wip cleanup

wip estotienemejorpinta
wip tampocosirve
2026-01-04 12:28:52 -05:00 · 2022-11-29 15:49:24 +01:00 · 2022-10-11 09:37:17 +02:00 · 2022-10-11 09:37:17 +02:00 · 2022-10-11 09:37:17 +02:00 · 2022-10-11 09:37:17 +02:00
676 changed files with 22495 additions and 39299 deletions
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -3,19 +3,19 @@ jobs:
  build:
    docker:
      - image: penpotapp/devenv:latest
-      - image: cimg/postgres:14.5
+      - image: cimg/postgres:13.5
        environment:
          POSTGRES_USER: penpot_test
          POSTGRES_PASSWORD: penpot_test
          POSTGRES_DB: penpot_test
-      - image: cimg/redis:7.0.5
+      - image: cimg/redis:6.2.6

    working_directory: ~/repo
    resource_class: large

    environment:
      # Customize the JVM maximum heap limit
-      JVM_OPTS: -Xmx4g
+      JVM_OPTS: -Xmx1g

    steps:
      - checkout
@@ -29,13 +29,6 @@ jobs:

      - run: cd .clj-kondo && cat config.edn

-      - run:
-          name: frontend styles prettier
-          working_directory: "./frontend"
-          command: |
-            yarn install
-            yarn run lint-scss
-
      - run:
          name: common lint
          working_directory: "./common"
@@ -50,6 +43,13 @@ jobs:
            clj-kondo --version
            clj-kondo --parallel --lint src/

+      - run:
+          name: frontend styles prettier
+          working_directory: "./frontend"
+          command: |
+            yarn install
+            yarn run lint-scss
+
      - run:
          name: backend lint
          working_directory: "./backend"
@@ -57,42 +57,47 @@ jobs:
            clj-kondo --version
            clj-kondo --parallel --lint src/

-      - run:
-          working_directory: "./common"
-          name: common tests
-          command: |
-            yarn install
-            yarn test
-            clojure -X:dev:test :patterns '["common-tests.*-test"]'
-
-          environment:
-            PATH: /usr/local/nodejs/bin/:/usr/local/bin:/bin:/usr/bin
-            JVM_OPTS: -Xmx4g
-            NODE_OPTIONS: --max-old-space-size=4096
-
+      # run backend test
      - run:
          name: backend test
          working_directory: "./backend"
-          command: |
-            clojure -X:dev:test :patterns '["backend-tests.*-test"]'
-
+          command: "clojure -X:dev:test"
          environment:
            PENPOT_TEST_DATABASE_URI: "postgresql://localhost/penpot_test"
            PENPOT_TEST_DATABASE_USERNAME: penpot_test
            PENPOT_TEST_DATABASE_PASSWORD: penpot_test
            PENPOT_TEST_REDIS_URI: "redis://localhost/1"
-            JVM_OPTS: -Xmx4g

      - run:
          name: frontend tests
          working_directory: "./frontend"
          command: |
            yarn install
-            yarn test
+            clojure -M:dev:shadow-cljs compile test
+            node target/tests.js
+
+          environment:
+            PATH: /usr/local/nodejs/bin/:/usr/local/bin:/bin:/usr/bin
+
+      - run:
+          working_directory: "./common"
+          name: common tests (cljs)
+          command: |
+            yarn install
+            yarn run compile-test
+            node target/test.js
+
+          environment:
+            PATH: /usr/local/nodejs/bin/:/usr/local/bin:/bin:/usr/bin
+
+      - run:
+          working_directory: "./common"
+          name: common tests (clj)
+          command: |
+            clojure -X:dev:test

          environment:
            PATH: /usr/local/nodejs/bin/:/usr/local/bin:/bin:/usr/bin
-            NODE_OPTIONS: --max-old-space-size=4096

      - save_cache:
         paths:
--- a/.clj-kondo/config.edn
+++ b/.clj-kondo/config.edn
@@ -7,7 +7,6 @@
  app.common.data/export clojure.core/def
  app.db/with-atomic clojure.core/with-open
  app.common.data.macros/get-in clojure.core/get-in
-  app.common.data.macros/with-open clojure.core/with-open
  app.common.data.macros/select-keys clojure.core/select-keys
  app.common.logging/with-context clojure.core/do}

@@ -45,15 +44,6 @@
  :redundant-do
  {:level :off}

-  :earmuffed-var-not-dynamic
-  {:level :off}
-
-  :dynamic-var-not-earmuffed
-  {:level :off}
-
-  :used-underscored-binding
-  {:level :warning}
-
  :unused-binding
  {:exclude-destructured-as true
   :exclude-destructured-keys-in-fn-args false
--- a/.gitignore
+++ b/.gitignore
@@ -1,59 +1,55 @@
 *-init.clj
 *.jar
-*.orig
 *.penpot
+*.orig
 .calva
 .clj-kondo
 .cpcache
+.lein-deps-sum
+.lein-failures
+.lein-plugins/
+.lein-repl-history
 .lsp
 .nrepl-port
 .nyc_output
 .rebel_readline_history
 .repl
-.shadow-cljs
-/*.jpg
-/*.md
-/*.png
-/*.sql
-/*.txt
-/*.yml
-/*.zip
 /.clj-kondo/.cache
 /_dump
-/backend/*.md
-/backend/*.sql
-/backend/*.txt
+/backend/-
 /backend/assets/
-/backend/builtin-templates
 /backend/dist/
 /backend/logs/
 /backend/resources/public/assets
 /backend/resources/public/media
 /backend/target/
+/backend/builtin-templates
 /bundle*
 /cd.md
 /clj-profiler/
+/common/.shadow-cljs
 /common/coverage
 /common/target
 /deploy
 /docker/images/bundle*
+/exporter/.shadow-cljs
 /exporter/target
+/frontend/.shadow-cljs
+/frontend/package-lock.json
+/frontend/cypress/videos/*/
 /frontend/cypress/fixtures/validuser.json
-/frontend/cypress/videos/*/
-/frontend/cypress/videos/*/
 /frontend/dist/
 /frontend/npm-debug.log
 /frontend/out/
-/frontend/package-lock.json
 /frontend/resources/fonts/experiments
 /frontend/resources/public/*
 /frontend/target/
-/other/
-/scripts/
+/frontend/cypress/videos/*/
+/media
 /telemetry/
-/tmp/
 /vendor/**/target
 /vendor/svgclean/bundle*.js
 /web
 clj-profiler/
+figwheel_server.log
 node_modules
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,29 +1,9 @@
 # CHANGELOG

-## :rocket: Next
+## :rocket: Next (1.17)

 ### :boom: Breaking changes & Deprecations
-
 ### :sparkles: New features
-
-### :bug: Bugs fixed
-
-### :arrow_up: Deps updates
-
-### :heart: Community contributions by (Thank you!)
-
-
-## 1.17.0
-
-### :sparkles: New features
-
- Adds layout flex functionality for boards
- Better overlays interactions on boards inside boards [Taiga #4386](https://tree.taiga.io/project/penpot/us/4386)
- Show board miniature in manual overlay setting [Taiga #4475](https://tree.taiga.io/project/penpot/issue/4475)
- Handoff visual improvements [Taiga #3124](https://tree.taiga.io/project/penpot/us/3124)
- Dynamic alignment only in sight [Github 1971](https://github.com/penpot/penpot/issues/1971)
- Add some accessibility to shortcut panel [Taiga #4713](https://tree.taiga.io/project/penpot/issue/4713)
-
 ### :bug: Bugs fixed

 - Add title to color bullets [Taiga #4218](https://tree.taiga.io/project/penpot/task/4218)
@@ -31,67 +11,13 @@
 - Fix shortcut texts alignment [Taiga #4275](https://tree.taiga.io/project/penpot/issue/4275)
 - Fix some texts and a typo [Taiga #4215](https://tree.taiga.io/project/penpot/issue/4215)
 - Fix twitter support account link [Taiga #4279](https://tree.taiga.io/project/penpot/issue/4279)
- Fix lang autodetect issue [Taiga #4277](https://tree.taiga.io/project/penpot/issue/4277)
- Fix adding an extra page on import [Taiga #4543](https://tree.taiga.io/project/penpot/task/4543)
- Fix unable to select text at assets inputs in firefox [Taiga #4572](https://tree.taiga.io/project/penpot/issue/4572)
- Fix component sync when converting to path [Taiga #3642](https://tree.taiga.io/project/penpot/issue/3642)
- Fix style for team invite in deutsch [Taiga #4614](https://tree.taiga.io/project/penpot/issue/4614)
- Fix problem with text edition in Safari [Taiga #4046](https://tree.taiga.io/project/penpot/issue/4046)
- Fix show outline with rounded corners on rects [Taiga #4053](https://tree.taiga.io/project/penpot/issue/4053)
- Fix wrong interaction between comments and panning modes [Taiga #4297](https://tree.taiga.io/project/penpot/issue/4297)
- Fix bad element positioning on interaction with fixed scroll [Github #2660](https://github.com/penpot/penpot/issues/2660)
- Fix display type of component library not persistent [Taiga #4512](https://tree.taiga.io/project/penpot/issue/4512)
- Fix problem when moving texts with keyboard [#2690](https://github.com/penpot/penpot/issues/2690)
- Fix problem when drawing boxes won't detect mouse-up [Taiga #4618](https://tree.taiga.io/project/penpot/issue/4618)
- Fix missing loading icon on shared libraries [Taiga #4148](https://tree.taiga.io/project/penpot/issue/4148)
- Fix selection stroke missing in properties of multiple texts [Taiga #4048](https://tree.taiga.io/project/penpot/issue/4048)
- Fix missing create component menu for frames [Github #2670](https://github.com/penpot/penpot/issues/2670)
- Fix "currentColor" is not converted when importing SVG [Github 2276](https://github.com/penpot/penpot/issues/2276)
- Fix incorrect color in properties of multiple bool shapes [Taiga #4355](https://tree.taiga.io/project/penpot/issue/4355)
- Fix pressing the enter key gives you an internal error [Github 2675](https://github.com/penpot/penpot/issues/2675) [Github 2577](https://github.com/penpot/penpot/issues/2577)
- Fix confirm group name with enter doesn't work in assets modal [Taiga #4506](https://tree.taiga.io/project/penpot/issue/4506)
- Fix group/ungroup shapes inside a component [Taiga #4052](https://tree.taiga.io/project/penpot/issue/4052)
- Fix wrong update of text in components [Taiga #4646](https://tree.taiga.io/project/penpot/issue/4646)
- Fix problem with SVG imports with style [#2605](https://github.com/penpot/penpot/issues/2605)
- Fix ghost shapes after sync groups in components [Taiga #4649](https://tree.taiga.io/project/penpot/issue/4649)
- Fix layer orders messed up on move, group, reparent and undo [Github #2672](https://github.com/penpot/penpot/issues/2672)
- Fix max height in library dialog [Github #2335](https://github.com/penpot/penpot/issues/2335)
- Fix undo ungroup (shift+g) scrambles positions [Taiga #4674](https://tree.taiga.io/project/penpot/issue/4674)
- Fix justified text is stretched [Github #2539](https://github.com/penpot/penpot/issues/2539)
- Fix mousewheel on viewer inspector [Taiga #4221](https://tree.taiga.io/project/penpot/issue/4221)
- Fix path edition activated on boards [Taiga #4105](https://tree.taiga.io/project/penpot/issue/4105)
- Fix hidden layers inside groups become visible after the group visibility is changed[Taiga #4710](https://tree.taiga.io/project/penpot/issue/4710)
- Fix format of HSLA color on viewer [Taiga #4393](https://tree.taiga.io/project/penpot/issue/4393)
- Fix some typos [Taiga #4724](https://tree.taiga.io/project/penpot/issue/4724)

-## 1.16.2-beta

-### :bug: Bugs fixed
+### :arrow_up: Deps updates
+### :heart: Community contributions by (Thank you!)

- Fix strage cursor behaviour after clicking viewport with text pool [Github #2447](https://github.com/penpot/penpot/issues/2447)

-## 1.16.1-beta
-
-### :bug: Bugs fixed
-
- Fix unexpected exception related to default nudge value
- Fix firefox changing layer color type is not applied [Taiga #4292](https://tree.taiga.io/project/penpot/issue/4292)
- Fix justify alignes text left [Taiga #4322](https://tree.taiga.io/project/penpot/issue/4322)
- Fix text out of borders with "auto width" and center align [Taiga #4308](https://tree.taiga.io/project/penpot/issue/4308)
- Fix wrong validation text after interaction with 2 and more files [Taiga #4276](https://tree.taiga.io/project/penpot/issue/4276)
- Fix auto-width for texts can make text appear stretched [Github #2482](https://github.com/penpot/penpot/issues/2482)
- Fix boards name do not disappear in focus mode [#4272](https://tree.taiga.io/project/penpot/issue/4272)
- Fix wrong email in the info message at change email [Taiga #4274](https://tree.taiga.io/project/penpot/issue/4274)
- Fix transform to path RMB menu item is not relevant if shape is already path [Taiga #4302](https://tree.taiga.io/project/penpot/issue/4302)
- Fix join nodes icon is active when 2 already joined nodes are selected [Taiga #4370](https://tree.taiga.io/project/penpot/issue/4370)
- Fix path nodes panel. "To curve" and "To corner" icons are active if node is already curved/cornered [Taiga #4371](https://tree.taiga.io/project/penpot/issue/4371)
- Fix displaying comments settings are not applied via "Comments" menu drop-down on the top navbar on view mode [Taiga #4389](https://tree.taiga.io/project/penpot/issue/4389)
- Fix bad behaviour on hovering and click nested artboards [Taiga #4018](https://tree.taiga.io/project/penpot/issue/4018) and [Taiga #4269](https://tree.taiga.io/project/penpot/us/4269)
- Fix lang autodetect issue [Taiga #4277](https://tree.taiga.io/project/penpot/issue/4277)
- Fix colorpicker does not close upon switching to Dashboard [Taiga #4408](https://tree.taiga.io/project/penpot/issue/4408)
- Fix problem with auto-width/auto-height + lock-proportions
-
-## 1.16.0-beta
+## :rocket: 1.16.0-beta

 ### :boom: Breaking changes & Deprecations

@@ -132,11 +58,8 @@
 - Fix ungroup does not work for typographies [Taiga #4195](https://tree.taiga.io/project/penpot/issue/4195)
 - Fix inviting to non existing users can fail [Taiga #4108](https://tree.taiga.io/project/penpot/issue/4108)
 - Fix components marked as touched when moved [Taiga #4061](https://tree.taiga.io/project/penpot/task/4061)
- Fix boards grouped shouldn't show the title [Taiga #4251](https://tree.taiga.io/project/penpot/issue/4251)
- Fix gradient handlers are under resize handlers[Taiga #4298](https://tree.taiga.io/project/penpot/issue/4298)
- Fix grid not syncing immediately in multiuser [Taiga #4339](https://tree.taiga.io/project/penpot/issue/4339)
- Fix custom font upload fails silently for unsupported formats [Taiga #4279](https://tree.taiga.io/project/penpot/issue/4280)

+### :arrow_up: Deps updates
 ### :heart: Community contributions by (Thank you!)

 - To @andrewzhurov for many code contributions on this release.
@@ -148,17 +71,11 @@
 ### :bug: Bugs fixed

 - Fix artboard border radius [Taiga #4291](https://tree.taiga.io/project/penpot/issue/4291)
- Fix copied & pasted layer is not visible [Taiga #4283](https://tree.taiga.io/project/penpot/issue/4283)
- Fix notification to newsletter is shown in all cases [Taiga #4367](https://tree.taiga.io/project/penpot/issue/4367)
- Fix comments section is not scrolling by mouse wheel [Taiga #4305](https://tree.taiga.io/project/penpot/issue/4305)
- Fix justify alignes text left [Taiga #4322](https://tree.taiga.io/project/penpot/issue/4322)
- Fix text out of borders with "auto width" and center align [Taiga #4308](https://tree.taiga.io/project/penpot/issue/4308)

 ## 1.15.4-beta

 ### :bug: Bugs fixed

- Fix social buttons in register form [Taiga #4320](https://tree.taiga.io/project/penpot/issue/4320)
 - Remove gitter information from feedback page [Taiga #4157](https://tree.taiga.io/project/penpot/issue/4157)
 - Fix overlay remains open on frame change [Taiga #4066](https://tree.taiga.io/project/penpot/issue/4066)
 - Fix toggle overlay position [Taiga #4091](https://tree.taiga.io/project/penpot/issue/4091)
--- a/backend/deps.edn
+++ b/backend/deps.edn
@@ -1,12 +1,12 @@
 {:deps
 {penpot/common {:local/root "../common"}
  org.clojure/clojure {:mvn/version "1.11.1"}
-  org.clojure/core.async {:mvn/version "1.6.673"}
+  org.clojure/core.async {:mvn/version "1.5.648"}

  ;; Logging
-  org.zeromq/jeromq {:mvn/version "0.5.3"}
+  org.zeromq/jeromq {:mvn/version "0.5.2"}

-  com.github.luben/zstd-jni {:mvn/version "1.5.2-5"}
+  com.github.luben/zstd-jni {:mvn/version "1.5.2-4"}
  org.clojure/data.fressian {:mvn/version "1.0.0"}

  io.prometheus/simpleclient {:mvn/version "0.16.0"}
@@ -16,20 +16,21 @@
   :exclusions [org.eclipse.jetty/jetty-server
                org.eclipse.jetty/jetty-servlet]}

+
  io.prometheus/simpleclient_httpserver {:mvn/version "0.16.0"}

-  io.lettuce/lettuce-core {:mvn/version "6.2.2.RELEASE"}
+  io.lettuce/lettuce-core {:mvn/version "6.2.0.RELEASE"}
  java-http-clj/java-http-clj {:mvn/version "0.4.3"}

  funcool/yetti
-  {:git/tag "v9.11"
-   :git/sha "6f9197a"
+  {:git/tag "v9.9"
+   :git/sha "f0a455d"
   :git/url "https://github.com/funcool/yetti.git"
   :exclusions [org.slf4j/slf4j-api]}

-  com.github.seancorfield/next.jdbc {:mvn/version "1.3.847"}
+  com.github.seancorfield/next.jdbc {:mvn/version "1.3.828"}
  metosin/reitit-core {:mvn/version "0.5.18"}
-  org.postgresql/postgresql {:mvn/version "42.5.1"}
+  org.postgresql/postgresql {:mvn/version "42.5.0"}
  com.zaxxer/HikariCP {:mvn/version "5.0.1"}

  io.whitfin/siphash {:mvn/version "2.0.0"}
@@ -37,9 +38,7 @@
  buddy/buddy-hashers {:mvn/version "1.8.158"}
  buddy/buddy-sign {:mvn/version "3.4.333"}

-  com.github.ben-manes.caffeine/caffeine {:mvn/version "3.1.2"}
-
-  org.jsoup/jsoup {:mvn/version "1.15.3"}
+  org.jsoup/jsoup {:mvn/version "1.15.1"}
  org.im4java/im4java
  {:git/tag "1.4.0-penpot-2"
   :git/sha "e2b3e16"
@@ -51,12 +50,11 @@
  integrant/integrant {:mvn/version "0.8.0"}

  dawran6/emoji {:mvn/version "0.1.5"}
-  markdown-clj/markdown-clj {:mvn/version "1.11.4"}
+  markdown-clj/markdown-clj {:mvn/version "1.11.3"}

  ;; Pretty Print specs
  pretty-spec/pretty-spec {:mvn/version "0.1.4"}
-  software.amazon.awssdk/s3 {:mvn/version "2.19.8"}
-  }
+  software.amazon.awssdk/s3 {:mvn/version "2.17.278"}}

 :paths ["src" "resources" "target/classes"]
 :aliases
@@ -64,16 +62,15 @@
  {:extra-deps
   {com.bhauman/rebel-readline {:mvn/version "RELEASE"}
    org.clojure/tools.namespace {:mvn/version "RELEASE"}
+    org.clojure/test.check {:mvn/version "RELEASE"}
    clojure-humanize/clojure-humanize {:mvn/version "0.2.2"}
    org.clojure/data.csv {:mvn/version "RELEASE"}
    com.clojure-goes-fast/clj-async-profiler {:mvn/version "RELEASE"}
    mockery/mockery {:mvn/version "RELEASE"}}
   :extra-paths ["test" "dev"]}

-
  :build
-  {:extra-deps
-   {io.github.clojure/tools.build {:git/tag "v0.9.0" :git/sha "8c93e0c"}}
+  {:extra-deps {io.github.clojure/tools.build {:git/tag "v0.8.3" :git/sha "0d20256"}}
   :ns-default build}

  :test
--- a/backend/dev/user.clj
+++ b/backend/dev/user.clj
@@ -12,12 +12,9 @@
   [app.common.logging :as l]
   [app.common.perf :as perf]
   [app.common.pprint :as pp]
-   [app.common.spec :as us]
   [app.common.transit :as t]
-   [app.common.uuid :as uuid]
   [app.config :as cfg]
   [app.main :as main]
-   [app.srepl.helpers]
   [app.srepl.main :as srepl]
   [app.util.blob :as blob]
   [app.util.fressian :as fres]
@@ -29,13 +26,10 @@
   [clojure.pprint :refer [pprint print-table]]
   [clojure.repl :refer :all]
   [clojure.spec.alpha :as s]
-   [clojure.stacktrace :as trace]
+   [clojure.spec.gen.alpha :as sgen]
   [clojure.test :as test]
-   [clojure.test.check.generators :as gen]
   [clojure.tools.namespace.repl :as repl]
   [clojure.walk :refer [macroexpand-all]]
-   [criterium.core  :as crit]
-   [cuerdas.core :as str]
   [datoteka.core]
   [integrant.core :as ig]))

@@ -48,24 +42,24 @@

 (defmacro run-quick-bench
  [& exprs]
-  `(crit/with-progress-reporting (crit/quick-bench (do ~@exprs) :verbose)))
+  `(with-progress-reporting (quick-bench (do ~@exprs) :verbose)))

 (defmacro run-quick-bench'
  [& exprs]
-  `(crit/quick-bench (do ~@exprs)))
+  `(quick-bench (do ~@exprs)))

 (defmacro run-bench
  [& exprs]
-  `(crit/with-progress-reporting (crit/bench (do ~@exprs) :verbose)))
+  `(with-progress-reporting (bench (do ~@exprs) :verbose)))

 (defmacro run-bench'
  [& exprs]
-  `(crit/bench (do ~@exprs)))
+  `(bench (do ~@exprs)))

 ;; --- Development Stuff

 (defn- run-tests
-  ([] (run-tests #"^backend-tests.*-test$"))
+  ([] (run-tests #"^app.*-test$"))
  ([o]
   (repl/refresh)
   (cond
@@ -80,15 +74,12 @@

 (defn- start
  []
-  (try
-    (alter-var-root #'system (fn [sys]
-                               (when sys (ig/halt! sys))
-                               (-> (merge main/system-config main/worker-config)
-                                   (ig/prep)
-                                   (ig/init))))
-    :started
-    (catch Throwable cause
-      (ex/print-throwable cause))))
+  (alter-var-root #'system (fn [sys]
+                             (when sys (ig/halt! sys))
+                             (-> (merge main/system-config main/worker-config)
+                                 (ig/prep)
+                                 (ig/init))))
+  :started)

 (defn- stop
  []
@@ -109,20 +100,12 @@

 (defn compression-bench
  [data]
-  (let [humanize (fn [v] (hum/filesize v :binary true :format " %.4f "))
-        v1 (time (humanize (alength (blob/encode data {:version 1}))))
-        v3 (time (humanize (alength (blob/encode data {:version 3}))))
-        v4 (time (humanize (alength (blob/encode data {:version 4}))))
-        v5 (time (humanize (alength (blob/encode data {:version 5}))))
-        v6 (time (humanize (alength (blob/encode data {:version 6}))))
-        ]
+  (let [humanize (fn [v] (hum/filesize v :binary true :format " %.4f "))]
    (print-table
-     [{
-       :v1 v1
-       :v3 v3
-       :v4 v4
-       :v5 v5
-       :v6 v6
+     [{:v1 (humanize (alength (blob/encode data {:version 1})))
+       :v2 (humanize (alength (blob/encode data {:version 2})))
+       :v3 (humanize (alength (blob/encode data {:version 3})))
+       :v4 (humanize (alength (blob/encode data {:version 4})))
       }])))

 (defonce debug-tap
--- a/backend/resources/app/onboarding.edn
+++ b/backend/resources/app/onboarding.edn
@@ -22,10 +22,6 @@
  :name "Circum Icons pack"
  :thumbnail-uri "https://penpot.app/images/libraries/cover-circum.jpg"
  :file-uri "https://github.com/penpot/penpot-files/raw/binary-files/CircumIcons.penpot"}
- {:id "coreui"
-  :name "CoreUI"
-  :thumbnail-uri "https://penpot.app/images/libraries/cover-coreui.jpg"
-  :file-uri "https://github.com/penpot/penpot-files/raw/main/CoreUI%20DesignSystem%20(DEMO).penpot"}
 {:id "whiteboarding-kit"
  :name "Whiteboarding Kit"
  :thumbnail-uri "https://penpot.app/images/libraries/cover-whiteboards.jpg"
--- a/backend/resources/app/templates/api-doc-entry.tmpl
+++ b/backend/resources/app/templates/api-doc-entry.tmpl
@@ -6,21 +6,14 @@
    <div class="tags">
      {% if item.deprecated %}
        <span class="tag">
-          <span>DEPRECATED</span>
-        </span>
-      {% endif %}
-
-      {% if item.auth %}
-        <span class="tag">
-          <span>AUTH</span>
-        </span>
-      {% endif %}
-      
-      {% if item.webhook %}
-        <span class="tag">
-          <span>WEBHOOK</span>
+          <span>Deprecated:</span>
+          <span>since v{{item.deprecated}}</span>,
        </span>
      {% endif %}
+      <span class="tag">
+        <span>Auth:</span>
+        <span>{% if item.auth %}YES{% else %}NO{% endif %}</span>
+      </span>
    </div>
  </div>
  <div class="rpc-row-detail hidden">
--- a/backend/resources/app/templates/error-list.tmpl
+++ b/backend/resources/app/templates/error-list.tmpl
@@ -11,8 +11,7 @@ penpot - error list
 <main class="horizontal-list">
  <ul>
    {% for item in items %}
-    <li><a class="date" href="/dbg/error/{{item.id}}">{{item.created-at}}</a> 
-        <span class="title">{{item.hint|abbreviate:150}}</span></li>
+    <li><a href="/dbg/error/{{item.id}}">{{item.created-at}}</a></li>
    {% endfor %}
  </ul>
 </main>
--- a/backend/resources/app/templates/styles.css
+++ b/backend/resources/app/templates/styles.css
@@ -137,6 +137,8 @@ nav > div:not(:last-child) {
  margin: 0px;
  padding: 0px;
  flex-direction: column;
+  flex-wrap: wrap;
+  height: calc(100vh - 75px);
  justify-content: flex-start;
 }

@@ -149,31 +151,19 @@ nav > div:not(:last-child) {
  margin: 0px 20px;
  cursor: pointer;
  display: flex;
+  justify-content: center;
  border-radius: 3px;
 }

-
-
 .horizontal-list li:hover {
  background-color: #e9e9e9;
 }

-.horizontal-list li > *:not(:last-child) {
-  margin-right: 10px;
-}
-
 .horizontal-list li > a {
  text-decoration: none;
  color: inherit;
 }

-.horizontal-list li > .date {
-  font-weight: 200;
-  color: #686868;
-  min-width: 210px;
-}
-
-
 form .row {
  padding: 5px 0;
 }
--- a/backend/resources/climit.edn
+++ b/backend/resources/climit.edn
@@ -1,9 +0,0 @@
-;; Example climit.edn file
-;; Required: concurrency
-;; Optional: queue-size, ommited means Integer/MAX_VALUE
-{:update-file   {:concurrency 1 :queue-size 3}
- :auth          {:concurrency 128}
- :process-font  {:concurrency 4 :queue-size 32}
- :process-image {:concurrency 8 :queue-size 32}
- :push-audit-events
- {:concurrency 1 :queue-size 3}}
--- a/backend/resources/log4j2-devenv.xml
+++ b/backend/resources/log4j2-devenv.xml
@@ -2,13 +2,11 @@
 <Configuration status="info" monitorInterval="30">
  <Appenders>
    <Console name="console" target="SYSTEM_OUT">
-      <PatternLayout pattern="[%d{YYYY-MM-dd HH:mm:ss.SSS}] %level{length=1} %logger{36} - %msg%n"
-                     alwaysWriteExceptions="false" />
+      <PatternLayout pattern="[%d{YYYY-MM-dd HH:mm:ss.SSS}] %level{length=1} %logger{36} - %msg%n"/>
    </Console>

    <RollingFile name="main" fileName="logs/main.log" filePattern="logs/main-%i.log">
-      <PatternLayout pattern="[%d{YYYY-MM-dd HH:mm:ss.SSS}] %level{length=1} %logger{36} - %msg%n"
-                     alwaysWriteExceptions="false" />
+      <PatternLayout pattern="[%d{YYYY-MM-dd HH:mm:ss.SSS}] %level{length=1} %logger{36} - %msg%n"/>
      <Policies>
        <SizeBasedTriggeringPolicy size="50M"/>
      </Policies>
@@ -34,8 +32,6 @@
    <Logger name="app.util.websocket" level="info" />
    <Logger name="app.redis" level="info" />
    <Logger name="app.rpc.rlimit" level="info" />
-    <Logger name="app.rpc.climit" level="info" />
-    <Logger name="app.rpc.mutations.files" level="info" />

    <Logger name="app.cli" level="debug" additivity="false">
      <AppenderRef ref="console"/>
--- a/backend/resources/log4j2.xml
+++ b/backend/resources/log4j2.xml
@@ -2,8 +2,7 @@
 <Configuration status="info" monitorInterval="60">
  <Appenders>
    <Console name="console" target="SYSTEM_OUT">
-      <PatternLayout pattern="[%d{YYYY-MM-dd HH:mm:ss.SSS}] %level{length=1} %logger{36} - %msg%n"
-                     alwaysWriteExceptions="false" />
+      <PatternLayout pattern="[%d{YYYY-MM-dd HH:mm:ss.SSS}] %level{length=1} %logger{36} - %msg%n"/>
    </Console>
  </Appenders>

--- a/backend/resources/rlimit.edn
+++ b/backend/resources/rlimit.edn
@@ -1,10 +1,6 @@
-;; Example rlimit.edn file
 ^{:refresh "30s"}
 {:default
 [[:default :window "200000/h"]]

- #{:command/get-teams}
- [[:burst :bucket "5/1/5s"]]
-
- #{:command/get-profile}
- [[:burst :bucket "60/60/1m"]]}
+ #{:query/profile}
+ [[:burst :bucket "100/60/1m"]]}
--- a/backend/scripts/build
+++ b/backend/scripts/build
@@ -13,9 +13,9 @@ cp ../CHANGES.md target/classes/changelog.md;
 clojure -T:build jar;
 mv target/penpot.jar target/dist/penpot.jar
 cp scripts/run.template.sh target/dist/run.sh;
-cp scripts/manage.py target/dist/manage.py
+cp scripts/manage.template.sh target/dist/manage.sh;
 chmod +x target/dist/run.sh;
-chmod +x target/dist/manage.py
+chmod +x target/dist/manage.sh;

 # Prefetch
 bb ./scripts/prefetch-templates.clj resources/app/onboarding.edn builtin-templates/
--- a/backend/scripts/kill-repl.sh
+++ b/backend/scripts/kill-repl.sh
@@ -1,4 +0,0 @@
-#!/usr/bin/env bash
-set -x
-
-jcmd |grep "rebel" |sed -nE 's/^([0-9]+).*$/\1/p' | xargs kill -9
--- a/backend/scripts/manage.py
+++ b/backend/scripts/manage.py
@@ -1,167 +0,0 @@
-#!/usr/bin/env python3
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# Copyright (c) KALEIDOS INC
-
-import argparse
-import json
-import socket
-import sys
-
-from getpass import getpass
-from urllib.parse import urlparse
-
-PREPL_URI = "tcp://localhost:6063"
-
-def get_prepl_conninfo():
-    uri_data = urlparse(PREPL_URI)
-    if uri_data.scheme != "tcp":
-        raise RuntimeException(f"invalid PREPL_URI: {PREPL_URI}")
-
-    if not isinstance(uri_data.netloc, str):
-        raise RuntimeException(f"invalid PREPL_URI: {PREPL_URI}")
-
-    host, port = uri_data.netloc.split(":", 2)
-
-    if port is None:
-        port = 6063
-
-    if isinstance(port, str):
-        port = int(port)
-
-    return host, port
-
-def send_eval(expr):
-    host, port = get_prepl_conninfo()
-
-    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
-        s.connect((host, port))
-        s.send(expr.encode("utf-8"))
-        s.send(b":repl/quit\n\n")
-
-        with s.makefile() as f:
-            result = json.load(f)
-            tag = result.get("tag", None)
-            if tag != "ret":
-                raise RuntimeException("unexpected response from PREPL")
-            return result.get("val", None), result.get("exception", None)
-
-def encode(val):
-    return json.dumps(json.dumps(val))
-
-def print_error(res):
-    for error in res["via"]:
-        print("ERR:", error["message"])
-        break
-
-def run_cmd(params):
-    expr = "(app.srepl.ext/run-json-cmd {})".format(encode(params))
-    res, failed = send_eval(expr)
-    if failed:
-        print_error(res)
-        sys.exit(-1)
-
-    return res
-
-def create_profile(fullname, email, password):
-    params = {
-        "cmd": "create-profile",
-        "params": {
-            "fullname": fullname,
-            "email": email,
-            "password": password
-        }
-    }
-
-    res = run_cmd(params)
-    print(f"Created: {res['email']} / {res['id']}")
-
-def update_profile(email, fullname, password, is_active):
-    params = {
-        "cmd": "update-profile",
-        "params": {
-            "email": email,
-            "fullname": fullname,
-            "password": password,
-            "is_active": is_active
-        }
-    }
-
-    res = run_cmd(params)
-    if res is True:
-        print(f"Updated")
-    else:
-        print(f"No profile found with email {email}")
-
-def derive_password(password):
-    params = {
-        "cmd": "derive-password",
-        "params": {
-            "password": password,
-        }
-    }
-
-    res = run_cmd(params)
-    print(f"Derived password: \"{res}\"")
-
-available_commands = [
-    "create-profile",
-    "update-profile",
-    "derive-password"
-]
-
-parser = argparse.ArgumentParser(
-    description=(
-        "Penpot Command Line Interface (CLI)"
-    )
-)
-
-parser.add_argument("-V", "--version", action="version", version="Penpot CLI %%develop%%")
-parser.add_argument("action", action="store", choices=available_commands)
-parser.add_argument("-n", "--fullname", help="Fullname", action="store")
-parser.add_argument("-e", "--email", help="Email", action="store")
-parser.add_argument("-p", "--password", help="Password", action="store")
-parser.add_argument("-c", "--connect", help="Connect to PREPL", action="store", default="tcp://localhost:6063")
-
-args = parser.parse_args()
-
-PREPL_URI = args.connect
-
-if args.action == "create-profile":
-    email = args.email
-    password = args.password
-    fullname = args.fullname
-
-    if email is None:
-        email = input("Email: ")
-
-    if fullname is None:
-        fullname = input("Fullname: ")
-
-    if password is None:
-        password = getpass("Password: ")
-
-    create_profile(fullname, email, password)
-
-elif args.action == "update-profile":
-    email = args.email
-    password = args.password
-
-    if email is None:
-        email = input("Email: ")
-
-    if password is None:
-        password = getpass("Password: ")
-
-    update_profile(email, None, password, None)
-
-elif args.action == "derive-password":
-    password = args.password
-
-    if password is None:
-        password = getpass("Password: ")
-
-    derive_password(password)
--- a/backend/scripts/manage.template.sh
+++ b/backend/scripts/manage.template.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set +e
+JAVA_CMD=$(type -p java)
+
+set -e
+if [[ ! -n "$JAVA_CMD" ]]; then
+  if [[ -n "$JAVA_HOME" ]] && [[ -x "$JAVA_HOME/bin/java" ]]; then
+    JAVA_CMD="$JAVA_HOME/bin/java"
+  else
+    >&2 echo "Couldn't find 'java'. Please set JAVA_HOME."
+    exit 1
+  fi
+fi
+
+if [ -f ./environ ]; then
+   source ./environ
+fi
+
+exec $JAVA_CMD $JVM_OPTS -jar penpot.jar -m app.cli.manage "$@"
--- a/backend/scripts/repl
+++ b/backend/scripts/repl
@@ -2,21 +2,7 @@

 export PENPOT_HOST=devenv
 export PENPOT_TENANT=dev
-export PENPOT_FLAGS="\
-       $PENPOT_FLAGS \
-       enable-backend-asserts \
-       enable-audit-log \
-       enable-transit-readable-response \
-       enable-demo-users \
-       disable-secure-session-cookies \
-       enable-smtp \
-       enable-prepl-server \
-       enable-urepl-server \
-       enable-rpc-climit \
-       enable-rpc-rlimit \
-       enable-soft-rpc-rlimit \
-       enable-webhooks \
-       enable-access-tokens";
+export PENPOT_FLAGS="$PENPOT_FLAGS enable-backend-asserts enable-audit-log enable-transit-readable-response enable-demo-users disable-secure-session-cookies enable-rpc-rate-limit enable-warn-rpc-rate-limits enable-smtp"

 # export PENPOT_DATABASE_URI="postgresql://172.17.0.1:5432/penpot"
 # export PENPOT_DATABASE_USERNAME="penpot"
@@ -30,6 +16,8 @@ export PENPOT_FLAGS="\
 # export PENPOT_LOGGERS_LOKI_URI="http://172.17.0.1:3100/loki/api/v1/push"
 # export PENPOT_AUDIT_LOG_ARCHIVE_URI="http://localhost:6070/api/audit"

+export PENPOT_DEFAULT_RATE_LIMIT="default,window,10000/h"
+
 # Initialize MINIO config
 mc alias set penpot-s3/ http://minio:9000 minioadmin minioadmin
 mc admin user add penpot-s3 penpot-devenv penpot-devenv
@@ -43,14 +31,13 @@ export PENPOT_STORAGE_ASSETS_S3_ENDPOINT=http://minio:9000
 export PENPOT_STORAGE_ASSETS_S3_BUCKET=penpot

 export OPTIONS="
-       -A:jmx-remote -A:dev \
+       -A:dev:jmx-remote \
       -J-Djava.util.logging.manager=org.apache.logging.log4j.jul.LogManager \
-       -J-Djdk.attach.allowAttachSelf \
       -J-Dlog4j2.configurationFile=log4j2-devenv.xml \
-       -J-Xms50m \
-       -J-Xmx1024m \
-       -J-XX:+UseZGC \
+       -J-XX:+UseG1GC \
       -J-XX:-OmitStackTraceInFastThrow \
+       -J-Xms50m -J-Xmx1024m \
+       -J-Djdk.attach.allowAttachSelf \
       -J-XX:+UnlockDiagnosticVMOptions \
       -J-XX:+DebugNonSafepoints";

--- a/backend/scripts/run.template.sh
+++ b/backend/scripts/run.template.sh
@@ -1,21 +1,19 @@
 #!/usr/bin/env bash
+set +e
+JAVA_CMD=$(type -p java)

+set -e
 if [[ ! -n "$JAVA_CMD" ]]; then
-    if [[ -n "$JAVA_HOME" ]] && [[ -x "$JAVA_HOME/bin/java" ]]; then
-        JAVA_CMD="$JAVA_HOME/bin/java"
-    else
-        set +e
-        JAVA_CMD=$(type -p java)
-        set -e
-        if [[ ! -n "$JAVA_CMD" ]]; then
-            >&2 echo "Couldn't find 'java'. Please set JAVA_HOME."
-            exit 1
-        fi
-    fi
+  if [[ -n "$JAVA_HOME" ]] && [[ -x "$JAVA_HOME/bin/java" ]]; then
+    JAVA_CMD="$JAVA_HOME/bin/java"
+  else
+    >&2 echo "Couldn't find 'java'. Please set JAVA_HOME."
+    exit 1
+  fi
 fi

 if [ -f ./environ ]; then
-    source ./environ
+   source ./environ
 fi

 set -x
--- a/backend/scripts/start-dev
+++ b/backend/scripts/start-dev
@@ -2,7 +2,7 @@

 export PENPOT_HOST=devenv
 export PENPOT_TENANT=dev
-export PENPOT_FLAGS="$PENPOT_FLAGS enable-backend-asserts enable-audit-log enable-transit-readable-response enable-demo-users disable-secure-session-cookies enable-smtp enable-webhooks"
+export PENPOT_FLAGS="$PENPOT_FLAGS enable-backend-asserts enable-audit-log enable-transit-readable-response enable-demo-users disable-secure-session-cookies enable-smtp"

 set -ex

--- a/backend/src/app/auth.clj
+++ b/backend/src/app/auth.clj
@@ -1,26 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC
-
-(ns app.auth
-  (:require
-   [buddy.hashers :as hashers]))
-
-(defn derive-password
-  [password]
-  (hashers/derive password
-                  {:alg :argon2id
-                   :memory 16384
-                   :iterations 20
-                   :parallelism 2}))
-
-(defn verify-password
-  [attempt password]
-  (try
-    (hashers/verify attempt password)
-    (catch Throwable _
-      {:update false
-       :valid false})))
-
--- a/backend/src/app/auth/ldap.clj
+++ b/backend/src/app/auth/ldap.clj
@@ -41,18 +41,15 @@
  (reduce-kv clojure.string/replace s replacements))

 (defn- search-user
-  [{:keys [::conn base-dn] :as cfg} email]
-  (let [query  (replace-several (:query cfg) ":username" email)
-        attrs  [(:attrs-username cfg)
-                (:attrs-email cfg)
-                (:attrs-fullname cfg)]
+  [{:keys [conn attrs base-dn] :as cfg} email]
+  (let [query   (replace-several (:query cfg) ":username" email)
        params  {:filter query
                 :sizelimit 1
                 :attributes attrs}]
    (first (ldap/search conn base-dn params))))

 (defn- retrieve-user
-  [{:keys [::conn] :as cfg} {:keys [email password]}]
+  [{:keys [conn] :as cfg} {:keys [email password]}]
  (when-let [{:keys [dn] :as user} (search-user cfg email)]
    (when (ldap/bind? conn dn password)
      {:fullname (get user (-> cfg :attrs-fullname keyword))
@@ -69,7 +66,7 @@
 (defn authenticate
  [cfg params]
  (with-open [conn (connect cfg)]
-    (when-let [user (-> (assoc cfg ::conn conn)
+    (when-let [user (-> (assoc cfg :conn conn)
                        (retrieve-user params))]
      (when-not (s/valid? ::info-data user)
        (let [explain (s/explain-str ::info-data user)]
@@ -103,6 +100,17 @@
                 :host (:host cfg) :port (:port cfg) :cause cause)
        nil))))

+(defn- prepare-attributes
+  [cfg]
+  (assoc cfg :attrs [(:attrs-username cfg)
+                     (:attrs-email cfg)
+                     (:attrs-fullname cfg)]))
+
+(defmethod ig/init-key ::provider
+  [_ cfg]
+  (when (:enabled? cfg)
+    (some-> cfg try-connectivity prepare-attributes)))
+
 (s/def ::enabled? ::us/boolean)
 (s/def ::host ::cf/ldap-host)
 (s/def ::port ::cf/ldap-port)
@@ -116,7 +124,8 @@
 (s/def ::attrs-fullname ::cf/ldap-attrs-fullname)
 (s/def ::attrs-username ::cf/ldap-attrs-username)

-(s/def ::provider-params
+(defmethod ig/pre-init-spec ::provider
+  [_]
  (s/keys :opt-un [::host ::port
                   ::ssl ::tls
                   ::enabled?
@@ -126,14 +135,3 @@
                   ::attrs-email
                   ::attrs-username
                   ::attrs-fullname]))
-(s/def ::provider
-  (s/nilable ::provider-params))
-
-(defmethod ig/pre-init-spec ::provider
-  [_]
-  (s/spec ::provider))
-
-(defmethod ig/init-key ::provider
-  [_ cfg]
-  (when (:enabled? cfg)
-    (try-connectivity cfg)))
--- a/backend/src/app/auth/oidc.clj
+++ b/backend/src/app/auth/oidc.clj
@@ -7,7 +7,6 @@
 (ns app.auth.oidc
  "OIDC client implementation."
  (:require
-   [app.auth.oidc.providers :as-alias providers]
   [app.common.data :as d]
   [app.common.data.macros :as dm]
   [app.common.exceptions :as ex]
@@ -18,10 +17,8 @@
   [app.db :as db]
   [app.http.client :as http]
   [app.http.middleware :as hmw]
-   [app.http.session :as session]
   [app.loggers.audit :as audit]
-   [app.main :as-alias main]
-   [app.rpc.commands.profile :as profile]
+   [app.rpc.queries.profile :as profile]
   [app.tokens :as tokens]
   [app.util.json :as json]
   [app.util.time :as dt]
@@ -50,11 +47,9 @@
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

 (defn- discover-oidc-config
-  [cfg {:keys [::base-uri] :as opts}]
+  [{:keys [http-client]} {:keys [base-uri] :as opts}]
  (let [discovery-uri (u/join base-uri ".well-known/openid-configuration")
-        response      (ex/try! (http/req! cfg
-                                          {:method :get :uri (str discovery-uri)}
-                                          {:sync? true}))]
+        response      (ex/try (http/req! http-client {:method :get :uri (str discovery-uri)} {:sync? true}))]
    (cond
      (ex/exception? response)
      (do
@@ -64,7 +59,7 @@
        nil)

      (= 200 (:status response))
-      (let [data (json/decode (:body response))]
+      (let [data (json/read (:body response))]
        {:token-uri (get data :token_endpoint)
         :auth-uri  (get data :authorization_endpoint)
         :user-uri  (get data :userinfo_endpoint)})
@@ -78,15 +73,15 @@

 (defn- prepare-oidc-opts
  [cfg]
-  (let [opts {:base-uri      (cf/get :oidc-base-uri)
-              :client-id     (cf/get :oidc-client-id)
-              :client-secret (cf/get :oidc-client-secret)
-              :token-uri     (cf/get :oidc-token-uri)
-              :auth-uri      (cf/get :oidc-auth-uri)
-              :user-uri      (cf/get :oidc-user-uri)
-              :scopes        (cf/get :oidc-scopes #{"openid" "profile" "email"})
-              :roles-attr    (cf/get :oidc-roles-attr)
-              :roles         (cf/get :oidc-roles)
+  (let [opts {:base-uri      (:base-uri cfg)
+              :client-id     (:client-id cfg)
+              :client-secret (:client-secret cfg)
+              :token-uri     (:token-uri cfg)
+              :auth-uri      (:auth-uri cfg)
+              :user-uri      (:user-uri cfg)
+              :scopes        (:scopes cfg #{"openid" "profile" "email"})
+              :roles-attr    (:roles-attr cfg)
+              :roles         (:roles cfg)
              :name          "oidc"}

        opts (d/without-nils opts)]
@@ -101,12 +96,13 @@
        (some-> (discover-oidc-config cfg opts)
                (merge opts {:discover? true}))))))

-(defmethod ig/pre-init-spec ::providers/generic [_]
-  (s/keys :req [::http/client]))
-
-(defmethod ig/init-key ::providers/generic
+(defmethod ig/prep-key ::generic-provider
  [_ cfg]
-  (when (contains? cf/flags :login-with-oidc)
+  (d/without-nils cfg))
+
+(defmethod ig/init-key ::generic-provider
+  [_ cfg]
+  (when (:enabled? cfg)
    (if-let [opts (prepare-oidc-opts cfg)]
      (do
        (l/info :hint "provider initialized"
@@ -114,10 +110,10 @@
                :method (if (:discover? opts) "discover" "manual")
                :client-id (:client-id opts)
                :client-secret (obfuscate-string (:client-secret opts))
-                :scopes     (str/join "," (:scopes opts))
-                :auth-uri   (:auth-uri opts)
-                :user-uri   (:user-uri opts)
-                :token-uri  (:token-uri opts)
+                :scopes (str/join "," (:scopes opts))
+                :auth-uri (:auth-uri opts)
+                :user-uri (:user-uri opts)
+                :token-uri (:token-uri opts)
                :roles-attr (:roles-attr opts)
                :roles      (:roles opts))
        opts)
@@ -129,17 +125,21 @@
 ;; GOOGLE AUTH PROVIDER
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

-(defmethod ig/init-key ::providers/google
-  [_ _]
-  (let [opts {:client-id     (cf/get :google-client-id)
-              :client-secret (cf/get :google-client-secret)
+(defmethod ig/prep-key ::google-provider
+  [_ cfg]
+  (d/without-nils cfg))
+
+(defmethod ig/init-key ::google-provider
+  [_ cfg]
+  (let [opts {:client-id     (:client-id cfg)
+              :client-secret (:client-secret cfg)
              :scopes        #{"openid" "email" "profile"}
              :auth-uri      "https://accounts.google.com/o/oauth2/v2/auth"
              :token-uri     "https://oauth2.googleapis.com/token"
              :user-uri      "https://openidconnect.googleapis.com/v1/userinfo"
              :name          "google"}]

-    (when (contains? cf/flags :login-with-google)
+    (when (:enabled? cfg)
      (if (and (string? (:client-id opts))
               (string? (:client-secret opts)))
        (do
@@ -158,29 +158,29 @@
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

 (defn- retrieve-github-email
-  [cfg tdata info]
+  [{:keys [http-client]} tdata info]
  (or (some-> info :email p/resolved)
-      (->> (http/req! cfg
-                      {:uri "https://api.github.com/user/emails"
-                       :headers {"Authorization" (dm/str (:type tdata) " " (:token tdata))}
-                       :timeout 6000
-                       :method :get})
-           (p/map (fn [{:keys [status body] :as response}]
+      (-> (http/req! http-client {:uri "https://api.github.com/user/emails"
+                                  :headers {"Authorization" (dm/str (:type tdata) " " (:token tdata))}
+                                  :timeout 6000
+                                  :method :get})
+          (p/then (fn [{:keys [status body] :as response}]
                    (when-not (s/int-in-range? 200 300 status)
                      (ex/raise :type :internal
                                :code :unable-to-retrieve-github-emails
                                :hint "unable to retrieve github emails"
                                :http-status status
                                :http-body body))
-                    (->> response :body json/decode (filter :primary) first :email))))))
+                    (->> response :body json/read (filter :primary) first :email))))))

-(defmethod ig/pre-init-spec ::providers/github [_]
-  (s/keys :req [::http/client]))
-
-(defmethod ig/init-key ::providers/github
+(defmethod ig/prep-key ::github-provider
  [_ cfg]
-  (let [opts {:client-id     (cf/get :github-client-id)
-              :client-secret (cf/get :github-client-secret)
+  (d/without-nils cfg))
+
+(defmethod ig/init-key ::github-provider
+  [_ cfg]
+  (let [opts {:client-id     (:client-id cfg)
+              :client-secret (:client-secret cfg)
              :scopes        #{"read:user" "user:email"}
              :auth-uri      "https://github.com/login/oauth/authorize"
              :token-uri     "https://github.com/login/oauth/access_token"
@@ -191,7 +191,7 @@
              ;; retrieve emails.
              :get-email-fn           (partial retrieve-github-email cfg)}]

-    (when (contains? cf/flags :login-with-github)
+    (when (:enabled? cfg)
      (if (and (string? (:client-id opts))
               (string? (:client-secret opts)))
        (do
@@ -209,18 +209,22 @@
 ;; GITLAB AUTH PROVIDER
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

-(defmethod ig/init-key ::providers/gitlab
-  [_ _]
-  (let [base (cf/get :gitlab-base-uri "https://gitlab.com")
+(defmethod ig/prep-key ::gitlab-provider
+  [_ cfg]
+  (d/without-nils cfg))
+
+(defmethod ig/init-key ::gitlab-provider
+  [_ cfg]
+  (let [base (:base-uri cfg "https://gitlab.com")
        opts {:base-uri      base
-              :client-id     (cf/get :gitlab-client-id)
-              :client-secret (cf/get :gitlab-client-secret)
+              :client-id     (:client-id cfg)
+              :client-secret (:client-secret cfg)
              :scopes        #{"openid" "profile" "email"}
              :auth-uri      (str base "/oauth/authorize")
              :token-uri     (str base "/oauth/token")
              :user-uri      (str base "/oauth/userinfo")
              :name          "gitlab"}]
-    (when (contains? cf/flags :login-with-gitlab)
+    (when (:enabled? cfg)
      (if (and (string? (:client-id opts))
               (string? (:client-secret opts)))
        (do
@@ -241,7 +245,7 @@

 (defn- build-redirect-uri
  [{:keys [provider] :as cfg}]
-  (let [public (u/uri (cf/get :public-uri))]
+  (let [public (u/uri (:public-uri cfg))]
    (str (assoc public :path (str "/api/auth/oauth/" (:name provider) "/callback")))))

 (defn- build-auth-uri
@@ -264,7 +268,7 @@
             props))

 (defn retrieve-access-token
-  [{:keys [provider] :as cfg} code]
+  [{:keys [provider http-client] :as cfg} code]
  (let [params {:client_id (:client-id provider)
                :client_secret (:client-secret provider)
                :code code
@@ -275,25 +279,25 @@
                          "accept" "application/json"}
                :uri (:token-uri provider)
                :body (u/map->query-string params)}]
-    (->> (http/req! cfg req)
-         (p/map (fn [{:keys [status body] :as res}]
-                  (if (= status 200)
-                    (let [data (json/decode body)]
-                      {:token (get data :access_token)
-                       :type (get data :token_type)})
-                    (ex/raise :type :internal
-                              :code :unable-to-retrieve-token
-                              :http-status status
-                              :http-body body)))))))
+    (p/then
+     (http/req! http-client req)
+     (fn [{:keys [status body] :as res}]
+       (if (= status 200)
+         (let [data (json/read body)]
+           {:token (get data :access_token)
+            :type (get data :token_type)})
+         (ex/raise :type :internal
+                   :code :unable-to-retrieve-token
+                   :http-status status
+                   :http-body body))))))

 (defn- retrieve-user-info
-  [{:keys [provider] :as cfg} tdata]
+  [{:keys [provider http-client] :as cfg} tdata]
  (letfn [(retrieve []
-            (http/req! cfg
-                       {:uri (:user-uri provider)
-                        :headers {"Authorization" (str (:type tdata) " " (:token tdata))}
-                        :timeout 6000
-                        :method :get}))
+            (http/req! http-client {:uri (:user-uri provider)
+                                    :headers {"Authorization" (str (:type tdata) " " (:token tdata))}
+                                    :timeout 6000
+                                    :method :get}))
          (validate-response [response]
            (when-not (s/int-in-range? 200 300 (:status response))
              (ex/raise :type :internal
@@ -316,7 +320,7 @@
              (get info attr-kw)))

          (process-response [response]
-            (p/let [info  (-> response :body json/decode)
+            (p/let [info  (-> response :body json/read)
                    email (get-email info)]
              {:backend  (:name provider)
               :email    email
@@ -349,8 +353,8 @@
                   ::fullname
                   ::props]))

-(defn get-info
-  [{:keys [provider] :as cfg} {:keys [params] :as request}]
+(defn retrieve-info
+  [{:keys [sprops provider] :as cfg} {:keys [params] :as request}]
  (letfn [(validate-oidc [info]
            ;; If the provider is OIDC, we can proceed to check
            ;; roles if they are defined.
@@ -389,42 +393,44 @@

    (let [state  (get params :state)
          code   (get params :code)
-          state  (tokens/verify (::main/props cfg) {:token state :iss :oauth})]
+          state  (tokens/verify sprops {:token state :iss :oauth})]
      (-> (p/resolved code)
          (p/then #(retrieve-access-token cfg %))
          (p/then #(retrieve-user-info cfg %))
          (p/then' validate-oidc)
          (p/then' (partial post-process state))))))

-(defn- get-profile
-  [{:keys [::db/pool ::wrk/executor] :as cfg} info]
+(defn- retrieve-profile
+  [{:keys [pool executor] :as cfg} info]
  (px/with-dispatch executor
    (with-open [conn (db/open pool)]
      (some->> (:email info)
-               (profile/get-profile-by-email conn)))))
+               (profile/retrieve-profile-data-by-email conn)
+               (profile/populate-additional-data conn)
+               (profile/decode-profile-row)))))

 (defn- redirect-response
  [uri]
  (yrs/response :status 302 :headers {"location" (str uri)}))

 (defn- generate-error-redirect
-  [_ error]
-  (let [uri (-> (u/uri (cf/get :public-uri))
+  [cfg error]
+  (let [uri (-> (u/uri (:public-uri cfg))
                (assoc :path "/#/auth/login")
                (assoc :query (u/map->query-string {:error "unable-to-auth" :hint (ex-message error)})))]
    (redirect-response uri)))

 (defn- generate-redirect
-  [cfg request info profile]
+  [{:keys [sprops session audit] :as cfg} request info profile]
  (if profile
-    (let [sxf    (session/create-fn cfg (:id profile))
+    (let [sxf    ((:create session) (:id profile))
          token  (or (:invitation-token info)
-                     (tokens/generate (::main/props cfg)
-                                      {:iss :auth
-                                       :exp (dt/in-future "15m")
-                                       :profile-id (:id profile)}))
+                     (tokens/generate sprops {:iss :auth
+                                              :exp (dt/in-future "15m")
+                                              :profile-id (:id profile)}))
          params {:token token}
-          uri    (-> (u/uri (cf/get :public-uri))
+
+          uri    (-> (u/uri (:public-uri cfg))
                     (assoc :path "/#/auth/verify-token")
                     (assoc :query (u/map->query-string params)))]

@@ -432,12 +438,13 @@
        (ex/raise :type :restriction
                  :code :profile-blocked))

-      (when-let [collector (::audit/collector cfg)]
-        (audit/submit! collector {:type "command"
-                                  :name "login-with-password"
-                                  :profile-id (:id profile)
-                                  :ip-addr (audit/parse-client-ip request)
-                                  :props (audit/profile->props profile)}))
+      (when (fn? audit)
+        (audit :cmd :submit
+               :type "command"
+               :name "login"
+               :profile-id (:id profile)
+               :ip-addr (audit/parse-client-ip request)
+               :props (audit/profile->props profile)))

      (->> (redirect-response uri)
           (sxf request)))
@@ -446,19 +453,19 @@
                        :iss :prepared-register
                        :is-active true
                        :exp (dt/in-future {:hours 48}))
-          token  (tokens/generate (::main/props cfg) info)
+          token  (tokens/generate sprops info)
          params (d/without-nils
                  {:token token
                   :fullname (:fullname info)})
-          uri    (-> (u/uri (cf/get :public-uri))
+          uri    (-> (u/uri (:public-uri cfg))
                     (assoc :path "/#/auth/register/validate")
                     (assoc :query (u/map->query-string params)))]
      (redirect-response uri))))

 (defn- auth-handler
-  [cfg {:keys [params] :as request}]
+  [{:keys [sprops] :as cfg} {:keys [params] :as request}]
  (let [props (audit/extract-utm-params params)
-        state (tokens/generate (::main/props cfg)
+        state (tokens/generate sprops
                               {:iss :oauth
                                :invitation-token (:invitation-token params)
                                :props props
@@ -469,8 +476,8 @@
 (defn- callback-handler
  [cfg request]
  (letfn [(process-request []
-            (p/let [info    (get-info cfg request)
-                    profile (get-profile cfg info)]
+            (p/let [info    (retrieve-info cfg request)
+                    profile (retrieve-profile cfg info)]
              (generate-redirect cfg request info profile)))

          (handle-error [cause]
@@ -484,7 +491,7 @@
  {:compile
   (fn [& _]
     (fn [handler]
-       (fn [{:keys [::providers] :as cfg} request]
+       (fn [{:keys [providers] :as cfg} request]
         (let [provider (some-> request :path-params :provider keyword)]
           (if-let [provider (get providers provider)]
             (handler (assoc cfg :provider provider) request)
@@ -493,54 +500,41 @@
                       :provider provider
                       :hint "provider not configured"))))))})

-
-(s/def ::client-id ::cf/oidc-client-id)
-(s/def ::client-secret ::cf/oidc-client-secret)
-(s/def ::base-uri ::cf/oidc-base-uri)
-(s/def ::token-uri ::cf/oidc-token-uri)
-(s/def ::auth-uri ::cf/oidc-auth-uri)
-(s/def ::user-uri ::cf/oidc-user-uri)
-(s/def ::scopes ::cf/oidc-scopes)
-(s/def ::roles ::cf/oidc-roles)
-(s/def ::roles-attr ::cf/oidc-roles-attr)
-(s/def ::email-attr ::cf/oidc-email-attr)
-(s/def ::name-attr ::cf/oidc-name-attr)
-
-;; FIXME: migrate to qualified-keywords
-(s/def ::provider
-  (s/keys :req-un [::client-id
-                   ::client-secret]
-          :opt-un [::base-uri
-                   ::token-uri
-                   ::auth-uri
-                   ::user-uri
-                   ::scopes
-                   ::roles
-                   ::roles-attr
-                   ::email-attr
-                   ::name-attr]))
-
-(s/def ::providers (s/map-of ::us/keyword (s/nilable ::provider)))
-
-(s/def ::routes vector?)
+(s/def ::public-uri ::us/not-empty-string)
+(s/def ::http-client ::http/client)
+(s/def ::session map?)
+(s/def ::sprops map?)
+(s/def ::providers map?)

