feat(server): add global encryption module (AES-256-GCM)

Provides an injectable EncryptionService that encrypts/decrypts strings
with AES-256-GCM using a key derived from APP_SECRET with domain
separation. Payloads are base64 JSON envelopes with validated IV and
auth tag lengths, and failures surface as typed errors.

Dockerfile

@@ -42,7 +42,7 @@ RUN chown -R node:node /app
 
 USER node
 
-RUN pnpm install --frozen-lockfile --prod
+RUN pnpm install --frozen-lockfile --prod && rm -rf /home/node/.cache/pnpm
 
 RUN mkdir -p /app/data/storage
 

apps/client/public/locales/en-US/translation.json

@@ -1291,5 +1291,16 @@
   "{{count}} rows deleted_one": "1 row deleted",
   "{{count}} rows deleted_other": "{{count}} rows deleted",
   "{{count}} selected_one": "1 selected",
-  "{{count}} selected_other": "{{count}} selected"
+  "{{count}} selected_other": "{{count}} selected",
+  "Compare": "Compare",
+  "Compare versions": "Compare versions",
+  "Select version from {{date}}": "Select version from {{date}}",
+  "Version actions for {{date}}": "Version actions for {{date}}",
+  "Comparing {{newer}} and {{older}}": "Comparing {{newer}} and {{older}}",
+  "Exit compare": "Exit compare",
+  "Search attachments...": "Search attachments...",
+  "Error loading attachments.": "Error loading attachments.",
+  "No attachments on this page yet.": "No attachments on this page yet.",
+  "Uploaded by {{name}}": "Uploaded by {{name}}",
+  "Download {{name}}": "Download {{name}}"
 }

apps/client/src/ee/ai-chat/components/chat-input.tsx

@@ -255,6 +255,7 @@ export default function ChatInput({
     },
     content: "",
     editable: true,
+    textDirection: "auto",
     immediatelyRender: true,
     shouldRerenderOnTransaction: false,
     autofocus: autofocus ? "end" : false,

apps/client/src/ee/template/components/readonly-template-editor.tsx

@@ -41,6 +41,7 @@ export default function ReadonlyTemplateEditor({
       <EditorProvider
         editable={false}
         immediatelyRender={true}
+        textDirection="auto"
         extensions={extensions}
         content={template.content}
       />

apps/client/src/ee/template/pages/template-editor.tsx

@@ -87,6 +87,7 @@ export default function TemplateEditor() {
   const editor = useEditor({
     extensions: templateExtensions,
     content: "",
+    textDirection: "auto",
     editorProps: {
       scrollThreshold: 80,
       scrollMargin: 80,

apps/client/src/features/attachments/components/attachment-file-icon.tsx

@@ -0,0 +1,59 @@
+import { ThemeIcon } from "@mantine/core";
+import {
+  IconFile,
+  IconFileTypeCsv,
+  IconFileTypeDocx,
+  IconFileTypePdf,
+  IconFileTypePpt,
+  IconFileTypeXls,
+  IconFileZip,
+  IconMovie,
+  IconMusic,
+  IconPhoto,
+  type Icon,
+} from "@tabler/icons-react";
+
+const EXT_ICONS: Record<string, { icon: Icon; color: string }> = {
+  ".pdf": { icon: IconFileTypePdf, color: "red" },
+  ".doc": { icon: IconFileTypeDocx, color: "blue" },
+  ".docx": { icon: IconFileTypeDocx, color: "blue" },
+  ".xls": { icon: IconFileTypeXls, color: "teal" },
+  ".xlsx": { icon: IconFileTypeXls, color: "teal" },
+  ".csv": { icon: IconFileTypeCsv, color: "teal" },
+  ".ppt": { icon: IconFileTypePpt, color: "orange" },
+  ".pptx": { icon: IconFileTypePpt, color: "orange" },
+  ".zip": { icon: IconFileZip, color: "gray" },
+  ".rar": { icon: IconFileZip, color: "gray" },
+  ".7z": { icon: IconFileZip, color: "gray" },
+  ".tar": { icon: IconFileZip, color: "gray" },
+  ".gz": { icon: IconFileZip, color: "gray" },
+};
+
+const MIME_ICONS: Array<{ prefix: string; icon: Icon; color: string }> = [
+  { prefix: "image/", icon: IconPhoto, color: "grape" },
+  { prefix: "video/", icon: IconMovie, color: "violet" },
+  { prefix: "audio/", icon: IconMusic, color: "pink" },
+];
+
+interface AttachmentFileIconProps {
+  fileExt?: string;
+  mimeType?: string;
+}
+
+export function AttachmentFileIcon({
+  fileExt,
+  mimeType,
+}: AttachmentFileIconProps) {
+  const byExt = fileExt ? EXT_ICONS[fileExt.toLowerCase()] : undefined;
+  const byMime = mimeType
+    ? MIME_ICONS.find((entry) => mimeType.startsWith(entry.prefix))
+    : undefined;
+  const { icon: FileIcon, color } = byExt ??
+    byMime ?? { icon: IconFile, color: "gray" };
+
+  return (
+    <ThemeIcon variant="light" color={color} size={40} radius="md">
+      <FileIcon size={22} stroke={1.5} />
+    </ThemeIcon>
+  );
+}

apps/client/src/features/attachments/components/page-attachments-modal.tsx

@@ -0,0 +1,191 @@
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import {
+  ActionIcon,
+  Anchor,
+  Center,
+  Group,
+  Loader,
+  Modal,
+  ScrollArea,
+  Text,
+  Tooltip,
+} from "@mantine/core";
+import { IconDownload } from "@tabler/icons-react";
+import { useTranslation } from "react-i18next";
+import { SearchInput } from "@/components/common/search-input.tsx";
+import { CustomAvatar } from "@/components/ui/custom-avatar.tsx";
+import { usePageAttachmentsQuery } from "@/features/attachments/queries/attachment-query.ts";
+import { IPageAttachment } from "@/features/attachments/types/attachment.types.ts";
+import { AttachmentFileIcon } from "@/features/attachments/components/attachment-file-icon.tsx";
+import { formatBytes } from "@/lib";
+import { getFileUrl } from "@/lib/config.ts";
+import { formattedDate } from "@/lib/time.ts";
+
+interface PageAttachmentsModalProps {
+  pageId: string;
+  open: boolean;
+  onClose: () => void;
+}
+
+export default function PageAttachmentsModal({
+  pageId,
+  open,
+  onClose,
+}: PageAttachmentsModalProps) {
+  const { t } = useTranslation();
+
+  return (
+    <Modal
+      opened={open}
+      onClose={onClose}
+      title={t("Attachments")}
+      size={800}
+      closeButtonProps={{ "aria-label": t("Close") }}
+    >
+      <PageAttachmentsList pageId={pageId} />
+    </Modal>
+  );
+}
+
+function PageAttachmentsList({ pageId }: { pageId: string }) {
+  const { t } = useTranslation();
+  const [search, setSearch] = useState("");
+  const {
+    data,
+    isLoading,
+    isError,
+    isFetching,
+    fetchNextPage,
+    hasNextPage,
+    isFetchingNextPage,
+  } = usePageAttachmentsQuery(pageId, search);
+
+  const attachments = useMemo(
+    () => data?.pages.flatMap((page) => page.items) ?? [],
+    [data],
+  );
+
+  const loadMoreRef = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    const sentinel = loadMoreRef.current;
+    if (!sentinel || !hasNextPage) return;
+
+    const observer = new IntersectionObserver(
+      (entries) => {
+        if (entries[0].isIntersecting && !isFetching) {
+          fetchNextPage();
+        }
+      },
+      { threshold: 0.1 },
+    );
+
+    observer.observe(sentinel);
+    return () => observer.disconnect();
+  }, [fetchNextPage, hasNextPage, isFetching]);
+
+  const handleSearch = useCallback((value: string) => setSearch(value), []);
+
+  return (
+    <>
+      <SearchInput
+        onSearch={handleSearch}
+        placeholder={t("Search attachments...")}
+      />
+
+      {isLoading ? (
+        <Center py="xl">
+          <Loader size="sm" />
+        </Center>
+      ) : isError ? (
+        <Center py="xl">
+          <Text size="sm" c="dimmed">
+            {t("Error loading attachments.")}
+          </Text>
+        </Center>
+      ) : attachments.length === 0 ? (
+        <Center py="xl">
+          <Text size="sm" c="dimmed">
+            {search
+              ? t("No results found")
+              : t("No attachments on this page yet.")}
+          </Text>
+        </Center>
+      ) : (
+        <ScrollArea.Autosize mah={480} type="scroll" scrollbarSize={5}>
+          {attachments.map((attachment) => (
+            <AttachmentRow key={attachment.id} attachment={attachment} />
+          ))}
+          {hasNextPage && <div ref={loadMoreRef} style={{ height: 1 }} />}
+          {isFetchingNextPage && (
+            <Center py="sm">
+              <Loader size="sm" />
+            </Center>
+          )}
+        </ScrollArea.Autosize>
+      )}
+    </>
+  );
+}
+
+function AttachmentRow({ attachment }: { attachment: IPageAttachment }) {
+  const { t } = useTranslation();
+  const fileUrl = getFileUrl(attachment.url);
+
+  return (
+    <Group wrap="nowrap" gap="md" py="sm" pr="xs">
+      <AttachmentFileIcon
+        fileExt={attachment.fileExt}
+        mimeType={attachment.mimeType}
+      />
+
+      <div style={{ flex: 1, minWidth: 0 }}>
+        <Anchor
+          href={fileUrl}
+          target="_blank"
+          rel="noopener noreferrer"
+          size="sm"
+          fw={500}
+          c="inherit"
+          truncate="end"
+          style={{ display: "block" }}
+        >
+          {attachment.fileName}
+        </Anchor>
+        <Text size="xs" c="dimmed" mt={2} truncate="end">
+          {formatBytes(Number(attachment.fileSize))}
+          {" · "}
+          {formattedDate(new Date(attachment.createdAt))}
+        </Text>
+      </div>
+
+      {attachment.creator && (
+        <Tooltip
+          label={t("Uploaded by {{name}}", { name: attachment.creator.name })}
+          withArrow
+        >
+          <CustomAvatar
+            avatarUrl={attachment.creator.avatarUrl}
+            name={attachment.creator.name}
+            size="sm"
+          />
+        </Tooltip>
+      )}
+
+      <Tooltip label={t("Download attachment")} withArrow>
+        <ActionIcon
+          component="a"
+          href={fileUrl}
+          download={attachment.fileName}
+          target="_blank"
+          rel="noopener noreferrer"
+          variant="subtle"
+          color="gray"
+          aria-label={t("Download {{name}}", { name: attachment.fileName })}
+        >
+          <IconDownload size={18} />
+        </ActionIcon>
+      </Tooltip>
+    </Group>
+  );
+}

