Merge branch 'main' into fix/conf-anchor

apps/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "server",
-  "version": "0.24.1",
+  "version": "0.70.1",
   "description": "",
   "author": "",
   "private": true,
@@ -30,43 +30,47 @@
     "test:e2e": "jest --config test/jest-e2e.json"
   },
   "dependencies": {
-    "@ai-sdk/google": "^3.0.9",
-    "@ai-sdk/openai": "^3.0.11",
-    "@ai-sdk/openai-compatible": "^2.0.12",
-    "@aws-sdk/client-s3": "3.701.0",
-    "@aws-sdk/lib-storage": "3.701.0",
-    "@aws-sdk/s3-request-presigner": "3.701.0",
+    "@ai-sdk/google": "^3.0.29",
+    "@ai-sdk/openai": "^3.0.29",
+    "@ai-sdk/openai-compatible": "^2.0.30",
+    "@aws-sdk/client-s3": "3.1000.0",
+    "@aws-sdk/lib-storage": "3.1000.0",
+    "@aws-sdk/s3-request-presigner": "3.1000.0",
+    "@clickhouse/client": "^1.17.0",
     "@fastify/cookie": "^11.0.2",
-    "@fastify/multipart": "^9.3.0",
-    "@fastify/static": "^8.3.0",
-    "@langchain/core": "1.1.13",
+    "@fastify/multipart": "^9.4.0",
+    "@fastify/static": "^9.0.0",
+    "@keyv/redis": "^5.1.6",
+    "@langchain/core": "1.1.29",
     "@langchain/textsplitters": "1.0.1",
+    "@modelcontextprotocol/sdk": "^1.27.1",
     "@nestjs-labs/nestjs-ioredis": "^11.0.4",
     "@nestjs/bullmq": "^11.0.4",
-    "@nestjs/common": "^11.1.11",
-    "@nestjs/config": "^4.0.2",
-    "@nestjs/core": "^11.1.11",
+    "@nestjs/cache-manager": "^3.1.0",
+    "@nestjs/common": "^11.1.14",
+    "@nestjs/config": "^4.0.3",
+    "@nestjs/core": "^11.1.14",
     "@nestjs/event-emitter": "^3.0.1",
     "@nestjs/jwt": "11.0.0",
     "@nestjs/mapped-types": "^2.1.0",
     "@nestjs/passport": "^11.0.5",
-    "@nestjs/platform-fastify": "^11.1.11",
-    "@nestjs/platform-socket.io": "^11.1.11",
-    "@nestjs/schedule": "^6.1.0",
-    "@nestjs/terminus": "^11.0.0",
-    "@nestjs/websockets": "^11.1.11",
+    "@nestjs/platform-fastify": "^11.1.14",
+    "@nestjs/platform-socket.io": "^11.1.14",
+    "@nestjs/schedule": "^6.1.1",
+    "@nestjs/terminus": "^11.1.1",
+    "@nestjs/websockets": "^11.1.14",
     "@node-saml/passport-saml": "^5.1.0",
-    "@react-email/components": "0.0.28",
-    "@react-email/render": "1.0.2",
+    "@react-email/components": "1.0.7",
+    "@react-email/render": "2.0.4",
     "@socket.io/redis-adapter": "^8.3.0",
-    "ai": "^6.0.37",
-    "ai-sdk-ollama": "^3.1.1",
+    "ai": "^6.0.86",
+    "ai-sdk-ollama": "^3.7.0",
     "bcrypt": "^6.0.0",
-    "bullmq": "^5.65.0",
-    "cache-manager": "^6.4.3",
-    "cheerio": "^1.1.2",
+    "bullmq": "^5.70.1",
+    "cache-manager": "^7.2.8",
+    "cheerio": "^1.2.0",
     "class-transformer": "^0.5.1",
-    "class-validator": "^0.14.3",
+    "class-validator": "^0.15.1",
     "cookie": "^1.1.1",
     "fs-extra": "^11.3.3",
     "happy-dom": "20.1.0",
@@ -81,6 +85,7 @@
     "mime-types": "^2.1.35",
     "msgpackr": "^1.11.8",
     "nanoid": "3.3.11",
+    "nestjs-cls": "^6.2.0",
     "nestjs-kysely": "^1.2.0",
     "nestjs-pino": "^4.5.0",
     "nodemailer": "^7.0.12",
@@ -92,51 +97,51 @@
     "pdfjs-dist": "^5.4.394",
     "pg-tsquery": "^8.4.2",
     "pgvector": "^0.2.1",
-    "postgres": "^3.4.8",
     "pino-http": "^11.0.0",
     "pino-pretty": "^13.1.3",
+    "postgres": "^3.4.8",
     "postmark": "^4.0.5",
     "react": "^18.3.1",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.2",
     "sanitize-filename-ts": "1.0.2",
-    "sharp": "0.34.3",
     "socket.io": "^4.8.3",
     "stripe": "^17.5.0",
     "tmp-promise": "^3.0.3",
     "tseep": "^1.3.1",
     "typesense": "^2.1.0",
     "ws": "^8.19.0",
-    "yauzl": "^3.2.0"
+    "yauzl": "^3.2.0",
+    "zod": "^4.3.6"
   },
   "devDependencies": {
     "@eslint/js": "^9.20.0",
-    "@nestjs/cli": "^11.0.4",
+    "@nestjs/cli": "^11.0.16",
     "@nestjs/schematics": "^11.0.1",
     "@nestjs/testing": "^11.0.10",
     "@types/bcrypt": "^5.0.2",
     "@types/debounce": "^1.2.4",
     "@types/fs-extra": "^11.0.4",
-    "@types/jest": "^29.5.14",
+    "@types/jest": "^30.0.0",
     "@types/mime-types": "^2.1.4",
     "@types/node": "^22.13.4",
     "@types/nodemailer": "^6.4.17",
     "@types/passport-google-oauth20": "^2.0.16",
     "@types/passport-jwt": "^4.0.1",
-    "@types/supertest": "^6.0.2",
-    "@types/ws": "^8.5.14",
+    "@types/supertest": "^6.0.3",
+    "@types/ws": "^8.18.1",
     "@types/yauzl": "^2.10.3",
-    "eslint": "^9.20.1",
+    "eslint": "^9.39.2",
     "eslint-config-prettier": "^10.0.1",
     "globals": "^15.15.0",
-    "jest": "^29.7.0",
-    "kysely-codegen": "^0.19.0",
+    "jest": "^30.2.0",
+    "kysely-codegen": "^0.20.0",
     "prettier": "^3.5.1",
-    "react-email": "3.0.2",
+    "react-email": "5.2.8",
     "source-map-support": "^0.5.21",
-    "supertest": "^7.0.0",
-    "ts-jest": "^29.2.5",
-    "ts-loader": "^9.5.2",
+    "supertest": "^7.2.2",
+    "ts-jest": "^29.4.6",
+    "ts-loader": "^9.5.4",
     "ts-node": "^10.9.2",
     "tsconfig-paths": "^4.2.0",
     "typescript": "^5.7.3",
@@ -157,6 +162,11 @@
       "**/*.(t|j)s"
     ],
     "coverageDirectory": "../coverage",
-    "testEnvironment": "node"
+    "testEnvironment": "node",
+    "moduleNameMapper": {
+      "^@docmost/db/(.*)$": "<rootDir>/database/$1",
+      "^@docmost/transactional/(.*)$": "<rootDir>/integrations/transactional/$1",
+      "^@docmost/ee/(.*)$": "<rootDir>/ee/$1"
+    }
   }
 }

apps/server/src/app.module.ts

@@ -1,6 +1,9 @@
 import { Module } from '@nestjs/common';
+import { APP_INTERCEPTOR } from '@nestjs/core';
 import { AppController } from './app.controller';
 import { AppService } from './app.service';
+import { EnvironmentService } from './integrations/environment/environment.service';
+import { AuditActorInterceptor } from './common/interceptors/audit-actor.interceptor';
 import { CoreModule } from './core/core.module';
 import { EnvironmentModule } from './integrations/environment/environment.module';
 import { CollaborationModule } from './collaboration/collaboration.module';
@@ -18,7 +21,10 @@ import { SecurityModule } from './integrations/security/security.module';
 import { TelemetryModule } from './integrations/telemetry/telemetry.module';
 import { RedisModule } from '@nestjs-labs/nestjs-ioredis';
 import { RedisConfigService } from './integrations/redis/redis-config.service';
+import { CacheModule } from '@nestjs/cache-manager';
+import KeyvRedis from '@keyv/redis';
 import { LoggerModule } from './common/logger/logger.module';
+import { ClsModule } from 'nestjs-cls';
 
 const enterpriseModules = [];
 try {
@@ -36,6 +42,10 @@ try {
 
 @Module({
   imports: [
+    ClsModule.forRoot({
+      global: true,
+      middleware: { mount: true },
+    }),
     LoggerModule,
     CoreModule,
     DatabaseModule,
@@ -43,6 +53,18 @@ try {
     RedisModule.forRootAsync({
       useClass: RedisConfigService,
     }),
+    CacheModule.registerAsync({
+      isGlobal: true,
+      useFactory: async (environmentService: EnvironmentService) => {
+        const redisUrl = environmentService.getRedisUrl();
+
+        return {
+          ttl: 5 * 1000,
+          stores: [new KeyvRedis(redisUrl)],
+        };
+      },
+      inject: [EnvironmentService],
+    }),
     CollaborationModule,
     WsModule,
     QueueModule,
@@ -62,6 +84,12 @@ try {
     ...enterpriseModules,
   ],
   controllers: [AppController],
-  providers: [AppService],
+  providers: [
+    AppService,
+    {
+      provide: APP_INTERCEPTOR,
+      useClass: AuditActorInterceptor,
+    },
+  ],
 })
 export class AppModule {}

apps/server/src/collaboration/collaboration.handler.ts

@@ -1,5 +1,12 @@
 import { Injectable, Logger } from '@nestjs/common';
 import { Hocuspocus, Document } from '@hocuspocus/server';
+import { TiptapTransformer } from '@hocuspocus/transformer';
+import {
+  prosemirrorNodeToYElement,
+  tiptapExtensions,
+} from './collaboration.util';
+import * as Y from 'yjs';
+import { User } from '@docmost/db/types/entity.types';
 
 export type CollabEventHandlers = ReturnType<
   CollaborationHandler['getHandlers']
@@ -20,6 +27,44 @@ export class CollaborationHandler {
         //   const fragment = doc.getXmlFragment('default');
         //});
       },
+      updatePageContent: async (
+        documentName: string,
+        payload: {
+          prosemirrorJson: any;
+          operation: string;
+          user: User;
+        },
+      ) => {
+        const { prosemirrorJson, operation, user } = payload;
+        this.logger.debug('Updating page content via yjs', documentName);
+        await this.withYdocConnection(
+          hocuspocus,
+          documentName,
+          { user },
+          (doc) => {
+            const fragment = doc.getXmlFragment('default');
+
+            if (operation === 'replace') {
+              if (fragment.length > 0) {
+                fragment.delete(0, fragment.length);
+              }
+
+              const newDoc = TiptapTransformer.toYdoc(
+                prosemirrorJson,
+                'default',
+                tiptapExtensions,
+              );
+              Y.applyUpdate(doc, Y.encodeStateAsUpdate(newDoc));
+            } else {
+              const newContent = prosemirrorJson.content || [];
+              const yElements = newContent.map(prosemirrorNodeToYElement);
+              const position =
+                operation === 'prepend' ? 0 : fragment.length;
+              fragment.insert(position, yElements);
+            }
+          },
+        );
+      },
     };
   }
 

apps/server/src/collaboration/collaboration.module.ts

@@ -1,4 +1,10 @@
-import { Logger, Module, OnModuleDestroy, OnModuleInit } from '@nestjs/common';
+import {
+  Global,
+  Logger,
+  Module,
+  OnModuleDestroy,
+  OnModuleInit,
+} from '@nestjs/common';
 import { AuthenticationExtension } from './extensions/authentication.extension';
 import { PersistenceExtension } from './extensions/persistence.extension';
 import { CollaborationGateway } from './collaboration.gateway';
@@ -7,9 +13,11 @@ import { CollabWsAdapter } from './adapter/collab-ws.adapter';
 import { IncomingMessage } from 'http';
 import { WebSocket } from 'ws';
 import { TokenModule } from '../core/auth/token.module';
-import { HistoryListener } from './listeners/history.listener';
+import { HistoryProcessor } from './processors/history.processor';
 import { LoggerExtension } from './extensions/logger.extension';
 import { CollaborationHandler } from './collaboration.handler';
+import { CollabHistoryService } from './services/collab-history.service';
+import { WatcherModule } from '../core/watcher/watcher.module';
 
 @Module({
   providers: [
@@ -17,11 +25,12 @@ import { CollaborationHandler } from './collaboration.handler';
     AuthenticationExtension,
     PersistenceExtension,
     LoggerExtension,
-    HistoryListener,
+    HistoryProcessor,
+    CollabHistoryService,
     CollaborationHandler,
   ],
   exports: [CollaborationGateway],
-  imports: [TokenModule],
+  imports: [TokenModule, WatcherModule],
 })
 export class CollaborationModule implements OnModuleInit, OnModuleDestroy {
   private readonly logger = new Logger(CollaborationModule.name);

apps/server/src/collaboration/collaboration.util.ts

@@ -33,7 +33,11 @@ import {
   Subpages,
   Highlight,
   UniqueID,
+  Columns,
+  Column,
+  Status,
   addUniqueIdsToDoc,
+  htmlToMarkdown,
 } from '@docmost/editor-ext';
 import { generateText, getSchema, JSONContent } from '@tiptap/core';
 import { generateHTML, generateJSON } from '../common/helpers/prosemirror/html';
@@ -42,6 +46,7 @@ import { generateHTML, generateJSON } from '../common/helpers/prosemirror/html';
 // see:https://github.com/ueberdosis/tiptap/issues/4089
 //import { generateJSON } from '@tiptap/html';
 import { Node, Schema } from '@tiptap/pm/model';
+import * as Y from 'yjs';
 import { Logger } from '@nestjs/common';
 
 export const tiptapExtensions = [
@@ -89,6 +94,9 @@ export const tiptapExtensions = [
   Embed,
   Mention,
   Subpages,
+  Columns,
+  Column,
+  Status,
 ] as any;
 
 export function jsonToHtml(tiptapJson: any) {
@@ -161,3 +169,37 @@ function stripUnknownNodes(
 
   return json;
 }
+
+export function prosemirrorNodeToYElement(node: any): Y.XmlElement | Y.XmlText {
+  if (node.type === 'text') {
+    const ytext = new Y.XmlText();
+    ytext.insert(0, node.text || '');
+    if (node.marks?.length > 0) {
+      const attrs: Record<string, any> = {};
+      for (const mark of node.marks) {
+        attrs[mark.type] = mark.attrs || true;
+      }
+      ytext.format(0, node.text?.length || 0, attrs);
+    }
+    return ytext;
+  }
+
+  const element = new Y.XmlElement(node.type);
+  if (node.attrs) {
+    for (const [key, value] of Object.entries(node.attrs)) {
+      if (value !== null && value !== undefined) {
+        element.setAttribute(key, value as any);
+      }
+    }
+  }
+  if (node.content?.length > 0) {
+    const children = node.content.map(prosemirrorNodeToYElement);
+    element.insert(0, children);
+  }
+  return element;
+}
+
+export function jsonToMarkdown(tiptapJson: any): string {
+  const html = jsonToHtml(tiptapJson);
+  return htmlToMarkdown(html);
+}

apps/server/src/collaboration/constants.ts

@@ -0,0 +1,3 @@
+export const HISTORY_INTERVAL = 5 * 60 * 1000;
+export const HISTORY_FAST_INTERVAL = 60 * 1000;
+export const HISTORY_FAST_THRESHOLD = 5 * 60 * 1000;

apps/server/src/collaboration/extensions/authentication.extension.ts

@@ -9,8 +9,10 @@ import { TokenService } from '../../core/auth/services/token.service';
 import { UserRepo } from '@docmost/db/repos/user/user.repo';
 import { PageRepo } from '@docmost/db/repos/page/page.repo';
 import { SpaceMemberRepo } from '@docmost/db/repos/space/space-member.repo';
+import { PagePermissionRepo } from '@docmost/db/repos/page/page-permission.repo';
 import { findHighestUserSpaceRole } from '@docmost/db/repos/space/utils';
 import { SpaceRole } from '../../common/helpers/types/permission';
+import { isUserDisabled } from '../../common/helpers';
 import { getPageId } from '../collaboration.util';
 import { JwtCollabPayload, JwtType } from '../../core/auth/dto/jwt-payload';
 
@@ -23,6 +25,7 @@ export class AuthenticationExtension implements Extension {
     private userRepo: UserRepo,
     private pageRepo: PageRepo,
     private readonly spaceMemberRepo: SpaceMemberRepo,
+    private readonly pagePermissionRepo: PagePermissionRepo,
   ) {}
 
   async onAuthenticate(data: onAuthenticatePayload) {
@@ -46,13 +49,13 @@ export class AuthenticationExtension implements Extension {
       throw new UnauthorizedException();
     }
 
-    if (user.deactivatedAt || user.deletedAt) {
+    if (isUserDisabled(user)) {
       throw new UnauthorizedException();
     }
 
     const page = await this.pageRepo.findById(pageId);
     if (!page) {
-      this.logger.warn(`Page not found: ${pageId}`);
+      this.logger.debug(`Page not found: ${pageId}`);
       throw new NotFoundException('Page not found');
     }
 
@@ -68,9 +71,34 @@ export class AuthenticationExtension implements Extension {
       throw new UnauthorizedException();
     }
 
-    if (userSpaceRole === SpaceRole.READER) {
+    // Check page-level permissions
+    const { hasAnyRestriction, canAccess, canEdit } =
+      await this.pagePermissionRepo.canUserEditPage(user.id, page.id);
+
+    if (hasAnyRestriction) {
+      if (!canAccess) {
+        this.logger.warn(
+          `User ${user.id} denied page-level access to page: ${pageId}`,
+        );
+        throw new UnauthorizedException();
+      }
+
+      if (!canEdit) {
+        data.connectionConfig.readOnly = true;
+        this.logger.debug(
+          `User ${user.id} granted readonly access to restricted page: ${pageId}`,
+        );
+      }
+    } else {
+      // No restrictions - use space-level permissions
+      if (userSpaceRole === SpaceRole.READER) {
+        data.connectionConfig.readOnly = true;
+        this.logger.debug(`User granted readonly access to page: ${pageId}`);
+      }
+    }
+
+    if (page.deletedAt) {
       data.connectionConfig.readOnly = true;
-      this.logger.debug(`User granted readonly access to page: ${pageId}`);
     }
 
     this.logger.debug(`Authenticated user ${user.id} on page ${pageId}`);

apps/server/src/collaboration/extensions/persistence.extension.ts

@@ -13,17 +13,27 @@ import { PageRepo } from '@docmost/db/repos/page/page.repo';
 import { InjectKysely } from 'nestjs-kysely';
 import { KyselyDB } from '@docmost/db/types/kysely.types';
 import { executeTx } from '@docmost/db/utils';
-import { EventEmitter2 } from '@nestjs/event-emitter';
 import { InjectQueue } from '@nestjs/bullmq';
 import { QueueJob, QueueName } from '../../integrations/queue/constants';
 import { Queue } from 'bullmq';
 import {
   extractMentions,
   extractPageMentions,
+  extractUserMentions,
 } from '../../common/helpers/prosemirror/utils';
 import { isDeepStrictEqual } from 'node:util';
-import { IPageBacklinkJob } from '../../integrations/queue/constants/queue.interface';
+import {
+  IPageBacklinkJob,
+  IPageHistoryJob,
+  IPageMentionNotificationJob,
+} from '../../integrations/queue/constants/queue.interface';
 import { Page } from '@docmost/db/types/entity.types';
+import { CollabHistoryService } from '../services/collab-history.service';
+import {
+  HISTORY_FAST_INTERVAL,
+  HISTORY_FAST_THRESHOLD,
+  HISTORY_INTERVAL,
+} from '../constants';
 
 @Injectable()
 export class PersistenceExtension implements Extension {
@@ -33,9 +43,11 @@ export class PersistenceExtension implements Extension {
   constructor(
     private readonly pageRepo: PageRepo,
     @InjectKysely() private readonly db: KyselyDB,
-    private eventEmitter: EventEmitter2,
     @InjectQueue(QueueName.GENERAL_QUEUE) private generalQueue: Queue,
     @InjectQueue(QueueName.AI_QUEUE) private aiQueue: Queue,
+    @InjectQueue(QueueName.HISTORY_QUEUE) private historyQueue: Queue,
+    @InjectQueue(QueueName.NOTIFICATION_QUEUE) private notificationQueue: Queue,
+    private readonly collabHistory: CollabHistoryService,
   ) {}
 
   async onLoadDocument(data: onLoadDocumentPayload) {
@@ -101,6 +113,7 @@ export class PersistenceExtension implements Extension {
     }
 
     let page: Page = null;
+    const editingUserIds = this.consumeContributors(documentName);
 
     try {
       await executeTx(this.db, async (trx) => {
@@ -123,13 +136,9 @@ export class PersistenceExtension implements Extension {
         let contributorIds = undefined;
         try {
           const existingContributors = page.contributorIds || [];
-          const contributorSet = this.contributors.get(documentName);
-          contributorSet.add(page.creatorId);
-          const newContributors = [...contributorSet];
           contributorIds = Array.from(
-            new Set([...existingContributors, ...newContributors]),
+            new Set([...existingContributors, ...editingUserIds, page.creatorId]),
           );
-          this.contributors.delete(documentName);
         } catch (err) {
           //this.logger.debug('Contributors error:' + err?.['message']);
         }
@@ -153,13 +162,7 @@ export class PersistenceExtension implements Extension {
     }
 
     if (page) {
-      this.eventEmitter.emit('collab.page.updated', {
-        page: {
-          ...page,
-          content: tiptapJson,
-          lastUpdatedById: context.user.id,
-        },
-      });
+      await this.collabHistory.addContributors(pageId, editingUserIds);
 
       const mentions = extractMentions(tiptapJson);
       const pageMentions = extractPageMentions(mentions);
@@ -170,16 +173,37 @@ export class PersistenceExtension implements Extension {
         mentions: pageMentions,
       } as IPageBacklinkJob);
 
+      const userMentions = extractUserMentions(mentions);
+      const oldMentions = page.content ? extractMentions(page.content) : [];
+      const oldMentionedUserIds = extractUserMentions(oldMentions).map((m) => m.entityId);
+
+      if (userMentions.length > 0) {
+        await this.notificationQueue.add(QueueJob.PAGE_MENTION_NOTIFICATION, {
+          userMentions: userMentions.map((m) => ({
+            userId: m.entityId,
+            mentionId: m.id,
+            creatorId: m.creatorId,
+          })),
+          oldMentionedUserIds,
+          pageId,
+          spaceId: page.spaceId,
+          workspaceId: page.workspaceId,
+        } as IPageMentionNotificationJob);
+      }
+
       await this.aiQueue.add(QueueJob.PAGE_CONTENT_UPDATED, {
         pageIds: [pageId],
         workspaceId: page.workspaceId,
       });
+
+      await this.enqueuePageHistory(page);
     }
   }
 
   async onChange(data: onChangePayload) {
     const documentName = data.documentName;
-    const userId = data.context?.user.id;
+    const userId = data.context?.user?.id;
+
     if (!userId) return;
 
     if (!this.contributors.has(documentName)) {
@@ -193,4 +217,26 @@ export class PersistenceExtension implements Extension {
     const documentName = data.documentName;
     this.contributors.delete(documentName);
   }
+
+  private consumeContributors(documentName: string): string[] {
+    const contributorSet = this.contributors.get(documentName);
+    if (!contributorSet) return [];
+    const userIds = [...contributorSet];
+    this.contributors.delete(documentName);
+    return userIds;
+  }
+
+  private async enqueuePageHistory(page: Page): Promise<void> {
+    const pageAge = Date.now() - new Date(page.createdAt).getTime();
+    const delay =
+      pageAge < HISTORY_FAST_THRESHOLD
+        ? HISTORY_FAST_INTERVAL
+        : HISTORY_INTERVAL;
+
+    await this.historyQueue.add(
+      QueueJob.PAGE_HISTORY,
+      { pageId: page.id } as IPageHistoryJob,
+      { jobId: page.id, delay },
+    );
+  }
 }

apps/server/src/collaboration/extensions/redis-sync/redis-sync.extension.ts

@@ -79,6 +79,8 @@ export class RedisSyncExtension<TCE extends CustomEvents> implements Extension {
     this.customEvents = (customEvents as any) ?? ({} as any as CustomEvents);
     this.sub.subscribe(this.msgChannel, `${this.msgChannel}:${this.serverId}`);
     this.sub.on('messageBuffer', this.handleRedisMessage);
+    this.pub.on('error', () => {});
+    this.sub.on('error', () => {});
   }
   private getKey(documentName: string) {
     return `${this.lockPrefix}:${documentName}`;

apps/server/src/collaboration/listeners/history.listener.ts

@@ -1,44 +0,0 @@
-import { Injectable, Logger } from '@nestjs/common';
-import { OnEvent } from '@nestjs/event-emitter';
-import { PageHistoryRepo } from '@docmost/db/repos/page/page-history.repo';
-import { Page } from '@docmost/db/types/entity.types';
-import { isDeepStrictEqual } from 'node:util';
-
-export class UpdatedPageEvent {
-  page: Page;
-}
-
-@Injectable()
-export class HistoryListener {
-  private readonly logger = new Logger(HistoryListener.name);
-
-  constructor(private readonly pageHistoryRepo: PageHistoryRepo) {}
-
-  @OnEvent('collab.page.updated')
-  async handleCreatePageHistory(event: UpdatedPageEvent) {
-    const { page } = event;
-
-    const pageCreationTime = new Date(page.createdAt).getTime();
-    const currentTime = Date.now();
-    const FIVE_MINUTES = 5 * 60 * 1000;
-
-    if (currentTime - pageCreationTime < FIVE_MINUTES) {
-      return;
-    }
-
-    const lastHistory = await this.pageHistoryRepo.findPageLastHistory(page.id);
-
-    if (
-      !lastHistory ||
-      (!isDeepStrictEqual(lastHistory.content, page.content) &&
-        currentTime - new Date(lastHistory.createdAt).getTime() >= FIVE_MINUTES)
-    ) {
-      try {
-        await this.pageHistoryRepo.saveHistory(page);
-        this.logger.debug(`New history created for: ${page.id}`);
-      } catch (err) {
-        this.logger.error(`Failed to create history for page: ${page.id}`, err);
-      }
-    }
-  }
-}

apps/server/src/collaboration/processors/history.processor.ts

@@ -0,0 +1,93 @@
+import { Logger, OnModuleDestroy } from '@nestjs/common';
+import { OnWorkerEvent, Processor, WorkerHost } from '@nestjs/bullmq';
+import { Job } from 'bullmq';
+import { QueueJob, QueueName } from '../../integrations/queue/constants';
+import { IPageHistoryJob } from '../../integrations/queue/constants/queue.interface';
+import { PageHistoryRepo } from '@docmost/db/repos/page/page-history.repo';
+import { PageRepo } from '@docmost/db/repos/page/page.repo';
+import { isDeepStrictEqual } from 'node:util';
+import { CollabHistoryService } from '../services/collab-history.service';
+import { WatcherService } from '../../core/watcher/watcher.service';
+
+@Processor(QueueName.HISTORY_QUEUE)
+export class HistoryProcessor extends WorkerHost implements OnModuleDestroy {
+  private readonly logger = new Logger(HistoryProcessor.name);
+
+  constructor(
+    private readonly pageHistoryRepo: PageHistoryRepo,
+    private readonly pageRepo: PageRepo,
+    private readonly collabHistory: CollabHistoryService,
+    private readonly watcherService: WatcherService,
+  ) {
+    super();
+  }
+
+  async process(job: Job<IPageHistoryJob, void>): Promise<void> {
+    if (job.name !== QueueJob.PAGE_HISTORY) return;
+
+    try {
+      const { pageId } = job.data;
+
+      const page = await this.pageRepo.findById(pageId, {
+        includeContent: true,
+      });
+
+      if (!page) {
+        this.logger.warn(`Page ${pageId} not found, skipping history`);
+        await this.collabHistory.clearContributors(pageId);
+        return;
+      }
+
+      const lastHistory = await this.pageHistoryRepo.findPageLastHistory(
+        pageId,
+        { includeContent: true },
+      );
+
+      if (
+        !lastHistory ||
+        !isDeepStrictEqual(lastHistory.content, page.content)
+      ) {
+        const contributorIds =
+          await this.collabHistory.popContributors(pageId);
+
+        try {
+          await this.watcherService.addPageWatchers(
+            contributorIds,
+            pageId,
+            page.spaceId,
+            page.workspaceId,
+          );
+
+          await this.pageHistoryRepo.saveHistory(page, { contributorIds });
+          this.logger.debug(`History created for page: ${pageId}`);
+        } catch (err) {
+          await this.collabHistory.addContributors(
+            pageId,
+            contributorIds,
+          );
+          throw err;
+        }
+      }
+    } catch (err) {
+      throw err;
+    }
+  }
+
+  @OnWorkerEvent('active')
+  onActive(job: Job) {
+    this.logger.debug(`Processing ${job.name} for page: ${job.data.pageId}`);
+  }
+
+  @OnWorkerEvent('failed')
+  onError(job: Job) {
+    this.logger.error(
+      `Failed ${job.name} for page: ${job.data.pageId}. Reason: ${job.failedReason}`,
+    );
+  }
+
+  async onModuleDestroy(): Promise<void> {
+    if (this.worker) {
+      await this.worker.close();
+    }
+  }
+}

apps/server/src/collaboration/server/collab-app.module.ts

@@ -9,6 +9,8 @@ import { EventEmitterModule } from '@nestjs/event-emitter';
 import { HealthModule } from '../../integrations/health/health.module';
 import { CollaborationController } from './collaboration.controller';
 import { LoggerModule } from '../../common/logger/logger.module';
+import { RedisModule } from '@nestjs-labs/nestjs-ioredis';
+import { RedisConfigService } from '../../integrations/redis/redis-config.service';
 
 @Module({
   imports: [
@@ -19,6 +21,9 @@ import { LoggerModule } from '../../common/logger/logger.module';
     QueueModule,
     HealthModule,
     EventEmitterModule.forRoot(),
+    RedisModule.forRootAsync({
+      useClass: RedisConfigService,
+    }),
   ],
   controllers: [
     AppController,

apps/server/src/collaboration/server/collab-main.ts

@@ -7,6 +7,7 @@ import {
 import { TransformHttpResponseInterceptor } from '../../common/interceptors/http-response.interceptor';
 import { Logger } from '@nestjs/common';
 import { Logger as PinoLogger } from 'nestjs-pino';
+import { InternalLogFilter } from '../../common/logger/internal-log-filter';
 
 async function bootstrap() {
   const app = await NestFactory.create<NestFastifyApplication>(
@@ -19,7 +20,8 @@ async function bootstrap() {
       },
     }),
     {
-      bufferLogs: true,
+      logger: new InternalLogFilter(),
+      bufferLogs: false,
     },
   );
 
@@ -36,7 +38,8 @@ async function bootstrap() {
   const logger = new Logger('CollabServer');
 
   const port = process.env.COLLAB_PORT || 3001;
-  await app.listen(port, '0.0.0.0', () => {
+  const host = process.env.HOST || '0.0.0.0';
+  await app.listen(port, host, () => {
     logger.log(`Listening on http://127.0.0.1:${port}`);
   });
 }

apps/server/src/collaboration/services/collab-history.service.ts

@@ -0,0 +1,30 @@
+import { Injectable } from '@nestjs/common';
+import { RedisService } from '@nestjs-labs/nestjs-ioredis';
+import type { Redis } from 'ioredis';
+
+const REDIS_KEY_PREFIX = 'history:contributors:';
+
+@Injectable()
+export class CollabHistoryService {
+  private readonly redis: Redis;
+
+  constructor(private readonly redisService: RedisService) {
+    this.redis = this.redisService.getOrThrow();
+  }
+
+  async addContributors(pageId: string, userIds: string[]): Promise<void> {
+    if (userIds.length === 0) return;
+    await this.redis.sadd(REDIS_KEY_PREFIX + pageId, ...userIds);
+  }
+
+  async popContributors(pageId: string): Promise<string[]> {
+    const key = REDIS_KEY_PREFIX + pageId;
+    const count = await this.redis.scard(key);
+    if (count === 0) return [];
+    return await this.redis.spop(key, count);
+  }
+
+  async clearContributors(pageId: string): Promise<void> {
+    await this.redis.del(REDIS_KEY_PREFIX + pageId);
+  }
+}

apps/server/src/collaboration/yjs.util.ts

@@ -0,0 +1,177 @@
+import {
+  initProseMirrorDoc,
+  relativePositionToAbsolutePosition,
+} from 'y-prosemirror';
+import * as Y from 'yjs';
+import { Document } from '@hocuspocus/server';
+import { getSchema } from '@tiptap/core';
+import { tiptapExtensions } from './collaboration.util';
+
+export type YjsSelection = {
+  anchor: any;
+  head: any;
+};
+
+export function setYjsMark(
+  doc: Document,
+  fragment: Y.XmlFragment,
+  yjsSelection: YjsSelection,
+  markName: string,
+  markAttributes: Record<string, any>,
+) {
+  const schema = getSchema(tiptapExtensions);
+  const { mapping } = initProseMirrorDoc(fragment, schema);
+
+  // Convert JSON positions to Y.js RelativePosition objects
+  const anchorRelPos = Y.createRelativePositionFromJSON(yjsSelection.anchor);
+  const headRelPos = Y.createRelativePositionFromJSON(yjsSelection.head);
+
+  const anchor = relativePositionToAbsolutePosition(
+    doc,
+    fragment,
+    anchorRelPos,
+    mapping,
+  );
+  const head = relativePositionToAbsolutePosition(
+    doc,
+    fragment,
+    headRelPos,
+    mapping,
+  );
+
+  if (anchor === null || head === null) {
+    throw new Error(
+      'Could not resolve Y.js relative positions to absolute positions',
+    );
+  }
+
+  const from = Math.min(anchor, head);
+  const to = Math.max(anchor, head);
+
+  // Apply mark directly to Y.js XmlText nodes
+  // This bypasses updateYFragment which has compatibility issues
+  applyMarkToYFragment(fragment, from, to, markName, markAttributes);
+}
+
+function applyMarkToYFragment(
+  fragment: Y.XmlFragment,
+  from: number,
+  to: number,
+  markName: string,
+  markAttributes: Record<string, any>,
+) {
+  let pos = 0;
+
+  const processItem = (item: any): boolean => {
+    if (pos >= to) return false;
+
+    if (item instanceof Y.XmlText) {
+      const textLength = item.length;
+      const itemEnd = pos + textLength;
+
+      if (itemEnd > from && pos < to) {
+        const formatFrom = Math.max(0, from - pos);
+        const formatTo = Math.min(textLength, to - pos);
+        const formatLength = formatTo - formatFrom;
+
+        if (formatLength > 0) {
+          item.format(formatFrom, formatLength, { [markName]: markAttributes });
+        }
+      }
+      pos = itemEnd;
+    } else if (item instanceof Y.XmlElement) {
+      pos++; // Opening tag
+      for (let i = 0; i < item.length; i++) {
+        if (!processItem(item.get(i))) return false;
+      }
+      pos++; // Closing tag
+    }
+    return true;
+  };
+
+  for (let i = 0; i < fragment.length; i++) {
+    if (!processItem(fragment.get(i))) break;
+  }
+}
+
+/**
+ * Removes a mark from all text in the fragment that has the specified attribute value.
+ * Useful for deleting comments by commentId.
+ */
+export function removeYjsMarkByAttribute(
+  fragment: Y.XmlFragment,
+  markName: string,
+  attributeName: string,
+  attributeValue: string,
+) {
+  const processItem = (item: any) => {
+    if (item instanceof Y.XmlText) {
+      // Get all formatting deltas to find ranges with this mark
+      const deltas = item.toDelta();
+      let offset = 0;
+
+      for (const delta of deltas) {
+        const length = delta.insert?.length ?? 0;
+        const attributes = delta.attributes ?? {};
+        const markAttr = attributes[markName];
+
+        if (markAttr && markAttr[attributeName] === attributeValue) {
+          // Remove the mark by setting it to null
+          item.format(offset, length, { [markName]: null });
+        }
+        offset += length;
+      }
+    } else if (item instanceof Y.XmlElement) {
+      for (let i = 0; i < item.length; i++) {
+        processItem(item.get(i));
+      }
+    }
+  };
+
+  for (let i = 0; i < fragment.length; i++) {
+    processItem(fragment.get(i));
+  }
+}
+
+/**
+ * Updates a mark's attributes for all text that has the specified attribute value.
+ * Useful for resolving/unresolving comments by commentId.
+ */
+export function updateYjsMarkAttribute(
+  fragment: Y.XmlFragment,
+  markName: string,
+  findByAttribute: { name: string; value: string },
+  newAttributes: Record<string, any>,
+) {
+  const processItem = (item: any) => {
+    if (item instanceof Y.XmlText) {
+      const deltas = item.toDelta();
+      let offset = 0;
+
+      for (const delta of deltas) {
+        const length = delta.insert?.length ?? 0;
+        const attributes = delta.attributes ?? {};
+        const markAttr = attributes[markName];
+
+        if (
+          markAttr &&
+          markAttr[findByAttribute.name] === findByAttribute.value
+        ) {
+          // Update the mark with new attributes (merge with existing)
+          item.format(offset, length, {
+            [markName]: { ...markAttr, ...newAttributes },
+          });
+        }
+        offset += length;
+      }
+    } else if (item instanceof Y.XmlElement) {
+      for (let i = 0; i < item.length; i++) {
+        processItem(item.get(i));
+      }
+    }
+  };
+
+  for (let i = 0; i < fragment.length; i++) {
+    processItem(fragment.get(i));
+  }
+}

