fix: remove client compression script

chore: pnpm minor version
chore: update pnpm
2026-08-26 08:17:05 +08:00 · 2026-08-25 15:43:47 +01:00 · 2026-08-25 04:34:11 +01:00 · 2026-08-25 04:31:23 +01:00 · 2026-08-25 03:29:56 +01:00 · 2026-08-25 03:28:59 +01:00
125 changed files with 2283 additions and 2388 deletions
@@ -1,7 +1,7 @@
 FROM node:26-slim AS base
 LABEL org.opencontainers.image.source="https://github.com/docmost/docmost"

-RUN npm install -g pnpm@11.15.1
+RUN npm install -g pnpm@11.23.0

 FROM base AS builder

@@ -18,6 +18,15 @@ RUN apt-get update \
  && apt-get install -y --no-install-recommends curl bash \
  && rm -rf /var/lib/apt/lists/*

+# drop npm and corepack
+RUN rm -rf /usr/local/lib/node_modules/npm \
+  && rm -rf /usr/local/lib/node_modules/corepack \
+  && rm -rf /usr/local/bin/npm \
+  && rm -rf /usr/local/bin/npx \
+  && rm -rf /usr/local/bin/corepack \
+  && rm -rf /root/.npm \
+  && rm -rf /root/.node-gyp
+
 WORKDIR /app

 # Copy apps
@@ -52,7 +52,7 @@
    "mantine-form-zod-resolver": "1.3.0",
    "mermaid": "11.16.1",
    "mitt": "3.0.1",
-    "nanoid": "3.3.17",
+    "nanoid": "3.3.18",
    "posthog-js": "1.391.2",
    "react": "19.2.7",
    "react-clear-modal": "^2.0.18",
@@ -64,6 +64,7 @@
    "react-router-dom": "7.18.2",
    "semver": "7.7.4",
    "socket.io-client": "4.8.3",
+    "yet-another-react-lightbox": "^3.32.2",
    "zod": "4.3.6"
  },
  "devDependencies": {
@@ -696,7 +696,7 @@
  "Upgrade your plan": "Upgrade Ihres Plans",
  "Available with a paid license": "Verfügbar mit einer kostenpflichtigen Lizenz",
  "Upgrade your license tier.": "Stufen Sie Ihre Lizenz hoch.",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "KI ist nur in der Docmost Enterprise-Edition verfügbar. Kontaktieren Sie sales@docmost.com.",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "KI ist in den kostenpflichtigen Docmost-Editionen verfügbar. Kontaktieren Sie sales@docmost.com.",
  "AI & MCP": "KI & MCP",
  "AI": "KI",
  "MCP": "MCP",
@@ -294,6 +294,7 @@
  "Export space": "Export space",
  "Export {{type}}": "Export {{type}}",
  "File exceeds the {{limit}} attachment limit": "File exceeds the {{limit}} attachment limit",
+  "Media": "Media",
  "Align left": "Align left",
  "Align right": "Align right",
  "Align center": "Align center",
@@ -698,7 +699,7 @@
  "Upgrade your plan": "Upgrade your plan",
  "Available with a paid license": "Available with a paid license",
  "Upgrade your license tier.": "Upgrade your license tier.",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "AI is available in the Docmost paid editions. Contact sales@docmost.com.",
  "AI & MCP": "AI & MCP",
  "AI": "AI",
  "MCP": "MCP",
@@ -706,8 +707,9 @@
  "Enable the MCP server to allow AI assistants and tools to interact with your workspace content.": "Enable the MCP server to allow AI assistants and tools to interact with your workspace content.",
  "MCP is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "MCP is only available in the Docmost enterprise edition. Contact sales@docmost.com.",
  "MCP Server URL": "MCP Server URL",
-  "Connect with your Docmost account via OAuth when your client supports it, or use an API key from your account settings.": "Connect with your Docmost account via OAuth when your client supports it, or use an API key from your account settings.",
+  "Use your API key for authentication. You can manage API keys in your account settings.": "Use your API key for authentication. You can manage API keys in your account settings.",
  "Supported tools": "Supported tools",
+  "Your workspace has MCP enabled. Use your API key to connect AI assistants.": "Your workspace has MCP enabled. Use your API key to connect AI assistants.",
  "MCP server URL:": "MCP server URL:",
  "Learn more": "Learn more",
  "Manage API keys for all users in the workspace. View the <anchor>API documentation</anchor> for usage details.": "Manage API keys for all users in the workspace. View the <anchor>API documentation</anchor> for usage details.",
@@ -1302,35 +1304,12 @@
  "No attachments on this page yet.": "No attachments on this page yet.",
  "Uploaded by {{name}}": "Uploaded by {{name}}",
  "Download {{name}}": "Download {{name}}",
-  "Access revoked": "Access revoked",
-  "Authorize application": "Authorize application",
-  "{{name}} wants to access {{workspace}}": "{{name}} wants to access {{workspace}}",
-  "Not you? Switch account": "Not you? Switch account",
-  "This application will be able to:": "This application will be able to:",
-  "Write": "Write",
-  "Invalid authorization request": "Invalid authorization request",
-  "Authorize": "Authorize",
-  "Application": "Application",
-  "Permissions": "Permissions",
-  "Authorized": "Authorized",
-  "Revoke access": "Revoke access",
-  "Revoke access for {{name}}": "Revoke access for {{name}}",
-  "Are you sure you want to revoke access for {{name}}? The application will no longer be able to access your account.": "Are you sure you want to revoke access for {{name}}? The application will no longer be able to access your account.",
-  "Something went wrong. Please try again.": "Something went wrong. Please try again.",
-  "Trusted applications": "Trusted applications",
-  "Remove {{name}}": "Remove {{name}}",
-  "This origin is already trusted.": "This origin is already trusted.",
-  "Trusted application name": "Trusted application name",
-  "Trusted application origin": "Trusted application origin",
-  "I recognize this application and want to continue": "I recognize this application and want to continue",
-  "You will be redirected to": "You will be redirected to",
-  "View content without making changes.": "View content without making changes.",
-  "Create and modify content.": "Create and modify content.",
-  "This application is not on your workspace's trusted list. Authorize only if you recognize it.": "This application is not on your workspace's trusted list. Authorize only if you recognize it.",
-  "Applications with these callback origins are trusted. Members will not see a warning when authorizing them.": "Applications with these callback origins are trusted. Members will not see a warning when authorizing them.",
-  "Enter the app's callback origin, e.g. https://app.yourcompany.com": "Enter the app's callback origin, e.g. https://app.yourcompany.com",
-  "Applications and AI assistants you have authorized to access your account.": "Applications and AI assistants you have authorized to access your account.",
-  "Your workspace has MCP enabled. Connect AI assistants with your Docmost account, or with an API key.": "Your workspace has MCP enabled. Connect AI assistants with your Docmost account, or with an API key.",
-  "Authorized apps": "Authorized apps",
-  "No authorized apps yet.": "No authorized apps yet."
+  "Workspace knowledge only": "Workspace knowledge only",
+  "Restrict AI Chat to answering from your workspace pages and uploaded files only. It will not use outside knowledge.": "Restrict AI Chat to answering from your workspace pages and uploaded files only. It will not use outside knowledge.",
+  "Toggle workspace knowledge only": "Toggle workspace knowledge only",
+  "Read-only mode": "Read-only mode",
+  "AI Chat can search and read workspace content, but cannot create or edit pages.": "AI Chat can search and read workspace content, but cannot create or edit pages.",
+  "Toggle AI Chat read-only mode": "Toggle AI Chat read-only mode",
+  "Title only": "Title only",
+  "you": "you"
 }
@@ -696,7 +696,7 @@
  "Upgrade your plan": "Mejora tu plan",
  "Available with a paid license": "Disponible con una licencia de pago",
  "Upgrade your license tier.": "Mejora el nivel de tu licencia.",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "La IA solo está disponible en la edición empresarial de Docmost. Contacte con sales@docmost.com.",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "La IA está disponible en las ediciones de pago de Docmost. Contacte con sales@docmost.com.",
  "AI & MCP": "IA y MCP",
  "AI": "IA",
  "MCP": "MCP",
@@ -696,7 +696,7 @@
  "Upgrade your plan": "Mettez à niveau votre forfait",
  "Available with a paid license": "Disponible avec une licence payante",
  "Upgrade your license tier.": "Mettez à niveau votre niveau de licence.",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "L'IA n'est disponible que dans l'édition Entreprise de Docmost. Contactez sales@docmost.com.",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "L'IA est disponible dans les éditions payantes de Docmost. Contactez sales@docmost.com.",
  "AI & MCP": "IA & MCP",
  "AI": "IA",
  "MCP": "MCP",
@@ -696,7 +696,7 @@
  "Upgrade your plan": "Aggiorna il tuo piano",
  "Available with a paid license": "Disponibile con una licenza a pagamento",
  "Upgrade your license tier.": "Aggiorna il livello della tua licenza.",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "L'IA è disponibile solo nell'edizione Enterprise di Docmost. Contatta sales@docmost.com.",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "L'IA è disponibile nelle edizioni a pagamento di Docmost. Contatta sales@docmost.com.",
  "AI & MCP": "IA e MCP",
  "AI": "IA",
  "MCP": "MCP",
@@ -696,7 +696,7 @@
  "Upgrade your plan": "プランをアップグレードする",
  "Available with a paid license": "有料ライセンスで利用可能",
  "Upgrade your license tier.": "ライセンスタイアをアップグレードしてください。",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "AI は Docmost のエンタープライズ版でのみ利用可能です。sales@docmost.com までお問い合わせください。",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "AI は Docmost の有料版で利用可能です。sales@docmost.com までお問い合わせください。",
  "AI & MCP": "AI と MCP",
  "AI": "AI",
  "MCP": "MCP",
@@ -696,7 +696,7 @@
  "Upgrade your plan": "요금제를 업그레이드하세요",
  "Available with a paid license": "유료 라이선스에서만 사용 가능합니다",
  "Upgrade your license tier.": "라이선스 등급을 업그레이드하세요.",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "AI는 Docmost 엔터프라이즈 에디션에서만 제공됩니다. sales@docmost.com으로 문의하세요.",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "AI는 Docmost 유료 에디션에서 제공됩니다. sales@docmost.com으로 문의하세요.",
  "AI & MCP": "AI 및 MCP",
  "AI": "AI",
  "MCP": "MCP",
@@ -696,7 +696,7 @@
  "Upgrade your plan": "Upgrade je abonnement",
  "Available with a paid license": "Beschikbaar met een betaalde licentie",
  "Upgrade your license tier.": "Upgrade je licentieniveau.",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "AI is alleen beschikbaar in de Docmost Enterprise-editie. Neem contact op met sales@docmost.com.",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "AI is beschikbaar in de betaalde edities van Docmost. Neem contact op met sales@docmost.com.",
  "AI & MCP": "AI & MCP",
  "AI": "AI",
  "MCP": "MCP",
@@ -696,7 +696,7 @@
  "Upgrade your plan": "Faça upgrade do seu plano",
  "Available with a paid license": "Disponível com uma licença paga",
  "Upgrade your license tier.": "Faça upgrade do seu nível de licença.",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "A IA está disponível apenas na edição empresarial do Docmost. Contate sales@docmost.com.",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "A IA está disponível nas edições pagas do Docmost. Contate sales@docmost.com.",
  "AI & MCP": "IA e MCP",
  "AI": "IA",
  "MCP": "MCP",
@@ -696,7 +696,7 @@
  "Upgrade your plan": "Обновите свой тарифный план",
  "Available with a paid license": "Доступно с платной лицензией",
  "Upgrade your license tier.": "Обновите уровень вашей лицензии.",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "ИИ доступен только в корпоративной версии Docmost. Свяжитесь по адресу sales@docmost.com.",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "ИИ доступен в платных версиях Docmost. Свяжитесь по адресу sales@docmost.com.",
  "AI & MCP": "ИИ и MCP",
  "AI": "ИИ",
  "MCP": "MCP",
@@ -696,7 +696,7 @@
  "Upgrade your plan": "Оновіть свій тарифний план",
  "Available with a paid license": "Доступно за платною ліцензією",
  "Upgrade your license tier.": "Оновіть рівень своєї ліцензії.",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "ШІ доступний лише в корпоративній редакції Docmost. Зверніться до sales@docmost.com.",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "ШІ доступний у платних редакціях Docmost. Зверніться до sales@docmost.com.",
  "AI & MCP": "ШІ та MCP",
  "AI": "ШІ",
  "MCP": "MCP",
@@ -696,7 +696,7 @@
  "Upgrade your plan": "升级您的方案",
  "Available with a paid license": "需付费许可才可用",
  "Upgrade your license tier.": "升级您的许可等级。",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "AI 仅在 Docmost 企业版中提供。请联系 sales@docmost.com。",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "AI 在 Docmost 付费版中提供。请联系 sales@docmost.com。",
  "AI & MCP": "AI 与 MCP",
  "AI": "AI",
  "MCP": "MCP",
@@ -1,61 +1,92 @@
+import { lazy, Suspense, useEffect } from "react";
 import { Navigate, Route, Routes } from "react-router-dom";
-import SetupWorkspace from "@/pages/auth/setup-workspace.tsx";
-import LoginPage from "@/pages/auth/login";
-import Home from "@/pages/dashboard/home";
-import Page from "@/pages/page/page";
-import AccountSettings from "@/pages/settings/account/account-settings";
-import WorkspaceMembers from "@/pages/settings/workspace/workspace-members";
-import WorkspaceSettings from "@/pages/settings/workspace/workspace-settings";
-import Groups from "@/pages/settings/group/groups";
-import GroupInfo from "./pages/settings/group/group-info";
-import Spaces from "@/pages/settings/space/spaces.tsx";
-import { Error404 } from "@/components/ui/error-404.tsx";
-import AccountPreferences from "@/pages/settings/account/account-preferences.tsx";
-import SpaceHome from "@/pages/space/space-home.tsx";
-import PageRedirect from "@/pages/page/page-redirect.tsx";
 import Layout from "@/components/layouts/global/layout.tsx";
-import InviteSignup from "@/pages/auth/invite-signup.tsx";
-import ForgotPassword from "@/pages/auth/forgot-password.tsx";
-import PasswordReset from "./pages/auth/password-reset";
-import Billing from "@/ee/billing/pages/billing.tsx";
-import CloudLogin from "@/ee/pages/cloud-login.tsx";
-import CreateWorkspace from "@/ee/pages/create-workspace.tsx";
+import { Error404 } from "@/components/ui/error-404.tsx";
 import { isCloud } from "@/lib/config.ts";
 import { useTranslation } from "react-i18next";
-import Security from "@/ee/security/pages/security.tsx";
-import License from "@/ee/licence/pages/license.tsx";
 import { useRedirectToCloudSelect } from "@/ee/hooks/use-redirect-to-cloud-select.tsx";
-import SharedPage from "@/pages/share/shared-page.tsx";
-import PdfRenderPage from "@/ee/pdf-export/pdf-render-page.tsx";
-import Shares from "@/pages/settings/shares/shares.tsx";
-import ShareLayout from "@/features/share/components/share-layout.tsx";
-import ShareRedirect from "@/pages/share/share-redirect.tsx";
 import { useTrackOrigin } from "@/hooks/use-track-origin";
-import SpacesPage from "@/pages/spaces/spaces.tsx";
-import { MfaChallengePage } from "@/ee/mfa/pages/mfa-challenge-page";
-import { MfaSetupRequiredPage } from "@/ee/mfa/pages/mfa-setup-required-page";
-import SpaceTrash from "@/pages/space/space-trash.tsx";
-import UserApiKeys from "@/ee/api-key/pages/user-api-keys";
-import WorkspaceApiKeys from "@/ee/api-key/pages/workspace-api-keys";
-import AiSettings from "@/ee/ai/pages/ai-settings.tsx";
-import BasePage from "@/ee/base/pages/base-page.tsx";
-import AuditLogs from "@/ee/audit/pages/audit-logs.tsx";
-import VerifiedPages from "@/ee/page-verification/pages/verified-pages.tsx";
-import TemplateList from "@/ee/template/pages/template-list";
-import TemplateEditor from "@/ee/template/pages/template-editor";
-import FavoritesPage from "@/pages/favorites/favorites-page";
-import AiChat from "@/ee/ai-chat/pages/ai-chat.tsx";
-import VerifyEmail from "@/ee/pages/verify-email.tsx";
-import LabelPage from "@/pages/label/label-page";
-import OAuthConsent from "@/ee/oauth/pages/oauth-consent.tsx";
+
+const SetupWorkspace = lazy(() => import("@/pages/auth/setup-workspace.tsx"));
+const LoginPage = lazy(() => import("@/pages/auth/login"));
+const Home = lazy(() => import("@/pages/dashboard/home"));
+const Page = lazy(() => import("@/pages/page/page"));
+const AccountSettings = lazy(
+  () => import("@/pages/settings/account/account-settings"),
+);
+const WorkspaceMembers = lazy(
+  () => import("@/pages/settings/workspace/workspace-members"),
+);
+const WorkspaceSettings = lazy(
+  () => import("@/pages/settings/workspace/workspace-settings"),
+);
+const Groups = lazy(() => import("@/pages/settings/group/groups"));
+const GroupInfo = lazy(() => import("./pages/settings/group/group-info"));
+const Spaces = lazy(() => import("@/pages/settings/space/spaces.tsx"));
+const AccountPreferences = lazy(
+  () => import("@/pages/settings/account/account-preferences.tsx"),
+);
+const SpaceHome = lazy(() => import("@/pages/space/space-home.tsx"));
+const PageRedirect = lazy(() => import("@/pages/page/page-redirect.tsx"));
+const InviteSignup = lazy(() => import("@/pages/auth/invite-signup.tsx"));
+const ForgotPassword = lazy(() => import("@/pages/auth/forgot-password.tsx"));
+const PasswordReset = lazy(() => import("./pages/auth/password-reset"));
+const Billing = lazy(() => import("@/ee/billing/pages/billing.tsx"));
+const CloudLogin = lazy(() => import("@/ee/pages/cloud-login.tsx"));
+const CreateWorkspace = lazy(() => import("@/ee/pages/create-workspace.tsx"));
+const Security = lazy(() => import("@/ee/security/pages/security.tsx"));
+const License = lazy(() => import("@/ee/licence/pages/license.tsx"));
+const SharedPage = lazy(() => import("@/pages/share/shared-page.tsx"));
+const PdfRenderPage = lazy(() => import("@/ee/pdf-export/pdf-render-page.tsx"));
+const Shares = lazy(() => import("@/pages/settings/shares/shares.tsx"));
+const ShareLayout = lazy(
+  () => import("@/features/share/components/share-layout.tsx"),
+);
+const ShareRedirect = lazy(() => import("@/pages/share/share-redirect.tsx"));
+const SpacesPage = lazy(() => import("@/pages/spaces/spaces.tsx"));
+const MfaChallengePage = lazy(() =>
+  import("@/ee/mfa/pages/mfa-challenge-page").then((m) => ({
+    default: m.MfaChallengePage,
+  })),
+);
+const MfaSetupRequiredPage = lazy(() =>
+  import("@/ee/mfa/pages/mfa-setup-required-page").then((m) => ({
+    default: m.MfaSetupRequiredPage,
+  })),
+);
+const SpaceTrash = lazy(() => import("@/pages/space/space-trash.tsx"));
+const UserApiKeys = lazy(() => import("@/ee/api-key/pages/user-api-keys"));
+const WorkspaceApiKeys = lazy(
+  () => import("@/ee/api-key/pages/workspace-api-keys"),
+);
+const AiSettings = lazy(() => import("@/ee/ai/pages/ai-settings.tsx"));
+const BasePage = lazy(() => import("@/ee/base/pages/base-page.tsx"));
+const AuditLogs = lazy(() => import("@/ee/audit/pages/audit-logs.tsx"));
+const VerifiedPages = lazy(
+  () => import("@/ee/page-verification/pages/verified-pages.tsx"),
+);
+const TemplateList = lazy(() => import("@/ee/template/pages/template-list"));
+const TemplateEditor = lazy(
+  () => import("@/ee/template/pages/template-editor"),
+);
+const FavoritesPage = lazy(() => import("@/pages/favorites/favorites-page"));
+const AiChat = lazy(() => import("@/ee/ai-chat/pages/ai-chat.tsx"));
+const VerifyEmail = lazy(() => import("@/ee/pages/verify-email.tsx"));
+const LabelPage = lazy(() => import("@/pages/label/label-page"));

 export default function App() {
  const { t } = useTranslation();
  useRedirectToCloudSelect();
  useTrackOrigin();

+  useEffect(() => {
+    // warm the editor chunk so opening a page doesn't wait on the network
+    const timer = setTimeout(() => import("@/pages/page/page"), 3000);
+    return () => clearTimeout(timer);
+  }, []);
+
  return (
-    <>
+    <Suspense fallback={null}>
      <Routes>
        <Route index element={<Navigate to="/home" />} />
        <Route path={"/login"} element={<LoginPage />} />
@@ -64,7 +95,6 @@ export default function App() {
        <Route path={"/password-reset"} element={<PasswordReset />} />
        <Route path={"/login/mfa"} element={<MfaChallengePage />} />
        <Route path={"/login/mfa/setup"} element={<MfaSetupRequiredPage />} />
-        <Route path={"/oauth/consent"} element={<OAuthConsent />} />

        {!isCloud() && (
          <Route path={"/setup/register"} element={<SetupWorkspace />} />
@@ -118,10 +148,6 @@ export default function App() {
              element={<AccountPreferences />}
            />
            <Route path={"account/api-keys"} element={<UserApiKeys />} />
-            <Route
-              path={"account/api-keys/authorized-apps"}
-              element={<UserApiKeys />}
-            />
            <Route path={"workspace"} element={<WorkspaceSettings />} />
            <Route path={"members"} element={<WorkspaceMembers />} />
            <Route path={"api-keys"} element={<WorkspaceApiKeys />} />
@@ -141,6 +167,6 @@ export default function App() {

        <Route path="*" element={<Error404 />} />
      </Routes>
-    </>
+    </Suspense>
  );
 }
@@ -1,17 +1,30 @@
 import { ActionIcon, Box, Group, ScrollArea, Title, Tooltip } from "@mantine/core";
 import { IconX } from "@tabler/icons-react";
-import CommentListWithTabs from "@/features/comment/components/comment-list-with-tabs.tsx";
 import { useAtom } from "jotai";
 import { asideStateAtom } from "@/components/layouts/global/hooks/atoms/sidebar-atom.ts";
-import React, { ReactNode, useEffect } from "react";
+import React, { lazy, ReactNode, Suspense, useEffect } from "react";
 import { useTranslation } from "react-i18next";
-import { TableOfContents } from "@/features/editor/components/table-of-contents/table-of-contents.tsx";
 import { useAtomValue } from "jotai";
 import { pageEditorAtom } from "@/features/editor/atoms/editor-atoms.ts";
-import AsideChatPanel from "@/ee/ai-chat/components/aside-chat-panel";
-import { PageDetailsAside } from "@/features/page-details/components/page-details-aside.tsx";
 import { ASIDE_PANEL_ID } from "@/hooks/use-toggle-aside.tsx";

+const CommentListWithTabs = lazy(
+  () => import("@/features/comment/components/comment-list-with-tabs.tsx"),
+);
+const TableOfContents = lazy(() =>
+  import(
+    "@/features/editor/components/table-of-contents/table-of-contents.tsx"
+  ).then((m) => ({ default: m.TableOfContents })),
+);
+const AsideChatPanel = lazy(
+  () => import("@/ee/ai-chat/components/aside-chat-panel"),
+);
+const PageDetailsAside = lazy(() =>
+  import("@/features/page-details/components/page-details-aside.tsx").then(
+    (m) => ({ default: m.PageDetailsAside }),
+  ),
+);
+
 export default function Aside() {
  const [{ tab, isAsideOpen }, setAsideState] = useAtom(asideStateAtom);
  const { t } = useTranslation();
@@ -68,17 +81,19 @@ export default function Aside() {
            </Group>
          )}

