feat: mcp oauth

Provides an injectable EncryptionService that encrypts/decrypts strings
with AES-256-GCM using a key derived from APP_SECRET with domain
separation.

Dockerfile

@@ -42,7 +42,7 @@ RUN chown -R node:node /app
 
 USER node
 
-RUN pnpm install --frozen-lockfile --prod
+RUN pnpm install --frozen-lockfile --prod && rm -rf /home/node/.cache/pnpm
 
 RUN mkdir -p /app/data/storage
 

apps/client/package.json

@@ -50,9 +50,9 @@
     "katex": "0.16.40",
     "lowlight": "3.3.0",
     "mantine-form-zod-resolver": "1.3.0",
-    "mermaid": "11.15.0",
+    "mermaid": "11.16.1",
     "mitt": "3.0.1",
-    "nanoid": "3.3.8",
+    "nanoid": "3.3.17",
     "posthog-js": "1.391.2",
     "react": "19.2.7",
     "react-clear-modal": "^2.0.18",

apps/client/public/locales/en-US/translation.json

@@ -387,6 +387,8 @@
   "Insert horizontal rule divider": "Insert horizontal rule divider",
   "Page break": "Page break",
   "Insert a page break for printing.": "Insert a page break for printing.",
+  "Footnote": "Footnote",
+  "Insert a footnote reference.": "Insert a footnote reference.",
   "Upload any image from your device.": "Upload any image from your device.",
   "Upload any video from your device.": "Upload any video from your device.",
   "Upload any audio from your device.": "Upload any audio from your device.",
@@ -704,9 +706,8 @@
   "Enable the MCP server to allow AI assistants and tools to interact with your workspace content.": "Enable the MCP server to allow AI assistants and tools to interact with your workspace content.",
   "MCP is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "MCP is only available in the Docmost enterprise edition. Contact sales@docmost.com.",
   "MCP Server URL": "MCP Server URL",
-  "Use your API key for authentication. You can manage API keys in your account settings.": "Use your API key for authentication. You can manage API keys in your account settings.",
+  "Connect with your Docmost account via OAuth when your client supports it, or use an API key from your account settings.": "Connect with your Docmost account via OAuth when your client supports it, or use an API key from your account settings.",
   "Supported tools": "Supported tools",
-  "Your workspace has MCP enabled. Use your API key to connect AI assistants.": "Your workspace has MCP enabled. Use your API key to connect AI assistants.",
   "MCP server URL:": "MCP server URL:",
   "Learn more": "Learn more",
   "Manage API keys for all users in the workspace. View the <anchor>API documentation</anchor> for usage details.": "Manage API keys for all users in the workspace. View the <anchor>API documentation</anchor> for usage details.",
@@ -1289,5 +1290,47 @@
   "{{count}} rows deleted_one": "1 row deleted",
   "{{count}} rows deleted_other": "{{count}} rows deleted",
   "{{count}} selected_one": "1 selected",
-  "{{count}} selected_other": "{{count}} selected"
+  "{{count}} selected_other": "{{count}} selected",
+  "Compare": "Compare",
+  "Compare versions": "Compare versions",
+  "Select version from {{date}}": "Select version from {{date}}",
+  "Version actions for {{date}}": "Version actions for {{date}}",
+  "Comparing {{newer}} and {{older}}": "Comparing {{newer}} and {{older}}",
+  "Exit compare": "Exit compare",
+  "Search attachments...": "Search attachments...",
+  "Error loading attachments.": "Error loading attachments.",
+  "No attachments on this page yet.": "No attachments on this page yet.",
+  "Uploaded by {{name}}": "Uploaded by {{name}}",
+  "Download {{name}}": "Download {{name}}",
+  "Access revoked": "Access revoked",
+  "Authorize application": "Authorize application",
+  "{{name}} wants to access {{workspace}}": "{{name}} wants to access {{workspace}}",
+  "Not you? Switch account": "Not you? Switch account",
+  "This application will be able to:": "This application will be able to:",
+  "Write": "Write",
+  "Invalid authorization request": "Invalid authorization request",
+  "Authorize": "Authorize",
+  "Application": "Application",
+  "Permissions": "Permissions",
+  "Authorized": "Authorized",
+  "Revoke access": "Revoke access",
+  "Revoke access for {{name}}": "Revoke access for {{name}}",
+  "Are you sure you want to revoke access for {{name}}? The application will no longer be able to access your account.": "Are you sure you want to revoke access for {{name}}? The application will no longer be able to access your account.",
+  "Something went wrong. Please try again.": "Something went wrong. Please try again.",
+  "Trusted applications": "Trusted applications",
+  "Remove {{name}}": "Remove {{name}}",
+  "This origin is already trusted.": "This origin is already trusted.",
+  "Trusted application name": "Trusted application name",
+  "Trusted application origin": "Trusted application origin",
+  "I recognize this application and want to continue": "I recognize this application and want to continue",
+  "You will be redirected to": "You will be redirected to",
+  "View content without making changes.": "View content without making changes.",
+  "Create and modify content.": "Create and modify content.",
+  "This application is not on your workspace's trusted list. Authorize only if you recognize it.": "This application is not on your workspace's trusted list. Authorize only if you recognize it.",
+  "Applications with these callback origins are trusted. Members will not see a warning when authorizing them.": "Applications with these callback origins are trusted. Members will not see a warning when authorizing them.",
+  "Enter the app's callback origin, e.g. https://app.yourcompany.com": "Enter the app's callback origin, e.g. https://app.yourcompany.com",
+  "Applications and AI assistants you have authorized to access your account.": "Applications and AI assistants you have authorized to access your account.",
+  "Your workspace has MCP enabled. Connect AI assistants with your Docmost account, or with an API key.": "Your workspace has MCP enabled. Connect AI assistants with your Docmost account, or with an API key.",
+  "Authorized apps": "Authorized apps",
+  "No authorized apps yet.": "No authorized apps yet."
 }

apps/client/src/App.tsx

@@ -47,6 +47,7 @@ import FavoritesPage from "@/pages/favorites/favorites-page";
 import AiChat from "@/ee/ai-chat/pages/ai-chat.tsx";
 import VerifyEmail from "@/ee/pages/verify-email.tsx";
 import LabelPage from "@/pages/label/label-page";
+import OAuthConsent from "@/ee/oauth/pages/oauth-consent.tsx";
 
 export default function App() {
   const { t } = useTranslation();
@@ -63,6 +64,7 @@ export default function App() {
         <Route path={"/password-reset"} element={<PasswordReset />} />
         <Route path={"/login/mfa"} element={<MfaChallengePage />} />
         <Route path={"/login/mfa/setup"} element={<MfaSetupRequiredPage />} />
+        <Route path={"/oauth/consent"} element={<OAuthConsent />} />
 
