Logger name="app.http.sse" level="info" />
+    <Logger name="app.util.websocket" level="info" />
+    <Logger name="app.redis" level="info" />
+    <Logger name="app.rpc.rlimit" level="info" />
+    <Logger name="app.rpc.climit" level="debug" />
+    <Logger name="app.common.files.migrations" level="info" />
+
+    <Logger name="app.loggers" level="debug" additivity="false">
+      <AppenderRef ref="main" level="debug" />
+    </Logger>
+
+    <Logger name="app.features" level="all" additivity="true">
+      <AppenderRef ref="reports" level="warn" />
+    </Logger>
+
+    <Logger name="app" level="all" additivity="false">
+      <AppenderRef ref="main" level="trace" />
+    </Logger>
+
+    <Logger name="user" level="trace" additivity="false">
+      <AppenderRef ref="main" level="trace" />
+    </Logger>
+
+    <Root level="info">
+      <AppenderRef ref="main" />
+    </Root>
+  </Loggers>
+</Configuration>

backend/resources/log4j2.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<Configuration status="info" monitorInterval="60">
+<Configuration status="fatal" monitorInterval="60">
   <Appenders>
     <Console name="console" target="SYSTEM_OUT">
       <PatternLayout pattern="[%d{YYYY-MM-dd HH:mm:ss.SSS}] %level{length=1} %logger{36} - %msg%n"
@@ -11,12 +11,9 @@
     <Logger name="io.lettuce" level="error" />
     <Logger name="com.zaxxer.hikari" level="error" />
     <Logger name="org.postgresql" level="error" />
-
-    <Logger name="app.util" level="info" />
     <Logger name="app" level="info" additivity="false">
-      <AppenderRef ref="console" />
+      <AppenderRef ref="console" level="info" />
     </Logger>
-
     <Root level="info">
       <AppenderRef ref="console" />
     </Root>

backend/scripts/build

@@ -7,6 +7,8 @@ set -ex
 rm -rf target;
 mkdir -p target/classes;
 mkdir -p target/dist;
+mkdir -p target/dist/scripts;
+
 echo "$CURRENT_VERSION" > target/classes/version.txt;
 cp ../CHANGES.md target/classes/changelog.md;
 
@@ -15,9 +17,12 @@ mv target/penpot.jar target/dist/penpot.jar
 cp resources/log4j2.xml target/dist/log4j2.xml
 cp scripts/run.template.sh target/dist/run.sh;
 cp scripts/manage.py target/dist/manage.py
+cp scripts/svgo-cli.js target/dist/scripts/;
 chmod +x target/dist/run.sh;
 chmod +x target/dist/manage.py
 
-# Prefetch
+# Prefetch templates
+rm -rf builtin-templates;
+mkdir builtin-templates;
 bb ./scripts/prefetch-templates.clj resources/app/onboarding.edn builtin-templates/
 cp -r builtin-templates target/dist/

backend/scripts/manage.py

@@ -44,11 +44,16 @@ def send_eval(expr):
         s.send(b":repl/quit\n\n")
 
         with s.makefile() as f:
-            result = json.load(f)
-            tag = result.get("tag", None)
-            if tag != "ret":
-                raise RuntimeError("unexpected response from PREPL")
-            return result.get("val", None), result.get("exception", None)
+            while True:
+                line = f.readline()
+                result = json.loads(line)
+                tag = result.get("tag", None)
+                if tag == "ret":
+                    return result.get("val", None), result.get("exception", None)
+                elif tag == "out":
+                    print(result.get("val"), end="")
+                else:
+                    raise RuntimeError("unexpected response from PREPL")
 
 def encode(val):
     return json.dumps(json.dumps(val))
@@ -60,7 +65,7 @@ def print_error(res):
 
 def run_cmd(params):
     try:
-        expr = "(app.srepl.ext/run-json-cmd {})".format(encode(params))
+        expr = "(app.srepl.cli/exec {})".format(encode(params))
         res, failed = send_eval(expr)
         if failed:
             print_error(res)
@@ -140,6 +145,15 @@ def derive_password(password):
     res = run_cmd(params)
     print(f"Derived password: \"{res}\"")
 
+
+def migrate_components_v2():
+    params = {
+        "cmd": "migrate-v2",
+        "params": {}
+    }
+
+    run_cmd(params)
+
 available_commands = (
     "create-profile",
     "update-profile",
@@ -217,3 +231,5 @@ elif args.action == "search-profile":
         email = input("Email: ")
 
     search_profile(email)
+
+

backend/scripts/nrepl

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+clojure -J-Xms50m -J-Xmx256m -J-XX:+UseSerialGC -Sdeps '{:deps {reply/reply {:mvn/version "0.5.0"}}}' -M -m reply.main --attach localhost:6064 -e "(in-ns 'app.main)"

backend/scripts/repl

@@ -1,18 +1,18 @@
 #!/usr/bin/env bash
 
 export PENPOT_HOST=devenv
-export PENPOT_TENANT=dev
 export PENPOT_FLAGS="\
        $PENPOT_FLAGS \
-       enable-registration
+       enable-login-with-ldap \
        enable-login-with-password
        enable-login-with-oidc \
        enable-login-with-google \
        enable-login-with-github \
        enable-login-with-gitlab \
+       enable-backend-worker \
        enable-backend-asserts \
-       enable-fdata-storage-pointer-map \
-       enable-fdata-storage-objets-map \
+       enable-feature-fdata-pointer-map \
+       enable-feature-fdata-objects-map \
        enable-audit-log \
        enable-transit-readable-response \
        enable-demo-users \
@@ -22,9 +22,23 @@ export PENPOT_FLAGS="\
        enable-urepl-server \
        enable-rpc-climit \
        enable-rpc-rlimit \
+       enable-quotes \
        enable-soft-rpc-rlimit \
+       enable-auto-file-snapshot \
        enable-webhooks \
-       enable-access-tokens";
+       enable-access-tokens \
+       enable-tiered-file-data-storage \
+       enable-file-validation \
+       enable-file-schema-validation";
+
+# Default deletion delay for devenv
+export PENPOT_DELETION_DELAY="24h"
+
+# Setup default upload media file size to 100MiB
+export PENPOT_MEDIA_MAX_FILE_SIZE=104857600
+
+# Setup default multipart upload size to 300MiB
+export PENPOT_HTTP_SERVER_MAX_MULTIPART_BODY_SIZE=314572800
 
 # export PENPOT_DATABASE_URI="postgresql://172.17.0.1:5432/penpot"
 # export PENPOT_DATABASE_USERNAME="penpot"
@@ -39,32 +53,39 @@ export PENPOT_FLAGS="\
 # export PENPOT_AUDIT_LOG_ARCHIVE_URI="http://localhost:6070/api/audit"
 
 # Initialize MINIO config
-mc alias set penpot-s3/ http://minio:9000 minioadmin minioadmin
-mc admin user add penpot-s3 penpot-devenv penpot-devenv
-mc admin policy set penpot-s3 readwrite user=penpot-devenv
-mc mb penpot-s3/penpot -p
+mc alias set penpot-s3/ http://minio:9000 minioadmin minioadmin -q
+mc admin user add penpot-s3 penpot-devenv penpot-devenv -q
+mc admin user info penpot-s3 penpot-devenv |grep -F -q "readwrite"
+if [ "$?" = "1" ]; then
+    mc admin policy attach penpot-s3 readwrite --user=penpot-devenv -q
+fi
+mc mb penpot-s3/penpot -p -q
 
 export AWS_ACCESS_KEY_ID=penpot-devenv
 export AWS_SECRET_ACCESS_KEY=penpot-devenv
-export PENPOT_ASSETS_STORAGE_BACKEND=assets-s3
-export PENPOT_STORAGE_ASSETS_S3_ENDPOINT=http://minio:9000
-export PENPOT_STORAGE_ASSETS_S3_BUCKET=penpot
 
-#-J-Djdk.virtualThreadScheduler.parallelism=16
+export PENPOT_OBJECTS_STORAGE_BACKEND=s3
+export PENPOT_OBJECTS_STORAGE_S3_ENDPOINT=http://minio:9000
+export PENPOT_OBJECTS_STORAGE_S3_BUCKET=penpot
+export PENPOT_OBJECTS_STORAGE_FS_DIRECTORY="assets"
 
 export OPTIONS="
        -A:jmx-remote -A:dev \
        -J-Djava.util.logging.manager=org.apache.logging.log4j.jul.LogManager \
        -J-Djdk.attach.allowAttachSelf \
-       -J-Dlog4j2.configurationFile=log4j2-devenv.xml \
+       -J-Dpolyglot.engine.WarnInterpreterOnly=false \
+       -J-Dlog4j2.configurationFile=log4j2-devenv-repl.xml \
+       -J-XX:+EnableDynamicAgentLoading \
        -J-XX:-OmitStackTraceInFastThrow \
        -J-XX:+UnlockDiagnosticVMOptions \
        -J-XX:+DebugNonSafepoints \
-       -J-Djdk.tracePinnedThreads=full \
-       -J--enable-preview";
+       -J-Djdk.tracePinnedThreads=full"
+
+# Enable preview
+export OPTIONS="$OPTIONS -J--enable-preview"
 
 # Setup HEAP
-export OPTIONS="$OPTIONS -J-Xms50m -J-Xmx1024m"
+# export OPTIONS="$OPTIONS -J-Xms50m -J-Xmx1024m"
 # export OPTIONS="$OPTIONS -J-Xms1100m -J-Xmx1100m -J-XX:+AlwaysPreTouch"
 
 # Increase virtual thread pool size
@@ -77,7 +98,7 @@ export OPTIONS="$OPTIONS -J-Xms50m -J-Xmx1024m"
 # export OPTIONS="$OPTIONS -J-Xint"
 
 # Setup GC
-export OPTIONS="$OPTIONS -J-XX:+UseG1GC"
+# export OPTIONS="$OPTIONS -J-XX:+UseG1GC"
 
 # Setup GC
 # export OPTIONS="$OPTIONS -J-XX:+UseZGC"

backend/scripts/repl-test

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+
+source /home/penpot/environ
+export PENPOT_FLAGS="$PENPOT_FLAGS disable-backend-worker"
+
+export OPTIONS="
+       -A:jmx-remote -A:dev \
+       -J-Djava.util.logging.manager=org.apache.logging.log4j.jul.LogManager \
+       -J-Djdk.attach.allowAttachSelf \
+       -J-Dlog4j2.configurationFile=log4j2-experiments.xml \
+       -J-XX:-OmitStackTraceInFastThrow \
+       -J-XX:+UnlockDiagnosticVMOptions \
+       -J-XX:+DebugNonSafepoints \
+       -J-Djdk.tracePinnedThreads=full \
+       -J-XX:+UseTransparentHugePages \
+       -J-XX:ReservedCodeCacheSize=1g \
+       -J-Dpolyglot.engine.WarnInterpreterOnly=false \
+       -J--enable-preview";
+
+# Setup HEAP
+export OPTIONS="$OPTIONS -J-Xms320g -J-Xmx320g -J-XX:+AlwaysPreTouch"
+
+export PENPOT_HTTP_SERVER_IO_THREADS=2
+export PENPOT_HTTP_SERVER_WORKER_THREADS=2
+
+# Increase virtual thread pool size
+# export OPTIONS="$OPTIONS -J-Djdk.virtualThreadScheduler.parallelism=16"
+
+# Disable C2 Compiler
+# export OPTIONS="$OPTIONS -J-XX:TieredStopAtLevel=1"
+
+# Disable all compilers
+# export OPTIONS="$OPTIONS -J-Xint"
+
+# Setup GC
+export OPTIONS="$OPTIONS -J-XX:+UseG1GC -J-Xlog:gc:logs/gc.log"
+
+# Setup GC
+#export OPTIONS="$OPTIONS -J-XX:+UseZGC -J-XX:+ZGenerational -J-Xlog:gc:logs/gc.log"
+
+# Enable ImageMagick v7.x support
+# export OPTIONS="-J-Dim4java.useV7=true $OPTIONS";
+
+export OPTIONS_EVAL="nil"
+# export OPTIONS_EVAL="(set! *warn-on-reflection* true)"
+
+set -ex
+exec clojure $OPTIONS -M -e "$OPTIONS_EVAL" -m rebel-readline.main

backend/scripts/run.template.sh

@@ -18,7 +18,9 @@ if [ -f ./environ ]; then
     source ./environ
 fi
 
-export JVM_OPTS="-Djava.util.logging.manager=org.apache.logging.log4j.jul.LogManager -Dlog4j2.configurationFile=log4j2.xml -XX:-OmitStackTraceInFastThrow --enable-preview $JVM_OPTS"
+export JVM_OPTS="-Djava.util.logging.manager=org.apache.logging.log4j.jul.LogManager -Dlog4j2.configurationFile=log4j2.xml -XX:-OmitStackTraceInFastThrow -Dpolyglot.engine.WarnInterpreterOnly=false --enable-preview $JVM_OPTS"
 
-set -x
-exec $JAVA_CMD $JVM_OPTS "$@" -jar penpot.jar -m app.main
+ENTRYPOINT=${1:-app.main};
+
+set -ex
+exec $JAVA_CMD $JVM_OPTS -jar penpot.jar -m $ENTRYPOINT

backend/scripts/start-dev

@@ -1,38 +1,69 @@
 #!/usr/bin/env bash
 
 export PENPOT_HOST=devenv
-export PENPOT_TENANT=dev
 export PENPOT_FLAGS="\
        $PENPOT_FLAGS \
        enable-prepl-server \
        enable-urepl-server \
+       enable-nrepl-server \
        enable-webhooks \
        enable-backend-asserts \
        enable-audit-log \
+       enable-login-with-ldap \
        enable-transit-readable-response \
        enable-demo-users \
-       enable-fdata-storage-pointer-map \
-       enable-fdata-storage-objets-map \
+       enable-feature-fdata-pointer-map \
+       enable-feature-fdata-objects-map \
        disable-secure-session-cookies \
+       enable-rpc-climit \
        enable-smtp \
-       enable-webhooks";
+       enable-quotes \
+       enable-file-snapshot \
+       enable-access-tokens \
+       enable-tiered-file-data-storage \
+       enable-file-validation \
+       enable-file-schema-validation";
+
+export OPTIONS="
+       -A:jmx-remote -A:dev \
+       -J-Djava.util.logging.manager=org.apache.logging.log4j.jul.LogManager \
+       -J-Djdk.attach.allowAttachSelf \
+       -J-Dpolyglot.engine.WarnInterpreterOnly=false \
+       -J-Dlog4j2.configurationFile=log4j2-devenv.xml \
+       -J-XX:+EnableDynamicAgentLoading \
+       -J-XX:-OmitStackTraceInFastThrow \
+       -J-XX:+UnlockDiagnosticVMOptions \
+       -J-XX:+DebugNonSafepoints"
+
+# Default deletion delay for devenv
+export PENPOT_DELETION_DELAY="24h"
+
+# Setup default upload media file size to 100MiB
+export PENPOT_MEDIA_MAX_FILE_SIZE=104857600
+
+# Setup default multipart upload size to 300MiB
+export PENPOT_HTTP_SERVER_MAX_MULTIPART_BODY_SIZE=314572800
+
+# Enable ImageMagick v7.x support
+# export OPTIONS="-J-Dim4java.useV7=true $OPTIONS";
+
+# Initialize MINIO config
+mc alias set penpot-s3/ http://minio:9000 minioadmin minioadmin -q
+mc admin user add penpot-s3 penpot-devenv penpot-devenv -q
+mc admin user info penpot-s3 penpot-devenv |grep -F -q "readwrite"
+if [ "$?" = "1" ]; then
+    mc admin policy attach penpot-s3 readwrite --user=penpot-devenv -q
+fi
+mc mb penpot-s3/penpot -p -q
+
+export AWS_ACCESS_KEY_ID=penpot-devenv
+export AWS_SECRET_ACCESS_KEY=penpot-devenv
+export PENPOT_OBJECTS_STORAGE_BACKEND=s3
+export PENPOT_OBJECTS_STORAGE_S3_ENDPOINT=http://minio:9000
+export PENPOT_OBJECTS_STORAGE_S3_BUCKET=penpot
+
+entrypoint=${1:-app.main};
 
 set -ex
 
-if [ "$1" = "--watch" ]; then
-    echo "Start Watch..."
-
-    clojure -A:dev -M -m app.main &
-    PID=$!
-
-    npx nodemon \
-        --watch src \
-        --watch ../common \
-        --ext "clj" \
-        --signal SIGKILL \
-        --exec 'echo "(user/restart)" | nc -N localhost 6062'
-
-    kill -9 $PID
-else
-    clojure -A:dev -M -m app.main
-fi
+clojure $OPTIONS -A:dev -M -m $entrypoint;

backend/src/app/auth.clj

@@ -6,14 +6,13 @@
 
 (ns app.auth
   (:require
-   [buddy.hashers :as hashers]
-   [promesa.exec :as px]))
+   [buddy.hashers :as hashers]))
 
 (def default-params
   {:alg :argon2id
-   :memory (* 32768 2)
-   :iterations 5
-   :parallelism (px/get-available-processors)})
+   :memory 32768 ;; 32 MiB
+   :iterations 3
+   :parallelism 2})
 
 (defn derive-password
   [password]
@@ -26,4 +25,3 @@
     (catch Throwable _
       {:update false
        :valid false})))
-

backend/src/app/auth/ldap.clj

@@ -8,10 +8,8 @@
   (:require
    [app.common.exceptions :as ex]
    [app.common.logging :as l]
-   [app.common.spec :as us]
-   [app.config :as cf]
+   [app.common.schema :as sm]
    [clj-ldap.client :as ldap]
-   [clojure.spec.alpha :as s]
    [clojure.string]
    [integrant.core :as ig]))
 
@@ -59,21 +57,26 @@
        :email    email
        :backend  "ldap"})))
 
-(s/def ::fullname ::us/not-empty-string)
-(s/def ::email ::us/email)
-(s/def ::backend ::us/not-empty-string)
+(def ^:private schema:info-data
+  [:map
+   [:fullname ::sm/text]
+   [:email ::sm/email]
+   [:backend ::sm/text]])
 
-(s/def ::info-data
-  (s/keys :req-un [::fullname ::email ::backend]))
+(def ^:private valid-info-data?
+  (sm/lazy-validator schema:info-data))
+
+(def ^:private explain-info-data
+  (sm/lazy-explainer schema:info-data))
 
 (defn authenticate
   [cfg params]
   (with-open [conn (connect cfg)]
     (when-let [user (-> (assoc cfg ::conn conn)
                         (retrieve-user params))]
-      (when-not (s/valid? ::info-data user)
-        (let [explain (s/explain-str ::info-data user)]
-          (l/warn ::l/raw (str "invalid response from ldap, looks like ldap is not configured correctly\n" explain))
+      (when-not (valid-info-data? user)
+        (let [explain (explain-info-data user)]
+          (l/warn :hint "invalid response from ldap, looks like ldap is not configured correctly" :data user)
           (ex/raise :type :restriction
                     :code :wrong-ldap-response
                     :explain explain)))
@@ -103,37 +106,31 @@
                  :host (:host cfg) :port (:port cfg) :cause cause)
         nil))))
 
-(s/def ::enabled? ::us/boolean)
-(s/def ::host ::cf/ldap-host)
-(s/def ::port ::cf/ldap-port)
-(s/def ::ssl ::cf/ldap-ssl)
-(s/def ::tls ::cf/ldap-starttls)
-(s/def ::query ::cf/ldap-user-query)
-(s/def ::base-dn ::cf/ldap-base-dn)
-(s/def ::bind-dn ::cf/ldap-bind-dn)
-(s/def ::bind-password ::cf/ldap-bind-password)
-(s/def ::attrs-email ::cf/ldap-attrs-email)
-(s/def ::attrs-fullname ::cf/ldap-attrs-fullname)
-(s/def ::attrs-username ::cf/ldap-attrs-username)
+(def ^:private schema:params
+  [:map
+   [:host {:optional true} :string]
+   [:port {:optional true} ::sm/int]
+   [:bind-dn {:optional true} :string]
+   [:bind-passwor {:optional true} :string]
+   [:query {:optional true} :string]
+   [:base-dn {:optional true} :string]
+   [:attrs-email {:optional true} :string]
+   [:attrs-username {:optional true} :string]
+   [:attrs-fullname {:optional true} :string]
+   [:ssl {:optional true} ::sm/boolean]
+   [:tls {:optional true} ::sm/boolean]])
 
-(s/def ::provider-params
-  (s/keys :opt-un [::host ::port
-                   ::ssl ::tls
-                   ::enabled?
-                   ::bind-dn
-                   ::bind-password
-                   ::query
-                   ::attrs-email
-                   ::attrs-username
-                   ::attrs-fullname]))
-(s/def ::provider
-  (s/nilable ::provider-params))
+(def ^:private check-params
+  (sm/check-fn schema:params :hint "Invalid LDAP provider parameters"))
 
-(defmethod ig/pre-init-spec ::provider
-  [_]
-  (s/spec ::provider))
+(defmethod ig/assert-key ::provider
+  [_ params]
+  (when (:enabled params)
+    (some->> params check-params)))
 
 (defmethod ig/init-key ::provider
   [_ cfg]
-  (when (:enabled? cfg)
+  (when (:enabled cfg)
     (try-connectivity cfg)))
+
+(sm/register! ::provider schema:params)

backend/src/app/auth/oidc.clj

@@ -12,29 +12,36 @@
    [app.common.data.macros :as dm]
    [app.common.exceptions :as ex]
    [app.common.logging :as l]
-   [app.common.spec :as us]
+   [app.common.schema :as sm]
    [app.common.uri :as u]
    [app.config :as cf]
    [app.db :as db]
+   [app.email.blacklist :as email.blacklist]
+   [app.email.whitelist :as email.whitelist]
    [app.http.client :as http]
+   [app.http.errors :as errors]
    [app.http.session :as session]
    [app.loggers.audit :as audit]
-   [app.main :as-alias main]
+   [app.rpc :as rpc]
    [app.rpc.commands.profile :as profile]
+   [app.setup :as-alias setup]
    [app.tokens :as tokens]
+   [app.util.inet :as inet]
    [app.util.json :as json]
    [app.util.time :as dt]
+   [buddy.sign.jwk :as jwk]
+   [buddy.sign.jwt :as jwt]
    [clojure.set :as set]
-   [clojure.spec.alpha :as s]
    [cuerdas.core :as str]
    [integrant.core :as ig]
-   [yetti.response :as-alias yrs]))
+   [yetti.request :as yreq]
+   [yetti.response :as-alias yres]))
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; HELPERS
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
-(defn- obfuscate-string
+(defn obfuscate-string
   [s]
   (if (< (count s) 10)
     (apply str (take (count s) (repeat "*")))
@@ -47,36 +54,29 @@
 
 (defn- discover-oidc-config
   [cfg {:keys [base-uri] :as opts}]
-  (let [discovery-uri (u/join base-uri ".well-known/openid-configuration")
-        response      (ex/try! (http/req! cfg
-                                          {:method :get :uri (str discovery-uri)}
-                                          {:sync? true}))]
-    (cond
-      (ex/exception? response)
-      (do
-        (l/warn :hint "unable to discover oidc configuration"
-                :discover-uri (str discovery-uri)
-                :cause response)
-        nil)
-
-      (= 200 (:status response))
-      (let [data      (json/decode (:body response))
+  (let [uri (dm/str (u/join base-uri ".well-known/openid-configuration"))
+        rsp (http/req! cfg {:method :get :uri uri} {:sync? true})]
+    (if (= 200 (:status rsp))
+      (let [data      (-> rsp :body json/decode)
             token-uri (get data :token_endpoint)
             auth-uri  (get data :authorization_endpoint)
-            user-uri  (get data :userinfo_endpoint)]
+            user-uri  (get data :userinfo_endpoint)
+            jwks-uri  (get data :jwks_uri)]
+
         (l/debug :hint "oidc uris discovered"
                  :token-uri token-uri
                  :auth-uri auth-uri
-                 :user-uri user-uri)
+                 :user-uri user-uri
+                 :jwks-uri jwks-uri)
+
         {:token-uri token-uri
          :auth-uri  auth-uri
-         :user-uri  user-uri})
-
-      :else
+         :user-uri  user-uri
+         :jwks-uri jwks-uri})
       (do
         (l/warn :hint "unable to discover OIDC configuration"
-                :uri (str discovery-uri)
-                :response-status-code (:status response))
+                :discover-uri uri
+                :http-status (:status rsp))
         nil))))
 
 (defn- prepare-oidc-opts
@@ -87,6 +87,7 @@
               :token-uri     (cf/get :oidc-token-uri)
               :auth-uri      (cf/get :oidc-auth-uri)
               :user-uri      (cf/get :oidc-user-uri)
+              :jwks-uri      (cf/get :oidc-jwks-uri)
               :scopes        (cf/get :oidc-scopes #{"openid" "profile" "email"})
               :roles-attr    (cf/get :oidc-roles-attr)
               :roles         (cf/get :oidc-roles)
@@ -101,29 +102,65 @@
                (string? (:user-uri opts))
                (string? (:auth-uri opts)))
         opts
-        (some-> (discover-oidc-config cfg opts)
-                (merge opts {:discover? true}))))))
+        (try
+          (-> (discover-oidc-config cfg opts)
+              (merge opts {:discover? true}))
+          (catch Throwable cause
+            (l/warn :hint "unable to discover OIDC configuration"
+                    :cause cause)))))))
 
-(defmethod ig/pre-init-spec ::providers/generic [_]
-  (s/keys :req [::http/client]))
+(defn- process-oidc-jwks
+  [keys]
+  (reduce (fn [result {:keys [kid] :as kdata}]
+            (let [pkey (ex/try! (jwk/public-key kdata))]
+              (if (ex/exception? pkey)
+                (do
+                  (l/warn :hint "unable to create public key"
+                          :kid (:kid kdata)
+                          :cause pkey)
+                  result)
+                (assoc result kid pkey))))
+          {}
+          keys))
+
+(defn- fetch-oidc-jwks
+  [cfg {:keys [jwks-uri]}]
+  (when jwks-uri
+    (try
+      (let [{:keys [status body]} (http/req! cfg {:method :get :uri jwks-uri} {:sync? true})]
+        (if (= 200 status)
+          (-> body json/decode :keys process-oidc-jwks)
+          (do
+            (l/warn :hint "unable to retrieve JWKs (unexpected response status code)"
+                    :response-status status
+                    :response-body  body)
+            nil)))
+      (catch Throwable cause
+        (l/warn :hint "unable to retrieve JWKs (unexpected exception)"
+                :cause cause)))))
+
+(defmethod ig/assert-key ::providers/generic
+  [_ params]
+  (assert (http/client? (::http/client params)) "expected a valid http client"))
 
 (defmethod ig/init-key ::providers/generic
   [_ cfg]
   (when (contains? cf/flags :login-with-oidc)
     (if-let [opts (prepare-oidc-opts cfg)]
-      (do
-        (l/info :hint "provider initialized"
-                :provider "oidc"
-                :method (if (:discover? opts) "discover" "manual")
-                :client-id (:client-id opts)
-                :client-secret (obfuscate-string (:client-secret opts))
-                :scopes     (str/join "," (:scopes opts))
-                :auth-uri   (:auth-uri opts)
-                :user-uri   (:user-uri opts)
-                :token-uri  (:token-uri opts)
-                :roles-attr (:roles-attr opts)
-                :roles      (:roles opts))
-        opts)
+      (let [jwks (fetch-oidc-jwks cfg opts)]
+        (l/inf :hint "provider initialized"
+               :provider "oidc"
+               :method (if (:discover? opts) "discover" "manual")
+               :client-id (:client-id opts)
+               :client-secret (obfuscate-string (:client-secret opts))
+               :scopes     (str/join "," (:scopes opts))
+               :auth-uri   (:auth-uri opts)
+               :user-uri   (:user-uri opts)
+               :token-uri  (:token-uri opts)
+               :roles-attr (:roles-attr opts)
+               :roles      (:roles opts)
+               :keys       (str/join "," (map str (keys jwks))))
+        (assoc opts :jwks jwks))
       (do
         (l/warn :hint "unable to initialize auth provider, missing configuration" :provider "oidc")
         nil))))
@@ -146,10 +183,10 @@
       (if (and (string? (:client-id opts))
                (string? (:client-secret opts)))
         (do
-          (l/info :hint "provider initialized"
-                  :provider "google"
-                  :client-id (:client-id opts)
-                  :client-secret (obfuscate-string (:client-secret opts)))
+          (l/inf :hint "provider initialized"
+                 :provider "google"
+                 :client-id (:client-id opts)
+                 :client-secret (obfuscate-string (:client-secret opts)))
           opts)
 
         (do
@@ -160,27 +197,33 @@
 ;; GITHUB AUTH PROVIDER
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
+(defn- int-in-range?
+  [val start end]
+  (and (<= start val) (< val end)))
+
 (defn- retrieve-github-email
   [cfg tdata props]
   (or (some-> props :github/email)
       (let [params {:uri "https://api.github.com/user/emails"
-                    :headers {"Authorization" (dm/str (:type tdata) " " (:token tdata))}
+                    :headers {"Authorization" (dm/str (:token/type tdata) " " (:token/access tdata))}
                     :timeout 6000
                     :method :get}
 
             {:keys [status body]} (http/req! cfg params {:sync? true})]
 
-        (when-not (s/int-in-range? 200 300 status)
+        (when-not (int-in-range? status 200 300)
           (ex/raise :type :internal
                     :code :unable-to-retrieve-github-emails
                     :hint "unable to retrieve github emails"
-                    :http-status status
-                    :http-body body))
+                    :request-uri (:uri params)
+                    :response-status status
+                    :response-body body))
 
         (->> body json/decode (filter :primary) first :email))))
 
-(defmethod ig/pre-init-spec ::providers/github [_]
-  (s/keys :req [::http/client]))
+(defmethod ig/assert-key ::providers/github
+  [_ params]
+  (assert (http/client? (::http/client params)) "expected a valid http client"))
 
 (defmethod ig/init-key ::providers/github
   [_ cfg]
@@ -200,10 +243,10 @@
       (if (and (string? (:client-id opts))
                (string? (:client-secret opts)))
         (do
-          (l/info :hint "provider initialized"
-                  :provider "github"
-                  :client-id (:client-id opts)
-                  :client-secret (obfuscate-string (:client-secret opts)))
+          (l/inf :hint "provider initialized"
+                 :provider "github"
+                 :client-id (:client-id opts)
+                 :client-secret (obfuscate-string (:client-secret opts)))
           opts)
 
         (do
@@ -215,7 +258,7 @@
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
 (defmethod ig/init-key ::providers/gitlab
-  [_ _]
+  [_ cfg]
   (let [base (cf/get :gitlab-base-uri "https://gitlab.com")
         opts {:base-uri      base
               :client-id     (cf/get :gitlab-client-id)
@@ -224,17 +267,18 @@
               :auth-uri      (str base "/oauth/authorize")
               :token-uri     (str base "/oauth/token")
               :user-uri      (str base "/oauth/userinfo")
+              :jwks-uri      (str base "/oauth/discovery/keys")
               :name          "gitlab"}]
     (when (contains? cf/flags :login-with-gitlab)
       (if (and (string? (:client-id opts))
                (string? (:client-secret opts)))
-        (do
-          (l/info :hint "provider initialized"
-                  :provider "gitlab"
-                  :base-uri base
-                  :client-id (:client-id opts)
-                  :client-secret (obfuscate-string (:client-secret opts)))
-          opts)
+        (let [jwks (fetch-oidc-jwks cfg opts)]
+          (l/inf :hint "provider initialized"
+                 :provider "gitlab"
+                 :base-uri base
+                 :client-id (:client-id opts)
+                 :client-secret (obfuscate-string (:client-secret opts)))
+          (assoc opts :jwks jwks))
 
         (do
           (l/warn :hint "unable to initialize auth provider, missing configuration" :provider "gitlab")
@@ -250,12 +294,12 @@
     (into [(keyword (:name provider) fitem)] (map keyword) items)))
 
 (defn- build-redirect-uri
-  [{:keys [provider] :as cfg}]
+  [{:keys [::provider] :as cfg}]
   (let [public (u/uri (cf/get :public-uri))]
     (str (assoc public :path (str "/api/auth/oauth/" (:name provider) "/callback")))))
 
 (defn- build-auth-uri
-  [{:keys [provider] :as cfg} state]
+  [{:keys [::provider] :as cfg} state]
   (let [params {:client_id (:client-id provider)
                 :redirect_uri (build-redirect-uri cfg)
                 :response_type "code"
@@ -266,15 +310,19 @@
         (assoc :query query)
         (str))))
 
+(defn- qualify-prop-key
+  [provider k]
+  (keyword (:name provider) (name k)))
+
 (defn- qualify-props
   [provider props]
   (reduce-kv (fn [result k v]
-               (assoc result (keyword (:name provider) (name k)) v))
+               (assoc result (qualify-prop-key provider k) v))
              {}
              props))
 
-(defn retrieve-access-token
-  [{:keys [provider] :as cfg} code]
+(defn- fetch-access-token
+  [{:keys [::provider] :as cfg} code]
   (let [params {:client_id (:client-id provider)
                 :client_secret (:client-secret provider)
                 :code code
@@ -286,32 +334,37 @@
                 :uri (:token-uri provider)
                 :body (u/map->query-string params)}]
 
-    (l/trace :hint "request access token"
-             :provider (:name provider)
-             :client-id (:client-id provider)
-             :client-secret (obfuscate-string (:client-secret provider))
-             :grant-type (:grant_type params)
-             :redirect-uri (:redirect_uri params))
+    (l/trc :hint "fetch access token"
+           :provider (:name provider)
+           :client-id (:client-id provider)
+           :client-secret (obfuscate-string (:client-secret provider))
+           :grant-type (:grant_type params)
+           :redirect-uri (:redirect_uri params))
 
     (let [{:keys [status body]} (http/req! cfg req {:sync? true})]
-      (l/trace :hint "access token response" :status status :body body)
+      (l/trc :hint "access token fetched" :status status :body body)
       (if (= status 200)
-        (let [data (json/decode body)]
-          {:token (get data :access_token)
-           :type (get data :token_type)})
-
+        (let [data (json/decode body)
+              data {:token/access (get data :access_token)
+                    :token/id     (get data :id_token)
+                    :token/type   (get data :token_type)}]
+          (l/trc :hint "access token fetched"
+                 :token-id (:token/id data)
+                 :token-type (:token/type data)
+                 :token (:token/access data))
+          data)
         (ex/raise :type :internal
-                  :code :unable-to-retrieve-token
-                  :hint "unable to retrieve token"
-                  :http-status status
-                  :http-body body)))))
+                  :code :unable-to-fetch-access-token
+                  :hint "unable to fetch access token"
+                  :request-uri (:uri req)
+                  :response-status status
+                  :response-body body)))))
 
-(defn- retrieve-user-info
-  [{:keys [provider] :as cfg} tdata]
+(defn- process-user-info
+  [provider tdata info]
   (letfn [(get-email [props]
             ;; Allow providers hook into this for custom email
             ;; retrieval method.
-
             (if-let [get-email-fn (:get-email-fn provider)]
               (get-email-fn tdata props)
               (let [attr-kw (cf/get :oidc-email-attr "email")
@@ -321,73 +374,87 @@
           (get-name [props]
             (let [attr-kw (cf/get :oidc-name-attr "name")
                   attr-ph (parse-attr-path provider attr-kw)]
-              (get-in props attr-ph)))
+              (get-in props attr-ph)))]
 
-          (process-response [response]
-            (let [info  (-> response :body json/decode)
-                  props (qualify-props provider info)
-                  email (get-email props)]
-              {:backend  (:name provider)
-               :fullname (or (get-name props) email)
-               :email    email
-               :props    props}))]
+    (let [props (qualify-props provider info)
+          email (get-email props)]
+      {:backend  (:name provider)
+       :fullname (or (get-name props) email)
+       :email    email
+       :props    props})))
 
-    (l/trace :hint "request user info"
-             :uri (:user-uri provider)
-             :token (obfuscate-string (:token tdata))
-             :token-type (:type tdata))
+(defn- fetch-user-info
+  [{:keys [::provider] :as cfg} tdata]
+  (l/trc :hint "fetch user info"
+         :uri (:user-uri provider)
+         :token (obfuscate-string (:token/access tdata)))
 
-    (let [request  {:uri (:user-uri provider)
-                    :headers {"Authorization" (str (:type tdata) " " (:token tdata))}
-                    :timeout 6000
-                    :method :get}
-          response (http/req! cfg request {:sync? true})]
+  (let [params   {:uri (:user-uri provider)
+                  :headers {"Authorization" (str (:token/type tdata) " " (:token/access tdata))}
+                  :timeout 6000
+                  :method :get}
+        response (http/req! cfg params {:sync? true})]
 
-      (l/trace :hint "user info response"
-               :status (:status response)
-               :body   (:body response))
+    (l/trc :hint "user info response"
+           :status (:status response)
+           :body   (:body response))
 
-      (when-not (s/int-in-range? 200 300 (:status response))
-        (ex/raise :type :internal
-                  :code :unable-to-retrieve-user-info
-                  :hint "unable to retrieve user info"
-                  :http-status (:status response)
-                  :http-body (:body response)))
+    (when-not (int-in-range? (:status response) 200 300)
+      (ex/raise :type :internal
+                :code :unable-to-retrieve-user-info
+                :hint "unable to retrieve user info"
+                :http-status (:status response)
+                :http-body (:body response)))
 
-      (let [info (process-response response)]
-        (l/trace :hint "authentication info" :info info)
+    (-> response :body json/decode)))
 
-        (when-not (s/valid? ::info info)
-          (l/warn :hint "received incomplete profile info object (please set correct scopes)" :info info)
-          (ex/raise :type :internal
-                    :code :incomplete-user-info
-                    :hint "inconmplete user info"
-                    :info info))
-        info))))
+(defn- get-user-info
+  [{:keys [::provider]} tdata]
+  (try
+    (when (:token/id tdata)
+      (let [{:keys [kid alg] :as theader} (jwt/decode-header (:token/id tdata))]
+        (when-let [key (if (str/starts-with? (name alg) "hs")
+                         (:client-secret provider)
+                         (get-in provider [:jwks kid]))]
 
-(s/def ::backend ::us/not-empty-string)
-(s/def ::email ::us/not-empty-string)
-(s/def ::fullname ::us/not-empty-string)
-(s/def ::props (s/map-of ::us/keyword any?))
-(s/def ::info
-  (s/keys :req-un [::backend
-                   ::email
-                   ::fullname
-                   ::props]))
+          (let [claims (jwt/unsign (:token/id tdata) key {:alg alg})]
+            (dissoc claims :exp :iss :iat :sid :aud :sub)))))
+    (catch Throwable cause
+      (l/warn :hint "unable to get user info from JWT token (unexpected exception)"
+              :cause cause))))
 
-(defn get-info
-  [{:keys [provider] :as cfg} {:keys [params] :as request}]
-  (when-let [error (get params :error)]
-    (ex/raise :type :internal
-              :code :error-on-retrieving-code
-              :error-id error
-              :error-desc (get params :error_description)))
+(def ^:private schema:info
+  [:map
+   [:backend ::sm/text]
+   [:email ::sm/email]
+   [:fullname ::sm/text]
+   [:props [:map-of :keyword :any]]])
 
+(def ^:private valid-info?
+  (sm/validator schema:info))
+
+(defn- get-info
+  [{:keys [::provider ::setup/props] :as cfg} {:keys [params] :as request}]
   (let [state  (get params :state)
         code   (get params :code)
-        state  (tokens/verify (::main/props cfg) {:token state :iss :oauth})
-        token  (retrieve-access-token cfg code)
-        info   (retrieve-user-info cfg token)]
+        state  (tokens/verify props {:token state :iss :oauth})
+        tdata  (fetch-access-token cfg code)
+        info   (case (cf/get :oidc-user-info-source)
+                 :token (get-user-info cfg tdata)
+                 :userinfo (fetch-user-info cfg tdata)
+                 (or (get-user-info cfg tdata)
+                     (fetch-user-info cfg tdata)))
+
+        info   (process-user-info provider tdata info)]
+
+    (l/trc :hint "user info" :info info)
+
+    (when-not (valid-info? info)
+      (l/warn :hint "received incomplete profile info object (please set correct scopes)" :info info)
+      (ex/raise :type :internal
+                :code :incomplete-user-info
+                :hint "inconmplete user info"
+                :info info))
 
     ;; If the provider is OIDC, we can proceed to check
     ;; roles if they are defined.
@@ -413,91 +480,172 @@
       (some? (:invitation-token state))
       (assoc :invitation-token (:invitation-token state))
 
+      (some? (:external-session-id state))
+      (assoc :external-session-id (:external-session-id state))
+
       ;; If state token comes with props, merge them. The state token
       ;; props can contain pm_ and utm_ prefixed query params.
       (map? (:props state))
       (update :props merge (:props state)))))
 
 (defn- get-profile
-  [{:keys [::db/pool] :as cfg} info]
-  (dm/with-open [conn (db/open pool)]
-    (some->> (:email info)
-             (profile/get-profile-by-email conn))))
+  [cfg info]
+  (db/run! cfg (fn [{:keys [::db/conn]}]
+                 (some->> (:email info)
+                          (profile/clean-email)
+                          (profile/get-profile-by-email conn)))))
 
 (defn- redirect-response
   [uri]
-  {::yrs/status 302
-   ::yrs/headers {"location" (str uri)}})
+  {::yres/status 302
+   ::yres/headers {"location" (str uri)}})
+
+(defn- redirect-with-error
+  ([error] (redirect-with-error error nil))
+  ([error hint]
+   (let [params {:error error :hint hint}
+         params (d/without-nils params)
+         uri    (-> (u/uri (cf/get :public-uri))
+                    (assoc :path "/#/auth/login")
+                    (assoc :query (u/map->query-string params)))]
+     (redirect-response uri))))
+
+(defn- redirect-to-register
+  [cfg info request]
+  (let [info   (assoc info
+                      :iss :prepared-register
+                      :exp (dt/in-future {:hours 48}))
+
+        params {:token (tokens/generate (::setup/props cfg) info)
+                :provider (:provider (:path-params request))
+                :fullname (:fullname info)}
+        params (d/without-nils params)]
+
+    (redirect-response
+     (-> (u/uri (cf/get :public-uri))
+         (assoc :path "/#/auth/register/validate")
+         (assoc :query (u/map->query-string params))))))
+
+(defn- redirect-to-verify-token
+  [token]
+  (let [params {:token token}
+        uri    (-> (u/uri (cf/get :public-uri))
+                   (assoc :path "/#/auth/verify-token")
+                   (assoc :query (u/map->query-string params)))]
 
-(defn- generate-error-redirect
-  [_ error]
-  (let [uri (-> (u/uri (cf/get :public-uri))
-                (assoc :path "/#/auth/login")
-                (assoc :query (u/map->query-string {:error "unable-to-auth" :hint (ex-message error)})))]
     (redirect-response uri)))
 
-(defn- generate-redirect
+(defn- provider-has-email-verified?
+  [{:keys [::provider] :as cfg} {:keys [props] :as info}]
+  (let [prop (qualify-prop-key provider :email_verified)]
+    (true? (get props prop))))
+
+(defn- profile-has-provider-props?
+  [{:keys [::provider] :as cfg} profile]
+  (let [prop (qualify-prop-key provider :email)]
+    (contains? (:props profile) prop)))
+
+(defn- provider-matches-profile?
+  [{:keys [::provider] :as cfg} profile info]
+  (or (= (:auth-backend profile) (:name provider))
+      (profile-has-provider-props? cfg profile)
+      (provider-has-email-verified? cfg info)))
+
+(defn- process-callback
   [cfg request info profile]
-  (if profile
-    (let [sxf    (session/create-fn cfg (:id profile))
-          token  (or (:invitation-token info)
-                     (tokens/generate (::main/props cfg)
-                                      {:iss :auth
-                                       :exp (dt/in-future "15m")
-                                       :profile-id (:id profile)}))
-          params {:token token}
-          uri    (-> (u/uri (cf/get :public-uri))
-                     (assoc :path "/#/auth/verify-token")
-                     (assoc :query (u/map->query-string params)))]
+  (cond
+    (some? profile)
+    (cond
+      (:is-blocked profile)
+      (redirect-with-error "profile-blocked")
 
-      (when (:is-blocked profile)
-        (ex/raise :type :restriction
-                  :code :profile-blocked))
+      (not (provider-matches-profile? cfg profile info))
+      (redirect-with-error "auth-provider-not-allowed")
 
-      (audit/submit! cfg {::audit/type "command"
-                          ::audit/name "login-with-oidc"
-                          ::audit/profile-id (:id profile)
-                          ::audit/ip-addr (audit/parse-client-ip request)
-                          ::audit/props (audit/profile->props profile)})
+      (not (:is-active profile))
+      (let [info (assoc info :profile-id (:id profile))]
+        (redirect-to-register cfg info request))
 
-      (->> (redirect-response uri)
-           (sxf request)))
+      :else
+      (let [sxf     (session/create-fn cfg (:id profile))
+            token   (or (:invitation-token info)
+                        (tokens/generate (::setup/props cfg)
+                                         {:iss :auth
+                                          :exp (dt/in-future "15m")
+                                          :profile-id (:id profile)}))
+            props   (audit/profile->props profile)
+            context (d/without-nils {:external-session-id (:external-session-id info)})]
 