-          {tab === "comments" || tab === "chat" ? (
-            component
-          ) : (
-            <ScrollArea
-              style={{ height: "85vh" }}
-              scrollbarSize={5}
-              type="scroll"
-            >
-              <div style={{ paddingBottom: "200px" }}>{component}</div>
-            </ScrollArea>
-          )}
+          <Suspense fallback={null}>
+            {tab === "comments" || tab === "chat" ? (
+              component
+            ) : (
+              <ScrollArea
+                style={{ height: "85vh" }}
+                scrollbarSize={5}
+                type="scroll"
+              >
+                <div style={{ paddingBottom: "200px" }}>{component}</div>
+              </ScrollArea>
+            )}
+          </Suspense>
        </>
      )}
    </Box>
@@ -11,7 +11,10 @@ import {
  sidebarWidthAtom,
 } from "@/components/layouts/global/hooks/atoms/sidebar-atom.ts";
 import { SpaceSidebar } from "@/features/space/components/sidebar/space-sidebar.tsx";
-import AiChatSidebar from "@/ee/ai-chat/components/ai-chat-sidebar.tsx";
+
+const AiChatSidebar = React.lazy(
+  () => import("@/ee/ai-chat/components/ai-chat-sidebar.tsx"),
+);
 import { AppHeader } from "@/components/layouts/global/app-header.tsx";
 import Aside from "@/components/layouts/global/aside.tsx";
 import classes from "./app-shell.module.css";
@@ -126,7 +129,11 @@ export default function GlobalAppShell({
        )}
        {isSpaceRoute && <SpaceSidebar />}
        {isSettingsRoute && <SettingsSidebar />}
-        {isAiRoute && <AiChatSidebar />}
+        {isAiRoute && (
+          <React.Suspense fallback={null}>
+            <AiChatSidebar />
+          </React.Suspense>
+        )}
        {showGlobalSidebar && <GlobalSidebar />}
      </AppShell.Navbar>
      <AppShell.Main id={MAIN_CONTENT_ID} tabIndex={-1}>
@@ -0,0 +1,12 @@
+import { UnstyledButton } from "@mantine/core";
+import { type ComponentPropsWithoutRef, forwardRef } from "react";
+
+// Menu.Item hard-codes role="menuitem"; use as its `component` to restore role="menuitemcheckbox" so aria-checked works.
+export const CheckboxMenuItem = forwardRef<
+  HTMLButtonElement,
+  ComponentPropsWithoutRef<"button">
+>((props, ref) => (
+  <UnstyledButton ref={ref} {...props} role="menuitemcheckbox" />
+));
+
+CheckboxMenuItem.displayName = "CheckboxMenuItem";
@@ -0,0 +1,74 @@
+import { Badge, Group, Text, Switch, Tooltip } from "@mantine/core";
+import { useAtom } from "jotai";
+import { workspaceAtom } from "@/features/user/atoms/current-user-atom.ts";
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import { updateWorkspace } from "@/features/workspace/services/workspace-service.ts";
+import { notifications } from "@mantine/notifications";
+import { useHasFeature } from "@/ee/hooks/use-feature";
+import { Feature } from "@/ee/features";
+import { useUpgradeLabel } from "@/ee/hooks/use-upgrade-label";
+
+export default function AiChatReadOnly() {
+  const { t } = useTranslation();
+  const hasAccess = useHasFeature(Feature.AI_CONTROLS);
+
+  return (
+    <Group justify="space-between" wrap="nowrap" gap="xl">
+      <div>
+        <Group gap="xs" align="center">
+          <Text size="md">{t("Read-only mode")}</Text>
+          {!hasAccess && (
+            <Badge variant="light" size="sm" radius="sm">
+              {t("Enterprise")}
+            </Badge>
+          )}
+        </Group>
+        <Text size="sm" c="dimmed">
+          {t(
+            "AI Chat can search and read workspace content, but cannot create or edit pages.",
+          )}
+        </Text>
+      </div>
+
+      <AiChatReadOnlyToggle />
+    </Group>
+  );
+}
+
+function AiChatReadOnlyToggle() {
+  const { t } = useTranslation();
+  const [workspace, setWorkspace] = useAtom(workspaceAtom);
+  const [checked, setChecked] = useState(
+    workspace?.settings?.ai?.chatReadOnly,
+  );
+  const hasAccess = useHasFeature(Feature.AI_CONTROLS);
+  const upgradeLabel = useUpgradeLabel();
+
+  const handleChange = async (event: React.ChangeEvent<HTMLInputElement>) => {
+    const value = event.currentTarget.checked;
+    try {
+      const updatedWorkspace = await updateWorkspace({
+        aiChatReadOnly: value,
+      });
+      setChecked(value);
+      setWorkspace(updatedWorkspace);
+    } catch (err: any) {
+      notifications.show({
+        message: err?.response?.data?.message,
+        color: "red",
+      });
+    }
+  };
+
+  return (
+    <Tooltip label={upgradeLabel} disabled={hasAccess} refProp="rootRef">
+      <Switch
+        defaultChecked={checked}
+        onChange={handleChange}
+        disabled={!hasAccess}
+        aria-label={t("Toggle AI Chat read-only mode")}
+      />
+    </Tooltip>
+  );
+}
@@ -0,0 +1,74 @@
+import { Badge, Group, Text, Switch, Tooltip } from "@mantine/core";
+import { useAtom } from "jotai";
+import { workspaceAtom } from "@/features/user/atoms/current-user-atom.ts";
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import { updateWorkspace } from "@/features/workspace/services/workspace-service.ts";
+import { notifications } from "@mantine/notifications";
+import { useHasFeature } from "@/ee/hooks/use-feature";
+import { Feature } from "@/ee/features";
+import { useUpgradeLabel } from "@/ee/hooks/use-upgrade-label";
+
+export default function AiChatWorkspaceKnowledgeOnly() {
+  const { t } = useTranslation();
+  const hasAccess = useHasFeature(Feature.AI_CONTROLS);
+
+  return (
+    <Group justify="space-between" wrap="nowrap" gap="xl">
+      <div>
+        <Group gap="xs" align="center">
+          <Text size="md">{t("Workspace knowledge only")}</Text>
+          {!hasAccess && (
+            <Badge variant="light" size="sm" radius="sm">
+              {t("Enterprise")}
+            </Badge>
+          )}
+        </Group>
+        <Text size="sm" c="dimmed">
+          {t(
+            "Restrict AI Chat to answering from your workspace pages and uploaded files only. It will not use outside knowledge.",
+          )}
+        </Text>
+      </div>
+
+      <AiChatWorkspaceKnowledgeOnlyToggle />
+    </Group>
+  );
+}
+
+function AiChatWorkspaceKnowledgeOnlyToggle() {
+  const { t } = useTranslation();
+  const [workspace, setWorkspace] = useAtom(workspaceAtom);
+  const [checked, setChecked] = useState(
+    workspace?.settings?.ai?.chatWorkspaceKnowledgeOnly,
+  );
+  const hasAccess = useHasFeature(Feature.AI_CONTROLS);
+  const upgradeLabel = useUpgradeLabel();
+
+  const handleChange = async (event: React.ChangeEvent<HTMLInputElement>) => {
+    const value = event.currentTarget.checked;
+    try {
+      const updatedWorkspace = await updateWorkspace({
+        aiChatWorkspaceKnowledgeOnly: value,
+      });
+      setChecked(value);
+      setWorkspace(updatedWorkspace);
+    } catch (err: any) {
+      notifications.show({
+        message: err?.response?.data?.message,
+        color: "red",
+      });
+    }
+  };
+
+  return (
+    <Tooltip label={upgradeLabel} disabled={hasAccess} refProp="rootRef">
+      <Switch
+        defaultChecked={checked}
+        onChange={handleChange}
+        disabled={!hasAccess}
+        aria-label={t("Toggle workspace knowledge only")}
+      />
+    </Tooltip>
+  );
+}
@@ -6,7 +6,10 @@ import {
  IconFileText,
 } from "@tabler/icons-react";
 import { useTranslation } from "react-i18next";
-import ChatInput from "./chat-input";
+import { useAtomValue } from "jotai";
+import { workspaceAtom } from "@/features/user/atoms/current-user-atom.ts";
+import { useRef } from "react";
+import ChatInput, { ChatInputHandle } from "./chat-input";
 import type { ChatAttachment, PageMention } from "../types/ai-chat.types";
 import classes from "../styles/ai-chat.module.css";

@@ -14,6 +17,7 @@ type Suggestion = {
  icon: React.ReactNode;
  text: string;
  prompt: string;
+  write?: boolean;
 };

 const SUGGESTIONS: Suggestion[] = [
@@ -26,6 +30,7 @@ const SUGGESTIONS: Suggestion[] = [
    icon: <IconFilePlus size={16} />,
    text: "Create a new page",
    prompt: "Create a new page titled ",
+    write: true,
  },
  {
    icon: <IconFileText size={16} />,
@@ -36,6 +41,7 @@ const SUGGESTIONS: Suggestion[] = [
    icon: <IconEdit size={16} />,
    text: "Update page content",
    prompt: "Update the page @",
+    write: true,
  },
 ];

@@ -47,9 +53,13 @@ type Props = {

 export default function ChatEmptyState({ isStreaming, onSend, onStop }: Props) {
  const { t } = useTranslation();
+  const workspace = useAtomValue(workspaceAtom);
+  const writesDisabled = workspace?.settings?.ai?.chatReadOnly === true;
+
+  const inputRef = useRef<ChatInputHandle>(null);

  const handleSuggestionClick = (prompt: string) => {
-    onSend(prompt, [], []);
+    inputRef.current?.prefill(prompt);
  };

  return (
@@ -62,6 +72,7 @@ export default function ChatEmptyState({ isStreaming, onSend, onStop }: Props) {

      <div className={classes.emptyStateInput}>
        <ChatInput
+          ref={inputRef}
          isStreaming={isStreaming}
          onSend={onSend}
          onStop={onStop}
@@ -73,7 +84,7 @@ export default function ChatEmptyState({ isStreaming, onSend, onStop }: Props) {
      <div className={classes.suggestionsSection}>
        <h2 className={classes.suggestionsLabel}>{t("Get started")}</h2>
        <div className={classes.suggestionsGrid}>
-          {SUGGESTIONS.map((s) => (
+          {SUGGESTIONS.filter((s) => !writesDisabled || !s.write).map((s) => (
            <button
              key={s.text}
              type="button"
@@ -1,4 +1,12 @@
-import { useCallback, useId, useRef, useEffect, useState } from "react";
+import {
+  forwardRef,
+  useCallback,
+  useId,
+  useImperativeHandle,
+  useRef,
+  useEffect,
+  useState,
+} from "react";
 import { useTranslation } from "react-i18next";
 import { IconArrowUp, IconPaperclip, IconPlayerStopFilled, IconX, IconFile, IconPhoto, IconPlus, IconAt, IconFileText } from "@tabler/icons-react";
 import { Popover } from "@mantine/core";
@@ -35,6 +43,10 @@ type Props = {
  chatId?: string;
 };

+export type ChatInputHandle = {
+  prefill: (text: string) => void;
+};
+
 function extractMentions(json: any): PageMention[] {
  const mentions: PageMention[] = [];
  const seen = new Set<string>();
@@ -89,7 +101,7 @@ function editorJsonToText(json: any): string {
  return text;
 }

-export default function ChatInput({
+const ChatInput = forwardRef<ChatInputHandle, Props>(function ChatInput({
  isStreaming,
  onSend,
  onStop,
@@ -100,7 +112,7 @@ export default function ChatInput({
  variant = "card",
  showDisclaimer = true,
  chatId,
-}: Props) {
+}: Props, ref) {
  const chatIdRef = useRef(chatId);
  chatIdRef.current = chatId;
  const { t } = useTranslation();
@@ -270,6 +282,19 @@ export default function ChatInput({
    }
  }, [editor]);

+  useImperativeHandle(
+    ref,
+    () => ({
+      prefill: (text: string) => {
+        if (!editor || editor.isDestroyed) return;
+        editor.commands.clearContent();
+        editor.commands.insertContent(text);
+        editor.commands.focus();
+      },
+    }),
+    [editor],
+  );
+
  const hasContent = !isEmpty || pendingAttachments.some((a) => !a.uploading) || (contextPages?.length ?? 0) > 0;

  const wrapperClass = variant === "flat" ? classes.inputWrapperFlat : classes.inputWrapper;
@@ -429,4 +454,6 @@ export default function ChatInput({
    )}
    </>
  );
-}
+});
+
+export default ChatInput;
@@ -1,9 +1,7 @@
 import {
  Anchor,
-  Button,
  Group,
  List,
-  Table,
  Text,
  Switch,
  TextInput,
@@ -17,33 +15,14 @@ import { workspaceAtom } from "@/features/user/atoms/current-user-atom.ts";
 import React, { useState } from "react";
 import { Trans, useTranslation } from "react-i18next";
 import { updateWorkspace } from "@/features/workspace/services/workspace-service.ts";
-import { ITrustedOAuthClient } from "@/features/workspace/types/workspace.types.ts";
 import { notifications } from "@mantine/notifications";
 import { useHasFeature } from "@/ee/hooks/use-feature";
 import { Feature } from "@/ee/features";
 import { useUpgradeLabel } from "@/ee/hooks/use-upgrade-label";
 import { getAppUrl } from "@/lib/config.ts";
-import {
-  IconCheck,
-  IconCopy,
-  IconInfoCircle,
-  IconTrash,
-} from "@tabler/icons-react";
+import { IconCheck, IconCopy, IconInfoCircle } from "@tabler/icons-react";
 import { CopyButton } from "@/components/common/copy-button.tsx";

-// Mirrors the server rule: an exact https origin, tolerating only a trailing slash.
-function parseTrustedOrigin(value: string): string | null {
-  const input = value.trim().toLowerCase();
-  try {
-    const url = new URL(input);
-    if (url.protocol !== "https:") return null;
-    if (input !== url.origin && input !== `${url.origin}/`) return null;
-    return url.origin;
-  } catch {
-    return null;
-  }
-}
-
 export default function McpSettings() {
  const { t } = useTranslation();
  const [workspace, setWorkspace] = useAtom(workspaceAtom);
@@ -51,14 +30,7 @@ export default function McpSettings() {
  const hasAccess = useHasFeature(Feature.MCP);
  const upgradeLabel = useUpgradeLabel();

-  const [newClientName, setNewClientName] = useState("");
-  const [newClientOrigin, setNewClientOrigin] = useState("");
-
  const mcpUrl = `${getAppUrl()}/mcp`;
-  const storedTrustedClients = workspace?.trustedOauthClients;
-  const trustedClients = Array.isArray(storedTrustedClients)
-    ? storedTrustedClients
-    : [];

  const handleChange = async (event: React.ChangeEvent<HTMLInputElement>) => {
    const value = event.currentTarget.checked;
@@ -74,51 +46,6 @@ export default function McpSettings() {
    }
  };

-  const saveTrustedClients = async (next: ITrustedOAuthClient[]) => {
-    try {
-      const updatedWorkspace = await updateWorkspace({
-        trustedOauthClients: next,
-      });
-      setWorkspace(updatedWorkspace);
-      return true;
-    } catch (err) {
-      notifications.show({
-        message: err?.response?.data?.message,
-        color: "red",
-      });
-      return false;
-    }
-  };
-
-  const handleAddTrustedClient = async () => {
-    const name = newClientName.trim();
-    const origin = parseTrustedOrigin(newClientOrigin);
-    if (!origin) {
-      notifications.show({
-        message: t("Enter the app's callback origin, e.g. https://app.yourcompany.com"),
-        color: "red",
-      });
-      return;
-    }
-    if (trustedClients.some((client) => client.origin.toLowerCase() === origin)) {
-      notifications.show({
-        message: t("This origin is already trusted."),
-        color: "red",
-      });
-      return;
-    }
-    if (await saveTrustedClients([...trustedClients, { origin, name }])) {
-      setNewClientName("");
-      setNewClientOrigin("");
-    }
-  };
-
-  const handleRemoveTrustedClient = (origin: string) => {
-    void saveTrustedClients(
-      trustedClients.filter((client) => client.origin !== origin),
-    );
-  };
-
  return (
    <Stack gap="lg">
      {!hasAccess && (
@@ -181,7 +108,7 @@ export default function McpSettings() {
          </Group>
          <Text size="sm" c="dimmed" mt="xs">
            {t(
-              "Connect with your Docmost account via OAuth when your client supports it, or use an API key from your account settings.",
+              "Use your API key for authentication. You can manage API keys in your account settings.",
            )}
          </Text>

@@ -222,81 +149,6 @@ export default function McpSettings() {
              </List.Item>
            </List>
          </div>
-
-          <div>
-            <Text size="sm" fw={500} mt="md" mb={4}>
-              {t("Trusted applications")}
-            </Text>
-            <Text size="sm" c="dimmed" mb="xs">
-              {t(
-                "Applications with these callback origins are trusted. Members will not see a warning when authorizing them.",
-              )}
-            </Text>
-
-            {trustedClients.length > 0 && (
-              <Table verticalSpacing="xs" mb="xs">
-                <Table.Tbody>
-                  {trustedClients.map((client) => (
-                    <Table.Tr key={client.origin}>
-                      <Table.Td>
-                        <Text size="sm" fw={500}>
-                          {client.name}
-                        </Text>
-                      </Table.Td>
-                      <Table.Td>
-                        <Text size="sm" c="dimmed">
-                          {client.origin}
-                        </Text>
-                      </Table.Td>
-                      <Table.Td w={40}>
-                        <ActionIcon
-                          variant="subtle"
-                          color="red"
-                          aria-label={t("Remove {{name}}", {
-                            name: client.name,
-                          })}
-                          onClick={() =>
-                            handleRemoveTrustedClient(client.origin)
-                          }
-                        >
-                          <IconTrash size={16} />
-                        </ActionIcon>
-                      </Table.Td>
-                    </Table.Tr>
-                  ))}
-                </Table.Tbody>
-              </Table>
-            )}
-
-            <Group gap="xs">
-              <TextInput
-                value={newClientName}
-                onChange={(event) =>
-                  setNewClientName(event.currentTarget.value)
-                }
-                placeholder={t("Name")}
-                aria-label={t("Trusted application name")}
-                maxLength={64}
-                style={{ flex: 1 }}
-              />
-              <TextInput
-                value={newClientOrigin}
-                onChange={(event) =>
-                  setNewClientOrigin(event.currentTarget.value)
-                }
-                placeholder="https://app.yourcompany.com"
-                aria-label={t("Trusted application origin")}
-                style={{ flex: 2 }}
-              />
-              <Button
-                variant="default"
-                onClick={handleAddTrustedClient}
-                disabled={!newClientName.trim() || !newClientOrigin.trim()}
-              >
-                {t("Add")}
-              </Button>
-            </Group>
-          </div>
        </div>
      )}
    </Stack>
@@ -5,8 +5,10 @@ import { useTranslation } from "react-i18next";
 import EnableAiSearch from "@/ee/ai/components/enable-ai-search.tsx";
 import EnableGenerativeAi from "@/ee/ai/components/enable-generative-ai.tsx";
 import EnableAiChat from "@/ee/ai-chat/components/enable-ai-chat.tsx";
+import AiChatReadOnly from "@/ee/ai-chat/components/ai-chat-read-only.tsx";
+import AiChatWorkspaceKnowledgeOnly from "@/ee/ai-chat/components/ai-chat-workspace-knowledge-only.tsx";
 import McpSettings from "@/ee/ai/components/mcp-settings.tsx";
-import { Alert, Stack, Tabs } from "@mantine/core";
+import { Alert, Collapse, Stack, Tabs } from "@mantine/core";
 import { IconInfoCircle } from "@tabler/icons-react";
 import { useHasFeature } from "@/ee/hooks/use-feature";
 import { Feature } from "@/ee/features";
@@ -14,12 +16,16 @@ import { useUpgradeLabel } from "@/ee/hooks/use-upgrade-label";
 import { isCloud } from "@/lib/config.ts";
 import { useLocation, useNavigate } from "react-router-dom";
 import { DocumentTitle } from "@/components/ui/document-title.tsx";
+import { useAtomValue } from "jotai";
+import { workspaceAtom } from "@/features/user/atoms/current-user-atom.ts";

 export default function AiSettings() {
  const { t } = useTranslation();
  const { isAdmin } = useUserRole();
  const hasAccess = useHasFeature(Feature.AI);
  const upgradeLabel = useUpgradeLabel();
+  const workspace = useAtomValue(workspaceAtom);
+  const aiChatEnabled = workspace?.settings?.ai?.chat === true;
  const location = useLocation();
  const navigate = useNavigate();

@@ -61,7 +67,7 @@ export default function AiSettings() {
              mb="lg"
            >
              {t(
-                "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.",
+                "AI is available in the Docmost paid editions. Contact sales@docmost.com.",
              )}
            </Alert>
          )}
@@ -70,6 +76,20 @@ export default function AiSettings() {
            {!isCloud() && <EnableAiSearch />}
            <EnableGenerativeAi />
            <EnableAiChat />
+            <Collapse expanded={aiChatEnabled}>
+              <Stack
+                gap="md"
+                pl="md"
+                ml="xs"
+                style={{
+                  borderLeft:
+                    "2px solid light-dark(var(--mantine-color-gray-3), var(--mantine-color-dark-4))",
+                }}
+              >
+                <AiChatReadOnly />
+                <AiChatWorkspaceKnowledgeOnly />
+              </Stack>
+            </Collapse>
          </Stack>
        </Tabs.Panel>

@@ -15,6 +15,14 @@ export interface IAiSearchResponse {
  }>;
 }

+export async function hintVectorCache(): Promise<void> {
+  try {
+    await api.post("/ai/vector-cache-hint");
+  } catch {
+    // best-effort cache hint
+  }
+}
+
 export async function aiAnswers(
  params: IPageSearchParams,
  onChunk?: (chunk: { content?: string; sources?: any[] }) => void,
@@ -1,5 +1,5 @@
 import React, { useState } from "react";
-import { Anchor, Alert, Button, Group, Space, Tabs, Text } from "@mantine/core";
+import { Anchor, Alert, Button, Group, Space, Text } from "@mantine/core";
 import { IconInfoCircle } from "@tabler/icons-react";
 import { Trans, useTranslation } from "react-i18next";
 import SettingsTitle from "@/components/settings/settings-title";
@@ -17,8 +17,6 @@ import { useAtom } from "jotai";
 import { workspaceAtom } from "@/features/user/atoms/current-user-atom.ts";
 import useUserRole from "@/hooks/use-user-role.tsx";
 import { DocumentTitle } from "@/components/ui/document-title.tsx";
-import { useLocation, useNavigate } from "react-router-dom";
-import { AuthorizedAppsPanel } from "@/ee/oauth/components/authorized-apps-panel.tsx";

 export default function UserApiKeys() {
  const { t } = useTranslation();
@@ -31,11 +29,6 @@ export default function UserApiKeys() {
  const { data, isLoading } = useGetApiKeysQuery({ cursor });
  const [workspace] = useAtom(workspaceAtom);
  const { isAdmin } = useUserRole();
-  const location = useLocation();
-  const navigate = useNavigate();
-  const activeTab = location.pathname.endsWith("/authorized-apps")
-    ? "authorized-apps"
-    : "api-keys";
  const mcpEnabled = workspace?.settings?.ai?.mcp === true;
  const restrictToAdmins = workspace?.settings?.api?.restrictToAdmins === true;
  const canCreate = !restrictToAdmins || isAdmin;
@@ -54,27 +47,26 @@ export default function UserApiKeys() {
    setRevokeModalOpened(true);
  };

-  const handleTabChange = (value: string | null) => {
-    navigate(
-      value === "authorized-apps"
-        ? "/settings/account/api-keys/authorized-apps"
-        : "/settings/account/api-keys",
-    );
-  };
-
  return (
    <>
-      <DocumentTitle
-        title={activeTab === "authorized-apps" ? t("Authorized apps") : t("API keys")}
-      />
+      <DocumentTitle title={t("API keys")} />

      <SettingsTitle title={t("API keys")} />

-      {mcpEnabled && (
+      <Text size="sm" c="dimmed" mb="md">
+        <Trans
+          i18nKey="View the <anchor>API documentation</anchor> for usage details."
+          components={{
+            anchor: <Anchor href="https://docmost.com/api-docs" target="_blank" size="sm" />,
+          }}
+        />
+      </Text>
+
+      {mcpEnabled && canCreate && (
        <Alert variant="light" color="blue" mb="md" p="sm" icon={<IconInfoCircle />}>
          <Text size="sm">
            {t(
-              "Your workspace has MCP enabled. Connect AI assistants with your Docmost account, or with an API key.",
+              "Your workspace has MCP enabled. Use your API key to connect AI assistants.",
            )}{" "}
            <Anchor
              href="https://docmost.com/docs/user-guide/mcp"
@@ -93,70 +85,37 @@ export default function UserApiKeys() {
        </Alert>
      )}

-      <Tabs color="dark" value={activeTab} onChange={handleTabChange}>
-        <Tabs.List>
-          <Tabs.Tab fw={500} value="api-keys">
-            {t("API keys")}
-          </Tabs.Tab>
-          <Tabs.Tab fw={500} value="authorized-apps">
-            {t("Authorized apps")}
-          </Tabs.Tab>
-        </Tabs.List>
-
-        <Tabs.Panel value="api-keys" pt="md">
-
-        <Group justify="space-between" align="center" mb="md">
-          <Text size="sm" c="dimmed">
-            <Trans
-              i18nKey="View the <anchor>API documentation</anchor> for usage details."
-              components={{
-                anchor: <Anchor href="https://docmost.com/api-docs" target="_blank" size="sm" />,
-              }}
-            />
-          </Text>
-
-          {canCreate && (
-            <Button
-              onClick={() => setCreateModalOpened(true)}
-              style={{ flexShrink: 0 }}
-            >
-              {t("Create API Key")}
-            </Button>
-          )}
+      {canCreate ? (
+        <Group justify="flex-end" mb="md">
+          <Button onClick={() => setCreateModalOpened(true)}>
+            {t("Create API Key")}
+          </Button>
        </Group>
+      ) : restrictToAdmins ? (
+        <Alert variant="light" color="yellow" mb="md" p="sm" icon={<IconInfoCircle />}>
+          <Text size="sm">
+            {t("API key creation is restricted to admins by your workspace administrator.")}
+          </Text>
+        </Alert>
+      ) : null}

-        {!canCreate && restrictToAdmins && (
-          <Alert variant="light" color="yellow" mb="md" p="sm" icon={<IconInfoCircle />}>
-            <Text size="sm">
-              {t("API key creation is restricted to admins by your workspace administrator.")}
-            </Text>
-          </Alert>
-        )}
+      <ApiKeyTable
+        apiKeys={data?.items || []}
+        isLoading={isLoading}
+        onUpdate={handleUpdate}
+        onRevoke={handleRevoke}
+      />

-        <ApiKeyTable
-          apiKeys={data?.items || []}
-          isLoading={isLoading}
-          onUpdate={handleUpdate}
-          onRevoke={handleRevoke}
+      <Space h="md" />
+
+      {data?.items.length > 0 && (
+        <Paginate
+          hasPrevPage={data?.meta?.hasPrevPage}
+          hasNextPage={data?.meta?.hasNextPage}
+          onNext={() => goNext(data?.meta?.nextCursor)}
+          onPrev={goPrev}
        />
-
-        <Space h="md" />
-
-        {data?.items.length > 0 && (
-          <Paginate
-            hasPrevPage={data?.meta?.hasPrevPage}
-            hasNextPage={data?.meta?.hasNextPage}
-            onNext={() => goNext(data?.meta?.nextCursor)}
-            onPrev={goPrev}
-          />
-        )}
-
-        </Tabs.Panel>
-
-        <Tabs.Panel value="authorized-apps" pt="md">
-          <AuthorizedAppsPanel />
-        </Tabs.Panel>
-      </Tabs>
+      )}

      <CreateApiKeyModal
        opened={createModalOpened}
@@ -9,6 +9,7 @@ import {
  Text,
  UnstyledButton,
  Button,
+  MultiSelect,
 } from "@mantine/core";
 import { IconPlus, IconTrash } from "@tabler/icons-react";
 import {
@@ -52,6 +53,9 @@ const NO_VALUE_OPERATORS: FilterOperator[] = ["isEmpty", "isNotEmpty"];
 // stored value so a stale shape isn't sent to the engine.
 function valueClass(op: FilterOperator, inputKind: string): string {
  if (NO_VALUE_OPERATORS.includes(op)) return "none";
+  if (inputKind === "choices") {
+    return op === "any" || op === "none" ? "choicesMulti" : "choicesSingle";
+  }
  if (inputKind === "person") {
    return op === "any" || op === "none" ? "personMulti" : "personSingle";
  }
@@ -70,6 +74,10 @@ function getOperatorsForType(type: string): FilterOperator[] {
    DEFAULT_FILTER_OPERATORS) as FilterOperator[];
 }