         {!isCloud() && (
           <Route path={"/setup/register"} element={<SetupWorkspace />} />
@@ -116,6 +118,10 @@ export default function App() {
               element={<AccountPreferences />}
             />
             <Route path={"account/api-keys"} element={<UserApiKeys />} />
+            <Route
+              path={"account/api-keys/authorized-apps"}
+              element={<UserApiKeys />}
+            />
             <Route path={"workspace"} element={<WorkspaceSettings />} />
             <Route path={"members"} element={<WorkspaceMembers />} />
             <Route path={"api-keys"} element={<WorkspaceApiKeys />} />

apps/client/src/components/ui/document-title.test.tsx

@@ -0,0 +1,45 @@
+import { describe, expect, it, beforeEach } from "vitest";
+import { render } from "@testing-library/react";
+import { HelmetProvider } from "react-helmet-async";
+import { DocumentTitle } from "./document-title.tsx";
+
+const renderTitle = (ui: React.ReactNode) =>
+  render(<HelmetProvider>{ui}</HelmetProvider>);
+
+describe("DocumentTitle", () => {
+  beforeEach(() => {
+    document.head.innerHTML = "<title>Docmost</title>";
+  });
+
+  it("appends the app name", () => {
+    renderTitle(<DocumentTitle title="Home" />);
+    expect(document.title).toBe("Home - Docmost");
+  });
+
+  it("omits the app name when asked", () => {
+    renderTitle(<DocumentTitle title="My page" withAppName={false} />);
+    expect(document.title).toBe("My page");
+  });
+
+  it("falls back to the app name without a title", () => {
+    renderTitle(<DocumentTitle />);
+    expect(document.title).toBe("Docmost");
+  });
+
+  it("never renders an empty title", () => {
+    renderTitle(<DocumentTitle title="Spaces" />);
+    const titles = Array.from(document.querySelectorAll("head > title"));
+    expect(titles.every((node) => node.textContent !== "")).toBe(true);
+  });
+
+  it("renders extra head children", () => {
+    renderTitle(
+      <DocumentTitle title="Shared">
+        <meta name="robots" content="noindex" />
+      </DocumentTitle>,
+    );
+    expect(
+      document.querySelector('head > meta[name="robots"]')?.getAttribute("content"),
+    ).toBe("noindex");
+  });
+});

apps/client/src/components/ui/document-title.tsx

@@ -0,0 +1,29 @@
+import React from "react";
+import { Helmet } from "react-helmet-async";
+import { getAppName } from "@/lib/config.ts";
+
+type DocumentTitleProps = {
+  title?: string;
+  withAppName?: boolean;
+  children?: React.ReactNode;
+};
+
+export function DocumentTitle({
+  title,
+  withAppName = true,
+  children,
+}: DocumentTitleProps) {
+  const appName = getAppName();
+
+  let documentTitle = appName;
+  if (title) {
+    documentTitle = withAppName ? `${title} - ${appName}` : title;
+  }
+
+  return (
+    <Helmet>
+      <title>{documentTitle}</title>
+      {children}
+    </Helmet>
+  );
+}

apps/client/src/components/ui/error-404.tsx

@@ -1,17 +1,15 @@
 import { Title, Text, Button, Container, Group } from "@mantine/core";
 import classes from "./error-404.module.css";
 import { Link } from "react-router-dom";
-import { Helmet } from "react-helmet-async";
 import { useTranslation } from "react-i18next";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export function Error404() {
   const { t } = useTranslation();
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title={t("404 page not found")} />
-        <title>{t("404 page not found")} - Docmost</title>
-      </Helmet>
       <Container className={classes.root}>
         <Title className={classes.title}>{t("404 page not found")}</Title>
         <Text c="dimmed" size="lg" ta="center" className={classes.description}>

apps/client/src/ee/ai-chat/components/chat-input.tsx

@@ -255,6 +255,7 @@ export default function ChatInput({
     },
     content: "",
     editable: true,
+    textDirection: "auto",
     immediatelyRender: true,
     shouldRerenderOnTransaction: false,
     autofocus: autofocus ? "end" : false,

apps/client/src/ee/ai/components/mcp-settings.tsx

@@ -1,7 +1,9 @@
 import {
   Anchor,
+  Button,
   Group,
   List,
+  Table,
   Text,
   Switch,
   TextInput,
@@ -15,14 +17,33 @@ import { workspaceAtom } from "@/features/user/atoms/current-user-atom.ts";
 import React, { useState } from "react";
 import { Trans, useTranslation } from "react-i18next";
 import { updateWorkspace } from "@/features/workspace/services/workspace-service.ts";
+import { ITrustedOAuthClient } from "@/features/workspace/types/workspace.types.ts";
 import { notifications } from "@mantine/notifications";
 import { useHasFeature } from "@/ee/hooks/use-feature";
 import { Feature } from "@/ee/features";
 import { useUpgradeLabel } from "@/ee/hooks/use-upgrade-label";
 import { getAppUrl } from "@/lib/config.ts";
-import { IconCheck, IconCopy, IconInfoCircle } from "@tabler/icons-react";
+import {
+  IconCheck,
+  IconCopy,
+  IconInfoCircle,
+  IconTrash,
+} from "@tabler/icons-react";
 import { CopyButton } from "@/components/common/copy-button.tsx";
 
+// Mirrors the server rule: an exact https origin, tolerating only a trailing slash.
+function parseTrustedOrigin(value: string): string | null {
+  const input = value.trim().toLowerCase();
+  try {
+    const url = new URL(input);
+    if (url.protocol !== "https:") return null;
+    if (input !== url.origin && input !== `${url.origin}/`) return null;
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
+
 export default function McpSettings() {
   const { t } = useTranslation();
   const [workspace, setWorkspace] = useAtom(workspaceAtom);
@@ -30,7 +51,14 @@ export default function McpSettings() {
   const hasAccess = useHasFeature(Feature.MCP);
   const upgradeLabel = useUpgradeLabel();
 
+  const [newClientName, setNewClientName] = useState("");
+  const [newClientOrigin, setNewClientOrigin] = useState("");
+
   const mcpUrl = `${getAppUrl()}/mcp`;
+  const storedTrustedClients = workspace?.trustedOauthClients;
+  const trustedClients = Array.isArray(storedTrustedClients)
+    ? storedTrustedClients
+    : [];
 
   const handleChange = async (event: React.ChangeEvent<HTMLInputElement>) => {
     const value = event.currentTarget.checked;
@@ -46,6 +74,51 @@ export default function McpSettings() {
     }
   };
 
+  const saveTrustedClients = async (next: ITrustedOAuthClient[]) => {
+    try {
+      const updatedWorkspace = await updateWorkspace({
+        trustedOauthClients: next,
+      });
+      setWorkspace(updatedWorkspace);
+      return true;
+    } catch (err) {
+      notifications.show({
+        message: err?.response?.data?.message,
+        color: "red",
+      });
+      return false;
+    }
+  };
+
+  const handleAddTrustedClient = async () => {
+    const name = newClientName.trim();
+    const origin = parseTrustedOrigin(newClientOrigin);
+    if (!origin) {
+      notifications.show({
+        message: t("Enter the app's callback origin, e.g. https://app.yourcompany.com"),
+        color: "red",
+      });
+      return;
+    }
+    if (trustedClients.some((client) => client.origin.toLowerCase() === origin)) {
+      notifications.show({
+        message: t("This origin is already trusted."),
+        color: "red",
+      });
+      return;
+    }
+    if (await saveTrustedClients([...trustedClients, { origin, name }])) {
+      setNewClientName("");
+      setNewClientOrigin("");
+    }
+  };
+
+  const handleRemoveTrustedClient = (origin: string) => {
+    void saveTrustedClients(
+      trustedClients.filter((client) => client.origin !== origin),
+    );
+  };
+
   return (
     <Stack gap="lg">
       {!hasAccess && (
@@ -108,7 +181,7 @@ export default function McpSettings() {
           </Group>
           <Text size="sm" c="dimmed" mt="xs">
             {t(
-              "Use your API key for authentication. You can manage API keys in your account settings.",
+              "Connect with your Docmost account via OAuth when your client supports it, or use an API key from your account settings.",
             )}
           </Text>
 
