merge main

apps/server/src/database/migrations/20260224T233803-page-permissions.ts

@@ -0,0 +1,90 @@
+import { Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .createTable('page_access')
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('page_id', 'uuid', (col) =>
+      col.notNull().unique().references('pages.id').onDelete('cascade'),
+    )
+    .addColumn('workspace_id', 'uuid', (col) =>
+      col.notNull().references('workspaces.id').onDelete('cascade'),
+    )
+    .addColumn('space_id', 'uuid', (col) =>
+      col.notNull().references('spaces.id').onDelete('cascade'),
+    )
+    .addColumn('access_level', 'varchar', (col) => col.notNull())
+    .addColumn('creator_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('set null'),
+    )
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addColumn('updated_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .execute();
+
+  await db.schema
+    .createTable('page_permissions')
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('page_access_id', 'uuid', (col) =>
+      col.notNull().references('page_access.id').onDelete('cascade'),
+    )
+    .addColumn('user_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('cascade'),
+    )
+    .addColumn('group_id', 'uuid', (col) =>
+      col.references('groups.id').onDelete('cascade'),
+    )
+    .addColumn('role', 'varchar', (col) => col.notNull())
+    .addColumn('added_by_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('set null'),
+    )
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addColumn('updated_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addUniqueConstraint('page_access_user_unique', [
+      'page_access_id',
+      'user_id',
+    ])
+    .addUniqueConstraint('page_access_group_unique', [
+      'page_access_id',
+      'group_id',
+    ])
+    .addCheckConstraint(
+      'allow_either_user_id_or_group_id_check',
+      sql`((user_id IS NOT NULL AND group_id IS NULL) OR (user_id IS NULL AND group_id IS NOT NULL))`,
+    )
+    .execute();
+
+  await db.schema
+    .createIndex('idx_page_access_space')
+    .on('page_access')
+    .column('space_id')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_page_permissions_user')
+    .on('page_permissions')
+    .column('user_id')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_page_permissions_group')
+    .on('page_permissions')
+    .column('group_id')
+    .execute();
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await db.schema.dropTable('page_permissions').ifExists().execute();
+  await db.schema.dropTable('page_access').ifExists().execute();
+}

apps/server/src/database/migrations/20260228T223532-audit.ts

@@ -0,0 +1,60 @@
+import { Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .createTable('audit')
+    .ifNotExists()
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('workspace_id', 'uuid', (col) =>
+      col.notNull().references('workspaces.id').onDelete('cascade'),
+    )
+    .addColumn('actor_id', 'uuid')
+    .addColumn('actor_type', 'varchar', (col) =>
+      col.notNull().defaultTo('user'),
+    )
+    .addColumn('event', 'varchar', (col) => col.notNull())
+    .addColumn('resource_type', 'varchar', (col) => col.notNull())
+    .addColumn('resource_id', 'uuid')
+    .addColumn('space_id', 'uuid')
+    .addColumn('changes', 'jsonb')
+    .addColumn('metadata', 'jsonb')
+    .addColumn('ip_address', sql`inet`)
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .execute();
+
+  await db.schema
+    .createIndex('idx_audit_workspace_id')
+    .ifNotExists()
+    .on('audit')
+    .columns(['workspace_id', 'id desc'])
+    .execute();
+
+  // add new workspace columns
+  await db.schema
+    .alterTable('workspaces')
+    .addColumn('audit_retention_days', 'int8', (col) => col)
+    .execute();
+
+  await db.schema
+    .alterTable('workspaces')
+    .addColumn('trash_retention_days', 'int8', (col) => col)
+    .execute();
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .alterTable('workspaces')
+    .dropColumn('audit_retention_days')
+    .execute();
+
+  await db.schema
+    .alterTable('workspaces')
+    .dropColumn('trash_retention_days')
+    .execute();
+
+  await db.schema.dropTable('audit').execute();
+}