apps/client/src/features/attachments/queries/attachment-query.ts

@@ -0,0 +1,25 @@
+import {
+  InfiniteData,
+  keepPreviousData,
+  useInfiniteQuery,
+  UseInfiniteQueryResult,
+} from "@tanstack/react-query";
+import { getPageAttachments } from "@/features/attachments/services/attachment-service.ts";
+import { IPageAttachment } from "@/features/attachments/types/attachment.types.ts";
+import { IPagination } from "@/lib/types.ts";
+
+export function usePageAttachmentsQuery(
+  pageId: string,
+  search?: string,
+): UseInfiniteQueryResult<InfiniteData<IPagination<IPageAttachment>, unknown>> {
+  return useInfiniteQuery({
+    queryKey: ["page-attachments", pageId, search],
+    queryFn: ({ pageParam }) =>
+      getPageAttachments(pageId, { cursor: pageParam, query: search }),
+    enabled: !!pageId,
+    gcTime: 0,
+    placeholderData: keepPreviousData,
+    initialPageParam: undefined,
+    getNextPageParam: (lastPage) => lastPage.meta?.nextCursor ?? undefined,
+  });
+}

apps/client/src/features/attachments/services/attachment-service.ts

@@ -3,7 +3,17 @@ import loadImage from "blueimp-load-image";
 import {
   AvatarIconType,
   IAttachment,
+  IPageAttachment,
 } from "@/features/attachments/types/attachment.types.ts";
+import { IPagination, QueryParams } from "@/lib/types.ts";
+
+export async function getPageAttachments(
+  pageId: string,
+  params?: QueryParams,
+): Promise<IPagination<IPageAttachment>> {
+  const req = await api.post("/pages/attachments", { pageId, ...params });
+  return req.data;
+}
 
 async function compressAndResizeIcon(
   file: File,

apps/client/src/features/attachments/services/index.ts

@@ -1,4 +1,5 @@
 export {
+  getPageAttachments,
   uploadIcon,
   uploadUserAvatar,
   uploadSpaceIcon,

apps/client/src/features/attachments/types/attachment.types.ts

@@ -15,6 +15,15 @@ export interface IAttachment {
   deletedAt: string | null;
 }
 
+export interface IPageAttachment extends IAttachment {
+  url: string;
+  creator: {
+    id: string;
+    name: string;
+    avatarUrl: string | null;
+  } | null;
+}
+
 export enum AvatarIconType {
   AVATAR = "avatar",
   SPACE_ICON = "space-icon",

apps/client/src/features/comment/components/comment-editor.tsx

@@ -103,6 +103,7 @@ const CommentEditor = forwardRef(
       },
       content: defaultContent,
       editable,
+      textDirection: "auto",
       immediatelyRender: true,
       shouldRerenderOnTransaction: false,
       autofocus: (autofocus && "end") || false,

apps/client/src/features/editor/components/transclusion/transclusion-content.tsx

@@ -40,6 +40,7 @@ export default function TransclusionContent({ content }: Props) {
       <EditorProvider
         editable={false}
         immediatelyRender={true}
+        textDirection="auto"
         extensions={extensions}
         content={content as any}
       />

apps/client/src/features/editor/page-editor.tsx

@@ -249,6 +249,7 @@ function CollabPageEditor({
     {
       extensions,
       editable,
+      textDirection: "auto",
       immediatelyRender: true,
       shouldRerenderOnTransaction: false,
       editorProps: {
@@ -484,6 +485,7 @@ function StaticPageEditor({
     <EditorProvider
       editable={false}
       immediatelyRender={true}
+      textDirection="auto"
       extensions={mainExtensions}
       content={content}
       editorProps={{

apps/client/src/features/editor/readonly-page-editor.tsx

@@ -85,6 +85,7 @@ export default function ReadonlyPageEditor({
         <EditorProvider
           editable={false}
           immediatelyRender={true}
+          textDirection="auto"
           extensions={titleExtensions}
           content={title}
         ></EditorProvider>
@@ -93,6 +94,7 @@ export default function ReadonlyPageEditor({
       <EditorProvider
         editable={false}
         immediatelyRender={true}
+        textDirection="auto"
         extensions={extensions}
         content={content}
         onCreate={({ editor }) => {

apps/client/src/features/editor/styles/table.css

@@ -54,7 +54,7 @@
         var(--mantine-color-dark-5)
       );
       font-weight: bold;
-      text-align: left;
+      text-align: start;
     }
 
     .column-resize-handle {

apps/client/src/features/editor/title-editor.tsx

@@ -86,6 +86,7 @@ export function TitleEditor({
     },
     editable: editable,
     content: title,
+    textDirection: "auto",
     immediatelyRender: true,
     shouldRerenderOnTransaction: false,
     editorProps: {

apps/client/src/features/page-history/atoms/history-atoms.ts

@@ -6,4 +6,13 @@ export const activeHistoryPrevIdAtom = atom<string>("");
 export const highlightChangesAtom = atom<boolean>(true);
 
 export type DiffCounts = { added: number; deleted: number; total: number };
-export const diffCountsAtom = atom<DiffCounts | null>(null);
+export const diffCountsAtom = atom<DiffCounts | null>(
+  null as DiffCounts | null,
+);
+
+export type ComparePair = { newerId: string; olderId: string };
+export const compareModeAtom = atom<boolean>(false);
+export const compareSelectionAtom = atom<string[]>([]);
+export const comparePairAtom = atom<ComparePair | null>(
+  null as ComparePair | null,
+);

apps/client/src/features/page-history/components/css/history.module.css

@@ -1,7 +1,7 @@
 .history {
-  display: block;
+  display: flex;
+  align-items: center;
   width: 100%;
-  padding: var(--mantine-spacing-md);
   color: light-dark(var(--mantine-color-black), var(--mantine-color-dark-0));
 