@@ -149,6 +222,81 @@ export default function McpSettings() {
               </List.Item>
             </List>
           </div>
+
+          <div>
+            <Text size="sm" fw={500} mt="md" mb={4}>
+              {t("Trusted applications")}
+            </Text>
+            <Text size="sm" c="dimmed" mb="xs">
+              {t(
+                "Applications with these callback origins are trusted. Members will not see a warning when authorizing them.",
+              )}
+            </Text>
+
+            {trustedClients.length > 0 && (
+              <Table verticalSpacing="xs" mb="xs">
+                <Table.Tbody>
+                  {trustedClients.map((client) => (
+                    <Table.Tr key={client.origin}>
+                      <Table.Td>
+                        <Text size="sm" fw={500}>
+                          {client.name}
+                        </Text>
+                      </Table.Td>
+                      <Table.Td>
+                        <Text size="sm" c="dimmed">
+                          {client.origin}
+                        </Text>
+                      </Table.Td>
+                      <Table.Td w={40}>
+                        <ActionIcon
+                          variant="subtle"
+                          color="red"
+                          aria-label={t("Remove {{name}}", {
+                            name: client.name,
+                          })}
+                          onClick={() =>
+                            handleRemoveTrustedClient(client.origin)
+                          }
+                        >
+                          <IconTrash size={16} />
+                        </ActionIcon>
+                      </Table.Td>
+                    </Table.Tr>
+                  ))}
+                </Table.Tbody>
+              </Table>
+            )}
+
+            <Group gap="xs">
+              <TextInput
+                value={newClientName}
+                onChange={(event) =>
+                  setNewClientName(event.currentTarget.value)
+                }
+                placeholder={t("Name")}
+                aria-label={t("Trusted application name")}
+                maxLength={64}
+                style={{ flex: 1 }}
+              />
+              <TextInput
+                value={newClientOrigin}
+                onChange={(event) =>
+                  setNewClientOrigin(event.currentTarget.value)
+                }
+                placeholder="https://app.yourcompany.com"
+                aria-label={t("Trusted application origin")}
+                style={{ flex: 2 }}
+              />
+              <Button
+                variant="default"
+                onClick={handleAddTrustedClient}
+                disabled={!newClientName.trim() || !newClientOrigin.trim()}
+              >
+                {t("Add")}
+              </Button>
+            </Group>
+          </div>
         </div>
       )}
     </Stack>

apps/client/src/ee/ai/pages/ai-settings.tsx

@@ -1,5 +1,3 @@
-import { Helmet } from "react-helmet-async";
-import { getAppName } from "@/lib/config.ts";
 import SettingsTitle from "@/components/settings/settings-title.tsx";
 import React from "react";
 import useUserRole from "@/hooks/use-user-role.tsx";
@@ -15,6 +13,7 @@ import { Feature } from "@/ee/features";
 import { useUpgradeLabel } from "@/ee/hooks/use-upgrade-label";
 import { isCloud } from "@/lib/config.ts";
 import { useLocation, useNavigate } from "react-router-dom";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function AiSettings() {
   const { t } = useTranslation();
@@ -40,9 +39,7 @@ export default function AiSettings() {
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title="AI settings" />
-        <title>AI settings - {getAppName()}</title>
-      </Helmet>
       <SettingsTitle title={t("AI settings")} />
 
       <Tabs color="dark" value={activeTab} onChange={handleTabChange}>

apps/client/src/ee/api-key/pages/user-api-keys.tsx

@@ -1,10 +1,9 @@
 import React, { useState } from "react";
-import { Anchor, Alert, Button, Group, Space, Text } from "@mantine/core";
+import { Anchor, Alert, Button, Group, Space, Tabs, Text } from "@mantine/core";
 import { IconInfoCircle } from "@tabler/icons-react";
-import { Helmet } from "react-helmet-async";
 import { Trans, useTranslation } from "react-i18next";
 import SettingsTitle from "@/components/settings/settings-title";
-import { getAppName, getAppUrl } from "@/lib/config";
+import { getAppUrl } from "@/lib/config";
 import { ApiKeyTable } from "@/ee/api-key/components/api-key-table";
 import { CreateApiKeyModal } from "@/ee/api-key/components/create-api-key-modal";
 import { ApiKeyCreatedModal } from "@/ee/api-key/components/api-key-created-modal";
@@ -17,6 +16,9 @@ import { IApiKey } from "@/ee/api-key";
 import { useAtom } from "jotai";
 import { workspaceAtom } from "@/features/user/atoms/current-user-atom.ts";
 import useUserRole from "@/hooks/use-user-role.tsx";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
+import { useLocation, useNavigate } from "react-router-dom";
+import { AuthorizedAppsPanel } from "@/ee/oauth/components/authorized-apps-panel.tsx";
 
 export default function UserApiKeys() {
   const { t } = useTranslation();
@@ -29,6 +31,11 @@ export default function UserApiKeys() {
   const { data, isLoading } = useGetApiKeysQuery({ cursor });
   const [workspace] = useAtom(workspaceAtom);
   const { isAdmin } = useUserRole();
+  const location = useLocation();
+  const navigate = useNavigate();
+  const activeTab = location.pathname.endsWith("/authorized-apps")
+    ? "authorized-apps"
+    : "api-keys";
   const mcpEnabled = workspace?.settings?.ai?.mcp === true;
   const restrictToAdmins = workspace?.settings?.api?.restrictToAdmins === true;
   const canCreate = !restrictToAdmins || isAdmin;
@@ -47,30 +54,27 @@ export default function UserApiKeys() {
     setRevokeModalOpened(true);
   };
 
+  const handleTabChange = (value: string | null) => {
+    navigate(
+      value === "authorized-apps"
+        ? "/settings/account/api-keys/authorized-apps"
+        : "/settings/account/api-keys",
+    );
+  };
+
   return (
     <>
-      <Helmet>
+      <DocumentTitle
-        <title>
+        title={activeTab === "authorized-apps" ? t("Authorized apps") : t("API keys")}
-          {t("API keys")} - {getAppName()}
+      />
-        </title>
-      </Helmet>
 
       <SettingsTitle title={t("API keys")} />
 
-      <Text size="sm" c="dimmed" mb="md">
+      {mcpEnabled && (
-        <Trans
-          i18nKey="View the <anchor>API documentation</anchor> for usage details."
-          components={{
-            anchor: <Anchor href="https://docmost.com/api-docs" target="_blank" size="sm" />,
-          }}
-        />
-      </Text>
-
-      {mcpEnabled && canCreate && (
         <Alert variant="light" color="blue" mb="md" p="sm" icon={<IconInfoCircle />}>
           <Text size="sm">
             {t(
-              "Your workspace has MCP enabled. Use your API key to connect AI assistants.",
+              "Your workspace has MCP enabled. Connect AI assistants with your Docmost account, or with an API key.",
             )}{" "}
             <Anchor
               href="https://docmost.com/docs/user-guide/mcp"
@@ -89,37 +93,70 @@ export default function UserApiKeys() {
         </Alert>
       )}
 
-      {canCreate ? (
+      <Tabs color="dark" value={activeTab} onChange={handleTabChange}>
-        <Group justify="flex-end" mb="md">
+        <Tabs.List>
-          <Button onClick={() => setCreateModalOpened(true)}>
+          <Tabs.Tab fw={500} value="api-keys">
-            {t("Create API Key")}
+            {t("API keys")}
-          </Button>
+          </Tabs.Tab>
-        </Group>
+          <Tabs.Tab fw={500} value="authorized-apps">
-      ) : restrictToAdmins ? (
+            {t("Authorized apps")}
-        <Alert variant="light" color="yellow" mb="md" p="sm" icon={<IconInfoCircle />}>
+          </Tabs.Tab>
-          <Text size="sm">
+        </Tabs.List>
-            {t("API key creation is restricted to admins by your workspace administrator.")}
+
+        <Tabs.Panel value="api-keys" pt="md">
+
+        <Group justify="space-between" align="center" mb="md">
+          <Text size="sm" c="dimmed">
+            <Trans
+              i18nKey="View the <anchor>API documentation</anchor> for usage details."
+              components={{
+                anchor: <Anchor href="https://docmost.com/api-docs" target="_blank" size="sm" />,
+              }}
+            />
           </Text>
-        </Alert>
-      ) : null}
 