 (defmethod ig/pre-init-spec ::routes
  [_]
-  (s/keys :req [::session/manager
-                ::http/client
-                ::wrk/executor
-                ::main/props
-                ::db/pool
-                ::providers]))
+  (s/keys :req-un [::public-uri
+                   ::session
+                   ::sprops
+                   ::http-client
+                   ::providers
+                   ::db/pool
+                   ::wrk/executor]))

 (defmethod ig/init-key ::routes
-  [_ {:keys [::wrk/executor] :as cfg}]
+  [_ {:keys [executor session] :as cfg}]
  (let [cfg (update cfg :provider d/without-nils)]
-    ["" {:middleware [[session/authz cfg]
+    ["" {:middleware [[(:middleware session)]
                      [hmw/with-dispatch executor]
                      [hmw/with-config cfg]
-                      [provider-lookup]]}
+                      [provider-lookup]
+                      ]}
+     ;; We maintain the both URI prefixes for backward compatibility.
+
     ["/auth/oauth"
+      ["/:provider"
+       {:handler auth-handler
+        :allowed-methods #{:post}}]
+      ["/:provider/callback"
+       {:handler callback-handler
+        :allowed-methods #{:get}}]]
+
+     ["/auth/oidc"
      ["/:provider"
       {:handler auth-handler
        :allowed-methods #{:post}}]
--- a/backend/src/app/cli/manage.clj
+++ b/backend/src/app/cli/manage.clj
@@ -10,8 +10,9 @@
   [app.common.logging :as l]
   [app.db :as db]
   [app.main :as main]
-   [app.rpc.commands.auth :as auth]
-   [app.rpc.commands.profile :as profile]
+   [app.rpc.commands.auth :as cmd.auth]
+   [app.rpc.mutations.profile :as profile]
+   [app.rpc.queries.profile :refer [retrieve-profile-data-by-email]]
   [clojure.string :as str]
   [clojure.tools.cli :refer [parse-opts]]
   [integrant.core :as ig])
@@ -54,17 +55,16 @@
                                         :type :password}))]
    (try
      (db/with-atomic [conn (:app.db/pool system)]
-        (->> (auth/create-profile! conn
-                                  {:fullname fullname
-                                   :email email
-                                   :password password
-                                   :is-active true
-                                   :is-demo false})
-             (auth/create-profile-rels! conn)))
+        (->> (cmd.auth/create-profile conn
+                                     {:fullname fullname
+                                      :email email
+                                      :password password
+                                      :is-active true
+                                      :is-demo false})
+             (cmd.auth/create-profile-relations conn)))

      (when (pos? (:verbosity options))
        (println "User created successfully."))
-
      (System/exit 0)

      (catch Exception _e
@@ -79,7 +79,7 @@
      (db/with-atomic [conn (:app.db/pool system)]
        (let [email    (or (:email options)
                           (read-from-console {:label "Email:"}))
-              profile  (profile/get-profile-by-email conn email)]
+              profile  (retrieve-profile-data-by-email conn email)]
          (when-not profile
            (when (pos? (:verbosity options))
              (println "Profile does not exists."))
--- a/backend/src/app/config.clj
+++ b/backend/src/app/config.clj
@@ -27,10 +27,6 @@
               clojure.lang.IRecord
               clojure.lang.IDeref)

-(prefer-method print-method
-               clojure.lang.IPersistentMap
-               clojure.lang.IDeref)
-
 (prefer-method pprint/simple-dispatch
               clojure.lang.IPersistentMap
               clojure.lang.IDeref)
@@ -50,20 +46,20 @@
   :database-username "penpot"
   :database-password "penpot"

-   :default-blob-version 5
+   :default-blob-version 4
   :loggers-zmq-uri "tcp://localhost:45556"
-
   :rpc-rlimit-config (fs/path "resources/rlimit.edn")
-   :rpc-climit-config (fs/path "resources/climit.edn")

   :file-change-snapshot-every 5
   :file-change-snapshot-timeout "3h"

   :public-uri "http://localhost:3449"
   :host "localhost"
-   :tenant "default"
+   :tenant "main"

   :redis-uri "redis://redis/0"
+   :srepl-host "127.0.0.1"
+   :srepl-port 6062

   :assets-storage-backend :assets-fs
   :storage-assets-fs-directory "assets"
@@ -90,7 +86,6 @@

 (s/def ::default-rpc-rlimit ::us/vector-of-strings)
 (s/def ::rpc-rlimit-config ::fs/path)
-(s/def ::rpc-climit-config ::fs/path)

 (s/def ::media-max-file-size ::us/integer)

@@ -98,17 +93,13 @@
 (s/def ::telemetry-enabled ::us/boolean)

 (s/def ::audit-log-archive-uri ::us/string)
-(s/def ::audit-log-http-handler-concurrency ::us/integer)

-(s/def ::admins ::us/set-of-valid-emails)
+(s/def ::admins ::us/set-of-strings)
 (s/def ::file-change-snapshot-every ::us/integer)
 (s/def ::file-change-snapshot-timeout ::dt/duration)

 (s/def ::default-executor-parallelism ::us/integer)
-(s/def ::scheduled-executor-parallelism ::us/integer)
-
-(s/def ::worker-default-parallelism ::us/integer)
-(s/def ::worker-webhook-parallelism ::us/integer)
+(s/def ::worker-executor-parallelism ::us/integer)

 (s/def ::authenticated-cookie-domain ::us/string)
 (s/def ::authenticated-cookie-name ::us/string)
@@ -125,17 +116,6 @@
 (s/def ::database-min-pool-size ::us/integer)
 (s/def ::database-max-pool-size ::us/integer)

-(s/def ::quotes-teams-per-profile ::us/integer)
-(s/def ::quotes-access-tokens-per-profile ::us/integer)
-(s/def ::quotes-projects-per-team ::us/integer)
-(s/def ::quotes-invitations-per-team ::us/integer)
-(s/def ::quotes-profiles-per-team ::us/integer)
-(s/def ::quotes-files-per-project ::us/integer)
-(s/def ::quotes-files-per-team ::us/integer)
-(s/def ::quotes-font-variants-per-team ::us/integer)
-(s/def ::quotes-comment-threads-per-file ::us/integer)
-(s/def ::quotes-comments-per-file ::us/integer)
-
 (s/def ::default-blob-version ::us/integer)
 (s/def ::error-report-webhook ::us/string)
 (s/def ::user-feedback-destination ::us/string)
@@ -164,6 +144,7 @@
 (s/def ::http-server-max-multipart-body-size ::us/integer)
 (s/def ::http-server-io-threads ::us/integer)
 (s/def ::http-server-worker-threads ::us/integer)
+(s/def ::initial-project-skey ::us/string)
 (s/def ::ldap-attrs-email ::us/string)
 (s/def ::ldap-attrs-fullname ::us/string)
 (s/def ::ldap-attrs-username ::us/string)
@@ -187,6 +168,11 @@
 (s/def ::redis-uri ::us/string)
 (s/def ::registration-domain-whitelist ::us/set-of-strings)

+(s/def ::semaphore-process-font ::us/integer)
+(s/def ::semaphore-process-image ::us/integer)
+(s/def ::semaphore-update-file ::us/integer)
+(s/def ::semaphore-auth ::us/integer)
+
 (s/def ::smtp-default-from ::us/string)
 (s/def ::smtp-default-reply-to ::us/string)
 (s/def ::smtp-host ::us/string)
@@ -195,15 +181,18 @@
 (s/def ::smtp-ssl ::us/boolean)
 (s/def ::smtp-tls ::us/boolean)
 (s/def ::smtp-username (s/nilable ::us/string))
-(s/def ::urepl-host ::us/string)
-(s/def ::urepl-port ::us/integer)
-(s/def ::prepl-host ::us/string)
-(s/def ::prepl-port ::us/integer)
+(s/def ::srepl-host ::us/string)
+(s/def ::srepl-port ::us/integer)
 (s/def ::assets-storage-backend ::us/keyword)
+(s/def ::fdata-storage-backend ::us/keyword)
 (s/def ::storage-assets-fs-directory ::us/string)
 (s/def ::storage-assets-s3-bucket ::us/string)
 (s/def ::storage-assets-s3-region ::us/keyword)
 (s/def ::storage-assets-s3-endpoint ::us/string)
+(s/def ::storage-fdata-s3-bucket ::us/string)
+(s/def ::storage-fdata-s3-region ::us/keyword)
+(s/def ::storage-fdata-s3-prefix ::us/string)
+(s/def ::storage-fdata-s3-endpoint ::us/string)
 (s/def ::telemetry-uri ::us/string)
 (s/def ::telemetry-with-taiga ::us/boolean)
 (s/def ::tenant ::us/string)
@@ -214,7 +203,6 @@
                   ::admins
                   ::allow-demo-users
                   ::audit-log-archive-uri
-                   ::audit-log-http-handler-concurrency
                   ::auth-token-cookie-name
                   ::auth-token-cookie-max-age
                   ::authenticated-cookie-name
@@ -229,9 +217,7 @@
                   ::default-rpc-rlimit
                   ::error-report-webhook
                   ::default-executor-parallelism
-                   ::scheduled-executor-parallelism
-                   ::worker-default-parallelism
-                   ::worker-webhook-parallelism
+                   ::worker-executor-parallelism
                   ::file-change-snapshot-every
                   ::file-change-snapshot-timeout
                   ::user-feedback-destination
@@ -260,6 +246,7 @@
                   ::http-server-max-multipart-body-size
                   ::http-server-io-threads
                   ::http-server-worker-threads
+                   ::initial-project-skey
                   ::ldap-attrs-email
                   ::ldap-attrs-fullname
                   ::ldap-attrs-username
@@ -280,18 +267,6 @@
                   ::profile-complaint-max-age
                   ::profile-complaint-threshold
                   ::public-uri
-
-                   ::quotes-teams-per-profile
-                   ::quotes-access-tokens-per-profile
-                   ::quotes-projects-per-team
-                   ::quotes-invitations-per-team
-                   ::quotes-profiles-per-team
-                   ::quotes-files-per-project
-                   ::quotes-files-per-team
-                   ::quotes-font-variants-per-team
-                   ::quotes-comment-threads-per-file
-                   ::quotes-comments-per-file
-
                   ::redis-uri
                   ::registration-domain-whitelist
                   ::rpc-rlimit-config
@@ -310,16 +285,19 @@
                   ::smtp-tls
                   ::smtp-username

-                   ::urepl-host
-                   ::urepl-port
-                   ::prepl-host
-                   ::prepl-port
+                   ::srepl-host
+                   ::srepl-port

                   ::assets-storage-backend
                   ::storage-assets-fs-directory
                   ::storage-assets-s3-bucket
                   ::storage-assets-s3-region
                   ::storage-assets-s3-endpoint
+                   ::fdata-storage-backend
+                   ::storage-fdata-s3-bucket
+                   ::storage-fdata-s3-region
+                   ::storage-fdata-s3-prefix
+                   ::storage-fdata-s3-endpoint
                   ::telemetry-enabled
                   ::telemetry-uri
                   ::telemetry-referer
@@ -360,8 +338,7 @@
      (when (ex/ex-info? e)
        (println ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;")
        (println "Error on validating configuration:")
-        (println (some-> e ex-data ex/explain))
-        (println (ex/explain (ex-data e)))
+        (println (us/pretty-explain (ex-data e)))
        (println ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"))
      (throw e))))

--- a/backend/src/app/db.clj
+++ b/backend/src/app/db.clj
@@ -167,7 +167,6 @@
  (instance? javax.sql.DataSource v))

 (s/def ::pool pool?)
-(s/def ::conn-or-pool some?)

 (defn closed?
  [pool]
@@ -233,46 +232,44 @@
  [pool]
  (jdbc/get-connection pool))

-(def ^:private default-opts
-  {:builder-fn sql/as-kebab-maps})
-
 (defn exec!
  ([ds sv]
-   (jdbc/execute! ds sv default-opts))
+   (exec! ds sv {}))
  ([ds sv opts]
-   (jdbc/execute! ds sv (merge default-opts opts))))
+   (jdbc/execute! ds sv (assoc opts :builder-fn sql/as-kebab-maps))))

 (defn exec-one!
-  ([ds sv]
-   (jdbc/execute-one! ds sv default-opts))
+  ([ds sv] (exec-one! ds sv {}))
  ([ds sv opts]
-   (jdbc/execute-one! ds sv
-                      (-> (merge default-opts opts)
-                          (assoc :return-keys (::return-keys? opts false))))))
+   (jdbc/execute-one! ds sv (assoc opts :builder-fn sql/as-kebab-maps))))

 (defn insert!
-  [ds table params & {:as opts}]
-  (exec-one! ds
-             (sql/insert table params opts)
-             (merge {::return-keys? true} opts)))
+  ([ds table params] (insert! ds table params nil))
+  ([ds table params opts]
+   (exec-one! ds
+              (sql/insert table params opts)
+              (merge {:return-keys true} opts))))

 (defn insert-multi!
-  [ds table cols rows & {:as opts}]
-  (exec! ds
-         (sql/insert-multi table cols rows opts)
-         (merge {::return-keys? true} opts)))
+  ([ds table cols rows] (insert-multi! ds table cols rows nil))
+  ([ds table cols rows opts]
+   (exec! ds
+          (sql/insert-multi table cols rows opts)
+          (merge {:return-keys true} opts))))

 (defn update!
-  [ds table params where & {:as opts}]
-  (exec-one! ds
-             (sql/update table params where opts)
-             (merge {::return-keys? true} opts)))
+  ([ds table params where] (update! ds table params where nil))
+  ([ds table params where opts]
+   (exec-one! ds
+              (sql/update table params where opts)
+              (merge {:return-keys true} opts))))

 (defn delete!
-  [ds table params & {:as opts}]
-  (exec-one! ds
-             (sql/delete table params opts)
-             (merge {::return-keys? true} opts)))
+  ([ds table params] (delete! ds table params nil))
+  ([ds table params opts]
+   (exec-one! ds
+              (sql/delete table params opts)
+              (assoc opts :return-keys true))))

 (defn is-row-deleted?
  [{:keys [deleted-at]}]
@@ -281,34 +278,54 @@
          (inst-ms (dt/now)))))

 (defn get*
-  "Retrieve a single row from database that matches a simple filters. Do
-  not raises exceptions."
-  [ds table params & {:as opts}]
-  (let [rows (exec! ds (sql/select table params opts))
-        rows (cond->> rows
-               (::remove-deleted? opts true)
-               (remove is-row-deleted?))]
-    (first rows)))
+  "Internal function for retrieve a single row from database that
+  matches a simple filters."
+  ([ds table params]
+   (get* ds table params nil))
+  ([ds table params {:keys [check-deleted?] :or {check-deleted? true} :as opts}]
+   (let [rows (exec! ds (sql/select table params opts))
+         rows (cond->> rows
+                check-deleted?
+                (remove is-row-deleted?))]
+     (first rows))))

 (defn get
-  "Retrieve a single row from database that matches a simple
-  filters. Raises :not-found exception if no object is found."
-  [ds table params & {:as opts}]
-  (let [row (get* ds table params opts)]
-    (when (and (not row) (::check-deleted? opts true))
-      (ex/raise :type :not-found
-                :code :object-not-found
-                :table table
-                :hint "database object not found"))
-    row))
+  ([ds table params]
+   (get ds table params nil))
+  ([ds table params {:keys [check-deleted?] :or {check-deleted? true} :as opts}]
+   (let [row (get* ds table params opts)]
+     (when (and (not row) check-deleted?)
+       (ex/raise :type :not-found
+                 :table table
+                 :hint "database object not found"))
+     row)))
+
+(defn get-by-params
+  "DEPRECATED"
+  ([ds table params]
+   (get-by-params ds table params nil))
+  ([ds table params {:keys [check-not-found] :or {check-not-found true} :as opts}]
+   (let [row (get* ds table params (assoc opts :check-deleted? check-not-found))]
+     (when (and (not row) check-not-found)
+       (ex/raise :type :not-found
+                 :table table
+                 :hint "database object not found"))
+     row)))

 (defn get-by-id
-  [ds table id & {:as opts}]
-  (get ds table {:id id} opts))
+  ([ds table id]
+   (get ds table {:id id} nil))
+  ([ds table id opts]
+   (let [opts (cond-> opts
+                (contains? opts :check-not-found)
+                (assoc :check-deleted? (:check-not-found opts)))]
+     (get ds table {:id id} opts))))

 (defn query
-  [ds table params & {:as opts}]
-  (exec! ds (sql/select table params opts)))
+  ([ds table params]
+   (query ds table params nil))
+  ([ds table params opts]
+   (exec! ds (sql/select table params opts))))

 (defn pgobject?
  ([v]
@@ -335,13 +352,10 @@
  [v]
  (and (pgarray? v) (= "uuid" (.getBaseTypeName ^PgArray v))))

-;; TODO rename to decode-pgarray-into
 (defn decode-pgarray
-  ([v] (decode-pgarray v []))
-  ([v in]
-   (into in (some-> ^PgArray v .getArray)))
-  ([v in xf]
-   (into in xf (some-> ^PgArray v .getArray))))
+  ([v] (some->> ^PgArray v .getArray vec))
+  ([v in] (some->> ^PgArray v .getArray (into in)))
+  ([v in xf]  (some->> ^PgArray v .getArray (into in xf))))

 (defn pgarray->set
  [v]
@@ -403,53 +417,47 @@

 (defn decode-json-pgobject
  [^PGobject o]
-  (when o
-    (let [typ (.getType o)
-          val (.getValue o)]
-      (if (or (= typ "json")
-              (= typ "jsonb"))
-        (json/decode val)
-        val))))
+  (let [typ (.getType o)
+        val (.getValue o)]
+    (if (or (= typ "json")
+            (= typ "jsonb"))
+      (json/read val)
+      val)))

 (defn decode-transit-pgobject
  [^PGobject o]
-  (when o
-    (let [typ (.getType o)
-          val (.getValue o)]
-      (if (or (= typ "json")
-              (= typ "jsonb"))
-        (t/decode-str val)
-        val))))
+  (let [typ (.getType o)
+        val (.getValue o)]
+    (if (or (= typ "json")
+            (= typ "jsonb"))
+      (t/decode-str val)
+      val)))

 (defn inet
  [ip-addr]
-  (when ip-addr
-    (doto (org.postgresql.util.PGobject.)
-      (.setType "inet")
-      (.setValue (str ip-addr)))))
+  (doto (org.postgresql.util.PGobject.)
+    (.setType "inet")
+    (.setValue (str ip-addr))))

 (defn decode-inet
  [^PGobject o]
-  (when o
-    (if (= "inet" (.getType o))
-      (.getValue o)
-      nil)))
+  (if (= "inet" (.getType o))
+    (.getValue o)
+    nil))

 (defn tjson
  "Encode as transit json."
  [data]
-  (when data
-    (doto (org.postgresql.util.PGobject.)
-      (.setType "jsonb")
-      (.setValue (t/encode-str data {:type :json-verbose})))))
+  (doto (org.postgresql.util.PGobject.)
+    (.setType "jsonb")
+    (.setValue (t/encode-str data {:type :json-verbose}))))

 (defn json
  "Encode as plain json."
  [data]
-  (when data
-    (doto (org.postgresql.util.PGobject.)
-      (.setType "jsonb")
-      (.setValue (json/encode-str data)))))
+  (doto (org.postgresql.util.PGobject.)
+    (.setType "jsonb")
+    (.setValue (json/write-str data))))

 ;; --- Locks

@@ -480,18 +488,3 @@
  (let [n   (xact-check-param n)
        row (exec-one! conn ["select pg_try_advisory_xact_lock(?::bigint) as lock" n])]
    (:lock row)))
-
-(defn sql-exception?
-  [cause]
-  (instance? java.sql.SQLException cause))
-
-(defn connection-error?
-  [cause]
-  (and (sql-exception? cause)
-       (contains? #{"08003" "08006" "08001" "08004"}
-                  (.getSQLState ^java.sql.SQLException cause))))
-
-(defn serialization-error?
-  [cause]
-  (and (sql-exception? cause)
-       (= "40001" (.getSQLState ^java.sql.SQLException cause))))
--- a/backend/src/app/db/sql.clj
+++ b/backend/src/app/db/sql.clj
@@ -7,7 +7,6 @@
 (ns app.db.sql
  (:refer-clojure :exclude [update])
  (:require
-   [app.db :as-alias db]
   [clojure.string :as str]
   [next.jdbc.optional :as jdbc-opt]
   [next.jdbc.sql.builder :as sql]))
@@ -44,10 +43,8 @@
  ([table where-params opts]
   (let [opts (merge default-opts opts)
         opts (cond-> opts
-                (::db/for-update? opts) (assoc :suffix "FOR UPDATE")
-                (::db/for-share? opts)  (assoc :suffix "FOR KEY SHARE")
-                (:for-update opts)      (assoc :suffix "FOR UPDATE")
-                (:for-key-share opts)   (assoc :suffix "FOR KEY SHARE"))]
+                (:for-update opts)    (assoc :suffix "FOR UPDATE")
+                (:for-key-share opts) (assoc :suffix "FOR KEY SHARE"))]
     (sql/for-query table where-params opts))))

 (defn update
--- a/backend/src/app/emails.clj
+++ b/backend/src/app/emails.clj
@@ -257,17 +257,15 @@
  "Schedule an already defined email to be sent using asynchronously
  using worker task."
  [{:keys [::conn ::factory] :as context}]
+  (us/verify fn? factory)
  (us/verify some? conn)
-  (let [email (if factory
-                (factory context)
-                (dissoc context ::conn))]
-    (wrk/submit! (merge
-                  {::wrk/task :sendmail
-                   ::wrk/delay 0
-                   ::wrk/max-retries 4
-                   ::wrk/priority 200
-                   ::wrk/conn conn}
-                  email))))
+  (let [email (factory context)]
+    (wrk/submit! (assoc email
+                        ::wrk/task :sendmail
+                        ::wrk/delay 0
+                        ::wrk/max-retries 4
+                        ::wrk/priority 200
+                        ::wrk/conn conn))))

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; SENDMAIL FN / TASK HANDLER
--- a/backend/src/app/http.clj
+++ b/backend/src/app/http.clj
@@ -6,22 +6,12 @@

 (ns app.http
  (:require
-   [app.auth.oidc :as-alias oidc]
   [app.common.data :as d]
   [app.common.logging :as l]
   [app.common.transit :as t]
-   [app.db :as-alias db]
-   [app.http.access-token :as actoken]
-   [app.http.assets :as-alias assets]
-   [app.http.awsns :as-alias awsns]
-   [app.http.debug :as-alias debug]
   [app.http.errors :as errors]
   [app.http.middleware :as mw]
-   [app.http.session :as session]
-   [app.http.websocket :as-alias ws]
   [app.metrics :as mtx]
-   [app.rpc :as-alias rpc]
-   [app.rpc.doc :as-alias rpc.doc]
   [app.worker :as wrk]
   [clojure.spec.alpha :as s]
   [integrant.core :as ig]
@@ -73,6 +63,7 @@
                 :http/max-body-size (:max-body-size cfg)
                 :http/max-multipart-body-size (:max-multipart-body-size cfg)
                 :xnio/io-threads (:io-threads cfg)
+                 :xnio/worker-threads (:worker-threads cfg)
                 :xnio/dispatch (:executor cfg)
                 :ring/async true}

@@ -99,7 +90,9 @@
              (let [params  (:path-params match)
                    result  (:result match)
                    handler (or (:handler result) not-found-handler)
-                    request (assoc request :path-params params)]
+                    request (-> request
+                                (assoc :path-params params)
+                                (update :params merge params))]
                (handler request respond raise))
              (not-found-handler request respond raise)))

@@ -121,41 +114,67 @@
 ;; HTTP ROUTER
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

+(s/def ::assets map?)
+(s/def ::audit-handler fn?)
+(s/def ::awsns-handler fn?)
+(s/def ::debug-routes (s/nilable vector?))
+(s/def ::doc-routes (s/nilable vector?))
+(s/def ::feedback fn?)
+(s/def ::oauth map?)
+(s/def ::oidc-routes (s/nilable vector?))
+(s/def ::rpc-routes (s/nilable vector?))
+(s/def ::session map?)
+(s/def ::storage map?)
+(s/def ::ws fn?)
+
 (defmethod ig/pre-init-spec ::router [_]
-  (s/keys :req [::session/manager
-                ::actoken/manager
-                ::ws/routes
-                ::rpc/routes
-                ::rpc.doc/routes
-                ::oidc/routes
-                ::assets/routes
-                ::debug/routes
-                ::db/pool
-                ::mtx/routes
-                ::awsns/routes]))
+  (s/keys :req-un [::mtx/metrics
+                   ::ws
+                   ::storage
+                   ::assets
+                   ::session
+                   ::feedback
+                   ::awsns-handler
+                   ::debug-routes
+                   ::oidc-routes
+                   ::audit-handler
+                   ::rpc-routes
+                   ::doc-routes]))

 (defmethod ig/init-key ::router
-  [_ cfg]
+  [_ {:keys [ws session metrics assets feedback] :as cfg}]
  (rr/router
   [["" {:middleware [[mw/server-timing]
                      [mw/format-response]
                      [mw/params]
                      [mw/parse-request]
-                      [session/soft-auth cfg]
-                      [actoken/soft-auth cfg]
                      [mw/errors errors/handle]
                      [mw/restrict-methods]]}

-     (::mtx/routes cfg)
-     (::assets/routes cfg)
-     (::debug/routes cfg)
+     ["/metrics" {:handler (::mtx/handler metrics)
+                  :allowed-methods #{:get}}]
+
+     ["/assets" {:middleware [(:middleware session)]}
+      ["/by-id/:id" {:handler (:objects-handler assets)}]
+      ["/by-file-media-id/:id" {:handler (:file-objects-handler assets)}]
+      ["/by-file-media-id/:id/thumbnail" {:handler (:file-thumbnails-handler assets)}]]
+
+     (:debug-routes cfg)

     ["/webhooks"
-      (::awsns/routes cfg)]
+      ["/sns" {:handler (:awsns-handler cfg)
+               :allowed-methods #{:post}}]]

-     (::ws/routes cfg)
+     ["/ws/notifications" {:middleware [(:middleware session)]
+                           :handler ws
+                           :allowed-methods #{:get}}]

-     ["/api" {:middleware [[mw/cors]]}
-      (::oidc/routes cfg)
-      (::rpc.doc/routes cfg)
-      (::rpc/routes cfg)]]]))
+     ["/api" {:middleware [[mw/cors]
+                           [(:middleware session)]]}
+      ["/audit/events" {:handler (:audit-handler cfg)
+                        :allowed-methods #{:post}}]
+      ["/feedback" {:handler feedback
+                    :allowed-methods #{:post}}]
+      (:doc-routes cfg)
+      (:oidc-routes cfg)
+      (:rpc-routes cfg)]]]))
--- a/backend/src/app/http/access_token.clj
+++ b/backend/src/app/http/access_token.clj
@@ -1,96 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC
-
-(ns app.http.access-token
-  (:require
-   [app.common.logging :as l]
-   [app.common.spec :as us]
-   [app.config :as cf]
-   [app.db :as db]
-   [app.main :as-alias main]
-   [app.tokens :as tokens]
-   [app.worker :as-alias wrk]
-   [clojure.spec.alpha :as s]
-   [integrant.core :as ig]
-   [promesa.core :as p]
-   [promesa.exec :as px]
-   [yetti.request :as yrq]))
-
-
-(s/def ::manager
-  (s/keys :req [::db/pool ::wrk/executor ::main/props]))
-
-(defmethod ig/pre-init-spec ::manager [_] ::manager)
-(defmethod ig/init-key ::manager [_ cfg] cfg)
-(defmethod ig/halt-key! ::manager [_ _])
-
-(def header-re #"^Token\s+(.*)")
-
-(defn- get-token
-  [request]
-  (some->> (yrq/get-header request "authorization")
-           (re-matches header-re)
-           (second)))
-
-(defn- decode-token
-  [props token]
-  (when token
-    (tokens/verify props {:token token :iss "access-token"})))
-
-(defn- get-token-perms
-  [pool token-id]
-  (when-not (db/read-only? pool)
-    (when-let [token (db/get* pool :access-token {:id token-id} {:columns [:perms]})]
-      (some-> (:perms token)
-              (db/decode-pgarray #{})))))
-
-(defn- wrap-soft-auth
-  [handler {:keys [::manager]}]
-  (us/assert! ::manager manager)
-
-  (let [{:keys [::wrk/executor ::main/props]} manager]
-    (fn [request respond raise]
-      (let [token (get-token request)]
-        (->> (px/submit! executor (partial decode-token props token))
-             (p/fnly (fn [claims cause]
-                       (when cause
-                         (l/trace :hint "exception on decoding malformed token" :cause cause))
-                       (let [request (cond-> request
-                                       (map? claims)
-                                       (assoc ::id (:tid claims)))]
-                         (handler request respond raise)))))))))
-
-(defn- wrap-authz
-  [handler {:keys [::manager]}]
-  (us/assert! ::manager manager)
-  (let [{:keys [::wrk/executor ::db/pool]} manager]
-    (fn [request respond raise]
-      (if-let [token-id (::id request)]
-        (->> (px/submit! executor (partial get-token-perms pool token-id))
-             (p/fnly (fn [perms cause]
-                       (cond
-                         (some? cause)
-                         (raise cause)
-
-                         (nil? perms)
-                         (handler request respond raise)
-
-                         :else
-                         (let [request (assoc request ::perms perms)]
-                           (handler request respond raise))))))
-        (handler request respond raise)))))
-
-(def soft-auth
-  {:name ::soft-auth
-   :compile (fn [& _]
-              (when (contains? cf/flags :access-tokens)
-                wrap-soft-auth))})
-
-(def authz
-  {:name ::authz
-   :compile (fn [& _]
-              (when (contains? cf/flags :access-tokens)
-                wrap-authz))})
--- a/backend/src/app/http/assets.clj
+++ b/backend/src/app/http/assets.clj
@@ -115,10 +115,7 @@
 (s/def ::cache-max-age ::dt/duration)
 (s/def ::signature-max-age ::dt/duration)

-(s/def ::routes vector?)
-
-;; FIXME: namespace qualified params
-(defmethod ig/pre-init-spec ::routes [_]
+(defmethod ig/pre-init-spec ::handlers [_]
  (s/keys :req-un [::storage
                   ::wrk/executor
                   ::mtx/metrics
@@ -126,9 +123,9 @@
                   ::cache-max-age
                   ::signature-max-age]))

-(defmethod ig/init-key ::routes
+(defmethod ig/init-key ::handlers
  [_ cfg]
-  ["/assets"
-   ["/by-id/:id" {:handler (partial objects-handler cfg)}]
-   ["/by-file-media-id/:id" {:handler (partial file-objects-handler cfg)}]
-   ["/by-file-media-id/:id/thumbnail" {:handler (partial file-thumbnails-handler cfg)}]])
+  {:objects-handler (partial objects-handler cfg)
+   :file-objects-handler (partial file-objects-handler cfg)
+   :file-thumbnails-handler (partial file-thumbnails-handler cfg)})
+
--- a/backend/src/app/http/awsns.clj
+++ b/backend/src/app/http/awsns.clj
@@ -12,9 +12,7 @@
   [app.db :as db]
   [app.db.sql :as sql]
   [app.http.client :as http]
-   [app.main :as-alias main]
   [app.tokens :as tokens]
-   [app.worker :as-alias wrk]
   [clojure.spec.alpha :as s]
   [cuerdas.core :as str]
   [integrant.core :as ig]
@@ -28,23 +26,21 @@
 (declare parse-notification)
 (declare process-report)

-(defmethod ig/pre-init-spec ::routes [_]
-  (s/keys :req [::http/client
-                ::main/props
-                ::db/pool
-                ::wrk/executor]))
+(s/def ::http-client ::http/client)
+(s/def ::sprops map?)

-(defmethod ig/init-key ::routes
-  [_ {:keys [::wrk/executor] :as cfg}]
-  (letfn [(handler [request respond _]
-            (let [data (-> request yrq/body slurp)]
-              (px/run! executor #(handle-request cfg data)))
-            (respond (yrs/response 200)))]
-    ["/sns" {:handler handler
-             :allowed-methods #{:post}}]))
+(defmethod ig/pre-init-spec ::handler [_]
+  (s/keys :req-un [::db/pool ::http-client ::sprops]))
+
+(defmethod ig/init-key ::handler
+  [_ {:keys [executor] :as cfg}]
+  (fn [request respond _]
+    (let [data (-> request yrq/body slurp)]
+      (px/run! executor #(handle-request cfg data)))
+    (respond (yrs/response 200))))

 (defn handle-request
-  [cfg data]
+  [{:keys [http-client] :as cfg} data]
  (try
    (let [body  (parse-json data)
          mtype (get body "Type")]
@@ -53,7 +49,7 @@
        (let [surl   (get body "SubscribeURL")
              stopic (get body "TopicArn")]
          (l/info :action "subscription received" :topic stopic :url surl)
-          (http/req! cfg {:uri surl :method :post :timeout 10000} {:sync? true}))
+          (http/req! http-client {:uri surl :method :post :timeout 10000} {:sync? true}))

        (= mtype "Notification")
        (when-let [message (parse-json (get body "Message"))]
@@ -104,10 +100,10 @@
          (get mail "headers")))

 (defn- extract-identity
-  [cfg headers]
+  [{:keys [sprops]} headers]
  (let [tdata (get headers "x-penpot-data")]
    (when-not (str/empty? tdata)
-      (let [result (tokens/verify (::main/props cfg) {:token tdata :iss :profile-identity})]
+      (let [result (tokens/verify sprops {:token tdata :iss :profile-identity})]
        (:profile-id result)))))

 (defn- parse-notification
@@ -140,7 +136,7 @@
   (j/read-value v)))

 (defn- register-bounce-for-profile
-  [{:keys [::db/pool]} {:keys [type kind profile-id] :as report}]
+  [{:keys [pool]} {:keys [type kind profile-id] :as report}]
  (when (= kind "permanent")
    (db/with-atomic [conn pool]
      (db/insert! conn :profile-complaint-report
@@ -169,7 +165,7 @@
                      {:id profile-id}))))))

 (defn- register-complaint-for-profile
-  [{:keys [::db/pool]} {:keys [type profile-id] :as report}]
+  [{:keys [pool]} {:keys [type profile-id] :as report}]
  (db/with-atomic [conn pool]
    (db/insert! conn :profile-complaint-report
                {:profile-id profile-id
--- a/backend/src/app/http/client.clj
+++ b/backend/src/app/http/client.clj
@@ -7,45 +7,34 @@
 (ns app.http.client
  "Http client abstraction layer."
  (:require
-   [app.common.spec :as us]
   [app.worker :as wrk]
   [clojure.spec.alpha :as s]
   [integrant.core :as ig]
-   [java-http-clj.core :as http]
-   [promesa.core :as p])
-  (:import
-   java.net.http.HttpClient))
+   [java-http-clj.core :as http]))

-(s/def ::client #(instance? HttpClient %))
-(s/def ::client-holder
-  (s/keys :req [::client]))
+(s/def ::client fn?)

-(defmethod ig/pre-init-spec ::client [_]
-  (s/keys :req [::wrk/executor]))
+(defmethod ig/pre-init-spec :app.http/client [_]
+  (s/keys :req-un [::wrk/executor]))

-(defmethod ig/init-key ::client
-  [_ {:keys [::wrk/executor] :as cfg}]
-  (http/build-client {:executor executor
-                      :connect-timeout 30000 ;; 10s
-                      :follow-redirects :always}))
-
-(defn send!
-  ([client req] (send! client req {}))
-  ([client req {:keys [response-type sync?] :or {response-type :string sync? false}}]
-   (us/assert! ::client client)
-   (if sync?
-     (http/send req {:client client :as response-type})
-     (try
-       (http/send-async req {:client client :as response-type})
-       (catch Throwable cause
-         (p/rejected cause))))))
+(defmethod ig/init-key :app.http/client
+  [_ {:keys [executor] :as cfg}]
+  (let [client (http/build-client {:executor executor
+                                   :connect-timeout 30000 ;; 10s
+                                   :follow-redirects :always})]
+    (with-meta
+      (fn send
+        ([req] (send req {}))
+        ([req {:keys [response-type sync?] :or {response-type :string sync? false}}]
+         (if sync?
+           (http/send req {:client client :as response-type})
+           (http/send-async req {:client client :as response-type}))))
+      {::client client})))

 (defn req!
  "A convencience toplevel function for gradual migration to a new API
  convention."
-  ([{:keys [::client] :as holder} request]
-   (us/assert! ::client-holder holder)
-   (send! client request {}))
-  ([{:keys [::client] :as holder} request options]
-   (us/assert! ::client-holder holder)
-   (send! client request options)))
+  ([client request]
+   (client request))
+  ([client request options]
+   (client request options)))
--- a/backend/src/app/http/debug.clj
+++ b/backend/src/app/http/debug.clj
@@ -14,10 +14,9 @@
   [app.config :as cf]
   [app.db :as db]
   [app.http.middleware :as mw]
-   [app.http.session :as session]
   [app.rpc.commands.binfile :as binf]
-   [app.rpc.commands.files-create :refer [create-file]]
-   [app.rpc.commands.profile :as profile]
+   [app.rpc.mutations.files :refer [create-file]]
+   [app.rpc.queries.profile :as profile]
   [app.util.blob :as blob]
   [app.util.template :as tmpl]
   [app.util.time :as dt]
@@ -39,9 +38,9 @@
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

 (defn authorized?
-  [pool {:keys [::session/profile-id]}]
+  [pool {:keys [profile-id]}]
  (or (= "devenv" (cf/get :host))
-      (let [profile (ex/ignoring (profile/get-profile pool profile-id))
+      (let [profile (ex/ignoring (profile/retrieve-profile-data pool profile-id))
            admins  (or (cf/get :admins) #{})]
        (contains? admins (:email profile)))))

@@ -61,7 +60,7 @@
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

 (defn index-handler
-  [{:keys [::db/pool]} request]
+  [{:keys [pool]} request]
  (when-not (authorized? pool request)
    (ex/raise :type :authentication
              :code :only-admins-allowed))
@@ -81,7 +80,7 @@
  "select revn, changes, data from file_change where file_id=? and revn = ?")

 (defn- retrieve-file-data
-  [{:keys [::db/pool]} {:keys [params ::session/profile-id] :as request}]
+  [{:keys [pool]} {:keys [params profile-id] :as request}]
  (when-not (authorized? pool request)
    (ex/raise :type :authentication
              :code :only-admins-allowed))
@@ -107,9 +106,8 @@
        (prepare-download-response data filename)

        (contains? params :clone)
-        (let [profile    (profile/get-profile pool profile-id)
-              project-id (:default-project-id profile)
-              data       (blob/decode data)]
+        (let [project-id (some-> (profile/retrieve-additional-data pool profile-id) :default-project-id)
+              data       (some-> data blob/decode)]
          (create-file pool {:id (uuid/next)
                             :name (str "Cloned file: " filename)
                             :project-id project-id
@@ -118,7 +116,7 @@
          (yrs/response 201 "OK CREATED"))

        :else
-        (prepare-response (blob/decode data))))))
+        (prepare-response (some-> data blob/decode))))))

 (defn- is-file-exists?
  [pool id]
@@ -126,9 +124,8 @@
    (-> (db/exec-one! pool [sql id]) :exists)))

 (defn- upload-file-data
-  [{:keys [::db/pool]} {:keys [::session/profile-id params] :as request}]
-  (let [profile    (profile/get-profile pool profile-id)
-        project-id (:default-project-id profile)
+  [{:keys [pool]} {:keys [profile-id params] :as request}]
+  (let [project-id (some-> (profile/retrieve-additional-data pool profile-id) :default-project-id)
        data       (some-> params :file :path io/read-as-bytes blob/decode)]

    (if (and data project-id)
@@ -164,7 +161,7 @@
              :code :method-not-found)))

 (defn file-changes-handler
-  [{:keys [::db/pool]} {:keys [params] :as request}]
+  [{:keys [pool]} {:keys [params] :as request}]
  (when-not (authorized? pool request)
    (ex/raise :type :authentication
              :code :only-admins-allowed))
@@ -204,7 +201,7 @@
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

 (defn error-handler
-  [{:keys [::db/pool]} request]
+  [{:keys [pool]} request]
  (letfn [(parse-id [request]
            (let [id (get-in request [:path-params :id])
                  id (parse-uuid id)]
@@ -246,19 +243,15 @@
        (yrs/response 404 "not found")))))

 (def sql:error-reports
-  "SELECT id, created_at,
-          content->>'~:hint' AS hint
-     FROM server_error_report
-    ORDER BY created_at DESC
-    LIMIT 100")
+  "select id, created_at from server_error_report order by created_at desc limit 100")

 (defn error-list-handler
-  [{:keys [::db/pool]} request]
+  [{:keys [pool]} request]
  (when-not (authorized? pool request)
    (ex/raise :type :authentication
              :code :only-admins-allowed))
-  (let [items (->> (db/exec! pool [sql:error-reports])
-                   (map #(update % :created-at dt/format-instant :rfc1123)))]
+  (let [items (db/exec! pool [sql:error-reports])
+        items (map #(update % :created-at dt/format-instant :rfc1123) items)]
    (yrs/response :status 200
                  :body (-> (io/resource "app/templates/error-list.tmpl")
                            (tmpl/render {:items items}))
@@ -270,7 +263,7 @@
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

 (defn export-handler
-  [{:keys [::db/pool] :as cfg} {:keys [params ::session/profile-id] :as request}]
+  [{:keys [pool] :as cfg} {:keys [params profile-id] :as request}]

  (let [file-ids (->> (:file-ids params)
                      (remove empty?)
@@ -289,8 +282,7 @@
                   (assoc ::binf/include-libraries? libs?)
                   (binf/export-to-tmpfile!))]
      (if clone?
-        (let [profile    (profile/get-profile pool profile-id)
-              project-id (:default-project-id profile)]
+        (let [project-id (some-> (profile/retrieve-additional-data pool profile-id) :default-project-id)]
          (binf/import!
           (assoc cfg
                  ::binf/input path
@@ -312,16 +304,15 @@


 (defn import-handler
-  [{:keys [::db/pool] :as cfg} {:keys [params ::session/profile-id] :as request}]
+  [{:keys [pool] :as cfg} {:keys [params profile-id] :as request}]
  (when-not (contains? params :file)
    (ex/raise :type :validation
              :code :missing-upload-file
              :hint "missing upload file"))

-  (let [profile    (profile/get-profile pool profile-id)
-        project-id (:default-project-id profile)
+  (let [project-id (some-> (profile/retrieve-additional-data pool profile-id) :default-project-id)
        overwrite? (contains? params :overwrite)
-        migrate?   (contains? params :migrate)
+        migrate? (contains? params :migrate)
        ignore-index-errors? (contains? params :ignore-index-errors)]

    (when-not project-id
@@ -349,14 +340,15 @@

 (defn health-handler
  "Mainly a task that performs a health check."
-  [{:keys [::db/pool]} _]
-  (try
-    (db/exec-one! pool ["select count(*) as count from server_prop;"])
-    (yrs/response 200 "OK")
-    (catch Throwable cause
-      (l/warn :hint "unable to execute query on health handler"
-              :cause cause)
-      (yrs/response 503 "KO"))))
+  [{:keys [pool]} _]
+  (db/with-atomic [conn pool]
+    (try
+      (db/exec-one! conn ["select count(*) as count from server_prop;"])
+      (yrs/response 200 "OK")
+      (catch Throwable cause
+        (l/warn :hint "unable to execute query on health handler"
+                :cause cause)
+        (yrs/response 503 "KO")))))

 (defn changelog-handler
  [_ _]
@@ -384,17 +376,18 @@
           (raise (ex/error :type :authentication
                            :code :only-admins-allowed))))))})

+
+(s/def ::session map?)
+
 (defmethod ig/pre-init-spec ::routes [_]
-  (s/keys :req [::db/pool
-                ::wrk/executor
-                ::session/manager]))
+  (s/keys :req-un [::db/pool ::wrk/executor ::session]))

 (defmethod ig/init-key ::routes
-  [_ {:keys [::db/pool ::wrk/executor] :as cfg}]
+  [_ {:keys [session pool executor] :as cfg}]
  [["/readyz" {:middleware [[mw/with-dispatch executor]
                            [mw/with-config cfg]]
               :handler health-handler}]
-   ["/dbg" {:middleware [[session/authz cfg]
+   ["/dbg" {:middleware [[(:middleware session)]
                         [with-authorization pool]
                         [mw/with-dispatch executor]
                         [mw/with-config cfg]]}
--- a/backend/src/app/http/errors.clj
+++ b/backend/src/app/http/errors.clj
@@ -7,12 +7,10 @@
 (ns app.http.errors
  "A errors handling for the http server."
  (:require
-   [app.common.data :as d]
   [app.common.exceptions :as ex]
   [app.common.logging :as l]
+   [app.common.spec :as us]
   [app.http :as-alias http]
-   [app.http.access-token :as-alias actoken]
-   [app.http.session :as-alias session]
   [clojure.spec.alpha :as s]
   [cuerdas.core :as str]
   [yetti.request :as yrq]
@@ -28,20 +26,16 @@

 (defn get-context
  [request]
-  (let [claims (-> {}
-                   (into (::session/token-claims request))
-                   (into (::actoken/token-claims request)))]
-    (merge
-     *context*
-     {:path          (:path request)
-      :method        (:method request)
-      :params        (:params request)
-      :ip-addr       (parse-client-ip request)}
-     (d/without-nils
-      {:user-agent (yrq/get-header request "user-agent")
-       :frontend-version (or (yrq/get-header request "x-frontend-version")
-                             "unknown")
-       :profile-id   (:uid claims)}))))
+  (merge
+   *context*
+   {:path          (:path request)
+    :method        (:method request)
+    :params        (:params request)
+    :ip-addr       (parse-client-ip request)
+    :profile-id    (:profile-id request)}
+   (let [headers (:headers request)]
+     {:user-agent (get headers "user-agent")
+      :frontend-version (get headers "x-frontend-version" "unknown")})))

 (defmulti handle-exception
  (fn [err & _rest]
@@ -53,10 +47,6 @@
  [err _]
  (yrs/response 401 (ex-data err)))

-(defmethod handle-exception :authorization
-  [err _]
-  (yrs/response 403 (ex-data err)))
-
 (defmethod handle-exception :restriction
  [err _]
  (yrs/response 400 (ex-data err)))
@@ -71,7 +61,7 @@
  (let [{:keys [code] :as data} (ex-data err)]
    (cond
      (= code :spec-validation)
-      (let [explain (ex/explain data)]
+      (let [explain (us/pretty-explain data)]
        (yrs/response :status 400
                      :body   (-> data
                                  (dissoc ::s/problems ::s/value)
@@ -85,11 +75,11 @@

 (defmethod handle-exception :assertion
  [error request]
-  (let [edata   (ex-data error)
-        explain (ex/explain edata)]
-    (l/error :hint (ex-message error)
-             :cause error
-             ::l/context (get-context request))
+  (let [edata (ex-data error)
+        explain (us/pretty-explain edata)]
+    (l/error ::l/raw (str (ex-message error) "\n" explain)
+             ::l/context (get-context request)
+             :cause error)
    (yrs/response :status 500
                  :body   {:type :server-error
                           :code :assertion
@@ -101,29 +91,12 @@
  [err _]
  (yrs/response 404 (ex-data err)))

-(defmethod handle-exception :internal
-  [error request]
-  (let [{:keys [code] :as edata} (ex-data error)]
-    (cond
-      (= :concurrency-limit-reached code)
-      (yrs/response 429)
-
-      :else
-      (do
-        (l/error :hint (ex-message error)
-                 :cause error
-                 ::l/context (get-context request))
-        (yrs/response 500 {:type :server-error
-                           :code :unhandled
-                           :hint (ex-message error)
-                           :data edata})))))
-
 (defmethod handle-exception org.postgresql.util.PSQLException
  [error request]
  (let [state (.getSQLState ^java.sql.SQLException error)]
-    (l/error :hint (ex-message error)
-             :cause error
-             ::l/context (get-context request))
+    (l/error ::l/raw (ex-message error)
+             ::l/context (get-context request)
+             :cause error)
    (cond
      (= state "57014")
      (yrs/response 504 {:type :server-error
@@ -148,9 +121,9 @@
      ;; This means that exception is not a controlled exception.
      (nil? edata)
      (do
-        (l/error :hint (ex-message error)
-                 :cause error
-                 ::l/context (get-context request))
+        (l/error ::l/raw (ex-message error)
+                 ::l/context (get-context request)
+                 :cause error)
        (yrs/response 500 {:type :server-error
                           :code :unexpected
                           :hint (ex-message error)}))
@@ -166,9 +139,9 @@

      :else
      (do
-        (l/error :hint (ex-message error)
-                 :cause error
-                 ::l/context (get-context request))
+        (l/error ::l/raw (ex-message error)
+                 ::l/context (get-context request)
+                 :cause error)
        (yrs/response 500 {:type :server-error
                           :code :unhandled
                           :hint (ex-message error)
--- a/backend/src/app/http/feedback.clj
+++ b/backend/src/app/http/feedback.clj
@@ -0,0 +1,80 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS INC
+
+(ns app.http.feedback
+  "A general purpose feedback module."
+  (:require
+   [app.common.data :as d]
+   [app.common.exceptions :as ex]
+   [app.common.spec :as us]
+   [app.config :as cf]
+   [app.db :as db]
+   [app.emails :as eml]
+   [app.rpc.queries.profile :as profile]
+   [app.worker :as wrk]
+   [clojure.spec.alpha :as s]
+   [integrant.core :as ig]
+   [promesa.core :as p]
+   [promesa.exec :as px]
+   [yetti.request :as yrq]
+   [yetti.response :as yrs]))
+
+(declare ^:private send-feedback)
+(declare ^:private handler)
+
+(defmethod ig/pre-init-spec ::handler [_]
+  (s/keys :req-un [::db/pool ::wrk/executor]))
+
+(defmethod ig/init-key ::handler
+  [_ {:keys [executor] :as cfg}]
+  (let [enabled? (contains? cf/flags :user-feedback)]
+    (if enabled?
+      (fn [request respond raise]
+        (-> (px/submit! executor #(handler cfg request))
+            (p/then' respond)
+            (p/catch raise)))
+      (fn [_ _ raise]
+        (raise (ex/error :type :validation
+                         :code :feedback-disabled
+                         :hint "feedback module is disabled"))))))
+
+(defn- handler
+  [{:keys [pool] :as cfg} {:keys [profile-id] :as request}]
+  (let [ftoken (cf/get :feedback-token ::no-token)
+        token  (yrq/get-header request "x-feedback-token")
+        params (d/merge (:params request)
+                        (:body-params request))]
+    (cond
+      (uuid? profile-id)
+      (let [profile (profile/retrieve-profile-data pool profile-id)
+            params  (assoc params :from (:email profile))]
+        (send-feedback pool profile params))
+
+      (= token ftoken)
+      (send-feedback cfg nil params))
+
+    (yrs/response 204)))
+
+(s/def ::content ::us/string)
+(s/def ::from    ::us/email)
+(s/def ::subject ::us/string)
+(s/def ::feedback
+  (s/keys :req-un [::from ::subject ::content]))
+
+(defn- send-feedback
+  [pool profile params]
+  (let [params      (us/conform ::feedback params)
+        destination (cf/get :feedback-destination)]
+    (eml/send! {::eml/conn pool
+                ::eml/factory eml/feedback
+                :from     destination
+                :to       destination
+                :profile  profile
+                :reply-to (:from params)
+                :email    (:from params)
+                :subject  (:subject params)
+                :content  (:content params)})
+    nil))
--- a/backend/src/app/http/middleware.clj
+++ b/backend/src/app/http/middleware.clj
@@ -19,7 +19,6 @@
   [yetti.request :as yrq]
   [yetti.response :as yrs])
  (:import
-   com.fasterxml.jackson.core.JsonParseException
   com.fasterxml.jackson.core.io.JsonEOFException
   io.undertow.server.RequestTooBigException
   java.io.OutputStream))
@@ -32,12 +31,6 @@
  {:name ::params
   :compile (constantly ymw/wrap-params)})

-(def ^:private json-mapper
-  (json/mapper
-   {:encode-key-fn str/camel
-    :decode-key-fn (comp keyword str/kebab)
-    :pretty true}))
-
 (defn wrap-parse-request
  [handler]
  (letfn [(process-request [request]
@@ -52,7 +45,7 @@

                (str/starts-with? header "application/json")
                (with-open [is (yrq/body request)]
-                  (let [params (json/decode is json-mapper)]
+                  (let [params (json/read is)]
                    (-> request
                        (assoc :body-params params)
                        (update :params merge params))))
@@ -67,23 +60,21 @@
                               :code :request-body-too-large
                               :hint (ex-message cause)))

-
-              (or (instance? JsonEOFException cause)
-                  (instance? JsonParseException cause))
+              (instance? JsonEOFException cause)
              (raise (ex/error :type :validation
                               :code :malformed-json
-                               :hint (ex-message cause)
-                               :cause cause))
+                               :hint (ex-message cause)))
              :else
              (raise cause)))]

    (fn [request respond raise]
-      (let [request (ex/try! (process-request request))]
-        (if (ex/exception? request)
-          (if (instance? RuntimeException request)
-            (handle-error raise (or (ex/cause request) request))
-            (handle-error raise request))
-          (handler request respond raise))))))
+      (when-let [request (try
+                           (process-request request)
+                           (catch RuntimeException cause
+                             (handle-error raise (or (.getCause cause) cause)))
+                           (catch Throwable cause
+                             (handle-error raise cause)))]
+        (handler request respond raise)))))

 (def parse-request
  {:name ::parse-request
@@ -122,32 +113,7 @@
                  (finally
                    (.close ^OutputStream output-stream))))))

-          (json-streamable-body [data]
-            (reify yrs/StreamableResponseBody
-              (-write-body-to-stream [_ _ output-stream]
-                (try
-
-                  (with-open [bos (buffered-output-stream output-stream buffer-size)]
-                    (json/write! bos data json-mapper))
-
-                  (catch java.io.IOException _cause
-                    ;; Do nothing, EOF means client closes connection abruptly
-                    nil)
-                  (catch Throwable cause
-                    (l/warn :hint "unexpected error on encoding response"
-                            :cause cause))
-                  (finally
-                    (.close ^OutputStream output-stream))))))
-
-          (format-response-with-json [response _]
-            (let [body (yrs/body response)]
-              (if (or (boolean? body) (coll? body))
-                (-> response
-                    (update :headers assoc "content-type" "application/json")
-                    (assoc :body (json-streamable-body body)))
-                response)))
-
-          (format-response-with-transit [response request]
+          (format-response [response request]
            (let [body (yrs/body response)]
              (if (or (boolean? body) (coll? body))
                (let [qs   (yrq/query request)
@@ -160,20 +126,6 @@
                      (assoc :body (transit-streamable-body body opts))))
                response)))

-          (format-response [response request]
-            (let [accept (yrq/get-header request "accept")]
-              (cond
-                (or (= accept "application/transit+json")
-                    (str/includes? accept "application/transit+json"))
-                (format-response-with-transit response request)
-
-                (or (= accept "application/json")
-                    (str/includes? accept "application/json"))
-                (format-response-with-json response request)
-
-                :else
-                (format-response-with-transit response request))))
-
          (process-response [response request]
            (cond-> response
              (map? response) (format-response request)))]
--- a/backend/src/app/http/session.clj
+++ b/backend/src/app/http/session.clj
@@ -5,30 +5,21 @@
 ;; Copyright (c) KALEIDOS INC

 (ns app.http.session
-  (:refer-clojure :exclude [read])
  (:require
   [app.common.data :as d]
   [app.common.logging :as l]
-   [app.common.spec :as us]
   [app.config :as cf]
   [app.db :as db]
   [app.db.sql :as sql]
-   [app.http.session.tasks :as-alias tasks]
-   [app.main :as-alias main]
   [app.tokens :as tokens]
   [app.util.time :as dt]
   [app.worker :as wrk]
   [clojure.spec.alpha :as s]
-   [cuerdas.core :as str]
   [integrant.core :as ig]
   [promesa.core :as p]
   [promesa.exec :as px]
   [yetti.request :as yrq]))

-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; DEFAULTS
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-
 ;; A default cookie name for storing the session.
 (def default-auth-token-cookie-name "auth-token")

@@ -42,242 +33,119 @@
 ;; Default age for automatic session renewal
 (def default-renewal-max-age (dt/duration {:hours 6}))

-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; PROTOCOLS
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+(defprotocol ISessionStore
+  (read-session [store key])
+  (write-session [store key data])
+  (update-session [store data])
+  (delete-session [store key]))