-    (let [info   (assoc info
-                        :iss :prepared-register
-                        :is-active true
-                        :exp (dt/in-future {:hours 48}))
-          token  (tokens/generate (::main/props cfg) info)
-          params (d/without-nils
-                  {:token token
-                   :fullname (:fullname info)})
-          uri    (-> (u/uri (cf/get :public-uri))
-                     (assoc :path "/#/auth/register/validate")
-                     (assoc :query (u/map->query-string params)))]
+        (audit/submit! cfg {::audit/type "action"
+                            ::audit/name "login-with-oidc"
+                            ::audit/profile-id (:id profile)
+                            ::audit/ip-addr (inet/parse-request request)
+                            ::audit/props props
+                            ::audit/context context})
 
-      (redirect-response uri))))
+        (->> (redirect-to-verify-token token)
+             (sxf request))))
+
+    (and (email.blacklist/enabled? cfg)
+         (email.blacklist/contains? cfg (:email info)))
+    (redirect-with-error "email-domain-not-allowed")
+
+    (and (email.whitelist/enabled? cfg)
+         (not (email.whitelist/contains? cfg (:email info))))
+    (redirect-with-error "email-domain-not-allowed")
+
+    :else
+    (let [info (assoc info :is-active (provider-has-email-verified? cfg info))]
+      (if (or (contains? cf/flags :registration)
+              (contains? cf/flags :oidc-registration))
+        (redirect-to-register cfg info request)
+        (redirect-with-error "registration-disabled")))))
+
+(defn- get-external-session-id
+  [request]
+  (let [session-id (yreq/get-header request "x-external-session-id")]
+    (when (string? session-id)
+      (if (or (> (count session-id) 256)
+              (= session-id "null")
+              (str/blank? session-id))
+        nil
+        session-id))))
 
 (defn- auth-handler
   [cfg {:keys [params] :as request}]
-  (let [props (audit/extract-utm-params params)
-        state (tokens/generate (::main/props cfg)
-                               {:iss :oauth
-                                :invitation-token (:invitation-token params)
-                                :props props
-                                :exp (dt/in-future "4h")})
-        uri   (build-auth-uri cfg state)]
-    {::yrs/status 200
-     ::yrs/body {:redirect-uri uri}}))
+  (let [props  (audit/extract-utm-params params)
+        esid   (rpc/get-external-session-id request)
+        params {:iss :oauth
+                :invitation-token (:invitation-token params)
+                :external-session-id esid
+                :props props
+                :exp (dt/in-future "4h")}
+        state  (tokens/generate (::setup/props cfg)
+                                (d/without-nils params))
+        uri    (build-auth-uri cfg state)]
+    {::yres/status 200
+     ::yres/body {:redirect-uri uri}}))
 
 (defn- callback-handler
-  [cfg request]
+  [{:keys [::provider] :as cfg} request]
   (try
-    (let [info    (get-info cfg request)
-          profile (get-profile cfg info)]
-      (generate-redirect cfg request info profile))
+    (if-let [error (dm/get-in request [:params :error])]
+      (redirect-with-error "unable-to-auth" error)
+      (let [info    (get-info cfg request)
+            profile (get-profile cfg info)]
+        (process-callback cfg request info profile)))
     (catch Throwable cause
-      (l/error :hint "error on oauth process" :cause cause)
-      (generate-error-redirect cfg cause))))
+      (binding [l/*context* (-> (errors/request->context request)
+                                (assoc :auth/provider (:name provider)))]
+        (let [edata (ex-data cause)]
+          (cond
+            (= :validation (:type edata))
+            (l/wrn :hint "invalid token received" :cause cause)
+
+            :else
+            (l/err :hint "error on oauth process" :cause cause))))
+
+      (redirect-with-error "unable-to-auth" (ex-message cause)))))
 
 (def provider-lookup
   {:compile
@@ -506,54 +654,43 @@
        (fn [request]
          (let [provider (some-> request :path-params :provider keyword)]
            (if-let [provider (get providers provider)]
-             (handler (assoc cfg :provider provider) request)
+             (handler (assoc cfg ::provider provider) request)
              (ex/raise :type :restriction
                        :code :provider-not-configured
                        :provider provider
                        :hint "provider not configured"))))))})
 
+(def ^:private schema:provider
+  [:map {:title "provider"}
+   [:client-id ::sm/text]
+   [:client-secret ::sm/text]
+   [:base-uri {:optional true} ::sm/text]
+   [:token-uri {:optional true} ::sm/text]
+   [:auth-uri {:optional true} ::sm/text]
+   [:user-uri {:optional true} ::sm/text]
+   [:scopes {:optional true}
+    [::sm/set ::sm/text]]
+   [:roles {:optional true}
+    [::sm/set ::sm/text]]
+   [:roles-attr {:optional true} ::sm/text]
+   [:email-attr {:optional true} ::sm/text]
+   [:name-attr {:optional true} ::sm/text]])
 
-(s/def ::client-id ::cf/oidc-client-id)
-(s/def ::client-secret ::cf/oidc-client-secret)
-(s/def ::base-uri ::cf/oidc-base-uri)
-(s/def ::token-uri ::cf/oidc-token-uri)
-(s/def ::auth-uri ::cf/oidc-auth-uri)
-(s/def ::user-uri ::cf/oidc-user-uri)
-(s/def ::scopes ::cf/oidc-scopes)
-(s/def ::roles ::cf/oidc-roles)
-(s/def ::roles-attr ::cf/oidc-roles-attr)
-(s/def ::email-attr ::cf/oidc-email-attr)
-(s/def ::name-attr ::cf/oidc-name-attr)
+(def ^:private schema:routes-params
+  [:map
+   ::session/manager
+   ::http/client
+   ::setup/props
+   ::db/pool
+   [::providers [:map-of :keyword [:maybe schema:provider]]]])
 
-;; FIXME: migrate to qualified-keywords
-(s/def ::provider
-  (s/keys :req-un [::client-id
-                   ::client-secret]
-          :opt-un [::base-uri
-                   ::token-uri
-                   ::auth-uri
-                   ::user-uri
-                   ::scopes
-                   ::roles
-                   ::roles-attr
-                   ::email-attr
-                   ::name-attr]))
-
-(s/def ::providers (s/map-of ::us/keyword (s/nilable ::provider)))
-
-(s/def ::routes vector?)
-
-(defmethod ig/pre-init-spec ::routes
-  [_]
-  (s/keys :req [::session/manager
-                ::http/client
-                ::main/props
-                ::db/pool
-                ::providers]))
+(defmethod ig/assert-key ::routes
+  [_ params]
+  (assert (sm/check schema:routes-params params)))
 
 (defmethod ig/init-key ::routes
   [_ cfg]
-  (let [cfg (update cfg :provider d/without-nils)]
+  (let [cfg (update cfg :providers d/without-nils)]
     ["" {:middleware [[session/authz cfg]
                       [provider-lookup cfg]]}
      ["/auth/oauth"

backend/src/app/binfile/common.clj

@@ -0,0 +1,510 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS INC
+
+(ns app.binfile.common
+  "A binfile related file processing common code, used for different
+  binfile format implementations and management rpc methods."
+  (:require
+   [app.common.data :as d]
+   [app.common.data.macros :as dm]
+   [app.common.exceptions :as ex]
+   [app.common.features :as cfeat]
+   [app.common.files.migrations :as fmg]
+   [app.common.files.validate :as fval]
+   [app.common.logging :as l]
+   [app.common.types.file :as ctf]
+   [app.common.uuid :as uuid]
+   [app.config :as cf]
+   [app.db :as db]
+   [app.db.sql :as sql]
+   [app.features.components-v2 :as feat.compv2]
+   [app.features.fdata :as feat.fdata]
+   [app.loggers.audit :as-alias audit]
+   [app.loggers.webhooks :as-alias webhooks]
+   [app.util.blob :as blob]
+   [app.util.pointer-map :as pmap]
+   [app.util.time :as dt]
+   [app.worker :as-alias wrk]
+   [clojure.set :as set]
+   [clojure.walk :as walk]
+   [cuerdas.core :as str]))
+
+(set! *warn-on-reflection* true)
+
+(def ^:dynamic *state* nil)
+(def ^:dynamic *options* nil)
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; DEFAULTS
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+;; Threshold in MiB when we pass from using
+;; in-memory byte-array's to use temporal files.
+(def temp-file-threshold
+  (* 1024 1024 2))
+
+;; A maximum (storage) object size allowed: 100MiB
+(def ^:const max-object-size
+  (* 1024 1024 100))
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+(def xf-map-id
+  (map :id))
+
+(def xf-map-media-id
+  (comp
+   (mapcat (juxt :media-id
+                 :thumbnail-id
+                 :woff1-file-id
+                 :woff2-file-id
+                 :ttf-file-id
+                 :otf-file-id))
+   (filter uuid?)))
+
+(def into-vec
+  (fnil into []))
+
+(def conj-vec
+  (fnil conj []))
+
+(defn initial-state
+  []
+  {:storage-objects #{}
+   :files #{}
+   :teams #{}
+   :projects #{}})
+
+(defn collect-storage-objects
+  [state items]
+  (update state :storage-objects into xf-map-media-id items))
+
+(defn collect-summary
+  [state key items]
+  (update state key into xf-map-media-id items))
+
+(defn lookup-index
+  [id]
+  (when id
+    (let [val (get-in @*state* [:index id])]
+      (l/trc :fn "lookup-index" :id (str id) :result (some-> val str) ::l/sync? true)
+      (or val id))))
+
+(defn remap-id
+  [item key]
+  (cond-> item
+    (contains? item key)
+    (update key lookup-index)))
+
+(defn- index-object
+  [index obj & attrs]
+  (reduce (fn [index attr-fn]
+            (let [old-id (attr-fn obj)
+                  new-id (if (::overwrite *options*) old-id (uuid/next))]
+              (assoc index old-id new-id)))
+          index
+          attrs))
+
+(defn update-index
+  ([coll]
+   (update-index {} coll identity))
+  ([index coll]
+   (update-index index coll identity))
+  ([index coll attr]
+   (reduce #(index-object %1 %2 attr) index coll)))
+
+(defn decode-row
+  "A generic decode row helper"
+  [{:keys [data features] :as row}]
+  (cond-> row
+    features (assoc :features (db/decode-pgarray features #{}))
+    data     (assoc :data (blob/decode data))))
+
+(defn get-file
+  [cfg file-id]
+  (db/run! cfg (fn [{:keys [::db/conn] :as cfg}]
+                 (binding [pmap/*load-fn* (partial feat.fdata/load-pointer cfg file-id)]
+                   (when-let [file (db/get* conn :file {:id file-id}
+                                            {::db/remove-deleted false})]
+                     (-> file
+                         (decode-row)
+                         (update :data feat.fdata/process-pointers deref)
+                         (update :data feat.fdata/process-objects (partial into {}))))))))
+
+(defn get-project
+  [cfg project-id]
+  (db/get cfg :project {:id project-id}))
+
+(def ^:private sql:get-teams
+  "SELECT t.* FROM team WHERE id = ANY(?)")
+
+(defn get-teams
+  [cfg ids]
+  (let [conn (db/get-connection cfg)
+        ids  (db/create-array conn "uuid" ids)]
+    (->> (db/exec! conn [sql:get-teams ids])
+         (map decode-row))))
+
+(defn get-team
+  [cfg team-id]
+  (-> (db/get cfg :team {:id team-id})
+      (decode-row)))
+
+(defn get-fonts
+  [cfg team-id]
+  (db/query cfg :team-font-variant
+            {:team-id team-id
+             :deleted-at nil}))
+
+(defn get-files-rels
+  "Given a set of file-id's, return all matching relations with the libraries"
+  [cfg ids]
+
+  (dm/assert!
+   "expected a set of uuids"
+   (and (set? ids)
+        (every? uuid? ids)))
+
+  (db/run! cfg (fn [{:keys [::db/conn]}]
+                 (let [ids (db/create-array conn "uuid" ids)
+                       sql (str "SELECT flr.* FROM file_library_rel AS flr "
+                                "  JOIN file AS l ON (flr.library_file_id = l.id) "
+                                " WHERE flr.file_id = ANY(?) AND l.deleted_at IS NULL")]
+                   (db/exec! conn [sql ids])))))
+
+(def ^:private sql:get-libraries
+  "WITH RECURSIVE libs AS (
+     SELECT fl.id
+       FROM file AS fl
+       JOIN file_library_rel AS flr ON (flr.library_file_id = fl.id)
+      WHERE flr.file_id = ANY(?)
+    UNION
+     SELECT fl.id
+       FROM file AS fl
+       JOIN file_library_rel AS flr ON (flr.library_file_id = fl.id)
+       JOIN libs AS l ON (flr.file_id = l.id)
+   )
+   SELECT DISTINCT l.id
+     FROM libs AS l")
+
+(defn get-libraries
+  "Get all libraries ids related to provided file ids"
+  [cfg ids]
+  (db/run! cfg (fn [{:keys [::db/conn]}]
+                 (let [ids' (db/create-array conn "uuid" ids)]
+                   (->> (db/exec! conn [sql:get-libraries ids'])
+                        (into #{} xf-map-id))))))
+
+(defn get-file-object-thumbnails
+  "Return all file object thumbnails for a given file."
+  [cfg file-id]
+  (->> (db/query cfg :file-tagged-object-thumbnail
+                 {:file-id file-id
+                  :deleted-at nil})
+       (not-empty)))
+
+(defn get-file-thumbnail
+  "Return the thumbnail for the specified file-id"
+  [cfg {:keys [id revn]}]
+  (db/get* cfg :file-thumbnail
+           {:file-id id
+            :revn revn
+            :data nil}
+           {::sql/columns [:media-id :file-id :revn]}))
+
+
+(def ^:private
+  xform:collect-media-id
+  (comp
+   (map :objects)
+   (mapcat vals)
+   (mapcat (fn [obj]
+             ;; NOTE: because of some bug, we ended with
+             ;; many shape types having the ability to
+             ;; have fill-image attribute (which initially
+             ;; designed for :path shapes).
+             (sequence
+              (keep :id)
+              (concat [(:fill-image obj)
+                       (:metadata obj)]
+                      (map :fill-image (:fills obj))
+                      (map :stroke-image (:strokes obj))
+                      (->> (:content obj)
+                           (tree-seq map? :children)
+                           (mapcat :fills)
+                           (map :fill-image))))))))
+
+(defn collect-used-media
+  "Given a fdata (file data), returns all media references."
+  [data]
+  (-> #{}
+      (into xform:collect-media-id (vals (:pages-index data)))
+      (into xform:collect-media-id (vals (:components data)))
+      (into (keys (:media data)))))
+
+(defn get-file-media
+  [cfg {:keys [data id] :as file}]
+  (db/run! cfg (fn [{:keys [::db/conn]}]
+                 (let [ids (collect-used-media data)
+                       ids (db/create-array conn "uuid" ids)
+                       sql (str "SELECT * FROM file_media_object WHERE id = ANY(?)")]
+
+                   ;; We assoc the file-id again to the file-media-object row
+                   ;; because there are cases that used objects refer to other
+                   ;; files and we need to ensure in the exportation process that
+                   ;; all ids matches
+                   (->> (db/exec! conn [sql ids])
+                        (mapv #(assoc % :file-id id)))))))
+
+(def ^:private sql:get-team-files-ids
+  "SELECT f.id FROM file AS f
+     JOIN project AS p ON (p.id = f.project_id)
+    WHERE p.team_id = ?")
+
+(defn get-team-files-ids
+  "Get a set of file ids for the specified team-id"
+  [{:keys [::db/conn]} team-id]
+  (->> (db/exec! conn [sql:get-team-files-ids team-id])
+       (into #{} xf-map-id)))
+
+(def ^:private sql:get-team-projects
+  "SELECT p.* FROM project AS p
+    WHERE p.team_id = ?
+      AND p.deleted_at IS NULL")
+
+(defn get-team-projects
+  "Get a set of project ids for the team"
+  [cfg team-id]
+  (->> (db/exec! cfg [sql:get-team-projects team-id])
+       (into #{} xf-map-id)))
+
+(def ^:private sql:get-project-files
+  "SELECT f.id FROM file AS f
+    WHERE f.project_id = ?
+      AND f.deleted_at IS NULL")
+
+(defn get-project-files
+  "Get a set of file ids for the project"
+  [{:keys [::db/conn]} project-id]
+  (->> (db/exec! conn [sql:get-project-files project-id])
+       (into #{} xf-map-id)))
+
+(defn remap-thumbnail-object-id
+  [object-id file-id]
+  (str/replace-first object-id #"^(.*?)/" (str file-id "/")))
+
+(defn- relink-shapes
+  "A function responsible to analyze all file data and
+  replace the old :component-file reference with the new
+  ones, using the provided file-index."
+  [data]
+  (letfn [(process-map-form [form]
+            (cond-> form
+              ;; Relink image shapes
+              (and (map? (:metadata form))
+                   (= :image (:type form)))
+              (update-in [:metadata :id] lookup-index)
+
+              ;; Relink paths with fill image
+              (map? (:fill-image form))
+              (update-in [:fill-image :id] lookup-index)
+
+              ;; This covers old shapes and the new :fills.
+              (uuid? (:fill-color-ref-file form))
+              (update :fill-color-ref-file lookup-index)
+
+              ;; This covers the old shapes and the new :strokes
+              (uuid? (:stroke-color-ref-file form))
+              (update :stroke-color-ref-file lookup-index)
+
+              ;; This covers all text shapes that have typography referenced
+              (uuid? (:typography-ref-file form))
+              (update :typography-ref-file lookup-index)
+
+              ;; This covers the component instance links
+              (uuid? (:component-file form))
+              (update :component-file lookup-index)
+
+              ;; This covers the shadows and grids (they have directly
+              ;; the :file-id prop)
+              (uuid? (:file-id form))
+              (update :file-id lookup-index)))
+
+          (process-form [form]
+            (if (map? form)
+              (try
+                (process-map-form form)
+                (catch Throwable cause
+                  (l/warn :hint "failed form" :form (pr-str form) ::l/sync? true)
+                  (throw cause)))
+              form))]
+
+    (walk/postwalk process-form data)))
+
+(defn- relink-media
+  "A function responsible of process the :media attr of file data and
+  remap the old ids with the new ones."
+  [media]
+  (reduce-kv (fn [res k v]
+               (let [id (lookup-index k)]
+                 (if (uuid? id)
+                   (-> res
+                       (assoc id (assoc v :id id))
+                       (dissoc k))
+                   res)))
+             media
+             media))
+
+(defn- relink-colors
+  "A function responsible of process the :colors attr of file data and
+  remap the old ids with the new ones."
+  [colors]
+  (reduce-kv (fn [res k v]
+               (if (:image v)
+                 (update-in res [k :image :id] lookup-index)
+                 res))
+             colors
+             colors))
+
+(defn embed-assets
+  [cfg data file-id]
+  (let [library-ids (get-libraries cfg [file-id])]
+    (reduce (fn [data library-id]
+              (let [library (get-file cfg library-id)]
+                (ctf/absorb-assets data (:data library))))
+            data
+            library-ids)))
+
+(defn disable-database-timeouts!
+  [cfg]
+  (let [conn (db/get-connection cfg)]
+    (db/exec-one! conn ["SET LOCAL idle_in_transaction_session_timeout = 0"])
+    (db/exec-one! conn ["SET CONSTRAINTS ALL DEFERRED"])))
+
+(defn- fix-version
+  [file]
+  (let [file (fmg/fix-version file)]
+    ;; FIXME: We're temporarily activating all migrations because a
+    ;; problem in the environments messed up with the version numbers
+    ;; When this problem is fixed delete the following line
+    (if (> (:version file) 22)
+      (assoc file :version 22)
+      file)))
+
+(defn process-file
+  [{:keys [id] :as file}]
+  (-> file
+      (fix-version)
+      (update :data (fn [fdata]
+                      (-> fdata
+                          (assoc :id id)
+                          (dissoc :recent-colors))))
+      (fmg/migrate-file)
+      (update :data (fn [fdata]
+                      (-> fdata
+                          (update :pages-index relink-shapes)
+                          (update :components relink-shapes)
+                          (update :media relink-media)
+                          (update :colors relink-colors)
+                          (d/without-nils))))))
+
+(defn- upsert-file!
+  [conn file]
+  (let [sql (str "INSERT INTO file (id, project_id, name, revn, version, is_shared, data, created_at, modified_at) "
+                 "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?) "
+                 "ON CONFLICT (id) DO UPDATE SET data=?, version=?")]
+    (db/exec-one! conn [sql
+                        (:id file)
+                        (:project-id file)
+                        (:name file)
+                        (:revn file)
+                        (:version file)
+                        (:is-shared file)
+                        (:data file)
+                        (:created-at file)
+                        (:modified-at file)
+                        (:data file)
+                        (:version file)])))
+
+(defn persist-file!
+  "Applies all the final validations and perist the file."
+  [{:keys [::db/conn ::timestamp] :as cfg} {:keys [id] :as file}]
+
+  (dm/assert!
+   "expected valid timestamp"
+   (dt/instant? timestamp))
+
+  (let [file   (-> file
+                   (assoc :created-at timestamp)
+                   (assoc :modified-at timestamp)
+                   (assoc :ignore-sync-until (dt/plus timestamp (dt/duration {:seconds 5})))
+                   (update :features
+                           (fn [features]
+                             (let [features (cfeat/check-supported-features! features)]
+                               (-> (::features cfg #{})
+                                   (set/difference cfeat/frontend-only-features)
+                                   (set/union features))))))
+
+        _      (when (contains? cf/flags :file-schema-validation)
+                 (fval/validate-file-schema! file))
+
+        _      (when (contains? cf/flags :soft-file-schema-validation)
+                 (let [result (ex/try! (fval/validate-file-schema! file))]
+                   (when (ex/exception? result)
+                     (l/error :hint "file schema validation error" :cause result))))
+
+        file   (if (contains? (:features file) "fdata/objects-map")
+                 (feat.fdata/enable-objects-map file)
+                 file)
+
+        file   (if (contains? (:features file) "fdata/pointer-map")
+                 (binding [pmap/*tracked* (pmap/create-tracked)]
+                   (let [file (feat.fdata/enable-pointer-map file)]
+                     (feat.fdata/persist-pointers! cfg id)
+                     file))
+                 file)
+
+        params (-> file
+                   (update :features db/encode-pgarray conn "text")
+                   (update :data blob/encode))]
+
+    (if (::overwrite cfg)
+      (upsert-file! conn params)
+      (db/insert! conn :file params ::db/return-keys false))
+
+    file))
+
+
+(defn register-pending-migrations
+  "All features that are enabled and requires explicit migration are
+  added to the state for a posterior migration step."
+  [cfg {:keys [id features] :as file}]
+  (doseq [feature (-> (::features cfg)
+                      (set/difference cfeat/no-migration-features)
+                      (set/difference cfeat/backend-only-features)
+                      (set/difference features))]
+    (vswap! *state* update :pending-to-migrate (fnil conj []) [feature id]))
+
+  file)
+
+
+(defn apply-pending-migrations!
+  "Apply alredy registered pending migrations to files"
+  [cfg]
+  (doseq [[feature file-id] (-> *state* deref :pending-to-migrate)]
+    (case feature
+      "components/v2"
+      (feat.compv2/migrate-file! cfg file-id
+                                 :validate? (::validate cfg true)
+                                 :skip-on-graphic-error? true)
+
+      "fdata/shape-data-type"
+      nil
+
+      (ex/raise :type :internal
+                :code :no-migration-defined
+                :hint (str/ffmt "no migation for feature '%' on file importation" feature)
+                :feature feature))))

backend/src/app/binfile/v1.clj

@@ -0,0 +1,767 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS INC
+
+(ns app.binfile.v1
+  "A custom, perfromance and efficiency focused binfile format impl"
+  (:refer-clojure :exclude [assert])
+  (:require
+   [app.binfile.common :as bfc]
+   [app.common.data :as d]
+   [app.common.data.macros :as dm]
+   [app.common.exceptions :as ex]
+   [app.common.features :as cfeat]
+   [app.common.fressian :as fres]
+   [app.common.logging :as l]
+   [app.common.spec :as us]
+   [app.common.types.file :as ctf]
+   [app.common.uuid :as uuid]
+   [app.config :as cf]
+   [app.db :as db]
+   [app.loggers.audit :as-alias audit]
+   [app.loggers.webhooks :as-alias webhooks]
+   [app.rpc :as-alias rpc]
+   [app.rpc.commands.teams :as teams]
+   [app.rpc.doc :as-alias doc]
+   [app.storage :as sto]
+   [app.storage.tmp :as tmp]
+   [app.tasks.file-gc]
+   [app.util.events :as events]
+   [app.util.time :as dt]
+   [app.worker :as-alias wrk]
+   [clojure.java.io :as jio]
+   [clojure.set :as set]
+   [clojure.spec.alpha :as s]
+   [cuerdas.core :as str]
+   [datoteka.io :as io]
+   [promesa.util :as pu]
+   [yetti.adapter :as yt])
+  (:import
+   com.github.luben.zstd.ZstdIOException
+   com.github.luben.zstd.ZstdInputStream
+   com.github.luben.zstd.ZstdOutputStream
+   java.io.DataInputStream
+   java.io.DataOutputStream
+   java.io.InputStream
+   java.io.OutputStream))
+
+(set! *warn-on-reflection* true)
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; LOW LEVEL STREAM IO API
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+(def ^:const buffer-size (:xnio/buffer-size yt/defaults))
+(def ^:const penpot-magic-number 800099563638710213)
+
+(def ^:dynamic *position* nil)
+
+(defn get-mark
+  [id]
+  (case id
+    :header  1
+    :stream  2
+    :uuid    3
+    :label   4
+    :obj     5
+    (ex/raise :type :validation
+              :code :invalid-mark-id
+              :hint (format "invalid mark id %s" id))))
+
+(defmacro assert
+  [expr hint]
+  `(when-not ~expr
+     (ex/raise :type :validation
+               :code :unexpected-condition
+               :hint ~hint)))
+
+(defmacro assert-mark
+  [v type]
+  `(let [expected# (get-mark ~type)
+         val#      (long ~v)]
+     (when (not= val# expected#)
+       (ex/raise :type :validation
+                 :code :unexpected-mark
+                 :hint (format "received mark %s, expected %s" val# expected#)))))
+
+(defmacro assert-label
+  [expr label]
+  `(let [v# ~expr]
+     (when (not= v# ~label)
+       (ex/raise :type :assertion
+                 :code :unexpected-label
+                 :hint (format "received label %s, expected %s" v# ~label)))))
+
+;; --- PRIMITIVE IO
+
+(defn write-byte!
+  [^DataOutputStream output data]
+  (l/trace :fn "write-byte!" :data data :position @*position* ::l/sync? true)
+  (.writeByte output (byte data))
+  (swap! *position* inc))
+
+(defn read-byte!
+  [^DataInputStream input]
+  (let [v (.readByte input)]
+    (l/trace :fn "read-byte!" :val v :position @*position* ::l/sync? true)
+    (swap! *position* inc)
+    v))
+
+(defn write-long!
+  [^DataOutputStream output data]
+  (l/trace :fn "write-long!" :data data :position @*position* ::l/sync? true)
+  (.writeLong output (long data))
+  (swap! *position* + 8))
+
+(defn read-long!
+  [^DataInputStream input]
+  (let [v (.readLong input)]
+    (l/trace :fn "read-long!" :val v :position @*position* ::l/sync? true)
+    (swap! *position* + 8)
+    v))
+
+(defn write-bytes!
+  [^DataOutputStream output ^bytes data]
+  (let [size (alength data)]
+    (l/trace :fn "write-bytes!" :size size :position @*position* ::l/sync? true)
+    (.write output data 0 size)
+    (swap! *position* + size)))
+
+(defn read-bytes!
+  [^InputStream input ^bytes buff]
+  (let [size   (alength buff)
+        readed (.readNBytes input buff 0 size)]
+    (l/trace :fn "read-bytes!" :expected (alength buff) :readed readed :position @*position* ::l/sync? true)
+    (swap! *position* + readed)
+    readed))
+
+;; --- COMPOSITE IO
+
+(defn write-uuid!
+  [^DataOutputStream output id]
+  (l/trace :fn "write-uuid!" :position @*position* :WRITTEN? (.size output) ::l/sync? true)
+
+  (doto output
+    (write-byte! (get-mark :uuid))
+    (write-long! (uuid/get-word-high id))
+    (write-long! (uuid/get-word-low id))))
+
+(defn read-uuid!
+  [^DataInputStream input]
+  (l/trace :fn "read-uuid!" :position @*position* ::l/sync? true)
+  (let [m (read-byte! input)]
+    (assert-mark m :uuid)
+    (let [a (read-long! input)
+          b (read-long! input)]
+      (uuid/custom a b))))
+
+(defn write-obj!
+  [^DataOutputStream output data]
+  (l/trace :fn "write-obj!" :position @*position* ::l/sync? true)
+  (let [^bytes data (fres/encode data)]
+    (doto output
+      (write-byte! (get-mark :obj))
+      (write-long! (alength data))
+      (write-bytes! data))))
+
+(defn read-obj!
+  [^DataInputStream input]
+  (l/trace :fn "read-obj!" :position @*position* ::l/sync? true)
+  (let [m (read-byte! input)]
+    (assert-mark m :obj)
+    (let [size (read-long! input)]
+      (assert (pos? size) "incorrect header size found on reading header")
+      (let [buff (byte-array size)]
+        (read-bytes! input buff)
+        (fres/decode buff)))))
+
+(defn write-label!
+  [^DataOutputStream output label]
+  (l/trace :fn "write-label!" :label label :position @*position* ::l/sync? true)
+  (doto output
+    (write-byte! (get-mark :label))
+    (write-obj! label)))
+
+(defn read-label!
+  [^DataInputStream input]
+  (l/trace :fn "read-label!" :position @*position* ::l/sync? true)
+  (let [m (read-byte! input)]
+    (assert-mark m :label)
+    (read-obj! input)))
+
+(defn write-header!
+  [^OutputStream output version]
+  (l/trace :fn "write-header!"
+           :version version
+           :position @*position*
+           ::l/sync? true)
+  (let [vers   (-> version name (subs 1) parse-long)
+        output (io/data-output-stream output)]
+    (doto output
+      (write-byte! (get-mark :header))
+      (write-long! penpot-magic-number)
+      (write-long! vers))))
+
+(defn read-header!
+  [^InputStream input]
+  (l/trace :fn "read-header!" :position @*position* ::l/sync? true)
+  (let [input (io/data-input-stream input)
+        mark  (read-byte! input)
+        mnum  (read-long! input)
+        vers  (read-long! input)]
+
+    (when (or (not= mark (get-mark :header))
+              (not= mnum penpot-magic-number))
+      (ex/raise :type :validation
+                :code :invalid-penpot-file
+                :hint "invalid penpot file"))
+
+    (keyword (str "v" vers))))
+
+(defn copy-stream!
+  [^OutputStream output ^InputStream input ^long size]
+  (let [written (io/copy input output :size size)]
+    (l/trace :fn "copy-stream!" :position @*position* :size size :written written ::l/sync? true)
+    (swap! *position* + written)
+    written))
+
+(defn write-stream!
+  [^DataOutputStream output stream size]
+  (l/trace :fn "write-stream!" :position @*position* ::l/sync? true :size size)
+  (doto output
+    (write-byte! (get-mark :stream))
+    (write-long! size))
+
+  (copy-stream! output stream size))
+
+(defn read-stream!
+  [^DataInputStream input]
+  (l/trace :fn "read-stream!" :position @*position* ::l/sync? true)
+  (let [m (read-byte! input)
+        s (read-long! input)
+        p (tmp/tempfile :prefix "penpot.binfile.")]
+    (assert-mark m :stream)
+
+    (when (> s bfc/max-object-size)
+      (ex/raise :type :validation
+                :code :max-file-size-reached
+                :hint (str/ffmt "unable to import storage object with size % bytes" s)))
+
+    (if (> s bfc/temp-file-threshold)
+      (with-open [^OutputStream output (io/output-stream p)]
+        (let [readed (io/copy input output :offset 0 :size s)]
+          (l/trace :fn "read-stream*!" :expected s :readed readed :position @*position* ::l/sync? true)
+          (swap! *position* + readed)
+          [s p]))
+      [s (io/read input :size s)])))
+
+(defmacro assert-read-label!
+  [input expected-label]
+  `(let [readed# (read-label! ~input)
+         expected# ~expected-label]
+     (when (not= readed# expected#)
+       (ex/raise :type :validation
+                 :code :unexpected-label
+                 :hint (format "unexpected label found: %s, expected: %s" readed# expected#)))))
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; API
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+;; --- HELPERS
+
+(defn zstd-input-stream
+  ^InputStream
+  [input]
+  (ZstdInputStream. ^InputStream input))
+
+(defn zstd-output-stream
+  ^OutputStream
+  [output & {:keys [level] :or {level 0}}]
+  (ZstdOutputStream. ^OutputStream output (int level)))
+
+(defn- get-files
+  [cfg ids]
+  (db/run! cfg (fn [{:keys [::db/conn]}]
+                 (let [sql (str "SELECT id FROM file "
+                                " WHERE id = ANY(?) ")
+                       ids (db/create-array conn "uuid" ids)]
+                   (->> (db/exec! conn [sql ids])
+                        (into [] (map :id))
+                        (not-empty))))))
+
+;; --- EXPORT WRITER
+
+(defmulti write-export ::version)
+(defmulti write-section ::section)
+
+(defn write-export!
+  [{:keys [::include-libraries ::embed-assets] :as cfg}]
+  (when (and include-libraries embed-assets)
+    (throw (IllegalArgumentException.
+            "the `include-libraries` and `embed-assets` are mutally excluding options")))
+
+  (write-export cfg))
+
+(defmethod write-export :default
+  [{:keys [::output] :as options}]
+  (write-header! output :v1)
+  (pu/with-open [output (zstd-output-stream output :level 12)
+                 output (io/data-output-stream output)]
+    (binding [bfc/*state* (volatile! {})]
+      (run! (fn [section]
+              (l/dbg :hint "write section" :section section ::l/sync? true)
+              (write-label! output section)
+              (let [options (-> options
+                                (assoc ::output output)
+                                (assoc ::section section))]
+                (binding [bfc/*options* options]
+                  (write-section options))))
+
+            [:v1/metadata :v1/files :v1/rels :v1/sobjects]))))
+
+(defmethod write-section :v1/metadata
+  [{:keys [::output ::ids ::include-libraries] :as cfg}]
+  (if-let [fids (get-files cfg ids)]
+    (let [lids (when include-libraries
+                 (bfc/get-libraries cfg ids))
+          ids  (into fids lids)]
+      (write-obj! output {:version cf/version :files ids})
+      (vswap! bfc/*state* assoc :files ids))
+    (ex/raise :type :not-found
+              :code :files-not-found
+              :hint "unable to retrieve files for export")))
+
+(defmethod write-section :v1/files
+  [{:keys [::output ::embed-assets ::include-libraries] :as cfg}]
+
+  ;; Initialize SIDS with empty vector
+  (vswap! bfc/*state* assoc :sids [])
+
+  (doseq [file-id (-> bfc/*state* deref :files)]
+    (let [detach?    (and (not embed-assets) (not include-libraries))
+          thumbnails (->> (bfc/get-file-object-thumbnails cfg file-id)
+                          (mapv #(dissoc % :file-id)))
+
+          file       (cond-> (bfc/get-file cfg file-id)
+                       detach?
+                       (-> (ctf/detach-external-references file-id)
+                           (dissoc :libraries))
+
+                       embed-assets
+                       (update :data #(bfc/embed-assets cfg % file-id))
+
+                       :always
+                       (assoc :thumbnails thumbnails))
+
+          media      (bfc/get-file-media cfg file)]
+
+      (l/dbg :hint "write penpot file"
+             :id (str file-id)
+             :name (:name file)
+             :thumbnails (count thumbnails)
+             :features (:features file)
+             :media (count media)
+             ::l/sync? true)
+
+      (doseq [item media]
+        (l/dbg :hint "write penpot file media object"
+               :id (:id item) ::l/sync? true))
+
+      (doseq [item thumbnails]
+        (l/dbg :hint "write penpot file object thumbnail"
+               :media-id (str (:media-id item)) ::l/sync? true))
+
+      (doto output
+        (write-obj! file)
+        (write-obj! media))
+
+      (vswap! bfc/*state* update :sids into bfc/xf-map-media-id media)
+      (vswap! bfc/*state* update :sids into bfc/xf-map-media-id thumbnails))))
+
+(defmethod write-section :v1/rels
+  [{:keys [::output ::include-libraries] :as cfg}]
+  (let [ids  (-> bfc/*state* deref :files set)
+        rels (when include-libraries
+               (bfc/get-files-rels cfg ids))]
+    (l/dbg :hint "found rels" :total (count rels) ::l/sync? true)
+    (write-obj! output rels)))
+
+(defmethod write-section :v1/sobjects
+  [{:keys [::output] :as cfg}]
+  (let [sids    (-> bfc/*state* deref :sids)
+        storage (sto/resolve cfg)]
+
+    (l/dbg :hint "found sobjects"
+           :items (count sids)
+           ::l/sync? true)
+
+    ;; Write all collected storage objects
+    (write-obj! output sids)
+
+    (doseq [id sids]
+      (let [{:keys [size] :as obj} (sto/get-object storage id)]
+        (l/dbg :hint "write sobject" :id (str id) ::l/sync? true)
+
+        (doto output
+          (write-uuid! id)
+          (write-obj! (meta obj)))
+
+        (pu/with-open [stream (sto/get-object-data storage obj)]
+          (let [written (write-stream! output stream size)]
+            (when (not= written size)
+              (ex/raise :type :validation
+                        :code :mismatch-readed-size
+                        :hint (str/ffmt "found unexpected object size; size=% written=%" size written)))))))))
+
+;; --- EXPORT READER
+
+(defmulti read-import ::version)
+(defmulti read-section ::section)
+
+(s/def ::profile-id ::us/uuid)
+(s/def ::project-id ::us/uuid)
+(s/def ::input io/input-stream?)
+(s/def ::overwrite? (s/nilable ::us/boolean))
+(s/def ::ignore-index-errors? (s/nilable ::us/boolean))
+
+;; FIXME: replace with schema
+(s/def ::read-import-options
+  (s/keys :req [::db/pool ::sto/storage ::project-id ::profile-id ::input]
+          :opt [::overwrite? ::ignore-index-errors?]))
+
+(defn read-import!
+  "Do the importation of the specified resource in penpot custom binary
+  format. There are some options for customize the importation
+  behavior:
+
+  `::bfc/overwrite`: if true, instead of creating new files and remapping id references,
+  it reuses all ids and updates existing objects; defaults to `false`."
+  [{:keys [::input ::bfc/timestamp] :or {timestamp (dt/now)} :as options}]
+
+  (dm/assert!
+   "expected input stream"
+   (io/input-stream? input))
+
+  (dm/assert!
+   "expected valid instant"
+   (dt/instant? timestamp))
+
+  (let [version (read-header! input)]
+    (read-import (assoc options ::version version ::bfc/timestamp timestamp))))
+
+(defn- read-import-v1
+  [{:keys [::db/conn ::project-id ::profile-id ::input] :as cfg}]
+
+  (bfc/disable-database-timeouts! cfg)
+
+  (pu/with-open [input (zstd-input-stream input)
+                 input (io/data-input-stream input)]
+    (binding [bfc/*state* (volatile! {:media [] :index {}})]
+      (let [team      (teams/get-team conn
+                                      :profile-id profile-id
+                                      :project-id project-id)
+
+            features  (cfeat/get-team-enabled-features cf/flags team)]
+
+        ;; Process all sections
+        (run! (fn [section]
+                (l/dbg :hint "reading section" :section section ::l/sync? true)
+                (assert-read-label! input section)
+                (let [options (-> cfg
+                                  (assoc ::bfc/features features)
+                                  (assoc ::section section)
+                                  (assoc ::input input))]
+                  (binding [bfc/*options* options]
+                    (events/tap :progress {:op :import :section section})
+                    (read-section options))))
+              [:v1/metadata :v1/files :v1/rels :v1/sobjects])
+
+        (bfc/apply-pending-migrations! cfg)
+
+        ;; Knowing that the ids of the created files are in index,
+        ;; just lookup them and return it as a set
+        (let [files (-> bfc/*state* deref :files)]
+          (into #{} (keep #(get-in @bfc/*state* [:index %])) files))))))
+
+(defmethod read-import :v1
+  [options]
+  (db/tx-run! options read-import-v1))
+
+(defmethod read-section :v1/metadata
+  [{:keys [::input]}]
+  (let [{:keys [version files]} (read-obj! input)]
+    (l/dbg :hint "metadata readed"
+           :version (:full version)
+           :files (mapv str files)
+           ::l/sync? true)
+    (vswap! bfc/*state* update :index bfc/update-index files)
+    (vswap! bfc/*state* assoc :version version :files files)))
+
+(defn- remap-thumbnails
+  [thumbnails file-id]
+  (mapv (fn [thumbnail]
+          (-> thumbnail
+              (assoc :file-id file-id)
+              (update :object-id #(str/replace-first % #"^(.*?)/" (str file-id "/")))))
+        thumbnails))
+
+(defn- clean-features
+  [file]
+  (update file :features (fn [features]
+                           (if (set? features)
+                             (-> features
+                                 (cfeat/migrate-legacy-features)
+                                 (set/difference cfeat/backend-only-features))
+                             #{}))))
+
+(defmethod read-section :v1/files
+  [{:keys [::db/conn ::input ::project-id ::bfc/overwrite ::name] :as system}]
+
+  (doseq [[idx expected-file-id] (d/enumerate (-> bfc/*state* deref :files))]
+    (let [file       (read-obj! input)
+          media      (read-obj! input)
+
+          file-id    (:id file)
+          file-id'   (bfc/lookup-index file-id)
+
+          file       (clean-features file)
+          thumbnails (:thumbnails file)]
+
+      (when (not= file-id expected-file-id)
+        (ex/raise :type :validation
+                  :code :inconsistent-penpot-file
+                  :found-id file-id
+                  :expected-id expected-file-id
+                  :hint "the penpot file seems corrupt, found unexpected uuid (file-id)"))
+
+      (l/dbg :hint "processing file"
+             :id (str file-id)
+             :features (:features file)
+             :version (-> file :data :version)
+             :media (count media)
+             :thumbnails (count thumbnails)
+             ::l/sync? true)
+
+      (when (seq thumbnails)
+        (let [thumbnails (remap-thumbnails thumbnails file-id')]
+          (l/dbg :hint "updated index with thumbnails"
+                 :total (count thumbnails)
+                 ::l/sync? true)
+          (vswap! bfc/*state* update :thumbnails bfc/into-vec thumbnails)))
+
+      (when (seq media)
+        ;; Update index with media
+        (l/dbg :hint "update index with media" :total (count media) ::l/sync? true)
+        (vswap! bfc/*state* update :index bfc/update-index (map :id media))
+
+        ;; Store file media for later insertion
+        (l/dbg :hint "update media references" ::l/sync? true)
+        (vswap! bfc/*state* update :media into (map #(update % :id bfc/lookup-index)) media))
+
+      (let [file (-> file
+                     (assoc :id file-id')
+                     (cond-> (and (= idx 0) (some? name))
+                       (assoc :name name))
+                     (assoc :project-id project-id)
+                     (dissoc :thumbnails)
+                     (bfc/process-file))]
+
+        ;; All features that are enabled and requires explicit migration are
+        ;; added to the state for a posterior migration step.
+        (doseq [feature (-> (::bfc/features system)
+                            (set/difference cfeat/no-migration-features)
+                            (set/difference (:features file)))]
+          (vswap! bfc/*state* update :pending-to-migrate (fnil conj []) [feature file-id']))
+
+        (l/dbg :hint "create file" :id (str file-id') ::l/sync? true)
+        (bfc/persist-file! system file)
+
+        (when overwrite
+          (db/delete! conn :file-thumbnail {:file-id file-id'}))
+
+        file-id'))))
+
+(defmethod read-section :v1/rels
+  [{:keys [::db/conn ::input ::bfc/timestamp]}]
+  (let [rels (read-obj! input)
+        ids  (into #{} (-> bfc/*state* deref :files))]
+    ;; Insert all file relations
+    (doseq [{:keys [library-file-id] :as rel} rels]
+      (let [rel (-> rel
+                    (assoc :synced-at timestamp)
+                    (update :file-id bfc/lookup-index)
+                    (update :library-file-id bfc/lookup-index))]
+
+        (if (contains? ids library-file-id)
+          (do
+            (l/dbg :hint "create file library link"
+                   :file-id (:file-id rel)
+                   :lib-id (:library-file-id rel)
+                   ::l/sync? true)
+            (db/insert! conn :file-library-rel rel))
+
+          (l/warn :hint "ignoring file library link"
+                  :file-id (:file-id rel)
+                  :lib-id (:library-file-id rel)
+                  ::l/sync? true))))))
+
+(defmethod read-section :v1/sobjects
+  [{:keys [::db/conn ::input ::bfc/overwrite ::bfc/timestamp] :as cfg}]
+  (let [storage (sto/resolve cfg)
+        ids     (read-obj! input)
+        thumb?  (into #{} (map :media-id) (:thumbnails @bfc/*state*))]
+
+    (doseq [expected-storage-id ids]
+      (let [id    (read-uuid! input)
+            mdata (read-obj! input)]
+
+        (when (not= id expected-storage-id)
+          (ex/raise :type :validation
+                    :code :inconsistent-penpot-file
+                    :hint "the penpot file seems corrupt, found unexpected uuid (storage-object-id)"))
+
+        (l/dbg :hint "readed storage object" :id (str id) ::l/sync? true)
+
+        (let [[size resource] (read-stream! input)
+              hash            (sto/calculate-hash resource)
+              content         (-> (sto/content resource size)
+                                  (sto/wrap-with-hash hash))
+
+              params          (-> mdata
+                                  (assoc ::sto/content content)
+                                  (assoc ::sto/deduplicate? true)
+                                  (assoc ::sto/touched-at timestamp))
+
+              params          (if (thumb? id)
+                                (assoc params :bucket "file-object-thumbnail")
+                                (assoc params :bucket "file-media-object"))
+
+              sobject         (sto/put-object! storage params)]
+
+          (l/dbg :hint "persisted storage object"
+                 :old-id (str id)
+                 :new-id (str (:id sobject))
+                 :is-thumbnail (boolean (thumb? id))
+                 ::l/sync? true)
+
+          (vswap! bfc/*state* update :index assoc id (:id sobject)))))
+
+    (doseq [item (:media @bfc/*state*)]
+      (l/dbg :hint "inserting file media object"
+             :id (str (:id item))
+             :file-id (str (:file-id item))
+             ::l/sync? true)
+
+      (let [file-id (bfc/lookup-index (:file-id item))]
+        (if (= file-id (:file-id item))
+          (l/warn :hint "ignoring file media object" :file-id (str file-id) ::l/sync? true)
+          (db/insert! conn :file-media-object
+                      (-> item
+                          (assoc :file-id file-id)
+                          (d/update-when :media-id bfc/lookup-index)
+                          (d/update-when :thumbnail-id bfc/lookup-index))
+                      {::db/on-conflict-do-nothing? overwrite}))))
+
+    (doseq [item (:thumbnails @bfc/*state*)]
+      (let [item (update item :media-id bfc/lookup-index)]
+        (l/dbg :hint "inserting file object thumbnail"
+               :file-id (str (:file-id item))
+               :media-id (str (:media-id item))
+               :object-id (:object-id item)
+               ::l/sync? true)
+        (db/insert! conn :file-tagged-object-thumbnail item
+                    {::db/on-conflict-do-nothing? overwrite})))))
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; HIGH LEVEL API
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+(defn export-files!
+  "Do the exportation of a specified file in custom penpot binary
+  format. There are some options available for customize the output:
+
+  `::include-libraries`: additionally to the specified file, all the
+  linked libraries also will be included (including transitive
+  dependencies).
+
+  `::embed-assets`: instead of including the libraries, embed in the
+  same file library all assets used from external libraries."
+
+  [{:keys [::ids] :as cfg} output]
+
+  (dm/assert!
+   "expected a set of uuid's for `::ids` parameter"
+   (and (set? ids)
+        (every? uuid? ids)))
+
+  (dm/assert!
+   "expected instance of jio/IOFactory for `input`"
+   (io/coercible? output))
+
+  (let [id (uuid/next)
+        tp (dt/tpoint)
+        ab (volatile! false)
+        cs (volatile! nil)]
+    (try
+      (l/info :hint "start exportation" :export-id (str id))
+      (pu/with-open [output (io/output-stream output)]
+        (binding [*position* (atom 0)]
+          (write-export! (assoc cfg ::output output))))
+
+      (catch java.io.IOException _cause
+        ;; Do nothing, EOF means client closes connection abruptly
+        (vreset! ab true)
+        nil)
+
+      (catch Throwable cause
+        (vreset! cs cause)
+        (vreset! ab true)
+        (throw cause))
+
+      (finally
+        (l/info :hint "exportation finished" :export-id (str id)
+                :elapsed (str (inst-ms (tp)) "ms")
+                :aborted @ab
+                :cause @cs)))))
+
+(defn import-files!
+  [{:keys [::input] :as cfg}]
+
+  (dm/assert!
+   "expected valid profile-id and project-id on `cfg`"
+   (and (uuid? (::profile-id cfg))
+        (uuid? (::project-id cfg))))
+
+  (dm/assert!
+   "expected instance of jio/IOFactory for `input`"
+   (satisfies? jio/IOFactory input))
+
+  (let [id (uuid/next)
+        tp (dt/tpoint)
+        cs (volatile! nil)]
+
+    (l/info :hint "import: started" :id (str id))
+    (try
+      (binding [*position* (atom 0)]
+        (pu/with-open [input (io/input-stream input)]
+          (read-import! (assoc cfg ::input input))))
+
+      (catch ZstdIOException cause
+        (ex/raise :type :validation
+                  :code :invalid-penpot-file
+                  :hint "invalid penpot file received: probably truncated"
+                  :cause cause))
+
+      (catch Throwable cause
+        (vreset! cs cause)
+        (throw cause))
+
+      (finally
+        (l/info :hint "import: terminated"
+                :id (str id)
+                :elapsed (dt/format-duration (tp))
+                :error? (some? @cs))))))
+