-      <ApiKeyTable
+          {canCreate && (
-        apiKeys={data?.items || []}
+            <Button
-        isLoading={isLoading}
+              onClick={() => setCreateModalOpened(true)}
-        onUpdate={handleUpdate}
+              style={{ flexShrink: 0 }}
-        onRevoke={handleRevoke}
+            >
-      />
+              {t("Create API Key")}
+            </Button>
+          )}
+        </Group>
 
-      <Space h="md" />
+        {!canCreate && restrictToAdmins && (
+          <Alert variant="light" color="yellow" mb="md" p="sm" icon={<IconInfoCircle />}>
+            <Text size="sm">
+              {t("API key creation is restricted to admins by your workspace administrator.")}
+            </Text>
+          </Alert>
+        )}
 
-      {data?.items.length > 0 && (
+        <ApiKeyTable
-        <Paginate
+          apiKeys={data?.items || []}
-          hasPrevPage={data?.meta?.hasPrevPage}
+          isLoading={isLoading}
-          hasNextPage={data?.meta?.hasNextPage}
+          onUpdate={handleUpdate}
-          onNext={() => goNext(data?.meta?.nextCursor)}
+          onRevoke={handleRevoke}
-          onPrev={goPrev}
         />
-      )}
+
+        <Space h="md" />
+
+        {data?.items.length > 0 && (
+          <Paginate
+            hasPrevPage={data?.meta?.hasPrevPage}
+            hasNextPage={data?.meta?.hasNextPage}
+            onNext={() => goNext(data?.meta?.nextCursor)}
+            onPrev={goPrev}
+          />
+        )}
+
+        </Tabs.Panel>
+
+        <Tabs.Panel value="authorized-apps" pt="md">
+          <AuthorizedAppsPanel />
+        </Tabs.Panel>
+      </Tabs>
 
       <CreateApiKeyModal
         opened={createModalOpened}

apps/client/src/ee/api-key/pages/workspace-api-keys.tsx

@@ -1,9 +1,7 @@
 import React, { useState } from "react";
 import { Anchor, Button, Divider, Group, Space, Text } from "@mantine/core";
-import { Helmet } from "react-helmet-async";
 import { Trans, useTranslation } from "react-i18next";
 import SettingsTitle from "@/components/settings/settings-title";
-import { getAppName } from "@/lib/config";
 import { ApiKeyTable } from "@/ee/api-key/components/api-key-table";
 import { CreateApiKeyModal } from "@/ee/api-key/components/create-api-key-modal";
 import { ApiKeyCreatedModal } from "@/ee/api-key/components/api-key-created-modal";
@@ -15,6 +13,7 @@ import { useGetApiKeysQuery } from "@/ee/api-key/queries/api-key-query.ts";
 import { IApiKey } from "@/ee/api-key";
 import useUserRole from '@/hooks/use-user-role.tsx';
 import RestrictApiToAdmins from "@/ee/api-key/components/restrict-api-to-admins";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function WorkspaceApiKeys() {
   const { t } = useTranslation();
@@ -47,11 +46,7 @@ export default function WorkspaceApiKeys() {
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title={t("API management")} />
-        <title>
-          {t("API management")} - {getAppName()}
-        </title>
-      </Helmet>
 
       <SettingsTitle title={t("API management")} />
 

apps/client/src/ee/audit/pages/audit-logs.tsx

@@ -10,11 +10,9 @@ import {
   Text,
   Tooltip,
 } from "@mantine/core";
-import { Helmet } from "react-helmet-async";
 import { useTranslation } from "react-i18next";
 import { IconSettings } from "@tabler/icons-react";
 import SettingsTitle from "@/components/settings/settings-title";
-import { getAppName } from "@/lib/config";
 import Paginate from "@/components/common/paginate";
 import { useCursorPaginate } from "@/hooks/use-cursor-paginate";
 import {
@@ -26,6 +24,7 @@ import { IAuditLogParams } from "@/ee/audit/types/audit.types";
 import { eventFilterOptions } from "@/ee/audit/lib/audit-event-labels";
 import AuditLogsTable from "@/ee/audit/components/audit-logs-table";
 import useUserRole from "@/hooks/use-user-role";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 type RetentionUnit = "days" | "months" | "years";
 
@@ -97,11 +96,7 @@ export default function AuditLogs() {
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title={t("Audit log")} />
-        <title>
-          {t("Audit log")} - {getAppName()}
-        </title>
-      </Helmet>
 
       <SettingsTitle title={t("Audit log")} />
 

apps/client/src/ee/billing/pages/billing.tsx

@@ -1,5 +1,3 @@
-import { Helmet } from "react-helmet-async";
-import { getAppName } from "@/lib/config.ts";
 import SettingsTitle from "@/components/settings/settings-title.tsx";
 import BillingPlans from "@/ee/billing/components/billing-plans.tsx";
 import BillingTrial from "@/ee/billing/components/billing-trial.tsx";
@@ -9,6 +7,7 @@ import React from "react";
 import BillingDetails from "@/ee/billing/components/billing-details.tsx";
 import { useBillingQuery } from "@/ee/billing/queries/billing-query.ts";
 import useUserRole from "@/hooks/use-user-role.tsx";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function Billing() {
   const { data: billing, isError: isBillingError } = useBillingQuery();
@@ -20,9 +19,7 @@ export default function Billing() {
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title="Billing" />
-        <title>Billing - {getAppName()}</title>
-      </Helmet>
       <SettingsTitle title="Billing" />
 
       <BillingTrial />

apps/client/src/ee/features.ts

@@ -22,4 +22,5 @@ export const Feature = {
   PERSONAL_SPACES: 'spaces:personal',
   DOCX_EXPORT: 'export:docx',
   BASES: 'bases',
+  OAUTH: 'oauth',
 } as const;

apps/client/src/ee/licence/pages/license.tsx

@@ -1,5 +1,3 @@
-import { Helmet } from "react-helmet-async";
-import { getAppName } from "@/lib/config.ts";
 import SettingsTitle from "@/components/settings/settings-title.tsx";
 import React from "react";
 import useUserRole from "@/hooks/use-user-role.tsx";
@@ -9,6 +7,7 @@ import InstallationDetails from "@/ee/licence/components/installation-details.ts
 import OssDetails from "@/ee/licence/components/oss-details.tsx";
 import { useAtom } from "jotai/index";
 import { entitlementAtom } from "@/ee/entitlement/entitlement-atom";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function License() {
   const [entitlements] = useAtom(entitlementAtom);
@@ -21,9 +20,7 @@ export default function License() {
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title="License" />
-        <title>License - {getAppName()}</title>
-      </Helmet>
       <SettingsTitle title="License" />
 
       <ActivateLicenseForm />

apps/client/src/ee/oauth/components/authorized-apps-panel.tsx

@@ -0,0 +1,19 @@
+import { Text } from "@mantine/core";
+import { useTranslation } from "react-i18next";
+import { OAuthGrantsTable } from "@/ee/oauth/components/oauth-grants-table";
+import { useOAuthGrantsQuery } from "@/ee/oauth/queries/oauth-query";
+
+export function AuthorizedAppsPanel() {
+  const { t } = useTranslation();
+  const { data, isLoading } = useOAuthGrantsQuery();
+
+  return (
+    <>
+      <Text size="sm" c="dimmed" mb="md">
+        {t("Applications and AI assistants you have authorized to access your account.")}
+      </Text>
+
+      <OAuthGrantsTable grants={data || []} isLoading={isLoading} />
+    </>
+  );
+}