apps/server/src/common/events/audit-events.ts

@@ -0,0 +1,143 @@
+export const AuditEvent = {
+  // Workspace
+  WORKSPACE_CREATED: 'workspace.created',
+  WORKSPACE_UPDATED: 'workspace.updated',
+  WORKSPACE_INVITE_CREATED: 'workspace.invite_created',
+  WORKSPACE_INVITE_RESENT: 'workspace.invite_resent',
+  WORKSPACE_INVITE_REVOKED: 'workspace.invite_revoked',
+
+  // User
+  USER_CREATED: 'user.created',
+  USER_DELETED: 'user.deleted',
+  USER_LOGIN: 'user.login',
+  USER_LOGOUT: 'user.logout',
+  USER_ROLE_CHANGED: 'user.role_changed',
+  USER_PASSWORD_CHANGED: 'user.password_changed',
+  USER_PASSWORD_RESET: 'user.password_reset',
+  USER_UPDATED: 'user.updated',
+  USER_DEACTIVATED: 'user.deactivated',
+  USER_ACTIVATED: 'user.activated',
+
+  // API Keys
+  API_KEY_CREATED: 'api_key.created',
+  API_KEY_UPDATED: 'api_key.updated',
+  API_KEY_DELETED: 'api_key.deleted',
+
+  // Space
+  SPACE_CREATED: 'space.created',
+  SPACE_UPDATED: 'space.updated',
+  SPACE_DELETED: 'space.deleted',
+  SPACE_MEMBER_ADDED: 'space.member_added',
+  SPACE_MEMBER_REMOVED: 'space.member_removed',
+  SPACE_MEMBER_ROLE_CHANGED: 'space.member_role_changed',
+
+  // Group
+  GROUP_CREATED: 'group.created',
+  GROUP_UPDATED: 'group.updated',
+  GROUP_DELETED: 'group.deleted',
+  GROUP_MEMBER_ADDED: 'group.member_added',
+  GROUP_MEMBER_REMOVED: 'group.member_removed',
+
+  // Comment
+  COMMENT_CREATED: 'comment.created',
+  COMMENT_DELETED: 'comment.deleted',
+
+  // Comment updates / resolve
+  COMMENT_UPDATED: 'comment.updated',
+  COMMENT_RESOLVED: 'comment.resolved',
+  COMMENT_REOPENED: 'comment.reopened',
+
+  // Page
+  PAGE_CREATED: 'page.created',
+  PAGE_TRASHED: 'page.trashed',
+  PAGE_DELETED: 'page.deleted',
+  PAGE_RESTORED: 'page.restored',
+  PAGE_MOVED_TO_SPACE: 'page.moved_to_space',
+  PAGE_DUPLICATED: 'page.duplicated',
+  // Page permission
+  PAGE_RESTRICTED: 'page.restricted',
+  PAGE_RESTRICTION_REMOVED: 'page.restriction_removed',
+  PAGE_PERMISSION_ADDED: 'page.permission_added',
+  PAGE_PERMISSION_REMOVED: 'page.permission_removed',
+
+  // Share
+  SHARE_CREATED: 'share.created',
+  SHARE_DELETED: 'share.deleted',
+
+  // Import / Export
+  PAGE_IMPORTED: 'page.imported',
+  PAGE_EXPORTED: 'page.exported',
+  SPACE_EXPORTED: 'space.exported',
+
+  // SSO provider management
+  SSO_PROVIDER_CREATED: 'sso.provider_created',
+  SSO_PROVIDER_UPDATED: 'sso.provider_updated',
+  SSO_PROVIDER_DELETED: 'sso.provider_deleted',
+
+  // MFA
+  USER_MFA_ENABLED: 'user.mfa_enabled',
+  USER_MFA_DISABLED: 'user.mfa_disabled',
+  USER_MFA_BACKUP_CODE_GENERATED: 'user.mfa_backup_code_generated',
+
+  // License
+  LICENSE_ACTIVATED: 'license.activated',
+  LICENSE_REMOVED: 'license.removed',
+
+  // Attachment
+  ATTACHMENT_UPLOADED: 'attachment.uploaded',
+  // ATTACHMENT_DELETED: 'attachment.deleted',
+} as const;
+
+export type AuditEventType = (typeof AuditEvent)[keyof typeof AuditEvent];
+
+export const EXCLUDED_AUDIT_EVENTS: Set<string> = new Set([
+  AuditEvent.PAGE_CREATED,
+  AuditEvent.PAGE_MOVED_TO_SPACE,
+  AuditEvent.PAGE_DUPLICATED,
+  AuditEvent.COMMENT_CREATED,
+  AuditEvent.COMMENT_UPDATED,
+  AuditEvent.COMMENT_RESOLVED,
+  AuditEvent.COMMENT_REOPENED,
+  AuditEvent.ATTACHMENT_UPLOADED
+]);
+
+export const AuditResource = {
+  WORKSPACE: 'workspace',
+  USER: 'user',
+  PAGE: 'page',
+  SPACE: 'space',
+  SPACE_MEMBER: 'space_member',
+  GROUP: 'group',
+  COMMENT: 'comment',
+  SHARE: 'share',
+  API_KEY: 'api_key',
+  SSO_PROVIDER: 'sso_provider',
+  WORKSPACE_INVITATION: 'workspace_invitation',
+  ATTACHMENT: 'attachment',
+  LICENSE: 'license',
+} as const;
+
+export type AuditResourceType =
+  (typeof AuditResource)[keyof typeof AuditResource];
+
+export type ActorType = 'user' | 'system' | 'api_key';
+
+export interface AuditLogPayload {
+  event: AuditEventType;
+  resourceType: AuditResourceType;
+  resourceId?: string;
+  spaceId?: string;
+  changes?: {
+    before?: Record<string, any>;
+    after?: Record<string, any>;
+  };
+  metadata?: Record<string, any>;
+}
+
+export interface AuditLogData extends AuditLogPayload {
+  workspaceId: string;
+  actorId?: string;
+  actorType: ActorType;
+  ipAddress?: string;
+  userAgent?: string;
+}

apps/server/src/common/helpers/cache-keys.ts

@@ -0,0 +1,3 @@
+export const CacheKey = {
+  LICENSE_VALID: (workspaceId: string) => `license:valid:${workspaceId}`,
+};

apps/server/src/common/helpers/constants.ts

@@ -9,3 +9,7 @@ export const LOCAL_STORAGE_PATH = path.resolve(
   '..',
   LOCAL_STORAGE_DIR,
 );
+
+export function getPageTitle(title: string | null | undefined): string {
+  return title || 'untitled';
+}

apps/server/src/common/helpers/prosemirror/utils.ts

@@ -64,6 +64,30 @@ export function extractPageMentions(mentionList: MentionNode[]): MentionNode[] {
   return pageMentionList as MentionNode[];
 }
 
+export function extractUserMentionIdsFromJson(json: any): string[] {
+  const userIds: string[] = [];
+
+  function walk(node: any) {
+    if (!node) return;
+    if (
+      node.type === 'mention' &&
+      node.attrs?.entityType === 'user' &&
+      node.attrs?.entityId &&
+      !userIds.includes(node.attrs.entityId)
+    ) {
+      userIds.push(node.attrs.entityId);
+    }
+    if (Array.isArray(node.content)) {
+      for (const child of node.content) {
+        walk(child);
+      }
+    }
+  }
+
+  walk(json);
+  return userIds;
+}
+
 export function getProsemirrorContent(content: any) {
   return (
     content ?? {

apps/server/src/common/helpers/types/permission.ts

@@ -14,3 +14,12 @@ export enum SpaceVisibility {
   OPEN = 'open', // any workspace member can see that it exists and join.
   PRIVATE = 'private', // only added space users can see
 }
+
+export enum PageAccessLevel {
+  RESTRICTED = 'restricted', // only specific users/groups can view or edit
+}
+
+export enum PagePermissionRole {
+  READER = 'reader', // can only view content and descendants
+  WRITER = 'writer', // can edit content, descendants, and add new users to permission
+}

apps/server/src/common/helpers/utils.ts

@@ -120,6 +120,37 @@ export function normalizePostgresUrl(url: string): string {
   return parsed.toString();
 }
 
+export function diffAuditTrackedFields(
+  fields: readonly string[],
+  dto: Record<string, any>,
+  before: Record<string, any> | undefined | null,
+  after: Record<string, any> | undefined | null,
+): { before: Record<string, any>; after: Record<string, any> } | null {
+  const beforeDiff: Record<string, any> = {};
+  const afterDiff: Record<string, any> = {};
+  let hasChanges = false;
+
+  for (const field of fields) {
+    if (typeof dto[field] === 'undefined') continue;
+    const oldVal = JSON.stringify(before?.[field] ?? null);
+    const newVal = JSON.stringify(after?.[field] ?? null);
+    if (oldVal !== newVal) {
+      beforeDiff[field] = before?.[field];
+      afterDiff[field] = after?.[field];
+      hasChanges = true;
+    }
+  }
+
+  return hasChanges ? { before: beforeDiff, after: afterDiff } : null;
+}
+
+export function isUserDisabled(user: {
+  deactivatedAt?: Date | null;
+  deletedAt?: Date | null;
+}): boolean {
+  return !!(user.deactivatedAt || user.deletedAt);
+}
+
 export function createByteCountingStream(source: Readable) {
   let bytesRead = 0;
   const stream = new Transform({

apps/server/src/common/interceptors/audit-actor.interceptor.ts

@@ -0,0 +1,29 @@
+import {
+  CallHandler,
+  ExecutionContext,
+  Injectable,
+  NestInterceptor,
+} from '@nestjs/common';
+import { Observable } from 'rxjs';
+import { ClsService } from 'nestjs-cls';
+import { AuditContext, AUDIT_CONTEXT_KEY } from '../middlewares/audit-context.middleware';
+
+@Injectable()
+export class AuditActorInterceptor implements NestInterceptor {
+  constructor(private readonly cls: ClsService) {}
+
+  intercept(context: ExecutionContext, next: CallHandler): Observable<any> {
+    const request = context.switchToHttp().getRequest();
+    const user = request.user?.user;
+
+    if (user?.id) {
+      const auditContext = this.cls.get<AuditContext>(AUDIT_CONTEXT_KEY);
+      if (auditContext) {
+        auditContext.actorId = user.id;
+        this.cls.set(AUDIT_CONTEXT_KEY, auditContext);
+      }
+    }
+
+    return next.handle();
+  }
+}

apps/server/src/common/logger/internal-log-filter.ts

@@ -1,7 +1,8 @@
-import { ConsoleLogger } from '@nestjs/common';
+import { ConsoleLogger, LogLevel } from '@nestjs/common';
 
 export class InternalLogFilter extends ConsoleLogger {
   static contextsToIgnore = [
+    'NestFactory',
     'InstanceLoader',
     'RoutesResolver',
     'RouterExplorer',
@@ -11,14 +12,23 @@ export class InternalLogFilter extends ConsoleLogger {
   private allowedLogLevels: string[];
 
   constructor() {
-    super();
     const isProduction = process.env.NODE_ENV === 'production';
+    super({
+      json: isProduction,
+    });
     const isDebugMode = process.env.DEBUG_MODE === 'true';
-    
+
     if (isProduction && !isDebugMode) {
-      this.allowedLogLevels = ['log', 'error', 'fatal'];
+      this.allowedLogLevels = ['info', 'error', 'fatal'];
     } else {
-      this.allowedLogLevels = ['log', 'debug', 'verbose', 'warn', 'error', 'fatal'];
+      this.allowedLogLevels = [
+        'info',
+        'debug',
+        'verbose',
+        'warn',
+        'error',
+        'fatal',
+      ];
     }
   }
 
@@ -28,9 +38,8 @@ export class InternalLogFilter extends ConsoleLogger {
 
   log(_: any, context?: string): void {
     if (
-      this.isLogLevelAllowed('log') &&
-      (process.env.NODE_ENV !== 'production' ||
-        !InternalLogFilter.contextsToIgnore.includes(context))
+      this.isLogLevelAllowed('info') &&
+      !InternalLogFilter.contextsToIgnore.includes(context)
     ) {
       super.log.apply(this, arguments);
     }
@@ -59,4 +68,15 @@ export class InternalLogFilter extends ConsoleLogger {
       super.verbose.apply(this, arguments);
     }
   }
+
+  protected printMessages(
+    messages: unknown[],
+    context?: string,
+    logLevel?: LogLevel,
+    writeStreamType?: 'stdout' | 'stderr',
+    errorStack?: unknown,
+  ): void {
+    const level = logLevel === 'log' ? ('info' as LogLevel) : logLevel;
+    super.printMessages(messages, context, level, writeStreamType, errorStack);
+  }
 }

apps/server/src/common/middlewares/audit-context.middleware.ts

@@ -0,0 +1,50 @@
+import { Injectable, NestMiddleware } from '@nestjs/common';
+import { FastifyRequest, FastifyReply } from 'fastify';
+import { ClsService } from 'nestjs-cls';
+
+export interface AuditContext {
+  workspaceId: string | null;
+  actorId: string | null;
+  actorType: 'user' | 'system' | 'api_key';
+  ipAddress: string | null;
+}
+
+export const AUDIT_CONTEXT_KEY = 'auditContext';
+
+@Injectable()
+export class AuditContextMiddleware implements NestMiddleware {
+  constructor(private readonly cls: ClsService) {}
+
+  use(req: FastifyRequest['raw'], res: FastifyReply['raw'], next: () => void) {
+    const workspaceId = (req as any).workspaceId ?? null;
+    const ipAddress = this.extractIpAddress(req);
+
+    const auditContext: AuditContext = {
+      workspaceId,
+      actorId: null,
+      actorType: 'user',
+      ipAddress,
+    };
+
+    this.cls.set(AUDIT_CONTEXT_KEY, auditContext);
+
+    next();
+  }
+
+  private extractIpAddress(req: FastifyRequest['raw']): string | null {
+    const xForwardedFor = req.headers['x-forwarded-for'];
+    if (xForwardedFor) {
+      const ips = Array.isArray(xForwardedFor)
+        ? xForwardedFor[0]
+        : xForwardedFor.split(',')[0];
+      return ips?.trim() ?? null;
+    }
+
+    const xRealIp = req.headers['x-real-ip'];
+    if (xRealIp) {
+      return Array.isArray(xRealIp) ? xRealIp[0] : xRealIp;
+    }
+
+    return (req as any).socket?.remoteAddress ?? null;
+  }
+}

apps/server/src/core/attachment/attachment.controller.ts

@@ -6,6 +6,7 @@ import {
   Get,
   HttpCode,
   HttpStatus,
+  Inject,
   Logger,
   NotFoundException,
   Param,
@@ -17,13 +18,13 @@ import {
   UseInterceptors,
 } from '@nestjs/common';
 import { AttachmentService } from './services/attachment.service';
-import { FastifyReply } from 'fastify';
+import { FastifyReply, FastifyRequest } from 'fastify';
 import { FileInterceptor } from '../../common/interceptors/file.interceptor';
 import * as bytes from 'bytes';
 import { AuthUser } from '../../common/decorators/auth-user.decorator';
 import { AuthWorkspace } from '../../common/decorators/auth-workspace.decorator';
 import { JwtAuthGuard } from '../../common/guards/jwt-auth.guard';
-import { User, Workspace } from '@docmost/db/types/entity.types';
+import { Attachment, User, Workspace } from '@docmost/db/types/entity.types';
 import { StorageService } from '../../integrations/storage/storage.service';
 import {
   getAttachmentFolderPath,
@@ -52,7 +53,13 @@ import { EnvironmentService } from '../../integrations/environment/environment.s
 import { TokenService } from '../auth/services/token.service';
 import { JwtAttachmentPayload, JwtType } from '../auth/dto/jwt-payload';
 import * as path from 'path';
-import { RemoveIconDto } from './dto/attachment.dto';
+import { AttachmentInfoDto, RemoveIconDto } from './dto/attachment.dto';
+import { PageAccessService } from '../page/page-access/page-access.service';
+import { AuditEvent, AuditResource } from '../../common/events/audit-events';
+import {
+  AUDIT_SERVICE,
+  IAuditService,
+} from '../../integrations/audit/audit.service';
 
 @Controller()
 export class AttachmentController {
@@ -67,6 +74,8 @@ export class AttachmentController {
     private readonly attachmentRepo: AttachmentRepo,
     private readonly environmentService: EnvironmentService,
     private readonly tokenService: TokenService,
+    private readonly pageAccessService: PageAccessService,
+    @Inject(AUDIT_SERVICE) private readonly auditService: IAuditService,
   ) {}
 
   @UseGuards(JwtAuthGuard)
@@ -111,13 +120,7 @@ export class AttachmentController {
       throw new NotFoundException('Page not found');
     }
 
-    const spaceAbility = await this.spaceAbility.createForUser(
-      user,
-      page.spaceId,
-    );
-    if (spaceAbility.cannot(SpaceCaslAction.Manage, SpaceCaslSubject.Page)) {
-      throw new ForbiddenException();
-    }
+    await this.pageAccessService.validateCanEdit(page, user);
 
     const spaceId = page.spaceId;
 
@@ -136,6 +139,18 @@ export class AttachmentController {
         attachmentId: attachmentId,
       });
 
+      this.auditService.log({
+        event: AuditEvent.ATTACHMENT_UPLOADED,
+        resourceType: AuditResource.ATTACHMENT,
+        resourceId: fileResponse?.id ?? attachmentId,
+        spaceId,
+        metadata: {
+          fileName: fileResponse?.fileName,
+          pageId,
+          spaceId,
+        },
+      });
+
       return res.send(fileResponse);
     } catch (err: any) {
       if (err?.statusCode === 413) {
@@ -151,6 +166,7 @@ export class AttachmentController {
   @UseGuards(JwtAuthGuard)
   @Get('/files/:fileId/:fileName')
   async getFile(
+    @Req() req: FastifyRequest,
     @Res() res: FastifyReply,
     @AuthUser() user: User,
     @AuthWorkspace() workspace: Workspace,
@@ -171,32 +187,15 @@ export class AttachmentController {
       throw new NotFoundException();
     }
 
-    const spaceAbility = await this.spaceAbility.createForUser(
-      user,
-      attachment.spaceId,
-    );
-
-    if (spaceAbility.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Page)) {
-      throw new ForbiddenException();
+    const page = await this.pageRepo.findById(attachment.pageId);
+    if (!page) {
+      throw new NotFoundException();
     }
 
+    await this.pageAccessService.validateCanView(page, user);
+
     try {
-      const fileStream = await this.storageService.readStream(
-        attachment.filePath,
-      );
-      res.headers({
-        'Content-Type': attachment.mimeType,
-        'Cache-Control': 'private, max-age=3600',
-      });
-
-      if (!inlineFileExtensions.includes(attachment.fileExt)) {
-        res.header(
-          'Content-Disposition',
-          `attachment; filename="${encodeURIComponent(attachment.fileName)}"`,
-        );
-      }
-
-      return res.send(fileStream);
+      return await this.sendFileResponse(req, res, attachment, 'private');
     } catch (err) {
       this.logger.error(err);
       throw new NotFoundException('File not found');
@@ -205,6 +204,7 @@ export class AttachmentController {
 
   @Get('/files/public/:fileId/:fileName')
   async getPublicFile(
+    @Req() req: FastifyRequest,
     @Res() res: FastifyReply,
     @AuthWorkspace() workspace: Workspace,
     @Param('fileId') fileId: string,
@@ -243,22 +243,7 @@ export class AttachmentController {
     }
 
     try {
-      const fileStream = await this.storageService.readStream(
-        attachment.filePath,
-      );
-      res.headers({
-        'Content-Type': attachment.mimeType,
-        'Cache-Control': 'public, max-age=3600',
-      });
-
-      if (!inlineFileExtensions.includes(attachment.fileExt)) {
-        res.header(
-          'Content-Disposition',
-          `attachment; filename="${encodeURIComponent(attachment.fileName)}"`,
-        );
-      }
-
-      return res.send(fileStream);
+      return await this.sendFileResponse(req, res, attachment, 'public');
     } catch (err) {
       this.logger.error(err);
       throw new NotFoundException('File not found');
@@ -383,6 +368,34 @@ export class AttachmentController {
     }
   }
 
+  @UseGuards(JwtAuthGuard)
+  @HttpCode(HttpStatus.OK)
+  @Post('files/info')
+  async getAttachmentInfo(
+    @Body() dto: AttachmentInfoDto,
+    @AuthWorkspace() workspace: Workspace,
+    @AuthUser() user: User,
+  ) {
+    const attachment = await this.attachmentRepo.findById(dto.attachmentId);
+    if (
+      !attachment ||
+      !attachment.pageId ||
+      attachment.workspaceId !== workspace.id ||
+      attachment.type !== AttachmentType.File
+    ) {
+      throw new NotFoundException('File not found');
+    }
+
+    const page = await this.pageRepo.findById(attachment.pageId);
+    if (!page) {
+      throw new NotFoundException('File not found');
+    }
+
+    await this.pageAccessService.validateCanView(page, user);
+
+    return attachment;
+  }
+
   @UseGuards(JwtAuthGuard)
   @HttpCode(HttpStatus.OK)
   @Post('attachments/remove-icon')
@@ -433,4 +446,70 @@ export class AttachmentController {
       return;
     }
   }
+
+  private async sendFileResponse(
+    req: FastifyRequest,
+    res: FastifyReply,
+    attachment: Attachment,
+    cacheScope: 'private' | 'public',
+  ) {
+    const fileSize = Number(attachment.fileSize);
+    const rangeHeader = req.headers.range;
+
+    res.header('Accept-Ranges', 'bytes');
+
+    if (!inlineFileExtensions.includes(attachment.fileExt)) {
+      res.header(
+        'Content-Disposition',
+        `attachment; filename="${encodeURIComponent(attachment.fileName)}"`,
+      );
+    }
+
+    if (rangeHeader && fileSize) {
+      const match = rangeHeader.match(/bytes=(\d+)-(\d*)/);
+      if (match) {
+        const start = parseInt(match[1], 10);
+        const end = match[2]
+          ? Math.min(parseInt(match[2], 10), fileSize - 1)
+          : fileSize - 1;
+
+        if (start >= fileSize || start > end) {
+          res.status(416);
+          res.header('Content-Range', `bytes */${fileSize}`);
+          return res.send();
+        }
+
+        const fileStream = await this.storageService.readRangeStream(
+          attachment.filePath,
+          { start, end },
+        );
+
+        res.status(206);
+        res.headers({
+          'Content-Type': attachment.mimeType,
+          'Content-Range': `bytes ${start}-${end}/${fileSize}`,
+          'Content-Length': end - start + 1,
+          'Cache-Control': `${cacheScope}, max-age=3600`,
+        });
+
+        return res.send(fileStream);
+      }
+    }
+
+    const fileStream = await this.storageService.readStream(
+      attachment.filePath,
+    );
+
+    res.headers({
+      'Content-Type': attachment.mimeType,
+      'Cache-Control': `${cacheScope}, max-age=3600`,
+    });
+
+    const isSvg = attachment.fileExt === '.svg';
+    if (fileSize && !isSvg) {
+      res.header('Content-Length', fileSize);
+    }
+
+    return res.send(fileStream);
+  }
 }

apps/server/src/core/attachment/attachment.utils.ts

@@ -2,7 +2,7 @@ import { MultipartFile } from '@fastify/multipart';
 import * as path from 'path';
 import { AttachmentType } from './attachment.constants';
 import { sanitizeFileName } from '../../common/helpers';
-import * as sharp from 'sharp';
+import { getMimeType } from '../../common/helpers';
 
 export interface PreparedFile {
   buffer?: Buffer;
@@ -41,7 +41,7 @@ export async function prepareFile(
       fileName,
       fileSize,
       fileExtension,
-      mimeType: file.mimetype,
+      mimeType: getMimeType(file.filename),
       multiPartFile: file,
     };
   } catch (error) {
@@ -77,51 +77,3 @@ export function getAttachmentFolderPath(
 }
 
 export const validAttachmentTypes = Object.values(AttachmentType);
-
-export async function compressAndResizeIcon(
-  buffer: Buffer,
-  attachmentType?: AttachmentType,
-): Promise<Buffer> {
-  try {
-    let sharpInstance = sharp(buffer);
-    const metadata = await sharpInstance.metadata();
-
-    const targetWidth = 300;
-    const targetHeight = 300;
-
-    // Only resize if image is larger than target dimensions
-    if (metadata.width > targetWidth || metadata.height > targetHeight) {
-      sharpInstance = sharpInstance.resize(targetWidth, targetHeight, {
-        fit: 'inside',
-        withoutEnlargement: true,
-      });
-    }
-
-    // Handle based on original format
-    if (metadata.format === 'png') {
-      // Only flatten avatars to remove transparency
-      if (attachmentType === AttachmentType.Avatar) {
-        sharpInstance = sharpInstance.flatten({
-          background: { r: 255, g: 255, b: 255 },
-        });
-      }
-
-      return await sharpInstance
-        .png({
-          quality: 85,
-          compressionLevel: 6,
-        })
-        .toBuffer();
-    } else {
-      return await sharpInstance
-        .jpeg({
-          quality: 85,
-          progressive: true,
-          mozjpeg: true,
-        })
-        .toBuffer();
-    }
-  } catch (err) {
-    throw err;
-  }
-}

apps/server/src/core/attachment/dto/attachment.dto.ts

@@ -1,6 +1,12 @@
 import { IsEnum, IsIn, IsNotEmpty, IsOptional, IsUUID } from 'class-validator';
 import { AttachmentType } from '../attachment.constants';
 
+export class AttachmentInfoDto {
+  @IsNotEmpty()
+  @IsUUID()
+  attachmentId: string;
+}
+
 export class RemoveIconDto {
   @IsEnum(AttachmentType)
   @IsIn([

apps/server/src/core/attachment/services/attachment.service.ts

@@ -8,7 +8,6 @@ import { Readable } from 'stream';
 import { StorageService } from '../../../integrations/storage/storage.service';
 import { MultipartFile } from '@fastify/multipart';
 import {
-  compressAndResizeIcon,
   getAttachmentFolderPath,
   PreparedFile,
   prepareFile,
@@ -99,6 +98,7 @@ export class AttachmentService {
       if (isUpdate) {
         attachment = await this.attachmentRepo.updateAttachment(
           {
+            fileSize: preparedFile.fileSize,
             updatedAt: new Date(),
           },
           attachmentId,
@@ -153,12 +153,6 @@ export class AttachmentService {
     const preparedFile: PreparedFile = await prepareFile(filePromise);
     validateFileType(preparedFile.fileExtension, validImageExtensions);
 
-    const processedBuffer = await compressAndResizeIcon(
-      preparedFile.buffer,
-      type,
-    );
-    preparedFile.buffer = processedBuffer;
-    preparedFile.fileSize = processedBuffer.length;
     preparedFile.fileName = uuid4() + preparedFile.fileExtension;
 
     const filePath = `${getAttachmentFolderPath(type, workspaceId)}/${preparedFile.fileName}`;

apps/server/src/core/auth/auth.controller.ts

@@ -3,6 +3,7 @@ import {
   Controller,
   HttpCode,
   HttpStatus,
+  Inject,
   Post,
   Res,
   UseGuards,
@@ -24,6 +25,11 @@ import { VerifyUserTokenDto } from './dto/verify-user-token.dto';
 import { FastifyReply } from 'fastify';
 import { validateSsoEnforcement } from './auth.util';
 import { ModuleRef } from '@nestjs/core';
+import { AuditEvent, AuditResource } from '../../common/events/audit-events';
+import {
+  AUDIT_SERVICE,
+  IAuditService,
+} from '../../integrations/audit/audit.service';
 
 @Controller('auth')
 export class AuthController {
@@ -33,6 +39,7 @@ export class AuthController {
     private authService: AuthService,
     private environmentService: EnvironmentService,
     private moduleRef: ModuleRef,
+    @Inject(AUDIT_SERVICE) private readonly auditService: IAuditService,
   ) {}
 
   @HttpCode(HttpStatus.OK)
@@ -169,8 +176,17 @@ export class AuthController {
   @UseGuards(JwtAuthGuard)
   @HttpCode(HttpStatus.OK)
   @Post('logout')
-  async logout(@Res({ passthrough: true }) res: FastifyReply) {
+  async logout(
+    @AuthUser() user: User,
+    @Res({ passthrough: true }) res: FastifyReply,
+  ) {
     res.clearCookie('authToken');
+
+    this.auditService.log({
+      event: AuditEvent.USER_LOGOUT,
+      resourceType: AuditResource.USER,
+      resourceId: user.id,
+    });
   }
 
   setAuthCookie(res: FastifyReply, token: string) {

apps/server/src/core/auth/services/auth.service.ts

@@ -1,5 +1,6 @@
 import {
   BadRequestException,
+  Inject,
   Injectable,
   NotFoundException,
   UnauthorizedException,
@@ -13,6 +14,7 @@ import { UserRepo } from '@docmost/db/repos/user/user.repo';
 import {
   comparePasswordHash,
   hashPassword,
+  isUserDisabled,
   nanoIdGen,
 } from '../../../common/helpers';
 import { ChangePasswordDto } from '../dto/change-password.dto';
@@ -29,6 +31,11 @@ import { InjectKysely } from 'nestjs-kysely';
 import { executeTx } from '@docmost/db/utils';
 import { VerifyUserTokenDto } from '../dto/verify-user-token.dto';
 import { DomainService } from '../../../integrations/environment/domain.service';
+import { AuditEvent, AuditResource } from '../../../common/events/audit-events';
+import {
+  AUDIT_SERVICE,
+  IAuditService,
+} from '../../../integrations/audit/audit.service';
 
 @Injectable()
 export class AuthService {
@@ -40,6 +47,7 @@ export class AuthService {
     private mailService: MailService,
     private domainService: DomainService,
     @InjectKysely() private readonly db: KyselyDB,
+    @Inject(AUDIT_SERVICE) private readonly auditService: IAuditService,
   ) {}
 
   async login(loginDto: LoginDto, workspaceId: string) {
@@ -48,7 +56,7 @@ export class AuthService {
     });
 
     const errorMessage = 'Email or password does not match';
-    if (!user || user?.deletedAt) {
+    if (!user || isUserDisabled(user)) {
       throw new UnauthorizedException(errorMessage);
     }
 
@@ -64,6 +72,13 @@ export class AuthService {
     user.lastLoginAt = new Date();
     await this.userRepo.updateLastLogin(user.id, workspaceId);
 
+    this.auditService.log({
+      event: AuditEvent.USER_LOGIN,
+      resourceType: AuditResource.USER,
+      resourceId: user.id,
+      metadata: { source: 'password' },
+    });
+
     return this.tokenService.generateAccessToken(user);
   }
 
@@ -89,7 +104,7 @@ export class AuthService {
       includePassword: true,
     });
 
-    if (!user || user.deletedAt) {
+    if (!user || isUserDisabled(user)) {
       throw new NotFoundException('User not found');
     }
 
@@ -112,6 +127,12 @@ export class AuthService {
       workspaceId,
     );
 
+    this.auditService.log({
+      event: AuditEvent.USER_PASSWORD_CHANGED,
+      resourceType: AuditResource.USER,
+      resourceId: userId,
+    });
+
     const emailTemplate = ChangePasswordEmail({ username: user.name });
     await this.mailService.sendToQueue({
       to: user.email,
@@ -129,22 +150,33 @@ export class AuthService {
       workspace.id,
     );
 
-    if (!user || user.deletedAt) {
+    if (!user || isUserDisabled(user)) {
       return;
     }
 
     const token = nanoIdGen(16);
 
-    const resetLink = `${this.domainService.getUrl(workspace.hostname)}/password-reset?token=${token}`;
+    await executeTx(this.db, async (trx) => {
+      await trx
+        .deleteFrom('userTokens')
+        .where('userId', '=', user.id)
+        .where('type', '=', UserTokenType.FORGOT_PASSWORD)
+        .execute();
 
-    await this.userTokenRepo.insertUserToken({
-      token: token,
-      userId: user.id,
-      workspaceId: user.workspaceId,
-      expiresAt: new Date(new Date().getTime() + 60 * 60 * 1000), // 1 hour
-      type: UserTokenType.FORGOT_PASSWORD,
+      await this.userTokenRepo.insertUserToken(
+        {
+          token,
+          userId: user.id,
+          workspaceId: user.workspaceId,
+          expiresAt: new Date(Date.now() + 30 * 60 * 1000), // 30 minutes
+          type: UserTokenType.FORGOT_PASSWORD,
+        },
+        { trx },
+      );
     });
 
+    const resetLink = `${this.domainService.getUrl(workspace.hostname)}/password-reset?token=${token}`;
+
     const emailTemplate = ForgotPasswordEmail({
       username: user.name,
       resetLink: resetLink,
@@ -177,7 +209,7 @@ export class AuthService {
     const user = await this.userRepo.findById(userToken.userId, workspace.id, {
       includeUserMfa: true,
     });
-    if (!user || user.deletedAt) {
+    if (!user || isUserDisabled(user)) {
       throw new NotFoundException('User not found');
     }
 
@@ -201,6 +233,13 @@ export class AuthService {
         .execute();
     });
 
+    this.auditService.setActorId(user.id);
+    this.auditService.log({
+      event: AuditEvent.USER_PASSWORD_RESET,
+      resourceType: AuditResource.USER,
+      resourceId: user.id,
+    });
+
     const emailTemplate = ChangePasswordEmail({ username: user.name });
     await this.mailService.sendToQueue({
       to: user.email,

apps/server/src/core/auth/services/signup.service.ts

@@ -1,4 +1,4 @@
-import { BadRequestException, Injectable } from '@nestjs/common';
+import { BadRequestException, Inject, Injectable } from '@nestjs/common';
 import { CreateUserDto } from '../dto/create-user.dto';
 import { WorkspaceService } from '../../workspace/services/workspace.service';
 import { CreateWorkspaceDto } from '../../workspace/dto/create-workspace.dto';
@@ -10,6 +10,11 @@ import { InjectKysely } from 'nestjs-kysely';
 import { User, Workspace } from '@docmost/db/types/entity.types';
 import { GroupUserRepo } from '@docmost/db/repos/group/group-user.repo';
 import { UserRole } from '../../../common/helpers/types/permission';
+import { AuditEvent, AuditResource } from '../../../common/events/audit-events';
+import {
+  AUDIT_SERVICE,
+  IAuditService,
+} from '../../../integrations/audit/audit.service';
 
 @Injectable()
 export class SignupService {
@@ -18,6 +23,7 @@ export class SignupService {
     private workspaceService: WorkspaceService,
     private groupUserRepo: GroupUserRepo,
     @InjectKysely() private readonly db: KyselyDB,
+    @Inject(AUDIT_SERVICE) private readonly auditService: IAuditService,
   ) {}
 
   async signup(
@@ -36,7 +42,7 @@ export class SignupService {
       );
     }
 
-    return await executeTx(
+    const user = await executeTx(
       this.db,
       async (trx) => {
         // create user
@@ -66,6 +72,24 @@ export class SignupService {
       },
       trx,
     );
+
+    this.auditService.log({
+      event: AuditEvent.USER_CREATED,
+      resourceType: AuditResource.USER,
+      resourceId: user.id,
+      changes: {
+        after: {
+          name: user.name,
+          email: user.email,
+          role: user.role,
+        },
+      },
+      metadata: {
+        source: 'signup',
+      },
+    });
+
+    return user;
   }
 
   async initialSetup(

apps/server/src/core/auth/services/token.service.ts

@@ -15,6 +15,7 @@ import {
   JwtType,
 } from '../dto/jwt-payload';
 import { User } from '@docmost/db/types/entity.types';
+import { isUserDisabled } from '../../../common/helpers';
 
 @Injectable()
 export class TokenService {
@@ -24,7 +25,7 @@ export class TokenService {
   ) {}
 
   async generateAccessToken(user: User): Promise<string> {
-    if (user.deactivatedAt || user.deletedAt) {
+    if (isUserDisabled(user)) {
       throw new ForbiddenException();
     }
 
@@ -38,7 +39,7 @@ export class TokenService {
   }
 
   async generateCollabToken(user: User, workspaceId: string): Promise<string> {
-    if (user.deactivatedAt || user.deletedAt) {
+    if (isUserDisabled(user)) {
       throw new ForbiddenException();
     }
 