backend/src/app/binfile/v2.clj

@@ -0,0 +1,437 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS INC
+
+(ns app.binfile.v2
+  "A sqlite3 based binary file exportation with support for exportation
+  of entire team (or multiple teams) at once."
+  (:refer-clojure :exclude [read])
+  (:require
+   [app.binfile.common :as bfc]
+   [app.common.data :as d]
+   [app.common.features :as cfeat]
+   [app.common.logging :as l]
+   [app.common.transit :as t]
+   [app.common.uuid :as uuid]
+   [app.config :as cf]
+   [app.db :as db]
+   [app.db.sql :as sql]
+   [app.loggers.audit :as-alias audit]
+   [app.loggers.webhooks :as-alias webhooks]
+   [app.storage :as sto]
+   [app.storage.tmp :as tmp]
+   [app.util.events :as events]
+   [app.util.time :as dt]
+   [app.worker :as-alias wrk]
+   [clojure.set :as set]
+   [cuerdas.core :as str]
+   [datoteka.io :as io]
+   [promesa.util :as pu])
+  (:import
+   java.sql.DriverManager))
+
+(set! *warn-on-reflection* true)
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; LOW LEVEL API
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+(defn- create-database
+  ([cfg]
+   (let [path (tmp/tempfile :prefix "penpot.binfile." :suffix ".sqlite")]
+     (create-database cfg path)))
+  ([cfg path]
+   (let [db (DriverManager/getConnection (str "jdbc:sqlite:" path))]
+     (assoc cfg ::db db ::path path))))
+
+(def ^:private
+  sql:create-kvdata-table
+  "CREATE TABLE kvdata (
+     tag text NOT NULL,
+     key text NOT NULL,
+     val text NOT NULL,
+     dat blob NULL
+   )")
+
+(def ^:private
+  sql:create-kvdata-index
+  "CREATE INDEX kvdata__tag_key__idx
+      ON kvdata (tag, key)")
+
+(defn- setup-schema!
+  [{:keys [::db]}]
+  (db/exec-one! db [sql:create-kvdata-table])
+  (db/exec-one! db [sql:create-kvdata-index]))
+
+(defn- write!
+  [{:keys [::db]} tag k v & [data]]
+  (db/insert! db :kvdata
+              {:tag (d/name tag)
+               :key (str k)
+               :val (t/encode-str v {:type :json-verbose})
+               :dat data}
+              {::db/return-keys false}))
+
+(defn- read-blob
+  [{:keys [::db]} tag k]
+  (let [obj (db/get db :kvdata
+                    {:tag (d/name tag)
+                     :key (str k)}
+                    {::sql/columns [:dat]})]
+    (:dat obj)))
+
+(defn- read-seq
+  ([{:keys [::db]} tag]
+   (->> (db/query db :kvdata
+                  {:tag (d/name tag)}
+                  {::sql/columns [::val]})
+        (map :val)
+        (map t/decode-str)))
+  ([{:keys [::db]} tag k]
+   (->> (db/query db :kvdata
+                  {:tag (d/name tag)
+                   :key (str k)}
+                  {::sql/columns [::val]})
+        (map :val)
+        (map t/decode-str))))
+
+(defn- read-obj
+  [{:keys [::db]} tag k]
+  (let [obj (db/get db :kvdata
+                    {:tag (d/name tag)
+                     :key (str k)}
+                    {::sql/columns [:val]})]
+    (-> obj :val t/decode-str)))
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; IMPORT/EXPORT IMPL
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+(declare ^:private write-project!)
+(declare ^:private write-file!)
+
+(defn- write-team!
+  [cfg team-id]
+
+  (let [team  (bfc/get-team cfg team-id)
+        fonts (bfc/get-fonts cfg team-id)]
+
+    (events/tap :progress
+                {:op :export
+                 :section :write-team
+                 :id team-id
+                 :name (:name team)})
+
+    (l/trc :hint "write" :obj "team"
+           :id (str team-id)
+           :fonts (count fonts))
+
+    (when-let [photo-id (:photo-id team)]
+      (vswap! bfc/*state* update :storage-objects conj photo-id))
+
+    (vswap! bfc/*state* update :teams conj team-id)
+    (vswap! bfc/*state* bfc/collect-storage-objects fonts)
+
+    (write! cfg :team team-id team)
+
+    (doseq [{:keys [id] :as font} fonts]
+      (vswap! bfc/*state* update :team-font-variants conj id)
+      (write! cfg :team-font-variant id font))))
+
+(defn- write-project!
+  [cfg project]
+  (events/tap :progress
+              {:op :export
+               :section :write-project
+               :id (:id project)
+               :name (:name project)})
+  (l/trc :hint "write" :obj "project" :id (str (:id project)))
+  (write! cfg :project (str (:id project)) project)
+  (vswap! bfc/*state* update :projects conj (:id project)))
+
+(defn- write-file!
+  [cfg file-id]
+  (let [file   (bfc/get-file cfg file-id)
+        thumbs (bfc/get-file-object-thumbnails cfg file-id)
+        media  (bfc/get-file-media cfg file)
+        rels   (bfc/get-files-rels cfg #{file-id})]
+
+    (events/tap :progress
+                {:op :export
+                 :section :write-file
+                 :id file-id
+                 :name (:name file)})
+
+    (vswap! bfc/*state* (fn [state]
+                          (-> state
+                              (update :files conj file-id)
+                              (update :file-media-objects into bfc/xf-map-id media)
+                              (bfc/collect-storage-objects thumbs)
+                              (bfc/collect-storage-objects media))))
+
+    (write! cfg :file file-id file)
+    (write! cfg :file-rels file-id rels)
+
+    (run! (partial write! cfg :file-media-object file-id) media)
+    (run! (partial write! cfg :file-object-thumbnail file-id) thumbs)
+
+    (when-let [thumb (bfc/get-file-thumbnail cfg file)]
+      (vswap! bfc/*state* bfc/collect-storage-objects [thumb])
+      (write! cfg :file-thumbnail file-id thumb))
+
+    (l/trc :hint "write" :obj "file"
+           :thumbnails (count thumbs)
+           :rels (count rels)
+           :media (count media))))
+
+(defn- write-storage-object!
+  [{:keys [::sto/storage] :as cfg} id]
+  (let [sobj (sto/get-object storage id)
+        data (with-open [input (sto/get-object-data storage sobj)]
+               (io/read input))]
+
+    (l/trc :hint "write" :obj "storage-object" :id (str id) :size (:size sobj))
+    (write! cfg :storage-object id (meta sobj) data)))
+
+(defn- read-storage-object!
+  [{:keys [::sto/storage ::bfc/timestamp] :as cfg} id]
+  (let [mdata   (read-obj cfg :storage-object id)
+        data    (read-blob cfg :storage-object id)
+        hash    (sto/calculate-hash data)
+
+        content (-> (sto/content data)
+                    (sto/wrap-with-hash hash))
+
+        params  (-> mdata
+                    (assoc ::sto/content content)
+                    (assoc ::sto/deduplicate? true)
+                    (assoc ::sto/touched-at timestamp))
+
+        sobject  (sto/put-object! storage params)]
+
+    (vswap! bfc/*state* update :index assoc id (:id sobject))
+
+    (l/trc :hint "read" :obj "storage-object"
+           :id (str id)
+           :new-id (str (:id sobject))
+           :size (:size sobject))))
+
+(defn read-team!
+  [{:keys [::db/conn ::bfc/timestamp] :as cfg} team-id]
+  (l/trc :hint "read" :obj "team" :id (str team-id))
+
+  (let [team (read-obj cfg :team team-id)
+        team (-> team
+                 (update :id bfc/lookup-index)
+                 (update :photo-id bfc/lookup-index)
+                 (assoc :created-at timestamp)
+                 (assoc :modified-at timestamp))]
+
+    (events/tap :progress
+                {:op :import
+                 :section :read-team
+                 :id team-id
+                 :name (:name team)})
+
+    (db/insert! conn :team
+                (update team :features db/encode-pgarray conn "text")
+                ::db/return-keys false)
+
+    (doseq [font (->> (read-seq cfg :team-font-variant)
+                      (filter #(= team-id (:team-id %))))]
+      (let [font (-> font
+                     (update :id bfc/lookup-index)
+                     (update :team-id bfc/lookup-index)
+                     (update :woff1-file-id bfc/lookup-index)
+                     (update :woff2-file-id bfc/lookup-index)
+                     (update :ttf-file-id bfc/lookup-index)
+                     (update :otf-file-id bfc/lookup-index)
+                     (assoc :created-at timestamp)
+                     (assoc :modified-at timestamp))]
+        (db/insert! conn :team-font-variant font
+                    ::db/return-keys false)))
+
+    team))
+
+(defn read-project!
+  [{:keys [::db/conn ::bfc/timestamp] :as cfg} project-id]
+  (l/trc :hint "read" :obj "project" :id (str project-id))
+
+  (let [project (read-obj cfg :project project-id)
+        project (-> project
+                    (update :id bfc/lookup-index)
+                    (update :team-id bfc/lookup-index)
+                    (assoc :created-at timestamp)
+                    (assoc :modified-at timestamp))]
+
+    (events/tap :progress
+                {:op :import
+                 :section :read-project
+                 :id project-id
+                 :name (:name project)})
+
+    (db/insert! conn :project project
+                ::db/return-keys false)))
+
+(defn read-file!
+  [{:keys [::db/conn ::bfc/timestamp] :as cfg} file-id]
+  (l/trc :hint "read" :obj "file" :id (str file-id))
+
+  (let [file (-> (read-obj cfg :file file-id)
+                 (update :id bfc/lookup-index)
+                 (update :project-id bfc/lookup-index)
+                 (bfc/process-file))]
+
+    (events/tap :progress
+                {:op :import
+                 :section :read-file
+                 :id file-id
+                 :name (:name file)})
+
+    ;; All features that are enabled and requires explicit migration are
+    ;; added to the state for a posterior migration step.
+    (doseq [feature (-> (::bfc/features cfg)
+                        (set/difference cfeat/no-migration-features)
+                        (set/difference (:features file)))]
+      (vswap! bfc/*state* update :pending-to-migrate (fnil conj []) [feature (:id file)]))
+
+    (bfc/persist-file! cfg file))
+
+  (doseq [thumbnail (read-seq cfg :file-object-thumbnail file-id)]
+    (let [thumbnail (-> thumbnail
+                        (update :file-id bfc/lookup-index)
+                        (update :media-id bfc/lookup-index))
+          file-id    (:file-id thumbnail)
+
+          thumbnail (update thumbnail :object-id
+                            #(str/replace-first % #"^(.*?)/" (str file-id "/")))]
+
+      (db/insert! conn :file-tagged-object-thumbnail thumbnail
+                  {::db/return-keys false})))
+
+  (doseq [rel (read-obj cfg :file-rels file-id)]
+    (let [rel (-> rel
+                  (update :file-id bfc/lookup-index)
+                  (update :library-file-id bfc/lookup-index)
+                  (assoc :synced-at timestamp))]
+      (db/insert! conn :file-library-rel rel
+                  ::db/return-keys false)))
+
+  (doseq [media (read-seq cfg :file-media-object file-id)]
+    (let [media (-> media
+                    (update :id bfc/lookup-index)
+                    (update :file-id bfc/lookup-index)
+                    (update :media-id bfc/lookup-index)
+                    (update :thumbnail-id bfc/lookup-index))]
+      (db/insert! conn :file-media-object media
+                  ::db/return-keys false
+                  ::sql/on-conflict-do-nothing true))))
+
+(def ^:private empty-summary
+  {:teams #{}
+   :files #{}
+   :projects #{}
+   :file-media-objects #{}
+   :team-font-variants #{}
+   :storage-objects #{}})
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; PUBLIC API
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+(defn export-team!
+  [cfg team-id]
+  (let [id  (uuid/next)
+        tp  (dt/tpoint)
+        cfg (create-database cfg)]
+
+    (l/inf :hint "start"
+           :operation "export"
+           :id (str id)
+           :path (str (::path cfg)))
+
+    (try
+      (db/tx-run! cfg (fn [cfg]
+                        (setup-schema! cfg)
+                        (binding [bfc/*state* (volatile! empty-summary)]
+                          (write-team! cfg team-id)
+
+                          (run! (partial write-project! cfg)
+                                (bfc/get-team-projects cfg team-id))
+
+                          (run! (partial write-file! cfg)
+                                (bfc/get-team-files-ids cfg team-id))
+
+                          (run! (partial write-storage-object! cfg)
+                                (-> bfc/*state* deref :storage-objects))
+
+                          (write! cfg :manifest "team-id" team-id)
+                          (write! cfg :manifest "objects" (deref bfc/*state*))
+
+                          (::path cfg))))
+      (finally
+        (pu/close! (::db cfg))
+
+        (let [elapsed (tp)]
+          (l/inf :hint "end"
+                 :operation "export"
+                 :id (str id)
+                 :elapsed (dt/format-duration elapsed)))))))
+
+(defn import-team!
+  [cfg path]
+  (let [id  (uuid/next)
+        tp  (dt/tpoint)
+
+        cfg (-> (create-database cfg path)
+                (assoc ::bfc/timestamp (dt/now)))]
+
+    (l/inf :hint "start"
+           :operation "import"
+           :id (str id)
+           :path (str (::path cfg)))
+
+    (try
+      (db/tx-run! cfg (fn [{:keys [::db/conn] :as cfg}]
+                        (db/exec-one! conn ["SET idle_in_transaction_session_timeout = 0"])
+                        (db/exec-one! conn ["SET CONSTRAINTS ALL DEFERRED"])
+
+                        (binding [bfc/*state* (volatile! {:index {}})]
+                          (let [objects (read-obj cfg :manifest "objects")]
+
+                            ;; We first process all storage objects, they have
+                            ;; deduplication so we can't rely on simple reindex. This
+                            ;; operation populates the index for all storage objects.
+                            (run! (partial read-storage-object! cfg) (:storage-objects objects))
+
+                            ;; Populate index with all the incoming objects
+                            (vswap! bfc/*state* update :index
+                                    (fn [index]
+                                      (-> index
+                                          (bfc/update-index (:teams objects))
+                                          (bfc/update-index (:projects objects))
+                                          (bfc/update-index (:files objects))
+                                          (bfc/update-index (:file-media-objects objects))
+                                          (bfc/update-index (:team-font-variants objects)))))
+
+                            (let [team-id  (read-obj cfg :manifest "team-id")
+                                  team     (read-team! cfg team-id)
+                                  features (cfeat/get-team-enabled-features cf/flags team)
+                                  cfg      (assoc cfg ::bfc/features features)]
+
+                              (run! (partial read-project! cfg) (:projects objects))
+                              (run! (partial read-file! cfg) (:files objects))
+
+                              ;; (run-pending-migrations! cfg)
+
+                              team)))))
+      (finally
+        (pu/close! (::db cfg))
+
+        (let [elapsed (tp)]
+          (l/inf :hint "end"
+                 :operation "import"
+                 :id (str id)
+                 :elapsed (dt/format-duration elapsed)))))))

backend/src/app/binfile/v3.clj

@@ -0,0 +1,957 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS INC
+
+(ns app.binfile.v3
+  "A ZIP based binary file exportation"
+  (:refer-clojure :exclude [read])
+  (:require
+   [app.binfile.common :as bfc]
+   [app.common.data :as d]
+   [app.common.data.macros :as dm]
+   [app.common.exceptions :as ex]
+   [app.common.json :as json]
+   [app.common.logging :as l]
+   [app.common.schema :as sm]
+   [app.common.thumbnails :as cth]
+   [app.common.types.color :as ctcl]
+   [app.common.types.component :as ctc]
+   [app.common.types.file :as ctf]
+   [app.common.types.page :as ctp]
+   [app.common.types.plugins :as ctpg]
+   [app.common.types.shape :as cts]
+   [app.common.types.typography :as cty]
+   [app.common.uuid :as uuid]
+   [app.config :as cf]
+   [app.db :as db]
+   [app.storage :as sto]
+   [app.storage.impl :as sto.impl]
+   [app.util.events :as events]
+   [app.util.time :as dt]
+   [clojure.java.io :as jio]
+   [cuerdas.core :as str]
+   [datoteka.fs :as fs]
+   [datoteka.io :as io])
+  (:import
+   java.io.InputStream
+   java.io.OutputStreamWriter
+   java.util.zip.ZipEntry
+   java.util.zip.ZipFile
+   java.util.zip.ZipOutputStream))
+
+;; --- SCHEMA
+
+(def ^:private schema:manifest
+  [:map {:title "Manifest"}
+   [:version ::sm/int]
+   [:type :string]
+
+   [:generated-by {:optional true} :string]
+
+   [:files
+    [:vector
+     [:map
+      [:id ::sm/uuid]
+      [:name :string]
+      [:project-id ::sm/uuid]]]]
+
+   [:relations {:optional true}
+    [:vector
+     [:tuple ::sm/uuid ::sm/uuid]]]])
+
+(def ^:private schema:storage-object
+  [:map {:title "StorageObject"}
+   [:id ::sm/uuid]
+   [:size ::sm/int]
+   [:content-type :string]
+   [:bucket [::sm/one-of {:format :string} sto/valid-buckets]]
+   [:hash :string]])
+
+(def ^:private schema:file-thumbnail
+  [:map {:title "FileThumbnail"}
+   [:file-id ::sm/uuid]
+   [:page-id ::sm/uuid]
+   [:frame-id ::sm/uuid]
+   [:tag :string]
+   [:media-id ::sm/uuid]])
+
+;; --- ENCODERS
+
+(def encode-file
+  (sm/encoder ::ctf/file sm/json-transformer))
+
+(def encode-page
+  (sm/encoder ::ctp/page sm/json-transformer))
+
+(def encode-shape
+  (sm/encoder ::cts/shape sm/json-transformer))
+
+(def encode-media
+  (sm/encoder ::ctf/media sm/json-transformer))
+
+(def encode-component
+  (sm/encoder ::ctc/component sm/json-transformer))
+
+(def encode-color
+  (sm/encoder ::ctcl/color sm/json-transformer))
+
+(def encode-typography
+  (sm/encoder ::cty/typography sm/json-transformer))
+
+(def encode-plugin-data
+  (sm/encoder ::ctpg/plugin-data sm/json-transformer))
+
+(def encode-storage-object
+  (sm/encoder schema:storage-object sm/json-transformer))
+
+(def encode-file-thumbnail
+  (sm/encoder schema:file-thumbnail sm/json-transformer))
+
+;; --- DECODERS
+
+(def decode-manifest
+  (sm/decoder schema:manifest sm/json-transformer))
+
+(def decode-media
+  (sm/decoder ::ctf/media sm/json-transformer))
+
+(def decode-component
+  (sm/decoder ::ctc/component sm/json-transformer))
+
+(def decode-color
+  (sm/decoder ::ctcl/color sm/json-transformer))
+
+(def decode-file
+  (sm/decoder ::ctf/file sm/json-transformer))
+
+(def decode-page
+  (sm/decoder ::ctp/page sm/json-transformer))
+
+(def decode-shape
+  (sm/decoder ::cts/shape sm/json-transformer))
+
+(def decode-typography
+  (sm/decoder ::cty/typography sm/json-transformer))
+
+(def decode-plugin-data
+  (sm/decoder ::ctpg/plugin-data sm/json-transformer))
+
+(def decode-storage-object
+  (sm/decoder schema:storage-object sm/json-transformer))
+
+(def decode-file-thumbnail
+  (sm/decoder schema:file-thumbnail sm/json-transformer))
+
+;; --- VALIDATORS
+
+(def validate-manifest
+  (sm/check-fn schema:manifest))
+
+(def validate-file
+  (sm/check-fn ::ctf/file))
+
+(def validate-page
+  (sm/check-fn ::ctp/page))
+
+(def validate-shape
+  (sm/check-fn ::cts/shape))
+
+(def validate-media
+  (sm/check-fn ::ctf/media))
+
+(def validate-color
+  (sm/check-fn ::ctcl/color))
+
+(def validate-component
+  (sm/check-fn ::ctc/component))
+
+(def validate-typography
+  (sm/check-fn ::cty/typography))
+
+(def validate-plugin-data
+  (sm/check-fn ::ctpg/plugin-data))
+
+(def validate-storage-object
+  (sm/check-fn schema:storage-object))
+
+(def validate-file-thumbnail
+  (sm/check-fn schema:file-thumbnail))
+
+;; --- EXPORT IMPL
+
+(defn- write-entry!
+  [^ZipOutputStream output ^String path data]
+  (.putNextEntry output (ZipEntry. path))
+  (let [writer (OutputStreamWriter. output "UTF-8")]
+    (json/write writer data :indent true :key-fn json/write-camel-key)
+    (.flush writer))
+  (.closeEntry output))
+
+(defn- get-file
+  [{:keys [::embed-assets ::include-libraries] :as cfg} file-id]
+
+  (when (and include-libraries embed-assets)
+    (throw (IllegalArgumentException.
+            "the `include-libraries` and `embed-assets` are mutally excluding options")))
+
+  (let [detach?  (and (not embed-assets) (not include-libraries))]
+    (cond-> (bfc/get-file cfg file-id)
+      detach?
+      (-> (ctf/detach-external-references file-id)
+          (dissoc :libraries))
+
+      embed-assets
+      (update :data #(bfc/embed-assets cfg % file-id)))))
+
+(defn- resolve-extension
+  [mtype]
+  (case mtype
+    "image/png"     ".png"
+    "image/jpeg"    ".jpg"
+    "image/gif"     ".gif"
+    "image/svg+xml" ".svg"
+    "image/webp"    ".webp"
+    "font/woff"     ".woff"
+    "font/woff2"    ".woff2"
+    "font/ttf"      ".ttf"
+    "font/otf"      ".otf"
+    "application/octet-stream" ".bin"))
+
+(defn- export-storage-objects
+  [{:keys [::output] :as cfg}]
+  (let [storage (sto/resolve cfg)]
+    (doseq [id (-> bfc/*state* deref :storage-objects not-empty)]
+      (let [sobject (sto/get-object storage id)
+            smeta   (meta sobject)
+            ext     (resolve-extension (:content-type smeta))
+            path    (str "objects/" id ".json")
+            params  (-> (meta sobject)
+                        (assoc :id (:id sobject))
+                        (assoc :size (:size sobject))
+                        (encode-storage-object))]
+
+        (write-entry! output path params)
+
+        (with-open [input (sto/get-object-data storage sobject)]
+          (.putNextEntry output (ZipEntry. (str "objects/" id ext)))
+          (io/copy input output :size (:size sobject))
+          (.closeEntry output))))))
+
+(defn- export-file
+  [{:keys [::file-id ::output] :as cfg}]
+  (let [file         (get-file cfg file-id)
+        media        (->> (bfc/get-file-media cfg file)
+                          (map (fn [media]
+                                 (dissoc media :file-id))))
+
+        data         (:data file)
+        typographies (:typographies data)
+        components   (:components data)
+        colors       (:colors data)
+
+        pages        (:pages data)
+        pages-index  (:pages-index data)
+
+        thumbnails   (bfc/get-file-object-thumbnails cfg file-id)]
+
+    (vswap! bfc/*state* update :files assoc file-id
+            {:id file-id
+             :project-id (:project-id file)
+             :name (:name file)})
+
+    (let [file (cond-> (dissoc file :data)
+                 (:options data)
+                 (assoc :options (:options data))
+                 :always
+                 (encode-file))
+          path (str "files/" file-id ".json")]
+      (write-entry! output path file))
+
+    (doseq [[index page-id] (d/enumerate pages)]
+      (let [path    (str "files/" file-id "/pages/" page-id ".json")
+            page    (get pages-index page-id)
+            objects (:objects page)
+            page    (-> page
+                        (dissoc :objects)
+                        (assoc :index index))
+            page    (encode-page page)]
+
+        (write-entry! output path page)
+
+        (doseq [[shape-id shape] objects]
+          (let [path  (str "files/" file-id "/pages/" page-id "/" shape-id ".json")
+                shape (assoc shape :page-id page-id)
+                shape (encode-shape shape)]
+            (write-entry! output path shape)))))
+
+    (vswap! bfc/*state* bfc/collect-storage-objects media)
+    (vswap! bfc/*state* bfc/collect-storage-objects thumbnails)
+
+    (doseq [{:keys [id] :as media} media]
+      (let [path  (str "files/" file-id "/media/" id ".json")
+            media (encode-media media)]
+        (write-entry! output path media)))
+
+    (doseq [thumbnail thumbnails]
+      (let [data (cth/parse-object-id (:object-id thumbnail))
+            path (str "files/" file-id "/thumbnails/" (:tag data) "/" (:page-id data)
+                      "/" (:frame-id data) ".json")
+            data (-> data
+                     (assoc :media-id (:media-id thumbnail))
+                     (encode-file-thumbnail))]
+        (write-entry! output path data)))
+
+    (doseq [[id component] components]
+      (let [path      (str "files/" file-id "/components/" id ".json")
+            component (encode-component component)]
+        (write-entry! output path component)))
+
+    (doseq [[id color] colors]
+      (let [path  (str "files/" file-id "/colors/" id ".json")
+            color (-> (encode-color color)
+                      (dissoc :file-id))
+            color (cond-> color
+                    (and (contains? color :path)
+                         (str/empty? (:path color)))
+                    (dissoc :path))]
+        (write-entry! output path color)))
+
+    (doseq [[id object] typographies]
+      (let [path  (str "files/" file-id "/typographies/" id ".json")
+            color (encode-typography object)]
+        (write-entry! output path color)))))
+
+(defn- export-files
+  [{:keys [::ids ::include-libraries ::output] :as cfg}]
+  (let [ids  (into ids (when include-libraries (bfc/get-libraries cfg ids)))
+        rels (if include-libraries
+               (->> (bfc/get-files-rels cfg ids)
+                    (mapv (juxt :file-id :library-file-id)))
+               [])]
+
+    (vswap! bfc/*state* assoc :files (d/ordered-map))
+
+    ;; Write all the exporting files
+    (doseq [[index file-id] (d/enumerate ids)]
+      (-> cfg
+          (assoc ::file-id file-id)
+          (assoc ::file-seqn index)
+          (export-file)))
+
+    ;; Write manifest file
+    (let [files  (:files @bfc/*state*)
+          params {:type "penpot/export-files"
+                  :version 1
+                  :generated-by (str "penpot/" (:full cf/version))
+                  :files (vec (vals files))
+                  :relations rels}]
+      (write-entry! output "manifest.json" params))))
+
+;; --- IMPORT IMPL
+
+(defn- read-zip-entries
+  [^ZipFile input]
+  (into #{} (iterator-seq (.entries input))))
+
+(defn- get-zip-entry*
+  [^ZipFile input ^String path]
+  (.getEntry input path))
+
+(defn- get-zip-entry
+  [input path]
+  (let [entry (get-zip-entry* input path)]
+    (when-not entry
+      (ex/raise :type :validation
+                :code :inconsistent-penpot-file
+                :hint "the penpot file seems corrupt, missing underlying zip entry"
+                :path path))
+    entry))
+
+(defn- get-zip-entry-size
+  [^ZipEntry entry]
+  (.getSize entry))
+
+(defn- zip-entry-name
+  [^ZipEntry entry]
+  (.getName entry))
+
+(defn- zip-entry-stream
+  ^InputStream
+  [^ZipFile input ^ZipEntry entry]
+  (.getInputStream input entry))
+
+(defn- zip-entry-reader
+  [^ZipFile input ^ZipEntry entry]
+  (-> (zip-entry-stream input entry)
+      (io/reader :encoding "UTF-8")))
+
+(defn- zip-entry-storage-content
+  "Wraps a ZipFile and ZipEntry into a penpot storage compatible
+  object and avoid creating temporal objects"
+  [input entry]
+  (let [hash  (delay (->> entry
+                          (zip-entry-stream input)
+                          (sto.impl/calculate-hash)))]
+    (reify
+      sto.impl/IContentObject
+      (get-size [_]
+        (get-zip-entry-size entry))
+
+      sto.impl/IContentHash
+      (get-hash [_]
+        (deref hash))
+
+      jio/IOFactory
+      (make-reader [this opts]
+        (jio/make-reader this opts))
+      (make-writer [_ _]
+        (throw (UnsupportedOperationException. "not implemented")))
+
+      (make-input-stream [_ _]
+        (zip-entry-stream input entry))
+      (make-output-stream [_ _]
+        (throw (UnsupportedOperationException. "not implemented"))))))
+
+(defn- read-manifest
+  [^ZipFile input]
+  (let [entry (get-zip-entry input "manifest.json")]
+    (with-open [reader (zip-entry-reader input entry)]
+      (let [manifest (json/read reader :key-fn json/read-kebab-key)]
+        (decode-manifest manifest)))))
+
+(defn- match-media-entry-fn
+  [file-id]
+  (let [pattern (str "^files/" file-id "/media/([^/]+).json$")
+        pattern (re-pattern pattern)]
+    (fn [entry]
+      (when-let [[_ id] (re-matches pattern (zip-entry-name entry))]
+        {:entry entry
+         :id (parse-uuid id)}))))
+
+(defn- match-color-entry-fn
+  [file-id]
+  (let [pattern (str "^files/" file-id "/colors/([^/]+).json$")
+        pattern (re-pattern pattern)]
+    (fn [entry]
+      (when-let [[_ id] (re-matches pattern (zip-entry-name entry))]
+        {:entry entry
+         :id (parse-uuid id)}))))
+
+(defn- match-component-entry-fn
+  [file-id]
+  (let [pattern (str "^files/" file-id "/components/([^/]+).json$")
+        pattern (re-pattern pattern)]
+    (fn [entry]
+      (when-let [[_ id] (re-matches pattern (zip-entry-name entry))]
+        {:entry entry
+         :id (parse-uuid id)}))))
+
+(defn- match-typography-entry-fn
+  [file-id]
+  (let [pattern (str "^files/" file-id "/typographies/([^/]+).json$")
+        pattern (re-pattern pattern)]
+    (fn [entry]
+      (when-let [[_ id] (re-matches pattern (zip-entry-name entry))]
+        {:entry entry
+         :id (parse-uuid id)}))))
+
+(defn- match-thumbnail-entry-fn
+  [file-id]
+  (let [pattern (str "^files/" file-id "/thumbnails/([^/]+)/([^/]+)/([^/]+).json$")
+        pattern (re-pattern pattern)]
+    (fn [entry]
+      (when-let [[_ tag page-id frame-id] (re-matches pattern (zip-entry-name entry))]
+        {:entry entry
+         :tag tag
+         :page-id (parse-uuid page-id)
+         :frame-id (parse-uuid frame-id)
+         :file-id file-id}))))
+
+(defn- match-page-entry-fn
+  [file-id]
+  (let [pattern (str "^files/" file-id "/pages/([^/]+).json$")
+        pattern (re-pattern pattern)]
+    (fn [entry]
+      (when-let [[_ id] (re-matches pattern (zip-entry-name entry))]
+        {:entry entry
+         :id (parse-uuid id)}))))
+
+(defn- match-shape-entry-fn
+  [file-id page-id]
+  (let [pattern (str "^files/" file-id "/pages/" page-id "/([^/]+).json$")
+        pattern (re-pattern pattern)]
+    (fn [entry]
+      (when-let [[_ id] (re-matches pattern (zip-entry-name entry))]
+        {:entry entry
+         :page-id page-id
+         :id (parse-uuid id)}))))
+
+(defn- match-storage-entry-fn
+  []
+  (let [pattern (str "^objects/([^/]+).json$")
+        pattern (re-pattern pattern)]
+    (fn [entry]
+      (when-let [[_ id] (re-matches pattern (zip-entry-name entry))]
+        {:entry entry
+         :id (parse-uuid id)}))))
+
+(defn- read-entry
+  [^ZipFile input entry]
+  (with-open [reader (zip-entry-reader input entry)]
+    (json/read reader :key-fn json/read-kebab-key)))
+
+(defn- read-file
+  [{:keys [::input ::file-id]}]
+  (let [path  (str "files/" file-id ".json")
+        entry (get-zip-entry input path)]
+    (-> (read-entry input entry)
+        (decode-file)
+        (validate-file))))
+
+(defn- read-file-plugin-data
+  [{:keys [::input ::file-id]}]
+  (let [path  (str "files/" file-id "/plugin-data.json")
+        entry (get-zip-entry* input path)]
+    (some->> entry
+             (read-entry input)
+             (decode-plugin-data)
+             (validate-plugin-data))))
+
+(defn- read-file-media
+  [{:keys [::input ::file-id ::entries]}]
+  (->> (keep (match-media-entry-fn file-id) entries)
+       (reduce (fn [result {:keys [id entry]}]
+                 (let [object (->> (read-entry input entry)
+                                   (decode-media)
+                                   (validate-media))
+                       object (assoc object :file-id file-id)]
+                   (if (= id (:id object))
+                     (conj result object)
+                     result)))
+               [])
+       (not-empty)))
+
+(defn- read-file-colors
+  [{:keys [::input ::file-id ::entries]}]
+  (->> (keep (match-color-entry-fn file-id) entries)
+       (reduce (fn [result {:keys [id entry]}]
+                 (let [object (->> (read-entry input entry)
+                                   (decode-color)
+                                   (validate-color))]
+                   (if (= id (:id object))
+                     (assoc result id object)
+                     result)))
+               {})
+       (not-empty)))
+
+(defn- read-file-components
+  [{:keys [::input ::file-id ::entries]}]
+  (->> (keep (match-component-entry-fn file-id) entries)
+       (reduce (fn [result {:keys [id entry]}]
+                 (let [object (->> (read-entry input entry)
+                                   (decode-component)
+                                   (validate-component))]
+                   (if (= id (:id object))
+                     (assoc result id object)
+                     result)))
+               {})
+       (not-empty)))
+
+(defn- read-file-typographies
+  [{:keys [::input ::file-id ::entries]}]
+  (->> (keep (match-typography-entry-fn file-id) entries)
+       (reduce (fn [result {:keys [id entry]}]
+                 (let [object (->> (read-entry input entry)
+                                   (decode-typography)
+                                   (validate-typography))]
+                   (if (= id (:id object))
+                     (assoc result id object)
+                     result)))
+               {})
+       (not-empty)))
+
+(defn- read-file-shapes
+  [{:keys [::input ::file-id ::page-id ::entries] :as cfg}]
+  (->> (keep (match-shape-entry-fn file-id page-id) entries)
+       (reduce (fn [result {:keys [id entry]}]
+                 (let [object (->> (read-entry input entry)
+                                   (decode-shape)
+                                   (validate-shape))]
+                   (if (= id (:id object))
+                     (assoc result id object)
+                     result)))
+               {})
+       (not-empty)))
+
+(defn- read-file-pages
+  [{:keys [::input ::file-id ::entries] :as cfg}]
+  (->> (keep (match-page-entry-fn file-id) entries)
+       (keep (fn [{:keys [id entry]}]
+               (let [page (->> (read-entry input entry)
+                               (decode-page))
+                     page (dissoc page :options)]
+                 (when (= id (:id page))
+                   (let [objects (-> (assoc cfg ::page-id id)
+                                     (read-file-shapes))]
+                     (assoc page :objects objects))))))
+       (sort-by :index)
+       (reduce (fn [result {:keys [id] :as page}]
+                 (assoc result id (dissoc page :index)))
+               (d/ordered-map))))
+
+(defn- read-file-thumbnails
+  [{:keys [::input ::file-id ::entries] :as cfg}]
+  (->> (keep (match-thumbnail-entry-fn file-id) entries)
+       (reduce (fn [result {:keys [page-id frame-id tag entry]}]
+                 (let [object (->> (read-entry input entry)
+                                   (decode-file-thumbnail)
+                                   (validate-file-thumbnail))]
+                   (if (and (= frame-id (:frame-id object))
+                            (= page-id (:page-id object))
+                            (= tag (:tag object)))
+                     (conj result object)
+                     result)))
+               [])
+       (not-empty)))
+
+(defn- read-file-data
+  [{:keys [] :as cfg}]
+  (let [colors       (read-file-colors cfg)
+        typographies (read-file-typographies cfg)
+        components   (read-file-components cfg)
+        plugin-data  (read-file-plugin-data cfg)
+        pages        (read-file-pages cfg)]
+
+    {:pages (-> pages keys vec)
+     :pages-index (into {} pages)
+     :colors colors
+     :typographies typographies
+     :components components
+     :plugin-data plugin-data}))
+
+(defn- import-file
+  [{:keys [::db/conn ::project-id ::file-id ::file-name] :as cfg}]
+  (let [file-id'   (bfc/lookup-index file-id)
+        file       (read-file cfg)
+        media      (read-file-media cfg)
+        thumbnails (read-file-thumbnails cfg)]
+
+    (l/dbg :hint "processing file"
+           :id (str file-id')
+           :prev-id (str file-id)
+           :features (str/join "," (:features file))
+           :version (:version file)
+           ::l/sync? true)
+
+    (events/tap :progress {:section :file :name file-name})
+
+    (when media
+      ;; Update index with media
+      (l/dbg :hint "update media index"
+             :file-id (str file-id')
+             :total (count media)
+             ::l/sync? true)
+
+      (vswap! bfc/*state* update :index bfc/update-index (map :id media))
+      (vswap! bfc/*state* update :media into media))
+
+    (when thumbnails
+      (l/dbg :hint "update thumbnails index"
+             :file-id (str file-id')
+             :total (count thumbnails)
+             ::l/sync? true)
+
+      (vswap! bfc/*state* update :index bfc/update-index (map :media-id thumbnails))
+      (vswap! bfc/*state* update :thumbnails into thumbnails))
+
+    (let [data (-> (read-file-data cfg)
+                   (d/without-nils)
+                   (assoc :id file-id')
+                   (cond-> (:options file)
+                     (assoc :options (:options file))))
+
+          file (-> file
+                   (assoc :id file-id')
+                   (assoc :data data)
+                   (assoc :name file-name)
+                   (assoc :project-id project-id)
+                   (dissoc :options)
+                   (bfc/process-file))]
+
+      (->> file
+           (bfc/register-pending-migrations cfg)
+           (bfc/persist-file! cfg))
+
+      (when (::bfc/overwrite cfg)
+        (db/delete! conn :file-thumbnail {:file-id file-id'}))
+
+      file-id')))
+
+(defn- import-file-relations
+  [{:keys [::db/conn ::manifest ::bfc/timestamp] :as cfg}]
+  (events/tap :progress {:section :relations})
+  (doseq [[file-id libr-id] (:relations manifest)]
+
+    (let [file-id (bfc/lookup-index file-id)
+          libr-id (bfc/lookup-index libr-id)]
+
+      (when (and file-id libr-id)
+        (l/dbg :hint "create file library link"
+               :file-id (str file-id)
+               :lib-id (str libr-id)
+               ::l/sync? true)
+        (db/insert! conn :file-library-rel
+                    {:synced-at timestamp
+                     :file-id file-id
+                     :library-file-id libr-id})))))
+
+(defn- import-storage-objects
+  [{:keys [::input ::entries ::bfc/timestamp] :as cfg}]
+  (events/tap :progress {:section :storage-objects})
+
+  (let [storage (sto/resolve cfg)
+        entries (keep (match-storage-entry-fn) entries)]
+
+    (doseq [{:keys [id entry]} entries]
+      (let [object (->> (read-entry input entry)
+                        (decode-storage-object)
+                        (validate-storage-object))]
+
+        (when (not= id (:id object))
+          (ex/raise :type :validation
+                    :code :inconsistent-penpot-file
+                    :hint "the penpot file seems corrupt, found unexpected uuid (storage-object-id)"
+                    :expected-id (str id)
+                    :found-id (str (:id object))))
+
+        (let [ext     (resolve-extension (:content-type object))
+              path    (str "objects/" id ext)
+              content (->> path
+                           (get-zip-entry input)
+                           (zip-entry-storage-content input))]
+
+          (when (not= (:size object) (sto/get-size content))
+            (ex/raise :type :validation
+                      :code :inconsistent-penpot-file
+                      :hint "found corrupted storage object: size does not match"
+                      :path path
+                      :expected-size (:size object)
+                      :found-size (sto/get-size content)))
+
+          (when (not= (:hash object) (sto/get-hash content))
+            (ex/raise :type :validation
+                      :code :inconsistent-penpot-file
+                      :hint "found corrupted storage object: hash does not match"
+                      :path path
+                      :expected-hash (:hash object)
+                      :found-hash (sto/get-hash content)))
+
+          (let [params  (-> object
+                            (dissoc :id :size)
+                            (assoc ::sto/content content)
+                            (assoc ::sto/deduplicate? true)
+                            (assoc ::sto/touched-at timestamp))
+                sobject (sto/put-object! storage params)]
+
+            (l/dbg :hint "persisted storage object"
+                   :id (str (:id sobject))
+                   :prev-id (str id)
+                   :bucket (:bucket params)
+                   ::l/sync? true)
+
+            (vswap! bfc/*state* update :index assoc id (:id sobject))))))))
+
+(defn- import-file-media
+  [{:keys [::db/conn] :as cfg}]
+  (events/tap :progress {:section :media})
+
+  (doseq [item (:media @bfc/*state*)]
+    (let [params (-> item
+                     (update :id bfc/lookup-index)
+                     (update :file-id bfc/lookup-index)
+                     (d/update-when :media-id bfc/lookup-index)
+                     (d/update-when :thumbnail-id bfc/lookup-index))]
+
+      (l/dbg :hint "inserting file media object"
+             :id (str (:id params))
+             :file-id (str (:file-id params))
+             ::l/sync? true)
+
+      (db/insert! conn :file-media-object params
+                  {::db/on-conflict-do-nothing? (::bfc/overwrite cfg)}))))
+
+(defn- import-file-thumbnails
+  [{:keys [::db/conn] :as cfg}]
+  (events/tap :progress {:section :thumbnails})
+  (doseq [item (:thumbnails @bfc/*state*)]
+    (let [file-id   (bfc/lookup-index (:file-id item))
+          media-id  (bfc/lookup-index (:media-id item))
+          object-id (-> (assoc item :file-id file-id)
+                        (cth/fmt-object-id))
+          params    {:file-id file-id
+                     :object-id object-id
+                     :tag (:tag item)
+                     :media-id media-id}]
+
+      (l/dbg :hint "inserting file object thumbnail"
+             :file-id (str file-id)
+             :media-id (str media-id)
+             ::l/sync? true)
+
+      (db/insert! conn :file-tagged-object-thumbnail params
+                  {::db/on-conflict-do-nothing? (::bfc/overwrite cfg)}))))
+
+(defn- import-files
+  [{:keys [::bfc/timestamp ::input ::name] :or {timestamp (dt/now)} :as cfg}]
+
+  (dm/assert!
+   "expected zip file"
+   (instance? ZipFile input))
+
+  (dm/assert!
+   "expected valid instant"
+   (dt/instant? timestamp))
+
+  (let [manifest (-> (read-manifest input)
+                     (validate-manifest))
+        entries  (read-zip-entries input)]
+
+    (when-not (= "penpot/export-files" (:type manifest))
+      (ex/raise :type :validation
+                :code :invalid-binfile-v3-manifest
+                :hint "unexpected type on manifest"
+                :manifest manifest))
+
+    ;; Check if all files referenced on manifest are present
+    (doseq [{file-id :id} (:files manifest)]
+      (let [path (str "files/" file-id ".json")]
+        (when-not (get-zip-entry input path)
+          (ex/raise :type :validation
+                    :code :invalid-binfile-v3
+                    :hint "some files referenced on manifest not found"
+                    :path path
+                    :file-id file-id))))
+
+    (events/tap :progress {:section :manifest})
+
+    (let [index (bfc/update-index (map :id (:files manifest)))
+          state {:media [] :index index}
+          cfg   (-> cfg
+                    (assoc ::entries entries)
+                    (assoc ::manifest manifest)
+                    (assoc ::bfc/timestamp timestamp))]
+
+      (binding [bfc/*state* (volatile! state)]
+        (db/tx-run! cfg (fn [cfg]
+                          (bfc/disable-database-timeouts! cfg)
+                          (let [ids (->> (:files manifest)
+                                         (reduce (fn [result {:keys [id] :as file}]
+                                                   (let [name' (get file :name)
+                                                         name' (if (map? name)
+                                                                 (get name id)
+                                                                 name')]
+                                                     (conj result (-> cfg
+                                                                      (assoc ::file-id id)
+                                                                      (assoc ::file-name name')
+                                                                      (import-file)))))
+                                                 []))]
+                            (import-file-relations cfg)
+                            (import-storage-objects cfg)
+                            (import-file-media cfg)
+                            (import-file-thumbnails cfg)
+
+                            (bfc/apply-pending-migrations! cfg)
+
+                            ids)))))))
+
+;; --- PUBLIC API
+
+(defn export-files!
+  "Do the exportation of a specified file in custom penpot binary
+  format. There are some options available for customize the output:
+
+  `::include-libraries`: additionally to the specified file, all the
+  linked libraries also will be included (including transitive
+  dependencies).
+
+  `::embed-assets`: instead of including the libraries, embed in the
+  same file library all assets used from external libraries."
+
+  [{:keys [::ids] :as cfg} output]
+
+  (dm/assert!
+   "expected a set of uuid's for `::ids` parameter"
+   (and (set? ids)
+        (every? uuid? ids)))
+
+  (dm/assert!
+   "expected instance of jio/IOFactory for `input`"
+   (satisfies? jio/IOFactory output))
+
+  (let [id (uuid/next)
+        tp (dt/tpoint)
+        ab (volatile! false)
+        cs (volatile! nil)]
+    (try
+      (l/info :hint "start exportation" :export-id (str id))
+      (binding [bfc/*state* (volatile! (bfc/initial-state))]
+        (with-open [output (io/output-stream output)]
+          (with-open [output (ZipOutputStream. output)]
+            (let [cfg (assoc cfg ::output output)]
+              (export-files cfg)
+              (export-storage-objects cfg)))))
+
+      (catch java.util.zip.ZipException cause
+        (vreset! cs cause)
+        (vreset! ab true)
+        (throw cause))
+
+      (catch java.io.IOException _cause
+        ;; Do nothing, EOF means client closes connection abruptly
+        (vreset! ab true)
+        nil)
+
+      (catch Throwable cause
+        (vreset! cs cause)
+        (vreset! ab true)
+        (throw cause))
+
+      (finally
+        (l/info :hint "exportation finished" :export-id (str id)
+                :elapsed (str (inst-ms (tp)) "ms")
+                :aborted @ab
+                :cause @cs)))))
+
+
+(defn import-files!
+  [{:keys [::input] :as cfg}]
+
+  (dm/assert!
+   "expected valid profile-id and project-id on `cfg`"
+   (and (uuid? (::profile-id cfg))
+        (uuid? (::project-id cfg))))
+
+  (dm/assert!
+   "expected instance of jio/IOFactory for `input`"
+   (io/coercible? input))
+
+  (let [id (uuid/next)
+        tp (dt/tpoint)
+        cs (volatile! nil)]
+
+    (l/info :hint "import: started" :id (str id))
+    (try
+      (with-open [input (ZipFile. (fs/file input))]
+        (import-files (assoc cfg ::input input)))
+
+      (catch Throwable cause
+        (vreset! cs cause)
+        (throw cause))
+
+      (finally
+        (l/info :hint "import: terminated"
+                :id (str id)
+                :elapsed (dt/format-duration (tp))
+                :error? (some? @cs))))))