apps/client/src/ee/oauth/components/oauth-grants-table.tsx

@@ -0,0 +1,178 @@
+import { ActionIcon, Badge, Group, Skeleton, Table, Text, Tooltip } from "@mantine/core";
+import { IconTrash } from "@tabler/icons-react";
+import { modals } from "@mantine/modals";
+import { useTranslation } from "react-i18next";
+import NoTableResults from "@/components/common/no-table-results";
+import { formatLocalized, useDateFnsLocale } from "@/lib/date-locale.ts";
+import { IOAuthGrant } from "@/ee/oauth/types/oauth.types";
+import { useRevokeOAuthGrantMutation } from "@/ee/oauth/queries/oauth-query";
+
+// Callback hosts identify the app; the full URL belongs on the consent screen.
+function callbackHosts(redirectUris: string[] = []): string[] {
+  const hosts = redirectUris.map((uri) => {
+    try {
+      const url = new URL(uri);
+      return url.protocol === "http:" || url.protocol === "https:"
+        ? url.host
+        : url.protocol;
+    } catch {
+      return uri;
+    }
+  });
+  return Array.from(new Set(hosts));
+}
+
+type OAuthGrantsTableProps = {
+  grants: IOAuthGrant[];
+  isLoading?: boolean;
+};
+
+function TableSkeleton() {
+  return (
+    <>
+      {Array.from({ length: 3 }).map((_, i) => (
+        <Table.Tr key={i}>
+          <Table.Td>
+            <Skeleton height={14} width={140} />
+          </Table.Td>
+          <Table.Td>
+            <Group gap={4}>
+              <Skeleton height={20} width={50} />
+              <Skeleton height={20} width={55} />
+            </Group>
+          </Table.Td>
+          <Table.Td>
+            <Skeleton height={14} width={90} />
+          </Table.Td>
+          <Table.Td>
+            <Skeleton height={14} width={90} />
+          </Table.Td>
+          <Table.Td>
+            <Skeleton height={28} width={28} circle />
+          </Table.Td>
+        </Table.Tr>
+      ))}
+    </>
+  );
+}
+
+export function OAuthGrantsTable({ grants, isLoading }: OAuthGrantsTableProps) {
+  const { t } = useTranslation();
+  const locale = useDateFnsLocale();
+  const revokeMutation = useRevokeOAuthGrantMutation();
+
+  const scopeMeta: Record<string, { color: string; label: string }> = {
+    read: { color: "blue", label: t("Read") },
+    write: { color: "orange", label: t("Write") },
+  };
+
+  const formatDate = (date: string | null) => {
+    if (!date) return t("Never");
+    return formatLocalized(date, "MMM dd, yyyy", "PP", locale);
+  };
+
+  const openRevokeModal = (grant: IOAuthGrant) =>
+    modals.openConfirmModal({
+      title: t("Revoke access"),
+      centered: true,
+      children: (
+        <Text size="sm">
+          {t(
+            "Are you sure you want to revoke access for {{name}}? The application will no longer be able to access your account.",
+            { name: grant.clientName },
+          )}
+        </Text>
+      ),
+      labels: { confirm: t("Revoke access"), cancel: t("Cancel") },
+      confirmProps: { color: "red" },
+      onConfirm: () => revokeMutation.mutate(grant.id),
+    });
+
+  return (
+    <Table.ScrollContainer minWidth={600}>
+      <Table highlightOnHover verticalSpacing="sm">
+        <Table.Thead>
+          <Table.Tr>
+            <Table.Th>{t("Application")}</Table.Th>
+            <Table.Th>{t("Permissions")}</Table.Th>
+            <Table.Th>{t("Authorized")}</Table.Th>
+            <Table.Th>{t("Last used")}</Table.Th>
+            <Table.Th aria-label={t("Action")} />
+          </Table.Tr>
+        </Table.Thead>
+
+        <Table.Tbody>
+          {isLoading ? (
+            <TableSkeleton />
+          ) : grants.length > 0 ? (
+            grants.map((grant) => (
+              <Table.Tr key={grant.id}>
+                <Table.Td>
+                  <Text fz="sm" fw={500}>
+                    {grant.clientName}
+                  </Text>
+                  <Text
+                    fz="xs"
+                    c="dimmed"
+                    title={grant.redirectUris?.join("\n")}
+                    style={{ overflowWrap: "anywhere" }}
+                  >
+                    {callbackHosts(grant.redirectUris).join(", ")}
+                  </Text>
+                </Table.Td>
+
+                <Table.Td>
+                  <Group gap={4}>
+                    {grant.scopes.map((scope) => {
+                      const meta = scopeMeta[scope];
+                      if (!meta) return null;
+                      return (
+                        <Badge
+                          key={scope}
+                          variant="light"
+                          color={meta.color}
+                          size="sm"
+                        >
+                          {meta.label}
+                        </Badge>
+                      );
+                    })}
+                  </Group>
+                </Table.Td>
+
+                <Table.Td>
+                  <Text fz="sm" style={{ whiteSpace: "nowrap" }}>
+                    {formatDate(grant.createdAt)}
+                  </Text>
+                </Table.Td>
+
+                <Table.Td>
+                  <Text fz="sm" style={{ whiteSpace: "nowrap" }}>
+                    {formatDate(grant.lastUsedAt)}
+                  </Text>
+                </Table.Td>
+
+                <Table.Td>
+                  <Tooltip label={t("Revoke access")}>
+                    <ActionIcon
+                      variant="subtle"
+                      color="red"
+                      aria-label={t("Revoke access for {{name}}", {
+                        name: grant.clientName,
+                      })}
+                      onClick={() => openRevokeModal(grant)}
+                    >
+                      <IconTrash size={16} />
+                    </ActionIcon>
+                  </Tooltip>
+                </Table.Td>
+              </Table.Tr>
+            ))
+          ) : (
+            <NoTableResults colSpan={5} text={t("No authorized apps yet.")} />
+          )}
+        </Table.Tbody>
+      </Table>
+    </Table.ScrollContainer>
+  );
+}