   @mixin hover {
@@ -12,6 +12,28 @@
   }
 }
 
+.historyButton {
+  flex: 1;
+  min-width: 0;
+  color: inherit;
+}
+
+.compareCheckbox {
+  padding-left: var(--mantine-spacing-xs);
+}
+
+.itemMenu {
+  opacity: 0;
+  margin-right: var(--mantine-spacing-xs);
+}
+
+.history:hover .itemMenu,
+.history:focus-within .itemMenu,
+.history.active .itemMenu,
+.itemMenu[aria-expanded="true"] {
+  opacity: 1;
+}
+
 .historyEditor {
   :global(.ProseMirror) {
     padding: 0 !important;
@@ -77,3 +99,8 @@
   flex: 1;
   padding: rem(16px) rem(40px);
 }
+
+.compareBanner {
+  border-bottom: rem(1px) solid
+    light-dark(var(--mantine-color-gray-3), var(--mantine-color-dark-4));
+}

apps/client/src/features/page-history/components/history-editor.tsx

@@ -31,6 +31,7 @@ export function HistoryEditor({
   const editor = useEditor({
     extensions: mainExtensions,
     editable: false,
+    textDirection: "auto",
   });
 
   useEffect(() => {
@@ -170,7 +171,6 @@ export function HistoryEditor({
     }
 
     const total = addedCount + deletedCount;
-    // @ts-ignore
     setDiffCounts({ added: addedCount, deleted: deletedCount, total });
 
     editor.setOptions({

apps/client/src/features/page-history/components/history-item.tsx

@@ -1,10 +1,21 @@
-import { Text, Group, UnstyledButton, Avatar, Tooltip } from "@mantine/core";
+import {
+  Text,
+  Group,
+  UnstyledButton,
+  Avatar,
+  Tooltip,
+  ActionIcon,
+  Checkbox,
+  Menu,
+} from "@mantine/core";
+import { IconDots } from "@tabler/icons-react";
 import { CustomAvatar } from "@/components/ui/custom-avatar.tsx";
 import { formattedDate } from "@/lib/time";
 import classes from "./css/history.module.css";
 import clsx from "clsx";
 import { IPageHistory } from "@/features/page-history/types/page.types";
 import { memo, useCallback } from "react";
+import { useTranslation } from "react-i18next";
 
 const MAX_VISIBLE_AVATARS = 5;
 
@@ -15,6 +26,13 @@ interface HistoryItemProps {
   onHover?: (id: string, index: number) => void;
   onHoverEnd?: () => void;
   isActive: boolean;
+  compareMode: boolean;
+  isChecked: boolean;
+  isCheckboxDisabled: boolean;
+  canCompare: boolean;
+  onToggleCompare: (id: string) => void;
+  onStartCompare: (id: string) => void;
+  onRestore?: (id: string, index: number) => void;
 }
 
 const HistoryItem = memo(function HistoryItem({
@@ -24,10 +42,24 @@ const HistoryItem = memo(function HistoryItem({
   onHover,
   onHoverEnd,
   isActive,
+  compareMode,
+  isChecked,
+  isCheckboxDisabled,
+  canCompare,
+  onToggleCompare,
+  onStartCompare,
+  onRestore,
 }: HistoryItemProps) {
+  const { t } = useTranslation();
+  const date = formattedDate(new Date(historyItem.createdAt));
+
   const handleClick = useCallback(() => {
-    onSelect(historyItem.id, index);
-  }, [onSelect, historyItem.id, index]);
+    if (compareMode) {
+      onToggleCompare(historyItem.id);
+    } else {
+      onSelect(historyItem.id, index);
+    }
+  }, [compareMode, onToggleCompare, onSelect, historyItem.id, index]);
 
   const handleMouseEnter = useCallback(() => {
     onHover?.(historyItem.id, index);
@@ -37,63 +69,115 @@ const HistoryItem = memo(function HistoryItem({
   const hasContributors = contributors && contributors.length > 0;
 
   return (
-    <UnstyledButton
-      p="xs"
-      onClick={handleClick}
+    <div
+      className={clsx(classes.history, { [classes.active]: isActive })}
       onMouseEnter={handleMouseEnter}
       onMouseLeave={onHoverEnd}
-      className={clsx(classes.history, { [classes.active]: isActive })}
     >
-      <Text size="sm">{formattedDate(new Date(historyItem.createdAt))}</Text>
+      {compareMode && (
+        <Checkbox
+          size="xs"
+          className={classes.compareCheckbox}
+          checked={isChecked}
+          disabled={isCheckboxDisabled}
+          onChange={() => onToggleCompare(historyItem.id)}
+          aria-label={t("Select version from {{date}}", { date })}
+        />
+      )}
 
-      <Group gap={6} wrap="nowrap" mt={4}>
-        {hasContributors ? (
-          <>
-            <Tooltip.Group openDelay={300} closeDelay={100}>
-              <Avatar.Group spacing={8}>
-                {contributors.slice(0, MAX_VISIBLE_AVATARS).map((contributor) => (
-                  <Tooltip key={contributor.id} label={contributor.name} withArrow>
-                    <CustomAvatar
-                      size="sm"
-                      avatarUrl={contributor.avatarUrl}
-                      name={contributor.name}
-                    />
-                  </Tooltip>
-                ))}
-                {contributors.length > MAX_VISIBLE_AVATARS && (
-                  <Tooltip
-                    withArrow
-                    label={contributors.slice(MAX_VISIBLE_AVATARS).map((c) => (
-                      <div key={c.id}>{c.name}</div>
+      <UnstyledButton
+        p="xs"
+        onClick={handleClick}
+        className={classes.historyButton}
+      >
+        <Text size="sm">{date}</Text>
+
+        <Group gap={6} wrap="nowrap" mt={4}>
+          {hasContributors ? (
+            <>
+              <Tooltip.Group openDelay={300} closeDelay={100}>
+                <Avatar.Group spacing={8}>
+                  {contributors
+                    .slice(0, MAX_VISIBLE_AVATARS)
+                    .map((contributor) => (
+                      <Tooltip
+                        key={contributor.id}
+                        label={contributor.name}
+                        withArrow
+                      >
+                        <CustomAvatar
+                          size="sm"
+                          avatarUrl={contributor.avatarUrl}
+                          name={contributor.name}
+                        />
+                      </Tooltip>
                     ))}
-                  >
-                    <Avatar size="sm" color="gray">
-                      +{contributors.length - MAX_VISIBLE_AVATARS}
-                    </Avatar>
-                  </Tooltip>
-                )}
-              </Avatar.Group>
-            </Tooltip.Group>
-            {contributors.length === 1 && (
+                  {contributors.length > MAX_VISIBLE_AVATARS && (
+                    <Tooltip
+                      withArrow
+                      label={contributors
+                        .slice(MAX_VISIBLE_AVATARS)
+                        .map((c) => (
+                          <div key={c.id}>{c.name}</div>
+                        ))}
+                    >
+                      <Avatar size="sm" color="gray">
+                        +{contributors.length - MAX_VISIBLE_AVATARS}
+                      </Avatar>
+                    </Tooltip>
+                  )}
+                </Avatar.Group>
+              </Tooltip.Group>
+              {contributors.length === 1 && (
+                <Text size="sm" c="dimmed" lineClamp={1}>
+                  {contributors[0].name}
+                </Text>
+              )}
+            </>
+          ) : (
+            <>
+              <CustomAvatar
+                size="sm"
+                avatarUrl={historyItem.lastUpdatedBy?.avatarUrl}
+                name={historyItem.lastUpdatedBy?.name}
+              />
               <Text size="sm" c="dimmed" lineClamp={1}>
-                {contributors[0].name}
+                {historyItem.lastUpdatedBy?.name}
               </Text>
+            </>
+          )}
+        </Group>
+      </UnstyledButton>
+
+      {!compareMode && (
+        <Menu shadow="md" width={180} position="bottom-end">
+          <Menu.Target>
+            <ActionIcon
+              variant="subtle"
+              color="gray"
+              className={classes.itemMenu}
+              aria-label={t("Version actions for {{date}}", { date })}
+              onClick={(e) => e.stopPropagation()}
+            >
+              <IconDots size={18} />
+            </ActionIcon>
+          </Menu.Target>
+          <Menu.Dropdown>
+            <Menu.Item
+              disabled={!canCompare}
+              onClick={() => onStartCompare(historyItem.id)}
+            >
+              {t("Compare")}
+            </Menu.Item>
+            {onRestore && (
+              <Menu.Item onClick={() => onRestore(historyItem.id, index)}>
+                {t("Restore")}
+              </Menu.Item>
             )}
-          </>
-        ) : (
-          <>
-            <CustomAvatar
-              size="sm"
-              avatarUrl={historyItem.lastUpdatedBy?.avatarUrl}
-              name={historyItem.lastUpdatedBy?.name}
-            />
-            <Text size="sm" c="dimmed" lineClamp={1}>
-              {historyItem.lastUpdatedBy?.name}
-            </Text>
-          </>
-        )}
-      </Group>
-    </UnstyledButton>
+          </Menu.Dropdown>
+        </Menu>
+      )}
+    </div>
   );
 });
 