apps/server/src/database/migrations/20260326T121350-user-sessions.ts

@@ -0,0 +1,45 @@
+import { Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .createTable('user_sessions')
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('user_id', 'uuid', (col) =>
+      col.notNull().references('users.id').onDelete('cascade'),
+    )
+    .addColumn('workspace_id', 'uuid', (col) =>
+      col.notNull().references('workspaces.id').onDelete('cascade'),
+    )
+    .addColumn('device_name', 'varchar')
+    .addColumn('user_agent', 'text')
+    .addColumn('ip_address', sql`inet`)
+    .addColumn('geo_location', 'varchar')
+    .addColumn('last_active_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addColumn('expires_at', 'timestamptz', (col) => col.notNull())
+    .addColumn('metadata', 'jsonb')
+    .addColumn('revoked_at', 'timestamptz')
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .execute();
+
+  await sql`
+    CREATE INDEX idx_user_sessions_active
+    ON user_sessions (user_id, workspace_id, last_active_at DESC)
+    WHERE revoked_at IS NULL
+  `.execute(db);
+
+  await sql`
+    CREATE INDEX idx_user_sessions_revoked
+    ON user_sessions (expires_at)
+    WHERE revoked_at IS NOT NULL
+  `.execute(db);
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await db.schema.dropTable('user_sessions').execute();
+}