backend/src/app/config.clj

@@ -11,52 +11,40 @@
    [app.common.data :as d]
    [app.common.exceptions :as ex]
    [app.common.flags :as flags]
-   [app.common.spec :as us]
+   [app.common.schema :as sm]
    [app.common.version :as v]
+   [app.util.overrides]
    [app.util.time :as dt]
    [clojure.core :as c]
    [clojure.java.io :as io]
-   [clojure.pprint :as pprint]
-   [clojure.spec.alpha :as s]
    [cuerdas.core :as str]
    [datoteka.fs :as fs]
    [environ.core :refer [env]]
    [integrant.core :as ig]))
 
-(prefer-method print-method
-               clojure.lang.IRecord
-               clojure.lang.IDeref)
-
-(prefer-method print-method
-               clojure.lang.IPersistentMap
-               clojure.lang.IDeref)
-
-(prefer-method pprint/simple-dispatch
-               clojure.lang.IPersistentMap
-               clojure.lang.IDeref)
-
 (defmethod ig/init-key :default
   [_ data]
   (d/without-nils data))
 
-(defmethod ig/prep-key :default
-  [_ data]
-  (if (map? data)
-    (d/without-nils data)
-    data))
+(defmethod ig/expand-key :default
+  [k v]
+  {k (if (map? v)
+       (d/without-nils v)
+       v)})
 
-(def defaults
+(def default
   {:database-uri "postgresql://postgres/penpot"
    :database-username "penpot"
    :database-password "penpot"
 
-   :default-blob-version 5
+   :default-blob-version 4
 
-   :rpc-rlimit-config (fs/path "resources/rlimit.edn")
-   :rpc-climit-config (fs/path "resources/climit.edn")
+   :rpc-rlimit-config "resources/rlimit.edn"
+   :rpc-climit-config "resources/climit.edn"
 
-   :file-change-snapshot-every 5
-   :file-change-snapshot-timeout "3h"
+   :auto-file-snapshot-total 10
+   :auto-file-snapshot-every 5
+   :auto-file-snapshot-timeout "3h"
 
    :public-uri "http://localhost:3449"
    :host "localhost"
@@ -64,8 +52,8 @@
 
    :redis-uri "redis://redis/0"
 
-   :assets-storage-backend :assets-fs
-   :storage-assets-fs-directory "assets"
+   :objects-storage-backend "fs"
+   :objects-storage-fs-directory "assets"
 
    :assets-path "/internal/assets/"
    :smtp-default-reply-to "Penpot <no-reply@example.com>"
@@ -79,254 +67,174 @@
 
    :telemetry-uri "https://telemetry.penpot.app/"
 
+   :media-max-file-size (* 1024 1024 30) ; 30MiB
+
    :ldap-user-query "(|(uid=:username)(mail=:username))"
    :ldap-attrs-username "uid"
    :ldap-attrs-email "mail"
    :ldap-attrs-fullname "cn"
 
    ;; a server prop key where initial project is stored.
-   :initial-project-skey "initial-project"})
+   :initial-project-skey "initial-project"
 
-(s/def ::default-rpc-rlimit ::us/vector-of-strings)
-(s/def ::rpc-rlimit-config ::fs/path)
-(s/def ::rpc-climit-config ::fs/path)
+   ;; time to avoid email sending after profile modification
+   :email-verify-threshold "15m"})
 
-(s/def ::media-max-file-size ::us/integer)
+(def schema:config
+  (do #_sm/optional-keys
+   [:map {:title "config"}
+    [:flags {:optional true} [::sm/set :string]]
+    [:admins {:optional true} [::sm/set ::sm/email]]
+    [:secret-key {:optional true} :string]
 
-(s/def ::flags ::us/vector-of-keywords)
-(s/def ::telemetry-enabled ::us/boolean)
+    [:tenant {:optional false} :string]
+    [:public-uri {:optional false} :string]
+    [:host {:optional false} :string]
 
-(s/def ::audit-log-archive-uri ::us/string)
-(s/def ::audit-log-http-handler-concurrency ::us/integer)
+    [:http-server-port {:optional true} ::sm/int]
+    [:http-server-host {:optional true} :string]
+    [:http-server-max-body-size {:optional true} ::sm/int]
+    [:http-server-max-multipart-body-size {:optional true} ::sm/int]
+    [:http-server-io-threads {:optional true} ::sm/int]
+    [:http-server-worker-threads {:optional true} ::sm/int]
 
-(s/def ::admins ::us/set-of-valid-emails)
-(s/def ::file-change-snapshot-every ::us/integer)
-(s/def ::file-change-snapshot-timeout ::dt/duration)
+    [:telemetry-uri {:optional true} :string]
+    [:telemetry-with-taiga {:optional true} ::sm/boolean] ;; DELETE
 
-(s/def ::default-executor-parallelism ::us/integer)
-(s/def ::scheduled-executor-parallelism ::us/integer)
+    [:auto-file-snapshot-total {:optional true} ::sm/int]
+    [:auto-file-snapshot-every {:optional true} ::sm/int]
+    [:auto-file-snapshot-timeout {:optional true} ::dt/duration]
 
-(s/def ::worker-default-parallelism ::us/integer)
-(s/def ::worker-webhook-parallelism ::us/integer)
+    [:media-max-file-size {:optional true} ::sm/int]
+    [:deletion-delay {:optional true} ::dt/duration] ;; REVIEW
+    [:telemetry-enabled {:optional true} ::sm/boolean]
+    [:default-blob-version {:optional true} ::sm/int]
+    [:allow-demo-users {:optional true} ::sm/boolean]
+    [:error-report-webhook {:optional true} :string]
+    [:user-feedback-destination {:optional true} :string]
 
-(s/def ::authenticated-cookie-domain ::us/string)
-(s/def ::authenticated-cookie-name ::us/string)
-(s/def ::auth-token-cookie-name ::us/string)
-(s/def ::auth-token-cookie-max-age ::dt/duration)
+    [:default-rpc-rlimit {:optional true} [::sm/vec :string]]
+    [:rpc-rlimit-config {:optional true} ::fs/path]
+    [:rpc-climit-config {:optional true} ::fs/path]
 
-(s/def ::secret-key ::us/string)
-(s/def ::allow-demo-users ::us/boolean)
-(s/def ::assets-path ::us/string)
-(s/def ::database-password (s/nilable ::us/string))
-(s/def ::database-uri ::us/string)
-(s/def ::database-username (s/nilable ::us/string))
-(s/def ::database-readonly ::us/boolean)
-(s/def ::database-min-pool-size ::us/integer)
-(s/def ::database-max-pool-size ::us/integer)
+    [:audit-log-archive-uri {:optional true} :string]
+    [:audit-log-http-handler-concurrency {:optional true} ::sm/int]
 
-(s/def ::quotes-teams-per-profile ::us/integer)
-(s/def ::quotes-access-tokens-per-profile ::us/integer)
-(s/def ::quotes-projects-per-team ::us/integer)
-(s/def ::quotes-invitations-per-team ::us/integer)
-(s/def ::quotes-profiles-per-team ::us/integer)
-(s/def ::quotes-files-per-project ::us/integer)
-(s/def ::quotes-files-per-team ::us/integer)
-(s/def ::quotes-font-variants-per-team ::us/integer)
-(s/def ::quotes-comment-threads-per-file ::us/integer)
-(s/def ::quotes-comments-per-file ::us/integer)
+    [:default-executor-parallelism {:optional true} ::sm/int] ;; REVIEW
+    [:scheduled-executor-parallelism {:optional true} ::sm/int] ;; REVIEW
+    [:worker-default-parallelism {:optional true} ::sm/int]
+    [:worker-webhook-parallelism {:optional true} ::sm/int]
 
-(s/def ::default-blob-version ::us/integer)
-(s/def ::error-report-webhook ::us/string)
-(s/def ::user-feedback-destination ::us/string)
-(s/def ::github-client-id ::us/string)
-(s/def ::github-client-secret ::us/string)
-(s/def ::gitlab-base-uri ::us/string)
-(s/def ::gitlab-client-id ::us/string)
-(s/def ::gitlab-client-secret ::us/string)
-(s/def ::google-client-id ::us/string)
-(s/def ::google-client-secret ::us/string)
-(s/def ::oidc-client-id ::us/string)
-(s/def ::oidc-client-secret ::us/string)
-(s/def ::oidc-base-uri ::us/string)
-(s/def ::oidc-token-uri ::us/string)
-(s/def ::oidc-auth-uri ::us/string)
-(s/def ::oidc-user-uri ::us/string)
-(s/def ::oidc-scopes ::us/set-of-strings)
-(s/def ::oidc-roles ::us/set-of-strings)
-(s/def ::oidc-roles-attr ::us/string)
-(s/def ::oidc-email-attr ::us/string)
-(s/def ::oidc-name-attr ::us/string)
-(s/def ::host ::us/string)
-(s/def ::http-server-port ::us/integer)
-(s/def ::http-server-host ::us/string)
-(s/def ::http-server-max-body-size ::us/integer)
-(s/def ::http-server-max-multipart-body-size ::us/integer)
-(s/def ::http-server-io-threads ::us/integer)
-(s/def ::http-server-worker-threads ::us/integer)
-(s/def ::ldap-attrs-email ::us/string)
-(s/def ::ldap-attrs-fullname ::us/string)
-(s/def ::ldap-attrs-username ::us/string)
-(s/def ::ldap-base-dn ::us/string)
-(s/def ::ldap-bind-dn ::us/string)
-(s/def ::ldap-bind-password ::us/string)
-(s/def ::ldap-host ::us/string)
-(s/def ::ldap-port ::us/integer)
-(s/def ::ldap-ssl ::us/boolean)
-(s/def ::ldap-starttls ::us/boolean)
-(s/def ::ldap-user-query ::us/string)
-(s/def ::media-directory ::us/string)
-(s/def ::media-uri ::us/string)
-(s/def ::profile-bounce-max-age ::dt/duration)
-(s/def ::profile-bounce-threshold ::us/integer)
-(s/def ::profile-complaint-max-age ::dt/duration)
-(s/def ::profile-complaint-threshold ::us/integer)
-(s/def ::public-uri ::us/string)
-(s/def ::redis-uri ::us/string)
-(s/def ::registration-domain-whitelist ::us/set-of-strings)
+    [:database-password {:optional true} [:maybe :string]]
+    [:database-uri {:optional true} ::sm/uri]
+    [:database-username {:optional true} [:maybe :string]]
+    [:database-readonly {:optional true} ::sm/boolean]
+    [:database-min-pool-size {:optional true} ::sm/int]
+    [:database-max-pool-size {:optional true} ::sm/int]
 
-(s/def ::smtp-default-from ::us/string)
-(s/def ::smtp-default-reply-to ::us/string)
-(s/def ::smtp-host ::us/string)
-(s/def ::smtp-password (s/nilable ::us/string))
-(s/def ::smtp-port ::us/integer)
-(s/def ::smtp-ssl ::us/boolean)
-(s/def ::smtp-tls ::us/boolean)
-(s/def ::smtp-username (s/nilable ::us/string))
-(s/def ::urepl-host ::us/string)
-(s/def ::urepl-port ::us/integer)
-(s/def ::prepl-host ::us/string)
-(s/def ::prepl-port ::us/integer)
-(s/def ::assets-storage-backend ::us/keyword)
-(s/def ::storage-assets-fs-directory ::us/string)
-(s/def ::storage-assets-s3-bucket ::us/string)
-(s/def ::storage-assets-s3-region ::us/keyword)
-(s/def ::storage-assets-s3-endpoint ::us/string)
-(s/def ::telemetry-uri ::us/string)
-(s/def ::telemetry-with-taiga ::us/boolean)
-(s/def ::tenant ::us/string)
+    [:quotes-teams-per-profile {:optional true} ::sm/int]
+    [:quotes-access-tokens-per-profile {:optional true} ::sm/int]
+    [:quotes-projects-per-team {:optional true} ::sm/int]
+    [:quotes-invitations-per-team {:optional true} ::sm/int]
+    [:quotes-profiles-per-team {:optional true} ::sm/int]
+    [:quotes-files-per-project {:optional true} ::sm/int]
+    [:quotes-files-per-team {:optional true} ::sm/int]
+    [:quotes-font-variants-per-team {:optional true} ::sm/int]
+    [:quotes-comment-threads-per-file {:optional true} ::sm/int]
+    [:quotes-comments-per-file {:optional true} ::sm/int]
+    [:quotes-snapshots-per-file {:optional true} ::sm/int]
+    [:quotes-snapshots-per-team {:optional true} ::sm/int]
 
-(s/def ::config
-  (s/keys :opt-un [::secret-key
-                   ::flags
-                   ::admins
-                   ::allow-demo-users
-                   ::audit-log-archive-uri
-                   ::audit-log-http-handler-concurrency
-                   ::auth-token-cookie-name
-                   ::auth-token-cookie-max-age
-                   ::authenticated-cookie-name
-                   ::authenticated-cookie-domain
-                   ::database-password
-                   ::database-uri
-                   ::database-username
-                   ::database-readonly
-                   ::database-min-pool-size
-                   ::database-max-pool-size
-                   ::default-blob-version
-                   ::default-rpc-rlimit
-                   ::error-report-webhook
-                   ::default-executor-parallelism
-                   ::scheduled-executor-parallelism
-                   ::worker-default-parallelism
-                   ::worker-webhook-parallelism
-                   ::file-change-snapshot-every
-                   ::file-change-snapshot-timeout
-                   ::user-feedback-destination
-                   ::github-client-id
-                   ::github-client-secret
-                   ::gitlab-base-uri
-                   ::gitlab-client-id
-                   ::gitlab-client-secret
-                   ::google-client-id
-                   ::google-client-secret
-                   ::oidc-client-id
-                   ::oidc-client-secret
-                   ::oidc-base-uri
-                   ::oidc-token-uri
-                   ::oidc-auth-uri
-                   ::oidc-user-uri
-                   ::oidc-scopes
-                   ::oidc-roles-attr
-                   ::oidc-email-attr
-                   ::oidc-name-attr
-                   ::oidc-roles
-                   ::host
-                   ::http-server-host
-                   ::http-server-port
-                   ::http-server-max-body-size
-                   ::http-server-max-multipart-body-size
-                   ::http-server-io-threads
-                   ::http-server-worker-threads
-                   ::ldap-attrs-email
-                   ::ldap-attrs-fullname
-                   ::ldap-attrs-username
-                   ::ldap-base-dn
-                   ::ldap-bind-dn
-                   ::ldap-bind-password
-                   ::ldap-host
-                   ::ldap-port
-                   ::ldap-ssl
-                   ::ldap-starttls
-                   ::ldap-user-query
-                   ::local-assets-uri
-                   ::media-max-file-size
-                   ::profile-bounce-max-age
-                   ::profile-bounce-threshold
-                   ::profile-complaint-max-age
-                   ::profile-complaint-threshold
-                   ::public-uri
+    [:auth-data-cookie-domain {:optional true} :string]
+    [:auth-token-cookie-name {:optional true} :string]
+    [:auth-token-cookie-max-age {:optional true} ::dt/duration]
 
-                   ::quotes-teams-per-profile
-                   ::quotes-access-tokens-per-profile
-                   ::quotes-projects-per-team
-                   ::quotes-invitations-per-team
-                   ::quotes-profiles-per-team
-                   ::quotes-files-per-project
-                   ::quotes-files-per-team
-                   ::quotes-font-variants-per-team
-                   ::quotes-comment-threads-per-file
-                   ::quotes-comments-per-file
+    [:registration-domain-whitelist {:optional true} [::sm/set :string]]
+    [:email-verify-threshold {:optional true} ::dt/duration]
 
-                   ::redis-uri
-                   ::registration-domain-whitelist
-                   ::rpc-rlimit-config
+    [:github-client-id {:optional true} :string]
+    [:github-client-secret {:optional true} :string]
+    [:gitlab-base-uri {:optional true} :string]
+    [:gitlab-client-id {:optional true} :string]
+    [:gitlab-client-secret {:optional true} :string]
+    [:google-client-id {:optional true} :string]
+    [:google-client-secret {:optional true} :string]
+    [:oidc-client-id {:optional true} :string]
+    [:oidc-user-info-source {:optional true} :keyword]
+    [:oidc-client-secret {:optional true} :string]
+    [:oidc-base-uri {:optional true} :string]
+    [:oidc-token-uri {:optional true} :string]
+    [:oidc-auth-uri {:optional true} :string]
+    [:oidc-user-uri {:optional true} :string]
+    [:oidc-jwks-uri {:optional true} :string]
+    [:oidc-scopes {:optional true} [::sm/set :string]]
+    [:oidc-roles {:optional true} [::sm/set :string]]
+    [:oidc-roles-attr {:optional true} :string]
+    [:oidc-email-attr {:optional true} :string]
+    [:oidc-name-attr {:optional true} :string]
 
-                   ::semaphore-process-font
-                   ::semaphore-process-image
-                   ::semaphore-update-file
-                   ::semaphore-auth
+    [:ldap-attrs-email {:optional true} :string]
+    [:ldap-attrs-fullname {:optional true} :string]
+    [:ldap-attrs-username {:optional true} :string]
+    [:ldap-base-dn {:optional true} :string]
+    [:ldap-bind-dn {:optional true} :string]
+    [:ldap-bind-password {:optional true} :string]
+    [:ldap-host {:optional true} :string]
+    [:ldap-port {:optional true} ::sm/int]
+    [:ldap-ssl {:optional true} ::sm/boolean]
+    [:ldap-starttls {:optional true} ::sm/boolean]
+    [:ldap-user-query {:optional true} :string]
 
-                   ::smtp-default-from
-                   ::smtp-default-reply-to
-                   ::smtp-host
-                   ::smtp-password
-                   ::smtp-port
-                   ::smtp-ssl
-                   ::smtp-tls
-                   ::smtp-username
+    [:profile-bounce-max-age {:optional true} ::dt/duration]
+    [:profile-bounce-threshold {:optional true} ::sm/int]
+    [:profile-complaint-max-age {:optional true} ::dt/duration]
+    [:profile-complaint-threshold {:optional true} ::sm/int]
 
-                   ::urepl-host
-                   ::urepl-port
-                   ::prepl-host
-                   ::prepl-port
+    [:redis-uri {:optional true} ::sm/uri]
 
-                   ::assets-storage-backend
-                   ::storage-assets-fs-directory
-                   ::storage-assets-s3-bucket
-                   ::storage-assets-s3-region
-                   ::storage-assets-s3-endpoint
-                   ::telemetry-enabled
-                   ::telemetry-uri
-                   ::telemetry-referer
-                   ::telemetry-with-taiga
-                   ::tenant]))
+    [:email-domain-blacklist {:optional true} ::fs/path]
+    [:email-domain-whitelist {:optional true} ::fs/path]
+
+    [:smtp-default-from {:optional true} :string]
+    [:smtp-default-reply-to {:optional true} :string]
+    [:smtp-host {:optional true} :string]
+    [:smtp-password {:optional true} [:maybe :string]]
+    [:smtp-port {:optional true} ::sm/int]
+    [:smtp-ssl {:optional true} ::sm/boolean]
+    [:smtp-tls {:optional true} ::sm/boolean]
+    [:smtp-username {:optional true} [:maybe :string]]
+
+    [:urepl-host {:optional true} :string]
+    [:urepl-port {:optional true} ::sm/int]
+    [:prepl-host {:optional true} :string]
+    [:prepl-port {:optional true} ::sm/int]
+
+    [:media-directory {:optional true} :string] ;; REVIEW
+    [:media-uri {:optional true} :string]
+    [:assets-path {:optional true} :string]
+
+    ;; Legacy, will be removed in 2.5
+    [:assets-storage-backend {:optional true} :keyword]
+    [:storage-assets-fs-directory {:optional true} :string]
+    [:storage-assets-s3-bucket {:optional true} :string]
+    [:storage-assets-s3-region {:optional true} :keyword]
+    [:storage-assets-s3-endpoint {:optional true} ::sm/uri]
+    [:storage-assets-s3-io-threads {:optional true} ::sm/int]
+
+    [:objects-storage-backend {:optional true} :keyword]
+    [:objects-storage-fs-directory {:optional true} :string]
+    [:objects-storage-s3-bucket {:optional true} :string]
+    [:objects-storage-s3-region {:optional true} :keyword]
+    [:objects-storage-s3-endpoint {:optional true} ::sm/uri]
+    [:objects-storage-s3-io-threads {:optional true} ::sm/int]]))
 
 (def default-flags
   [:enable-backend-api-doc
    :enable-backend-openapi-doc
    :enable-backend-worker
    :enable-secure-session-cookies
-   :enable-email-verification])
+   :enable-email-verification
+   :enable-v2-migration])
 
 (defn- parse-flags
   [config]
@@ -346,20 +254,22 @@
      {}
      env)))
 
-(defn- read-config
-  []
-  (try
-    (->> (read-env "penpot")
-         (merge defaults)
-         (us/conform ::config))
-    (catch Throwable e
-      (when (ex/error? e)
-        (println ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;")
-        (println "Error on validating configuration:")
-        (println (some-> e ex-data ex/explain))
-        (println (ex/explain (ex-data e)))
-        (println ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"))
-      (throw e))))
+(def decode-config
+  (sm/decoder schema:config sm/string-transformer))
+
+(def validate-config
+  (sm/validator schema:config))
+
+(def explain-config
+  (sm/explainer schema:config))
+
+(defn read-config
+  "Reads the configuration from enviroment variables and decodes all
+  known values."
+  [& {:keys [prefix default] :or {prefix "penpot"}}]
+  (->> (read-env prefix)
+       (merge default)
+       (decode-config)))
 
 (def version
   (v/parse (or (some-> (io/resource "version.txt")
@@ -367,11 +277,30 @@
                        (str/trim))
                "%version%")))
 
-(defonce ^:dynamic config (read-config))
+(defonce ^:dynamic config (read-config :default default))
 (defonce ^:dynamic flags (parse-flags config))
 
-(def deletion-delay
-  (dt/duration {:days 7}))
+(defn validate!
+  "Validate the currently loaded configuration data."
+  [& {:keys [exit-on-error?] :or {exit-on-error? true}}]
+  (if (validate-config config)
+    true
+    (let [explain (explain-config config)]
+      (println "Error on validating configuration:")
+      (sm/pretty-explain explain
+                         :variant ::sm/schemaless-explain
+                         :message "Configuration Validation Error")
+      (flush)
+      (if exit-on-error?
+        (System/exit -1)
+        (ex/raise :type :validation
+                  :code :config-validaton
+                  ::sm/explain explain)))))
+
+(defn get-deletion-delay
+  []
+  (or (c/get config :deletion-delay)
+      (dt/duration {:days 7})))
 
 (defn get
   "A configuration getter. Helps code be more testable."

backend/src/app/db.clj

@@ -5,13 +5,13 @@
 ;; Copyright (c) KALEIDOS INC
 
 (ns app.db
-  (:refer-clojure :exclude [get])
+  (:refer-clojure :exclude [get run!])
   (:require
    [app.common.data :as d]
    [app.common.exceptions :as ex]
    [app.common.geom.point :as gpt]
    [app.common.logging :as l]
-   [app.common.spec :as us]
+   [app.common.schema :as sm]
    [app.common.transit :as t]
    [app.common.uuid :as uuid]
    [app.db.sql :as sql]
@@ -19,7 +19,7 @@
    [app.util.json :as json]
    [app.util.time :as dt]
    [clojure.java.io :as io]
-   [clojure.spec.alpha :as s]
+   [clojure.set :as set]
    [integrant.core :as ig]
    [next.jdbc :as jdbc]
    [next.jdbc.date-time :as jdbc-dt])
@@ -48,27 +48,17 @@
 ;; Initialization
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
-(s/def ::connection-timeout ::us/integer)
-(s/def ::max-size ::us/integer)
-(s/def ::min-size ::us/integer)
-(s/def ::name keyword?)
-(s/def ::password ::us/string)
-(s/def ::uri ::us/not-empty-string)
-(s/def ::username ::us/string)
-(s/def ::validation-timeout ::us/integer)
-(s/def ::read-only? ::us/boolean)
-
-(s/def ::pool-options
-  (s/keys :opt [::uri
-                ::name
-                ::min-size
-                ::max-size
-                ::connection-timeout
-                ::validation-timeout
-                ::username
-                ::password
-                ::mtx/metrics
-                ::read-only?]))
+(def ^:private schema:pool-options
+  [:map {:title "pool-options"}
+   [::connect-timeout {:optional true} ::sm/int]
+   [::max-size {:optional true} ::sm/int]
+   [::min-size {:optional true} ::sm/int]
+   [::name {:optional true} :keyword]
+   [::uri {:optional true} ::sm/uri]
+   [::password {:optional true} :string]
+   [::username {:optional true} :string]
+   [::validation-timeout {:optional true} ::sm/int]
+   [::read-only {:optional true} ::sm/boolean]])
 
 (def defaults
   {::name :main
@@ -78,27 +68,26 @@
    ::validation-timeout 10000
    ::idle-timeout 120000 ; 2min
    ::max-lifetime 1800000 ; 30m
-   ::read-only? false})
+   ::read-only false})
 
-(defmethod ig/prep-key ::pool
-  [_ cfg]
-  (merge defaults (d/without-nils cfg)))
-
-;; Don't validate here, just validate that a map is received.
-(defmethod ig/pre-init-spec ::pool [_] ::pool-options)
+(defmethod ig/assert-key ::pool
+  [_ options]
+  (assert (sm/check schema:pool-options options)))
 
 (defmethod ig/init-key ::pool
-  [_ {:keys [::uri ::read-only?] :as cfg}]
-  (when uri
-    (l/info :hint "initialize connection pool"
-            :name (d/name (::name cfg))
-            :uri uri
-            :read-only read-only?
-            :with-credentials (and (contains? cfg ::username)
-                                   (contains? cfg ::password))
-            :min-size (::min-size cfg)
-          :max-size (::max-size cfg))
-    (create-pool cfg)))
+  [_ cfg]
+  (let [{:keys [::uri ::read-only] :as cfg}
+        (merge defaults cfg)]
+    (when uri
+      (l/info :hint "initialize connection pool"
+              :name (d/name (::name cfg))
+              :uri (str uri)
+              :read-only read-only
+              :credentials (and (contains? cfg ::username)
+                                (contains? cfg ::password))
+              :min-size (::min-size cfg)
+              :max-size (::max-size cfg))
+      (create-pool cfg))))
 
 (defmethod ig/halt-key! ::pool
   [_ pool]
@@ -114,13 +103,15 @@
        "SET idle_in_transaction_session_timeout = 300000;"))
 
 (defn- create-datasource-config
-  [{:keys [::mtx/metrics ::uri] :as cfg}]
+  [{:keys [::uri] :as cfg}]
+
+  ;; (app.common.pprint/pprint cfg)
   (let [config (HikariConfig.)]
     (doto config
       (.setJdbcUrl           (str "jdbc:" uri))
       (.setPoolName          (d/name (::name cfg)))
       (.setAutoCommit true)
-      (.setReadOnly          (::read-only? cfg))
+      (.setReadOnly          (::read-only cfg))
       (.setConnectionTimeout (::connection-timeout cfg))
       (.setValidationTimeout (::validation-timeout cfg))
       (.setIdleTimeout       (::idle-timeout cfg))
@@ -131,8 +122,8 @@
       (.setInitializationFailTimeout -1))
 
     ;; When metrics namespace is provided
-    (when metrics
-      (->> (::mtx/registry metrics)
+    (when-let [instance (::mtx/metrics cfg)]
+      (->> (mtx/get-registry instance)
            (PrometheusMetricsTrackerFactory.)
            (.setMetricsTrackerFactory config)))
 
@@ -145,10 +136,26 @@
   [v]
   (instance? javax.sql.DataSource v))
 
-(s/def ::conn some?)
-(s/def ::nilable-pool (s/nilable ::pool))
-(s/def ::pool pool?)
-(s/def ::pool-or-conn some?)
+(defn connection?
+  [conn]
+  (instance? Connection conn))
+
+(defn connectable?
+  [o]
+  (or (connection? o)
+      (pool? o)))
+
+(sm/register!
+ {:type ::conn
+  :pred connection?})
+
+(sm/register!
+ {:type ::connectable
+  :pred connectable?})
+
+(sm/register!
+ {:type ::pool
+  :pred pool?})
 
 (defn closed?
   [pool]
@@ -218,52 +225,164 @@
 
 (defmacro with-atomic
   [& args]
-  `(jdbc/with-transaction ~@args))
+  (if (symbol? (first args))
+    (let [cfgs (first args)
+          body (rest args)]
+      `(jdbc/with-transaction [conn# (::pool ~cfgs)]
+         (let [~cfgs (assoc ~cfgs ::conn conn#)]
+           ~@body)))
+    `(jdbc/with-transaction ~@args)))
 
 (defn open
-  [pool]
-  (jdbc/get-connection pool))
+  [system-or-pool]
+  (if (pool? system-or-pool)
+    (jdbc/get-connection system-or-pool)
+    (if (map? system-or-pool)
+      (open (::pool system-or-pool))
+      (throw (IllegalArgumentException. "unable to resolve connection pool")))))
+
+(defn get-update-count
+  [result]
+  (:next.jdbc/update-count result))
+
+(defn get-connection
+  [cfg-or-conn]
+  (if (connection? cfg-or-conn)
+    cfg-or-conn
+    (if (map? cfg-or-conn)
+      (get-connection (::conn cfg-or-conn))
+      (throw (IllegalArgumentException. "unable to resolve connection")))))
+
+(defn connection-map?
+  "Check if the provided value is a map like data structure that
+  contains a database connection."
+  [o]
+  (and (map? o) (connection? (::conn o))))
+
+(defn get-connectable
+  "Resolve to a connection or connection pool instance; if it is not
+  possible, raises an exception"
+  [o]
+  (cond
+    (connection? o) o
+    (pool? o)       o
+    (map? o)        (get-connectable (or (::conn o) (::pool o)))
+    :else           (throw (IllegalArgumentException. "unable to resolve connectable"))))
+
+(def ^:private params-mapping
+  {::return-keys? :return-keys
+   ::return-keys :return-keys})
+
+(defn rename-opts
+  [opts]
+  (set/rename-keys opts params-mapping))
+
+(def ^:private default-insert-opts
+  {:builder-fn sql/as-kebab-maps
+   :return-keys true})
 
 (def ^:private default-opts
   {:builder-fn sql/as-kebab-maps})
 
 (defn exec!
-  ([ds sv]
-   (jdbc/execute! ds sv default-opts))
+  ([ds sv] (exec! ds sv nil))
   ([ds sv opts]
-   (jdbc/execute! ds sv (merge default-opts opts))))
+   (let [conn (get-connectable ds)
+         opts (if (empty? opts)
+                default-opts
+                (into default-opts (rename-opts opts)))]
+     (jdbc/execute! conn sv opts))))
 
 (defn exec-one!
-  ([ds sv]
-   (jdbc/execute-one! ds sv default-opts))
+  ([ds sv] (exec-one! ds sv nil))
   ([ds sv opts]
-   (jdbc/execute-one! ds sv
-                      (-> (merge default-opts opts)
-                          (assoc :return-keys (::return-keys? opts false))))))
+   (let [conn (get-connectable ds)
+         opts (if (empty? opts)
+                default-opts
+                (into default-opts (rename-opts opts)))]
+     (jdbc/execute-one! conn sv opts))))
 
 (defn insert!
+  "A helper that builds an insert sql statement and executes it. By
+  default returns the inserted row with all the field; you can delimit
+  the returned columns with the `::columns` option."
   [ds table params & {:as opts}]
-  (exec-one! ds
-             (sql/insert table params opts)
-             (merge {::return-keys? true} opts)))
+  (let [conn (get-connectable ds)
+        sql  (sql/insert table params opts)
+        opts (if (empty? opts)
+               default-insert-opts
+               (into default-insert-opts (rename-opts opts)))]
+    (jdbc/execute-one! conn sql opts)))
 
-(defn insert-multi!
+(defn insert-many!
+  "An optimized version of `insert!` that perform insertion of multiple
+  values at once.
+
+  This expands to a single SQL statement with placeholders for every
+  value being inserted. For large data sets, this may exceed the limit
+  of sql string size and/or number of parameters."
   [ds table cols rows & {:as opts}]
-  (exec! ds
-         (sql/insert-multi table cols rows opts)
-         (merge {::return-keys? true} opts)))
+  (let [conn (get-connectable ds)
+        sql  (sql/insert-many table cols rows opts)
+        opts (if (empty? opts)
+               default-insert-opts
+               (into default-insert-opts (rename-opts opts)))
+        opts (update opts :return-keys boolean)]
+    (jdbc/execute! conn sql opts)))
 
 (defn update!
+  "A helper that build an UPDATE SQL statement and executes it.
+
+   Given a connectable object, a table name, a hash map of columns and
+  values to set, and either a hash map of columns and values to search
+  on or a vector of a SQL where clause and parameters, perform an
+  update on the table.
+
+  By default returns an object with the number of affected rows; a
+  complete row can be returned if you pass `::return-keys` with `true`
+  or with a vector of columns.
+
+  Also it can be combined with the `::many` option if you perform an
+  update to multiple rows and you want all the affected rows to be
+  returned."
   [ds table params where & {:as opts}]
-  (exec-one! ds
-             (sql/update table params where opts)
-             (merge {::return-keys? true} opts)))
+  (let [conn (get-connectable ds)
+        sql  (sql/update table params where opts)
+        opts (if (empty? opts)
+               default-opts
+               (into default-opts (rename-opts opts)))
+        opts (update opts :return-keys boolean)]
+    (if (::many opts)
+      (jdbc/execute! conn sql opts)
+      (jdbc/execute-one! conn sql opts))))
 
 (defn delete!
+  "A helper that builds an DELETE SQL statement and executes it.
+
+  Given a connectable object, a table name, and either a hash map of columns
+  and values to search on or a vector of a SQL where clause and parameters,
+  perform a delete on the table.
+
+  By default returns an object with the number of affected rows; a
+  complete row can be returned if you pass `::return-keys` with `true`
+  or with a vector of columns.
+
+  Also it can be combined with the `::many` option if you perform an
+  update to multiple rows and you want all the affected rows to be
+  returned."
   [ds table params & {:as opts}]
-  (exec-one! ds
-             (sql/delete table params opts)
-             (merge {::return-keys? true} opts)))
+  (let [conn (get-connectable ds)
+        sql  (sql/delete table params opts)
+        opts (if (empty? opts)
+               default-opts
+               (into default-opts (rename-opts opts)))]
+    (if (::many opts)
+      (jdbc/execute! conn sql opts)
+      (jdbc/execute-one! conn sql opts))))
+
+(defn query
+  [ds table params & {:as opts}]
+  (exec! ds (sql/select table params opts) opts))
 
 (defn is-row-deleted?
   [{:keys [deleted-at]}]
@@ -277,7 +396,7 @@
   [ds table params & {:as opts}]
   (let [rows (exec! ds (sql/select table params opts))
         rows (cond->> rows
-               (::remove-deleted? opts true)
+               (::remove-deleted opts true)
                (remove is-row-deleted?))]
     (first rows)))
 
@@ -286,21 +405,42 @@
   filters. Raises :not-found exception if no object is found."
   [ds table params & {:as opts}]
   (let [row (get* ds table params opts)]
-    (when (and (not row) (::check-deleted? opts true))
+    (when (and (not row) (::check-deleted opts true))
       (ex/raise :type :not-found
                 :code :object-not-found
                 :table table
+                :params params
                 :hint "database object not found"))
     row))
 
+(defn plan
+  [ds sql]
+  (-> (get-connectable ds)
+      (jdbc/plan sql sql/default-opts)))
+
+(defn cursor
+  "Return a lazy seq of rows using server side cursors"
+  [conn query & {:keys [chunk-size] :or {chunk-size 25}}]
+  (let [cname  (str (gensym "cursor_"))
+        fquery [(str "FETCH " chunk-size " FROM " cname)]]
+
+    ;; declare cursor
+    (exec-one! conn
+               (if (vector? query)
+                 (into [(str "DECLARE " cname " CURSOR FOR " (nth query 0))]
+                       (rest query))
+                 [(str "DECLARE " cname " CURSOR FOR " query)]))
+
+    ;; return a lazy seq
+    ((fn fetch-more []
+       (lazy-seq
+        (when-let [chunk (seq (exec! conn fquery))]
+          (concat chunk (fetch-more))))))))
+
 (defn get-by-id
   [ds table id & {:as opts}]
   (get ds table {:id id} opts))
 
-(defn query
-  [ds table params & {:as opts}]
-  (exec! ds (sql/select table params opts)))
-
 (defn pgobject?
   ([v]
    (instance? PGobject v))
@@ -353,6 +493,10 @@
       (.createArrayOf conn ^String type (into-array Object objects))
       (.createArrayOf conn ^String type objects))))
 
+(defn encode-pgarray
+  [data conn type]
+  (create-array conn type data))
+
 (defn decode-pgpoint
   [^PGpoint v]
   (gpt/point (.-x v) (.-y v)))
@@ -361,10 +505,6 @@
   [data]
   (org.postgresql.util.PGInterval. ^String data))
 
-(defn connection?
-  [conn]
-  (instance? Connection conn))
-
 (defn savepoint
   ([^Connection conn]
    (.setSavepoint conn))
@@ -372,14 +512,77 @@
    (.setSavepoint conn (name label))))
 
 (defn release!
-  [^Connection conn ^Savepoint sp ]
+  [^Connection conn ^Savepoint sp]
   (.releaseSavepoint conn sp))
 