-(defprotocol ISessionManager
-  (read [_ key])
-  (write! [_ key data])
-  (update! [_ data])
-  (delete! [_ key]))
-
-(s/def ::manager #(satisfies? ISessionManager %))
-
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; STORAGE IMPL
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-
-(s/def ::session-params
-  (s/keys :req-un [::user-agent
-                   ::profile-id
-                   ::created-at]))
-
-(defn- prepare-session-params
-  [key params]
-  (us/assert! ::us/not-empty-string key)
-  (us/assert! ::session-params params)
-
-  {:user-agent (:user-agent params)
-   :profile-id (:profile-id params)
-   :created-at (:created-at params)
-   :updated-at (:created-at params)
-   :id key})
-
-(defn- database-manager
-  [{:keys [::db/pool ::wrk/executor ::main/props]}]
-  ^{::wrk/executor executor
-    ::db/pool pool
-    ::main/props props}
-  (reify ISessionManager
-    (read [_ token]
+(defn- make-database-store
+  [{:keys [pool sprops executor]}]
+  (reify ISessionStore
+    (read-session [_ token]
      (px/with-dispatch executor
        (db/exec-one! pool (sql/select :http-session {:id token}))))

-    (write! [_ key params]
+    (write-session [_ _ data]
      (px/with-dispatch executor
-        (let [params (prepare-session-params key params)]
-          (db/insert! pool :http-session params)
-          params)))
+        (let [profile-id (:profile-id data)
+              user-agent (:user-agent data)
+              created-at (or (:created-at data) (dt/now))
+              token      (tokens/generate sprops {:iss "authentication"
+                                                  :iat created-at
+                                                  :uid profile-id})
+              params     {:user-agent user-agent
+                          :profile-id profile-id
+                          :created-at created-at
+                          :updated-at created-at
+                          :id token}]
+          (db/insert! pool :http-session params))))

-    (update! [_ params]
+    (update-session [_ data]
      (let [updated-at (dt/now)]
        (px/with-dispatch executor
          (db/update! pool :http-session
                      {:updated-at updated-at}
-                      {:id (:id params)})
-          (assoc params :updated-at updated-at))))
+                      {:id (:id data)})
+          (assoc data :updated-at updated-at))))

-    (delete! [_ token]
+    (delete-session [_ token]
      (px/with-dispatch executor
        (db/delete! pool :http-session {:id token})
        nil))))

-(defn inmemory-manager
-  [{:keys [::db/pool ::wrk/executor ::main/props]}]
+(defn make-inmemory-store
+  [{:keys [sprops]}]
  (let [cache (atom {})]
-    ^{::main/props props
-      ::wrk/executor executor
-      ::db/pool pool}
-    (reify ISessionManager
-      (read [_ token]
+    (reify ISessionStore
+      (read-session [_ token]
        (p/do (get @cache token)))

-      (write! [_ key params]
+      (write-session [_ _ data]
        (p/do
-          (let [params (prepare-session-params key params)]
-            (swap! cache assoc key params)
+          (let [profile-id (:profile-id data)
+                user-agent (:user-agent data)
+                created-at (or (:created-at data) (dt/now))
+                token      (tokens/generate sprops {:iss "authentication"
+                                                    :iat created-at
+                                                    :uid profile-id})
+                params     {:user-agent user-agent
+                            :created-at created-at
+                            :updated-at created-at
+                            :profile-id profile-id
+                            :id token}]
+
+            (swap! cache assoc token params)
            params)))

-      (update! [_ params]
-        (p/do
-          (let [updated-at (dt/now)]
-            (swap! cache update (:id params) assoc :updated-at updated-at)
-            (assoc params :updated-at updated-at))))
+      (update-session [_ data]
+        (let [updated-at (dt/now)]
+          (swap! cache update (:id data) assoc :updated-at updated-at)
+          (assoc data :updated-at updated-at)))

-      (delete! [_ token]
+      (delete-session [_ token]
        (p/do
          (swap! cache dissoc token)
          nil)))))

-(defmethod ig/pre-init-spec ::manager [_]
-  (s/keys :req [::db/pool ::wrk/executor ::main/props]))
+(s/def ::sprops map?)
+(defmethod ig/pre-init-spec ::store [_]
+  (s/keys :req-un [::db/pool ::wrk/executor ::sprops]))

-(defmethod ig/init-key ::manager
-  [_ {:keys [::db/pool] :as cfg}]
+(defmethod ig/init-key ::store
+  [_ {:keys [pool] :as cfg}]
  (if (db/read-only? pool)
-    (inmemory-manager cfg)
-    (database-manager cfg)))
+    (make-inmemory-store cfg)
+    (make-database-store cfg)))

-(defmethod ig/halt-key! ::manager
+(defmethod ig/halt-key! ::store
  [_ _])

-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; MANAGER IMPL
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-
-(declare ^:private assign-auth-token-cookie)
-(declare ^:private assign-authenticated-cookie)
-(declare ^:private clear-auth-token-cookie)
-(declare ^:private clear-authenticated-cookie)
-(declare ^:private gen-token)
-
-(defn create-fn
-  [{:keys [::manager]} profile-id]
-  (us/assert! ::manager manager)
-  (us/assert! ::us/uuid profile-id)
-
-  (let [props (-> manager meta ::main/props)]
-    (fn [request response]
-      (let [uagent (yrq/get-header request "user-agent")
-            params {:profile-id profile-id
-                    :user-agent uagent
-                    :created-at (dt/now)}
-            token  (gen-token props params)]
-
-        (->> (write! manager token params)
-             (p/fmap (fn [session]
-                       (l/trace :hint "create" :profile-id profile-id)
-                       (-> response
-                           (assign-auth-token-cookie session)
-                           (assign-authenticated-cookie session)))))))))
-(defn delete-fn
-  [{:keys [::manager]}]
-  (us/assert! ::manager manager)
-  (letfn [(delete [{:keys [profile-id] :as request}]
-            (let [cname   (cf/get :auth-token-cookie-name default-auth-token-cookie-name)
-                  cookie  (yrq/get-cookie request cname)]
-              (l/trace :hint "delete" :profile-id profile-id)
-              (some->> (:value cookie) (delete! manager))))]
-    (fn [request response]
-      (p/do
-        (delete request)
-        (-> response
-            (assoc :status 204)
-            (assoc :body nil)
-            (clear-auth-token-cookie)
-            (clear-authenticated-cookie))))))
-
-(defn- gen-token
-  [props {:keys [profile-id created-at]}]
-  (tokens/generate props {:iss "authentication"
-                          :iat created-at
-                          :uid profile-id}))
-(defn- decode-token
-  [props token]
-  (when token
-    (tokens/verify props {:token token :iss "authentication"})))
-
-(defn- get-token
-  [request]
-  (let [cname  (cf/get :auth-token-cookie-name default-auth-token-cookie-name)
-        cookie (some-> (yrq/get-cookie request cname) :value)]
-    (when-not (str/empty? cookie)
-      cookie)))
-
-(defn- get-session
-  [manager token]
-  (some->> token (read manager)))
-
-(defn- renew-session?
-  [{:keys [updated-at] :as session}]
-  (and (dt/instant? updated-at)
-       (let [elapsed (dt/diff updated-at (dt/now))]
-         (neg? (compare default-renewal-max-age elapsed)))))
-
-(defn- wrap-reneval
-  [respond manager session]
-  (fn [response]
-    (p/let [session (update! manager session)]
-      (-> response
-          (assign-auth-token-cookie session)
-          (assign-authenticated-cookie session)
-          (respond)))))
-
-(defn- wrap-soft-auth
-  [handler {:keys [::manager]}]
-  (us/assert! ::manager manager)
-
-  (let [{:keys [::wrk/executor ::main/props]} (meta manager)]
-    (fn [request respond raise]
-      (let [token (get-token request)]
-        (->> (px/submit! executor (partial decode-token props token))
-             (p/fnly (fn [claims cause]
-                       (when cause
-                         (l/trace :hint "exception on decoding malformed token" :cause cause))
-
-                       (let [request (cond-> request
-                                       (map? claims)
-                                       (-> (assoc ::token-claims claims)
-                                           (assoc ::token token)))]
-                         (handler request respond raise)))))))))
-
-(defn- wrap-authz
-  [handler {:keys [::manager]}]
-  (us/assert! ::manager manager)
-  (fn [request respond raise]
-    (if-let [token (::token request)]
-      (->> (get-session manager token)
-           (p/fnly (fn [session cause]
-                     (cond
-                       (some? cause)
-                       (raise cause)
-
-                       (nil? session)
-                       (handler request respond raise)
-
-                       :else
-                       (let [request (-> request
-                                         (assoc ::profile-id (:profile-id session))
-                                         (assoc ::id (:id session)))
-                             respond (cond-> respond
-                                       (renew-session? session)
-                                       (wrap-reneval manager session))]
-                         (handler request respond raise))))))
-
-      (handler request respond raise))))
-
-(def soft-auth
-  {:name ::soft-auth
-   :compile (constantly wrap-soft-auth)})
-
-(def authz
-  {:name ::authz
-   :compile (constantly wrap-authz)})
-
 ;; --- IMPL

-(defn- assign-auth-token-cookie
+(defn- create-session!
+  [store profile-id user-agent]
+  (let [params {:user-agent user-agent
+                :profile-id profile-id}]
+    (write-session store nil params)))
+
+(defn- update-session!
+  [store session]
+  (update-session store session))
+
+(defn- delete-session!
+  [store {:keys [cookies] :as request}]
+  (let [name (cf/get :auth-token-cookie-name default-auth-token-cookie-name)]
+    (when-let [token (get-in cookies [name :value])]
+      (delete-session store token))))
+
+(defn- retrieve-session
+  [store request]
+  (let [cookie-name (cf/get :auth-token-cookie-name default-auth-token-cookie-name)]
+    (when-let [cookie (yrq/get-cookie request cookie-name)]
+      (read-session store (:value cookie)))))
+
+(defn assign-auth-token-cookie
  [response {token :id updated-at :updated-at}]
  (let [max-age    (cf/get :auth-token-cookie-max-age default-cookie-max-age)
        created-at (or updated-at (dt/now))
@@ -296,7 +164,7 @@
                    :secure secure?}]
    (update response :cookies assoc name cookie)))

-(defn- assign-authenticated-cookie
+(defn assign-authenticated-cookie
  [response {updated-at :updated-at}]
  (let [max-age    (cf/get :auth-token-cookie-max-age default-cookie-max-age)
        created-at (or updated-at (dt/now))
@@ -317,44 +185,112 @@
      (string? domain)
      (update :cookies assoc name cookie))))

-(defn- clear-auth-token-cookie
+(defn clear-auth-token-cookie
  [response]
-  (let [cname (cf/get :auth-token-cookie-name default-auth-token-cookie-name)]
-    (update response :cookies assoc cname {:path "/" :value "" :max-age -1})))
+  (let [name (cf/get :auth-token-cookie-name default-auth-token-cookie-name)]
+    (update response :cookies assoc name {:path "/" :value "" :max-age -1})))

 (defn- clear-authenticated-cookie
  [response]
-  (let [cname   (cf/get :authenticated-cookie-name default-authenticated-cookie-name)
+  (let [name   (cf/get :authenticated-cookie-name default-authenticated-cookie-name)
        domain (cf/get :authenticated-cookie-domain)]
    (cond-> response
      (string? domain)
-      (update :cookies assoc cname {:domain domain :path "/" :value "" :max-age -1}))))
+      (update :cookies assoc name {:domain domain :path "/" :value "" :max-age -1}))))
+
+(defn- make-middleware
+  [{:keys [store] :as cfg}]
+  (letfn [;; Check if time reached for automatic session renewal
+          (renew-session? [{:keys [updated-at] :as session}]
+            (and (dt/instant? updated-at)
+                 (let [elapsed (dt/diff updated-at (dt/now))]
+                   (neg? (compare default-renewal-max-age elapsed)))))
+
+          ;; Wrap respond with session renewal code
+          (wrap-respond [respond session]
+            (fn [response]
+              (p/let [session (update-session! store session)]
+                (-> response
+                    (assign-auth-token-cookie session)
+                    (assign-authenticated-cookie session)
+                    (respond)))))]
+
+    {:name :session
+     :compile (fn [& _]
+                (fn [handler]
+                  (fn [request respond raise]
+                    (try
+                      (-> (retrieve-session store request)
+                          (p/finally (fn [session cause]
+                                       (cond
+                                         (some? cause)
+                                         (raise cause)
+
+                                         (nil? session)
+                                         (handler request respond raise)
+
+                                         :else
+                                         (let [request (-> request
+                                                           (assoc :profile-id (:profile-id session))
+                                                           (assoc :session-id (:id session)))
+                                               respond (cond-> respond
+                                                         (renew-session? session)
+                                                         (wrap-respond session))]
+                                           (handler request respond raise))))))
+
+                      (catch Throwable cause
+                        (raise cause))))))}))


-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; TASK: SESSION GC
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; --- STATE INIT: SESSION

-(s/def ::tasks/max-age ::dt/duration)
+(s/def ::store #(satisfies? ISessionStore %))

-(defmethod ig/pre-init-spec ::tasks/gc [_]
-  (s/keys :req [::db/pool]
-          :opt [::tasks/max-age]))
+(defmethod ig/pre-init-spec :app.http/session [_]
+  (s/keys :req-un [::store]))

-(defmethod ig/prep-key ::tasks/gc
+(defmethod ig/prep-key :app.http/session
  [_ cfg]
-  (let [max-age (cf/get :auth-token-cookie-max-age default-cookie-max-age)]
-    (merge {::tasks/max-age max-age} (d/without-nils cfg))))
+  (d/merge {:buffer-size 128}
+           (d/without-nils cfg)))

-(def ^:private
-  sql:delete-expired
-  "delete from http_session
-    where updated_at < now() - ?::interval
-       or (updated_at is null and
-           created_at < now() - ?::interval)")
+(defmethod ig/init-key :app.http/session
+  [_ {:keys [store] :as cfg}]
+  (-> cfg
+      (assoc :middleware (make-middleware cfg))
+      (assoc :create (fn [profile-id]
+                       (fn [request response]
+                         (p/let [uagent  (yrq/get-header request "user-agent")
+                                 session (create-session! store profile-id uagent)]
+                           (-> response
+                               (assign-auth-token-cookie session)
+                               (assign-authenticated-cookie session))))))
+      (assoc :delete (fn [request response]
+                       (p/do
+                         (delete-session! store request)
+                         (-> response
+                             (assoc :status 204)
+                             (assoc :body nil)
+                             (clear-auth-token-cookie)
+                             (clear-authenticated-cookie)))))))

-(defmethod ig/init-key ::tasks/gc
-  [_ {:keys [::db/pool ::tasks/max-age] :as cfg}]
+;; --- STATE INIT: SESSION GC
+
+(declare sql:delete-expired)
+
+(s/def ::max-age ::dt/duration)
+
+(defmethod ig/pre-init-spec ::gc-task [_]
+  (s/keys :req-un [::db/pool]
+          :opt-un [::max-age]))
+
+(defmethod ig/prep-key ::gc-task
+  [_ cfg]
+  (merge {:max-age default-cookie-max-age}
+         (d/without-nils cfg)))
+
+(defmethod ig/init-key ::gc-task
+  [_ {:keys [pool max-age] :as cfg}]
  (l/debug :hint "initializing session gc task" :max-age max-age)
  (fn [_]
    (db/with-atomic [conn pool]
@@ -366,3 +302,9 @@
                 :deleted result)
        result))))

+(def ^:private
+  sql:delete-expired
+  "delete from http_session
+    where updated_at < now() - ?::interval
+       or (updated_at is null and
+           created_at < now() - ?::interval)")
--- a/backend/src/app/http/websocket.clj
+++ b/backend/src/app/http/websocket.clj
@@ -12,7 +12,6 @@
   [app.common.pprint :as pp]
   [app.common.spec :as us]
   [app.db :as db]
-   [app.http.session :as session]
   [app.metrics :as mtx]
   [app.msgbus :as mbus]
   [app.util.time :as dt]
@@ -35,7 +34,7 @@
 (def state (atom {}))

 (defn- on-connect
-  [{:keys [::mtx/metrics]} wsp]
+  [{:keys [metrics]} wsp]
  (let [created-at (dt/now)]
    (swap! state assoc (::ws/id @wsp) wsp)
    (mtx/run! metrics
@@ -49,7 +48,7 @@
                :val (/ (inst-ms (dt/diff created-at (dt/now))) 1000.0)))))

 (defn- on-rcv-message
-  [{:keys [::mtx/metrics]} _ message]
+  [{:keys [metrics]} _ message]
  (mtx/run! metrics
            :id :websocket-messages-total
            :labels recv-labels
@@ -57,7 +56,7 @@
  message)

 (defn- on-snd-message
-  [{:keys [::mtx/metrics]} _ message]
+  [{:keys [metrics]} _ message]
  (mtx/run! metrics
            :id :websocket-messages-total
            :labels send-labels
@@ -96,6 +95,7 @@
     :user-agent       (::ws/user-agent @wsp)
     :ip-addr          (::ws/remote-addr @wsp)
     :last-activity-at (::ws/last-activity-at @wsp)
+     :http-session-id  (::ws/http-session-id @wsp)
     :subscribed-file  (-> wsp deref ::file-subscription :file-id)
     :subscribed-team  (-> wsp deref ::team-subscription :team-id)}))

@@ -120,7 +120,7 @@
 (defmethod handle-message :connect
  [cfg wsp _]

-  (let [msgbus     (::mbus/msgbus cfg)
+  (let [msgbus     (:msgbus cfg)
        conn-id    (::ws/id @wsp)
        profile-id (::profile-id @wsp)
        session-id (::session-id @wsp)
@@ -139,7 +139,7 @@

 (defmethod handle-message :disconnect
  [cfg wsp _]
-  (let [msgbus     (::mbus/msgbus cfg)
+  (let [msgbus     (:msgbus cfg)
        conn-id    (::ws/id @wsp)
        profile-id (::profile-id @wsp)
        session-id (::session-id @wsp)
@@ -173,7 +173,7 @@

 (defmethod handle-message :subscribe-team
  [cfg wsp {:keys [team-id] :as params}]
-  (let [msgbus     (::mbus/msgbus cfg)
+  (let [msgbus     (:msgbus cfg)
        conn-id    (::ws/id @wsp)
        session-id (::session-id @wsp)
        output-ch  (::ws/output-ch @wsp)
@@ -205,7 +205,7 @@

 (defmethod handle-message :subscribe-file
  [cfg wsp {:keys [file-id] :as params}]
-  (let [msgbus     (::mbus/msgbus cfg)
+  (let [msgbus     (:msgbus cfg)
        conn-id    (::ws/id @wsp)
        profile-id (::profile-id @wsp)
        session-id (::session-id @wsp)
@@ -258,7 +258,7 @@

 (defmethod handle-message :unsubscribe-file
  [cfg wsp {:keys [file-id] :as params}]
-  (let [msgbus     (::mbus/msgbus cfg)
+  (let [msgbus     (:msgbus cfg)
        conn-id    (::ws/id @wsp)
        session-id (::session-id @wsp)
        profile-id (::profile-id @wsp)
@@ -288,7 +288,7 @@

 (defmethod handle-message :pointer-update
  [cfg wsp {:keys [file-id] :as message}]
-  (let [msgbus     (::mbus/msgbus cfg)
+  (let [msgbus     (:msgbus cfg)
        profile-id (::profile-id @wsp)
        session-id (::session-id @wsp)
        subs       (::file-subscription @wsp)
@@ -313,47 +313,39 @@
 ;; HTTP HANDLER
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

+(s/def ::msgbus ::mbus/msgbus)
 (s/def ::session-id ::us/uuid)
+
 (s/def ::handler-params
  (s/keys :req-un [::session-id]))

-(defn- http-handler
-  [cfg {:keys [params ::session/profile-id] :as request} respond raise]
-  (let [{:keys [session-id]} (us/conform ::handler-params params)]
-    (cond
-      (not profile-id)
-      (raise (ex/error :type :authentication
-                       :hint "Authentication required."))
+(defmethod ig/pre-init-spec ::handler [_]
+  (s/keys :req-un [::msgbus ::db/pool ::mtx/metrics]))

-      (not (yws/upgrade-request? request))
-      (raise (ex/error :type :validation
-                       :code :websocket-request-expected
-                       :hint "this endpoint only accepts websocket connections"))
-
-      :else
-      (do
-        (l/trace :hint "websocket request" :profile-id profile-id :session-id session-id)
-
-        (->> (ws/handler
-              ::ws/on-rcv-message (partial on-rcv-message cfg)
-              ::ws/on-snd-message (partial on-snd-message cfg)
-              ::ws/on-connect (partial on-connect cfg)
-              ::ws/handler (partial handle-message cfg)
-              ::profile-id profile-id
-              ::session-id session-id)
-             (yws/upgrade request)
-             (respond))))))
-
-(defmethod ig/pre-init-spec ::routes [_]
-  (s/keys :req [::mbus/msgbus
-                ::mtx/metrics
-                ::db/pool
-                ::session/manager]))
-
-(s/def ::routes vector?)
-
-(defmethod ig/init-key ::routes
+(defmethod ig/init-key ::handler
  [_ cfg]
-  ["/ws/notifications" {:middleware [[session/authz cfg]]
-                        :handler (partial http-handler cfg)
-                        :allowed-methods #{:get}}])
+  (fn [{:keys [profile-id params] :as req} respond raise]
+    (let [{:keys [session-id]} (us/conform ::handler-params params)]
+      (cond
+        (not profile-id)
+        (raise (ex/error :type :authentication
+                         :hint "Authentication required."))
+
+        (not (yws/upgrade-request? req))
+        (raise (ex/error :type :validation
+                         :code :websocket-request-expected
+                         :hint "this endpoint only accepts websocket connections"))
+
+        :else
+        (do
+          (l/trace :hint "websocket request" :profile-id profile-id :session-id session-id)
+
+          (->> (ws/handler
+                ::ws/on-rcv-message (partial on-rcv-message cfg)
+                ::ws/on-snd-message (partial on-snd-message cfg)
+                ::ws/on-connect (partial on-connect cfg)
+                ::ws/handler (partial handle-message cfg)
+                ::profile-id profile-id
+                ::session-id session-id)
+               (yws/upgrade req)
+               (respond)))))))
--- a/backend/src/app/loggers/audit.clj
+++ b/backend/src/app/loggers/audit.clj
@@ -8,7 +8,6 @@
  "Services related to the user activity (audit log)."
  (:require
   [app.common.data :as d]
-   [app.common.data.macros :as dm]
   [app.common.exceptions :as ex]
   [app.common.logging :as l]
   [app.common.spec :as us]
@@ -16,27 +15,19 @@
   [app.common.uuid :as uuid]
   [app.config :as cf]
   [app.db :as db]
-   [app.http.client :as http]
-   [app.loggers.audit.tasks :as-alias tasks]
-   [app.loggers.webhooks :as-alias webhooks]
-   [app.main :as-alias main]
-   [app.metrics :as mtx]
-   [app.rpc :as-alias rpc]
   [app.tokens :as tokens]
-   [app.util.retry :as rtry]
+   [app.util.async :as aa]
   [app.util.time :as dt]
   [app.worker :as wrk]
+   [clojure.core.async :as a]
   [clojure.spec.alpha :as s]
   [cuerdas.core :as str]
   [integrant.core :as ig]
   [lambdaisland.uri :as u]
   [promesa.core :as p]
   [promesa.exec :as px]
-   [yetti.request :as yrq]))
-
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; HELPERS
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+   [yetti.request :as yrq]
+   [yetti.response :as yrs]))

 (defn parse-client-ip
  [request]
@@ -58,22 +49,10 @@
                (assoc (->> sk str/kebab (keyword "penpot")) v))))]
    (reduce-kv process-param {} params)))

-(def ^:private
-  profile-props
-  [:id
-   :is-active
-   :is-muted
-   :auth-backend
-   :email
-   :default-team-id
-   :default-project-id
-   :fullname
-   :lang])
-
 (defn profile->props
  [profile]
  (-> profile
-      (select-keys profile-props)
+      (select-keys [:id :is-active :is-muted :auth-backend :email :default-team-id :default-project-id :fullname :lang])
      (merge (:props profile))
      (d/without-nils)))

@@ -100,132 +79,180 @@

    (update event :props #(into {} xform %))))

-;; --- SPECS
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; HTTP Handler
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+(declare persist-http-events)

 (s/def ::profile-id ::us/uuid)
 (s/def ::name ::us/string)
 (s/def ::type ::us/string)
 (s/def ::props (s/map-of ::us/keyword any?))
-(s/def ::ip-addr ::us/string)
+(s/def ::timestamp dt/instant?)
+(s/def ::context (s/map-of ::us/keyword any?))

-(s/def ::webhooks/event? ::us/boolean)
-(s/def ::webhooks/batch-timeout ::dt/duration)
-(s/def ::webhooks/batch-key
-  (s/or :fn fn? :str string? :kw keyword?))
+(s/def ::frontend-event
+  (s/keys :req-un [::type ::name ::props ::timestamp ::profile-id]
+          :opt-un [::context]))

-(s/def ::event
-  (s/keys :req-un [::type ::name ::profile-id]
-          :opt-un [::ip-addr ::props]
-          :opt [::webhooks/event?
-                ::webhooks/batch-timeout
-                ::webhooks/batch-key]))
+(s/def ::frontend-events (s/every ::frontend-event))
+
+(defmethod ig/init-key ::http-handler
+  [_  {:keys [executor pool] :as cfg}]
+  (if (or (db/read-only? pool) (not (contains? cf/flags :audit-log)))
+    (do
+      (l/warn :hint "audit log http handler disabled or db is read-only")
+      (fn [_ respond _]
+        (respond (yrs/response 204))))
+
+    (letfn [(handler [{:keys [profile-id] :as request}]
+              (let [events  (->> (:events (:params request))
+                                 (remove #(not= profile-id (:profile-id %)))
+                                 (us/conform ::frontend-events))
+
+                    ip-addr (parse-client-ip request)
+                    cfg     (-> cfg
+                                (assoc :source "frontend")
+                                (assoc :events events)
+                                (assoc :ip-addr ip-addr))]
+                (persist-http-events cfg)))
+
+            (handle-error [cause]
+              (let [xdata (ex-data cause)]
+                (if (= :spec-validation (:code xdata))
+                  (l/error ::l/raw (str "spec validation on persist-events:\n" (us/pretty-explain xdata)))
+                  (l/error :hint "error on persist-events" :cause cause))))]
+
+      (fn [request respond _]
+        ;; Fire and forget, log error in case of error
+        (-> (px/submit! executor #(handler request))
+            (p/catch handle-error))
+
+        (respond (yrs/response 204))))))
+
+(defn- persist-http-events
+  [{:keys [pool events ip-addr source] :as cfg}]
+  (let [columns    [:id :name :source :type :tracked-at :profile-id :ip-addr :props :context]
+        prepare-xf (map (fn [event]
+                          [(uuid/next)
+                           (:name event)
+                           source
+                           (:type event)
+                           (:timestamp event)
+                           (:profile-id event)
+                           (db/inet ip-addr)
+                           (db/tjson (:props event))
+                           (db/tjson (d/without-nils (:context event)))]))]
+    (when (seq events)
+      (->> (into [] prepare-xf events)
+           (db/insert-multi! pool :audit-log columns)))))

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; COLLECTOR
+;; Collector
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

 ;; Defines a service that collects the audit/activity log using
 ;; internal database. Later this audit log can be transferred to
 ;; an external storage and data cleared.

-(s/def ::collector
-  (s/keys :req [::wrk/executor ::db/pool]))
+(declare persist-events)

 (defmethod ig/pre-init-spec ::collector [_]
-  (s/keys :req [::db/pool ::wrk/executor ::mtx/metrics]))
+  (s/keys :req-un [::db/pool ::wrk/executor]))
+
+(s/def ::ip-addr string?)
+(s/def ::backend-event
+  (s/keys :req-un [::type ::name ::profile-id]
+          :opt-un [::ip-addr ::props]))
+
+(def ^:private backend-event-xform
+  (comp
+   (filter #(us/valid? ::backend-event %))
+   (map clean-props)))

 (defmethod ig/init-key ::collector
-  [_ {:keys [::db/pool] :as cfg}]
+  [_ {:keys [pool] :as cfg}]
  (cond
+    (not (contains? cf/flags :audit-log))
+    (do
+      (l/info :hint "audit log collection disabled")
+      (constantly nil))
+
    (db/read-only? pool)
-    (l/warn :hint "audit: disabled (db is read-only)")
+    (do
+      (l/warn :hint "audit log collection disabled, db is read-only")
+      (constantly nil))

    :else
-    cfg))
+    (let [input  (a/chan 512 backend-event-xform)
+          buffer (aa/batch input {:max-batch-size 100
+                                  :max-batch-age (* 10 1000) ; 10s
+                                  :init []})]
+      (l/info :hint "audit log collector initialized")
+      (a/go-loop []
+        (when-let [[_type events] (a/<! buffer)]
+          (let [res (a/<! (persist-events cfg events))]
+            (when (ex/exception? res)
+              (l/error :hint "error on persisting events" :cause res))
+            (recur))))

-(defn- persist-event!
-  [pool event]
-  (us/verify! ::event event)
-  (let [params {:id (uuid/next)
-                :name (:name event)
-                :type (:type event)
-                :profile-id (:profile-id event)
-                :ip-addr (:ip-addr event)
-                :props (:props event)}]
+      (fn [& {:keys [cmd] :as params}]
+        (case cmd
+          :stop
+          (a/close! input)

-    (when (contains? cf/flags :audit-log)
-      ;; NOTE: this operation may cause primary key conflicts on inserts
-      ;; because of the timestamp precission (two concurrent requests), in
-      ;; this case we just retry the operation.
-      (rtry/with-retry {::rtry/when rtry/conflict-exception?
-                        ::rtry/max-retries 6
-                        ::rtry/label "persist-audit-log"}
-        (let [now (dt/now)]
-          (db/insert! pool :audit-log
-                      (-> params
-                          (update :props db/tjson)
-                          (update :ip-addr db/inet)
-                          (assoc :created-at now)
-                          (assoc :tracked-at now)
-                          (assoc :source "backend"))))))
+          :submit
+          (let [params (-> params
+                           (dissoc :cmd)
+                           (assoc :tracked-at (dt/now)))]
+            (when-not (a/offer! input params)
+              (l/warn :hint "activity channel is full"))))))))

-    (when (and (contains? cf/flags :webhooks)
-               (::webhooks/event? event))
-      (let [batch-key     (::webhooks/batch-key event)
-            batch-timeout (::webhooks/batch-timeout event)
-            label         (dm/str "rpc:" (:name params))
-            label         (cond
-                            (ifn? batch-key)    (dm/str label ":" (batch-key (::rpc/params event)))
-                            (string? batch-key) (dm/str label ":" batch-key)
-                            :else               label)
-            dedupe?       (boolean (and batch-key batch-timeout))]
-
-        (wrk/submit! ::wrk/conn pool
-                     ::wrk/task :process-webhook-event
-                     ::wrk/queue :webhooks
-                     ::wrk/max-retries 0
-                     ::wrk/delay (or batch-timeout 0)
-                     ::wrk/dedupe dedupe?
-                     ::wrk/label label
-
-                     ::webhooks/event
-                     (-> params
-                         (dissoc :ip-addr)
-                         (dissoc :type)))))))
-
-(defn submit!
-  "Submit audit event to the collector."
-  [{:keys [::wrk/executor ::db/pool] :as collector} params]
-  (us/assert! ::collector collector)
-  (->> (px/submit! executor (partial persist-event! pool (d/without-nils params)))
-       (p/merr (fn [cause]
-                 (l/error :hint "audit: unexpected error processing event" :cause cause)
-                 (p/resolved nil)))))
+(defn- persist-events
+  [{:keys [pool executor] :as cfg} events]
+  (letfn [(event->row [event]
+            [(uuid/next)
+             (:name event)
+             (:type event)
+             (:profile-id event)
+             (:tracked-at event)
+             (some-> (:ip-addr event) db/inet)
+             (db/tjson (:props event))
+             "backend"])]
+    (aa/with-thread executor
+      (when (seq events)
+        (db/with-atomic [conn pool]
+          (db/insert-multi! conn :audit-log
+                            [:id :name :type :profile-id :tracked-at :ip-addr :props :source]
+                            (sequence (keep event->row) events)))))))

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; TASK: ARCHIVE
+;; Archive Task
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

-;; This is a task responsible to send the accumulated events to
+;; This is a task responsible to send the accumulated events to an
 ;; external service for archival.

 (declare archive-events)

-(s/def ::tasks/uri ::us/string)
+(s/def ::http-client fn?)
+(s/def ::uri ::us/string)
+(s/def ::sprops map?)

-(defmethod ig/pre-init-spec ::tasks/archive-task [_]
-  (s/keys :req [::db/pool ::main/props ::http/client]))
+(defmethod ig/pre-init-spec ::archive-task [_]
+  (s/keys :req-un [::db/pool ::sprops ::http-client]
+          :opt-un [::uri]))

-(defmethod ig/init-key ::tasks/archive
-  [_ cfg]
-  (fn [params]
+(defmethod ig/init-key ::archive-task
+  [_ {:keys [uri] :as cfg}]
+  (fn [props]
    ;; NOTE: this let allows overwrite default configured values from
    ;; the repl, when manually invoking the task.
    (let [enabled (or (contains? cf/flags :audit-log-archive)
-                      (:enabled params false))
-          uri     (cf/get :audit-log-archive-uri)
-          uri     (or uri (:uri params))
-          cfg     (assoc cfg ::uri uri)]
+                      (:enabled props false))
+          uri     (or uri (:uri props))
+          cfg     (assoc cfg :uri uri)]

      (when (and enabled (not uri))
        (ex/raise :type :internal
@@ -237,21 +264,20 @@
          (let [n (archive-events cfg)]
            (if n
              (do
-                (px/sleep 100)
+                (aa/thread-sleep 100)
                (recur (+ total n)))
              (when (pos? total)
-                (l/debug :hint "events archived" :total total)))))))))
+                (l/trace :hint "events chunk archived" :num total)))))))))

-(def ^:private sql:retrieve-batch-of-audit-log
-  "select *
-     from audit_log
+(def sql:retrieve-batch-of-audit-log
+  "select * from audit_log
    where archived_at is null
    order by created_at asc
    limit 256
      for update skip locked;")

 (defn archive-events
-  [{:keys [::db/pool ::uri] :as cfg}]
+  [{:keys [pool uri sprops http-client] :as cfg}]
  (letfn [(decode-row [{:keys [props ip-addr context] :as row}]
            (cond-> row
              (db/pgobject? props)
@@ -275,10 +301,9 @@
                              :context]))

          (send [events]
-            (let [token   (tokens/generate (::main/props cfg)
-                                           {:iss "authentication"
-                                            :iat (dt/now)
-                                            :uid uuid/zero})
+            (let [token   (tokens/generate sprops {:iss "authentication"
+                                                   :iat (dt/now)
+                                                   :uid uuid/zero})
                  body    (t/encode {:events events})
                  headers {"content-type" "application/transit+json"
                           "origin" (cf/get :public-uri)
@@ -288,7 +313,7 @@
                           :method :post
                           :headers headers
                           :body body}
-                  resp    (http/req! cfg params {:sync? true})]
+                  resp    (http-client params {:sync? true})]
              (if (= (:status resp) 204)
                true
                (do
@@ -309,7 +334,7 @@
                         (map row->event))
            events (into [] xform rows)]
        (when-not (empty? events)
-          (l/trace :hint "archive events chunk" :uri uri :events (count events))
+          (l/debug :action "archive-events" :uri uri :events (count events))
          (when (send events)
            (mark-as-archived conn rows)
            (count events)))))))
@@ -318,7 +343,7 @@
 ;; GC Task
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

-(def ^:private sql:clean-archived
+(def sql:clean-archived
  "delete from audit_log
    where archived_at is not null")

@@ -329,10 +354,9 @@
    (l/debug :hint "delete archived audit log entries" :deleted result)
    result))

-(defmethod ig/pre-init-spec ::tasks/gc [_]
-  (s/keys :req [::db/pool]))
+(defmethod ig/pre-init-spec ::gc-task [_]
+  (s/keys :req-un [::db/pool]))

-(defmethod ig/init-key ::tasks/gc
+(defmethod ig/init-key ::gc-task
  [_ cfg]
-  (fn [_]
-    (clean-archived cfg)))
+  (partial clean-archived cfg))
--- a/backend/src/app/loggers/database.clj
+++ b/backend/src/app/loggers/database.clj
@@ -11,12 +11,12 @@
   [app.common.uuid :as uuid]
   [app.config :as cf]
   [app.db :as db]
-   [app.loggers.zmq :as lzmq]
+   [app.util.async :as aa]
+   [app.worker :as wrk]
   [clojure.core.async :as a]
   [clojure.spec.alpha :as s]
   [cuerdas.core :as str]
-   [integrant.core :as ig]
-   [promesa.exec :as px]))
+   [integrant.core :as ig]))

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Error Listener
@@ -27,7 +27,7 @@
 (defonce enabled (atom true))

 (defn- persist-on-database!
-  [{:keys [::db/pool] :as cfg} {:keys [id] :as event}]
+  [{:keys [pool] :as cfg} {:keys [id] :as event}]
  (when-not (db/read-only? pool)
    (db/insert! pool :server-error-report {:id id :content (db/tjson event)})))

@@ -53,49 +53,41 @@
      (assoc :version (:full cf/version))
      (update :id #(or % (uuid/next)))))

-(defn- handle-event
-  [cfg event]
-  (try
-    (let [event (parse-event event)
-          uri   (cf/get :public-uri)]
+(defn handle-event
+  [{:keys [executor] :as cfg} event]
+  (aa/with-thread executor
+    (try
+      (let [event (parse-event event)
+            uri   (cf/get :public-uri)]

-      (l/debug :hint "registering error on database" :id (:id event)
-               :uri (str uri "/dbg/error/" (:id event)))
+        (l/debug :hint "registering error on database" :id (:id event)
+                 :uri (str uri "/dbg/error/" (:id event)))

-      (persist-on-database! cfg event))
-    (catch Throwable cause
-      (l/warn :hint "unexpected exception on database error logger" :cause cause))))
+        (persist-on-database! cfg event))
+      (catch Exception cause
+        (l/warn :hint "unexpected exception on database error logger" :cause cause)))))

-(defn- error-event?
+(defmethod ig/pre-init-spec ::reporter [_]
+  (s/keys :req-un [::wrk/executor ::db/pool ::receiver]))
+
+(defn error-event?
  [event]
  (= "error" (:logger/level event)))

-(defmethod ig/pre-init-spec ::reporter [_]
-  (s/keys :req [::db/pool ::lzmq/receiver]))
-
 (defmethod ig/init-key ::reporter
-  [_ {:keys [::lzmq/receiver] :as cfg}]
-  (px/thread
-    {:name "penpot/database-reporter"}
-    (l/info :hint "initializing database error persistence")
-
-    (let [input (a/chan (a/sliding-buffer 5)
-                        (filter error-event?))]
-      (try
-        (lzmq/sub! receiver input)
-        (loop []
-          (when-let [msg (a/<!! input)]
-            (handle-event cfg msg))
-          (recur))
-
-        (catch InterruptedException _
-          (l/debug :hint "reporter interrupted"))
-        (catch Throwable cause
-          (l/error :hint "unexpected error" :cause cause))
-        (finally
-          (a/close! input)
-          (l/info :hint "reporter terminated"))))))
+  [_ {:keys [receiver] :as cfg}]
+  (l/info :msg "initializing database error persistence")
+  (let [output (a/chan (a/sliding-buffer 5) (filter error-event?))]
+    (receiver :sub output)
+    (a/go-loop []
+      (let [msg (a/<! output)]
+        (if (nil? msg)
+          (l/info :msg "stopping error reporting loop")
+          (do
+            (a/<! (handle-event cfg msg))
+            (recur)))))
+    output))

 (defmethod ig/halt-key! ::reporter
-  [_ thread]
-  (some-> thread px/interrupt!))
+  [_ output]
+  (a/close! output))
--- a/backend/src/app/loggers/loki.clj
+++ b/backend/src/app/loggers/loki.clj
@@ -8,55 +8,58 @@
  "A Loki integration."
  (:require
   [app.common.logging :as l]
-   [app.config :as cf]
-   [app.http.client :as http]
-   [app.loggers.zmq :as lzmq]
+   [app.common.spec :as us]
+   [app.config :as cfg]
   [app.util.json :as json]
   [clojure.core.async :as a]
   [clojure.spec.alpha :as s]
-   [integrant.core :as ig]
-   [promesa.exec :as px]))
+   [integrant.core :as ig]))

 (declare ^:private handle-event)
+(declare ^:private start-rcv-loop)
+
+(s/def ::uri ::us/string)
+(s/def ::receiver fn?)
+(s/def ::http-client fn?)

 (defmethod ig/pre-init-spec ::reporter [_]
-  (s/keys :req [::http/client
-                ::lzmq/receiver]))
+  (s/keys :req-un [ ::receiver ::http-client]
+          :opt-un [::uri]))

 (defmethod ig/init-key ::reporter
-  [_ cfg]
-  (when-let [uri (cf/get :loggers-loki-uri)]
-    (px/thread
-      {:name "penpot/loki-reporter"}
-      (l/info :hint "reporter started" :uri uri)
-      (let [input (a/chan (a/dropping-buffer 2048))
-            cfg   (assoc cfg ::uri uri)]
+  [_ {:keys [receiver uri] :as cfg}]
+  (when uri
+    (l/info :msg "initializing loki reporter" :uri uri)
+    (let [input (a/chan (a/dropping-buffer 2048))]
+      (receiver :sub input)

-        (try
-          (lzmq/sub! (::lzmq/receiver cfg) input)
-          (loop []
-            (when-let [msg (a/<!! input)]
-              (handle-event cfg msg)
-              (recur)))
+      (doto (Thread. #(start-rcv-loop cfg input))
+        (.setDaemon true)
+        (.setName "penpot/loki-sender")
+        (.start))

-          (catch InterruptedException _
-            (l/debug :hint "reporter interrupted"))
-          (catch Throwable cause
-            (l/error :hint "unexpected exception"
-                     :cause cause))
-          (finally
-            (a/close! input)
-            (l/info :hint "reporter terminated")))))))
+      input)))

 (defmethod ig/halt-key! ::reporter
-  [_ thread]
-  (some-> thread px/interrupt!))
+  [_ output]
+  (when output
+    (a/close! output)))
+
+(defn- start-rcv-loop
+  [cfg input]
+  (loop []
+    (let [msg (a/<!! input)]
+      (when-not (nil? msg)
+        (handle-event cfg msg)
+        (recur))))
+
+  (l/info :msg "stopping error reporting loop"))

 (defn- prepare-payload
  [event]
-  (let [labels {:host    (cf/get :host)
-                :tenant  (cf/get :tenant)
-                :version (:full cf/version)
+  (let [labels {:host    (cfg/get :host)
+                :tenant  (cfg/get :tenant)
+                :version (:full cfg/version)
                :logger  (:logger/name event)
                :level   (:logger/level event)}]
    {:streams
@@ -66,15 +69,15 @@
                      (when-let [error (:trace event)]
                        (str "\n" error)))]]}]}))

+
 (defn- make-request
-  [{:keys [::uri] :as cfg} payload]
-  (http/req! cfg
-             {:uri uri
-              :timeout 3000
-              :method :post
-              :headers {"content-type" "application/json"}
-              :body (json/encode payload)}
-             {:sync? true}))
+  [{:keys [http-client uri] :as cfg} payload]
+  (http-client {:uri uri
+                :timeout 3000
+                :method :post
+                :headers {"content-type" "application/json"}
+                :body (json/write payload)}
+               {:sync? true}))

 (defn- handle-event
  [cfg event]
@@ -82,6 +85,7 @@
    (let [payload  (prepare-payload event)
          response (make-request cfg payload)]
      (when-not (= 204 (:status response))
+        (map? response)
        (l/error :hint "error on sending log to loki (unexpected response)"
                 :response (pr-str response))))
    (catch Throwable cause
--- a/backend/src/app/loggers/mattermost.clj
+++ b/backend/src/app/loggers/mattermost.clj
@@ -9,69 +9,67 @@
  (:require
   [app.common.logging :as l]
   [app.config :as cf]
-   [app.http.client :as http]
   [app.loggers.database :as ldb]
-   [app.loggers.zmq :as lzmq]
   [app.util.json :as json]
   [clojure.core.async :as a]
   [clojure.spec.alpha :as s]
   [integrant.core :as ig]
-   [promesa.exec :as px]))
+   [promesa.core :as p]))

 (defonce enabled (atom true))

 (defn- send-mattermost-notification!
-  [cfg {:keys [host id public-uri] :as event}]
-  (let [text (str "Exception on (host: " host ", url: " public-uri "/dbg/error/" id ")\n"
-             (when-let [pid (:profile-id event)]
-               (str "- profile-id: #uuid-" pid "\n")))
-        resp (http/req! cfg
-                        {:uri (cf/get :error-report-webhook)
-                         :method :post
-                         :headers {"content-type" "application/json"}
-                         :body (json/encode-str {:text text})}
-                        {:sync? true})]
-
-    (when (not= 200 (:status resp))
-      (l/warn :hint "error on sending data"
-              :response (pr-str resp)))))
+  [{:keys [http-client] :as cfg} {:keys [host id public-uri] :as event}]
+  (let [uri  (:uri cfg)
+        text (str "Exception on (host: " host ", url: " public-uri "/dbg/error/" id ")\n"
+                  (when-let [pid (:profile-id event)]
+                    (str "- profile-id: #uuid-" pid "\n")))]
+    (p/then
+     (http-client {:uri uri
+                   :method :post
+                   :headers {"content-type" "application/json"}
+                   :body (json/write-str {:text text})})
+     (fn [{:keys [status] :as rsp}]
+       (when (not= status 200)
+         (l/warn :hint "error on sending data to mattermost"
+                 :response (pr-str rsp)))))))

 (defn handle-event
  [cfg event]
-  (when @enabled
-    (try
-      (let [event (ldb/parse-event event)]
-        (send-mattermost-notification! cfg event))
-      (catch Throwable cause
-        (l/warn :hint "unhandled error"
-                :cause cause)))))
+  (let [ch (a/chan)]
+    (-> (p/let [event (ldb/parse-event event)]
+          (send-mattermost-notification! cfg event))
+        (p/finally (fn [_ cause]
+                     (when cause
+                       (l/warn :hint "unexpected exception on error reporter" :cause cause))
+                     (a/close! ch))))
+    ch))
+
+(s/def ::http-client fn?)
+(s/def ::uri ::cf/error-report-webhook)

 (defmethod ig/pre-init-spec ::reporter [_]
-  (s/keys :req [::http/client
-                ::lzmq/receiver]))
+  (s/keys :req-un [::http-client ::receiver]
+          :opt-un [::uri]))

 (defmethod ig/init-key ::reporter
-  [_ cfg]
-  (when-let [uri (cf/get :error-report-webhook)]
-    (px/thread
-      {:name "penpot/mattermost-reporter"}
-      (l/info :msg "initializing error reporter" :uri uri)
-      (let [input (a/chan (a/sliding-buffer 128)
-                          (filter #(= (:logger/level %) "error")))]
-        (try
-          (lzmq/sub! (::lzmq/receiver cfg) input)
-          (loop []
-            (when-let [msg (a/<!! input)]
-              (handle-event cfg msg)
-              (recur)))
-          (catch InterruptedException _
-            (l/debug :hint "reporter interrupted"))
-          (catch Throwable cause
-            (l/error :hint "unexpected error" :cause cause))
-          (finally
-            (a/close! input)
-            (l/info :hint "reporter terminated")))))))
+  [_ {:keys [receiver uri] :as cfg}]
+  (when uri
+    (l/info :msg "initializing mattermost error reporter" :uri uri)
+    (let [output (a/chan (a/sliding-buffer 128)
+                         (filter (fn [event]
+                                   (= (:logger/level event) "error"))))]
+      (receiver :sub output)
+      (a/go-loop []
+        (let [msg (a/<! output)]
+          (if (nil? msg)
+            (l/info :msg "stopping error reporting loop")
+            (do
+              (a/<! (handle-event cfg msg))
+              (recur)))))
+      output)))

 (defmethod ig/halt-key! ::reporter
-  [_ thread]
-  (some-> thread px/interrupt!))
+  [_ output]
+  (when output
+    (a/close! output)))
--- a/backend/src/app/loggers/webhooks.clj
+++ b/backend/src/app/loggers/webhooks.clj
@@ -1,186 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC
-
-(ns app.loggers.webhooks
-  "A mattermost integration for error reporting."
-  (:require
-   [app.common.data :as d]
-   [app.common.data.macros :as dm]
-   [app.common.logging :as l]
-   [app.common.transit :as t]
-   [app.common.uri :as uri]
-   [app.config :as cf]
-   [app.db :as db]
-   [app.http.client :as http]
-   [app.util.json :as json]
-   [app.util.time :as dt]
-   [app.worker :as wrk]
-   [clojure.spec.alpha :as s]
-   [cuerdas.core :as str]
-   [integrant.core :as ig]))
-
-;; --- HELPERS
-
-(defn key-fn
-  [k & keys]
-  (fn [params]
-    (reduce #(dm/str %1 ":" (get params %2))
-            (dm/str (get params k))
-            keys)))
-
-;; --- PROC
-
-(defn- lookup-webhooks-by-team
-  [pool team-id]
-  (db/exec! pool ["select w.* from webhook as w where team_id=? and is_active=true" team-id]))
-
-(defn- lookup-webhooks-by-project
-  [pool project-id]
-  (let [sql [(str "select w.* from webhook as w"
-                  "  join project as p on (p.team_id = w.team_id)"
-                  " where p.id = ? and w.is_active = true")
-             project-id]]
-    (db/exec! pool sql)))
-
-(defn- lookup-webhooks-by-file
-  [pool file-id]
-  (let [sql [(str "select w.* from webhook as w"
-                  "  join project as p on (p.team_id = w.team_id)"
-                  "  join file as f on (f.project_id = p.id)"
-                  " where f.id = ? and w.is_active = true")
-             file-id]]
-    (db/exec! pool sql)))
-
-(defn- lookup-webhooks
-  [{:keys [::db/pool]} {:keys [props] :as event}]
-  (or (some->> (:team-id props) (lookup-webhooks-by-team pool))
-      (some->> (:project-id props) (lookup-webhooks-by-project pool))
-      (some->> (:file-id props) (lookup-webhooks-by-file pool))))
-
-(defmethod ig/pre-init-spec ::process-event-handler [_]
-  (s/keys :req [::db/pool]))
-
-(defmethod ig/init-key ::process-event-handler
-  [_ {:keys [::db/pool] :as cfg}]
-  (fn [{:keys [props] :as task}]
-    (let [event (::event props)]
-
-      (l/debug :hint "process webhook event"
-               :name (:name event))
-
-      (when-let [items (lookup-webhooks cfg event)]
-        (l/trace :hint "webhooks found for event" :total (count items))
-
-        (db/with-atomic [conn pool]
-          (doseq [item items]
-            (wrk/submit! ::wrk/conn conn
-                         ::wrk/task :run-webhook
-                         ::wrk/queue :webhooks
-                         ::wrk/max-retries 3
-                         ::event event
-                         ::config item)))))))
-
-;; --- RUN
-
-(declare interpret-exception)
-(declare interpret-response)
-
-(def ^:private json-mapper
-  (json/mapper
-   {:encode-key-fn str/camel
-    :decode-key-fn (comp keyword str/kebab)
-    :pretty true}))
-
-(defmethod ig/pre-init-spec ::run-webhook-handler [_]
-  (s/keys :req [::http/client ::db/pool]))
-
-(defmethod ig/prep-key ::run-webhook-handler
-  [_ cfg]
-  (merge {::max-errors 3} (d/without-nils cfg)))
-
-(defmethod ig/init-key ::run-webhook-handler
-  [_ {:keys [::db/pool ::max-errors] :as cfg}]
-  (letfn [(update-webhook! [whook err]
-            (if err
-              (let [sql [(str "update webhook "
-                              "   set error_code=?, "
-                              "       error_count=error_count+1 "
-                              " where id=?")
-                         err
-                         (:id whook)]
-                    res (db/exec-one! pool sql {::db/return-keys? true})]
-                (when (>= (:error-count res) max-errors)
-                  (db/update! pool :webhook {:is-active false} {:id (:id whook)})))
-
-              (db/update! pool :webhook
-                          {:updated-at (dt/now)
-                           :error-code nil
-                           :error-count 0}
-                          {:id (:id whook)})))
-
-          (report-delivery! [whook req rsp err]
-            (db/insert! pool :webhook-delivery
-                        {:webhook-id (:id whook)
-                         :created-at (dt/now)
-                         :error-code err
-                         :req-data (db/tjson req)
-                         :rsp-data (db/tjson rsp)}))]
-
-    (fn [{:keys [props] :as task}]
-      (let [event (::event props)
-            whook (::config props)
-
-            body  (case (:mtype whook)
-                    "application/json" (json/encode-str event json-mapper)
-                    "application/transit+json" (t/encode-str event)
-                    "application/x-www-form-urlencoded" (uri/map->query-string event))]
-
-        (l/debug :hint "run webhook"
-                 :event-name (:name event)
-                 :webhook-id (:id whook)
-                 :webhook-uri (:uri whook)
-                 :webhook-mtype (:mtype whook))
-
-        (let [req {:uri (:uri whook)
-                   :headers {"content-type" (:mtype whook)
-                             "user-agent" (str/ffmt "penpot/%" (:main cf/version))}
-                   :timeout (dt/duration "4s")
-                   :method :post
-                   :body body}]
-          (try
-            (let [rsp (http/req! cfg req {:response-type :input-stream :sync? true})
-                  err (interpret-response rsp)]
-              (report-delivery! whook req rsp err)
-              (update-webhook! whook err))
-            (catch Throwable cause
-              (let [err (interpret-exception cause)]
-                (report-delivery! whook req nil err)
-                (update-webhook! whook err)
-                (when (= err "unknown")
-                  (l/error :hint "unknown error on webhook request"
-                           :cause cause))))))))))
-
-(defn interpret-response
-  [{:keys [status] :as response}]
-  (when-not (or (= 200 status)
-                (= 204 status))
-    (str/ffmt "unexpected-status:%" status)))
-
-(defn interpret-exception
-  [cause]
-  (cond
-    (instance? javax.net.ssl.SSLHandshakeException cause)
-    "ssl-validation-error"
-
-    (instance? java.net.ConnectException cause)
-    "connection-error"
-
-    (instance? java.lang.IllegalArgumentException cause)
-    "invalid-uri"
-
-    (instance? java.net.http.HttpConnectTimeoutException cause)
-    "timeout"
-    ))
--- a/backend/src/app/loggers/zmq.clj
+++ b/backend/src/app/loggers/zmq.clj
@@ -9,15 +9,13 @@
  (:require
   [app.common.exceptions :as ex]
   [app.common.logging :as l]
-   [app.config :as cf]
-   [app.loggers.zmq.receiver :as-alias receiver]
+   [app.common.spec :as us]
   [app.util.json :as json]
   [app.util.time :as dt]
   [clojure.core.async :as a]
   [clojure.spec.alpha :as s]
   [cuerdas.core :as str]
-   [integrant.core :as ig]
-   [promesa.exec :as px])
+   [integrant.core :as ig])
  (:import
   org.zeromq.SocketType
   org.zeromq.ZMQ$Socket
@@ -26,56 +24,38 @@
 (declare prepare)
 (declare start-rcv-loop)

+(s/def ::endpoint ::us/string)
+
+(defmethod ig/pre-init-spec ::receiver [_]
+  (s/keys :opt-un [::endpoint]))
+
 (defmethod ig/init-key ::receiver
-  [_ cfg]
-  (let [uri    (cf/get :loggers-zmq-uri)
-        buffer (a/chan 1)
+  [_ {:keys [endpoint] :as cfg}]
+  (l/info :msg "initializing ZMQ receiver" :bind endpoint)
+  (let [buffer (a/chan 1)
        output (a/chan 1 (comp (filter map?)
                               (keep prepare)))
-        mult   (a/mult output)
-        thread (when uri
-                 (px/thread
-                   {:name "penpot/zmq-receiver"
-                    :daemon false}
-                   (l/info :hint "receiver started")
-                   (try
-                     (start-rcv-loop buffer uri)
-                     (catch InterruptedException _
-                       (l/debug :hint "receiver interrupted"))
-                     (catch java.lang.IllegalStateException cause
-                       (if (= "errno 4" (ex-message cause))
-                         (l/debug :hint "receiver interrupted")
-                         (l/error :hint "unhandled error" :cause cause)))
-                     (catch Throwable cause
-                       (l/error :hint "unhandled error" :cause cause))
-                     (finally
-                       (l/info :hint "receiver terminated")))))]
+        mult   (a/mult output)]
+    (when endpoint
+      (let [thread (Thread. #(start-rcv-loop {:out buffer :endpoint endpoint}))]
+        (.setDaemon thread false)
+        (.setName thread "penpot/zmq-logger-receiver")
+        (.start thread)))

    (a/pipe buffer output)
-    (-> cfg
-        (assoc ::receiver/mult mult)
-        (assoc ::receiver/thread thread)
-        (assoc ::receiver/output output)
-        (assoc ::receiver/buffer buffer))))
-
-(s/def ::receiver/mult some?)
-(s/def ::receiver/thread #(instance? Thread %))
-(s/def ::receiver/output some?)
-(s/def ::receiver/buffer some?)
-(s/def ::receiver
-  (s/keys :req [::receiver/mult
-                ::receiver/thread
-                ::receiver/output
-                ::receiver/buffer]))
-
-(defn sub!
-  [{:keys [::receiver/mult]} ch]
-  (a/tap mult ch))
+    (with-meta
+      (fn [cmd ch]
+        (case cmd
+          :sub (a/tap mult ch)
+          :unsub (a/untap mult ch))
+        ch)
+      {::output output
+       ::buffer buffer
+       ::mult mult})))

 (defmethod ig/halt-key! ::receiver
-  [_ {:keys [::receiver/buffer ::receiver/thread]}]
-  (some-> thread px/interrupt!)
-  (some-> buffer a/close!))
+  [_ f]
+  (a/close! (::buffer (meta f))))

 (def ^:private json-mapper
  (json/mapper
@@ -83,23 +63,23 @@
    :decode-key-fn (comp keyword str/kebab)}))

 (defn- start-rcv-loop
-  [output endpoint]
-  (let [zctx   (ZContext. 1)
-        socket (.. zctx (createSocket SocketType/SUB))]
-    (try
-      (.. socket (connect ^String endpoint))
-      (.. socket (subscribe ""))
-      (.. socket (setReceiveTimeOut 5000))
-      (loop []
-        (let [msg (.recv ^ZMQ$Socket socket)
-              msg (ex/ignoring (json/decode msg json-mapper))
-              msg (if (nil? msg) :empty msg)]
-          (when (a/>!! output msg)
-            (recur))))
-
-      (finally
-        (.close ^java.lang.AutoCloseable socket)
-        (.destroy ^ZContext zctx)))))
+  ([] (start-rcv-loop nil))
+  ([{:keys [out endpoint] :or {endpoint "tcp://localhost:5556"}}]
+   (let [out    (or out (a/chan 1))
+         zctx   (ZContext. 1)
+         socket (.. zctx (createSocket SocketType/SUB))]
+     (.. socket (connect ^String endpoint))
+     (.. socket (subscribe ""))
+     (.. socket (setReceiveTimeOut 5000))
+     (loop []
+       (let [msg (.recv ^ZMQ$Socket socket)
+             msg (ex/ignoring (json/read msg json-mapper))
+             msg (if (nil? msg) :empty msg)]
+         (if (a/>!! out msg)
+           (recur)
+           (do
+             (.close ^java.lang.AutoCloseable socket)
+             (.destroy ^ZContext zctx))))))))