apps/client/src/ee/oauth/pages/oauth-consent.tsx

@@ -0,0 +1,353 @@
+import React, { useEffect, useMemo, useState } from "react";
+import {
+  Alert,
+  Anchor,
+  Box,
+  Button,
+  Center,
+  Checkbox,
+  Container,
+  Divider,
+  Group,
+  Loader,
+  Paper,
+  Stack,
+  Text,
+  ThemeIcon,
+  Title,
+} from "@mantine/core";
+import { notifications } from "@mantine/notifications";
+import {
+  IconAlertTriangle,
+  IconEye,
+  IconInfoCircle,
+  IconPencil,
+} from "@tabler/icons-react";
+import { useQuery } from "@tanstack/react-query";
+import { useAtom } from "jotai";
+import { RESET } from "jotai/utils";
+import { useTranslation } from "react-i18next";
+import { useLocation, useSearchParams } from "react-router-dom";
+import { AuthLayout } from "@/features/auth/components/auth-layout.tsx";
+import classes from "@/features/auth/components/auth.module.css";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
+import { UserInfo } from "@/components/common/user-info.tsx";
+import useCurrentUser from "@/features/user/hooks/use-current-user";
+import { currentUserAtom } from "@/features/user/atoms/current-user-atom";
+import { logout } from "@/features/auth/services/auth-service";
+import { ICurrentUser } from "@/features/user/types/user.types";
+import APP_ROUTE from "@/lib/app-route.ts";
+import {
+  approveOAuthAuthorization,
+  getOAuthAuthorizeInfo,
+} from "@/ee/oauth/services/oauth-service";
+import {
+  IApproveAuthorizationPayload,
+  IAuthorizeParams,
+  IOAuthAuthorizeInfo,
+} from "@/ee/oauth/types/oauth.types";
+
+function loginRedirectUrl(pathname: string, search: string): string {
+  return `${APP_ROUTE.AUTH.LOGIN}?redirect=${encodeURIComponent(pathname + search)}`;
+}
+
+function errorStatus(error: any): number | undefined {
+  return error?.response?.status;
+}
+
+function errorText(error: any): string | undefined {
+  const data = error?.response?.data;
+  if (typeof data?.error_description === "string") return data.error_description;
+  if (Array.isArray(data?.message)) return data.message.join(", ");
+  return data?.message;
+}
+
+const OAUTH_PARAM_NAMES = [
+  "response_type",
+  "client_id",
+  "redirect_uri",
+  "state",
+  "code_challenge",
+  "code_challenge_method",
+  "scope",
+  "resource",
+];
+
+function pickOAuthParams(params: IAuthorizeParams): IAuthorizeParams {
+  const picked: IAuthorizeParams = {};
+  for (const name of OAUTH_PARAM_NAMES) {
+    if (params[name] !== undefined) {
+      picked[name] = params[name];
+    }
+  }
+  return picked;
+}
+
+export default function OAuthConsent() {
+  const { t } = useTranslation();
+  const location = useLocation();
+  const [searchParams] = useSearchParams();
+
+  const params = useMemo<IAuthorizeParams>(
+    () => Object.fromEntries(searchParams.entries()),
+    [searchParams],
+  );
+
+  const currentUserQuery = useCurrentUser();
+  const infoQuery = useQuery({
+    queryKey: ["oauth-authorize-info", params],
+    queryFn: () => getOAuthAuthorizeInfo(params),
+  });
+
+  const isUnauthenticated =
+    errorStatus(currentUserQuery.error) === 401 ||
+    errorStatus(infoQuery.error) === 401;
+
+  useEffect(() => {
+    if (isUnauthenticated) {
+      window.location.replace(
+        loginRedirectUrl(location.pathname, location.search),
+      );
+    }
+  }, [isUnauthenticated, location.pathname, location.search]);
+
+  const isLoading =
+    isUnauthenticated || currentUserQuery.isLoading || infoQuery.isLoading;
+
+  return (
+    <AuthLayout>
+      <DocumentTitle title={t("Authorize application")} />
+      <Container size={460} className={classes.container}>
+        <Box p="xl">
+          {isLoading ? (
+            <Center mih={200}>
+              <Loader />
+            </Center>
+          ) : infoQuery.data && currentUserQuery.data ? (
+            <ConsentCard
+              info={infoQuery.data}
+              currentUser={currentUserQuery.data}
+              params={params}
+            />
+          ) : (
+            <InvalidRequestCard
+              description={errorText(infoQuery.error ?? currentUserQuery.error)}
+            />
+          )}
+        </Box>
+      </Container>
+    </AuthLayout>
+  );
+}
+
+function InvalidRequestCard({ description }: { description?: string }) {
+  const { t } = useTranslation();
+
+  return (
+    <Stack align="center" gap="sm">
+      <ThemeIcon size={48} radius="xl" variant="light" color="red">
+        <IconAlertTriangle size={26} stroke={1.5} />
+      </ThemeIcon>
+      <Title order={3} ta="center" fw={600}>
+        {t("Invalid authorization request")}
+      </Title>
+      {description && (
+        <Text size="sm" c="dimmed" ta="center">
+          {description}
+        </Text>
+      )}
+    </Stack>
+  );
+}
+
+type ConsentCardProps = {
+  info: IOAuthAuthorizeInfo;
+  currentUser: ICurrentUser;
+  params: IAuthorizeParams;
+};
+
+function ConsentCard({ info, currentUser, params }: ConsentCardProps) {
+  const { t } = useTranslation();
+  const location = useLocation();
+  const [, setCurrentUser] = useAtom(currentUserAtom);
+  const [approvedScopes, setApprovedScopes] = useState<string[]>(
+    info.scopes.filter((scope) => scope === "read" || scope === "write"),
+  );
+  const [submitting, setSubmitting] = useState<"approve" | "deny" | null>(null);
+  const [acknowledged, setAcknowledged] = useState(false);
+
+  const scopeRows = [
+    {
+      scope: "read",
+      icon: <IconEye size={16} stroke={1.5} />,
+      label: t("Read"),
+      description: t("View data in your workspace without making changes."),
+    },
+    {
+      scope: "write",
+      icon: <IconPencil size={16} stroke={1.5} />,
+      label: t("Write"),
+      description: t("Create and modify data in your workspace."),
+    },
+  ];
+
+  function toggleScope(scope: string, checked: boolean) {
+    setApprovedScopes((prev) =>
+      checked ? [...prev, scope] : prev.filter((item) => item !== scope),
+    );
+  }
+
+  async function submitDecision(approved: boolean) {
+    setSubmitting(approved ? "approve" : "deny");
+    const oauthParams = pickOAuthParams(params);
+    const payload: IApproveAuthorizationPayload = approved
+      ? { ...oauthParams, approved: true, approvedScopes }
+      : { ...oauthParams, approved: false };
+
+    try {
+      const res = await approveOAuthAuthorization(payload);
+      window.location.replace(res.redirectUrl);
+    } catch (err) {
+      if (errorStatus(err) === 401) {
+        window.location.replace(
+          loginRedirectUrl(location.pathname, location.search),
+        );
+        return;
+      }
+      setSubmitting(null);
+      notifications.show({
+        message: errorText(err) || t("Something went wrong. Please try again."),
+        color: "red",
+      });
+    }
+  }
+
+  async function switchAccount() {
+    if (submitting !== null) {
+      return;
+    }
+    setCurrentUser(RESET);
+    try {
+      await logout();
+    } finally {
+      window.location.replace(
+        loginRedirectUrl(location.pathname, location.search),
+      );
+    }
+  }
+
+  return (
+    <Stack gap="lg">
+      <Title order={3} ta="center" fw={600}>
+        {t("{{name}} wants to access {{workspace}}", {
+          name: info.clientName,
+          workspace: currentUser.workspace.name,
+        })}
+      </Title>
+
+      <Paper withBorder radius="md" p="sm">
+        <Group justify="space-between" wrap="nowrap">
+          <UserInfo user={currentUser.user} />
+          <Anchor
+            component="button"
+            type="button"
+            size="xs"
+            c="dimmed"
+            disabled={submitting !== null}
+            onClick={switchAccount}
+            style={{ whiteSpace: "nowrap" }}
+          >
+            {t("Not you? Switch account")}
+          </Anchor>
+        </Group>
+      </Paper>
+
+      <Divider />
+
+      <Stack gap="sm">
+        <Text size="sm" fw={500}>
+          {t("This application will be able to:")}
+        </Text>
+        {scopeRows.map((row) => {
+          const requested = info.scopes.includes(row.scope);
+          return (
+            <Checkbox
+              key={row.scope}
+              size="sm"
+              checked={approvedScopes.includes(row.scope)}
+              disabled={!requested || submitting !== null}
+              onChange={(event) =>
+                toggleScope(row.scope, event.currentTarget.checked)
+              }
+              label={
+                <Group gap={6} wrap="nowrap">
+                  {row.icon}
+                  <Text size="sm" fw={500}>
+                    {row.label}
+                  </Text>
+                </Group>
+              }
+              description={row.description}
+            />
+          );
+        })}
+      </Stack>
+
+      <div>
+        <Text size="xs" c="dimmed">
+          {t("You will be redirected to")}
+        </Text>
+        <Text size="xs" ff="monospace" style={{ overflowWrap: "anywhere" }}>
+          {info.redirectUri}
+        </Text>
+      </div>
+
+      {!info.verified && (
+        <Alert
+          variant="light"
+          color="yellow"
+          icon={<IconInfoCircle size={16} />}
+        >
+          <Stack gap="xs">
+            <Text size="sm">
+              {t(
+                "This application is not on your workspace's trusted list. Authorize only if you recognize it.",
+              )}
+            </Text>
+            <Checkbox
+              size="sm"
+              checked={acknowledged}
+              disabled={submitting !== null}
+              onChange={(event) =>
+                setAcknowledged(event.currentTarget.checked)
+              }
+              label={t("I recognize this application and want to continue")}
+            />
+          </Stack>
+        </Alert>
+      )}
+
+      <Group grow>
+        <Button
+          variant="default"
+          onClick={() => submitDecision(false)}
+          loading={submitting === "deny"}
+          disabled={submitting === "approve"}
+        >
+          {t("Cancel")}
+        </Button>
+        <Button
+          onClick={() => submitDecision(true)}
+          loading={submitting === "approve"}
+          disabled={
+            approvedScopes.length === 0 ||
+            (!info.verified && !acknowledged) ||
+            submitting === "deny"
+          }
+        >
+          {t("Authorize")}
+        </Button>
+      </Group>
+    </Stack>
+  );
+}