apps/server/src/database/migrations/20260329T163516-add-new-indexes.ts

@@ -0,0 +1,333 @@
+import { type Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .createIndex('idx_group_users_user_id')
+    .ifNotExists()
+    .on('group_users')
+    .column('user_id')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_space_members_user_id')
+    .ifNotExists()
+    .on('space_members')
+    .column('user_id')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_space_members_group_id')
+    .ifNotExists()
+    .on('space_members')
+    .column('group_id')
+    .execute();
+
+  // Page tree
+  await sql`
+    CREATE INDEX IF NOT EXISTS idx_pages_space_parent_position
+    ON pages (space_id, parent_page_id, position COLLATE "C")
+    WHERE deleted_at IS NULL
+  `.execute(db);
+
+  await sql`
+    CREATE INDEX IF NOT EXISTS idx_pages_parent_page_id
+    ON pages (parent_page_id)
+    WHERE deleted_at IS NULL
+  `.execute(db);
+
+  // Recent pages query
+  await sql`
+    CREATE INDEX IF NOT EXISTS idx_pages_space_updated
+    ON pages (space_id, updated_at DESC)
+    WHERE deleted_at IS NULL
+  `.execute(db);
+
+  // Trash view
+  await sql`
+    CREATE INDEX IF NOT EXISTS idx_pages_space_deleted
+    ON pages (space_id, deleted_at DESC)
+    WHERE deleted_at IS NOT NULL
+  `.execute(db);
+
+  await sql`
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_workspaces_hostname_lower
+    ON workspaces (LOWER(hostname))
+  `.execute(db);
+
+  await db.schema
+    .createIndex('idx_workspaces_created_at')
+    .ifNotExists()
+    .on('workspaces')
+    .column('created_at')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_users_workspace_deleted')
+    .ifNotExists()
+    .on('users')
+    .columns(['workspace_id', 'deleted_at'])
+    .execute();
+
+  await sql`
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_spaces_slug_lower_workspace
+    ON spaces (LOWER(slug), workspace_id)
+  `.execute(db);
+
+  await db.schema
+    .createIndex('idx_spaces_workspace_id')
+    .ifNotExists()
+    .on('spaces')
+    .column('workspace_id')
+    .execute();
+
+  await sql`
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_groups_name_lower_workspace
+    ON groups (LOWER(name), workspace_id)
+  `.execute(db);
+
+  await db.schema
+    .createIndex('idx_groups_workspace_id')
+    .ifNotExists()
+    .on('groups')
+    .column('workspace_id')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_shares_page_id')
+    .ifNotExists()
+    .on('shares')
+    .column('page_id')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_attachments_page_id')
+    .ifNotExists()
+    .on('attachments')
+    .column('page_id')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_attachments_space_id')
+    .ifNotExists()
+    .on('attachments')
+    .column('space_id')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_comments_page_id')
+    .ifNotExists()
+    .on('comments')
+    .column('page_id')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_comments_parent_comment_id')
+    .ifNotExists()
+    .on('comments')
+    .column('parent_comment_id')
+    .execute();
+
+  await sql`
+    CREATE INDEX IF NOT EXISTS idx_page_history_page_created
+    ON page_history (page_id, created_at DESC)
+  `.execute(db);
+
+  await db.schema
+    .createIndex('idx_attachments_workspace_id')
+    .ifNotExists()
+    .on('attachments')
+    .column('workspace_id')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_backlinks_target_page_id')
+    .ifNotExists()
+    .on('backlinks')
+    .column('target_page_id')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_pages_workspace_id')
+    .ifNotExists()
+    .on('pages')
+    .column('workspace_id')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_pages_creator_id')
+    .ifNotExists()
+    .on('pages')
+    .column('creator_id')
+    .execute();
+
+  // Notifications: FK cascade from pages, spaces, comments
+  await db.schema
+    .createIndex('idx_notifications_page_id')
+    .ifNotExists()
+    .on('notifications')
+    .column('page_id')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_notifications_space_id')
+    .ifNotExists()
+    .on('notifications')
+    .column('space_id')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_notifications_comment_id')
+    .ifNotExists()
+    .on('notifications')
+    .column('comment_id')
+    .execute();
+
+  // Watchers: cleanup queries and FK cascade
+  await db.schema
+    .createIndex('idx_watchers_user_workspace')
+    .ifNotExists()
+    .on('watchers')
+    .columns(['user_id', 'workspace_id'])
+    .execute();
+
+  await db.schema
+    .createIndex('idx_watchers_space_id')
+    .ifNotExists()
+    .on('watchers')
+    .column('space_id')
+    .execute();
+
+  // Auth providers: all queries filter by workspaceId
+  await db.schema
+    .createIndex('idx_auth_providers_workspace_id')
+    .ifNotExists()
+    .on('auth_providers')
+    .column('workspace_id')
+    .execute();
+
+  // Auth accounts: SSO login lookup by provider user
+  await db.schema
+    .createIndex('idx_auth_accounts_provider_user_id')
+    .ifNotExists()
+    .on('auth_accounts')
+    .columns(['provider_user_id', 'auth_provider_id'])
+    .execute();
+
+  // Workspace invitations: listing and SSO lookup
+  await db.schema
+    .createIndex('idx_workspace_invitations_workspace_id')
+    .ifNotExists()
+    .on('workspace_invitations')
+    .column('workspace_id')
+    .execute();
+
+  // API keys: query and FK cascade
+  await db.schema
+    .createIndex('idx_api_keys_workspace_id')
+    .ifNotExists()
+    .on('api_keys')
+    .column('workspace_id')
+    .execute();
+
+  // User sessions: delete queries and FK cascade on all session states
+  await db.schema
+    .createIndex('idx_user_sessions_user_workspace')
+    .ifNotExists()
+    .on('user_sessions')
+    .columns(['user_id', 'workspace_id'])
+    .execute();
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await db.schema.dropIndex('idx_group_users_user_id').ifExists().execute();
+  await db.schema.dropIndex('idx_space_members_user_id').ifExists().execute();
+  await db.schema.dropIndex('idx_space_members_group_id').ifExists().execute();
+  await db.schema
+    .dropIndex('idx_pages_space_parent_position')
+    .ifExists()
+    .execute();
+  await db.schema.dropIndex('idx_pages_parent_page_id').ifExists().execute();
+  await db.schema.dropIndex('idx_pages_space_updated').ifExists().execute();
+  await db.schema.dropIndex('idx_pages_space_deleted').ifExists().execute();
+  await db.schema
+    .dropIndex('idx_workspaces_hostname_lower')
+    .ifExists()
+    .execute();
+  await db.schema.dropIndex('idx_workspaces_created_at').ifExists().execute();
+  await db.schema
+    .dropIndex('idx_users_workspace_deleted')
+    .ifExists()
+    .execute();
+  await db.schema
+    .dropIndex('idx_spaces_slug_lower_workspace')
+    .ifExists()
+    .execute();
+  await db.schema
+    .dropIndex('idx_spaces_workspace_id')
+    .ifExists()
+    .execute();
+  await db.schema
+    .dropIndex('idx_groups_name_lower_workspace')
+    .ifExists()
+    .execute();
+  await db.schema.dropIndex('idx_groups_workspace_id').ifExists().execute();
+  await db.schema.dropIndex('idx_shares_page_id').ifExists().execute();
+  await db.schema.dropIndex('idx_attachments_page_id').ifExists().execute();
+  await db.schema.dropIndex('idx_attachments_space_id').ifExists().execute();
+  await db.schema.dropIndex('idx_comments_page_id').ifExists().execute();
+  await db.schema
+    .dropIndex('idx_comments_parent_comment_id')
+    .ifExists()
+    .execute();
+  await db.schema
+    .dropIndex('idx_page_history_page_created')
+    .ifExists()
+    .execute();
+  await db.schema
+    .dropIndex('idx_attachments_workspace_id')
+    .ifExists()
+    .execute();
+  await db.schema
+    .dropIndex('idx_backlinks_target_page_id')
+    .ifExists()
+    .execute();
+  await db.schema.dropIndex('idx_pages_workspace_id').ifExists().execute();
+  await db.schema.dropIndex('idx_pages_creator_id').ifExists().execute();
+  await db.schema
+    .dropIndex('idx_notifications_page_id')
+    .ifExists()
+    .execute();
+  await db.schema
+    .dropIndex('idx_notifications_space_id')
+    .ifExists()
+    .execute();
+  await db.schema
+    .dropIndex('idx_notifications_comment_id')
+    .ifExists()
+    .execute();
+  await db.schema
+    .dropIndex('idx_watchers_user_workspace')
+    .ifExists()
+    .execute();
+  await db.schema.dropIndex('idx_watchers_space_id').ifExists().execute();
+  await db.schema
+    .dropIndex('idx_auth_providers_workspace_id')
+    .ifExists()
+    .execute();
+  await db.schema
+    .dropIndex('idx_auth_accounts_provider_user_id')
+    .ifExists()
+    .execute();
+  await db.schema
+    .dropIndex('idx_workspace_invitations_workspace_id')
+    .ifExists()
+    .execute();
+  await db.schema
+    .dropIndex('idx_api_keys_workspace_id')
+    .ifExists()
+    .execute();
+  await db.schema
+    .dropIndex('idx_user_sessions_user_workspace')
+    .ifExists()
+    .execute();
+}