apps/client/src/features/page-history/components/history-list.tsx

@@ -6,8 +6,12 @@ import HistoryItem from "@/features/page-history/components/history-item";
 import {
   activeHistoryIdAtom,
   activeHistoryPrevIdAtom,
+  compareModeAtom,
+  comparePairAtom,
+  compareSelectionAtom,
   historyAtoms,
 } from "@/features/page-history/atoms/history-atoms";
+import { resolveComparePair } from "@/features/page-history/utils/resolve-compare-pair";
 import { useAtom, useSetAtom } from "jotai";
 import { useCallback, useEffect, useMemo, useRef } from "react";
 import {
@@ -32,6 +36,9 @@ function HistoryList({ pageId }: Props) {
   const [activeHistoryId, setActiveHistoryId] = useAtom(activeHistoryIdAtom);
   const setActiveHistoryPrevId = useSetAtom(activeHistoryPrevIdAtom);
   const setHistoryModalOpen = useSetAtom(historyAtoms);
+  const [compareMode, setCompareMode] = useAtom(compareModeAtom);
+  const [compareSelection, setCompareSelection] = useAtom(compareSelectionAtom);
+  const setComparePair = useSetAtom(comparePairAtom);
 
   const {
     data: pageHistoryData,
@@ -79,10 +86,58 @@ function HistoryList({ pageId }: Props) {
 
   const handleSelect = useCallback(
     (id: string, index: number) => {
+      setComparePair(null);
       setActiveHistoryId(id);
       setActiveHistoryPrevId(historyItems[index + 1]?.id ?? "");
     },
-    [historyItems, setActiveHistoryId, setActiveHistoryPrevId],
+    [historyItems, setActiveHistoryId, setActiveHistoryPrevId, setComparePair],
+  );
+
+  const handleToggleCompare = useCallback(
+    (id: string) => {
+      setCompareSelection((prev) => {
+        if (prev.includes(id)) return prev.filter((item) => item !== id);
+        if (prev.length >= 2) return prev;
+        return [...prev, id];
+      });
+    },
+    [setCompareSelection],
+  );
+
+  const handleStartCompare = useCallback(
+    (id: string) => {
+      setComparePair(null);
+      setCompareMode(true);
+      setCompareSelection([id]);
+    },
+    [setComparePair, setCompareMode, setCompareSelection],
+  );
+
+  const handleCancelCompare = useCallback(() => {
+    setCompareMode(false);
+    setCompareSelection([]);
+  }, [setCompareMode, setCompareSelection]);
+
+  const handleConfirmCompare = useCallback(() => {
+    const pair = resolveComparePair(historyItems, compareSelection);
+    if (!pair) return;
+    setComparePair(pair);
+    setCompareMode(false);
+    setCompareSelection([]);
+  }, [
+    historyItems,
+    compareSelection,
+    setComparePair,
+    setCompareMode,
+    setCompareSelection,
+  ]);
+
+  const handleRestoreItem = useCallback(
+    (id: string, index: number) => {
+      handleSelect(id, index);
+      confirmRestore(id);
+    },
+    [handleSelect, confirmRestore],
   );
 
   useEffect(() => {
@@ -138,6 +193,16 @@ function HistoryList({ pageId }: Props) {
             onHover={handleHover}
             onHoverEnd={clearPrefetchTimeout}
             isActive={historyItem.id === activeHistoryId}
+            compareMode={compareMode}
+            isChecked={compareSelection.includes(historyItem.id)}
+            isCheckboxDisabled={
+              !compareSelection.includes(historyItem.id) &&
+              compareSelection.length >= 2
+            }
+            canCompare={historyItems.length >= 2}
+            onToggleCompare={handleToggleCompare}
+            onStartCompare={handleStartCompare}
+            onRestore={canRestore ? handleRestoreItem : undefined}
           />
         ))}
         {hasNextPage && <div ref={loadMoreRef} style={{ height: 1 }} />}
@@ -148,22 +213,44 @@ function HistoryList({ pageId }: Props) {
         )}
       </ScrollArea>
 
-      {canRestore && (
+      {compareMode ? (
         <>
           <Divider />
           <Group p="xs" wrap="nowrap">
             <Button
               variant="default"
               size="compact-md"
-              onClick={() => setHistoryModalOpen(false)}
+              onClick={handleCancelCompare}
             >
               {t("Cancel")}
             </Button>
-            <Button size="compact-md" onClick={confirmRestore}>
-              {t("Restore")}
+            <Button
+              size="compact-md"
+              disabled={compareSelection.length !== 2}
+              onClick={handleConfirmCompare}
+            >
+              {t("Compare")}
             </Button>
           </Group>
         </>
+      ) : (
+        canRestore && (
+          <>
+            <Divider />
+            <Group p="xs" wrap="nowrap">
+              <Button
+                variant="default"
+                size="compact-md"
+                onClick={() => setHistoryModalOpen(false)}
+              >
+                {t("Cancel")}
+              </Button>
+              <Button size="compact-md" onClick={() => confirmRestore()}>
+                {t("Restore")}
+              </Button>
+            </Group>
+          </>
+        )
       )}
     </div>
   );

apps/client/src/features/page-history/components/history-modal-body.tsx

@@ -1,5 +1,6 @@
 import {
   ActionIcon,
+  CloseButton,
   Group,
   Paper,
   ScrollArea,
@@ -12,17 +13,20 @@ import { useAtom, useAtomValue } from "jotai";
 import {
   activeHistoryIdAtom,
   activeHistoryPrevIdAtom,
+  comparePairAtom,
   diffCountsAtom,
   highlightChangesAtom,
 } from "@/features/page-history/atoms/history-atoms";
 import HistoryView from "@/features/page-history/components/history-view";
-import { useRef } from "react";
+import { useMemo, useRef } from "react";
 import { IconChevronUp, IconChevronDown } from "@tabler/icons-react";
 import { useTranslation } from "react-i18next";
 import {
   useDiffNavigation,
   useHistoryReset,
 } from "@/features/page-history/hooks";
+import { usePageHistoryListQuery } from "@/features/page-history/queries/page-history-query";
+import { formattedDate } from "@/lib/time";
 
 interface Props {
   pageId: string;
@@ -36,6 +40,28 @@ export default function HistoryModalBody({ pageId }: Props) {
   const activeHistoryPrevId = useAtomValue(activeHistoryPrevIdAtom);
   const [highlightChanges, setHighlightChanges] = useAtom(highlightChangesAtom);
   const diffCounts = useAtomValue(diffCountsAtom);
+  const [comparePair, setComparePair] = useAtom(comparePairAtom);
+
+  const { data: pageHistoryData } = usePageHistoryListQuery(pageId);
+  const historyItems = useMemo(
+    () => pageHistoryData?.pages.flatMap((page) => page.items) ?? [],
+    [pageHistoryData],
+  );
+
+  const compareLabel = useMemo(() => {
+    if (!comparePair) return null;
+    const newerItem = historyItems.find(
+      (item) => item.id === comparePair.newerId,
+    );
+    const olderItem = historyItems.find(
+      (item) => item.id === comparePair.olderId,
+    );
+    if (!newerItem || !olderItem) return null;
+    return t("Comparing {{newer}} and {{older}}", {
+      newer: formattedDate(new Date(newerItem.createdAt)),
+      older: formattedDate(new Date(olderItem.createdAt)),
+    });
+  }, [comparePair, historyItems, t]);
 
   useHistoryReset(pageId);
   const { currentChangeIndex, handlePrevChange, handleNextChange } =
@@ -50,6 +76,25 @@ export default function HistoryModalBody({ pageId }: Props) {
       </nav>
 