@@ -79,7 +80,7 @@ export class TokenService {
   }
 
   async generateMfaToken(user: User, workspaceId: string): Promise<string> {
-    if (user.deactivatedAt || user.deletedAt) {
+    if (isUserDisabled(user)) {
       throw new ForbiddenException();
     }
 
@@ -98,7 +99,7 @@ export class TokenService {
     expiresIn?: string | number;
   }): Promise<string> {
     const { apiKeyId, user, workspaceId, expiresIn } = opts;
-    if (user.deactivatedAt || user.deletedAt) {
+    if (isUserDisabled(user)) {
       throw new ForbiddenException();
     }
 

apps/server/src/core/auth/strategies/jwt.strategy.ts

@@ -6,7 +6,7 @@ import { JwtApiKeyPayload, JwtPayload, JwtType } from '../dto/jwt-payload';
 import { WorkspaceRepo } from '@docmost/db/repos/workspace/workspace.repo';
 import { UserRepo } from '@docmost/db/repos/user/user.repo';
 import { FastifyRequest } from 'fastify';
-import { extractBearerTokenFromHeader } from '../../../common/helpers';
+import { extractBearerTokenFromHeader, isUserDisabled } from '../../../common/helpers';
 import { ModuleRef } from '@nestjs/core';
 
 @Injectable()
@@ -53,7 +53,7 @@ export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
     }
     const user = await this.userRepo.findById(payload.sub, payload.workspaceId);
 
-    if (!user || user.deactivatedAt || user.deletedAt) {
+    if (!user || isUserDisabled(user)) {
       throw new UnauthorizedException();
     }
 

apps/server/src/core/casl/abilities/workspace-ability.factory.ts

@@ -41,6 +41,7 @@ function buildWorkspaceOwnerAbility() {
   can(WorkspaceCaslAction.Manage, WorkspaceCaslSubject.Member);
   can(WorkspaceCaslAction.Manage, WorkspaceCaslSubject.Attachment);
   can(WorkspaceCaslAction.Manage, WorkspaceCaslSubject.API);
+  can(WorkspaceCaslAction.Manage, WorkspaceCaslSubject.Audit);
 
   return build();
 }

apps/server/src/core/casl/interfaces/workspace-ability.type.ts

@@ -12,6 +12,7 @@ export enum WorkspaceCaslSubject {
   Group = 'group',
   Attachment = 'attachment',
   API = 'api_key',
+  Audit = 'audit',
 }
 
 export type IWorkspaceAbility =
@@ -20,4 +21,5 @@ export type IWorkspaceAbility =
   | [WorkspaceCaslAction, WorkspaceCaslSubject.Space]
   | [WorkspaceCaslAction, WorkspaceCaslSubject.Group]
   | [WorkspaceCaslAction, WorkspaceCaslSubject.Attachment]
-  | [WorkspaceCaslAction, WorkspaceCaslSubject.API];
+  | [WorkspaceCaslAction, WorkspaceCaslSubject.API]
+  | [WorkspaceCaslAction, WorkspaceCaslSubject.Audit];

apps/server/src/core/comment/comment.controller.ts

@@ -5,6 +5,7 @@ import {
   HttpCode,
   HttpStatus,
   UseGuards,
+  Inject,
   NotFoundException,
   ForbiddenException,
 } from '@nestjs/common';
@@ -24,6 +25,13 @@ import {
   SpaceCaslSubject,
 } from '../casl/interfaces/space-ability.type';
 import { CommentRepo } from '@docmost/db/repos/comment/comment.repo';
+import { PageAccessService } from '../page/page-access/page-access.service';
+import { AuditEvent, AuditResource } from '../../common/events/audit-events';
+import {
+  AUDIT_SERVICE,
+  IAuditService,
+} from '../../integrations/audit/audit.service';
+import { WsService } from '../../ws/ws.service';
 
 @UseGuards(JwtAuthGuard)
 @Controller('comments')
@@ -33,6 +41,9 @@ export class CommentController {
     private readonly commentRepo: CommentRepo,
     private readonly pageRepo: PageRepo,
     private readonly spaceAbility: SpaceAbilityFactory,
+    private readonly pageAccessService: PageAccessService,
+    private readonly wsService: WsService,
+    @Inject(AUDIT_SERVICE) private readonly auditService: IAuditService,
   ) {}
 
   @HttpCode(HttpStatus.OK)
@@ -47,12 +58,9 @@ export class CommentController {
       throw new NotFoundException('Page not found');
     }
 
-    const ability = await this.spaceAbility.createForUser(user, page.spaceId);
-    if (ability.cannot(SpaceCaslAction.Create, SpaceCaslSubject.Page)) {
-      throw new ForbiddenException();
-    }
+    await this.pageAccessService.validateCanEdit(page, user);
 
-    return this.commentService.create(
+    const comment = await this.commentService.create(
       {
         userId: user.id,
         page,
@@ -60,6 +68,18 @@ export class CommentController {
       },
       createCommentDto,
     );
+
+    this.auditService.log({
+      event: AuditEvent.COMMENT_CREATED,
+      resourceType: AuditResource.COMMENT,
+      resourceId: comment.id,
+      spaceId: page.spaceId,
+      metadata: {
+        pageId: page.id,
+      },
+    });
+
+    return comment;
   }
 
   @HttpCode(HttpStatus.OK)
@@ -75,10 +95,8 @@ export class CommentController {
       throw new NotFoundException('Page not found');
     }
 
-    const ability = await this.spaceAbility.createForUser(user, page.spaceId);
-    if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Page)) {
-      throw new ForbiddenException();
-    }
+    await this.pageAccessService.validateCanView(page, user);
+
     return this.commentService.findByPageId(page.id, pagination);
   }
 
@@ -90,36 +108,34 @@ export class CommentController {
       throw new NotFoundException('Comment not found');
     }
 
-    const ability = await this.spaceAbility.createForUser(
-      user,
-      comment.spaceId,
-    );
-    if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Page)) {
-      throw new ForbiddenException();
+    const page = await this.pageRepo.findById(comment.pageId);
+    if (!page) {
+      throw new NotFoundException('Page not found');
     }
+
+    await this.pageAccessService.validateCanView(page, user);
+
     return comment;
   }
 
   @HttpCode(HttpStatus.OK)
   @Post('update')
   async update(@Body() dto: UpdateCommentDto, @AuthUser() user: User) {
-    const comment = await this.commentRepo.findById(dto.commentId);
+    const comment = await this.commentRepo.findById(dto.commentId, {
+      includeCreator: true,
+      includeResolvedBy: true,
+    });
     if (!comment) {
       throw new NotFoundException('Comment not found');
     }
 
-    const ability = await this.spaceAbility.createForUser(
-      user,
-      comment.spaceId,
-    );
-
-    // must be a space member with edit permission
-    if (ability.cannot(SpaceCaslAction.Edit, SpaceCaslSubject.Page)) {
-      throw new ForbiddenException(
-        'You must have space edit permission to edit comments',
-      );
+    const page = await this.pageRepo.findById(comment.pageId);
+    if (!page) {
+      throw new NotFoundException('Page not found');
     }
 
+    await this.pageAccessService.validateCanEdit(page, user);
+
     return this.commentService.update(comment, dto, user);
   }
 
@@ -131,47 +147,51 @@ export class CommentController {
       throw new NotFoundException('Comment not found');
     }
 
-    const ability = await this.spaceAbility.createForUser(
-      user,
-      comment.spaceId,
-    );
-
-    // must be a space member with edit permission
-    if (ability.cannot(SpaceCaslAction.Edit, SpaceCaslSubject.Page)) {
-      throw new ForbiddenException();
+    const page = await this.pageRepo.findById(comment.pageId);
+    if (!page) {
+      throw new NotFoundException('Page not found');
     }
 
+    // Check page-level edit permission first
+    await this.pageAccessService.validateCanEdit(page, user);
+
     // Check if user is the comment owner
     const isOwner = comment.creatorId === user.id;
 
     if (isOwner) {
-      /*
-      // Check if comment has children from other users
-      const hasChildrenFromOthers =
-        await this.commentRepo.hasChildrenFromOtherUsers(comment.id, user.id);
+      await this.commentRepo.deleteComment(comment.id);
+    } else {
+      const ability = await this.spaceAbility.createForUser(
+        user,
+        comment.spaceId,
+      );
 
-      // Owner can delete if no children from other users
-      if (!hasChildrenFromOthers) {
-        await this.commentRepo.deleteComment(comment.id);
-        return;
-      }
-
-      // If has children from others, only space admin can delete
+      // Space admin can delete any comment
       if (ability.cannot(SpaceCaslAction.Manage, SpaceCaslSubject.Settings)) {
         throw new ForbiddenException(
-          'Only space admins can delete comments with replies from other users',
+          'You can only delete your own comments or must be a space admin',
         );
-      }*/
+      }
       await this.commentRepo.deleteComment(comment.id);
-      return;
     }
 
-    // Space admin can delete any comment
-    if (ability.cannot(SpaceCaslAction.Manage, SpaceCaslSubject.Settings)) {
-      throw new ForbiddenException(
-        'You can only delete your own comments or must be a space admin',
-      );
-    }
-    await this.commentRepo.deleteComment(comment.id);
+    this.wsService.emitCommentEvent(comment.spaceId, comment.pageId, {
+      operation: 'commentDeleted',
+      pageId: comment.pageId,
+      commentId: comment.id,
+    });
+
+    this.auditService.log({
+      event: AuditEvent.COMMENT_DELETED,
+      resourceType: AuditResource.COMMENT,
+      resourceId: comment.id,
+      spaceId: comment.spaceId,
+      changes: {
+        before: {
+          pageId: comment.pageId,
+          creatorId: comment.creatorId,
+        },
+      },
+    });
   }
 }

apps/server/src/core/comment/comment.module.ts

@@ -3,7 +3,6 @@ import { CommentService } from './comment.service';
 import { CommentController } from './comment.controller';
 
 @Module({
-  imports: [],
   controllers: [CommentController],
   providers: [CommentService],
   exports: [CommentService],

apps/server/src/core/comment/comment.service.ts

@@ -2,23 +2,35 @@ import {
   BadRequestException,
   ForbiddenException,
   Injectable,
+  Logger,
   NotFoundException,
 } from '@nestjs/common';
+import { InjectQueue } from '@nestjs/bullmq';
+import { Queue } from 'bullmq';
 import { CreateCommentDto } from './dto/create-comment.dto';
 import { UpdateCommentDto } from './dto/update-comment.dto';
 import { CommentRepo } from '@docmost/db/repos/comment/comment.repo';
 import { Comment, Page, User } from '@docmost/db/types/entity.types';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
-import { PaginationResult } from '@docmost/db/pagination/pagination';
 import { PageRepo } from '@docmost/db/repos/page/page.repo';
-import { SpaceMemberRepo } from '@docmost/db/repos/space/space-member.repo';
+import { CursorPaginationResult } from '@docmost/db/pagination/cursor-pagination';
+import { QueueJob, QueueName } from '../../integrations/queue/constants';
+import { extractUserMentionIdsFromJson } from '../../common/helpers/prosemirror/utils';
+import { ICommentNotificationJob } from '../../integrations/queue/constants/queue.interface';
+import { WsService } from '../../ws/ws.service';
 
 @Injectable()
 export class CommentService {
+  private readonly logger = new Logger(CommentService.name);
+
   constructor(
     private commentRepo: CommentRepo,
     private pageRepo: PageRepo,
-    private spaceMemberRepo: SpaceMemberRepo,
+    private wsService: WsService,
+    @InjectQueue(QueueName.GENERAL_QUEUE)
+    private generalQueue: Queue,
+    @InjectQueue(QueueName.NOTIFICATION_QUEUE)
+    private notificationQueue: Queue,
   ) {}
 
   async findById(commentId: string) {
@@ -53,29 +65,67 @@ export class CommentService {
       }
     }
 
-    return await this.commentRepo.insertComment({
+    const inserted = await this.commentRepo.insertComment({
       pageId: page.id,
       content: commentContent,
-      selection: createCommentDto?.selection?.substring(0, 250),
-      type: 'inline',
+      selection: createCommentDto?.selection?.substring(0, 250) ?? null,
+      type: createCommentDto.type ?? 'page',
       parentCommentId: createCommentDto?.parentCommentId,
       creatorId: userId,
       workspaceId: workspaceId,
       spaceId: page.spaceId,
     });
+
+    const comment = await this.commentRepo.findById(inserted.id, {
+      includeCreator: true,
+      includeResolvedBy: true,
+    });
+
+    this.generalQueue
+      .add(QueueJob.ADD_PAGE_WATCHERS, {
+        userIds: [userId],
+        pageId: page.id,
+        spaceId: page.spaceId,
+        workspaceId,
+      })
+      .catch((err) =>
+        this.logger.warn(`Failed to queue add-page-watchers: ${err.message}`),
+      );
+
+    const isReply = !!createCommentDto.parentCommentId;
+
+    await this.queueCommentNotification(
+      commentContent,
+      [],
+      comment.id,
+      page.id,
+      page.spaceId,
+      workspaceId,
+      userId,
+      !isReply,
+      createCommentDto.parentCommentId,
+    );
+
+    this.wsService.emitCommentEvent(page.spaceId, page.id, {
+      operation: 'commentCreated',
+      pageId: page.id,
+      comment,
+    });
+
+    return comment;
   }
 
   async findByPageId(
     pageId: string,
     pagination: PaginationOptions,
-  ): Promise<PaginationResult<Comment>> {
+  ): Promise<CursorPaginationResult<Comment>> {
     const page = await this.pageRepo.findById(pageId);
 
     if (!page) {
       throw new BadRequestException('Page not found');
     }
 
-    return await this.commentRepo.findPageComments(pageId, pagination);
+    return this.commentRepo.findPageComments(pageId, pagination);
   }
 
   async update(
@@ -89,6 +139,8 @@ export class CommentService {
       throw new ForbiddenException('You can only edit your own comments');
     }
 
+    const oldMentionIds = extractUserMentionIdsFromJson(comment.content);
+
     const editedAt = new Date();
 
     await this.commentRepo.updateComment(
@@ -99,10 +151,63 @@ export class CommentService {
       },
       comment.id,
     );
+
+    await this.queueCommentNotification(
+      commentContent,
+      oldMentionIds,
+      comment.id,
+      comment.pageId,
+      comment.spaceId,
+      comment.workspaceId,
+      authUser.id,
+      false,
+    );
+
     comment.content = commentContent;
     comment.editedAt = editedAt;
     comment.updatedAt = editedAt;
 
+    this.wsService.emitCommentEvent(comment.spaceId, comment.pageId, {
+      operation: 'commentUpdated',
+      pageId: comment.pageId,
+      comment,
+    });
+
     return comment;
   }
+
+  private async queueCommentNotification(
+    content: any,
+    oldMentionIds: string[],
+    commentId: string,
+    pageId: string,
+    spaceId: string,
+    workspaceId: string,
+    actorId: string,
+    notifyWatchers: boolean,
+    parentCommentId?: string,
+  ) {
+    const mentionedUserIds = extractUserMentionIdsFromJson(content);
+    const newMentionIds = mentionedUserIds.filter(
+      (id) => id !== actorId && !oldMentionIds.includes(id),
+    );
+
+    if (newMentionIds.length === 0 && !notifyWatchers && !parentCommentId) return;
+
+    const jobData: ICommentNotificationJob = {
+      commentId,
+      parentCommentId,
+      pageId,
+      spaceId,
+      workspaceId,
+      actorId,
+      mentionedUserIds: newMentionIds,
+      notifyWatchers,
+    };
+
+    await this.notificationQueue.add(
+      QueueJob.COMMENT_NOTIFICATION,
+      jobData,
+    );
+  }
 }

apps/server/src/core/comment/dto/create-comment.dto.ts

@@ -1,4 +1,4 @@
-import { IsJSON, IsOptional, IsString, IsUUID } from 'class-validator';
+import { IsIn, IsJSON, IsOptional, IsString, IsUUID } from 'class-validator';
 
 export class CreateCommentDto {
   @IsString()
@@ -11,6 +11,10 @@ export class CreateCommentDto {
   @IsString()
   selection: string;
 
+  @IsOptional()
+  @IsIn(['inline', 'page'])
+  type: string;
+
   @IsOptional()
   @IsUUID()
   parentCommentId: string;

apps/server/src/core/core.module.ts

@@ -14,8 +14,17 @@ import { SearchModule } from './search/search.module';
 import { SpaceModule } from './space/space.module';
 import { GroupModule } from './group/group.module';
 import { CaslModule } from './casl/casl.module';
+import { PageAccessModule } from './page/page-access/page-access.module';
 import { DomainMiddleware } from '../common/middlewares/domain.middleware';
+import { AuditContextMiddleware } from '../common/middlewares/audit-context.middleware';
 import { ShareModule } from './share/share.module';
+import { NotificationModule } from './notification/notification.module';
+import { WatcherModule } from './watcher/watcher.module';
+import {
+  AUDIT_SERVICE,
+  NoopAuditService,
+} from '../integrations/audit/audit.service';
+import { ClsMiddleware } from 'nestjs-cls';
 
 @Module({
   imports: [
@@ -29,19 +38,36 @@ import { ShareModule } from './share/share.module';
     SpaceModule,
     GroupModule,
     CaslModule,
+    PageAccessModule,
     ShareModule,
+    NotificationModule,
+    WatcherModule,
   ],
+  providers: [
+    {
+      provide: AUDIT_SERVICE,
+      useClass: NoopAuditService,
+    },
+  ],
+  exports: [AUDIT_SERVICE],
 })
 export class CoreModule implements NestModule {
   configure(consumer: MiddlewareConsumer) {
+    const excludedRoutes = [
+      { path: 'auth/setup', method: RequestMethod.POST },
+      { path: 'health', method: RequestMethod.GET },
+      { path: 'health/live', method: RequestMethod.GET },
+      { path: 'billing/stripe/webhook', method: RequestMethod.POST },
+    ];
+
     consumer
       .apply(DomainMiddleware)
-      .exclude(
-        { path: 'auth/setup', method: RequestMethod.POST },
-        { path: 'health', method: RequestMethod.GET },
-        { path: 'health/live', method: RequestMethod.GET },
-        { path: 'billing/stripe/webhook', method: RequestMethod.POST },
-      )
+      .exclude(...excludedRoutes)
+      .forRoutes('*');
+
+    consumer
+      .apply(AuditContextMiddleware)
+      .exclude(...excludedRoutes)
       .forRoutes('*');
   }
 }

apps/server/src/core/group/group.module.ts

@@ -4,6 +4,7 @@ import { GroupController } from './group.controller';
 import { GroupUserService } from './services/group-user.service';
 
 @Module({
+  imports: [],
   controllers: [GroupController],
   providers: [GroupService, GroupUserService],
   exports: [GroupService, GroupUserService],

apps/server/src/core/group/services/group-user.service.ts

@@ -10,16 +10,27 @@ import { GroupService } from './group.service';
 import { KyselyDB } from '@docmost/db/types/kysely.types';
 import { InjectKysely } from 'nestjs-kysely';
 import { GroupUserRepo } from '@docmost/db/repos/group/group-user.repo';
+import { SpaceMemberRepo } from '@docmost/db/repos/space/space-member.repo';
 import { UserRepo } from '@docmost/db/repos/user/user.repo';
+import { executeTx } from '@docmost/db/utils';
+import { WatcherRepo } from '@docmost/db/repos/watcher/watcher.repo';
+import { AuditEvent, AuditResource } from '../../../common/events/audit-events';
+import {
+  AUDIT_SERVICE,
+  IAuditService,
+} from '../../../integrations/audit/audit.service';
 
 @Injectable()
 export class GroupUserService {
   constructor(
     private groupUserRepo: GroupUserRepo,
+    private spaceMemberRepo: SpaceMemberRepo,
     private userRepo: UserRepo,
     @Inject(forwardRef(() => GroupService))
     private groupService: GroupService,
+    private readonly watcherRepo: WatcherRepo,
     @InjectKysely() private readonly db: KyselyDB,
+    @Inject(AUDIT_SERVICE) private readonly auditService: IAuditService,
   ) {}
 
   async getGroupUsers(
@@ -67,6 +78,20 @@ export class GroupUserService {
       .values(groupUsersToInsert)
       .onConflict((oc) => oc.columns(['userId', 'groupId']).doNothing())
       .execute();
+
+    for (const user of validUsers) {
+      this.auditService.log({
+        event: AuditEvent.GROUP_MEMBER_ADDED,
+        resourceType: AuditResource.GROUP,
+        resourceId: groupId,
+        changes: {
+          after: {
+            userId: user.id,
+            userName: user.name,
+          },
+        },
+      });
+    }
   }
 
   async removeUserFromGroup(
@@ -100,6 +125,34 @@ export class GroupUserService {
       throw new BadRequestException('Group member not found');
     }
 
-    await this.groupUserRepo.delete(userId, groupId);
+    const spaceIds = await this.spaceMemberRepo.getSpaceIdsByGroupId(groupId);
+
+    // TODO: use queue instead
+    await executeTx(this.db, async (trx) => {
+      await this.groupUserRepo.delete(userId, groupId, { trx });
+
+      for (const spaceId of spaceIds) {
+        await this.watcherRepo.deleteByUsersWithoutSpaceAccess(
+          [userId],
+          spaceId,
+          { trx },
+        );
+      }
+    });
+
+    this.auditService.log({
+      event: AuditEvent.GROUP_MEMBER_REMOVED,
+      resourceType: AuditResource.GROUP,
+      resourceId: groupId,
+      changes: {
+        before: {
+          userId: user.id,
+          userName: user.name,
+        },
+      },
+      metadata: {
+        groupName: group.name,
+      },
+    });
   }
 }

apps/server/src/core/group/services/group.service.ts

@@ -8,18 +8,34 @@ import {
 import { CreateGroupDto, DefaultGroup } from '../dto/create-group.dto';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
 import { UpdateGroupDto } from '../dto/update-group.dto';
-import { KyselyTransaction } from '@docmost/db/types/kysely.types';
+import { KyselyDB, KyselyTransaction } from '@docmost/db/types/kysely.types';
 import { GroupRepo } from '@docmost/db/repos/group/group.repo';
+import { GroupUserRepo } from '@docmost/db/repos/group/group-user.repo';
+import { SpaceMemberRepo } from '@docmost/db/repos/space/space-member.repo';
 import { Group, InsertableGroup, User } from '@docmost/db/types/entity.types';
-import { PaginationResult } from '@docmost/db/pagination/pagination';
+import { CursorPaginationResult } from '@docmost/db/pagination/cursor-pagination';
 import { GroupUserService } from './group-user.service';
+import { WatcherRepo } from '@docmost/db/repos/watcher/watcher.repo';
+import { executeTx } from '@docmost/db/utils';
+import { InjectKysely } from 'nestjs-kysely';
+import { AuditEvent, AuditResource } from '../../../common/events/audit-events';
+import { diffAuditTrackedFields } from '../../../common/helpers';
+import {
+  AUDIT_SERVICE,
+  IAuditService,
+} from '../../../integrations/audit/audit.service';
 
 @Injectable()
 export class GroupService {
   constructor(
     private groupRepo: GroupRepo,
+    private groupUserRepo: GroupUserRepo,
+    private spaceMemberRepo: SpaceMemberRepo,
     @Inject(forwardRef(() => GroupUserService))
     private groupUserService: GroupUserService,
+    private readonly watcherRepo: WatcherRepo,
+    @InjectKysely() private readonly db: KyselyDB,
+    @Inject(AUDIT_SERVICE) private readonly auditService: IAuditService,
   ) {}
 
   async getGroupInfo(groupId: string, workspaceId: string): Promise<Group> {
@@ -65,21 +81,19 @@ export class GroupService {
       );
     }
 
-    return createdGroup;
-  }
+    this.auditService.log({
+      event: AuditEvent.GROUP_CREATED,
+      resourceType: AuditResource.GROUP,
+      resourceId: createdGroup.id,
+      changes: {
+        after: {
+          name: createdGroup.name,
+          description: createdGroup.description,
+        },
+      },
+    });
 
-  async createDefaultGroup(
-    workspaceId: string,
-    userId?: string,
-    trx?: KyselyTransaction,
-  ): Promise<Group> {
-    const insertableGroup: InsertableGroup = {
-      name: DefaultGroup.EVERYONE,
-      isDefault: true,
-      creatorId: userId ?? null,
-      workspaceId: workspaceId,
-    };
-    return await this.groupRepo.insertGroup(insertableGroup, trx);
+    return createdGroup;
   }
 
   async updateGroup(
@@ -100,6 +114,8 @@ export class GroupService {
       throw new BadRequestException('You cannot update a default group');
     }
 
+    const groupBefore = { name: group.name, description: group.description };
+
     if (updateGroupDto.name) {
       const existingGroup = await this.groupRepo.findByName(
         updateGroupDto.name,
@@ -126,18 +142,30 @@ export class GroupService {
       workspaceId,
     );
 
+    const changes = diffAuditTrackedFields(
+      ['name', 'description'],
+      updateGroupDto,
+      groupBefore,
+      group,
+    );
+
+    if (changes) {
+      this.auditService.log({
+        event: AuditEvent.GROUP_UPDATED,
+        resourceType: AuditResource.GROUP,
+        resourceId: group.id,
+        changes,
+      });
+    }
+
     return group;
   }
 
   async getWorkspaceGroups(
     workspaceId: string,
     paginationOptions: PaginationOptions,
-  ): Promise<PaginationResult<Group>> {
-    const groups = await this.groupRepo.getGroupsPaginated(
-      workspaceId,
-      paginationOptions,
-    );
-    return groups;
+  ): Promise<CursorPaginationResult<Group>> {
+    return this.groupRepo.getGroupsPaginated(workspaceId, paginationOptions);
   }
 
   async deleteGroup(groupId: string, workspaceId: string): Promise<void> {
@@ -145,7 +173,36 @@ export class GroupService {
     if (group.isDefault) {
       throw new BadRequestException('You cannot delete a default group');
     }
-    await this.groupRepo.delete(groupId, workspaceId);
+
+    const [userIds, spaceIds] = await Promise.all([
+      this.groupUserRepo.getUserIdsByGroupId(groupId),
+      this.spaceMemberRepo.getSpaceIdsByGroupId(groupId),
+    ]);
+
+    // TODO: use queue instead
+    await executeTx(this.db, async (trx) => {
+      await this.groupRepo.delete(groupId, workspaceId, { trx });
+
+      for (const spaceId of spaceIds) {
+        await this.watcherRepo.deleteByUsersWithoutSpaceAccess(
+          userIds,
+          spaceId,
+          { trx },
+        );
+      }
+    });
+
+    this.auditService.log({
+      event: AuditEvent.GROUP_DELETED,
+      resourceType: AuditResource.GROUP,
+      resourceId: groupId,
+      changes: {
+        before: {
+          name: group.name,
+          description: group.description,
+        },
+      },
+    });
   }
 
   async findAndValidateGroup(

apps/server/src/core/notification/dto/notification.dto.ts

@@ -0,0 +1,13 @@
+import { IsArray, IsOptional, IsUUID } from 'class-validator';
+
+export class NotificationIdDto {
+  @IsUUID()
+  notificationId: string;
+}
+
+export class MarkNotificationsReadDto {
+  @IsArray()
+  @IsUUID(undefined, { each: true })
+  @IsOptional()
+  notificationIds?: string[];
+}

apps/server/src/core/notification/notification.constants.ts

@@ -0,0 +1,10 @@
+export const NotificationType = {
+  COMMENT_USER_MENTION: 'comment.user_mention',
+  COMMENT_CREATED: 'comment.created',
+  COMMENT_RESOLVED: 'comment.resolved',
+  PAGE_USER_MENTION: 'page.user_mention',
+  PAGE_PERMISSION_GRANTED: 'page.permission_granted',
+} as const;
+
+export type NotificationType =
+  (typeof NotificationType)[keyof typeof NotificationType];

apps/server/src/core/notification/notification.controller.ts

@@ -0,0 +1,56 @@
+import {
+  Body,
+  Controller,
+  HttpCode,
+  HttpStatus,
+  Post,
+  UseGuards,
+} from '@nestjs/common';
+import { NotificationService } from './notification.service';
+import { AuthUser } from '../../common/decorators/auth-user.decorator';
+import { JwtAuthGuard } from '../../common/guards/jwt-auth.guard';
+import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
+import { User } from '@docmost/db/types/entity.types';
+import { MarkNotificationsReadDto } from './dto/notification.dto';
+
+@UseGuards(JwtAuthGuard)
+@Controller('notifications')
+export class NotificationController {
+  constructor(private readonly notificationService: NotificationService) {}
+
+  @HttpCode(HttpStatus.OK)
+  @Post('/')
+  async getNotifications(
+    @Body() pagination: PaginationOptions,
+    @AuthUser() user: User,
+  ) {
+    return this.notificationService.findByUserId(user.id, pagination);
+  }
+
+  @HttpCode(HttpStatus.OK)
+  @Post('unread-count')
+  async getUnreadCount(@AuthUser() user: User) {
+    const count = await this.notificationService.getUnreadCount(user.id);
+    return { count };
+  }
+
+  @HttpCode(HttpStatus.OK)
+  @Post('mark-read')
+  async markAsRead(
+    @Body() dto: MarkNotificationsReadDto,
+    @AuthUser() user: User,
+  ) {
+    if (dto.notificationIds?.length) {
+      await this.notificationService.markMultipleAsRead(
+        dto.notificationIds,
+        user.id,
+      );
+    }
+  }
+
+  @HttpCode(HttpStatus.OK)
+  @Post('mark-all-read')
+  async markAllAsRead(@AuthUser() user: User) {
+    await this.notificationService.markAllAsRead(user.id);
+  }
+}

apps/server/src/core/notification/notification.module.ts

@@ -0,0 +1,19 @@
+import { Module } from '@nestjs/common';
+import { NotificationService } from './notification.service';
+import { NotificationController } from './notification.controller';
+import { NotificationProcessor } from './notification.processor';
+import { CommentNotificationService } from './services/comment.notification';
+import { PageNotificationService } from './services/page.notification';
+
+@Module({
+  imports: [],
+  controllers: [NotificationController],
+  providers: [
+    NotificationService,
+    NotificationProcessor,
+    CommentNotificationService,
+    PageNotificationService,
+  ],
+  exports: [NotificationService],
+})
+export class NotificationModule {}

apps/server/src/core/notification/notification.processor.ts

@@ -0,0 +1,111 @@
+import { Logger, OnModuleDestroy } from '@nestjs/common';
+import { OnWorkerEvent, Processor, WorkerHost } from '@nestjs/bullmq';
+import { Job } from 'bullmq';
+import { InjectKysely } from 'nestjs-kysely';
+import { KyselyDB } from '@docmost/db/types/kysely.types';
+import { QueueJob, QueueName } from '../../integrations/queue/constants';
+import {
+  ICommentNotificationJob,
+  ICommentResolvedNotificationJob,
+  IPageMentionNotificationJob,
+  IPermissionGrantedNotificationJob,
+} from '../../integrations/queue/constants/queue.interface';
+import { CommentNotificationService } from './services/comment.notification';
+import { PageNotificationService } from './services/page.notification';
+import { DomainService } from '../../integrations/environment/domain.service';
+
+@Processor(QueueName.NOTIFICATION_QUEUE)
+export class NotificationProcessor
+  extends WorkerHost
+  implements OnModuleDestroy
+{
+  private readonly logger = new Logger(NotificationProcessor.name);
+
+  constructor(
+    private readonly commentNotificationService: CommentNotificationService,
+    private readonly pageNotificationService: PageNotificationService,
+    private readonly domainService: DomainService,
+    @InjectKysely() private readonly db: KyselyDB,
+  ) {
+    super();
+  }
+
+  async process(
+    job: Job<
+      | ICommentNotificationJob
+      | ICommentResolvedNotificationJob
+      | IPageMentionNotificationJob
+      | IPermissionGrantedNotificationJob,
+      void
+    >,
+  ): Promise<void> {
+    try {
+      const workspaceId = (job.data as { workspaceId: string }).workspaceId;
+      const appUrl = await this.getWorkspaceUrl(workspaceId);
+
+      switch (job.name) {
+        case QueueJob.COMMENT_NOTIFICATION: {
+          await this.commentNotificationService.processComment(
+            job.data as ICommentNotificationJob,
+            appUrl,
+          );
+          break;
+        }
+
+        case QueueJob.COMMENT_RESOLVED_NOTIFICATION: {
+          await this.commentNotificationService.processResolved(
+            job.data as ICommentResolvedNotificationJob,
+            appUrl,
+          );
+          break;
+        }
+
+        case QueueJob.PAGE_MENTION_NOTIFICATION: {
+          await this.pageNotificationService.processPageMention(
+            job.data as IPageMentionNotificationJob,
+            appUrl,
+          );
+          break;
+        }
+
+        case QueueJob.PAGE_PERMISSION_GRANTED: {
+          await this.pageNotificationService.processPermissionGranted(
+            job.data as IPermissionGrantedNotificationJob,
+            appUrl,
+          );
+          break;
+        }
+
+        default:
+          this.logger.warn(`Unknown notification job: ${job.name}`);
+      }
+    } catch (err: unknown) {
+      const message = err instanceof Error ? err.message : 'Unknown error';
+      this.logger.error(`Failed to process ${job.name}: ${message}`);
+      throw err;
+    }
+  }
+
+  private async getWorkspaceUrl(workspaceId: string): Promise<string> {
+    const workspace = await this.db
+      .selectFrom('workspaces')
+      .select('hostname')
+      .where('id', '=', workspaceId)
+      .executeTakeFirst();
+
+    return this.domainService.getUrl(workspace?.hostname);
+  }
+
+  @OnWorkerEvent('failed')
+  onError(job: Job) {
+    this.logger.error(
+      `Error processing ${job.name} job. Reason: ${job.failedReason}`,
+    );
+  }
+
+  async onModuleDestroy(): Promise<void> {
+    if (this.worker) {
+      await this.worker.close();
+    }
+  }
+}

apps/server/src/core/notification/notification.service.ts

@@ -0,0 +1,80 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { InjectKysely } from 'nestjs-kysely';
+import { KyselyDB } from '@docmost/db/types/kysely.types';
+import { NotificationRepo } from '@docmost/db/repos/notification/notification.repo';
+import { InsertableNotification } from '@docmost/db/types/entity.types';
+import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
+import { WsGateway } from '../../ws/ws.gateway';
+import { MailService } from '../../integrations/mail/mail.service';
+
+@Injectable()
+export class NotificationService {
+  private readonly logger = new Logger(NotificationService.name);
+
+  constructor(
+    private readonly notificationRepo: NotificationRepo,
+    private readonly wsGateway: WsGateway,
+    private readonly mailService: MailService,
+    @InjectKysely() private readonly db: KyselyDB,
+  ) {}
+
+  async create(data: InsertableNotification) {
+    const notification = await this.notificationRepo.insert(data);
+
+    this.wsGateway.server
+      .to(`user-${data.userId}`)
+      .emit('notification', { id: notification.id, type: notification.type });
+
+    return notification;
+  }
+
+  async findByUserId(userId: string, pagination: PaginationOptions) {
+    return this.notificationRepo.findByUserId(userId, pagination);
+  }
+
+  async getUnreadCount(userId: string) {
+    return this.notificationRepo.getUnreadCount(userId);
+  }
+
+  async markAsRead(notificationId: string, userId: string) {
+    return this.notificationRepo.markAsRead(notificationId, userId);
+  }
+
+  async markMultipleAsRead(notificationIds: string[], userId: string) {
+    return this.notificationRepo.markMultipleAsRead(notificationIds, userId);
+  }
+
+  async markAllAsRead(userId: string) {
+    return this.notificationRepo.markAllAsRead(userId);
+  }
+
+  async queueEmail(
+    userId: string,
+    notificationId: string,
+    subject: string,
+    template: any,
+  ) {
+    try {
+      const user = await this.db
+        .selectFrom('users')
+        .select(['email'])
+        .where('id', '=', userId)
+        .where('deletedAt', 'is', null)
+        .executeTakeFirst();
+
+      if (!user?.email) return;
+
+      await this.mailService.sendToQueue({
+        to: user.email,
+        subject,
+        template,
+        notificationId,
+      });
+    } catch (err: unknown) {
+      const message = err instanceof Error ? err.message : 'Unknown error';
+      this.logger.error(
+        `Failed to queue email for notification ${notificationId}: ${message}`,
+      );
+    }
+  }
+}