 (s/def ::logger-name string?)
 (s/def ::level string?)
--- a/backend/src/app/main.clj
+++ b/backend/src/app/main.clj
@@ -6,250 +6,108 @@

 (ns app.main
  (:require
-   [app.auth.ldap :as-alias ldap]
-   [app.auth.oidc :as-alias oidc]
-   [app.auth.oidc.providers :as-alias oidc.providers]
+   [app.auth.oidc]
   [app.common.logging :as l]
   [app.config :as cf]
-   [app.db :as-alias db]
-   [app.http.access-token :as-alias actoken]
-   [app.http.assets :as-alias http.assets]
-   [app.http.awsns :as http.awsns]
-   [app.http.client :as-alias http.client]
-   [app.http.debug :as-alias http.debug]
-   [app.http.session :as-alias session]
-   [app.http.session.tasks :as-alias session.tasks]
-   [app.http.websocket :as http.ws]
-   [app.loggers.audit :as-alias audit]
-   [app.loggers.audit.tasks :as-alias audit.tasks]
-   [app.loggers.webhooks :as-alias webhooks]
-   [app.loggers.zmq :as-alias lzmq]
-   [app.metrics :as-alias mtx]
-   [app.metrics.definition :as-alias mdef]
-   [app.msgbus :as-alias mbus]
-   [app.redis :as-alias rds]
-   [app.rpc :as-alias rpc]
-   [app.rpc.doc :as-alias rpc.doc]
-   [app.srepl :as-alias srepl]
-   [app.storage :as-alias sto]
   [app.util.time :as dt]
-   [app.worker :as-alias wrk]
   [cuerdas.core :as str]
   [integrant.core :as ig])
  (:gen-class))

-(def default-metrics
-  {:update-file-changes
-   {::mdef/name "penpot_rpc_update_file_changes_total"
-    ::mdef/help "A total number of changes submitted to update-file."
-    ::mdef/type :counter}
-
-   :update-file-bytes-processed
-   {::mdef/name "penpot_rpc_update_file_bytes_processed_total"
-    ::mdef/help "A total number of bytes processed by update-file."
-    ::mdef/type :counter}
-
-   :rpc-mutation-timing
-   {::mdef/name "penpot_rpc_mutation_timing"
-    ::mdef/help "RPC mutation method call timing."
-    ::mdef/labels ["name"]
-    ::mdef/type :histogram}
-
-   :rpc-command-timing
-   {::mdef/name "penpot_rpc_command_timing"
-    ::mdef/help "RPC command method call timing."
-    ::mdef/labels ["name"]
-    ::mdef/type :histogram}
-
-   :rpc-query-timing
-   {::mdef/name "penpot_rpc_query_timing"
-    ::mdef/help "RPC query method call timing."
-    ::mdef/labels ["name"]
-    ::mdef/type :histogram}
-
-   :websocket-active-connections
-   {::mdef/name "penpot_websocket_active_connections"
-    ::mdef/help "Active websocket connections gauge"
-    ::mdef/type :gauge}
-
-   :websocket-messages-total
-   {::mdef/name "penpot_websocket_message_total"
-    ::mdef/help "Counter of processed messages."
-    ::mdef/labels ["op"]
-    ::mdef/type :counter}
-
-   :websocket-session-timing
-   {::mdef/name "penpot_websocket_session_timing"
-    ::mdef/help "Websocket session timing (seconds)."
-    ::mdef/type :summary}
-
-   :session-update-total
-   {::mdef/name "penpot_http_session_update_total"
-    ::mdef/help "A counter of session update batch events."
-    ::mdef/type :counter}
-
-   :tasks-timing
-   {::mdef/name "penpot_tasks_timing"
-    ::mdef/help "Background tasks timing (milliseconds)."
-    ::mdef/labels ["name"]
-    ::mdef/type :summary}
-
-   :redis-eval-timing
-   {::mdef/name "penpot_redis_eval_timing"
-    ::mdef/help "Redis EVAL commands execution timings (ms)"
-    ::mdef/labels ["name"]
-    ::mdef/type :summary}
-
-   :rpc-climit-queue-size
-   {::mdef/name "penpot_rpc_climit_queue_size"
-    ::mdef/help "Current number of queued submissions on the CLIMIT."
-    ::mdef/labels ["name"]
-    ::mdef/type :gauge}
-
-   :rpc-climit-concurrency
-   {::mdef/name "penpot_rpc_climit_concurrency"
-    ::mdef/help "Current number of used concurrency capacity on the CLIMIT"
-    ::mdef/labels ["name"]
-    ::mdef/type :gauge}
-
-   :rpc-climit-timing
-   {::mdef/name "penpot_rpc_climit_timing"
-    ::mdef/help "Summary of the time between queuing and executing on the CLIMIT"
-    ::mdef/labels ["name"]
-    ::mdef/type :summary}
-
-   :audit-http-handler-queue-size
-   {::mdef/name "penpot_audit_http_handler_queue_size"
-    ::mdef/help "Current number of queued submissions on the audit log http handler"
-    ::mdef/labels []
-    ::mdef/type :gauge}
-
-   :audit-http-handler-concurrency
-   {::mdef/name "penpot_audit_http_handler_concurrency"
-    ::mdef/help "Current number of used concurrency capacity on the audit log http handler"
-    ::mdef/labels []
-    ::mdef/type :gauge}
-
-   :audit-http-handler-timing
-   {::mdef/name "penpot_audit_http_handler_timing"
-    ::mdef/help "Summary of the time between queuing and executing on the audit log http handler"
-    ::mdef/labels []
-    ::mdef/type :summary}
-
-   :executors-active-threads
-   {::mdef/name "penpot_executors_active_threads"
-    ::mdef/help "Current number of threads available in the executor service."
-    ::mdef/labels ["name"]
-    ::mdef/type :gauge}
-
-   :executors-completed-tasks
-   {::mdef/name "penpot_executors_completed_tasks_total"
-    ::mdef/help "Approximate number of completed tasks by the executor."
-    ::mdef/labels ["name"]
-    ::mdef/type :counter}
-
-   :executors-running-threads
-   {::mdef/name "penpot_executors_running_threads"
-    ::mdef/help "Current number of threads with state RUNNING."
-    ::mdef/labels ["name"]
-    ::mdef/type :gauge}
-
-   :executors-queued-submissions
-   {::mdef/name "penpot_executors_queued_submissions"
-    ::mdef/help "Current number of queued submissions."
-    ::mdef/labels ["name"]
-    ::mdef/type :gauge}})
-
 (def system-config
-  {::db/pool
+  {:app.db/pool
   {:uri        (cf/get :database-uri)
    :username   (cf/get :database-username)
    :password   (cf/get :database-password)
    :read-only  (cf/get :database-readonly false)
-    :metrics    (ig/ref ::mtx/metrics)
+    :metrics    (ig/ref :app.metrics/metrics)
    :migrations (ig/ref :app.migrations/all)
    :name       :main
    :min-size   (cf/get :database-min-pool-size 0)
    :max-size   (cf/get :database-max-pool-size 60)}

   ;; Default thread pool for IO operations
-   ::wrk/executor
-   {::wrk/parallelism (cf/get :default-executor-parallelism 100)}
+   [::default :app.worker/executor]
+   {:parallelism (cf/get :default-executor-parallelism 70)}

-   ::wrk/scheduled-executor
-   {::wrk/parallelism (cf/get :scheduled-executor-parallelism 20)}
+   ;; Dedicated thread pool for background tasks execution.
+   [::worker :app.worker/executor]
+   {:parallelism (cf/get :worker-executor-parallelism 20)}

-   ::wrk/monitor
-   {::mtx/metrics  (ig/ref ::mtx/metrics)
-    ::wrk/name     "default"
-    ::wrk/executor (ig/ref ::wrk/executor)}
+   :app.worker/scheduler
+   {:parallelism 1
+    :prefix :scheduler}
+
+   :app.worker/executors
+   {:default (ig/ref [::default :app.worker/executor])
+    :worker  (ig/ref [::worker :app.worker/executor])}
+
+   :app.worker/executor-monitor
+   {:metrics   (ig/ref :app.metrics/metrics)
+    :executors (ig/ref :app.worker/executors)}

   :app.migrations/migrations
   {}

-   ::mtx/metrics
-   {:default default-metrics}
-
-   ::mtx/routes
-   {::mtx/metrics (ig/ref ::mtx/metrics)}
+   :app.metrics/metrics
+   {}

   :app.migrations/all
   {:main (ig/ref :app.migrations/migrations)}

-   ::rds/redis
-   {::rds/uri     (cf/get :redis-uri)
-    ::mtx/metrics (ig/ref ::mtx/metrics)}
+   :app.redis/redis
+   {:uri     (cf/get :redis-uri)
+    :metrics (ig/ref :app.metrics/metrics)}

-   ::mbus/msgbus
+   :app.msgbus/msgbus
   {:backend   (cf/get :msgbus-backend :redis)
-    :executor  (ig/ref ::wrk/executor)
-    :redis     (ig/ref ::rds/redis)}
+    :executor  (ig/ref [::default :app.worker/executor])
+    :redis     (ig/ref :app.redis/redis)}

   :app.storage.tmp/cleaner
-   {::wrk/executor (ig/ref ::wrk/executor)
-    ::wrk/scheduled-executor (ig/ref ::wrk/scheduled-executor)}
+   {:executor (ig/ref [::worker :app.worker/executor])
+    :scheduler (ig/ref :app.worker/scheduler)}

-   ::sto/gc-deleted-task
-   {:pool     (ig/ref ::db/pool)
-    :storage  (ig/ref ::sto/storage)
-    :executor (ig/ref ::wrk/executor)}
+   :app.storage/gc-deleted-task
+   {:pool     (ig/ref :app.db/pool)
+    :storage  (ig/ref :app.storage/storage)
+    :executor (ig/ref [::worker :app.worker/executor])}

-   ::sto/gc-touched-task
-   {:pool (ig/ref ::db/pool)}
+   :app.storage/gc-touched-task
+   {:pool (ig/ref :app.db/pool)}

-   ::http.client/client
-   {::wrk/executor (ig/ref ::wrk/executor)}
+   :app.http/client
+   {:executor (ig/ref [::default :app.worker/executor])}

-   ::session/manager
-   {::db/pool      (ig/ref ::db/pool)
-    ::wrk/executor (ig/ref ::wrk/executor)
-    ::props        (ig/ref :app.setup/props)}
+   :app.http/session
+   {:store (ig/ref :app.http.session/store)}

-   ::actoken/manager
-   {::db/pool      (ig/ref ::db/pool)
-    ::wrk/executor (ig/ref ::wrk/executor)
-    ::props        (ig/ref :app.setup/props)}
+   :app.http.session/store
+   {:pool     (ig/ref :app.db/pool)
+    :sprops   (ig/ref :app.setup/props)
+    :executor (ig/ref [::default :app.worker/executor])}

-   ::session.tasks/gc
-   {::db/pool (ig/ref ::db/pool)}
+   :app.http.session/gc-task
+   {:pool        (ig/ref :app.db/pool)
+    :max-age     (cf/get :auth-token-cookie-max-age)}

-   ::http.awsns/routes
-   {::props              (ig/ref :app.setup/props)
-    ::db/pool            (ig/ref ::db/pool)
-    ::http.client/client (ig/ref ::http.client/client)
-    ::wrk/executor       (ig/ref ::wrk/executor)}
+   :app.http.awsns/handler
+   {:sprops      (ig/ref :app.setup/props)
+    :pool        (ig/ref :app.db/pool)
+    :http-client (ig/ref :app.http/client)
+    :executor    (ig/ref [::worker :app.worker/executor])}

   :app.http/server
   {:port        (cf/get :http-server-port)
    :host        (cf/get :http-server-host)
    :router      (ig/ref :app.http/router)
-    :metrics     (ig/ref ::mtx/metrics)
-    :executor    (ig/ref ::wrk/executor)
+    :metrics     (ig/ref :app.metrics/metrics)
+    :executor    (ig/ref [::default :app.worker/executor])
    :io-threads  (cf/get :http-server-io-threads)
    :max-body-size           (cf/get :http-server-max-body-size)
    :max-multipart-body-size (cf/get :http-server-max-multipart-body-size)}

-   ::ldap/provider
+   :app.auth.ldap/provider
   {:host           (cf/get :ldap-host)
    :port           (cf/get :ldap-port)
    :ssl            (cf/get :ldap-ssl)
@@ -263,123 +121,139 @@
    :bind-password  (cf/get :ldap-bind-password)
    :enabled?       (contains? cf/flags :login-with-ldap)}

-   ::oidc.providers/google
-   {}
+   :app.auth.oidc/google-provider
+   {:enabled?      (contains? cf/flags :login-with-google)
+    :client-id     (cf/get :google-client-id)
+    :client-secret (cf/get :google-client-secret)}

-   ::oidc.providers/github
-   {::http.client/client (ig/ref ::http.client/client)}
+   :app.auth.oidc/github-provider
+   {:enabled?      (contains? cf/flags :login-with-github)
+    :http-client   (ig/ref :app.http/client)
+    :client-id     (cf/get :github-client-id)
+    :client-secret (cf/get :github-client-secret)}

-   ::oidc.providers/gitlab
-   {}
+   :app.auth.oidc/gitlab-provider
+   {:enabled?      (contains? cf/flags :login-with-gitlab)
+    :base-uri      (cf/get :gitlab-base-uri "https://gitlab.com")
+    :client-id     (cf/get :gitlab-client-id)
+    :client-secret (cf/get :gitlab-client-secret)}

-   ::oidc.providers/generic
-   {::http.client/client (ig/ref ::http.client/client)}
+   :app.auth.oidc/generic-provider
+   {:enabled?      (contains? cf/flags :login-with-oidc)
+    :http-client   (ig/ref :app.http/client)

-   ::oidc/routes
-   {::http.client/client (ig/ref ::http.client/client)
-    ::db/pool            (ig/ref ::db/pool)
-    ::props              (ig/ref :app.setup/props)
-    ::wrk/executor       (ig/ref ::wrk/executor)
-    ::oidc/providers     {:google (ig/ref ::oidc.providers/google)
-                          :github (ig/ref ::oidc.providers/github)
-                          :gitlab (ig/ref ::oidc.providers/gitlab)
-                          :oidc   (ig/ref ::oidc.providers/generic)}
-    ::audit/collector    (ig/ref ::audit/collector)
-    ::session/manager    (ig/ref ::session/manager)}
+    :client-id     (cf/get :oidc-client-id)
+    :client-secret (cf/get :oidc-client-secret)

+    :base-uri      (cf/get :oidc-base-uri)
+
+    :token-uri     (cf/get :oidc-token-uri)
+    :auth-uri      (cf/get :oidc-auth-uri)
+    :user-uri      (cf/get :oidc-user-uri)
+
+    :scopes        (cf/get :oidc-scopes)
+    :roles-attr    (cf/get :oidc-roles-attr)
+    :roles         (cf/get :oidc-roles)}
+
+   :app.auth.oidc/routes
+   {:providers   {:google (ig/ref :app.auth.oidc/google-provider)
+                  :github (ig/ref :app.auth.oidc/github-provider)
+                  :gitlab (ig/ref :app.auth.oidc/gitlab-provider)
+                  :oidc   (ig/ref :app.auth.oidc/generic-provider)}
+    :sprops      (ig/ref :app.setup/props)
+    :http-client (ig/ref :app.http/client)
+    :pool        (ig/ref :app.db/pool)
+    :session     (ig/ref :app.http/session)
+    :public-uri  (cf/get :public-uri)
+    :executor    (ig/ref [::default :app.worker/executor])}
+
+   ;; TODO: revisit the dependencies of this service, looks they are too much unused of them
   :app.http/router
-   {::session/manager    (ig/ref ::session/manager)
-    ::actoken/manager    (ig/ref ::actoken/manager)
-    ::wrk/executor       (ig/ref ::wrk/executor)
-    ::db/pool            (ig/ref ::db/pool)
-    ::rpc/routes         (ig/ref ::rpc/routes)
-    ::rpc.doc/routes     (ig/ref ::rpc.doc/routes)
-    ::props              (ig/ref :app.setup/props)
-    ::mtx/routes         (ig/ref ::mtx/routes)
-    ::oidc/routes        (ig/ref ::oidc/routes)
-    ::http.debug/routes  (ig/ref ::http.debug/routes)
-    ::http.assets/routes (ig/ref ::http.assets/routes)
-    ::http.ws/routes     (ig/ref ::http.ws/routes)
-    ::http.awsns/routes  (ig/ref ::http.awsns/routes)}
+   {:assets        (ig/ref :app.http.assets/handlers)
+    :feedback      (ig/ref :app.http.feedback/handler)
+    :session       (ig/ref :app.http/session)
+    :awsns-handler (ig/ref :app.http.awsns/handler)
+    :debug-routes  (ig/ref :app.http.debug/routes)
+    :oidc-routes   (ig/ref :app.auth.oidc/routes)
+    :ws            (ig/ref :app.http.websocket/handler)
+    :metrics       (ig/ref :app.metrics/metrics)
+    :public-uri    (cf/get :public-uri)
+    :storage       (ig/ref :app.storage/storage)
+    :audit-handler (ig/ref :app.loggers.audit/http-handler)
+    :rpc-routes    (ig/ref :app.rpc/routes)
+    :doc-routes    (ig/ref :app.rpc.doc/routes)
+    :executor      (ig/ref [::default :app.worker/executor])}

   :app.http.debug/routes
-   {::db/pool         (ig/ref ::db/pool)
-    ::wrk/executor    (ig/ref ::wrk/executor)
-    ::session/manager (ig/ref ::session/manager)}
+   {:pool     (ig/ref :app.db/pool)
+    :executor (ig/ref [::worker :app.worker/executor])
+    :storage  (ig/ref :app.storage/storage)
+    :session  (ig/ref :app.http/session)}

-   :app.http.websocket/routes
-   {::db/pool         (ig/ref ::db/pool)
-    ::mtx/metrics     (ig/ref ::mtx/metrics)
-    ::mbus/msgbus     (ig/ref :app.msgbus/msgbus)
-    ::session/manager (ig/ref ::session/manager)}
+   :app.http.websocket/handler
+   {:pool     (ig/ref :app.db/pool)
+    :metrics  (ig/ref :app.metrics/metrics)
+    :msgbus   (ig/ref :app.msgbus/msgbus)}

-   :app.http.assets/routes
-   {:metrics           (ig/ref ::mtx/metrics)
+   :app.http.assets/handlers
+   {:metrics           (ig/ref :app.metrics/metrics)
    :assets-path       (cf/get :assets-path)
-    :storage           (ig/ref ::sto/storage)
-    :executor          (ig/ref ::wrk/executor)
+    :storage           (ig/ref :app.storage/storage)
+    :executor          (ig/ref [::default :app.worker/executor])
    :cache-max-age     (dt/duration {:hours 24})
    :signature-max-age (dt/duration {:hours 24 :minutes 5})}

-   :app.rpc/climit
-   {::mtx/metrics  (ig/ref ::mtx/metrics)
-    ::wrk/executor (ig/ref ::wrk/executor)}
+   :app.http.feedback/handler
+   {:pool     (ig/ref :app.db/pool)
+    :executor (ig/ref [::default :app.worker/executor])}
+
+   :app.rpc/semaphores
+   {:metrics (ig/ref :app.metrics/metrics)
+    :executor (ig/ref [::default :app.worker/executor])}

   :app.rpc/rlimit
-   {::wrk/executor           (ig/ref ::wrk/executor)
-    ::wrk/scheduled-executor (ig/ref ::wrk/scheduled-executor)}
+   {:executor  (ig/ref [::worker :app.worker/executor])
+    :scheduler (ig/ref :app.worker/scheduler)}

   :app.rpc/methods
-   {::audit/collector    (ig/ref ::audit/collector)
-    ::http.client/client (ig/ref ::http.client/client)
-    ::db/pool            (ig/ref ::db/pool)
-    ::wrk/executor       (ig/ref ::wrk/executor)
-    ::session/manager    (ig/ref ::session/manager)
-    ::ldap/provider      (ig/ref ::ldap/provider)
-    ::sto/storage        (ig/ref ::sto/storage)
-    ::mtx/metrics        (ig/ref ::mtx/metrics)
-    ::mbus/msgbus        (ig/ref ::mbus/msgbus)
-    ::rds/redis          (ig/ref ::rds/redis)
-
-    ::rpc/climit         (ig/ref ::rpc/climit)
-    ::rpc/rlimit         (ig/ref ::rpc/rlimit)
-
-    ::props              (ig/ref :app.setup/props)
-
-    :pool                (ig/ref ::db/pool)
-    :templates           (ig/ref :app.setup/builtin-templates)
+   {:pool        (ig/ref :app.db/pool)
+    :session     (ig/ref :app.http/session)
+    :sprops      (ig/ref :app.setup/props)
+    :metrics     (ig/ref :app.metrics/metrics)
+    :storage     (ig/ref :app.storage/storage)
+    :msgbus      (ig/ref :app.msgbus/msgbus)
+    :public-uri  (cf/get :public-uri)
+    :redis       (ig/ref :app.redis/redis)
+    :audit       (ig/ref :app.loggers.audit/collector)
+    :ldap        (ig/ref :app.auth.ldap/provider)
+    :http-client (ig/ref :app.http/client)
+    :rlimit      (ig/ref :app.rpc/rlimit)
+    :executors   (ig/ref :app.worker/executors)
+    :executor    (ig/ref [::default :app.worker/executor])
+    :templates   (ig/ref :app.setup/builtin-templates)
+    :semaphores  (ig/ref :app.rpc/semaphores)
    }

   :app.rpc.doc/routes
   {:methods (ig/ref :app.rpc/methods)}

   :app.rpc/routes
-   {::rpc/methods     (ig/ref :app.rpc/methods)
-    ::db/pool         (ig/ref ::db/pool)
-    ::wrk/executor    (ig/ref ::wrk/executor)
-    ::session/manager (ig/ref ::session/manager)
-    ::actoken/manager (ig/ref ::actoken/manager)
-    ::props           (ig/ref :app.setup/props)}
+   {:methods (ig/ref :app.rpc/methods)}

-   ::wrk/registry
-   {:metrics (ig/ref ::mtx/metrics)
+   :app.worker/registry
+   {:metrics (ig/ref :app.metrics/metrics)
    :tasks
    {:sendmail           (ig/ref :app.emails/handler)
     :objects-gc         (ig/ref :app.tasks.objects-gc/handler)
     :file-gc            (ig/ref :app.tasks.file-gc/handler)
     :file-xlog-gc       (ig/ref :app.tasks.file-xlog-gc/handler)
-     :storage-gc-deleted (ig/ref ::sto/gc-deleted-task)
-     :storage-gc-touched (ig/ref ::sto/gc-touched-task)
+     :storage-gc-deleted (ig/ref :app.storage/gc-deleted-task)
+     :storage-gc-touched (ig/ref :app.storage/gc-touched-task)
     :tasks-gc           (ig/ref :app.tasks.tasks-gc/handler)
     :telemetry          (ig/ref :app.tasks.telemetry/handler)
-     :session-gc         (ig/ref ::session.tasks/gc)
-     :audit-log-archive  (ig/ref ::audit.tasks/archive)
-     :audit-log-gc       (ig/ref ::audit.tasks/gc)
-
-     :process-webhook-event
-     (ig/ref ::webhooks/process-event-handler)
-     :run-webhook
-     (ig/ref ::webhooks/run-webhook-handler)}}
+     :session-gc         (ig/ref :app.http.session/gc-task)
+     :audit-log-archive  (ig/ref :app.loggers.audit/archive-task)
+     :audit-log-gc       (ig/ref :app.loggers.audit/gc-task)}}


   :app.emails/sendmail
@@ -394,81 +268,78 @@

   :app.emails/handler
   {:sendmail (ig/ref :app.emails/sendmail)
-    :metrics  (ig/ref ::mtx/metrics)}
+    :metrics  (ig/ref :app.metrics/metrics)}

   :app.tasks.tasks-gc/handler
-   {:pool    (ig/ref ::db/pool)
+   {:pool    (ig/ref :app.db/pool)
    :max-age cf/deletion-delay}

   :app.tasks.objects-gc/handler
-   {::db/pool     (ig/ref ::db/pool)
-    ::sto/storage (ig/ref ::sto/storage)}
+   {:pool    (ig/ref :app.db/pool)
+    :storage (ig/ref :app.storage/storage)}

   :app.tasks.file-gc/handler
-   {:pool (ig/ref ::db/pool)}
+   {:pool (ig/ref :app.db/pool)}

   :app.tasks.file-xlog-gc/handler
-   {:pool (ig/ref ::db/pool)}
+   {:pool (ig/ref :app.db/pool)}

   :app.tasks.telemetry/handler
-   {::db/pool            (ig/ref ::db/pool)
-    ::http.client/client (ig/ref ::http.client/client)
-    ::props              (ig/ref :app.setup/props)}
+   {:pool        (ig/ref :app.db/pool)
+    :version     (:full cf/version)
+    :uri         (cf/get :telemetry-uri)
+    :sprops      (ig/ref :app.setup/props)
+    :http-client (ig/ref :app.http/client)}

-   [::srepl/urepl ::srepl/server]
-   {:port (cf/get :urepl-port 6062)
-    :host (cf/get :urepl-host "localhost")}
-
-   [::srepl/prepl ::srepl/server]
-   {:port (cf/get :prepl-port 6063)
-    :host (cf/get :prepl-host "localhost")}
+   :app.srepl/server
+   {:port (cf/get :srepl-port)
+    :host (cf/get :srepl-host)}

   :app.setup/builtin-templates
-   {::http.client/client (ig/ref ::http.client/client)}
+   {:http-client (ig/ref :app.http/client)}

   :app.setup/props
-   {:pool (ig/ref ::db/pool)
+   {:pool (ig/ref :app.db/pool)
    :key  (cf/get :secret-key)}

-   ::lzmq/receiver
-   {}
+   :app.loggers.zmq/receiver
+   {:endpoint (cf/get :loggers-zmq-uri)}

-   ::audit/collector
-   {::db/pool           (ig/ref ::db/pool)
-    ::wrk/executor      (ig/ref ::wrk/executor)
-    ::mtx/metrics       (ig/ref ::mtx/metrics)}
+   :app.loggers.audit/http-handler
+   {:pool     (ig/ref :app.db/pool)
+    :executor (ig/ref [::default :app.worker/executor])}

-   ::audit.tasks/archive
-   {::props              (ig/ref :app.setup/props)
-    ::db/pool            (ig/ref ::db/pool)
-    ::http.client/client (ig/ref ::http.client/client)}
+   :app.loggers.audit/collector
+   {:pool     (ig/ref :app.db/pool)
+    :executor (ig/ref [::worker :app.worker/executor])}

-   ::audit.tasks/gc
-   {::db/pool (ig/ref ::db/pool)}
+   :app.loggers.audit/archive-task
+   {:uri         (cf/get :audit-log-archive-uri)
+    :sprops      (ig/ref :app.setup/props)
+    :pool        (ig/ref :app.db/pool)
+    :http-client (ig/ref :app.http/client)}

-   ::webhooks/process-event-handler
-   {::db/pool            (ig/ref ::db/pool)
-    ::http.client/client (ig/ref ::http.client/client)}
-
-   ::webhooks/run-webhook-handler
-   {::db/pool            (ig/ref ::db/pool)
-    ::http.client/client (ig/ref ::http.client/client)}
+   :app.loggers.audit/gc-task
+   {:pool (ig/ref :app.db/pool)}

   :app.loggers.loki/reporter
-   {::lzmq/receiver      (ig/ref ::lzmq/receiver)
-    ::http.client/client (ig/ref ::http.client/client)}
+   {:uri         (cf/get :loggers-loki-uri)
+    :receiver    (ig/ref :app.loggers.zmq/receiver)
+    :http-client (ig/ref :app.http/client)}

   :app.loggers.mattermost/reporter
-   {::lzmq/receiver      (ig/ref ::lzmq/receiver)
-    ::http.client/client (ig/ref ::http.client/client)}
+   {:uri         (cf/get :error-report-webhook)
+    :receiver    (ig/ref :app.loggers.zmq/receiver)
+    :http-client (ig/ref :app.http/client)}

   :app.loggers.database/reporter
-   {::lzmq/receiver (ig/ref :app.loggers.zmq/receiver)
-    ::db/pool       (ig/ref ::db/pool)}
+   {:receiver (ig/ref :app.loggers.zmq/receiver)
+    :pool     (ig/ref :app.db/pool)
+    :executor (ig/ref [::worker :app.worker/executor])}

-   ::sto/storage
-   {:pool     (ig/ref ::db/pool)
-    :executor (ig/ref ::wrk/executor)
+   :app.storage/storage
+   {:pool     (ig/ref :app.db/pool)
+    :executor (ig/ref [::default :app.worker/executor])

    :backends
    {:assets-s3 (ig/ref [::assets :app.storage.s3/backend])
@@ -482,7 +353,7 @@
   {:region   (cf/get :storage-assets-s3-region)
    :endpoint (cf/get :storage-assets-s3-endpoint)
    :bucket   (cf/get :storage-assets-s3-bucket)
-    :executor (ig/ref ::wrk/executor)}
+    :executor (ig/ref [::default :app.worker/executor])}

   [::assets :app.storage.fs/backend]
   {:directory (cf/get :storage-assets-fs-directory)}
@@ -490,11 +361,12 @@


 (def worker-config
-  {::wrk/cron
-   {::wrk/scheduled-executor  (ig/ref ::wrk/scheduled-executor)
-    ::wrk/registry            (ig/ref ::wrk/registry)
-    ::db/pool                 (ig/ref ::db/pool)
-    ::wrk/entries
+  {:app.worker/cron
+   {:executor   (ig/ref [::worker :app.worker/executor])
+    :scheduler  (ig/ref :app.worker/scheduler)
+    :tasks      (ig/ref :app.worker/registry)
+    :pool       (ig/ref :app.db/pool)
+    :entries
    [{:cron #app/cron "0 0 * * * ?" ;; hourly
      :task :file-xlog-gc}

@@ -527,27 +399,11 @@
       {:cron #app/cron "30 */5 * * * ?" ;; every 5m
        :task :audit-log-gc})]}

-   ::wrk/dispatcher
-   {::rds/redis   (ig/ref ::rds/redis)
-    ::mtx/metrics (ig/ref ::mtx/metrics)
-    ::db/pool     (ig/ref ::db/pool)}
-
-   [::default ::wrk/worker]
-   {::wrk/parallelism (cf/get ::worker-default-parallelism 1)
-    ::wrk/queue       :default
-    ::rds/redis       (ig/ref ::rds/redis)
-    ::wrk/registry    (ig/ref ::wrk/registry)
-    ::mtx/metrics     (ig/ref ::mtx/metrics)
-    ::db/pool         (ig/ref ::db/pool)}
-
-   [::webhook ::wrk/worker]
-   {::wrk/parallelism (cf/get ::worker-webhook-parallelism 1)
-    ::wrk/queue       :webhooks
-    ::rds/redis       (ig/ref ::rds/redis)
-    ::wrk/registry    (ig/ref ::wrk/registry)
-    ::mtx/metrics     (ig/ref ::mtx/metrics)
-    ::db/pool         (ig/ref ::db/pool)}})
-
+   :app.worker/worker
+   {:executor (ig/ref [::worker :app.worker/executor])
+    :tasks    (ig/ref :app.worker/registry)
+    :metrics  (ig/ref :app.metrics/metrics)
+    :pool     (ig/ref :app.db/pool)}})

 (def system nil)

@@ -561,7 +417,7 @@
                                   (merge worker-config))
                                 (ig/prep)
                                 (ig/init))))
-  (l/info :hint "welcome to penpot"
+  (l/info :msg "welcome to penpot"
          :flags (str/join "," (map name cf/flags))
          :worker? (contains? cf/flags :backend-worker)
          :version (:full cf/version)))
@@ -574,9 +430,4 @@

 (defn -main
  [& _args]
-  (try
-    (start)
-    (catch Throwable cause
-      (l/error :hint (ex-message cause)
-               :cause cause)
-      (System/exit -1))))
+  (start))
--- a/backend/src/app/metrics.clj
+++ b/backend/src/app/metrics.clj
@@ -38,6 +38,110 @@
 ;; METRICS SERVICE PROVIDER
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

+(def default-metrics
+  {:update-file-changes
+   {::mdef/name "penpot_rpc_update_file_changes_total"
+    ::mdef/help "A total number of changes submitted to update-file."
+    ::mdef/type :counter}
+
+   :update-file-bytes-processed
+   {::mdef/name "penpot_rpc_update_file_bytes_processed_total"
+    ::mdef/help "A total number of bytes processed by update-file."
+    ::mdef/type :counter}
+
+   :rpc-mutation-timing
+   {::mdef/name "penpot_rpc_mutation_timing"
+    ::mdef/help "RPC mutation method call timing."
+    ::mdef/labels ["name"]
+    ::mdef/type :histogram}
+
+   :rpc-command-timing
+   {::mdef/name "penpot_rpc_command_timing"
+    ::mdef/help "RPC command method call timing."
+    ::mdef/labels ["name"]
+    ::mdef/type :histogram}
+
+   :rpc-query-timing
+   {::mdef/name "penpot_rpc_query_timing"
+    ::mdef/help "RPC query method call timing."
+    ::mdef/labels ["name"]
+    ::mdef/type :histogram}
+
+   :websocket-active-connections
+   {::mdef/name "penpot_websocket_active_connections"
+    ::mdef/help "Active websocket connections gauge"
+    ::mdef/type :gauge}
+
+   :websocket-messages-total
+   {::mdef/name "penpot_websocket_message_total"
+    ::mdef/help "Counter of processed messages."
+    ::mdef/labels ["op"]
+    ::mdef/type :counter}
+
+   :websocket-session-timing
+   {::mdef/name "penpot_websocket_session_timing"
+    ::mdef/help "Websocket session timing (seconds)."
+    ::mdef/type :summary}
+
+   :session-update-total
+   {::mdef/name "penpot_http_session_update_total"
+    ::mdef/help "A counter of session update batch events."
+    ::mdef/type :counter}
+
+   :tasks-timing
+   {::mdef/name "penpot_tasks_timing"
+    ::mdef/help "Background tasks timing (milliseconds)."
+    ::mdef/labels ["name"]
+    ::mdef/type :summary}
+
+   :redis-eval-timing
+   {::mdef/name "penpot_redis_eval_timing"
+    ::mdef/help "Redis EVAL commands execution timings (ms)"
+    ::mdef/labels ["name"]
+    ::mdef/type :summary}
+
+   :semaphore-queued-submissions
+   {::mdef/name "penpot_semaphore_queued_submissions"
+    ::mdef/help "Current number of queued submissions on SEMAPHORE."
+    ::mdef/labels ["name"]
+    ::mdef/type :gauge}
+
+   :semaphore-used-permits
+   {::mdef/name "penpot_semaphore_used_permits"
+    ::mdef/help "Current number of used permits on SEMAPHORE."
+    ::mdef/labels ["name"]
+    ::mdef/type :gauge}
+
+   :semaphore-timing
+   {::mdef/name "penpot_semaphore_timing"
+    ::mdef/help "Total timing of SEMAPHORE."
+    ::mdef/labels ["name"]
+    ::mdef/type :summary}
+
+   :executors-active-threads
+   {::mdef/name "penpot_executors_active_threads"
+    ::mdef/help "Current number of threads available in the executor service."
+    ::mdef/labels ["name"]
+    ::mdef/type :gauge}
+
+   :executors-completed-tasks
+   {::mdef/name "penpot_executors_completed_tasks_total"
+    ::mdef/help "Approximate number of completed tasks by the executor."
+    ::mdef/labels ["name"]
+    ::mdef/type :counter}
+
+   :executors-running-threads
+   {::mdef/name "penpot_executors_running_threads"
+    ::mdef/help "Current number of threads with state RUNNING."
+    ::mdef/labels ["name"]
+    ::mdef/type :gauge}
+
+   :executors-queued-submissions
+   {::mdef/name "penpot_executors_queued_submissions"
+    ::mdef/help "Current number of queued submissions."
+    ::mdef/labels ["name"]
+    ::mdef/type :gauge}})
+
 (s/def ::mdef/name string?)
 (s/def ::mdef/help string?)
 (s/def ::mdef/labels (s/every string? :kind vector?))
@@ -65,13 +169,8 @@
                ::handler
                ::definitions]))

-(s/def ::default ::definitions)
-
-(defmethod ig/pre-init-spec ::metrics [_]
-  (s/keys :req-un [::default]))
-
 (defmethod ig/init-key ::metrics
-  [_ cfg]
+  [_ _]
  (l/info :action "initialize metrics")
  (let [registry    (create-registry)
        definitions (reduce-kv (fn [res k v]
@@ -79,7 +178,7 @@
                                      (create-collector)
                                      (assoc res k)))
                               {}
-                               (:default cfg))]
+                               default-metrics)]

    (us/verify! ::definitions definitions)

@@ -87,7 +186,6 @@
     ::definitions definitions
     ::registry registry}))

-
 (defn- handler
  [registry _ respond _]
  (let [samples  (.metricFamilySamples ^CollectorRegistry registry)
@@ -96,18 +194,6 @@
    (respond {:headers {"content-type" TextFormat/CONTENT_TYPE_004}
              :body (.toString writer)})))

-
-
-(s/def ::routes vector?)
-(defmethod ig/pre-init-spec ::routes [_]
-  (s/keys :req [::metrics]))
-
-(defmethod ig/init-key ::routes
-  [_ {:keys [::metrics]}]
-  (let [registry (::registry metrics)]
-    ["/metrics" {:handler (partial handler registry)
-                 :allowed-methods #{:get}}]))
-
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Implementation
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -145,7 +231,7 @@

 (defmethod run-collector! :counter
  [{:keys [::mdef/instance]} {:keys [inc labels] :or {inc 1 labels default-empty-labels}}]
-  (let [instance (.labels ^Counter instance (if (is-array? labels) labels (into-array String labels)))]
+  (let [instance (.labels instance (if (is-array? labels) labels (into-array String labels)))]
    (.inc ^Counter$Child instance (double inc))))

 (defmethod run-collector! :gauge
--- a/backend/src/app/migrations.clj
+++ b/backend/src/app/migrations.clj
@@ -247,68 +247,7 @@

   {:name "0079-mod-profile-table"
    :fn (mg/resource "app/migrations/sql/0079-mod-profile-table.sql")}
-
-   {:name "0080-mod-index-names"
-    :fn (mg/resource "app/migrations/sql/0080-mod-index-names.sql")}
-
-   {:name "0081-add-deleted-at-index-to-file-table"
-    :fn (mg/resource "app/migrations/sql/0081-add-deleted-at-index-to-file-table.sql")}
-
-   {:name "0082-add-features-column-to-file-table"
-    :fn (mg/resource "app/migrations/sql/0082-add-features-column-to-file-table.sql")}
-
-   {:name "0083-add-file-data-fragment-table"
-    :fn (mg/resource "app/migrations/sql/0083-add-file-data-fragment-table.sql")}
-
-   {:name "0084-add-features-column-to-file-change-table"
-    :fn (mg/resource "app/migrations/sql/0084-add-features-column-to-file-change-table.sql")}
-
-   {:name "0085-add-webhook-table"
-    :fn (mg/resource "app/migrations/sql/0085-add-webhook-table.sql")}
-
-   {:name "0086-add-webhook-delivery-table"
-    :fn (mg/resource "app/migrations/sql/0086-add-webhook-delivery-table.sql")}
-
-   {:name "0087-mod-task-table"
-    :fn (mg/resource "app/migrations/sql/0087-mod-task-table.sql")}
-
-   {:name "0088-mod-team-profile-rel-table"
-    :fn (mg/resource "app/migrations/sql/0088-mod-team-profile-rel-table.sql")}
-
-   {:name "0089-mod-project-profile-rel-table"
-    :fn (mg/resource "app/migrations/sql/0089-mod-project-profile-rel-table.sql")}
-
-   {:name "0090-mod-http-session-table"
-    :fn (mg/resource "app/migrations/sql/0090-mod-http-session-table.sql")}
-
-   {:name "0091-mod-team-project-profile-rel-table"
-    :fn (mg/resource "app/migrations/sql/0091-mod-team-project-profile-rel-table.sql")}
-
-   {:name "0092-mod-team-invitation-table"
-    :fn (mg/resource "app/migrations/sql/0092-mod-team-invitation-table.sql")}
-
-   {:name "0093-del-file-share-tokens-table"
-    :fn (mg/resource "app/migrations/sql/0093-del-file-share-tokens-table.sql")}
-
-   {:name "0094-del-profile-attr-table"
-    :fn (mg/resource "app/migrations/sql/0094-del-profile-attr-table.sql")}
-
-   {:name "0095-del-storage-data-table"
-    :fn (mg/resource "app/migrations/sql/0095-del-storage-data-table.sql")}
-
-   {:name "0096-del-storage-pending-table"
-    :fn (mg/resource "app/migrations/sql/0096-del-storage-pending-table.sql")}
-
-   {:name "0098-add-quotes-table"
-    :fn (mg/resource "app/migrations/sql/0098-add-quotes-table.sql")}
-
-   {:name "0099-add-access-token-table"
-    :fn (mg/resource "app/migrations/sql/0099-add-access-token-table.sql")}
-
-   {:name "0100-mod-profile-indexes"
-    :fn (mg/resource "app/migrations/sql/0100-mod-profile-indexes.sql")}
-
-  ])
+   ])


 (defmethod ig/init-key ::migrations [_ _] migrations)
--- a/backend/src/app/migrations/sql/0080-mod-index-names.sql
+++ b/backend/src/app/migrations/sql/0080-mod-index-names.sql
@@ -1,11 +0,0 @@
-ALTER INDEX team_font_variant_deleted_at_idx
-RENAME TO team_font_variant__deleted_at__idx;
-
-ALTER INDEX team_deleted_at_idx
-RENAME TO team__deleted_at__idx;
-
-ALTER INDEX profile_deleted_at_idx
-RENAME TO profile__deleted_at__idx;
-
-ALTER INDEX project_deleted_at_idx
-RENAME TO project__deleted_at__idx;
--- a/backend/src/app/migrations/sql/0081-add-deleted-at-index-to-file-table.sql
+++ b/backend/src/app/migrations/sql/0081-add-deleted-at-index-to-file-table.sql
@@ -1,3 +0,0 @@
-CREATE INDEX file__deleted_at__idx
-    ON file (deleted_at, id)
- WHERE deleted_at IS NOT NULL;
--- a/backend/src/app/migrations/sql/0082-add-features-column-to-file-table.sql
+++ b/backend/src/app/migrations/sql/0082-add-features-column-to-file-table.sql
@@ -1,2 +0,0 @@
-ALTER TABLE file
-  ADD COLUMN features text[] DEFAULT NULL;
--- a/backend/src/app/migrations/sql/0083-add-file-data-fragment-table.sql
+++ b/backend/src/app/migrations/sql/0083-add-file-data-fragment-table.sql
@@ -1,15 +0,0 @@
-CREATE TABLE file_data_fragment (
-  id uuid NOT NULL,
-  file_id uuid NOT NULL REFERENCES file(id) ON DELETE CASCADE DEFERRABLE,
-
-  created_at timestamptz NOT NULL DEFAULT now(),
-
-  metadata jsonb NULL,
-  content bytea NOT NULL,
-
-  PRIMARY KEY (file_id, id)
-);
-
-ALTER TABLE file_data_fragment
-  ALTER COLUMN metadata SET STORAGE external,
-  ALTER COLUMN content SET STORAGE external;
--- a/backend/src/app/migrations/sql/0084-add-features-column-to-file-change-table.sql
+++ b/backend/src/app/migrations/sql/0084-add-features-column-to-file-change-table.sql
@@ -1,8 +0,0 @@
-ALTER TABLE file_change
-  ADD COLUMN features text[] DEFAULT NULL;
-
-ALTER TABLE file_change
-  ALTER COLUMN features SET STORAGE external;
-
-ALTER TABLE file
-  ALTER COLUMN features SET STORAGE external;
--- a/backend/src/app/migrations/sql/0085-add-webhook-table.sql
+++ b/backend/src/app/migrations/sql/0085-add-webhook-table.sql
@@ -1,25 +0,0 @@
-CREATE TABLE webhook (
-  id uuid PRIMARY KEY,
-  team_id uuid NOT NULL REFERENCES team(id) ON DELETE CASCADE DEFERRABLE,
-
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now(),
-
-  uri text NOT NULL,
-  mtype text NOT NULL,
-
-  error_code text NULL,
-  error_count smallint DEFAULT 0,
-
-  is_active boolean DEFAULT true,
-  secret_key text NULL
-);
-
-ALTER TABLE webhook
-  ALTER COLUMN uri SET STORAGE external,
-  ALTER COLUMN mtype SET STORAGE external,
-  ALTER COLUMN error_code SET STORAGE external,
-  ALTER COLUMN secret_key SET STORAGE external;
-
-
-CREATE INDEX webhook__team_id__idx ON webhook (team_id);
--- a/backend/src/app/migrations/sql/0086-add-webhook-delivery-table.sql
+++ b/backend/src/app/migrations/sql/0086-add-webhook-delivery-table.sql
@@ -1,16 +0,0 @@
-CREATE TABLE webhook_delivery (
-  webhook_id uuid NOT NULL REFERENCES webhook(id) ON DELETE CASCADE DEFERRABLE,
-  created_at timestamptz NOT NULL DEFAULT now(),
-
-  error_code text NULL,
-
-  req_data jsonb NULL,
-  rsp_data jsonb NULL,
-
-  PRIMARY KEY (webhook_id, created_at)
-);
-
-ALTER TABLE webhook_delivery
-  ALTER COLUMN error_code SET STORAGE external,
-  ALTER COLUMN req_data SET STORAGE external,
-  ALTER COLUMN rsp_data SET STORAGE external;
--- a/backend/src/app/migrations/sql/0087-mod-task-table.sql
+++ b/backend/src/app/migrations/sql/0087-mod-task-table.sql
@@ -1,9 +0,0 @@
-ALTER TABLE task
-  ADD COLUMN label text NULL;
-
-ALTER TABLE task
-  ALTER COLUMN label SET STORAGE external;
-
-CREATE INDEX task__label__idx
-    ON task (label, name, queue)
- WHERE status = 'new';
--- a/backend/src/app/migrations/sql/0088-mod-team-profile-rel-table.sql
+++ b/backend/src/app/migrations/sql/0088-mod-team-profile-rel-table.sql
@@ -1,3 +0,0 @@
-ALTER TABLE team_profile_rel DROP CONSTRAINT team_profile_rel_pkey;
-ALTER TABLE team_profile_rel ADD COLUMN id uuid DEFAULT uuid_generate_v4() PRIMARY KEY;
-ALTER TABLE team_profile_rel ADD CONSTRAINT team_profile_rel_unique UNIQUE (team_id, profile_id);
--- a/backend/src/app/migrations/sql/0089-mod-project-profile-rel-table.sql
+++ b/backend/src/app/migrations/sql/0089-mod-project-profile-rel-table.sql
@@ -1,3 +0,0 @@
-ALTER TABLE project_profile_rel DROP CONSTRAINT project_profile_rel_pkey;
-ALTER TABLE project_profile_rel ADD COLUMN id uuid DEFAULT uuid_generate_v4() PRIMARY KEY;
-ALTER TABLE project_profile_rel ADD CONSTRAINT project_profile_rel_unique UNIQUE (project_id, profile_id);
--- a/backend/src/app/migrations/sql/0090-mod-http-session-table.sql
+++ b/backend/src/app/migrations/sql/0090-mod-http-session-table.sql
@@ -1,2 +0,0 @@
-ALTER TABLE http_session DROP CONSTRAINT http_session_pkey;
-ALTER TABLE http_session ADD CONSTRAINT http_session_pkey PRIMARY KEY (id);
--- a/backend/src/app/migrations/sql/0091-mod-team-project-profile-rel-table.sql
+++ b/backend/src/app/migrations/sql/0091-mod-team-project-profile-rel-table.sql
@@ -1,3 +0,0 @@
-ALTER TABLE team_project_profile_rel DROP CONSTRAINT team_project_profile_rel_pkey;
-ALTER TABLE team_project_profile_rel ADD COLUMN id uuid DEFAULT uuid_generate_v4() PRIMARY KEY;
-ALTER TABLE team_project_profile_rel ADD CONSTRAINT team_project_profile_rel_unique UNIQUE (team_id, project_id, profile_id);
--- a/backend/src/app/migrations/sql/0092-mod-team-invitation-table.sql
+++ b/backend/src/app/migrations/sql/0092-mod-team-invitation-table.sql
@@ -1,3 +0,0 @@
-ALTER TABLE team_invitation DROP CONSTRAINT team_invitation_pkey;
-ALTER TABLE team_invitation ADD COLUMN id uuid DEFAULT uuid_generate_v4() PRIMARY KEY;
-ALTER TABLE team_invitation ADD CONSTRAINT team_invitation_unique UNIQUE (team_id, email_to);
--- a/backend/src/app/migrations/sql/0093-del-file-share-tokens-table.sql
+++ b/backend/src/app/migrations/sql/0093-del-file-share-tokens-table.sql
@@ -1 +0,0 @@
-DROP TABLE file_share_token;
--- a/backend/src/app/migrations/sql/0094-del-profile-attr-table.sql
+++ b/backend/src/app/migrations/sql/0094-del-profile-attr-table.sql
@@ -1 +0,0 @@
-DROP TABLE profile_attr;
--- a/backend/src/app/migrations/sql/0095-del-storage-data-table.sql
+++ b/backend/src/app/migrations/sql/0095-del-storage-data-table.sql
@@ -1 +0,0 @@
-DROP TABLE storage_data;
--- a/backend/src/app/migrations/sql/0096-del-storage-pending-table.sql
+++ b/backend/src/app/migrations/sql/0096-del-storage-pending-table.sql
@@ -1 +0,0 @@
-DROP TABLE storage_pending;
--- a/backend/src/app/migrations/sql/0098-add-quotes-table.sql
+++ b/backend/src/app/migrations/sql/0098-add-quotes-table.sql
@@ -1,82 +0,0 @@
-CREATE TABLE usage_quote (
-  id uuid NOT NULL DEFAULT uuid_generate_v4() PRIMARY KEY,
-  target text NOT NULL,
-  quote bigint NOT NULL,
-
-  profile_id uuid NULL REFERENCES profile(id) ON DELETE CASCADE DEFERRABLE,
-  project_id uuid NULL REFERENCES project(id) ON DELETE CASCADE DEFERRABLE,
-  team_id uuid NULL REFERENCES team(id) ON DELETE CASCADE DEFERRABLE,
-  file_id uuid NULL REFERENCES file(id) ON DELETE CASCADE DEFERRABLE
-);
-
-ALTER TABLE usage_quote
-  ALTER COLUMN target SET STORAGE external;
-
-CREATE INDEX usage_quote__profile_id__idx ON usage_quote(profile_id, target);
-CREATE INDEX usage_quote__project_id__idx ON usage_quote(project_id, target);
-CREATE INDEX usage_quote__team_id__idx ON usage_quote(team_id, target);
-
-- DROP TABLE IF EXISTS usage_quote_test;
-- CREATE TABLE usage_quote_test (
--   id bigserial NOT NULL PRIMARY KEY,
--   target text NOT NULL,
--   quote bigint NOT NULL,
-
--   profile_id bigint NULL,
--   team_id bigint NULL,
--   project_id bigint NULL,
--   file_id bigint NULL
-- );
-
-- ALTER TABLE usage_quote_test
--   ALTER COLUMN target SET STORAGE external;
-
-- CREATE INDEX usage_quote_test__profile_id__idx ON usage_quote_test(profile_id, target);
-- CREATE INDEX usage_quote_test__project_id__idx ON usage_quote_test(project_id, target);
-- CREATE INDEX usage_quote_test__team_id__idx ON usage_quote_test(team_id, target);
-- -- CREATE INDEX usage_quote_test__target__idx ON usage_quote_test(target);
-
-- DELETE FROM usage_quote_test;
-
-- INSERT INTO usage_quote_test (target, quote, profile_id, team_id, project_id)
-- SELECT 'files-per-project', 50*RANDOM(), 2000*RANDOM(), null, null
--   FROM generate_series(1, 5000);
-
-- INSERT INTO usage_quote_test (target, quote, profile_id, team_id, project_id)
-- SELECT 'files-per-project', 200*RANDOM(), 300*RANDOM(), 300*RANDOM(), null
--   FROM generate_series(1, 1000);
-
-- INSERT INTO usage_quote_test (target, quote, profile_id, team_id, project_id)
-- SELECT 'files-per-project', 100*RANDOM(), 300*RANDOM(), null, 300*RANDOM()
--   FROM generate_series(1, 1000);
-
-- INSERT INTO usage_quote_test (target, quote, profile_id, team_id, project_id)
-- SELECT 'files-per-project', 100*RANDOM(), 300*RANDOM(), 300*RANDOM(), 300*RANDOM()
--   FROM generate_series(1, 1000);
-
-- INSERT INTO usage_quote_test (target, quote, profile_id, team_id, project_id)
-- SELECT 'files-per-project', 30*RANDOM(), null, 2000*RANDOM(), null
--   FROM generate_series(1, 5000);
-
-- INSERT INTO usage_quote_test (target, quote, profile_id, team_id, project_id)
-- SELECT 'files-per-project', 10*RANDOM(), null, null, 2000*RANDOM()
--   FROM generate_series(1, 5000);
-
-- VACUUM ANALYZE usage_quote_test;
-
-- select * from usage_quote_test
--  where target = 'files-per-project'
--    and profile_id = 1
--    and team_id is null
--    and project_id is null;
-
-- select * from usage_quote_test
--  where target = 'files-per-project'
--    and ((team_id = 1 and (profile_id = 1 or profile_id is null)) or
--         (profile_id = 1 and team_id is null and project_id is null));
-
-- select * from usage_quote_test
--  where target = 'files-per-project'
--    and ((project_id = 1 and (profile_id = 1 or profile_id is null)) or
--         (team_id = 1 and (profile_id = 1 or profile_id is null)) or
--         (profile_id = 1 and team_id is null and project_id is null));
--- a/backend/src/app/migrations/sql/0099-add-access-token-table.sql
+++ b/backend/src/app/migrations/sql/0099-add-access-token-table.sql
@@ -1,19 +0,0 @@
-DROP TABLE IF EXISTS access_token;
-CREATE TABLE access_token (
-  id uuid NOT NULL DEFAULT uuid_generate_v4() PRIMARY KEY,
-  profile_id uuid NOT NULL REFERENCES profile(id) ON DELETE CASCADE DEFERRABLE,
-
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now(),
-
-  name text NOT NULL,
-  token text NOT NULL,
-  perms text[] NULL
-);
-
-ALTER TABLE access_token
-  ALTER COLUMN name SET STORAGE external,
-  ALTER COLUMN token SET STORAGE external,
-  ALTER COLUMN perms SET STORAGE external;
-
-CREATE INDEX access_token__profile_id__idx ON access_token(profile_id);
--- a/backend/src/app/migrations/sql/0100-mod-profile-indexes.sql
+++ b/backend/src/app/migrations/sql/0100-mod-profile-indexes.sql
@@ -1,31 +0,0 @@
-ALTER TABLE profile
-  ADD COLUMN default_project_id uuid NULL REFERENCES project(id) ON DELETE SET NULL DEFERRABLE,
-  ADD COLUMN default_team_id uuid NULL REFERENCES team(id) ON DELETE SET NULL DEFERRABLE;
-
-CREATE INDEX profile__default_project__idx ON profile(default_project_id);
-CREATE INDEX profile__default_team__idx ON profile(default_team_id);
-
-with profiles as (
-  select p.id,
-         tpr.team_id as default_team_id,
-         ppr.project_id as default_project_id
-    from profile as p
-    join team_profile_rel as tpr
-      on (tpr.profile_id = p.id and
-          tpr.is_owner is true)
-    join project_profile_rel as ppr
-      on (ppr.profile_id = p.id and
-          ppr.is_owner is true)
-    join project as pj
-      on (pj.id = ppr.project_id)
-    join team as tm
-      on (tm.id = tpr.team_id)
-   where pj.is_default is true
-     and tm.is_default is true
-     and pj.team_id = tm.id
-)
-update profile
-   set default_team_id = p.default_team_id,
-       default_project_id = p.default_project_id
-  from profiles as p
- where profile.id = p.id;
--- a/backend/src/app/msgbus.clj
+++ b/backend/src/app/msgbus.clj
@@ -20,8 +20,7 @@
   [clojure.core.async :as a]
   [clojure.spec.alpha :as s]
   [integrant.core :as ig]
-   [promesa.core :as p]
-   [promesa.exec :as px]))
+   [promesa.core :as p]))

 (set! *warn-on-reflection* true)

@@ -53,8 +52,8 @@
 (s/def ::rcv-ch ::aa/channel)
 (s/def ::pub-ch ::aa/channel)
 (s/def ::state ::us/agent)
-(s/def ::pconn ::redis/connection-holder)
-(s/def ::sconn ::redis/connection-holder)
+(s/def ::pconn ::redis/connection)
+(s/def ::sconn ::redis/connection)
 (s/def ::msgbus
  (s/keys :req [::cmd-ch ::rcv-ch ::pub-ch ::state ::pconn ::sconn ::wrk/executor]))

@@ -123,8 +122,8 @@

 (defn- redis-disconnect
  [{:keys [::pconn ::sconn] :as cfg}]
-  (d/close! pconn)
-  (d/close! sconn))
+  (redis/close! pconn)
+  (redis/close! sconn))

 (defn- conj-subscription
  "A low level function that is responsible to create on-demand
@@ -206,33 +205,31 @@
              (when-let [closed (a/<! (send-to-topic topic message))]
                (send-via executor state unsubscribe-channels cfg closed nil))))
          ]
-    (px/thread
-      {:name "penpot/msgbus-io-loop"}
-      (loop []
-        (let [[val port] (a/alts!! [pub-ch rcv-ch])]
-          (cond
-            (nil? val)
-            (do
-              (l/trace :hint "stopping io-loop, nil received")
-              (send-via executor state (fn [state]
-                                         (->> (vals state)
-                                              (mapcat identity)
-                                              (filter some?)
-                                              (run! a/close!))
-                                         nil)))

-            (= port rcv-ch)
-            (do
-              (a/<!! (process-incoming val))
-              (recur))
+  (a/go-loop []
+    (let [[val port] (a/alts! [pub-ch rcv-ch])]
+      (cond
+        (nil? val)
+        (do
+          (l/trace :hint "stopping io-loop, nil received")
+          (send-via executor state (fn [state]
+                                     (->> (vals state)
+                                          (mapcat identity)
+                                          (filter some?)
+                                          (run! a/close!))
+                                     nil)))

-            (= port pub-ch)
-            (let [result (a/<!! (redis-pub cfg val))]
-              (when (ex/exception? result)
-                (l/error :hint "unexpected error on publishing"
-                         :message val
-                         :cause result))
-              (recur))))))))
+        (= port rcv-ch)
+        (do
+          (a/<! (process-incoming val))
+          (recur))
+
+        (= port pub-ch)
+        (let [result (a/<! (redis-pub cfg val))]
+          (when (ex/exception? result)
+            (l/error :hint "unexpected error on publishing" :message val
+                     :cause result))
+          (recur)))))))

 (defn- redis-pub
  "Publish a message to the redis server. Asynchronous operation,
--- a/backend/src/app/redis.clj
+++ b/backend/src/app/redis.clj
@@ -21,19 +21,13 @@
   [promesa.core :as p])
  (:import
   clojure.lang.IDeref
-   clojure.lang.MapEntry
-   io.lettuce.core.KeyValue
   io.lettuce.core.RedisClient
-   io.lettuce.core.RedisCommandInterruptedException
-   io.lettuce.core.RedisCommandTimeoutException
-   io.lettuce.core.RedisException
   io.lettuce.core.RedisURI
   io.lettuce.core.ScriptOutputType
   io.lettuce.core.api.StatefulConnection
   io.lettuce.core.api.StatefulRedisConnection
   io.lettuce.core.api.async.RedisAsyncCommands
   io.lettuce.core.api.async.RedisScriptingAsyncCommands
-   io.lettuce.core.api.sync.RedisCommands
   io.lettuce.core.codec.ByteArrayCodec
   io.lettuce.core.codec.RedisCodec
   io.lettuce.core.codec.StringCodec
@@ -51,12 +45,13 @@

 (declare initialize-resources)
 (declare shutdown-resources)
-(declare connect*)
+(declare connect)
+(declare close!)