apps/client/src/ee/oauth/queries/oauth-query.ts

@@ -0,0 +1,45 @@
+import {
+  useMutation,
+  useQuery,
+  useQueryClient,
+  UseQueryResult,
+} from "@tanstack/react-query";
+import {
+  getOAuthGrants,
+  revokeOAuthGrant,
+} from "@/ee/oauth/services/oauth-service";
+import { IOAuthGrant } from "@/ee/oauth/types/oauth.types";
+import { notifications } from "@mantine/notifications";
+import { useTranslation } from "react-i18next";
+
+export function useOAuthGrantsQuery(): UseQueryResult<IOAuthGrant[], Error> {
+  return useQuery({
+    queryKey: ["oauth-grants"],
+    queryFn: () => getOAuthGrants(),
+    staleTime: 0,
+    gcTime: 0,
+  });
+}
+
+export function useRevokeOAuthGrantMutation() {
+  const queryClient = useQueryClient();
+  const { t } = useTranslation();
+
+  return useMutation<void, Error, string>({
+    mutationFn: (grantId) => revokeOAuthGrant(grantId),
+    onSuccess: () => {
+      notifications.show({ message: t("Access revoked") });
+      queryClient.invalidateQueries({
+        predicate: (item) =>
+          ["oauth-grants"].includes(item.queryKey[0] as string),
+      });
+    },
+    onError: (error) => {
+      const errorMessage = error["response"]?.data?.message;
+      notifications.show({
+        message: errorMessage || t("Something went wrong. Please try again."),
+        color: "red",
+      });
+    },
+  });
+}

apps/client/src/ee/oauth/services/oauth-service.ts

@@ -0,0 +1,36 @@
+import api from "@/lib/api-client";
+import {
+  IApproveAuthorizationPayload,
+  IAuthorizeParams,
+  IOAuthAuthorizeInfo,
+  IOAuthGrant,
+} from "@/ee/oauth/types/oauth.types";
+
+export async function getOAuthAuthorizeInfo(
+  params: IAuthorizeParams,
+): Promise<IOAuthAuthorizeInfo> {
+  const req = await api.post<IOAuthAuthorizeInfo>(
+    "/oauth/authorize-info",
+    params,
+  );
+  return req.data;
+}
+
+export async function approveOAuthAuthorization(
+  payload: IApproveAuthorizationPayload,
+): Promise<{ redirectUrl: string }> {
+  const req = await api.post<{ redirectUrl: string }>(
+    "/oauth/authorize",
+    payload,
+  );
+  return req.data;
+}
+
+export async function getOAuthGrants(): Promise<IOAuthGrant[]> {
+  const req = await api.post<IOAuthGrant[]>("/oauth/grants", {});
+  return req.data;
+}
+
+export async function revokeOAuthGrant(grantId: string): Promise<void> {
+  await api.post("/oauth/grants/revoke", { grantId });
+}

apps/client/src/ee/oauth/types/oauth.types.ts

@@ -0,0 +1,24 @@
+export interface IOAuthAuthorizeInfo {
+  clientName: string;
+  redirectUri: string;
+  scopes: string[];
+  clientCreatedAt: string;
+  verified: boolean;
+}
+
+export interface IOAuthGrant {
+  id: string;
+  clientName: string;
+  redirectUris: string[];
+  scopes: string[];
+  createdAt: string;
+  lastUsedAt: string | null;
+}
+
+export type IAuthorizeParams = Record<string, string>;
+
+export type IApproveAuthorizationPayload = {
+  [param: string]: unknown;
+  approved: boolean;
+  approvedScopes?: string[];
+};

apps/client/src/ee/page-verification/pages/verified-pages.tsx

@@ -1,17 +1,16 @@
 import { useState, useMemo } from "react";
 import { Group, MultiSelect, Select, Space, TextInput } from "@mantine/core";
 import { useDebouncedValue } from "@mantine/hooks";
-import { Helmet } from "react-helmet-async";
 import { useTranslation } from "react-i18next";
 import { IconSearch } from "@tabler/icons-react";
 import SettingsTitle from "@/components/settings/settings-title";
-import { getAppName } from "@/lib/config";
 import Paginate from "@/components/common/paginate";
 import { useCursorPaginate } from "@/hooks/use-cursor-paginate";
 import { useVerificationListQuery } from "@/ee/page-verification/queries/page-verification-query";
 import { IVerificationListParams } from "@/ee/page-verification/types/page-verification.types";
 import VerificationListTable from "@/ee/page-verification/components/verification-list-table";
 import { useGetSpacesQuery } from "@/features/space/queries/space-query";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function VerifiedPages() {
   const { t } = useTranslation();
@@ -68,11 +67,7 @@ export default function VerifiedPages() {
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title={t("Verified pages")} />
-        <title>
-          {t("Verified pages")} - {getAppName()}
-        </title>
-      </Helmet>
 
       <SettingsTitle title={t("Verified pages")} />
 

apps/client/src/ee/pages/cloud-login.tsx

@@ -1,18 +1,13 @@
-import { Helmet } from "react-helmet-async";
-import { getAppName } from "@/lib/config.ts";
 import { CloudLoginForm } from "@/ee/components/cloud-login-form.tsx";
 import { useTranslation } from "react-i18next";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function CloudLogin() {
   const { t } = useTranslation();
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title={t("Login")} />
-        <title>
-          {t("Login")} - {getAppName()}
-        </title>
-      </Helmet>
 
       <CloudLoginForm />
     </>

apps/client/src/ee/pages/create-workspace.tsx

@@ -1,14 +1,11 @@
 import { SetupWorkspaceForm } from "@/features/auth/components/setup-workspace-form.tsx";
-import { Helmet } from "react-helmet-async";
 import React from "react";
-import { getAppName } from "@/lib/config.ts";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function CreateWorkspace() {
   return (
     <>
-      <Helmet>
+      <DocumentTitle title="Create Workspace" />
-        <title>Create Workspace - {getAppName()}</title>
-      </Helmet>
       <SetupWorkspaceForm />
     </>
   );

apps/client/src/ee/security/pages/security.tsx

@@ -1,5 +1,4 @@
-import { Helmet } from "react-helmet-async";
+import { isCloud } from "@/lib/config.ts";
-import { getAppName, isCloud } from "@/lib/config.ts";
 import SettingsTitle from "@/components/settings/settings-title.tsx";
 import {
   Alert,
@@ -37,6 +36,7 @@ import EnableScim from "@/ee/scim/components/enable-scim";
 import { useCursorPaginate } from "@/hooks/use-cursor-paginate";
 import Paginate from "@/components/common/paginate";
 import { IScimToken } from "@/ee/scim/types/scim-token.types";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 const SCIM_TOKEN_LIMIT = 5;
 
@@ -64,9 +64,7 @@ export default function Security() {
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title="Security" />
-        <title>Security - {getAppName()}</title>
-      </Helmet>
       <SettingsTitle title={t("Security")} />
 