apps/server/src/core/notification/services/comment.notification.ts

@@ -0,0 +1,235 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { InjectKysely } from 'nestjs-kysely';
+import { KyselyDB } from '@docmost/db/types/kysely.types';
+import {
+  ICommentNotificationJob,
+  ICommentResolvedNotificationJob,
+} from '../../../integrations/queue/constants/queue.interface';
+import { NotificationService } from '../notification.service';
+import { NotificationType } from '../notification.constants';
+import { SpaceMemberRepo } from '@docmost/db/repos/space/space-member.repo';
+import { PagePermissionRepo } from '@docmost/db/repos/page/page-permission.repo';
+import { WatcherRepo } from '@docmost/db/repos/watcher/watcher.repo';
+import { CommentMentionEmail } from '@docmost/transactional/emails/comment-mention-email';
+import { CommentCreateEmail } from '@docmost/transactional/emails/comment-created-email';
+import { CommentResolvedEmail } from '@docmost/transactional/emails/comment-resolved-email';
+import { getPageTitle } from '../../../common/helpers';
+
+@Injectable()
+export class CommentNotificationService {
+  private readonly logger = new Logger(CommentNotificationService.name);
+
+  constructor(
+    @InjectKysely() private readonly db: KyselyDB,
+    private readonly notificationService: NotificationService,
+    private readonly spaceMemberRepo: SpaceMemberRepo,
+    private readonly pagePermissionRepo: PagePermissionRepo,
+    private readonly watcherRepo: WatcherRepo,
+  ) {}
+
+  async processComment(data: ICommentNotificationJob, appUrl: string) {
+    const {
+      commentId,
+      parentCommentId,
+      pageId,
+      spaceId,
+      workspaceId,
+      actorId,
+      mentionedUserIds,
+      notifyWatchers,
+    } = data;
+
+    const context = await this.getCommentContext(
+      actorId,
+      pageId,
+      spaceId,
+      commentId,
+      appUrl,
+    );
+    if (!context) return;
+
+    const { actor, pageTitle, pageUrl } = context;
+    const notifiedUserIds = new Set<string>();
+    notifiedUserIds.add(actorId);
+
+    const recipientIds = parentCommentId
+      ? await this.getThreadParticipantIds(parentCommentId)
+      : notifyWatchers
+        ? await this.watcherRepo.getPageWatcherIds(pageId)
+        : [];
+
+    const allCandidateIds = [
+      ...new Set([...mentionedUserIds, ...recipientIds]),
+    ];
+    const usersWithSpaceAccess =
+      await this.spaceMemberRepo.getUserIdsWithSpaceAccess(
+        allCandidateIds,
+        spaceId,
+      );
+
+    const usersWithPageAccess =
+      await this.pagePermissionRepo.getUserIdsWithPageAccess(
+        pageId,
+        [...usersWithSpaceAccess],
+      );
+    const usersWithAccess = new Set(usersWithPageAccess);
+
+    for (const userId of mentionedUserIds) {
+      if (!usersWithAccess.has(userId)) continue;
+
+      const notification = await this.notificationService.create({
+        userId,
+        workspaceId,
+        type: NotificationType.COMMENT_USER_MENTION,
+        actorId,
+        pageId,
+        spaceId,
+        commentId,
+      });
+
+      await this.notificationService.queueEmail(
+        userId,
+        notification.id,
+        `${actor.name} mentioned you in a comment`,
+        CommentMentionEmail({ actorName: actor.name, pageTitle, pageUrl }),
+      );
+
+      notifiedUserIds.add(userId);
+    }
+
+    for (const recipientId of recipientIds) {
+      if (notifiedUserIds.has(recipientId)) continue;
+      if (!usersWithAccess.has(recipientId)) continue;
+
+      const notification = await this.notificationService.create({
+        userId: recipientId,
+        workspaceId,
+        type: NotificationType.COMMENT_CREATED,
+        actorId,
+        pageId,
+        spaceId,
+        commentId,
+      });
+
+      await this.notificationService.queueEmail(
+        recipientId,
+        notification.id,
+        `${actor.name} commented on ${pageTitle}`,
+        CommentCreateEmail({ actorName: actor.name, pageTitle, pageUrl }),
+      );
+    }
+  }
+
+  async processResolved(data: ICommentResolvedNotificationJob, appUrl: string) {
+    const {
+      commentId,
+      commentCreatorId,
+      pageId,
+      spaceId,
+      workspaceId,
+      actorId,
+    } = data;
+
+    if (commentCreatorId === actorId) return;
+
+    const context = await this.getCommentContext(
+      actorId,
+      pageId,
+      spaceId,
+      commentId,
+      appUrl,
+    );
+    if (!context) return;
+
+    const { actor, pageTitle, pageUrl } = context;
+
+    const roles = await this.spaceMemberRepo.getUserSpaceRoles(
+      commentCreatorId,
+      spaceId,
+    );
+
+    if (!roles) {
+      this.logger.debug(
+        `Skipping resolved notification for user ${commentCreatorId}: no access to space ${spaceId}`,
+      );
+      return;
+    }
+
+    const hasPageAccess =
+      await this.pagePermissionRepo.getUserIdsWithPageAccess(
+        pageId,
+        [commentCreatorId],
+      );
+    if (hasPageAccess.length === 0) return;
+
+    const notification = await this.notificationService.create({
+      userId: commentCreatorId,
+      workspaceId,
+      type: NotificationType.COMMENT_RESOLVED,
+      actorId,
+      pageId,
+      spaceId,
+      commentId,
+    });
+
+    const subject = `${actor.name} resolved a comment on ${pageTitle}`;
+
+    await this.notificationService.queueEmail(
+      commentCreatorId,
+      notification.id,
+      subject,
+      CommentResolvedEmail({ actorName: actor.name, pageTitle, pageUrl }),
+    );
+  }
+
+  private async getThreadParticipantIds(
+    parentCommentId: string,
+  ): Promise<string[]> {
+    const participants = await this.db
+      .selectFrom('comments')
+      .select('creatorId')
+      .where((eb) =>
+        eb.or([
+          eb('id', '=', parentCommentId),
+          eb('parentCommentId', '=', parentCommentId),
+        ]),
+      )
+      .execute();
+
+    return [...new Set(participants.map((p) => p.creatorId))];
+  }
+
+  private async getCommentContext(
+    actorId: string,
+    pageId: string,
+    spaceId: string,
+    commentId: string,
+    appUrl: string,
+  ) {
+    const [actor, page, space] = await Promise.all([
+      this.db
+        .selectFrom('users')
+        .select(['id', 'name'])
+        .where('id', '=', actorId)
+        .executeTakeFirst(),
+      this.db
+        .selectFrom('pages')
+        .select(['id', 'title', 'slugId'])
+        .where('id', '=', pageId)
+        .executeTakeFirst(),
+      this.db
+        .selectFrom('spaces')
+        .select(['id', 'slug'])
+        .where('id', '=', spaceId)
+        .executeTakeFirst(),
+    ]);
+
+    if (!actor || !page || !space) {
+      return null;
+    }
+
+    const pageUrl = `${appUrl}/s/${space.slug}/p/${page.slugId}`;
+
+    return { actor, pageTitle: getPageTitle(page.title), pageUrl };
+  }
+}

apps/server/src/core/notification/services/page.notification.ts

@@ -0,0 +1,191 @@
+import { Injectable } from '@nestjs/common';
+import { InjectKysely } from 'nestjs-kysely';
+import { KyselyDB } from '@docmost/db/types/kysely.types';
+import {
+  IPageMentionNotificationJob,
+  IPermissionGrantedNotificationJob,
+} from '../../../integrations/queue/constants/queue.interface';
+import { NotificationService } from '../notification.service';
+import { NotificationType } from '../notification.constants';
+import { SpaceMemberRepo } from '@docmost/db/repos/space/space-member.repo';
+import { PagePermissionRepo } from '@docmost/db/repos/page/page-permission.repo';
+import { PageMentionEmail } from '@docmost/transactional/emails/page-mention-email';
+import { PermissionGrantedEmail } from '@docmost/transactional/emails/permission-granted-email';
+import { getPageTitle } from '../../../common/helpers';
+
+@Injectable()
+export class PageNotificationService {
+  constructor(
+    @InjectKysely() private readonly db: KyselyDB,
+    private readonly notificationService: NotificationService,
+    private readonly spaceMemberRepo: SpaceMemberRepo,
+    private readonly pagePermissionRepo: PagePermissionRepo,
+  ) {}
+
+  async processPageMention(data: IPageMentionNotificationJob, appUrl: string) {
+    const { userMentions, oldMentionedUserIds, pageId, spaceId, workspaceId } =
+      data;
+
+    const oldIds = new Set(oldMentionedUserIds);
+    const newMentions = userMentions.filter(
+      (m) => !oldIds.has(m.userId) && m.creatorId !== m.userId,
+    );
+
+    if (newMentions.length === 0) return;
+
+    const candidateUserIds = newMentions.map((m) => m.userId);
+    const usersWithSpaceAccess =
+      await this.spaceMemberRepo.getUserIdsWithSpaceAccess(
+        candidateUserIds,
+        spaceId,
+      );
+
+    const usersWithPageAccess =
+      await this.pagePermissionRepo.getUserIdsWithPageAccess(
+        pageId,
+        [...usersWithSpaceAccess],
+      );
+    const usersWithAccess = new Set(usersWithPageAccess);
+
+    const accessibleMentions = newMentions.filter((m) =>
+      usersWithAccess.has(m.userId),
+    );
+    if (accessibleMentions.length === 0) return;
+
+    const mentionsByCreator = new Map<
+      string,
+      { userId: string; mentionId: string }[]
+    >();
+    for (const m of accessibleMentions) {
+      const list = mentionsByCreator.get(m.creatorId) || [];
+      list.push({ userId: m.userId, mentionId: m.mentionId });
+      mentionsByCreator.set(m.creatorId, list);
+    }
+
+    for (const [actorId, mentions] of mentionsByCreator) {
+      await this.notifyMentionedUsers(
+        mentions,
+        actorId,
+        pageId,
+        spaceId,
+        workspaceId,
+        appUrl,
+      );
+    }
+  }
+
+  private async notifyMentionedUsers(
+    mentions: { userId: string; mentionId: string }[],
+    actorId: string,
+    pageId: string,
+    spaceId: string,
+    workspaceId: string,
+    appUrl: string,
+  ) {
+    const context = await this.getPageContext(actorId, pageId, spaceId, appUrl);
+    if (!context) return;
+
+    const { actor, pageTitle, basePageUrl } = context;
+
+    for (const { userId, mentionId } of mentions) {
+      const notification = await this.notificationService.create({
+        userId,
+        workspaceId,
+        type: NotificationType.PAGE_USER_MENTION,
+        actorId,
+        pageId,
+        spaceId,
+        data: { mentionId },
+      });
+
+      const pageUrl = `${basePageUrl}`;
+      const subject = `${actor.name} mentioned you in ${pageTitle}`;
+
+      await this.notificationService.queueEmail(
+        userId,
+        notification.id,
+        subject,
+        PageMentionEmail({ actorName: actor.name, pageTitle, pageUrl }),
+      );
+    }
+  }
+
+  async processPermissionGranted(
+    data: IPermissionGrantedNotificationJob,
+    appUrl: string,
+  ) {
+    const { userIds, pageId, spaceId, workspaceId, actorId, role } = data;
+
+    if (userIds.length === 0) return;
+
+    const usersWithSpaceAccess =
+      await this.spaceMemberRepo.getUserIdsWithSpaceAccess(userIds, spaceId);
+
+    if (usersWithSpaceAccess.size === 0) return;
+
+    const context = await this.getPageContext(actorId, pageId, spaceId, appUrl);
+    if (!context) return;
+
+    const { actor, pageTitle, basePageUrl } = context;
+    const accessLabel = role === 'writer' ? 'edit' : 'view';
+
+    for (const userId of usersWithSpaceAccess) {
+      const notification = await this.notificationService.create({
+        userId,
+        workspaceId,
+        type: NotificationType.PAGE_PERMISSION_GRANTED,
+        actorId,
+        pageId,
+        spaceId,
+        data: { role },
+      });
+
+      const subject = `${actor.name} gave you ${accessLabel} access to ${pageTitle}`;
+
+      await this.notificationService.queueEmail(
+        userId,
+        notification.id,
+        subject,
+        PermissionGrantedEmail({
+          actorName: actor.name,
+          pageTitle,
+          pageUrl: basePageUrl,
+          accessLabel,
+        }),
+      );
+    }
+  }
+
+  private async getPageContext(
+    actorId: string,
+    pageId: string,
+    spaceId: string,
+    appUrl: string,
+  ) {
+    const [actor, page, space] = await Promise.all([
+      this.db
+        .selectFrom('users')
+        .select(['id', 'name'])
+        .where('id', '=', actorId)
+        .executeTakeFirst(),
+      this.db
+        .selectFrom('pages')
+        .select(['id', 'title', 'slugId'])
+        .where('id', '=', pageId)
+        .executeTakeFirst(),
+      this.db
+        .selectFrom('spaces')
+        .select(['id', 'slug'])
+        .where('id', '=', spaceId)
+        .executeTakeFirst(),
+    ]);
+
+    if (!actor || !page || !space) {
+      return null;
+    }
+
+    const basePageUrl = `${appUrl}/s/${space.slug}/p/${page.slugId}`;
+
+    return { actor, pageTitle: getPageTitle(page.title), basePageUrl };
+  }
+}

apps/server/src/core/page/dto/create-page.dto.ts

@@ -1,4 +1,13 @@
-import { IsOptional, IsString, IsUUID } from 'class-validator';
+import {
+  IsIn,
+  IsOptional,
+  IsString,
+  IsUUID,
+  ValidateIf,
+} from 'class-validator';
+import { Transform } from 'class-transformer';
+
+export type ContentFormat = 'json' | 'markdown' | 'html';
 
 export class CreatePageDto {
   @IsOptional()
@@ -15,4 +24,12 @@ export class CreatePageDto {
 
   @IsUUID()
   spaceId: string;
+
+  @IsOptional()
+  content?: string | object;
+
+  @ValidateIf((o) => o.content !== undefined)
+  @Transform(({ value }) => value?.toLowerCase() ?? 'json')
+  @IsIn(['json', 'markdown', 'html'])
+  format?: ContentFormat;
 }

apps/server/src/core/page/dto/page.dto.ts

@@ -1,10 +1,14 @@
 import {
   IsBoolean,
+  IsIn,
   IsNotEmpty,
   IsOptional,
   IsString,
   IsUUID,
 } from 'class-validator';
+import { Transform } from 'class-transformer';
+
+import { ContentFormat } from './create-page.dto';
 
 export class PageIdDto {
   @IsString()
@@ -30,6 +34,11 @@ export class PageInfoDto extends PageIdDto {
   @IsOptional()
   @IsBoolean()
   includeContent: boolean;
+
+  @IsOptional()
+  @Transform(({ value }) => value?.toLowerCase())
+  @IsIn(['json', 'markdown', 'html'])
+  format?: ContentFormat;
 }
 
 export class DeletePageDto extends PageIdDto {

apps/server/src/core/page/dto/update-page.dto.ts

@@ -1,8 +1,24 @@
 import { PartialType } from '@nestjs/mapped-types';
-import { CreatePageDto } from './create-page.dto';
-import { IsString } from 'class-validator';
+import { CreatePageDto, ContentFormat } from './create-page.dto';
+import { IsIn, IsOptional, IsString, ValidateIf } from 'class-validator';
+import { Transform } from 'class-transformer';
+
+export type ContentOperation = 'append' | 'prepend' | 'replace';
 
 export class UpdatePageDto extends PartialType(CreatePageDto) {
   @IsString()
   pageId: string;
+
+  @IsOptional()
+  content?: string | object;
+
+  @ValidateIf((o) => o.content !== undefined)
+  @Transform(({ value }) => value?.toLowerCase())
+  @IsIn(['append', 'prepend', 'replace'])
+  operation?: ContentOperation;
+
+  @ValidateIf((o) => o.content !== undefined)
+  @Transform(({ value }) => value?.toLowerCase() ?? 'json')
+  @IsIn(['json', 'markdown', 'html'])
+  format?: ContentFormat;
 }

apps/server/src/core/page/page-access/page-access.module.ts

@@ -0,0 +1,9 @@
+import { Global, Module } from '@nestjs/common';
+import { PageAccessService } from './page-access.service';
+
+@Global()
+@Module({
+  providers: [PageAccessService],
+  exports: [PageAccessService],
+})
+export class PageAccessModule {}

apps/server/src/core/page/page-access/page-access.service.ts

@@ -0,0 +1,102 @@
+import { ForbiddenException, Injectable } from '@nestjs/common';
+import { Page, User } from '@docmost/db/types/entity.types';
+import { PagePermissionRepo } from '@docmost/db/repos/page/page-permission.repo';
+import SpaceAbilityFactory from '../../casl/abilities/space-ability.factory';
+import {
+  SpaceCaslAction,
+  SpaceCaslSubject,
+} from '../../casl/interfaces/space-ability.type';
+
+@Injectable()
+export class PageAccessService {
+  constructor(
+    private readonly pagePermissionRepo: PagePermissionRepo,
+    private readonly spaceAbility: SpaceAbilityFactory,
+  ) {}
+
+  /**
+   * Validate user can view page, throws ForbiddenException if not.
+   * If page has restrictions: page-level permission determines access.
+   * If no restrictions: space-level permission determines access.
+   */
+  async validateCanView(page: Page, user: User): Promise<void> {
+    // TODO: cache by pageId and userId.
+    const ability = await this.spaceAbility.createForUser(user, page.spaceId);
+
+    // User must be at least a space member
+    if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Page)) {
+      throw new ForbiddenException();
+    }
+
+    const canAccess = await this.pagePermissionRepo.canUserAccessPage(
+      user.id,
+      page.id,
+    );
+    if (!canAccess) {
+      throw new ForbiddenException();
+    }
+  }
+
+  /**
+   * Validate user can view page AND return effective canEdit permission.
+   * Combines access check + edit permission in a single query pass.
+   */
+  async validateCanViewWithPermissions(
+    page: Page,
+    user: User,
+  ): Promise<{ canEdit: boolean; hasRestriction: boolean }> {
+    const ability = await this.spaceAbility.createForUser(user, page.spaceId);
+
+    if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Page)) {
+      throw new ForbiddenException();
+    }
+
+    const { hasAnyRestriction, canAccess, canEdit } =
+      await this.pagePermissionRepo.canUserEditPage(user.id, page.id);
+
+    if (hasAnyRestriction && !canAccess) {
+      throw new ForbiddenException();
+    }
+
+    return {
+      canEdit: hasAnyRestriction
+        ? canEdit
+        : ability.can(SpaceCaslAction.Edit, SpaceCaslSubject.Page),
+      hasRestriction: hasAnyRestriction,
+    };
+  }
+
+  /**
+   * Validate user can edit page, throws ForbiddenException if not.
+   * If page has restrictions: page-level writer permission determines access.
+   * If no restrictions: space-level edit permission determines access.
+   */
+  async validateCanEdit(
+    page: Page,
+    user: User,
+  ): Promise<{ hasRestriction: boolean }> {
+    const ability = await this.spaceAbility.createForUser(user, page.spaceId);
+
+    // User must be at least a space member
+    if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Page)) {
+      throw new ForbiddenException();
+    }
+
+    const { hasAnyRestriction, canEdit } =
+      await this.pagePermissionRepo.canUserEditPage(user.id, page.id);
+
+    if (hasAnyRestriction) {
+      // Page has restrictions - use page-level permission
+      if (!canEdit) {
+        throw new ForbiddenException();
+      }
+    } else {
+      // No restrictions - use space-level permission
+      if (ability.cannot(SpaceCaslAction.Edit, SpaceCaslSubject.Page)) {
+        throw new ForbiddenException();
+      }
+    }
+
+    return { hasRestriction: hasAnyRestriction };
+  }
+}

apps/server/src/core/page/page.controller.ts

@@ -5,11 +5,13 @@ import {
   ForbiddenException,
   HttpCode,
   HttpStatus,
+  Inject,
   NotFoundException,
   Post,
   UseGuards,
 } from '@nestjs/common';
 import { PageService } from './services/page.service';
+import { PageAccessService } from './page-access/page-access.service';
 import { CreatePageDto } from './dto/create-page.dto';
 import { UpdatePageDto } from './dto/update-page.dto';
 import { MovePageDto, MovePageToSpaceDto } from './dto/move-page.dto';
@@ -24,7 +26,7 @@ import { AuthUser } from '../../common/decorators/auth-user.decorator';
 import { AuthWorkspace } from '../../common/decorators/auth-workspace.decorator';
 import { JwtAuthGuard } from '../../common/guards/jwt-auth.guard';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
-import { User, Workspace } from '@docmost/db/types/entity.types';
+import { Page, User, Workspace } from '@docmost/db/types/entity.types';
 import { SidebarPageDto } from './dto/sidebar-page.dto';
 import {
   SpaceCaslAction,
@@ -35,6 +37,16 @@ import { PageRepo } from '@docmost/db/repos/page/page.repo';
 import { RecentPageDto } from './dto/recent-page.dto';
 import { DuplicatePageDto } from './dto/duplicate-page.dto';
 import { DeletedPageDto } from './dto/deleted-page.dto';
+import {
+  jsonToHtml,
+  jsonToMarkdown,
+} from '../../collaboration/collaboration.util';
+import { AuditEvent, AuditResource } from '../../common/events/audit-events';
+import {
+  AUDIT_SERVICE,
+  IAuditService,
+} from '../../integrations/audit/audit.service';
+import { getPageTitle } from '../../common/helpers';
 
 @UseGuards(JwtAuthGuard)
 @Controller('pages')
@@ -44,6 +56,8 @@ export class PageController {
     private readonly pageRepo: PageRepo,
     private readonly pageHistoryService: PageHistoryService,
     private readonly spaceAbility: SpaceAbilityFactory,
+    private readonly pageAccessService: PageAccessService,
+    @Inject(AUDIT_SERVICE) private readonly auditService: IAuditService,
   ) {}
 
   @HttpCode(HttpStatus.OK)
@@ -61,12 +75,24 @@ export class PageController {
       throw new NotFoundException('Page not found');
     }
 
-    const ability = await this.spaceAbility.createForUser(user, page.spaceId);
-    if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Page)) {
-      throw new ForbiddenException();
+    const { canEdit, hasRestriction } =
+      await this.pageAccessService.validateCanViewWithPermissions(page, user);
+
+    const permissions = { canEdit, hasRestriction };
+
+    if (dto.format && dto.format !== 'json' && page.content) {
+      const contentOutput =
+        dto.format === 'markdown'
+          ? jsonToMarkdown(page.content)
+          : jsonToHtml(page.content);
+      return {
+        ...page,
+        content: contentOutput,
+        permissions,
+      };
     }
 
-    return page;
+    return { ...page, permissions };
   }
 
   @HttpCode(HttpStatus.OK)
@@ -76,15 +102,67 @@ export class PageController {
     @AuthUser() user: User,
     @AuthWorkspace() workspace: Workspace,
   ) {
-    const ability = await this.spaceAbility.createForUser(
-      user,
-      createPageDto.spaceId,
-    );
-    if (ability.cannot(SpaceCaslAction.Create, SpaceCaslSubject.Page)) {
-      throw new ForbiddenException();
+    if (createPageDto.parentPageId) {
+      // Creating under a parent page - check edit permission on parent
+      const parentPage = await this.pageRepo.findById(
+        createPageDto.parentPageId,
+      );
+      if (
+        !parentPage ||
+        parentPage.deletedAt ||
+        parentPage.spaceId !== createPageDto.spaceId
+      ) {
+        throw new NotFoundException('Parent page not found');
+      }
+      await this.pageAccessService.validateCanEdit(parentPage, user);
+    } else {
+      // Creating at root level - require space-level permission
+      const ability = await this.spaceAbility.createForUser(
+        user,
+        createPageDto.spaceId,
+      );
+      if (ability.cannot(SpaceCaslAction.Create, SpaceCaslSubject.Page)) {
+        throw new ForbiddenException();
+      }
     }
 
-    return this.pageService.create(user.id, workspace.id, createPageDto);
+    const page = await this.pageService.create(
+      user.id,
+      workspace.id,
+      createPageDto,
+    );
+
+    const { canEdit, hasRestriction } =
+      await this.pageAccessService.validateCanViewWithPermissions(page, user);
+
+    const permissions = { canEdit, hasRestriction };
+
+    this.auditService.log({
+      event: AuditEvent.PAGE_CREATED,
+      resourceType: AuditResource.PAGE,
+      resourceId: page.id,
+      spaceId: page.spaceId,
+      changes: {
+        after: {
+          title: getPageTitle(page.title),
+          spaceId: page.spaceId,
+        },
+      },
+    });
+
+    if (
+      createPageDto.format &&
+      createPageDto.format !== 'json' &&
+      page.content
+    ) {
+      const contentOutput =
+        createPageDto.format === 'markdown'
+          ? jsonToMarkdown(page.content)
+          : jsonToHtml(page.content);
+      return { ...page, content: contentOutput, permissions };
+    }
+
+    return { ...page, permissions };
   }
 
   @HttpCode(HttpStatus.OK)
@@ -96,12 +174,32 @@ export class PageController {
       throw new NotFoundException('Page not found');
     }
 
-    const ability = await this.spaceAbility.createForUser(user, page.spaceId);
-    if (ability.cannot(SpaceCaslAction.Edit, SpaceCaslSubject.Page)) {
-      throw new ForbiddenException();
+    const { hasRestriction } = await this.pageAccessService.validateCanEdit(
+      page,
+      user,
+    );
+
+    const updatedPage = await this.pageService.update(
+      page,
+      updatePageDto,
+      user,
+    );
+
+    const permissions = { canEdit: true, hasRestriction };
+
+    if (
+      updatePageDto.format &&
+      updatePageDto.format !== 'json' &&
+      updatedPage.content
+    ) {
+      const contentOutput =
+        updatePageDto.format === 'markdown'
+          ? jsonToMarkdown(updatedPage.content)
+          : jsonToHtml(updatedPage.content);
+      return { ...updatedPage, content: contentOutput, permissions };
     }
 
-    return this.pageService.update(page, updatePageDto, user.id);
+    return { ...updatedPage, permissions };
   }
 
   @HttpCode(HttpStatus.OK)
@@ -127,16 +225,45 @@ export class PageController {
         );
       }
       await this.pageService.forceDelete(deletePageDto.pageId, workspace.id);
+
+      this.auditService.log({
+        event: AuditEvent.PAGE_DELETED,
+        resourceType: AuditResource.PAGE,
+        resourceId: page.id,
+        spaceId: page.spaceId,
+        changes: {
+          before: {
+            pageId: page.id,
+            slugId: page.slugId,
+            title: getPageTitle(page.title),
+            spaceId: page.spaceId,
+          },
+        },
+      });
     } else {
-      // Soft delete requires page manage permissions
-      if (ability.cannot(SpaceCaslAction.Manage, SpaceCaslSubject.Page)) {
-        throw new ForbiddenException();
-      }
+      // User with edit permission can delete
+      await this.pageAccessService.validateCanEdit(page, user);
+
       await this.pageService.removePage(
         deletePageDto.pageId,
         user.id,
         workspace.id,
       );
+
+      this.auditService.log({
+        event: AuditEvent.PAGE_TRASHED,
+        resourceType: AuditResource.PAGE,
+        resourceId: page.id,
+        spaceId: page.spaceId,
+        changes: {
+          before: {
+            pageId: page.id,
+            slugId: page.slugId,
+            title: getPageTitle(page.title),
+            spaceId: page.spaceId,
+          },
+        },
+      });
     }
   }
 
@@ -153,13 +280,30 @@ export class PageController {
       throw new NotFoundException('Page not found');
     }
 
+    // only users with "can edit" space level permission can restore pages
     const ability = await this.spaceAbility.createForUser(user, page.spaceId);
-    if (ability.cannot(SpaceCaslAction.Manage, SpaceCaslSubject.Page)) {
+    if (ability.cannot(SpaceCaslAction.Edit, SpaceCaslSubject.Page)) {
       throw new ForbiddenException();
     }
 
+    // make sure they have page level access to the page
+    await this.pageAccessService.validateCanEdit(page, user);
+
     await this.pageRepo.restorePage(pageIdDto.pageId, workspace.id);
 
+    this.auditService.log({
+      event: AuditEvent.PAGE_RESTORED,
+      resourceType: AuditResource.PAGE,
+      resourceId: page.id,
+      spaceId: page.spaceId,
+      changes: {
+        after: {
+          title: getPageTitle(page.title),
+          spaceId: page.spaceId,
+        },
+      },
+    });
+
     return this.pageRepo.findById(pageIdDto.pageId, {
       includeHasChildren: true,
     });
@@ -184,6 +328,7 @@ export class PageController {
 
       return this.pageService.getRecentSpacePages(
         recentPageDto.spaceId,
+        user.id,
         pagination,
       );
     }
@@ -204,18 +349,18 @@ export class PageController {
         deletedPageDto.spaceId,
       );
 
-      if (ability.cannot(SpaceCaslAction.Manage, SpaceCaslSubject.Page)) {
+      if (ability.cannot(SpaceCaslAction.Edit, SpaceCaslSubject.Page)) {
         throw new ForbiddenException();
       }
 
       return this.pageService.getDeletedSpacePages(
         deletedPageDto.spaceId,
+        user.id,
         pagination,
       );
     }
   }
 
-  // TODO: scope to workspaces
   @HttpCode(HttpStatus.OK)
   @Post('/history')
   async getPageHistory(
@@ -228,10 +373,7 @@ export class PageController {
       throw new NotFoundException('Page not found');
     }
 
-    const ability = await this.spaceAbility.createForUser(user, page.spaceId);
-    if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Page)) {
-      throw new ForbiddenException();
-    }
+    await this.pageAccessService.validateCanView(page, user);
 
     return this.pageHistoryService.findHistoryByPageId(page.id, pagination);
   }
@@ -247,13 +389,14 @@ export class PageController {
       throw new NotFoundException('Page history not found');
     }
 
-    const ability = await this.spaceAbility.createForUser(
-      user,
-      history.spaceId,
-    );
-    if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Page)) {
-      throw new ForbiddenException();
+    // Get the page to check permissions
+    const page = await this.pageRepo.findById(history.pageId);
+    if (!page) {
+      throw new NotFoundException('Page not found');
     }
+
+    await this.pageAccessService.validateCanView(page, user);
+
     return history;
   }
 
@@ -285,7 +428,18 @@ export class PageController {
       throw new ForbiddenException();
     }
 
-    return this.pageService.getSidebarPages(spaceId, pagination, dto.pageId);
+    const spaceCanEdit = ability.can(
+      SpaceCaslAction.Edit,
+      SpaceCaslSubject.Page,
+    );
+
+    return this.pageService.getSidebarPages(
+      spaceId,
+      pagination,
+      dto.pageId,
+      user.id,
+      spaceCanEdit,
+    );
   }
 
   @HttpCode(HttpStatus.OK)
@@ -315,7 +469,30 @@ export class PageController {
       throw new ForbiddenException();
     }
 
-    return this.pageService.movePageToSpace(movedPage, dto.spaceId);
+    // Check page-level edit permission on the source page
+    await this.pageAccessService.validateCanEdit(movedPage, user);
+
+    // Moves only accessible pages; inaccessible child pages become root pages in original space
+    const { childPageIds } = await this.pageService.movePageToSpace(
+      movedPage,
+      dto.spaceId,
+      user.id,
+    );
+
+    this.auditService.log({
+      event: AuditEvent.PAGE_MOVED_TO_SPACE,
+      resourceType: AuditResource.PAGE,
+      resourceId: movedPage.id,
+      spaceId: movedPage.spaceId,
+      changes: {
+        before: { spaceId: movedPage.spaceId },
+        after: { spaceId: dto.spaceId },
+      },
+      metadata: {
+        title: getPageTitle(movedPage.title),
+        ...(childPageIds.length > 0 && { childPageIds }),
+      },
+    });
   }
 
   @HttpCode(HttpStatus.OK)
@@ -326,6 +503,12 @@ export class PageController {
       throw new NotFoundException('Page to copy not found');
     }
 
+    // Check page-level view permission on the source page (need to read to copy)
+    // Inaccessible child branches are automatically skipped during duplication
+    await this.pageAccessService.validateCanView(copiedPage, user);
+
+    let result;
+
     // If spaceId is provided, it's a copy to different space
     if (dto.spaceId) {
       const abilities = await Promise.all([
@@ -341,7 +524,27 @@ export class PageController {
         throw new ForbiddenException();
       }
 
-      return this.pageService.duplicatePage(copiedPage, dto.spaceId, user);
+      result = await this.pageService.duplicatePage(
+        copiedPage,
+        dto.spaceId,
+        user,
+      );
+
+      this.auditService.log({
+        event: AuditEvent.PAGE_DUPLICATED,
+        resourceType: AuditResource.PAGE,
+        resourceId: result.id,
+        spaceId: dto.spaceId,
+        metadata: {
+          sourcePageId: copiedPage.id,
+          title: getPageTitle(copiedPage.title),
+          sourceSpaceId: copiedPage.spaceId,
+          targetSpaceId: dto.spaceId,
+          ...(result.childPageIds.length > 0 && {
+            childPageIds: result.childPageIds,
+          }),
+        },
+      });
     } else {
       // If no spaceId, it's a duplicate in same space
       const ability = await this.spaceAbility.createForUser(
@@ -352,8 +555,28 @@ export class PageController {
         throw new ForbiddenException();
       }
 
-      return this.pageService.duplicatePage(copiedPage, undefined, user);
+      result = await this.pageService.duplicatePage(
+        copiedPage,
+        undefined,
+        user,
+      );
+
+      this.auditService.log({
+        event: AuditEvent.PAGE_DUPLICATED,
+        resourceType: AuditResource.PAGE,
+        resourceId: result.id,
+        spaceId: copiedPage.spaceId,
+        metadata: {
+          sourcePageId: copiedPage.id,
+          title: getPageTitle(copiedPage.title),
+          ...(result.childPageIds.length > 0 && {
+            childPageIds: result.childPageIds,
+          }),
+        },
+      });
     }
+
+    return result;
   }
 
   @HttpCode(HttpStatus.OK)
@@ -368,10 +591,23 @@ export class PageController {
       user,
       movedPage.spaceId,
     );
+
     if (ability.cannot(SpaceCaslAction.Edit, SpaceCaslSubject.Page)) {
       throw new ForbiddenException();
     }
 
+    // Check page-level edit permission
+    await this.pageAccessService.validateCanEdit(movedPage, user);
+
+    // If moving to a new parent, check permission on the target parent
+    if (dto.parentPageId && dto.parentPageId !== movedPage.parentPageId) {
+      const targetParent = await this.pageRepo.findById(dto.parentPageId);
+      if (!targetParent || targetParent.deletedAt) {
+        throw new NotFoundException('Target parent page not found');
+      }
+      await this.pageAccessService.validateCanEdit(targetParent, user);
+    }
+
     return this.pageService.movePage(dto, movedPage);
   }
 
@@ -383,10 +619,8 @@ export class PageController {
       throw new NotFoundException('Page not found');
     }
 
-    const ability = await this.spaceAbility.createForUser(user, page.spaceId);
-    if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Page)) {
-      throw new ForbiddenException();
-    }
+    await this.pageAccessService.validateCanView(page, user);
+
     return this.pageService.getPageBreadCrumbs(page.id);
   }
 }

apps/server/src/core/page/page.module.ts

@@ -4,11 +4,13 @@ import { PageController } from './page.controller';
 import { PageHistoryService } from './services/page-history.service';
 import { TrashCleanupService } from './services/trash-cleanup.service';
 import { StorageModule } from '../../integrations/storage/storage.module';
+import { CollaborationModule } from '../../collaboration/collaboration.module';
+import { WatcherModule } from '../watcher/watcher.module';
 
 @Module({
   controllers: [PageController],
   providers: [PageService, PageHistoryService, TrashCleanupService],
   exports: [PageService, PageHistoryService],
-  imports: [StorageModule],
+  imports: [StorageModule, CollaborationModule, WatcherModule],
 })
 export class PageModule {}

apps/server/src/core/page/services/page-history.service.ts

@@ -2,25 +2,25 @@ import { Injectable } from '@nestjs/common';
 import { PageHistoryRepo } from '@docmost/db/repos/page/page-history.repo';
 import { PageHistory } from '@docmost/db/types/entity.types';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
-import { PaginationResult } from '@docmost/db/pagination/pagination';
+import { CursorPaginationResult } from '@docmost/db/pagination/cursor-pagination';
 