       <div style={{ position: "relative", flex: 1 }}>
+        {comparePair && (
+          <Group
+            justify="space-between"
+            wrap="nowrap"
+            px="md"
+            py={4}
+            className={classes.compareBanner}
+          >
+            <Text size="sm" fw={500} lineClamp={1}>
+              {compareLabel ?? t("Compare versions")}
+            </Text>
+            <CloseButton
+              size="sm"
+              aria-label={t("Exit compare")}
+              onClick={() => setComparePair(null)}
+            />
+          </Group>
+        )}
+
         <ScrollArea
           h={650}
           w="100%"
@@ -57,11 +102,18 @@ export default function HistoryModalBody({ pageId }: Props) {
           viewportRef={scrollViewportRef}
         >
           <div className={classes.sidebarRightSection}>
-            {activeHistoryId && <HistoryView />}
+            {comparePair ? (
+              <HistoryView
+                historyId={comparePair.newerId}
+                prevHistoryId={comparePair.olderId}
+              />
+            ) : (
+              activeHistoryId && <HistoryView />
+            )}
           </div>
         </ScrollArea>
 
-        {activeHistoryId && activeHistoryPrevId && (
+        {(comparePair || (activeHistoryId && activeHistoryPrevId)) && (
           <Paper
             shadow="md"
             radius="xl"

apps/client/src/features/page-history/components/history-modal-mobile.tsx

@@ -166,7 +166,7 @@ export default function HistoryModalMobile({ pageId, pageTitle }: Props) {
           <Button variant="default" onClick={() => setHistoryModalOpen(false)}>
             {t("Cancel")}
           </Button>
-          <Button onClick={confirmRestore}>{t("Restore")}</Button>
+          <Button onClick={() => confirmRestore()}>{t("Restore")}</Button>
         </Group>
       )}
 

apps/client/src/features/page-history/components/history-view.tsx

@@ -7,21 +7,29 @@ import {
   activeHistoryPrevIdAtom,
 } from "@/features/page-history/atoms/history-atoms";
 
-function HistoryView() {
+interface Props {
+  historyId?: string;
+  prevHistoryId?: string;
+}
+
+function HistoryView({ historyId, prevHistoryId }: Props) {
   const { t } = useTranslation();
-  const historyId = useAtomValue(activeHistoryIdAtom);
-  const prevHistoryId = useAtomValue(activeHistoryPrevIdAtom);
+  const activeId = useAtomValue(activeHistoryIdAtom);
+  const activePrevId = useAtomValue(activeHistoryPrevIdAtom);
+
+  const resolvedId = historyId ?? activeId;
+  const resolvedPrevId = prevHistoryId ?? activePrevId;
 
   const {
     data,
     isLoading: isLoadingCurrent,
     isError: isErrorCurrent,
-  } = usePageHistoryQuery(historyId);
+  } = usePageHistoryQuery(resolvedId);
   const {
     data: prevData,
     isLoading: isLoadingPrev,
     isError: isErrorPrev,
-  } = usePageHistoryQuery(prevHistoryId);
+  } = usePageHistoryQuery(resolvedPrevId);
 
   if (isLoadingCurrent || isLoadingPrev) {
     return <></>;

apps/client/src/features/page-history/hooks/use-history-reset.ts

@@ -3,22 +3,45 @@ import { useEffect } from "react";
 import {
   activeHistoryIdAtom,
   activeHistoryPrevIdAtom,
+  compareModeAtom,
+  comparePairAtom,
+  compareSelectionAtom,
   diffCountsAtom,
 } from "@/features/page-history/atoms/history-atoms";
 
 /**
  * Resets history state when pageId changes.
- * Clears active selection and diff counts.
+ * Clears active selection, diff counts, and compare state.
+ * Compare state also resets on unmount so reopening the modal starts clean.
  */
 export function useHistoryReset(pageId: string) {
   const [, setActiveHistoryId] = useAtom(activeHistoryIdAtom);
   const [, setActiveHistoryPrevId] = useAtom(activeHistoryPrevIdAtom);
   const [, setDiffCounts] = useAtom(diffCountsAtom);
+  const [, setCompareMode] = useAtom(compareModeAtom);
+  const [, setCompareSelection] = useAtom(compareSelectionAtom);
+  const [, setComparePair] = useAtom(comparePairAtom);
 
   useEffect(() => {
+    const resetCompare = () => {
+      setCompareMode(false);
+      setCompareSelection([]);
+      setComparePair(null);
+    };
+
     setActiveHistoryId("");
     setActiveHistoryPrevId("");
-    // @ts-ignore
     setDiffCounts(null);
-  }, [pageId, setActiveHistoryId, setActiveHistoryPrevId, setDiffCounts]);
+    resetCompare();
+
+    return resetCompare;
+  }, [
+    pageId,
+    setActiveHistoryId,
+    setActiveHistoryPrevId,
+    setDiffCounts,
+    setCompareMode,
+    setCompareSelection,
+    setComparePair,
+  ]);
 }

apps/client/src/features/page-history/hooks/use-history-restore.tsx

@@ -1,4 +1,4 @@
-import { useAtom, useAtomValue, useSetAtom } from "jotai";
+import { useAtomValue, useSetAtom } from "jotai";
 import { useCallback } from "react";
 import { useTranslation } from "react-i18next";
 import { Text } from "@mantine/core";
@@ -9,7 +9,8 @@ import {
   activeHistoryIdAtom,
   historyAtoms,
 } from "@/features/page-history/atoms/history-atoms";
-import { usePageHistoryQuery } from "@/features/page-history/queries/page-history-query";
+import { fetchPageHistory } from "@/features/page-history/queries/page-history-query";
+import { IPageHistory } from "@/features/page-history/types/page.types";
 import {
   pageEditorAtom,
   titleEditorAtom,
@@ -25,8 +26,6 @@ export function useHistoryRestore() {
   const { t } = useTranslation();
 
   const activeHistoryId = useAtomValue(activeHistoryIdAtom);
-  const { data: activeHistoryData } = usePageHistoryQuery(activeHistoryId);
-
   const mainEditor = useAtomValue(pageEditorAtom);
   const mainEditorTitle = useAtomValue(titleEditorAtom);
   const setHistoryModalOpen = useSetAtom(historyAtoms);
@@ -40,47 +39,66 @@ export function useHistoryRestore() {
     SpaceCaslSubject.Page,
   );
 
-  const handleRestore = useCallback(() => {
-    if (!activeHistoryData) return;
-    if (
-      !mainEditor ||
-      mainEditor.isDestroyed ||
-      !mainEditorTitle ||
-      mainEditorTitle.isDestroyed
-    ) {
-      return;
-    }
+  const handleRestore = useCallback(
+    async (historyId: string) => {
+      let historyData: IPageHistory;
+      try {
+        historyData = await fetchPageHistory(historyId);
+      } catch {
+        notifications.show({
+          message: t("Error fetching page data."),
+          color: "red",
+        });
+        return;
+      }
 
-    mainEditorTitle
-      .chain()
-      .clearContent()
-      .setContent(activeHistoryData.title, { emitUpdate: true })
-      .run();
+      if (
+        !mainEditor ||
+        mainEditor.isDestroyed ||
+        !mainEditorTitle ||
+        mainEditorTitle.isDestroyed
+      ) {
+        return;
+      }
 
-    mainEditor
-      .chain()
-      .clearContent()
-      .setContent(activeHistoryData.content)
-      .run();
+      mainEditorTitle
+        .chain()
+        .clearContent()
+        .setContent(historyData.title, { emitUpdate: true })
+        .run();
 
-    setHistoryModalOpen(false);
-    notifications.show({ message: t("Successfully restored") });
-  }, [activeHistoryData, mainEditor, mainEditorTitle, setHistoryModalOpen, t]);
+      mainEditor
+        .chain()
+        .clearContent()
+        .setContent(historyData.content)
+        .run();
 
-  const confirmRestore = useCallback(() => {
-    modals.openConfirmModal({
-      title: t("Please confirm your action"),
-      children: (
-        <Text size="sm">
-          {t(
-            "Are you sure you want to restore this version? Any changes not versioned will be lost.",
-          )}
-        </Text>
-      ),
-      labels: { confirm: t("Confirm"), cancel: t("Cancel") },
-      onConfirm: handleRestore,
-    });
-  }, [t, handleRestore]);
+      setHistoryModalOpen(false);
+      notifications.show({ message: t("Successfully restored") });
+    },
+    [mainEditor, mainEditorTitle, setHistoryModalOpen, t],
+  );
+
+  const confirmRestore = useCallback(
+    (historyId?: string) => {
+      const targetId = historyId ?? activeHistoryId;
+      if (!targetId) return;
+
+      modals.openConfirmModal({
+        title: t("Please confirm your action"),
+        children: (
+          <Text size="sm">
+            {t(
+              "Are you sure you want to restore this version? Any changes not versioned will be lost.",
+            )}
+          </Text>
+        ),
+        labels: { confirm: t("Confirm"), cancel: t("Cancel") },
+        onConfirm: () => handleRestore(targetId),
+      });
+    },
+    [t, handleRestore, activeHistoryId],
+  );
 
   return { canRestore, confirmRestore };
 }

apps/client/src/features/page-history/queries/page-history-query.ts

@@ -23,6 +23,14 @@ export function prefetchPageHistory(historyId: string) {
   });
 }
 