+function isMultiChoice(op: FilterCondition["op"]): boolean {
+  return op === "any" || op === "none";
+}
+
 function FilterValueInput({
  condition,
  property,
@@ -121,6 +129,32 @@ function FilterValueInput({
    const typeOptions = property.typeOptions as SelectTypeOptions | undefined;
    const choices = typeOptions?.choices ?? [];
    const choiceOptions = choices.map((c) => ({ value: c.id, label: c.name }));
+
+    if (isMultiChoice(condition.op)) {
+      const { value } = condition;
+      const selected = (
+        Array.isArray(value) ? value : value ? [value] : []
+      ).filter((id) => choices.some((c) => c.id === id));
+
+      return (
+        <MultiSelect
+          size="xs"
+          data={choiceOptions}
+          comboboxProps={{ withinPortal: false }}
+          value={selected}
+          onChange={(values) => onChange(values)}
+          w={160}
+          styles={{
+            pillsList: {
+              maxHeight: 70,
+              overflowY: "auto",
+            },
+          }}
+          maxDropdownHeight={220}
+        />
+      );
+    }
+
    return (
      <Select
        size="xs"
@@ -199,11 +233,18 @@ export function ViewFilterConfigPopover({
    label: p.name,
  }));

+  const [unSaved, setUnSaved] = useState(false)
  const [draft, setDraft] = useState<FilterCondition | null>(null);
+  const [draftConditions, setDraftConditions] =
+    useState<FilterCondition[]>(conditions);

  useEffect(() => {
-    if (!opened) setDraft(null);
-  }, [opened]);
+    if (opened) {
+      setDraftConditions(conditions);
+      setDraft(null);
+      setUnSaved(false)
+    }
+  }, [opened, conditions]);

  const handleStartDraft = useCallback(() => {
    const firstProperty = properties[0];
@@ -216,14 +257,21 @@ export function ViewFilterConfigPopover({
  }, [properties]);

  const handleSaveDraft = useCallback(() => {
-    if (!draft) return;
-    onChange([...conditions, draft]);
+    const nextConditions = draft
+      ? [...draftConditions, draft]
+      : draftConditions;
+
+    onChange(nextConditions);
    setDraft(null);
-  }, [draft, conditions, onChange]);
+    setUnSaved(false)
+
+  }, [draft, draftConditions, onChange]);

  const handleCancelDraft = useCallback(() => {
+    setDraftConditions(conditions)
    setDraft(null);
-  }, []);
+    setUnSaved(false)
+  }, [conditions]);

  const handleDraftPropertyChange = useCallback(
    (propertyId: string | null) => {
@@ -272,17 +320,19 @@ export function ViewFilterConfigPopover({

  const handleRemove = useCallback(
    (index: number) => {
-      onChange(conditions.filter((_, i) => i !== index));
+      setUnSaved(true);
+      setDraftConditions((current) => current.filter((_, i) => i !== index));
    },
-    [conditions, onChange],
+    [],
  );

  const handlePropertyChange = useCallback(
    (index: number, propertyId: string | null) => {
      if (!propertyId) return;
      const newProperty = properties.find((p) => p.id === propertyId);
-      onChange(
-        conditions.map((f, i) => {
+      setUnSaved(true)
+      setDraftConditions((current) =>
+        current.map((f, i) => {
          if (i !== index) return f;
          if (newProperty) {
            const validOperators = getOperatorsForType(newProperty.type);
@@ -302,15 +352,16 @@ export function ViewFilterConfigPopover({
        }),
      );
    },
-    [conditions, properties, onChange],
+    [properties],
  );

  const handleOperatorChange = useCallback(
    (index: number, operator: string | null) => {
      if (!operator) return;
      const op = operator as FilterOperator;
-      onChange(
-        conditions.map((f, i) => {
+      setUnSaved(true)
+      setDraftConditions((current) =>
+        current.map((f, i) => {
          if (i !== index) return f;
          const kind = inputKindForProperty(
            properties.find((p) => p.id === f.propertyId),
@@ -320,16 +371,17 @@ export function ViewFilterConfigPopover({
        }),
      );
    },
-    [conditions, properties, onChange],
+    [properties],
  );

  const handleValueChange = useCallback(
    (index: number, value: unknown) => {
-      onChange(
-        conditions.map((f, i) => (i === index ? { ...f, value } : f)),
+      setUnSaved(true)
+      setDraftConditions((current) =>
+        current.map((f, i) => (i === index ? { ...f, value } : f)),
      );
    },
-    [conditions, onChange],
+    [],
  );

  return (
@@ -362,13 +414,13 @@ export function ViewFilterConfigPopover({
            {t("Filter by")}
          </Text>

-          {conditions.length === 0 && !draft && (
+          {draftConditions.length === 0 && !draft && (
            <Text size="xs" c="dimmed">
              {t("No filters applied")}
            </Text>
          )}

-          {conditions.map((condition, index) => {
+          {draftConditions.map((condition, index) => {
            const needsValue = !NO_VALUE_OPERATORS.includes(condition.op);
            const property = properties.find(
              (p) => p.id === condition.propertyId,
@@ -471,14 +523,6 @@ export function ViewFilterConfigPopover({
                    />
                  )}
                </Group>
-                <Group justify="flex-end" gap="xs">
-                  <Button variant="default" size="xs" onClick={handleCancelDraft}>
-                    {t("Cancel")}
-                  </Button>
-                  <Button size="xs" onClick={handleSaveDraft}>
-                    {t("Save")}
-                  </Button>
-                </Group>
              </Stack>
            );
          })()}
@@ -492,6 +536,20 @@ export function ViewFilterConfigPopover({
              {t("Add filter")}
            </UnstyledButton>
          )}
+          <Group justify="flex-end" gap="xs">
+            <Button
+              variant="default"
+              size="xs"
+              onClick={handleCancelDraft}
+              disabled={!draft && !unSaved}
+            >
+              {t("Cancel")}
+            </Button>
+
+            <Button size="xs" onClick={handleSaveDraft} disabled={!draft && !unSaved}>
+              {t("Save")}
+            </Button>
+          </Group>
        </Stack>
      </Popover.Dropdown>
    </Popover>
@@ -22,5 +22,5 @@ export const Feature = {
  PERSONAL_SPACES: 'spaces:personal',
  DOCX_EXPORT: 'export:docx',
  BASES: 'bases',
-  OAUTH: 'oauth',
+  AI_CONTROLS: 'ai:controls',
 } as const;
@@ -1,19 +0,0 @@
-import { Text } from "@mantine/core";
-import { useTranslation } from "react-i18next";
-import { OAuthGrantsTable } from "@/ee/oauth/components/oauth-grants-table";
-import { useOAuthGrantsQuery } from "@/ee/oauth/queries/oauth-query";
-
-export function AuthorizedAppsPanel() {
-  const { t } = useTranslation();
-  const { data, isLoading } = useOAuthGrantsQuery();
-
-  return (
-    <>
-      <Text size="sm" c="dimmed" mb="md">
-        {t("Applications and AI assistants you have authorized to access your account.")}
-      </Text>
-
-      <OAuthGrantsTable grants={data || []} isLoading={isLoading} />
-    </>
-  );
-}
@@ -1,178 +0,0 @@
-import { ActionIcon, Badge, Group, Skeleton, Table, Text, Tooltip } from "@mantine/core";
-import { IconTrash } from "@tabler/icons-react";
-import { modals } from "@mantine/modals";
-import { useTranslation } from "react-i18next";
-import NoTableResults from "@/components/common/no-table-results";
-import { formatLocalized, useDateFnsLocale } from "@/lib/date-locale.ts";
-import { IOAuthGrant } from "@/ee/oauth/types/oauth.types";
-import { useRevokeOAuthGrantMutation } from "@/ee/oauth/queries/oauth-query";
-
-// Callback hosts identify the app; the full URL belongs on the consent screen.
-function callbackHosts(redirectUris: string[] = []): string[] {
-  const hosts = redirectUris.map((uri) => {
-    try {
-      const url = new URL(uri);
-      return url.protocol === "http:" || url.protocol === "https:"
-        ? url.host
-        : url.protocol;
-    } catch {
-      return uri;
-    }
-  });
-  return Array.from(new Set(hosts));
-}
-
-type OAuthGrantsTableProps = {
-  grants: IOAuthGrant[];
-  isLoading?: boolean;
-};
-
-function TableSkeleton() {
-  return (
-    <>
-      {Array.from({ length: 3 }).map((_, i) => (
-        <Table.Tr key={i}>
-          <Table.Td>
-            <Skeleton height={14} width={140} />
-          </Table.Td>
-          <Table.Td>
-            <Group gap={4}>
-              <Skeleton height={20} width={50} />
-              <Skeleton height={20} width={55} />
-            </Group>
-          </Table.Td>
-          <Table.Td>
-            <Skeleton height={14} width={90} />
-          </Table.Td>
-          <Table.Td>
-            <Skeleton height={14} width={90} />
-          </Table.Td>
-          <Table.Td>
-            <Skeleton height={28} width={28} circle />
-          </Table.Td>
-        </Table.Tr>
-      ))}
-    </>
-  );
-}
-
-export function OAuthGrantsTable({ grants, isLoading }: OAuthGrantsTableProps) {
-  const { t } = useTranslation();
-  const locale = useDateFnsLocale();
-  const revokeMutation = useRevokeOAuthGrantMutation();
-
-  const scopeMeta: Record<string, { color: string; label: string }> = {
-    read: { color: "blue", label: t("Read") },
-    write: { color: "orange", label: t("Write") },
-  };
-
-  const formatDate = (date: string | null) => {
-    if (!date) return t("Never");
-    return formatLocalized(date, "MMM dd, yyyy", "PP", locale);
-  };
-
-  const openRevokeModal = (grant: IOAuthGrant) =>
-    modals.openConfirmModal({
-      title: t("Revoke access"),
-      centered: true,
-      children: (
-        <Text size="sm">
-          {t(
-            "Are you sure you want to revoke access for {{name}}? The application will no longer be able to access your account.",
-            { name: grant.clientName },
-          )}
-        </Text>
-      ),
-      labels: { confirm: t("Revoke access"), cancel: t("Cancel") },
-      confirmProps: { color: "red" },
-      onConfirm: () => revokeMutation.mutate(grant.id),
-    });
-
-  return (
-    <Table.ScrollContainer minWidth={600}>
-      <Table highlightOnHover verticalSpacing="sm">
-        <Table.Thead>
-          <Table.Tr>
-            <Table.Th>{t("Application")}</Table.Th>
-            <Table.Th>{t("Permissions")}</Table.Th>
-            <Table.Th>{t("Authorized")}</Table.Th>
-            <Table.Th>{t("Last used")}</Table.Th>
-            <Table.Th aria-label={t("Action")} />
-          </Table.Tr>
-        </Table.Thead>
-
-        <Table.Tbody>
-          {isLoading ? (
-            <TableSkeleton />
-          ) : grants.length > 0 ? (
-            grants.map((grant) => (
-              <Table.Tr key={grant.id}>
-                <Table.Td>
-                  <Text fz="sm" fw={500}>
-                    {grant.clientName}
-                  </Text>
-                  <Text
-                    fz="xs"
-                    c="dimmed"
-                    title={grant.redirectUris?.join("\n")}
-                    style={{ overflowWrap: "anywhere" }}
-                  >
-                    {callbackHosts(grant.redirectUris).join(", ")}
-                  </Text>
-                </Table.Td>
-
-                <Table.Td>
-                  <Group gap={4}>
-                    {grant.scopes.map((scope) => {
-                      const meta = scopeMeta[scope];
-                      if (!meta) return null;
-                      return (
-                        <Badge
-                          key={scope}
-                          variant="light"
-                          color={meta.color}
-                          size="sm"
-                        >
-                          {meta.label}
-                        </Badge>
-                      );
-                    })}
-                  </Group>
-                </Table.Td>
-
-                <Table.Td>
-                  <Text fz="sm" style={{ whiteSpace: "nowrap" }}>
-                    {formatDate(grant.createdAt)}
-                  </Text>
-                </Table.Td>
-
-                <Table.Td>
-                  <Text fz="sm" style={{ whiteSpace: "nowrap" }}>
-                    {formatDate(grant.lastUsedAt)}
-                  </Text>
-                </Table.Td>
-
-                <Table.Td>
-                  <Tooltip label={t("Revoke access")}>
-                    <ActionIcon
-                      variant="subtle"
-                      color="red"
-                      aria-label={t("Revoke access for {{name}}", {
-                        name: grant.clientName,
-                      })}
-                      onClick={() => openRevokeModal(grant)}
-                    >
-                      <IconTrash size={16} />
-                    </ActionIcon>
-                  </Tooltip>
-                </Table.Td>
-              </Table.Tr>
-            ))
-          ) : (
-            <NoTableResults colSpan={5} text={t("No authorized apps yet.")} />
-          )}
-        </Table.Tbody>
-      </Table>
-    </Table.ScrollContainer>
-  );
-}
@@ -1,353 +0,0 @@
-import React, { useEffect, useMemo, useState } from "react";
-import {
-  Alert,
-  Anchor,
-  Box,
-  Button,
-  Center,
-  Checkbox,
-  Container,
-  Divider,
-  Group,
-  Loader,
-  Paper,
-  Stack,
-  Text,
-  ThemeIcon,
-  Title,
-} from "@mantine/core";
-import { notifications } from "@mantine/notifications";
-import {
-  IconAlertTriangle,
-  IconEye,
-  IconInfoCircle,
-  IconPencil,
-} from "@tabler/icons-react";
-import { useQuery } from "@tanstack/react-query";
-import { useAtom } from "jotai";
-import { RESET } from "jotai/utils";
-import { useTranslation } from "react-i18next";
-import { useLocation, useSearchParams } from "react-router-dom";
-import { AuthLayout } from "@/features/auth/components/auth-layout.tsx";
-import classes from "@/features/auth/components/auth.module.css";
-import { DocumentTitle } from "@/components/ui/document-title.tsx";
-import { UserInfo } from "@/components/common/user-info.tsx";
-import useCurrentUser from "@/features/user/hooks/use-current-user";
-import { currentUserAtom } from "@/features/user/atoms/current-user-atom";
-import { logout } from "@/features/auth/services/auth-service";
-import { ICurrentUser } from "@/features/user/types/user.types";
-import APP_ROUTE from "@/lib/app-route.ts";
-import {
-  approveOAuthAuthorization,
-  getOAuthAuthorizeInfo,
-} from "@/ee/oauth/services/oauth-service";
-import {
-  IApproveAuthorizationPayload,
-  IAuthorizeParams,
-  IOAuthAuthorizeInfo,
-} from "@/ee/oauth/types/oauth.types";
-
-function loginRedirectUrl(pathname: string, search: string): string {
-  return `${APP_ROUTE.AUTH.LOGIN}?redirect=${encodeURIComponent(pathname + search)}`;
-}
-
-function errorStatus(error: any): number | undefined {
-  return error?.response?.status;
-}
-
-function errorText(error: any): string | undefined {
-  const data = error?.response?.data;
-  if (typeof data?.error_description === "string") return data.error_description;
-  if (Array.isArray(data?.message)) return data.message.join(", ");
-  return data?.message;
-}
-
-const OAUTH_PARAM_NAMES = [
-  "response_type",
-  "client_id",
-  "redirect_uri",
-  "state",
-  "code_challenge",
-  "code_challenge_method",
-  "scope",
-  "resource",
-];
-
-function pickOAuthParams(params: IAuthorizeParams): IAuthorizeParams {
-  const picked: IAuthorizeParams = {};
-  for (const name of OAUTH_PARAM_NAMES) {
-    if (params[name] !== undefined) {
-      picked[name] = params[name];
-    }
-  }
-  return picked;
-}
-
-export default function OAuthConsent() {
-  const { t } = useTranslation();
-  const location = useLocation();
-  const [searchParams] = useSearchParams();
-
-  const params = useMemo<IAuthorizeParams>(
-    () => Object.fromEntries(searchParams.entries()),
-    [searchParams],
-  );
-
-  const currentUserQuery = useCurrentUser();
-  const infoQuery = useQuery({
-    queryKey: ["oauth-authorize-info", params],
-    queryFn: () => getOAuthAuthorizeInfo(params),
-  });
-
-  const isUnauthenticated =
-    errorStatus(currentUserQuery.error) === 401 ||
-    errorStatus(infoQuery.error) === 401;
-
-  useEffect(() => {
-    if (isUnauthenticated) {
-      window.location.replace(
-        loginRedirectUrl(location.pathname, location.search),
-      );
-    }
-  }, [isUnauthenticated, location.pathname, location.search]);
-
-  const isLoading =
-    isUnauthenticated || currentUserQuery.isLoading || infoQuery.isLoading;
-
-  return (
-    <AuthLayout>
-      <DocumentTitle title={t("Authorize application")} />
-      <Container size={460} className={classes.container}>
-        <Box p="xl">
-          {isLoading ? (
-            <Center mih={200}>
-              <Loader />
-            </Center>
-          ) : infoQuery.data && currentUserQuery.data ? (
-            <ConsentCard
-              info={infoQuery.data}
-              currentUser={currentUserQuery.data}
-              params={params}
-            />
-          ) : (
-            <InvalidRequestCard
-              description={errorText(infoQuery.error ?? currentUserQuery.error)}
-            />
-          )}
-        </Box>
-      </Container>
-    </AuthLayout>
-  );
-}
-
-function InvalidRequestCard({ description }: { description?: string }) {
-  const { t } = useTranslation();
-
-  return (
-    <Stack align="center" gap="sm">
-      <ThemeIcon size={48} radius="xl" variant="light" color="red">
-        <IconAlertTriangle size={26} stroke={1.5} />
-      </ThemeIcon>
-      <Title order={3} ta="center" fw={600}>
-        {t("Invalid authorization request")}
-      </Title>
-      {description && (
-        <Text size="sm" c="dimmed" ta="center">
-          {description}
-        </Text>
-      )}
-    </Stack>
-  );
-}
-
-type ConsentCardProps = {
-  info: IOAuthAuthorizeInfo;
-  currentUser: ICurrentUser;
-  params: IAuthorizeParams;
-};
-
-function ConsentCard({ info, currentUser, params }: ConsentCardProps) {
-  const { t } = useTranslation();
-  const location = useLocation();
-  const [, setCurrentUser] = useAtom(currentUserAtom);
-  const [approvedScopes, setApprovedScopes] = useState<string[]>(
-    info.scopes.filter((scope) => scope === "read" || scope === "write"),
-  );
-  const [submitting, setSubmitting] = useState<"approve" | "deny" | null>(null);
-  const [acknowledged, setAcknowledged] = useState(false);
-
-  const scopeRows = [
-    {
-      scope: "read",
-      icon: <IconEye size={16} stroke={1.5} />,
-      label: t("Read"),
-      description: t("View data in your workspace without making changes."),
-    },
-    {
-      scope: "write",
-      icon: <IconPencil size={16} stroke={1.5} />,
-      label: t("Write"),
-      description: t("Create and modify data in your workspace."),
-    },
-  ];
-
-  function toggleScope(scope: string, checked: boolean) {
-    setApprovedScopes((prev) =>
-      checked ? [...prev, scope] : prev.filter((item) => item !== scope),
-    );
-  }
-
-  async function submitDecision(approved: boolean) {
-    setSubmitting(approved ? "approve" : "deny");
-    const oauthParams = pickOAuthParams(params);
-    const payload: IApproveAuthorizationPayload = approved
-      ? { ...oauthParams, approved: true, approvedScopes }
-      : { ...oauthParams, approved: false };
-
-    try {
-      const res = await approveOAuthAuthorization(payload);
-      window.location.replace(res.redirectUrl);
-    } catch (err) {
-      if (errorStatus(err) === 401) {
-        window.location.replace(
-          loginRedirectUrl(location.pathname, location.search),
-        );
-        return;
-      }
-      setSubmitting(null);
-      notifications.show({
-        message: errorText(err) || t("Something went wrong. Please try again."),
-        color: "red",
-      });
-    }
-  }
-
-  async function switchAccount() {
-    if (submitting !== null) {
-      return;
-    }
-    setCurrentUser(RESET);
-    try {
-      await logout();
-    } finally {
-      window.location.replace(
-        loginRedirectUrl(location.pathname, location.search),
-      );
-    }
-  }
-
-  return (
-    <Stack gap="lg">
-      <Title order={3} ta="center" fw={600}>
-        {t("{{name}} wants to access {{workspace}}", {
-          name: info.clientName,
-          workspace: currentUser.workspace.name,
-        })}
-      </Title>
-
-      <Paper withBorder radius="md" p="sm">
-        <Group justify="space-between" wrap="nowrap">
-          <UserInfo user={currentUser.user} />
-          <Anchor
-            component="button"
-            type="button"
-            size="xs"
-            c="dimmed"
-            disabled={submitting !== null}
-            onClick={switchAccount}
-            style={{ whiteSpace: "nowrap" }}
-          >
-            {t("Not you? Switch account")}
-          </Anchor>
-        </Group>
-      </Paper>
-
-      <Divider />
-
-      <Stack gap="sm">
-        <Text size="sm" fw={500}>
-          {t("This application will be able to:")}
-        </Text>
-        {scopeRows.map((row) => {
-          const requested = info.scopes.includes(row.scope);
-          return (
-            <Checkbox
-              key={row.scope}
-              size="sm"
-              checked={approvedScopes.includes(row.scope)}
-              disabled={!requested || submitting !== null}
-              onChange={(event) =>
-                toggleScope(row.scope, event.currentTarget.checked)
-              }
-              label={
-                <Group gap={6} wrap="nowrap">
-                  {row.icon}
-                  <Text size="sm" fw={500}>
-                    {row.label}
-                  </Text>
-                </Group>
-              }
-              description={row.description}
-            />
-          );
-        })}
-      </Stack>
-
-      <div>
-        <Text size="xs" c="dimmed">
-          {t("You will be redirected to")}
-        </Text>
-        <Text size="xs" ff="monospace" style={{ overflowWrap: "anywhere" }}>
-          {info.redirectUri}
-        </Text>
-      </div>
-
-      {!info.verified && (
-        <Alert
-          variant="light"
-          color="yellow"
-          icon={<IconInfoCircle size={16} />}
-        >
-          <Stack gap="xs">
-            <Text size="sm">
-              {t(
-                "This application is not on your workspace's trusted list. Authorize only if you recognize it.",
-              )}
-            </Text>
-            <Checkbox
-              size="sm"
-              checked={acknowledged}
-              disabled={submitting !== null}
-              onChange={(event) =>
-                setAcknowledged(event.currentTarget.checked)
-              }
-              label={t("I recognize this application and want to continue")}
-            />
-          </Stack>
-        </Alert>
-      )}
-
-      <Group grow>
-        <Button
-          variant="default"
-          onClick={() => submitDecision(false)}
-          loading={submitting === "deny"}
-          disabled={submitting === "approve"}
-        >
-          {t("Cancel")}
-        </Button>
-        <Button
-          onClick={() => submitDecision(true)}
-          loading={submitting === "approve"}
-          disabled={
-            approvedScopes.length === 0 ||
-            (!info.verified && !acknowledged) ||
-            submitting === "deny"
-          }
-        >
-          {t("Authorize")}
-        </Button>
-      </Group>
-    </Stack>
-  );
-}
@@ -1,45 +0,0 @@
-import {
-  useMutation,
-  useQuery,
-  useQueryClient,
-  UseQueryResult,
-} from "@tanstack/react-query";
-import {
-  getOAuthGrants,
-  revokeOAuthGrant,
-} from "@/ee/oauth/services/oauth-service";
-import { IOAuthGrant } from "@/ee/oauth/types/oauth.types";
-import { notifications } from "@mantine/notifications";
-import { useTranslation } from "react-i18next";
-
-export function useOAuthGrantsQuery(): UseQueryResult<IOAuthGrant[], Error> {
-  return useQuery({
-    queryKey: ["oauth-grants"],
-    queryFn: () => getOAuthGrants(),
-    staleTime: 0,
-    gcTime: 0,
-  });
-}
-
-export function useRevokeOAuthGrantMutation() {
-  const queryClient = useQueryClient();
-  const { t } = useTranslation();
-
-  return useMutation<void, Error, string>({
-    mutationFn: (grantId) => revokeOAuthGrant(grantId),
-    onSuccess: () => {
-      notifications.show({ message: t("Access revoked") });
-      queryClient.invalidateQueries({
-        predicate: (item) =>
-          ["oauth-grants"].includes(item.queryKey[0] as string),
-      });
-    },
-    onError: (error) => {
-      const errorMessage = error["response"]?.data?.message;
-      notifications.show({
-        message: errorMessage || t("Something went wrong. Please try again."),
-        color: "red",
-      });
-    },
-  });
-}
@@ -1,36 +0,0 @@
-import api from "@/lib/api-client";
-import {
-  IApproveAuthorizationPayload,
-  IAuthorizeParams,
-  IOAuthAuthorizeInfo,
-  IOAuthGrant,
-} from "@/ee/oauth/types/oauth.types";
-
-export async function getOAuthAuthorizeInfo(
-  params: IAuthorizeParams,
-): Promise<IOAuthAuthorizeInfo> {
-  const req = await api.post<IOAuthAuthorizeInfo>(
-    "/oauth/authorize-info",
-    params,
-  );
-  return req.data;
-}
-
-export async function approveOAuthAuthorization(
-  payload: IApproveAuthorizationPayload,
-): Promise<{ redirectUrl: string }> {
-  const req = await api.post<{ redirectUrl: string }>(
-    "/oauth/authorize",
-    payload,
-  );
-  return req.data;
-}
-
-export async function getOAuthGrants(): Promise<IOAuthGrant[]> {
-  const req = await api.post<IOAuthGrant[]>("/oauth/grants", {});
-  return req.data;
-}
-
-export async function revokeOAuthGrant(grantId: string): Promise<void> {
-  await api.post("/oauth/grants/revoke", { grantId });
-}
@@ -1,24 +0,0 @@
-export interface IOAuthAuthorizeInfo {
-  clientName: string;
-  redirectUri: string;
-  scopes: string[];
-  clientCreatedAt: string;
-  verified: boolean;
-}
-
-export interface IOAuthGrant {
-  id: string;
-  clientName: string;
-  redirectUris: string[];
-  scopes: string[];
-  createdAt: string;
-  lastUsedAt: string | null;
-}
-
-export type IAuthorizeParams = Record<string, string>;
-
-export type IApproveAuthorizationPayload = {
-  [param: string]: unknown;
-  approved: boolean;
-  approvedScopes?: string[];
-};
@@ -16,6 +16,14 @@ export const showAiMenuAtom = atom(false);

 export const showLinkMenuAtom = atom(false);

