Walkthrough

This pull request introduces a comprehensive refactoring of Appwrite's authentication and authorization architecture, along with infrastructure and API endpoint updates. Key changes include: migration from Auth class constants to new global constants and User document-based methods; expansion of ADMIN authentication requirements across numerous API endpoints; introduction of multi-stage Docker builds with production/development targets; addition of new email template support with dark mode styling; database schema extensions (new user attributes, indexes, field sizes); framework configuration updates including new TanStack Start support; CSV export functionality; storage enhancements with image transformation flags; dependency updates to support new auth and email capabilities; and platform-aware resource injection replacing environment-based configuration. The changes affect API controllers, configuration files, Docker setup, database documents, email templates, and supporting utilities.

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~120+ minutes

Areas requiring extra attention:

• API Authentication Changes (app/controllers/api/*.php): Multiple endpoints across health, locale, storage, avatars, graphql, and messaging have expanded auth requirements (adding ADMIN); verify authorization logic is correctly applied and doesn't break existing integrations.
• User Document and Auth Migration (app/init/constants.php, app/controllers/shared/api.php, app/realtime.php): Pervasive replacement of Auth class methods with User-based equivalents (isPrivileged, isApp); verify all privilege/app checks are correctly migrated and authorization flow is preserved.
• Resource and Proof System (app/init/resources.php): Introduction of new Store, Token, Password, and Code proof abstractions alongside refactored user/session resource management; validate the token hashing, storage, and retrieval logic.
• Messaging Provider Nullable Parameters (app/controllers/api/messaging.php): Extensive wrapping of provider fields with Nullable validators and new Resend provider integration; requires careful validation of credential handling and enablement logic across multiple provider types.
• Database Schema Changes (app/config/collections/common.php): New user attributes (emailCanonical, emailIsFree, etc.), index additions, and field size changes; verify migrations and backward compatibility.
• Docker Multi-stage Build and CoreDNS Integration (Dockerfile, docker-compose.yml, .env): New production/development stage separation and DNS setup; ensure both paths build correctly and development environment functions as expected.
• VCS and Migrations Refactoring (app/controllers/api/vcs.php, app/controllers/api/migrations.php): Platform-aware context plumbing, CSV export endpoint additions, and device resource renaming; verify git workflow and migration logic remain intact.
• Dependency Updates (composer.json): Major version bumps (utopia-php/config 0.2→1.*, database 2→3); assess compatibility and any breaking changes from these libraries.

Possibly related PRs

• appwrite/appwrite#10778: Introduces similar large-scale wrapping of route parameter validators with Nullable to enable optional null values; closely related at the code-change level for parameter validation patterns.

Suggested reviewers

• abnegate

• 📝 Generate docstrings

• X
• Mastodon
• Reddit
• LinkedIn