apps/server/src/database/migrations/20260409T132415-ai-chat.ts

@@ -0,0 +1,118 @@
+import { type Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .createTable('ai_chats')
+    .ifNotExists()
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('workspace_id', 'uuid', (col) =>
+      col.references('workspaces.id').onDelete('cascade').notNull(),
+    )
+    .addColumn('creator_id', 'uuid', (col) =>
+      col.references('users.id').notNull(),
+    )
+    .addColumn('title', 'varchar', (col) => col)
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addColumn('updated_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addColumn('deleted_at', 'timestamptz', (col) => col)
+    .execute();
+
+  await db.schema
+    .createIndex('idx_ai_chats_workspace_creator')
+    .ifNotExists()
+    .on('ai_chats')
+    .columns(['workspace_id', 'creator_id', 'id'])
+    .execute();
+
+  await db.schema
+    .createTable('ai_chat_messages')
+    .ifNotExists()
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('chat_id', 'uuid', (col) =>
+      col.references('ai_chats.id').onDelete('cascade').notNull(),
+    )
+    .addColumn('workspace_id', 'uuid', (col) =>
+      col.references('workspaces.id').onDelete('cascade').notNull(),
+    )
+    .addColumn('user_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('set null'),
+    )
+    .addColumn('role', 'varchar', (col) => col.notNull())
+    .addColumn('content', 'text', (col) => col)
+    .addColumn('tool_calls', 'jsonb', (col) => col)
+    .addColumn('metadata', 'jsonb', (col) => col)
+    .addColumn('tsv', sql`tsvector`, (col) => col)
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addColumn('updated_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addColumn('deleted_at', 'timestamptz', (col) => col)
+    .execute();
+
+  await db.schema
+    .createIndex('idx_ai_chat_messages_chat_id')
+    .ifNotExists()
+    .on('ai_chat_messages')
+    .columns(['chat_id', 'id'])
+    .execute();
+
+  await db.schema
+    .createIndex('idx_ai_chat_messages_tsv')
+    .ifNotExists()
+    .on('ai_chat_messages')
+    .using('GIN')
+    .column('tsv')
+    .execute();
+
+  //ts-vector
+  await sql`
+    CREATE OR REPLACE FUNCTION ai_chat_messages_tsvector_trigger() RETURNS trigger AS $$
+    BEGIN
+      NEW.tsv := to_tsvector('english', f_unaccent(substring(coalesce(NEW.content, ''), 1, 100000)));
+      RETURN NEW;
+    END;
+    $$ LANGUAGE plpgsql;
+  `.execute(db);
+
+  await sql`
+    CREATE OR REPLACE TRIGGER ai_chat_messages_tsvector_update
+      BEFORE INSERT OR UPDATE ON ai_chat_messages
+      FOR EACH ROW EXECUTE FUNCTION ai_chat_messages_tsvector_trigger();
+  `.execute(db);
+
+  await db.schema
+    .alterTable('attachments')
+    .addColumn('ai_chat_id', 'uuid', (col) => col)
+    .execute();
+
+  await db.schema
+    .createIndex('idx_attachments_ai_chat_id')
+    .ifNotExists()
+    .on('attachments')
+    .column('ai_chat_id')
+    .execute();
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await db.schema.dropIndex('idx_attachments_ai_chat_id').execute();
+  await db.schema.alterTable('attachments').dropColumn('ai_chat_id').execute();
+
+  await sql`DROP TRIGGER IF EXISTS ai_chat_messages_tsvector_update ON ai_chat_messages`.execute(
+    db,
+  );
+  await sql`DROP FUNCTION IF EXISTS ai_chat_messages_tsvector_trigger`.execute(
+    db,
+  );
+  await db.schema.dropTable('ai_chat_messages').execute();
+  await db.schema.dropTable('ai_chats').execute();
+}