+export type LightboxRequest = {
+  src: string;
+  type: "image" | "video";
+} | null;
+
+const initialLightboxRequest: LightboxRequest = null;
+export const lightboxRequestAtom = atom(initialLightboxRequest);
+
 // Current page's edit mode — initialized from the user's saved preference on
 // first load, can be toggled locally without persisting to the server.
 export const currentPageEditModeAtom = atom<PageEditMode>(PageEditMode.Edit);
@@ -23,11 +23,21 @@ import {
 } from "@/features/comment/atoms/comment-atom";
 import { useAtom, useAtomValue } from "jotai";
 import { v7 as uuid7 } from "uuid";
-import { isCellSelection, isEditorReady, isTextSelected } from "@docmost/editor-ext";
+import {
+  isCellSelection,
+  isEditorReady,
+  isTextSelected,
+} from "@docmost/editor-ext";
 import { LinkSelector } from "@/features/editor/components/bubble-menu/link-selector.tsx";
 import { useTranslation } from "react-i18next";
-import { showAiMenuAtom, showLinkMenuAtom } from "@/features/editor/atoms/editor-atoms";
-import { userAtom, workspaceAtom } from "@/features/user/atoms/current-user-atom";
+import {
+  showAiMenuAtom,
+  showLinkMenuAtom,
+} from "@/features/editor/atoms/editor-atoms";
+import {
+  userAtom,
+  workspaceAtom,
+} from "@/features/user/atoms/current-user-atom";

 export interface BubbleMenuItem {
  name: string;
@@ -217,7 +227,12 @@ export const EditorBubbleMenu: FC<EditorBubbleMenuProps> = (props) => {

            <ActionIcon.Group>
              {items.map((item, index) => (
-                <Tooltip key={index} label={t(item.name)} withArrow>
+                <Tooltip
+                  key={index}
+                  label={t(item.name)}
+                  withArrow
+                  withinPortal={false}
+                >
                  <ActionIcon
                    key={index}
                    variant="default"
@@ -226,7 +241,9 @@ export const EditorBubbleMenu: FC<EditorBubbleMenuProps> = (props) => {
                    aria-label={t(item.name)}
                    className={clsx({ [classes.active]: item.isActive() })}
                    style={{ border: "none" }}
-                    onClick={() => isEditorReady(props.editor) && item.command()}
+                    onClick={() =>
+                      isEditorReady(props.editor) && item.command()
+                    }
                  >
                    <item.icon style={{ width: rem(16) }} stroke={2} />
                  </ActionIcon>
@@ -256,7 +273,9 @@ export const EditorBubbleMenu: FC<EditorBubbleMenuProps> = (props) => {
              radius="6px"
              aria-label={t(commentItem.name)}
              style={{ border: "none" }}
-              onClick={() => isEditorReady(props.editor) && commentItem.command()}
+              onClick={() =>
+                isEditorReady(props.editor) && commentItem.command()
+              }
            >
              <IconMessage size={16} stroke={2} />
            </ActionIcon>
@@ -129,8 +129,7 @@ function handleColorKeyNav(
  grid: "text" | "highlight",
 ) {
  const cols = COLOR_GRID_COLS;
-  const total =
-    grid === "text" ? TEXT_COLORS.length : HIGHLIGHT_COLORS.length;
+  const total = grid === "text" ? TEXT_COLORS.length : HIGHLIGHT_COLORS.length;
  const col = index % cols;

  if (e.key === "ArrowRight") {
@@ -163,8 +162,7 @@ function handleColorKeyNav(
    if (prev >= 0) {
      focusSwatch(grid, prev);
    } else if (grid === "highlight") {
-      const lastRowStart =
-        Math.floor((TEXT_COLORS.length - 1) / cols) * cols;
+      const lastRowStart = Math.floor((TEXT_COLORS.length - 1) / cols) * cols;
      focusSwatch("text", Math.min(lastRowStart + col, TEXT_COLORS.length - 1));
    }
    return;
@@ -222,7 +220,7 @@ export const ColorSelector: FC<ColorSelectorProps> = ({
      withArrow
    >
      <Popover.Target>
-        <Tooltip label={t("Text color")} withArrow>
+        <Tooltip label={t("Text color")} withArrow withinPortal={false}>
          <Button
            variant="default"
            radius="0"
@@ -247,26 +245,26 @@ export const ColorSelector: FC<ColorSelectorProps> = ({

      <Popover.Dropdown onMouseDown={(e) => e.preventDefault()}>
        <Stack gap="md" p="2px">
-            <Box>
-              <Text size="sm" fw={600} mb="xs">
-                {t("Text color")}
-              </Text>
-              <SimpleGrid cols={5} spacing="xs">
-                {TEXT_COLORS.map(({ name, color }, index) => {
-                  const applyTextColor = () => {
-                    if (!isEditorReady(editor)) return;
-                    if (name === "Default") {
-                      editor.commands.unsetColor();
-                    } else {
-                      editor
-                        .chain()
-                        .focus()
-                        .setColor(color || "")
-                        .run();
-                    }
-                    setIsOpen(false);
-                  };
-                  return (
+          <Box>
+            <Text size="sm" fw={600} mb="xs">
+              {t("Text color")}
+            </Text>
+            <SimpleGrid cols={5} spacing="xs">
+              {TEXT_COLORS.map(({ name, color }, index) => {
+                const applyTextColor = () => {
+                  if (!isEditorReady(editor)) return;
+                  if (name === "Default") {
+                    editor.commands.unsetColor();
+                  } else {
+                    editor
+                      .chain()
+                      .focus()
+                      .setColor(color || "")
+                      .run();
+                  }
+                  setIsOpen(false);
+                };
+                return (
                  <Tooltip key={index} label={t(name)} withArrow>
                    <Box
                      role="button"
@@ -306,34 +304,34 @@ export const ColorSelector: FC<ColorSelectorProps> = ({
                      A
                    </Box>
                  </Tooltip>
-                  );
-                })}
-              </SimpleGrid>
-            </Box>
+                );
+              })}
+            </SimpleGrid>
+          </Box>

-            <Box>
-              <Text size="sm" fw={600} mb="xs">
-                {t("Highlight color")}
-              </Text>
-              <SimpleGrid cols={5} spacing="xs">
-                {HIGHLIGHT_COLORS.map(({ name, color }, index) => {
-                  const applyHighlight = () => {
-                    if (!isEditorReady(editor)) return;
-                    if (name === "Default") {
-                      editor.commands.unsetHighlight();
-                    } else {
-                      editor
-                        .chain()
-                        .focus()
-                        .toggleMark("highlight", {
-                          color: color || "",
-                          colorName: name.toLowerCase() || "",
-                        })
-                        .run();
-                    }
-                    setIsOpen(false);
-                  };
-                  return (
+          <Box>
+            <Text size="sm" fw={600} mb="xs">
+              {t("Highlight color")}
+            </Text>
+            <SimpleGrid cols={5} spacing="xs">
+              {HIGHLIGHT_COLORS.map(({ name, color }, index) => {
+                const applyHighlight = () => {
+                  if (!isEditorReady(editor)) return;
+                  if (name === "Default") {
+                    editor.commands.unsetHighlight();
+                  } else {
+                    editor
+                      .chain()
+                      .focus()
+                      .toggleMark("highlight", {
+                        color: color || "",
+                        colorName: name.toLowerCase() || "",
+                      })
+                      .run();
+                  }
+                  setIsOpen(false);
+                };
+                return (
                  <Tooltip key={index} label={t(name)} withArrow>
                    <Box
                      role="button"
@@ -378,37 +376,36 @@ export const ColorSelector: FC<ColorSelectorProps> = ({
                      )}
                    </Box>
                  </Tooltip>
-                  );
-                })}
-              </SimpleGrid>
-            </Box>
+                );
+              })}
+            </SimpleGrid>
+          </Box>

-            <Button
-              variant="default"
-              fullWidth
-              data-color-grid="remove"
-              className={classes.removeColor}
-              onClick={() => {
-                if (isEditorReady(editor)) {
-                  editor.commands.unsetColor();
-                  editor.commands.unsetHighlight();
-                }
-                setIsOpen(false);
-              }}
-              onKeyDown={(e) => {
-                if (e.key === "ArrowUp") {
-                  e.preventDefault();
-                  const lastRowStart =
-                    Math.floor(
-                      (HIGHLIGHT_COLORS.length - 1) / COLOR_GRID_COLS,
-                    ) * COLOR_GRID_COLS;
-                  focusSwatch("highlight", lastRowStart);
-                }
-              }}
-            >
-              {t("Remove color")}
-            </Button>
-          </Stack>
+          <Button
+            variant="default"
+            fullWidth
+            data-color-grid="remove"
+            className={classes.removeColor}
+            onClick={() => {
+              if (isEditorReady(editor)) {
+                editor.commands.unsetColor();
+                editor.commands.unsetHighlight();
+              }
+              setIsOpen(false);
+            }}
+            onKeyDown={(e) => {
+              if (e.key === "ArrowUp") {
+                e.preventDefault();
+                const lastRowStart =
+                  Math.floor((HIGHLIGHT_COLORS.length - 1) / COLOR_GRID_COLS) *
+                  COLOR_GRID_COLS;
+                focusSwatch("highlight", lastRowStart);
+              }
+            }}
+          >
+            {t("Remove color")}
+          </Button>
+        </Stack>
      </Popover.Dropdown>
    </Popover>
  );
@@ -10,7 +10,7 @@ export const LinkSelector: FC = () => {
  const setShowLinkMenu = useSetAtom(showLinkMenuAtom);

  return (
-    <Tooltip label={t("Add link")} withArrow>
+    <Tooltip label={t("Add link")} withArrow withinPortal={false}>
      <ActionIcon
        variant="default"
        size="lg"
@@ -91,7 +91,12 @@ export const TextAlignmentSelector: FC<TextAlignmentProps> = ({
      onChange={setIsOpen}
    >
      <Menu.Target>
-        <Tooltip label={t("Text align")} withArrow disabled={isOpen}>
+        <Tooltip
+          label={t("Text align")}
+          withArrow
+          disabled={isOpen}
+          withinPortal={false}
+        >
          <Button
            variant="default"
            style={{ border: "none", height: "34px" }}
@@ -0,0 +1,176 @@
+import type { Editor } from "@tiptap/react";
+import type { Node as PMNode } from "@tiptap/pm/model";
+import Lightbox, { type Slide } from "yet-another-react-lightbox";
+import type { LightboxRequest } from "@/features/editor/atoms/editor-atoms";
+import { getFileUrl } from "@/lib/config.ts";
+import "yet-another-react-lightbox/styles.css";
+import "yet-another-react-lightbox/plugins/captions.css";
+import Captions from "yet-another-react-lightbox/plugins/captions";
+import Download from "yet-another-react-lightbox/plugins/download";
+import Fullscreen from "yet-another-react-lightbox/plugins/fullscreen";
+import Video from "yet-another-react-lightbox/plugins/video";
+import Zoom from "yet-another-react-lightbox/plugins/zoom";
+import { useEffect, useMemo, useState } from "react";
+import i18n from "@/i18n.ts";
+import { useTranslation } from "react-i18next";
+
+type LightboxViewProps = {
+  editor: Editor;
+  open: boolean;
+  src: string;
+  type: "image" | "video";
+  onClose: () => void;
+};
+
+function getVideoMimeType(src: string) {
+  const extension = src.split(/[?#]/, 1)[0].split(".").pop()?.toLowerCase();
+
+  switch (extension) {
+    case "webm":
+      return "video/webm";
+    case "ogv":
+      return "video/ogg";
+    case "mov":
+      return "video/quicktime";
+    case "m4v":
+      return "video/x-m4v";
+    default:
+      return "video/mp4";
+  }
+}
+
+function getFilename(src: string) {
+  const filename = src.split(/[?#]/, 1)[0].split("/").pop();
+  if (!filename) return i18n.t("Media");
+
+  try {
+    return decodeURIComponent(filename);
+  } catch {
+    return filename;
+  }
+}
+
+function getMedia(rawSrc: string, type?: string, alt?: string): Slide {
+  const src = getFileUrl(rawSrc);
+  const filename = getFilename(rawSrc);
+  const caption = alt || filename;
+
+  if (type === "video") {
+    return {
+      type: "video",
+      sources: [{ src, type: getVideoMimeType(rawSrc) }],
+      title: caption,
+      download: { url: src, filename },
+    };
+  } else {
+    return {
+      type: "image",
+      src,
+      alt: alt || undefined,
+      title: caption,
+      download: { url: src, filename },
+    };
+  }
+}
+
+const LIGHTBOX_NODE_TYPES: Record<string, "image" | "video"> = {
+  image: "image",
+  video: "video",
+  drawio: "image",
+  excalidraw: "image",
+};
+
+// video is excluded: clicks there operate the native controls
+const CLICK_TO_EXPAND_NODE_TYPES = new Set(["image", "drawio", "excalidraw"]);
+
+export function getLightboxClickRequest(node: PMNode): LightboxRequest {
+  if (!CLICK_TO_EXPAND_NODE_TYPES.has(node.type.name)) return null;
+
+  const src = typeof node.attrs.src === "string" ? node.attrs.src : "";
+  if (!src) return null;
+
+  return { src: getFileUrl(src), type: "image" };
+}
+
+function getPageMedia(editor: Editor): Slide[] {
+  const media: Slide[] = [];
+
+  editor.state.doc.descendants((node) => {
+    const type = LIGHTBOX_NODE_TYPES[node.type.name];
+    if (!type) return;
+
+    const rawSrc = typeof node.attrs.src === "string" ? node.attrs.src : "";
+    if (!rawSrc) return;
+
+    media.push(getMedia(rawSrc, type, node.attrs.alt));
+  });
+
+  return media;
+}
+
+export default function LightboxView({
+  editor,
+  open,
+  src,
+  type,
+  onClose,
+}: LightboxViewProps) {
+  const { i18n: i18nInstance } = useTranslation();
+
+  const selectedSlide = useMemo(
+    () => getMedia(src, type),
+    [src, type, i18nInstance.language]
+  );
+
+  const [pageSlides, setPageSlides] = useState<Slide[]>([]);
+  const [loadedMediaKey, setLoadedMediaKey] = useState<string | null>(null);
+
+  useEffect(() => {
+    if (!open) return;
+
+    setLoadedMediaKey(null);
+
+    const frame = requestAnimationFrame(() => {
+      const slides = getPageMedia(editor);
+
+      setPageSlides(slides);
+      setLoadedMediaKey(`${type}:${src}`);
+    });
+
+    return () => cancelAnimationFrame(frame);
+  }, [editor, open, type, src]);
+
+  const slides = loadedMediaKey === `${type}:${src}` ? pageSlides : [selectedSlide];
+
+  const index = useMemo(() => {
+    if (!(pageSlides.length > 0)) {
+      return 0;
+    }
+
+    const idx = slides.findIndex((slide) =>
+      type === "video"
+        ? "sources" in slide && slide.sources.some((s) => s.src === src)
+        : "src" in slide && slide.src === src
+    );
+    return idx >= 0 ? idx : 0;
+  }, [slides, src, type]);
+
+  return (
+    <Lightbox
+      open={open}
+      close={onClose}
+      index={index}
+      slides={slides}
+      plugins={[Captions, Download, Fullscreen, Video, Zoom]}
+      styles={{ container: { backgroundColor: "rgba(0, 0, 0, 0.8)" } }}
+      captions={{ descriptionTextAlign: "center" }}
+      video={{ controls: true, playsInline: true }}
+      zoom={{
+        scrollToZoom: true,
+        maxZoomPixelRatio: 4,
+        maxZoom: 4,
+        supports: ["video"],
+      }}
+    />
+  );
+}
@@ -1,6 +1,7 @@
 import { BubbleMenu as BaseBubbleMenu } from "@tiptap/react/menus";
 import { findParentNode, posToDOMRect, useEditorState } from "@tiptap/react";
 import { useCallback, useEffect, useRef, useState } from "react";
+import { useSetAtom } from "jotai";
 import { Node as PMNode } from "@tiptap/pm/model";
 import { isEditorReady } from "@docmost/editor-ext";
 import {
@@ -24,6 +25,7 @@ import {
  IconDownload,
  IconEdit,
  IconTrash,
+  IconZoomIn,
 } from "@tabler/icons-react";
 import { useTranslation } from "react-i18next";
 import { getDrawioUrl, getFileUrl } from "@/lib/config.ts";
@@ -39,10 +41,12 @@ import { decodeBase64ToSvgString, svgStringToFile } from "@/lib/utils";
 import { IAttachment } from "@/features/attachments/types/attachment.types";
 import { modals } from "@mantine/modals";
 import { useAltTextControl } from "@/features/editor/components/common/use-alt-text-control.tsx";
+import { lightboxRequestAtom } from "@/features/editor/atoms/editor-atoms";
 import classes from "../common/toolbar-menu.module.css";

 export function DrawioMenu({ editor }: EditorMenuProps) {
  const { t } = useTranslation();
+  const setLightboxRequest = useSetAtom(lightboxRequestAtom);
  const [opened, { open, close }] = useDisclosure(false);
  const [initialXML, setInitialXML] = useState<string>("");
  const drawioRef = useRef<DrawIoEmbedRef>(null);
@@ -328,6 +332,23 @@ export function DrawioMenu({ editor }: EditorMenuProps) {

          <div className={classes.divider} />

+          <Tooltip position="top" label={t("Expand")} withinPortal={false}>
+            <ActionIcon
+              onClick={() =>
+                editorState?.src &&
+                setLightboxRequest({
+                  src: getFileUrl(editorState.src),
+                  type: "image",
+                })
+              }
+              size="lg"
+              aria-label={t("Expand")}
+              variant="subtle"
+            >
+              <IconZoomIn size={18} />
+            </ActionIcon>
+          </Tooltip>
+
          <Tooltip position="top" label={t("Edit")} withinPortal={false}>
            <ActionIcon
              onClick={handleOpen}
@@ -1,6 +1,7 @@
 import { BubbleMenu as BaseBubbleMenu } from "@tiptap/react/menus";
 import { findParentNode, posToDOMRect, useEditorState } from "@tiptap/react";
 import { lazy, Suspense, useCallback, useEffect, useRef, useState } from "react";
+import { useSetAtom } from "jotai";
 import { Node as PMNode } from "@tiptap/pm/model";
 import { isEditorReady } from "@docmost/editor-ext";
 import {
@@ -25,6 +26,7 @@ import {
  IconDownload,
  IconEdit,
  IconTrash,
+  IconZoomIn,
 } from "@tabler/icons-react";
 import { useTranslation } from "react-i18next";
 import { getFileUrl } from "@/lib/config.ts";
@@ -37,6 +39,7 @@ import ReactClearModal from "react-clear-modal";
 import { useHandleLibrary } from "@excalidraw/excalidraw";
 import { localStorageLibraryAdapter } from "@/features/editor/components/excalidraw/excalidraw-utils.ts";
 import { useAltTextControl } from "@/features/editor/components/common/use-alt-text-control.tsx";
+import { lightboxRequestAtom } from "@/features/editor/atoms/editor-atoms";
 import classes from "../common/toolbar-menu.module.css";

 const ExcalidrawComponent = lazy(() =>
@@ -47,6 +50,7 @@ const ExcalidrawComponent = lazy(() =>

 export function ExcalidrawMenu({ editor }: EditorMenuProps) {
  const { t } = useTranslation();
+  const setLightboxRequest = useSetAtom(lightboxRequestAtom);
  const [opened, { open, close }] = useDisclosure(false);
  const [excalidrawAPI, setExcalidrawAPI] =
    useState<ExcalidrawImperativeAPI>(null);
@@ -359,6 +363,23 @@ export function ExcalidrawMenu({ editor }: EditorMenuProps) {

          <div className={classes.divider} />

+          <Tooltip position="top" label={t("Expand")} withinPortal={false}>
+            <ActionIcon
+              onClick={() =>
+                editorState?.src &&
+                setLightboxRequest({
+                  src: getFileUrl(editorState.src),
+                  type: "image",
+                })
+              }
+              size="lg"
+              aria-label={t("Expand")}
+              variant="subtle"
+            >
+              <IconZoomIn size={18} />
+            </ActionIcon>
+          </Tooltip>
+
          <Tooltip position="top" label={t("Edit")} withinPortal={false}>
            <ActionIcon
              onClick={handleOpen}
@@ -1,6 +1,7 @@
 import { BubbleMenu as BaseBubbleMenu } from "@tiptap/react/menus";
 import { findParentNode, posToDOMRect, useEditorState } from "@tiptap/react";
 import React, { useCallback, useRef } from "react";
+import { useSetAtom } from "jotai";
 import { Node as PMNode } from "@tiptap/pm/model";
 import { isEditorReady } from "@docmost/editor-ext";
 import {
@@ -16,16 +17,19 @@ import {
  IconDownload,
  IconRefresh,
  IconTrash,
+  IconZoomIn,
 } from "@tabler/icons-react";
 import { useTranslation } from "react-i18next";
 import { getFileUrl } from "@/lib/config.ts";
 import { uploadImageAction } from "@/features/editor/components/image/upload-image-action.tsx";
 import { useAltTextControl } from "@/features/editor/components/common/use-alt-text-control.tsx";
+import { lightboxRequestAtom } from "@/features/editor/atoms/editor-atoms";
 import classes from "../common/toolbar-menu.module.css";

 export function ImageMenu({ editor }: EditorMenuProps) {
  const { t } = useTranslation();
  const fileInputRef = useRef<HTMLInputElement>(null);
+  const setLightboxRequest = useSetAtom(lightboxRequestAtom);

  const editorState = useEditorState({
    editor,
@@ -207,6 +211,23 @@ export function ImageMenu({ editor }: EditorMenuProps) {

        <div className={classes.divider} />

+        <Tooltip position="top" label={t("Expand")} withinPortal={false}>
+          <ActionIcon
+            onClick={() =>
+              editorState?.src &&
+              setLightboxRequest({
+                src: getFileUrl(editorState.src),
+                type: "image",
+              })
+            }
+            size="lg"
+            aria-label={t("Expand")}
+            variant="subtle"
+          >
+            <IconZoomIn size={18} />
+          </ActionIcon>
+        </Tooltip>
+
        <Tooltip position="top" label={t("Download")} withinPortal={false}>
          <ActionIcon
            onClick={handleDownload}
@@ -13,14 +13,21 @@ import {
 import { useTranslation } from "react-i18next";
 import { sortPositionKeys } from "@/features/page/tree/utils/utils";
 import { useSharedPageSubpages } from "@/features/share/hooks/use-shared-page-subpages";
+import { extractPageSlugId } from "@/lib";

 export default function SubpagesView(props: NodeViewProps) {
  const { editor } = props;
-  const { spaceSlug, shareId } = useParams();
+  const { spaceSlug, shareId, pageSlug } = useParams();
  const { t } = useTranslation();

-  //@ts-ignore
-  const currentPageId = editor.storage.pageId;
+  // @ts-ignore
+  const storagePageId = editor.storage.pageId;
+  const routePageId = extractPageSlugId(pageSlug);
+  let currentPageId = storagePageId;
+
+  if (shareId){
+    currentPageId = routePageId;
+  }

  // Get subpages from shared tree if we're in a shared context
  const sharedSubpages = useSharedPageSubpages(currentPageId);
@@ -1,6 +1,7 @@
 import { BubbleMenu as BaseBubbleMenu } from "@tiptap/react/menus";
 import { findParentNode, posToDOMRect, useEditorState } from "@tiptap/react";
 import { useCallback } from "react";
+import { useSetAtom } from "jotai";
 import { Node as PMNode } from "@tiptap/pm/model";
 import { isEditorReady } from "@docmost/editor-ext";
 import {
@@ -15,14 +16,17 @@ import {
  IconLayoutAlignRight,
  IconDownload,
  IconTrash,
+  IconZoomIn,
 } from "@tabler/icons-react";
 import { useTranslation } from "react-i18next";
 import { getFileUrl } from "@/lib/config.ts";
 import { useAltTextControl } from "@/features/editor/components/common/use-alt-text-control.tsx";
+import { lightboxRequestAtom } from "@/features/editor/atoms/editor-atoms";
 import classes from "../common/toolbar-menu.module.css";

 export function VideoMenu({ editor }: EditorMenuProps) {
  const { t } = useTranslation();
+  const setLightboxRequest = useSetAtom(lightboxRequestAtom);

  const editorState = useEditorState({
    editor,
@@ -183,6 +187,23 @@ export function VideoMenu({ editor }: EditorMenuProps) {

        <div className={classes.divider} />

+        <Tooltip position="top" label={t("Expand")} withinPortal={false}>
+          <ActionIcon
+            onClick={() =>
+              editorState?.src &&
+              setLightboxRequest({
+                src: getFileUrl(editorState.src),
+                type: "video",
+              })
+            }
+            size="lg"
+            aria-label={t("Expand")}
+            variant="subtle"
+          >
+            <IconZoomIn size={18} />
+          </ActionIcon>
+        </Tooltip>
+
        <Tooltip position="top" label={t("Download")} withinPortal={false}>
          <ActionIcon
            onClick={handleDownload}
@@ -33,6 +33,7 @@ import { useAtom, useAtomValue } from "jotai";
 import { currentUserAtom } from "@/features/user/atoms/current-user-atom";
 import {
  currentPageEditModeAtom,
+  lightboxRequestAtom,
  pageEditorAtom,
  yjsConnectionStatusAtom,
  yjsSyncedAtom,
@@ -53,6 +54,9 @@ import CalloutMenu from "@/features/editor/components/callout/callout-menu.tsx";
 import VideoMenu from "@/features/editor/components/video/video-menu.tsx";
 import PdfMenu from "@/features/editor/components/pdf/pdf-menu.tsx";
 import SubpagesMenu from "@/features/editor/components/subpages/subpages-menu.tsx";
+import LightboxView, {
+  getLightboxClickRequest,
+} from "@/features/editor/components/common/lightbox-view";
 import {
  handleFileDrop,
  handlePaste,
@@ -184,6 +188,7 @@ function CollabPageEditor({
  const [, setActiveCommentId] = useAtom(activeCommentIdAtom);
  const [showCommentPopup, setShowCommentPopup] = useAtom(showCommentPopupAtom);
  const [showReadOnlyCommentPopup] = useAtom(showReadOnlyCommentPopupAtom);
+  const [lightboxRequest, setLightboxRequest] = useAtom(lightboxRequestAtom);
  const [isLocalSynced, setIsLocalSynced] = useState(false);
  const [isRemoteSynced, setIsRemoteSynced] = useState(false);
  const [yjsConnectionStatus, setYjsConnectionStatus] = useAtom(
@@ -245,6 +250,17 @@ function CollabPageEditor({
    return [...mainExtensions, ...collabExtensions(provider, currentUser.user)];
  }, [provider, currentUser?.user]);