+export function fetchPageHistory(historyId: string): Promise<IPageHistory> {
+  return queryClient.fetchQuery({
+    queryKey: ["page-history", historyId],
+    queryFn: () => getPageHistoryById(historyId),
+    staleTime: HISTORY_STALE_TIME,
+  });
+}
+
 export function usePageHistoryListQuery(
   pageId: string,
 ): UseInfiniteQueryResult<InfiniteData<IPagination<IPageHistory>, unknown>> {

apps/client/src/features/page-history/utils/resolve-compare-pair.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, it } from "vitest";
+import { resolveComparePair } from "./resolve-compare-pair";
+
+// list is newest-first, matching usePageHistoryListQuery order
+const items = [{ id: "v3" }, { id: "v2" }, { id: "v1" }];
+
+describe("resolveComparePair", () => {
+  it("orders newer before older regardless of selection order", () => {
+    expect(resolveComparePair(items, ["v1", "v3"])).toEqual({
+      newerId: "v3",
+      olderId: "v1",
+    });
+    expect(resolveComparePair(items, ["v3", "v1"])).toEqual({
+      newerId: "v3",
+      olderId: "v1",
+    });
+  });
+
+  it("returns null unless exactly two versions are selected", () => {
+    expect(resolveComparePair(items, [])).toBeNull();
+    expect(resolveComparePair(items, ["v1"])).toBeNull();
+    expect(resolveComparePair(items, ["v1", "v2", "v3"])).toBeNull();
+  });
+
+  it("returns null when a selected id is not in the list", () => {
+    expect(resolveComparePair(items, ["v1", "missing"])).toBeNull();
+  });
+
+  it("returns null when the same id is selected twice", () => {
+    expect(resolveComparePair(items, ["v2", "v2"])).toBeNull();
+  });
+});

apps/client/src/features/page-history/utils/resolve-compare-pair.ts

@@ -0,0 +1,18 @@
+import { ComparePair } from "@/features/page-history/atoms/history-atoms";
+
+/**
+ * Resolves which of the two selected versions is newer using their position
+ * in the history list (list is newest-first: lower index = newer).
+ */
+export function resolveComparePair(
+  historyItems: { id: string }[],
+  selection: string[],
+): ComparePair | null {
+  if (selection.length !== 2) return null;
+  const indexA = historyItems.findIndex((item) => item.id === selection[0]);
+  const indexB = historyItems.findIndex((item) => item.id === selection[1]);
+  if (indexA === -1 || indexB === -1 || indexA === indexB) return null;
+  return indexA < indexB
+    ? { newerId: selection[0], olderId: selection[1] }
+    : { newerId: selection[1], olderId: selection[0] };
+}

apps/client/src/features/page/components/header/page-header-menu.tsx

@@ -11,6 +11,7 @@ import {
   IconList,
   IconMarkdown,
   IconMessage,
+  IconPaperclip,
   IconPrinter,
   IconStar,
   IconStarFilled,
@@ -42,6 +43,7 @@ import {
 import { formattedDate } from "@/lib/time.ts";
 import { PageEditModeToggle } from "@/features/user/components/page-state-pref.tsx";
 import MovePageModal from "@/features/page/components/move-page-modal.tsx";
+import PageAttachmentsModal from "@/features/attachments/components/page-attachments-modal.tsx";
 import { useTimeAgo } from "@/hooks/use-time-ago.tsx";
 import { PageShareModal } from "@/ee/page-permission";
 import {
@@ -157,6 +159,10 @@ function PageActionMenu({ readOnly }: PageActionMenuProps) {
     verificationOpened,
     { open: openVerificationModal, close: closeVerificationModal },
   ] = useDisclosure(false);
+  const [
+    attachmentsOpened,
+    { open: openAttachmentsModal, close: closeAttachmentsModal },
+  ] = useDisclosure(false);
   const [pageEditor] = useAtom(pageEditorAtom);
   const pageUpdatedAt = useTimeAgo(page?.updatedAt);
   const favoriteIds = useFavoriteIds("page", page?.spaceId);
@@ -293,6 +299,15 @@ function PageActionMenu({ readOnly }: PageActionMenuProps) {
             </Menu.Item>
           )}
 
+          {!page?.isBase && (
+            <Menu.Item
+              leftSection={<IconPaperclip size={16} />}
+              onClick={openAttachmentsModal}
+            >
+              {t("Attachments")}
+            </Menu.Item>
+          )}
+
           {!readOnly && !page?.isBase && (
             <PageVerificationMenuItem
               pageId={page?.id}
@@ -395,6 +410,12 @@ function PageActionMenu({ readOnly }: PageActionMenuProps) {
         opened={verificationOpened}
         onClose={closeVerificationModal}
       />
+
+      <PageAttachmentsModal
+        pageId={page.id}
+        open={attachmentsOpened}
+        onClose={closeAttachmentsModal}
+      />
     </>
   );
 }

apps/server/src/app.module.ts

@@ -27,6 +27,7 @@ import { LoggerModule } from './common/logger/logger.module';
 import { ClsModule } from 'nestjs-cls';
 import { NoopAuditModule } from './integrations/audit/audit.module';
 import { ThrottleModule } from './integrations/throttle/throttle.module';
+import { EncryptionModule } from './integrations/encryption/encryption.module';
 
 const enterpriseModules = [];
 try {
@@ -53,6 +54,7 @@ try {
     CoreModule,
     DatabaseModule,
     EnvironmentModule,
+    EncryptionModule,
     RedisModule.forRootAsync({
       useClass: RedisConfigService,
     }),

apps/server/src/collaboration/collaboration.util.ts

@@ -50,7 +50,12 @@ import {
   Footnote,
   FootnoteReference,
 } from '@docmost/editor-ext';
-import { generateText, getSchema, JSONContent } from '@tiptap/core';
+import {
+  extensions as coreExtensions,
+  generateText,
+  getSchema,
+  JSONContent,
+} from '@tiptap/core';
 import { generateHTML, generateJSON } from '../common/helpers/prosemirror/html';
 // @tiptap/html library works best for generating prosemirror json state but not HTML
 // see: https://github.com/ueberdosis/tiptap/issues/5352
@@ -61,6 +66,7 @@ import * as Y from 'yjs';
 import { Logger } from '@nestjs/common';
 
 export const tiptapExtensions = [
+  coreExtensions.TextDirection.configure({ direction: 'auto' }),
   StarterKit.configure({
     document: false,
     codeBlock: false,

apps/server/src/core/attachment/attachment.controller.ts

@@ -53,8 +53,14 @@ import { EnvironmentService } from '../../integrations/environment/environment.s
 import { TokenService } from '../auth/services/token.service';
 import { JwtAttachmentPayload, JwtType } from '../auth/dto/jwt-payload';
 import * as path from 'path';
-import { AttachmentInfoDto, RemoveIconDto } from './dto/attachment.dto';
+import {
+  AttachmentInfoDto,
+  PageIdDto,
+  RemoveIconDto,
+} from './dto/attachment.dto';
+import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
 import { PageAccessService } from '../page/page-access/page-access.service';
+import { DomainService } from '../../integrations/environment/domain.service';
 import { AuditEvent, AuditResource } from '../../common/events/audit-events';
 import {
   AUDIT_SERVICE,
@@ -75,6 +81,7 @@ export class AttachmentController {
     private readonly environmentService: EnvironmentService,
     private readonly tokenService: TokenService,
     private readonly pageAccessService: PageAccessService,
+    private readonly domainService: DomainService,
     @Inject(AUDIT_SERVICE) private readonly auditService: IAuditService,
   ) {}
 
@@ -151,7 +158,10 @@ export class AttachmentController {
         },
       });
 