 @Injectable()
 export class PageHistoryService {
   constructor(private pageHistoryRepo: PageHistoryRepo) {}
 
   async findById(historyId: string): Promise<PageHistory> {
-    return await this.pageHistoryRepo.findById(historyId);
+    return await this.pageHistoryRepo.findById(historyId, {
+      includeContent: true,
+    });
   }
 
   async findHistoryByPageId(
     pageId: string,
     paginationOptions: PaginationOptions,
-  ): Promise<PaginationResult<any>> {
-    const pageHistory = await this.pageHistoryRepo.findPageHistoryByPageId(
+  ): Promise<CursorPaginationResult<PageHistory>> {
+    return this.pageHistoryRepo.findPageHistoryByPageId(
       pageId,
       paginationOptions,
     );
-
-    return pageHistory;
   }
 }

apps/server/src/core/page/services/page.service.ts

@@ -4,20 +4,22 @@ import {
   Logger,
   NotFoundException,
 } from '@nestjs/common';
-import { CreatePageDto } from '../dto/create-page.dto';
-import { UpdatePageDto } from '../dto/update-page.dto';
+import { CreatePageDto, ContentFormat } from '../dto/create-page.dto';
+import { ContentOperation, UpdatePageDto } from '../dto/update-page.dto';
 import { PageRepo } from '@docmost/db/repos/page/page.repo';
+import { PagePermissionRepo } from '@docmost/db/repos/page/page-permission.repo';
 import { InsertablePage, Page, User } from '@docmost/db/types/entity.types';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
 import {
-  executeWithPagination,
-  PaginationResult,
-} from '@docmost/db/pagination/pagination';
+  CursorPaginationResult,
+  executeWithCursorPagination,
+} from '@docmost/db/pagination/cursor-pagination';
 import { InjectKysely } from 'nestjs-kysely';
 import { KyselyDB } from '@docmost/db/types/kysely.types';
 import { generateJitteredKeyBetween } from 'fractional-indexing-jittered';
 import { MovePageDto } from '../dto/move-page.dto';
 import { generateSlugId } from '../../../common/helpers';
+import { getPageTitle } from '../../../common/helpers';
 import { executeTx } from '@docmost/db/utils';
 import { AttachmentRepo } from '@docmost/db/repos/attachment/attachment.repo';
 import { v7 as uuid7 } from 'uuid';
@@ -28,7 +30,11 @@ import {
   isAttachmentNode,
   removeMarkTypeFromDoc,
 } from '../../../common/helpers/prosemirror/utils';
-import { jsonToNode, jsonToText } from 'src/collaboration/collaboration.util';
+import {
+  htmlToJson,
+  jsonToNode,
+  jsonToText,
+} from 'src/collaboration/collaboration.util';
 import {
   CopyPageMapEntry,
   ICopyPageAttachment,
@@ -40,6 +46,10 @@ import { Queue } from 'bullmq';
 import { QueueJob, QueueName } from '../../../integrations/queue/constants';
 import { EventName } from '../../../common/events/event.contants';
 import { EventEmitter2 } from '@nestjs/event-emitter';
+import { CollaborationGateway } from '../../../collaboration/collaboration.gateway';
+import { markdownToHtml } from '@docmost/editor-ext';
+import { WatcherService } from '../../watcher/watcher.service';
+import { sql } from 'kysely';
 
 @Injectable()
 export class PageService {
@@ -47,12 +57,16 @@ export class PageService {
 
   constructor(
     private pageRepo: PageRepo,
+    private pagePermissionRepo: PagePermissionRepo,
     private attachmentRepo: AttachmentRepo,
     @InjectKysely() private readonly db: KyselyDB,
     private readonly storageService: StorageService,
     @InjectQueue(QueueName.ATTACHMENT_QUEUE) private attachmentQueue: Queue,
     @InjectQueue(QueueName.AI_QUEUE) private aiQueue: Queue,
+    @InjectQueue(QueueName.GENERAL_QUEUE) private generalQueue: Queue,
     private eventEmitter: EventEmitter2,
+    private collaborationGateway: CollaborationGateway,
+    private readonly watcherService: WatcherService,
   ) {}
 
   async findById(
@@ -81,14 +95,33 @@ export class PageService {
         createPageDto.parentPageId,
       );
 
-      if (!parentPage || parentPage.spaceId !== createPageDto.spaceId) {
+      if (
+        !parentPage ||
+        parentPage.deletedAt ||
+        parentPage.spaceId !== createPageDto.spaceId
+      ) {
         throw new NotFoundException('Parent page not found');
       }
 
       parentPageId = parentPage.id;
     }
 
-    const createdPage = await this.pageRepo.insertPage({
+    let content = undefined;
+    let textContent = undefined;
+    let ydoc = undefined;
+
+    if (createPageDto?.content && createPageDto?.format) {
+      const prosemirrorJson = await this.parseProsemirrorContent(
+        createPageDto.content,
+        createPageDto.format,
+      );
+
+      content = prosemirrorJson;
+      textContent = jsonToText(prosemirrorJson);
+      ydoc = createYdocFromJson(prosemirrorJson);
+    }
+
+    const page = await this.pageRepo.insertPage({
       slugId: generateSlugId(),
       title: createPageDto.title,
       position: await this.nextPagePosition(
@@ -101,9 +134,23 @@ export class PageService {
       creatorId: userId,
       workspaceId: workspaceId,
       lastUpdatedById: userId,
+      content,
+      textContent,
+      ydoc,
     });
 
-    return createdPage;
+    this.generalQueue
+      .add(QueueJob.ADD_PAGE_WATCHERS, {
+        userIds: [userId],
+        pageId: page.id,
+        spaceId: createPageDto.spaceId,
+        workspaceId,
+      })
+      .catch((err) =>
+        this.logger.warn(`Failed to queue add-page-watchers: ${err.message}`),
+      );
+
+    return page;
   }
 
   async nextPagePosition(spaceId: string, parentPageId?: string) {
@@ -150,23 +197,48 @@ export class PageService {
   async update(
     page: Page,
     updatePageDto: UpdatePageDto,
-    userId: string,
+    user: User,
   ): Promise<Page> {
     const contributors = new Set<string>(page.contributorIds);
-    contributors.add(userId);
+    contributors.add(user.id);
     const contributorIds = Array.from(contributors);
 
     await this.pageRepo.updatePage(
       {
         title: updatePageDto.title,
         icon: updatePageDto.icon,
-        lastUpdatedById: userId,
+        lastUpdatedById: user.id,
         updatedAt: new Date(),
         contributorIds: contributorIds,
       },
       page.id,
     );
 
+    this.generalQueue
+      .add(QueueJob.ADD_PAGE_WATCHERS, {
+        userIds: [user.id],
+        pageId: page.id,
+        spaceId: page.spaceId,
+        workspaceId: page.workspaceId,
+      })
+      .catch((err) =>
+        this.logger.warn(`Failed to queue add-page-watchers: ${err.message}`),
+      );
+
+    if (
+      updatePageDto.content &&
+      updatePageDto.operation &&
+      updatePageDto.format
+    ) {
+      await this.updatePageContent(
+        page.id,
+        updatePageDto.content,
+        updatePageDto.operation,
+        updatePageDto.format,
+        user,
+      );
+    }
+
     return await this.pageRepo.findById(page.id, {
       includeSpace: true,
       includeContent: true,
@@ -176,11 +248,30 @@ export class PageService {
     });
   }
 
+  async updatePageContent(
+    pageId: string,
+    content: string | object,
+    operation: ContentOperation,
+    format: ContentFormat,
+    user: User,
+  ): Promise<void> {
+    const prosemirrorJson = await this.parseProsemirrorContent(content, format);
+
+    const documentName = `page.${pageId}`;
+    await this.collaborationGateway.handleYjsEvent(
+      'updatePageContent',
+      documentName,
+      { operation, prosemirrorJson, user },
+    );
+  }
+
   async getSidebarPages(
     spaceId: string,
     pagination: PaginationOptions,
     pageId?: string,
-  ): Promise<any> {
+    userId?: string,
+    spaceCanEdit?: boolean,
+  ): Promise<CursorPaginationResult<Partial<Page> & { hasChildren: boolean }>> {
     let query = this.db
       .selectFrom('pages')
       .select([
@@ -195,7 +286,6 @@ export class PageService {
         'deletedAt',
       ])
       .select((eb) => this.pageRepo.withHasChildren(eb))
-      .orderBy('position', (ob) => ob.collate('C').asc())
       .where('deletedAt', 'is', null)
       .where('spaceId', '=', spaceId);
 
@@ -205,16 +295,116 @@ export class PageService {
       query = query.where('parentPageId', 'is', null);
     }
 
-    const result = executeWithPagination(query, {
-      page: pagination.page,
-      perPage: 250,
+    const result = await executeWithCursorPagination(query, {
+      perPage: 200,
+      cursor: pagination.cursor,
+      beforeCursor: pagination.beforeCursor,
+      fields: [
+        {
+          expression: 'position',
+          direction: 'asc',
+          orderModifier: (ob) => ob.collate('C').asc(),
+        },
+        { expression: 'id', direction: 'asc' },
+      ],
+      parseCursor: (cursor) => ({
+        position: cursor.position,
+        id: cursor.id,
+      }),
     });
 
+    if (userId && result.items.length > 0) {
+      const hasRestrictions =
+        await this.pagePermissionRepo.hasRestrictedPagesInSpace(spaceId);
+
+      if (!hasRestrictions) {
+        result.items = result.items.map((p: any) => ({
+          ...p,
+          canEdit: spaceCanEdit ?? true,
+        }));
+      } else {
+        const pageIds = result.items.map((p: any) => p.id);
+
+        const accessiblePages =
+          await this.pagePermissionRepo.filterAccessiblePageIdsWithPermissions(
+            pageIds,
+            userId,
+          );
+
+        const permissionMap = new Map(
+          accessiblePages.map((p) => [p.id, p.canEdit]),
+        );
+
+        result.items = result.items
+          .filter((p: any) => permissionMap.has(p.id))
+          .map((p: any) => ({
+            ...p,
+            canEdit: permissionMap.get(p.id) && (spaceCanEdit ?? true),
+          }));
+
+        const pagesWithChildren = result.items.filter(
+          (p: any) => p.hasChildren,
+        );
+        if (pagesWithChildren.length > 0) {
+          const parentIds = pagesWithChildren.map((p: any) => p.id);
+          const parentsWithAccessibleChildren =
+            await this.pagePermissionRepo.getParentIdsWithAccessibleChildren(
+              parentIds,
+              userId,
+            );
+          const hasAccessibleChildrenSet = new Set(
+            parentsWithAccessibleChildren,
+          );
+
+          result.items = result.items.map((p: any) => ({
+            ...p,
+            hasChildren: p.hasChildren && hasAccessibleChildrenSet.has(p.id),
+          }));
+        }
+      }
+    }
+
     return result;
   }
 
-  async movePageToSpace(rootPage: Page, spaceId: string) {
+  async movePageToSpace(rootPage: Page, spaceId: string, userId: string) {
+    let childPageIds: string[] = [];
+
+    const allPages = await this.pageRepo.getPageAndDescendants(rootPage.id, {
+      includeContent: false,
+    });
+
+    // Filter to only accessible pages while maintaining tree integrity
+    const accessiblePages = await this.filterAccessibleTreePages(
+      allPages,
+      rootPage.id,
+      userId,
+      rootPage.spaceId,
+    );
+    const accessibleIds = new Set(accessiblePages.map((p) => p.id));
+
+    // Find inaccessible pages whose parent is being moved - these need to be orphaned
+    const pagesToOrphan = allPages.filter(
+      (p) =>
+        !accessibleIds.has(p.id) &&
+        p.parentPageId &&
+        accessibleIds.has(p.parentPageId),
+    );
+
     await executeTx(this.db, async (trx) => {
+      // Orphan inaccessible child pages (make them root pages in original space)
+      for (const page of pagesToOrphan) {
+        const orphanPosition = await this.nextPagePosition(
+          rootPage.spaceId,
+          null,
+        );
+        await this.pageRepo.updatePage(
+          { parentPageId: null, position: orphanPosition },
+          page.id,
+          trx,
+        );
+      }
+
       // Update root page
       const nextPosition = await this.nextPagePosition(spaceId);
       await this.pageRepo.updatePage(
@@ -222,47 +412,62 @@ export class PageService {
         rootPage.id,
         trx,
       );
-      const pageIds = await this.pageRepo
-        .getPageAndDescendants(rootPage.id, { includeContent: false })
-        .then((pages) => pages.map((page) => page.id));
-      // The first id is the root page id
-      if (pageIds.length > 1) {
-        // Update sub pages
+
+      const pageIdsToMove = accessiblePages.map((p) => p.id);
+
+      childPageIds = pageIdsToMove.filter((id) => id !== rootPage.id);
+
+      if (pageIdsToMove.length > 1) {
+        // Update sub pages (all accessible pages except root)
         await this.pageRepo.updatePages(
           { spaceId },
-          pageIds.filter((id) => id !== rootPage.id),
+          childPageIds,
           trx,
         );
       }
 
-      if (pageIds.length > 0) {
+      if (pageIdsToMove.length > 0) {
+        // Clear page-level permissions - moved pages inherit destination space permissions
+        // (page_permissions cascade deletes via foreign key)
+        await trx
+          .deleteFrom('pageAccess')
+          .where('pageId', 'in', pageIdsToMove)
+          .execute();
+
         // update spaceId in shares
         await trx
           .updateTable('shares')
           .set({ spaceId: spaceId })
-          .where('pageId', 'in', pageIds)
+          .where('pageId', 'in', pageIdsToMove)
           .execute();
 
         // Update comments
         await trx
           .updateTable('comments')
           .set({ spaceId: spaceId })
-          .where('pageId', 'in', pageIds)
+          .where('pageId', 'in', pageIdsToMove)
           .execute();
 
         // Update attachments
         await this.attachmentRepo.updateAttachmentsByPageId(
           { spaceId },
-          pageIds,
+          pageIdsToMove,
           trx,
         );
 
+        // Update watchers and remove those without access to new space
+        await this.watcherService.movePageWatchersToSpace(pageIdsToMove, spaceId, {
+          trx,
+        });
+
         await this.aiQueue.add(QueueJob.PAGE_MOVED_TO_SPACE, {
-          pageId: pageIds,
-          workspaceId: rootPage.workspaceId
+          pageId: pageIdsToMove,
+          workspaceId: rootPage.workspaceId,
         });
       }
     });
+
+    return { childPageIds };
   }
 
   async duplicatePage(
@@ -284,10 +489,18 @@ export class PageService {
       nextPosition = await this.nextPagePosition(spaceId);
     }
 
-    const pages = await this.pageRepo.getPageAndDescendants(rootPage.id, {
+    const allPages = await this.pageRepo.getPageAndDescendants(rootPage.id, {
       includeContent: true,
     });
 
+    // Filter to only accessible pages while maintaining tree integrity
+    const pages = await this.filterAccessibleTreePages(
+      allPages,
+      rootPage.id,
+      authUser.id,
+      rootPage.spaceId,
+    );
+
     const pageMap = new Map<string, CopyPageMapEntry>();
     pages.forEach((page) => {
       pageMap.set(page.id, {
@@ -370,7 +583,7 @@ export class PageService {
         // Add "Copy of " prefix to the root page title only for duplicates in same space
         let title = page.title;
         if (isDuplicateInSameSpace && page.id === rootPage.id) {
-          const originalTitle = page.title || 'Untitled';
+          const originalTitle = getPageTitle(page.title);
           title = `Copy of ${originalTitle}`;
         }
 
@@ -387,9 +600,14 @@ export class PageService {
           workspaceId: page.workspaceId,
           creatorId: authUser.id,
           lastUpdatedById: authUser.id,
-          parentPageId: page.id === rootPage.id
-            ? (isDuplicateInSameSpace ? rootPage.parentPageId : null)
-            : (page.parentPageId ? pageMap.get(page.parentPageId)?.newPageId : null),
+          parentPageId:
+            page.id === rootPage.id
+              ? isDuplicateInSameSpace
+                ? rootPage.parentPageId
+                : null
+              : page.parentPageId
+                ? pageMap.get(page.parentPageId)?.newPageId
+                : null,
         };
       }),
     );
@@ -468,10 +686,12 @@ export class PageService {
     });
 
     const hasChildren = pages.length > 1;
+    const childPageIds = insertedPageIds.filter((id) => id !== newPageId);
 
     return {
       ...duplicatedPage,
       hasChildren,
+      childPageIds,
     };
   }
 
@@ -490,7 +710,11 @@ export class PageService {
       // changing the page's parent
       if (dto.parentPageId) {
         const parentPage = await this.pageRepo.findById(dto.parentPageId);
-        if (!parentPage || parentPage.spaceId !== movedPage.spaceId) {
+        if (
+          !parentPage ||
+          parentPage.deletedAt ||
+          parentPage.spaceId !== movedPage.spaceId
+        ) {
           throw new NotFoundException('Parent page not found');
         }
         parentPageId = parentPage.id;
@@ -521,7 +745,6 @@ export class PageService {
             'spaceId',
             'deletedAt',
           ])
-          .select((eb) => this.pageRepo.withHasChildren(eb))
           .where('id', '=', childPageId)
           .where('deletedAt', 'is', null)
           .unionAll((exp) =>
@@ -537,30 +760,21 @@ export class PageService {
                 'p.spaceId',
                 'p.deletedAt',
               ])
-              .select(
-                exp
-                  .selectFrom('pages as child')
-                  .select((eb) =>
-                    eb
-                      .case()
-                      .when(eb.fn.countAll(), '>', 0)
-                      .then(true)
-                      .else(false)
-                      .end()
-                      .as('count'),
-                  )
-                  .whereRef('child.parentPageId', '=', 'id')
-                  .where('child.deletedAt', 'is', null)
-                  .limit(1)
-                  .as('hasChildren'),
-              )
-              //.select((eb) => this.withHasChildren(eb))
               .innerJoin('page_ancestors as pa', 'pa.parentPageId', 'p.id')
               .where('p.deletedAt', 'is', null),
           ),
       )
       .selectFrom('page_ancestors')
-      .selectAll()
+      .selectAll('page_ancestors')
+      .select((eb) =>
+        eb.exists(
+          eb
+            .selectFrom('pages as child')
+            .select(sql`1`.as('one'))
+            .whereRef('child.parentPageId', '=', 'page_ancestors.id')
+            .where('child.deletedAt', 'is', null),
+        ).as('hasChildren'),
+      )
       .execute();
 
     return ancestors.reverse();
@@ -568,23 +782,72 @@ export class PageService {
 
   async getRecentSpacePages(
     spaceId: string,
+    userId: string,
     pagination: PaginationOptions,
-  ): Promise<PaginationResult<Page>> {
-    return await this.pageRepo.getRecentPagesInSpace(spaceId, pagination);
+  ): Promise<CursorPaginationResult<Page>> {
+    const result = await this.pageRepo.getRecentPagesInSpace(
+      spaceId,
+      pagination,
+    );
+
+    if (result.items.length > 0) {
+      const pageIds = result.items.map((p) => p.id);
+      const accessibleIds =
+        await this.pagePermissionRepo.filterAccessiblePageIds({
+          pageIds,
+          userId,
+          spaceId,
+        });
+      const accessibleSet = new Set(accessibleIds);
+      result.items = result.items.filter((p) => accessibleSet.has(p.id));
+    }
+
+    return result;
   }
 
   async getRecentPages(
     userId: string,
     pagination: PaginationOptions,
-  ): Promise<PaginationResult<Page>> {
-    return await this.pageRepo.getRecentPages(userId, pagination);
+  ): Promise<CursorPaginationResult<Page>> {
+    const result = await this.pageRepo.getRecentPages(userId, pagination);
+
+    if (result.items.length > 0) {
+      const pageIds = result.items.map((p) => p.id);
+      const accessibleIds =
+        await this.pagePermissionRepo.filterAccessiblePageIds({
+          pageIds,
+          userId,
+        });
+      const accessibleSet = new Set(accessibleIds);
+      result.items = result.items.filter((p) => accessibleSet.has(p.id));
+    }
+
+    return result;
   }
 
   async getDeletedSpacePages(
     spaceId: string,
+    userId: string,
     pagination: PaginationOptions,
-  ): Promise<PaginationResult<Page>> {
-    return await this.pageRepo.getDeletedPagesInSpace(spaceId, pagination);
+  ): Promise<CursorPaginationResult<Page>> {
+    const result = await this.pageRepo.getDeletedPagesInSpace(
+      spaceId,
+      pagination,
+    );
+
+    if (result.items.length > 0) {
+      const pageIds = result.items.map((p) => p.id);
+      const accessibleIds =
+        await this.pagePermissionRepo.filterAccessiblePageIds({
+          pageIds,
+          userId,
+          spaceId,
+        });
+      const accessibleSet = new Set(accessibleIds);
+      result.items = result.items.filter((p) => accessibleSet.has(p.id));
+    }
+
+    return result;
   }
 
   async forceDelete(pageId: string, workspaceId: string): Promise<void> {
@@ -642,4 +905,93 @@ export class PageService {
   ): Promise<void> {
     await this.pageRepo.removePage(pageId, userId, workspaceId);
   }
+
+  private async parseProsemirrorContent(
+    content: string | object,
+    format: ContentFormat,
+  ): Promise<any> {
+    let prosemirrorJson: any;
+
+    switch (format) {
+      case 'markdown': {
+        const html = await markdownToHtml(content as string);
+        prosemirrorJson = htmlToJson(html as string);
+        break;
+      }
+      case 'html': {
+        prosemirrorJson = htmlToJson(content as string);
+        break;
+      }
+      case 'json':
+      default: {
+        prosemirrorJson = content;
+        break;
+      }
+    }
+
+    try {
+      jsonToNode(prosemirrorJson);
+    } catch (err) {
+      throw new BadRequestException('Invalid content format');
+    }
+
+    return prosemirrorJson;
+  }
+
+  /**
+   * Filters a list of pages to only those accessible to the user while maintaining tree integrity.
+   * A page is included only if:
+   * 1. The user has access to it
+   * 2. Its parent is also included (or it's the root page)
+   * This ensures that if a middle page is inaccessible, its entire subtree is excluded.
+   */
+  private async filterAccessibleTreePages<
+    T extends { id: string; parentPageId: string | null },
+  >(
+    pages: T[],
+    rootPageId: string,
+    userId: string,
+    spaceId?: string,
+  ): Promise<T[]> {
+    if (pages.length === 0) return [];
+
+    const pageIds = pages.map((p) => p.id);
+    const accessibleIds = await this.pagePermissionRepo.filterAccessiblePageIds(
+      {
+        pageIds,
+        userId,
+        spaceId,
+      },
+    );
+    const accessibleSet = new Set(accessibleIds);
+
+    // Prune: include a page only if it's accessible AND its parent chain to root is included
+    const includedIds = new Set<string>();
+
+    // Process pages in a way that ensures parents are processed before children
+    // We do this by iterating until no more pages can be added
+    let changed = true;
+    while (changed) {
+      changed = false;
+      for (const page of pages) {
+        if (includedIds.has(page.id)) continue;
+        if (!accessibleSet.has(page.id)) continue;
+
+        // Root page: include if accessible
+        if (page.id === rootPageId) {
+          includedIds.add(page.id);
+          changed = true;
+          continue;
+        }
+
+        // Non-root: include if parent is already included
+        if (page.parentPageId && includedIds.has(page.parentPageId)) {
+          includedIds.add(page.id);
+          changed = true;
+        }
+      }
+    }
+
+    return pages.filter((p) => includedIds.has(p.id));
+  }
 }

apps/server/src/core/page/services/trash-cleanup.service.ts

@@ -6,10 +6,11 @@ import { InjectQueue } from '@nestjs/bullmq';
 import { Queue } from 'bullmq';
 import { QueueJob, QueueName } from '../../../integrations/queue/constants';
 
+const DEFAULT_RETENTION_DAYS = 30;
+
 @Injectable()
 export class TrashCleanupService {
   private readonly logger = new Logger(TrashCleanupService.name);
-  private readonly RETENTION_DAYS = 30;
 
   constructor(
     @InjectKysely() private readonly db: KyselyDB,
@@ -21,36 +22,46 @@ export class TrashCleanupService {
     try {
       this.logger.debug('Starting trash cleanup job');
 
-      const retentionDate = new Date();
-      retentionDate.setDate(retentionDate.getDate() - this.RETENTION_DAYS);
-
-      // Get all pages that were deleted more than 30 days ago
-      const oldDeletedPages = await this.db
-        .selectFrom('pages')
-        .select(['id', 'spaceId', 'workspaceId'])
-        .where('deletedAt', '<', retentionDate)
+      const workspaces = await this.db
+        .selectFrom('workspaces')
+        .select(['id', 'trashRetentionDays'])
+        .where('deletedAt', 'is', null)
         .execute();
 
-      if (oldDeletedPages.length === 0) {
-        this.logger.debug('No old trash items to clean up');
-        return;
-      }
+      let totalCleaned = 0;
 
-      this.logger.debug(`Found ${oldDeletedPages.length} pages to clean up`);
+      for (const workspace of workspaces) {
+        const retentionDays =
+          workspace.trashRetentionDays ?? DEFAULT_RETENTION_DAYS;
 
-      // Process each page
-      for (const page of oldDeletedPages) {
-        try {
-          await this.cleanupPage(page.id);
-        } catch (error) {
-          this.logger.error(
-            `Failed to cleanup page ${page.id}: ${error instanceof Error ? error.message : 'Unknown error'}`,
-            error instanceof Error ? error.stack : undefined,
-          );
+        const retentionDate = new Date();
+        retentionDate.setDate(retentionDate.getDate() - retentionDays);
+
+        const oldDeletedPages = await this.db
+          .selectFrom('pages')
+          .select(['id'])
+          .where('workspaceId', '=', workspace.id)
+          .where('deletedAt', '<', retentionDate)
+          .execute();
+
+        for (const page of oldDeletedPages) {
+          try {
+            await this.cleanupPage(page.id);
+            totalCleaned++;
+          } catch (error) {
+            this.logger.error(
+              `Failed to cleanup page ${page.id}: ${error instanceof Error ? error.message : 'Unknown error'}`,
+              error instanceof Error ? error.stack : undefined,
+            );
+          }
         }
       }
 
-      this.logger.debug('Trash cleanup job completed');
+      this.logger.debug(
+        totalCleaned > 0
+          ? `Trash cleanup completed: ${totalCleaned} pages cleaned`
+          : 'No old trash items to clean up',
+      );
     } catch (error) {
       this.logger.error(
         'Trash cleanup job failed',

apps/server/src/core/search/search.module.ts

@@ -5,5 +5,6 @@ import { SearchService } from './search.service';
 @Module({
   controllers: [SearchController],
   providers: [SearchService],
+  exports: [SearchService],
 })
 export class SearchModule {}

apps/server/src/core/search/search.service.ts

@@ -7,6 +7,7 @@ import { sql } from 'kysely';
 import { PageRepo } from '@docmost/db/repos/page/page.repo';
 import { SpaceMemberRepo } from '@docmost/db/repos/space/space-member.repo';
 import { ShareRepo } from '@docmost/db/repos/share/share.repo';
+import { PagePermissionRepo } from '@docmost/db/repos/page/page-permission.repo';
 
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const tsquery = require('pg-tsquery')();
@@ -18,6 +19,7 @@ export class SearchService {
     private pageRepo: PageRepo,
     private shareRepo: ShareRepo,
     private spaceMemberRepo: SpaceMemberRepo,
+    private pagePermissionRepo: PagePermissionRepo,
   ) {}
 
   async searchPage(
@@ -26,11 +28,11 @@ export class SearchService {
       userId?: string;
       workspaceId: string;
     },
-  ): Promise<SearchResponseDto[]> {
+  ): Promise<{ items: SearchResponseDto[] }> {
     const { query } = searchParams;
 
     if (query.length < 1) {
-      return;
+      return { items: [] };
     }
     const searchQuery = tsquery(query.trim() + '*');
 
@@ -62,7 +64,7 @@ export class SearchService {
       )
       .where('deletedAt', 'is', null)
       .orderBy('rank', 'desc')
-      .limit(searchParams.limit | 25)
+      .limit(searchParams.limit || 25)
       .offset(searchParams.offset || 0);
 
     if (!searchParams.shareId) {
@@ -86,7 +88,7 @@ export class SearchService {
       const shareId = searchParams.shareId;
       const share = await this.shareRepo.findById(shareId);
       if (!share || share.workspaceId !== opts.workspaceId) {
-        return [];
+        return { items: [] };
       }
 
       const pageIdsToSearch = [];
@@ -108,17 +110,30 @@ export class SearchService {
           .where('id', 'in', pageIdsToSearch)
           .where('workspaceId', '=', opts.workspaceId);
       } else {
-        return [];
+        return { items: [] };
       }
     } else {
-      return [];
+      return { items: [] };
     }
 
     //@ts-ignore
-    queryResults = await queryResults.execute();
+    let results: any[] = await queryResults.execute();
+
+    // Filter results by page-level permissions (if user is authenticated)
+    if (opts.userId && results.length > 0) {
+      const pageIds = results.map((r: any) => r.id);
+      const accessibleIds =
+        await this.pagePermissionRepo.filterAccessiblePageIds({
+          pageIds,
+          userId: opts.userId,
+          spaceId: searchParams.spaceId,
+        });
+      const accessibleSet = new Set(accessibleIds);
+      results = results.filter((r: any) => accessibleSet.has(r.id));
+    }
 
     //@ts-ignore
-    const searchResults = queryResults.map((result: SearchResponseDto) => {
+    const searchResults = results.map((result: SearchResponseDto) => {
       if (result.highlight) {
         result.highlight = result.highlight
           .replace(/\r\n|\r|\n/g, ' ')
@@ -127,7 +142,7 @@ export class SearchService {
       return result;
     });
 
-    return searchResults;
+    return { items: searchResults };
   }
 
   async searchSuggestions(
@@ -183,6 +198,7 @@ export class SearchService {
       let pageSearch = this.db
         .selectFrom('pages')
         .select(['id', 'slugId', 'title', 'icon', 'spaceId'])
+        .select((eb) => this.pageRepo.withSpace(eb))
         .where((eb) =>
           eb(
             sql`LOWER(f_unaccent(pages.title))`,
@@ -194,19 +210,33 @@ export class SearchService {
         .where('workspaceId', '=', workspaceId)
         .limit(limit);
 
-      // only search spaces the user has access to
+      // search all spaces the user has access to, prioritizing the current space
       const userSpaceIds = await this.spaceMemberRepo.getUserSpaceIds(userId);
 
-      if (suggestion?.spaceId) {
-        if (userSpaceIds.includes(suggestion.spaceId)) {
-          pageSearch = pageSearch.where('spaceId', '=', suggestion.spaceId);
-          pages = await pageSearch.execute();
-        }
-      } else if (userSpaceIds?.length > 0) {
-        // we need this check or the query will throw an error if the userSpaceIds array is empty
+      if (userSpaceIds?.length > 0) {
         pageSearch = pageSearch.where('spaceId', 'in', userSpaceIds);
+
+        if (suggestion?.spaceId) {
+          pageSearch = pageSearch.orderBy(
+            sql`CASE WHEN pages."space_id" = ${suggestion.spaceId} THEN 0 ELSE 1 END`,
+            'asc',
+          );
+        }
+
         pages = await pageSearch.execute();
       }
+
+      // Filter by page-level permissions
+      if (pages.length > 0) {
+        const pageIds = pages.map((p) => p.id);
+        const accessibleIds =
+          await this.pagePermissionRepo.filterAccessiblePageIds({
+            pageIds,
+            userId,
+          });
+        const accessibleSet = new Set(accessibleIds);
+        pages = pages.filter((p) => accessibleSet.has(p.id));
+      }
     }
 
     return { users, groups, pages };

apps/server/src/core/share/share.controller.ts

@@ -5,18 +5,14 @@ import {
   ForbiddenException,
   HttpCode,
   HttpStatus,
+  Inject,
   NotFoundException,
   Post,
   UseGuards,
 } from '@nestjs/common';
 import { AuthUser } from '../../common/decorators/auth-user.decorator';
 import { User, Workspace } from '@docmost/db/types/entity.types';
-import {
-  SpaceCaslAction,
-  SpaceCaslSubject,
-} from '../casl/interfaces/space-ability.type';
 import { AuthWorkspace } from '../../common/decorators/auth-workspace.decorator';
-import SpaceAbilityFactory from '../casl/abilities/space-ability.factory';
 import { ShareService } from './share.service';
 import {
   CreateShareDto,
@@ -26,22 +22,31 @@ import {
   UpdateShareDto,
 } from './dto/share.dto';
 import { PageRepo } from '@docmost/db/repos/page/page.repo';
+import { PagePermissionRepo } from '@docmost/db/repos/page/page-permission.repo';
+import { PageAccessService } from '../page/page-access/page-access.service';
 import { JwtAuthGuard } from '../../common/guards/jwt-auth.guard';
 import { Public } from '../../common/decorators/public.decorator';
 import { ShareRepo } from '@docmost/db/repos/share/share.repo';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
 import { EnvironmentService } from '../../integrations/environment/environment.service';
 import { hasLicenseOrEE } from '../../common/helpers';
+import { AuditEvent, AuditResource } from '../../common/events/audit-events';
+import {
+  AUDIT_SERVICE,
+  IAuditService,
+} from '../../integrations/audit/audit.service';
 
 @UseGuards(JwtAuthGuard)
 @Controller('shares')
 export class ShareController {
   constructor(
     private readonly shareService: ShareService,
-    private readonly spaceAbility: SpaceAbilityFactory,
     private readonly shareRepo: ShareRepo,
     private readonly pageRepo: PageRepo,
+    private readonly pagePermissionRepo: PagePermissionRepo,
+    private readonly pageAccessService: PageAccessService,
     private readonly environmentService: EnvironmentService,
+    @Inject(AUDIT_SERVICE) private readonly auditService: IAuditService,
   ) {}
 
   @HttpCode(HttpStatus.OK)
@@ -64,8 +69,18 @@ export class ShareController {
       throw new BadRequestException();
     }
 
+    const shareData = await this.shareService.getSharedPage(dto, workspace.id);
+
+    const sharingAllowed = await this.shareService.isSharingAllowed(
+      workspace.id,
+      shareData.share.spaceId,
+    );
+    if (!sharingAllowed) {
+      throw new NotFoundException('Shared page not found');
+    }
+
     return {
-      ...(await this.shareService.getSharedPage(dto, workspace.id)),
+      ...shareData,
       hasLicenseKey: hasLicenseOrEE({
         licenseKey: workspace.licenseKey,
         isCloud: this.environmentService.isCloud(),
@@ -86,6 +101,14 @@ export class ShareController {
       throw new NotFoundException('Share not found');
     }
 
+    const sharingAllowed = await this.shareService.isSharingAllowed(
+      share.workspaceId,
+      share.spaceId,
+    );
+    if (!sharingAllowed) {
+      throw new NotFoundException('Share not found');
+    }
+
     return share;
   }
 
@@ -101,10 +124,7 @@ export class ShareController {
       throw new NotFoundException('Shared page not found');
     }
 
-    const ability = await this.spaceAbility.createForUser(user, page.spaceId);
-    if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Share)) {
-      throw new ForbiddenException();
-    }
+    await this.pageAccessService.validateCanView(page, user);
 
     return this.shareService.getShareForPage(page.id, workspace.id);
   }
@@ -122,17 +142,46 @@ export class ShareController {
       throw new NotFoundException('Page not found');
     }
 
-    const ability = await this.spaceAbility.createForUser(user, page.spaceId);
-    if (ability.cannot(SpaceCaslAction.Create, SpaceCaslSubject.Share)) {
-      throw new ForbiddenException();
+    // User must be able to edit the page to create a share
+    //TODO: i dont think this is neccessary if we prevent restricted pages from getting shared
+    // rather, use space level permission and workspace/space level sharing restriction
+    await this.pageAccessService.validateCanEdit(page, user);
+
+    // Prevent sharing restricted pages
+    const isRestricted = await this.pagePermissionRepo.hasRestrictedAncestor(
+      page.id,
+    );
+    if (isRestricted) {
+      throw new BadRequestException('Cannot share a restricted page');
     }
 
-    return this.shareService.createShare({
+    const sharingAllowed = await this.shareService.isSharingAllowed(
+      workspace.id,
+      page.spaceId,
+    );
+    if (!sharingAllowed) {
+      throw new ForbiddenException('Public sharing is disabled');
+    }
+
+    const share = await this.shareService.createShare({
       page,
       authUserId: user.id,
       workspaceId: workspace.id,
       createShareDto,
     });
+
+    this.auditService.log({
+      event: AuditEvent.SHARE_CREATED,
+      resourceType: AuditResource.SHARE,
+      resourceId: share.id,
+      spaceId: page.spaceId,
+      metadata: {
+        pageId: page.id,
+        spaceId: page.spaceId,
+      },
+    });
+
+    return share;
   }
 
   @HttpCode(HttpStatus.OK)
@@ -144,11 +193,14 @@ export class ShareController {
       throw new NotFoundException('Share not found');
     }
 
-    const ability = await this.spaceAbility.createForUser(user, share.spaceId);
-    if (ability.cannot(SpaceCaslAction.Edit, SpaceCaslSubject.Share)) {
-      throw new ForbiddenException();
+    const page = await this.pageRepo.findById(share.pageId);
+    if (!page) {
+      throw new NotFoundException('Page not found');
     }
 
+    // User must be able to edit the page to update its share
+    await this.pageAccessService.validateCanEdit(page, user);
+
     return this.shareService.updateShare(share.id, updateShareDto);
   }
 
@@ -161,12 +213,28 @@ export class ShareController {
       throw new NotFoundException('Share not found');
     }
 
-    const ability = await this.spaceAbility.createForUser(user, share.spaceId);
-    if (ability.cannot(SpaceCaslAction.Manage, SpaceCaslSubject.Share)) {
-      throw new ForbiddenException();
+    const page = await this.pageRepo.findById(share.pageId);
+    if (!page) {
+      throw new NotFoundException('Page not found');
     }
 