apps/server/src/database/migrations/20260412T135891-templates.ts

@@ -0,0 +1,76 @@
+import { Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .createTable('templates')
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('title', 'varchar')
+    .addColumn('description', 'text')
+    .addColumn('content', 'jsonb')
+    .addColumn('ydoc', 'bytea')
+    .addColumn('icon', 'varchar')
+    .addColumn('space_id', 'uuid', (col) =>
+      col.references('spaces.id').onDelete('cascade'),
+    )
+    .addColumn('workspace_id', 'uuid', (col) =>
+      col.notNull().references('workspaces.id').onDelete('cascade'),
+    )
+    .addColumn('creator_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('set null'),
+    )
+    .addColumn('last_updated_by_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('set null'),
+    )
+    .addColumn('collaborator_ids', sql`uuid[]`)
+    .addColumn('text_content', 'text', (col) => col)
+    .addColumn('tsv', sql`tsvector`, (col) => col)
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addColumn('updated_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addColumn('deleted_at', 'timestamptz')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_templates_workspace_id')
+    .on('templates')
+    .columns(['workspace_id'])
+    .execute();
+
+  await db.schema
+    .createIndex('idx_templates_space_id')
+    .on('templates')
+    .columns(['space_id'])
+    .execute();
+
+  await db.schema
+    .createIndex('templates_tsv_idx')
+    .on('templates')
+    .using('GIN')
+    .column('tsv')
+    .execute();
+
+  await sql`
+    CREATE OR REPLACE FUNCTION templates_tsvector_trigger() RETURNS trigger AS $$
+    begin
+        new.tsv :=
+                  setweight(to_tsvector('english', f_unaccent(coalesce(new.title, ''))), 'A') ||
+                  setweight(to_tsvector('english', f_unaccent(substring(coalesce(new.text_content, ''), 1, 1000000))), 'B');
+        return new;
+    end;
+    $$ LANGUAGE plpgsql;
+  `.execute(db);
+
+  await sql`CREATE OR REPLACE TRIGGER templates_tsvector_update BEFORE INSERT OR UPDATE
+                ON templates FOR EACH ROW EXECUTE FUNCTION templates_tsvector_trigger();`.execute(db);
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await sql`DROP TRIGGER IF EXISTS templates_tsvector_update ON templates`.execute(db);
+  await sql`DROP FUNCTION IF EXISTS templates_tsvector_trigger`.execute(db);
+  await db.schema.dropTable('templates').execute();
+}