+  const debouncedUpdateContent = useDebouncedCallback((newContent: any) => {
+    const pageData = queryClient.getQueryData<IPage>(["pages", slugId]);
+
+    if (pageData) {
+      queryClient.setQueryData(["pages", slugId], {
+        ...pageData,
+        content: newContent,
+      });
+    }
+  }, 3000);
+
  const editor = useEditor(
    {
      extensions,
@@ -305,6 +321,22 @@ function CollabPageEditor({

          return handleFileDrop(editorRef.current, event, moved, pageId);
        },
+        handleClickOn: (view, _pos, node) => {
+          if (view.editable) return false;
+
+          const request = getLightboxClickRequest(node);
+          if (!request) return false;
+
+          setLightboxRequest(request);
+          return true;
+        },
+        handleDoubleClickOn: (_view, _pos, node) => {
+          const request = getLightboxClickRequest(node);
+          if (!request) return false;
+
+          setLightboxRequest(request);
+          return true;
+        },
      },
      onCreate({ editor }) {
        if (editor) {
@@ -343,17 +375,6 @@ function CollabPageEditor({
    },
  });

-  const debouncedUpdateContent = useDebouncedCallback((newContent: any) => {
-    const pageData = queryClient.getQueryData<IPage>(["pages", slugId]);
-
-    if (pageData) {
-      queryClient.setQueryData(["pages", slugId], {
-        ...pageData,
-        content: newContent,
-      });
-    }
-  }, 3000);
-
  const handleActiveCommentEvent = (event) => {
    const { commentId, resolved } = event.detail;

@@ -386,6 +407,7 @@ function CollabPageEditor({
    setActiveCommentId(null);
    setShowCommentPopup(false);
    setAsideState({ tab: "", isAsideOpen: false });
+    setLightboxRequest(null);
  }, [pageId]);

  const isSynced = isLocalSynced && isRemoteSynced;
@@ -459,6 +481,15 @@ function CollabPageEditor({
        {editor && !editorIsEditable && (editable || canComment) && (
          <ReadonlyBubbleMenu editor={editor} />
        )}
+        {editor && (
+          <LightboxView
+            editor={editor}
+            open={!!lightboxRequest}
+            src={lightboxRequest?.src ?? ""}
+            type={lightboxRequest?.type ?? "image"}
+            onClose={() => setLightboxRequest(null)}
+          />
+        )}
        {showCommentPopup && <CommentDialog editor={editor} pageId={pageId} />}
        {showReadOnlyCommentPopup && (
          <CommentDialog editor={editor} pageId={pageId} readOnly />
@@ -1,15 +1,27 @@
 import "@/features/editor/styles/index.css";
-import React, { useCallback, useEffect, useMemo, useRef } from "react";
-import { EditorProvider } from "@tiptap/react";
+import React, {
+  useCallback,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+} from "react";
+import { Editor, EditorProvider } from "@tiptap/react";
 import { mainExtensions } from "@/features/editor/extensions/extensions";
 import { Document } from "@tiptap/extension-document";
 import { Heading, UniqueID } from "@docmost/editor-ext";
 import { Text } from "@tiptap/extension-text";
 import { Placeholder } from "@tiptap/extension-placeholder";
 import { useAtom } from "jotai";
-import { readOnlyEditorAtom } from "@/features/editor/atoms/editor-atoms.ts";
+import {
+  lightboxRequestAtom,
+  readOnlyEditorAtom,
+} from "@/features/editor/atoms/editor-atoms.ts";
 import { useEditorScroll } from "./hooks/use-editor-scroll";
 import { TransclusionLookupProvider } from "@/features/editor/components/transclusion/transclusion-lookup-context";
+import LightboxView, {
+  getLightboxClickRequest,
+} from "@/features/editor/components/common/lightbox-view";

 interface PageEditorProps {
  title: string;
@@ -33,6 +45,8 @@ export default function ReadonlyPageEditor({
  shareId,
 }: PageEditorProps) {
  const [, setReadOnlyEditor] = useAtom(readOnlyEditorAtom);
+  const [lightboxRequest, setLightboxRequest] = useAtom(lightboxRequestAtom);
+  const [contentEditor, setContentEditor] = useState<Editor | null>(null);
  const isComponentMounted = useRef(false);
  const editorCreated = useRef(false);

@@ -49,6 +63,11 @@ export default function ReadonlyPageEditor({
    isComponentMounted.current = true;
  }, []);

+  useEffect(() => {
+    if (!shareId) return;
+    setLightboxRequest(null);
+  }, [pageId, shareId]);
+
  const extensions = useMemo(() => {
    const excludedExtensions = new Set([
      "uniqueID",
@@ -97,6 +116,19 @@ export default function ReadonlyPageEditor({
        textDirection="auto"
        extensions={extensions}
        content={content}
+        editorProps={
+          shareId
+            ? {
+                handleClickOn: (_view, _pos, node) => {
+                  const request = getLightboxClickRequest(node);
+                  if (!request) return false;
+
+                  setLightboxRequest(request);
+                  return true;
+                },
+              }
+            : undefined
+        }
        onCreate={({ editor }) => {
          if (editor) {
            if (pageId) {
@@ -105,12 +137,22 @@ export default function ReadonlyPageEditor({
            }
            // @ts-ignore
            setReadOnlyEditor(editor);
+            setContentEditor(editor);

            handleScrollTo(editor);
            editorCreated.current = true;
          }
        }}
      ></EditorProvider>
+      {shareId && contentEditor && (
+        <LightboxView
+          editor={contentEditor}
+          open={!!lightboxRequest}
+          src={lightboxRequest?.src ?? ""}
+          type={lightboxRequest?.type ?? "image"}
+          onClose={() => setLightboxRequest(null)}
+        />
+      )}
      <div style={{ paddingBottom: "20vh" }}></div>
    </TransclusionLookupProvider>
  );
@@ -39,6 +39,7 @@ export function useWorkspaceLabelsQuery(query: string, enabled: boolean) {
    queryFn: () => getWorkspaceLabels({ type: "page", query, limit: 50 }),
    enabled,
    staleTime: 30 * 1000,
+    placeholderData: keepPreviousData
  });
 }

@@ -0,0 +1,152 @@
+import { ReactNode, useMemo, useState } from "react";
+import { Divider, Group, Menu, ScrollArea, Text, TextInput } from "@mantine/core";
+import { useDebouncedValue } from "@mantine/hooks";
+import { IconCheck, IconSearch } from "@tabler/icons-react";
+import { useTranslation } from "react-i18next";
+import { useSearchSuggestionsQuery } from "@/features/search/queries/search-query";
+import { RadioMenuItem } from "@/components/ui/radio-menu-item";
+import { CustomAvatar } from "@/components/ui/custom-avatar.tsx";
+import { IUser } from "@/features/user/types/user.types.ts";
+import { useAtomValue } from "jotai";
+import { userAtom } from "@/features/user/atoms/current-user-atom.ts";
+
+type CreatorFilterMenuProps = {
+  value: string | null;
+  onChange: (user: IUser | null) => void;
+  children: ReactNode;
+  width?: number;
+  position?:
+    | "bottom-start"
+    | "bottom-end"
+    | "bottom"
+    | "top-start"
+    | "top-end"
+    | "top";
+  zIndex?: number;
+  opened?: boolean;
+  onOpenChange?: (opened: boolean) => void;
+};
+
+export function CreatorFilterMenu({
+  value,
+  onChange,
+  children,
+  width = 280,
+  position = "bottom-end",
+  zIndex,
+  opened,
+  onOpenChange,
+}: CreatorFilterMenuProps) {
+  const { t } = useTranslation();
+  const [searchQuery, setSearchQuery] = useState("");
+  const [debouncedQuery] = useDebouncedValue(searchQuery, 300);
+
+  const { data: suggestion, isLoading } = useSearchSuggestionsQuery({
+    query: debouncedQuery,
+    includeUsers: true,
+    includeGroups: false,
+    includePages: false,
+    preload: true,
+  });
+
+  const users: IUser[] = (suggestion?.users as IUser[]) ?? [];
+  const currentUser = useAtomValue(userAtom);
+
+  // pin the signed-in user on top so they never have to search themselves
+  const displayUsers = useMemo(() => {
+    if (!currentUser) return users;
+    const others = users.filter((user) => user.id !== currentUser.id);
+    const q = debouncedQuery.trim().toLowerCase();
+    const matchesQuery =
+      !q ||
+      currentUser.name?.toLowerCase().includes(q) ||
+      currentUser.email?.toLowerCase().includes(q);
+    return matchesQuery ? [currentUser as IUser, ...others] : users;
+  }, [users, currentUser, debouncedQuery]);
+
+  return (
+    <Menu
+      shadow="md"
+      width={width}
+      position={position}
+      zIndex={zIndex}
+      opened={opened}
+      onChange={onOpenChange}
+    >
+      <Menu.Target>{children}</Menu.Target>
+      <Menu.Dropdown>
+        <TextInput
+          placeholder={t("Find a user")}
+          data-autofocus
+          autoFocus
+          leftSection={<IconSearch size={16} />}
+          value={searchQuery}
+          onChange={(e) => setSearchQuery(e.target.value)}
+          size="sm"
+          variant="filled"
+          radius="sm"
+          styles={{ input: { marginBottom: 8 } }}
+        />
+
+        <ScrollArea.Autosize mah={280}>
+          <Menu.Item
+            component={RadioMenuItem}
+            aria-checked={!value}
+            onClick={() => onChange(null)}
+          >
+            <Group flex="1" gap="xs">
+              <div style={{ flex: 1 }}>
+                <Text size="sm" fw={500}>
+                  {t("Anyone")}
+                </Text>
+              </div>
+              {!value && <IconCheck size={20} aria-hidden />}
+            </Group>
+          </Menu.Item>
+
+          <Divider my="xs" />
+
+          {displayUsers.length === 0 && (
+            <Text size="xs" c="dimmed" px="xs" py="sm">
+              {isLoading ? t("Loading...") : t("No users found")}
+            </Text>
+          )}
+
+          {displayUsers.map((user) => (
+            <Menu.Item
+              key={user.id}
+              component={RadioMenuItem}
+              aria-checked={value === user.id}
+              onClick={() => onChange(user)}
+            >
+              <Group flex="1" gap="xs">
+                <CustomAvatar
+                  avatarUrl={user.avatarUrl}
+                  size={20}
+                  name={user.name}
+                />
+                <div style={{ flex: 1, minWidth: 0 }}>
+                  <Text size="sm" fw={500} truncate>
+                    {user.name}
+                    {user.id === currentUser?.id && (
+                      <Text span size="sm" c="dimmed" fw={400}>
+                        {" "}
+                        ({t("you")})
+                      </Text>
+                    )}
+                  </Text>
+                  {user.email && (
+                    <Text size="xs" c="dimmed" truncate>
+                      {user.email}
+                    </Text>
+                  )}
+                </div>
+                {value === user.id && <IconCheck size={20} aria-hidden />}
+              </Group>
+            </Menu.Item>
+          ))}
+        </ScrollArea.Autosize>
+      </Menu.Dropdown>
+    </Menu>
+  );
+}
@@ -0,0 +1,127 @@
+import { ReactNode, useMemo, useState } from "react";
+import {
+  Group,
+  Menu,
+  ScrollArea,
+  Text,
+  TextInput,
+  useComputedColorScheme,
+} from "@mantine/core";
+import { useDebouncedValue } from "@mantine/hooks";
+import { IconCheck, IconSearch } from "@tabler/icons-react";
+import { useTranslation } from "react-i18next";
+import { useWorkspaceLabelsQuery } from "@/features/label/queries/label-query.ts";
+import { getLabelColor } from "@/features/label/utils/label-colors.ts";
+import { CheckboxMenuItem } from "@/components/ui/checkbox-menu-item";
+
+type LabelFilterMenuProps = {
+  value: string[];
+  onChange: (labelIds: string[]) => void;
+  children: ReactNode;
+  width?: number;
+  position?:
+    | "bottom-start"
+    | "bottom-end"
+    | "bottom"
+    | "top-start"
+    | "top-end"
+    | "top";
+  zIndex?: number;
+  opened?: boolean;
+  onOpenChange?: (opened: boolean) => void;
+};
+
+export function LabelFilterMenu({
+  value,
+  onChange,
+  children,
+  width = 280,
+  position = "bottom-end",
+  zIndex,
+  opened,
+  onOpenChange,
+}: LabelFilterMenuProps) {
+  const { t } = useTranslation();
+  const scheme = useComputedColorScheme("light");
+  const [searchQuery, setSearchQuery] = useState("");
+  const [debouncedQuery] = useDebouncedValue(searchQuery, 300);
+
+  const { data, isLoading } = useWorkspaceLabelsQuery(debouncedQuery, true);
+  const labels = data?.items ?? [];
+
+  const selectedSet = useMemo(() => new Set(value), [value]);
+
+  const toggleLabel = (labelId: string) => {
+    if (selectedSet.has(labelId)) {
+      onChange(value.filter((id) => id !== labelId));
+    } else {
+      onChange([...value, labelId]);
+    }
+  };
+
+  return (
+    <Menu
+      shadow="md"
+      width={width}
+      position={position}
+      zIndex={zIndex}
+      opened={opened}
+      onChange={onOpenChange}
+      closeOnItemClick={false}
+    >
+      <Menu.Target>{children}</Menu.Target>
+      <Menu.Dropdown>
+        <TextInput
+          placeholder={t("Find a label")}
+          data-autofocus
+          autoFocus
+          leftSection={<IconSearch size={16} />}
+          value={searchQuery}
+          onChange={(e) => setSearchQuery(e.target.value)}
+          size="sm"
+          variant="filled"
+          radius="sm"
+          styles={{ input: { marginBottom: 8 } }}
+        />
+
+        <ScrollArea.Autosize mah={280}>
+          {labels.length === 0 && (
+            <Text size="xs" c="dimmed" px="xs" py="sm">
+              {isLoading ? t("Loading...") : t("No labels found")}
+            </Text>
+          )}
+
+          {labels.map((label) => {
+            const isChecked = selectedSet.has(label.id);
+            const color = getLabelColor(label.name, scheme);
+            return (
+              <Menu.Item
+                key={label.id}
+                type="button"
+                component={CheckboxMenuItem}
+                aria-checked={isChecked}
+                onClick={() => toggleLabel(label.id)}
+              >
+                <Group flex="1" gap="xs">
+                  <span
+                    style={{
+                      width: 8,
+                      height: 8,
+                      borderRadius: "50%",
+                      background: color.dot,
+                      flexShrink: 0,
+                    }}
+                  />
+                  <Text size="sm" fw={500} style={{ flex: 1 }} truncate>
+                    {label.name}
+                  </Text>
+                  {isChecked && <IconCheck size={20} aria-hidden />}
+                </Group>
+              </Menu.Item>
+            );
+          })}
+        </ScrollArea.Autosize>
+      </Menu.Dropdown>
+    </Menu>
+  );
+}
@@ -19,6 +19,7 @@ import {
 } from "@/features/search/types/search.types";
 import DOMPurify from "dompurify";
 import { useTranslation } from "react-i18next";
+import { timeAgo } from "@/lib/time.ts";

 interface SearchResultItemProps {
  result: IPageSearch | IAttachmentSearch;
@@ -26,6 +27,14 @@ interface SearchResultItemProps {
  showSpace?: boolean;
 }

+// Spotlight hardcodes tabIndex={-1} after spreading props; a ref wins and
+// React never writes -1 back because the prop value never changes
+const makeActionTabbable = (el: HTMLElement | null) => {
+  if (el) {
+    el.tabIndex = 0;
+  }
+};
+
 export function SearchResultItem({
  result,
  isAttachmentResult,
@@ -46,6 +55,7 @@ export function SearchResultItem({
    return (
      <Spotlight.Action
        component={Link}
+        ref={makeActionTabbable}
        //@ts-ignore
        to={buildPageUrl(
          attachmentResult.space.slug,
@@ -59,8 +69,13 @@ export function SearchResultItem({
            <IconFile size={16} />
          </Center>

-          <div style={{ flex: 1 }}>
-            <Text>{attachmentResult.fileName}</Text>
+          <div style={{ flex: 1, minWidth: 0 }}>
+            <Group justify="space-between" wrap="nowrap" gap="xs">
+              <Text truncate>{attachmentResult.fileName}</Text>
+              <Text size="xs" c="dimmed" style={{ flexShrink: 0 }}>
+                {timeAgo(attachmentResult.updatedAt)}
+              </Text>
+            </Group>
            <Text size="xs" opacity={0.6}>
              {attachmentResult.space.name} • {attachmentResult.page.title}
            </Text>
@@ -96,6 +111,7 @@ export function SearchResultItem({
    return (
      <Spotlight.Action
        component={Link}
+        ref={makeActionTabbable}
        //@ts-ignore
        to={buildPageUrl(
          pageResult.space.slug,
@@ -107,8 +123,13 @@ export function SearchResultItem({
        <Group wrap="nowrap" w="100%">
          <Center>{getPageIcon(pageResult?.icon)}</Center>

-          <div style={{ flex: 1 }}>
-            <Text>{pageResult.title}</Text>
+          <div style={{ flex: 1, minWidth: 0 }}>
+            <Group justify="space-between" wrap="nowrap" gap="xs">
+              <Text truncate>{pageResult.title || t("Untitled")}</Text>
+              <Text size="xs" c="dimmed" style={{ flexShrink: 0 }}>
+                {timeAgo(pageResult.updatedAt)}
+              </Text>
+            </Group>

            {showSpace && pageResult.space && (
              <Badge variant="light" size="xs" color="gray">
@@ -17,3 +17,10 @@
    color: light-dark(var(--mantine-color-gray-7), var(--mantine-color-gray-6));
  }
 }
+
+.filterButtonActive {
+  color: var(--mantine-color-blue-light-color);
+  &:hover {
+    color: var(--mantine-color-blue-light-color);
+  }
+}
@@ -1,4 +1,5 @@
 import React, { useState, useEffect } from "react";
+import cx from "clsx";
 import {
  Button,
  Menu,
@@ -11,18 +12,24 @@ import {
 import {
  IconChevronDown,
  IconBuilding,
+  IconPlus,
  IconFileDescription,
  IconCheck,
+  IconUser,
+  IconTag,
+  IconLetterCase,
 } from "@tabler/icons-react";
 import { useTranslation } from "react-i18next";
 import { useGetSpacesQuery } from "@/features/space/queries/space-query";
 import { SpaceFilterMenu } from "@/features/space/components/space-filter-menu";
+import { CreatorFilterMenu } from "@/features/search/components/creator-filter-menu";
 import { RadioMenuItem } from "@/components/ui/radio-menu-item";
 import { useHasFeature } from "@/ee/hooks/use-feature";
 import { Feature } from "@/ee/features";
 import classes from "./search-spotlight-filters.module.css";
 import { useAtom } from "jotai";
 import { workspaceAtom } from "@/features/user/atoms/current-user-atom.ts";
+import { LabelFilterMenu } from "./label-filter-menu";

 interface SearchSpotlightFiltersProps {
  onFiltersChange?: (filters: any) => void;
@@ -40,9 +47,17 @@ export function SearchSpotlightFilters({
  const { t } = useTranslation();
  const hasAttachmentIndexing = useHasFeature(Feature.ATTACHMENT_INDEXING);
  const [selectedSpaceId, setSelectedSpaceId] = useState<string | null>(
-    spaceId || null,
+    spaceId || null
  );
  const [contentType, setContentType] = useState<string | null>("page");
+  const [selectedCreatorId, setSelectedCreatorId] = useState<string | null>(null);
+  const [selectedCreatorName, setSelectedCreatorName] = useState<string | null>(
+    null
+  );
+  const [selectedLabelIds, setSelectedLabelIds] = useState<string[]>([]);
+  const [titleOnly, setTitleOnly] = useState(false);
+  const [openedFilter, setOpenedFilter] = useState<string | null>(null);
+  const [visibleFilters, setVisibleFilters] = useState<string[]>([]);
  const [workspace] = useAtom(workspaceAtom);

  const { data: spacesData } = useGetSpacesQuery({ limit: 100 });
@@ -50,15 +65,6 @@ export function SearchSpotlightFilters({
    ? spacesData?.items.find((space) => space.id === selectedSpaceId)
    : null;

-  useEffect(() => {
-    if (onFiltersChange) {
-      onFiltersChange({
-        spaceId: selectedSpaceId,
-        contentType,
-      });
-    }
-  }, []);
-
  const contentTypeOptions = [
    { value: "page", label: t("Pages") },
    {
@@ -68,38 +74,70 @@ export function SearchSpotlightFilters({
    },
  ];

+  useEffect(() => {
+    onFiltersChange?.({
+      spaceId: selectedSpaceId,
+      contentType,
+      creatorId: selectedCreatorId,
+      labelIds: selectedLabelIds,
+      titleOnly,
+    });
+  }, [
+    selectedSpaceId,
+    contentType,
+    selectedCreatorId,
+    selectedLabelIds,
+    titleOnly,
+    onFiltersChange,
+  ]);
+
  const handleSpaceSelect = (spaceId: string | null) => {
    setSelectedSpaceId(spaceId);
+  };

-    if (onFiltersChange) {
-      onFiltersChange({
-        spaceId: spaceId,
-        contentType,
-      });
+  const handleCreatorSelect = (user: { id: string; name: string } | null) => {
+    setSelectedCreatorId(user?.id ?? null);
+    setSelectedCreatorName(user?.name ?? null);
+  };
+
+  const handleLabelsSelect = (labelIds: string[]) => {
+    setSelectedLabelIds(labelIds);
+  };
+
+  const handleChangeContentType = (value: string) => {
+    setContentType(value);
+
+    if (value === "attachment") {
+      setSelectedLabelIds([]);
    }
  };

-  const handleFilterChange = (filterType: string, value: any) => {
-    let newSelectedSpaceId = selectedSpaceId;
-    let newContentType = contentType;
+  const onDemandFilters = [
+    { key: "creator", label: t("Created by"), icon: IconUser, available: true },
+    {
+      key: "labels",
+      label: t("Labels"),
+      icon: IconTag,
+      available: contentType !== "attachment",
+    },
+  ];

-    switch (filterType) {
-      case "spaceId":
-        newSelectedSpaceId = value;
-        setSelectedSpaceId(value);
-        break;
-      case "contentType":
-        newContentType = value;
-        setContentType(value);
-        break;
-    }
+  const isFilterVisible = (key: string) => {
+    if (openedFilter === key) return true;
+    if (key === "creator") return !!selectedCreatorId;
+    if (key === "labels")
+      return contentType !== "attachment" && selectedLabelIds.length > 0;
+    return false;
+  };