 (defn rollback!
-  ([^Connection conn]
-   (.rollback conn))
-  ([^Connection conn ^Savepoint sp]
-   (.rollback conn sp)))
+  ([conn]
+   (if (and (map? conn) (::savepoint conn))
+     (rollback! conn (::savepoint conn))
+     (let [^Connection conn (get-connection conn)]
+       (l/trc :hint "explicit rollback requested")
+       (.rollback conn))))
+  ([conn ^Savepoint sp]
+   (let [^Connection conn (get-connection conn)]
+     (l/trc :hint "explicit rollback requested (savepoint)")
+     (.rollback conn sp))))
+
+(defn tx-run!
+  [system f & params]
+  (cond
+    (connection? system)
+    (tx-run! {::conn system} f)
+
+    (pool? system)
+    (tx-run! {::pool system} f)
+
+    (::conn system)
+    (let [conn (::conn system)
+          sp   (savepoint conn)]
+      (try
+        (let [system' (-> system
+                          (assoc ::savepoint sp)
+                          (dissoc ::rollback))
+              result  (apply f system' params)]
+          (if (::rollback system)
+            (rollback! conn sp)
+            (release! conn sp))
+          result)
+        (catch Throwable cause
+          (.rollback ^Connection conn ^Savepoint sp)
+          (throw cause))))
+
+    (::pool system)
+    (with-atomic [conn (::pool system)]
+      (let [system' (-> system
+                        (assoc ::conn conn)
+                        (dissoc ::rollback))
+            result  (apply f system' params)]
+        (when (::rollback system)
+          (rollback! conn))
+        result))
+
+    :else
+    (throw (IllegalArgumentException. "invalid system/cfg provided"))))
+
+(defn run!
+  [system f & params]
+  (cond
+    (connection? system)
+    (run! {::conn system} f)
+
+    (pool? system)
+    (run! {::pool system} f)
+
+    (::conn system)
+    (apply f system params)
+
+    (::pool system)
+    (with-open [^Connection conn (open (::pool system))]
+      (apply f (assoc system ::conn conn) params))
+
+    :else
+    (throw (IllegalArgumentException. "invalid arguments"))))
 
 (defn interval
   [o]
@@ -450,11 +653,6 @@
       (.setType "jsonb")
       (.setValue (json/encode-str data)))))
 
-(defn get-update-count
-  [result]
-  (:next.jdbc/update-count result))
-
-
 ;; --- Locks
 
 (def ^:private siphash-state

backend/src/app/db/sql.clj

@@ -29,11 +29,14 @@
   ([table key-map opts]
    (let [opts (merge default-opts opts)
          opts (cond-> opts
-                (:on-conflict-do-nothing opts)
+                (::db/on-conflict-do-nothing? opts)
+                (assoc :suffix "ON CONFLICT DO NOTHING")
+
+                (::on-conflict-do-nothing opts)
                 (assoc :suffix "ON CONFLICT DO NOTHING"))]
      (sql/for-insert table key-map opts))))
 
-(defn insert-multi
+(defn insert-many
   [table cols rows opts]
   (let [opts (merge default-opts opts)]
     (sql/for-insert-multi table cols rows opts)))
@@ -44,22 +47,30 @@
   ([table where-params opts]
    (let [opts (merge default-opts opts)
          opts (cond-> opts
-                (::db/for-update? opts) (assoc :suffix "FOR UPDATE")
-                (::db/for-share? opts)  (assoc :suffix "FOR KEY SHARE")
-                (:for-update opts)      (assoc :suffix "FOR UPDATE")
-                (:for-key-share opts)   (assoc :suffix "FOR KEY SHARE"))]
+                (::order-by opts)   (assoc :order-by (::order-by opts))
+                (::columns opts)    (assoc :columns (::columns opts))
+                (::for-update opts) (assoc :suffix "FOR UPDATE")
+                (::for-share opts)  (assoc :suffix "FOR SHARE"))]
      (sql/for-query table where-params opts))))
 
 (defn update
   ([table key-map where-params]
    (update table key-map where-params nil))
   ([table key-map where-params opts]
-   (let [opts (merge default-opts opts)]
+   (let [opts (into default-opts opts)
+         keys (::db/return-keys opts)
+         opts (if (vector? keys)
+                (assoc opts :suffix (str "RETURNING " (sql/as-cols keys opts)))
+                opts)]
      (sql/for-update table key-map where-params opts))))
 
 (defn delete
   ([table where-params]
    (delete table where-params nil))
   ([table where-params opts]
-   (let [opts (merge default-opts opts)]
+   (let [opts (merge default-opts opts)
+         keys (::db/return-keys opts)
+         opts (if (vector? keys)
+                (assoc opts :suffix (str "RETURNING " (sql/as-cols keys opts)))
+                opts)]
      (sql/for-delete table where-params opts))))

backend/src/app/email.clj

@@ -7,19 +7,17 @@
 (ns app.email
   "Main api for send emails."
   (:require
+   [app.common.data.macros :as dm]
    [app.common.exceptions :as ex]
    [app.common.logging :as l]
    [app.common.pprint :as pp]
-   [app.common.spec :as us]
+   [app.common.schema :as sm]
    [app.config :as cf]
    [app.db :as db]
    [app.db.sql :as sql]
-   [app.email.invite-to-team :as-alias email.invite-to-team]
-   [app.metrics :as mtx]
    [app.util.template :as tmpl]
    [app.worker :as wrk]
    [clojure.java.io :as io]
-   [clojure.spec.alpha :as s]
    [cuerdas.core :as str]
    [integrant.core :as ig])
   (:import
@@ -149,9 +147,27 @@
     "mail.smtp.timeout" timeout
     "mail.smtp.connectiontimeout" timeout}))
 
+(def ^:private schema:smtp-config
+  [:map
+   [::username {:optional true} :string]
+   [::password {:optional true} :string]
+   [::tls {:optional true} ::sm/boolean]
+   [::ssl {:optional true} ::sm/boolean]
+   [::host {:optional true} :string]
+   [::port {:optional true} ::sm/int]
+   [::default-from {:optional true} :string]
+   [::default-reply-to {:optional true} :string]])
+
+(def valid-smtp-config?
+  (sm/check-fn schema:smtp-config))
+
 (defn- create-smtp-session
   ^Session
   [cfg]
+  (dm/assert!
+   "expected valid smtp config"
+   (valid-smtp-config? cfg))
+
   (let [props (opts->props cfg)]
     (Session/getInstance props)))
 
@@ -201,50 +217,47 @@
               [{:type "text/html"
                 :content html}]))}))
 
-(s/def ::priority #{:high :low})
-(s/def ::to (s/or :single ::us/email
-                  :multi (s/coll-of ::us/email)))
-(s/def ::from ::us/email)
-(s/def ::reply-to ::us/email)
-(s/def ::lang string?)
-(s/def ::extra-data ::us/string)
+(def ^:private schema:context
+  [:map
+   [:to [:or ::sm/email [::sm/vec ::sm/email]]]
+   [:reply-to {:optional true} ::sm/email]
+   [:from {:optional true} ::sm/email]
+   [:lang {:optional true} ::sm/text]
+   [:priority {:optional true} [:enum :high :low]]
+   [:extra-data {:optional true} ::sm/text]])
 
-(s/def ::context
-  (s/keys :req-un [::to]
-          :opt-un [::reply-to ::from ::lang ::priority ::extra-data]))
+(def ^:private valid-context?
+  (sm/validator schema:context))
 
 (defn template-factory
-  ([id] (template-factory id {}))
-  ([id extra-context]
-   (s/assert keyword? id)
-   (fn [context]
-     (us/verify ::context context)
-     (when-let [spec (s/get-spec id)]
-       (s/assert spec context))
+  [& {:keys [id schema]}]
+  (assert (keyword? id) "id should be provided and it should be a keyword")
+  (let [check-fn (if schema
+                   (sm/check-fn schema)
+                   (constantly nil))]
+    (fn [context]
+      (assert (valid-context? context) "expected a valid context")
+      (check-fn context)
 
-     (let [context (merge (if (fn? extra-context)
-                            (extra-context)
-                            extra-context)
-                          context)
-           email   (build-email-template id context)]
-       (when-not email
-         (ex/raise :type :internal
-                   :code :email-template-does-not-exists
-                   :hint "seems like the template is wrong or does not exists."
-                   :context {:id id}))
-       (cond-> (assoc email :id (name id))
-         (:extra-data context)
-         (assoc :extra-data (:extra-data context))
+      (let [email (build-email-template id context)]
+        (when-not email
+          (ex/raise :type :internal
+                    :code :email-template-does-not-exists
+                    :hint "seems like the template is wrong or does not exists."
+                    :template-id id))
 
-         (:from context)
-         (assoc :from (:from context))
+        (cond-> (assoc email :id (name id))
+          (:extra-data context)
+          (assoc :extra-data (:extra-data context))
 
-         (:reply-to context)
-         (assoc :reply-to (:reply-to context))
+          (:from context)
+          (assoc :from (:from context))
 
-         (:to context)
-         (assoc :to (:to context)))))))
+          (:reply-to context)
+          (assoc :reply-to (:reply-to context))
 
+          (:to context)
+          (assoc :to (:to context)))))))
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; PUBLIC HIGH-LEVEL API
@@ -258,69 +271,52 @@
   "Schedule an already defined email to be sent using asynchronously
   using worker task."
   [{:keys [::conn ::factory] :as context}]
-  (us/verify some? conn)
+  (assert (db/connection? conn) "expected a valid database connection")
+
   (let [email (if factory
                 (factory context)
                 (dissoc context ::conn))]
-    (wrk/submit! (merge
-                  {::wrk/task :sendmail
-                   ::wrk/delay 0
-                   ::wrk/max-retries 4
-                   ::wrk/priority 200
-                   ::wrk/conn conn}
-                  email))))
+    (wrk/submit! {::wrk/task :sendmail
+                  ::wrk/delay 0
+                  ::wrk/max-retries 4
+                  ::wrk/priority 200
+                  ::db/conn conn
+                  ::wrk/params email})))
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; SENDMAIL FN / TASK HANDLER
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
-(s/def ::username ::cf/smtp-username)
-(s/def ::password ::cf/smtp-password)
-(s/def ::tls ::cf/smtp-tls)
-(s/def ::ssl ::cf/smtp-ssl)
-(s/def ::host ::cf/smtp-host)
-(s/def ::port ::cf/smtp-port)
-(s/def ::default-reply-to ::cf/smtp-default-reply-to)
-(s/def ::default-from ::cf/smtp-default-from)
-
-(s/def ::smtp-config
-  (s/keys :opt [::username
-                ::password
-                ::tls
-                ::ssl
-                ::host
-                ::port
-                ::default-from
-                ::default-reply-to]))
-
 (declare send-to-logger!)
 
-(s/def ::sendmail fn?)
-
-(defmethod ig/pre-init-spec ::sendmail [_]
-  (s/spec ::smtp-config))
-
 (defmethod ig/init-key ::sendmail
   [_ cfg]
   (fn [params]
     (when (contains? cf/flags :smtp)
       (let [session (create-smtp-session cfg)]
-        (with-open [transport (.getTransport session (if (:ssl cfg) "smtps" "smtp"))]
+        (with-open [transport (.getTransport session (if (::ssl cfg) "smtps" "smtp"))]
           (.connect ^Transport transport
+                    ^String (::host cfg)
+                    ^String (::port cfg)
                     ^String (::username cfg)
                     ^String (::password cfg))
 
           (let [^MimeMessage message (create-smtp-message cfg session params)]
+            (l/dbg :hint "sendmail"
+                   :id (:id params)
+                   :to (:to params)
+                   :subject (str/trim (:subject params)))
+
             (.sendMessage ^Transport transport
                           ^MimeMessage message
                           (.getAllRecipients message))))))
 
-    (when (or (contains? cf/flags :log-emails)
-              (not (contains? cf/flags :smtp)))
+    (when (contains? cf/flags :log-emails)
       (send-to-logger! cfg params))))
 
-(defmethod ig/pre-init-spec ::handler [_]
-  (s/keys :req [::sendmail ::mtx/metrics]))
+(defmethod ig/assert-key ::handler
+  [_ params]
+  (assert (fn? (::sendmail params)) "expected valid sendmail handler"))
 
 (defmethod ig/init-key ::handler
   [_ {:keys [::sendmail]}]
@@ -341,58 +337,119 @@
                                (map :content)
                                first)))
                (println "******** end email" (:id email) "**********"))]
-    (l/info ::l/raw out)))
+    (l/raw! :info out)))
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; EMAIL FACTORIES
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
-(s/def ::subject ::us/string)
-(s/def ::content ::us/string)
-
-(s/def ::feedback
-  (s/keys :req-un [::subject ::content]))
+(def ^:private schema:feedback
+  [:map
+   [:subject ::sm/text]
+   [:content ::sm/text]])
 
 (def feedback
   "A profile feedback email."
-  (template-factory ::feedback))
+  (template-factory
+   :id ::feedback
+   :schema schema:feedback))
 
-(s/def ::name ::us/string)
-(s/def ::register
-  (s/keys :req-un [::name]))
+(def ^:private schema:register
+  [:map [:name ::sm/text]])
 
 (def register
   "A new profile registration welcome email."
-  (template-factory ::register))
+  (template-factory
+   :id ::register
+   :schema schema:register))
 
-(s/def ::token ::us/string)
-(s/def ::password-recovery
-  (s/keys :req-un [::name ::token]))
+(def ^:private schema:password-recovery
+  [:map
+   [:name ::sm/text]
+   [:token ::sm/text]])
 
 (def password-recovery
   "A password recovery notification email."
-  (template-factory ::password-recovery))
+  (template-factory
+   :id ::password-recovery
+   :schema schema:password-recovery))
 
-(s/def ::pending-email ::us/email)
-(s/def ::change-email
-  (s/keys :req-un [::name ::pending-email ::token]))
+(def ^:private schema:change-email
+  [:map
+   [:name ::sm/text]
+   [:pending-email ::sm/email]
+   [:token ::sm/text]])
 
 (def change-email
   "Password change confirmation email"
-  (template-factory ::change-email))
+  (template-factory
+   :id ::change-email
+   :schema schema:change-email))
 
-(s/def ::email.invite-to-team/invited-by ::us/string)
-(s/def ::email.invite-to-team/team ::us/string)
-(s/def ::email.invite-to-team/token ::us/string)
-
-(s/def ::invite-to-team
-  (s/keys :req-un [::email.invite-to-team/invited-by
-                   ::email.invite-to-team/token
-                   ::email.invite-to-team/team]))
+(def ^:private schema:invite-to-team
+  [:map
+   [:invited-by ::sm/text]
+   [:team ::sm/text]
+   [:token ::sm/text]])
 
 (def invite-to-team
   "Teams member invitation email."
-  (template-factory ::invite-to-team))
+  (template-factory
+   :id ::invite-to-team
+   :schema schema:invite-to-team))
+
+(def ^:private schema:join-team
+  [:map
+   [:invited-by ::sm/text]
+   [:team ::sm/text]
+   [:team-id ::sm/uuid]])
+
+(def join-team
+  "Teams member joined after request email."
+  (template-factory
+   :id ::join-team
+   :schema schema:join-team))
+
+(def ^:private schema:request-file-access
+  [:map
+   [:requested-by ::sm/text]
+   [:requested-by-email ::sm/text]
+   [:team-name ::sm/text]
+   [:team-id ::sm/uuid]
+   [:file-name ::sm/text]
+   [:file-id ::sm/uuid]
+   [:page-id ::sm/uuid]])
+
+(def request-file-access
+  "File access request email."
+  (template-factory
+   :id ::request-file-access
+   :schema schema:request-file-access))
+
+(def request-file-access-yourpenpot
+  "File access on Your Penpot request email."
+  (template-factory
+   :id ::request-file-access-yourpenpot
+   :schema schema:request-file-access))
+
+(def request-file-access-yourpenpot-view
+  "File access on Your Penpot view mode request email."
+  (template-factory
+   :id ::request-file-access-yourpenpot-view
+   :schema schema:request-file-access))
+
+(def ^:private schema:request-team-access
+  [:map
+   [:requested-by ::sm/text]
+   [:requested-by-email ::sm/text]
+   [:team-name ::sm/text]
+   [:team-id ::sm/uuid]])
+
+(def request-team-access
+  "Team access request email."
+  (template-factory
+   :id ::request-team-access
+   :schema schema:request-team-access))
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; BOUNCE/COMPLAINS HELPERS
@@ -443,3 +500,11 @@
                                             {:email email :type "bounce"}
                                             {:limit 10}))]
      (>= (count reports) threshold))))
+
+(defn has-reports?
+  ([conn email] (has-reports? conn email nil))
+  ([conn email {:keys [threshold] :or {threshold 1}}]
+   (let [reports (db/exec! conn (sql/select :global-complaint-report
+                                            {:email email}
+                                            {:limit 10}))]
+     (>= (count reports) threshold))))

backend/src/app/email/blacklist.clj

@@ -0,0 +1,47 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS INC
+
+(ns app.email.blacklist
+  "Email blacklist provider"
+  (:refer-clojure :exclude [contains?])
+  (:require
+   [app.common.logging :as l]
+   [app.config :as cf]
+   [app.email :as-alias email]
+   [clojure.core :as c]
+   [clojure.java.io :as io]
+   [cuerdas.core :as str]
+   [integrant.core :as ig]))
+
+(defmethod ig/init-key ::email/blacklist
+  [_ _]
+  (when (c/contains? cf/flags :email-blacklist)
+    (try
+      (let [path   (cf/get :email-domain-blacklist)
+            result (with-open [reader (io/reader path)]
+                     (reduce (fn [result line]
+                               (if (str/starts-with? line "#")
+                                 result
+                                 (conj result (-> line str/trim str/lower))))
+                             #{}
+                             (line-seq reader)))]
+        (l/inf :hint "initializing email blacklist" :domains (count result))
+        (not-empty result))
+
+      (catch Throwable cause
+        (l/wrn :hint "unexpected exception on initializing email blacklist"
+               :cause cause)))))
+
+(defn contains?
+  "Check if email is in the blacklist."
+  [{:keys [::email/blacklist]} email]
+  (let [[_ domain] (str/split email "@" 2)]
+    (c/contains? blacklist (str/lower domain))))
+
+(defn enabled?
+  "Check if the blacklist is enabled"
+  [{:keys [::email/blacklist]}]
+  (some? blacklist))

backend/src/app/email/whitelist.clj

@@ -0,0 +1,59 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS INC
+
+(ns app.email.whitelist
+  "Email whitelist provider"
+  (:refer-clojure :exclude [contains?])
+  (:require
+   [app.common.logging :as l]
+   [app.config :as cf]
+   [app.email :as-alias email]
+   [clojure.core :as c]
+   [clojure.java.io :as io]
+   [cuerdas.core :as str]
+   [datoteka.fs :as fs]
+   [integrant.core :as ig]))
+
+(defn- read-whitelist
+  [path]
+  (when (and path (fs/exists? path))
+    (try
+      (with-open [reader (io/reader path)]
+        (reduce (fn [result line]
+                  (if (str/starts-with? line "#")
+                    result
+                    (conj result (-> line str/trim str/lower))))
+                #{}
+                (line-seq reader)))
+
+      (catch Throwable cause
+        (l/wrn :hint "unexpected exception on reading email whitelist"
+               :cause cause)))))
+
+(defmethod ig/init-key ::email/whitelist
+  [_ _]
+  (let [whitelist (or (cf/get :registration-domain-whitelist) #{})
+        whitelist (if (c/contains? cf/flags :email-whitelist)
+                    (into whitelist (read-whitelist (cf/get :email-domain-whitelist)))
+                    whitelist)
+        whitelist (not-empty whitelist)]
+
+
+    (when whitelist
+      (l/inf :hint "initializing email whitelist" :domains (count whitelist)))
+
+    whitelist))
+
+(defn contains?
+  "Check if email is in the whitelist."
+  [{:keys [::email/whitelist]} email]
+  (let [[_ domain] (str/split email "@" 2)]
+    (c/contains? whitelist (str/lower domain))))
+
+(defn enabled?
+  "Check if the whitelist is enabled"
+  [{:keys [::email/whitelist]}]
+  (some? whitelist))

backend/src/app/features/fdata.clj

@@ -0,0 +1,145 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS INC
+
+(ns app.features.fdata
+  "A `fdata/*` related feature migration helpers"
+  (:require
+   [app.common.data :as d]
+   [app.common.exceptions :as ex]
+   [app.common.logging :as l]
+   [app.db :as db]
+   [app.db.sql :as-alias sql]
+   [app.storage :as sto]
+   [app.util.blob :as blob]
+   [app.util.objects-map :as omap]
+   [app.util.pointer-map :as pmap]))
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; OFFLOAD
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+(defn offloaded?
+  [file]
+  (= "objects-storage" (:data-backend file)))
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; OBJECTS-MAP
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+(defn enable-objects-map
+  [file]
+  (let [update-page
+        (fn [page]
+          (if (and (pmap/pointer-map? page)
+                   (not (pmap/loaded? page)))
+            page
+            (update page :objects omap/wrap)))
+
+        update-data
+        (fn [fdata]
+          (update fdata :pages-index d/update-vals update-page))]
+
+    (-> file
+        (update :data update-data)
+        (update :features conj "fdata/objects-map"))))
+
+(defn process-objects
+  "Apply a function to all objects-map on the file. Usualy used for convert
+  the objects-map instances to plain maps"
+  [fdata update-fn]
+  (if (contains? fdata :pages-index)
+    (update fdata :pages-index d/update-vals
+            (fn [page]
+              (update page :objects
+                      (fn [objects]
+                        (if (omap/objects-map? objects)
+                          (update-fn objects)
+                          objects)))))
+    fdata))
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; POINTER-MAP
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+(defn get-file-data
+  "Get file data given a file instance."
+  [system file]
+  (if (offloaded? file)
+    (let [storage (sto/resolve system ::db/reuse-conn true)]
+      (->> (sto/get-object storage (:data-ref-id file))
+           (sto/get-object-bytes storage)))
+    (:data file)))
+
+(defn resolve-file-data
+  [system file]
+  (let [data (get-file-data system file)]
+    (assoc file :data data)))
+
+(defn load-pointer
+  "A database loader pointer helper"
+  [system file-id id]
+  (let [fragment (db/get* system :file-data-fragment
+                          {:id id :file-id file-id}
+                          {::sql/columns [:data :data-backend :data-ref-id :id]})]
+
+    (l/trc :hint "load pointer"
+           :file-id (str file-id)
+           :id (str id)
+           :found (some? fragment))
+
+    (when-not fragment
+      (ex/raise :type :internal
+                :code :fragment-not-found
+                :hint "fragment not found"
+                :file-id file-id
+                :fragment-id id))
+
+    (let [data (get-file-data system fragment)]
+      ;; FIXME: conditional thread scheduling for decoding big objects
+      (blob/decode data))))
+
+(defn persist-pointers!
+  "Persist all currently tracked pointer objects"
+  [system file-id]
+  (let [conn (db/get-connection system)]
+    (doseq [[id item] @pmap/*tracked*]
+      (when (pmap/modified? item)
+        (l/trc :hint "persist pointer" :file-id (str file-id) :id (str id))
+        (let [content (-> item deref blob/encode)]
+          (db/insert! conn :file-data-fragment
+                      {:id id
+                       :file-id file-id
+                       :data content}))))))
+
+(defn process-pointers
+  "Apply a function to all pointers on the file. Usuly used for
+  dereference the pointer to a plain value before some processing."
+  [fdata update-fn]
+  (let [update-fn' (fn [val]
+                     (if (pmap/pointer-map? val)
+                       (update-fn val)
+                       val))]
+    (-> fdata
+        (d/update-vals update-fn')
+        (update :pages-index d/update-vals update-fn'))))
+
+(defn get-used-pointer-ids
+  "Given a file, return all pointer ids used in the data."
+  [fdata]
+  (->> (concat (vals fdata)
+               (vals (:pages-index fdata)))
+       (into #{} (comp (filter pmap/pointer-map?)
+                       (map pmap/get-id)))))
+
+(defn enable-pointer-map
+  "Enable the fdata/pointer-map feature on the file."
+  [file]
+  (-> file
+      (update :data (fn [fdata]
+                      (-> fdata
+                          (update :pages-index d/update-vals pmap/wrap)
+                          (d/update-when :components pmap/wrap))))
+      (update :features conj "fdata/pointer-map")))

backend/src/app/http.clj

@@ -9,6 +9,7 @@
    [app.auth.oidc :as-alias oidc]
    [app.common.data :as d]
    [app.common.logging :as l]
+   [app.common.schema :as sm]
    [app.common.transit :as t]
    [app.db :as-alias db]
    [app.http.access-token :as actoken]
@@ -23,15 +24,14 @@
    [app.metrics :as mtx]
    [app.rpc :as-alias rpc]
    [app.rpc.doc :as-alias rpc.doc]
-   [app.worker :as wrk]
-   [clojure.spec.alpha :as s]
+   [app.setup :as-alias setup]
    [integrant.core :as ig]
    [promesa.exec :as px]
    [reitit.core :as r]
    [reitit.middleware :as rr]
    [yetti.adapter :as yt]
-   [yetti.request :as yrq]
-   [yetti.response :as-alias yrs]))
+   [yetti.request :as yreq]
+   [yetti.response :as-alias yres]))
 
 (declare router-handler)
 
@@ -39,32 +39,28 @@
 ;; HTTP SERVER
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
-(s/def ::handler fn?)
-(s/def ::router some?)
-(s/def ::port integer?)
-(s/def ::host string?)
-(s/def ::name string?)
+(def default-params
+  {::port 6060
+   ::host "0.0.0.0"
+   ::max-body-size (* 1024 1024 30)             ; default 30 MiB
+   ::max-multipart-body-size (* 1024 1024 120)}) ; default 120 MiB
 
-(s/def ::max-body-size integer?)
-(s/def ::max-multipart-body-size integer?)
-(s/def ::io-threads integer?)
+(defmethod ig/expand-key ::server
+  [k v]
+  {k (merge default-params (d/without-nils v))})
 
-(defmethod ig/prep-key ::server
-  [_ cfg]
-  (merge {::port 6060
-          ::host "0.0.0.0"
-          ::max-body-size (* 1024 1024 30)             ; 30 MiB
-          ::max-multipart-body-size (* 1024 1024 120)} ; 120 MiB
-         (d/without-nils cfg)))
+(def ^:private schema:server-params
+  [:map
+   [::port ::sm/int]
+   [::host ::sm/text]
+   [::max-body-size {:optional true} ::sm/int]
+   [::max-multipart-body-size {:optional true} ::sm/int]
+   [::router {:optional true} [:fn r/router?]]
+   [::handler {:optional true} ::sm/fn]])
 
-(defmethod ig/pre-init-spec ::server [_]
-  (s/keys :req [::port ::host]
-          :opt [::max-body-size
-                ::max-multipart-body-size
-                ::router
-                ::handler
-                ::io-threads
-                ::wrk/executor]))
+(defmethod ig/assert-key ::server
+  [_ params]
+  (assert (sm/check schema:server-params params)))
 
 (defmethod ig/init-key ::server
   [_ {:keys [::handler ::router ::host ::port] :as cfg}]
@@ -75,11 +71,9 @@
                  :http/max-multipart-body-size (::max-multipart-body-size cfg)
                  :xnio/io-threads (or (::io-threads cfg)
                                       (max 3 (px/get-available-processors)))
-                 :xnio/worker-threads (or (::worker-threads cfg)
-                                          (max 6 (px/get-available-processors)))
-                 :xnio/dispatch true
-                 :socket/backlog 4069
-                 :ring/async true}
+                 :xnio/dispatch :virtual
+                 :ring/compat :ring2
+                 :socket/backlog 4069}
 
         handler (cond
                   (some? router)
@@ -102,13 +96,13 @@
   (yt/stop! server))
 
 (defn- not-found-handler
-  [_ respond _]
-  (respond {::yrs/status 404}))
+  [_]
+  {::yres/status 404})
 
 (defn- router-handler
   [router]
   (letfn [(resolve-handler [request]
-            (if-let [match (r/match-by-path router (yrq/path request))]
+            (if-let [match (r/match-by-path router (yreq/path request))]
               (let [params  (:path-params match)
                     result  (:result match)
                     handler (or (:handler result) not-found-handler)
@@ -117,38 +111,43 @@
               (partial not-found-handler request)))
 
           (on-error [cause request]
-            (let [{:keys [body] :as response} (errors/handle cause request)]
+            (let [{:keys [::yres/body] :as response} (errors/handle cause request)]
               (cond-> response
                 (map? body)
-                (-> (update ::yrs/headers assoc "content-type" "application/transit+json")
-                    (assoc ::yrs/body (t/encode-str body {:type :json-verbose}))))))]
+                (-> (update ::yres/headers assoc "content-type" "application/transit+json")
+                    (assoc ::yres/body (t/encode-str body {:type :json-verbose}))))))]
 
-    (fn [request respond _]
-      (let [handler  (resolve-handler request)
-            exchange (yrq/exchange request)]
-        (handler
-         (fn [response]
-           (yt/dispatch! exchange (partial respond response)))
-         (fn [cause]
-           (let [response (on-error cause request)]
-             (yt/dispatch! exchange (partial respond response)))))))))
+    (fn [request]
+      (let [handler (resolve-handler request)]
+        (try
+          (handler)
+          (catch Throwable cause
+            (on-error cause request)))))))
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; HTTP ROUTER
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
-(defmethod ig/pre-init-spec ::router [_]
-  (s/keys :req [::session/manager
-                ::ws/routes
-                ::rpc/routes
-                ::rpc.doc/routes
-                ::oidc/routes
-                ::main/props
-                ::assets/routes
-                ::debug/routes
-                ::db/pool
-                ::mtx/routes
-                ::awsns/routes]))
+(def ^:private schema:routes
+  [:vector :any])
+
+(def ^:private schema:router-params
+  [:map
+   [::ws/routes schema:routes]
+   [::rpc/routes schema:routes]
+   [::rpc.doc/routes schema:routes]
+   [::oidc/routes schema:routes]
+   [::assets/routes schema:routes]
+   [::debug/routes schema:routes]
+   [::mtx/routes schema:routes]
+   [::awsns/routes schema:routes]
+   ::session/manager
+   ::setup/props
+   ::db/pool])
+
+(defmethod ig/assert-key ::router
+  [_ params]
+  (assert (sm/check schema:router-params params)))
 
 (defmethod ig/init-key ::router
   [_ cfg]
@@ -157,11 +156,10 @@
                       [mw/params]
                       [mw/format-response]
                       [mw/parse-request]
+                      [mw/errors errors/handle]
                       [session/soft-auth cfg]
                       [actoken/soft-auth cfg]
-                      [mw/errors errors/handle]
-                      [mw/restrict-methods]
-                      [mw/with-dispatch :vthread]]}
+                      [mw/restrict-methods]]}
 
      (::mtx/routes cfg)
      (::assets/routes cfg)

backend/src/app/http/access_token.clj

@@ -10,14 +10,15 @@
    [app.config :as cf]
    [app.db :as db]
    [app.main :as-alias main]
+   [app.setup :as-alias setup]
    [app.tokens :as tokens]
-   [yetti.request :as yrq]))
+   [yetti.request :as yreq]))
 
 (def header-re #"^Token\s+(.*)")
 
 (defn- get-token
   [request]
-  (some->> (yrq/get-header request "authorization")
+  (some->> (yreq/get-header request "authorization")
            (re-matches header-re)
            (second)))
 
@@ -30,7 +31,7 @@
   "SELECT perms, profile_id, expires_at
      FROM access_token
     WHERE id = ?
-      AND (expires_at IS NULL 
+      AND (expires_at IS NULL
            OR (expires_at > now()));")
 
 (defn- get-token-data
@@ -42,7 +43,7 @@
 (defn- wrap-soft-auth
   "Soft Authentication, will be executed synchronously on the undertow
   worker thread."
-  [handler {:keys [::main/props]}]
+  [handler {:keys [::setup/props]}]
   (letfn [(handle-request [request]
             (try
               (let [token  (get-token request)
@@ -54,9 +55,8 @@
                 (l/trace :hint "exception on decoding malformed token" :cause cause)
                 request)))]
 
-    (fn [request respond raise]
-      (let [request (handle-request request)]
-        (handler request respond raise)))))
+    (fn [request]
+      (handler (handle-request request)))))
 
 (defn- wrap-authz
   "Authorization middleware, will be executed synchronously on vthread."

backend/src/app/http/assets.clj

@@ -9,14 +9,12 @@
   (:require
    [app.common.data :as d]
    [app.common.exceptions :as ex]
-   [app.common.spec :as us]
    [app.common.uri :as u]
    [app.db :as db]
    [app.storage :as sto]
    [app.util.time :as dt]
-   [clojure.spec.alpha :as s]
    [integrant.core :as ig]
-   [yetti.response :as-alias yrs]))
+   [yetti.response :as-alias yres]))
 
 (def ^:private cache-max-age
   (dt/duration {:hours 24}))
@@ -37,11 +35,11 @@
 (defn- serve-object-from-s3
   [{:keys [::sto/storage] :as cfg} obj]
   (let [{:keys [host port] :as url} (sto/get-object-url storage obj {:max-age signature-max-age})]
-    {::yrs/status  307
-     ::yrs/headers {"location" (str url)
-                    "x-host"   (cond-> host port (str ":" port))
-                    "x-mtype"  (-> obj meta :content-type)
-                    "cache-control" (str "max-age=" (inst-ms cache-max-age))}}))
+    {::yres/status  307
+     ::yres/headers {"location" (str url)
+                     "x-host"   (cond-> host port (str ":" port))
+                     "x-mtype"  (-> obj meta :content-type)
+                     "cache-control" (str "max-age=" (inst-ms cache-max-age))}}))
 
 (defn- serve-object-from-fs
   [{:keys [::path]} obj]
@@ -51,17 +49,16 @@
         headers {"x-accel-redirect" (:path purl)
                  "content-type" (:content-type mdata)
                  "cache-control" (str "max-age=" (inst-ms cache-max-age))}]
-    {::yrs/status 204
-     ::yrs/headers headers}))
+    {::yres/status 204
+     ::yres/headers headers}))
 
 (defn- serve-object
   "Helper function that returns the appropriate response depending on
   the storage object backend type."
-  [{:keys [::sto/storage] :as cfg} {:keys [backend] :as obj}]
-  (let [backend (sto/resolve-backend storage backend)]
-    (case (::sto/type backend)
-      :s3 (serve-object-from-s3 cfg obj)
-      :fs (serve-object-from-fs cfg obj))))
+  [cfg {:keys [backend] :as obj}]
+  (case backend
+    (:s3 :assets-s3) (serve-object-from-s3 cfg obj)
+    (:fs :assets-fs) (serve-object-from-fs cfg obj)))
 
 (defn objects-handler
   "Handler that servers storage objects by id."
@@ -70,7 +67,7 @@
         obj (sto/get-object storage id)]
     (if obj
       (serve-object cfg obj)
-      {::yrs/status 404})))
+      {::yres/status 404})))
 
 (defn- generic-handler
   "A generic handler helper/common code for file-media based handlers."
@@ -81,7 +78,7 @@
         sobj (sto/get-object storage (kf mobj))]
     (if sobj
       (serve-object cfg sobj)
-      {::yrs/status 404})))
+      {::yres/status 404})))
 
 (defn file-objects-handler
   "Handler that serves storage objects by file media id."
@@ -96,11 +93,10 @@
 
 ;; --- Initialization
 
-(s/def ::path ::us/string)
-(s/def ::routes vector?)
-
-(defmethod ig/pre-init-spec ::routes [_]
-  (s/keys :req [::sto/storage  ::path]))
+(defmethod ig/assert-key ::routes
+  [_ params]
+  (assert (sto/valid-storage? (::sto/storage params)) "expected valid storage instance")
+  (assert (string? (::path params))))
 
 (defmethod ig/init-key ::routes
   [_ cfg]

backend/src/app/http/awsns.clj

@@ -9,37 +9,39 @@
   (:require
    [app.common.exceptions :as ex]
    [app.common.logging :as l]
+   [app.common.pprint :as pp]
+   [app.common.schema :as sm]
    [app.db :as db]
    [app.db.sql :as sql]
    [app.http.client :as http]
    [app.main :as-alias main]
+   [app.setup :as-alias setup]
    [app.tokens :as tokens]
    [app.worker :as-alias wrk]
-   [clojure.spec.alpha :as s]
+   [clojure.data.json :as j]
    [cuerdas.core :as str]
    [integrant.core :as ig]
-   [jsonista.core :as j]
    [promesa.exec :as px]
-   [yetti.request :as yrq]
-   [yetti.response :as-alias yrs]))
+   [yetti.request :as yreq]
+   [yetti.response :as-alias yres]))
 
 (declare parse-json)
 (declare handle-request)
 (declare parse-notification)
 (declare process-report)
 
-(defmethod ig/pre-init-spec ::routes [_]
-  (s/keys :req [::http/client
-                ::main/props
-                ::db/pool
-                ::wrk/executor]))
+(defmethod ig/assert-key ::routes
+  [_ params]
+  (assert (http/client? (::http/client params)) "expect a valid http client")
+  (assert (sm/valid? ::setup/props (::setup/props params)) "expected valid setup props")
+  (assert (db/pool? (::db/pool params)) "expect valid database pool"))
 
 (defmethod ig/init-key ::routes
-  [_ {:keys [::wrk/executor] :as cfg}]
-  (letfn [(handler [request respond _]
-            (let [data (-> request yrq/body slurp)]
-              (px/run! executor #(handle-request cfg data)))
-            (respond {::yrs/status 200}))]
+  [_ cfg]
+  (letfn [(handler [request]
+            (let [data (-> request yreq/body slurp)]
+              (px/run! :vthread (partial handle-request cfg data)))
+            {::yres/status 200})]
     ["/sns" {:handler handler
              :allowed-methods #{:post}}]))
 
@@ -107,7 +109,7 @@
   [cfg headers]
   (let [tdata (get headers "x-penpot-data")]
     (when-not (str/empty? tdata)
-      (let [result (tokens/verify (::main/props cfg) {:token tdata :iss :profile-identity})]
+      (let [result (tokens/verify (::setup/props cfg) {:token tdata :iss :profile-identity})]
         (:profile-id result)))))
 
 (defn- parse-notification
@@ -136,83 +138,110 @@
 
 (defn- parse-json
   [v]
-  (ex/ignoring
-   (j/read-value v)))
+  (try
+    (j/read-str v)
+    (catch Throwable cause
+      (l/wrn :hint "unable to decode request body"
+             :cause cause))))
 
 (defn- register-bounce-for-profile
   [{:keys [::db/pool]} {:keys [type kind profile-id] :as report}]
   (when (= kind "permanent")
-    (db/with-atomic [conn pool]
-      (db/insert! conn :profile-complaint-report
+    (try
+      (db/insert! pool :profile-complaint-report
                   {:profile-id profile-id
                    :type (name type)
                    :content (db/tjson report)})
 
-      ;; TODO: maybe also try to find profiles by mail and if exists
-      ;; register profile reports for them?
-      (doseq [recipient (:recipients report)]
-        (db/insert! conn :global-complaint-report
-                    {:email (:email recipient)
-                     :type (name type)
-                     :content (db/tjson report)}))
+      (catch Throwable cause
+        (l/warn :hint "unable to persist profile complaint"
+                :cause cause)))
 
-      (let [profile (db/exec-one! conn (sql/select :profile {:id profile-id}))]
-        (when (some #(= (:email profile) (:email %)) (:recipients report))
-          ;; If the report matches the profile email, this means that
-          ;; the report is for itself, can be caused when a user
-          ;; registers with an invalid email or the user email is
-          ;; permanently rejecting receiving the email. In this case we
-          ;; have no option to mark the user as muted (and in this case
-          ;; the profile will be also inactive.
-          (db/update! conn :profile
-                      {:is-muted true}
-                      {:id profile-id}))))))
-
-(defn- register-complaint-for-profile
-  [{:keys [::db/pool]} {:keys [type profile-id] :as report}]
-  (db/with-atomic [conn pool]
-    (db/insert! conn :profile-complaint-report
-                {:profile-id profile-id
-                 :type (name type)
-                 :content (db/tjson report)})
-
-    ;; TODO: maybe also try to find profiles by email and if exists
-    ;; register profile reports for them?
-    (doseq [email (:recipients report)]
-      (db/insert! conn :global-complaint-report
-                  {:email email
+    (doseq [recipient (:recipients report)]
+      (db/insert! pool :global-complaint-report
+                  {:email (:email recipient)
                    :type (name type)
                    :content (db/tjson report)}))
 
-    (let [profile (db/exec-one! conn (sql/select :profile {:id profile-id}))]
-      (when (some #(= % (:email profile)) (:recipients report))
+    (let [profile (db/exec-one! pool (sql/select :profile {:id profile-id}))]
+      (when (some #(= (:email profile) (:email %)) (:recipients report))
         ;; If the report matches the profile email, this means that
-        ;; the report is for itself, rare case but can happen; In this
-        ;; case just mark profile as muted (very rare case).
-        (db/update! conn :profile
+        ;; the report is for itself, can be caused when a user
+        ;; registers with an invalid email or the user email is
+        ;; permanently rejecting receiving the email. In this case we
+        ;; have no option to mark the user as muted (and in this case
+        ;; the profile will be also inactive.
+
+        (l/inf :hint "mark profile: muted"
+               :profile-id (str (:id profile))
+               :email (:email profile)
+               :reason "bounce report"
+               :report-id (:feedback-id report))
+
+        (db/update! pool :profile
                     {:is-muted true}
-                    {:id profile-id})))))
+                    {:id profile-id}
+                    {::db/return-keys false})))))
+
+(defn- register-complaint-for-profile
+  [{:keys [::db/pool]} {:keys [type profile-id] :as report}]
+
+  (try
+    (db/insert! pool :profile-complaint-report
+                {:profile-id profile-id
+                 :type (name type)
+                 :content (db/tjson report)})
+    (catch Throwable cause
+      (l/warn :hint "unable to persist profile complaint"
+              :cause cause)))
+
+  ;; TODO: maybe also try to find profiles by email and if exists
+  ;; register profile reports for them?
+  (doseq [email (:recipients report)]
+    (db/insert! pool :global-complaint-report
+                {:email email
+                 :type (name type)
+                 :content (db/tjson report)}))
+
+  (let [profile (db/exec-one! pool (sql/select :profile {:id profile-id}))]
+    (when (some #(= % (:email profile)) (:recipients report))
+      ;; If the report matches the profile email, this means that
+      ;; the report is for itself, rare case but can happen; In this
+      ;; case just mark profile as muted (very rare case).
+      (l/inf :hint "mark profile: muted"
+             :profile-id (str (:id profile))
+             :email (:email profile)
+             :reason "complaint report"
+             :report-id (:feedback-id report))
+
+      (db/update! pool :profile
+                  {:is-muted true}
+                  {:id profile-id}
+                  {::db/return-keys false}))))
 
 (defn- process-report
   [cfg {:keys [type profile-id] :as report}]
-  (l/trace :action "processing report" :report (pr-str report))
   (cond
     ;; In this case we receive a bounce/complaint notification without
     ;; confirmed identity, we just emit a warning but do nothing about
     ;; it because this is not a normal case. All notifications should
     ;; come with profile identity.
     (nil? profile-id)
-    (l/warn :msg "a notification without identity received from AWS"
-            :report (pr-str report))
+    (l/wrn :hint "not-identified report"
+           ::l/body (pp/pprint-str report {:length 40 :level 6}))
 
     (= "bounce" type)
-    (register-bounce-for-profile cfg report)
+    (do
+      (l/trc :hint "bounce report"
+             ::l/body (pp/pprint-str report {:length 40 :level 6}))
+      (register-bounce-for-profile cfg report))
 
     (= "complaint" type)
-    (register-complaint-for-profile cfg report)
+    (do
+      (l/trc :hint "complaint report"
+             ::l/body (pp/pprint-str report {:length 40 :level 6}))
+      (register-complaint-for-profile cfg report))
 
     :else
-    (l/warn :msg "unrecognized report received from AWS"
-            :report (pr-str report))))
-
-
+    (l/wrn :hint "unrecognized report"
+           ::l/body (pp/pprint-str report {:length 20 :level 4}))))

backend/src/app/http/client.clj

@@ -7,32 +7,30 @@
 (ns app.http.client
   "Http client abstraction layer."
   (:require
-   [app.common.spec :as us]
-   [app.worker :as wrk]
-   [clojure.spec.alpha :as s]
+   [app.common.schema :as sm]
    [integrant.core :as ig]
    [java-http-clj.core :as http]
    [promesa.core :as p])
   (:import
    java.net.http.HttpClient))
 
-(s/def ::client #(instance? HttpClient %))
-(s/def ::client-holder
-  (s/keys :req [::client]))
+(defn client?
+  [o]
+  (instance? HttpClient o))
 
-(defmethod ig/pre-init-spec ::client [_]
-  (s/keys :req [::wrk/executor]))
+(sm/register!
+ {:type ::client
+  :pred client?})
 
 (defmethod ig/init-key ::client
-  [_ {:keys [::wrk/executor] :as cfg}]
-  (http/build-client {:executor executor
-                      :connect-timeout 30000 ;; 10s
+  [_ _]
+  (http/build-client {:connect-timeout 30000 ;; 10s
                       :follow-redirects :always}))
 
 (defn send!
   ([client req] (send! client req {}))
   ([client req {:keys [response-type sync?] :or {response-type :string sync? false}}]
-   (us/assert! ::client client)
+   (assert (client? client) "expected valid http client")
    (if sync?
      (http/send req {:client client :as response-type})
      (try
@@ -56,9 +54,10 @@
   "A convencience toplevel function for gradual migration to a new API
   convention."
   ([cfg-or-client request]
-   (let [client (resolve-client cfg-or-client)]
-     (send! client request {})))
+   (let [client  (resolve-client cfg-or-client)
+         request (update request :uri str)]
+     (send! client request {:sync? true})))
   ([cfg-or-client request options]
-   (let [client (resolve-client cfg-or-client)]
-     (send! client request options))))
-
+   (let [client  (resolve-client cfg-or-client)
+         request (update request :uri str)]
+     (send! client request (merge {:sync? true} options)))))

backend/src/app/http/debug.clj

@@ -7,6 +7,8 @@
 (ns app.http.debug
   (:refer-clojure :exclude [error-handler])
   (:require
+   [app.binfile.v1 :as bf.v1]
+   [app.common.data :as d]
    [app.common.exceptions :as ex]
    [app.common.logging :as l]
    [app.common.pprint :as pp]
@@ -14,69 +16,57 @@
    [app.config :as cf]
    [app.db :as db]
    [app.http.session :as session]
-   [app.rpc.commands.binfile :as binf]
+   [app.rpc.commands.auth :as auth]
    [app.rpc.commands.files-create :refer [create-file]]
    [app.rpc.commands.profile :as profile]
+   [app.setup :as-alias setup]
+   [app.srepl.helpers :as srepl]
    [app.storage :as-alias sto]
+   [app.storage.tmp :as tmp]
    [app.util.blob :as blob]
    [app.util.template :as tmpl]
    [app.util.time :as dt]
-   [clojure.spec.alpha :as s]
    [cuerdas.core :as str]
    [datoteka.io :as io]
    [emoji.core :as emj]
    [integrant.core :as ig]
    [markdown.core :as md]
    [markdown.transformers :as mdt]
-   [yetti.request :as yrq]
-   [yetti.response :as yrs]))
+   [yetti.request :as yreq]
+   [yetti.response :as yres]))
 
 ;; (selmer.parser/cache-off!)
 