+    // User must be able to edit the page to delete its share
+    await this.pageAccessService.validateCanEdit(page, user);
+
     await this.shareRepo.deleteShare(share.id);
+
+    this.auditService.log({
+      event: AuditEvent.SHARE_DELETED,
+      resourceType: AuditResource.SHARE,
+      resourceId: share.id,
+      spaceId: share.spaceId,
+      changes: {
+        before: {
+          pageId: share.pageId,
+          spaceId: share.spaceId,
+        },
+      },
+    });
   }
 
   @Public()
@@ -176,8 +244,21 @@ export class ShareController {
     @Body() dto: ShareIdDto,
     @AuthWorkspace() workspace: Workspace,
   ) {
+    const treeData = await this.shareService.getShareTree(
+      dto.shareId,
+      workspace.id,
+    );
+
+    const sharingAllowed = await this.shareService.isSharingAllowed(
+      workspace.id,
+      treeData.share.spaceId,
+    );
+    if (!sharingAllowed) {
+      throw new NotFoundException('Share not found');
+    }
+
     return {
-      ...(await this.shareService.getShareTree(dto.shareId, workspace.id)),
+      ...treeData,
       hasLicenseKey: hasLicenseOrEE({
         licenseKey: workspace.licenseKey,
         isCloud: this.environmentService.isCloud(),

apps/server/src/core/share/share.service.ts

@@ -19,6 +19,7 @@ import {
 } from '../../common/helpers/prosemirror/utils';
 import { Node } from '@tiptap/pm/model';
 import { ShareRepo } from '@docmost/db/repos/share/share.repo';
+import { PagePermissionRepo } from '@docmost/db/repos/page/page-permission.repo';
 import { updateAttachmentAttr } from './share.util';
 import { Page } from '@docmost/db/types/entity.types';
 import { validate as isValidUUID } from 'uuid';
@@ -31,6 +32,7 @@ export class ShareService {
   constructor(
     private readonly shareRepo: ShareRepo,
     private readonly pageRepo: PageRepo,
+    private readonly pagePermissionRepo: PagePermissionRepo,
     @InjectKysely() private readonly db: KyselyDB,
     private readonly tokenService: TokenService,
   ) {}
@@ -41,12 +43,20 @@ export class ShareService {
       throw new NotFoundException('Share not found');
     }
 
-    if (share.includeSubPages) {
-      const pageList = await this.pageRepo.getPageAndDescendants(share.pageId, {
-        includeContent: false,
-      });
+    const isRestricted =
+      await this.pagePermissionRepo.hasRestrictedAncestor(share.pageId);
+    if (isRestricted) {
+      throw new NotFoundException('Share not found');
+    }
 
-      return { share, pageTree: pageList };
+    if (share.includeSubPages) {
+      const pageTree =
+        await this.pageRepo.getPageAndDescendantsExcludingRestricted(
+          share.pageId,
+          { includeContent: false },
+        );
+
+      return { share, pageTree };
     } else {
       return { share, pageTree: [] };
     }
@@ -112,6 +122,13 @@ export class ShareService {
       throw new NotFoundException('Shared page not found');
     }
 
+    // Block access to restricted pages
+    const isRestricted =
+      await this.pagePermissionRepo.hasRestrictedAncestor(page.id);
+    if (isRestricted) {
+      throw new NotFoundException('Shared page not found');
+    }
+
     page.content = await this.updatePublicAttachments(page);
 
     return { page, share };
@@ -264,6 +281,31 @@ export class ShareService {
     return ancestor;
   }
 
+  async isSharingAllowed(
+    workspaceId: string,
+    spaceId: string,
+  ): Promise<boolean> {
+    const result = await this.db
+      .selectFrom('workspaces')
+      .innerJoin('spaces', 'spaces.workspaceId', 'workspaces.id')
+      .select([
+        'workspaces.settings as workspaceSettings',
+        'spaces.settings as spaceSettings',
+      ])
+      .where('workspaces.id', '=', workspaceId)
+      .where('spaces.id', '=', spaceId)
+      .executeTakeFirst();
+
+    if (!result) return false;
+
+    const workspaceDisabled =
+      (result.workspaceSettings as any)?.sharing?.disabled === true;
+    const spaceDisabled =
+      (result.spaceSettings as any)?.sharing?.disabled === true;
+
+    return !workspaceDisabled && !spaceDisabled;
+  }
+
   async updatePublicAttachments(page: Page): Promise<any> {
     const prosemirrorJson = getProsemirrorContent(page.content);
     const attachmentIds = getAttachmentIds(prosemirrorJson);

apps/server/src/core/space/dto/update-space.dto.ts

@@ -1,10 +1,14 @@
 import { PartialType } from '@nestjs/mapped-types';
 import { CreateSpaceDto } from './create-space.dto';
-import { IsNotEmpty, IsString, IsUUID } from 'class-validator';
+import { IsBoolean, IsNotEmpty, IsOptional, IsString, IsUUID } from 'class-validator';
 
 export class UpdateSpaceDto extends PartialType(CreateSpaceDto) {
   @IsString()
   @IsNotEmpty()
   @IsUUID()
   spaceId: string;
+
+  @IsOptional()
+  @IsBoolean()
+  disablePublicSharing: boolean;
 }

apps/server/src/core/space/services/space-member.service.ts

@@ -1,11 +1,13 @@
 import {
   BadRequestException,
+  Inject,
   Injectable,
   NotFoundException,
 } from '@nestjs/common';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
 import { KyselyDB, KyselyTransaction } from '@docmost/db/types/kysely.types';
 import { SpaceMemberRepo } from '@docmost/db/repos/space/space-member.repo';
+import { GroupUserRepo } from '@docmost/db/repos/group/group-user.repo';
 import { AddSpaceMembersDto } from '../dto/add-space-members.dto';
 import { InjectKysely } from 'nestjs-kysely';
 import { Space, SpaceMember, User } from '@docmost/db/types/entity.types';
@@ -13,14 +15,24 @@ import { SpaceRepo } from '@docmost/db/repos/space/space.repo';
 import { RemoveSpaceMemberDto } from '../dto/remove-space-member.dto';
 import { UpdateSpaceMemberRoleDto } from '../dto/update-space-member-role.dto';
 import { SpaceRole } from '../../../common/helpers/types/permission';
-import { PaginationResult } from '@docmost/db/pagination/pagination';
+import { CursorPaginationResult } from '@docmost/db/pagination/cursor-pagination';
+import { WatcherRepo } from '@docmost/db/repos/watcher/watcher.repo';
+import { executeTx } from '@docmost/db/utils';
+import { AuditEvent, AuditResource } from '../../../common/events/audit-events';
+import {
+  AUDIT_SERVICE,
+  IAuditService,
+} from '../../../integrations/audit/audit.service';
 
 @Injectable()
 export class SpaceMemberService {
   constructor(
     private spaceMemberRepo: SpaceMemberRepo,
+    private groupUserRepo: GroupUserRepo,
     private spaceRepo: SpaceRepo,
+    private watcherRepo: WatcherRepo,
     @InjectKysely() private readonly db: KyselyDB,
+    @Inject(AUDIT_SERVICE) private readonly auditService: IAuditService,
   ) {}
 
   async addUserToSpace(
@@ -68,18 +80,16 @@ export class SpaceMemberService {
     spaceId: string,
     workspaceId: string,
     pagination: PaginationOptions,
-  ) {
+  ): Promise<CursorPaginationResult<any>> {
     const space = await this.spaceRepo.findById(spaceId, workspaceId);
     if (!space) {
       throw new NotFoundException('Space not found');
     }
 
-    const members = await this.spaceMemberRepo.getSpaceMembersPaginated(
+    return await this.spaceMemberRepo.getSpaceMembersPaginated(
       spaceId,
       pagination,
     );
-
-    return members;
   }
 
   async addMembersToSpaceBatch(
@@ -87,7 +97,6 @@ export class SpaceMemberService {
     authUser: User,
     workspaceId: string,
   ): Promise<void> {
-    // await this.spaceService.findAndValidateSpace(spaceId, workspaceId);
 
     const space = await this.spaceRepo.findById(dto.spaceId, workspaceId);
     if (!space) {
@@ -161,8 +170,45 @@ export class SpaceMemberService {
 
     if (membersToAdd.length > 0) {
       await this.spaceMemberRepo.insertSpaceMember(membersToAdd);
-    } else {
-      // either they are already members or do not exist on the workspace
+
+      // Audit log for each member added
+      for (const user of validUsers) {
+        this.auditService.log({
+          event: AuditEvent.SPACE_MEMBER_ADDED,
+          resourceType: AuditResource.SPACE_MEMBER,
+          resourceId: dto.spaceId,
+          spaceId: dto.spaceId,
+          changes: {
+            after: { role: dto.role },
+          },
+          metadata: {
+            spaceId: dto.spaceId,
+            spaceName: space.name,
+            userId: user.id,
+            userName: user.name,
+            memberType: 'user',
+          },
+        });
+      }
+
+      for (const group of validGroups) {
+        this.auditService.log({
+          event: AuditEvent.SPACE_MEMBER_ADDED,
+          resourceType: AuditResource.SPACE_MEMBER,
+          resourceId: dto.spaceId,
+          spaceId: dto.spaceId,
+          changes: {
+            after: { role: dto.role },
+          },
+          metadata: {
+            spaceId: dto.spaceId,
+            spaceName: space.name,
+            groupId: group.id,
+            groupName: group.name,
+            memberType: 'group',
+          },
+        });
+      }
     }
   }
 
@@ -205,10 +251,45 @@ export class SpaceMemberService {
       await this.validateLastAdmin(dto.spaceId);
     }
 
-    await this.spaceMemberRepo.removeSpaceMemberById(
-      spaceMember.id,
-      dto.spaceId,
-    );
+    let affectedUserIds: string[] = [];
+    if (dto.userId) {
+      affectedUserIds = [dto.userId];
+    } else if (dto.groupId) {
+      affectedUserIds = await this.groupUserRepo.getUserIdsByGroupId(
+        dto.groupId,
+      );
+    }
+
+    await executeTx(this.db, async (trx) => {
+      await this.spaceMemberRepo.removeSpaceMemberById(
+        spaceMember.id,
+        dto.spaceId,
+        { trx },
+      );
+
+      await this.watcherRepo.deleteByUsersWithoutSpaceAccess(
+        affectedUserIds,
+        dto.spaceId,
+        { trx },
+      );
+    });
+
+    this.auditService.log({
+      event: AuditEvent.SPACE_MEMBER_REMOVED,
+      resourceType: AuditResource.SPACE_MEMBER,
+      resourceId: dto.spaceId,
+      spaceId: dto.spaceId,
+      changes: {
+        before: { role: spaceMember.role },
+      },
+      metadata: {
+        spaceId: dto.spaceId,
+        spaceName: space.name,
+        userId: spaceMember.userId,
+        groupId: spaceMember.groupId,
+        memberType: spaceMember.userId ? 'user' : 'group',
+      },
+    });
   }
 
   async updateSpaceMemberRole(
@@ -259,6 +340,24 @@ export class SpaceMemberService {
       spaceMember.id,
       dto.spaceId,
     );
+
+    this.auditService.log({
+      event: AuditEvent.SPACE_MEMBER_ROLE_CHANGED,
+      resourceType: AuditResource.SPACE_MEMBER,
+      resourceId: dto.spaceId,
+      spaceId: dto.spaceId,
+      changes: {
+        before: { role: spaceMember.role },
+        after: { role: dto.role },
+      },
+      metadata: {
+        spaceId: dto.spaceId,
+        spaceName: space.name,
+        userId: spaceMember.userId,
+        groupId: spaceMember.groupId,
+        memberType: spaceMember.userId ? 'user' : 'group',
+      },
+    });
   }
 
   async validateLastAdmin(spaceId: string): Promise<void> {
@@ -276,7 +375,7 @@ export class SpaceMemberService {
   async getUserSpaces(
     userId: string,
     pagination: PaginationOptions,
-  ): Promise<PaginationResult<Space>> {
-    return await this.spaceMemberRepo.getUserSpaces(userId, pagination);
+  ): Promise<CursorPaginationResult<Space>> {
+    return this.spaceMemberRepo.getUserSpaces(userId, pagination);
   }
 }

apps/server/src/core/space/services/space.service.ts

@@ -1,5 +1,7 @@
 import {
   BadRequestException,
+  ForbiddenException,
+  Inject,
   Injectable,
   NotFoundException,
 } from '@nestjs/common';
@@ -8,7 +10,6 @@ import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
 import { SpaceRepo } from '@docmost/db/repos/space/space.repo';
 import { KyselyDB, KyselyTransaction } from '@docmost/db/types/kysely.types';
 import { Space, User } from '@docmost/db/types/entity.types';
-import { PaginationResult } from '@docmost/db/pagination/pagination';
 import { UpdateSpaceDto } from '../dto/update-space.dto';
 import { executeTx } from '@docmost/db/utils';
 import { InjectKysely } from 'nestjs-kysely';
@@ -17,14 +18,28 @@ import { SpaceRole } from '../../../common/helpers/types/permission';
 import { QueueJob, QueueName } from 'src/integrations/queue/constants';
 import { Queue } from 'bullmq';
 import { InjectQueue } from '@nestjs/bullmq';
+import { CursorPaginationResult } from '@docmost/db/pagination/cursor-pagination';
+import { ShareRepo } from '@docmost/db/repos/share/share.repo';
+import { WorkspaceRepo } from '@docmost/db/repos/workspace/workspace.repo';
+import { LicenseCheckService } from '../../../integrations/environment/license-check.service';
+import { AuditEvent, AuditResource } from '../../../common/events/audit-events';
+import { diffAuditTrackedFields } from '../../../common/helpers';
+import {
+  AUDIT_SERVICE,
+  IAuditService,
+} from '../../../integrations/audit/audit.service';
 
 @Injectable()
 export class SpaceService {
   constructor(
     private spaceRepo: SpaceRepo,
     private spaceMemberService: SpaceMemberService,
+    private shareRepo: ShareRepo,
+    private workspaceRepo: WorkspaceRepo,
+    private licenseCheckService: LicenseCheckService,
     @InjectKysely() private readonly db: KyselyDB,
     @InjectQueue(QueueName.ATTACHMENT_QUEUE) private attachmentQueue: Queue,
+    @Inject(AUDIT_SERVICE) private readonly auditService: IAuditService,
   ) {}
 
   async createSpace(
@@ -56,6 +71,19 @@ export class SpaceService {
       trx,
     );
 
+    this.auditService.log({
+      event: AuditEvent.SPACE_CREATED,
+      resourceType: AuditResource.SPACE,
+      resourceId: space.id,
+      spaceId: space.id,
+      changes: {
+        after: {
+          name: space.name,
+          slug: space.slug,
+        },
+      },
+    });
+
     return { ...space, memberCount: 1 };
   }
 
@@ -105,15 +133,86 @@ export class SpaceService {
       }
     }
 
-    return await this.spaceRepo.updateSpace(
-      {
-        name: updateSpaceDto.name,
-        description: updateSpaceDto.description,
-        slug: updateSpaceDto.slug,
-      },
+    if (typeof updateSpaceDto.disablePublicSharing !== 'undefined') {
+      const workspace = await this.workspaceRepo.findById(workspaceId, {
+        withLicenseKey: true,
+      });
+
+      if (
+        !this.licenseCheckService.isValidEELicense(workspace.licenseKey)
+      ) {
+        throw new ForbiddenException(
+          'This feature requires a valid enterprise license',
+        );
+      }
+    }
+
+    const spaceBefore = await this.spaceRepo.findById(
       updateSpaceDto.spaceId,
       workspaceId,
     );
+    const settingsBefore = (spaceBefore?.settings ?? {}) as Record<string, any>;
+
+    const before: Record<string, any> = {};
+    const after: Record<string, any> = {};
+
+    let updatedSpace: Space;
+
+    await executeTx(this.db, async (trx) => {
+      if (typeof updateSpaceDto.disablePublicSharing !== 'undefined') {
+        const prev = settingsBefore?.sharing?.disabled ?? false;
+        if (prev !== updateSpaceDto.disablePublicSharing) {
+          before.disablePublicSharing = prev;
+          after.disablePublicSharing = updateSpaceDto.disablePublicSharing;
+        }
+
+        await this.spaceRepo.updateSharingSettings(
+          updateSpaceDto.spaceId,
+          workspaceId,
+          'disabled',
+          updateSpaceDto.disablePublicSharing,
+          trx,
+        );
+
+        if (updateSpaceDto.disablePublicSharing) {
+          await this.shareRepo.deleteBySpaceId(updateSpaceDto.spaceId, trx);
+        }
+      }
+
+      updatedSpace = await this.spaceRepo.updateSpace(
+        {
+          name: updateSpaceDto.name,
+          description: updateSpaceDto.description,
+          slug: updateSpaceDto.slug,
+        },
+        updateSpaceDto.spaceId,
+        workspaceId,
+        trx,
+      );
+    });
+
+    const columnChanges = diffAuditTrackedFields(
+      ['name', 'slug', 'description'],
+      updateSpaceDto,
+      spaceBefore,
+      updatedSpace,
+    );
+    if (columnChanges) {
+      Object.assign(before, columnChanges.before);
+      Object.assign(after, columnChanges.after);
+    }
+
+    if (Object.keys(after).length > 0) {
+      this.auditService.log({
+        event: AuditEvent.SPACE_UPDATED,
+        resourceType: AuditResource.SPACE,
+        resourceId: updateSpaceDto.spaceId,
+        spaceId: updateSpaceDto.spaceId,
+        changes: { before, after },
+      });
+    }
+
+    return updatedSpace;
   }
 
   async getSpaceInfo(spaceId: string, workspaceId: string): Promise<Space> {
@@ -130,13 +229,8 @@ export class SpaceService {
   async getWorkspaceSpaces(
     workspaceId: string,
     pagination: PaginationOptions,
-  ): Promise<PaginationResult<Space>> {
-    const spaces = await this.spaceRepo.getSpacesInWorkspace(
-      workspaceId,
-      pagination,
-    );
-
-    return spaces;
+  ): Promise<CursorPaginationResult<Space>> {
+    return this.spaceRepo.getSpacesInWorkspace(workspaceId, pagination);
   }
 
   async deleteSpace(spaceId: string, workspaceId: string): Promise<void> {
@@ -147,5 +241,19 @@ export class SpaceService {
 
     await this.spaceRepo.deleteSpace(spaceId, workspaceId);
     await this.attachmentQueue.add(QueueJob.DELETE_SPACE_ATTACHMENTS, space);
+
+    this.auditService.log({
+      event: AuditEvent.SPACE_DELETED,
+      resourceType: AuditResource.SPACE,
+      resourceId: spaceId,
+      spaceId: spaceId,
+      changes: {
+        before: {
+          name: space.name,
+          slug: space.slug,
+          description: space.description,
+        },
+      },
+    });
   }
 }

apps/server/src/core/space/space.module.ts

@@ -4,6 +4,7 @@ import { SpaceController } from './space.controller';
 import { SpaceMemberService } from './services/space-member.service';
 
 @Module({
+  imports: [],
   controllers: [SpaceController],
   providers: [SpaceService, SpaceMemberService],
   exports: [SpaceService, SpaceMemberService],

apps/server/src/core/user/user.service.ts

@@ -1,18 +1,27 @@
 import { UserRepo } from '@docmost/db/repos/user/user.repo';
 import {
   BadRequestException,
+  Inject,
   Injectable,
   NotFoundException,
   UnauthorizedException,
 } from '@nestjs/common';
 import { UpdateUserDto } from './dto/update-user.dto';
-import { comparePasswordHash } from 'src/common/helpers/utils';
+import { comparePasswordHash, diffAuditTrackedFields } from 'src/common/helpers/utils';
 import { Workspace } from '@docmost/db/types/entity.types';
 import { validateSsoEnforcement } from '../auth/auth.util';
+import { AuditEvent, AuditResource } from '../../common/events/audit-events';
+import {
+  AUDIT_SERVICE,
+  IAuditService,
+} from '../../integrations/audit/audit.service';
 
 @Injectable()
 export class UserService {
-  constructor(private userRepo: UserRepo) {}
+  constructor(
+    private userRepo: UserRepo,
+    @Inject(AUDIT_SERVICE) private readonly auditService: IAuditService,
+  ) {}
 
   async findById(userId: string, workspaceId: string) {
     return this.userRepo.findById(userId, workspaceId);
@@ -51,6 +60,8 @@ export class UserService {
       );
     }
 
+    const userBefore = { name: user.name, email: user.email, locale: user.locale };
+
     if (updateUserDto.name) {
       user.name = updateUserDto.name;
     }
@@ -91,6 +102,23 @@ export class UserService {
     delete updateUserDto.confirmPassword;
 
     await this.userRepo.updateUser(updateUserDto, userId, workspace.id);
+
+    const changes = diffAuditTrackedFields(
+      ['name', 'email'],
+      updateUserDto,
+      userBefore,
+      user,
+    );
+
+    if (changes) {
+      this.auditService.log({
+        event: AuditEvent.USER_UPDATED,
+        resourceType: AuditResource.USER,
+        resourceId: userId,
+        changes,
+      });
+    }
+
     return user;
   }
 }

apps/server/src/core/watcher/dto/watcher.dto.ts

@@ -0,0 +1,7 @@
+import { IsString, IsNotEmpty } from 'class-validator';
+
+export class WatcherPageDto {
+  @IsString()
+  @IsNotEmpty()
+  pageId: string;
+}

apps/server/src/core/watcher/watcher.controller.ts

@@ -0,0 +1,99 @@
+/***
+ import {
+  Body,
+  Controller,
+  ForbiddenException,
+  HttpCode,
+  HttpStatus,
+  NotFoundException,
+  Post,
+  UseGuards,
+} from '@nestjs/common';
+import { WatcherService } from './watcher.service';
+import { AuthUser } from '../../common/decorators/auth-user.decorator';
+import { AuthWorkspace } from '../../common/decorators/auth-workspace.decorator';
+import { JwtAuthGuard } from '../../common/guards/jwt-auth.guard';
+import { User, Workspace } from '@docmost/db/types/entity.types';
+import { WatcherPageDto } from './dto/watcher.dto';
+import { PageRepo } from '@docmost/db/repos/page/page.repo';
+import SpaceAbilityFactory from '../casl/abilities/space-ability.factory';
+import {
+  SpaceCaslAction,
+  SpaceCaslSubject,
+} from '../casl/interfaces/space-ability.type';
+
+
+@UseGuards(JwtAuthGuard)
+@Controller('pages')
+export class WatcherController {
+  constructor(
+    private readonly watcherService: WatcherService,
+    private readonly pageRepo: PageRepo,
+    private readonly spaceAbility: SpaceAbilityFactory,
+  ) {}
+
+  @HttpCode(HttpStatus.OK)
+  @Post('watch')
+  async watchPage(
+    @Body() dto: WatcherPageDto,
+    @AuthUser() user: User,
+    @AuthWorkspace() workspace: Workspace,
+  ) {
+    const page = await this.pageRepo.findById(dto.pageId);
+    if (!page) {
+      throw new NotFoundException('Page not found');
+    }
+
+    const ability = await this.spaceAbility.createForUser(user, page.spaceId);
+    if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Page)) {
+      throw new ForbiddenException();
+    }
+
+    await this.watcherService.watchPage(
+      user.id,
+      page.id,
+      page.spaceId,
+      workspace.id,
+    );
+
+    return { watching: true };
+  }
+
+  @HttpCode(HttpStatus.OK)
+  @Post('unwatch')
+  async unwatchPage(@Body() dto: WatcherPageDto, @AuthUser() user: User) {
+    const page = await this.pageRepo.findById(dto.pageId);
+    if (!page) {
+      throw new NotFoundException('Page not found');
+    }
+
+    const ability = await this.spaceAbility.createForUser(user, page.spaceId);
+    if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Page)) {
+      throw new ForbiddenException();
+    }
+
+    await this.watcherService.unwatchPage(user.id, page.id);
+
+    return { watching: false };
+  }
+
+  @HttpCode(HttpStatus.OK)
+  @Post('watch-status')
+  async getWatchStatus(@Body() dto: WatcherPageDto, @AuthUser() user: User) {
+    const page = await this.pageRepo.findById(dto.pageId);
+    if (!page) {
+      throw new NotFoundException('Page not found');
+    }
+
+    const ability = await this.spaceAbility.createForUser(user, page.spaceId);
+    if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Page)) {
+      throw new ForbiddenException();
+    }
+
+    const watching = await this.watcherService.isWatchingPage(user.id, page.id);
+
+    return { watching };
+  }
+
+}
+***/

apps/server/src/core/watcher/watcher.module.ts

@@ -0,0 +1,11 @@
+import { Module } from '@nestjs/common';
+import { WatcherService } from './watcher.service';
+import { CaslModule } from '../casl/casl.module';
+
+@Module({
+  imports: [CaslModule],
+  controllers: [],
+  providers: [WatcherService],
+  exports: [WatcherService],
+})
+export class WatcherModule {}

apps/server/src/core/watcher/watcher.service.ts

@@ -0,0 +1,99 @@
+import { Injectable } from '@nestjs/common';
+import {
+  WatcherRepo,
+  WatcherType,
+} from '@docmost/db/repos/watcher/watcher.repo';
+import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
+import { KyselyTransaction } from '@docmost/db/types/kysely.types';
+import { InsertableWatcher } from '@docmost/db/types/entity.types';
+
+@Injectable()
+export class WatcherService {
+  constructor(private readonly watcherRepo: WatcherRepo) {}
+
+  async watchPage(
+    userId: string,
+    pageId: string,
+    spaceId: string,
+    workspaceId: string,
+    trx?: KyselyTransaction,
+  ) {
+    const watcher: InsertableWatcher = {
+      userId,
+      pageId,
+      spaceId,
+      workspaceId,
+      type: WatcherType.PAGE,
+      addedById: userId,
+    };
+    return this.watcherRepo.upsert(watcher, trx);
+  }
+
+  async addPageWatchers(
+    userIds: string[],
+    pageId: string,
+    spaceId: string,
+    workspaceId: string,
+    trx?: KyselyTransaction,
+  ) {
+    if (userIds.length === 0) return;
+
+    const watchers: InsertableWatcher[] = userIds.map((userId) => ({
+      userId,
+      pageId,
+      spaceId,
+      workspaceId,
+      type: WatcherType.PAGE,
+      addedById: userId,
+    }));
+
+    return this.watcherRepo.insertMany(watchers, trx);
+  }
+
+  async unwatchPage(userId: string, pageId: string) {
+    return this.watcherRepo.mute(userId, pageId);
+  }
+
+  async isWatchingPage(userId: string, pageId: string): Promise<boolean> {
+    return this.watcherRepo.isWatching(userId, pageId);
+  }
+
+  async getPageWatchers(pageId: string, pagination: PaginationOptions) {
+    return this.watcherRepo.findPageWatchers(pageId, pagination);
+  }
+
+  async getPageWatcherIds(
+    pageId: string,
+    trx?: KyselyTransaction,
+  ): Promise<string[]> {
+    return this.watcherRepo.getPageWatcherIds(pageId, trx);
+  }
+
+  async countPageWatchers(pageId: string): Promise<number> {
+    return this.watcherRepo.countPageWatchers(pageId);
+  }
+
+  async cleanupOnSpaceAccessChange(
+    userIds: string[],
+    spaceId: string,
+    opts?: { trx?: KyselyTransaction },
+  ): Promise<void> {
+    const { trx } = opts;
+    await this.watcherRepo.deleteByUsersWithoutSpaceAccess(userIds, spaceId, {
+      trx,
+    });
+  }
+
+  async movePageWatchersToSpace(
+    pageIds: string[],
+    spaceId: string,
+    opts?: { trx?: KyselyTransaction },
+  ): Promise<void> {
+    await this.watcherRepo.updateSpaceIdByPageIds(spaceId, pageIds, opts);
+    await this.watcherRepo.deleteByPageIdsWithoutSpaceAccess(
+      pageIds,
+      spaceId,
+      opts,
+    );
+  }
+}

apps/server/src/core/workspace/controllers/workspace.controller.ts

@@ -109,6 +109,7 @@ export class WorkspaceController {
   @HttpCode(HttpStatus.OK)
   @Post('members/deactivate')
   async deactivateWorkspaceMember(
+    @Body() dto: RemoveWorkspaceUserDto,
     @AuthUser() user: User,
     @AuthWorkspace() workspace: Workspace,
   ) {
@@ -118,6 +119,23 @@ export class WorkspaceController {
     ) {
       throw new ForbiddenException();
     }
+    await this.workspaceService.deactivateUser(user, dto.userId, workspace.id);
+  }
+
+  @HttpCode(HttpStatus.OK)
+  @Post('members/activate')
+  async activateWorkspaceMember(
+    @Body() dto: RemoveWorkspaceUserDto,
+    @AuthUser() user: User,
+    @AuthWorkspace() workspace: Workspace,
+  ) {
+    const ability = this.workspaceAbility.createForUser(user, workspace);
+    if (
+      ability.cannot(WorkspaceCaslAction.Manage, WorkspaceCaslSubject.Member)
+    ) {
+      throw new ForbiddenException();
+    }
+    await this.workspaceService.activateUser(user, dto.userId, workspace.id);
   }
 
   @HttpCode(HttpStatus.OK)

apps/server/src/core/workspace/dto/update-workspace.dto.ts

@@ -1,6 +1,13 @@
 import { PartialType } from '@nestjs/mapped-types';
 import { CreateWorkspaceDto } from './create-workspace.dto';
-import { IsArray, IsBoolean, IsOptional, IsString } from 'class-validator';
+import {
+  IsArray,
+  IsBoolean,
+  IsInt,
+  IsOptional,
+  IsString,
+  Min,
+} from 'class-validator';
 
 export class UpdateWorkspaceDto extends PartialType(CreateWorkspaceDto) {
   @IsOptional()
@@ -30,4 +37,17 @@ export class UpdateWorkspaceDto extends PartialType(CreateWorkspaceDto) {
   @IsOptional()
   @IsBoolean()
   generativeAi: boolean;
+
+  @IsOptional()
+  @IsBoolean()
+  disablePublicSharing: boolean;
+
+  @IsOptional()
+  @IsBoolean()
+  mcpEnabled: boolean;
+
+  @IsOptional()
+  @IsInt()
+  @Min(1)
+  trashRetentionDays: number;
 }

apps/server/src/core/workspace/services/workspace-invitation.service.ts

@@ -1,5 +1,6 @@
 import {
   BadRequestException,
+  Inject,
   Injectable,
   Logger,
   NotFoundException,
@@ -23,7 +24,7 @@ import InvitationAcceptedEmail from '@docmost/transactional/emails/invitation-ac
 import { TokenService } from '../../auth/services/token.service';
 import { nanoIdGen } from '../../../common/helpers';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
-import { executeWithPagination } from '@docmost/db/pagination/pagination';
+import { executeWithCursorPagination } from '@docmost/db/pagination/cursor-pagination';
 import { DomainService } from 'src/integrations/environment/domain.service';
 import { InjectQueue } from '@nestjs/bullmq';
 import { QueueJob, QueueName } from '../../../integrations/queue/constants';
@@ -33,6 +34,11 @@ import {
   validateAllowedEmail,
   validateSsoEnforcement,
 } from '../../auth/auth.util';
+import { AuditEvent, AuditResource } from '../../../common/events/audit-events';
+import {
+  AUDIT_SERVICE,
+  IAuditService,
+} from '../../../integrations/audit/audit.service';
 
 @Injectable()
 export class WorkspaceInvitationService {
@@ -46,6 +52,7 @@ export class WorkspaceInvitationService {
     @InjectKysely() private readonly db: KyselyDB,
     @InjectQueue(QueueName.BILLING_QUEUE) private billingQueue: Queue,
     private readonly environmentService: EnvironmentService,
+    @Inject(AUDIT_SERVICE) private readonly auditService: IAuditService,
   ) {}
 
   async getInvitations(workspaceId: string, pagination: PaginationOptions) {
@@ -64,12 +71,13 @@ export class WorkspaceInvitationService {
       );
     }
 
-    const result = executeWithPagination(query, {
-      page: pagination.page,
+    return executeWithCursorPagination(query, {
       perPage: pagination.limit,
+      cursor: pagination.cursor,
+      beforeCursor: pagination.beforeCursor,
+      fields: [{ expression: 'id', direction: 'asc' }],
+      parseCursor: (cursor) => ({ id: cursor.id }),
     });
-
-    return result;
   }
 
   async getInvitationById(invitationId: string, workspace: Workspace) {
@@ -179,6 +187,24 @@ export class WorkspaceInvitationService {
           workspace.hostname,
         );
       });
+
+      // Audit log for each invitation created
+      for (const invitation of invites) {
+        this.auditService.log({
+          event: AuditEvent.WORKSPACE_INVITE_CREATED,
+          resourceType: AuditResource.WORKSPACE_INVITATION,
+          resourceId: invitation.id,
+          changes: {
+            after: {
+              email: invitation.email,
+              role: invitation.role,
+            },
+          },
+          metadata: {
+            groupIds: invitation.groupIds,
+          },
+        });
+      }
     }
   }
 
@@ -295,6 +321,23 @@ export class WorkspaceInvitationService {
       });
     }
 
+    this.auditService.log({
+      event: AuditEvent.USER_CREATED,
+      resourceType: AuditResource.USER,
+      resourceId: newUser.id,
+      changes: {
+        after: {
+          name: newUser.name,
+          email: newUser.email,
+          role: invitation.role,
+        },
+      },
+      metadata: {
+        source: 'invitation',
+        invitationId: invitation.id,
+      },
+    });
+
     if (this.environmentService.isCloud()) {
       await this.billingQueue.add(QueueJob.STRIPE_SEATS_SYNC, {
         workspaceId: workspace.id,
@@ -338,17 +381,48 @@ export class WorkspaceInvitationService {
       invitedByUser.name,
       workspace.hostname,
     );
+
+    this.auditService.log({
+      event: AuditEvent.WORKSPACE_INVITE_RESENT,
+      resourceType: AuditResource.WORKSPACE_INVITATION,
+      resourceId: invitation.id,
+      metadata: {
+        email: invitation.email,
+        role: invitation.role,
+      },
+    });
   }
 
   async revokeInvitation(
     invitationId: string,
     workspaceId: string,
   ): Promise<void> {
+    const invitation = await this.db
+      .selectFrom('workspaceInvitations')
+      .select(['id', 'email', 'role'])
+      .where('id', '=', invitationId)
+      .where('workspaceId', '=', workspaceId)
+      .executeTakeFirst();
+
     await this.db
       .deleteFrom('workspaceInvitations')
       .where('id', '=', invitationId)
       .where('workspaceId', '=', workspaceId)
       .execute();
+
+    if (invitation) {
+      this.auditService.log({
+        event: AuditEvent.WORKSPACE_INVITE_REVOKED,
+        resourceType: AuditResource.WORKSPACE_INVITATION,
+        resourceId: invitation.id,
+        changes: {
+          before: {
+            email: invitation.email,
+            role: invitation.role,
+          },
+        },
+      });
+    }
   }
 
   async getInvitationLinkById(

apps/server/src/core/workspace/services/workspace.service.ts

@@ -1,10 +1,12 @@
 import {
   BadRequestException,
   ForbiddenException,
+  Inject,
   Injectable,
   Logger,
   NotFoundException,
 } from '@nestjs/common';
+import { LicenseCheckService } from '../../../integrations/environment/license-check.service';
 import { CreateWorkspaceDto } from '../dto/create-workspace.dto';
 import { UpdateWorkspaceDto } from '../dto/update-workspace.dto';
 import { SpaceService } from '../../space/services/space.service';
@@ -19,7 +21,6 @@ import { User } from '@docmost/db/types/entity.types';
 import { GroupUserRepo } from '@docmost/db/repos/group/group-user.repo';
 import { GroupRepo } from '@docmost/db/repos/group/group.repo';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
-import { PaginationResult } from '@docmost/db/pagination/pagination';
 import { UpdateWorkspaceUserRoleDto } from '../dto/update-workspace-user-role.dto';
 import { UserRepo } from '@docmost/db/repos/user/user.repo';
 import { EnvironmentService } from '../../../integrations/environment/environment.service';
@@ -28,12 +29,22 @@ import { jsonArrayFrom } from 'kysely/helpers/postgres';
 import { addDays } from 'date-fns';
 import { DISALLOWED_HOSTNAMES, WorkspaceStatus } from '../workspace.constants';
 import { v4 } from 'uuid';
-import { AttachmentType } from 'src/core/attachment/attachment.constants';
 import { InjectQueue } from '@nestjs/bullmq';
 import { QueueJob, QueueName } from '../../../integrations/queue/constants';
 import { Queue } from 'bullmq';
-import { generateRandomSuffixNumbers } from '../../../common/helpers';
+import {
+  generateRandomSuffixNumbers,
+  diffAuditTrackedFields,
+} from '../../../common/helpers';
 import { isPageEmbeddingsTableExists } from '@docmost/db/helpers/helpers';
+import { CursorPaginationResult } from '@docmost/db/pagination/cursor-pagination';
+import { ShareRepo } from '@docmost/db/repos/share/share.repo';
+import { WatcherRepo } from '@docmost/db/repos/watcher/watcher.repo';
+import { AuditEvent, AuditResource } from '../../../common/events/audit-events';
+import {
+  AUDIT_SERVICE,
+  IAuditService,
+} from '../../../integrations/audit/audit.service';
 