-    if (onFiltersChange) {
-      onFiltersChange({
-        spaceId: newSelectedSpaceId,
-        contentType: newContentType,
-      });
-    }
+  const orderedVisibleFilters = visibleFilters.filter(isFilterVisible);
+  const addableFilters = onDemandFilters.filter(
+    (filter) => filter.available && !isFilterVisible(filter.key),
+  );
+
+  const revealFilter = (key: string) => {
+    setVisibleFilters((prev) => [...prev.filter((k) => k !== key), key]);
+    setOpenedFilter(key);
  };

  return (
@@ -122,8 +160,17 @@ export function SearchSpotlightFilters({
            color="blue"
            labelPosition="left"
            styles={{
-              root: { display: "flex", alignItems: "center" },
-              label: { paddingRight: "8px", fontSize: "13px", fontWeight: 500 },
+              root: {
+                display: "flex",
+                alignItems: "center",
+                flexShrink: 0,
+              },
+              label: {
+                whiteSpace: "nowrap",
+                paddingRight: "8px",
+                fontSize: "13px",
+                fontWeight: 500,
+              },
            }}
          />
        </div>
@@ -181,7 +228,7 @@ export function SearchSpotlightFilters({
              onClick={() =>
                !option.disabled &&
                contentType !== option.value &&
-                handleFilterChange("contentType", option.value)
+                handleChangeContentType(option.value)
              }
              disabled={
                option.disabled || (isAiMode && option.value === "attachment")
@@ -195,13 +242,11 @@ export function SearchSpotlightFilters({
                      {t("Enterprise")}
                    </Badge>
                  )}
-                  {!option.disabled &&
-                    isAiMode &&
-                    option.value === "attachment" && (
-                      <Text size="xs" mt={4}>
-                        {t("AI Answers not available for attachments")}
-                      </Text>
-                    )}
+                  {!option.disabled && isAiMode && option.value === "attachment" && (
+                    <Text size="xs" mt={4}>
+                      {t("AI Answers not available for attachments")}
+                    </Text>
+                  )}
                </div>
                {contentType === option.value && <IconCheck size={20} aria-hidden />}
              </Group>
@@ -209,6 +254,126 @@ export function SearchSpotlightFilters({
          ))}
        </Menu.Dropdown>
      </Menu>
+
+      {!isAiMode && (
+        <Button
+          variant={titleOnly ? "light" : "subtle"}
+          color={titleOnly ? "blue" : "gray"}
+          size="sm"
+          radius="xl"
+          leftSection={<IconLetterCase size={16} />}
+          className={cx(
+            classes.filterButton,
+            titleOnly && classes.filterButtonActive,
+          )}
+          fw={500}
+          aria-pressed={titleOnly}
+          onClick={() => setTitleOnly(!titleOnly)}
+        >
+          {t("Title only")}
+        </Button>
+      )}
+
+      {!isAiMode &&
+        orderedVisibleFilters.map((filterKey) => {
+        if (filterKey === "creator") {
+          return (
+            <CreatorFilterMenu
+              key="creator"
+              value={selectedCreatorId}
+              onChange={handleCreatorSelect}
+              position="bottom-start"
+              width={250}
+              zIndex={getDefaultZIndex("max")}
+              opened={openedFilter === "creator"}
+              onOpenChange={(opened) =>
+                setOpenedFilter(opened ? "creator" : null)
+              }
+            >
+              <Button
+                variant="subtle"
+                color="gray"
+                size="sm"
+                rightSection={<IconChevronDown size={14} />}
+                leftSection={<IconUser size={16} />}
+                className={classes.filterButton}
+                fw={500}
+              >
+                {selectedCreatorId
+                  ? `${t("Created by")}: ${selectedCreatorName || t("Unknown")}`
+                  : `${t("Created by")}: ${t("Anyone")}`}
+              </Button>
+            </CreatorFilterMenu>
+          );
+        }
+
+        if (filterKey === "labels") {
+          return (
+            <LabelFilterMenu
+              key="labels"
+              value={selectedLabelIds}
+              onChange={handleLabelsSelect}
+              position="bottom-start"
+              width={250}
+              zIndex={getDefaultZIndex("max")}
+              opened={openedFilter === "labels"}
+              onOpenChange={(opened) =>
+                setOpenedFilter(opened ? "labels" : null)
+              }
+            >
+              <Button
+                variant="subtle"
+                color="gray"
+                size="sm"
+                rightSection={<IconChevronDown size={14} />}
+                leftSection={<IconTag size={16} />}
+                className={classes.filterButton}
+                fw={500}
+              >
+                {selectedLabelIds.length > 0
+                  ? `${t("Labels")} (${selectedLabelIds.length})`
+                  : t("Labels")}
+              </Button>
+            </LabelFilterMenu>
+          );
+        }
+
+        return null;
+      })}
+
+      {!isAiMode && addableFilters.length > 0 && (
+        <Menu
+          shadow="md"
+          width={200}
+          position="bottom-end"
+          zIndex={getDefaultZIndex("max")}
+        >
+          <Menu.Target>
+            <Button
+              variant="subtle"
+              color="gray"
+              size="sm"
+              leftSection={<IconPlus size={16} />}
+              className={classes.filterButton}
+              style={{ marginLeft: "auto" }}
+              fw={500}
+            >
+              {t("Filter")}
+            </Button>
+          </Menu.Target>
+          <Menu.Dropdown>
+            {addableFilters.map((filter) => (
+              <Menu.Item
+                key={filter.key}
+                leftSection={<filter.icon size={16} />}
+                onClick={() => revealFilter(filter.key)}
+              >
+                {filter.label}
+              </Menu.Item>
+            ))}
+          </Menu.Dropdown>
+        </Menu>
+      )}
    </div>
  );
 }
@@ -1,7 +1,7 @@
 import { Spotlight } from "@mantine/spotlight";
 import { IconSearch, IconSparkles } from "@tabler/icons-react";
-import { Group, Button, VisuallyHidden } from "@mantine/core";
-import React, { useState, useMemo, useEffect } from "react";
+import { Group, Button, VisuallyHidden, Text } from "@mantine/core";
+import React, { useState, useMemo, useEffect, useCallback } from "react";
 import { useDebouncedValue } from "@mantine/hooks";
 import { useTranslation } from "react-i18next";
 import { notifications } from "@mantine/notifications";
@@ -13,11 +13,16 @@ import { SearchResultItem } from "./search-result-item.tsx";
 import { AiSearchResult } from "../../../ee/ai/components/ai-search-result.tsx";
 import { useHasFeature } from "@/ee/hooks/use-feature";
 import { Feature } from "@/ee/features";
+import { useAtomValue } from "jotai";
+import { workspaceAtom } from "@/features/user/atoms/current-user-atom.ts";
+import { hintVectorCache } from "@/ee/ai/services/ai-search-service.ts";
+import { getAiVectorDriver } from "@/lib/config.ts";

 interface SearchSpotlightProps {
  spaceId?: string;
 }
 export function SearchSpotlight({ spaceId }: SearchSpotlightProps) {
+  const workspace = useAtomValue(workspaceAtom);
  const { t } = useTranslation();
  const hasAiFeature = useHasFeature(Feature.AI);
  const hasAttachmentIndexing = useHasFeature(Feature.ATTACHMENT_INDEXING);
@@ -26,6 +31,9 @@ export function SearchSpotlight({ spaceId }: SearchSpotlightProps) {
  const [filters, setFilters] = useState<{
    spaceId?: string | null;
    contentType?: string;
+    creatorId?: string | null;
+    labelIds?: string[];
+    titleOnly?: boolean;
  }>({
    contentType: "page",
  });
@@ -43,10 +51,25 @@ export function SearchSpotlight({ spaceId }: SearchSpotlightProps) {
      params.spaceId = filters.spaceId;
    }

+    if (filters.creatorId) {
+      params.creatorId = filters.creatorId;
+    }
+
+    if (filters.labelIds?.length) {
+      params.labelIds = filters.labelIds;
+    }
+
+    if (filters.titleOnly) {
+      params.titleOnly = true;
+    }
+
    return params;
  }, [debouncedSearchQuery, filters]);

-  const { data: searchResults, isLoading } = useUnifiedSearch(
+  const {
+    data: searchResults,
+    isFetching,
+  } = useUnifiedSearch(
    searchParams,
    !isAiMode // Disable regular search when in AI mode
  );
@@ -83,6 +106,11 @@ export function SearchSpotlight({ spaceId }: SearchSpotlightProps) {
    }
  }, [aiSearchError, t]);

+  const isFilterBrowse =
+    (filters.labelIds?.length ?? 0) > 0 || !!filters.creatorId;
+  // while the debounce is pending the empty list is not a settled "no results"
+  const isQuerySettled = query === debouncedSearchQuery;
+
  // Determine result type for rendering
  const isAttachmentSearch =
    filters.contentType === "attachment" && hasAttachmentIndexing;
@@ -96,10 +124,19 @@ export function SearchSpotlight({ spaceId }: SearchSpotlightProps) {
    />
  ));

-  const handleFiltersChange = (newFilters: any) => {
-    setFilters(newFilters);
+  const handleSpotlightOpen = () => {
+    if (
+      workspace?.settings?.ai?.search === true &&
+      getAiVectorDriver() === "turbopuffer"
+    ) {
+      hintVectorCache();
+    }
  };

+  const handleFiltersChange = useCallback((newFilters: any) => {
+    setFilters(newFilters);
+  }, [setFilters]);
+
  const handleAskClick = () => {
    setIsAiMode(!isAiMode);
  };
@@ -115,6 +152,7 @@ export function SearchSpotlight({ spaceId }: SearchSpotlightProps) {
      <Spotlight.Root
        size="xl"
        maxHeight={600}
+        onSpotlightOpen={handleSpotlightOpen}
        store={searchSpotlightStore}
        query={query}
        onQueryChange={setQuery}
@@ -167,7 +205,7 @@ export function SearchSpotlight({ spaceId }: SearchSpotlightProps) {
            ? query.length > 0 && !isAiLoading && !aiSearchResult
              ? t("No answer available")
              : ""
-            : query.length > 0 && !isLoading
+            : (query.length > 0 || isFilterBrowse) && !isFetching
              ? resultItems.length === 0
                ? t("No results found")
                : t("{{count}} results found", { count: resultItems.length })
@@ -194,15 +232,28 @@ export function SearchSpotlight({ spaceId }: SearchSpotlightProps) {
            </>
          ) : (
            <>
-              {query.length === 0 && resultItems.length === 0 && (
+              {query.length === 0 && !isFilterBrowse && resultItems.length === 0 && (
                <Spotlight.Empty>{t("Start typing to search...")}</Spotlight.Empty>
              )}

-              {query.length > 0 && !isLoading && resultItems.length === 0 && (
-                <Spotlight.Empty>{t("No results found...")}</Spotlight.Empty>
-              )}
+              {(query.length > 0 || isFilterBrowse) &&
+                !isFetching &&
+                isQuerySettled &&
+                resultItems.length === 0 && (
+                  <Spotlight.Empty>{t("No results found...")}</Spotlight.Empty>
+                )}

              {resultItems.length > 0 && <>{resultItems}</>}
+
+              {(query.length > 0 || isFilterBrowse) &&
+                isFetching &&
+                resultItems.length === 0 && (
+                <Spotlight.Empty>
+                  <Text size="sm" style={{ marginTop: 10 }}>
+                    {t("Searching...")}
+                  </Text>
+                </Spotlight.Empty>
+              )}
            </>
          )}
        </Spotlight.ActionsList>
@@ -39,6 +39,20 @@ export function useUnifiedSearch(
        return await searchPage(backendParams);
      }
    },
-    enabled: !!params.query && enabled,
+    enabled:
+      (!!params.query ||
+        (params.labelIds?.length ?? 0) > 0 ||
+        !!params.creatorId) &&
+      enabled,
+    // keep previous results only within the same search type; page results
+    // rendered as attachments (or vice versa) crash on missing fields
+    placeholderData: (previousData, previousQuery) => {
+      if (!params.query && !params.labelIds?.length && !params.creatorId)
+        return undefined;
+      if (previousQuery && previousQuery.queryKey[1] !== searchType) {
+        return undefined;
+      }
+      return previousData;
+    },
  });
 }
@@ -36,6 +36,9 @@ export interface IPageSearchParams {
  query: string;
  spaceId?: string;
  shareId?: string;
+  creatorId?: string;
+  labelIds?: string[];
+  titleOnly?: boolean;
 }

 export interface IAttachmentSearch {
@@ -54,7 +54,9 @@ import {
 import { mobileSidebarAtom } from "@/components/layouts/global/hooks/atoms/sidebar-atom.ts";
 import { useToggleSidebar } from "@/components/layouts/global/hooks/hooks/use-toggle-sidebar.ts";
 import { searchSpotlight } from "@/features/search/constants";
-import TemplatePickerModal from "@/ee/template/components/template-picker-modal";
+const TemplatePickerModal = React.lazy(
+  () => import("@/ee/template/components/template-picker-modal"),
+);
 import { useHasFeature } from "@/ee/hooks/use-feature";
 import { useUpgradeLabel } from "@/ee/hooks/use-upgrade-label";
 import { Feature } from "@/ee/features";
@@ -406,11 +408,13 @@ function SpaceMenu({

      {hasTemplates && templatePickerOpened && (
        <ErrorBoundary fallbackRender={() => null}>
-          <TemplatePickerModal
-            opened={templatePickerOpened}
-            onClose={closeTemplatePicker}
-            initialSpaceId={spaceId}
-          />
+          <React.Suspense fallback={null}>
+            <TemplatePickerModal
+              opened={templatePickerOpened}
+              onClose={closeTemplatePicker}
+              initialSpaceId={spaceId}
+            />
+          </React.Suspense>
        </ErrorBoundary>
      )}
    </>
@@ -25,13 +25,14 @@ export interface IWorkspace {
  generativeAi?: boolean;
  disablePublicSharing?: boolean;
  mcpEnabled?: boolean;
+  aiChatReadOnly?: boolean;
+  aiChatWorkspaceKnowledgeOnly?: boolean;
  trashRetentionDays?: number;
  restrictApiToAdmins?: boolean;
  allowMemberTemplates?: boolean;
  allowPersonalSpaces?: boolean;
  defaultPageEditMode?: string;
  isScimEnabled?: boolean;
-  trustedOauthClients?: ITrustedOAuthClient[];
 }

 export interface IWorkspaceSettings {
@@ -43,11 +44,6 @@ export interface IWorkspaceSettings {
  defaultPageEditMode?: string;
 }

-export interface ITrustedOAuthClient {
-  origin: string;
-  name: string;
-}
-
 export interface IWorkspaceApiSettings {
  restrictToAdmins?: boolean;
 }
@@ -57,6 +53,8 @@ export interface IWorkspaceAiSettings {
  generative?: boolean;
  mcp?: boolean;
  chat?: boolean;
+  chatReadOnly?: boolean;
+  chatWorkspaceKnowledgeOnly?: boolean;
 }

 export interface IWorkspaceSharingSettings {
@@ -76,8 +76,6 @@ function redirectToLogin() {
    APP_ROUTE.AUTH.MFA_CHALLENGE,
    APP_ROUTE.AUTH.MFA_SETUP_REQUIRED,
    "/invites",
-    // the oauth consent page redirects to login itself, preserving its query string
-    "/oauth/consent",
  ];
  if (!exemptPaths.some((path) => window.location.pathname.startsWith(path))) {
    const redirectTo = window.location.pathname;
@@ -43,6 +43,10 @@ export function isCloud(): boolean {
  return castToBoolean(getConfigValue("CLOUD"));
 }

+export function getAiVectorDriver(): string {
+  return getConfigValue("AI_VECTOR_DRIVER");
+}
+
 export function getAvatarUrl(
  avatarUrl: string,
  type: AvatarIconType = AvatarIconType.AVATAR,
@@ -33,3 +33,31 @@
  color: var(--mantine-color-dimmed);
  -webkit-text-fill-color: var(--mantine-color-dimmed);
 }
+
+/* Spotlight's selected action ships as primary-filled blue with white text,
+ * but our custom action children (gray badge, dimmed snippet, gray icons)
+ * keep their light-surface colors on it and drop below WCAG AA 4.5:1
+ * (WCAG 1.4.3). Use a gray selection one step above the gray-0/dark-6
+ * hover instead - it matches the app's selection styling (we use no blue
+ * fills) and keeps every child at its already-passing resting contrast.
+ */
+.mantine-Spotlight-action[data-selected] {
+  background-color: light-dark(
+    var(--mantine-color-gray-1),
+    var(--mantine-color-dark-5)
+  );
+  color: var(--mantine-color-text);
+  --action-description-color: var(--mantine-color-dimmed);
+  --action-description-opacity: 1;
+}
+
+/* Result actions are tab stops (tabIndex restored via ref); give keyboard
+ * focus the same gray treatment as arrow-key selection so both navigation
+ * modes read identically (WCAG 2.4.7 focus visible).
+ */
+.mantine-Spotlight-action:focus-visible {
+  background-color: light-dark(
+    var(--mantine-color-gray-1),
+    var(--mantine-color-dark-5)
+  );
+}
@@ -16,6 +16,7 @@ export default defineConfig(({ mode }) => {
    BILLING_TRIAL_DAYS,
    POSTHOG_HOST,
    POSTHOG_KEY,
+    AI_VECTOR_DRIVER,
  } = loadEnv(mode, envPath, "");

  return {
@@ -31,6 +32,7 @@ export default defineConfig(({ mode }) => {
        BILLING_TRIAL_DAYS,
        POSTHOG_HOST,
        POSTHOG_KEY,
+        AI_VECTOR_DRIVER,
      },
      APP_VERSION: JSON.stringify(process.env.npm_package_version),
    },
@@ -40,33 +40,33 @@
    "@clickhouse/client": "1.18.2",
    "@docmost/base-formula": "workspace:*",
    "@docmost/pdf-inspector": "1.9.6",
-    "@fastify/cookie": "11.0.2",
-    "@fastify/multipart": "10.0.0",
-    "@fastify/static": "10.1.2",
-    "@jmondi/oauth2-server": "^4.3.7",
+    "@fastify/cookie": "11.1.2",
+    "@fastify/multipart": "10.1.1",
+    "@fastify/static": "10.1.3",
    "@keyv/redis": "5.1.6",
    "@langchain/core": "1.1.46",
    "@langchain/textsplitters": "1.0.1",
    "@modelcontextprotocol/sdk": "1.30.0",
    "@nest-lab/throttler-storage-redis": "1.2.0",
    "@nestjs-labs/nestjs-ioredis": "11.0.4",
-    "@nestjs/bullmq": "11.0.4",
+    "@nestjs/bullmq": "11.0.5",
    "@nestjs/cache-manager": "3.1.3",
-    "@nestjs/common": "11.1.28",
+    "@nestjs/common": "11.2.1",
    "@nestjs/config": "4.0.4",
-    "@nestjs/core": "11.1.27",
+    "@nestjs/core": "11.2.1",
    "@nestjs/event-emitter": "3.1.0",
    "@nestjs/jwt": "11.0.2",
    "@nestjs/mapped-types": "2.1.1",
    "@nestjs/passport": "11.0.5",
-    "@nestjs/platform-fastify": "11.1.28",
-    "@nestjs/platform-socket.io": "11.1.28",
+    "@nestjs/platform-fastify": "11.2.1",
+    "@nestjs/platform-socket.io": "11.2.1",
    "@nestjs/schedule": "6.1.3",
    "@nestjs/terminus": "11.1.1",
    "@nestjs/throttler": "6.5.0",
-    "@nestjs/websockets": "11.1.28",
+    "@nestjs/websockets": "11.2.1",
    "@node-saml/passport-saml": "5.1.0",
    "@socket.io/redis-adapter": "8.3.0",
+    "@turbopuffer/turbopuffer": "^2.8.0",
    "ai": "6.0.134",
    "ai-sdk-ollama": "3.8.1",
    "bcrypt": "6.0.0",
@@ -120,7 +120,7 @@
    "tmp-promise": "3.0.3",
    "typesense": "3.0.5",
    "undici": "7.29.0",
-    "ws": "8.21.0",
+    "ws": "8.21.3",
    "yauzl": "3.4.0",
    "zod": "4.3.6"
  },
@@ -22,7 +22,8 @@ import { TelemetryModule } from './integrations/telemetry/telemetry.module';
 import { RedisModule } from '@nestjs-labs/nestjs-ioredis';
 import { RedisConfigService } from './integrations/redis/redis-config.service';
 import { CacheModule } from '@nestjs/cache-manager';
-import KeyvRedis from '@keyv/redis';
+import KeyvRedis, { defaultReconnectStrategy } from '@keyv/redis';
+import { parseRedisUrl } from './common/helpers';
 import { LoggerModule } from './common/logger/logger.module';
 import { ClsModule } from 'nestjs-cls';
 import { NoopAuditModule } from './integrations/audit/audit.module';
@@ -62,10 +63,20 @@ try {
      isGlobal: true,
      useFactory: async (environmentService: EnvironmentService) => {
        const redisUrl = environmentService.getRedisUrl();
+        const { family, tls } = parseRedisUrl(redisUrl);

        return {
          ttl: 5 * 1000,
-          stores: [new KeyvRedis(redisUrl)],
+          stores: [
+            new KeyvRedis({
+              url: redisUrl,
+              socket: {
+                family,
+                reconnectStrategy: defaultReconnectStrategy,
+                ...tls,
+              },
+            }),
+          ],
        };
      },
      inject: [EnvironmentService],
@@ -66,6 +66,7 @@ export class CollaborationGateway {
          password: this.redisConfig.password,
          db: this.redisConfig.db,
          family: this.redisConfig.family,
+          tls: this.redisConfig.tls,
          retryStrategy: createRetryStrategy(),
        }),
        serverId: `collab-${os?.hostname()}-${nanoid(10)}`,
@@ -57,6 +57,7 @@ import {
  JSONContent,
 } from '@tiptap/core';
 import { generateHTML, generateJSON } from '../common/helpers/prosemirror/html';
+import { collapseBlankLines } from '../common/helpers';
 // @tiptap/html library works best for generating prosemirror json state but not HTML
 // see: https://github.com/ueberdosis/tiptap/issues/5352
 // see:https://github.com/ueberdosis/tiptap/issues/4089
@@ -146,7 +147,7 @@ export function htmlToJson(html: string) {
 }

 export function jsonToText(tiptapJson: JSONContent) {
-  return generateText(tiptapJson, tiptapExtensions);
+  return collapseBlankLines(generateText(tiptapJson, tiptapExtensions));
 }

 export function jsonToNode(tiptapJson: JSONContent) {
@@ -1,8 +0,0 @@
-import { SetMetadata } from '@nestjs/common';
-
-export const OAUTH_SCOPE_KEY = 'oauthScope';
-
-export type OAuthRouteScope = 'read' | 'write';
-
-export const OAuthScope = (scope: OAuthRouteScope) =>
-  SetMetadata(OAUTH_SCOPE_KEY, scope);
@@ -1,6 +0,0 @@
-import { SetMetadata } from '@nestjs/common';
-
-export const REQUIRE_SESSION_AUTH_KEY = 'requireSessionAuth';
-
-export const RequireSessionAuth = () =>
-  SetMetadata(REQUIRE_SESSION_AUTH_KEY, true);
@@ -23,11 +23,6 @@ export const AuditEvent = {
  API_KEY_UPDATED: 'api_key.updated',
  API_KEY_DELETED: 'api_key.deleted',

-  // OAuth
-  OAUTH_CLIENT_REGISTERED: 'oauth_client.registered',
-  OAUTH_GRANT_CREATED: 'oauth_grant.created',
-  OAUTH_GRANT_REVOKED: 'oauth_grant.revoked',
-
  // SCIM Tokens
  SCIM_TOKEN_CREATED: 'scim_token.created',
  SCIM_TOKEN_UPDATED: 'scim_token.updated',
@@ -129,8 +124,6 @@ export const AuditResource = {
  COMMENT: 'comment',
  SHARE: 'share',
  API_KEY: 'api_key',
-  OAUTH_CLIENT: 'oauth_client',
-  OAUTH_GRANT: 'oauth_grant',
  SCIM_TOKEN: 'scim_token',
  SSO_PROVIDER: 'sso_provider',
  WORKSPACE_INVITATION: 'workspace_invitation',
@@ -12,8 +12,6 @@ export enum EventName {
  SPACE_UPDATED = 'space.updated',
  SPACE_DELETED = 'space.deleted',

-  USER_PASSWORD_RESET = 'user.password.reset',
-
  WORKSPACE_CREATED = 'workspace.created',
  WORKSPACE_UPDATED = 'workspace.updated',
  WORKSPACE_DELETED = 'workspace.deleted',
@@ -23,7 +23,7 @@ export const Feature = {
  PERSONAL_SPACES: 'spaces:personal',
  DOCX_EXPORT: 'export:docx',
  BASES: 'bases',
-  OAUTH: 'oauth',
+  AI_CONTROLS: 'ai:controls',
 } as const;

 export type FeatureKey = (typeof Feature)[keyof typeof Feature];
@@ -1,186 +0,0 @@
-import {
-  ExecutionContext,
-  ForbiddenException,
-  UnauthorizedException,
-} from '@nestjs/common';
-import { JwtAuthGuard } from './jwt-auth.guard';
-import { OAUTH_SCOPE_KEY } from '../decorators/oauth-scope.decorator';
-import { REQUIRE_SESSION_AUTH_KEY } from '../decorators/require-session-auth.decorator';
-import { JwtType } from '../../core/auth/dto/jwt-payload';
-
-const handlerSentinel = () => 'handler';
-const classSentinel = class Controller {};
-
-function createCtx(): ExecutionContext {
-  return {
-    getHandler: () => handlerSentinel,
-    getClass: () => classSentinel,
-  } as any;
-}
-
-function createGuard(scopeMetadata?: unknown, requireSession?: boolean) {
-  const reflector = {
-    getAllAndOverride: jest.fn((key: string) =>
-      key === REQUIRE_SESSION_AUTH_KEY ? requireSession : scopeMetadata,
-    ),
-  } as any;
-  const environmentService = {
-    isCloud: jest.fn().mockReturnValue(false),
-  } as any;
-  const guard = new JwtAuthGuard(reflector, environmentService);
-  return { guard, reflector };
-}
-
-function oauthUser(scopes: string[]) {
-  return {
-    user: { id: 'user_1' },
-    workspace: { id: 'ws_1' },
-    oauth: { grantId: 'grant_1', scopes },
-  };
-}
-
-describe('JwtAuthGuard.handleRequest', () => {
-  it('rethrows the strategy error', () => {
-    const { guard } = createGuard();
-    const err = new UnauthorizedException('bad token');
-
-    expect(() => guard.handleRequest(err, null, null, createCtx())).toThrow(err);
-  });
-
-  it('throws UnauthorizedException when there is no user', () => {
-    const { guard } = createGuard();
-
-    expect(() => guard.handleRequest(null, null, null, createCtx())).toThrow(
-      UnauthorizedException,
-    );
-  });
-
-  it('returns a non-oauth user untouched without consulting scope metadata', () => {
-    const { guard, reflector } = createGuard();
-    const user = { user: { id: 'user_1' }, workspace: { id: 'ws_1' } };
-
-    expect(guard.handleRequest(null, user, null, createCtx())).toBe(user);
-    expect(reflector.getAllAndOverride).not.toHaveBeenCalledWith(
-      OAUTH_SCOPE_KEY,
-      expect.anything(),
-    );
-  });
-
-  it('forbids an oauth user on a route without scope metadata', () => {
-    const { guard, reflector } = createGuard(undefined);
-
-    expect(() =>
-      guard.handleRequest(null, oauthUser(['read', 'write']), null, createCtx()),
-    ).toThrow(ForbiddenException);
-    expect(reflector.getAllAndOverride).toHaveBeenCalledWith(OAUTH_SCOPE_KEY, [
-      handlerSentinel,
-      classSentinel,
-    ]);
-  });
-
-  it('passes read scope on a read route', () => {
-    const { guard } = createGuard('read');
-    const user = oauthUser(['read']);
-
-    expect(guard.handleRequest(null, user, null, createCtx())).toBe(user);
-  });
-
-  it('forbids read scope on a write route with insufficient_scope', () => {
-    const { guard } = createGuard('write');
-
-    expect(() =>
-      guard.handleRequest(null, oauthUser(['read']), null, createCtx()),
-    ).toThrow('insufficient_scope');
-  });
-
-  it('passes write scope on a read route', () => {
-    const { guard } = createGuard('read');
-    const user = oauthUser(['write']);
-
-    expect(guard.handleRequest(null, user, null, createCtx())).toBe(user);
-  });
-
-  it('passes write scope on a write route', () => {
-    const { guard } = createGuard('write');
-    const user = oauthUser(['write']);
-
-    expect(guard.handleRequest(null, user, null, createCtx())).toBe(user);
-  });
-
-  describe('session-only routes', () => {
-    const sessionUser = {
-      user: { id: 'user_1' },
-      workspace: { id: 'ws_1' },
-      authType: JwtType.ACCESS,
-    };
-
-    it('allows a signed-in session', () => {
-      const { guard } = createGuard(undefined, true);
-
-      expect(guard.handleRequest(null, sessionUser, null, createCtx())).toBe(
-        sessionUser,
-      );
-    });
-
-    it('forbids an api key', () => {
-      const { guard } = createGuard(undefined, true);
-      const apiKeyUser = {
-        user: { id: 'user_1' },
-        workspace: { id: 'ws_1' },
-        authType: JwtType.API_KEY,
-      };
-
-      expect(() =>
-        guard.handleRequest(null, apiKeyUser, null, createCtx()),
-      ).toThrow('This action requires an interactive user session');
-    });
-
-    it('forbids an oauth token even when it carries write scope', () => {
-      const { guard } = createGuard('write', true);
-      const user = { ...oauthUser(['write']), authType: JwtType.OAUTH_ACCESS };
-
-      expect(() => guard.handleRequest(null, user, null, createCtx())).toThrow(
-        'This action requires an interactive user session',
-      );
-    });
-
-    it('leaves api keys working on routes without the marker', () => {
-      const { guard } = createGuard(undefined, undefined);
-      const apiKeyUser = {
-        user: { id: 'user_1' },
-        workspace: { id: 'ws_1' },
-        authType: JwtType.API_KEY,
-      };
-
-      expect(guard.handleRequest(null, apiKeyUser, null, createCtx())).toBe(
-        apiKeyUser,
-      );
-    });
-  });
-
-  it('lets handler metadata override class metadata', () => {
-    const metadataByTarget = new Map<unknown, string>([
-      [handlerSentinel, 'write'],
-      [classSentinel, 'read'],
-    ]);
-    const reflector = {
-      getAllAndOverride: jest.fn((key: string, targets: unknown[]) => {
-        if (key === REQUIRE_SESSION_AUTH_KEY) {
-          return undefined;
-        }
-        for (const target of targets) {
-          if (metadataByTarget.has(target)) {
-            return metadataByTarget.get(target);
-          }
-        }
-        return undefined;
-      }),
-    } as any;
-    const environmentService = { isCloud: jest.fn().mockReturnValue(false) } as any;
-    const guard = new JwtAuthGuard(reflector, environmentService);
-
-    expect(() =>
-      guard.handleRequest(null, oauthUser(['read']), null, createCtx()),
-    ).toThrow('insufficient_scope');
-  });
-});
@@ -1,26 +1,16 @@
 import {
  ExecutionContext,
-  ForbiddenException,
  Injectable,
-  Logger,
  UnauthorizedException,
 } from '@nestjs/common';
 import { AuthGuard } from '@nestjs/passport';
 import { IS_PUBLIC_KEY } from '../decorators/public.decorator';
-import {
-  OAUTH_SCOPE_KEY,
-  OAuthRouteScope,
-} from '../decorators/oauth-scope.decorator';
-import { REQUIRE_SESSION_AUTH_KEY } from '../decorators/require-session-auth.decorator';
-import { JwtType } from '../../core/auth/dto/jwt-payload';
 import { Reflector } from '@nestjs/core';
 import { EnvironmentService } from '../../integrations/environment/environment.service';
 import { addDays } from 'date-fns';