 (s/def ::timer
  #(instance? Timer %))

-(s/def ::default-connection
+(s/def ::connection
  #(or (instance? StatefulRedisConnection %)
       (and (instance? IDeref %)
            (instance? StatefulRedisConnection (deref %)))))
@@ -66,13 +61,6 @@
       (and (instance? IDeref %)
            (instance? StatefulRedisPubSubConnection (deref %)))))

-(s/def ::connection
-  (s/or :default ::default-connection
-        :pubsub  ::pubsub-connection))
-
-(s/def ::connection-holder
-  (s/keys :req [::connection]))
-
 (s/def ::redis-uri
  #(instance? RedisURI %))

@@ -87,37 +75,32 @@
 (s/def ::connect? ::us/boolean)
 (s/def ::io-threads ::us/integer)
 (s/def ::worker-threads ::us/integer)
-(s/def ::cache #(instance? clojure.lang.Atom %))

 (s/def ::redis
-  (s/keys :req [::resources
-                ::redis-uri
-                ::timer
-                ::mtx/metrics]
-          :opt [::connection
-                ::cache]))
+  (s/keys :req [::resources ::redis-uri ::timer ::mtx/metrics]
+          :opt [::connection]))
+
+(defmethod ig/pre-init-spec ::redis [_]
+  (s/keys :req-un [::uri ::mtx/metrics]
+          :opt-un [::timeout
+                   ::connect?
+                   ::io-threads
+                   ::worker-threads]))

 (defmethod ig/prep-key ::redis
  [_ cfg]
  (let [runtime (Runtime/getRuntime)
        cpus    (.availableProcessors ^Runtime runtime)]
-    (merge {::timeout (dt/duration "10s")
-            ::io-threads (max 3 cpus)
-            ::worker-threads (max 3 cpus)}
-           (d/without-nils cfg))))
-
-(defmethod ig/pre-init-spec ::redis [_]
-  (s/keys :req [::uri ::mtx/metrics]
-          :opt [::timeout
-                ::connect?
-                ::io-threads
-                ::worker-threads]))
+    (merge {:timeout (dt/duration 5000)
+            :io-threads (max 3 cpus)
+            :worker-threads (max 3 cpus)}
+         (d/without-nils cfg))))

 (defmethod ig/init-key ::redis
-  [_ {:keys [::connect?] :as cfg}]
-  (let [state (initialize-resources cfg)]
-    (cond-> state
-      connect? (assoc ::connection (connect* cfg {})))))
+  [_ {:keys [connect?] :as cfg}]
+  (let [cfg (initialize-resources cfg)]
+    (cond-> cfg
+      connect? (assoc ::connection (connect cfg)))))

 (defmethod ig/halt-key! ::redis
  [_ state]
@@ -131,7 +114,7 @@

 (defn- initialize-resources
  "Initialize redis connection resources"
-  [{:keys [::uri ::io-threads ::worker-threads ::connect?] :as cfg}]
+  [{:keys [uri io-threads worker-threads connect? metrics] :as cfg}]
  (l/info :hint "initialize redis resources"
          :uri uri
          :io-threads io-threads
@@ -148,32 +131,34 @@
        redis-uri (RedisURI/create ^String uri)]

    (-> cfg
-        (assoc ::resources resources)
-        (assoc ::timer timer)
+        (assoc ::mtx/metrics metrics)
        (assoc ::cache (atom {}))
-        (assoc ::redis-uri redis-uri))))
+        (assoc ::timer timer)
+        (assoc ::redis-uri redis-uri)
+        (assoc ::resources resources))))

 (defn- shutdown-resources
  [{:keys [::resources ::cache ::timer]}]
-  (run! d/close! (vals @cache))
+  (run! close! (vals @cache))
  (when resources
    (.shutdown ^ClientResources resources))
  (when timer
    (.stop ^Timer timer)))

-(defn connect*
-  [{:keys [::resources ::redis-uri] :as state}
-   {:keys [timeout codec type]
-    :or {codec default-codec type :default}}]
+(defn connect
+  [{:keys [::resources ::redis-uri] :as cfg}
+   & {:keys [timeout codec type] :or {codec default-codec type :default}}]

  (us/assert! ::resources resources)
+
  (let [client  (RedisClient/create ^ClientResources resources ^RedisURI redis-uri)
-        timeout (or timeout (::timeout state))
+        timeout (or timeout (:timeout cfg))
        conn    (case type
                  :default (.connect ^RedisClient client ^RedisCodec codec)
                  :pubsub  (.connectPubSub ^RedisClient client ^RedisCodec codec))]

    (.setTimeout ^StatefulConnection conn ^Duration timeout)
+
    (reify
      IDeref
      (deref [_] conn)
@@ -183,109 +168,53 @@
        (.close ^StatefulConnection conn)
        (.shutdown ^RedisClient client)))))

-(defn connect
-  [state & {:as opts}]
-  (let [connection (connect* state opts)]
-    (-> state
-        (assoc ::connection connection)
-        (dissoc ::cache)
-        (vary-meta assoc `d/close! (fn [_] (d/close! connection))))))
-
 (defn get-or-connect
  [{:keys [::cache] :as state} key options]
-  (us/assert! ::redis state)
-  (-> state
-      (assoc ::connection
-             (or (get @cache key)
-                 (-> (swap! cache (fn [cache]
-                                    (when-let [prev (get cache key)]
-                                      (d/close! prev))
-                                    (assoc cache key (connect* state options))))
-                     (get key))))
-      (dissoc ::cache)))
+  (assoc state ::connection
+         (or (get @cache key)
+             (-> (swap! cache (fn [cache]
+                                (when-let [prev (get cache key)]
+                                  (close! prev))
+                                (assoc cache key (connect state options))))
+                 (get key)))))

 (defn add-listener!
-  [{:keys [::connection] :as conn} listener]
-  (us/assert! ::pubsub-connection connection)
+  [conn listener]
+  (us/assert! ::pubsub-connection @conn)
  (us/assert! ::pubsub-listener listener)
-  (.addListener ^StatefulRedisPubSubConnection @connection
+
+  (.addListener ^StatefulRedisPubSubConnection @conn
                ^RedisPubSubListener listener)
  conn)

 (defn publish!
-  [{:keys [::connection]} topic message]
+  [conn topic message]
  (us/assert! ::us/string topic)
  (us/assert! ::us/bytes message)
-  (us/assert! ::default-connection connection)
+  (us/assert! ::connection @conn)

-  (let [pcomm (.async ^StatefulRedisConnection @connection)]
+  (let [pcomm (.async ^StatefulRedisConnection @conn)]
    (.publish ^RedisAsyncCommands pcomm ^String topic ^bytes message)))

 (defn subscribe!
-  "Blocking operation, intended to be used on a thread/agent thread."
-  [{:keys [::connection]} & topics]
-  (us/assert! ::pubsub-connection connection)
-  (try
-    (let [topics (into-array String (map str topics))
-          cmd    (.sync ^StatefulRedisPubSubConnection @connection)]
-      (.subscribe ^RedisPubSubCommands cmd topics))
-    (catch RedisCommandInterruptedException cause
-      (throw (InterruptedException. (ex-message cause))))))
+  "Blocking operation, intended to be used on a worker/agent thread."
+  [conn & topics]
+  (us/assert! ::pubsub-connection @conn)
+  (let [topics (into-array String (map str topics))
+        cmd    (.sync ^StatefulRedisPubSubConnection @conn)]
+    (.subscribe ^RedisPubSubCommands cmd topics)))

 (defn unsubscribe!
-  "Blocking operation, intended to be used on a thread/agent thread."
-  [{:keys [::connection]} & topics]
-  (us/assert! ::pubsub-connection connection)
-  (try
-    (let [topics (into-array String (map str topics))
-          cmd    (.sync ^StatefulRedisPubSubConnection @connection)]
-      (.unsubscribe ^RedisPubSubCommands cmd topics))
-    (catch RedisCommandInterruptedException cause
-      (throw (InterruptedException. (ex-message cause))))))
-
-(defn rpush!
-  [{:keys [::connection]} key payload]
-  (us/assert! ::default-connection connection)
-  (us/assert! (or (and (vector? payload)
-                       (every? bytes? payload))
-                  (bytes? payload)))
-  (try
-    (let [cmd  (.sync ^StatefulRedisConnection @connection)
-          data (if (vector? payload) payload [payload])
-          vals (make-array (. Class (forName "[B")) (count data))]
-
-      (loop [i 0 xs (seq data)]
-        (when xs
-          (aset ^"[[B" vals i ^bytes (first xs))
-          (recur (inc i) (next xs))))
-
-      (.rpush ^RedisCommands cmd
-              ^String key
-              ^"[[B" vals))
-
-    (catch RedisCommandInterruptedException cause
-      (throw (InterruptedException. (ex-message cause))))))
-
-(defn blpop!
-  [{:keys [::connection]} timeout & keys]
-  (us/assert! ::default-connection connection)
-  (try
-    (let [keys    (into-array Object (map str keys))
-          cmd     (.sync ^StatefulRedisConnection @connection)
-          timeout (/ (double (inst-ms timeout)) 1000.0)]
-      (when-let [res (.blpop ^RedisCommands cmd
-                             ^double timeout
-                             ^"[Ljava.lang.String;" keys)]
-        (MapEntry/create
-         (.getKey ^KeyValue res)
-         (.getValue ^KeyValue res))))
-    (catch RedisCommandInterruptedException cause
-      (throw (InterruptedException. (ex-message cause))))))
+  "Blocking operation, intended to be used on a worker/agent thread."
+  [conn & topics]
+  (us/assert! ::pubsub-connection @conn)
+  (let [topics (into-array String (map str topics))
+        cmd    (.sync ^StatefulRedisPubSubConnection @conn)]
+    (.unsubscribe ^RedisPubSubCommands cmd topics)))

 (defn open?
-  [{:keys [::connection]}]
-  (us/assert! ::pubsub-connection connection)
-  (.isOpen ^StatefulConnection @connection))
+  [conn]
+  (.isOpen ^StatefulConnection @conn))

 (defn pubsub-listener
  [& {:keys [on-message on-subscribe on-unsubscribe]}]
@@ -314,6 +243,10 @@
      (when on-unsubscribe
        (on-unsubscribe nil topic count)))))

+(defn close!
+  [o]
+  (.close ^AutoCloseable o))
+
 (def ^:private scripts-cache (atom {}))
 (def noop-fn (constantly nil))

@@ -329,12 +262,12 @@
                ::rscript/vals]))

 (defn eval!
-  [{:keys [::mtx/metrics ::connection] :as state} script]
-  (us/assert! ::redis state)
-  (us/assert! ::default-connection connection)
+  [{:keys [::mtx/metrics] :as state} script]
  (us/assert! ::rscript/script script)
+  (us/assert! ::redis state)

-  (let [cmd   (.async ^StatefulRedisConnection @connection)
+  (let [rconn (-> state ::connection deref)
+        cmd   (.async ^StatefulRedisConnection rconn)
        keys  (into-array String (map str (::rscript/keys script)))
        vals  (into-array String (map str (::rscript/vals script)))
        sname (::rscript/name script)]
@@ -343,52 +276,44 @@
              (if (instance? io.lettuce.core.RedisNoScriptException cause)
                (do
                  (l/error :hint "no script found" :name sname :cause cause)
-                  (->> (load-script)
-                       (p/mapcat eval-script)))
+                  (-> (load-script)
+                      (p/then eval-script)))
                (if-let [on-error (::rscript/on-error script)]
                  (on-error cause)
                  (p/rejected cause))))

            (eval-script [sha]
              (let [tpoint (dt/tpoint)]
-                (->> (.evalsha ^RedisScriptingAsyncCommands cmd
-                               ^String sha
-                               ^ScriptOutputType ScriptOutputType/MULTI
-                               ^"[Ljava.lang.String;" keys
-                               ^"[Ljava.lang.String;" vals)
-                     (p/fmap (fn [result]
-                               (let [elapsed (tpoint)]
-                                 (mtx/run! metrics {:id :redis-eval-timing
-                                                    :labels [(name sname)]
-                                                    :val (inst-ms elapsed)})
-                                 (l/trace :hint "eval script"
-                                          :name (name sname)
-                                          :sha sha
-                                          :params (str/join "," (::rscript/vals script))
-                                          :elapsed (dt/format-duration elapsed))
-                                 result)))
-                     (p/merr on-error))))
+                (-> (.evalsha ^RedisScriptingAsyncCommands cmd
+                              ^String sha
+                              ^ScriptOutputType ScriptOutputType/MULTI
+                              ^"[Ljava.lang.String;" keys
+                              ^"[Ljava.lang.String;" vals)
+                    (p/then (fn [result]
+                              (let [elapsed (tpoint)]
+                                (mtx/run! metrics {:id :redis-eval-timing
+                                                   :labels [(name sname)]
+                                                   :val (inst-ms elapsed)})
+                                (l/trace :hint "eval script"
+                                         :name (name sname)
+                                         :sha sha
+                                         :params (str/join "," (::rscript/vals script))
+                                         :elapsed (dt/format-duration elapsed))
+                                result)))
+                    (p/catch on-error))))

            (read-script []
              (-> script ::rscript/path io/resource slurp))

            (load-script []
              (l/trace :hint "load script" :name sname)
-              (->> (.scriptLoad ^RedisScriptingAsyncCommands cmd
+              (-> (.scriptLoad ^RedisScriptingAsyncCommands cmd
                               ^String (read-script))
-                   (p/map (fn [sha]
+                  (p/then (fn [sha]
                            (swap! scripts-cache assoc sname sha)
                            sha))))]

      (if-let [sha (get @scripts-cache sname)]
        (eval-script sha)
-        (->> (load-script)
-             (p/mapcat eval-script))))))
-
-(defn timeout-exception?
-  [cause]
-  (instance? RedisCommandTimeoutException cause))
-
-(defn exception?
-  [cause]
-  (instance? RedisException cause))
+        (-> (load-script)
+            (p/then eval-script))))))
--- a/backend/src/app/rpc.clj
+++ b/backend/src/app/rpc.clj
@@ -6,288 +6,181 @@

 (ns app.rpc
  (:require
-   [app.auth.ldap :as-alias ldap]
-   [app.common.data :as d]
   [app.common.exceptions :as ex]
   [app.common.logging :as l]
   [app.common.spec :as us]
-   [app.common.uuid :as uuid]
-   [app.config :as cf]
   [app.db :as db]
   [app.http :as-alias http]
-   [app.http.access-token :as-alias actoken]
-   [app.http.client :as-alias http.client]
-   [app.http.session :as-alias session]
   [app.loggers.audit :as audit]
-   [app.loggers.webhooks :as-alias webhooks]
-   [app.main :as-alias main]
   [app.metrics :as mtx]
   [app.msgbus :as-alias mbus]
-   [app.rpc.climit :as climit]
-   [app.rpc.cond :as cond]
-   [app.rpc.helpers :as rph]
   [app.rpc.retry :as retry]
   [app.rpc.rlimit :as rlimit]
-   [app.storage :as-alias sto]
+   [app.rpc.semaphore :as-alias rsem]
   [app.util.services :as sv]
-   [app.util.time :as dt]
-   [app.worker :as-alias wrk]
+   [app.util.time :as ts]
   [clojure.spec.alpha :as s]
   [integrant.core :as ig]
   [promesa.core :as p]
   [promesa.exec :as px]
-   [yetti.request :as yrq]
   [yetti.response :as yrs]))

-(s/def ::profile-id ::us/uuid)
-
 (defn- default-handler
  [_]
  (p/rejected (ex/error :type :not-found)))

 (defn- handle-response-transformation
  [response request mdata]
-  (let [transform-fn (reduce (fn [res-fn transform-fn]
-                               (fn [request response]
-                                 (p/then (res-fn request response) #(transform-fn request %))))
-                             (constantly response)
-                             (::response-transform-fns mdata))]
-    (transform-fn request response)))
+  (let [response (if (sv/wrapped? response) @response response)]
+    (if-let [transform-fn (:transform-response mdata)]
+      (p/do (transform-fn request response))
+      (p/resolved response))))

 (defn- handle-before-comple-hook
  [response mdata]
-  (doseq [hook-fn (::before-complete-fns mdata)]
+  (when-let [hook-fn (:before-complete mdata)]
    (ex/ignoring (hook-fn)))
  response)

 (defn- handle-response
  [request result]
-  (if (fn? result)
-    (p/wrap (result request))
-    (let [mdata (meta result)]
-      (p/-> (yrs/response {:status  (::http/status mdata 200)
-                           :headers (::http/headers mdata {})
-                           :body    (rph/unwrap result)})
-            (handle-response-transformation request mdata)
-            (handle-before-comple-hook mdata)))))
+  (let [mdata (meta result)]
+    (p/-> (yrs/response 200 result (::http/headers mdata {}))
+          (handle-response-transformation request mdata)
+          (handle-before-comple-hook mdata))))

 (defn- rpc-query-handler
  "Ring handler that dispatches query requests and convert between
  internal async flow into ring async flow."
-  [methods {:keys [params path-params] :as request} respond raise]
-  (let [type       (keyword (:type path-params))
-        profile-id (or (::session/profile-id request)
-                       (::actoken/profile-id request))
+  [methods {:keys [profile-id session-id params] :as request} respond raise]
+  (let [type   (keyword (:type params))
+        data   (into {::http/request request} params)
+        data   (if profile-id
+                 (assoc data :profile-id profile-id ::session-id session-id)
+                 (dissoc data :profile-id))
+        method (get methods type default-handler)]

-        data       (-> params
-                       (assoc ::request-at (dt/now))
-                       (assoc ::http/request request))
-        data       (if profile-id
-                     (-> data
-                         (assoc :profile-id profile-id)
-                         (assoc ::profile-id profile-id))
-                     (dissoc data :profile-id ::profile-id))
-        method     (get methods type default-handler)]
-
-    (->> (method data)
-         (p/mcat (partial handle-response request))
-         (p/fnly (fn [response cause]
-                   (if cause
-                     (raise (ex/wrap-with-context cause {:profile-id profile-id}))
-                     (respond response)))))))
+    (-> (method data)
+        (p/then (partial handle-response request))
+        (p/then respond)
+        (p/catch (fn [cause]
+                   (let [context {:profile-id profile-id}]
+                     (raise (ex/wrap-with-context cause context))))))))

 (defn- rpc-mutation-handler
  "Ring handler that dispatches mutation requests and convert between
  internal async flow into ring async flow."
-  [methods {:keys [params path-params] :as request} respond raise]
-  (let [type       (keyword (:type path-params))
-        profile-id (or (::session/profile-id request)
-                       (::actoken/profile-id request))
-        data       (-> params
-                       (assoc ::request-at (dt/now))
-                       (assoc ::http/request request))
-        data       (if profile-id
-                     (-> data
-                         (assoc :profile-id profile-id)
-                         (assoc ::profile-id profile-id))
-                     (dissoc data :profile-id))
-        method     (get methods type default-handler)]
+  [methods {:keys [profile-id session-id params] :as request} respond raise]
+  (let [type   (keyword (:type params))
+        data   (into {::request request} params)
+        data   (if profile-id
+                 (assoc data :profile-id profile-id ::session-id session-id)
+                 (dissoc data :profile-id))

-    (->> (method data)
-         (p/mcat (partial handle-response request))
-         (p/fnly (fn [response cause]
-                   (if cause
-                     (raise (ex/wrap-with-context cause {:profile-id profile-id}))
-                     (respond response)))))))
+        method (get methods type default-handler)]
+    (-> (method data)
+        (p/then (partial handle-response request))
+        (p/then respond)
+        (p/catch (fn [cause]
+                   (let [context {:profile-id profile-id}]
+                     (raise (ex/wrap-with-context cause context))))))))

 (defn- rpc-command-handler
  "Ring handler that dispatches cmd requests and convert between
  internal async flow into ring async flow."
-  [methods {:keys [params path-params] :as request} respond raise]
-  (let [type       (keyword (:type path-params))
-        etag       (yrq/get-header request "if-none-match")
-        profile-id (or (::session/profile-id request)
-                       (::actoken/profile-id request))
+  [methods {:keys [profile-id session-id params] :as request} respond raise]
+  (let [cmd    (keyword (:command params))
+        data   (into {::request request} params)
+        data   (if profile-id
+                 (assoc data :profile-id profile-id ::session-id session-id)
+                 (dissoc data :profile-id))

-        data       (-> params
-                       (assoc ::request-at (dt/now))
-                       (assoc ::session/id (::session/id request))
-                       (assoc ::http/request request)
-                       (assoc ::cond/key etag)
-                       (cond-> (uuid? profile-id)
-                         (assoc ::profile-id profile-id)))
-
-        method    (get methods type default-handler)]
-
-    (binding [cond/*enabled* true]
-      (->> (method data)
-           (p/mcat (partial handle-response request))
-           (p/fnly (fn [response cause]
-                     (if cause
-                       (raise (ex/wrap-with-context cause {:profile-id profile-id}))
-                       (respond response))))))))
+        method (get methods cmd default-handler)]
+    (-> (method data)
+        (p/then (partial handle-response request))
+        (p/then respond)
+        (p/catch (fn [cause]
+                   (let [context {:profile-id profile-id}]
+                     (raise (ex/wrap-with-context cause context))))))))

 (defn- wrap-metrics
  "Wrap service method with metrics measurement."
  [{:keys [metrics ::metrics-id]} f mdata]
  (let [labels (into-array String [(::sv/name mdata)])]
    (fn [cfg params]
-      (let [tp (dt/tpoint)]
-        (->> (f cfg params)
-             (p/fnly (fn [_ _]
-                       (mtx/run! metrics
-                                 :id metrics-id
-                                 :val (inst-ms (tp))
-                                 :labels labels))))))))
-
-
-(defn- wrap-authentication
-  [_ f {:keys [::auth] :as mdata}]
-  (fn [cfg params]
-    (let [profile-id (::profile-id params)]
-      (if (and auth (not (uuid? profile-id)))
-        (p/rejected
-         (ex/error :type :authentication
-                   :code :authentication-required
-                   :hint "authentication required for this endpoint"))
-        (f cfg params)))))
-
-(defn- wrap-access-token
-  "Wraps service method with access token validation."
-  [_ f {:keys [::sv/name] :as mdata}]
-  (if (contains? cf/flags :access-tokens)
-    (fn [cfg params]
-      (let [request (::http/request params)]
-        (if (contains? request ::actoken/id)
-          (let [perms (::actoken/perms request #{})]
-            (if (contains? perms name)
-              (f cfg params)
-              (p/rejected
-               (ex/error :type :authorization
-                         :code :operation-not-allowed
-                         :allowed perms))))
-          (f cfg params))))
-    f))
+      (let [tp (ts/tpoint)]
+        (p/finally
+          (f cfg params)
+          (fn [_ _]
+            (mtx/run! metrics
+                      :id metrics-id
+                      :val (inst-ms (tp))
+                      :labels labels)))))))

 (defn- wrap-dispatch
  "Wraps service method into async flow, with the ability to dispatching
  it to a preconfigured executor service."
-  [{:keys [::wrk/executor] :as cfg} f mdata]
+  [{:keys [executor] :as cfg} f mdata]
  (with-meta
    (fn [cfg params]
-      (->> (px/submit! executor (px/wrap-bindings #(f cfg params)))
-           (p/mapcat p/wrap)
-           (p/map rph/wrap)))
+      (-> (px/submit! executor #(f cfg params))
+          (p/bind p/wrap)))
    mdata))

 (defn- wrap-audit
-  [cfg f mdata]
-  (if-let [collector (::audit/collector cfg)]
-    (letfn [(handle-audit [params result]
-              (let [resultm    (meta result)
-                    request    (::http/request params)
-
-                    profile-id (or (::audit/profile-id resultm)
-                                   (:profile-id result)
-                                   (if (= (::type cfg) "command")
-                                     (::profile-id params)
-                                     (:profile-id params))
-                                   uuid/zero)
-
-                    props      (-> (or (::audit/replace-props resultm)
-                                       (-> params
-                                           (merge (::audit/props resultm))
-                                           (dissoc :profile-id)
-                                           (dissoc :type)))
-                                   (d/without-qualified)
-                                   (d/without-nils))
-
-                    event      {:type (or (::audit/type resultm)
+  [{:keys [audit] :as cfg} f mdata]
+  (if audit
+    (with-meta
+      (fn [cfg {:keys [::request] :as params}]
+        (p/finally (f cfg params)
+                   (fn [result _]
+                     (when result
+                       (let [resultm    (meta result)
+                             profile-id (or (::audit/profile-id resultm)
+                                            (:profile-id result)
+                                            (:profile-id params))
+                             props      (or (::audit/replace-props resultm)
+                                            (-> params
+                                                (merge (::audit/props resultm))
+                                                (dissoc :type)))]
+                         (audit :cmd :submit
+                                :type (or (::audit/type resultm)
                                          (::type cfg))
                                :name (or (::audit/name resultm)
                                          (::sv/name mdata))
                                :profile-id profile-id
                                :ip-addr (some-> request audit/parse-client-ip)
-                                :props props
-
-                                ;; NOTE: for batch-key lookup we need the params as-is
-                                ;; because the rpc api does not need to know the
-                                ;; audit/webhook specific object layout.
-                                ::params (dissoc params ::http/request)
-
-                                ::webhooks/batch-key
-                                (or (::webhooks/batch-key mdata)
-                                    (::webhooks/batch-key resultm))
-
-                                ::webhooks/batch-timeout
-                                (or (::webhooks/batch-timeout mdata)
-                                    (::webhooks/batch-timeout resultm))
-
-                                ::webhooks/event?
-                                (or (::webhooks/event? mdata)
-                                    (::webhooks/event? resultm)
-                                    false)}]
-
-                (audit/submit! collector event)))
-
-            (handle-request [cfg params]
-              (->> (f cfg params)
-                   (p/mcat (fn [result]
-                             (->> (handle-audit params result)
-                                  (p/map (constantly result)))))))]
-      (if-not (::audit/skip mdata)
-        (with-meta handle-request mdata)
-        f))
+                                :props (dissoc props ::request)))))))
+      mdata)
    f))

-(defn- wrap-spec-conform
-  [_ f mdata]
-  (let [spec (or (::sv/spec mdata) (s/spec any?))]
-    (fn [cfg params]
-      (let [params (ex/try! (us/conform spec params))]
-        (if (ex/exception? params)
-          (p/rejected params)
-          (f cfg params))))))
-
-(defn- wrap-all
-  [cfg f mdata]
-  (as-> f $
-    (wrap-dispatch cfg $ mdata)
-    (wrap-metrics cfg $ mdata)
-    (cond/wrap cfg $ mdata)
-    (retry/wrap-retry cfg $ mdata)
-    (climit/wrap cfg $ mdata)
-    (rlimit/wrap cfg $ mdata)
-    (wrap-audit cfg $ mdata)
-    (wrap-spec-conform cfg $ mdata)
-    (wrap-authentication cfg $ mdata)
-    (wrap-access-token cfg $ mdata)))
-
 (defn- wrap
  [cfg f mdata]
-  (l/debug :hint "register method" :name (::sv/name mdata))
-  (let [f (wrap-all cfg f mdata)]
-    (with-meta #(f cfg %) mdata)))
+  (let [f     (as-> f $
+                (wrap-dispatch cfg $ mdata)
+                (wrap-metrics cfg $ mdata)
+                (retry/wrap-retry cfg $ mdata)
+                (rsem/wrap cfg $ mdata)
+                (rlimit/wrap cfg $ mdata)
+                (wrap-audit cfg $ mdata))
+
+        spec  (or (::sv/spec mdata) (s/spec any?))
+        auth? (:auth mdata true)]
+
+    (l/debug :hint "register method" :name (::sv/name mdata))
+    (with-meta
+      (fn [{:keys [::request] :as params}]
+        ;; Raise authentication error when rpc method requires auth but
+        ;; no profile-id is found in the request.
+        (p/do!
+         (if (and auth? (not (uuid? (:profile-id params))))
+           (ex/raise :type :authentication
+                     :code :authentication-required
+                     :hint "authentication required for this endpoint")
+           (let [params (us/conform spec (dissoc params ::request))]
+             (f cfg (assoc params ::request request))))))
+
+      mdata)))

 (defn- process-method
  [cfg vfn]
@@ -298,70 +191,68 @@
 (defn- resolve-query-methods
  [cfg]
  (let [cfg (assoc cfg ::type "query" ::metrics-id :rpc-query-timing)]
-    (->> (sv/scan-ns
-          'app.rpc.queries.projects
-          'app.rpc.queries.profile
-          'app.rpc.queries.viewer
-          'app.rpc.queries.fonts)
+    (->> (sv/scan-ns 'app.rpc.queries.projects
+                     'app.rpc.queries.files
+                     'app.rpc.queries.teams
+                     'app.rpc.queries.comments
+                     'app.rpc.queries.profile
+                     'app.rpc.queries.viewer
+                     'app.rpc.queries.fonts)
         (map (partial process-method cfg))
         (into {}))))

 (defn- resolve-mutation-methods
  [cfg]
  (let [cfg (assoc cfg ::type "mutation" ::metrics-id :rpc-mutation-timing)]
-    (->> (sv/scan-ns
-          'app.rpc.mutations.media
-          'app.rpc.mutations.profile
-          'app.rpc.mutations.projects
-          'app.rpc.mutations.fonts
-          'app.rpc.mutations.share-link)
+    (->> (sv/scan-ns 'app.rpc.mutations.media
+                     'app.rpc.mutations.profile
+                     'app.rpc.mutations.files
+                     'app.rpc.mutations.comments
+                     'app.rpc.mutations.projects
+                     'app.rpc.mutations.teams
+                     'app.rpc.mutations.management
+                     'app.rpc.mutations.fonts
+                     'app.rpc.mutations.share-link
+                     'app.rpc.mutations.verify-token)
         (map (partial process-method cfg))
         (into {}))))

 (defn- resolve-command-methods
  [cfg]
  (let [cfg (assoc cfg ::type "command" ::metrics-id :rpc-command-timing)]
-    (->> (sv/scan-ns
-          'app.rpc.commands.access-token
-          'app.rpc.commands.audit
-          'app.rpc.commands.auth
-          'app.rpc.commands.feedback
-          'app.rpc.commands.fonts
-          'app.rpc.commands.binfile
-          'app.rpc.commands.comments
-          'app.rpc.commands.demo
-          'app.rpc.commands.files
-          'app.rpc.commands.files-create
-          'app.rpc.commands.files-share
-          'app.rpc.commands.files-temp
-          'app.rpc.commands.files-update
-          'app.rpc.commands.ldap
-          'app.rpc.commands.management
-          'app.rpc.commands.media
-          'app.rpc.commands.profile
-          'app.rpc.commands.projects
-          'app.rpc.commands.search
-          'app.rpc.commands.teams
-          'app.rpc.commands.verify-token
-          'app.rpc.commands.viewer
-          'app.rpc.commands.webhooks)
+    (->> (sv/scan-ns 'app.rpc.commands.binfile
+                     'app.rpc.commands.comments
+                     'app.rpc.commands.management
+                     'app.rpc.commands.verify-token
+                     'app.rpc.commands.auth
+                     'app.rpc.commands.ldap
+                     'app.rpc.commands.demo
+                     'app.rpc.commands.files)
         (map (partial process-method cfg))
         (into {}))))

+(s/def ::audit (s/nilable fn?))
+(s/def ::http-client fn?)
+(s/def ::ldap (s/nilable map?))
+(s/def ::msgbus ::mbus/msgbus)
+(s/def ::public-uri ::us/not-empty-string)
+(s/def ::session map?)
+(s/def ::storage some?)
+(s/def ::sprops map?)
+
 (defmethod ig/pre-init-spec ::methods [_]
-  (s/keys :req [::audit/collector
-                ::session/manager
-                ::http.client/client
-                ::db/pool
-                ::mbus/msgbus
-                ::ldap/provider
-                ::sto/storage
-                ::mtx/metrics
-                ::main/props
-                ::wrk/executor]
-          :opt [::climit
-                ::rlimit]
-          :req-un [::db/pool]))
+  (s/keys :req-un [::storage
+                   ::session
+                   ::sprops
+                   ::audit
+                   ::public-uri
+                   ::msgbus
+                   ::http-client
+                   ::rsem/semaphores
+                   ::rlimit/rlimit
+                   ::mtx/metrics
+                   ::db/pool
+                   ::ldap]))

 (defmethod ig/init-key ::methods
  [_ cfg]
@@ -383,21 +274,13 @@
                   ::queries
                   ::commands]))

-(s/def ::routes vector?)
-
 (defmethod ig/pre-init-spec ::routes [_]
-  (s/keys :req [::methods
-                ::db/pool
-                ::main/props
-                ::wrk/executor
-                ::session/manager
-                ::actoken/manager]))
+  (s/keys :req-un [::methods]))

 (defmethod ig/init-key ::routes
-  [_ {:keys [::methods] :as cfg}]
-  [["/rpc" {:middleware [[session/authz cfg]
-                         [actoken/authz cfg]]}
-    ["/command/:type" {:handler (partial rpc-command-handler (:commands methods))}]
+  [_ {:keys [methods] :as cfg}]
+  [["/rpc"
+    ["/command/:command" {:handler (partial rpc-command-handler (:commands methods))}]
    ["/query/:type" {:handler (partial rpc-query-handler (:queries methods))}]
    ["/mutation/:type" {:handler (partial rpc-mutation-handler (:mutations methods))
                        :allowed-methods #{:post}}]]])
--- a/backend/src/app/rpc/climit.clj
+++ b/backend/src/app/rpc/climit.clj
@@ -1,206 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC
-
-(ns app.rpc.climit
-  "Concurrencly limiter for RPC."
-  (:require
-   [app.common.data :as d]
-   [app.common.exceptions :as ex]
-   [app.common.logging :as l]
-   [app.common.spec :as us]
-   [app.config :as cf]
-   [app.metrics :as mtx]
-   [app.rpc :as-alias rpc]
-   [app.util.services :as-alias sv]
-   [app.util.time :as dt]
-   [app.worker :as-alias wrk]
-   [clojure.edn :as edn]
-   [clojure.spec.alpha :as s]
-   [datoteka.fs :as fs]
-   [integrant.core :as ig]
-   [promesa.core :as p]
-   [promesa.exec :as px]
-   [promesa.exec.bulkhead :as pxb])
-  (:import
-   com.github.benmanes.caffeine.cache.Cache
-   com.github.benmanes.caffeine.cache.CacheLoader
-   com.github.benmanes.caffeine.cache.Caffeine
-   com.github.benmanes.caffeine.cache.RemovalListener))
-
-(defn- capacity-exception?
-  [o]
-  (and (ex/ex-info? o)
-       (let [data (ex-data o)]
-         (and (= :bulkhead-error (:type data))
-              (= :capacity-limit-reached (:code data))))))
-
-(defn invoke!
-  [limiter f]
-  (->> (px/submit! limiter f)
-       (p/hcat (fn [result cause]
-                 (cond
-                   (capacity-exception? cause)
-                   (p/rejected
-                    (ex/error :type :internal
-                              :code :concurrency-limit-reached
-                              :queue (-> limiter meta ::bkey name)
-                              :cause cause))
-
-                   (some? cause)
-                   (p/rejected cause)
-
-                   :else
-                   (p/resolved result))))))
-
-(defn- create-limiter
-  [{:keys [::wrk/executor ::mtx/metrics ::bkey ::skey concurrency queue-size]}]
-  (let [labels   (into-array String [(name bkey)])
-        on-queue (fn [instance]
-                   (l/trace :hint "enqueued"
-                            :key (name bkey)
-                            :skey (str skey)
-                            :queue-size (get instance ::pxb/current-queue-size)
-                            :concurrency (get instance ::pxb/current-concurrency))
-                   (mtx/run! metrics
-                             :id :rpc-climit-queue-size
-                             :val (get instance ::pxb/current-queue-size)
-                             :labels labels)
-                   (mtx/run! metrics
-                             :id :rpc-climit-concurrency
-                             :val (get instance ::pxb/current-concurrency)
-                             :labels labels))
-
-        on-run   (fn [instance task]
-                   (let [elapsed (- (inst-ms (dt/now))
-                                    (inst-ms task))]
-                     (l/trace :hint "execute"
-                              :key (name bkey)
-                              :skey (str skey)
-                              :elapsed (str elapsed "ms"))
-                     (mtx/run! metrics
-                               :id :rpc-climit-timing
-                               :val elapsed
-                               :labels labels)
-                     (mtx/run! metrics
-                               :id :rpc-climit-queue-size
-                               :val (get instance ::pxb/current-queue-size)
-                               :labels labels)
-                     (mtx/run! metrics
-                               :id :rpc-climit-concurrency
-                               :val (get instance ::pxb/current-concurrency)
-                               :labels labels)))
-
-        options  {:executor executor
-                  :concurrency concurrency
-                  :queue-size (or queue-size Integer/MAX_VALUE)
-                  :on-queue on-queue
-                  :on-run on-run}]
-
-    (-> (pxb/create options)
-        (vary-meta assoc ::bkey bkey ::skey skey))))
-
-(defn- create-cache
-  [{:keys [::wrk/executor] :as params} config]
-  (let [listener (reify RemovalListener
-                   (onRemoval [_ key _val cause]
-                     (l/trace :hint "cache: remove" :key key :reason (str cause))))
-
-        loader   (reify CacheLoader
-                   (load [_ key]
-                     (let [[bkey skey] key]
-                       (when-let [config (get config bkey)]
-                         (-> (merge params config)
-                             (assoc ::bkey bkey)
-                             (assoc ::skey skey)
-                             (create-limiter))))))]
-
-  (.. (Caffeine/newBuilder)
-      (weakValues)
-      (executor executor)
-      (removalListener listener)
-      (build loader))))
-
-(defprotocol IConcurrencyManager)
-
-(s/def ::concurrency ::us/integer)
-(s/def ::queue-size ::us/integer)
-(s/def ::config
-  (s/map-of keyword?
-            (s/keys :req-un [::concurrency]
-                    :opt-un [::queue-size])))
-
-(defmethod ig/prep-key ::rpc/climit
-  [_ cfg]
-  (merge {::path (cf/get :rpc-climit-config)}
-         (d/without-nils cfg)))
-
-(s/def ::path ::fs/path)
-
-(defmethod ig/pre-init-spec ::rpc/climit [_]
-  (s/keys :req [::wrk/executor ::mtx/metrics ::path]))
-
-(defmethod ig/init-key ::rpc/climit
-  [_ {:keys [::path] :as params}]
-  (when (contains? cf/flags :rpc-climit)
-    (if-let [config (some->> path slurp edn/read-string)]
-      (do
-        (l/info :hint "initializing concurrency limit" :config (str path))
-        (us/verify! ::config config)
-
-        (let [cache (create-cache params config)]
-          ^{::cache cache}
-          (reify
-            IConcurrencyManager
-            clojure.lang.IDeref
-            (deref [_] config)
-
-            clojure.lang.ILookup
-            (valAt [_ key]
-              (let [key (if (vector? key) key [key])]
-                (.get ^Cache cache key))))))
-
-      (l/warn :hint "unable to load configuration" :config (str path)))))
-
-
-(s/def ::rpc/climit
-  (s/nilable #(satisfies? IConcurrencyManager %)))
-
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; PUBLIC API
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-
-(defmacro with-dispatch
-  [lim & body]
-  `(if ~lim
-     (invoke! ~lim (^:once fn [] (p/wrap (do ~@body))))
-     (p/wrap (do ~@body))))
-
-(defn wrap
-  [{:keys [::rpc/climit]} f {:keys [::queue ::key-fn] :as mdata}]
-  (if (and (some? climit)
-           (some? queue))
-    (if-let [config (get @climit queue)]
-      (do
-        (l/debug :hint "wrap: instrumenting method"
-                 :limit-name (name queue)
-                 :service-name (::sv/name mdata)
-                 :queue-size (or (:queue-size config) Integer/MAX_VALUE)
-                 :concurrency (:concurrency config)
-                 :keyed? (some? key-fn))
-        (if (some? key-fn)
-          (fn [cfg params]
-            (let [key [queue (key-fn params)]
-                  lim (get climit key)]
-              (invoke! lim (partial f cfg params))))
-          (let [lim (get climit queue)]
-            (fn [cfg params]
-              (invoke! lim (partial f cfg params))))))
-      (do
-        (l/warn :hint "wrap: no config found"
-                :queue (name queue)
-                :service (::sv/name mdata))
-        f))
-    f))
--- a/backend/src/app/rpc/commands/access_token.clj
+++ b/backend/src/app/rpc/commands/access_token.clj
@@ -1,87 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC
-
-(ns app.rpc.commands.access-token
-  (:require
-   [app.common.spec :as us]
-   [app.common.uuid :as uuid]
-   [app.db :as db]
-   [app.main :as-alias main]
-   [app.rpc :as-alias rpc]
-   [app.rpc.doc :as-alias doc]
-   [app.rpc.quotes :as quotes]
-   [app.tokens :as tokens]
-   [app.util.services :as sv]
-   [app.util.time :as dt]
-   [clojure.spec.alpha :as s]))
-
-(defn- decode-row
-  [{:keys [perms] :as row}]
-  (cond-> row
-    (db/pgarray? perms "text")
-    (assoc :perms (db/decode-pgarray perms #{}))))
-
-(defn- create-access-token
-  [{:keys [::conn ::main/props]} profile-id name perms]
-  (let [created-at (dt/now)
-        token-id   (uuid/next)
-        token      (tokens/generate props {:iss "access-token"
-                                           :tid token-id
-                                           :iat created-at})]
-    (db/insert! conn :access-token
-                {:id token-id
-                 :name name
-                 :token token
-                 :profile-id profile-id
-                 :created-at created-at
-                 :updated-at created-at
-                 :perms (db/create-array conn "text" perms)})))
-
-(defn repl-create-access-token
-  [{:keys [::db/pool] :as system} profile-id name perms]
-  (db/with-atomic [conn pool]
-    (let [props (:app.setup/props system)]
-      (create-access-token {::conn conn ::main/props props}
-                           profile-id
-                           name
-                           perms))))
-
-(s/def ::name ::us/not-empty-string)
-(s/def ::perms ::us/set-of-strings)
-
-(s/def ::create-access-token
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::name ::perms]))
-
-(sv/defmethod ::create-access-token
-  {::doc/added "1.18"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id name perms]}]
-  (db/with-atomic [conn pool]
-    (let [cfg (assoc cfg ::conn conn)]
-      (quotes/check-quote! conn
-                           {::quotes/id ::quotes/access-tokens-per-profile
-                            ::quotes/profile-id profile-id})
-      (-> (create-access-token cfg profile-id name perms)
-          (decode-row)))))
-
-(s/def ::delete-access-token
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::us/id]))
-
-(sv/defmethod ::delete-access-token
-  {::doc/added "1.18"}
-  [{:keys [::db/pool]} {:keys [::rpc/profile-id id]}]
-  (db/delete! pool :access-token {:id id :profile-id profile-id})
-  nil)
-
-(s/def ::get-access-tokens
-  (s/keys :req [::rpc/profile-id]))
-
-(sv/defmethod ::get-access-tokens
-  {::doc/added "1.18"}
-  [{:keys [::db/pool]} {:keys [::rpc/profile-id]}]
-  (->> (db/query pool :access-token {:profile-id profile-id})
-       (mapv decode-row)))
--- a/backend/src/app/rpc/commands/audit.clj
+++ b/backend/src/app/rpc/commands/audit.clj
@@ -1,87 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC
-
-(ns app.rpc.commands.audit
-  "Audit Log related RPC methods"
-  (:require
-   [app.common.data :as d]
-   [app.common.logging :as l]
-   [app.common.spec :as us]
-   [app.common.uuid :as uuid]
-   [app.config :as cf]
-   [app.db :as db]
-   [app.http :as-alias http]
-   [app.loggers.audit :as audit]
-   [app.rpc :as-alias rpc]
-   [app.rpc.climit :as-alias climit]
-   [app.rpc.doc :as-alias doc]
-   [app.rpc.helpers :as rph]
-   [app.util.services :as sv]
-   [app.util.time :as dt]
-   [app.worker :as wrk]
-   [clojure.spec.alpha :as s]
-   [promesa.core :as p]
-   [promesa.exec :as px]))
-
-(defn- event->row [event]
-  [(uuid/next)
-   (:name event)
-   (:source event)
-   (:type event)
-   (:timestamp event)
-   (:profile-id event)
-   (db/inet (:ip-addr event))
-   (db/tjson (:props event))
-   (db/tjson (d/without-nils (:context event)))])
-
-(def ^:private event-columns
-  [:id :name :source :type :tracked-at
-   :profile-id :ip-addr :props :context])
-
-(defn- handle-events
-  [{:keys [::db/pool]} {:keys [::rpc/profile-id events ::http/request]}]
-  (let [ip-addr (audit/parse-client-ip request)
-        xform   (comp
-                 (map #(assoc % :profile-id profile-id))
-                 (map #(assoc % :ip-addr ip-addr))
-                 (map #(assoc % :source "frontend"))
-                 (filter :profile-id)
-                 (map event->row))
-        events  (sequence xform events)]
-    (when (seq events)
-      (db/insert-multi! pool :audit-log event-columns events))))
-
-(s/def ::name ::us/string)
-(s/def ::type ::us/string)
-(s/def ::props (s/map-of ::us/keyword any?))
-(s/def ::timestamp dt/instant?)
-(s/def ::context (s/map-of ::us/keyword any?))
-
-(s/def ::event
-  (s/keys :req-un [::type ::name ::props ::timestamp]
-          :opt-un [::context]))
-
-(s/def ::events (s/every ::event))
-
-(s/def ::push-audit-events
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::events]))
-
-(sv/defmethod ::push-audit-events
-  {::climit/queue :push-audit-events
-   ::climit/key-fn ::rpc/profile-id
-   ::audit/skip true
-   ::doc/added "1.17"}
-  [{:keys [::db/pool ::wrk/executor] :as cfg} params]
-  (if (or (db/read-only? pool)
-          (not (contains? cf/flags :audit-log)))
-    (do
-      (l/warn :hint "audit: http handler disabled or db is read-only")
-      (rph/wrap nil))
-
-    (->> (px/submit! executor #(handle-events cfg params))
-         (p/fmap (constantly nil)))))
-
--- a/backend/src/app/rpc/commands/auth.clj
+++ b/backend/src/app/rpc/commands/auth.clj
@@ -6,7 +6,6 @@

 (ns app.rpc.commands.auth
  (:require
-   [app.auth :as auth]
   [app.common.data :as d]
   [app.common.exceptions :as ex]
   [app.common.spec :as us]
@@ -14,18 +13,15 @@
   [app.config :as cf]
   [app.db :as db]
   [app.emails :as eml]
-   [app.http.session :as session]
   [app.loggers.audit :as audit]
-   [app.main :as-alias main]
-   [app.rpc :as-alias rpc]
-   [app.rpc.climit :as climit]
-   [app.rpc.commands.profile :as profile]
-   [app.rpc.commands.teams :as teams]
   [app.rpc.doc :as-alias doc]
-   [app.rpc.helpers :as rph]
+   [app.rpc.mutations.teams :as teams]
+   [app.rpc.queries.profile :as profile]
+   [app.rpc.semaphore :as rsem]
   [app.tokens :as tokens]
   [app.util.services :as sv]
   [app.util.time :as dt]
+   [buddy.hashers :as hashers]
   [clojure.spec.alpha :as s]
   [cuerdas.core :as str]))

@@ -33,6 +29,7 @@
 (s/def ::fullname ::us/not-empty-string)
 (s/def ::lang ::us/string)
 (s/def ::path ::us/string)
+(s/def ::profile-id ::us/uuid)
 (s/def ::password ::us/not-empty-string)
 (s/def ::old-password ::us/not-empty-string)
 (s/def ::theme ::us/string)
@@ -41,6 +38,22 @@

 ;; ---- HELPERS

+(defn derive-password
+  [password]
+  (hashers/derive password
+                  {:alg :argon2id
+                   :memory 16384
+                   :iterations 20
+                   :parallelism 2}))
+
+(defn verify-password
+  [attempt password]
+  (try
+    (hashers/verify attempt password)
+    (catch Exception _e
+      {:update false
+       :valid false})))
+
 (defn email-domain-in-whitelist?
  "Returns true if email's domain is in the given whitelist or if
  given whitelist is an empty string."
@@ -52,13 +65,26 @@
                            (str/split #"@" 2))]
      (contains? domains candidate))))

+(def ^:private sql:profile-existence
+  "select exists (select * from profile
+                   where email = ?
+                     and deleted_at is null) as val")
+
+(defn check-profile-existence!
+  [conn {:keys [email] :as params}]
+  (let [email  (str/lower email)
+        result (db/exec-one! conn [sql:profile-existence email])]
+    (when (:val result)
+      (ex/raise :type :validation
+                :code :email-already-exists))
+    params))
+
 ;; ---- COMMAND: login with password

 (defn login-with-password
-  [{:keys [::db/pool] :as cfg} {:keys [email password] :as params}]
+  [{:keys [pool session sprops] :as cfg} {:keys [email password] :as params}]

-  (when-not (or (contains? cf/flags :login)
-                (contains? cf/flags :login-with-password))
+  (when-not (contains? cf/flags :login)
    (ex/raise :type :restriction
              :code :login-disabled
              :hint "login is disabled in this instance"))
@@ -68,7 +94,7 @@
              (ex/raise :type :validation
                        :code :account-without-password
                        :hint "the current account does not have password"))
-            (:valid (auth/verify-password password (:password profile))))
+            (:valid (verify-password password (:password profile))))

          (validate-profile [profile]
            (when-not profile
@@ -91,25 +117,26 @@
            profile)]

    (db/with-atomic [conn pool]
-      (let [profile    (->> (profile/get-profile-by-email conn email)
+      (let [profile    (->> (profile/retrieve-profile-data-by-email conn email)
                            (validate-profile)
-                            (profile/decode-row)
-                            (profile/strip-private-attrs))
+                            (profile/strip-private-attrs)
+                            (profile/populate-additional-data conn)
+                            (profile/decode-profile-row))

            invitation (when-let [token (:invitation-token params)]
-                         (tokens/verify (::main/props cfg) {:token token :iss :team-invitation}))
+                         (tokens/verify sprops {:token token :iss :team-invitation}))

            ;; If invitation member-id does not matches the profile-id, we just proceed to ignore the
            ;; invitation because invitations matches exactly; and user can't login with other email and
            ;; accept invitation with other email
            response   (if (and (some? invitation) (= (:id profile) (:member-id invitation)))
                         {:invitation-token (:invitation-token params)}
-                         (assoc profile :is-admin (let [admins (cf/get :admins)]
-                                                    (contains? admins (:email profile)))))]
-        (-> response
-            (rph/with-transform (session/create-fn cfg (:id profile)))
-            (rph/with-meta {::audit/props (audit/profile->props profile)
-                            ::audit/profile-id (:id profile)}))))))
+                         profile)]
+
+        (with-meta response
+          {:transform-response ((:create session) (:id profile))
+           ::audit/props (audit/profile->props profile)
+           ::audit/profile-id (:id profile)})))))

 (s/def ::login-with-password
  (s/keys :req-un [::email ::password]
@@ -117,8 +144,8 @@

 (sv/defmethod ::login-with-password
  "Performs authentication using penpot password."
-  {::rpc/auth false
-   ::climit/queue :auth
+  {:auth false
+   ::rsem/queue :auth
   ::doc/added "1.15"}
  [cfg params]
  (login-with-password cfg params))
@@ -126,25 +153,26 @@
 ;; ---- COMMAND: Logout

 (s/def ::logout
-  (s/keys :opt [::rpc/profile-id]))
+  (s/keys :opt-un [::profile-id]))

 (sv/defmethod ::logout
  "Clears the authentication cookie and logout the current session."
-  {::rpc/auth false
+  {:auth false
   ::doc/added "1.15"}
-  [cfg _]
-  (rph/with-transform {} (session/delete-fn cfg)))
+  [{:keys [session] :as cfg} _]
+  (with-meta {}
+    {:transform-response (:delete session)}))

 ;; ---- COMMAND: Recover Profile

 (defn recover-profile
-  [{:keys [::db/pool] :as cfg} {:keys [token password]}]
+  [{:keys [pool sprops] :as cfg} {:keys [token password]}]
  (letfn [(validate-token [token]
-            (let [tdata (tokens/verify (::main/props cfg) {:token token :iss :password-recovery})]
+            (let [tdata (tokens/verify sprops {:token token :iss :password-recovery})]
              (:profile-id tdata)))

          (update-password [conn profile-id]
-            (let [pwd (auth/derive-password password)]
+            (let [pwd (derive-password password)]
              (db/update! conn :profile {:password pwd} {:id profile-id})))]

    (db/with-atomic [conn pool]
@@ -157,8 +185,8 @@
  (s/keys :req-un [::token ::password]))

 (sv/defmethod ::recover-profile
-  {::rpc/auth false
-   ::climit/queue :auth
+  {:auth false
+   ::rsem/queue :auth
   ::doc/added "1.15"}
  [cfg params]
  (recover-profile cfg params))
@@ -166,13 +194,13 @@
 ;; ---- COMMAND: Prepare Register

 (defn validate-register-attempt!
-  [{:keys [::db/pool] :as cfg} params]
+  [{:keys [pool sprops]} params]

  (when-not (contains? cf/flags :registration)
    (if-not (contains? params :invitation-token)
      (ex/raise :type :restriction
                :code :registration-disabled)
-      (let [invitation (tokens/verify (::main/props cfg) {:token (:invitation-token params) :iss :team-invitation})]
+      (let [invitation (tokens/verify sprops {:token (:invitation-token params) :iss :team-invitation})]
        (when-not (= (:email params) (:member-email invitation))
          (ex/raise :type :restriction
                    :code :email-does-not-match-invitation
@@ -206,11 +234,11 @@
    (pos? (compare elapsed register-retry-threshold))))

 (defn prepare-register
-  [{:keys [::db/pool] :as cfg} params]
+  [{:keys [pool sprops] :as cfg} params]

  (validate-register-attempt! cfg params)

-  (let [profile (when-let [profile (profile/get-profile-by-email pool (:email params))]
+  (let [profile (when-let [profile (profile/retrieve-profile-data-by-email pool (:email params))]
                  (cond
                    (:is-blocked profile)
                    (ex/raise :type :restriction
@@ -235,7 +263,7 @@

        params (d/without-nils params)

-        token  (tokens/generate (::main/props cfg) params)]
+        token  (tokens/generate sprops params)]
    (with-meta {:token token}
      {::audit/profile-id uuid/zero})))

@@ -244,28 +272,26 @@
          :opt-un [::invitation-token]))

 (sv/defmethod ::prepare-register-profile
-  {::rpc/auth false
+  {:auth false
   ::doc/added "1.15"}
  [cfg params]
  (prepare-register cfg params))

 ;; ---- COMMAND: Register Profile

-(defn create-profile!
+(defn create-profile
  "Create the profile entry on the database with limited set of input
  attrs (all the other attrs are filled with default values)."
-  [conn {:keys [email] :as params}]
-  (us/assert! ::us/email email)
+  [conn params]
  (let [id        (or (:id params) (uuid/next))
        props     (-> (audit/extract-utm-params params)
                      (merge (:props params))
                      (merge {:viewed-tutorial? false
-                              :viewed-walkthrough? false
-                              :nudge {:big 10 :small 1}})
+                              :viewed-walkthrough? false})
                      (db/tjson))

        password  (if-let [password (:password params)]
-                    (auth/derive-password password)
+                    (derive-password password)
                    "!")

        locale    (:locale params)
@@ -276,7 +302,7 @@
        is-demo   (:is-demo params false)
        is-muted  (:is-muted params false)
        is-active (:is-active params false)
-        email     (str/lower email)
+        email     (str/lower (:email params))

        params    {:id id
                   :fullname (:fullname params)
@@ -291,38 +317,35 @@
                   :is-demo is-demo}]
    (try
      (-> (db/insert! conn :profile params)
-          (profile/decode-row))
+          (profile/decode-profile-row))
      (catch org.postgresql.util.PSQLException e
        (let [state (.getSQLState e)]
          (if (not= state "23505")
            (throw e)
            (ex/raise :type :validation
                      :code :email-already-exists
-                      :hint "email already exists"
                      :cause e)))))))

-(defn create-profile-rels!
-  [conn {:keys [id] :as profile}]
-  (let [team (teams/create-team conn {:profile-id id
+(defn create-profile-relations
+  [conn profile]
+  (let [team (teams/create-team conn {:profile-id (:id profile)
                                      :name "Default"
                                      :is-default true})]
-    (-> (db/update! conn :profile
-                    {:default-team-id (:id team)
-                     :default-project-id  (:default-project-id team)}
-                    {:id id})
-        (profile/decode-row))))
-
+    (-> profile
+        (profile/strip-private-attrs)
+        (assoc :default-team-id (:id team))
+        (assoc :default-project-id (:default-project-id team)))))

 (defn send-email-verification!
-  [conn props profile]
-  (let [vtoken (tokens/generate props
+  [conn sprops profile]
+  (let [vtoken (tokens/generate sprops
                                {:iss :verify-email
                                 :exp (dt/in-future "72h")
                                 :profile-id (:id profile)
                                 :email (:email profile)})
        ;; NOTE: this token is mainly used for possible complains
        ;; identification on the sns webhook
-        ptoken (tokens/generate props
+        ptoken (tokens/generate sprops
                                {:iss :profile-identity
                                 :profile-id (:id profile)
                                 :exp (dt/in-future {:days 30})})]
@@ -335,31 +358,36 @@
                :extra-data ptoken})))

 (defn register-profile
-  [{:keys [conn] :as cfg} {:keys [token] :as params}]
-  (let [claims     (tokens/verify (::main/props cfg) {:token token :iss :prepared-register})
+  [{:keys [conn sprops session] :as cfg} {:keys [token] :as params}]
+  (let [claims     (tokens/verify sprops {:token token :iss :prepared-register})
        params     (merge params claims)

        is-active  (or (:is-active params)
-                       (not (contains? cf/flags :email-verification)))
+                       (not (contains? cf/flags :email-verification))
+
+                       ;; DEPRECATED: v1.15
+                       (contains? cf/flags :insecure-register))

        profile    (if-let [profile-id (:profile-id claims)]
-                     (profile/get-profile conn profile-id)
-                     (->> (create-profile! conn (assoc params :is-active is-active))
-                          (create-profile-rels! conn)))
+                     (profile/retrieve-profile conn profile-id)
+                     (->> (assoc params :is-active is-active)
+                          (create-profile conn)
+                          (create-profile-relations conn)
+                          (profile/decode-profile-row)))
+        audit-fn   (:audit cfg)

        invitation (when-let [token (:invitation-token params)]
-                     (tokens/verify (::main/props cfg) {:token token :iss :team-invitation}))]
+                     (tokens/verify sprops {:token token :iss :team-invitation}))]

    ;; If profile is filled in claims, means it tries to register
    ;; again, so we proceed to update the modified-at attr
    ;; accordingly.
    (when-let [id (:profile-id claims)]
      (db/update! conn :profile {:modified-at (dt/now)} {:id id})
-      (when-let [collector (::audit/collector cfg)]
-        (audit/submit! collector
-                       {:type "fact"
-                        :name "register-profile-retry"
-                        :profile-id id})))
+      (audit-fn :cmd :submit
+                :type "fact"
+                :name "register-profile-retry"
+                :profile-id id))

    (cond
      ;; If invitation token comes in params, this is because the
@@ -370,35 +398,35 @@
      ;; email.
      (and (some? invitation) (= (:email profile) (:member-email invitation)))
      (let [claims (assoc invitation :member-id  (:id profile))
-            token  (tokens/generate (::main/props cfg) claims)
+            token  (tokens/generate sprops claims)
            resp   {:invitation-token token}]
-        (-> resp
-            (rph/with-transform (session/create-fn cfg (:id profile)))
-            (rph/with-meta {::audit/replace-props (audit/profile->props profile)
-                            ::audit/profile-id (:id profile)})))
+        (with-meta resp
+          {:transform-response ((:create session) (:id profile))
+           ::audit/replace-props (audit/profile->props profile)
+           ::audit/profile-id (:id profile)}))

      ;; If auth backend is different from "penpot" means user is
      ;; registering using third party auth mechanism; in this case
      ;; we need to mark this session as logged.
      (not= "penpot" (:auth-backend profile))
-      (-> (profile/strip-private-attrs profile)
-          (rph/with-transform (session/create-fn cfg (:id profile)))
-          (rph/with-meta {::audit/replace-props (audit/profile->props profile)
-                          ::audit/profile-id (:id profile)}))
+      (with-meta (profile/strip-private-attrs profile)
+        {:transform-response ((:create session) (:id profile))
+         ::audit/replace-props (audit/profile->props profile)
+         ::audit/profile-id (:id profile)})

      ;; If the `:enable-insecure-register` flag is set, we proceed
      ;; to sign in the user directly, without email verification.
      (true? is-active)
-      (-> (profile/strip-private-attrs profile)
-          (rph/with-transform (session/create-fn cfg (:id profile)))
-          (rph/with-meta {::audit/replace-props (audit/profile->props profile)
-                          ::audit/profile-id (:id profile)}))
+      (with-meta (profile/strip-private-attrs profile)
+        {:transform-response ((:create session) (:id profile))
+         ::audit/replace-props (audit/profile->props profile)
+         ::audit/profile-id (:id profile)})

      ;; In all other cases, send a verification email.
      :else
      (do
-        (send-email-verification! conn (::main/props cfg) profile)
-        (rph/with-meta profile
+        (send-email-verification! conn sprops profile)
+        (with-meta profile
          {::audit/replace-props (audit/profile->props profile)
           ::audit/profile-id (:id profile)})))))

@@ -406,10 +434,10 @@
  (s/keys :req-un [::token ::fullname]))

 (sv/defmethod ::register-profile
-  {::rpc/auth false
-   ::climit/queue :auth
+  {:auth false
+   ::rsem/queue :auth
   ::doc/added "1.15"}
-  [{:keys [::db/pool] :as cfg} params]
+  [{:keys [pool] :as cfg} params]
  (db/with-atomic [conn pool]
    (-> (assoc cfg :conn conn)
        (register-profile params))))
@@ -417,22 +445,22 @@
 ;; ---- COMMAND: Request Profile Recovery

 (defn request-profile-recovery
-  [{:keys [::db/pool] :as cfg} {:keys [email] :as params}]
+  [{:keys [pool sprops] :as cfg} {:keys [email] :as params}]
  (letfn [(create-recovery-token [{:keys [id] :as profile}]
-            (let [token (tokens/generate (::main/props cfg)
+            (let [token (tokens/generate sprops
                                         {:iss :password-recovery
                                          :exp (dt/in-future "15m")
                                          :profile-id id})]
              (assoc profile :token token)))

          (send-email-notification [conn profile]
-            (let [ptoken (tokens/generate (::main/props cfg)
+            (let [ptoken (tokens/generate sprops
                                          {:iss :profile-identity
                                           :profile-id (:id profile)
                                           :exp (dt/in-future {:days 30})})]
              (eml/send! {::eml/conn conn
                          ::eml/factory eml/password-recovery
-                          :public-uri (cf/get :public-uri)
+                          :public-uri (:public-uri cfg)
                          :to (:email profile)
                          :token (:token profile)
                          :name (:fullname profile)
@@ -440,7 +468,7 @@
              nil))]

    (db/with-atomic [conn pool]
-      (when-let [profile (profile/get-profile-by-email conn email)]
+      (when-let [profile (profile/retrieve-profile-data-by-email conn email)]
        (when-not (eml/allow-send-emails? conn profile)
          (ex/raise :type :validation
                    :code :profile-is-muted
@@ -464,7 +492,7 @@
  (s/keys :req-un [::email]))

 (sv/defmethod ::request-profile-recovery
-  {::rpc/auth false
+  {:auth false
   ::doc/added "1.15"}
  [cfg params]
  (request-profile-recovery cfg params))
--- a/backend/src/app/rpc/commands/binfile.clj
+++ b/backend/src/app/rpc/commands/binfile.clj
@@ -9,28 +9,21 @@
  (:require
   [app.common.data :as d]
   [app.common.exceptions :as ex]
-   [app.common.files.features :as ffeat]
   [app.common.logging :as l]
   [app.common.pages.migrations :as pmg]
   [app.common.spec :as us]
   [app.common.uuid :as uuid]
   [app.config :as cf]
   [app.db :as db]
-   [app.loggers.audit :as-alias audit]
-   [app.loggers.webhooks :as-alias webhooks]
   [app.media :as media]
-   [app.rpc :as-alias rpc]
-   [app.rpc.commands.files :as files]
-   [app.rpc.commands.projects :as projects]
   [app.rpc.doc :as-alias doc]
-   [app.rpc.helpers :as rph]
+   [app.rpc.queries.files :as files]
+   [app.rpc.queries.projects :as projects]
   [app.storage :as sto]
   [app.storage.tmp :as tmp]
   [app.tasks.file-gc]
   [app.util.blob :as blob]
   [app.util.fressian :as fres]
-   [app.util.objects-map :as omap]
-   [app.util.pointer-map :as pmap]
   [app.util.services :as sv]
   [app.util.time :as dt]
   [clojure.spec.alpha :as s]
@@ -296,11 +289,9 @@

 (defn- retrieve-file
  [pool file-id]
-  (with-open [^AutoCloseable conn (db/open pool)]
-    (binding [pmap/*load-fn* (partial files/load-pointer conn file-id)]
-      (some-> (db/get* conn :file {:id file-id})
-              (files/decode-row)
-              (update :data files/process-pointers deref)))))
+  (->> (db/query pool :file {:id file-id})
+       (map files/decode-row)
+       (first)))

 (def ^:private sql:file-media-objects
  "SELECT * FROM file_media_object WHERE id = ANY(?)")
@@ -438,8 +429,9 @@
 (s/def ::embed-assets? (s/nilable ::us/boolean))

 (s/def ::write-export-options
-  (s/keys :req [::db/pool ::sto/storage ::output ::file-ids]
-          :opt [::include-libraries? ::embed-assets?]))
+  (s/keys :req-un [::db/pool ::sto/storage]
+          :req    [::output ::file-ids]
+          :opt    [::include-libraries? ::embed-assets?]))