 @Injectable()
 export class WorkspaceService {
@@ -48,10 +59,14 @@ export class WorkspaceService {
     private userRepo: UserRepo,
     private environmentService: EnvironmentService,
     private domainService: DomainService,
+    private licenseCheckService: LicenseCheckService,
+    private shareRepo: ShareRepo,
+    private watcherRepo: WatcherRepo,
     @InjectKysely() private readonly db: KyselyDB,
     @InjectQueue(QueueName.ATTACHMENT_QUEUE) private attachmentQueue: Queue,
     @InjectQueue(QueueName.BILLING_QUEUE) private billingQueue: Queue,
     @InjectQueue(QueueName.AI_QUEUE) private aiQueue: Queue,
+    @Inject(AUDIT_SERVICE) private readonly auditService: IAuditService,
   ) {}
 
   async findById(workspaceId: string) {
@@ -113,6 +128,7 @@ export class WorkspaceService {
         let status = undefined;
         let plan = undefined;
         let billingEmail = undefined;
+        let settings = undefined;
 
         if (this.environmentService.isCloud()) {
           // generate unique hostname
@@ -126,6 +142,7 @@ export class WorkspaceService {
           status = WorkspaceStatus.Active;
           plan = 'standard';
           billingEmail = user.email;
+          settings = { ai: { generative: true } };
         }
 
         // create workspace
@@ -138,6 +155,7 @@ export class WorkspaceService {
             trialEndAt,
             plan,
             billingEmail,
+            settings,
           },
           trx,
         );
@@ -272,7 +290,7 @@ export class WorkspaceService {
     if (updateWorkspaceDto.enforceSso) {
       const sso = await this.db
         .selectFrom('authProviders')
-        .selectAll()
+        .select(['id'])
         .where('isEnabled', '=', true)
         .where('workspaceId', '=', workspaceId)
         .execute();
@@ -287,9 +305,7 @@ export class WorkspaceService {
     if (updateWorkspaceDto.emailDomains) {
       const regex =
         /(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9][a-z0-9-]{0,61}[a-z0-9]/;
-
       const emailDomains = updateWorkspaceDto.emailDomains || [];
-
       updateWorkspaceDto.emailDomains = emailDomains
         .map((domain) => regex.exec(domain)?.[0])
         .filter(Boolean);
@@ -305,67 +321,187 @@ export class WorkspaceService {
       }
     }
 
-    if (typeof updateWorkspaceDto.restrictApiToAdmins !== 'undefined') {
-      await this.workspaceRepo.updateApiSettings(
-        workspaceId,
-        'restrictToAdmins',
-        updateWorkspaceDto.restrictApiToAdmins,
-      );
-      delete updateWorkspaceDto.restrictApiToAdmins;
-    }
+    const before: Record<string, any> = {};
+    const after: Record<string, any> = {};
 
-    if (typeof updateWorkspaceDto.aiSearch !== 'undefined') {
-      await this.workspaceRepo.updateAiSettings(
-        workspaceId,
-        'search',
-        updateWorkspaceDto.aiSearch,
-      );
+    if (
+      typeof updateWorkspaceDto.disablePublicSharing !== 'undefined' ||
+      typeof updateWorkspaceDto.trashRetentionDays !== 'undefined' ||
+      typeof updateWorkspaceDto.mcpEnabled !== 'undefined' ||
+      typeof updateWorkspaceDto.restrictApiToAdmins !== 'undefined'
+    ) {
+      const ws = await this.db
+        .selectFrom('workspaces')
+        .select(['id', 'licenseKey', 'trashRetentionDays'])
+        .where('id', '=', workspaceId)
+        .executeTakeFirst();
 
-      if (updateWorkspaceDto.aiSearch) {
-        const tableExists = await isPageEmbeddingsTableExists(this.db);
-        if (!tableExists) {
-          throw new BadRequestException(
-            'Failed to activate. Make sure pgvector postgres extension is installed.',
-          );
-        }
-
-        await this.aiQueue.add(QueueJob.WORKSPACE_CREATE_EMBEDDINGS, {
-          workspaceId,
-        });
-      } else {
-        // Schedule deletion after 24 hours
-        const deleteJobId = `ai-search-disabled-${workspaceId}`;
-        await this.aiQueue.add(
-          QueueJob.WORKSPACE_DELETE_EMBEDDINGS,
-          { workspaceId },
-          {
-            jobId: deleteJobId,
-            delay: 24 * 60 * 60 * 1000,
-            removeOnComplete: true,
-            removeOnFail: true,
-          },
+      if (!this.licenseCheckService.isValidEELicense(ws.licenseKey)) {
+        throw new ForbiddenException(
+          'This feature requires a valid enterprise license',
         );
       }
 
+      if (
+        typeof updateWorkspaceDto.trashRetentionDays !== 'undefined' &&
+        updateWorkspaceDto.trashRetentionDays !== ws.trashRetentionDays
+      ) {
+        before.trashRetentionDays = ws.trashRetentionDays;
+        after.trashRetentionDays = updateWorkspaceDto.trashRetentionDays;
+      }
+    }
+
+    if (updateWorkspaceDto.aiSearch) {
+      const tableExists = await isPageEmbeddingsTableExists(this.db);
+      if (!tableExists) {
+        throw new BadRequestException(
+          'Failed to activate. Make sure pgvector postgres extension is installed.',
+        );
+      }
+    }
+
+    const workspaceBefore = await this.workspaceRepo.findById(workspaceId);
+    const settingsBefore = (workspaceBefore?.settings ?? {}) as Record<
+      string,
+      any
+    >;
+
+    await executeTx(this.db, async (trx) => {
+      if (typeof updateWorkspaceDto.restrictApiToAdmins !== 'undefined') {
+        const prev = settingsBefore?.api?.restrictToAdmins ?? false;
+        if (prev !== updateWorkspaceDto.restrictApiToAdmins) {
+          before.restrictApiToAdmins = prev;
+          after.restrictApiToAdmins = updateWorkspaceDto.restrictApiToAdmins;
+        }
+        await this.workspaceRepo.updateApiSettings(
+          workspaceId,
+          'restrictToAdmins',
+          updateWorkspaceDto.restrictApiToAdmins,
+          trx,
+        );
+      }
+
+      if (typeof updateWorkspaceDto.aiSearch !== 'undefined') {
+        const prev = settingsBefore?.ai?.search ?? false;
+        if (prev !== updateWorkspaceDto.aiSearch) {
+          before.aiSearch = prev;
+          after.aiSearch = updateWorkspaceDto.aiSearch;
+        }
+        await this.workspaceRepo.updateAiSettings(
+          workspaceId,
+          'search',
+          updateWorkspaceDto.aiSearch,
+          trx,
+        );
+      }
+
+      if (typeof updateWorkspaceDto.generativeAi !== 'undefined') {
+        const prev = settingsBefore?.ai?.generative ?? false;
+        if (prev !== updateWorkspaceDto.generativeAi) {
+          before.generativeAi = prev;
+          after.generativeAi = updateWorkspaceDto.generativeAi;
+        }
+        await this.workspaceRepo.updateAiSettings(
+          workspaceId,
+          'generative',
+          updateWorkspaceDto.generativeAi,
+          trx,
+        );
+      }
+
+      if (typeof updateWorkspaceDto.disablePublicSharing !== 'undefined') {
+        const prev = settingsBefore?.sharing?.disabled ?? false;
+        if (prev !== updateWorkspaceDto.disablePublicSharing) {
+          before.disablePublicSharing = prev;
+          after.disablePublicSharing = updateWorkspaceDto.disablePublicSharing;
+        }
+        await this.workspaceRepo.updateSharingSettings(
+          workspaceId,
+          'disabled',
+          updateWorkspaceDto.disablePublicSharing,
+          trx,
+        );
+        if (updateWorkspaceDto.disablePublicSharing) {
+          await this.shareRepo.deleteByWorkspaceId(workspaceId, trx);
+        }
+      }
+
+      if (typeof updateWorkspaceDto.mcpEnabled !== 'undefined') {
+        const prev = settingsBefore?.ai?.mcp ?? false;
+        if (prev !== updateWorkspaceDto.mcpEnabled) {
+          before.mcpEnabled = prev;
+          after.mcpEnabled = updateWorkspaceDto.mcpEnabled;
+        }
+        await this.workspaceRepo.updateAiSettings(
+          workspaceId,
+          'mcp',
+          updateWorkspaceDto.mcpEnabled,
+          trx,
+        );
+      }
+
+      delete updateWorkspaceDto.restrictApiToAdmins;
       delete updateWorkspaceDto.aiSearch;
-    }
-
-    if (typeof updateWorkspaceDto.generativeAi !== 'undefined') {
-      await this.workspaceRepo.updateAiSettings(
-        workspaceId,
-        'generative',
-        updateWorkspaceDto.generativeAi,
-      );
       delete updateWorkspaceDto.generativeAi;
-    }
+      delete updateWorkspaceDto.disablePublicSharing;
+      delete updateWorkspaceDto.mcpEnabled;
 
-    await this.workspaceRepo.updateWorkspace(updateWorkspaceDto, workspaceId);
+      await this.workspaceRepo.updateWorkspace(
+        updateWorkspaceDto,
+        workspaceId,
+        trx,
+      );
+    });
+
+    if (after.aiSearch === true) {
+      await this.aiQueue.add(QueueJob.WORKSPACE_CREATE_EMBEDDINGS, {
+        workspaceId,
+      });
+    } else if (after.aiSearch === false) {
+      const deleteJobId = `ai-search-disabled-${workspaceId}`;
+      await this.aiQueue.add(
+        QueueJob.WORKSPACE_DELETE_EMBEDDINGS,
+        { workspaceId },
+        {
+          jobId: deleteJobId,
+          delay: 24 * 60 * 60 * 1000,
+          removeOnComplete: true,
+          removeOnFail: true,
+        },
+      );
+    }
 
     const workspace = await this.workspaceRepo.findById(workspaceId, {
       withMemberCount: true,
       withLicenseKey: true,
     });
 
+    const columnChanges = diffAuditTrackedFields(
+      [
+        'name',
+        'logo',
+        'enforceSso',
+        'enforceMfa',
+        'emailDomains',
+      ],
+      updateWorkspaceDto,
+      workspaceBefore,
+      workspace,
+    );
+    if (columnChanges) {
+      Object.assign(before, columnChanges.before);
+      Object.assign(after, columnChanges.after);
+    }
+
+    if (Object.keys(after).length > 0) {
+      this.auditService.log({
+        event: AuditEvent.WORKSPACE_UPDATED,
+        resourceType: AuditResource.WORKSPACE,
+        resourceId: workspaceId,
+        changes: { before, after },
+      });
+    }
+
     const { licenseKey, ...rest } = workspace;
     return {
       ...rest,
@@ -376,13 +512,8 @@ export class WorkspaceService {
   async getWorkspaceUsers(
     workspaceId: string,
     pagination: PaginationOptions,
-  ): Promise<PaginationResult<User>> {
-    const users = await this.userRepo.getUsersPaginated(
-      workspaceId,
-      pagination,
-    );
-
-    return users;
+  ): Promise<CursorPaginationResult<User>> {
+    return this.userRepo.getUsersPaginated(workspaceId, pagination);
   }
 
   async updateWorkspaceUserRole(
@@ -428,6 +559,16 @@ export class WorkspaceService {
       user.id,
       workspaceId,
     );
+
+    this.auditService.log({
+      event: AuditEvent.USER_ROLE_CHANGED,
+      resourceType: AuditResource.USER,
+      resourceId: user.id,
+      changes: {
+        before: { role: user.role },
+        after: { role: newRole },
+      },
+    });
   }
 
   async generateHostname(
@@ -476,6 +617,105 @@ export class WorkspaceService {
     return { hostname: this.domainService.getUrl(hostname) };
   }
 
+  async deactivateUser(
+    authUser: User,
+    userId: string,
+    workspaceId: string,
+  ): Promise<void> {
+    const user = await this.userRepo.findById(userId, workspaceId);
+
+    if (!user || user.deletedAt) {
+      throw new BadRequestException('Workspace member not found');
+    }
+
+    if (user.deactivatedAt) {
+      throw new BadRequestException('User is already deactivated');
+    }
+
+    if (authUser.id === userId) {
+      throw new BadRequestException('You cannot deactivate yourself');
+    }
+
+    if (authUser.role === UserRole.ADMIN && user.role === UserRole.OWNER) {
+      throw new BadRequestException(
+        'You cannot deactivate a user with owner role',
+      );
+    }
+
+    if (user.role === UserRole.OWNER) {
+      const workspaceOwnerCount = await this.userRepo.roleCountByWorkspaceId(
+        UserRole.OWNER,
+        workspaceId,
+      );
+
+      if (workspaceOwnerCount === 1) {
+        throw new BadRequestException(
+          'There must be at least one workspace owner',
+        );
+      }
+    }
+
+    await this.userRepo.updateUser(
+      { deactivatedAt: new Date() },
+      userId,
+      workspaceId,
+    );
+
+    this.auditService.log({
+      event: AuditEvent.USER_DEACTIVATED,
+      resourceType: AuditResource.USER,
+      resourceId: user.id,
+      changes: {
+        before: {
+          name: user.name,
+          email: user.email,
+          role: user.role,
+        },
+      },
+    });
+  }
+
+  async activateUser(
+    authUser: User,
+    userId: string,
+    workspaceId: string,
+  ): Promise<void> {
+    const user = await this.userRepo.findById(userId, workspaceId);
+
+    if (!user || user.deletedAt) {
+      throw new BadRequestException('Workspace member not found');
+    }
+
+    if (!user.deactivatedAt) {
+      throw new BadRequestException('User is not deactivated');
+    }
+
+    if (authUser.role === UserRole.ADMIN && user.role === UserRole.OWNER) {
+      throw new BadRequestException(
+        'You cannot activate a user with owner role',
+      );
+    }
+
+    await this.userRepo.updateUser(
+      { deactivatedAt: null },
+      userId,
+      workspaceId,
+    );
+
+    this.auditService.log({
+      event: AuditEvent.USER_ACTIVATED,
+      resourceType: AuditResource.USER,
+      resourceId: user.id,
+      changes: {
+        before: {
+          name: user.name,
+          email: user.email,
+          role: user.role,
+        },
+      },
+    });
+  }
+
   async deleteUser(
     authUser: User,
     userId: string,
@@ -529,6 +769,23 @@ export class WorkspaceService {
         .deleteFrom('authAccounts')
         .where('userId', '=', userId)
         .execute();
+
+      await this.watcherRepo.deleteByUserAndWorkspace(userId, workspaceId, {
+        trx,
+      });
+    });
+
+    this.auditService.log({
+      event: AuditEvent.USER_DELETED,
+      resourceType: AuditResource.USER,
+      resourceId: user.id,
+      changes: {
+        before: {
+          name: user.name,
+          email: user.email,
+          role: user.role,
+        },
+      },
     });
 
     try {

apps/server/src/database/database.module.ts

@@ -1,10 +1,4 @@
-import {
-  Global,
-  Logger,
-  Module,
-  OnApplicationBootstrap,
-  BeforeApplicationShutdown,
-} from '@nestjs/common';
+import { Global, Logger, Module, OnApplicationBootstrap } from '@nestjs/common';
 import { InjectKysely, KyselyModule } from 'nestjs-kysely';
 import { EnvironmentService } from '../integrations/environment/environment.service';
 import { CamelCasePlugin, LogEvent, sql } from 'kysely';
@@ -15,6 +9,7 @@ import { GroupUserRepo } from '@docmost/db/repos/group/group-user.repo';
 import { SpaceRepo } from '@docmost/db/repos/space/space.repo';
 import { SpaceMemberRepo } from '@docmost/db/repos/space/space-member.repo';
 import { PageRepo } from './repos/page/page.repo';
+import { PagePermissionRepo } from './repos/page/page-permission.repo';
 import { CommentRepo } from './repos/comment/comment.repo';
 import { PageHistoryRepo } from './repos/page/page-history.repo';
 import { AttachmentRepo } from './repos/attachment/attachment.repo';
@@ -24,6 +19,8 @@ import { MigrationService } from '@docmost/db/services/migration.service';
 import { UserTokenRepo } from './repos/user-token/user-token.repo';
 import { BacklinkRepo } from '@docmost/db/repos/backlink/backlink.repo';
 import { ShareRepo } from '@docmost/db/repos/share/share.repo';
+import { NotificationRepo } from '@docmost/db/repos/notification/notification.repo';
+import { WatcherRepo } from '@docmost/db/repos/watcher/watcher.repo';
 import { PageListener } from '@docmost/db/listeners/page.listener';
 import { PostgresJSDialect } from 'kysely-postgres-js';
 import * as postgres from 'postgres';
@@ -74,12 +71,15 @@ import { normalizePostgresUrl } from '../common/helpers';
     SpaceRepo,
     SpaceMemberRepo,
     PageRepo,
+    PagePermissionRepo,
     PageHistoryRepo,
     CommentRepo,
     AttachmentRepo,
     UserTokenRepo,
     BacklinkRepo,
     ShareRepo,
+    NotificationRepo,
+    WatcherRepo,
     PageListener,
   ],
   exports: [
@@ -90,17 +90,18 @@ import { normalizePostgresUrl } from '../common/helpers';
     SpaceRepo,
     SpaceMemberRepo,
     PageRepo,
+    PagePermissionRepo,
     PageHistoryRepo,
     CommentRepo,
     AttachmentRepo,
     UserTokenRepo,
     BacklinkRepo,
     ShareRepo,
+    NotificationRepo,
+    WatcherRepo,
   ],
 })
-export class DatabaseModule
-  implements OnApplicationBootstrap, BeforeApplicationShutdown
-{
+export class DatabaseModule implements OnApplicationBootstrap {
   private readonly logger = new Logger(DatabaseModule.name);
 
   constructor(
@@ -117,12 +118,6 @@ export class DatabaseModule
     }
   }
 
-  async beforeApplicationShutdown(): Promise<void> {
-    if (this.db) {
-      await this.db.destroy();
-    }
-  }
-
   async establishConnection() {
     const retryAttempts = 15;
     const retryDelay = 3000;

apps/server/src/database/migrations/20260205T214213-add-settings-to-spaces.ts

@@ -0,0 +1,9 @@
+import { Kysely } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema.alterTable('spaces').addColumn('settings', 'jsonb').execute();
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await db.schema.alterTable('spaces').dropColumn('settings').execute();
+}

apps/server/src/database/migrations/20260209T120000-add-contributor_ids-to-page-history.ts

@@ -0,0 +1,15 @@
+import { type Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .alterTable('page_history')
+    .addColumn('contributor_ids', sql`uuid[]`, (col) => col.defaultTo('{}'))
+    .execute();
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .alterTable('page_history')
+    .dropColumn('contributor_ids')
+    .execute();
+}

apps/server/src/database/migrations/20260213T085259-notifications.ts

@@ -0,0 +1,53 @@
+import { type Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .createTable('notifications')
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('user_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('cascade').notNull(),
+    )
+    .addColumn('workspace_id', 'uuid', (col) =>
+      col.references('workspaces.id').onDelete('cascade').notNull(),
+    )
+    .addColumn('type', 'text', (col) => col.notNull())
+    .addColumn('actor_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('set null'),
+    )
+    .addColumn('page_id', 'uuid', (col) =>
+      col.references('pages.id').onDelete('cascade'),
+    )
+    .addColumn('space_id', 'uuid', (col) =>
+      col.references('spaces.id').onDelete('cascade'),
+    )
+    .addColumn('comment_id', 'uuid', (col) =>
+      col.references('comments.id').onDelete('cascade'),
+    )
+    .addColumn('data', 'jsonb')
+    .addColumn('read_at', 'timestamptz')
+    .addColumn('emailed_at', 'timestamptz')
+    .addColumn('archived_at', 'timestamptz')
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .execute();
+
+  await db.schema
+    .createIndex('idx_notifications_user_id')
+    .on('notifications')
+    .columns(['user_id', 'id desc'])
+    .execute();
+
+  await db.schema
+    .createIndex('idx_notifications_user_unread')
+    .on('notifications')
+    .column('user_id')
+    .where(sql.ref('read_at'), 'is', null)
+    .execute();
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await db.schema.dropTable('notifications').execute();
+}

apps/server/src/database/migrations/20260213T085320-watchers.ts

@@ -0,0 +1,57 @@
+import { type Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .createTable('watchers')
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('user_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('cascade').notNull(),
+    )
+    .addColumn('page_id', 'uuid', (col) =>
+      col.references('pages.id').onDelete('cascade'),
+    )
+    .addColumn('space_id', 'uuid', (col) =>
+      col.references('spaces.id').onDelete('cascade').notNull(),
+    )
+    .addColumn('workspace_id', 'uuid', (col) =>
+      col.references('workspaces.id').onDelete('cascade').notNull(),
+    )
+    .addColumn('type', 'text', (col) => col.notNull())
+    .addColumn('added_by_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('set null'),
+    )
+    .addColumn('muted_at', 'timestamptz')
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .execute();
+
+  await db.schema
+    .createIndex('idx_watchers_user_page')
+    .on('watchers')
+    .columns(['user_id', 'page_id'])
+    .unique()
+    .where('page_id', 'is not', null)
+    .execute();
+
+  await db.schema
+    .createIndex('idx_watchers_user_space')
+    .on('watchers')
+    .columns(['user_id', 'space_id'])
+    .unique()
+    .where(sql.ref('page_id'), 'is', null)
+    .execute();
+
+  // Query index for fetching watchers by page
+  await db.schema
+    .createIndex('idx_watchers_page_id')
+    .on('watchers')
+    .column('page_id')
+    .execute();
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await db.schema.dropTable('watchers').execute();
+}

apps/server/src/database/migrations/20260213T085337-backfill-watchers.ts

@@ -0,0 +1,29 @@
+import { type Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  // Backfill watchers from pages.contributorIds and pages.creatorId
+  // This inserts unique user-page combinations from both sources
+  await sql`
+    INSERT INTO watchers (user_id, page_id, space_id, workspace_id, type, added_by_id)
+    SELECT DISTINCT
+      u.user_id,
+      p.id as page_id,
+      p.space_id,
+      p.workspace_id,
+      'page' as type,
+      u.user_id as added_by_id
+    FROM pages p
+    CROSS JOIN LATERAL (
+      SELECT unnest(p.contributor_ids) as user_id
+      UNION
+      SELECT p.creator_id as user_id WHERE p.creator_id IS NOT NULL
+    ) u
+    WHERE p.deleted_at IS NULL
+      AND u.user_id IS NOT NULL
+    ON CONFLICT DO NOTHING
+  `.execute(db);
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await sql`DELETE FROM watchers WHERE type = 'page'`.execute(db);
+}

apps/server/src/database/migrations/20260224T233803-page-permissions.ts

@@ -0,0 +1,90 @@
+import { Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .createTable('page_access')
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('page_id', 'uuid', (col) =>
+      col.notNull().unique().references('pages.id').onDelete('cascade'),
+    )
+    .addColumn('workspace_id', 'uuid', (col) =>
+      col.notNull().references('workspaces.id').onDelete('cascade'),
+    )
+    .addColumn('space_id', 'uuid', (col) =>
+      col.notNull().references('spaces.id').onDelete('cascade'),
+    )
+    .addColumn('access_level', 'varchar', (col) => col.notNull())
+    .addColumn('creator_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('set null'),
+    )
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addColumn('updated_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .execute();
+
+  await db.schema
+    .createTable('page_permissions')
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('page_access_id', 'uuid', (col) =>
+      col.notNull().references('page_access.id').onDelete('cascade'),
+    )
+    .addColumn('user_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('cascade'),
+    )
+    .addColumn('group_id', 'uuid', (col) =>
+      col.references('groups.id').onDelete('cascade'),
+    )
+    .addColumn('role', 'varchar', (col) => col.notNull())
+    .addColumn('added_by_id', 'uuid', (col) =>
+      col.references('users.id').onDelete('set null'),
+    )
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addColumn('updated_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .addUniqueConstraint('page_access_user_unique', [
+      'page_access_id',
+      'user_id',
+    ])
+    .addUniqueConstraint('page_access_group_unique', [
+      'page_access_id',
+      'group_id',
+    ])
+    .addCheckConstraint(
+      'allow_either_user_id_or_group_id_check',
+      sql`((user_id IS NOT NULL AND group_id IS NULL) OR (user_id IS NULL AND group_id IS NOT NULL))`,
+    )
+    .execute();
+
+  await db.schema
+    .createIndex('idx_page_access_space')
+    .on('page_access')
+    .column('space_id')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_page_permissions_user')
+    .on('page_permissions')
+    .column('user_id')
+    .execute();
+
+  await db.schema
+    .createIndex('idx_page_permissions_group')
+    .on('page_permissions')
+    .column('group_id')
+    .execute();
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await db.schema.dropTable('page_permissions').ifExists().execute();
+  await db.schema.dropTable('page_access').ifExists().execute();
+}

apps/server/src/database/migrations/20260228T223532-audit.ts

@@ -0,0 +1,60 @@
+import { Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .createTable('audit')
+    .ifNotExists()
+    .addColumn('id', 'uuid', (col) =>
+      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
+    )
+    .addColumn('workspace_id', 'uuid', (col) =>
+      col.notNull().references('workspaces.id').onDelete('cascade'),
+    )
+    .addColumn('actor_id', 'uuid')
+    .addColumn('actor_type', 'varchar', (col) =>
+      col.notNull().defaultTo('user'),
+    )
+    .addColumn('event', 'varchar', (col) => col.notNull())
+    .addColumn('resource_type', 'varchar', (col) => col.notNull())
+    .addColumn('resource_id', 'uuid')
+    .addColumn('space_id', 'uuid')
+    .addColumn('changes', 'jsonb')
+    .addColumn('metadata', 'jsonb')
+    .addColumn('ip_address', sql`inet`)
+    .addColumn('created_at', 'timestamptz', (col) =>
+      col.notNull().defaultTo(sql`now()`),
+    )
+    .execute();
+
+  await db.schema
+    .createIndex('idx_audit_workspace_id')
+    .ifNotExists()
+    .on('audit')
+    .columns(['workspace_id', 'id desc'])
+    .execute();
+
+  // add new workspace columns
+  await db.schema
+    .alterTable('workspaces')
+    .addColumn('audit_retention_days', 'int8', (col) => col)
+    .execute();
+
+  await db.schema
+    .alterTable('workspaces')
+    .addColumn('trash_retention_days', 'int8', (col) => col)
+    .execute();
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await db.schema
+    .alterTable('workspaces')
+    .dropColumn('audit_retention_days')
+    .execute();
+
+  await db.schema
+    .alterTable('workspaces')
+    .dropColumn('trash_retention_days')
+    .execute();
+
+  await db.schema.dropTable('audit').execute();
+}

apps/server/src/database/pagination/cursor-pagination.ts

@@ -0,0 +1,363 @@
+// adapted from https://github.com/charlie-hadden/kysely-paginate/blob/main/src/cursor.ts - MIT
+import {
+  OrderByDirection,
+  OrderByModifiers,
+  ReferenceExpression,
+  SelectQueryBuilder,
+  StringReference,
+} from 'kysely';
+
+type SortField<DB, TB extends keyof DB, O> =
+  | {
+      expression:
+        | (StringReference<DB, TB> & keyof O & string)
+        | (StringReference<DB, TB> & `${string}.${keyof O & string}`);
+      direction: OrderByDirection;
+      orderModifier?: OrderByModifiers;
+      key?: keyof O & string;
+    }
+  | {
+      expression: ReferenceExpression<DB, TB>;
+      direction: OrderByDirection;
+      orderModifier?: OrderByModifiers;
+      key: keyof O & string;
+    };
+
+type ExtractSortFieldKey<
+  DB,
+  TB extends keyof DB,
+  O,
+  T extends SortField<DB, TB, O>,
+> = T['key'] extends keyof O & string
+  ? T['key']
+  : T['expression'] extends keyof O & string
+    ? T['expression']
+    : T['expression'] extends `${string}.${infer K}`
+      ? K extends keyof O & string
+        ? K
+        : never
+      : never;
+
+type Fields<DB, TB extends keyof DB, O> = ReadonlyArray<
+  Readonly<SortField<DB, TB, O>>
+>;
+
+type FieldNames<DB, TB extends keyof DB, O, T extends Fields<DB, TB, O>> = {
+  [TIndex in keyof T]: ExtractSortFieldKey<DB, TB, O, T[TIndex]>;
+};
+
+type EncodeCursorValues<
+  DB,
+  TB extends keyof DB,
+  O,
+  T extends Fields<DB, TB, O>,
+> = {
+  [TIndex in keyof T]: [
+    ExtractSortFieldKey<DB, TB, O, T[TIndex]>,
+    O[ExtractSortFieldKey<DB, TB, O, T[TIndex]>],
+  ];
+};
+
+export type CursorEncoder<
+  DB,
+  TB extends keyof DB,
+  O,
+  T extends Fields<DB, TB, O>,
+> = (values: EncodeCursorValues<DB, TB, O, T>) => string;
+
+type DecodedCursor<DB, TB extends keyof DB, O, T extends Fields<DB, TB, O>> = {
+  [TField in ExtractSortFieldKey<DB, TB, O, T[number]>]: string;
+};
+
+export type CursorDecoder<
+  DB,
+  TB extends keyof DB,
+  O,
+  T extends Fields<DB, TB, O>,
+> = (
+  cursor: string,
+  fields: FieldNames<DB, TB, O, T>,
+) => DecodedCursor<DB, TB, O, T>;
+
+type ParsedCursorValues<
+  DB,
+  TB extends keyof DB,
+  O,
+  T extends Fields<DB, TB, O>,
+> = {
+  [TField in ExtractSortFieldKey<DB, TB, O, T[number]>]: O[TField];
+};
+
+export type CursorParser<
+  DB,
+  TB extends keyof DB,
+  O,
+  T extends Fields<DB, TB, O>,
+> = (cursor: DecodedCursor<DB, TB, O, T>) => ParsedCursorValues<DB, TB, O, T>;
+
+type CursorPaginationResultRow<
+  TRow,
+  TCursorKey extends string | boolean | undefined,
+> = TRow & {
+  [K in TCursorKey extends undefined
+    ? never
+    : TCursorKey extends false
+      ? never
+      : TCursorKey extends true
+        ? '$cursor'
+        : TCursorKey]: string;
+};
+
+type CursorPaginationMeta = {
+  limit: number;
+  hasNextPage: boolean;
+  hasPrevPage: boolean;
+  nextCursor: string | null;
+  prevCursor: string | null;
+};
+
+export type CursorPaginationResult<
+  TRow,
+  TCursorKey extends string | boolean | undefined = undefined,
+> = {
+  meta: CursorPaginationMeta;
+  items: CursorPaginationResultRow<TRow, TCursorKey>[];
+};
+
+export async function executeWithCursorPagination<
+  DB,
+  TB extends keyof DB,
+  O,
+  const TFields extends Fields<DB, TB, O>,
+  TCursorKey extends string | boolean | undefined = undefined,
+>(
+  qb: SelectQueryBuilder<DB, TB, O>,
+  opts: {
+    perPage: number;
+    cursor?: string;
+    beforeCursor?: string;
+    cursorPerRow?: TCursorKey;
+    fields: TFields;
+    encodeCursor?: CursorEncoder<DB, TB, O, TFields>;
+    decodeCursor?: CursorDecoder<DB, TB, O, TFields>;
+    parseCursor:
+      | CursorParser<DB, TB, O, TFields>
+      | { parse: CursorParser<DB, TB, O, TFields> };
+  },
+): Promise<CursorPaginationResult<O, TCursorKey>> {
+  const encodeCursor = opts.encodeCursor ?? defaultEncodeCursor;
+  const decodeCursor = opts.decodeCursor ?? defaultDecodeCursor;
+
+  const parseCursor =
+    typeof opts.parseCursor === 'function'
+      ? opts.parseCursor
+      : opts.parseCursor.parse;
+
+  const fields = opts.fields.map((field) => {
+    let key = field.key;
+
+    if (!key && typeof field.expression === 'string') {
+      const expressionParts = field.expression.split('.');
+
+      key = (expressionParts[1] ?? expressionParts[0]) as
+        | (keyof O & string)
+        | undefined;
+    }
+
+    if (!key) throw new Error('missing key');
+
+    return { ...field, key };
+  });
+
+  function generateCursor(row: O): string {
+    const cursorFieldValues = fields.map(({ key }) => [
+      key,
+      row[key],
+    ]) as EncodeCursorValues<DB, TB, O, TFields>;
+
+    return encodeCursor(cursorFieldValues);
+  }
+
+  const fieldNames = fields.map((field) => field.key) as FieldNames<
+    DB,
+    TB,
+    O,
+    TFields
+  >;
+
+  function applyCursor(
+    qb: SelectQueryBuilder<DB, TB, O>,
+    encoded: string,
+    defaultDirection: OrderByDirection,
+  ) {
+    const decoded = decodeCursor(encoded, fieldNames);
+    const cursor = parseCursor(decoded);
+
+    return qb.where(({ and, or, eb }) => {
+      let expression;
+
+      for (let i = fields.length - 1; i >= 0; --i) {
+        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+        const field = fields[i]!;
+
+        const comparison = field.direction === defaultDirection ? '>' : '<';
+        const value = cursor[field.key as keyof typeof cursor];
+
+        const conditions = [eb(field.expression, comparison, value)];
+
+        if (expression) {
+          conditions.push(and([eb(field.expression, '=', value), expression]));
+        }
+
+        expression = or(conditions);
+      }
+
+      if (!expression) {
+        throw new Error('Error building cursor expression');
+      }
+
+      return expression;
+    });
+  }
+
+  if (opts.cursor) qb = applyCursor(qb, opts.cursor, 'asc');
+  if (opts.beforeCursor) qb = applyCursor(qb, opts.beforeCursor, 'desc');
+
+  const reversed = !!opts.beforeCursor && !opts.cursor;
+
+  for (const { expression, direction, orderModifier } of fields) {
+    qb = qb.orderBy(
+      expression,
+      orderModifier ??
+        (reversed ? (direction === 'asc' ? 'desc' : 'asc') : direction),
+    );
+  }
+
+  const rows = await qb.limit(opts.perPage + 1).execute();
+
+  const hasNextPage = rows.length > opts.perPage;
+
+  // If we fetched an extra row to determine if we have a next page, that
+  // shouldn't be in the returned results
+  if (rows.length > opts.perPage) rows.pop();
+
+  if (reversed) rows.reverse();
+
+  const startRow = rows[0];
+  const endRow = rows[rows.length - 1];
+
+  const hasPrevPage = !!opts.cursor;
+  const prevCursor = hasPrevPage && startRow ? generateCursor(startRow) : null;
+  const nextCursor = hasNextPage && endRow ? generateCursor(endRow) : null;
+
+  return {
+    items: rows.map((row) => {
+      if (opts.cursorPerRow) {
+        const cursorKey =
+          typeof opts.cursorPerRow === 'string' ? opts.cursorPerRow : '$cursor';
+
+        (row as any)[cursorKey] = generateCursor(row);
+      }
+
+      return row as CursorPaginationResultRow<O, TCursorKey>;
+    }),
+    meta: {
+      limit: opts.perPage,
+      hasNextPage,
+      hasPrevPage,
+      nextCursor,
+      prevCursor,
+    },
+  };
+}
+
+export function defaultEncodeCursor<
+  DB,
+  TB extends keyof DB,
+  O,
+  T extends Fields<DB, TB, O>,
+>(values: EncodeCursorValues<DB, TB, O, T>) {
+  const cursor = new URLSearchParams();
+
+  for (const [key, value] of values) {
+    switch (typeof value) {
+      case 'string':
+        cursor.set(key, value);
+        break;
+
+      case 'number':
+      case 'bigint':
+        cursor.set(key, value.toString(10));
+        break;
+
+      case 'object': {
+        if (value instanceof Date) {
+          cursor.set(key, value.toISOString());
+          break;
+        }
+      }
+
+      // eslint-disable-next-line no-fallthrough
+      default:
+        throw new Error(`Unable to encode '${key.toString()}'`);
+    }
+  }
+
+  return Buffer.from(cursor.toString(), 'utf8').toString('base64url');
+}
+
+export function emptyCursorPaginationResult<T>(
+  limit: number,
+): CursorPaginationResult<T> {
+  return {
+    items: [],
+    meta: {
+      limit,
+      hasNextPage: false,
+      hasPrevPage: false,
+      nextCursor: null,
+      prevCursor: null,
+    },
+  };
+}
+
+export function defaultDecodeCursor<
+  DB,
+  TB extends keyof DB,
+  O,
+  T extends Fields<DB, TB, O>,
+>(
+  cursor: string,
+  fields: FieldNames<DB, TB, O, T>,
+): DecodedCursor<DB, TB, O, T> {
+  let parsed;
+
+  try {
+    parsed = [
+      ...new URLSearchParams(
+        Buffer.from(cursor, 'base64url').toString('utf8'),
+      ).entries(),
+    ];
+  } catch {
+    throw new Error('Unparsable cursor');
+  }
+
+  if (parsed.length !== fields.length) {
+    throw new Error('Unexpected number of fields');
+  }
+
+  for (let i = 0; i < fields.length; i++) {
+    const field = parsed[i];
+    const expectedName = fields[i];
+
+    if (!field) {
+      throw new Error('Unable to find field');
+    }
+
+    if (field[0] !== expectedName) {
+      throw new Error('Unexpected field name');
+    }
+  }
+
+  return Object.fromEntries(parsed) as DecodedCursor<DB, TB, O, T>;
+}

apps/server/src/database/pagination/pagination-options.ts

@@ -9,11 +9,6 @@ import {
 } from 'class-validator';
 
 export class PaginationOptions {
-  @IsOptional()
-  @IsNumber()
-  @Min(1)
-  page = 1;
-
   @IsOptional()
   @IsNumber()
   @IsPositive()
@@ -21,6 +16,14 @@ export class PaginationOptions {
   @Max(100)
   limit = 20;
 