apps/server/src/database/migrations/20260412T162318-favorites.ts

@@ -0,0 +1,63 @@
+import { type Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .createTable('favorites')
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('user_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('cascade').notNull(),
+    )
+    .addColumn('page_id', 'uuid', (col) =>
+      col.references('pages.id').onDelete('cascade'),
+    )
+    .addColumn('space_id', 'uuid', (col) =>
+      col.references('spaces.id').onDelete('cascade'),
+    )
+    .addColumn('template_id', 'uuid', (col) =>
+      col.references('templates.id').onDelete('cascade'),
+    )
+    .addColumn('type', 'varchar', (col) => col.notNull())
+    .addColumn('workspace_id', 'uuid', (col) =>
+      col.references('workspaces.id').onDelete('cascade').notNull(),
+    )
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.defaultTo(sql`now()`).notNull(),
+    )
+    .execute();
+
+  await db.schema
+    .createIndex('idx_favorites_user_page')
+    .on('favorites')
+    .columns(['user_id', 'page_id'])
+    .unique()
+    .where('page_id', 'is not', null)
+    .execute();
+
+  await db.schema
+    .createIndex('idx_favorites_user_space')
+    .on('favorites')
+    .columns(['user_id', 'space_id'])
+    .unique()
+    .where('space_id', 'is not', null)
+    .execute();
+
+  await db.schema
+    .createIndex('idx_favorites_user_template')
+    .on('favorites')
+    .columns(['user_id', 'template_id'])
+    .unique()
+    .where('template_id', 'is not', null)
+    .execute();
+
+  await db.schema
+    .createIndex('idx_favorites_user_workspace_type')
+    .on('favorites')
+    .columns(['user_id', 'workspace_id', 'type'])
+    .execute();
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await db.schema.dropTable('favorites').execute();
+}

apps/server/src/database/migrations/20260413T121647-page-verifications.ts

@@ -0,0 +1,117 @@
+import { Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .createTable('page_verifications')
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('page_id', 'uuid', (col) =>
+      col.notNull().unique().references('pages.id').onDelete('cascade'),
+    )
+    .addColumn('workspace_id', 'uuid', (col) =>
+      col.notNull().references('workspaces.id').onDelete('cascade'),
+    )
+    .addColumn('space_id', 'uuid', (col) =>
+      col.notNull().references('spaces.id').onDelete('cascade'),
+    )
+    .addColumn('type', 'varchar', (col) => col.notNull().defaultTo('expiring'))
+    .addColumn('status', 'varchar')
+    .addColumn('mode', 'varchar')
+    .addColumn('period_amount', 'integer')
+    .addColumn('period_unit', 'varchar')
+    .addColumn('verified_at', 'timestamptz')
+    .addColumn('verified_by_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('set null'),
+    )
+    .addColumn('expires_at', 'timestamptz')
+    .addColumn('requested_at', 'timestamptz')
+    .addColumn('requested_by_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('set null'),
+    )
+    .addColumn('rejected_at', 'timestamptz')
+    .addColumn('rejected_by_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('set null'),
+    )
+    .addColumn('rejection_comment', 'text')
+    .addColumn('data', 'jsonb')
+    .addColumn('creator_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('set null'),
+    )
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addColumn('updated_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .execute();
+
+  await db.schema
+    .createTable('page_verifiers')
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('page_verification_id', 'uuid', (col) =>
+      col.notNull().references('page_verifications.id').onDelete('cascade'),
+    )
+    .addColumn('user_id', 'uuid', (col) =>
+      col.notNull().references('users.id').onDelete('cascade'),
+    )
+    .addColumn('is_primary', 'boolean', (col) => col.notNull().defaultTo(false))
+    .addColumn('added_by_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('set null'),
+    )
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addUniqueConstraint('page_verifiers_verification_user_unique', [
+      'page_verification_id',
+      'user_id',
+    ])
+    .execute();
+
+  await db.schema
+    .createIndex('idx_page_verifications_expires_at')
+    .ifNotExists()
+    .on('page_verifications')
+    .column('expires_at')
+    .where('expires_at', 'is not', null)
+    .execute();
+
+  await db.schema
+    .createIndex('idx_page_verifications_workspace_id_id')
+    .ifNotExists()
+    .on('page_verifications')
+    .columns(['workspace_id', 'id desc'])
+    .execute();
+
+  await db.schema
+    .createIndex('idx_page_verifications_space_id')
+    .ifNotExists()
+    .on('page_verifications')
+    .column('space_id')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_page_verifiers_user_id')
+    .ifNotExists()
+    .on('page_verifiers')
+    .column('user_id')
+    .execute();
+
+  await db.schema
+    .alterTable('notifications')
+    .addColumn('page_verification_id', 'uuid', (col) =>
+      col.references('page_verifications.id').onDelete('cascade'),
+    )
+    .execute();
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .alterTable('notifications')
+    .dropColumn('page_verification_id')
+    .execute();
+  await db.schema.dropTable('page_verifiers').ifExists().execute();
+  await db.schema.dropTable('page_verifications').ifExists().execute();
+}