 (defn write-export!
  "Do the exportation of a specified file in custom penpot binary
@@ -476,7 +468,7 @@
              [:v1/metadata :v1/files :v1/rels :v1/sobjects])))))

 (defmethod write-section :v1/metadata
-  [{:keys [::db/pool ::output ::file-ids ::include-libraries?]}]
+  [{:keys [pool ::output ::file-ids ::include-libraries?]}]
  (let [libs  (when include-libraries?
                (retrieve-libraries pool file-ids))
        files (into file-ids libs)]
@@ -484,7 +476,7 @@
    (vswap! *state* assoc :files files)))

 (defmethod write-section :v1/files
-  [{:keys [::db/pool ::output ::embed-assets?]}]
+  [{:keys [pool ::output ::embed-assets?]}]

  ;; Initialize SIDS with empty vector
  (vswap! *state* assoc :sids [])
@@ -508,7 +500,7 @@
      (vswap! *state* update :sids into storage-object-id-xf media))))

 (defmethod write-section :v1/rels
-  [{:keys [::db/pool ::output ::include-libraries?]}]
+  [{:keys [pool  ::output ::include-libraries?]}]
  (let [rels  (when include-libraries?
                (retrieve-library-relations pool (-> *state* deref :files)))]
    (l/debug :hint "found rels" :total (count rels) ::l/async false)
@@ -556,8 +548,9 @@
 (s/def ::ignore-index-errors? (s/nilable ::us/boolean))

 (s/def ::read-import-options
-  (s/keys :req [::db/pool ::sto/storage ::project-id ::input]
-          :opt [::overwrite? ::migrate? ::ignore-index-errors?]))
+  (s/keys :req-un [::db/pool ::sto/storage]
+          :req    [::project-id ::input]
+          :opt    [::overwrite? ::migrate? ::ignore-index-errors?]))

 (defn read-import!
  "Do the importation of the specified resource in penpot custom binary
@@ -580,7 +573,7 @@
    (read-import (assoc options ::version version ::timestamp timestamp))))

 (defmethod read-import :v1
-  [{:keys [::db/pool ::input] :as options}]
+  [{:keys [pool ::input] :as options}]
  (with-open [input (zstd-input-stream input)]
    (with-open [input (io/data-input-stream input)]
      (db/with-atomic [conn pool]
@@ -609,23 +602,12 @@
    (vswap! *state* update :index update-index files)
    (vswap! *state* assoc :version version :files files)))

-(defn- postprocess-file
-  [data]
-  (let [omap-wrap ffeat/*wrap-with-objects-map-fn*
-        pmap-wrap ffeat/*wrap-with-pointer-map-fn*]
-    (-> data
-        (update :pages-index update-vals #(update % :objects omap-wrap))
-        (update :pages-index update-vals pmap-wrap)
-        (update :components update-vals #(update % :objects omap-wrap))
-        (update :components pmap-wrap))))
-
 (defmethod read-section :v1/files
  [{:keys [conn ::input ::migrate? ::project-id ::timestamp ::overwrite?]}]
  (doseq [expected-file-id (-> *state* deref :files)]
-    (let [file     (read-obj! input)
-          media'   (read-obj! input)
-          file-id  (:id file)
-          features files/default-features]
+    (let [file    (read-obj! input)
+          media'  (read-obj! input)
+          file-id (:id file)]

      (when (not= file-id expected-file-id)
        (ex/raise :type :validation
@@ -640,42 +622,33 @@
      (l/debug :hint "update media references" ::l/async false)
      (vswap! *state* update :media into (map #(update % :id lookup-index)) media')

-      (l/debug :hint "processing file" :file-id file-id ::features features ::l/async false)
+      (l/debug :hint "processing file" :file-id file-id ::l/async false)

-      (binding [ffeat/*current* features
-                ffeat/*wrap-with-objects-map-fn* (if (features "storage/objects-map") omap/wrap identity)
-                ffeat/*wrap-with-pointer-map-fn* (if (features "storage/pointer-map") pmap/wrap identity)
-                pmap/*tracked* (atom {})]
+      (let [file-id' (lookup-index file-id)
+            data     (-> (:data file)
+                         (assoc :id file-id')
+                         (cond-> migrate? (pmg/migrate-data))
+                         (update :pages-index relink-shapes)
+                         (update :components relink-shapes)
+                         (update :media relink-media))

-        (let [file-id' (lookup-index file-id)
-              data     (-> (:data file)
-                           (assoc :id file-id')
-                           (cond-> migrate? (pmg/migrate-data))
-                           (update :pages-index relink-shapes)
-                           (update :components relink-shapes)
-                           (update :media relink-media)
-                           (postprocess-file))
+            params  {:id file-id'
+                     :project-id project-id
+                     :name (str "Imported: " (:name file))
+                     :revn (:revn file)
+                     :is-shared (:is-shared file)
+                     :data (blob/encode data)
+                     :created-at timestamp
+                     :modified-at timestamp}]

-              params  {:id file-id'
-                       :project-id project-id
-                       :features (db/create-array conn "text" features)
-                       :name (:name file)
-                       :revn (:revn file)
-                       :is-shared (:is-shared file)
-                       :data (blob/encode data)
-                       :created-at timestamp
-                       :modified-at timestamp}]
+        (l/debug :hint "create file" :id file-id' ::l/async false)

-          (l/debug :hint "create file" :id file-id' ::l/async false)
+        (if overwrite?
+          (create-or-update-file conn params)
+          (db/insert! conn :file params))

-          (if overwrite?
-            (create-or-update-file conn params)
-            (db/insert! conn :file params))
-
-          (files/persist-pointers! conn file-id')
-
-          (when overwrite?
-            (db/delete! conn :file-thumbnail {:file-id file-id'})))))))
+        (when overwrite?
+          (db/delete! conn :file-thumbnail {:file-id file-id'}))))))

 (defmethod read-section :v1/rels
  [{:keys [conn ::input ::timestamp]}]
@@ -693,7 +666,7 @@
        (db/insert! conn :file-library-rel rel)))))

 (defmethod read-section :v1/sobjects
-  [{:keys [::sto/storage conn ::input ::overwrite?]}]
+  [{:keys [storage conn ::input ::overwrite?]}]
  (let [storage (media/configure-assets-storage storage)
        ids     (read-obj! input)]

@@ -834,7 +807,7 @@
        cs (volatile! nil)]
    (try
      (l/info :hint "start exportation" :export-id id)
-      (with-open [^AutoCloseable output (io/output-stream output)]
+      (with-open [output (io/output-stream output)]
        (binding [*position* (atom 0)]
          (write-export! (assoc cfg ::output output))))

@@ -857,19 +830,19 @@
 (defn export-to-tmpfile!
  [cfg]
  (let [path (tmp/tempfile :prefix "penpot.export.")]
-    (with-open [^AutoCloseable output (io/output-stream path)]
+    (with-open [output (io/output-stream path)]
      (export! cfg output)
      path)))

 (defn import!
  [{:keys [::input] :as cfg}]
  (let [id (uuid/next)
-        tp (dt/tpoint)
+        ts (dt/now)
        cs (volatile! nil)]
-    (l/info :hint "import: started" :import-id id)
    (try
+      (l/info :hint "start importation" :import-id id)
      (binding [*position* (atom 0)]
-        (with-open [^AutoCloseable input (io/input-stream input)]
+        (with-open [input (io/input-stream input)]
          (read-import! (assoc cfg ::input input))))

      (catch Throwable cause
@@ -877,30 +850,27 @@
        (throw cause))

      (finally
-        (l/info :hint "import: terminated"
-                :import-id id
-                :elapsed (dt/format-duration (tp))
+        (l/info :hint "importation finished" :import-id id
+                :elapsed (str (inst-ms (dt/diff ts (dt/now))) "ms")
                :error? (some? @cs)
-                :cause @cs
-                )))))
+                :cause @cs)))))

 ;; --- Command: export-binfile

 (s/def ::file-id ::us/uuid)
+(s/def ::profile-id ::us/uuid)
 (s/def ::include-libraries? ::us/boolean)
 (s/def ::embed-assets? ::us/boolean)

 (s/def ::export-binfile
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::file-id ::include-libraries? ::embed-assets?]))
+  (s/keys :req-un [::profile-id ::file-id ::include-libraries? ::embed-assets?]))

 (sv/defmethod ::export-binfile
  "Export a penpot file in a binary format."
-  {::doc/added "1.15"
-   ::webhooks/event? true}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id file-id include-libraries? embed-assets?] :as params}]
+  {::doc/added "1.15"}
+  [{:keys [pool] :as cfg} {:keys [profile-id file-id include-libraries? embed-assets?] :as params}]
  (files/check-read-permissions! pool profile-id file-id)
-  (let [body (reify yrs/StreamableResponseBody
+  (let [resp (reify yrs/StreamableResponseBody
               (-write-body-to-stream [_ _ output-stream]
                 (-> cfg
                     (assoc ::file-ids [file-id])
@@ -908,24 +878,23 @@
                     (assoc ::include-libraries? include-libraries?)
                     (export! output-stream))))]

-    (fn [_]
-      (yrs/response 200 body {"content-type" "application/octet-stream"}))))
+    (with-meta (sv/wrap nil)
+      {:transform-response (fn [_ response]
+                             (-> response
+                                 (assoc :body resp)
+                                 (assoc :headers {"content-type" "application/octet-stream"})))})))

 (s/def ::file ::media/upload)
 (s/def ::import-binfile
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::project-id ::file]))
+  (s/keys :req-un [::profile-id ::project-id ::file]))

 (sv/defmethod ::import-binfile
  "Import a penpot file in a binary format."
-  {::doc/added "1.15"
-   ::webhooks/event? true}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id project-id file] :as params}]
+  {::doc/added "1.15"}
+  [{:keys [pool] :as cfg} {:keys [profile-id project-id file] :as params}]
  (db/with-atomic [conn pool]
    (projects/check-read-permissions! conn profile-id project-id)
-    (let [ids (import! (assoc cfg
-                              ::input (:path file)
-                              ::project-id project-id
-                              ::ignore-index-errors? true))]
-      (rph/with-meta ids
-        {::audit/props {:file nil :file-ids ids}}))))
+    (import! (assoc cfg
+                    ::input (:path file)
+                    ::project-id project-id
+                    ::ignore-index-errors? true))))
--- a/backend/src/app/rpc/commands/comments.clj
+++ b/backend/src/app/rpc/commands/comments.clj
@@ -6,26 +6,22 @@

 (ns app.rpc.commands.comments
  (:require
-   [app.common.data.macros :as dm]
   [app.common.exceptions :as ex]
   [app.common.geom.point :as gpt]
   [app.common.spec :as us]
-   [app.common.uuid :as uuid]
   [app.db :as db]
-   [app.loggers.audit :as-alias audit]
-   [app.loggers.webhooks :as-alias webhooks]
-   [app.rpc :as-alias rpc]
-   [app.rpc.commands.files :as files]
-   [app.rpc.commands.teams :as teams]
   [app.rpc.doc :as-alias doc]
-   [app.rpc.quotes :as quotes]
-   [app.util.pointer-map :as pmap]
-   [app.util.retry :as rtry]
+   [app.rpc.queries.files :as files]
+   [app.rpc.queries.teams :as teams]
+   [app.rpc.retry :as retry]
+   [app.util.blob :as blob]
   [app.util.services :as sv]
   [app.util.time :as dt]
   [clojure.spec.alpha :as s]))

-;; --- GENERAL PURPOSE INTERNAL HELPERS
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; QUERY COMMANDS
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

 (defn decode-row
  [{:keys [participants position] :as row}]
@@ -33,77 +29,23 @@
    (db/pgpoint? position) (assoc :position (db/decode-pgpoint position))
    (db/pgobject? participants) (assoc :participants (db/decode-transit-pgobject participants))))

-(def sql:get-file
-  "select f.id, f.modified_at, f.revn, f.features,
-          f.project_id, p.team_id, f.data
-     from file as f
-     join project as p on (p.id = f.project_id)
-    where f.id = ?
-      and f.deleted_at is null")
-
-(defn- get-file
-  "A specialized version of get-file for comments module."
-  [conn file-id page-id]
-  (binding [pmap/*load-fn* (partial files/load-pointer conn file-id)]
-    (if-let [{:keys [data] :as file} (some-> (db/exec-one! conn [sql:get-file file-id]) (files/decode-row))]
-      (-> file
-          (assoc :page-name (dm/get-in data [:pages-index page-id :name]))
-          (assoc :page-id page-id))
-      (ex/raise :type :not-found
-                :code :object-not-found
-                :hint "file not found"))))
-
-(defn- get-comment-thread
-  [conn thread-id & {:as opts}]
-  (-> (db/get-by-id conn :comment-thread thread-id opts)
-      (decode-row)))
-
-(defn- get-comment
-  [conn comment-id & {:keys [for-update?]}]
-  (db/get-by-id conn :comment comment-id {:for-update for-update?}))
-
-(defn- get-next-seqn
-  [conn file-id]
-  (let [sql "select (f.comment_thread_seqn + 1) as next_seqn from file as f where f.id = ?"
-        res (db/exec-one! conn [sql file-id])]
-    (:next-seqn res)))
-
-(def sql:upsert-comment-thread-status
-  "insert into comment_thread_status (thread_id, profile_id, modified_at)
-   values (?, ?, ?)
-       on conflict (thread_id, profile_id)
-       do update set modified_at = ?
-   returning modified_at;")
-
-(defn upsert-comment-thread-status!
-  ([conn profile-id thread-id]
-   (upsert-comment-thread-status! conn profile-id thread-id (dt/now)))
-  ([conn profile-id thread-id mod-at]
-   (db/exec-one! conn [sql:upsert-comment-thread-status thread-id profile-id mod-at mod-at])))
-
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; QUERY COMMANDS
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-
 ;; --- COMMAND: Get Comment Threads

-(declare ^:private get-comment-threads)
+(declare retrieve-comment-threads)

 (s/def ::team-id ::us/uuid)
 (s/def ::file-id ::us/uuid)
 (s/def ::share-id (s/nilable ::us/uuid))

 (s/def ::get-comment-threads
-  (s/and (s/keys :req [::rpc/profile-id]
+  (s/and (s/keys :req-un [::profile-id]
                 :opt-un [::file-id ::share-id ::team-id])
         #(or (:file-id %) (:team-id %))))

 (sv/defmethod ::get-comment-threads
-  {::doc/added "1.15"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id file-id share-id] :as params}]
+  [{:keys [pool] :as cfg} params]
  (with-open [conn (db/open pool)]
-    (files/check-comment-permissions! conn profile-id file-id share-id)
-    (get-comment-threads conn profile-id file-id)))
+    (retrieve-comment-threads conn params)))

 (def sql:comment-threads
  "select distinct on (ct.id)
@@ -127,26 +69,25 @@
    where ct.file_id = ?
   window w as (partition by c.thread_id order by c.created_at asc)")

-(defn- get-comment-threads
-  [conn profile-id file-id]
+(defn retrieve-comment-threads
+  [conn {:keys [profile-id file-id share-id]}]
+  (files/check-comment-permissions! conn profile-id file-id share-id)
  (->> (db/exec! conn [sql:comment-threads profile-id file-id])
       (into [] (map decode-row))))

 ;; --- COMMAND: Get Unread Comment Threads

-(declare ^:private get-unread-comment-threads)
+(declare retrieve-unread-comment-threads)

 (s/def ::team-id ::us/uuid)
 (s/def ::get-unread-comment-threads
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id]))
+  (s/keys :req-un [::profile-id ::team-id]))

 (sv/defmethod ::get-unread-comment-threads
-  {::doc/added "1.15"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id team-id] :as params}]
+  [{:keys [pool] :as cfg} {:keys [profile-id team-id] :as params}]
  (with-open [conn (db/open pool)]
    (teams/check-read-permissions! conn profile-id team-id)
-    (get-unread-comment-threads conn profile-id team-id)))
+    (retrieve-unread-comment-threads conn params)))

 (def sql:comment-threads-by-team
  "select distinct on (ct.id)
@@ -175,22 +116,22 @@
  (str "with threads as (" sql:comment-threads-by-team ")"
       "select * from threads where count_unread_comments > 0"))

-(defn- get-unread-comment-threads
-  [conn profile-id team-id]
+(defn retrieve-unread-comment-threads
+  [conn {:keys [profile-id team-id]}]
  (->> (db/exec! conn [sql:unread-comment-threads-by-team profile-id team-id])
       (into [] (map decode-row))))


 ;; --- COMMAND: Get Single Comment Thread

+(s/def ::id ::us/uuid)
+(s/def ::share-id (s/nilable ::us/uuid))
 (s/def ::get-comment-thread
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::file-id ::us/id]
+  (s/keys :req-un [::profile-id ::file-id ::id]
          :opt-un [::share-id]))

 (sv/defmethod ::get-comment-thread
-  {::doc/added "1.15"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id file-id id share-id] :as params}]
+  [{:keys [pool] :as cfg} {:keys [profile-id file-id id share-id] :as params}]
  (with-open [conn (db/open pool)]
    (files/check-comment-permissions! conn profile-id file-id share-id)
    (let [sql (str "with threads as (" sql:comment-threads ")"
@@ -198,30 +139,37 @@
      (-> (db/exec-one! conn [sql profile-id file-id id])
          (decode-row)))))

+(defn get-comment-thread
+  [conn {:keys [profile-id file-id id] :as params}]
+  (let [sql (str "with threads as (" sql:comment-threads ")"
+                 "select * from threads where id = ?")]
+    (-> (db/exec-one! conn [sql profile-id file-id id])
+        (decode-row))))
+
 ;; --- COMMAND: Retrieve Comments

-(declare ^:private get-comments)
+(declare get-comments)

+(s/def ::file-id ::us/uuid)
+(s/def ::share-id (s/nilable ::us/uuid))
 (s/def ::thread-id ::us/uuid)
 (s/def ::get-comments
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::thread-id]
+  (s/keys :req-un [::profile-id ::thread-id]
          :opt-un [::share-id]))

 (sv/defmethod ::get-comments
-  {::doc/added "1.15"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id thread-id share-id] :as params}]
+  [{:keys [pool] :as cfg} {:keys [profile-id thread-id share-id] :as params}]
  (with-open [conn (db/open pool)]
-    (let [{:keys [file-id] :as thread} (get-comment-thread conn thread-id)]
-      (files/check-comment-permissions! conn profile-id file-id share-id)
-      (get-comments conn thread-id))))
+    (let [thread (db/get-by-id conn :comment-thread thread-id)]
+      (files/check-comment-permissions! conn profile-id (:file-id thread) share-id))
+    (get-comments conn thread-id)))

 (def sql:comments
  "select c.* from comment as c
    where c.thread_id = ?
    order by c.created_at asc")

-(defn- get-comments
+(defn get-comments
  [conn thread-id]
  (->> (db/query conn :comment
                 {:thread-id thread-id}
@@ -230,6 +178,25 @@

 ;; --- COMMAND: Get file comments users

+(declare get-file-comments-users)
+
+(s/def ::file-id ::us/uuid)
+(s/def ::share-id (s/nilable ::us/uuid))
+
+(s/def ::get-profiles-for-file-comments
+  (s/keys :req-un [::profile-id ::file-id]
+          :opt-un [::share-id]))
+
+(sv/defmethod ::get-profiles-for-file-comments
+  "Retrieves a list of profiles with limited set of properties of all
+  participants on comment threads of the file."
+  {::doc/added "1.15"
+   ::doc/changes ["1.15" "Imported from queries and renamed."]}
+  [{:keys [pool] :as cfg} {:keys [profile-id file-id share-id]}]
+  (with-open [conn (db/open pool)]
+    (files/check-comment-permissions! conn profile-id file-id share-id)
+    (get-file-comments-users conn file-id profile-id)))
+
 ;; All the profiles that had comment the file, plus the current
 ;; profile.

@@ -252,113 +219,86 @@
  [conn file-id profile-id]
  (db/exec! conn [sql:file-comment-users file-id profile-id]))

-(s/def ::get-profiles-for-file-comments
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::file-id]
-          :opt-un [::share-id]))
-
-(sv/defmethod ::get-profiles-for-file-comments
-  "Retrieves a list of profiles with limited set of properties of all
-  participants on comment threads of the file."
-  {::doc/added "1.15"
-   ::doc/changes ["1.15" "Imported from queries and renamed."]}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id file-id share-id]}]
-  (with-open [conn (db/open pool)]
-    (files/check-comment-permissions! conn profile-id file-id share-id)
-    (get-file-comments-users conn file-id profile-id)))

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; MUTATION COMMANDS
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

-(declare ^:private create-comment-thread)
-
 ;; --- COMMAND: Create Comment Thread

+(declare upsert-comment-thread-status!)
+(declare create-comment-thread)
+(declare retrieve-page-name)
+
 (s/def ::page-id ::us/uuid)
+(s/def ::file-id ::us/uuid)
+(s/def ::share-id (s/nilable ::us/uuid))
+(s/def ::profile-id ::us/uuid)
 (s/def ::position ::gpt/point)
 (s/def ::content ::us/string)
 (s/def ::frame-id ::us/uuid)

 (s/def ::create-comment-thread
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::file-id ::position ::content ::page-id ::frame-id]
+  (s/keys :req-un [::profile-id ::file-id ::position ::content ::page-id ::frame-id]
          :opt-un [::share-id]))

 (sv/defmethod ::create-comment-thread
-  {::doc/added "1.15"
-   ::webhooks/event? true}
-  [{:keys [::db/pool] :as cfg}
-   {:keys [::rpc/profile-id ::rpc/request-at file-id page-id share-id position content frame-id]}]
-
+  {::retry/max-retries 3
+   ::retry/matches retry/conflict-db-insert?
+   ::doc/added "1.15"}
+  [{:keys [pool] :as cfg} {:keys [profile-id file-id share-id] :as params}]
  (db/with-atomic [conn pool]
-    (let [{:keys [team-id project-id page-name] :as file} (get-file conn file-id page-id)]
-      (files/check-comment-permissions! conn profile-id file-id share-id)
+    (files/check-comment-permissions! conn profile-id file-id share-id)
+    (create-comment-thread conn params)))

-      (run! (partial quotes/check-quote! conn)
-            (list {::quotes/id ::quotes/comment-threads-per-file
-                   ::quotes/profile-id profile-id
-                   ::quotes/team-id team-id
-                   ::quotes/project-id project-id
-                   ::quotes/file-id file-id}
-                  {::quotes/id ::quotes/comments-per-file
-                   ::quotes/profile-id profile-id
-                   ::quotes/team-id team-id
-                   ::quotes/project-id project-id
-                   ::quotes/file-id file-id}))
+(defn- retrieve-next-seqn
+  [conn file-id]
+  (let [sql "select (f.comment_thread_seqn + 1) as next_seqn from file as f where f.id = ?"
+        res (db/exec-one! conn [sql file-id])]
+    (:next-seqn res)))

-      (rtry/with-retry {::rtry/when rtry/conflict-exception?
-                        ::rtry/max-retries 3
-                        ::rtry/label "create-comment-thread"}
-        (create-comment-thread conn
-                               {:created-at request-at
-                                :profile-id profile-id
-                                :file-id file-id
-                                :page-id page-id
-                                :page-name page-name
-                                :position position
-                                :content content
-                                :frame-id frame-id})))))
+(defn create-comment-thread
+  [conn {:keys [profile-id file-id page-id position content frame-id] :as params}]
+  (let [seqn    (retrieve-next-seqn conn file-id)
+        now     (dt/now)
+        pname   (retrieve-page-name conn params)
+        thread  (db/insert! conn :comment-thread
+                           {:file-id file-id
+                            :owner-id profile-id
+                            :participants (db/tjson #{profile-id})
+                            :page-name pname
+                            :page-id page-id
+                            :created-at now
+                            :modified-at now
+                            :seqn seqn
+                            :position (db/pgpoint position)
+                            :frame-id frame-id})]


-(defn- create-comment-thread
-  [conn {:keys [profile-id file-id page-id page-name created-at position content frame-id]}]
-  (let [;; NOTE: we take the next seq number from a separate query because the whole
-        ;; operation can be retried on conflict, and in this case the new seq shold be
-        ;; retrieved from the database.
-        seqn      (get-next-seqn conn file-id)
-        thread-id (uuid/next)
-        thread    (db/insert! conn :comment-thread
-                              {:id thread-id
-                               :file-id file-id
-                               :owner-id profile-id
-                               :participants (db/tjson #{profile-id})
-                               :page-name page-name
-                               :page-id page-id
-                               :created-at created-at
-                               :modified-at created-at
-                               :seqn seqn
-                               :position (db/pgpoint position)
-                               :frame-id frame-id})
-        comment   (db/insert! conn :comment
-                              {:id (uuid/next)
-                               :thread-id thread-id
-                               :owner-id profile-id
-                               :created-at created-at
-                               :modified-at created-at
-                               :content content})]
+    ;; Create a comment entry
+    (db/insert! conn :comment
+                {:thread-id (:id thread)
+                 :owner-id profile-id
+                 :created-at now
+                 :modified-at now
+                 :content content})

    ;; Make the current thread as read.
-    (upsert-comment-thread-status! conn profile-id thread-id created-at)
+    (upsert-comment-thread-status! conn profile-id (:id thread))

    ;; Optimistic update of current seq number on file.
    (db/update! conn :file
                {:comment-thread-seqn seqn}
                {:id file-id})

-    (-> thread
-        (select-keys [:id :file-id :page-id])
-        (assoc :comment-id (:id comment)))))
+    (select-keys thread [:id :file-id :page-id])))
+
+(defn- retrieve-page-name
+  [conn {:keys [file-id page-id]}]
+  (let [{:keys [data]} (db/get-by-id conn :file file-id)
+        data           (blob/decode data)]
+    (get-in data [:pages-index page-id :name])))
+

 ;; --- COMMAND: Update Comment Thread Status

@@ -366,33 +306,49 @@
 (s/def ::share-id (s/nilable ::us/uuid))

 (s/def ::update-comment-thread-status
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::id]
+  (s/keys :req-un [::profile-id ::id]
          :opt-un [::share-id]))

 (sv/defmethod ::update-comment-thread-status
  {::doc/added "1.15"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id id share-id] :as params}]
+  [{:keys [pool] :as cfg} {:keys [profile-id id share-id] :as params}]
  (db/with-atomic [conn pool]
-    (let [{:keys [file-id] :as thread} (get-comment-thread conn id ::db/for-update? true)]
-      (files/check-comment-permissions! conn profile-id file-id share-id)
-      (upsert-comment-thread-status! conn profile-id id))))
+    (let [cthr (db/get-by-id conn :comment-thread id {:for-update true})]
+      (when-not cthr
+        (ex/raise :type :not-found))
+
+      (files/check-comment-permissions! conn profile-id (:file-id cthr) share-id)
+      (upsert-comment-thread-status! conn profile-id (:id cthr)))))
+
+(def sql:upsert-comment-thread-status
+  "insert into comment_thread_status (thread_id, profile_id)
+   values (?, ?)
+       on conflict (thread_id, profile_id)
+       do update set modified_at = clock_timestamp()
+   returning modified_at;")
+
+(defn upsert-comment-thread-status!
+  [conn profile-id thread-id]
+  (db/exec-one! conn [sql:upsert-comment-thread-status thread-id profile-id]))


 ;; --- COMMAND: Update Comment Thread

 (s/def ::is-resolved ::us/boolean)
 (s/def ::update-comment-thread
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::id ::is-resolved]
+  (s/keys :req-un [::profile-id ::id ::is-resolved]
          :opt-un [::share-id]))

 (sv/defmethod ::update-comment-thread
  {::doc/added "1.15"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id id is-resolved share-id] :as params}]
+  [{:keys [pool] :as cfg} {:keys [profile-id id is-resolved share-id] :as params}]
  (db/with-atomic [conn pool]
-    (let [{:keys [file-id] :as thread} (get-comment-thread conn id ::db/for-update? true)]
-      (files/check-comment-permissions! conn profile-id file-id share-id)
+    (let [thread (db/get-by-id conn :comment-thread id {:for-update true})]
+      (when-not thread
+        (ex/raise :type :not-found))
+
+      (files/check-comment-permissions! conn profile-id (:file-id thread) share-id)
+
      (db/update! conn :comment-thread
                  {:is-resolved is-resolved}
                  {:id id})
@@ -401,149 +357,156 @@

 ;; --- COMMAND: Add Comment

-(declare get-comment-thread)
 (declare create-comment)

 (s/def ::create-comment
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::thread-id ::content]
+  (s/keys :req-un [::profile-id ::thread-id ::content]
          :opt-un [::share-id]))

 (sv/defmethod ::create-comment
-  {::doc/added "1.15"
-   ::webhooks/event? true}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id ::rpc/request-at thread-id share-id content] :as params}]
+  {::doc/added "1.15"}
+  [{:keys [pool] :as cfg} params]
  (db/with-atomic [conn pool]
-    (let [{:keys [file-id page-id] :as thread} (get-comment-thread conn thread-id ::db/for-update? true)
-          {:keys [team-id project-id page-name] :as file} (get-file conn file-id page-id)]
+    (create-comment conn params)))

-      (files/check-comment-permissions! conn profile-id (:id file) share-id)
-      (quotes/check-quote! conn
-                           {::quotes/id ::quotes/comments-per-file
-                            ::quotes/profile-id profile-id
-                            ::quotes/team-id team-id
-                            ::quotes/project-id project-id
-                            ::quotes/file-id (:id file)})
+(defn create-comment
+  [conn {:keys [profile-id thread-id content share-id] :as params}]
+  (let [thread (-> (db/get-by-id conn :comment-thread thread-id {:for-update true})
+                   (decode-row))
+        pname  (retrieve-page-name conn thread)]

-      ;; Update the page-name cached attribute on comment thread table.
-      (when (not= page-name (:page-name thread))
-        (db/update! conn :comment-thread
-                    {:page-name page-name}
-                    {:id thread-id}))
+    ;; Standard Checks
+    (when-not thread (ex/raise :type :not-found))

-      (let [comment (db/insert! conn :comment
-                                {:id (uuid/next)
-                                 :created-at request-at
-                                 :modified-at request-at
-                                 :thread-id thread-id
-                                 :owner-id profile-id
-                                 :content content})
-            props    {:file-id file-id
-                      :share-id nil}]
+    ;; Permission Checks
+    (files/check-comment-permissions! conn profile-id (:file-id thread) share-id)

-        ;; Update thread modified-at attribute and assoc the current
-        ;; profile to the participant set.
-        (db/update! conn :comment-thread
-                    {:modified-at request-at
-                     :participants (-> (:participants thread #{})
-                                       (conj profile-id)
-                                       (db/tjson))}
-                    {:id thread-id})
+    ;; Update the page-name cachedattribute on comment thread table.
+    (when (not= pname (:page-name thread))
+      (db/update! conn :comment-thread
+                  {:page-name pname}
+                  {:id thread-id}))

-        ;; Update the current profile status in relation to the
-        ;; current thread.
-        (upsert-comment-thread-status! conn profile-id thread-id request-at)
+    ;; NOTE: is important that all timestamptz related fields are
+    ;; created or updated on the database level for avoid clock
+    ;; inconsistencies (some user sees something read that is not
+    ;; read, etc...)
+    (let [ppants  (:participants thread #{})
+          comment (db/insert! conn :comment
+                              {:thread-id thread-id
+                               :owner-id profile-id
+                               :content content})]

-        (vary-meta comment assoc ::audit/props props)))))
+      ;; NOTE: this is done in SQL instead of using db/update!
+      ;; helper because currently the helper does not allow pass raw
+      ;; function call parameters to the underlying prepared
+      ;; statement; in a future when we fix/improve it, this can be
+      ;; changed to use the helper.
+
+      ;; Update thread modified-at attribute and assoc the current
+      ;; profile to the participant set.
+      (let [ppants (conj ppants profile-id)
+            sql    "update comment_thread
+                         set modified_at = clock_timestamp(),
+                             participants = ?
+                       where id = ?"]
+        (db/exec-one! conn [sql (db/tjson ppants) thread-id]))
+
+      ;; Update the current profile status in relation to the
+      ;; current thread.
+      (upsert-comment-thread-status! conn profile-id thread-id)
+
+      ;; Return the created comment object.
+      comment)))

 ;; --- COMMAND: Update Comment

+(declare update-comment)
+
 (s/def ::update-comment
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::id ::content]
+  (s/keys :req-un [::profile-id ::id ::content]
          :opt-un [::share-id]))

 (sv/defmethod ::update-comment
  {::doc/added "1.15"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id ::rpc/request-at id share-id content] :as params}]
+  [{:keys [pool] :as cfg} params]
  (db/with-atomic [conn pool]
-    (let [{:keys [thread-id] :as comment} (get-comment conn id ::db/for-update? true)
-          {:keys [file-id page-id owner-id] :as thread} (get-comment-thread conn thread-id ::db/for-update? true)]
+    (update-comment conn params)))

-      (files/check-comment-permissions! conn profile-id file-id share-id)
+(defn update-comment
+  [conn {:keys [profile-id id content share-id] :as params}]
+  (let [comment (db/get-by-id conn :comment id {:for-update true})
+        _       (when-not comment (ex/raise :type :not-found))
+        thread  (db/get-by-id conn :comment-thread (:thread-id comment) {:for-update true})
+        _       (when-not thread (ex/raise :type :not-found))
+        pname   (retrieve-page-name conn thread)]

-      ;; Don't allow edit comments to not owners
-      (when-not (= owner-id profile-id)
-        (ex/raise :type :validation
-                  :code :not-allowed))
+    (files/check-comment-permissions! conn profile-id (:file-id thread) share-id)

-      (let [{:keys [page-name] :as file} (get-file conn file-id page-id)]
-        (db/update! conn :comment
-                    {:content content
-                     :modified-at request-at}
-                    {:id id})
+    ;; Don't allow edit comments to not owners
+    (when-not (= (:owner-id thread) profile-id)
+      (ex/raise :type :validation
+                :code :not-allowed))
+
+    (db/update! conn :comment
+                {:content content
+                 :modified-at (dt/now)}
+                {:id (:id comment)})
+
+    (db/update! conn :comment-thread
+                {:modified-at (dt/now)
+                 :page-name pname}
+                {:id (:id thread)})
+    nil))

-        (db/update! conn :comment-thread
-                    {:modified-at request-at
-                     :page-name page-name}
-                    {:id thread-id})
-        nil))))

 ;; --- COMMAND: Delete Comment Thread

 (s/def ::delete-comment-thread
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::id]
-          :opt-un [::share-id]))
+  (s/keys :req-un [::profile-id ::id]))

 (sv/defmethod ::delete-comment-thread
  {::doc/added "1.15"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id id share-id] :as params}]
+  [{:keys [pool] :as cfg} {:keys [profile-id id] :as params}]
  (db/with-atomic [conn pool]
-    (let [{:keys [owner-id file-id] :as thread} (get-comment-thread conn id ::db/for-update? true)]
-      (files/check-comment-permissions! conn profile-id file-id share-id)
-      (when-not (= owner-id profile-id)
+    (let [thread (db/get-by-id conn :comment-thread id {:for-update true})]
+      (when-not (= (:owner-id thread) profile-id)
        (ex/raise :type :validation
                  :code :not-allowed))
-
      (db/delete! conn :comment-thread {:id id})
      nil)))

+
 ;; --- COMMAND: Delete comment

 (s/def ::delete-comment
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::id]
-          :opt-un [::share-id]))
+  (s/keys :req-un [::profile-id ::id]))

 (sv/defmethod ::delete-comment
  {::doc/added "1.15"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id id share-id] :as params}]
+  [{:keys [pool] :as cfg} {:keys [profile-id id] :as params}]
  (db/with-atomic [conn pool]
-    (let [{:keys [owner-id thread-id] :as comment} (get-comment conn id ::db/for-update? true)
-          {:keys [file-id] :as thread} (get-comment-thread conn thread-id)]
-      (files/check-comment-permissions! conn profile-id file-id share-id)
-      (when-not (= owner-id profile-id)
+    (let [comment (db/get-by-id conn :comment id {:for-update true})]
+      (when-not (= (:owner-id comment) profile-id)
        (ex/raise :type :validation
                  :code :not-allowed))
-      (db/delete! conn :comment {:id id}))))

+      (db/delete! conn :comment {:id id}))))

 ;; --- COMMAND: Update comment thread position

 (s/def ::update-comment-thread-position
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::id ::position ::frame-id]
+  (s/keys :req-un [::profile-id ::id ::position ::frame-id]
          :opt-un [::share-id]))

 (sv/defmethod ::update-comment-thread-position
  {::doc/added "1.15"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id id position frame-id share-id] :as params}]
+  [{:keys [pool] :as cfg} {:keys [profile-id id position frame-id share-id] :as params}]
  (db/with-atomic [conn pool]
-    (let [{:keys [file-id] :as thread} (get-comment-thread conn id ::db/for-update? true)]
-      (files/check-comment-permissions! conn profile-id file-id share-id)
+    (let [thread (db/get-by-id conn :comment-thread id {:for-update true})]
+      (files/check-comment-permissions! conn profile-id (:file-id thread) share-id)
      (db/update! conn :comment-thread
-                  {:modified-at (::rpc/request-at params)
+                  {:modified-at (dt/now)
                   :position (db/pgpoint position)
                   :frame-id frame-id}
                  {:id (:id thread)})
@@ -552,18 +515,18 @@
 ;; --- COMMAND: Update comment frame

 (s/def ::update-comment-thread-frame
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::id ::frame-id]
+  (s/keys :req-un [::profile-id ::id ::frame-id]
          :opt-un [::share-id]))

 (sv/defmethod ::update-comment-thread-frame
  {::doc/added "1.15"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id id frame-id share-id] :as params}]
+  [{:keys [pool] :as cfg} {:keys [profile-id id frame-id share-id] :as params}]
  (db/with-atomic [conn pool]
-    (let [{:keys [file-id] :as thread} (get-comment-thread conn id ::db/for-update? true)]
-      (files/check-comment-permissions! conn profile-id file-id share-id)
+    (let [thread (db/get-by-id conn :comment-thread id {:for-update true})]
+      (files/check-comment-permissions! conn profile-id (:file-id thread) share-id)
      (db/update! conn :comment-thread
-                  {:modified-at (::rpc/request-at params)
+                  {:modified-at (dt/now)
                   :frame-id frame-id}
-                  {:id id})
+                  {:id (:id thread)})
      nil)))
+
--- a/backend/src/app/rpc/commands/demo.clj
+++ b/backend/src/app/rpc/commands/demo.clj
@@ -8,11 +8,11 @@
  "A demo specific mutations."
  (:require
   [app.common.exceptions :as ex]
+   [app.common.uuid :as uuid]
   [app.config :as cf]
   [app.db :as db]
   [app.loggers.audit :as audit]
-   [app.rpc :as-alias rpc]
-   [app.rpc.commands.auth :as auth]
+   [app.rpc.commands.auth :as cmd.auth]
   [app.rpc.doc :as-alias doc]
   [app.util.services :as sv]
   [app.util.time :as dt]
@@ -26,34 +26,35 @@
  "A command that is responsible of creating a demo purpose
  profile. It only works if the `demo-users` flag is enabled in the
  configuration."
-  {::rpc/auth false
+  {:auth false
   ::doc/added "1.15"
   ::doc/changes ["1.15" "This method is migrated from mutations to commands."]}
-  [{:keys [::db/pool] :as cfg} _]
-
-  (when-not (contains? cf/flags :demo-users)
-    (ex/raise :type :validation
-              :code :demo-users-not-allowed
-              :hint "Demo users are disabled by config."))
-
-  (let [sem      (System/currentTimeMillis)
+  [{:keys [pool] :as cfg} _]
+  (let [id       (uuid/next)
+        sem      (System/currentTimeMillis)
        email    (str "demo-" sem ".demo@example.com")
        fullname (str "Demo User " sem)
-
        password (-> (bn/random-bytes 16)
                     (bc/bytes->b64u)
                     (bc/bytes->str))
-
-        params   {:email email
+        params   {:id id
+                  :email email
                  :fullname fullname
                  :is-active true
                  :deleted-at (dt/in-future cf/deletion-delay)
                  :password password
-                  :props {}}]
+                  :props {}
+                  }]
+
+    (when-not (contains? cf/flags :demo-users)
+      (ex/raise :type :validation
+                :code :demo-users-not-allowed
+                :hint "Demo users are disabled by config."))