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; HELPERS
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-
-(defn authorized?
-  [pool {:keys [::session/profile-id]}]
-  (or (= "devenv" (cf/get :host))
-      (let [profile (ex/ignoring (profile/get-profile pool profile-id))
-            admins  (or (cf/get :admins) #{})]
-        (contains? admins (:email profile)))))
-
-(defn prepare-response
-  [body]
-  (let [headers {"content-type" "application/transit+json"}]
-    {::yrs/status 200
-     ::yrs/body body
-     ::yrs/headers headers}))
-
-(defn prepare-download-response
-  [body filename]
-  (let [headers {"content-disposition" (str "attachment; filename=" filename)
-                 "content-type" "application/octet-stream"}]
-    {::yrs/status 200
-     ::yrs/body body
-     ::yrs/headers headers}))
-
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; INDEX
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
 (defn index-handler
-  [{:keys [::db/pool]} request]
-  (when-not (authorized? pool request)
-    (ex/raise :type :authentication
-              :code :only-admins-allowed))
-  {::yrs/status  200
-   ::yrs/headers {"content-type" "text/html"}
-   ::yrs/body    (-> (io/resource "app/templates/debug.tmpl")
-                     (tmpl/render {}))})
+  [_cfg _request]
+  {::yres/status  200
+   ::yres/headers {"content-type" "text/html"}
+   ::yres/body    (-> (io/resource "app/templates/debug.tmpl")
+                      (tmpl/render {:version (:full cf/version)}))})
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; FILE CHANGES
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
+(defn prepare-response
+  [body]
+  (let [headers {"content-type" "application/transit+json"}]
+    {::yres/status 200
+     ::yres/body body
+     ::yres/headers headers}))
+
+(defn prepare-download-response
+  [body filename]
+  (let [headers {"content-disposition" (str "attachment; filename=" filename)
+                 "content-type" "application/octet-stream"}]
+    {::yres/status 200
+     ::yres/body body
+     ::yres/headers headers}))
+
 (def sql:retrieve-range-of-changes
   "select revn, changes from file_change where file_id=? and revn >= ? and revn <= ? order by revn")
 
@@ -85,10 +75,6 @@
 
 (defn- retrieve-file-data
   [{:keys [::db/pool]} {:keys [params ::session/profile-id] :as request}]
-  (when-not (authorized? pool request)
-    (ex/raise :type :authentication
-              :code :only-admins-allowed))
-
   (let [file-id  (some-> params :file-id parse-uuid)
         revn     (some-> params :revn parse-long)
         filename (str file-id)]
@@ -111,15 +97,18 @@
 
         (contains? params :clone)
         (let [profile    (profile/get-profile pool profile-id)
-              project-id (:default-project-id profile)
-              data       (blob/decode data)]
-          (create-file pool {:id (uuid/next)
-                             :name (str "Cloned file: " filename)
-                             :project-id project-id
-                             :profile-id profile-id
-                             :data data})
-          {::yrs/status 201
-           ::yrs/body "OK CREATED"})
+              project-id (:default-project-id profile)]
+
+          (db/run! pool (fn [{:keys [::db/conn] :as cfg}]
+                          (create-file cfg {:id file-id
+                                            :name (str "Cloned file: " filename)
+                                            :project-id project-id
+                                            :profile-id profile-id})
+                          (db/update! conn :file
+                                      {:data data}
+                                      {:id file-id})
+                          {::yres/status 201
+                           ::yres/body "OK CREATED"})))
 
         :else
         (prepare-response (blob/decode data))))))
@@ -133,38 +122,41 @@
   [{:keys [::db/pool]} {:keys [::session/profile-id params] :as request}]
   (let [profile    (profile/get-profile pool profile-id)
         project-id (:default-project-id profile)
-        data       (some-> params :file :path io/read-as-bytes blob/decode)]
+        data       (some-> params :file :path io/read*)]
 
     (if (and data project-id)
-      (let [fname      (str "Imported file *: " (dt/now))
-            overwrite? (contains? params :overwrite?)
-            file-id    (or (and overwrite? (ex/ignoring (-> params :file :filename parse-uuid)))
-                           (uuid/next))]
+      (let [fname     (str "Imported file *: " (dt/now))
+            reuse-id? (contains? params :reuseid)
+            file-id   (or (and reuse-id? (ex/ignoring (-> params :file :filename parse-uuid)))
+                          (uuid/next))]
 
-        (if (and overwrite? file-id
+        (if (and reuse-id? file-id
                  (is-file-exists? pool file-id))
           (do
             (db/update! pool :file
-                        {:data (blob/encode data)}
+                        {:data data
+                         :deleted-at nil}
                         {:id file-id})
-            {::yrs/status 200
-             ::yrs/body "OK UPDATED"})
+            {::yres/status 200
+             ::yres/body "OK UPDATED"})
 
-          (do
-            (create-file pool {:id file-id
-                               :name fname
-                               :project-id project-id
-                               :profile-id profile-id
-                               :data data})
-            {::yrs/status 201
-             ::yrs/body "OK CREATED"})))
+          (db/run! pool (fn [{:keys [::db/conn] :as cfg}]
+                          (create-file cfg {:id file-id
+                                            :name fname
+                                            :project-id project-id
+                                            :profile-id profile-id})
+                          (db/update! conn :file
+                                      {:data data}
+                                      {:id file-id})
+                          {::yres/status 201
+                           ::yres/body "OK CREATED"}))))
 
-      {::yrs/status 500
-       ::yrs/body "ERROR"})))
+      {::yres/status 500
+       ::yres/body "ERROR"})))
 
 (defn file-data-handler
   [cfg request]
-  (case (yrq/method request)
+  (case (yreq/method request)
     :get (retrieve-file-data cfg request)
     :post (upload-file-data cfg request)
     (ex/raise :type :http
@@ -172,10 +164,6 @@
 
 (defn file-changes-handler
   [{:keys [::db/pool]} {:keys [params] :as request}]
-  (when-not (authorized? pool request)
-    (ex/raise :type :authentication
-              :code :only-admins-allowed))
-
   (letfn [(retrieve-changes [file-id revn]
             (if (str/includes? revn ":")
               (let [[start end] (->> (str/split revn #":")
@@ -238,46 +226,40 @@
             (-> (io/resource "app/templates/error-report.v2.tmpl")
                 (tmpl/render report)))
 
-          (render-template-v3 [{report :content}]
+          (render-template-v3 [{:keys [content id created-at]}]
             (-> (io/resource "app/templates/error-report.v3.tmpl")
-                (tmpl/render report)))
-          ]
-
-    (when-not (authorized? pool request)
-      (ex/raise :type :authentication
-                :code :only-admins-allowed))
+                (tmpl/render (-> content
+                                 (assoc :id id)
+                                 (assoc :created-at (dt/format-instant created-at :rfc1123))))))]
 
     (if-let [report (get-report request)]
       (let [result (case (:version report)
                      1 (render-template-v1 report)
                      2 (render-template-v2 report)
                      3 (render-template-v3 report))]
-        {::yrs/status 200
-         ::yrs/body result
-         ::yrs/headers {"content-type" "text/html; charset=utf-8"
-                        "x-robots-tag" "noindex"}})
-      {::yrs/status 404
-       ::yrs/body "not found"})))
+        {::yres/status 200
+         ::yres/body result
+         ::yres/headers {"content-type" "text/html; charset=utf-8"
+                         "x-robots-tag" "noindex"}})
+      {::yres/status 404
+       ::yres/body "not found"})))
 
 (def sql:error-reports
   "SELECT id, created_at,
           content->>'~:hint' AS hint
      FROM server_error_report
     ORDER BY created_at DESC
-    LIMIT 100")
+    LIMIT 200")
 
 (defn error-list-handler
-  [{:keys [::db/pool]} request]
-  (when-not (authorized? pool request)
-    (ex/raise :type :authentication
-              :code :only-admins-allowed))
+  [{:keys [::db/pool]} _request]
   (let [items (->> (db/exec! pool [sql:error-reports])
                    (map #(update % :created-at dt/format-instant :rfc1123)))]
-    {::yrs/status 200
-     ::yrs/body (-> (io/resource "app/templates/error-list.tmpl")
-                    (tmpl/render {:items items}))
-     ::yrs/headers {"content-type" "text/html; charset=utf-8"
-                    "x-robots-tag" "noindex"}}))
+    {::yres/status 200
+     ::yres/body (-> (io/resource "app/templates/error-list.tmpl")
+                     (tmpl/render {:items items}))
+     ::yres/headers {"content-type" "text/html; charset=utf-8"
+                     "x-robots-tag" "noindex"}}))
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; EXPORT/IMPORT
@@ -286,9 +268,10 @@
 (defn export-handler
   [{:keys [::db/pool] :as cfg} {:keys [params ::session/profile-id] :as request}]
 
-  (let [file-ids (->> (:file-ids params)
-                      (remove empty?)
-                      (mapv parse-uuid))
+  (let [file-ids (into #{}
+                       (comp (remove empty?)
+                             (map parse-uuid))
+                       (:file-ids params))
         libs?    (contains? params :includelibs)
         clone?   (contains? params :clone)
         embed?   (contains? params :embedassets)]
@@ -297,31 +280,31 @@
       (ex/raise :type :validation
                 :code :missing-arguments))
 
-    (let [path (-> cfg
-                   (assoc ::binf/file-ids file-ids)
-                   (assoc ::binf/embed-assets? embed?)
-                   (assoc ::binf/include-libraries? libs?)
-                   (binf/export-to-tmpfile!))]
+    (let [path (tmp/tempfile :prefix "penpot.export.")]
+      (with-open [output (io/output-stream path)]
+        (-> cfg
+            (assoc ::bf.v1/ids file-ids)
+            (assoc ::bf.v1/embed-assets embed?)
+            (assoc ::bf.v1/include-libraries libs?)
+            (bf.v1/export-files! output)))
+
       (if clone?
         (let [profile    (profile/get-profile pool profile-id)
-              project-id (:default-project-id profile)]
-          (binf/import!
-           (assoc cfg
-                  ::binf/input path
-                  ::binf/overwrite? false
-                  ::binf/ignore-index-errors? true
-                  ::binf/profile-id profile-id
-                  ::binf/project-id project-id))
-
-          {::yrs/status  200
-           ::yrs/headers {"content-type" "text/plain"}
-           ::yrs/body    "OK CLONED"})
-
-        {::yrs/status  200
-         ::yrs/body    (io/input-stream path)
-         ::yrs/headers {"content-type" "application/octet-stream"
-                        "content-disposition" (str "attachmen; filename=" (first file-ids) ".penpot")}}))))
+              project-id (:default-project-id profile)
+              cfg        (assoc cfg
+                                ::bf.v1/overwrite false
+                                ::bf.v1/profile-id profile-id
+                                ::bf.v1/project-id project-id
+                                ::bf.v1/input path)]
+          (bf.v1/import-files! cfg)
+          {::yres/status  200
+           ::yres/headers {"content-type" "text/plain"}
+           ::yres/body    "OK CLONED"})
 
+        {::yres/status  200
+         ::yres/body    (io/input-stream path)
+         ::yres/headers {"content-type" "application/octet-stream"
+                         "content-disposition" (str "attachmen; filename=" (first file-ids) ".penpot")}}))))
 
 
 (defn import-handler
@@ -334,26 +317,109 @@
   (let [profile    (profile/get-profile pool profile-id)
         project-id (:default-project-id profile)
         overwrite? (contains? params :overwrite)
-        migrate?   (contains? params :migrate)
-        ignore-index-errors? (contains? params :ignore-index-errors)]
+        migrate?   (contains? params :migrate)]
 
     (when-not project-id
       (ex/raise :type :validation
                 :code :missing-project
                 :hint "project not found"))
 
-    (binf/import!
-     (assoc cfg
-            ::binf/input (-> params :file :path)
-            ::binf/overwrite? overwrite?
-            ::binf/migrate? migrate?
-            ::binf/ignore-index-errors? ignore-index-errors?
-            ::binf/profile-id profile-id
-            ::binf/project-id project-id))
+    (let [path (-> params :file :path)
+          cfg  (assoc cfg
+                      ::bf.v1/overwrite overwrite?
+                      ::bf.v1/migrate migrate?
+                      ::bf.v1/profile-id profile-id
+                      ::bf.v1/project-id project-id
+                      ::bf.v1/input path)]
+      (bf.v1/import-files! cfg)
+      {::yres/status  200
+       ::yres/headers {"content-type" "text/plain"}
+       ::yres/body    "OK"})))
+
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; ACTIONS
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+(defn- resend-email-notification
+  [cfg {:keys [params] :as request}]
+  (db/tx-run! cfg (fn [{:keys [::db/conn] :as cfg}]
+                    (when-not (contains? params :force)
+                      (ex/raise :type :validation
+                                :code :missing-force
+                                :hint "missing force checkbox"))
+
+                    (let [profile (some->> params
+                                           :email
+                                           (profile/clean-email)
+                                           (profile/get-profile-by-email conn))]
+
+                      (when-not profile
+                        (ex/raise :type :validation
+                                  :code :missing-profile
+                                  :hint "unable to find profile by email"))
+
+                      (cond
+                        (contains? params :block)
+                        (do
+                          (db/update! conn :profile {:is-blocked true} {:id (:id profile)})
+                          (db/delete! conn :http-session {:profile-id (:id profile)})
+
+                          {::yres/status  200
+                           ::yres/headers {"content-type" "text/plain"}
+                           ::yres/body    (str/ffmt "PROFILE '%' BLOCKED" (:email profile))})
+
+                        (contains? params :unblock)
+                        (do
+                          (db/update! conn :profile {:is-blocked false} {:id (:id profile)})
+                          {::yres/status  200
+                           ::yres/headers {"content-type" "text/plain"}
+                           ::yres/body    (str/ffmt "PROFILE '%' UNBLOCKED" (:email profile))})
+
+                        (contains? params :resend)
+                        (if (:is-blocked profile)
+                          {::yres/status  200
+                           ::yres/headers {"content-type" "text/plain"}
+                           ::yres/body    "PROFILE ALREADY BLOCKED"}
+                          (do
+                            (#'auth/send-email-verification! cfg profile)
+                            {::yres/status  200
+                             ::yres/headers {"content-type" "text/plain"}
+                             ::yres/body    (str/ffmt "RESENDED FOR '%'" (:email profile))}))
+
+                        :else
+                        (do
+                          (db/update! conn :profile {:is-active true} {:id (:id profile)})
+                          {::yres/status  200
+                           ::yres/headers {"content-type" "text/plain"}
+                           ::yres/body    (str/ffmt "PROFILE '%' ACTIVATED" (:email profile))}))))))
+
+
+(defn- reset-file-version
+  [cfg {:keys [params] :as request}]
+  (let [file-id (some-> params :file-id d/parse-uuid)
+        version (some-> params :version d/parse-integer)]
+
+    (when-not (contains? params :force)
+      (ex/raise :type :validation
+                :code :missing-force
+                :hint "missing force checkbox"))
+
+    (when (nil? file-id)
+      (ex/raise :type :validation
+                :code :invalid-file-id
+                :hint "provided invalid file id"))
+
+    (when (nil? version)
+      (ex/raise :type :validation
+                :code :invalid-version
+                :hint "provided invalid version"))
+
+    (db/tx-run! cfg srepl/process-file! file-id #(assoc % :version version))
+
+    {::yres/status  200
+     ::yres/headers {"content-type" "text/plain"}
+     ::yres/body    "OK"}))
 
-    {::yrs/status  200
-     ::yrs/headers {"content-type" "text/plain"}
-     ::yrs/body    "OK"}))
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; OTHER SMALL VIEWS/HANDLERS
@@ -364,13 +430,13 @@
   [{:keys [::db/pool]} _]
   (try
     (db/exec-one! pool ["select count(*) as count from server_prop;"])
-    {::yrs/status 200
-     ::yrs/body "OK"}
+    {::yres/status 200
+     ::yres/body "OK"}
     (catch Throwable cause
       (l/warn :hint "unable to execute query on health handler"
               :cause cause)
-      {::yrs/status 503
-       ::yrs/body "KO"})))
+      {::yres/status 503
+       ::yres/body "KO"})))
 
 (defn changelog-handler
   [_ _]
@@ -379,16 +445,23 @@
           (md->html [text]
             (md/md-to-html-string text :replacement-transformers (into [transform-emoji] mdt/transformer-vector)))]
     (if-let [clog (io/resource "changelog.md")]
-      {::yrs/status 200
-       ::yrs/headers {"content-type" "text/html; charset=utf-8"}
-       ::yrs/body (-> clog slurp md->html)}
-      {::yrs/status 404
-       ::yrs/body "NOT FOUND"})))
+      {::yres/status 200
+       ::yres/headers {"content-type" "text/html; charset=utf-8"}
+       ::yres/body (-> clog slurp md->html)}
+      {::yres/status 404
+       ::yres/body "NOT FOUND"})))
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; INIT
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
+(defn authorized?
+  [pool {:keys [::session/profile-id]}]
+  (or (= "devenv" (cf/get :host))
+      (let [profile (ex/ignoring (profile/get-profile pool profile-id))
+            admins  (or (cf/get :admins) #{})]
+        (contains? admins (:email profile)))))
+
 (def with-authorization
   {:compile
    (fn [& _]
@@ -399,8 +472,10 @@
            (ex/raise :type :authentication
                      :code :only-admins-allowed)))))})
 
-(defmethod ig/pre-init-spec ::routes [_]
-  (s/keys :req [::db/pool ::session/manager]))
+(defmethod ig/assert-key ::routes
+  [_ params]
+  (assert (db/pool? (::db/pool params)) "expected a valid database pool")
+  (assert (session/manager? (::session/manager params)) "expected a valid session manager"))
 
 (defmethod ig/init-key ::routes
   [_ {:keys [::db/pool] :as cfg}]
@@ -412,6 +487,10 @@
     ["/changelog" {:handler (partial changelog-handler cfg)}]
     ["/error/:id" {:handler (partial error-handler cfg)}]
     ["/error" {:handler (partial error-list-handler cfg)}]
+    ["/actions/resend-email-verification"
+     {:handler (partial resend-email-notification cfg)}]
+    ["/actions/reset-file-version"
+     {:handler (partial reset-file-version cfg)}]
     ["/file/export" {:handler (partial export-handler cfg)}]
     ["/file/import" {:handler (partial import-handler cfg)}]
     ["/file/data" {:handler (partial file-data-handler cfg)}]

backend/src/app/http/errors.clj

@@ -9,20 +9,15 @@
   (:require
    [app.common.exceptions :as ex]
    [app.common.logging :as l]
-   [app.common.schema :as sm]
+   [app.common.schema :as-alias sm]
+   [app.config :as cf]
    [app.http :as-alias http]
    [app.http.access-token :as-alias actoken]
    [app.http.session :as-alias session]
+   [app.util.inet :as inet]
    [clojure.spec.alpha :as s]
-   [cuerdas.core :as str]
-   [yetti.request :as yrq]
-   [yetti.response :as yrs]))
-
-(defn- parse-client-ip
-  [request]
-  (or (some-> (yrq/get-header request "x-forwarded-for") (str/split ",") first)
-      (yrq/get-header request "x-real-ip")
-      (yrq/remote-addr request)))
+   [yetti.request :as yreq]
+   [yetti.response :as yres]))
 
 (defn request->context
   "Extracts error report relevant context data from request."
@@ -30,182 +25,228 @@
   (let [claims (-> {}
                    (into (::session/token-claims request))
                    (into (::actoken/token-claims request)))]
-    {:path       (:path request)
-     :method     (:method request)
-     :params     (:params request)
-     :ip-addr    (parse-client-ip request)
-     :user-agent (yrq/get-header request "user-agent")
-     :profile-id (:uid claims)
-     :version    (or (yrq/get-header request "x-frontend-version")
-                     "unknown")}))
+
+    {:request/path       (:path request)
+     :request/method     (:method request)
+     :request/params     (:params request)
+     :request/user-agent (yreq/get-header request "user-agent")
+     :request/ip-addr    (inet/parse-request request)
+     :request/profile-id (:uid claims)
+     :version/frontend   (or (yreq/get-header request "x-frontend-version") "unknown")
+     :version/backend    (:full cf/version)}))
+
+
+(defmulti handle-error
+  (fn [cause _ _]
+    (-> cause ex-data :type)))
 
 (defmulti handle-exception
-  (fn [err & _rest]
-    (let [edata (ex-data err)]
-      (or (:type edata)
-          (class err)))))
+  (fn [cause _ _]
+    (class cause)))
 
-(defmethod handle-exception :authentication
-  [err _]
-  {::yrs/status 401
-   ::yrs/body (ex-data err)})
+(defmethod handle-error :authentication
+  [err _ _]
+  {::yres/status 401
+   ::yres/body (ex-data err)})
 
-(defmethod handle-exception :authorization
-  [err _]
-  {::yrs/status 403
-   ::yrs/body (ex-data err)})
+(defmethod handle-error :authorization
+  [err _ _]
+  {::yres/status 403
+   ::yres/body (ex-data err)})
 
-(defmethod handle-exception :restriction
-  [err _]
-  {::yrs/status 400
-   ::yrs/body (ex-data err)})
+(defmethod handle-error :restriction
+  [err _ _]
+  (let [{:keys [code] :as data} (ex-data err)]
+    (if (= code :method-not-allowed)
+      {::yres/status 405
+       ::yres/body data}
+      {::yres/status 400
+       ::yres/body data})))
 
-(defmethod handle-exception :rate-limit
-  [err _]
+(defmethod handle-error :rate-limit
+  [err _ _]
   (let [headers (-> err ex-data ::http/headers)]
-    {::yrs/status 429
-     ::yrs/headers headers}))
+    {::yres/status 429
+     ::yres/headers headers}))
 
-(defmethod handle-exception :concurrency-limit
-  [err _]
+(defmethod handle-error :concurrency-limit
+  [err _ _]
   (let [headers (-> err ex-data ::http/headers)]
-    {::yrs/status 429
-     ::yrs/headers headers}))
+    {::yres/status 429
+     ::yres/headers headers}))
 
-(defmethod handle-exception :validation
-  [err _]
+(defmethod handle-error :validation
+  [err request parent-cause]
   (let [{:keys [code] :as data} (ex-data err)]
     (cond
-      (= code :spec-validation)
+      (or (= code :spec-validation)
+          (= code :params-validation)
+          (= code :schema-validation)
+          (= code :data-validation))
       (let [explain (ex/explain data)]
-        {::yrs/status 400
-         ::yrs/body   (-> data
-                          (dissoc ::s/problems ::s/value)
-                          (cond-> explain (assoc :explain explain)))})
+        {::yres/status 400
+         ::yres/body   (-> data
+                           (dissoc ::s/problems ::s/value ::s/spec ::sm/explain)
+                           (cond-> explain (assoc :explain explain)))})
 
-      (= code :params-validation)
-      (let [explain (::sm/explain data)
-            payload (sm/humanize-data explain)]
-        {::yrs/status 400
-         ::yrs/body   (-> data
-                          (dissoc ::sm/explain)
-                          (assoc :data payload))})
+      (= code :vern-conflict)
+      {::yres/status 409 ;; 409 - Conflict
+       ::yres/body data}
 
       (= code :request-body-too-large)
-      {::yrs/status 413 ::yrs/body data}
+      {::yres/status 413 ::yres/body data}
+
+      (= code :invalid-image)
+      (binding [l/*context* (request->context request)]
+        (let [cause (or parent-cause err)]
+          (l/warn :hint "unexpected error on processing image" :cause cause)
+          {::yres/status 400 ::yres/body data}))
 
       :else
-      {::yrs/status 400 ::yrs/body data})))
+      {::yres/status 400 ::yres/body data})))
 
-(defmethod handle-exception :assertion
-  [error request]
+(defmethod handle-error :assertion
+  [error request parent-cause]
   (binding [l/*context* (request->context request)]
-    (let [{:keys [code] :as data} (ex-data error)]
+    (let [{:keys [code] :as data} (ex-data error)
+          cause (or parent-cause error)]
       (cond
         (= code :data-validation)
-        (let [explain (::sm/explain data)
-              payload (sm/humanize-data explain)]
-          (l/error :hint "Data assertion error" :message (ex-message error) :cause error)
-          {::yrs/status 500
-           ::yrs/body   {:type :server-error
-                         :code :assertion
-                         :data (-> data
-                                   (dissoc ::sm/explain)
-                                   (assoc :data payload))}})
+        (let [explain (ex/explain data)]
+          (l/error :hint "data assertion error" :cause cause)
+          {::yres/status 500
+           ::yres/body   (-> data
+                             (dissoc ::sm/explain)
+                             (cond-> explain (assoc :explain explain))
+                             (assoc :type :server-error)
+                             (assoc :code :assertion))})
 
         (= code :spec-validation)
         (let [explain (ex/explain data)]
-          (l/error :hint "Spec assertion error" :message (ex-message error) :cause error)
-          {::yrs/status 500
-           ::yrs/body   {:type :server-error
-                         :code :assertion
-                         :data (-> data
-                                   (dissoc ::s/problems ::s/value ::s/spec)
-                                   (cond-> explain (assoc :explain explain)))}})
+          (l/error :hint "spec assertion error" :cause cause)
+          {::yres/status 500
+           ::yres/body   (-> data
+                             (dissoc ::s/problems ::s/value ::s/spec)
+                             (cond-> explain (assoc :explain explain))
+                             (assoc :type :server-error)
+                             (assoc :code :assertion))})
 
         :else
         (do
-          (l/error :hint "Assertion error" :message (ex-message error) :cause error)
-          {::yrs/status 500
-           ::yrs/body   {:type :server-error
-                         :code :assertion
-                         :data data}})))))
+          (l/error :hint "assertion error" :cause cause)
+          {::yres/status 500
+           ::yres/body   (-> data
+                             (assoc :type :server-error)
+                             (assoc :code :assertion))})))))
 
+(defmethod handle-error :not-found
+  [err _ _]
+  {::yres/status 404
+   ::yres/body (ex-data err)})
 
-(defmethod handle-exception :not-found
-  [err _]
-  {::yrs/status 404
-   ::yrs/body (ex-data err)})
-
-(defmethod handle-exception :internal
-  [error request]
+(defmethod handle-error :internal
+  [error request parent-cause]
   (binding [l/*context* (request->context request)]
-    (l/error :hint "Internal error" :message (ex-message error) :cause error)
-    {::yrs/status 500
-     ::yrs/body {:type :server-error
-                 :code :unhandled
-                 :hint (ex-message error)
-                 :data (ex-data error)}}))
+    (let [cause (or parent-cause error)
+          data  (ex-data error)]
+      (l/error :hint "internal error" :cause cause)
+      {::yres/status 500
+       ::yres/body (-> data
+                       (assoc :type :server-error)
+                       (update :code #(or % :unhandled))
+                       (assoc :hint (ex-message error)))})))
+
+(defmethod handle-error :default
+  [error request parent-cause]
+  (let [edata (ex-data error)]
+    ;; This is a special case for the idle-in-transaction error;
+    ;; when it happens, the connection is automatically closed and
+    ;; next-jdbc combines the two errors in a single ex-info. We
+    ;; only need the :handling error, because the :rollback error
+    ;; will be always "connection closed".
+    (if (and (ex/exception? (:rollback edata))
+             (ex/exception? (:handling edata)))
+      (handle-exception (:handling edata) request error)
+      (handle-exception error request parent-cause))))
 
 (defmethod handle-exception org.postgresql.util.PSQLException
-  [error request]
-  (let [state (.getSQLState ^java.sql.SQLException error)]
+  [error request parent-cause]
+  (let [state (.getSQLState ^java.sql.SQLException error)
+        cause (or parent-cause error)]
     (binding [l/*context* (request->context request)]
-      (l/error :hint "PSQL error" :message (ex-message error) :cause error)
+      (l/error :hint "PSQL error"
+               :cause cause)
       (cond
         (= state "57014")
-        {::yrs/status 504
-         ::yrs/body {:type :server-error
-                     :code :statement-timeout
-                     :hint (ex-message error)}}
+        {::yres/status 504
+         ::yres/body {:type :server-error
+                      :code :statement-timeout
+                      :hint (ex-message error)}}
 
         (= state "25P03")
-        {::yrs/status 504
-         ::yrs/body {:type :server-error
-                     :code :idle-in-transaction-timeout
-                     :hint (ex-message error)}}
+        {::yres/status 504
+         ::yres/body {:type :server-error
+                      :code :idle-in-transaction-timeout
+                      :hint (ex-message error)}}
 
         :else
-        {::yrs/status 500
-         ::yrs/body {:type :server-error
-                     :code :unexpected
-                     :hint (ex-message error)
-                     :state state}}))))
+        {::yres/status 500
+         ::yres/body {:type :server-error
+                      :code :unexpected
+                      :hint (ex-message error)
+                      :state state}}))))
 
 (defmethod handle-exception :default
-  [error request]
-  (let [edata (ex-data error)]
+  [error request parent-cause]
+  (let [edata (ex-data error)
+        cause (or parent-cause error)]
     (cond
       ;; This means that exception is not a controlled exception.
       (nil? edata)
       (binding [l/*context* (request->context request)]
-        (l/error :hint "Unexpected error" :message (ex-message error) :cause error)
-        {::yrs/status 500
-         ::yrs/body {:type :server-error
-                     :code :unexpected
-                     :hint (ex-message error)}})
-
-      ;; This is a special case for the idle-in-transaction error;
-      ;; when it happens, the connection is automatically closed and
-      ;; next-jdbc combines the two errors in a single ex-info. We
-      ;; only need the :handling error, because the :rollback error
-      ;; will be always "connection closed".
-      (and (ex/exception? (:rollback edata))
-           (ex/exception? (:handling edata)))
-      (handle-exception (:handling edata) request)
+        (l/error :hint "unexpected error" :cause cause)
+        {::yres/status 500
+         ::yres/body {:type :server-error
+                      :code :unexpected
+                      :hint (ex-message error)}})
 
       :else
       (binding [l/*context* (request->context request)]
-        (l/error :hint "Unhandled error" :message (ex-message error) :cause error)
-        {::yrs/status 500
-         ::yrs/body {:type :server-error
-                     :code :unhandled
-                     :hint (ex-message error)
-                     :data edata}}))))
+        (l/error :hint "unhandled error" :cause cause)
+        {::yres/status 500
+         ::yres/body (-> edata
+                         (assoc :type :server-error)
+                         (update :code #(or % :unhandled))
+                         (assoc :hint (ex-message error)))}))))
+
+(defmethod handle-exception java.io.IOException
+  [cause _ _]
+  (l/wrn :hint "io exception" :cause cause)
+  {::yres/status 500
+   ::yres/body {:type :server-error
+                :code :io-exception
+                :hint (ex-message cause)}})
+
+(defmethod handle-exception java.util.concurrent.CompletionException
+  [cause request _]
+  (let [cause' (ex-cause cause)]
+    (if (ex/error? cause')
+      (handle-error cause' request cause)
+      (handle-exception cause' request cause))))
+
+(defmethod handle-exception java.util.concurrent.ExecutionException
+  [cause request _]
+  (let [cause' (ex-cause cause)]
+    (if (ex/error? cause')
+      (handle-error cause' request cause)
+      (handle-exception cause' request cause))))
 
 (defn handle
   [cause request]
-  (if (or (instance? java.util.concurrent.CompletionException cause)
-          (instance? java.util.concurrent.ExecutionException cause))
-    (handle-exception (ex-cause cause) request)
-    (handle-exception cause request)))
+  (if (ex/error? cause)
+    (handle-error cause request nil)
+    (handle-exception cause request nil)))
+
+(defn handle'
+  [cause request]
+  (::yres/body (handle cause request)))

backend/src/app/http/middleware.clj

@@ -7,24 +7,22 @@
 (ns app.http.middleware
   (:require
    [app.common.exceptions :as ex]
+   [app.common.json :as json]
    [app.common.logging :as l]
+   [app.common.schema :as-alias sm]
    [app.common.transit :as t]
    [app.config :as cf]
-   [app.util.json :as json]
+   [app.http.errors :as errors]
+   [app.util.pointer-map :as pmap]
    [cuerdas.core :as str]
-   [promesa.core :as p]
-   [promesa.exec :as px]
-   [promesa.util :as pu]
    [yetti.adapter :as yt]
    [yetti.middleware :as ymw]
-   [yetti.request :as yrq]
-   [yetti.response :as yrs])
+   [yetti.request :as yreq]
+   [yetti.response :as yres])
   (:import
-   com.fasterxml.jackson.core.JsonParseException
-   com.fasterxml.jackson.core.io.JsonEOFException
    io.undertow.server.RequestTooBigException
-   java.io.OutputStream
-   java.io.InputStream))
+   java.io.InputStream
+   java.io.OutputStream))
 
 (set! *warn-on-reflection* true)
 
@@ -36,27 +34,28 @@
   {:name ::params
    :compile (constantly ymw/wrap-params)})
 
-(def ^:private json-mapper
-  (json/mapper
-   {:encode-key-fn str/camel
-    :decode-key-fn (comp keyword str/kebab)
-    :pretty true}))
+(defn- get-reader
+  ^java.io.BufferedReader
+  [request]
+  (let [^InputStream body (yreq/body request)]
+    (java.io.BufferedReader.
+     (java.io.InputStreamReader. body))))
 
 (defn wrap-parse-request
   [handler]
   (letfn [(process-request [request]
-            (let [header (yrq/get-header request "content-type")]
+            (let [header (yreq/get-header request "content-type")]
               (cond
                 (str/starts-with? header "application/transit+json")
-                (with-open [^InputStream is (yrq/body request)]
+                (with-open [^InputStream is (yreq/body request)]
                   (let [params (t/read! (t/reader is))]
                     (-> request
                         (assoc :body-params params)
                         (update :params merge params))))
 
                 (str/starts-with? header "application/json")
-                (with-open [^InputStream is (yrq/body request)]
-                  (let [params (json/decode is json-mapper)]
+                (with-open [reader (get-reader request)]
+                  (let [params (json/read reader :key-fn json/read-kebab-key)]
                     (-> request
                         (assoc :body-params params)
                         (update :params merge params))))
@@ -64,35 +63,34 @@
                 :else
                 request)))
 
-          (handle-error [raise cause]
+          (handle-error [cause request]
             (cond
               (instance? RuntimeException cause)
               (if-let [cause (ex-cause cause)]
-                (handle-error raise cause)
-                (raise cause))
+                (handle-error cause request)
+                (errors/handle cause request))
 
               (instance? RequestTooBigException cause)
-              (raise (ex/error :type :validation
-                               :code :request-body-too-large
-                               :hint (ex-message cause)))
+              (ex/raise :type :validation
+                        :code :request-body-too-large
+                        :hint (ex-message cause))
 
+              (instance? java.io.EOFException cause)
+              (ex/raise :type :validation
+                        :code :malformed-json
+                        :hint (ex-message cause)
+                        :cause cause)
 
-              (or (instance? JsonEOFException cause)
-                  (instance? JsonParseException cause))
-              (raise (ex/error :type :validation
-                               :code :malformed-json
-                               :hint (ex-message cause)
-                               :cause cause))
               :else
-              (raise cause)))]
+              (errors/handle cause request)))]
 
-    (fn [request respond raise]
-      (if (= (yrq/method request) :post)
-        (let [request (ex/try! (process-request request))]
-          (if (ex/exception? request)
-            (handle-error raise request)
-            (handler request respond raise)))
-        (handler request respond raise)))))
+    (fn [request]
+      (if (= (yreq/method request) :post)
+        (try
+          (-> request process-request handler)
+          (catch Throwable cause
+            (handle-error cause request)))
+        (handler request)))))
 
 (def parse-request
   {:name ::parse-request
@@ -107,55 +105,61 @@
 
 (def ^:const buffer-size (:xnio/buffer-size yt/defaults))
 
+(defn- write-json-value
+  [_ val]
+  (if (pmap/pointer-map? val)
+    [(pmap/get-id val) (meta val)]
+    val))
+
 (defn wrap-format-response
   [handler]
-  (letfn [(transit-streamable-body [data opts]
-            (reify yrs/StreamableResponseBody
-              (-write-body-to-stream [_ _ output-stream]
-                (try
-                  (with-open [^OutputStream bos (buffered-output-stream output-stream buffer-size)]
-                    (let [tw (t/writer bos opts)]
-                      (t/write! tw data)))
-                  (catch java.io.IOException _)
-                  (catch Throwable cause
-                    (l/warn :hint "unexpected error on encoding response"
-                            :cause cause))
-                  (finally
-                    (.close ^OutputStream output-stream))))))
+  (letfn [(transit-streamable-body [data opts _ output-stream]
+            (try
+              (with-open [^OutputStream bos (buffered-output-stream output-stream buffer-size)]
+                (let [tw (t/writer bos opts)]
+                  (t/write! tw data)))
+              (catch java.io.IOException _)
+              (catch Throwable cause
+                (binding [l/*context* {:value data}]
+                  (l/error :hint "unexpected error on encoding response"
+                           :cause cause)))
+              (finally
+                (.close ^OutputStream output-stream))))
 
-          (json-streamable-body [data]
-            (reify yrs/StreamableResponseBody
-              (-write-body-to-stream [_ _ output-stream]
-                (try
-                  (with-open [^OutputStream bos (buffered-output-stream output-stream buffer-size)]
-                    (json/write! bos data json-mapper))
-
-                  (catch java.io.IOException _)
-                  (catch Throwable cause
-                    (l/warn :hint "unexpected error on encoding response"
-                            :cause cause))
-                  (finally
-                    (.close ^OutputStream output-stream))))))
+          (json-streamable-body [data _ output-stream]
+            (try
+              (let [encode (or (-> data meta :encode/json) identity)
+                    data   (encode data)]
+                (with-open [^OutputStream bos (buffered-output-stream output-stream buffer-size)]
+                  (with-open [^java.io.OutputStreamWriter writer (java.io.OutputStreamWriter. bos)]
+                    (json/write writer data :key-fn json/write-camel-key :value-fn write-json-value))))
+              (catch java.io.IOException _)
+              (catch Throwable cause
+                (binding [l/*context* {:value data}]
+                  (l/error :hint "unexpected error on encoding response"
+                           :cause cause)))
+              (finally
+                (.close ^OutputStream output-stream))))
 
           (format-response-with-json [response _]
-            (let [body (::yrs/body response)]
+            (let [body (::yres/body response)]
               (if (or (boolean? body) (coll? body))
                 (-> response
-                    (update ::yrs/headers assoc "content-type" "application/json")
-                    (assoc ::yrs/body (json-streamable-body body)))
+                    (update ::yres/headers assoc "content-type" "application/json")
+                    (assoc ::yres/body (yres/stream-body (partial json-streamable-body body))))
                 response)))
 
           (format-response-with-transit [response request]
-            (let [body (::yrs/body response)]
+            (let [body (::yres/body response)]
               (if (or (boolean? body) (coll? body))
-                (let [qs   (yrq/query request)
+                (let [qs   (yreq/query request)
                       opts (if (or (contains? cf/flags :transit-readable-response)
                                    (str/includes? qs "transit_verbose"))
                              {:type :json-verbose}
                              {:type :json})]
                   (-> response
-                      (update ::yrs/headers assoc "content-type" "application/transit+json")
-                      (assoc ::yrs/body (transit-streamable-body body opts))))
+                      (update ::yres/headers assoc "content-type" "application/transit+json")
+                      (assoc ::yres/body (yres/stream-body (partial transit-streamable-body body opts)))))
                 response)))
 
           (format-from-params [{:keys [query-params] :as request}]
@@ -164,7 +168,7 @@
 
           (format-response [response request]
             (let [accept (or (format-from-params request)
-                             (yrq/get-header request "accept"))]
+                             (yreq/get-header request "accept"))]
               (cond
                 (or (= accept "application/transit+json")
                     (str/includes? accept "application/transit+json"))
@@ -181,11 +185,9 @@
             (cond-> response
               (map? response) (format-response request)))]
 
-    (fn [request respond raise]
-      (handler request
-               (fn [response]
-                 (respond (process-response response request)))
-               raise))))
+    (fn [request]
+      (let [response (handler request)]
+        (process-response response request)))))
 
 (def format-response
   {:name ::format-response
@@ -193,12 +195,11 @@
 
 (defn wrap-errors
   [handler on-error]
-  (fn [request respond raise]
-    (handler request respond (fn [cause]
-                               (try
-                                 (respond (on-error cause request))
-                                 (catch Throwable cause
-                                   (raise cause)))))))
+  (fn [request]
+    (try
+      (handler request)
+      (catch Throwable cause
+        (on-error cause request)))))
 
 (def errors
   {:name ::errors
@@ -216,11 +217,11 @@
 (defn wrap-cors
   [handler]
   (fn [request]
-    (let [response (if (= (yrq/method request) :options)
-                     {::yrs/status 200}
+    (let [response (if (= (yreq/method request) :options)
+                     {::yres/status 200}
                      (handler request))
-          origin   (yrq/get-header request "origin")]
-      (update response ::yrs/headers with-cors-headers origin))))
+          origin   (yreq/get-header request "origin")]
+      (update response ::yres/headers with-cors-headers origin))))
 
 (def cors
   {:name ::cors
@@ -234,18 +235,8 @@
    (fn [data _]
      (when-let [allowed (:allowed-methods data)]
        (fn [handler]
-         (fn [request respond raise]
-           (let [method (yrq/method request)]
+         (fn [request]
+           (let [method (yreq/method request)]
              (if (contains? allowed method)
-               (handler request respond raise)
-               (respond {::yrs/status 405})))))))})
-
-(def with-dispatch
-  {:name ::with-dispatch
-   :compile
-   (fn [& _]
-     (fn [handler executor]
-       (let [executor (px/resolve-executor executor)]
-         (fn [request respond raise]
-           (->> (px/submit! executor (partial handler request))
-                (p/fnly (pu/handler respond raise)))))))})
+               (handler request)
+               {::yres/status 405}))))))})

backend/src/app/http/session.clj

@@ -9,18 +9,19 @@
   (:require
    [app.common.data :as d]
    [app.common.logging :as l]
-   [app.common.spec :as us]
+   [app.common.schema :as sm]
+   [app.common.uri :as u]
    [app.config :as cf]
    [app.db :as db]
    [app.db.sql :as sql]
    [app.http.session.tasks :as-alias tasks]
    [app.main :as-alias main]
+   [app.setup :as-alias setup]
    [app.tokens :as tokens]
    [app.util.time :as dt]
-   [clojure.spec.alpha :as s]
    [cuerdas.core :as str]
    [integrant.core :as ig]
-   [yetti.request :as yrq]))
+   [yetti.request :as yreq]))
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; DEFAULTS
@@ -31,7 +32,7 @@
 
 ;; A cookie that we can use to check from other sites of the same
 ;; domain if a user is authenticated.
-(def default-authenticated-cookie-name "authenticated")
+(def default-auth-data-cookie-name "auth-data")
 
 ;; Default value for cookie max-age
 (def default-cookie-max-age (dt/duration {:days 7}))
@@ -49,21 +50,32 @@
   (update! [_ data])
   (delete! [_ key]))
 
-(s/def ::manager #(satisfies? ISessionManager %))
+(defn manager?
+  [o]
+  (satisfies? ISessionManager o))
+
+(sm/register!
+ {:type ::manager
+  :pred manager?})
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; STORAGE IMPL
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
-(s/def ::session-params
-  (s/keys :req-un [::user-agent
-                   ::profile-id
-                   ::created-at]))
+(def ^:private schema:params
+  [:map {:title "session-params"}
+   [:user-agent ::sm/text]
+   [:profile-id ::sm/uuid]
+   [:created-at ::sm/inst]])
+
+(def ^:private valid-params?
+  (sm/validator schema:params))
 