@Injectable()
 export class JwtAuthGuard extends AuthGuard('jwt') {
-  private logger = new Logger('JwtAuthGuard');
-
  constructor(
    private reflector: Reflector,
    private environmentService: EnvironmentService,
@@ -46,39 +36,6 @@ export class JwtAuthGuard extends AuthGuard('jwt') {
      throw err || new UnauthorizedException();
    }

-    const requiresSession = this.reflector.getAllAndOverride<boolean>(
-      REQUIRE_SESSION_AUTH_KEY,
-      [ctx.getHandler(), ctx.getClass()],
-    );
-    if (requiresSession && user.authType !== JwtType.ACCESS) {
-      this.logger.warn(
-        `session-only endpoint ${ctx.getClass()?.name}.${ctx.getHandler()?.name} refused authType ${user.authType}`,
-      );
-      throw new ForbiddenException(
-        'This action requires an interactive user session',
-      );
-    }
-
-    if (user.oauth) {
-      const required = this.reflector.getAllAndOverride<
-        OAuthRouteScope | undefined
-      >(OAUTH_SCOPE_KEY, [ctx.getHandler(), ctx.getClass()]);
-      if (!required) {
-        this.logger.warn(
-          `oauth scope check: no @OAuthScope metadata on ${ctx.getClass()?.name}.${ctx.getHandler()?.name}`,
-        );
-        throw new ForbiddenException('OAuth tokens cannot access this endpoint');
-      }
-      const scopes: string[] = user.oauth.scopes ?? [];
-      const satisfied =
-        required === 'read'
-          ? scopes.includes('read') || scopes.includes('write')
-          : scopes.includes('write');
-      if (!satisfied) {
-        throw new ForbiddenException('insufficient_scope');
-      }
-    }
-
    this.setJoinedWorkspacesCookie(user, ctx);
    return user;
  }
@@ -1,4 +1,5 @@
 export * from './utils';
+export * from './text.utils';
 export * from './nanoid.utils';
 export * from './file.helper';
 export * from './constants';
@@ -1,66 +0,0 @@
-import {
-  resolveFrameHeader,
-  resolveFrameHeadersForPath,
-  SecurityHeader,
-} from './security-headers';
-
-describe('resolveFrameHeader', () => {
-  it('denies framing with X-Frame-Options when embedding is off', () => {
-    expect(resolveFrameHeader(false, [])).toEqual({
-      name: 'X-Frame-Options',
-      value: 'SAMEORIGIN',
-    });
-  });
-
-  it('returns null when embedding is on but no origins are configured', () => {
-    expect(resolveFrameHeader(true, [])).toBeNull();
-  });
-
-  it('emits a frame-ancestors CSP for the allowed origins', () => {
-    expect(resolveFrameHeader(true, ['https://a.example', 'https://b.example']))
-      .toEqual({
-        name: 'Content-Security-Policy',
-        value: "frame-ancestors 'self' https://a.example https://b.example",
-      });
-  });
-});
-
-describe('resolveFrameHeadersForPath', () => {
-  const configured: SecurityHeader = {
-    name: 'Content-Security-Policy',
-    value: "frame-ancestors 'self' https://a.example",
-  };
-
-  it.each(['/oauth/consent', '/oauth/consent/nested'])(
-    'force-denies %s regardless of configured header',
-    (path) => {
-      expect(resolveFrameHeadersForPath(path, configured)).toEqual([
-        { name: 'X-Frame-Options', value: 'DENY' },
-        { name: 'Content-Security-Policy', value: "frame-ancestors 'none'" },
-      ]);
-    },
-  );
-
-  it('force-denies consent even when the global header is absent', () => {
-    expect(resolveFrameHeadersForPath('/oauth/consent', null)).toEqual([
-      { name: 'X-Frame-Options', value: 'DENY' },
-      { name: 'Content-Security-Policy', value: "frame-ancestors 'none'" },
-    ]);
-  });
-
-  it('does not match an unrelated path that merely contains the prefix', () => {
-    expect(
-      resolveFrameHeadersForPath('/oauth/consenting-adults', configured),
-    ).toEqual([configured]);
-  });
-
-  it('passes the configured header through for other paths', () => {
-    expect(resolveFrameHeadersForPath('/home', configured)).toEqual([
-      configured,
-    ]);
-  });
-
-  it('returns nothing for other paths when no header is configured', () => {
-    expect(resolveFrameHeadersForPath('/home', null)).toEqual([]);
-  });
-});
@@ -17,19 +17,3 @@ export function resolveFrameHeader(
    value: `frame-ancestors 'self' ${allowedOrigins.join(' ')}`,
  };
 }
-
-// Deny OAuth consent in iframe
-export const OAUTH_CONSENT_PATH = '/oauth/consent';
-
-export function resolveFrameHeadersForPath(
-  path: string,
-  configuredHeader: SecurityHeader | null,
-): SecurityHeader[] {
-  if (path === OAUTH_CONSENT_PATH || path.startsWith(`${OAUTH_CONSENT_PATH}/`)) {
-    return [
-      { name: 'X-Frame-Options', value: 'DENY' },
-      { name: 'Content-Security-Policy', value: "frame-ancestors 'none'" },
-    ];
-  }
-  return configuredHeader ? [configuredHeader] : [];
-}
@@ -0,0 +1,14 @@
+import { collapseBlankLines } from './text.utils';
+
+describe('collapseBlankLines', () => {
+  it.each([
+    ['a\n\n\n\nb', 'a\n\nb'],
+    ['a\n\nb', 'a\n\nb'],
+    ['a\nb', 'a\nb'],
+    ['\n\n\n\na\n\n\n', '\n\na\n\n'],
+    ['no newlines', 'no newlines'],
+    ['', ''],
+  ])('collapses %j to %j', (input, expected) => {
+    expect(collapseBlankLines(input)).toBe(expected);
+  });
+});
@@ -0,0 +1,3 @@
+export function collapseBlankLines(text: string): string {
+  return text.replace(/\n{2,}/g, '\n\n');
+}
@@ -30,13 +30,14 @@ export type RedisConfig = {
  db: number;
  password?: string;
  family?: number;
+  tls?: { rejectUnauthorized?: boolean };
 };

 export function parseRedisUrl(redisUrl: string): RedisConfig {
-  // format - redis[s]://[[username][:password]@][host][:port][/db-number][?family=4|6]
+  // format - redis[s]://[[username][:password]@][host][:port][/db-number][?family=4|6][&rejectUnauthorized=false]
  const url = new URL(redisUrl);
-  const { hostname, port, password, pathname, searchParams } = url;
-  const portInt = parseInt(port, 10);
+  const { hostname, port, password, pathname, protocol, searchParams } = url;
+  const portInt = port ? parseInt(port, 10) : 6379;

  let db: number = 0;
  // extract db value if present
@@ -54,7 +55,14 @@ export function parseRedisUrl(redisUrl: string): RedisConfig {
    family = parseInt(familyParam, 10);
  }

-  return { host: hostname, port: portInt, password, db, family };
+  const tls =
+    protocol === 'rediss:'
+      ? searchParams.get('rejectUnauthorized') === 'false'
+        ? { rejectUnauthorized: false }
+        : {}
+      : undefined;
+
+  return { host: hostname, port: portInt, password: password || undefined, db, family, tls };
 }

 export function createRetryStrategy() {
@@ -24,7 +24,6 @@ import * as bytes from 'bytes';
 import { AuthUser } from '../../common/decorators/auth-user.decorator';
 import { AuthWorkspace } from '../../common/decorators/auth-workspace.decorator';
 import { JwtAuthGuard } from '../../common/guards/jwt-auth.guard';
-import { OAuthScope } from '../../common/decorators/oauth-scope.decorator';
 import { Attachment, User, Workspace } from '@docmost/db/types/entity.types';
 import { StorageService } from '../../integrations/storage/storage.service';
 import {
@@ -176,7 +175,6 @@ export class AttachmentController {

  @UseGuards(JwtAuthGuard)
  @Get('/files/:fileId/:fileName')
-  @OAuthScope('read')
  async getFile(
    @Req() req: FastifyRequest,
    @Res() res: FastifyReply,
@@ -429,7 +427,6 @@ export class AttachmentController {
  @UseGuards(JwtAuthGuard)
  @HttpCode(HttpStatus.OK)
  @Post('pages/attachments')
-  @OAuthScope('read')
  async getPageAttachments(
    @Body() dto: PageIdDto,
    @Body() pagination: PaginationOptions,
@@ -116,8 +116,8 @@ export class AttachmentService {
        });
      }

-      // Only index PDFs and DOCX files
-      if (['.pdf', '.docx'].includes(attachment.fileExt.toLowerCase())) {
+      // Only index PDF, DOCX and TXT files
+      if (['.pdf', '.docx', '.txt'].includes(attachment.fileExt.toLowerCase())) {
        await this.attachmentQueue.add(
          QueueJob.ATTACHMENT_INDEX_CONTENT,
          {
@@ -12,7 +12,7 @@ import {
 } from '@nestjs/common';
 import { SkipThrottle, ThrottlerGuard } from '@nestjs/throttler';
 import {
-  ALL_NAMED_THROTTLERS_SKIPPED,
+  AI_CHAT_THROTTLER,
  AUTH_THROTTLER,
 } from '../../integrations/throttle/throttler-names';
 import { LoginDto } from './dto/login.dto';
@@ -38,7 +38,7 @@ import {
  IAuditService,
 } from '../../integrations/audit/audit.service';

-@SkipThrottle({ ...ALL_NAMED_THROTTLERS_SKIPPED, [AUTH_THROTTLER]: false })
+@SkipThrottle({ [AI_CHAT_THROTTLER]: true })
@UseGuards(ThrottlerGuard)
@Controller('auth')
 export class AuthController {
@@ -7,7 +7,6 @@ export enum JwtType {
  API_KEY = 'api_key',
  PDF_RENDER = 'pdf_render',
  PDF_EXPORT_DOWNLOAD = 'pdf_export_download',
-  OAUTH_ACCESS = 'oauth_access',
 }
 export type JwtPayload = {
  sub: string;
@@ -60,14 +59,3 @@ export type JwtPdfExportDownloadPayload = {
  workspaceId: string;
  type: 'pdf_export_download';
 };
-
-export type JwtOAuthPayload = {
-  sub: string;
-  workspaceId: string;
-  grantId: string;
-  scope: string;
-  aud: string;
-  iss: string;
-  jti: string;
-  type: JwtType.OAUTH_ACCESS;
-};
@@ -2,7 +2,6 @@ import {
  BadRequestException,
  Inject,
  Injectable,
-  Logger,
  NotFoundException,
  UnauthorizedException,
 } from '@nestjs/common';
@@ -41,13 +40,9 @@ import {
  IAuditService,
 } from '../../../integrations/audit/audit.service';
 import { EnvironmentService } from '../../../integrations/environment/environment.service';
-import { EventEmitter2 } from '@nestjs/event-emitter';
-import { EventName } from '../../../common/events/event.contants';

@Injectable()
 export class AuthService {
-  private readonly logger = new Logger(AuthService.name);
-
  constructor(
    private signupService: SignupService,
    private tokenService: TokenService,
@@ -58,7 +53,6 @@ export class AuthService {
    private mailService: MailService,
    private domainService: DomainService,
    private environmentService: EnvironmentService,
-    private eventEmitter: EventEmitter2,
    @InjectKysely() private readonly db: KyselyDB,
    @Inject(AUDIT_SERVICE) private readonly auditService: IAuditService,
  ) {}
@@ -267,19 +261,6 @@ export class AuthService {

    await this.userSessionRepo.deleteByUserId(user.id, workspace.id);

-    // A failed revocation must not block the reset itself; log loudly instead.
-    try {
-      await this.eventEmitter.emitAsync(EventName.USER_PASSWORD_RESET, {
-        userId: user.id,
-        workspaceId: workspace.id,
-      });
-    } catch (err) {
-      this.logger.error(
-        `failed to revoke oauth grants for user ${user.id} after password reset`,
-        err,
-      );
-    }
-
    this.auditService.setActorId(user.id);
    this.auditService.log({
      event: AuditEvent.USER_PASSWORD_RESET,
@@ -2,12 +2,7 @@ import { Injectable, Logger, UnauthorizedException } from '@nestjs/common';
 import { PassportStrategy } from '@nestjs/passport';
 import { Strategy } from 'passport-jwt';
 import { EnvironmentService } from '../../../integrations/environment/environment.service';
-import {
-  JwtApiKeyPayload,
-  JwtOAuthPayload,
-  JwtPayload,
-  JwtType,
-} from '../dto/jwt-payload';
+import { JwtApiKeyPayload, JwtPayload, JwtType } from '../dto/jwt-payload';
 import { WorkspaceRepo } from '@docmost/db/repos/workspace/workspace.repo';
 import { UserRepo } from '@docmost/db/repos/user/user.repo';
 import { UserSessionRepo } from '@docmost/db/repos/session/user-session.repo';
@@ -38,10 +33,7 @@ export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
    });
  }

-  async validate(
-    req: any,
-    payload: JwtPayload | JwtApiKeyPayload | JwtOAuthPayload,
-  ) {
+  async validate(req: any, payload: JwtPayload | JwtApiKeyPayload) {
    if (!payload.workspaceId) {
      throw new UnauthorizedException();
    }
@@ -50,21 +42,8 @@ export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
      throw new UnauthorizedException('Workspace does not match');
    }

-    // authType lets guards tell an interactive session from a programmatic credential.
    if (payload.type === JwtType.API_KEY) {
-      const authResult = await this.validateApiKey(
-        req,
-        payload as JwtApiKeyPayload,
-      );
-      return { ...authResult, authType: JwtType.API_KEY };
-    }
-
-    if (payload.type === JwtType.OAUTH_ACCESS) {
-      const authResult = await this.validateOAuthToken(
-        req,
-        payload as JwtOAuthPayload,
-      );
-      return { ...authResult, authType: JwtType.OAUTH_ACCESS };
+      return this.validateApiKey(req, payload as JwtApiKeyPayload);
    }

    if (payload.type !== JwtType.ACCESS) {
@@ -120,36 +99,4 @@ export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {

    throw new UnauthorizedException('Enterprise API Key module missing');
  }
-
-  private async validateOAuthToken(req: any, payload: JwtOAuthPayload) {
-    let OAuthStrategyModule: any;
-    let isOAuthModuleReady = false;
-
-    try {
-      // eslint-disable-next-line @typescript-eslint/no-require-imports
-      OAuthStrategyModule = require('./../../../ee/oauth/services/oauth-strategy.service');
-      isOAuthModuleReady = true;
-    } catch (err) {
-      this.logger.debug(
-        'OAuth module requested but enterprise module not bundled in this build',
-      );
-      isOAuthModuleReady = false;
-    }
-
-    if (isOAuthModuleReady) {
-      const OAuthStrategyService = this.moduleRef.get(
-        OAuthStrategyModule.OAuthStrategyService,
-        {
-          strict: false,
-        },
-      );
-
-      return OAuthStrategyService.validateOAuthToken(payload, {
-        workspaceId: req.raw.workspaceId,
-        host: req.raw.headers?.host ?? req.headers?.host,
-      });
-    }
-
-    throw new UnauthorizedException('Enterprise OAuth module missing');
-  }
 }
@@ -16,7 +16,6 @@ import { PageIdDto, CommentIdDto } from './dto/comments.input';
 import { AuthUser } from '../../common/decorators/auth-user.decorator';
 import { AuthWorkspace } from '../../common/decorators/auth-workspace.decorator';
 import { JwtAuthGuard } from '../../common/guards/jwt-auth.guard';
-import { OAuthScope } from '../../common/decorators/oauth-scope.decorator';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
 import { User, Workspace } from '@docmost/db/types/entity.types';
 import SpaceAbilityFactory from '../casl/abilities/space-ability.factory';
@@ -49,14 +48,13 @@ export class CommentController {

  @HttpCode(HttpStatus.OK)
  @Post('create')
-  @OAuthScope('write')
  async create(
    @Body() createCommentDto: CreateCommentDto,
    @AuthUser() user: User,
    @AuthWorkspace() workspace: Workspace,
  ) {
    const page = await this.pageRepo.findById(createCommentDto.pageId);
-    if (!page || page.deletedAt) {
+    if (!page || page.workspaceId !== workspace.id || page.deletedAt) {
      throw new NotFoundException('Page not found');
    }

@@ -86,15 +84,15 @@ export class CommentController {

  @HttpCode(HttpStatus.OK)
  @Post('/')
-  @OAuthScope('read')
  async findPageComments(
    @Body() input: PageIdDto,
    @Body()
    pagination: PaginationOptions,
    @AuthUser() user: User,
+    @AuthWorkspace() workspace: Workspace,
  ) {
    const page = await this.pageRepo.findById(input.pageId);
-    if (!page) {
+    if (!page || page.workspaceId !== workspace.id || page.deletedAt) {
      throw new NotFoundException('Page not found');
    }

@@ -105,14 +103,18 @@ export class CommentController {

  @HttpCode(HttpStatus.OK)
  @Post('info')
-  async findOne(@Body() input: CommentIdDto, @AuthUser() user: User) {
+  async findOne(
+    @Body() input: CommentIdDto,
+    @AuthUser() user: User,
+    @AuthWorkspace() workspace: Workspace,
+  ) {
    const comment = await this.commentRepo.findById(input.commentId);
    if (!comment) {
      throw new NotFoundException('Comment not found');
    }

    const page = await this.pageRepo.findById(comment.pageId);
-    if (!page) {
+    if (!page || page.workspaceId !== workspace.id || page.deletedAt) {
      throw new NotFoundException('Page not found');
    }

@@ -123,7 +125,6 @@ export class CommentController {

  @HttpCode(HttpStatus.OK)
  @Post('update')
-  @OAuthScope('write')
  async update(@Body() dto: UpdateCommentDto, @AuthUser() user: User, @AuthWorkspace() workspace: Workspace) {
    const comment = await this.commentRepo.findById(dto.commentId, {
      includeCreator: true,
@@ -134,7 +135,7 @@ export class CommentController {
    }

    const page = await this.pageRepo.findById(comment.pageId);
-    if (!page) {
+    if (!page || page.workspaceId !== workspace.id || page.deletedAt) {
      throw new NotFoundException('Page not found');
    }

@@ -152,7 +153,7 @@ export class CommentController {
    }

    const page = await this.pageRepo.findById(comment.pageId);
-    if (!page) {
+    if (!page || page.workspaceId !== workspace.id || page.deletedAt) {
      throw new NotFoundException('Page not found');
    }

@@ -7,12 +7,15 @@ import { executeTx } from '@docmost/db/utils';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
 import { PagePermissionRepo } from '@docmost/db/repos/page/page-permission.repo';
 import { normalizeLabelName } from './utils';
+import { EventEmitter2 } from "@nestjs/event-emitter";
+import { EventName } from "src/common/events/event.contants";

@Injectable()
 export class LabelService {
  constructor(
    private readonly labelRepo: LabelRepo,
    private readonly pagePermissionRepo: PagePermissionRepo,
+    private readonly eventEmitter: EventEmitter2,
    @InjectKysely() private readonly db: KyselyDB,
  ) {}

@@ -34,6 +37,12 @@ export class LabelService {
        attached.push(label);
      }
    });
+
+    this.eventEmitter.emit(EventName.PAGE_UPDATED, {
+      pageIds: [pageId],
+      workspaceId: workspaceId,
+    });
+    
    return attached;
  }

@@ -64,6 +73,11 @@ export class LabelService {
        await this.labelRepo.deleteLabel(labelId, workspaceId, trx);
      }
    });
+
+    this.eventEmitter.emit(EventName.PAGE_UPDATED, {
+      pageIds: [pageId],
+      workspaceId: workspaceId,
+    });
  }

  async getPageLabels(pageId: string, pagination: PaginationOptions) {
@@ -26,7 +26,6 @@ import { PageHistoryService } from './services/page-history.service';
 import { AuthUser } from '../../common/decorators/auth-user.decorator';
 import { AuthWorkspace } from '../../common/decorators/auth-workspace.decorator';
 import { JwtAuthGuard } from '../../common/guards/jwt-auth.guard';
-import { OAuthScope } from '../../common/decorators/oauth-scope.decorator';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
 import { Page, User, Workspace } from '@docmost/db/types/entity.types';
 import { SidebarPageDto } from './dto/sidebar-page.dto';
@@ -70,7 +69,6 @@ export class PageController {

  @HttpCode(HttpStatus.OK)
  @Post('/info')
-  @OAuthScope('read')
  async getPage(@Body() dto: PageInfoDto, @AuthUser() user: User) {
    const page = await this.pageRepo.findById(dto.pageId, {
      includeSpace: true,
@@ -201,7 +199,6 @@ export class PageController {

  @HttpCode(HttpStatus.OK)
  @Post('create')
-  @OAuthScope('write')
  async create(
    @Body() createPageDto: CreatePageDto,
    @AuthUser() user: User,
@@ -272,7 +269,6 @@ export class PageController {

  @HttpCode(HttpStatus.OK)
  @Post('update')
-  @OAuthScope('write')
  async update(@Body() updatePageDto: UpdatePageDto, @AuthUser() user: User) {
    const page = await this.pageRepo.findById(updatePageDto.pageId);

@@ -417,7 +413,6 @@ export class PageController {

  @HttpCode(HttpStatus.OK)
  @Post('recent')
-  @OAuthScope('read')
  async getRecentPages(
    @Body() recentPageDto: RecentPageDto,
    @Body() pagination: PaginationOptions,
@@ -532,7 +527,6 @@ export class PageController {

  @HttpCode(HttpStatus.OK)
  @Post('/sidebar-pages')
-  @OAuthScope('read')
  async getSidebarPages(
    @Body() dto: SidebarPageDto,
    @Body() pagination: PaginationOptions,
@@ -575,7 +569,6 @@ export class PageController {

  @HttpCode(HttpStatus.OK)
  @Post('move-to-space')
-  @OAuthScope('write')
  async movePageToSpace(
    @Body() dto: MovePageToSpaceDto,
    @AuthUser() user: User,
@@ -629,7 +622,6 @@ export class PageController {

  @HttpCode(HttpStatus.OK)
  @Post('duplicate')
-  @OAuthScope('write')
  async duplicatePage(@Body() dto: DuplicatePageDto, @AuthUser() user: User) {
    const copiedPage = await this.pageRepo.findById(dto.pageId);
    if (!copiedPage) {
@@ -714,7 +706,6 @@ export class PageController {

  @HttpCode(HttpStatus.OK)
  @Post('move')
-  @OAuthScope('write')
  async movePage(@Body() dto: MovePageDto, @AuthUser() user: User) {
    const movedPage = await this.pageRepo.findById(dto.pageId);
    if (!movedPage) {
@@ -496,10 +496,21 @@ export class PageService {
          },
        );

-        await this.aiQueue.add(QueueJob.PAGE_MOVED_TO_SPACE, {
-          pageIds: pageIdsToMove,
-          workspaceId: rootPage.workspaceId,
-        });
+        await this.aiQueue.add(
+          QueueJob.PAGE_MOVED_TO_SPACE,
+          {
+            pageIds: pageIdsToMove,
+            spaceId,
+            workspaceId: rootPage.workspaceId,
+          },
+          {
+            attempts: 2,
+            backoff: {
+              type: 'fixed',
+              delay: 2 * 60 * 1000,
+            },
+          },
+        );
      }
    });

@@ -1,4 +1,5 @@
 import {
+  IsArray,
  IsBoolean,
  IsNotEmpty,
  IsNumber,
@@ -8,9 +9,9 @@ import {
 } from 'class-validator';

 export class SearchDTO {
-  @IsNotEmpty()
+  @IsOptional()
  @IsString()
-  query: string;
+  query?: string;

  @IsOptional()
  @IsUUID()
@@ -24,6 +25,15 @@ export class SearchDTO {
  @IsUUID()
  creatorId?: string;