apps/server/src/database/migrations/20260414T124451-update-file_tasks.ts

@@ -0,0 +1,32 @@
+import { Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .alterTable('file_tasks')
+    .addColumn('page_id', 'uuid', (col) =>
+      col.references('pages.id').onDelete('set null').ifNotExists(),
+    )
+    .execute();
+
+  await db.schema
+    .alterTable('file_tasks')
+    .addColumn('metadata', 'jsonb', (col) => col.ifNotExists())
+    .execute();
+
+  await db.schema
+    .createIndex('idx_file_tasks_page_export')
+    .ifNotExists()
+    .on('file_tasks')
+    .columns(['page_id', 'workspace_id'])
+    .where(sql.ref('type'), '=', 'export')
+    .where(sql.ref('deleted_at'), 'is', null)
+    .execute();
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await db.schema.dropIndex('idx_file_tasks_page_export').execute();
+
+  await db.schema.alterTable('file_tasks').dropColumn('page_id').execute();
+
+  await db.schema.alterTable('file_tasks').dropColumn('metadata').execute();
+}

apps/server/src/database/migrations/20260501T092214-scim.ts

@@ -0,0 +1,110 @@
+import { Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .createTable('scim_tokens')
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('name', 'varchar', (col) => col.notNull())
+    .addColumn('token_hash', 'varchar', (col) => col.notNull())
+    .addColumn('token_last_four', 'varchar(4)', (col) => col.notNull())
+    .addColumn('last_used_at', 'timestamptz')
+    .addColumn('is_enabled', 'boolean', (col) => col.notNull().defaultTo(true))
+    .addColumn('creator_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('set null'),
+    )
+    .addColumn('workspace_id', 'uuid', (col) =>
+      col.references('workspaces.id').onDelete('cascade').notNull(),
+    )
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addColumn('updated_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addColumn('deleted_at', 'timestamptz')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_scim_tokens_token_hash')
+    .ifNotExists()
+    .on('scim_tokens')
+    .column('token_hash')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_scim_tokens_workspace_id')
+    .ifNotExists()
+    .on('scim_tokens')
+    .column('workspace_id')
+    .execute();
+
+  await db.schema
+    .alterTable('users')
+    .addColumn('scim_external_id', 'text')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_users_workspace_scim_external_id')
+    .ifNotExists()
+    .on('users')
+    .columns(['workspace_id', 'scim_external_id'])
+    .where('scim_external_id', 'is not', null)
+    .unique()
+    .execute();
+
+  await db.schema
+    .alterTable('groups')
+    .addColumn('scim_external_id', 'text')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_groups_workspace_scim_external_id')
+    .ifNotExists()
+    .on('groups')
+    .columns(['workspace_id', 'scim_external_id'])
+    .where('scim_external_id', 'is not', null)
+    .unique()
+    .execute();
+
+  await db.schema
+    .alterTable('groups')
+    .addColumn('is_external', 'boolean', (col) =>
+      col.notNull().defaultTo(false),
+    )
+    .execute();
+
+  // Backfill: mark all non-default groups as external in workspaces with SSO group sync enabled
+  await sql`
+    UPDATE groups SET is_external = true
+    WHERE is_default = false
+    AND workspace_id IN (
+      SELECT workspace_id FROM auth_providers WHERE group_sync = true
+    )
+  `.execute(db);
+
+  await db.schema
+    .alterTable('workspaces')
+    .addColumn('is_scim_enabled', 'boolean', (col) =>
+      col.notNull().defaultTo(false),
+    )
+    .execute();
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await db.schema.dropTable('scim_tokens').execute();
+
+  await db.schema.dropIndex('idx_users_workspace_scim_external_id').execute();
+  await db.schema.alterTable('users').dropColumn('scim_external_id').execute();
+
+  await db.schema.dropIndex('idx_groups_workspace_scim_external_id').execute();
+  await db.schema.alterTable('groups').dropColumn('scim_external_id').execute();
+
+  await db.schema.alterTable('groups').dropColumn('is_external').execute();
+
+  await db.schema
+    .alterTable('workspaces')
+    .dropColumn('is_scim_enabled')
+    .execute();
+}