 (defn- prepare-session-params
   [key params]
-  (us/assert! ::us/not-empty-string key)
-  (us/assert! ::session-params params)
+  (assert (string? key) "expected key to be a string")
+  (assert (not (str/blank? key)) "expected key to be not empty")
+  (assert (valid-params? params) "expected valid params")
 
   {:user-agent (:user-agent params)
    :profile-id (:profile-id params)
@@ -114,8 +126,9 @@
         (swap! cache dissoc token)
         nil))))
 
-(defmethod ig/pre-init-spec ::manager [_]
-  (s/keys :req [::db/pool]))
+(defmethod ig/assert-key ::manager
+  [_ params]
+  (assert (db/pool? (::db/pool params)) "expect valid database pool"))
 
 (defmethod ig/init-key ::manager
   [_ {:keys [::db/pool]}]
@@ -131,18 +144,18 @@
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
 (declare ^:private assign-auth-token-cookie)
-(declare ^:private assign-authenticated-cookie)
+(declare ^:private assign-auth-data-cookie)
 (declare ^:private clear-auth-token-cookie)
-(declare ^:private clear-authenticated-cookie)
+(declare ^:private clear-auth-data-cookie)
 (declare ^:private gen-token)
 
 (defn create-fn
-  [{:keys [::manager ::main/props]} profile-id]
-  (us/assert! ::manager manager)
-  (us/assert! ::us/uuid profile-id)
+  [{:keys [::manager ::setup/props]} profile-id]
+  (assert (manager? manager) "expected valid session manager")
+  (assert (uuid? profile-id) "expected valid uuid for profile-id")
 
   (fn [request response]
-    (let [uagent  (yrq/get-header request "user-agent")
+    (let [uagent  (yreq/get-header request "user-agent")
           params  {:profile-id profile-id
                    :user-agent uagent
                    :created-at (dt/now)}
@@ -151,21 +164,21 @@
       (l/trace :hint "create" :profile-id (str profile-id))
       (-> response
           (assign-auth-token-cookie session)
-          (assign-authenticated-cookie session)))))
+          (assign-auth-data-cookie session)))))
 
 (defn delete-fn
   [{:keys [::manager]}]
-  (us/assert! ::manager manager)
+  (assert (manager? manager) "expected valid session manager")
   (fn [request response]
     (let [cname   (cf/get :auth-token-cookie-name default-auth-token-cookie-name)
-          cookie  (yrq/get-cookie request cname)]
+          cookie  (yreq/get-cookie request cname)]
       (l/trace :hint "delete" :profile-id (:profile-id request))
       (some->> (:value cookie) (delete! manager))
       (-> response
           (assoc :status 204)
           (assoc :body nil)
           (clear-auth-token-cookie)
-          (clear-authenticated-cookie)))))
+          (clear-auth-data-cookie)))))
 
 (defn- gen-token
   [props {:keys [profile-id created-at]}]
@@ -180,7 +193,7 @@
 (defn- get-token
   [request]
   (let [cname  (cf/get :auth-token-cookie-name default-auth-token-cookie-name)
-        cookie (some-> (yrq/get-cookie request cname) :value)]
+        cookie (some-> (yreq/get-cookie request cname) :value)]
     (when-not (str/empty? cookie)
       cookie)))
 
@@ -195,8 +208,8 @@
          (neg? (compare default-renewal-max-age elapsed)))))
 
 (defn- wrap-soft-auth
-  [handler {:keys [::manager ::main/props]}]
-  (us/assert! ::manager manager)
+  [handler {:keys [::manager ::setup/props]}]
+  (assert (manager? manager) "expected valid session manager")
   (letfn [(handle-request [request]
             (try
               (let [token  (get-token request)
@@ -209,24 +222,26 @@
                 (l/trace :hint "exception on decoding malformed token" :cause cause)
                 request)))]
 
-    (fn [request respond raise]
-      (let [request (handle-request request)]
-        (handler request respond raise)))))
+    (fn [request]
+      (handler (handle-request request)))))
 
 (defn- wrap-authz
   [handler {:keys [::manager]}]
-  (us/assert! ::manager manager)
+  (assert (manager? manager) "expected valid session manager")
   (fn [request]
     (let [session  (get-session manager (::token request))
           request  (cond-> request
                      (some? session)
                      (assoc ::profile-id (:profile-id session)
-                            ::id (:id session)))]
+                            ::id (:id session)))
+          response (handler request)]
 
-      (cond-> (handler request)
-        (renew-session? session)
-        (-> (assign-auth-token-cookie session)
-            (assign-authenticated-cookie session))))))
+      (if (renew-session? session)
+        (let [session (update! manager session)]
+          (-> response
+              (assign-auth-token-cookie session)
+              (assign-auth-data-cookie session)))
+        response))))
 
 (def soft-auth
   {:name ::soft-auth
@@ -245,6 +260,7 @@
         renewal    (dt/plus created-at default-renewal-max-age)
         expires    (dt/plus created-at max-age)
         secure?    (contains? cf/flags :secure-session-cookies)
+        strict?    (contains? cf/flags :strict-session-cookies)
         cors?      (contains? cf/flags :cors)
         name       (cf/get :auth-token-cookie-name default-auth-token-cookie-name)
         comment    (str "Renewal at: " (dt/format-instant renewal :rfc1123))
@@ -253,15 +269,15 @@
                     :expires expires
                     :value token
                     :comment comment
-                    :same-site (if cors? :none :lax)
+                    :same-site (if cors? :none (if strict? :strict :lax))
                     :secure secure?}]
     (update response :cookies assoc name cookie)))
 
-(defn- assign-authenticated-cookie
-  [response {updated-at :updated-at}]
+(defn- assign-auth-data-cookie
+  [response {profile-id :profile-id updated-at :updated-at}]
   (let [max-age    (cf/get :auth-token-cookie-max-age default-cookie-max-age)
-        domain     (cf/get :authenticated-cookie-domain)
-        cname      (cf/get :authenticated-cookie-name "authenticated")
+        domain     (cf/get :auth-data-cookie-domain)
+        cname      default-auth-data-cookie-name
 
         created-at (or updated-at (dt/now))
         renewal    (dt/plus created-at default-renewal-max-age)
@@ -269,14 +285,17 @@
 
         comment    (str "Renewal at: " (dt/format-instant renewal :rfc1123))
         secure?    (contains? cf/flags :secure-session-cookies)
+        strict?    (contains? cf/flags :strict-session-cookies)
+        cors?      (contains? cf/flags :cors)
 
         cookie     {:domain domain
                     :expires expires
                     :path "/"
                     :comment comment
-                    :value true
-                    :same-site :strict
+                    :value (u/map->query-string {:profile-id profile-id})
+                    :same-site (if cors? :none (if strict? :strict :lax))
                     :secure secure?}]
+
     (cond-> response
       (string? domain)
       (update :cookies assoc cname cookie))))
@@ -286,10 +305,10 @@
   (let [cname (cf/get :auth-token-cookie-name default-auth-token-cookie-name)]
     (update response :cookies assoc cname {:path "/" :value "" :max-age 0})))
 
-(defn- clear-authenticated-cookie
+(defn- clear-auth-data-cookie
   [response]
-  (let [cname  (cf/get :authenticated-cookie-name default-authenticated-cookie-name)
-        domain (cf/get :authenticated-cookie-domain)]
+  (let [cname  default-auth-data-cookie-name
+        domain (cf/get :auth-data-cookie-domain)]
     (cond-> response
       (string? domain)
       (update :cookies assoc cname {:domain domain :path "/" :value "" :max-age 0}))))
@@ -299,16 +318,17 @@
 ;; TASK: SESSION GC
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
-(s/def ::tasks/max-age ::dt/duration)
+;; FIXME: MOVE
 
-(defmethod ig/pre-init-spec ::tasks/gc [_]
-  (s/keys :req [::db/pool]
-          :opt [::tasks/max-age]))
+(defmethod ig/assert-key ::tasks/gc
+  [_ params]
+  (assert (db/pool? (::db/pool params)) "expected valid database pool")
+  (assert (dt/duration? (::tasks/max-age params))))
 
-(defmethod ig/prep-key ::tasks/gc
-  [_ cfg]
+(defmethod ig/expand-key ::tasks/gc
+  [k v]
   (let [max-age (cf/get :auth-token-cookie-max-age default-cookie-max-age)]
-    (merge {::tasks/max-age max-age} (d/without-nils cfg))))
+    {k (merge {::tasks/max-age max-age} (d/without-nils v))}))
 
 (def ^:private
   sql:delete-expired

backend/src/app/http/sse.clj

@@ -0,0 +1,70 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS INC
+
+(ns app.http.sse
+  "SSE (server sent events) helpers"
+  (:refer-clojure :exclude [tap])
+  (:require
+   [app.common.data :as d]
+   [app.common.exceptions :as ex]
+   [app.common.logging :as l]
+   [app.common.transit :as t]
+   [app.http.errors :as errors]
+   [app.util.events :as events]
+   [promesa.exec :as px]
+   [promesa.exec.csp :as sp]
+   [promesa.util :as pu]
+   [yetti.response :as yres])
+  (:import
+   java.io.OutputStream))
+
+(defn- write!
+  [^OutputStream output ^bytes data]
+  (l/trc :hint "writting data" :data data :length (alength data))
+  (.write output data)
+  (.flush output))
+
+(defn- encode
+  [[name data]]
+  (try
+    (let [data (with-out-str
+                 (println "event:" (d/name name))
+                 (println "data:" (t/encode-str data {:type :json-verbose}))
+                 (println))]
+      (.getBytes data "UTF-8"))
+    (catch Throwable cause
+      (l/err :hint "unexpected error on encoding value on sse stream"
+             :cause cause)
+      nil)))
+
+;; ---- PUBLIC API
+
+(def default-headers
+  {"Content-Type" "text/event-stream;charset=UTF-8"
+   "Cache-Control" "no-cache, no-store, max-age=0, must-revalidate"
+   "Pragma" "no-cache"})
+
+(defn response
+  [handler & {:keys [buf] :or {buf 32} :as opts}]
+  (fn [request]
+    {::yres/headers default-headers
+     ::yres/status 200
+     ::yres/body (yres/stream-body
+                  (fn [_ output]
+                    (binding [events/*channel* (sp/chan :buf buf :xf (keep encode))]
+                      (let [listener (events/start-listener
+                                      (partial write! output)
+                                      (partial pu/close! output))]
+                        (try
+                          (let [result (handler)]
+                            (events/tap :end result))
+                          (catch Throwable cause
+                            (events/tap :error (errors/handle' cause request))
+                            (when-not (ex/instance? java.io.EOFException cause)
+                              (l/err :hint "unexpected error on processing sse response" :cause cause)))
+                          (finally
+                            (sp/close! events/*channel*)
+                            (px/await! listener)))))))}))

backend/src/app/http/websocket.clj

@@ -10,14 +10,14 @@
    [app.common.exceptions :as ex]
    [app.common.logging :as l]
    [app.common.pprint :as pp]
-   [app.common.spec :as us]
+   [app.common.schema :as sm]
+   [app.common.uuid :as uuid]
    [app.db :as db]
    [app.http.session :as session]
    [app.metrics :as mtx]
    [app.msgbus :as mbus]
    [app.util.time :as dt]
    [app.util.websocket :as ws]
-   [clojure.spec.alpha :as s]
    [integrant.core :as ig]
    [promesa.exec.csp :as sp]
    [yetti.websocket :as yws]))
@@ -99,7 +99,10 @@
     (sp/pipe ch output-ch false)
 
     ;; Subscribe to the profile topic on msgbus/redis
-    (mbus/sub! msgbus :topic profile-id :chan ch)))
+    (mbus/sub! msgbus :topic profile-id :chan ch)
+
+    ;; Subscribe to the system topic on msgbus/redis
+    (mbus/sub! msgbus :topic (str uuid/zero) :chan ch)))
 
 (defmethod handle-message :close
   [{:keys [::mbus/msgbus]} {:keys [::ws/id ::ws/state ::profile-id ::session-id]} _]
@@ -108,34 +111,31 @@
         fsub (::file-subscription @state)
         tsub (::team-subscription @state)
         msg  {:type :disconnect
-              :subs-id profile-id
               :profile-id profile-id
               :session-id session-id}]
 
-      ;; Close profile subscription if exists
-      (when-let [ch (:channel psub)]
-        (sp/close! ch)
-        (mbus/purge! msgbus [ch]))
+    ;; Close profile subscription if exists
+    (when-let [ch (:channel psub)]
+      (sp/close! ch)
+      (mbus/purge! msgbus [ch]))
 
-      ;; Close team subscription if exists
-      (when-let [ch (:channel tsub)]
-        (sp/close! ch)
-        (mbus/purge! msgbus [ch]))
+    ;; Close team subscription if exists
+    (when-let [ch (:channel tsub)]
+      (sp/close! ch)
+      (mbus/purge! msgbus [ch]))
 
-      ;; Close file subscription if exists
-      (when-let [{:keys [topic channel]} fsub]
-        (sp/close! channel)
-        (mbus/purge! msgbus [channel])
-        (mbus/pub! msgbus :topic topic :message msg))))
+    ;; Close file subscription if exists
+    (when-let [{:keys [topic channel]} fsub]
+      (sp/close! channel)
+      (mbus/purge! msgbus [channel])
+      (mbus/pub! msgbus :topic topic :message msg))))
 
 (defmethod handle-message :subscribe-team
   [{:keys [::mbus/msgbus]} {:keys [::ws/id ::ws/state ::ws/output-ch ::session-id]} {:keys [team-id] :as params}]
   (l/trace :fn "handle-message" :event "subscribe-team" :team-id team-id :conn-id id)
   (let [prev-subs (get @state ::team-subscription)
         channel   (sp/chan :buf (sp/dropping-buffer 64)
-                           :xf  (comp
-                                 (remove #(= (:session-id %) session-id))
-                                 (map #(assoc % :subs-id team-id))))]
+                           :xf  (remove #(= (:session-id %) session-id)))]
 
     (sp/pipe channel output-ch false)
     (mbus/sub! msgbus :topic team-id :chan channel)
@@ -154,8 +154,7 @@
   (l/trace :fn "handle-message" :event "subscribe-file" :file-id file-id :conn-id id)
   (let [psub (::file-subscription @state)
         fch  (sp/chan :buf (sp/dropping-buffer 64)
-                      :xf  (comp (remove #(= (:session-id %) session-id))
-                                 (map #(assoc % :subs-id file-id))))]
+                      :xf  (remove #(= (:session-id %) session-id)))]
 
     (let [subs {:file-id file-id :channel fch :topic file-id}]
       (swap! state assoc ::file-subscription subs))
@@ -174,7 +173,7 @@
           (let [message {:type :presence
                          :file-id file-id
                          :session-id session-id
-                           :profile-id profile-id}]
+                         :profile-id profile-id}]
             (mbus/pub! msgbus
                        :topic file-id
                        :message message)))
@@ -186,7 +185,6 @@
     ;; Notifify the rest of participants of the new connection.
     (let [message {:type :join-file
                    :file-id file-id
-                   :subs-id file-id
                    :session-id session-id
                    :profile-id profile-id}]
       (mbus/pub! msgbus :topic file-id :message message))))
@@ -273,19 +271,23 @@
             :inc 1)
   message)
 
-
-(s/def ::session-id ::us/uuid)
-(s/def ::handler-params
-  (s/keys :req-un [::session-id]))
-
 (defn- http-handler
   [cfg {:keys [params ::session/profile-id] :as request}]
-  (let [{:keys [session-id]} (us/conform ::handler-params params)]
+  (let [session-id (some-> params :session-id sm/parse-uuid)]
+    (when-not (uuid? session-id)
+      (ex/raise :type :validation
+                :code :missing-session-id
+                :hint "missing or invalid session-id found"))
+
     (cond
       (not profile-id)
       (ex/raise :type :authentication
-                :hint "Authentication required.")
+                :hint "authentication required")
 
+      ;; WORKAROUND: we use the adapter specific predicate for
+      ;; performance reasons; for now, the ring default impl for
+      ;; `upgrade-request?` parses all requests headers before perform
+      ;; any checking.
       (not (yws/upgrade-request? request))
       (ex/raise :type :validation
                 :code :websocket-request-expected
@@ -294,25 +296,27 @@
       :else
       (do
         (l/trace :hint "websocket request" :profile-id profile-id :session-id session-id)
-        (->> (ws/handler
-              ::ws/on-rcv-message (partial on-rcv-message cfg)
-              ::ws/on-snd-message (partial on-snd-message cfg)
-              ::ws/on-connect (partial on-connect cfg)
-              ::ws/handler (partial handle-message cfg)
-              ::profile-id profile-id
-              ::session-id session-id)
-             (yws/upgrade request))))))
+        {::yws/listener (ws/listener request
+                                     ::ws/on-rcv-message (partial on-rcv-message cfg)
+                                     ::ws/on-snd-message (partial on-snd-message cfg)
+                                     ::ws/on-connect (partial on-connect cfg)
+                                     ::ws/handler (partial handle-message cfg)
+                                     ::profile-id profile-id
+                                     ::session-id session-id)}))))
 
-(defmethod ig/pre-init-spec ::routes [_]
-  (s/keys :req [::mbus/msgbus
-                ::mtx/metrics
-                ::db/pool
-                ::session/manager]))
 
-(s/def ::routes vector?)
+(def ^:private schema:routes-params
+  [:map
+   ::mbus/msgbus
+   ::mtx/metrics
+   ::db/pool
+   ::session/manager])
+
+(defmethod ig/assert-key ::routes
+  [_ params]
+  (assert (sm/valid? schema:routes-params params)))
 
 (defmethod ig/init-key ::routes
   [_ cfg]
   ["/ws/notifications" {:middleware [[session/authz cfg]]
-                        :handler (partial http-handler cfg)
-                        :allowed-methods #{:get}}])
+                        :handler (partial http-handler cfg)}])

backend/src/app/loggers/audit.clj

@@ -9,42 +9,28 @@
   (:require
    [app.common.data :as d]
    [app.common.data.macros :as dm]
-   [app.common.exceptions :as ex]
    [app.common.logging :as l]
-   [app.common.spec :as us]
-   [app.common.transit :as t]
+   [app.common.schema :as sm]
    [app.common.uuid :as uuid]
    [app.config :as cf]
    [app.db :as db]
    [app.http :as-alias http]
    [app.http.access-token :as-alias actoken]
-   [app.http.client :as http.client]
    [app.loggers.audit.tasks :as-alias tasks]
    [app.loggers.webhooks :as-alias webhooks]
-   [app.main :as-alias main]
    [app.rpc :as-alias rpc]
    [app.rpc.retry :as rtry]
-   [app.tokens :as tokens]
+   [app.setup :as-alias setup]
+   [app.util.inet :as inet]
    [app.util.services :as-alias sv]
    [app.util.time :as dt]
    [app.worker :as wrk]
-   [clojure.spec.alpha :as s]
-   [cuerdas.core :as str]
-   [integrant.core :as ig]
-   [lambdaisland.uri :as u]
-   [promesa.exec :as px]
-   [yetti.request :as yrq]))
+   [cuerdas.core :as str]))
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; HELPERS
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
-(defn parse-client-ip
-  [request]
-  (or (some-> (yrq/get-header request "x-forwarded-for") (str/split ",") first)
-      (yrq/get-header request "x-real-ip")
-      (some-> (yrq/remote-addr request) str)))
-
 (defn extract-utm-params
   "Extracts additional data from params and namespace them under
   `penpot` ns."
@@ -59,8 +45,7 @@
                 (assoc (->> sk str/kebab (keyword "penpot")) v))))]
     (reduce-kv process-param {} params)))
 
-(def ^:private
-  profile-props
+(def profile-props
   [:id
    :is-active
    :is-muted
@@ -93,50 +78,43 @@
          (remove #(contains? reserved-props (key %))))
         props))
 
+(defn event-from-rpc-params
+  "Create a base event skeleton with pre-filled some important
+  data that can be extracted from RPC params object"
+  [params]
+  (let [context {:external-session-id (::rpc/external-session-id params)
+                 :external-event-origin (::rpc/external-event-origin params)
+                 :triggered-by (::rpc/handler-name params)}]
+    {::type "action"
+     ::profile-id (::rpc/profile-id params)
+     ::ip-addr (::rpc/ip-addr params)
+     ::context (d/without-nils context)}))
+
 ;; --- SPECS
 
-
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; COLLECTOR
+;; COLLECTOR API
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
 ;; Defines a service that collects the audit/activity log using
 ;; internal database. Later this audit log can be transferred to
 ;; an external storage and data cleared.
 
-(s/def ::profile-id ::us/uuid)
-(s/def ::name ::us/string)
-(s/def ::type ::us/string)
-(s/def ::props (s/map-of ::us/keyword any?))
-(s/def ::ip-addr ::us/string)
+(def ^:private schema:event
+  [:map {:title "event"}
+   [::type ::sm/text]
+   [::name ::sm/text]
+   [::profile-id ::sm/uuid]
+   [::ip-addr {:optional true} ::sm/text]
+   [::props {:optional true} [:map-of :keyword :any]]
+   [::context {:optional true} [:map-of :keyword :any]]
+   [::webhooks/event? {:optional true} ::sm/boolean]
+   [::webhooks/batch-timeout {:optional true} ::dt/duration]
+   [::webhooks/batch-key {:optional true}
+    [:or ::sm/fn ::sm/text :keyword]]])
 
-(s/def ::webhooks/event? ::us/boolean)
-(s/def ::webhooks/batch-timeout ::dt/duration)
-(s/def ::webhooks/batch-key
-  (s/or :fn fn? :str string? :kw keyword?))
-
-(s/def ::event
-  (s/keys :req [::type ::name ::profile-id]
-          :opt [::ip-addr
-                ::props
-                ::webhooks/event?
-                ::webhooks/batch-timeout
-                ::webhooks/batch-key]))
-
-(s/def ::collector
-  (s/keys :req [::wrk/executor ::db/pool]))
-
-(defmethod ig/pre-init-spec ::collector [_]
-  (s/keys :req [::db/pool ::wrk/executor]))
-
-(defmethod ig/init-key ::collector
-  [_ {:keys [::db/pool] :as cfg}]
-  (cond
-    (db/read-only? pool)
-    (l/warn :hint "audit: disabled (db is read-only)")
-
-    :else
-    cfg))
+(def ^:private check-event
+  (sm/check-fn schema:event))
 
 (defn prepare-event
   [cfg mdata params result]
@@ -147,24 +125,31 @@
                        (::rpc/profile-id params)
                        uuid/zero)
 
-        props      (-> (or (::replace-props resultm)
-                           (-> params
-                               (merge (::props resultm))
-                               (dissoc :profile-id)
-                               (dissoc :type)))
+        session-id   (get params ::rpc/external-session-id)
+        event-origin (get params ::rpc/external-event-origin)
+        props        (-> (or (::replace-props resultm)
+                             (-> params
+                                 (merge (::props resultm))
+                                 (dissoc :profile-id)
+                                 (dissoc :type)))
 
-                       (clean-props))
+                         (clean-props))
 
         token-id  (::actoken/id request)
-        context   (d/without-nils
-                   {:access-token-id (some-> token-id str)})]
+        context   (-> (::context resultm)
+                      (assoc :external-session-id session-id)
+                      (assoc :external-event-origin event-origin)
+                      (assoc :access-token-id (some-> token-id str))
+                      (d/without-nils))
+
+        ip-addr   (inet/parse-request request)]
 
     {::type (or (::type resultm)
                 (::rpc/type cfg))
      ::name (or (::name resultm)
                 (::sv/name mdata))
      ::profile-id profile-id
-     ::ip-addr (some-> request parse-client-ip)
+     ::ip-addr ip-addr
      ::props props
      ::context context
 
@@ -186,34 +171,58 @@
          (::webhooks/event? resultm)
          false)}))
 
-(defn- handle-event!
-  [conn-or-pool event]
-  (us/verify! ::event event)
+(defn- event->params
+  [event]
   (let [params {:id (uuid/next)
                 :name (::name event)
                 :type (::type event)
                 :profile-id (::profile-id event)
                 :ip-addr (::ip-addr event)
-                :context (::context event)
-                :props (::props event)}]
+                :context (::context event {})
+                :props (::props event {})
+                :source "backend"}
+        tnow   (::tracked-at event)]
+
+    (cond-> params
+      (some? tnow)
+      (assoc :tracked-at tnow))))
+
+(defn- append-audit-entry!
+  [cfg params]
+  (let [params (-> params
+                   (update :props db/tjson)
+                   (update :context db/tjson)
+                   (update :ip-addr db/inet))]
+    (db/insert! cfg :audit-log params)))
+
+(defn- handle-event!
+  [cfg event]
+  (let [params (event->params event)
+        tnow   (dt/now)]
 
     (when (contains? cf/flags :audit-log)
       ;; NOTE: this operation may cause primary key conflicts on inserts
       ;; because of the timestamp precission (two concurrent requests), in
       ;; this case we just retry the operation.
-      (rtry/with-retry {::rtry/when rtry/conflict-exception?
-                        ::rtry/max-retries 6
-                        ::rtry/label "persist-audit-log"
-                        ::db/conn (dm/check db/connection? conn-or-pool)}
-        (let [now (dt/now)]
-          (db/insert! conn-or-pool :audit-log
-                      (-> params
-                          (update :props db/tjson)
-                          (update :context db/tjson)
-                          (update :ip-addr db/inet)
-                          (assoc :created-at now)
-                          (assoc :tracked-at now)
-                          (assoc :source "backend"))))))
+      (let [params (-> params
+                       (assoc :created-at tnow)
+                       (update :tracked-at #(or % tnow)))]
+        (append-audit-entry! cfg params)))
+
+    (when (and (or (contains? cf/flags :telemetry)
+                   (cf/get :telemetry-enabled))
+               (not (contains? cf/flags :audit-log)))
+      ;; NOTE: this operation may cause primary key conflicts on inserts
+      ;; because of the timestamp precission (two concurrent requests), in
+      ;; this case we just retry the operation.
+      ;;
+      ;; NOTE: this is only executed when general audit log is disabled
+      (let [params (-> params
+                       (assoc :created-at tnow)
+                       (update :tracked-at #(or % tnow))
+                       (assoc :props {})
+                       (assoc :context {}))]
+        (append-audit-entry! cfg params)))
 
     (when (and (contains? cf/flags :webhooks)
                (::webhooks/event? event))
@@ -226,161 +235,45 @@
                             :else               label)
             dedupe?       (boolean (and batch-key batch-timeout))]
 
-        (wrk/submit! ::wrk/conn conn-or-pool
-                     ::wrk/task :process-webhook-event
-                     ::wrk/queue :webhooks
-                     ::wrk/max-retries 0
-                     ::wrk/delay (or batch-timeout 0)
-                     ::wrk/dedupe dedupe?
-                     ::wrk/label label
-
-                     ::webhooks/event
-                     (-> params
-                         (dissoc :ip-addr)
-                         (dissoc :type)))))
+        (wrk/submit! (-> cfg
+                         (assoc ::wrk/task :process-webhook-event)
+                         (assoc ::wrk/queue :webhooks)
+                         (assoc ::wrk/max-retries 0)
+                         (assoc ::wrk/delay (or batch-timeout 0))
+                         (assoc ::wrk/dedupe dedupe?)
+                         (assoc ::wrk/label label)
+                         (assoc ::wrk/params (-> params
+                                                 (dissoc :source)
+                                                 (dissoc :context)
+                                                 (dissoc :ip-addr)
+                                                 (dissoc :type)))))))
     params))
 
 (defn submit!
   "Submit audit event to the collector."
-  [cfg params]
-  (let [conn (or (::db/conn cfg) (::db/pool cfg))]
-    (us/assert! ::db/pool-or-conn conn)
-    (try
-      (handle-event! conn (d/without-nils params))
-      (catch Throwable cause
-        (l/error :hint "audit: unexpected error processing event" :cause cause)))))
+  [cfg event]
+  (try
+    (let [event (-> (d/without-nils event)
+                    (check-event))
+          cfg   (-> cfg
+                    (assoc ::rtry/when rtry/conflict-exception?)
+                    (assoc ::rtry/max-retries 6)
+                    (assoc ::rtry/label "persist-audit-log"))]
+      (rtry/invoke! cfg db/tx-run! handle-event! event))
+    (catch Throwable cause
+      (l/error :hint "unexpected error processing event" :cause cause))))
 
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; TASK: ARCHIVE
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-
-;; This is a task responsible to send the accumulated events to
-;; external service for archival.
-
-(declare archive-events)
-
-(s/def ::tasks/uri ::us/string)
-
-(defmethod ig/pre-init-spec ::tasks/archive-task [_]
-  (s/keys :req [::db/pool ::main/props ::http.client/client]))
-
-(defmethod ig/init-key ::tasks/archive
-  [_ cfg]
-  (fn [params]
-    ;; NOTE: this let allows overwrite default configured values from
-    ;; the repl, when manually invoking the task.
-    (let [enabled (or (contains? cf/flags :audit-log-archive)
-                      (:enabled params false))
-          uri     (cf/get :audit-log-archive-uri)
-          uri     (or uri (:uri params))
-          cfg     (assoc cfg ::uri uri)]
-
-      (when (and enabled (not uri))
-        (ex/raise :type :internal
-                  :code :task-not-configured
-                  :hint "archive task not configured, missing uri"))
-
-      (when enabled
-        (loop [total 0]
-          (let [n (archive-events cfg)]
-            (if n
-              (do
-                (px/sleep 100)
-                (recur (+ total ^long n)))
-              (when (pos? total)
-                (l/debug :hint "events archived" :total total)))))))))
-
-(def ^:private sql:retrieve-batch-of-audit-log
-  "select *
-     from audit_log
-    where archived_at is null
-    order by created_at asc
-    limit 128
-      for update skip locked;")
-
-(defn archive-events
-  [{:keys [::db/pool ::uri] :as cfg}]
-  (letfn [(decode-row [{:keys [props ip-addr context] :as row}]
-            (cond-> row
-              (db/pgobject? props)
-              (assoc :props (db/decode-transit-pgobject props))
-
-              (db/pgobject? context)
-              (assoc :context (db/decode-transit-pgobject context))
-
-              (db/pgobject? ip-addr "inet")
-              (assoc :ip-addr (db/decode-inet ip-addr))))
-
-          (row->event [row]
-            (select-keys row [:type
-                              :name
-                              :source
-                              :created-at
-                              :tracked-at
-                              :profile-id
-                              :ip-addr
-                              :props
-                              :context]))
-
-          (send [events]
-            (let [token   (tokens/generate (::main/props cfg)
-                                           {:iss "authentication"
-                                            :iat (dt/now)
-                                            :uid uuid/zero})
-                  body    (t/encode {:events events})
-                  headers {"content-type" "application/transit+json"
-                           "origin" (cf/get :public-uri)
-                           "cookie" (u/map->query-string {:auth-token token})}
-                  params  {:uri uri
-                           :timeout 6000
-                           :method :post
-                           :headers headers
-                           :body body}
-                  resp    (http.client/req! cfg params {:sync? true})]
-              (if (= (:status resp) 204)
-                true
-                (do
-                  (l/error :hint "unable to archive events"
-                           :resp-status (:status resp)
-                           :resp-body (:body resp))
-                  false))))
-
-          (mark-as-archived [conn rows]
-            (db/exec-one! conn ["update audit_log set archived_at=now() where id = ANY(?)"
-                                (->> (map :id rows)
-                                     (into-array java.util.UUID)
-                                     (db/create-array conn "uuid"))]))]
-
-    (db/with-atomic [conn pool]
-      (let [rows   (db/exec! conn [sql:retrieve-batch-of-audit-log])
-            xform  (comp (map decode-row)
-                         (map row->event))
-            events (into [] xform rows)]
-        (when-not (empty? events)
-          (l/trace :hint "archive events chunk" :uri uri :events (count events))
-          (when (send events)
-            (mark-as-archived conn rows)
-            (count events)))))))
-
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; GC Task
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-
-(def ^:private sql:clean-archived
-  "delete from audit_log
-    where archived_at is not null")
-
-(defn- clean-archived
-  [{:keys [::db/pool]}]
-  (let [result (db/exec-one! pool [sql:clean-archived])
-        result (:next.jdbc/update-count result)]
-    (l/debug :hint "delete archived audit log entries" :deleted result)
-    result))
-
-(defmethod ig/pre-init-spec ::tasks/gc [_]
-  (s/keys :req [::db/pool]))
-
-(defmethod ig/init-key ::tasks/gc
-  [_ cfg]
-  (fn [_]
-    (clean-archived cfg)))
+(defn insert!
+  "Submit audit event to the collector, intended to be used only from
+  command line helpers because this skips all webhooks and telemetry
+  logic."
+  [cfg event]
+  (when (contains? cf/flags :audit-log)
+    (let [event (-> (d/without-nils event)
+                    (check-event))]
+      (db/run! cfg (fn [cfg]
+                     (let [tnow   (dt/now)
+                           params (-> (event->params event)
+                                      (assoc :created-at tnow)
+                                      (update :tracked-at #(or % tnow)))]
+                       (append-audit-entry! cfg params)))))))

backend/src/app/loggers/audit/archive_task.clj

@@ -0,0 +1,147 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS INC
+
+(ns app.loggers.audit.archive-task
+  (:require
+   [app.common.exceptions :as ex]
+   [app.common.logging :as l]
+   [app.common.schema :as sm]
+   [app.common.transit :as t]
+   [app.common.uuid :as uuid]
+   [app.config :as cf]
+   [app.db :as db]
+   [app.http.client :as http]
+   [app.setup :as-alias setup]
+   [app.tokens :as tokens]
+   [app.util.time :as dt]
+   [integrant.core :as ig]
+   [lambdaisland.uri :as u]
+   [promesa.exec :as px]))
+
+;; This is a task responsible to send the accumulated events to
+;; external service for archival.
+
+(defn- decode-row
+  [{:keys [props ip-addr context] :as row}]
+  (cond-> row
+    (db/pgobject? props)
+    (assoc :props (db/decode-transit-pgobject props))
+
+    (db/pgobject? context)
+    (assoc :context (db/decode-transit-pgobject context))
+
+    (db/pgobject? ip-addr "inet")
+    (assoc :ip-addr (db/decode-inet ip-addr))))
+
+(def ^:private event-keys
+  [:type
+   :name
+   :source
+   :created-at
+   :tracked-at
+   :profile-id
+   :ip-addr
+   :props
+   :context])
+
+(defn- row->event
+  [row]
+  (select-keys row event-keys))
+
+(defn- send!
+  [{:keys [::uri] :as cfg} events]
+  (let [token   (tokens/generate (::setup/props cfg)
+                                 {:iss "authentication"
+                                  :iat (dt/now)
+                                  :uid uuid/zero})
+        body    (t/encode {:events events})
+        headers {"content-type" "application/transit+json"
+                 "origin" (cf/get :public-uri)
+                 "cookie" (u/map->query-string {:auth-token token})}
+        params  {:uri uri
+                 :timeout 12000
+                 :method :post
+                 :headers headers
+                 :body body}
+        resp    (http/req! cfg params)]
+    (if (= (:status resp) 204)
+      true
+      (do
+        (l/error :hint "unable to archive events"
+                 :resp-status (:status resp)
+                 :resp-body (:body resp))
+        false))))
+
+(defn- mark-archived!
+  [{:keys [::db/conn]} rows]
+  (let [ids (db/create-array conn "uuid" (map :id rows))]
+    (db/exec-one! conn ["update audit_log set archived_at=now() where id = ANY(?)" ids])))
+
+(def ^:private xf:create-event
+  (comp (map decode-row)
+        (map row->event)))
+
+(def ^:private sql:get-audit-log-chunk
+  "SELECT *
+     FROM audit_log
+    WHERE archived_at is null
+    ORDER BY created_at ASC
+    LIMIT 128
+      FOR UPDATE
+     SKIP LOCKED")
+
+(defn- get-event-rows
+  [{:keys [::db/conn] :as cfg}]
+  (->> (db/exec! conn [sql:get-audit-log-chunk])
+       (not-empty)))
+
+(defn- archive-events!
+  [{:keys [::uri] :as cfg}]
+  (db/tx-run! cfg (fn [cfg]
+                    (when-let [rows (get-event-rows cfg)]
+                      (let [events (into [] xf:create-event rows)]
+                        (l/trc :hint "archive events chunk" :uri uri :events (count events))
+                        (when (send! cfg events)
+                          (mark-archived! cfg rows)
+                          (count events)))))))
+
+(def ^:private schema:handler-params
+  [:map
+   ::db/pool
+   ::setup/props
+   ::http/client])
+
+(defmethod ig/assert-key ::handler
+  [_ params]
+  (assert (sm/valid? schema:handler-params params) "valid params expected for handler"))
+
+(defmethod ig/init-key ::handler
+  [_ cfg]
+  (fn [params]
+    ;; NOTE: this let allows overwrite default configured values from
+    ;; the repl, when manually invoking the task.
+    (let [enabled (or (contains? cf/flags :audit-log-archive)
+                      (:enabled params false))
+
+          uri     (cf/get :audit-log-archive-uri)
+          uri     (or uri (:uri params))
+          cfg     (assoc cfg ::uri uri)]
+
+      (when (and enabled (not uri))
+        (ex/raise :type :internal
+                  :code :task-not-configured
+                  :hint "archive task not configured, missing uri"))
+
+      (when enabled
+        (loop [total 0]
+          (if-let [n (archive-events! cfg)]
+            (do
+              (px/sleep 100)
+              (recur (+ total ^long n)))
+
+            (when (pos? total)
+              (l/dbg :hint "events archived" :total total))))))))
+

backend/src/app/loggers/audit/gc_task.clj

@@ -0,0 +1,31 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS INC
+
+(ns app.loggers.audit.gc-task
+  (:require
+   [app.common.logging :as l]
+   [app.db :as db]
+   [integrant.core :as ig]))
+
+(def ^:private sql:clean-archived
+  "DELETE FROM audit_log
+    WHERE archived_at IS NOT NULL")
+
+(defn- clean-archived!
+  [{:keys [::db/pool]}]
+  (let [result (db/exec-one! pool [sql:clean-archived])
+        result (db/get-update-count result)]
+    (l/debug :hint "delete archived audit log entries" :deleted result)
+    result))
+
+(defmethod ig/assert-key ::handler
+  [_ params]
+  (assert (db/pool? (::db/pool params)) "valid database pool expected"))
+
+(defmethod ig/init-key ::handler
+  [_ cfg]
+  (fn [_]
+    (clean-archived! cfg)))

backend/src/app/loggers/database.clj

@@ -12,7 +12,6 @@
    [app.common.logging :as l]
    [app.common.pprint :as pp]
    [app.common.schema :as sm]
-   [app.common.spec :as us]
    [app.config :as cf]
    [app.db :as db]
    [clojure.spec.alpha :as s]
@@ -38,36 +37,41 @@
 
 (defn record->report
   [{:keys [::l/context ::l/message ::l/props ::l/logger ::l/level ::l/cause] :as record}]
-  (us/assert! ::l/record record)
+  (assert (l/valid-record? record) "expectd valid log record")
+  (if (or (instance? java.util.concurrent.CompletionException cause)
+          (instance? java.util.concurrent.ExecutionException cause))
+    (-> record
+        (assoc ::trace (ex/format-throwable cause :data? false :explain? false :header? false :summary? false))
+        (assoc ::l/cause (ex-cause cause))
+        (record->report))
 
-  (let [data (ex-data cause)]
-    (merge
-     {:context (-> context
+    (let [data (ex-data cause)
+          ctx  (-> context
                    (assoc :tenant (cf/get :tenant))
                    (assoc :host (cf/get :host))
                    (assoc :public-uri (cf/get :public-uri))
-                   (assoc :version (:full cf/version))
-                   (assoc :logger-name logger)
-                   (assoc :logger-level level)
-                   (dissoc :params)
-                   (pp/pprint-str :width 200))
+                   (assoc :logger/name logger)
+                   (assoc :logger/level level)
+                   (dissoc :request/params :value :params :data))]
+      (merge
+       {:context (-> (into (sorted-map) ctx)
+                     (pp/pprint-str :length 50))
+        :props   (pp/pprint-str props :length 50)
+        :hint    (or (ex-message cause) @message)
+        :trace   (or (::trace record)
+                     (ex/format-throwable cause :data? false :explain? false :header? false :summary? false))}
 
-      :props   (pp/pprint-str props :width 200)
-      :hint    (or (ex-message cause) @message)
-      :trace   (ex/format-throwable cause :data? false :explain? false :header? false :summary? false)}
+       (when-let [params (or (:request/params context) (:params context))]
+         {:params (pp/pprint-str params :length 30 :level 13)})
 
-     (when-let [params (:params context)]
-       {:params (pp/pprint-str params :width 200)})
+       (when-let [value (:value context)]
+         {:value (pp/pprint-str value :length 30 :level 12)})
 
-     (when-let [data (some-> data (dissoc ::s/problems ::s/value ::s/spec ::sm/explain :hint))]
-       {:data (pp/pprint-str data :width 200)})
-
-     (when-let [value (-> data ::sm/explain :value)]
-       {:value (pp/pprint-str value :width 200)})
-
-     (when-let [explain (ex/explain data)]
-       {:explain explain}))))
+       (when-let [data (some-> data (dissoc ::s/problems ::s/value ::s/spec ::sm/explain :hint))]
+         {:data (pp/pprint-str data :length 30 :level 12)})
 
+       (when-let [explain (ex/explain data :length 30 :level 12)]
+         {:explain explain})))))
 
 (defn error-record?
   [{:keys [::l/level ::l/cause]}]
@@ -86,16 +90,17 @@
     (catch Throwable cause
       (l/warn :hint "unexpected exception on database error logger" :cause cause))))
 
-(defmethod ig/pre-init-spec ::reporter [_]
-  (s/keys :req [::db/pool]))
+(defmethod ig/assert-key ::reporter
+  [_ params]
+  (assert (db/pool? (::db/pool params)) "expect valid database pool"))
 
 (defmethod ig/init-key ::reporter
   [_ cfg]
-  (let [input (sp/chan :buf (sp/sliding-buffer 32)
+  (let [input (sp/chan :buf (sp/sliding-buffer 64)
                        :xf  (filter error-record?))]
     (add-watch l/log-record ::reporter #(sp/put! input %4))
 
-    (px/thread {:name "penpot/database-reporter" :virtual true}
+    (px/thread {:name "penpot/database-reporter"}
       (l/info :hint "initializing database error persistence")
       (try
         (loop []

backend/src/app/loggers/mattermost.clj

@@ -9,12 +9,10 @@
   (:require
    [app.common.exceptions :as ex]
    [app.common.logging :as l]
-   [app.common.spec :as us]
    [app.config :as cf]
    [app.http.client :as http]
    [app.loggers.database :as ldb]
    [app.util.json :as json]
-   [clojure.spec.alpha :as s]
    [integrant.core :as ig]
    [promesa.exec :as px]
    [promesa.exec.csp :as sp]))
@@ -23,15 +21,20 @@
 
 (defn- send-mattermost-notification!
   [cfg {:keys [id public-uri] :as report}]
+
+
   (let [text (str "Exception: " public-uri "/dbg/error/" id " "
                   (when-let [pid (:profile-id report)]
                     (str "(pid: #uuid-" pid ")"))
                   "\n"
-                  "```\n"
-                  "- host: `" (:host report) "`\n"
-                  "- tenant: `" (:tenant report) "`\n"
-                  "- version: `" (:version report) "`\n"
+                  "- host: #" (:host report) "\n"
+                  "- tenant: #" (:tenant report) "\n"
+                  "- logger: #" (:logger report) "\n"
+                  "- request-path: `" (:request-path report) "`\n"
+                  "- frontend-version: `" (:frontend-version report) "`\n"
+                  "- backend-version: `" (:backend-version report) "`\n"
                   "\n"
+                  "```\n"
                   "Trace:\n"
                   (:trace report)
                   "```")
@@ -49,14 +52,17 @@
 
 (defn record->report
   [{:keys [::l/context ::l/id ::l/cause] :as record}]
-  (us/assert! ::l/record record)
-  {:id         id
-   :tenant     (cf/get :tenant)
-   :host       (cf/get :host)
-   :public-uri (cf/get :public-uri)
-   :version    (:full cf/version)
-   :profile-id (:profile-id context)
-   :trace      (ex/format-throwable cause :detail? false :header? false)})
+  (assert (l/valid-record? record) "expectd valid log record")
+  {:id               id
+   :tenant           (cf/get :tenant)
+   :host             (cf/get :host)
+   :public-uri       (cf/get :public-uri)
+   :backend-version  (or (:version/backend context) (:full cf/version))
+   :frontend-version (:version/frontend context)
+   :profile-id       (:request/profile-id context)
+   :request-path     (:request/path context)
+   :logger           (::l/logger record)
+   :trace            (ex/format-throwable cause :detail? false :header? false)})
 
 (defn handle-event
   [cfg record]
@@ -67,8 +73,9 @@
       (catch Throwable cause
         (l/warn :hint "unhandled error" :cause cause)))))
 