    (db/with-atomic [conn pool]
-      (let [profile (->> (auth/create-profile! conn params)
-                         (auth/create-profile-rels! conn))]
-        (with-meta {:email email
-                    :password password}
-          {::audit/profile-id (:id profile)})))))
+      (->> (cmd.auth/create-profile conn params)
+           (cmd.auth/create-profile-relations conn))
+
+      (with-meta {:email email
+                  :password password}
+        {::audit/profile-id id}))))
--- a/backend/src/app/rpc/commands/feedback.clj
+++ b/backend/src/app/rpc/commands/feedback.clj
@@ -1,56 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC
-
-(ns app.rpc.commands.feedback
-  "A general purpose feedback module."
-  (:require
-   [app.common.exceptions :as ex]
-   [app.common.spec :as us]
-   [app.config :as cf]
-   [app.db :as db]
-   [app.emails :as eml]
-   [app.rpc :as-alias rpc]
-   [app.rpc.commands.profile :as profile]
-   [app.rpc.doc :as-alias doc]
-   [app.util.services :as sv]
-   [clojure.spec.alpha :as s]))
-
-(declare ^:private send-feedback!)
-
-(s/def ::content ::us/string)
-(s/def ::from    ::us/email)
-(s/def ::subject ::us/string)
-
-(s/def ::send-user-feedback
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::subject
-                   ::content]))
-
-(sv/defmethod ::send-user-feedback
-  {::doc/added "1.18"}
-  [{:keys [::db/pool]} {:keys [::rpc/profile-id] :as params}]
-  (when-not (contains? cf/flags :user-feedback)
-    (ex/raise :type :restriction
-              :code :feedback-disabled
-              :hint "feedback not enabled"))
-
-  (let [profile (profile/get-profile pool profile-id)]
-    (send-feedback! pool profile params)
-    nil))
-
-(defn- send-feedback!
-  [pool profile params]
-  (let [dest (cf/get :feedback-destination)]
-    (eml/send! {::eml/conn pool
-                ::eml/factory eml/feedback
-                :from     dest
-                :to       dest
-                :profile  profile
-                :reply-to (:email profile)
-                :email    (:email profile)
-                :subject  (:subject params)
-                :content  (:content params)})
-    nil))
--- a/backend/src/app/rpc/commands/files.clj
+++ b/backend/src/app/rpc/commands/files.clj
--- a/backend/src/app/rpc/commands/files_create.clj
+++ b/backend/src/app/rpc/commands/files_create.clj
@@ -1,96 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC
-
-(ns app.rpc.commands.files-create
-  (:require
-   [app.common.data :as d]
-   [app.common.files.features :as ffeat]
-   [app.common.types.file :as ctf]
-   [app.common.uuid :as uuid]
-   [app.db :as db]
-   [app.loggers.audit :as-alias audit]
-   [app.loggers.webhooks :as-alias webhooks]
-   [app.rpc :as-alias rpc]
-   [app.rpc.commands.files :as files]
-   [app.rpc.commands.projects :as projects]
-   [app.rpc.doc :as-alias doc]
-   [app.rpc.permissions :as perms]
-   [app.rpc.quotes :as quotes]
-   [app.util.blob :as blob]
-   [app.util.objects-map :as omap]
-   [app.util.pointer-map :as pmap]
-   [app.util.services :as sv]
-   [clojure.spec.alpha :as s]))
-
-(defn create-file-role!
-  [conn {:keys [file-id profile-id role]}]
-  (let [params {:file-id file-id
-                :profile-id profile-id}]
-    (->> (perms/assign-role-flags params role)
-         (db/insert! conn :file-profile-rel))))
-
-(defn create-file
-  [conn {:keys [id name project-id is-shared data revn
-                modified-at deleted-at create-page
-                ignore-sync-until features]
-         :or {is-shared false revn 0 create-page true}
-         :as params}]
-  (let [id       (or id (:id data) (uuid/next))
-        features (-> (into files/default-features features)
-                     (files/check-features-compatibility!))
-
-        data     (or data
-                     (binding [ffeat/*current* features
-                               ffeat/*wrap-with-objects-map-fn* (if (features "storate/objects-map") omap/wrap identity)
-                               ffeat/*wrap-with-pointer-map-fn* (if (features "storage/pointer-map") pmap/wrap identity)]
-                       (if create-page
-                         (ctf/make-file-data id)
-                         (ctf/make-file-data id nil))))
-
-        features (db/create-array conn "text" features)
-        file     (db/insert! conn :file
-                             (d/without-nils
-                              {:id id
-                               :project-id project-id
-                               :name name
-                               :revn revn
-                               :is-shared is-shared
-                               :data (blob/encode data)
-                               :features features
-                               :ignore-sync-until ignore-sync-until
-                               :modified-at modified-at
-                               :deleted-at deleted-at}))]
-
-    (->> (assoc params :file-id id :role :owner)
-         (create-file-role! conn))
-
-    (files/decode-row file)))
-
-(s/def ::create-file
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::files/name
-                   ::files/project-id]
-          :opt-un [::files/id
-                   ::files/is-shared
-                   ::files/features]))
-
-(sv/defmethod ::create-file
-  {::doc/added "1.17"
-   ::webhooks/event? true}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id project-id] :as params}]
-  (db/with-atomic [conn pool]
-    (projects/check-edition-permissions! conn profile-id project-id)
-    (let [team-id (files/get-team-id conn project-id)
-          params  (assoc params :profile-id profile-id)]
-
-      (run! (partial quotes/check-quote! conn)
-            (list {::quotes/id ::quotes/files-per-project
-                   ::quotes/team-id team-id
-                   ::quotes/profile-id profile-id
-                   ::quotes/project-id project-id}))
-
-      (-> (create-file conn params)
-          (vary-meta assoc ::audit/props {:team-id team-id})))))
--- a/backend/src/app/rpc/commands/files_share.clj
+++ b/backend/src/app/rpc/commands/files_share.clj
@@ -1,71 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC
-
-(ns app.rpc.commands.files-share
-  "Share link related rpc mutation methods."
-  (:require
-   [app.common.spec :as us]
-   [app.common.uuid :as uuid]
-   [app.db :as db]
-   [app.rpc :as-alias rpc]
-   [app.rpc.commands.files :as files]
-   [app.rpc.doc :as-alias doc]
-   [app.util.services :as sv]
-   [clojure.spec.alpha :as s]))
-
-;; --- Helpers & Specs
-
-(s/def ::file-id ::us/uuid)
-(s/def ::who-comment ::us/string)
-(s/def ::who-inspect ::us/string)
-(s/def ::pages (s/every ::us/uuid :kind set?))
-
-;; --- MUTATION: Create Share Link
-
-(declare create-share-link)
-
-(s/def ::create-share-link
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::file-id ::who-comment ::who-inspect ::pages]))
-
-(sv/defmethod ::create-share-link
-  "Creates a share-link object.
-
-  Share links are resources that allows external users access to specific
-  pages of a file with specific permissions (who-comment and who-inspect)."
-  {::doc/added "1.18"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id file-id] :as params}]
-  (db/with-atomic [conn pool]
-    (files/check-edition-permissions! conn profile-id file-id)
-    (create-share-link conn (assoc params :profile-id profile-id))))
-
-(defn create-share-link
-  [conn {:keys [profile-id file-id pages who-comment who-inspect]}]
-  (let [pages (db/create-array conn "uuid" pages)
-        slink (db/insert! conn :share-link
-                          {:id (uuid/next)
-                           :file-id file-id
-                           :who-comment who-comment
-                           :who-inspect who-inspect
-                           :pages pages
-                           :owner-id profile-id})]
-
-    (update slink :pages db/decode-pgarray #{})))
-
-;; --- MUTATION: Delete Share Link
-
-(s/def ::delete-share-link
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::us/id]))
-
-(sv/defmethod ::delete-share-link
-  {::doc/added "1.18"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id id] :as params}]
-  (db/with-atomic [conn pool]
-    (let [slink (db/get-by-id conn :share-link id)]
-      (files/check-edition-permissions! conn profile-id (:file-id slink))
-      (db/delete! conn :share-link {:id id})
-      nil)))
--- a/backend/src/app/rpc/commands/files_temp.clj
+++ b/backend/src/app/rpc/commands/files_temp.clj
@@ -1,108 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC
-
-(ns app.rpc.commands.files-temp
-  (:require
-   [app.common.exceptions :as ex]
-   [app.common.pages :as cp]
-   [app.common.spec :as us]
-   [app.common.uuid :as uuid]
-   [app.db :as db]
-   [app.rpc :as-alias rpc]
-   [app.rpc.commands.files :as files]
-   [app.rpc.commands.files-create :refer [create-file]]
-   [app.rpc.commands.files-update :as-alias files.update]
-   [app.rpc.commands.projects :as projects]
-   [app.rpc.doc :as-alias doc]
-   [app.util.blob :as blob]
-   [app.util.services :as sv]
-   [app.util.time :as dt]
-   [clojure.spec.alpha :as s]))
-
-;; --- MUTATION COMMAND: create-temp-file
-
-(s/def ::create-page ::us/boolean)
-
-(s/def ::create-temp-file
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::files/name
-                   ::files/project-id]
-          :opt-un [::files/id
-                   ::files/is-shared
-                   ::files/features
-                   ::create-page]))
-
-(sv/defmethod ::create-temp-file
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id project-id] :as params}]
-  (db/with-atomic [conn pool]
-    (projects/check-edition-permissions! conn profile-id project-id)
-    (create-file conn (assoc params :profile-id profile-id :deleted-at (dt/in-future {:days 1})))))
-
-;; --- MUTATION COMMAND: update-temp-file
-
-(defn update-temp-file
-  [conn {:keys [profile-id session-id id revn changes] :as params}]
-  (db/insert! conn :file-change
-              {:id (uuid/next)
-               :session-id session-id
-               :profile-id profile-id
-               :created-at (dt/now)
-               :file-id id
-               :revn revn
-               :data nil
-               :changes (blob/encode changes)}))
-
-(s/def ::update-temp-file
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::files.update/changes
-                   ::files.update/revn
-                   ::files.update/session-id
-                   ::files/id]))
-
-(sv/defmethod ::update-temp-file
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id] :as params}]
-  (db/with-atomic [conn pool]
-    (update-temp-file conn (assoc params :profile-id profile-id))
-    nil))
-
-;; --- MUTATION COMMAND: persist-temp-file
-
-(defn persist-temp-file
-  [conn {:keys [id] :as params}]
-  (let [file (db/get-by-id conn :file id)
-        revs (db/query conn :file-change
-                       {:file-id id}
-                       {:order-by [[:revn :asc]]})
-        revn (count revs)]
-
-    (when (nil? (:deleted-at file))
-      (ex/raise :type :validation
-                :code :cant-persist-already-persisted-file))
-
-    (loop [revs (seq revs)
-           data (blob/decode (:data file))]
-      (if-let [rev (first revs)]
-        (recur (rest revs)
-               (->> rev :changes blob/decode (cp/process-changes data)))
-        (db/update! conn :file
-                    {:deleted-at nil
-                     :revn revn
-                     :data (blob/encode data)}
-                    {:id id})))
-    nil))
-
-(s/def ::persist-temp-file
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::files/id]))
-
-(sv/defmethod ::persist-temp-file
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id id] :as params}]
-  (db/with-atomic [conn pool]
-    (files/check-edition-permissions! conn profile-id id)
-    (persist-temp-file conn params)))
--- a/backend/src/app/rpc/commands/files_update.clj
+++ b/backend/src/app/rpc/commands/files_update.clj
@@ -1,302 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC
-
-(ns app.rpc.commands.files-update
-  (:require
-   [app.common.exceptions :as ex]
-   [app.common.files.features :as ffeat]
-   [app.common.logging :as l]
-   [app.common.pages :as cp]
-   [app.common.pages.migrations :as pmg]
-   [app.common.spec :as us]
-   [app.common.types.file :as ctf]
-   [app.common.uuid :as uuid]
-   [app.config :as cf]
-   [app.db :as db]
-   [app.loggers.audit :as audit]
-   [app.loggers.webhooks :as webhooks]
-   [app.metrics :as mtx]
-   [app.msgbus :as mbus]
-   [app.rpc :as-alias rpc]
-   [app.rpc.climit :as-alias climit]
-   [app.rpc.commands.files :as files]
-   [app.rpc.doc :as-alias doc]
-   [app.rpc.helpers :as rph]
-   [app.util.blob :as blob]
-   [app.util.objects-map :as omap]
-   [app.util.pointer-map :as pmap]
-   [app.util.services :as sv]
-   [app.util.time :as dt]
-   [clojure.spec.alpha :as s]))
-
-;; --- SPECS
-
-(s/def ::changes
-  (s/coll-of map? :kind vector?))
-
-(s/def ::hint-origin ::us/keyword)
-(s/def ::hint-events
-  (s/every ::us/keyword :kind vector?))
-
-(s/def ::change-with-metadata
-  (s/keys :req-un [::changes]
-          :opt-un [::hint-origin
-                   ::hint-events]))
-
-(s/def ::changes-with-metadata
-  (s/every ::change-with-metadata :kind vector?))
-
-(s/def ::session-id ::us/uuid)
-(s/def ::revn ::us/integer)
-(s/def ::update-file
-  (s/and
-   (s/keys :req [::rpc/profile-id]
-           :req-un [::files/id ::session-id ::revn]
-           :opt-un [::changes ::changes-with-metadata ::features])
-   (fn [o]
-     (or (contains? o :changes)
-         (contains? o :changes-with-metadata)))))
-
-;; --- HELPERS
-
-;; File changes that affect to the library, and must be notified
-;; to all clients using it.
-
-(def ^:private library-change-types
-  #{:add-color :mod-color :del-color
-    :add-media :mod-media :del-media
-    :add-component :mod-component :del-component
-    :add-typography :mod-typography :del-typography})
-
-(def ^:private file-change-types
-  #{:add-obj :mod-obj :del-obj
-    :reg-objects :mov-objects})
-
-(defn- library-change?
-  [{:keys [type] :as change}]
-  (or (contains? library-change-types type)
-      (and (contains? file-change-types type)
-           (some? (:component-id change)))))
-
-(def ^:private sql:get-file
-  "SELECT f.*, p.team_id
-     FROM file AS f
-     JOIN project AS p ON (p.id = f.project_id)
-    WHERE f.id = ?
-      AND (f.deleted_at IS NULL OR
-           f.deleted_at > now())
-      FOR KEY SHARE")
-
-(defn get-file
-  [conn id]
-  (let [file (db/exec-one! conn [sql:get-file id])]
-    (when-not file
-      (ex/raise :type :not-found
-                :code :object-not-found
-                :hint (format "file with id '%s' does not exists" id)))
-    (update file :features db/decode-pgarray #{})))
-
-(defn- wrap-with-pointer-map-context
-  [f]
-  (fn [{:keys [conn] :as cfg} {:keys [id] :as file}]
-    (binding [pmap/*tracked* (atom {})
-              pmap/*load-fn* (partial files/load-pointer conn id)
-              ffeat/*wrap-with-pointer-map-fn* pmap/wrap]
-      (let [result (f cfg file)]
-        (files/persist-pointers! conn id)
-        result))))
-
-(defn- wrap-with-objects-map-context
-  [f]
-  (fn [cfg file]
-    (binding [ffeat/*wrap-with-objects-map-fn* omap/wrap]
-      (f cfg file))))
-
-(declare get-lagged-changes)
-(declare send-notifications!)
-(declare update-file)
-(declare update-file*)
-(declare take-snapshot?)
-
-;; If features are specified from params and the final feature
-;; set is different than the persisted one, update it on the
-;; database.
-
-(sv/defmethod ::update-file
-  {::climit/queue :update-file
-   ::climit/key-fn :id
-   ::webhooks/event? true
-   ::webhooks/batch-timeout (dt/duration "2m")
-   ::webhooks/batch-key (webhooks/key-fn ::rpc/profile-id :id)
-   ::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id id] :as params}]
-  (db/with-atomic [conn pool]
-    (files/check-edition-permissions! conn profile-id id)
-    (db/xact-lock! conn id)
-
-    (let [cfg    (assoc cfg :conn conn)
-          params (assoc params :profile-id profile-id)
-          tpoint (dt/tpoint)]
-      (-> (update-file cfg params)
-          (rph/with-defer #(let [elapsed (tpoint)]
-                             (l/trace :hint "update-file" :time (dt/format-duration elapsed))))))))
-
-(defn update-file
-  [{:keys [conn ::mtx/metrics] :as cfg} {:keys [profile-id id changes changes-with-metadata] :as params}]
-  (let [file     (get-file conn id)
-        features (->> (concat (:features file)
-                              (:features params))
-                      (into files/default-features)
-                      (files/check-features-compatibility!))]
-
-    (files/check-edition-permissions! conn profile-id (:id file))
-
-    (binding [ffeat/*current*  features
-              ffeat/*previous* (:features file)]
-      (let [update-fn (cond-> update-file*
-                        (contains? features "storage/pointer-map")
-                        (wrap-with-pointer-map-context)
-
-                        (contains? features "storage/objects-map")
-                        (wrap-with-objects-map-context))
-
-            file      (assoc file :features features)
-            changes   (if changes-with-metadata
-                        (->> changes-with-metadata (mapcat :changes) vec)
-                        (vec changes))
-
-            params    (-> params
-                          (assoc :file file)
-                          (assoc :changes changes)
-                          (assoc ::created-at (dt/now)))]
-
-        (when (> (:revn params)
-                 (:revn file))
-          (ex/raise :type :validation
-                    :code :revn-conflict
-                    :hint "The incoming revision number is greater that stored version."
-                    :context {:incoming-revn (:revn params)
-                              :stored-revn (:revn file)}))
-
-        (mtx/run! metrics {:id :update-file-changes :inc (count changes)})
-
-        (when (not= features (:features file))
-          (let [features (db/create-array conn "text" features)]
-            (db/update! conn :file
-                        {:features features}
-                        {:id id})))
-
-        (-> (update-fn cfg params)
-            (vary-meta assoc ::audit/replace-props
-                       {:id         (:id file)
-                        :name       (:name file)
-                        :features   (:features file)
-                        :project-id (:project-id file)
-                        :team-id    (:team-id file)}))))))
-
-(defn- update-file*
-  [{:keys [conn] :as cfg} {:keys [profile-id file changes session-id ::created-at] :as params}]
-  (let [file (-> file
-                 (update :revn inc)
-                 (update :data (fn [data]
-                                 (cond-> data
-                                   :always
-                                   (-> (blob/decode)
-                                       (assoc :id (:id file))
-                                       (pmg/migrate-data))
-
-                                   (and (contains? ffeat/*current* "components/v2")
-                                        (not (contains? ffeat/*previous* "components/v2")))
-                                   (ctf/migrate-to-components-v2)
-
-                                   :always
-                                   (-> (cp/process-changes changes)
-                                       (blob/encode))))))]
-    (db/insert! conn :file-change
-                {:id (uuid/next)
-                 :session-id session-id
-                 :profile-id profile-id
-                 :created-at created-at
-                 :file-id (:id file)
-                 :revn (:revn file)
-                 :features (db/create-array conn "text" (:features file))
-                 :data (when (take-snapshot? file)
-                         (:data file))
-                 :changes (blob/encode changes)})
-
-    (db/update! conn :file
-                {:revn (:revn file)
-                 :data (:data file)
-                 :data-backend nil
-                 :modified-at created-at
-                 :has-media-trimmed false}
-                {:id (:id file)})
-
-    (db/update! conn :project
-                {:modified-at created-at}
-                {:id (:project-id file)})
-
-    (let [params (assoc params :file file)]
-      ;; Send asynchronous notifications
-      (send-notifications! cfg params)
-
-      ;; Retrieve and return lagged data
-      (get-lagged-changes conn params))))
-
-(defn- take-snapshot?
-  "Defines the rule when file `data` snapshot should be saved."
-  [{:keys [revn modified-at] :as file}]
-  (let [freq    (or (cf/get :file-change-snapshot-every) 20)
-        timeout (or (cf/get :file-change-snapshot-timeout)
-                    (dt/duration {:hours 1}))]
-    (or (= 1 freq)
-        (zero? (mod revn freq))
-        (> (inst-ms (dt/diff modified-at (dt/now)))
-           (inst-ms timeout)))))
-
-(def ^:private
-  sql:lagged-changes
-  "select s.id, s.revn, s.file_id,
-          s.session_id, s.changes
-     from file_change as s
-    where s.file_id = ?
-      and s.revn > ?
-    order by s.created_at asc")
-
-(defn- get-lagged-changes
-  [conn {:keys [id revn] :as params}]
-  (->> (db/exec! conn [sql:lagged-changes id revn])
-       (map files/decode-row)
-       (vec)))
-
-(defn- send-notifications!
-  [{:keys [conn] :as cfg} {:keys [file changes session-id] :as params}]
-  (let [lchanges (filter library-change? changes)
-        msgbus   (::mbus/msgbus cfg)]
-
-    ;; Asynchronously publish message to the msgbus
-    (mbus/pub! msgbus
-               :topic (:id file)
-               :message {:type :file-change
-                         :profile-id (:profile-id params)
-                         :file-id (:id file)
-                         :session-id (:session-id params)
-                         :revn (:revn file)
-                         :changes changes})
-
-    (when (and (:is-shared file) (seq lchanges))
-      (let [team-id (or (:team-id file)
-                        (files/get-team-id conn (:project-id file)))]
-        ;; Asynchronously publish message to the msgbus
-        (mbus/pub! msgbus
-                   :topic team-id
-                   :message {:type :library-change
-                             :profile-id (:profile-id params)
-                             :file-id (:id file)
-                             :session-id session-id
-                             :revn (:revn file)
-                             :modified-at (dt/now)
-                             :changes lchanges})))))
--- a/backend/src/app/rpc/commands/fonts.clj
+++ b/backend/src/app/rpc/commands/fonts.clj
@@ -1,237 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC
-
-(ns app.rpc.commands.fonts
-  (:require
-   [app.common.data :as d]
-   [app.common.exceptions :as ex]
-   [app.common.spec :as us]
-   [app.common.uuid :as uuid]
-   [app.db :as db]
-   [app.loggers.audit :as-alias audit]
-   [app.loggers.webhooks :as-alias webhooks]
-   [app.media :as media]
-   [app.rpc :as-alias rpc]
-   [app.rpc.climit :as-alias climit]
-   [app.rpc.commands.files :as files]
-   [app.rpc.commands.projects :as projects]
-   [app.rpc.commands.teams :as teams]
-   [app.rpc.doc :as-alias doc]
-   [app.rpc.helpers :as rph]
-   [app.rpc.quotes :as quotes]
-   [app.storage :as sto]
-   [app.util.services :as sv]
-   [app.util.time :as dt]
-   [app.worker :as-alias wrk]
-   [clojure.spec.alpha :as s]
-   [promesa.core :as p]
-   [promesa.exec :as px]))
-
-(def valid-weight #{100 200 300 400 500 600 700 800 900 950})
-(def valid-style #{"normal" "italic"})
-
-(s/def ::data (s/map-of ::us/string any?))
-(s/def ::file-id ::us/uuid)
-(s/def ::font-id ::us/uuid)
-(s/def ::id ::us/uuid)
-(s/def ::name ::us/not-empty-string)
-(s/def ::project-id ::us/uuid)
-(s/def ::style valid-style)
-(s/def ::team-id ::us/uuid)
-(s/def ::team-id ::us/uuid)
-(s/def ::weight valid-weight)
-
-;; --- QUERY: Get font variants
-
-(s/def ::get-font-variants
-  (s/and
-   (s/keys :req [::rpc/profile-id]
-           :opt-un [::team-id
-                    ::file-id
-                    ::project-id])
-   (fn [o]
-     (or (contains? o :team-id)
-         (contains? o :file-id)
-         (contains? o :project-id)))))
-
-(sv/defmethod ::get-font-variants
-  {::doc/added "1.18"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id team-id file-id project-id] :as params}]
-  (with-open [conn (db/open pool)]
-    (cond
-      (uuid? team-id)
-      (do
-        (teams/check-read-permissions! conn profile-id team-id)
-        (db/query conn :team-font-variant
-                  {:team-id team-id
-                   :deleted-at nil}))
-
-      (uuid? project-id)
-      (let [project (db/get-by-id conn :project project-id {:columns [:id :team-id]})]
-        (projects/check-read-permissions! conn profile-id project-id)
-        (db/query conn :team-font-variant
-                  {:team-id (:team-id project)
-                   :deleted-at nil}))
-
-      (uuid? file-id)
-      (let [file    (db/get-by-id conn :file file-id {:columns [:id :project-id]})
-            project (db/get-by-id conn :project (:project-id file) {:columns [:id :team-id]})]
-        (files/check-read-permissions! conn profile-id file-id)
-        (db/query conn :team-font-variant
-                  {:team-id (:team-id project)
-                   :deleted-at nil})))))
-
-
-(declare create-font-variant)
-
-(s/def ::create-font-variant
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id
-                   ::data
-                   ::font-id
-                   ::font-family
-                   ::font-weight
-                   ::font-style]))
-
-(sv/defmethod ::create-font-variant
-  {::doc/added "1.18"
-   ::webhooks/event? true}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id team-id] :as params}]
-  (let [cfg (update cfg ::sto/storage media/configure-assets-storage)]
-    (teams/check-edition-permissions! pool profile-id team-id)
-    (quotes/check-quote! pool {::quotes/id ::quotes/font-variants-per-team
-                               ::quotes/profile-id profile-id
-                               ::quotes/team-id team-id})
-    (create-font-variant cfg (assoc params :profile-id profile-id))))
-
-(defn create-font-variant
-  [{:keys [::sto/storage ::db/pool ::wrk/executor ::rpc/climit]} {:keys [data] :as params}]
-  (letfn [(generate-fonts [data]
-            (climit/with-dispatch (:process-font climit)
-              (media/run {:cmd :generate-fonts :input data})))
-
-          ;; Function responsible of calculating cryptographyc hash of
-          ;; the provided data.
-          (calculate-hash [data]
-            (px/with-dispatch executor
-              (sto/calculate-hash data)))
-
-          (validate-data [data]
-            (when (and (not (contains? data "font/otf"))
-                       (not (contains? data "font/ttf"))
-                       (not (contains? data "font/woff"))
-                       (not (contains? data "font/woff2")))
-              (ex/raise :type :validation
-                        :code :invalid-font-upload))
-            data)
-
-          (persist-font-object [data mtype]
-            (when-let [resource (get data mtype)]
-              (p/let [hash    (calculate-hash resource)
-                      content (-> (sto/content resource)
-                                  (sto/wrap-with-hash hash))]
-                (sto/put-object! storage {::sto/content content
-                                          ::sto/touched-at (dt/now)
-                                          ::sto/deduplicate? true
-                                          :content-type mtype
-                                          :bucket "team-font-variant"}))))
-
-          (persist-fonts [data]
-            (p/let [otf   (persist-font-object data "font/otf")
-                    ttf   (persist-font-object data "font/ttf")
-                    woff1 (persist-font-object data "font/woff")
-                    woff2 (persist-font-object data "font/woff2")]
-
-              (d/without-nils
-               {:otf otf
-                :ttf ttf
-                :woff1 woff1
-                :woff2 woff2})))
-
-          (insert-into-db [{:keys [woff1 woff2 otf ttf]}]
-            (db/insert! pool :team-font-variant
-                        {:id (uuid/next)
-                         :team-id (:team-id params)
-                         :font-id (:font-id params)
-                         :font-family (:font-family params)
-                         :font-weight (:font-weight params)
-                         :font-style (:font-style params)
-                         :woff1-file-id (:id woff1)
-                         :woff2-file-id (:id woff2)
-                         :otf-file-id (:id otf)
-                         :ttf-file-id (:id ttf)}))
-          ]
-
-    (->> (generate-fonts data)
-         (p/fmap validate-data)
-         (p/mcat executor persist-fonts)
-         (p/fmap executor insert-into-db)
-         (p/fmap (fn [result]
-                   (let [params (update params :data (comp vec keys))]
-                     (rph/with-meta result {::audit/replace-props params})))))))
-
-;; --- UPDATE FONT FAMILY
-
-(s/def ::update-font
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id ::id ::name]))
-
-(sv/defmethod ::update-font
-  {::doc/added "1.18"
-   ::webhooks/event? true}
-  [{:keys [::db/pool]} {:keys [::rpc/profile-id team-id id name]}]
-  (db/with-atomic [conn pool]
-    (teams/check-edition-permissions! conn profile-id team-id)
-    (rph/with-meta
-      (db/update! conn :team-font-variant
-                  {:font-family name}
-                  {:font-id id
-                   :team-id team-id})
-      {::audit/replace-props {:id id
-                              :name name
-                              :team-id team-id
-                              :profile-id profile-id}})))
-
-;; --- DELETE FONT
-
-(s/def ::delete-font
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id ::id]))
-
-(sv/defmethod ::delete-font
-  {::doc/added "1.18"
-   ::webhooks/event? true}
-  [{:keys [::db/pool]} {:keys [::rpc/profile-id id team-id]}]
-  (db/with-atomic [conn pool]
-    (teams/check-edition-permissions! conn profile-id team-id)
-    (let [font (db/update! conn :team-font-variant
-                           {:deleted-at (dt/now)}
-                           {:font-id id :team-id team-id})]
-      (rph/with-meta (rph/wrap)
-        {::audit/props {:id id
-                        :team-id team-id
-                        :name (:font-family font)
-                        :profile-id profile-id}}))))
-
-;; --- DELETE FONT VARIANT
-
-(s/def ::delete-font-variant
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id ::id]))
-
-(sv/defmethod ::delete-font-variant
-  {::doc/added "1.18"
-   ::webhooks/event? true}
-  [{:keys [::db/pool]} {:keys [::rpc/profile-id id team-id]}]
-  (db/with-atomic [conn pool]
-    (teams/check-edition-permissions! conn profile-id team-id)
-    (let [variant (db/update! conn :team-font-variant
-                              {:deleted-at (dt/now)}
-                              {:id id :team-id team-id})]
-      (rph/with-meta (rph/wrap)
-        {::audit/props {:font-family (:font-family variant)
-                        :font-id (:font-id variant)}}))))
-
--- a/backend/src/app/rpc/commands/ldap.clj
+++ b/backend/src/app/rpc/commands/ldap.clj
@@ -10,15 +10,10 @@
   [app.common.exceptions :as ex]
   [app.common.spec :as us]
   [app.db :as db]
-   [app.http.session :as session]
   [app.loggers.audit :as-alias audit]
-   [app.main :as-alias main]
-   [app.rpc :as-alias rpc]
-   [app.rpc.commands.auth :as auth]
-   [app.rpc.commands.profile :as profile]
+   [app.rpc.commands.auth :as cmd.auth]
   [app.rpc.doc :as-alias doc]
-   [app.rpc.helpers :as rph]
-   [app.tokens :as tokens]
+   [app.rpc.queries.profile :as profile]
   [app.util.services :as sv]
   [clojure.spec.alpha :as s]))

@@ -37,15 +32,15 @@
 (sv/defmethod ::login-with-ldap
  "Performs the authentication using LDAP backend. Only works if LDAP
  is properly configured and enabled with `login-with-ldap` flag."
-  {::rpc/auth false
+  {:auth false
   ::doc/added "1.15"}
-  [{:keys [::main/props ::ldap/provider] :as cfg} params]
-  (when-not provider
+  [{:keys [session tokens ldap] :as cfg} params]
+  (when-not ldap
    (ex/raise :type :restriction
              :code :ldap-not-initialized
              :hide "ldap auth provider is not initialized"))

-  (let [info (ldap/authenticate provider params)]
+  (let [info (ldap/authenticate ldap params)]
    (when-not info
      (ex/raise :type :validation
                :code :wrong-credentials))
@@ -61,29 +56,30 @@
        ;; user comes from team-invitation process; in this case,
        ;; regenerate token and send back to the user a new invitation
        ;; token (and mark current session as logged).
-        (let [claims (tokens/verify props {:token token :iss :team-invitation})
+        (let [claims (tokens :verify {:token token :iss :team-invitation})
              claims (assoc claims
                            :member-id  (:id profile)
                            :member-email (:email profile))
-              token  (tokens/generate props claims)]
-          (-> {:invitation-token token}
-              (rph/with-transform (session/create-fn cfg (:id profile)))
-              (rph/with-meta {::audit/props (:props profile)
-                              ::audit/profile-id (:id profile)})))
+              token  (tokens :generate claims)]
+          (with-meta {:invitation-token token}
+            {:transform-response ((:create session) (:id profile))
+             ::audit/props (:props profile)
+             ::audit/profile-id (:id profile)}))

-        (-> profile
-            (rph/with-transform (session/create-fn cfg (:id profile)))
-            (rph/with-meta {::audit/props (:props profile)
-                            ::audit/profile-id (:id profile)}))))))
+        (with-meta profile
+          {:transform-response ((:create session) (:id profile))
+           ::audit/props (:props profile)
+           ::audit/profile-id (:id profile)})))))

 (defn- login-or-register
-  [{:keys [::db/pool] :as cfg} info]
+  [{:keys [pool] :as cfg} info]
  (db/with-atomic [conn pool]
    (or (some->> (:email info)
-                 (profile/get-profile-by-email conn)
-                 (profile/decode-row))
+                 (profile/retrieve-profile-data-by-email conn)
+                 (profile/populate-additional-data conn)
+                 (profile/decode-profile-row))
        (->> (assoc info :is-active true :is-demo false)
-             (auth/create-profile! conn)
-             (auth/create-profile-rels! conn)
+             (cmd.auth/create-profile conn)
+             (cmd.auth/create-profile-relations conn)
             (profile/strip-private-attrs)))))

--- a/backend/src/app/rpc/commands/management.clj
+++ b/backend/src/app/rpc/commands/management.clj
@@ -13,15 +13,12 @@
   [app.common.spec :as us]
   [app.common.uuid :as uuid]
   [app.db :as db]
-   [app.loggers.webhooks :as-alias webhooks]
-   [app.rpc :as-alias rpc]
   [app.rpc.commands.binfile :as binfile]
-   [app.rpc.commands.files :as files]
-   [app.rpc.commands.projects :as proj]
-   [app.rpc.commands.teams :as teams :refer [create-project-role create-project]]
   [app.rpc.doc :as-alias doc]
+   [app.rpc.mutations.projects :refer [create-project-role create-project]]
+   [app.rpc.queries.projects :as proj]
+   [app.rpc.queries.teams :as teams]
   [app.util.blob :as blob]
-   [app.util.pointer-map :as pmap]
   [app.util.services :as sv]
   [app.util.time :as dt]
   [clojure.spec.alpha :as s]
@@ -32,23 +29,22 @@
 (declare duplicate-file)

 (s/def ::id ::us/uuid)
+(s/def ::profile-id ::us/uuid)
 (s/def ::project-id ::us/uuid)
 (s/def ::file-id ::us/uuid)
 (s/def ::team-id ::us/uuid)
 (s/def ::name ::us/string)

 (s/def ::duplicate-file
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::file-id]
+  (s/keys :req-un [::profile-id ::file-id]
          :opt-un [::name]))

 (sv/defmethod ::duplicate-file
  "Duplicate a single file in the same team."
-  {::doc/added "1.16"
-   ::webhooks/event? true}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id] :as params}]
+  {::doc/added "1.16"}
+  [{:keys [pool] :as cfg} params]
  (db/with-atomic [conn pool]
-    (duplicate-file conn (assoc params :profile-id profile-id))))
+    (duplicate-file conn params)))

 (defn- remap-id
  [item index key]
@@ -57,7 +53,7 @@
    (assoc key (get index (get item key) (get item key)))))

 (defn- process-file
-  [conn {:keys [id] :as file} index]
+  [file index]
  (letfn [(process-form [form]
            (cond-> form
              ;; Relink library items
@@ -101,25 +97,18 @@
                             res)))
                       media
                       media))]
-    (-> file
-        (update :id #(get index %))
-        (update :data
-                (fn [data]
-                  (binding [pmap/*load-fn* (partial files/load-pointer conn id)
-                            pmap/*tracked* (atom {})]
-                    (let [file-id (get index id)
-                          data    (-> data
-                                      (blob/decode)
-                                      (assoc :id file-id)
-                                      (pmg/migrate-data)
-                                      (update :pages-index relink-shapes)
-                                      (update :components relink-shapes)
-                                      (update :media relink-media)
-                                      (d/without-nils)
-                                      (files/process-pointers pmap/clone)
-                                      (blob/encode))]
-                      (files/persist-pointers! conn file-id)
-                      data)))))))
+
+    (update file :data
+            (fn [data]
+              (-> data
+                  (blob/decode)
+                  (assoc :id (:id file))
+                  (pmg/migrate-data)
+                  (update :pages-index relink-shapes)
+                  (update :components relink-shapes)
+                  (update :media relink-media)
+                  (d/without-nils)
+                  (blob/encode))))))

 (def sql:retrieve-used-libraries
  "select flr.*
@@ -136,7 +125,7 @@
      and so.deleted_at is null")

 (defn duplicate-file*
-  [conn {:keys [profile-id file index project-id name flibs fmeds]} {:keys [reset-shared-flag]}]
+  [conn {:keys [profile-id file index project-id name flibs fmeds]} {:keys [reset-shared-flag] :as opts}]
  (let [flibs    (or flibs (db/exec! conn [sql:retrieve-used-libraries (:id file)]))
        fmeds    (or fmeds (db/exec! conn [sql:retrieve-used-media-objects (:id file)]))

@@ -177,9 +166,9 @@
        file    (-> file
                    (assoc :created-at now)
                    (assoc :modified-at now)
-                    (assoc :ignore-sync-until ignore))
-
-        file    (process-file conn file index)]
+                    (assoc :ignore-sync-until ignore)
+                    (update :id #(get index %))
+                    (process-file index))]

    (db/insert! conn :file file)
    (db/insert! conn :file-profile-rel
@@ -205,25 +194,22 @@
    (proj/check-edition-permissions! conn profile-id (:project-id file))
    (db/exec-one! conn ["SET CONSTRAINTS ALL DEFERRED"])
    (-> (duplicate-file* conn params {:reset-shared-flag true})
-        (update :data blob/decode)
-        (update :features db/decode-pgarray #{}))))
+        (update :data blob/decode))))

 ;; --- COMMAND: Duplicate Project

 (declare duplicate-project)

 (s/def ::duplicate-project
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::project-id]
+  (s/keys :req-un [::profile-id ::project-id]
          :opt-un [::name]))

 (sv/defmethod ::duplicate-project
  "Duplicate an entire project with all the files"
-  {::doc/added "1.16"
-   ::webhooks/event? true}
-  [{:keys [::db/pool] :as cfg} params]
+  {::doc/added "1.16"}
+  [{:keys [pool] :as cfg} params]
  (db/with-atomic [conn pool]
-    (duplicate-project conn (assoc params :profile-id (::rpc/profile-id params)))))
+    (duplicate-project conn params)))

 (defn duplicate-project
  [conn {:keys [profile-id project-id name] :as params}]
@@ -251,7 +237,9 @@
    ;; create the duplicated project and assign the current profile as
    ;; a project owner
    (create-project conn project)
-    (create-project-role conn profile-id (:id project) :owner)
+    (create-project-role conn {:project-id (:id project)
+                               :profile-id profile-id
+                               :role :owner})

    ;; duplicate all files
    (let [index  (reduce #(assoc %1 (:id %2) (uuid/next)) {} files)
@@ -322,16 +310,15 @@

 (s/def ::ids (s/every ::us/uuid :kind set?))
 (s/def ::move-files
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::ids ::project-id]))
+  (s/keys :req-un [::profile-id ::ids ::project-id]))

 (sv/defmethod ::move-files
  "Move a set of files from one project to other."
-  {::doc/added "1.16"
-   ::webhooks/event? true}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id] :as params}]
+  {::doc/added "1.16"}
+  [{:keys [pool] :as cfg} params]
  (db/with-atomic [conn pool]
-    (move-files conn (assoc params :profile-id profile-id))))
+    (move-files conn params)))
+

 ;; --- COMMAND: Move project

@@ -362,16 +349,14 @@


 (s/def ::move-project
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id ::project-id]))
+  (s/keys :req-un [::profile-id ::team-id ::project-id]))

 (sv/defmethod ::move-project
  "Move projects between teams."
-  {::doc/added "1.16"
-   ::webhooks/event? true}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id] :as params}]
+  {::doc/added "1.16"}
+  [{:keys [pool] :as cfg} params]
  (db/with-atomic [conn pool]
-    (move-project conn (assoc params :profile-id profile-id))))
+    (move-project conn params)))

 ;; --- COMMAND: Clone Template

@@ -379,17 +364,15 @@

 (s/def ::template-id ::us/not-empty-string)
 (s/def ::clone-template
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::project-id ::template-id]))
+  (s/keys :req-un [::profile-id ::project-id ::template-id]))

 (sv/defmethod ::clone-template
  "Clone into the specified project the template by its id."
-  {::doc/added "1.16"
-   ::webhooks/event? true}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id] :as params}]
+  {::doc/added "1.16"}
+  [{:keys [pool] :as cfg} params]
  (db/with-atomic [conn pool]
    (-> (assoc cfg :conn conn)
-        (clone-template (assoc params :profile-id profile-id)))))
+        (clone-template params))))