-      return res.send(fileResponse);
+      return res.send({
+        ...fileResponse,
+        url: this.buildFileUrl(workspace, fileResponse),
+      });
     } catch (err: any) {
       if (err?.statusCode === 413) {
         const errMessage = `File too large. Exceeds the ${this.environmentService.getFileUploadSizeLimit()} limit`;
@@ -411,7 +421,37 @@ export class AttachmentController {
 
     await this.pageAccessService.validateCanView(page, user);
 
-    return attachment;
+    return { ...attachment, url: this.buildFileUrl(workspace, attachment) };
+  }
+
+  @UseGuards(JwtAuthGuard)
+  @HttpCode(HttpStatus.OK)
+  @Post('pages/attachments')
+  async getPageAttachments(
+    @Body() dto: PageIdDto,
+    @Body() pagination: PaginationOptions,
+    @AuthUser() user: User,
+    @AuthWorkspace() workspace: Workspace,
+  ) {
+    const page = await this.pageRepo.findById(dto.pageId);
+    if (!page || page.workspaceId !== workspace.id) {
+      throw new NotFoundException('Page not found');
+    }
+
+    await this.pageAccessService.validateCanView(page, user);
+
+    const result = await this.attachmentRepo.findPageAttachments(
+      page.id,
+      pagination,
+    );
+
+    return {
+      ...result,
+      items: result.items.map((attachment) => ({
+        ...attachment,
+        url: this.buildFileUrl(workspace, attachment),
+      })),
+    };
   }
 
   @UseGuards(JwtAuthGuard)
@@ -465,6 +505,10 @@ export class AttachmentController {
     }
   }
 
+  private buildFileUrl(workspace: Workspace, attachment: Attachment): string {
+    return `${this.domainService.getUrl(workspace.hostname)}/api/files/${attachment.id}/${encodeURIComponent(attachment.fileName)}`;
+  }
+
   private async sendFileResponse(
     req: FastifyRequest,
     res: FastifyReply,

apps/server/src/core/attachment/dto/attachment.dto.ts

@@ -1,4 +1,11 @@
-import { IsEnum, IsIn, IsNotEmpty, IsOptional, IsUUID } from 'class-validator';
+import {
+  IsEnum,
+  IsIn,
+  IsNotEmpty,
+  IsOptional,
+  IsString,
+  IsUUID,
+} from 'class-validator';
 import { AttachmentType } from '../attachment.constants';
 
 export class AttachmentInfoDto {
@@ -7,6 +14,12 @@ export class AttachmentInfoDto {
   attachmentId: string;
 }
 
+export class PageIdDto {
+  @IsString()
+  @IsNotEmpty()
+  pageId: string;
+}
+
 export class RemoveIconDto {
   @IsEnum(AttachmentType)
   @IsIn([

apps/server/src/database/repos/attachment/attachment.repo.ts

@@ -1,5 +1,8 @@
 import { Injectable } from '@nestjs/common';
 import { InjectKysely } from 'nestjs-kysely';
+import { ExpressionBuilder, sql } from 'kysely';
+import { jsonObjectFrom } from 'kysely/helpers/postgres';
+import { DB } from '@docmost/db/types/db';
 import { KyselyDB, KyselyTransaction } from '@docmost/db/types/kysely.types';
 import { dbOrTx } from '@docmost/db/utils';
 import {
@@ -8,6 +11,8 @@ import {
   UpdatableAttachment,
 } from '@docmost/db/types/entity.types';
 import { AttachmentType } from '../../../core/attachment/attachment.constants';
+import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
+import { executeWithCursorPagination } from '@docmost/db/pagination/cursor-pagination';
 
 @Injectable()
 export class AttachmentRepo {
@@ -89,6 +94,41 @@ export class AttachmentRepo {
       .execute();
   }
 
+  async findPageAttachments(pageId: string, pagination: PaginationOptions) {
+    let query = this.db
+      .selectFrom('attachments')
+      .select(this.baseFields)
+      .select((eb) => this.withCreator(eb))
+      .where('pageId', '=', pageId)
+      .where('type', '=', AttachmentType.File)
+      .where('deletedAt', 'is', null);
+
+    if (pagination.query) {
+      query = query.where(
+        sql`f_unaccent(file_name)`,
+        'ilike',
+        sql`f_unaccent(${'%' + pagination.query + '%'})`,
+      );
+    }
+
+    return executeWithCursorPagination(query, {
+      perPage: pagination.limit,
+      cursor: pagination.cursor,
+      beforeCursor: pagination.beforeCursor,
+      fields: [{ expression: 'id', direction: 'desc' }],
+      parseCursor: (cursor) => ({ id: cursor.id }),
+    });
+  }
+
+  withCreator(eb: ExpressionBuilder<DB, 'attachments'>) {
+    return jsonObjectFrom(
+      eb
+        .selectFrom('users')
+        .select(['users.id', 'users.name', 'users.avatarUrl'])
+        .whereRef('users.id', '=', 'attachments.creatorId'),
+    ).as('creator');
+  }
+
   async findByIds(
     ids: string[],
     opts?: {

apps/server/src/integrations/encryption/encryption.errors.ts

@@ -0,0 +1,13 @@
+export class UnableToInitialize extends Error {
+  constructor(message: string) {
+    super(`Unable to initialize the encryption service: ${message}`);
+    this.name = 'UnableToInitialize';
+  }
+}
+
+export class UnableToDecrypt extends Error {
+  constructor(reason: string) {
+    super(`Unable to decrypt the ciphertext: ${reason}`);
+    this.name = 'UnableToDecrypt';
+  }
+}

apps/server/src/integrations/encryption/encryption.module.ts

@@ -0,0 +1,9 @@
+import { Global, Module } from '@nestjs/common';
+import { EncryptionService } from './encryption.service';
+
+@Global()
+@Module({
+  providers: [EncryptionService],
+  exports: [EncryptionService],
+})
+export class EncryptionModule {}