-(defmethod ig/pre-init-spec ::reporter [_]
-  (s/keys :req [::http/client]))
+(defmethod ig/assert-key ::reporter
+  [_ params]
+  (assert (http/client? (::http/client params)) "expect valid http client"))
 
 (defmethod ig/init-key ::reporter
   [_ cfg]

backend/src/app/loggers/webhooks.clj

@@ -15,10 +15,9 @@
    [app.config :as cf]
    [app.db :as db]
    [app.http.client :as http]
-   [app.util.json :as json]
    [app.util.time :as dt]
    [app.worker :as wrk]
-   [clojure.spec.alpha :as s]
+   [clojure.data.json :as json]
    [cuerdas.core :as str]
    [integrant.core :as ig]))
 
@@ -60,46 +59,43 @@
       (some->> (:project-id props) (lookup-webhooks-by-project pool))
       (some->> (:file-id props) (lookup-webhooks-by-file pool))))
 
-(defmethod ig/pre-init-spec ::process-event-handler [_]
-  (s/keys :req [::db/pool]))
+(defmethod ig/assert-key ::process-event-handler
+  [_ params]
+  (assert (db/pool? (::db/pool params)) "expect valid database pool")
+  (assert (http/client? (::http/client params)) "expect valid http client"))
 
 (defmethod ig/init-key ::process-event-handler
-  [_ {:keys [::db/pool] :as cfg}]
+  [_ cfg]
   (fn [{:keys [props] :as task}]
-    (let [event (::event props)]
-
-      (l/debug :hint "process webhook event"
-               :name (:name event))
-
-      (when-let [items (lookup-webhooks cfg event)]
-        (l/trace :hint "webhooks found for event" :total (count items))
-
-        (db/with-atomic [conn pool]
-          (doseq [item items]
-            (wrk/submit! ::wrk/conn conn
-                         ::wrk/task :run-webhook
-                         ::wrk/queue :webhooks
-                         ::wrk/max-retries 3
-                         ::event event
-                         ::config item)))))))
+    (l/dbg :hint "process webhook event" :name (:name props))
 
+    (when-let [items (lookup-webhooks cfg props)]
+      (l/trc :hint "webhooks found for event" :total (count items))
+      (db/tx-run! cfg (fn [cfg]
+                        (doseq [item items]
+                          (wrk/submit! (-> cfg
+                                           (assoc ::wrk/task :run-webhook)
+                                           (assoc ::wrk/queue :webhooks)
+                                           (assoc ::wrk/max-retries 3)
+                                           (assoc ::wrk/params {:event props
+                                                                :config item})))))))))
 ;; --- RUN
 
 (declare interpret-exception)
 (declare interpret-response)
 
-(def ^:private json-mapper
-  (json/mapper
-   {:encode-key-fn str/camel
-    :decode-key-fn (comp keyword str/kebab)
-    :pretty true}))
+(def json-write-opts
+  {:key-fn str/camel
+   :indent true})
 
-(defmethod ig/pre-init-spec ::run-webhook-handler [_]
-  (s/keys :req [::http/client ::db/pool]))
+(defmethod ig/assert-key ::run-webhook-handler
+  [_ params]
+  (assert (db/pool? (::db/pool params)) "expect valid database pool")
+  (assert (http/client? (::http/client params)) "expect valid http client"))
 
-(defmethod ig/prep-key ::run-webhook-handler
-  [_ cfg]
-  (merge {::max-errors 3} (d/without-nils cfg)))
+(defmethod ig/expand-key ::run-webhook-handler
+  [k v]
+  {k (merge {::max-errors 3} (d/without-nils v))})
 
 (defmethod ig/init-key ::run-webhook-handler
   [_ {:keys [::db/pool ::max-errors] :as cfg}]
@@ -111,9 +107,11 @@
                               " where id=?")
                          err
                          (:id whook)]
-                    res (db/exec-one! pool sql {::db/return-keys? true})]
+                    res (db/exec-one! pool sql {::db/return-keys true})]
                 (when (>= (:error-count res) max-errors)
-                  (db/update! pool :webhook {:is-active false} {:id (:id whook)})))
+                  (db/update! pool :webhook
+                              {:is-active false}
+                              {:id (:id whook)})))
 
               (db/update! pool :webhook
                           {:updated-at (dt/now)
@@ -130,19 +128,19 @@
                          :rsp-data (db/tjson rsp)}))]
 
     (fn [{:keys [props] :as task}]
-      (let [event (::event props)
-            whook (::config props)
+      (let [event (:event props)
+            whook (:config props)
 
             body  (case (:mtype whook)
-                    "application/json" (json/encode-str event json-mapper)
+                    "application/json" (json/write-str event json-write-opts)
                     "application/transit+json" (t/encode-str event)
                     "application/x-www-form-urlencoded" (uri/map->query-string event))]
 
-        (l/debug :hint "run webhook"
-                 :event-name (:name event)
-                 :webhook-id (:id whook)
-                 :webhook-uri (:uri whook)
-                 :webhook-mtype (:mtype whook))
+        (l/dbg :hint "run webhook"
+               :event-name (:name event)
+               :webhook-id (str (:id whook))
+               :webhook-uri (:uri whook)
+               :webhook-mtype (:mtype whook))
 
         (let [req {:uri (:uri whook)
                    :headers {"content-type" (:mtype whook)
@@ -160,8 +158,8 @@
                 (report-delivery! whook req nil err)
                 (update-webhook! whook err)
                 (when (= err "unknown")
-                  (l/error :hint "unknown error on webhook request"
-                           :cause cause))))))))))
+                  (l/err :hint "unknown error on webhook request"
+                         :cause cause))))))))))
 
 (defn interpret-response
   [{:keys [status] :as response}]
@@ -182,5 +180,4 @@
     "invalid-uri"
 
     (instance? java.net.http.HttpConnectTimeoutException cause)
-    "timeout"
-    ))
+    "timeout"))

backend/src/app/main.clj

@@ -9,6 +9,7 @@
    [app.auth.ldap :as-alias ldap]
    [app.auth.oidc :as-alias oidc]
    [app.auth.oidc.providers :as-alias oidc.providers]
+   [app.common.exceptions :as ex]
    [app.common.logging :as l]
    [app.config :as cf]
    [app.db :as-alias db]
@@ -21,22 +22,31 @@
    [app.http.session :as-alias session]
    [app.http.session.tasks :as-alias session.tasks]
    [app.http.websocket :as http.ws]
-   [app.loggers.audit.tasks :as-alias audit.tasks]
    [app.loggers.webhooks :as-alias webhooks]
    [app.metrics :as-alias mtx]
    [app.metrics.definition :as-alias mdef]
+   [app.migrations.v2 :as migrations.v2]
    [app.msgbus :as-alias mbus]
    [app.redis :as-alias rds]
    [app.rpc :as-alias rpc]
+   [app.rpc.climit :as-alias climit]
    [app.rpc.doc :as-alias rpc.doc]
+   [app.setup :as-alias setup]
    [app.srepl :as-alias srepl]
    [app.storage :as-alias sto]
    [app.storage.fs :as-alias sto.fs]
+   [app.storage.gc-deleted :as-alias sto.gc-deleted]
+   [app.storage.gc-touched :as-alias sto.gc-touched]
    [app.storage.s3 :as-alias sto.s3]
+   [app.svgo :as-alias svgo]
    [app.util.time :as dt]
    [app.worker :as-alias wrk]
+   [cider.nrepl :refer [cider-nrepl-handler]]
+   [clojure.test :as test]
+   [clojure.tools.namespace.repl :as repl]
    [cuerdas.core :as str]
    [integrant.core :as ig]
+   [nrepl.server :as nrepl]
    [promesa.exec :as px])
   (:gen-class))
 
@@ -94,13 +104,13 @@
    {::mdef/name "penpot_tasks_timing"
     ::mdef/help "Background tasks timing (milliseconds)."
     ::mdef/labels ["name"]
-    ::mdef/type :summary}
+    ::mdef/type :histogram}
 
    :redis-eval-timing
    {::mdef/name "penpot_redis_eval_timing"
     ::mdef/help "Redis EVAL commands execution timings (ms)"
     ::mdef/labels ["name"]
-    ::mdef/type :summary}
+    ::mdef/type :histogram}
 
    :rpc-climit-queue
    {::mdef/name "penpot_rpc_climit_queue"
@@ -118,7 +128,7 @@
    {::mdef/name "penpot_rpc_climit_timing"
     ::mdef/help "Summary of the time between queuing and executing on the CLIMIT"
     ::mdef/labels ["name"]
-    ::mdef/type :summary}
+    ::mdef/type :histogram}
 
    :audit-http-handler-queue-size
    {::mdef/name "penpot_audit_http_handler_queue_size"
@@ -136,7 +146,7 @@
    {::mdef/name "penpot_audit_http_handler_timing"
     ::mdef/help "Summary of the time between queuing and executing on the audit log http handler"
     ::mdef/labels []
-    ::mdef/type :summary}
+    ::mdef/type :histogram}
 
    :executors-active-threads
    {::mdef/name "penpot_executors_active_threads"
@@ -154,12 +164,6 @@
    {::mdef/name "penpot_executors_running_threads"
     ::mdef/help "Current number of threads with state RUNNING."
     ::mdef/labels ["name"]
-    ::mdef/type :gauge}
-
-   :executors-queued-submissions
-   {::mdef/name "penpot_executors_queued_submissions"
-    ::mdef/help "Current number of queued submissions."
-    ::mdef/labels ["name"]
     ::mdef/type :gauge}})
 
 (def system-config
@@ -167,20 +171,19 @@
    {::db/uri        (cf/get :database-uri)
     ::db/username   (cf/get :database-username)
     ::db/password   (cf/get :database-password)
-    ::db/read-only? (cf/get :database-readonly false)
+    ::db/read-only  (cf/get :database-readonly false)
     ::db/min-size   (cf/get :database-min-pool-size 0)
     ::db/max-size   (cf/get :database-max-pool-size 60)
     ::mtx/metrics   (ig/ref ::mtx/metrics)}
 
    ;; Default thread pool for IO operations
    ::wrk/executor
-   {::wrk/parallelism (cf/get :default-executor-parallelism
-                              (+ 3 (* (px/get-available-processors) 3)))}
+   {}
 
    ::wrk/monitor
    {::mtx/metrics  (ig/ref ::mtx/metrics)
-    ::wrk/name     "default"
-    ::wrk/executor (ig/ref ::wrk/executor)}
+    ::wrk/executor (ig/ref ::wrk/executor)
+    ::wrk/name     "default"}
 
    :app.migrations/migrations
    {::db/pool (ig/ref ::db/pool)}
@@ -203,15 +206,15 @@
    :app.storage.tmp/cleaner
    {::wrk/executor (ig/ref ::wrk/executor)}
 
-   ::sto/gc-deleted-task
+   ::sto.gc-deleted/handler
    {::db/pool      (ig/ref ::db/pool)
     ::sto/storage  (ig/ref ::sto/storage)}
 
-   ::sto/gc-touched-task
+   ::sto.gc-touched/handler
    {::db/pool (ig/ref ::db/pool)}
 
    ::http.client/client
-   {::wrk/executor (ig/ref ::wrk/executor)}
+   {}
 
    ::session/manager
    {::db/pool (ig/ref ::db/pool)}
@@ -220,16 +223,14 @@
    {::db/pool (ig/ref ::db/pool)}
 
    ::http.awsns/routes
-   {::props              (ig/ref :app.setup/props)
+   {::setup/props        (ig/ref ::setup/props)
     ::db/pool            (ig/ref ::db/pool)
-    ::http.client/client (ig/ref ::http.client/client)
-    ::wrk/executor       (ig/ref ::wrk/executor)}
+    ::http.client/client (ig/ref ::http.client/client)}
 
    ::http/server
    {::http/port                    (cf/get :http-server-port)
     ::http/host                    (cf/get :http-server-host)
     ::http/router                  (ig/ref ::http/router)
-    ::wrk/executor                 (ig/ref ::wrk/executor)
     ::http/io-threads              (cf/get :http-server-io-threads)
     ::http/max-body-size           (cf/get :http-server-max-body-size)
     ::http/max-multipart-body-size (cf/get :http-server-max-multipart-body-size)}
@@ -246,7 +247,7 @@
     :base-dn        (cf/get :ldap-base-dn)
     :bind-dn        (cf/get :ldap-bind-dn)
     :bind-password  (cf/get :ldap-bind-password)
-    :enabled?       (contains? cf/flags :login-with-ldap)}
+    :enabled        (contains? cf/flags :login-with-ldap)}
 
    ::oidc.providers/google
    {}
@@ -255,7 +256,7 @@
    {::http.client/client (ig/ref ::http.client/client)}
 
    ::oidc.providers/gitlab
-   {}
+   {::http.client/client (ig/ref ::http.client/client)}
 
    ::oidc.providers/generic
    {::http.client/client (ig/ref ::http.client/client)}
@@ -263,19 +264,21 @@
    ::oidc/routes
    {::http.client/client (ig/ref ::http.client/client)
     ::db/pool            (ig/ref ::db/pool)
-    ::props              (ig/ref :app.setup/props)
+    ::setup/props        (ig/ref ::setup/props)
     ::oidc/providers     {:google (ig/ref ::oidc.providers/google)
                           :github (ig/ref ::oidc.providers/github)
                           :gitlab (ig/ref ::oidc.providers/gitlab)
                           :oidc   (ig/ref ::oidc.providers/generic)}
-    ::session/manager    (ig/ref ::session/manager)}
+    ::session/manager    (ig/ref ::session/manager)
+    ::email/blacklist    (ig/ref ::email/blacklist)
+    ::email/whitelist    (ig/ref ::email/whitelist)}
 
    :app.http/router
    {::session/manager    (ig/ref ::session/manager)
     ::db/pool            (ig/ref ::db/pool)
     ::rpc/routes         (ig/ref ::rpc/routes)
     ::rpc.doc/routes     (ig/ref ::rpc.doc/routes)
-    ::props              (ig/ref :app.setup/props)
+    ::setup/props        (ig/ref ::setup/props)
     ::mtx/routes         (ig/ref ::mtx/routes)
     ::oidc/routes        (ig/ref ::oidc/routes)
     ::http.debug/routes  (ig/ref ::http.debug/routes)
@@ -283,11 +286,11 @@
     ::http.ws/routes     (ig/ref ::http.ws/routes)
     ::http.awsns/routes  (ig/ref ::http.awsns/routes)}
 
-   :app.http.debug/routes
+   ::http.debug/routes
    {::db/pool         (ig/ref ::db/pool)
-    ::wrk/executor    (ig/ref ::wrk/executor)
     ::session/manager (ig/ref ::session/manager)
-    ::sto/storage     (ig/ref ::sto/storage)}
+    ::sto/storage     (ig/ref ::sto/storage)
+    ::setup/props     (ig/ref ::setup/props)}
 
    ::http.ws/routes
    {::db/pool         (ig/ref ::db/pool)
@@ -299,12 +302,13 @@
    {::http.assets/path  (cf/get :assets-path)
     ::http.assets/cache-max-age (dt/duration {:hours 24})
     ::http.assets/cache-max-agesignature-max-age (dt/duration {:hours 24 :minutes 5})
-    ::sto/storage  (ig/ref ::sto/storage)
-    ::wrk/executor (ig/ref ::wrk/executor)}
+    ::sto/storage  (ig/ref ::sto/storage)}
 
-   :app.rpc/climit
-   {::mtx/metrics  (ig/ref ::mtx/metrics)
-    ::wrk/executor (ig/ref ::wrk/executor)}
+   ::rpc/climit
+   {::mtx/metrics        (ig/ref ::mtx/metrics)
+    ::wrk/executor       (ig/ref ::wrk/executor)
+    ::climit/config      (cf/get :rpc-climit-config)
+    ::climit/enabled     (contains? cf/flags :rpc-climit)}
 
    :app.rpc/rlimit
    {::wrk/executor (ig/ref ::wrk/executor)}
@@ -322,22 +326,20 @@
 
     ::rpc/climit         (ig/ref ::rpc/climit)
     ::rpc/rlimit         (ig/ref ::rpc/rlimit)
+    ::setup/templates    (ig/ref ::setup/templates)
+    ::setup/props        (ig/ref ::setup/props)
 
-    ::props              (ig/ref :app.setup/props)
-
-    :pool                (ig/ref ::db/pool)
-    :templates           (ig/ref :app.setup/builtin-templates)
-    }
+    ::email/blacklist    (ig/ref ::email/blacklist)
+    ::email/whitelist    (ig/ref ::email/whitelist)}
 
    :app.rpc.doc/routes
-   {:methods (ig/ref :app.rpc/methods)}
+   {:app.rpc/methods (ig/ref :app.rpc/methods)}
 
    :app.rpc/routes
    {::rpc/methods     (ig/ref :app.rpc/methods)
     ::db/pool         (ig/ref ::db/pool)
-    ::wrk/executor    (ig/ref ::wrk/executor)
     ::session/manager (ig/ref ::session/manager)
-    ::props           (ig/ref :app.setup/props)}
+    ::setup/props     (ig/ref ::setup/props)}
 
    ::wrk/registry
    {::mtx/metrics (ig/ref ::mtx/metrics)
@@ -345,20 +347,30 @@
     {:sendmail           (ig/ref ::email/handler)
      :objects-gc         (ig/ref :app.tasks.objects-gc/handler)
      :file-gc            (ig/ref :app.tasks.file-gc/handler)
+     :file-gc-scheduler  (ig/ref :app.tasks.file-gc-scheduler/handler)
+     :offload-file-data  (ig/ref :app.tasks.offload-file-data/handler)
      :file-xlog-gc       (ig/ref :app.tasks.file-xlog-gc/handler)
-     :storage-gc-deleted (ig/ref ::sto/gc-deleted-task)
-     :storage-gc-touched (ig/ref ::sto/gc-touched-task)
      :tasks-gc           (ig/ref :app.tasks.tasks-gc/handler)
      :telemetry          (ig/ref :app.tasks.telemetry/handler)
+     :storage-gc-deleted (ig/ref ::sto.gc-deleted/handler)
+     :storage-gc-touched (ig/ref ::sto.gc-touched/handler)
      :session-gc         (ig/ref ::session.tasks/gc)
-     :audit-log-archive  (ig/ref ::audit.tasks/archive)
-     :audit-log-gc       (ig/ref ::audit.tasks/gc)
+     :audit-log-archive  (ig/ref :app.loggers.audit.archive-task/handler)
+     :audit-log-gc       (ig/ref :app.loggers.audit.gc-task/handler)
 
+     :delete-object
+     (ig/ref :app.tasks.delete-object/handler)
      :process-webhook-event
      (ig/ref ::webhooks/process-event-handler)
      :run-webhook
      (ig/ref ::webhooks/run-webhook-handler)}}
 
+   ::email/blacklist
+   {}
+
+   ::email/whitelist
+   {}
+
    ::email/sendmail
    {::email/host             (cf/get :smtp-host)
     ::email/port             (cf/get :smtp-port)
@@ -370,8 +382,7 @@
     ::email/default-from     (cf/get :smtp-default-from)}
 
    ::email/handler
-   {::email/sendmail (ig/ref ::email/sendmail)
-    ::mtx/metrics    (ig/ref ::mtx/metrics)}
+   {::email/sendmail (ig/ref ::email/sendmail)}
 
    :app.tasks.tasks-gc/handler
    {::db/pool (ig/ref ::db/pool)}
@@ -380,17 +391,28 @@
    {::db/pool     (ig/ref ::db/pool)
     ::sto/storage (ig/ref ::sto/storage)}
 
+   :app.tasks.delete-object/handler
+   {::db/pool (ig/ref ::db/pool)}
+
    :app.tasks.file-gc/handler
    {::db/pool     (ig/ref ::db/pool)
     ::sto/storage (ig/ref ::sto/storage)}
 
-   :app.tasks.file-xlog-gc/handler
+   :app.tasks.file-gc-scheduler/handler
    {::db/pool (ig/ref ::db/pool)}
 
+   :app.tasks.offload-file-data/handler
+   {::db/pool     (ig/ref ::db/pool)
+    ::sto/storage (ig/ref ::sto/storage)}
+
+   :app.tasks.file-xlog-gc/handler
+   {::db/pool     (ig/ref ::db/pool)
+    ::sto/storage (ig/ref ::sto/storage)}
+
    :app.tasks.telemetry/handler
    {::db/pool            (ig/ref ::db/pool)
     ::http.client/client (ig/ref ::http.client/client)
-    ::props              (ig/ref :app.setup/props)}
+    ::setup/props        (ig/ref ::setup/props)}
 
    [::srepl/urepl ::srepl/server]
    {::srepl/port (cf/get :urepl-port 6062)
@@ -400,23 +422,22 @@
    {::srepl/port (cf/get :prepl-port 6063)
     ::srepl/host (cf/get :prepl-host "localhost")}
 
-   :app.setup/builtin-templates
-   {::http.client/client (ig/ref ::http.client/client)}
+   ::setup/templates {}
 
-   :app.setup/props
+   ::setup/props
    {::db/pool    (ig/ref ::db/pool)
-    ::key        (cf/get :secret-key)
+    ::setup/key  (cf/get :secret-key)
 
     ;; NOTE: this dependency is only necessary for proper initialization ordering, props
     ;; module requires the migrations to run before initialize.
     ::migrations (ig/ref :app.migrations/migrations)}
 
-   ::audit.tasks/archive
-   {::props              (ig/ref :app.setup/props)
+   :app.loggers.audit.archive-task/handler
+   {::setup/props        (ig/ref ::setup/props)
     ::db/pool            (ig/ref ::db/pool)
     ::http.client/client (ig/ref ::http.client/client)}
 
-   ::audit.tasks/gc
+   :app.loggers.audit.gc-task/handler
    {::db/pool (ig/ref ::db/pool)}
 
    ::webhooks/process-event-handler
@@ -435,20 +456,30 @@
 
    ::sto/storage
    {::db/pool      (ig/ref ::db/pool)
-    ::wrk/executor (ig/ref ::wrk/executor)
     ::sto/backends
-    {:assets-s3 (ig/ref [::assets :app.storage.s3/backend])
-     :assets-fs (ig/ref [::assets :app.storage.fs/backend])}}
+    {:s3 (ig/ref :app.storage.s3/backend)
+     :fs (ig/ref :app.storage.fs/backend)
 
-   [::assets :app.storage.s3/backend]
-   {::sto.s3/region   (cf/get :storage-assets-s3-region)
-    ::sto.s3/endpoint (cf/get :storage-assets-s3-endpoint)
-    ::sto.s3/bucket   (cf/get :storage-assets-s3-bucket)
-    ::wrk/executor    (ig/ref ::wrk/executor)}
+     ;; LEGACY (should not be removed, can only be removed after an
+     ;; explicit migration because the database objects/rows will
+     ;; still reference the old names).
+     :assets-s3 (ig/ref :app.storage.s3/backend)
+     :assets-fs (ig/ref :app.storage.fs/backend)}}
 
-   [::assets :app.storage.fs/backend]
-   {::sto.fs/directory (cf/get :storage-assets-fs-directory)}
-   })
+   :app.storage.s3/backend
+   {::sto.s3/region     (or (cf/get :storage-assets-s3-region)
+                            (cf/get :objects-storage-s3-region))
+    ::sto.s3/endpoint   (or (cf/get :storage-assets-s3-endpoint)
+                            (cf/get :objects-storage-s3-endpoint))
+    ::sto.s3/bucket     (or (cf/get :storage-assets-s3-bucket)
+                            (cf/get :objects-storage-s3-bucket))
+    ::sto.s3/io-threads (or (cf/get :storage-assets-s3-io-threads)
+                            (cf/get :objects-storage-s3-io-threads))
+    ::wrk/executor      (ig/ref ::wrk/executor)}
+
+   :app.storage.fs/backend
+   {::sto.fs/directory (or (cf/get :storage-assets-fs-directory)
+                           (cf/get :objects-storage-fs-directory))}})
 
 
 (def worker-config
@@ -456,10 +487,7 @@
    {::wrk/registry            (ig/ref ::wrk/registry)
     ::db/pool                 (ig/ref ::db/pool)
     ::wrk/entries
-    [{:cron #app/cron "0 0 * * * ?" ;; hourly
-      :task :file-xlog-gc}
-
-     {:cron #app/cron "0 0 0 * * ?" ;; daily
+    [{:cron #app/cron "0 0 0 * * ?" ;; daily
       :task :session-gc}
 
      {:cron #app/cron "0 0 0 * * ?" ;; daily
@@ -475,7 +503,7 @@
       :task :tasks-gc}
 
      {:cron #app/cron "0 0 2 * * ?" ;; daily
-      :task :file-gc}
+      :task :file-gc-scheduler}
 
      {:cron #app/cron "0 30 */3,23 * * ?"
       :task :telemetry}
@@ -491,19 +519,22 @@
    ::wrk/dispatcher
    {::rds/redis   (ig/ref ::rds/redis)
     ::mtx/metrics (ig/ref ::mtx/metrics)
-    ::db/pool     (ig/ref ::db/pool)}
+    ::db/pool     (ig/ref ::db/pool)
+    ::wrk/tenant  (cf/get :tenant)}
 
-   [::default ::wrk/worker]
+   [::default ::wrk/runner]
    {::wrk/parallelism (cf/get ::worker-default-parallelism 1)
     ::wrk/queue       :default
+    ::wrk/tenant      (cf/get :tenant)
     ::rds/redis       (ig/ref ::rds/redis)
     ::wrk/registry    (ig/ref ::wrk/registry)
     ::mtx/metrics     (ig/ref ::mtx/metrics)
     ::db/pool         (ig/ref ::db/pool)}
 
-   [::webhook ::wrk/worker]
+   [::webhook ::wrk/runner]
    {::wrk/parallelism (cf/get ::worker-webhook-parallelism 1)
     ::wrk/queue       :webhooks
+    ::wrk/tenant      (cf/get :tenant)
     ::rds/redis       (ig/ref ::rds/redis)
     ::wrk/registry    (ig/ref ::wrk/registry)
     ::mtx/metrics     (ig/ref ::mtx/metrics)
@@ -514,30 +545,82 @@
 
 (defn start
   []
+  (cf/validate!)
   (ig/load-namespaces (merge system-config worker-config))
   (alter-var-root #'system (fn [sys]
                              (when sys (ig/halt! sys))
                              (-> system-config
                                  (cond-> (contains? cf/flags :backend-worker)
                                    (merge worker-config))
-                                 (ig/prep)
+                                 (ig/expand)
                                  (ig/init))))
-  (l/info :hint "welcome to penpot"
-          :flags (str/join "," (map name cf/flags))
-          :worker? (contains? cf/flags :backend-worker)
-          :version (:full cf/version)))
+  (l/inf :hint "welcome to penpot"
+         :flags (str/join "," (map name cf/flags))
+         :worker? (contains? cf/flags :backend-worker)
+         :version (:full cf/version)))
+
+(defn start-custom
+  [config]
+  (ig/load-namespaces config)
+  (alter-var-root #'system (fn [sys]
+                             (when sys (ig/halt! sys))
+                             (-> config
+                                 (ig/expand)
+                                 (ig/init)))))
 
 (defn stop
   []
   (alter-var-root #'system (fn [sys]
                              (when sys (ig/halt! sys))
                              nil)))
+(defn restart
+  []
+  (stop)
+  (repl/refresh :after 'app.main/start))
+
+(defn restart-all
+  []
+  (stop)
+  (repl/refresh-all :after 'app.main/start))
+
+(defmacro run-bench
+  [& exprs]
+  `(do
+     (require 'criterium.core)
+     (criterium.core/with-progress-reporting (crit/quick-bench (do ~@exprs) :verbose))))
+
+(defn run-tests
+  ([] (run-tests #"^backend-tests.*-test$"))
+  ([o]
+   (repl/refresh)
+   (cond
+     (instance? java.util.regex.Pattern o)
+     (test/run-all-tests o)
+
+     (symbol? o)
+     (if-let [sns (namespace o)]
+       (do (require (symbol sns))
+           (test/test-vars [(resolve o)]))
+       (test/test-ns o)))))
+
+(repl/disable-reload! (find-ns 'integrant.core))
 
 (defn -main
   [& _args]
   (try
-    (start)
+    (let [p (promise)]
+      (when (contains? cf/flags :nrepl-server)
+        (l/inf :hint "start nrepl server" :port 6064)
+        (nrepl/start-server :bind "0.0.0.0" :port 6064 :handler cider-nrepl-handler))
+
+      (start)
+
+      (when (contains? cf/flags :v2-migration)
+        (px/sleep 5000)
+        (migrations.v2/migrate app.main/system))
+
+      (deref p))
     (catch Throwable cause
-      (l/error :hint (ex-message cause)
-               :cause cause)
+      (ex/print-throwable cause)
+      (px/sleep 500)
       (System/exit -1))))

backend/src/app/media.clj

@@ -11,14 +11,13 @@
    [app.common.exceptions :as ex]
    [app.common.media :as cm]
    [app.common.schema :as sm]
-   [app.common.schema.generators :as sg]
    [app.common.schema.openapi :as-alias oapi]
    [app.common.spec :as us]
+   [app.common.svg :as csvg]
    [app.config :as cf]
    [app.db :as-alias db]
    [app.storage :as-alias sto]
    [app.storage.tmp :as tmp]
-   [app.util.svg :as svg]
    [app.util.time :as dt]
    [buddy.core.bytes :as bb]
    [buddy.core.codecs :as bc]
@@ -32,9 +31,6 @@
    org.im4java.core.IMOperation
    org.im4java.core.Info))
 
-(def default-max-file-size
-  (* 1024 1024 30)) ; 30 MiB
-
 (s/def ::path fs/path?)
 (s/def ::filename string?)
 (s/def ::size integer?)
@@ -50,26 +46,15 @@
   (s/keys :req-un [::path]
           :opt-un [::mtype]))
 
-(sm/def! ::fs/path
-  {:type ::fs/path
-   :pred fs/path?
-   :type-properties
-   {:title "path"
-    :description "filesystem path"
-    :error/message "expected a valid fs path instance"
-    :gen/gen (sg/generator :string)
-    ::oapi/type "string"
-    ::oapi/format "unix-path"
-    ::oapi/decode fs/path}})
-
-(sm/def! ::upload
-  [:map {:title "Upload"}
-   [:filename :string]
-   [:size :int]
-   [:path ::fs/path]
-   [:mtype {:optional true} :string]
-   [:headers {:optional true}
-    [:map-of :string :string]]])
+(sm/register!
+ ^{::sm/type ::upload}
+ [:map {:title "Upload"}
+  [:filename :string]
+  [:size ::sm/int]
+  [:path ::fs/path]
+  [:mtype {:optional true} :string]
+  [:headers {:optional true}
+   [:map-of :string :string]]])
 
 (defn validate-media-type!
   ([upload] (validate-media-type! upload cm/valid-image-types))
@@ -83,13 +68,14 @@
 
 (defn validate-media-size!
   [upload]
-  (when (> (:size upload) (cf/get :media-max-file-size default-max-file-size))
-    (ex/raise :type :restriction
-              :code :media-max-file-size-reached
-              :hint (str/ffmt "the uploaded file size % is greater than the maximum %"
-                              (:size upload)
-                              default-max-file-size)))
-  upload)
+  (let [max-size (cf/get :media-max-file-size)]
+    (when (> (:size upload) max-size)
+      (ex/raise :type :restriction
+                :code :media-max-file-size-reached
+                :hint (str/ffmt "the uploaded file size % is greater than the maximum %"
+                                (:size upload)
+                                max-size)))
+    upload))
 
 (defmulti process :cmd)
 (defmulti process-error class)
@@ -201,7 +187,7 @@
   (us/assert ::input input)
   (let [{:keys [path mtype]} input]
     (if (= mtype "image/svg+xml")
-      (let [info (some-> path slurp svg/pre-process svg/parse get-basic-info-from-svg)]
+      (let [info (some-> path slurp csvg/parse get-basic-info-from-svg)]
         (when-not info
           (ex/raise :type :validation
                     :code :invalid-svg-file
@@ -240,7 +226,7 @@
   (letfn [(ttf->otf [data]
             (let [finput  (tmp/tempfile :prefix "penpot.font." :suffix "")
                   foutput (fs/path (str finput ".otf"))
-                  _       (io/write-to-file! data finput)
+                  _       (io/write* finput data)
                   res     (sh/sh "fontforge" "-lang=ff" "-c"
                                  (str/fmt "Open('%s'); Generate('%s')"
                                           (str finput)
@@ -251,7 +237,7 @@
           (otf->ttf [data]
             (let [finput  (tmp/tempfile :prefix "penpot.font." :suffix "")
                   foutput (fs/path (str finput ".ttf"))
-                  _       (io/write-to-file! data finput)
+                  _       (io/write* finput data)
                   res     (sh/sh "fontforge" "-lang=ff" "-c"
                                  (str/fmt "Open('%s'); Generate('%s')"
                                           (str finput)
@@ -265,14 +251,14 @@
             ;; command.
             (let [finput  (tmp/tempfile :prefix "penpot.font." :suffix "")
                   foutput (fs/path (str finput ".woff"))
-                  _       (io/write-to-file! data finput)
+                  _       (io/write* finput data)
                   res     (sh/sh "sfnt2woff" (str finput))]
               (when (zero? (:exit res))
                 foutput)))
 
           (woff->sfnt [data]
             (let [finput  (tmp/tempfile :prefix "penpot" :suffix "")
-                  _       (io/write-to-file! data finput)
+                  _       (io/write* finput data)
                   res     (sh/sh "woff2sfnt" (str finput)
                                  :out-enc :bytes)]
               (when (zero? (:exit res))
@@ -328,17 +314,3 @@
               (= stype :ttf)
               (-> (assoc "font/otf" (ttf->otf sfnt))
                   (assoc "font/ttf" sfnt)))))))))
-
-
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; Utility functions
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-
-(defn configure-assets-storage
-  "Given storage map, returns a storage configured with the appropriate
-  backend for assets and optional connection attached."
-  ([storage]
-   (assoc storage ::sto/backend (cf/get :assets-storage-backend :assets-fs)))
-  ([storage pool-or-conn]
-   (-> (configure-assets-storage storage)
-       (assoc ::db/pool-or-conn pool-or-conn))))

backend/src/app/metrics.clj

@@ -8,9 +8,8 @@
   (:refer-clojure :exclude [run!])
   (:require
    [app.common.logging :as l]
-   [app.common.spec :as us]
+   [app.common.schema :as sm]
    [app.metrics.definition :as-alias mdef]
-   [clojure.spec.alpha :as s]
    [integrant.core :as ig])
   (:import
    io.prometheus.client.CollectorRegistry
@@ -34,41 +33,52 @@
 (declare create-collector)
 (declare handler)
 
+(defprotocol IMetrics
+  (get-registry [_])
+  (get-collector [_ id])
+  (get-handler [_]))
+
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; METRICS SERVICE PROVIDER
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
-(s/def ::mdef/name string?)
-(s/def ::mdef/help string?)
-(s/def ::mdef/labels (s/every string? :kind vector?))
-(s/def ::mdef/type #{:gauge :counter :summary :histogram})
+(sm/register!
+ {:type ::collector
+  :pred #(instance? SimpleCollector %)
+  :type-properties
+  {:title "collector"
+   :description "An instance of SimpleCollector"}})
 
-(s/def ::mdef/instance
-  #(instance? SimpleCollector %))
+(sm/register!
+ {:type ::registry
+  :pred  #(instance? CollectorRegistry %)
+  :type-properties
+  {:title "Metrics Registry"
+   :description "Instance of CollectorRegistry"}})
 
-(s/def ::mdef/definition
-  (s/keys :req [::mdef/name
-                ::mdef/help
-                ::mdef/type]
-          :opt [::mdef/labels
-                ::mdef/instance]))
+(def ^:private schema:definitions
+  [:map-of :keyword
+   [:map {:title "definition"}
+    [::mdef/name :string]
+    [::mdef/help :string]
+    [::mdef/type [:enum :gauge :counter :summary :histogram]]
+    [::mdef/labels {:optional true} [::sm/vec :string]]
+    [::mdef/instance {:optional true} ::collector]]])
 
-(s/def ::definitions
-  (s/map-of keyword? ::mdef/definition))
+(defn metrics?
+  [o]
+  (satisfies? IMetrics o))
 
-(s/def ::registry
-  #(instance? CollectorRegistry %))
+(sm/register!
+ {:type ::metrics
+  :pred metrics?})
 
-(s/def ::handler fn?)
-(s/def ::metrics
-  (s/keys :req [::registry
-                ::handler
-                ::definitions]))
+(def ^:private valid-definitions?
+  (sm/validator schema:definitions))
 
-(s/def ::default ::definitions)
-
-(defmethod ig/pre-init-spec ::metrics [_]
-  (s/keys :req-un [::default]))
+(defmethod ig/assert-key ::metrics
+  [_ {:keys [default]}]
+  (assert (valid-definitions? default) "expected valid definitions"))
 
 (defmethod ig/init-key ::metrics
   [_ cfg]
@@ -81,12 +91,14 @@
                                {}
                                (:default cfg))]
 
-    (us/verify! ::definitions definitions)
-
-    {::handler (partial handler registry)
-     ::definitions definitions
-     ::registry registry}))
-
+    (reify
+      IMetrics
+      (get-handler [_]
+        (partial handler registry))
+      (get-collector [_ id]
+        (get definitions id))
+      (get-registry [_]
+        registry))))
 
 (defn- handler
   [registry _]
@@ -94,19 +106,16 @@
         writer   (StringWriter.)]
     (TextFormat/write004 writer samples)
     {:headers {"content-type" TextFormat/CONTENT_TYPE_004}
-              :body (.toString writer)}))
+     :body (.toString writer)}))
 
-
-
-(s/def ::routes vector?)
-(defmethod ig/pre-init-spec ::routes [_]
-  (s/keys :req [::metrics]))
+(defmethod ig/assert-key ::routes
+  [_ {:keys [::metrics]}]
+  (assert (metrics? metrics) "expected a valid instance for metrics"))
 
 (defmethod ig/init-key ::routes
   [_ {:keys [::metrics]}]
-  (let [registry (::registry metrics)]
-    ["/metrics" {:handler (partial handler registry)
-                 :allowed-methods #{:get}}]))
+  ["/metrics" {:handler (get-handler metrics)
+               :allowed-methods #{:get}}])
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Implementation
@@ -126,8 +135,9 @@
 (defmulti create-collector ::mdef/type)
 
 (defn run!
-  [{:keys [::definitions]} & {:keys [id] :as params}]
-  (when-let [mobj (get definitions id)]
+  [instance & {:keys [id] :as params}]
+  (assert (metrics? instance) "expected valid metrics instance")
+  (when-let [mobj (get-collector instance id)]
     (run-collector! mobj params)
     true))
 

backend/src/app/migrations.clj

@@ -11,7 +11,6 @@
    [app.db :as db]
    [app.migrations.clj.migration-0023 :as mg0023]
    [app.util.migrations :as mg]
-   [clojure.spec.alpha :as s]
    [integrant.core :as ig]))
 
 (def migrations
@@ -324,7 +323,110 @@
    {:name "0104-mod-file-thumbnail-table"
     :fn (mg/resource "app/migrations/sql/0104-mod-file-thumbnail-table.sql")}
 
-   ])
+   {:name "0105-mod-file-change-table"
+    :fn (mg/resource "app/migrations/sql/0105-mod-file-change-table.sql")}
+
+   {:name "0105-mod-server-error-report-table"
+    :fn (mg/resource "app/migrations/sql/0105-mod-server-error-report-table.sql")}
+
+   {:name "0106-add-file-tagged-object-thumbnail-table"
+    :fn (mg/resource "app/migrations/sql/0106-add-file-tagged-object-thumbnail-table.sql")}
+
+   {:name "0106-mod-team-table"
+    :fn (mg/resource "app/migrations/sql/0106-mod-team-table.sql")}
+
+   {:name "0107-mod-file-tagged-object-thumbnail-table"
+    :fn (mg/resource "app/migrations/sql/0107-mod-file-tagged-object-thumbnail-table.sql")}
+
+   {:name "0107-add-deletion-protection-trigger-function"
+    :fn (mg/resource "app/migrations/sql/0107-add-deletion-protection-trigger-function.sql")}
+
+   {:name "0108-mod-file-thumbnail-table"
+    :fn (mg/resource "app/migrations/sql/0108-mod-file-thumbnail-table.sql")}
+
+   {:name "0109-mod-file-tagged-object-thumbnail-table"
+    :fn (mg/resource "app/migrations/sql/0109-mod-file-tagged-object-thumbnail-table.sql")}
+
+   {:name "0110-mod-file-media-object-table"
+    :fn (mg/resource "app/migrations/sql/0110-mod-file-media-object-table.sql")}
+
+   {:name "0111-mod-file-data-fragment-table"
+    :fn (mg/resource "app/migrations/sql/0111-mod-file-data-fragment-table.sql")}
+
+   {:name "0112-mod-profile-table"
+    :fn (mg/resource "app/migrations/sql/0112-mod-profile-table.sql")}
+
+   {:name "0113-mod-team-font-variant-table"
+    :fn (mg/resource "app/migrations/sql/0113-mod-team-font-variant-table.sql")}
+
+   {:name "0114-mod-team-table"
+    :fn (mg/resource "app/migrations/sql/0114-mod-team-table.sql")}
+
+   {:name "0115-mod-project-table"
+    :fn (mg/resource "app/migrations/sql/0115-mod-project-table.sql")}
+
+   {:name "0116-mod-file-table"
+    :fn (mg/resource "app/migrations/sql/0116-mod-file-table.sql")}
+
+   {:name "0117-mod-file-object-thumbnail-table"
+    :fn (mg/resource "app/migrations/sql/0117-mod-file-object-thumbnail-table.sql")}
+
+   {:name "0118-mod-task-table"
+    :fn (mg/resource "app/migrations/sql/0118-mod-task-table.sql")}
+
+   {:name "0119-mod-file-table"
+    :fn (mg/resource "app/migrations/sql/0119-mod-file-table.sql")}
+
+   {:name "0120-mod-audit-log-table"
+    :fn (mg/resource "app/migrations/sql/0120-mod-audit-log-table.sql")}
+
+   {:name "0121-mod-file-data-fragment-table"
+    :fn (mg/resource "app/migrations/sql/0121-mod-file-data-fragment-table.sql")}
+
+   {:name "0122-mod-file-table"
+    :fn (mg/resource "app/migrations/sql/0122-mod-file-table.sql")}
+
+   {:name "0122-mod-file-data-fragment-table"
+    :fn (mg/resource "app/migrations/sql/0122-mod-file-data-fragment-table.sql")}
+
+   {:name "0123-mod-file-change-table"
+    :fn (mg/resource "app/migrations/sql/0123-mod-file-change-table.sql")}
+
+   {:name "0124-mod-profile-table"
+    :fn (mg/resource "app/migrations/sql/0124-mod-profile-table.sql")}
+
+   {:name "0125-mod-file-table"
+    :fn (mg/resource "app/migrations/sql/0125-mod-file-table.sql")}
+
+   {:name "0126-add-team-access-request-table"
+    :fn (mg/resource "app/migrations/sql/0126-add-team-access-request-table.sql")}
+
+   {:name "0127-mod-storage-object-table"
+    :fn (mg/resource "app/migrations/sql/0127-mod-storage-object-table.sql")}
+
+   {:name "0128-mod-task-table"
+    :fn (mg/resource "app/migrations/sql/0128-mod-task-table.sql")}
+
+   {:name "0129-mod-file-change-table"
+    :fn (mg/resource "app/migrations/sql/0129-mod-file-change-table.sql")}
+
+   {:name "0130-mod-file-change-table"
+    :fn (mg/resource "app/migrations/sql/0130-mod-file-change-table.sql")}
+
+   {:name "0131-mod-webhook-table"
+    :fn (mg/resource "app/migrations/sql/0131-mod-webhook-table.sql")}
+
+   {:name "0132-mod-file-change-table"
+    :fn (mg/resource "app/migrations/sql/0132-mod-file-change-table.sql")}
+
+   {:name "0133-mod-file-table"
+    :fn (mg/resource "app/migrations/sql/0133-mod-file-table.sql")}
+
+   {:name "0134-mod-file-change-table"
+    :fn (mg/resource "app/migrations/sql/0134-mod-file-change-table.sql")}
+
+   {:name "0135-mod-team-invitation-table.sql"
+    :fn (mg/resource "app/migrations/sql/0135-mod-team-invitation-table.sql")}])
 
 (defn apply-migrations!
   [pool name migrations]
@@ -332,9 +434,9 @@
     (mg/setup! conn)
     (mg/migrate! conn {:name name :steps migrations})))
 
-(defmethod ig/pre-init-spec ::migrations
-  [_]
-  (s/keys :req [::db/pool]))
+(defmethod ig/assert-key ::migrations
+  [_ {:keys [::db/pool]}]
+  (assert (db/pool? pool) "expected valid pool"))
 
 (defmethod ig/init-key ::migrations
   [module {:keys [::db/pool]}]

backend/src/app/migrations/sql/0105-mod-file-change-table.sql

@@ -0,0 +1,9 @@
+ALTER TABLE file_change
+  ADD COLUMN label text NULL;
+
+ALTER TABLE file_change
+  ALTER COLUMN label SET STORAGE external;
+
+CREATE INDEX file_change__label__idx
+    ON file_change (file_id, label)
+ WHERE label is not null;