+  @IsOptional()
+  @IsString()
+  cursor?: string;
+
+  @IsOptional()
+  @IsString()
+  beforeCursor?: string;
+
   @IsOptional()
   @IsString()
   query: string;

apps/server/src/database/repos/comment/comment.repo.ts

@@ -8,7 +8,7 @@ import {
   UpdatableComment,
 } from '@docmost/db/types/entity.types';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
-import { executeWithPagination } from '@docmost/db/pagination/pagination';
+import { executeWithCursorPagination } from '@docmost/db/pagination/cursor-pagination';
 import { ExpressionBuilder } from 'kysely';
 import { DB } from '@docmost/db/types/db';
 import { jsonObjectFrom } from 'kysely/helpers/postgres';
@@ -37,15 +37,15 @@ export class CommentRepo {
       .selectAll('comments')
       .select((eb) => this.withCreator(eb))
       .select((eb) => this.withResolvedBy(eb))
-      .where('pageId', '=', pageId)
-      .orderBy('createdAt', 'asc');
+      .where('pageId', '=', pageId);
 
-    const result = executeWithPagination(query, {
-      page: pagination.page,
+    return executeWithCursorPagination(query, {
       perPage: pagination.limit,
+      cursor: pagination.cursor,
+      beforeCursor: pagination.beforeCursor,
+      fields: [{ expression: 'id', direction: 'asc' }],
+      parseCursor: (cursor) => ({ id: cursor.id }),
     });
-
-    return result;
   }
 
   async updateComment(

apps/server/src/database/repos/group/group-user.repo.ts

@@ -9,7 +9,7 @@ import { dbOrTx, executeTx } from '@docmost/db/utils';
 import { sql } from 'kysely';
 import { GroupUser, InsertableGroupUser } from '@docmost/db/types/entity.types';
 import { PaginationOptions } from '../../pagination/pagination-options';
-import { executeWithPagination } from '@docmost/db/pagination/pagination';
+import { executeWithCursorPagination } from '@docmost/db/pagination/cursor-pagination';
 import { GroupRepo } from '@docmost/db/repos/group/group.repo';
 import { UserRepo } from '@docmost/db/repos/user/user.repo';
 
@@ -52,18 +52,24 @@ export class GroupUserRepo {
       .selectFrom('groupUsers')
       .innerJoin('users', 'users.id', 'groupUsers.userId')
       .selectAll('users')
-      .where('groupId', '=', groupId)
-      .orderBy('createdAt', 'asc');
+      .where('groupId', '=', groupId);
 
     if (pagination.query) {
       query = query.where((eb) =>
-        eb(sql`f_unaccent(users.name)`, 'ilike', sql`f_unaccent(${'%' + pagination.query + '%'})`),
+        eb(
+          sql`f_unaccent(users.name)`,
+          'ilike',
+          sql`f_unaccent(${'%' + pagination.query + '%'})`,
+        ),
       );
     }
 
-    const result = await executeWithPagination(query, {
-      page: pagination.page,
+    const result = await executeWithCursorPagination(query, {
       perPage: pagination.limit,
+      cursor: pagination.cursor,
+      beforeCursor: pagination.beforeCursor,
+      fields: [{ expression: 'users.id', direction: 'asc', key: 'id' }],
+      parseCursor: (cursor) => ({ id: cursor.id }),
     });
 
     result.items.map((user) => {
@@ -145,11 +151,38 @@ export class GroupUserRepo {
     );
   }
 
-  async delete(userId: string, groupId: string): Promise<void> {
-    await this.db
+  async getUserIdsByGroupId(groupId: string): Promise<string[]> {
+    const rows = await this.db
+      .selectFrom('groupUsers')
+      .select('userId')
+      .where('groupId', '=', groupId)
+      .execute();
+
+    return rows.map((r) => r.userId);
+  }
+
+  async delete(
+    userId: string,
+    groupId: string,
+    opts?: { trx?: KyselyTransaction },
+  ): Promise<void> {
+    const { trx } = opts;
+    const db = dbOrTx(this.db, trx);
+
+    await db
       .deleteFrom('groupUsers')
       .where('userId', '=', userId)
       .where('groupId', '=', groupId)
       .execute();
   }
+
+  async getUserGroupIds(userId: string): Promise<string[]> {
+    const results = await this.db
+      .selectFrom('groupUsers')
+      .select('groupId')
+      .where('userId', '=', userId)
+      .execute();
+
+    return results.map((r) => r.groupId);
+  }
 }

apps/server/src/database/repos/group/group.repo.ts

@@ -10,8 +10,8 @@ import {
 import { ExpressionBuilder, sql } from 'kysely';
 import { PaginationOptions } from '../../pagination/pagination-options';
 import { DB } from '@docmost/db/types/db';
-import { executeWithPagination } from '@docmost/db/pagination/pagination';
 import { DefaultGroup } from '../../../core/group/dto/create-group.dto';
+import { executeWithCursorPagination } from '@docmost/db/pagination/cursor-pagination';
 
 @Injectable()
 export class GroupRepo {
@@ -104,17 +104,19 @@ export class GroupRepo {
   }
 
   async getGroupsPaginated(workspaceId: string, pagination: PaginationOptions) {
-    let query = this.db
+    let baseQuery = this.db
       .selectFrom('groups')
       .selectAll('groups')
       .select((eb) => this.withMemberCount(eb))
-      .where('workspaceId', '=', workspaceId)
-      .orderBy('memberCount', 'desc')
-      .orderBy('createdAt', 'asc');
+      .where('workspaceId', '=', workspaceId);
 
     if (pagination.query) {
-      query = query.where((eb) =>
-        eb(sql`f_unaccent(name)`, 'ilike', sql`f_unaccent(${'%' + pagination.query + '%'})`).or(
+      baseQuery = baseQuery.where((eb) =>
+        eb(
+          sql`f_unaccent(name)`,
+          'ilike',
+          sql`f_unaccent(${'%' + pagination.query + '%'})`,
+        ).or(
           sql`f_unaccent(description)`,
           'ilike',
           sql`f_unaccent(${'%' + pagination.query + '%'})`,
@@ -122,12 +124,26 @@ export class GroupRepo {
       );
     }
 
-    const result = executeWithPagination(query, {
-      page: pagination.page,
+    const query = this.db.selectFrom(baseQuery.as('sub')).selectAll('sub');
+    return executeWithCursorPagination(query, {
       perPage: pagination.limit,
+      cursor: pagination.cursor,
+      beforeCursor: pagination.beforeCursor,
+      fields: [
+        {
+          expression: 'sub.memberCount',
+          direction: 'desc',
+          key: 'memberCount',
+        },
+        { expression: 'sub.name', direction: 'asc', key: 'name' },
+        { expression: 'sub.id', direction: 'asc', key: 'id' },
+      ],
+      parseCursor: (cursor) => ({
+        memberCount: parseInt(cursor.memberCount, 10),
+        name: cursor.name,
+        id: cursor.id,
+      }),
     });
-
-    return result;
   }
 
   withMemberCount(eb: ExpressionBuilder<DB, 'groups'>) {
@@ -138,8 +154,15 @@ export class GroupRepo {
       .as('memberCount');
   }
 
-  async delete(groupId: string, workspaceId: string): Promise<void> {
-    await this.db
+  async delete(
+    groupId: string,
+    workspaceId: string,
+    opts?: { trx?: KyselyTransaction },
+  ): Promise<void> {
+    const { trx } = opts;
+    const db = dbOrTx(this.db, trx);
+
+    await db
       .deleteFrom('groups')
       .where('id', '=', groupId)
       .where('workspaceId', '=', workspaceId)

apps/server/src/database/repos/notification/notification.repo.ts

@@ -0,0 +1,167 @@
+import { Injectable } from '@nestjs/common';
+import { InjectKysely } from 'nestjs-kysely';
+import { KyselyDB } from '../../types/kysely.types';
+import {
+  InsertableNotification,
+  Notification,
+} from '@docmost/db/types/entity.types';
+import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
+import { executeWithCursorPagination } from '@docmost/db/pagination/cursor-pagination';
+import { ExpressionBuilder } from 'kysely';
+import { DB } from '@docmost/db/types/db';
+import { jsonObjectFrom } from 'kysely/helpers/postgres';
+import { SpaceMemberRepo } from '@docmost/db/repos/space/space-member.repo';
+
+@Injectable()
+export class NotificationRepo {
+  constructor(
+    @InjectKysely() private readonly db: KyselyDB,
+    private readonly spaceMemberRepo: SpaceMemberRepo,
+  ) {}
+
+  async findById(notificationId: string): Promise<Notification | undefined> {
+    return this.db
+      .selectFrom('notifications')
+      .selectAll('notifications')
+      .where('id', '=', notificationId)
+      .executeTakeFirst();
+  }
+
+  async findByUserId(userId: string, pagination: PaginationOptions) {
+    const query = this.db
+      .selectFrom('notifications')
+      .selectAll('notifications')
+      .select((eb) => this.withActor(eb))
+      .select((eb) => this.withPage(eb))
+      .select((eb) => this.withSpace(eb))
+      .where('userId', '=', userId)
+      .where((eb) =>
+        eb.or([
+          eb('spaceId', 'is', null),
+          eb('spaceId', 'in', this.spaceMemberRepo.getUserSpaceIdsQuery(userId)),
+        ]),
+      );
+
+    return executeWithCursorPagination(query, {
+      perPage: pagination.limit,
+      cursor: pagination.cursor,
+      beforeCursor: pagination.beforeCursor,
+      fields: [{ expression: 'id', direction: 'desc' }],
+      parseCursor: (cursor) => ({ id: cursor.id }),
+    });
+  }
+
+  async getUnreadCount(userId: string): Promise<number> {
+    const result = await this.db
+      .selectFrom('notifications')
+      .select((eb) => eb.fn.count('id').as('count'))
+      .where('userId', '=', userId)
+      .where('readAt', 'is', null)
+      .where((eb) =>
+        eb.or([
+          eb('spaceId', 'is', null),
+          eb('spaceId', 'in', this.spaceMemberRepo.getUserSpaceIdsQuery(userId)),
+        ]),
+      )
+      .executeTakeFirst();
+
+    return Number(result?.count ?? 0);
+  }
+
+  async insert(notification: InsertableNotification): Promise<Notification> {
+    return this.db
+      .insertInto('notifications')
+      .values(notification)
+      .returningAll()
+      .executeTakeFirst();
+  }
+
+  async markAsRead(notificationId: string, userId: string): Promise<void> {
+    await this.db
+      .updateTable('notifications')
+      .set({ readAt: new Date() })
+      .where('id', '=', notificationId)
+      .where('userId', '=', userId)
+      .where('readAt', 'is', null)
+      .where((eb) =>
+        eb.or([
+          eb('spaceId', 'is', null),
+          eb('spaceId', 'in', this.spaceMemberRepo.getUserSpaceIdsQuery(userId)),
+        ]),
+      )
+      .execute();
+  }
+
+  async markMultipleAsRead(
+    notificationIds: string[],
+    userId: string,
+  ): Promise<void> {
+    if (notificationIds.length === 0) {
+      return;
+    }
+    await this.db
+      .updateTable('notifications')
+      .set({ readAt: new Date() })
+      .where('id', 'in', notificationIds)
+      .where('userId', '=', userId)
+      .where('readAt', 'is', null)
+      .where((eb) =>
+        eb.or([
+          eb('spaceId', 'is', null),
+          eb('spaceId', 'in', this.spaceMemberRepo.getUserSpaceIdsQuery(userId)),
+        ]),
+      )
+      .execute();
+  }
+
+  async markAsEmailed(notificationId: string): Promise<void> {
+    await this.db
+      .updateTable('notifications')
+      .set({ emailedAt: new Date() })
+      .where('id', '=', notificationId)
+      .where('emailedAt', 'is', null)
+      .execute();
+  }
+
+  async markAllAsRead(userId: string): Promise<void> {
+    await this.db
+      .updateTable('notifications')
+      .set({ readAt: new Date() })
+      .where('userId', '=', userId)
+      .where('readAt', 'is', null)
+      .where((eb) =>
+        eb.or([
+          eb('spaceId', 'is', null),
+          eb('spaceId', 'in', this.spaceMemberRepo.getUserSpaceIdsQuery(userId)),
+        ]),
+      )
+      .execute();
+  }
+
+  withActor(eb: ExpressionBuilder<DB, 'notifications'>) {
+    return jsonObjectFrom(
+      eb
+        .selectFrom('users')
+        .select(['users.id', 'users.name', 'users.avatarUrl'])
+        .whereRef('users.id', '=', 'notifications.actorId'),
+    ).as('actor');
+  }
+
+  withPage(eb: ExpressionBuilder<DB, 'notifications'>) {
+    return jsonObjectFrom(
+      eb
+        .selectFrom('pages')
+        .select(['pages.id', 'pages.title', 'pages.slugId', 'pages.icon'])
+        .whereRef('pages.id', '=', 'notifications.pageId'),
+    ).as('page');
+  }
+
+  withSpace(eb: ExpressionBuilder<DB, 'notifications'>) {
+    return jsonObjectFrom(
+      eb
+        .selectFrom('spaces')
+        .select(['spaces.id', 'spaces.name', 'spaces.slug'])
+        .whereRef('spaces.id', '=', 'notifications.spaceId'),
+    ).as('space');
+  }
+}

apps/server/src/database/repos/page/page-history.repo.ts

@@ -8,25 +8,44 @@ import {
   PageHistory,
 } from '@docmost/db/types/entity.types';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
-import { executeWithPagination } from '@docmost/db/pagination/pagination';
-import { jsonObjectFrom } from 'kysely/helpers/postgres';
-import { ExpressionBuilder } from 'kysely';
+import { executeWithCursorPagination } from '@docmost/db/pagination/cursor-pagination';
+import { jsonArrayFrom, jsonObjectFrom } from 'kysely/helpers/postgres';
+import { ExpressionBuilder, sql } from 'kysely';
 import { DB } from '@docmost/db/types/db';
 
 @Injectable()
 export class PageHistoryRepo {
   constructor(@InjectKysely() private readonly db: KyselyDB) {}
 
+  private baseFields: Array<keyof PageHistory> = [
+    'id',
+    'pageId',
+    'slugId',
+    'title',
+    'icon',
+    'coverPhoto',
+    'lastUpdatedById',
+    'contributorIds',
+    'spaceId',
+    'workspaceId',
+    'createdAt',
+  ];
+
   async findById(
     pageHistoryId: string,
-    trx?: KyselyTransaction,
+    opts?: {
+      includeContent?: boolean;
+      trx?: KyselyTransaction;
+    },
   ): Promise<PageHistory> {
-    const db = dbOrTx(this.db, trx);
+    const db = dbOrTx(this.db, opts?.trx);
 
     return await db
       .selectFrom('pageHistory')
-      .selectAll()
+      .select(this.baseFields)
+      .$if(opts?.includeContent, (qb) => qb.select('content'))
       .select((eb) => this.withLastUpdatedBy(eb))
+      .select((eb) => this.withContributors(eb))
       .where('id', '=', pageHistoryId)
       .executeTakeFirst();
   }
@@ -43,7 +62,10 @@ export class PageHistoryRepo {
       .executeTakeFirst();
   }
 
-  async saveHistory(page: Page, trx?: KyselyTransaction): Promise<void> {
+  async saveHistory(
+    page: Page,
+    opts?: { contributorIds?: string[]; trx?: KyselyTransaction },
+  ): Promise<void> {
     await this.insertPageHistory(
       {
         pageId: page.id,
@@ -53,35 +75,44 @@ export class PageHistoryRepo {
         icon: page.icon,
         coverPhoto: page.coverPhoto,
         lastUpdatedById: page.lastUpdatedById ?? page.creatorId,
+        contributorIds: opts?.contributorIds,
         spaceId: page.spaceId,
         workspaceId: page.workspaceId,
       },
-      trx,
+      opts?.trx,
     );
   }
 
   async findPageHistoryByPageId(pageId: string, pagination: PaginationOptions) {
     const query = this.db
       .selectFrom('pageHistory')
-      .selectAll()
+      .select(this.baseFields)
       .select((eb) => this.withLastUpdatedBy(eb))
-      .where('pageId', '=', pageId)
-      .orderBy('createdAt', 'desc');
+      .select((eb) => this.withContributors(eb))
+      .where('pageId', '=', pageId);
 
-    const result = executeWithPagination(query, {
-      page: pagination.page,
+    return executeWithCursorPagination(query, {
       perPage: pagination.limit,
+      cursor: pagination.cursor,
+      beforeCursor: pagination.beforeCursor,
+      fields: [{ expression: 'id', direction: 'desc' }],
+      parseCursor: (cursor) => ({ id: cursor.id }),
     });
-
-    return result;
   }
 
-  async findPageLastHistory(pageId: string, trx?: KyselyTransaction) {
-    const db = dbOrTx(this.db, trx);
+  async findPageLastHistory(
+    pageId: string,
+    opts?: {
+      includeContent?: boolean;
+      trx?: KyselyTransaction;
+    },
+  ) {
+    const db = dbOrTx(this.db, opts?.trx);
 
     return await db
       .selectFrom('pageHistory')
-      .selectAll()
+      .select(this.baseFields)
+      .$if(opts?.includeContent, (qb) => qb.select('content'))
       .where('pageId', '=', pageId)
       .limit(1)
       .orderBy('createdAt', 'desc')
@@ -96,4 +127,17 @@ export class PageHistoryRepo {
         .whereRef('users.id', '=', 'pageHistory.lastUpdatedById'),
     ).as('lastUpdatedBy');
   }
+
+  withContributors(eb: ExpressionBuilder<DB, 'pageHistory'>) {
+    return jsonArrayFrom(
+      eb
+        .selectFrom('users')
+        .select(['users.id', 'users.name', 'users.avatarUrl'])
+        .whereRef(
+          'users.id',
+          '=',
+          sql`ANY(${eb.ref('pageHistory.contributorIds')})`,
+        ),
+    ).as('contributors');
+  }
 }

apps/server/src/database/repos/page/page.repo.ts

@@ -8,7 +8,7 @@ import {
   UpdatablePage,
 } from '@docmost/db/types/entity.types';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
-import { executeWithPagination } from '@docmost/db/pagination/pagination';
+import { executeWithCursorPagination } from '@docmost/db/pagination/cursor-pagination';
 import { validate as isValidUUID } from 'uuid';
 import { ExpressionBuilder, sql } from 'kysely';
 import { DB } from '@docmost/db/types/db';
@@ -175,11 +175,13 @@ export class PageRepo {
           .selectFrom('pages')
           .select(['id'])
           .where('id', '=', pageId)
+          .where('deletedAt', 'is', null)
           .unionAll((exp) =>
             exp
               .selectFrom('pages as p')
               .select(['p.id'])
-              .innerJoin('page_descendants as pd', 'pd.id', 'p.parentPageId'),
+              .innerJoin('page_descendants as pd', 'pd.id', 'p.parentPageId')
+              .where('p.deletedAt', 'is', null),
           ),
       )
       .selectFrom('page_descendants')
@@ -197,6 +199,7 @@ export class PageRepo {
             deletedAt: currentDate,
           })
           .where('id', 'in', pageIds)
+          .where('deletedAt', 'is', null)
           .execute();
 
         await trx.deleteFrom('shares').where('pageId', 'in', pageIds).execute();
@@ -281,15 +284,21 @@ export class PageRepo {
       .select(this.baseFields)
       .select((eb) => this.withSpace(eb))
       .where('spaceId', '=', spaceId)
-      .where('deletedAt', 'is', null)
-      .orderBy('updatedAt', 'desc');
+      .where('deletedAt', 'is', null);
 
-    const result = executeWithPagination(query, {
-      page: pagination.page,
+    return executeWithCursorPagination(query, {
       perPage: pagination.limit,
+      cursor: pagination.cursor,
+      beforeCursor: pagination.beforeCursor,
+      fields: [
+        { expression: 'updatedAt', direction: 'desc' },
+        { expression: 'id', direction: 'desc' },
+      ],
+      parseCursor: (cursor) => ({
+        updatedAt: new Date(cursor.updatedAt),
+        id: cursor.id,
+      }),
     });
-
-    return result;
   }
 
   async getRecentPages(userId: string, pagination: PaginationOptions) {
@@ -298,12 +307,20 @@ export class PageRepo {
       .select(this.baseFields)
       .select((eb) => this.withSpace(eb))
       .where('spaceId', 'in', this.spaceMemberRepo.getUserSpaceIdsQuery(userId))
-      .where('deletedAt', 'is', null)
-      .orderBy('updatedAt', 'desc');
+      .where('deletedAt', 'is', null);
 
-    return executeWithPagination(query, {
-      page: pagination.page,
+    return executeWithCursorPagination(query, {
       perPage: pagination.limit,
+      cursor: pagination.cursor,
+      beforeCursor: pagination.beforeCursor,
+      fields: [
+        { expression: 'updatedAt', direction: 'desc' },
+        { expression: 'id', direction: 'desc' },
+      ],
+      parseCursor: (cursor) => ({
+        updatedAt: new Date(cursor.updatedAt),
+        id: cursor.id,
+      }),
     });
   }
 
@@ -331,15 +348,21 @@ export class PageRepo {
             ),
           ),
         ]),
-      )
-      .orderBy('deletedAt', 'desc');
+      );
 
-    const result = executeWithPagination(query, {
-      page: pagination.page,
+    return executeWithCursorPagination(query, {
       perPage: pagination.limit,
+      cursor: pagination.cursor,
+      beforeCursor: pagination.beforeCursor,
+      fields: [
+        { expression: 'deletedAt', direction: 'desc' },
+        { expression: 'id', direction: 'desc' },
+      ],
+      parseCursor: (cursor) => ({
+        deletedAt: new Date(cursor.deletedAt),
+        id: cursor.id,
+      }),
     });
-
-    return result;
   }
 
   withSpace(eb: ExpressionBuilder<DB, 'pages'>) {
@@ -452,4 +475,75 @@ export class PageRepo {
       .selectAll()
       .execute();
   }
+
+  /**
+   * Get page and all descendants, excluding restricted pages and their subtrees.
+   * More efficient than getPageAndDescendants + filtering because:
+   * 1. Single DB query (no separate restricted IDs query)
+   * 2. Stops traversing at restricted pages (doesn't fetch data to discard)
+   * 3. No in-memory filtering needed
+   */
+  async getPageAndDescendantsExcludingRestricted(
+    parentPageId: string,
+    opts: { includeContent: boolean },
+  ) {
+    return (
+      this.db
+        .withRecursive('page_hierarchy', (db) =>
+          db
+            .selectFrom('pages')
+            .leftJoin('pageAccess', 'pageAccess.pageId', 'pages.id')
+            .select([
+              'pages.id',
+              'pages.slugId',
+              'pages.title',
+              'pages.icon',
+              'pages.position',
+              'pages.parentPageId',
+              'pages.spaceId',
+              'pages.workspaceId',
+              sql<boolean>`page_access.id IS NOT NULL`.as('isRestricted'),
+            ])
+            .$if(opts?.includeContent, (qb) => qb.select('pages.content'))
+            .where('pages.id', '=', parentPageId)
+            .where('pages.deletedAt', 'is', null)
+            .unionAll((exp) =>
+              exp
+                .selectFrom('pages as p')
+                .innerJoin('page_hierarchy as ph', 'p.parentPageId', 'ph.id')
+                .leftJoin('pageAccess', 'pageAccess.pageId', 'p.id')
+                .select([
+                  'p.id',
+                  'p.slugId',
+                  'p.title',
+                  'p.icon',
+                  'p.position',
+                  'p.parentPageId',
+                  'p.spaceId',
+                  'p.workspaceId',
+                  sql<boolean>`page_access.id IS NOT NULL`.as('isRestricted'),
+                ])
+                .$if(opts?.includeContent, (qb) => qb.select('p.content'))
+                .where('p.deletedAt', 'is', null)
+                // Only recurse into children of non-restricted pages
+                .where('ph.isRestricted', '=', false),
+            ),
+        )
+        .selectFrom('page_hierarchy')
+        .select([
+          'id',
+          'slugId',
+          'title',
+          'icon',
+          'position',
+          'parentPageId',
+          'spaceId',
+          'workspaceId',
+        ])
+        .$if(opts?.includeContent, (qb) => qb.select('content'))
+        // Filter out restricted pages from the result
+        .where('isRestricted', '=', false)
+        .execute()
+    );
+  }
 }

apps/server/src/database/repos/page/types/page-permission.types.ts

@@ -0,0 +1,23 @@
+type PagePermissionUserMember = {
+  id: string;
+  name: string;
+  email: string;
+  avatarUrl: string | null;
+  type: 'user';
+  role: string;
+  createdAt: Date;
+};
+
+type PagePermissionGroupMember = {
+  id: string;
+  name: string;
+  memberCount: number;
+  isDefault: boolean;
+  type: 'group';
+  role: string;
+  createdAt: Date;
+};
+
+export type PagePermissionMember =
+  | PagePermissionUserMember
+  | PagePermissionGroupMember;

apps/server/src/database/repos/share/share.repo.ts

@@ -8,7 +8,7 @@ import {
   UpdatableShare,
 } from '@docmost/db/types/entity.types';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
-import { executeWithPagination } from '@docmost/db/pagination/pagination';
+import { executeWithCursorPagination } from '@docmost/db/pagination/cursor-pagination';
 import { validate as isValidUUID } from 'uuid';
 import { ExpressionBuilder, sql } from 'kysely';
 import { DB } from '@docmost/db/types/db';
@@ -136,6 +136,28 @@ export class ShareRepo {
     await query.execute();
   }
 
+  async deleteBySpaceId(
+    spaceId: string,
+    trx?: KyselyTransaction,
+  ): Promise<void> {
+    const db = dbOrTx(this.db, trx);
+    await db
+      .deleteFrom('shares')
+      .where('spaceId', '=', spaceId)
+      .execute();
+  }
+
+  async deleteByWorkspaceId(
+    workspaceId: string,
+    trx?: KyselyTransaction,
+  ): Promise<void> {
+    const db = dbOrTx(this.db, trx);
+    await db
+      .deleteFrom('shares')
+      .where('workspaceId', '=', workspaceId)
+      .execute();
+  }
+
   async getShares(userId: string, pagination: PaginationOptions) {
     const query = this.db
       .selectFrom('shares')
@@ -143,12 +165,20 @@ export class ShareRepo {
       .select((eb) => this.withPage(eb))
       .select((eb) => this.withSpace(eb, userId))
       .select((eb) => this.withCreator(eb))
-      .where('spaceId', 'in', this.spaceMemberRepo.getUserSpaceIdsQuery(userId))
-      .orderBy('updatedAt', 'desc');
+      .where('spaceId', 'in', this.spaceMemberRepo.getUserSpaceIdsQuery(userId));
 
-    return executeWithPagination(query, {
-      page: pagination.page,
+    return executeWithCursorPagination(query, {
       perPage: pagination.limit,
+      cursor: pagination.cursor,
+      beforeCursor: pagination.beforeCursor,
+      fields: [
+        { expression: 'updatedAt', direction: 'desc' },
+        { expression: 'id', direction: 'desc' },
+      ],
+      parseCursor: (cursor) => ({
+        updatedAt: new Date(cursor.updatedAt),
+        id: cursor.id,
+      }),
     });
   }
 

apps/server/src/database/repos/space/space-member.repo.ts

@@ -10,7 +10,7 @@ import {
 } from '@docmost/db/types/entity.types';
 import { PaginationOptions } from '../../pagination/pagination-options';
 import { MemberInfo, UserSpaceRole } from './types';
-import { executeWithPagination } from '@docmost/db/pagination/pagination';
+import { executeWithCursorPagination } from '@docmost/db/pagination/cursor-pagination';
 import { GroupRepo } from '@docmost/db/repos/group/group.repo';
 import { SpaceRepo } from '@docmost/db/repos/space/space.repo';
 
@@ -73,8 +73,9 @@ export class SpaceMemberRepo {
   async removeSpaceMemberById(
     memberId: string,
     spaceId: string,
-    trx?: KyselyTransaction,
+    opts?: { trx?: KyselyTransaction },
   ): Promise<void> {
+    const { trx } = opts;
     const db = dbOrTx(this.db, trx);
     await db
       .deleteFrom('spaceMembers')
@@ -98,11 +99,12 @@ export class SpaceMemberRepo {
     spaceId: string,
     pagination: PaginationOptions,
   ) {
-    let query = this.db
+    let baseQuery = this.db
       .selectFrom('spaceMembers')
       .leftJoin('users', 'users.id', 'spaceMembers.userId')
       .leftJoin('groups', 'groups.id', 'spaceMembers.groupId')
       .select([
+        'spaceMembers.id as id',
         'users.id as userId',
         'users.name as userName',
         'users.avatarUrl as userAvatarUrl',
@@ -114,12 +116,21 @@ export class SpaceMemberRepo {
         'spaceMembers.createdAt',
       ])
       .select((eb) => this.groupRepo.withMemberCount(eb))
-      .where('spaceId', '=', spaceId)
-      .orderBy((eb) => eb('groups.id', 'is not', null), 'desc')
-      .orderBy('spaceMembers.createdAt', 'asc');
+      .select(
+        sql<number>`case when groups.id is not null then 1 else 0 end`.as(
+          'isGroup',
+        ),
+      )
+      .select(
+        sql<number>`case "space_members"."role" when 'admin' then 1 when 'writer' then 2 when 'reader' then 3 else 4 end`.as(
+          'roleOrder',
+        ),
+      )
+      .select(sql<string>`coalesce(users.name, groups.name)`.as('memberName'))
+      .where('spaceId', '=', spaceId);
 
     if (pagination.query) {
-      query = query.where((eb) =>
+      baseQuery = baseQuery.where((eb) =>
         eb(
           sql`f_unaccent(users.name)`,
           'ilike',
@@ -138,9 +149,24 @@ export class SpaceMemberRepo {
       );
     }
 
-    const result = await executeWithPagination(query, {
-      page: pagination.page,
+    const query = this.db.selectFrom(baseQuery.as('sub')).selectAll('sub');
+
+    const result = await executeWithCursorPagination(query, {
       perPage: pagination.limit,
+      cursor: pagination.cursor,
+      beforeCursor: pagination.beforeCursor,
+      fields: [
+        { expression: 'sub.roleOrder', direction: 'asc', key: 'roleOrder' },
+        { expression: 'sub.isGroup', direction: 'desc', key: 'isGroup' },
+        { expression: 'sub.memberName', direction: 'asc', key: 'memberName' },
+        { expression: 'sub.id', direction: 'asc', key: 'id' },
+      ],
+      parseCursor: (cursor) => ({
+        roleOrder: parseInt(cursor.roleOrder, 10),
+        isGroup: parseInt(cursor.isGroup, 10),
+        memberName: cursor.memberName,
+        id: cursor.id,
+      }),
     });
 
     let memberInfo: MemberInfo;
@@ -209,6 +235,40 @@ export class SpaceMemberRepo {
     return roles;
   }
 
+  async getUserIdsWithSpaceAccess(
+    userIds: string[],
+    spaceId: string,
+  ): Promise<Set<string>> {
+    if (userIds.length === 0) return new Set();
+
+    const rows = await this.db
+      .selectFrom('spaceMembers')
+      .select('userId')
+      .where('userId', 'in', userIds)
+      .where('spaceId', '=', spaceId)
+      .unionAll(
+        this.db
+          .selectFrom('spaceMembers')
+          .innerJoin('groupUsers', 'groupUsers.groupId', 'spaceMembers.groupId')
+          .select('groupUsers.userId')
+          .where('groupUsers.userId', 'in', userIds)
+          .where('spaceMembers.spaceId', '=', spaceId),
+      )
+      .execute();
+
+    return new Set(rows.map((r) => r.userId));
+  }
+
+  async getSpaceIdsByGroupId(groupId: string): Promise<string[]> {
+    const rows = await this.db
+      .selectFrom('spaceMembers')
+      .select('spaceId')
+      .where('groupId', '=', groupId)
+      .execute();
+
+    return rows.map((r) => r.spaceId);
+  }
+
   getUserSpaceIdsQuery(userId: string) {
     return this.db
       .selectFrom('spaceMembers')
@@ -235,8 +295,7 @@ export class SpaceMemberRepo {
       .selectFrom('spaces')
       .selectAll()
       .select((eb) => [this.spaceRepo.withMemberCount(eb)])
-      .where('id', 'in', this.getUserSpaceIdsQuery(userId))
-      .orderBy('createdAt', 'asc');
+      .where('id', 'in', this.getUserSpaceIdsQuery(userId));
 
     if (pagination.query) {
       query = query.where((eb) =>
@@ -252,9 +311,15 @@ export class SpaceMemberRepo {
       );
     }
 
-    return executeWithPagination(query, {
-      page: pagination.page,
+    return executeWithCursorPagination(query, {
       perPage: pagination.limit,
+      cursor: pagination.cursor,
+      beforeCursor: pagination.beforeCursor,
+      fields: [
+        { expression: 'name', direction: 'asc' },
+        { expression: 'id', direction: 'asc' },
+      ],
+      parseCursor: (cursor) => ({ name: cursor.name, id: cursor.id }),
     });
   }
 }

apps/server/src/database/repos/space/space.repo.ts

@@ -9,7 +9,7 @@ import {
 } from '@docmost/db/types/entity.types';
 import { ExpressionBuilder, sql } from 'kysely';
 import { PaginationOptions } from '../../pagination/pagination-options';
-import { executeWithPagination } from '@docmost/db/pagination/pagination';
+import { executeWithCursorPagination } from '@docmost/db/pagination/cursor-pagination';
 import { DB } from '@docmost/db/types/db';
 import { validate as isValidUUID } from 'uuid';
 import { EventEmitter2 } from '@nestjs/event-emitter';
@@ -89,6 +89,28 @@ export class SpaceRepo {
       .executeTakeFirst();
   }
 
+  async updateSharingSettings(
+    spaceId: string,
+    workspaceId: string,
+    prefKey: string,
+    prefValue: string | boolean,
+    trx?: KyselyTransaction,
+  ) {
+    const db = dbOrTx(this.db, trx);
+    return db
+      .updateTable('spaces')
+      .set({
+        settings: sql`COALESCE(settings, '{}'::jsonb)
+          || jsonb_build_object('sharing', COALESCE(settings->'sharing', '{}'::jsonb)
+          || jsonb_build_object('${sql.raw(prefKey)}', ${sql.lit(prefValue)}))`,
+        updatedAt: new Date(),
+      })
+      .where('id', '=', spaceId)
+      .where('workspaceId', '=', workspaceId)
+      .returningAll()
+      .executeTakeFirst();
+  }
+
   async insertSpace(
     insertableSpace: InsertableSpace,
     trx?: KyselyTransaction,
@@ -110,8 +132,7 @@ export class SpaceRepo {
       .selectFrom('spaces')
       .selectAll('spaces')
       .select((eb) => [this.withMemberCount(eb)])
-      .where('workspaceId', '=', workspaceId)
-      .orderBy('createdAt', 'asc');
+      .where('workspaceId', '=', workspaceId);
 
     if (pagination.query) {
       query = query.where((eb) =>
@@ -127,12 +148,16 @@ export class SpaceRepo {
       );
     }
 
-    const result = executeWithPagination(query, {
-      page: pagination.page,
+    return executeWithCursorPagination(query, {
       perPage: pagination.limit,
+      cursor: pagination.cursor,
+      beforeCursor: pagination.beforeCursor,
+      fields: [
+        { expression: 'name', direction: 'asc' },
+        { expression: 'id', direction: 'asc' },
+      ],
+      parseCursor: (cursor) => ({ name: cursor.name, id: cursor.id }),
     });
-
-    return result;
   }
 
   withMemberCount(eb: ExpressionBuilder<DB, 'spaces'>) {

apps/server/src/database/repos/user-token/user-token.repo.ts

@@ -38,9 +38,9 @@ export class UserTokenRepo {
 
   async insertUserToken(
     insertableUserToken: InsertableUserToken,
-    trx?: KyselyTransaction,
+    opts?: { trx?: KyselyTransaction },
   ) {
-    const db = dbOrTx(this.db, trx);
+    const db = dbOrTx(this.db, opts?.trx);
     return db
       .insertInto('userTokens')
       .values(insertableUserToken)