+  @IsOptional()
+  @IsArray()
+  @IsUUID('all', { each: true })
+  labelIds?: string[];
+
+  @IsOptional()
+  @IsBoolean()
+  titleOnly?: boolean;
+
  @IsOptional()
  @IsNumber()
  limit?: number;
@@ -17,7 +17,6 @@ import {
 } from './dto/search.dto';
 import { AuthWorkspace } from '../../common/decorators/auth-workspace.decorator';
 import { JwtAuthGuard } from '../../common/guards/jwt-auth.guard';
-import { OAuthScope } from '../../common/decorators/oauth-scope.decorator';
 import { User, Workspace } from '@docmost/db/types/entity.types';
 import SpaceAbilityFactory from '../casl/abilities/space-ability.factory';
 import {
@@ -43,7 +42,6 @@ export class SearchController {

  @HttpCode(HttpStatus.OK)
  @Post()
-  @OAuthScope('read')
  async pageSearch(
    @Body() searchDto: SearchDTO,
    @AuthUser() user: User,
@@ -77,7 +75,6 @@ export class SearchController {

  @HttpCode(HttpStatus.OK)
  @Post('suggest')
-  @OAuthScope('read')
  async searchSuggestions(
    @Body() dto: SearchSuggestionDTO,
    @AuthUser() user: User,
@@ -29,12 +29,36 @@ export class SearchService {
      workspaceId: string;
    },
  ): Promise<{ items: SearchResponseDto[] }> {
-    const { query } = searchParams;
+    const query = searchParams.query?.trim() ?? '';
+    const labelIds = [...new Set(searchParams.labelIds ?? [])];
+    // selected filters (labels, creator) are browsable without a query
+    const browseByFilters =
+      query.length < 1 &&
+      (labelIds.length > 0 || Boolean(searchParams.creatorId));

-    if (query.length < 1) {
+    if (query.length < 1 && !browseByFilters) {
      return { items: [] };
    }
-    const searchQuery = tsquery(query.trim() + '*');
+    const searchQuery = tsquery(query + '*');
+    const titleOnly = searchParams.titleOnly === true;
+    const titleQuery = query;
+    // escape LIKE wildcards; ranking keeps the raw query
+    const titleLikeQuery = query.replace(/[\\%_]/g, '\\$&');
+
+    const rankColumn = browseByFilters
+      ? sql<number>`0`.as('rank')
+      : titleOnly
+        ? sql<number>`word_similarity(lower(${titleQuery}), lower(pages.title))`.as(
+            'rank',
+          )
+        : sql<number>`ts_rank(tsv, to_tsquery('english', f_unaccent(${searchQuery})))`.as(
+            'rank',
+          );
+    const highlightColumn = browseByFilters || titleOnly
+      ? sql<string>`''`.as('highlight')
+      : sql<string>`ts_headline('english', text_content, to_tsquery('english', f_unaccent(${searchQuery})),'MinWords=9, MaxWords=10, MaxFragments=3')`.as(
+          'highlight',
+        );

    let queryResults = this.db
      .selectFrom('pages')
@@ -47,23 +71,41 @@ export class SearchService {
        'creatorId',
        'createdAt',
        'updatedAt',
-        sql<number>`ts_rank(tsv, to_tsquery('english', f_unaccent(${searchQuery})))`.as(
-          'rank',
-        ),
-        sql<string>`ts_headline('english', text_content, to_tsquery('english', f_unaccent(${searchQuery})),'MinWords=9, MaxWords=10, MaxFragments=3')`.as(
-          'highlight',
-        ),
+        rankColumn,
+        highlightColumn,
      ])
-      .where(
-        'tsv',
-        '@@',
-        sql<string>`to_tsquery('english', f_unaccent(${searchQuery}))`,
+      .$if(!browseByFilters && !titleOnly, (qb) =>
+        qb.where(
+          'tsv',
+          '@@',
+          sql<string>`to_tsquery('english', f_unaccent(${searchQuery}))`,
+        ),
+      )
+      .$if(!browseByFilters && titleOnly, (qb) =>
+        qb.where((eb) =>
+          eb(
+            sql`lower(pages.title)`,
+            'like',
+            sql`lower(${`%${titleLikeQuery}%`})`,
+          ),
+        ),
      )
      .$if(Boolean(searchParams.creatorId), (qb) =>
        qb.where('creatorId', '=', searchParams.creatorId),
      )
+      .$if(labelIds?.length > 0, (qb) =>
+        qb.where(
+          'id',
+          'in',
+          this.db
+            .selectFrom('pageLabels')
+            .select('pageId')
+            .where('labelId', 'in', labelIds),
+        ),
+      )
      .where('deletedAt', 'is', null)
-      .orderBy('rank', 'desc')
+      .$if(browseByFilters, (qb) => qb.orderBy('updatedAt', 'desc'))
+      .$if(!browseByFilters, (qb) => qb.orderBy('rank', 'desc'))
      .limit(searchParams.limit || 25)
      .offset(searchParams.offset || 0);

@@ -71,8 +113,7 @@ export class SearchService {
      queryResults = queryResults.select((eb) => this.pageRepo.withSpace(eb));
    }

-    if (searchParams.spaceId) {
-      // search by spaceId
+    if (searchParams.spaceId && opts.userId) {
      queryResults = queryResults.where('spaceId', '=', searchParams.spaceId);
    } else if (opts.userId && !searchParams.spaceId) {
      // only search spaces the user is a member of
@@ -46,8 +46,9 @@ export class ShareService {
      throw new NotFoundException('Share not found');
    }

-    const isRestricted =
-      await this.pagePermissionRepo.hasRestrictedAncestor(share.pageId);
+    const isRestricted = await this.pagePermissionRepo.hasRestrictedAncestor(
+      share.pageId,
+    );
    if (isRestricted) {
      throw new NotFoundException('Share not found');
    }
@@ -110,6 +111,9 @@ export class ShareService {
  }

  async getSharedPage(dto: ShareInfoDto, workspaceId: string) {
+    //TODO: we should resolve the page from the share id
+    if (!dto.pageId) throw new NotFoundException('Shared page not found');
+
    const share = await this.getShareForPage(dto.pageId, workspaceId);

    if (!share) {
@@ -126,8 +130,9 @@ export class ShareService {
    }

    // Block access to restricted pages
-    const isRestricted =
-      await this.pagePermissionRepo.hasRestrictedAncestor(page.id);
+    const isRestricted = await this.pagePermissionRepo.hasRestrictedAncestor(
+      page.id,
+    );
    if (isRestricted) {
      throw new NotFoundException('Shared page not found');
    }
@@ -339,15 +339,25 @@ export class SpaceMemberService {
      return;
    }

-    if (spaceMember.role === SpaceRole.ADMIN) {
-      await this.validateLastAdmin(dto.spaceId);
-    }
+    await executeTx(this.db, async (trx) => {
+      await trx
+        .selectFrom('spaces')
+        .select('id')
+        .where('id', '=', dto.spaceId)
+        .forUpdate()
+        .executeTakeFirst();

-    await this.spaceMemberRepo.updateSpaceMember(
-      { role: dto.role },
-      spaceMember.id,
-      dto.spaceId,
-    );
+      if (spaceMember.role === SpaceRole.ADMIN) {
+        await this.validateLastAdmin(dto.spaceId, trx);
+      }
+
+      await this.spaceMemberRepo.updateSpaceMember(
+        { role: dto.role },
+        spaceMember.id,
+        dto.spaceId,
+        trx,
+      );
+    });

    this.auditService.log({
      event: AuditEvent.SPACE_MEMBER_ROLE_CHANGED,
@@ -368,10 +378,14 @@ export class SpaceMemberService {
    });
  }

-  async validateLastAdmin(spaceId: string): Promise<void> {
+  async validateLastAdmin(
+    spaceId: string,
+    trx?: KyselyTransaction,
+  ): Promise<void> {
    const spaceOwnerCount = await this.spaceMemberRepo.roleCountBySpaceId(
      SpaceRole.ADMIN,
      spaceId,
+      trx,
    );
    if (spaceOwnerCount === 1) {
      throw new BadRequestException(
@@ -13,7 +13,6 @@ import { SpaceService } from './services/space.service';
 import { AuthUser } from '../../common/decorators/auth-user.decorator';
 import { AuthWorkspace } from '../../common/decorators/auth-workspace.decorator';
 import { JwtAuthGuard } from '../../common/guards/jwt-auth.guard';
-import { OAuthScope } from '../../common/decorators/oauth-scope.decorator';
 import { SpaceIdDto } from './dto/space-id.dto';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
 import { SpaceMemberService } from './services/space-member.service';
@@ -49,7 +48,6 @@ export class SpaceController {

  @HttpCode(HttpStatus.OK)
  @Post('/')
-  @OAuthScope('read')
  async getWorkspaceSpaces(
    @Body()
    pagination: PaginationOptions,
@@ -94,7 +92,6 @@ export class SpaceController {

  @HttpCode(HttpStatus.OK)
  @Post('info')
-  @OAuthScope('read')
  async getSpaceInfo(
    @Body() spaceIdDto: SpaceIdDto,
    @AuthUser() user: User,
@@ -132,7 +129,6 @@ export class SpaceController {

  @HttpCode(HttpStatus.OK)
  @Post('create')
-  @OAuthScope('write')
  createSpace(
    @Body() createSpaceDto: CreateSpaceDto,
    @AuthUser() user: User,
@@ -149,7 +145,6 @@ export class SpaceController {

  @HttpCode(HttpStatus.OK)
  @Post('update')
-  @OAuthScope('write')
  async updateSpace(
    @Body() updateSpaceDto: UpdateSpaceDto,
    @AuthUser() user: User,
@@ -10,7 +10,6 @@ import { UserService } from './user.service';
 import { UpdateUserDto } from './dto/update-user.dto';
 import { AuthUser } from '../../common/decorators/auth-user.decorator';
 import { JwtAuthGuard } from '../../common/guards/jwt-auth.guard';
-import { OAuthScope } from '../../common/decorators/oauth-scope.decorator';
 import { AuthWorkspace } from '../../common/decorators/auth-workspace.decorator';
 import { User, Workspace } from '@docmost/db/types/entity.types';
 import { WorkspaceRepo } from '@docmost/db/repos/workspace/workspace.repo';
@@ -25,7 +24,6 @@ export class UserController {

  @HttpCode(HttpStatus.OK)
  @Post('me')
-  @OAuthScope('read')
  async getUserInfo(
    @AuthUser() authUser: User,
    @AuthWorkspace() workspace: Workspace,
@@ -24,7 +24,6 @@ import {
  RevokeInviteDto,
 } from '../dto/invitation.dto';
 import { JwtAuthGuard } from '../../../common/guards/jwt-auth.guard';
-import { OAuthScope } from '../../../common/decorators/oauth-scope.decorator';
 import { User, Workspace } from '@docmost/db/types/entity.types';
 import WorkspaceAbilityFactory from '../../casl/abilities/workspace-ability.factory';
 import {
@@ -59,7 +58,6 @@ export class WorkspaceController {

  @HttpCode(HttpStatus.OK)
  @Post('/info')
-  @OAuthScope('read')
  async getWorkspace(@AuthWorkspace() workspace: Workspace) {
    return this.workspaceService.getWorkspaceInfo(workspace.id);
  }
@@ -115,7 +113,6 @@ export class WorkspaceController {

  @HttpCode(HttpStatus.OK)
  @Post('members')
-  @OAuthScope('read')
  async getWorkspaceMembers(
    @Body()
    pagination: PaginationOptions,
@@ -1,32 +1,15 @@
 import { PartialType } from '@nestjs/mapped-types';
-import { Type } from 'class-transformer';
 import { CreateWorkspaceDto } from './create-workspace.dto';
-import { TrustedOAuthClient } from '../workspace.util';
 import {
-  ArrayMaxSize,
  IsArray,
  IsBoolean,
  IsIn,
  IsInt,
-  IsNotEmpty,
  IsOptional,
  IsString,
-  MaxLength,
  Min,
-  ValidateNested,
 } from 'class-validator';

-export class TrustedOAuthClientDto {
-  @IsString()
-  @IsNotEmpty()
-  origin: string;
-
-  @IsString()
-  @IsNotEmpty()
-  @MaxLength(64)
-  name: string;
-}
-
 export class UpdateWorkspaceDto extends PartialType(CreateWorkspaceDto) {
  @IsOptional()
  @IsArray()
@@ -87,9 +70,10 @@ export class UpdateWorkspaceDto extends PartialType(CreateWorkspaceDto) {
  defaultPageEditMode: string;

  @IsOptional()
-  @IsArray()
-  @ArrayMaxSize(50)
-  @ValidateNested({ each: true })
-  @Type(() => TrustedOAuthClientDto)
-  trustedOauthClients?: TrustedOAuthClient[];
+  @IsBoolean()
+  aiChatReadOnly: boolean;
+
+  @IsOptional()
+  @IsBoolean()
+  aiChatWorkspaceKnowledgeOnly: boolean;
 }
@@ -30,10 +30,7 @@ import { DomainService } from '../../../integrations/environment/domain.service'
 import { jsonArrayFrom } from 'kysely/helpers/postgres';
 import { addDays } from 'date-fns';
 import { DISALLOWED_HOSTNAMES, WorkspaceStatus } from '../workspace.constants';
-import {
-  isAdminActingOnOwner,
-  normalizeTrustedOAuthClients,
-} from '../workspace.util';
+import { isAdminActingOnOwner } from '../workspace.util';
 import { v4 } from 'uuid';
 import { InjectQueue } from '@nestjs/bullmq';
 import { QueueJob, QueueName } from '../../../integrations/queue/constants';
@@ -317,12 +314,6 @@ export class WorkspaceService {
        .filter(Boolean);
    }

-    if (typeof updateWorkspaceDto.trustedOauthClients !== 'undefined') {
-      updateWorkspaceDto.trustedOauthClients = normalizeTrustedOAuthClients(
-        updateWorkspaceDto.trustedOauthClients,
-      );
-    }
-
    if (updateWorkspaceDto.hostname) {
      const hostname = updateWorkspaceDto.hostname;
      if (DISALLOWED_HOSTNAMES.includes(hostname)) {
@@ -344,7 +335,8 @@ export class WorkspaceService {
      typeof updateWorkspaceDto.allowMemberTemplates !== 'undefined' ||
      typeof updateWorkspaceDto.isScimEnabled !== 'undefined' ||
      typeof updateWorkspaceDto.allowPersonalSpaces !== 'undefined' ||
-      typeof updateWorkspaceDto.trustedOauthClients !== 'undefined'
+      typeof updateWorkspaceDto.aiChatReadOnly !== 'undefined' ||
+      typeof updateWorkspaceDto.aiChatWorkspaceKnowledgeOnly !== 'undefined'
    ) {
      const ws = await this.db
        .selectFrom('workspaces')
@@ -372,11 +364,11 @@ export class WorkspaceService {
        }
      }

-      if (typeof updateWorkspaceDto.trustedOauthClients !== 'undefined') {
+      if (typeof updateWorkspaceDto.allowPersonalSpaces !== 'undefined') {
        if (
          !this.licenseCheckService.hasFeature(
            ws.licenseKey,
-            Feature.OAUTH,
+            Feature.PERSONAL_SPACES,
            ws.plan,
          )
        ) {
@@ -384,11 +376,14 @@ export class WorkspaceService {
        }
      }

-      if (typeof updateWorkspaceDto.allowPersonalSpaces !== 'undefined') {
+      if (
+        typeof updateWorkspaceDto.aiChatReadOnly !== 'undefined' ||
+        typeof updateWorkspaceDto.aiChatWorkspaceKnowledgeOnly !== 'undefined'
+      ) {
        if (
          !this.licenseCheckService.hasFeature(
            ws.licenseKey,
-            Feature.PERSONAL_SPACES,
+            Feature.AI_CONTROLS,
            ws.plan,
          )
        ) {
@@ -418,7 +413,10 @@ export class WorkspaceService {
      }
    }

-    if (updateWorkspaceDto.aiSearch) {
+    if (
+      updateWorkspaceDto.aiSearch &&
+      this.environmentService.getAiVectorDriver() !== 'turbopuffer'
+    ) {
      const tableExists = await isPageEmbeddingsTableExists(this.db);
      if (!tableExists) {
        throw new BadRequestException(
@@ -535,6 +533,34 @@ export class WorkspaceService {
        );
      }

+      if (typeof updateWorkspaceDto.aiChatReadOnly !== 'undefined') {
+        const prev = settingsBefore?.ai?.chatReadOnly ?? false;
+        if (prev !== updateWorkspaceDto.aiChatReadOnly) {
+          before.aiChatReadOnly = prev;
+          after.aiChatReadOnly = updateWorkspaceDto.aiChatReadOnly;
+        }
+        await this.workspaceRepo.updateAiSettings(
+          workspaceId,
+          'chatReadOnly',
+          updateWorkspaceDto.aiChatReadOnly,
+          trx,
+        );
+      }
+
+      if (typeof updateWorkspaceDto.aiChatWorkspaceKnowledgeOnly !== 'undefined') {
+        const prev = settingsBefore?.ai?.chatWorkspaceKnowledgeOnly ?? false;
+        if (prev !== updateWorkspaceDto.aiChatWorkspaceKnowledgeOnly) {
+          before.aiChatWorkspaceKnowledgeOnly = prev;
+          after.aiChatWorkspaceKnowledgeOnly = updateWorkspaceDto.aiChatWorkspaceKnowledgeOnly;
+        }
+        await this.workspaceRepo.updateAiSettings(
+          workspaceId,
+          'chatWorkspaceKnowledgeOnly',
+          updateWorkspaceDto.aiChatWorkspaceKnowledgeOnly,
+          trx,
+        );
+      }
+
      if (typeof updateWorkspaceDto.allowPersonalSpaces !== 'undefined') {
        const prev = settingsBefore?.spaces?.allowPersonal ?? false;
        if (prev !== updateWorkspaceDto.allowPersonalSpaces) {
@@ -572,6 +598,8 @@ export class WorkspaceService {
      delete updateWorkspaceDto.aiChat;
      delete updateWorkspaceDto.allowPersonalSpaces;
      delete updateWorkspaceDto.defaultPageEditMode;
+      delete updateWorkspaceDto.aiChatReadOnly;
+      delete updateWorkspaceDto.aiChatWorkspaceKnowledgeOnly;

      await this.workspaceRepo.updateWorkspace(
        updateWorkspaceDto,
@@ -611,7 +639,6 @@ export class WorkspaceService {
        'enforceMfa',
        'emailDomains',
        'isScimEnabled',
-        'trustedOauthClients',
      ],
      updateWorkspaceDto,
      workspaceBefore,
@@ -1,49 +0,0 @@
-import { BadRequestException } from '@nestjs/common';
-import { normalizeTrustedOAuthClients } from './workspace.util';
-
-describe('normalizeTrustedOAuthClients', () => {
-  it('lowercases origins and trims names', () => {
-    expect(
-      normalizeTrustedOAuthClients([
-        { origin: 'https://mcp.acme.com', name: '  Acme MCP  ' },
-      ]),
-    ).toEqual([{ origin: 'https://mcp.acme.com', name: 'Acme MCP' }]);
-  });
-
-  it('dedupes origins case-insensitively with the last entry winning', () => {
-    expect(
-      normalizeTrustedOAuthClients([
-        { origin: 'https://mcp.acme.com', name: 'First' },
-        { origin: 'https://mcp.acme.com', name: 'Second' },
-      ]),
-    ).toEqual([{ origin: 'https://mcp.acme.com', name: 'Second' }]);
-  });
-
-  it.each([
-    ['http origin', 'http://mcp.acme.com'],
-    ['trailing slash', 'https://mcp.acme.com/'],
-    ['path suffix', 'https://mcp.acme.com/oauth'],
-    ['uppercase host', 'https://MCP.acme.com'],
-    ['not a url', 'mcp.acme.com'],
-  ])('rejects %s naming the origin', (_label, origin) => {
-    expect(() =>
-      normalizeTrustedOAuthClients([{ origin, name: 'Acme MCP' }]),
-    ).toThrow(BadRequestException);
-    expect(() =>
-      normalizeTrustedOAuthClients([{ origin, name: 'Acme MCP' }]),
-    ).toThrow(origin);
-  });
-
-  it.each([
-    ['blank', '   '],
-    ['too long', 'x'.repeat(65)],
-  ])('rejects a %s name', (_label, name) => {
-    expect(() =>
-      normalizeTrustedOAuthClients([{ origin: 'https://mcp.acme.com', name }]),
-    ).toThrow(BadRequestException);
-  });
-
-  it('returns an empty array for no entries', () => {
-    expect(normalizeTrustedOAuthClients([])).toEqual([]);
-  });
-});
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Philipinho	14840ef065	fix: remove client compression script	2026-08-25 15:43:47 +01:00
Philipinho	83d7ee4460	chore: pnpm minor version	2026-08-25 04:34:11 +01:00
Philipinho	fc90fbd8c0	chore: update pnpm	2026-08-25 04:31:23 +01:00
Philip Okugbe	a0ec93506c	chore: compress and lazy load client code (#2425 )	2026-08-25 03:29:56 +01:00
Philipinho	a415b86193	fix: clean up unaccent usage in index	2026-08-25 03:28:59 +01:00
Philipinho	702f8b7a41	fix: local editor cache	2026-08-25 02:54:38 +01:00
Salihu	95cef61927	fix: rework filtering behaviour (#2413 ) * rework filtering behaviour * fix classification bug	2026-08-25 02:52:24 +01:00
SalihuandPhilipinho	7bd73f77a4	feat: lightbox media display (#2420 ) * lightbox media display init * revert uninteded changes * load page media more accurately * restrict lock file changes to installed packages * revert changes in lock file * update lockfile * - support diagrams - support readonly mode - use softer backdrop - other enhancments --------- Co-authored-by: Philipinho <16838612+Philipinho@users.noreply.github.com>	2026-08-25 02:43:19 +01:00
Salihu	3a25336d3d	fix: display subpages correctly on first load (#2423 )	2026-08-25 01:39:55 +01:00
SalihuandPhilipinho	917195b2f2	feat: enhanced search filters (#2398 ) * advanced search filters * improve labelId filtering in query * index label ids on typesense * index label ids on typesense * filters on AI search * refactor: detect typesense schema drift from the declared collection schema * feat: show secondary search filters only when applied Created by and Labels now stay hidden until they hold a value; a Filter button at the right end of the bar lists the hidden ones and opens the picked filter's dropdown immediately. * fix: keep applied search filters in the order they were added * feat: add title-only search mode Adds a titleOnly flag to page search: the Postgres driver matches titles via trigram-indexed unaccented LIKE ranked by word_similarity, and a Match filter in the search spotlight switches between everything and title-only matching. * refactor: make title-only search a toggle chip * fix: drop stale results when the search content type changes * feat: add trigram index on attachment file names * feat: extend title-only search to attachments The titleOnly flag now matches attachment file names via the separator-normalized trigram expression, and the toggle chip stays available in attachment mode as File name only. * refactor: keep the title-only label uniform across search modes * feat: index txt attachments for content search * feat: pin the current user at the top of the creator filter * refactor: dim the you suffix in the creator filter * feat: browse label-filtered pages without a query Selecting labels now lists their pages newest-first before any text is typed, on both the Postgres and Typesense drivers. * fix: match any selected label instead of requiring all * fix: use a gray spotlight selection instead of primary blue * feat: include search results in the spotlight tab order * feat: show last updated time on search results * fix: stop empty-state flicker while the search query debounces * feat: browse creator-filtered results without a query Selecting a creator with an empty query now lists their pages (or attachments in attachment mode) newest-first, with the same space and page permission filtering as typed search. * fix: show Untitled for pages without a title in search results * quick page sharing fix * minor search filter fixes --------- Co-authored-by: Philipinho <16838612+Philipinho@users.noreply.github.com>	2026-08-25 01:39:33 +01:00
Philip Okugbe	cd597f0161	chore: remove unused npm modules in Docke build (#2422 )	2026-08-24 20:32:50 +01:00
Philip Okugbe	b7f0b063dc	feat(ee): add enterprise ai chat controls (#2421 ) * feat(ee): add enterprise ai chat controls * feat: add comment listing tool to ai chat * fix: scope comment endpoints to workspace and skip trashed pages	2026-08-24 20:29:21 +01:00
Salihu	cd9c166927	Merge pull request #2417 from docmost/fix/checkbox-filtering fix(ee): checkbox filtering	2026-08-23 21:21:02 +01:00
Philip Okugbe	549cf7c005	fix: skip pgvector table check when enabling AI search on turbopuffer (#2416 )	2026-08-22 13:20:35 +01:00
Philip Okugbe	e14f499f3d	fix: pass tls to redis in throttle module (#2415 )	2026-08-22 03:46:00 +01:00
Salihu	b814bd0f12	fix: checkbox filtering	2026-08-21 19:29:10 +01:00
Salihu	b86abd3d40	Revert "fix: checkbox filtering" This reverts commit `3b858746e3`.	2026-08-21 19:23:48 +01:00
Salihu	3b858746e3	fix: checkbox filtering	2026-08-21 19:21:14 +01:00
Philipinho	66b424a3b8	fix: preserve hash in vimeo embed url	2026-08-20 22:25:45 +01:00
Philipinho	ab43031375	fix race issue	2026-08-19 21:46:01 +01:00
Michael LohrandPhilipinho	8c2c49ea6d	fix: handle empty password, missing port, and TLS in Redis URL parsing (#2021 ) * fix: handle empty password, missing port, and TLS in Redis URL parsing --------- Co-authored-by: Philipinho <16838612+Philipinho@users.noreply.github.com>	2026-08-19 21:05:44 +01:00
Philip Okugbe	8913d20aa0	chore: package updates (#2412 )	2026-08-19 19:59:00 +01:00
Philip Okugbe	232beda471	feat(ee): turbopuffer ai vector search driver (#2402 ) * feat(ai): add AI_VECTOR_DRIVER and turbopuffer configuration * feat(ai): carry workspace and target space ids on vector lifecycle events * feat(ai): add vector driver interface and turbopuffer request helpers * feat(ai): add pgvector driver behind the vector driver interface * refactor(ai): route vector reads and writes through the vector driver * feat(ai): add turbopuffer vector driver * feat(ai): rebuild turbopuffer namespaces when the embedding model changes * feat(ai): warm the vector namespace cache on session start * fix(ai): harden turbopuffer misconfiguration and reset failure paths * fix(ai): collapse blank-line runs in extracted page text * fix(ai): skip full re-embed when ai search is re-enabled within the delete grace window * sync * fix(ai): store real embedding dimensions instead of serialized vector length * fix(ai): filter search hits by the page's current space at query time * fix(ai): retry the page moved-to-space vector patch job * sync * feat(ai): pre-warm the vector namespace * fix(ai): pass AI_VECTOR_DRIVER through the client build config	2026-08-17 21:18:16 +01:00