apps/server/src/integrations/encryption/encryption.service.spec.ts

@@ -0,0 +1,184 @@
+import { Test, TestingModule } from '@nestjs/testing';
+import { EncryptionService } from './encryption.service';
+import { UnableToDecrypt, UnableToInitialize } from './encryption.errors';
+import { EnvironmentService } from '../environment/environment.service';
+
+const APP_SECRET = 'test-app-secret-with-plenty-of-entropy-1234567890';
+
+const buildService = (appSecret: string | undefined) => {
+  const env = { getAppSecret: () => appSecret } as EnvironmentService;
+  return new EncryptionService(env);
+};
+
+const decodeEnvelope = (encrypted: string) =>
+  JSON.parse(Buffer.from(encrypted, 'base64').toString()) as {
+    iv: string;
+    authTag: string;
+    cipherText: string;
+  };
+
+const encodeEnvelope = (envelope: {
+  iv: string;
+  authTag: string;
+  cipherText: string;
+}) => Buffer.from(JSON.stringify(envelope)).toString('base64');
+
+describe('EncryptionService', () => {
+  let service: EncryptionService;
+
+  beforeEach(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [
+        EncryptionService,
+        {
+          provide: EnvironmentService,
+          useValue: { getAppSecret: () => APP_SECRET },
+        },
+      ],
+    }).compile();
+
+    service = module.get<EncryptionService>(EncryptionService);
+  });
+
+  describe('initialization', () => {
+    it('compiles via Nest DI', () => {
+      expect(service).toBeDefined();
+    });
+
+    it('throws UnableToInitialize when APP_SECRET is missing', () => {
+      expect(() => buildService(undefined)).toThrow(UnableToInitialize);
+      expect(() => buildService('')).toThrow(UnableToInitialize);
+    });
+  });
+
+  describe('encrypt + decrypt round-trip', () => {
+    it('decrypts back to the original plaintext', () => {
+      const plaintext = 'hello world';
+      const encrypted = service.encrypt(plaintext);
+      expect(service.decrypt(encrypted)).toBe(plaintext);
+    });
+
+    it('handles empty string', () => {
+      const encrypted = service.encrypt('');
+      expect(service.decrypt(encrypted)).toBe('');
+    });
+
+    it('handles unicode (multi-byte UTF-8)', () => {
+      const plaintext = 'héllo 🔐 世界';
+      const encrypted = service.encrypt(plaintext);
+      expect(service.decrypt(encrypted)).toBe(plaintext);
+    });
+
+    it('handles long plaintext (>1 block)', () => {
+      const plaintext = 'a'.repeat(10_000);
+      const encrypted = service.encrypt(plaintext);
+      expect(service.decrypt(encrypted)).toBe(plaintext);
+    });
+
+    it('produces distinct ciphertexts for the same plaintext (random IV)', () => {
+      const plaintext = 'same input';
+      const a = service.encrypt(plaintext);
+      const b = service.encrypt(plaintext);
+      expect(a).not.toBe(b);
+      expect(service.decrypt(a)).toBe(plaintext);
+      expect(service.decrypt(b)).toBe(plaintext);
+    });
+  });
+
+  describe('cross-key isolation', () => {
+    it('cannot decrypt ciphertext produced under a different APP_SECRET', () => {
+      const other = buildService('totally-different-secret-value-9876543210');
+      const encrypted = service.encrypt('secret');
+      expect(() => other.decrypt(encrypted)).toThrow(UnableToDecrypt);
+    });
+  });
+
+  describe('tamper detection', () => {
+    it('rejects modified ciphertext', () => {
+      const encrypted = service.encrypt('hello');
+      const env = decodeEnvelope(encrypted);
+      const tamperedCipher = Buffer.from(env.cipherText, 'base64');
+      tamperedCipher[0] ^= 0x01;
+      const tampered = encodeEnvelope({
+        ...env,
+        cipherText: tamperedCipher.toString('base64'),
+      });
+      expect(() => service.decrypt(tampered)).toThrow(UnableToDecrypt);
+    });
+
+    it('rejects modified auth tag', () => {
+      const encrypted = service.encrypt('hello');
+      const env = decodeEnvelope(encrypted);
+      const tamperedTag = Buffer.from(env.authTag, 'base64');
+      tamperedTag[0] ^= 0x01;
+      const tampered = encodeEnvelope({
+        ...env,
+        authTag: tamperedTag.toString('base64'),
+      });
+      expect(() => service.decrypt(tampered)).toThrow(UnableToDecrypt);
+    });
+
+    it('rejects modified IV', () => {
+      const encrypted = service.encrypt('hello');
+      const env = decodeEnvelope(encrypted);
+      const tamperedIV = Buffer.from(env.iv, 'base64');
+      tamperedIV[0] ^= 0x01;
+      const tampered = encodeEnvelope({
+        ...env,
+        iv: tamperedIV.toString('base64'),
+      });
+      expect(() => service.decrypt(tampered)).toThrow(UnableToDecrypt);
+    });
+  });
+
+  describe('malformed payloads', () => {
+    it('rejects non-base64 garbage', () => {
+      expect(() => service.decrypt('!!!not-valid-base64!!!')).toThrow(
+        UnableToDecrypt,
+      );
+    });
+
+    it('rejects base64 of non-JSON', () => {
+      const garbage = Buffer.from('not json at all').toString('base64');
+      expect(() => service.decrypt(garbage)).toThrow(UnableToDecrypt);
+    });
+
+    it('rejects JSON missing required fields', () => {
+      const partial = encodeEnvelope({
+        iv: Buffer.alloc(12).toString('base64'),
+        authTag: Buffer.alloc(16).toString('base64'),
+      } as never);
+      expect(() => service.decrypt(partial)).toThrow(UnableToDecrypt);
+    });
+
+    it('rejects wrong-length IV', () => {
+      const encrypted = service.encrypt('hello');
+      const env = decodeEnvelope(encrypted);
+      const bad = encodeEnvelope({
+        ...env,
+        iv: Buffer.alloc(8).toString('base64'),
+      });
+      expect(() => service.decrypt(bad)).toThrow(UnableToDecrypt);
+    });
+
+    it('rejects wrong-length auth tag', () => {
+      const encrypted = service.encrypt('hello');
+      const env = decodeEnvelope(encrypted);
+      const bad = encodeEnvelope({
+        ...env,
+        authTag: Buffer.alloc(8).toString('base64'),
+      });
+      expect(() => service.decrypt(bad)).toThrow(UnableToDecrypt);
+    });
+  });
+
+  describe('envelope format', () => {
+    it('returns base64 of JSON envelope with iv (12B), authTag (16B), cipherText', () => {
+      const encrypted = service.encrypt('hello');
+      const env = decodeEnvelope(encrypted);
+      expect(Buffer.from(env.iv, 'base64')).toHaveLength(12);
+      expect(Buffer.from(env.authTag, 'base64')).toHaveLength(16);
+      expect(Buffer.from(env.cipherText, 'base64').length).toBeGreaterThan(0);
+    });
+  });
+});

apps/server/src/integrations/encryption/encryption.service.ts

@@ -0,0 +1,108 @@
+// https://github.com/nhedger/nestjs-encryption - MIT
+import { Injectable } from '@nestjs/common';
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  randomBytes,
+} from 'node:crypto';
+import { UnableToDecrypt, UnableToInitialize } from './encryption.errors';
+import { EnvironmentService } from '../environment/environment.service';
+
+const ALGORITHM = 'aes-256-gcm';
+const KEY_DOMAIN = 'docmost:encryption:v1';
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+
+type AEADPayload<TFormat = string | Buffer> = {
+  iv: TFormat;
+  authTag: TFormat;
+  cipherText: TFormat;
+};
+
+@Injectable()
+export class EncryptionService {
+  private readonly key: Buffer;
+
+  constructor(environmentService: EnvironmentService) {
+    const appSecret = environmentService.getAppSecret();
+    if (!appSecret) {
+      throw new UnableToInitialize('APP_SECRET is not set.');
+    }
+    this.key = createHash('sha256')
+      .update(KEY_DOMAIN)
+      .update(appSecret)
+      .digest();
+  }
+
+  public encrypt(plaintext: string): string {
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, this.key, iv);
+    const cipherText = Buffer.concat([
+      cipher.update(plaintext, 'utf8'),
+      cipher.final(),
+    ]);
+    const authTag = cipher.getAuthTag();
+
+    const aead: AEADPayload<string> = {
+      iv: iv.toString('base64'),
+      authTag: authTag.toString('base64'),
+      cipherText: cipherText.toString('base64'),
+    };
+
+    return Buffer.from(JSON.stringify(aead)).toString('base64');
+  }
+
+  public decrypt(encrypted: string): string {
+    try {
+      const { iv, authTag, cipherText } = this.decodeAEADPayload(encrypted);
+      const decipher = createDecipheriv(ALGORITHM, this.key, iv);
+      decipher.setAuthTag(authTag);
+      const decrypted = Buffer.concat([
+        decipher.update(cipherText),
+        decipher.final(),
+      ]);
+      return decrypted.toString('utf8');
+    } catch (e: unknown) {
+      throw new UnableToDecrypt((e as Error).message);
+    }
+  }
+
+  private decodeAEADPayload(encodedPayload: string): AEADPayload<Buffer> {
+    const payload = Buffer.from(encodedPayload, 'base64');
+
+    let deserializedPkg: Record<string, unknown>;
+    try {
+      deserializedPkg = JSON.parse(payload.toString());
+    } catch {
+      throw new Error('The decoded AEAD payload is not a valid JSON string.');
+    }
+
+    for (const field of ['iv', 'authTag', 'cipherText']) {
+      if (!Object.prototype.hasOwnProperty.call(deserializedPkg, field)) {
+        throw new Error(`The AEAD payload is missing the ${field} field.`);
+      }
+    }
+
+    const iv = Buffer.from(deserializedPkg.iv as string, 'base64');
+    if (iv.length !== IV_LENGTH) {
+      throw new Error(
+        `The decoded IV is not the correct length. Expected ${IV_LENGTH} bytes, got ${iv.length} bytes.`,
+      );
+    }
+
+    const authTag = Buffer.from(deserializedPkg.authTag as string, 'base64');
+    if (authTag.length !== AUTH_TAG_LENGTH) {
+      throw new Error(
+        `The decoded auth tag is not the correct length. Expected ${AUTH_TAG_LENGTH} bytes, got ${authTag.length} bytes.`,
+      );
+    }
+
+    const cipherText = Buffer.from(
+      deserializedPkg.cipherText as string,
+      'base64',
+    );
+
+    return { iv, authTag, cipherText };
+  }
+}

packages/editor-ext/src/lib/prosemirror-docx/schema.ts

@@ -192,6 +192,7 @@ export const defaultAsyncNodes: NodeSerializerAsync = {
   // No usable static export representation: skip without failing.
   subpages() {},
   transclusionReference() {},
+  base() {},
 };
 
 export const defaultMarks: MarkSerializer = {