 (defn- clone-template
  [{:keys [conn templates] :as cfg} {:keys [profile-id template-id project-id]}]
--- a/backend/src/app/rpc/commands/media.clj
+++ b/backend/src/app/rpc/commands/media.clj
@@ -1,275 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC
-
-(ns app.rpc.commands.media
-  (:require
-   [app.common.data :as d]
-   [app.common.exceptions :as ex]
-   [app.common.media :as cm]
-   [app.common.spec :as us]
-   [app.common.uuid :as uuid]
-   [app.config :as cf]
-   [app.db :as db]
-   [app.http.client :as http]
-   [app.media :as media]
-   [app.rpc :as-alias rpc]
-   [app.rpc.climit :as climit]
-   [app.rpc.commands.files :as files]
-   [app.rpc.doc :as-alias doc]
-   [app.storage :as sto]
-   [app.storage.tmp :as tmp]
-   [app.util.services :as sv]
-   [app.util.time :as dt]
-   [app.worker :as-alias wrk]
-   [clojure.spec.alpha :as s]
-   [cuerdas.core :as str]
-   [datoteka.io :as io]
-   [promesa.core :as p]
-   [promesa.exec :as px]))
-
-(def default-max-file-size
-  (* 1024 1024 10)) ; 10 MiB
-
-(def thumbnail-options
-  {:width 100
-   :height 100
-   :quality 85
-   :format :jpeg})
-
-(s/def ::id ::us/uuid)
-(s/def ::name ::us/string)
-(s/def ::file-id ::us/uuid)
-(s/def ::team-id ::us/uuid)
-
-(defn validate-content-size!
-  [content]
-  (when (> (:size content) (cf/get :media-max-file-size default-max-file-size))
-    (ex/raise :type :restriction
-              :code :media-max-file-size-reached
-              :hint (str/ffmt "the uploaded file size % is greater than the maximum %"
-                              (:size content)
-                              default-max-file-size))))
-
-;; --- Create File Media object (upload)
-
-(declare create-file-media-object)
-
-(s/def ::content ::media/upload)
-(s/def ::is-local ::us/boolean)
-
-(s/def ::upload-file-media-object
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::file-id ::is-local ::name ::content]
-          :opt-un [::id]))
-
-(sv/defmethod ::upload-file-media-object
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id file-id content] :as params}]
-  (let [cfg (update cfg ::sto/storage media/configure-assets-storage)]
-    (files/check-edition-permissions! pool profile-id file-id)
-    (media/validate-media-type! content)
-    (validate-content-size! content)
-
-    (create-file-media-object cfg params)))
-
-(defn- big-enough-for-thumbnail?
-  "Checks if the provided image info is big enough for
-  create a separate thumbnail storage object."
-  [info]
-  (or (> (:width info) (:width thumbnail-options))
-      (> (:height info) (:height thumbnail-options))))
-
-(defn- svg-image?
-  [info]
-  (= (:mtype info) "image/svg+xml"))
-
-;; NOTE: we use the `on conflict do update` instead of `do nothing`
-;; because postgresql does not returns anything if no update is
-;; performed, the `do update` does the trick.
-
-(def sql:create-file-media-object
-  "insert into file_media_object (id, file_id, is_local, name, media_id, thumbnail_id, width, height, mtype)
-   values (?, ?, ?, ?, ?, ?, ?, ?, ?)
-       on conflict (id) do update set created_at=file_media_object.created_at
-       returning *")
-
-;; NOTE: the following function executes without a transaction, this
-;; means that if something fails in the middle of this function, it
-;; will probably leave leaked/unreferenced objects in the database and
-;; probably in the storage layer. For handle possible object leakage,
-;; we create all media objects marked as touched, this ensures that if
-;; something fails, all leaked (already created storage objects) will
-;; be eventually marked as deleted by the touched-gc task.
-;;
-;; The touched-gc task, performs periodic analysis of all touched
-;; storage objects and check references of it. This is the reason why
-;; `reference` metadata exists: it indicates the name of the table
-;; witch holds the reference to storage object (it some kind of
-;; inverse, soft referential integrity).
-
-(defn create-file-media-object
-  [{:keys [::sto/storage ::db/pool climit ::wrk/executor]}
-   {:keys [id file-id is-local name content]}]
-  (letfn [;; Function responsible to retrieve the file information, as
-          ;; it is synchronous operation it should be wrapped into
-          ;; with-dispatch macro.
-          (get-info [content]
-            (climit/with-dispatch (:process-image climit)
-              (media/run {:cmd :info :input content})))
-
-          ;; Function responsible of calculating cryptographyc hash of
-          ;; the provided data.
-          (calculate-hash [data]
-            (px/with-dispatch executor
-              (sto/calculate-hash data)))
-
-          ;; Function responsible of generating thumnail. As it is synchronous
-          ;; opetation, it should be wrapped into with-dispatch macro
-          (generate-thumbnail [info]
-            (climit/with-dispatch (:process-image climit)
-              (media/run (assoc thumbnail-options
-                                :cmd :generic-thumbnail
-                                :input info))))
-
-          (create-thumbnail [info]
-            (when (and (not (svg-image? info))
-                       (big-enough-for-thumbnail? info))
-              (p/let [thumb   (generate-thumbnail info)
-                      hash    (calculate-hash (:data thumb))
-                      content (-> (sto/content (:data thumb) (:size thumb))
-                                  (sto/wrap-with-hash hash))]
-                (sto/put-object! storage
-                                 {::sto/content content
-                                  ::sto/deduplicate? true
-                                  ::sto/touched-at (dt/now)
-                                  :content-type (:mtype thumb)
-                                  :bucket "file-media-object"}))))
-
-          (create-image [info]
-            (p/let [data    (:path info)
-                    hash    (calculate-hash data)
-                    content (-> (sto/content data)
-                                (sto/wrap-with-hash hash))]
-              (sto/put-object! storage
-                               {::sto/content content
-                                ::sto/deduplicate? true
-                                ::sto/touched-at (dt/now)
-                                :content-type (:mtype info)
-                                :bucket "file-media-object"})))
-
-          (insert-into-database [info image thumb]
-            (px/with-dispatch executor
-              (db/exec-one! pool [sql:create-file-media-object
-                                  (or id (uuid/next))
-                                  file-id is-local name
-                                  (:id image)
-                                  (:id thumb)
-                                  (:width info)
-                                  (:height info)
-                                  (:mtype info)])))]
-
-    (p/let [info  (get-info content)
-            thumb (create-thumbnail info)
-            image (create-image info)]
-      (insert-into-database info image thumb))))
-
-;; --- Create File Media Object (from URL)
-
-(declare ^:private create-file-media-object-from-url)
-
-(s/def ::create-file-media-object-from-url
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::file-id ::is-local ::url]
-          :opt-un [::id ::name]))
-
-(sv/defmethod ::create-file-media-object-from-url
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id file-id] :as params}]
-  (let [cfg (update cfg ::sto/storage media/configure-assets-storage)]
-    (files/check-edition-permissions! pool profile-id file-id)
-    (create-file-media-object-from-url cfg params)))
-
-(defn- create-file-media-object-from-url
-  [cfg {:keys [url name] :as params}]
-  (letfn [(parse-and-validate-size [headers]
-            (let [size     (some-> (get headers "content-length") d/parse-integer)
-                  mtype    (get headers "content-type")
-                  format   (cm/mtype->format mtype)
-                  max-size (cf/get :media-max-file-size default-max-file-size)]
-
-              (when-not size
-                (ex/raise :type :validation
-                          :code :unknown-size
-                          :hint "seems like the url points to resource with unknown size"))
-
-              (when (> size max-size)
-                (ex/raise :type :validation
-                          :code :file-too-large
-                          :hint (str/ffmt "the file size % is greater than the maximum %"
-                                          size
-                                          default-max-file-size)))
-
-              (when (nil? format)
-                (ex/raise :type :validation
-                          :code :media-type-not-allowed
-                          :hint "seems like the url points to an invalid media object"))
-
-              {:size size
-               :mtype mtype
-               :format format}))
-
-          (download-media [uri]
-            (-> (http/req! cfg {:method :get :uri uri} {:response-type :input-stream})
-                (p/then process-response)))
-
-          (process-response [{:keys [body headers] :as response}]
-            (let [{:keys [size mtype]} (parse-and-validate-size headers)
-                  path                 (tmp/tempfile :prefix "penpot.media.download.")
-                  written              (io/write-to-file! body path :size size)]
-
-              (when (not= written size)
-                (ex/raise :type :internal
-                          :code :mismatch-write-size
-                          :hint "unexpected state: unable to write to file"))
-
-              {:filename "tempfile"
-               :size size
-               :path path
-               :mtype mtype}))]
-
-    (p/let [content (download-media url)]
-      (->> (merge params {:content content :name (or name (:filename content))})
-           (create-file-media-object cfg)))))
-
-;; --- Clone File Media object (Upload and create from url)
-
-(declare clone-file-media-object)
-
-(s/def ::clone-file-media-object
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::file-id ::is-local ::id]))
-
-(sv/defmethod ::clone-file-media-object
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id file-id] :as params}]
-  (db/with-atomic [conn pool]
-    (files/check-edition-permissions! conn profile-id file-id)
-    (-> (assoc cfg :conn conn)
-        (clone-file-media-object params))))
-
-(defn clone-file-media-object
-  [{:keys [conn]} {:keys [id file-id is-local]}]
-  (let [mobj (db/get-by-id conn :file-media-object id)]
-    (db/insert! conn :file-media-object
-                {:id (uuid/next)
-                 :file-id file-id
-                 :is-local is-local
-                 :name (:name mobj)
-                 :media-id (:media-id mobj)
-                 :thumbnail-id (:thumbnail-id mobj)
-                 :width  (:width mobj)
-                 :height (:height mobj)
-                 :mtype  (:mtype mobj)})))
--- a/backend/src/app/rpc/commands/profile.clj
+++ b/backend/src/app/rpc/commands/profile.clj
@@ -1,424 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC
-
-(ns app.rpc.commands.profile
-  (:require
-   [app.auth :as auth]
-   [app.common.data :as d]
-   [app.common.exceptions :as ex]
-   [app.common.spec :as us]
-   [app.common.uuid :as uuid]
-   [app.config :as cf]
-   [app.db :as db]
-   [app.emails :as eml]
-   [app.http.session :as session]
-   [app.loggers.audit :as audit]
-   [app.main :as-alias main]
-   [app.media :as media]
-   [app.rpc :as-alias rpc]
-   [app.rpc.climit :as climit]
-   [app.rpc.doc :as-alias doc]
-   [app.rpc.helpers :as rph]
-   [app.storage :as sto]
-   [app.tokens :as tokens]
-   [app.util.services :as sv]
-   [app.util.time :as dt]
-   [app.worker :as-alias wrk]
-   [clojure.spec.alpha :as s]
-   [cuerdas.core :as str]
-   [promesa.core :as p]
-   [promesa.exec :as px]))
-
-(declare decode-row)
-(declare get-profile)
-(declare strip-private-attrs)
-(declare filter-props)
-(declare check-profile-existence!)
-
-;; --- QUERY: Get profile (own)
-
-(s/def ::get-profile
-  (s/keys :opt [::rpc/profile-id]))
-
-(sv/defmethod ::get-profile
-  {::rpc/auth false
-   ::doc/added "1.18"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id]}]
-  ;; We need to return the anonymous profile object in two cases, when
-  ;; no profile-id is in session, and when db call raises not found. In all other
-  ;; cases we need to reraise the exception.
-  (try
-    (-> (get-profile pool profile-id)
-        (strip-private-attrs)
-        (update :props filter-props))
-    (catch Throwable _
-      {:id uuid/zero :fullname "Anonymous User"})))
-
-(defn get-profile
-  "Get profile by id. Throws not-found exception if no profile found."
-  [conn id & {:as attrs}]
-  (-> (db/get-by-id conn :profile id attrs)
-      (decode-row)))
-
-
-;; --- MUTATION: Update Profile (own)
-
-(s/def ::email ::us/email)
-(s/def ::fullname ::us/not-empty-string)
-(s/def ::lang ::us/string)
-(s/def ::theme ::us/string)
-
-(s/def ::update-profile
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::fullname]
-          :opt-un [::lang ::theme]))
-
-(sv/defmethod ::update-profile
-  {::doc/added "1.0"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id fullname lang theme] :as params}]
-  (db/with-atomic [conn pool]
-    ;; NOTE: we need to retrieve the profile independently if we use
-    ;; it or not for explicit locking and avoid concurrent updates of
-    ;; the same row/object.
-    (let [profile (-> (db/get-by-id conn :profile profile-id ::db/for-update? true)
-                      (decode-row))
-
-          ;; Update the profile map with direct params
-          profile (-> profile
-                      (assoc :fullname fullname)
-                      (assoc :lang lang)
-                      (assoc :theme theme))
-          ]
-
-      (db/update! conn :profile
-                  {:fullname fullname
-                   :lang lang
-                   :theme theme
-                   :props (db/tjson (:props profile))}
-                  {:id profile-id})
-
-      (-> profile
-          (strip-private-attrs)
-          (d/without-nils)
-          (rph/with-meta {::audit/props (audit/profile->props profile)})))))
-
-
-;; --- MUTATION: Update Password
-
-(declare validate-password!)
-(declare update-profile-password!)
-(declare invalidate-profile-session!)
-
-(s/def ::password ::us/not-empty-string)
-(s/def ::old-password ::us/not-empty-string)
-
-(s/def ::update-profile-password
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::password ::old-password]))
-
-(sv/defmethod ::update-profile-password
-  {::climit/queue :auth}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id password] :as params}]
-  (db/with-atomic [conn pool]
-    (let [profile    (validate-password! conn (assoc params :profile-id profile-id))
-          session-id (::session/id params)]
-
-      (when (= (str/lower (:email profile))
-               (str/lower (:password params)))
-        (ex/raise :type :validation
-                  :code :email-as-password
-                  :hint "you can't use your email as password"))
-
-      (update-profile-password! conn (assoc profile :password password))
-      (invalidate-profile-session! conn profile-id session-id)
-      nil)))
-
-(defn- invalidate-profile-session!
-  "Removes all sessions except the current one."
-  [conn profile-id session-id]
-  (let [sql "delete from http_session where profile_id = ? and id != ?"]
-    (:next.jdbc/update-count (db/exec-one! conn [sql profile-id session-id]))))
-
-(defn- validate-password!
-  [conn {:keys [profile-id old-password] :as params}]
-  (let [profile (db/get-by-id conn :profile profile-id ::db/for-update? true)]
-    (when-not (:valid (auth/verify-password old-password (:password profile)))
-      (ex/raise :type :validation
-                :code :old-password-not-match))
-    profile))
-
-(defn update-profile-password!
-  [conn {:keys [id password] :as profile}]
-  (db/update! conn :profile
-              {:password (auth/derive-password password)}
-              {:id id}))
-
-;; --- MUTATION: Update Photo
-
-(declare upload-photo)
-(declare update-profile-photo)
-
-(s/def ::file ::media/upload)
-(s/def ::update-profile-photo
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::file]))
-
-(sv/defmethod ::update-profile-photo
-  [cfg {:keys [::rpc/profile-id file] :as params}]
-  ;; Validate incoming mime type
-  (media/validate-media-type! file #{"image/jpeg" "image/png" "image/webp"})
-  (let [cfg (update cfg ::sto/storage media/configure-assets-storage)]
-    (update-profile-photo cfg (assoc params :profile-id profile-id))))
-
-;; TODO: reimplement it without p/let
-
-(defn update-profile-photo
-  [{:keys [::db/pool ::sto/storage ::wrk/executor] :as cfg} {:keys [profile-id file] :as params}]
-  (letfn [(on-uploaded [photo]
-            (let [profile (db/get-by-id pool :profile profile-id ::db/for-update? true)]
-
-              ;; Schedule deletion of old photo
-              (when-let [id (:photo-id profile)]
-                (sto/touch-object! storage id))
-
-              ;; Save new photo
-              (db/update! pool :profile
-                          {:photo-id (:id photo)}
-                          {:id profile-id})
-
-              (-> (rph/wrap)
-                  (rph/with-meta {::audit/replace-props
-                                  {:file-name (:filename file)
-                                   :file-size (:size file)
-                                   :file-path (str (:path file))
-                                   :file-mtype (:mtype file)}}))))]
-    (->> (upload-photo cfg params)
-         (p/fmap executor on-uploaded))))
-
-(defn upload-photo
-  [{:keys [::sto/storage ::wrk/executor climit] :as cfg} {:keys [file]}]
-  (letfn [(get-info [content]
-            (climit/with-dispatch (:process-image climit)
-              (media/run {:cmd :info :input content})))
-
-          (generate-thumbnail [info]
-            (climit/with-dispatch (:process-image climit)
-              (media/run {:cmd :profile-thumbnail
-                          :format :jpeg
-                          :quality 85
-                          :width 256
-                          :height 256
-                          :input info})))
-
-          ;; Function responsible of calculating cryptographyc hash of
-          ;; the provided data.
-          (calculate-hash [data]
-            (px/with-dispatch executor
-              (sto/calculate-hash data)))]
-
-    (p/let [info    (get-info file)
-            thumb   (generate-thumbnail info)
-            hash    (calculate-hash (:data thumb))
-            content (-> (sto/content (:data thumb) (:size thumb))
-                        (sto/wrap-with-hash hash))]
-      (sto/put-object! storage {::sto/content content
-                                ::sto/deduplicate? true
-                                :bucket "profile"
-                                :content-type (:mtype thumb)}))))
-
-
-;; --- MUTATION: Request Email Change
-
-(declare ^:private request-email-change!)
-(declare ^:private change-email-immediately!)
-
-(s/def ::request-email-change
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::email]))
-
-(sv/defmethod ::request-email-change
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id email] :as params}]
-  (db/with-atomic [conn pool]
-    (let [profile (db/get-by-id conn :profile profile-id)
-          cfg     (assoc cfg ::conn conn)
-          params  (assoc params
-                         :profile profile
-                         :email (str/lower email))]
-      (if (contains? cf/flags :smtp)
-        (request-email-change! cfg params)
-        (change-email-immediately! cfg params)))))
-
-(defn- change-email-immediately!
-  [{:keys [::conn]} {:keys [profile email] :as params}]
-  (when (not= email (:email profile))
-    (check-profile-existence! conn params))
-
-  (db/update! conn :profile
-              {:email email}
-              {:id (:id profile)})
-
-  {:changed true})
-
-(defn- request-email-change!
-  [{:keys [::conn] :as cfg} {:keys [profile email] :as params}]
-  (let [token   (tokens/generate (::main/props cfg)
-                                 {:iss :change-email
-                                  :exp (dt/in-future "15m")
-                                  :profile-id (:id profile)
-                                  :email email})
-        ptoken  (tokens/generate (::main/props cfg)
-                                 {:iss :profile-identity
-                                  :profile-id (:id profile)
-                                  :exp (dt/in-future {:days 30})})]
-
-    (when (not= email (:email profile))
-      (check-profile-existence! conn params))
-
-    (when-not (eml/allow-send-emails? conn profile)
-      (ex/raise :type :validation
-                :code :profile-is-muted
-                :hint "looks like the profile has reported repeatedly as spam or has permanent bounces."))
-
-    (when (eml/has-bounce-reports? conn email)
-      (ex/raise :type :validation
-                :code :email-has-permanent-bounces
-                :hint "looks like the email you invite has been repeatedly reported as spam or permanent bounce"))
-
-    (eml/send! {::eml/conn conn
-                ::eml/factory eml/change-email
-                :public-uri (cf/get :public-uri)
-                :to (:email profile)
-                :name (:fullname profile)
-                :pending-email email
-                :token token
-                :extra-data ptoken})
-    nil))
-
-
-;; --- MUTATION: Update Profile Props
-
-(s/def ::props map?)
-(s/def ::update-profile-props
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::props]))
-
-(sv/defmethod ::update-profile-props
-  [{:keys [::db/pool]} {:keys [::rpc/profile-id props]}]
-  (db/with-atomic [conn pool]
-    (let [profile (get-profile conn profile-id ::db/for-update? true)
-          props   (reduce-kv (fn [props k v]
-                               ;; We don't accept namespaced keys
-                               (if (simple-ident? k)
-                                 (if (nil? v)
-                                   (dissoc props k)
-                                   (assoc props k v))
-                                 props))
-                             (:props profile)
-                             props)]
-
-      (db/update! conn :profile
-                  {:props (db/tjson props)}
-                  {:id profile-id})
-
-      (filter-props props))))
-
-
-;; --- MUTATION: Delete Profile
-
-(declare ^:private get-owned-teams-with-participants)
-
-(s/def ::delete-profile
-  (s/keys :req [::rpc/profile-id]))
-
-(sv/defmethod ::delete-profile
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id] :as params}]
-  (db/with-atomic [conn pool]
-    (let [teams      (get-owned-teams-with-participants conn profile-id)
-          deleted-at (dt/now)]
-
-      ;; If we found owned teams with participants, we don't allow
-      ;; delete profile until the user properly transfer ownership or
-      ;; explicitly removes all participants from the team
-      (when (some pos? (map :participants teams))
-        (ex/raise :type :validation
-                  :code :owner-teams-with-people
-                  :hint "The user need to transfer ownership of owned teams."
-                  :context {:teams (mapv :id teams)}))
-
-      (doseq [{:keys [id]} teams]
-        (db/update! conn :team
-                    {:deleted-at deleted-at}
-                    {:id id}))
-
-      (db/update! conn :profile
-                  {:deleted-at deleted-at}
-                  {:id profile-id})
-
-      (rph/with-transform {} (session/delete-fn cfg)))))
-
-
-;; --- HELPERS
-
-(def sql:owned-teams
-  "with owner_teams as (
-      select tpr.team_id as id
-        from team_profile_rel as tpr
-       where tpr.is_owner is true
-         and tpr.profile_id = ?
-   )
-   select tpr.team_id as id,
-          count(tpr.profile_id) - 1 as participants
-     from team_profile_rel as tpr
-    where tpr.team_id in (select id from owner_teams)
-      and tpr.profile_id != ?
-    group by 1")
-
-(defn- get-owned-teams-with-participants
-  [conn profile-id]
-  (db/exec! conn [sql:owned-teams profile-id profile-id]))
-
-(def ^:private sql:profile-existence
-  "select exists (select * from profile
-                   where email = ?
-                     and deleted_at is null) as val")
-
-(defn check-profile-existence!
-  [conn {:keys [email] :as params}]
-  (let [email  (str/lower email)
-        result (db/exec-one! conn [sql:profile-existence email])]
-    (when (:val result)
-      (ex/raise :type :validation
-                :code :email-already-exists))
-    params))
-
-(def ^:private sql:profile-by-email
-  "select p.* from profile as p
-    where p.email = ?
-      and (p.deleted_at is null or
-           p.deleted_at > now())")
-
-(defn get-profile-by-email
-  "Returns a profile looked up by email or `nil` if not match found."
-  [conn email]
-  (->> (db/exec! conn [sql:profile-by-email (str/lower email)])
-       (map decode-row)
-       (first)))
-
-(defn strip-private-attrs
-  "Only selects a publicly visible profile attrs."
-  [row]
-  (dissoc row :password :deleted-at))
-
-(defn filter-props
-  "Removes all namespace qualified props from `props` attr."
-  [props]
-  (into {} (filter (fn [[k _]] (simple-ident? k))) props))
-
-(defn decode-row
-  [{:keys [props] :as row}]
-  (cond-> row
-    (db/pgobject? props "jsonb")
-    (assoc :props (db/decode-transit-pgobject props))))
--- a/backend/src/app/rpc/commands/projects.clj
+++ b/backend/src/app/rpc/commands/projects.clj
@@ -1,268 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC
-
-(ns app.rpc.commands.projects
-  (:require
-   [app.common.spec :as us]
-   [app.db :as db]
-   [app.loggers.audit :as-alias audit]
-   [app.loggers.webhooks :as webhooks]
-   [app.rpc :as-alias rpc]
-   [app.rpc.commands.teams :as teams]
-   [app.rpc.doc :as-alias doc]
-   [app.rpc.helpers :as rph]
-   [app.rpc.permissions :as perms]
-   [app.rpc.quotes :as quotes]
-   [app.util.services :as sv]
-   [app.util.time :as dt]
-   [clojure.spec.alpha :as s]))
-
-(s/def ::id ::us/uuid)
-(s/def ::name ::us/string)
-
-;; --- Check Project Permissions
-
-(def ^:private sql:project-permissions
-  "select tpr.is_owner,
-          tpr.is_admin,
-          tpr.can_edit
-     from team_profile_rel as tpr
-    inner join project as p on (p.team_id = tpr.team_id)
-    where p.id = ?
-      and tpr.profile_id = ?
-   union all
-   select ppr.is_owner,
-          ppr.is_admin,
-          ppr.can_edit
-     from project_profile_rel as ppr
-    where ppr.project_id = ?
-      and ppr.profile_id = ?")
-
-(defn- get-permissions
-  [conn profile-id project-id]
-  (let [rows     (db/exec! conn [sql:project-permissions
-                                 project-id profile-id
-                                 project-id profile-id])
-        is-owner (boolean (some :is-owner rows))
-        is-admin (boolean (some :is-admin rows))
-        can-edit (boolean (some :can-edit rows))]
-     (when (seq rows)
-       {:is-owner is-owner
-        :is-admin (or is-owner is-admin)
-        :can-edit (or is-owner is-admin can-edit)
-        :can-read true})))
-
-(def has-edit-permissions?
-  (perms/make-edition-predicate-fn get-permissions))
-
-(def has-read-permissions?
-  (perms/make-read-predicate-fn get-permissions))
-
-(def check-edition-permissions!
-  (perms/make-check-fn has-edit-permissions?))
-
-(def check-read-permissions!
-  (perms/make-check-fn has-read-permissions?))
-
-;; --- QUERY: Get projects
-
-(declare get-projects)
-
-(s/def ::team-id ::us/uuid)
-(s/def ::get-projects
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id]))
-
-(sv/defmethod ::get-projects
-  {::doc/added "1.18"}
-  [{:keys [::db/pool]} {:keys [::rpc/profile-id team-id]}]
-  (with-open [conn (db/open pool)]
-    (teams/check-read-permissions! conn profile-id team-id)
-    (get-projects conn profile-id team-id)))
-
-(def sql:projects
-  "select p.*,
-          coalesce(tpp.is_pinned, false) as is_pinned,
-          (select count(*) from file as f
-            where f.project_id = p.id
-              and deleted_at is null) as count
-     from project as p
-    inner join team as t on (t.id = p.team_id)
-     left join team_project_profile_rel as tpp
-            on (tpp.project_id = p.id and
-                tpp.team_id = p.team_id and
-                tpp.profile_id = ?)
-    where p.team_id = ?
-      and p.deleted_at is null
-      and t.deleted_at is null
-    order by p.modified_at desc")
-
-(defn get-projects
-  [conn profile-id team-id]
-  (db/exec! conn [sql:projects profile-id team-id]))
-
-;; --- QUERY: Get all projects
-
-(declare get-all-projects)
-
-(s/def ::get-all-projects
-  (s/keys :req [::rpc/profile-id]))
-
-(sv/defmethod ::get-all-projects
-  {::doc/added "1.18"}
-  [{:keys [::db/pool]} {:keys [::rpc/profile-id]}]
-  (with-open [conn (db/open pool)]
-    (get-all-projects conn profile-id)))
-
-(def sql:all-projects
-  "select p1.*, t.name as team_name, t.is_default as is_default_team
-     from project as p1
-    inner join team as t on (t.id = p1.team_id)
-    where t.id in (select team_id
-                     from team_profile_rel as tpr
-                    where tpr.profile_id = ?
-                      and (tpr.can_edit = true or
-                           tpr.is_owner = true or
-                           tpr.is_admin = true))
-      and t.deleted_at is null
-      and p1.deleted_at is null
-   union
-   select p2.*, t.name as team_name, t.is_default as is_default_team
-     from project as p2
-    inner join team as t on (t.id = p2.team_id)
-    where p2.id in (select project_id
-                     from project_profile_rel as ppr
-                    where ppr.profile_id = ?
-                      and (ppr.can_edit = true or
-                           ppr.is_owner = true or
-                           ppr.is_admin = true))
-      and t.deleted_at is null
-      and p2.deleted_at is null
-    order by team_name, name;")
-
-(defn get-all-projects
-  [conn profile-id]
-  (db/exec! conn [sql:all-projects profile-id profile-id]))
-
-
-;; --- QUERY: Get project
-
-(s/def ::get-project
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::id]))
-
-(sv/defmethod ::get-project
-  {::doc/added "1.18"}
-  [{:keys [::db/pool]} {:keys [::rpc/profile-id id]}]
-  (with-open [conn (db/open pool)]
-    (let [project (db/get-by-id conn :project id)]
-      (check-read-permissions! conn profile-id id)
-      project)))
-
-
-
-;; --- MUTATION: Create Project
-
-(s/def ::create-project
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id ::name]
-          :opt-un [::id]))
-
-(sv/defmethod ::create-project
-  {::doc/added "1.18"
-   ::webhooks/event? true}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id team-id] :as params}]
-  (db/with-atomic [conn pool]
-    (teams/check-edition-permissions! conn profile-id team-id)
-    (quotes/check-quote! conn {::quotes/id ::quotes/projects-per-team
-                               ::quotes/profile-id profile-id
-                               ::quotes/team-id team-id})
-
-    (let [params  (assoc params :profile-id profile-id)
-          project (teams/create-project conn params)]
-      (teams/create-project-role conn profile-id (:id project) :owner)
-      (db/insert! conn :team-project-profile-rel
-                  {:project-id (:id project)
-                   :profile-id profile-id
-                   :team-id team-id
-                   :is-pinned true})
-      (assoc project :is-pinned true))))
-
-
-;; --- MUTATION: Toggle Project Pin
-
-(def ^:private
-  sql:update-project-pin
-  "insert into team_project_profile_rel (team_id, project_id, profile_id, is_pinned)
-   values (?, ?, ?, ?)
-       on conflict (team_id, project_id, profile_id)
-       do update set is_pinned=?")
-
-(s/def ::is-pinned ::us/boolean)
-(s/def ::project-id ::us/uuid)
-(s/def ::update-project-pin
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::id ::team-id ::is-pinned]))
-
-(sv/defmethod ::update-project-pin
-  {::doc/added "1.18"
-   ::webhooks/batch-timeout (dt/duration "5s")
-   ::webhooks/batch-key (webhooks/key-fn ::rpc/profile-id :id)
-   ::webhooks/event? true}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id id team-id is-pinned] :as params}]
-  (db/with-atomic [conn pool]
-    (check-edition-permissions! conn profile-id id)
-    (db/exec-one! conn [sql:update-project-pin team-id id profile-id is-pinned is-pinned])
-    nil))
-
-;; --- MUTATION: Rename Project
-
-(declare rename-project)
-
-(s/def ::rename-project
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::name ::id]))
-
-(sv/defmethod ::rename-project
-  {::doc/added "1.18"
-   ::webhooks/event? true}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id id name] :as params}]
-  (db/with-atomic [conn pool]
-    (check-edition-permissions! conn profile-id id)
-    (let [project (db/get-by-id conn :project id ::db/for-update? true)]
-      (db/update! conn :project
-                  {:name name}
-                  {:id id})
-      (rph/with-meta (rph/wrap)
-        {::audit/props {:team-id (:team-id project)
-                        :prev-name (:name project)}}))))
-
-;; --- MUTATION: Delete Project
-
-(s/def ::delete-project
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::id]))
-
-;; TODO: right now, we just don't allow delete default projects, in a
-;; future we need to ensure raise a correct exception signaling that
-;; this is not allowed.
-
-(sv/defmethod ::delete-project
-  {::doc/added "1.18"
-   ::webhooks/event? true}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id id] :as params}]
-  (db/with-atomic [conn pool]
-    (check-edition-permissions! conn profile-id id)
-    (let [project (db/update! conn :project
-                              {:deleted-at (dt/now)}
-                              {:id id :is-default false})]
-      (rph/with-meta (rph/wrap)
-        {::audit/props {:team-id (:team-id project)
-                        :name (:name project)
-                        :created-at (:created-at project)
-                        :modified-at (:modified-at project)}}))))
-
-
--- a/backend/src/app/rpc/commands/search.clj
+++ b/backend/src/app/rpc/commands/search.clj
@@ -1,68 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC
-
-(ns app.rpc.commands.search
-  (:require
-   [app.common.spec :as us]
-   [app.db :as db]
-   [app.rpc :as-alias rpc]
-   [app.rpc.doc :as-alias doc]
-   [app.util.services :as sv]
-   [clojure.spec.alpha :as s]))
-
-(def ^:private sql:search-files
-  "with projects as (
-     select p.*
-       from project as p
-      inner join team_profile_rel as tpr on (tpr.team_id = p.team_id)
-      where tpr.profile_id = ?
-        and p.team_id = ?
-        and (p.deleted_at is null or p.deleted_at > now())
-        and (tpr.is_admin = true or
-             tpr.is_owner = true or
-             tpr.can_edit = true)
-      union
-     select p.*
-       from project as p
-      inner join project_profile_rel as ppr on (ppr.project_id = p.id)
-      where ppr.profile_id = ?
-        and p.team_id = ?
-        and (p.deleted_at is null or p.deleted_at > now())
-        and (ppr.is_admin = true or
-             ppr.is_owner = true or
-             ppr.can_edit = true)
-   )
-   select distinct
-          f.id,
-          f.project_id,
-          f.created_at,
-          f.modified_at,
-          f.name,
-          f.is_shared
-     from file as f
-    inner join projects as pr on (f.project_id = pr.id)
-    where f.name ilike ('%' || ? || '%')
-    order by f.created_at asc")
-
-(defn search-files
-  [conn profile-id team-id search-term]
-  (db/exec! conn [sql:search-files
-                  profile-id team-id
-                  profile-id team-id
-                  search-term]))
-
-(s/def ::team-id ::us/uuid)
-(s/def ::search-files ::us/string)
-
-(s/def ::search-files
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id]
-          :opt-un [::search-term]))
-
-(sv/defmethod ::search-files
-  {::doc/added "1.17"}
-  [{:keys [::db/pool]} {:keys [::rpc/profile-id team-id search-term]}]
-  (some->> search-term (search-files pool profile-id team-id)))
--- a/backend/src/app/rpc/commands/teams.clj
+++ b/backend/src/app/rpc/commands/teams.clj
@@ -1,860 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC
-
-(ns app.rpc.commands.teams
-  (:require
-   [app.common.data :as d]
-   [app.common.exceptions :as ex]
-   [app.common.logging :as l]
-   [app.common.spec :as us]
-   [app.common.uuid :as uuid]
-   [app.config :as cf]
-   [app.db :as db]
-   [app.emails :as eml]
-   [app.loggers.audit :as audit]
-   [app.main :as-alias main]
-   [app.media :as media]
-   [app.rpc :as-alias rpc]
-   [app.rpc.commands.profile :as profile]
-   [app.rpc.doc :as-alias doc]
-   [app.rpc.helpers :as rph]
-   [app.rpc.permissions :as perms]
-   [app.rpc.quotes :as quotes]
-   [app.storage :as sto]
-   [app.tokens :as tokens]
-   [app.util.services :as sv]
-   [app.util.time :as dt]
-   [app.worker :as-alias wrk]
-   [clojure.spec.alpha :as s]
-   [cuerdas.core :as str]
-   [promesa.core :as p]
-   [promesa.exec :as px]))
-
-;; --- Helpers & Specs
-
-(s/def ::id ::us/uuid)
-(s/def ::name ::us/string)
-(s/def ::file-id ::us/uuid)
-(s/def ::team-id ::us/uuid)
-
-(def ^:private sql:team-permissions
-  "select tpr.is_owner,
-          tpr.is_admin,
-          tpr.can_edit
-     from team_profile_rel as tpr
-     join team as t on (t.id = tpr.team_id)
-    where tpr.profile_id = ?
-      and tpr.team_id = ?
-      and t.deleted_at is null")
-
-(defn get-permissions
-  [conn profile-id team-id]
-  (let [rows     (db/exec! conn [sql:team-permissions profile-id team-id])
-        is-owner (boolean (some :is-owner rows))
-        is-admin (boolean (some :is-admin rows))
-        can-edit (boolean (some :can-edit rows))]
-     (when (seq rows)
-       {:is-owner is-owner
-        :is-admin (or is-owner is-admin)
-        :can-edit (or is-owner is-admin can-edit)
-        :can-read true})))
-
-(def has-edit-permissions?
-  (perms/make-edition-predicate-fn get-permissions))
-
-(def has-read-permissions?
-  (perms/make-read-predicate-fn get-permissions))
-
-(def check-edition-permissions!
-  (perms/make-check-fn has-edit-permissions?))
-
-(def check-read-permissions!
-  (perms/make-check-fn has-read-permissions?))
-
-;; --- Query: Teams
-
-(declare retrieve-teams)
-
-(s/def ::get-teams
-  (s/keys :req [::rpc/profile-id]))
-
-(sv/defmethod ::get-teams
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id] :as params}]
-  (with-open [conn (db/open pool)]
-    (retrieve-teams conn profile-id)))
-
-(def sql:teams
-  "select t.*,
-          tp.is_owner,
-          tp.is_admin,
-          tp.can_edit,
-          (t.id = ?) as is_default
-     from team_profile_rel as tp
-     join team as t on (t.id = tp.team_id)
-    where t.deleted_at is null
-      and tp.profile_id = ?
-    order by tp.created_at asc")
-
-(defn process-permissions
-  [team]
-  (let [is-owner    (:is-owner team)
-        is-admin    (:is-admin team)
-        can-edit    (:can-edit team)
-        permissions {:type :membership
-                     :is-owner is-owner
-                     :is-admin (or is-owner is-admin)
-                     :can-edit (or is-owner is-admin can-edit)}]
-    (-> team
-        (dissoc :is-owner :is-admin :can-edit)
-        (assoc :permissions permissions))))
-
-(defn retrieve-teams
-  [conn profile-id]
-  (let [profile (profile/get-profile conn profile-id)]
-    (->> (db/exec! conn [sql:teams (:default-team-id profile) profile-id])
-         (mapv process-permissions))))
-
-;; --- Query: Team (by ID)
-
-(declare retrieve-team)
-
-(s/def ::get-team
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::id]))
-
-(sv/defmethod ::get-team
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id id]}]
-  (with-open [conn (db/open pool)]
-    (retrieve-team conn profile-id id)))
-
-(defn retrieve-team
-  [conn profile-id team-id]
-  (let [profile (profile/get-profile conn profile-id)
-        sql     (str "WITH teams AS (" sql:teams ") SELECT * FROM teams WHERE id=?")
-        result  (db/exec-one! conn [sql (:default-team-id profile) profile-id team-id])]
-
-    (when-not result
-      (ex/raise :type :not-found
-                :code :team-does-not-exist))
-
-    (process-permissions result)))
-
-;; --- Query: Team Members
-
-(def sql:team-members
-  "select tp.*,
-          p.id,
-          p.email,
-          p.fullname as name,
-          p.fullname as fullname,
-          p.photo_id,
-          p.is_active
-     from team_profile_rel as tp
-     join profile as p on (p.id = tp.profile_id)
-    where tp.team_id = ?")
-
-(defn retrieve-team-members
-  [conn team-id]
-  (db/exec! conn [sql:team-members team-id]))
-
-(s/def ::team-id ::us/uuid)
-(s/def ::get-team-members
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id]))
-
-(sv/defmethod ::get-team-members
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id team-id]}]
-  (with-open [conn (db/open pool)]
-    (check-read-permissions! conn profile-id team-id)
-    (retrieve-team-members conn team-id)))
-
-
-;; --- Query: Team Users
-
-(declare retrieve-users)
-(declare retrieve-team-for-file)
-
-(s/def ::get-team-users
-  (s/and (s/keys :req [::rpc/profile-id]
-                 :opt-un [::team-id ::file-id])
-         #(or (:team-id %) (:file-id %))))
-
-(sv/defmethod ::get-team-users
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id team-id file-id]}]
-  (with-open [conn (db/open pool)]
-    (if team-id
-      (do
-        (check-read-permissions! conn profile-id team-id)
-        (retrieve-users conn team-id))
-      (let [{team-id :id} (retrieve-team-for-file conn file-id)]
-        (check-read-permissions! conn profile-id team-id)
-        (retrieve-users conn team-id)))))
-
-;; This is a similar query to team members but can contain more data
-;; because some user can be explicitly added to project or file (not
-;; implemented in UI)
-
-(def sql:team-users
-  "select pf.id, pf.fullname, pf.photo_id
-     from profile as pf
-    inner join team_profile_rel as tpr on (tpr.profile_id = pf.id)
-    where tpr.team_id = ?
-    union
-   select pf.id, pf.fullname, pf.photo_id
-     from profile as pf
-    inner join project_profile_rel as ppr on (ppr.profile_id = pf.id)
-    inner join project as p on (ppr.project_id = p.id)
-    where p.team_id = ?
-   union
-   select pf.id, pf.fullname, pf.photo_id
-     from profile as pf
-    inner join file_profile_rel as fpr on (fpr.profile_id = pf.id)
-    inner join file as f on (fpr.file_id = f.id)
-    inner join project as p on (f.project_id = p.id)
-    where p.team_id = ?")
-
-(def sql:team-by-file
-  "select p.team_id as id
-     from project as p
-     join file as f on (p.id = f.project_id)
-    where f.id = ?")
-
-(defn retrieve-users
-  [conn team-id]
-  (db/exec! conn [sql:team-users team-id team-id team-id]))
-
-(defn retrieve-team-for-file
-  [conn file-id]
-  (->> [sql:team-by-file file-id]
-       (db/exec-one! conn)))
-
-;; --- Query: Team Stats
-
-(declare retrieve-team-stats)
-
-(s/def ::get-team-stats
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id]))
-
-(sv/defmethod ::get-team-stats
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id team-id]}]
-  (with-open [conn (db/open pool)]
-    (check-read-permissions! conn profile-id team-id)
-    (retrieve-team-stats conn team-id)))
-
-(def sql:team-stats
-  "select (select count(*) from project where team_id = ?) as projects,
-          (select count(*) from file as f join project as p on (p.id = f.project_id) where p.team_id = ?) as files")
-
-(defn retrieve-team-stats
-  [conn team-id]
-  (db/exec-one! conn [sql:team-stats team-id team-id]))
-
-
-;; --- Query: Team invitations
-
-(s/def ::get-team-invitations
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id]))
-
-(def sql:team-invitations
-  "select email_to as email, role, (valid_until < now()) as expired
-   from team_invitation where team_id = ? order by valid_until desc, created_at desc")
-
-(defn get-team-invitations
-  [conn team-id]
-  (->> (db/exec! conn [sql:team-invitations team-id])
-       (mapv #(update % :role keyword))))
-
-(sv/defmethod ::get-team-invitations
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id team-id]}]
-  (with-open [conn (db/open pool)]
-    (check-read-permissions! conn profile-id team-id)
-    (get-team-invitations conn team-id)))
-
-;; --- Mutation: Create Team
-
-(declare create-team)
-(declare create-project)
-(declare create-project-role)
-(declare ^:private create-team*)
-(declare ^:private create-team-role)
-(declare ^:private create-team-default-project)
-
-(s/def ::create-team
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::name]
-          :opt-un [::id]))
-
-(sv/defmethod ::create-team
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id] :as params}]
-  (db/with-atomic [conn pool]
-    (quotes/check-quote! conn {::quotes/id ::quotes/teams-per-profile
-                               ::quotes/profile-id profile-id})
-
-    (create-team conn (assoc params :profile-id profile-id))))
-
-(defn create-team
-  "This is a complete team creation process, it creates the team
-  object and all related objects (default role and default project)."
-  [conn params]
-  (let [team    (create-team* conn params)
-        params  (assoc params
-                       :team-id (:id team)
-                       :role :owner)
-        project (create-team-default-project conn params)]
-    (create-team-role conn params)
-    (assoc team :default-project-id (:id project))))
-
-(defn- create-team*
-  [conn {:keys [id name is-default] :as params}]
-  (let [id         (or id (uuid/next))
-        is-default (if (boolean? is-default) is-default false)]
-    (db/insert! conn :team
-                {:id id
-                 :name name
-                 :is-default is-default})))
-
-(defn- create-team-role
-  [conn {:keys [profile-id team-id role] :as params}]
-  (let [params {:team-id team-id
-                :profile-id profile-id}]
-    (->> (perms/assign-role-flags params role)
-         (db/insert! conn :team-profile-rel))))
-
-(defn- create-team-default-project
-  [conn {:keys [profile-id team-id] :as params}]
-  (let [project {:id (uuid/next)
-                 :team-id team-id
-                 :name "Drafts"
-                 :is-default true}
-        project (create-project conn project)]
-    (create-project-role conn profile-id (:id project) :owner)
-    project))
-
-;; NOTE: we have project creation here because there are cyclic
-;; dependency between teams and projects namespaces, and the project
-;; creation happens in both sides, on team creation and on simple
-;; project creation, so it make sense to have this functions in this
-;; namespace too.
-
-(defn create-project
-  [conn {:keys [id team-id name is-default] :as params}]
-  (let [id         (or id (uuid/next))
-        is-default (if (boolean? is-default) is-default false)]
-    (db/insert! conn :project
-                {:id id
-                 :name name
-                 :team-id team-id
-                 :is-default is-default})))
-
-(defn create-project-role
-  [conn profile-id project-id role]
-  (let [params {:project-id project-id
-                :profile-id profile-id}]
-    (->> (perms/assign-role-flags params role)
-         (db/insert! conn :project-profile-rel))))
-
-;; --- Mutation: Update Team
-
-(s/def ::update-team
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::name ::id]))
-
-(sv/defmethod ::update-team
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id id name] :as params}]
-  (db/with-atomic [conn pool]
-    (check-edition-permissions! conn profile-id id)
-    (db/update! conn :team
-                {:name name}
-                {:id id})
-    nil))
-
-
-;; --- Mutation: Leave Team
-
-(declare role->params)
-
-(defn leave-team
-  [conn {:keys [profile-id id reassign-to]}]
-  (let [perms   (get-permissions conn profile-id id)
-        members (retrieve-team-members conn id)]
-
-    (cond
-      ;; we can only proceed if there are more members in the team
-      ;; besides the current profile
-      (<= (count members) 1)
-      (ex/raise :type :validation
-                :code :no-enough-members-for-leave
-                :context {:members (count members)})
-
-      ;; if the `reassign-to` is filled and has a different value
-      ;; than the current profile-id, we proceed to reassing the
-      ;; owner role to profile identified by the `reassign-to`.
-      (and reassign-to (not= reassign-to profile-id))
-      (let [member (d/seek #(= reassign-to (:id %)) members)]
-        (when-not member
-          (ex/raise :type :not-found :code :member-does-not-exist))
-
-        ;; unasign owner role to current profile
-        (db/update! conn :team-profile-rel
-                    {:is-owner false}
-                    {:team-id id
-                     :profile-id profile-id})
-
-        ;; assign owner role to new profile
-        (db/update! conn :team-profile-rel
-                    (role->params :owner)
-                    {:team-id id :profile-id reassign-to}))
-
-      ;; and finally, if all other conditions does not match and the
-      ;; current profile is owner, we dont allow it because there
-      ;; must always be an owner.
-      (:is-owner perms)
-      (ex/raise :type :validation
-                :code :owner-cant-leave-team
-                :hint "releasing owner before leave"))
-
-    (db/delete! conn :team-profile-rel
-                {:profile-id profile-id
-                 :team-id id})
-
-    nil))
-
-(s/def ::reassign-to ::us/uuid)
-(s/def ::leave-team
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::id]
-          :opt-un [::reassign-to]))
-
-(sv/defmethod ::leave-team
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id] :as params}]
-  (db/with-atomic [conn pool]
-    (leave-team conn (assoc params :profile-id profile-id))))
-
-;; --- Mutation: Delete Team
-
-(s/def ::delete-team
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::id]))
-
-;; TODO: right now just don't allow delete default team, in future it
-;; should raise a specific exception for signal that this action is
-;; not allowed.
-
-(sv/defmethod ::delete-team
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id id] :as params}]
-  (db/with-atomic [conn pool]
-    (let [perms (get-permissions conn profile-id id)]
-      (when-not (:is-owner perms)
-        (ex/raise :type :validation
-                  :code :only-owner-can-delete-team))
-
-      (db/update! conn :team
-                  {:deleted-at (dt/now)}
-                  {:id id :is-default false})
-      nil)))
-
-
-;; --- Mutation: Team Update Role
-
-(s/def ::team-id ::us/uuid)
-(s/def ::member-id ::us/uuid)
-;; Temporarily disabled viewer role
-;; https://tree.taiga.io/project/uxboxproject/issue/1083
-;; (s/def ::role #{:owner :admin :editor :viewer})
-(s/def ::role #{:owner :admin :editor})
-
-(defn role->params
-  [role]
-  (case role
-    :admin  {:is-owner false :is-admin true :can-edit true}
-    :editor {:is-owner false :is-admin false :can-edit true}
-    :owner  {:is-owner true  :is-admin true :can-edit true}
-    :viewer {:is-owner false :is-admin false :can-edit false}))
-
-(defn update-team-member-role
-  [conn {:keys [profile-id team-id member-id role] :as params}]
-  ;; We retrieve all team members instead of query the
-  ;; database for a single member. This is just for
-  ;; convenience, if this becomes a bottleneck or problematic,
-  ;; we will change it to more efficient fetch mechanisms.
-  (let [perms   (get-permissions conn profile-id team-id)
-        members (retrieve-team-members conn team-id)
-        member  (d/seek #(= member-id (:id %)) members)
-
-        is-owner? (:is-owner perms)
-        is-admin? (:is-admin perms)]
-
-    ;; If no member is found, just 404
-    (when-not member
-      (ex/raise :type :not-found
-                :code :member-does-not-exist))
-
-    ;; First check if we have permissions to change roles
-    (when-not (or is-owner? is-admin?)
-      (ex/raise :type :validation
-                :code :insufficient-permissions))
-
-    ;; Don't allow change role of owner member
-    (when (:is-owner member)
-      (ex/raise :type :validation
-                :code :cant-change-role-to-owner))
-
-    ;; Don't allow promote to owner to admin users.
-    (when (and (not is-owner?) (= role :owner))
-      (ex/raise :type :validation
-                :code :cant-promote-to-owner))
-
-    (let [params (role->params role)]
-      ;; Only allow single owner on team
-      (when (= role :owner)
-        (db/update! conn :team-profile-rel
-                    {:is-owner false}
-                    {:team-id team-id
-                     :profile-id profile-id}))
-
-      (db/update! conn :team-profile-rel
-                  params
-                  {:team-id team-id
-                   :profile-id member-id})
-      nil)))
-
-(s/def ::update-team-member-role
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id ::member-id ::role]))
-
-(sv/defmethod ::update-team-member-role
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id] :as params}]
-  (db/with-atomic [conn pool]
-    (update-team-member-role conn (assoc params :profile-id profile-id))))
-
-
-;; --- Mutation: Delete Team Member
-
-(s/def ::delete-team-member
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id ::member-id]))
-
-(sv/defmethod ::delete-team-member
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id team-id member-id] :as params}]
-  (db/with-atomic [conn pool]
-    (let [perms (get-permissions conn profile-id team-id)]
-      (when-not (or (:is-owner perms)
-                    (:is-admin perms))
-        (ex/raise :type :validation
-                  :code :insufficient-permissions))
-
-      (when (= member-id profile-id)
-        (ex/raise :type :validation
-                  :code :cant-remove-yourself))
-
-      (db/delete! conn :team-profile-rel {:profile-id member-id
-                                          :team-id team-id})
-
-      nil)))
-
-;; --- Mutation: Update Team Photo
-
-(declare upload-photo)
-(declare ^:private update-team-photo)
-
-(s/def ::file ::media/upload)
-(s/def ::update-team-photo
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id ::file]))
-
-(sv/defmethod ::update-team-photo
-  {::doc/added "1.17"}
-  [cfg {:keys [::rpc/profile-id file] :as params}]
-  ;; Validate incoming mime type
-  (media/validate-media-type! file #{"image/jpeg" "image/png" "image/webp"})
-  (let [cfg (update cfg ::sto/storage media/configure-assets-storage)]
-    (update-team-photo cfg (assoc params :profile-id profile-id))))
-
-(defn update-team-photo
-  [{:keys [::db/pool ::sto/storage ::wrk/executor] :as cfg} {:keys [profile-id team-id] :as params}]
-  (p/let [team  (px/with-dispatch executor
-                  (retrieve-team pool profile-id team-id))
-          photo (profile/upload-photo cfg params)]
-
-    ;; Mark object as touched for make it ellegible for tentative
-    ;; garbage collection.
-    (when-let [id (:photo-id team)]
-      (sto/touch-object! storage id))
-
-    ;; Save new photo
-    (db/update! pool :team
-                {:photo-id (:id photo)}
-                {:id team-id})
-
-    (assoc team :photo-id (:id photo))))
-
-
-;; --- Mutation: Create Team Invitation
-
-(def sql:upsert-team-invitation
-  "insert into team_invitation(team_id, email_to, role, valid_until)
-   values (?, ?, ?, ?)
-       on conflict(team_id, email_to) do
-          update set role = ?, updated_at = now();")
-
-(defn- create-invitation-token
-  [cfg {:keys [profile-id valid-until team-id member-id member-email role]}]
-  (tokens/generate (::main/props cfg)
-                   {:iss :team-invitation
-                    :exp valid-until
-                    :profile-id profile-id
-                    :role role
-                    :team-id team-id
-                    :member-email member-email
-                    :member-id member-id}))
-
-(defn- create-profile-identity-token
-  [cfg profile]
-  (tokens/generate (::main/props cfg)
-                   {:iss :profile-identity
-                    :profile-id (:id profile)
-                    :exp (dt/in-future {:days 30})}))
-
-(defn- create-invitation
-  [{:keys [::conn] :as cfg} {:keys [team profile role email] :as params}]
-  (let [member (profile/get-profile-by-email conn email)
-        expire (dt/in-future "168h") ;; 7 days
-        itoken (create-invitation-token cfg {:profile-id (:id profile)
-                                             :valid-until expire
-                                             :team-id (:id team)
-                                             :member-email (or (:email member) email)
-                                             :member-id (:id member)
-                                             :role role})
-        ptoken (create-profile-identity-token cfg profile)]
-
-    (when (and member (not (eml/allow-send-emails? conn member)))
-      (ex/raise :type :validation
-                :code :member-is-muted
-                :email email
-                :hint "the profile has reported repeatedly as spam or has bounces"))
-
-    ;; Secondly check if the invited member email is part of the global spam/bounce report.
-    (when (eml/has-bounce-reports? conn email)
-      (ex/raise :type :validation
-                :code :email-has-permanent-bounces
-                :email email
-                :hint "the email you invite has been repeatedly reported as spam or bounce"))
-
-    (when (contains? cf/flags :log-invitation-tokens)
-      (l/trace :hint "invitation token" :token itoken))
-
-    ;; When we have email verification disabled and invitation user is
-    ;; already present in the database, we proceed to add it to the
-    ;; team as-is, without email roundtrip.
-
-    ;; TODO: if member does not exists and email verification is
-    ;; disabled, we should proceed to create the profile (?)
-    (if (and (not (contains? cf/flags :email-verification))
-             (some? member))
-      (let [params (merge {:team-id (:id team)
-                           :profile-id (:id member)}
-                          (role->params role))]
-
-        ;; Insert the invited member to the team
-        (db/insert! conn :team-profile-rel params {:on-conflict-do-nothing true})
-
-        ;; If profile is not yet verified, mark it as verified because
-        ;; accepting an invitation link serves as verification.
-        (when-not (:is-active member)
-          (db/update! conn :profile
-                      {:is-active true}
-                      {:id (:id member)})))
-      (do
-        (db/exec-one! conn [sql:upsert-team-invitation
-                            (:id team) (str/lower email) (name role) expire (name role)])
-        (eml/send! {::eml/conn conn
-                    ::eml/factory eml/invite-to-team
-                    :public-uri (cf/get :public-uri)
-                    :to email
-                    :invited-by (:fullname profile)
-                    :team (:name team)
-                    :token itoken
-                    :extra-data ptoken})))
-
-    itoken))
-
-(s/def ::email ::us/email)
-(s/def ::emails ::us/set-of-valid-emails)
-(s/def ::create-team-invitations
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id ::role]
-          :opt-un [::email ::emails]))
-
-(sv/defmethod ::create-team-invitations
-  "A rpc call that allow to send a single or multiple invitations to
-  join the team."
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id team-id email emails role] :as params}]
-  (db/with-atomic [conn pool]
-    (let [perms    (get-permissions conn profile-id team-id)
-          profile  (db/get-by-id conn :profile profile-id)
-          team     (db/get-by-id conn :team team-id)
-          emails   (cond-> (or emails #{}) (string? email) (conj email))]
-
-
-      (run! (partial quotes/check-quote! conn)
-            (list {::quotes/id ::quotes/invitations-per-team
-                   ::quotes/profile-id profile-id
-                   ::quotes/team-id (:id team)
-                   ::quotes/incr (count emails)}
-                  {::quotes/id ::quotes/profiles-per-team
-                   ::quotes/profile-id profile-id
-                   ::quotes/team-id (:id team)
-                   ::quotes/incr (count emails)}))
-
-      (when-not (:is-admin perms)
-        (ex/raise :type :validation
-                  :code :insufficient-permissions))
-
-      ;; First check if the current profile is allowed to send emails.
-      (when-not (eml/allow-send-emails? conn profile)
-        (ex/raise :type :validation
-                  :code :profile-is-muted
-                  :hint "looks like the profile has reported repeatedly as spam or has permanent bounces"))
-
-      (let [cfg         (assoc cfg ::conn conn)
-            invitations (->> emails
-                             (map (fn [email]
-                                    {:email (str/lower email)
-                                     :team team
-                                     :profile profile
-                                     :role role}))
-                             (map (partial create-invitation cfg)))]
-        (with-meta (vec invitations)
-          {::audit/props {:invitations (count invitations)}})))))
-
-
-;; --- Mutation: Create Team & Invite Members
-
-(s/def ::emails ::us/set-of-valid-emails)
-(s/def ::create-team-with-invitations
-  (s/merge ::create-team
-           (s/keys :req-un [::emails ::role])))
-
-(sv/defmethod ::create-team-with-invitations
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id emails role] :as params}]
-  (db/with-atomic [conn pool]
-    (let [team     (create-team conn params)
-          profile  (db/get-by-id conn :profile profile-id)
-          cfg      (assoc cfg ::conn conn)]
-
-      ;; Create invitations for all provided emails.
-      (->> emails
-           (map (fn [email]
-                  {:team team
-                   :profile profile
-                   :email (str/lower email)
-                   :role role}))
-           (run! (partial create-invitation cfg)))
-
-      (run! (partial quotes/check-quote! conn)
-            (list {::quotes/id ::quotes/teams-per-profile
-                   ::quotes/profile-id profile-id}
-                  {::quotes/id ::quotes/invitations-per-team
-                   ::quotes/profile-id profile-id
-                   ::quotes/team-id (:id team)
-                   ::quotes/incr (count emails)}
-                  {::quotes/id ::quotes/profiles-per-team
-                   ::quotes/profile-id profile-id
-                   ::quotes/team-id (:id team)
-                   ::quotes/incr (count emails)}))
-
-      (-> team
-          (vary-meta assoc ::audit/props {:invitations (count emails)})
-          (rph/with-defer
-            #(when-let [collector (::audit/collector cfg)]
-               (audit/submit! collector
-                              {:type "command"
-                               :name "create-team-invitations"
-                               :profile-id profile-id
-                               :props {:emails emails
-                                       :role role
-                                       :profile-id profile-id
-                                       :invitations (count emails)}})))))))
-
-;; --- Query: get-team-invitation-token
-
-(s/def ::get-team-invitation-token
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id ::email]))
-
-(sv/defmethod ::get-team-invitation-token
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id team-id email] :as params}]
-  (check-read-permissions! pool profile-id team-id)
-  (let [invit (-> (db/get pool :team-invitation
-                          {:team-id team-id
-                           :email-to (str/lower email)})
-                  (update :role keyword))
-        member (profile/get-profile-by-email pool (:email invit))
-        token  (create-invitation-token cfg {:team-id (:team-id invit)
-                                             :profile-id profile-id
-                                             :valid-until (:valid-until invit)
-                                             :role (:role invit)
-                                             :member-id (:id member)
-                                             :member-email (or (:email member) (:email-to invit))})]
-    {:token token}))
-
-;; --- Mutation: Update invitation role
-
-(s/def ::update-team-invitation-role
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id ::email ::role]))
-
-(sv/defmethod ::update-team-invitation-role
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id team-id email role] :as params}]
-  (db/with-atomic [conn pool]
-    (let [perms    (get-permissions conn profile-id team-id)]
-
-      (when-not (:is-admin perms)
-        (ex/raise :type :validation
-                  :code :insufficient-permissions))
-
-      (db/update! conn :team-invitation
-                  {:role (name role) :updated-at (dt/now)}
-                  {:team-id team-id :email-to (str/lower email)})
-      nil)))
-
-;; --- Mutation: Delete invitation
-
-(s/def ::delete-team-invitation
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id ::email]))
-
-(sv/defmethod ::delete-team-invitation
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id team-id email] :as params}]
-  (db/with-atomic [conn pool]
-    (let [perms (get-permissions conn profile-id team-id)]
-
-      (when-not (:is-admin perms)
-        (ex/raise :type :validation
-                  :code :insufficient-permissions))
-
-      (db/delete! conn :team-invitation
-                {:team-id team-id :email-to (str/lower email)})
-      nil)))
--- a/backend/src/app/rpc/commands/verify_token.clj
+++ b/backend/src/app/rpc/commands/verify_token.clj
@@ -9,15 +9,10 @@
   [app.common.exceptions :as ex]
   [app.common.spec :as us]
   [app.db :as db]
-   [app.http.session :as session]
   [app.loggers.audit :as audit]
-   [app.main :as-alias main]
-   [app.rpc :as-alias rpc]
-   [app.rpc.commands.profile :as profile]
-   [app.rpc.commands.teams :as teams]
   [app.rpc.doc :as-alias doc]
-   [app.rpc.helpers :as rph]
-   [app.rpc.quotes :as quotes]
+   [app.rpc.mutations.teams :as teams]
+   [app.rpc.queries.profile :as profile]
   [app.tokens :as tokens]
   [app.tokens.spec.team-invitation :as-alias spec.team-invitation]
   [app.util.services :as sv]
@@ -30,20 +25,20 @@

 (s/def ::verify-token
  (s/keys :req-un [::token]
-          :opt [::rpc/profile-id]))
+          :opt-un [::profile-id]))

 (sv/defmethod ::verify-token
-  {::rpc/auth false
+  {:auth false
   ::doc/added "1.15"}
-  [{:keys [::db/pool] :as cfg} {:keys [token] :as params}]
+  [{:keys [pool sprops] :as cfg} {:keys [token] :as params}]
  (db/with-atomic [conn pool]
-    (let [claims (tokens/verify (::main/props cfg) {:token token})
+    (let [claims (tokens/verify sprops {:token token})
          cfg    (assoc cfg :conn conn)]
      (process-token cfg params claims))))

 (defmethod process-token :change-email
  [{:keys [conn] :as cfg} _params {:keys [profile-id email] :as claims}]
-  (when (profile/get-profile-by-email conn email)
+  (when (profile/retrieve-profile-data-by-email conn email)
    (ex/raise :type :validation
              :code :email-already-exists))

@@ -51,14 +46,14 @@
              {:email email}
              {:id profile-id})

-  (rph/with-meta claims
+  (with-meta claims
    {::audit/name "update-profile-email"
     ::audit/props {:email email}
     ::audit/profile-id profile-id}))

 (defmethod process-token :verify-email
-  [{:keys [conn] :as cfg} _ {:keys [profile-id] :as claims}]
-  (let [profile (profile/get-profile conn profile-id)
+  [{:keys [conn session] :as cfg} _ {:keys [profile-id] :as claims}]
+  (let [profile (profile/retrieve-profile conn profile-id)
        claims  (assoc claims :profile profile)]

    (when-not (:is-active profile)
@@ -71,15 +66,15 @@
                  {:is-active true}
                  {:id (:id profile)}))

-    (-> claims
-        (rph/with-transform (session/create-fn cfg profile-id))
-        (rph/with-meta {::audit/name "verify-profile-email"
-                        ::audit/props (audit/profile->props profile)
-                        ::audit/profile-id (:id profile)}))))
+    (with-meta claims
+      {:transform-response ((:create session) profile-id)
+       ::audit/name "verify-profile-email"
+       ::audit/props (audit/profile->props profile)
+       ::audit/profile-id (:id profile)})))

 (defmethod process-token :auth
  [{:keys [conn] :as cfg} _params {:keys [profile-id] :as claims}]
-  (let [profile (profile/get-profile conn profile-id)]
+  (let [profile (profile/retrieve-profile conn profile-id)]
    (assoc claims :profile profile)))

 ;; --- Team Invitation
@@ -98,11 +93,6 @@
      (ex/raise :type :restriction
                :code :profile-blocked))

-    (quotes/check-quote! conn
-                         {::quotes/id ::quotes/profiles-per-team
-                          ::quotes/profile-id (:id member)
-                          ::quotes/team-id team-id})
-
    ;; Insert the invited member to the team
    (db/insert! conn :team-profile-rel params {:on-conflict-do-nothing true})

@@ -134,11 +124,10 @@
          :opt-un [::spec.team-invitation/member-id]))

 (defmethod process-token :team-invitation
-  [{:keys [conn] :as cfg}
-   {:keys [::rpc/profile-id token]}
+  [{:keys [conn session] :as cfg} {:keys [profile-id token]}
   {:keys [member-id team-id member-email] :as claims}]

-  (us/verify! ::team-invitation-claims claims)
+  (us/assert ::team-invitation-claims claims)

  (let [invitation (db/get* conn :team-invitation
                            {:team-id team-id :email-to member-email})
@@ -157,13 +146,14 @@
        ;; proceed with accepting the invitation and joining the
        ;; current profile to the invited team.
        (let [profile (accept-invitation cfg claims invitation profile)]
-          (-> (assoc claims :state :created)
-              (rph/with-meta {::audit/name "accept-team-invitation"
-                              ::audit/props (merge
-                                             (audit/profile->props profile)
-                                             {:team-id (:team-id claims)
-                                              :role (:role claims)})
-                              ::audit/profile-id profile-id})))
+          (with-meta
+            (assoc claims :state :created)
+            {::audit/name "accept-team-invitation"
+             ::audit/props (merge
+                            (audit/profile->props profile)
+                            {:team-id (:team-id claims)
+                             :role (:role claims)})
+             ::audit/profile-id profile-id}))

        (ex/raise :type :validation
                  :code :invalid-token
@@ -179,14 +169,15 @@
                                 {:email member-email})
                               {:columns [:id :email]})]
        (let [profile (accept-invitation cfg claims invitation member)]
-          (-> (assoc claims :state :created)
-              (rph/with-transform (session/create-fn cfg (:id profile)))
-              (rph/with-meta {::audit/name "accept-team-invitation"
-                              ::audit/props (merge
-                                             (audit/profile->props profile)
-                                             {:team-id (:team-id claims)
-                                              :role (:role claims)})
-                              ::audit/profile-id member-id})))
+          (with-meta
+            (assoc claims :state :created)
+            {:transform-response ((:create session) (:id profile))
+             ::audit/name "accept-team-invitation"
+             ::audit/props (merge
+                            (audit/profile->props profile)
+                            {:team-id (:team-id claims)
+                             :role (:role claims)})
+             ::audit/profile-id member-id}))

        {:invitation-token token
         :iss :team-invitation
--- a/backend/src/app/rpc/commands/viewer.clj
+++ b/backend/src/app/rpc/commands/viewer.clj
@@ -1,89 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC
-
-(ns app.rpc.commands.viewer
-  (:require
-   [app.common.exceptions :as ex]
-   [app.db :as db]
-   [app.rpc :as-alias rpc]
-   [app.rpc.commands.comments :as comments]
-   [app.rpc.commands.files :as files]
-   [app.rpc.cond :as-alias cond]
-   [app.rpc.doc :as-alias doc]
-   [app.util.services :as sv]
-   [clojure.spec.alpha :as s]))
-
-;; --- QUERY: View Only Bundle
-
-(defn- get-project
-  [conn id]
-  (db/get-by-id conn :project id {:columns [:id :name :team-id]}))
-
-(defn- get-bundle
-  [conn file-id profile-id features]
-  (let [file    (files/get-file conn file-id features)
-        project (get-project conn (:project-id file))
-        libs    (files/get-file-libraries conn file-id features)
-        users   (comments/get-file-comments-users conn file-id profile-id)
-
-        links   (->> (db/query conn :share-link {:file-id file-id})
-                     (mapv (fn [row]
-                             (update row :pages db/decode-pgarray #{}))))
-
-        fonts   (db/query conn :team-font-variant
-                          {:team-id (:team-id project)
-                           :deleted-at nil})]
-
-    {:file file
-     :users users
-     :fonts fonts
-     :project project
-     :share-links links
-     :libraries libs}))
-
-(defn- remove-not-allowed-pages
-  [data allowed]
-  (-> data
-      (update :pages (fn [pages] (filterv #(contains? allowed %) pages)))
-      (update :pages-index select-keys allowed)))
-
-(defn get-view-only-bundle
-  [conn {:keys [profile-id file-id share-id features] :as params}]
-  (let [perms  (files/get-permissions conn profile-id file-id share-id)
-        bundle (-> (get-bundle conn file-id profile-id features)
-                   (assoc :permissions perms))]
-
-    ;; When we have neither profile nor share, we just return a not
-    ;; found response to the user.
-    (when-not perms
-      (ex/raise :type :not-found
-                :code :object-not-found
-                :hint "object not found"))
-
-    (update bundle :file
-            (fn [file]
-              (cond-> file
-                (= :share-link (:type perms))
-                (update :data remove-not-allowed-pages (:pages perms))
-
-                :always
-                (update :data select-keys [:id :options :pages :pages-index]))))))
-
-(s/def ::get-view-only-bundle
-  (s/keys :req-un [::files/file-id]
-          :opt-un [::files/share-id
-                   ::files/features]
-          :opt [::rpc/profile-id]))
-
-(sv/defmethod ::get-view-only-bundle
-  {::rpc/auth false
-   ::cond/get-object #(files/get-minimal-file %1 (:file-id %2))
-   ::cond/key-fn files/get-file-etag
-   ::cond/reuse-key? true
-   ::doc/added "1.17"}
-  [{:keys [::db/pool]} {:keys [::rpc/profile-id] :as params}]
-  (with-open [conn (db/open pool)]
-    (get-view-only-bundle conn (assoc params :profile-id profile-id))))
--- a/backend/src/app/rpc/commands/webhooks.clj
+++ b/backend/src/app/rpc/commands/webhooks.clj
@@ -1,146 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC
-
-(ns app.rpc.commands.webhooks
-  (:require
-   [app.common.exceptions :as ex]
-   [app.common.spec :as us]
-   [app.common.uuid :as uuid]
-   [app.db :as db]
-   [app.http.client :as http]
-   [app.loggers.webhooks :as webhooks]
-   [app.rpc :as-alias rpc]
-   [app.rpc.commands.teams :refer [check-edition-permissions! check-read-permissions!]]
-   [app.rpc.doc :as-alias doc]
-   [app.util.services :as sv]
-   [app.util.time :as dt]
-   [app.worker :as-alias wrk]
-   [clojure.spec.alpha :as s]
-   [cuerdas.core :as str]
-   [promesa.core :as p]))
-
-;; --- Mutation: Create Webhook
-
-(s/def ::team-id ::us/uuid)
-(s/def ::uri ::us/not-empty-string)
-(s/def ::is-active ::us/boolean)
-(s/def ::mtype
-  #{"application/json"
-    "application/transit+json"})
-
-(s/def ::create-webhook
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id ::uri ::mtype]
-          :opt-un [::is-active]))
-
-;; NOTE: for now the quote is hardcoded but this need to be solved in
-;; a more universal way for handling properly object quotes
-(def max-hooks-for-team 8)
-
-(defn- validate-webhook!
-  [cfg whook params]
-  (letfn [(handle-exception [exception]
-            (if-let [hint (webhooks/interpret-exception exception)]
-              (ex/raise :type :validation
-                        :code :webhook-validation
-                        :hint hint)
-              (ex/raise :type :internal
-                        :code :webhook-validation
-                        :cause exception)))
-
-          (handle-response [response]
-            (when-let [hint (webhooks/interpret-response response)]
-              (ex/raise :type :validation
-                        :code :webhook-validation
-                        :hint hint)))]
-
-    (if (not= (:uri whook) (:uri params))
-      (->> (http/req! cfg {:method :head
-                           :uri (:uri params)
-                           :timeout (dt/duration "3s")})
-           (p/hmap (fn [response exception]
-                     (if exception
-                       (handle-exception exception)
-                       (handle-response response)))))
-      (p/resolved nil))))
-
-(defn- validate-quotes!
-  [{:keys [::db/pool]} {:keys [team-id]}]
-  (let [sql   ["select count(*) as total from webhook where team_id = ?" team-id]
-        total (:total (db/exec-one! pool sql))]
-    (when (>= total max-hooks-for-team)
-      (ex/raise :type :restriction
-                :code :webhooks-quote-reached
-                :hint (str/ffmt "can't create more than % webhooks per team"
-                                max-hooks-for-team)))))
-
-(defn- insert-webhook!
-  [{:keys [::db/pool]} {:keys [team-id uri mtype is-active] :as params}]
-  (db/insert! pool :webhook
-              {:id (uuid/next)
-               :team-id team-id
-               :uri uri
-               :is-active is-active
-               :mtype mtype}))
-
-(defn- update-webhook!
-  [{:keys [::db/pool] :as cfg} {:keys [id] :as wook} {:keys [uri mtype is-active] :as params}]
-  (db/update! pool :webhook
-              {:uri uri
-               :is-active is-active
-               :mtype mtype
-               :error-code nil
-               :error-count 0}
-              {:id id}))
-
-(sv/defmethod ::create-webhook
-  {::doc/added "1.17"}
-  [{:keys [::db/pool ::wrk/executor] :as cfg} {:keys [::rpc/profile-id team-id] :as params}]
-  (check-edition-permissions! pool profile-id team-id)
-  (validate-quotes! cfg params)
-  (->> (validate-webhook! cfg nil params)
-       (p/fmap executor (fn [_] (insert-webhook! cfg params)))))
-
-(s/def ::update-webhook
-  (s/keys :req-un [::id ::uri ::mtype ::is-active]))
-
-(sv/defmethod ::update-webhook
-  {::doc/added "1.17"}
-  [{:keys [::db/pool ::wrk/executor] :as cfg} {:keys [::rpc/profile-id id] :as params}]
-  (let [whook (db/get pool :webhook {:id id})]
-    (check-edition-permissions! pool profile-id (:team-id whook))
-    (->> (validate-webhook! cfg whook params)
-         (p/fmap executor (fn [_] (update-webhook! cfg whook params))))))
-
-(s/def ::delete-webhook
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::id]))
-
-(sv/defmethod ::delete-webhook
-  {::doc/added "1.17"}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id id]}]
-  (db/with-atomic [conn pool]
-    (let [whook (db/get conn :webhook {:id id})]
-      (check-edition-permissions! conn profile-id (:team-id whook))
-      (db/delete! conn :webhook {:id id})
-      nil)))
-
-;; --- Query: Webhooks
-
-(s/def ::team-id ::us/uuid)
-(s/def ::get-webhooks
-  (s/keys :req [::rpc/profile-id]
-          :req-un [::team-id]))
-
-(def sql:get-webhooks
-  "select id, uri, mtype, is_active, error_code, error_count
-   from webhook where team_id = ? order by uri")
-
-(sv/defmethod ::get-webhooks
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id team-id]}]
-  (with-open [conn (db/open pool)]
-    (check-read-permissions! conn profile-id team-id)
-    (db/exec! conn [sql:get-webhooks team-id])))
--- a/backend/src/app/rpc/cond.clj
+++ b/backend/src/app/rpc/cond.clj
@@ -1,67 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC
-
-(ns app.rpc.cond
-  "Conditional loading middleware.
-
-  A middleware consists mainly on wrapping a RPC method with
-  conditional logic. It expects to to have some metadata set on the RPC
-  method that will enable this middleware to retrieve the necessary data
-  for process the conditional logic:
-
-  - `::get-object` => should be a function that retrieves the minimum version
-    of the object that will be used for calculate the KEY (etags in terms of
-    the HTTP protocol).
-  - `::key-fn` a function used to generate a string representation
-    of the object. This function can be applied to the object returned by the
-    `get-object` but also to the RPC return value (in case you don't provide
-    the return value calculated key under `::key` metadata prop.
-  - `::reuse-key?` enables reusing the key calculated on first time; usefull
-    when the target object is not retrieved on the RPC (typical on retrieving
-    dependent objects).
-  "
-  (:require
-   [app.common.logging :as l]
-   [app.rpc.helpers :as rph]
-   [app.util.services :as-alias sv]
-   [promesa.core :as p]
-   [promesa.exec :as px]
-   [yetti.response :as yrs]))
-
-(def
-  ^{:dynamic true
-    :doc "Runtime flag for enable/disable conditional processing of RPC methods."}
-  *enabled* false)
-
-(defn- fmt-key
-  [s]
-  (when s
-    (str "W/\"" s "\"")))
-
-(defn wrap
-  [{:keys [executor]} f {:keys [::get-object ::key-fn ::reuse-key?] :as mdata}]
-  (if (and (ifn? get-object) (ifn? key-fn))
-    (do
-      (l/debug :hint "instrumenting method" :service (::sv/name mdata))
-      (fn [cfg {:keys [::key] :as params}]
-        (if *enabled*
-          (->> (if (or key reuse-key?)
-                 (->> (px/submit! executor (partial get-object cfg params))
-                      (p/map key-fn)
-                      (p/map fmt-key))
-                 (p/resolved nil))
-               (p/mapcat (fn [key']
-                           (if (and (some? key)
-                                    (= key key'))
-                             (p/resolved (fn [_] (yrs/response 304)))
-                             (->> (f cfg params)
-                                  (p/map (fn [result]
-                                           (->> (or (and reuse-key? key')
-                                                    (-> result meta ::key fmt-key)
-                                                    (-> result key-fn fmt-key))
-                                                (rph/with-header result "etag")))))))))
-          (f cfg params))))
-    f))
--- a/backend/src/app/rpc/doc.clj
+++ b/backend/src/app/rpc/doc.clj
@@ -9,7 +9,6 @@
  (:require
   [app.common.data :as d]
   [app.config :as cf]
-   [app.loggers.webhooks :as-alias webhooks]
   [app.rpc :as-alias rpc]
   [app.util.services :as sv]
   [app.util.template :as tmpl]
@@ -36,7 +35,6 @@
               :name (d/name name)
               :module (-> (:ns mdata) (str/split ".") last)
               :auth (:auth mdata true)
-               :webhook (::webhooks/event? mdata false)
               :docs (::sv/docstring mdata)
               :deprecated (::deprecated mdata)
               :added (::added mdata)
@@ -53,7 +51,6 @@
     (->> (:queries methods)
          (map (partial gen-doc :query))
          (sort-by (juxt :module :name)))
-
     :mutation-methods
     (->> (:mutations methods)
          (map (partial gen-doc :query))
@@ -70,8 +67,6 @@
      (respond (yrs/response 404)))))


-(s/def ::routes vector?)
-
 (defmethod ig/pre-init-spec ::routes [_]
  (s/keys :req-un [::rpc/methods]))

--- a/backend/src/app/rpc/helpers.clj
+++ b/backend/src/app/rpc/helpers.clj
@@ -6,72 +6,11 @@

 (ns app.rpc.helpers
  "General purpose RPC helpers."
-  (:refer-clojure :exclude [with-meta])
-  (:require
-   [app.common.data.macros :as dm]
-   [app.http :as-alias http]
-   [app.rpc :as-alias rpc]))
+  (:require [app.common.data.macros :as dm]))

-;; A utilty wrapper object for wrap service responses that does not
-;; implements the IObj interface that make possible attach metadata to
-;; it.
-
-(deftype MetadataWrapper [obj ^:unsynchronized-mutable metadata]
-  clojure.lang.IDeref
-  (deref [_] obj)
-
-  clojure.lang.IObj
-  (withMeta [_ meta]
-    (MetadataWrapper. obj meta))
-
-  (meta [_] metadata))
-
-(defn wrap
-  "Conditionally wrap a value into MetadataWrapper instance. If the
-  object already implements IObj interface it will be returned as is."
-  ([] (wrap nil))
-  ([o]
-   (if (instance? clojure.lang.IObj o)
-     o
-     (MetadataWrapper. o {})))
-  ([o m]
-   (MetadataWrapper. o m)))
-
-(defn wrapped?
-  [o]
-  (instance? MetadataWrapper o))
-
-(defn unwrap
-  [o]
-  (if (wrapped? o) @o o))
-
-(defn with-header
-  "Add a http header to the RPC result."
-  [mdw key val]
-  (vary-meta mdw update ::http/headers assoc key val))
-
-(defn with-transform
-  "Adds a http response transform to the RPC result."
-  [mdw transform-fn]
-  (vary-meta mdw update ::rpc/response-transform-fns conj transform-fn))
-
-(defn with-defer
-  "Defer execution of the function until request is finished."
-  [mdw hook-fn]
-  (vary-meta mdw update ::rpc/before-complete-fns conj hook-fn))
-
-(defn with-meta
-  [mdw mdata]
-  (vary-meta mdw merge mdata))
-
-(defn assoc-meta
-  [mdw k v]
-  (vary-meta mdw assoc k v))
-
-(defn with-http-cache
-  [mdw max-age]
-  (vary-meta mdw update ::rpc/response-transform-fns conj
-             (fn [_ response]
-               (let [exp (if (integer? max-age) max-age (inst-ms max-age))
-                     val (dm/fmt "max-age=%" (int (/ exp 1000.0)))]
-                 (update response :headers assoc "cache-control" val)))))
+(defn http-cache
+  [{:keys [max-age]}]
+  (fn [_ response]
+    (let [exp (if (integer? max-age) max-age (inst-ms max-age))
+          val (dm/fmt "max-age=%" (int (/ exp 1000.0)))]
+      (update response :headers assoc "cache-control" val))))
--- a/backend/src/app/rpc/mutations/comments.clj
+++ b/backend/src/app/rpc/mutations/comments.clj
@@ -0,0 +1,123 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS INC
+
+(ns app.rpc.mutations.comments
+  (:require
+   [app.common.exceptions :as ex]
+   [app.common.spec :as us]
+   [app.db :as db]
+   [app.rpc.commands.comments :as cmd.comments]
+   [app.rpc.doc :as-alias doc]
+   [app.rpc.queries.files :as files]
+   [app.rpc.retry :as retry]
+   [app.util.services :as sv]
+   [clojure.spec.alpha :as s]))
+
+;; --- Mutation: Create Comment Thread
+
+(s/def ::create-comment-thread ::cmd.comments/create-comment-thread)
+
+(sv/defmethod ::create-comment-thread
+  {::retry/max-retries 3
+   ::retry/matches retry/conflict-db-insert?
+   ::doc/added "1.0"
+   ::doc/deprecated "1.15"}
+  [{:keys [pool] :as cfg} {:keys [profile-id file-id share-id] :as params}]
+  (db/with-atomic [conn pool]
+    (files/check-comment-permissions! conn profile-id file-id share-id)
+    (cmd.comments/create-comment-thread conn params)))
+
+;; --- Mutation: Update Comment Thread Status
+
+(s/def ::id ::us/uuid)
+(s/def ::share-id (s/nilable ::us/uuid))
+
+(s/def ::update-comment-thread-status ::cmd.comments/update-comment-thread-status)
+
+(sv/defmethod ::update-comment-thread-status
+  {::doc/added "1.0"
+   ::doc/deprecated "1.15"}
+  [{:keys [pool] :as cfg} {:keys [profile-id id share-id] :as params}]
+  (db/with-atomic [conn pool]
+    (let [cthr (db/get-by-id conn :comment-thread id {:for-update true})]
+      (when-not cthr (ex/raise :type :not-found))
+      (files/check-comment-permissions! conn profile-id (:file-id cthr) share-id)
+      (cmd.comments/upsert-comment-thread-status! conn profile-id (:id cthr)))))
+
+
+;; --- Mutation: Update Comment Thread
+
+(s/def ::update-comment-thread ::cmd.comments/update-comment-thread)
+
+(sv/defmethod ::update-comment-thread
+  {::doc/added "1.0"
+   ::doc/deprecated "1.15"}
+  [{:keys [pool] :as cfg} {:keys [profile-id id is-resolved share-id] :as params}]
+  (db/with-atomic [conn pool]
+    (let [thread (db/get-by-id conn :comment-thread id {:for-update true})]
+      (when-not thread
+        (ex/raise :type :not-found))
+
+      (files/check-comment-permissions! conn profile-id (:file-id thread) share-id)
+      (db/update! conn :comment-thread
+                  {:is-resolved is-resolved}
+                  {:id id})
+      nil)))
+
+
+;; --- Mutation: Add Comment
+
+(s/def ::add-comment ::cmd.comments/create-comment)
+
+(sv/defmethod ::add-comment
+  {::doc/added "1.0"
+   ::doc/deprecated "1.15"}
+  [{:keys [pool] :as cfg} params]
+  (db/with-atomic [conn pool]
+    (cmd.comments/create-comment conn params)))
+
+
+;; --- Mutation: Update Comment
+
+(s/def ::update-comment ::cmd.comments/update-comment)
+
+(sv/defmethod ::update-comment
+  {::doc/added "1.0"
+   ::doc/deprecated "1.15"}
+  [{:keys [pool] :as cfg} params]
+  (db/with-atomic [conn pool]
+    (cmd.comments/update-comment conn params)))
+
+
+;; --- Mutation: Delete Comment Thread
+
+(s/def ::delete-comment-thread ::cmd.comments/delete-comment-thread)
+
+(sv/defmethod ::delete-comment-thread
+  {::doc/added "1.0"
+   ::doc/deprecated "1.15"}
+  [{:keys [pool] :as cfg} {:keys [profile-id id] :as params}]
+  (db/with-atomic [conn pool]
+    (let [thread (db/get-by-id conn :comment-thread id {:for-update true})]
+      (when-not (= (:owner-id thread) profile-id)
+        (ex/raise :type :validation :code :not-allowed))
+      (db/delete! conn :comment-thread {:id id})
+      nil)))
+
+
+;; --- Mutation: Delete comment
+
+(s/def ::delete-comment ::cmd.comments/delete-comment)
+
+(sv/defmethod ::delete-comment
+  {::doc/added "1.0"
+   ::doc/deprecated "1.15"}
+  [{:keys [pool] :as cfg} {:keys [profile-id id] :as params}]
+  (db/with-atomic [conn pool]
+    (let [comment (db/get-by-id conn :comment id {:for-update true})]
+      (when-not (= (:owner-id comment) profile-id)
+        (ex/raise :type :validation :code :not-allowed))
+      (db/delete! conn :comment {:id id}))))
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Andrés Moya	8f4fcfe5eb	wip cleanup	2022-11-29 15:49:24 +01:00
Andrés Moya	7ba15b9a3a	wip estotienemejorpinta	2022-10-11 09:37:17 +02:00
Andrés Moya	1cba7346fd	wip tampocosirve	2022-10-11 09:37:17 +02:00
Andrés Moya	f1bee5edf5	Revert "wip roto 2" This reverts commit 1cb7391b35fefaa8898abb6dc482310291db3d68.	2022-10-11 09:37:17 +02:00
Andrés Moya	835ed342f8	wip roto 2	2022-10-11 09:37:17 +02:00
Andrés Moya	de4c7762ad	wip roto	2022-10-11 09:37:17 +02:00
Andrés Moya	3112d04a99	wip	2022-10-11 09:37:17 +02:00
Andrés Moya	3b26d05fed	🎉 Show transient changes in component copies	2022-10-11 09:37:17 +02:00
Andrés Moya	0e88398dc2	🎉 Show transient changes in component copies (old algorithm)	2022-10-11 09:37:17 +02:00
Andrés Moya	5d3eadc6db	🐛 Avoid loops in main instance sync	2022-10-11 09:37:15 +02:00