apps/server/src/database/migrations/20260501T202258-page-transclusions.ts

@@ -0,0 +1,76 @@
+import { type Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .createTable('page_transclusions')
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('workspace_id', 'uuid', (col) =>
+      col.notNull().references('workspaces.id').onDelete('cascade'),
+    )
+    .addColumn('page_id', 'uuid', (col) =>
+      col.notNull().references('pages.id').onDelete('cascade'),
+    )
+    .addColumn('transclusion_id', 'varchar', (col) => col.notNull())
+    .addColumn('content', 'jsonb', (col) => col.notNull())
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addColumn('updated_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addUniqueConstraint('page_transclusions_page_transclusion_unique', [
+      'page_id',
+      'transclusion_id',
+    ])
+    .execute();
+
+  await db.schema
+    .createIndex('idx_page_transclusions_workspace')
+    .on('page_transclusions')
+    .column('workspace_id')
+    .execute();
+
+  await db.schema
+    .createTable('page_transclusion_references')
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('workspace_id', 'uuid', (col) =>
+      col.notNull().references('workspaces.id').onDelete('cascade'),
+    )
+    .addColumn('reference_page_id', 'uuid', (col) =>
+      col.notNull().references('pages.id').onDelete('cascade'),
+    )
+    .addColumn('source_page_id', 'uuid', (col) =>
+      col.notNull().references('pages.id').onDelete('cascade'),
+    )
+    .addColumn('transclusion_id', 'varchar', (col) => col.notNull())
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addUniqueConstraint('page_transclusion_references_unique', [
+      'reference_page_id',
+      'source_page_id',
+      'transclusion_id',
+    ])
+    .execute();
+
+  await db.schema
+    .createIndex('idx_page_transclusion_references_source')
+    .on('page_transclusion_references')
+    .columns(['source_page_id', 'transclusion_id'])
+    .execute();
+
+  await db.schema
+    .createIndex('idx_page_transclusion_references_workspace')
+    .on('page_transclusion_references')
+    .column('workspace_id')
+    .execute();
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await db.schema.dropTable('page_transclusion_references').execute();
+  await db.schema.dropTable('page_transclusions').execute();
+}

apps/server/src/database/migrations/20260509T121236-labels.ts

@@ -0,0 +1,59 @@
+import { type Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .createTable('labels')
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('name', 'varchar', (col) => col.notNull())
+    .addColumn('type', 'varchar', (col) => col.notNull().defaultTo('page'))
+    .addColumn('workspace_id', 'uuid', (col) =>
+      col.references('workspaces.id').onDelete('cascade').notNull(),
+    )
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addColumn('updated_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .execute();
+
+  await db.schema
+    .createIndex('labels_workspace_id_type_name_unique')
+    .on('labels')
+    .columns(['workspace_id', 'type', 'name'])
+    .unique()
+    .execute();
+
+  await db.schema
+    .createTable('page_labels')
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('page_id', 'uuid', (col) =>
+      col.references('pages.id').onDelete('cascade').notNull(),
+    )
+    .addColumn('label_id', 'uuid', (col) =>
+      col.references('labels.id').onDelete('cascade').notNull(),
+    )
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addUniqueConstraint('page_labels_page_id_label_id_unique', [
+      'page_id',
+      'label_id',
+    ])
+    .execute();
+
+  await db.schema
+    .createIndex('page_labels_label_id_idx')
+    .on('page_labels')
+    .column('label_id')
+    .execute();
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await db.schema.dropTable('page_labels').execute();
+  await db.schema.dropTable('labels').execute();
+}