       <EnforceMfa />

apps/client/src/ee/template/components/readonly-template-editor.tsx

@@ -41,6 +41,7 @@ export default function ReadonlyTemplateEditor({
       <EditorProvider
         editable={false}
         immediatelyRender={true}
+        textDirection="auto"
         extensions={extensions}
         content={template.content}
       />

apps/client/src/ee/template/pages/template-editor.tsx

@@ -22,8 +22,6 @@ import { useTranslation } from "react-i18next";
 import { useDisclosure, useWindowEvent } from "@mantine/hooks";
 import { notifications } from "@mantine/notifications";
 import { Link, useParams } from "react-router-dom";
-import { Helmet } from "react-helmet-async";
-import { getAppName } from "@/lib/config";
 import { useEditor, EditorContent } from "@tiptap/react";
 import { templateExtensions } from "@/features/editor/extensions/extensions";
 import {
@@ -44,6 +42,7 @@ import CalloutMenu from "@/features/editor/components/callout/callout-menu.tsx";
 import ColumnsMenu from "@/features/editor/components/columns/columns-menu.tsx";
 
 import classes from "./template-editor.module.css";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function TemplateEditor() {
   const { t } = useTranslation();
@@ -88,6 +87,7 @@ export default function TemplateEditor() {
   const editor = useEditor({
     extensions: templateExtensions,
     content: "",
+    textDirection: "auto",
     editorProps: {
       scrollThreshold: 80,
       scrollMargin: 80,
@@ -247,11 +247,7 @@ export default function TemplateEditor() {
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title={t("Edit template")} />
-        <title>
-          {t("Edit template")} - {getAppName()}
-        </title>
-      </Helmet>
 
       {editorToolbarEnabled && editor && (
         <FixedToolbar editor={editor} templateMode />

apps/client/src/ee/template/pages/template-list.tsx

@@ -13,11 +13,9 @@ import {
 } from "@mantine/core";
 import { modals } from "@mantine/modals";
 import { IconPlus } from "@tabler/icons-react";
-import { Helmet } from "react-helmet-async";
 import { useTranslation } from "react-i18next";
 import { useNavigate } from "react-router-dom";
 import { useDisclosure } from "@mantine/hooks";
-import { getAppName } from "@/lib/config";
 import {
   useGetTemplatesQuery,
   useDeleteTemplateMutation,
@@ -31,6 +29,7 @@ import useUserRole from "@/hooks/use-user-role";
 import CreateTemplateModal from "@/ee/template/components/create-template-modal";
 import { useAtomValue } from "jotai";
 import { workspaceAtom } from "@/features/user/atoms/current-user-atom";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function TemplateList() {
   const { t } = useTranslation();
@@ -102,11 +101,7 @@ export default function TemplateList() {
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title={t("Templates")} />
-        <title>
-          {t("Templates")} - {getAppName()}
-        </title>
-      </Helmet>
 
       <Container size="900" pt="xl">
         <Group justify="space-between" mb="xl">

apps/client/src/features/attachments/components/attachment-file-icon.tsx

@@ -0,0 +1,59 @@
+import { ThemeIcon } from "@mantine/core";
+import {
+  IconFile,
+  IconFileTypeCsv,
+  IconFileTypeDocx,
+  IconFileTypePdf,
+  IconFileTypePpt,
+  IconFileTypeXls,
+  IconFileZip,
+  IconMovie,
+  IconMusic,
+  IconPhoto,
+  type Icon,
+} from "@tabler/icons-react";
+
+const EXT_ICONS: Record<string, { icon: Icon; color: string }> = {
+  ".pdf": { icon: IconFileTypePdf, color: "red" },
+  ".doc": { icon: IconFileTypeDocx, color: "blue" },
+  ".docx": { icon: IconFileTypeDocx, color: "blue" },
+  ".xls": { icon: IconFileTypeXls, color: "teal" },
+  ".xlsx": { icon: IconFileTypeXls, color: "teal" },
+  ".csv": { icon: IconFileTypeCsv, color: "teal" },
+  ".ppt": { icon: IconFileTypePpt, color: "orange" },
+  ".pptx": { icon: IconFileTypePpt, color: "orange" },
+  ".zip": { icon: IconFileZip, color: "gray" },
+  ".rar": { icon: IconFileZip, color: "gray" },
+  ".7z": { icon: IconFileZip, color: "gray" },
+  ".tar": { icon: IconFileZip, color: "gray" },
+  ".gz": { icon: IconFileZip, color: "gray" },
+};
+
+const MIME_ICONS: Array<{ prefix: string; icon: Icon; color: string }> = [
+  { prefix: "image/", icon: IconPhoto, color: "grape" },
+  { prefix: "video/", icon: IconMovie, color: "violet" },
+  { prefix: "audio/", icon: IconMusic, color: "pink" },
+];
+
+interface AttachmentFileIconProps {
+  fileExt?: string;
+  mimeType?: string;
+}
+
+export function AttachmentFileIcon({
+  fileExt,
+  mimeType,
+}: AttachmentFileIconProps) {
+  const byExt = fileExt ? EXT_ICONS[fileExt.toLowerCase()] : undefined;
+  const byMime = mimeType
+    ? MIME_ICONS.find((entry) => mimeType.startsWith(entry.prefix))
+    : undefined;
+  const { icon: FileIcon, color } = byExt ??
+    byMime ?? { icon: IconFile, color: "gray" };
+
+  return (
+    <ThemeIcon variant="light" color={color} size={40} radius="md">
+      <FileIcon size={22} stroke={1.5} />
+    </ThemeIcon>
+  );
+}

apps/client/src/features/attachments/components/page-attachments-modal.tsx

@@ -0,0 +1,191 @@
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import {
+  ActionIcon,
+  Anchor,
+  Center,
+  Group,
+  Loader,
+  Modal,
+  ScrollArea,
+  Text,
+  Tooltip,
+} from "@mantine/core";
+import { IconDownload } from "@tabler/icons-react";
+import { useTranslation } from "react-i18next";
+import { SearchInput } from "@/components/common/search-input.tsx";
+import { CustomAvatar } from "@/components/ui/custom-avatar.tsx";
+import { usePageAttachmentsQuery } from "@/features/attachments/queries/attachment-query.ts";
+import { IPageAttachment } from "@/features/attachments/types/attachment.types.ts";
+import { AttachmentFileIcon } from "@/features/attachments/components/attachment-file-icon.tsx";
+import { formatBytes } from "@/lib";
+import { getFileUrl } from "@/lib/config.ts";
+import { formattedDate } from "@/lib/time.ts";
+
+interface PageAttachmentsModalProps {
+  pageId: string;
+  open: boolean;
+  onClose: () => void;
+}
+
+export default function PageAttachmentsModal({
+  pageId,
+  open,
+  onClose,
+}: PageAttachmentsModalProps) {
+  const { t } = useTranslation();
+
+  return (
+    <Modal
+      opened={open}
+      onClose={onClose}
+      title={t("Attachments")}
+      size={800}
+      closeButtonProps={{ "aria-label": t("Close") }}
+    >
+      <PageAttachmentsList pageId={pageId} />
+    </Modal>
+  );
+}
+
+function PageAttachmentsList({ pageId }: { pageId: string }) {
+  const { t } = useTranslation();
+  const [search, setSearch] = useState("");
+  const {
+    data,
+    isLoading,
+    isError,
+    isFetching,
+    fetchNextPage,
+    hasNextPage,
+    isFetchingNextPage,
+  } = usePageAttachmentsQuery(pageId, search);
+
+  const attachments = useMemo(
+    () => data?.pages.flatMap((page) => page.items) ?? [],
+    [data],
+  );
+
+  const loadMoreRef = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    const sentinel = loadMoreRef.current;
+    if (!sentinel || !hasNextPage) return;
+
+    const observer = new IntersectionObserver(
+      (entries) => {
+        if (entries[0].isIntersecting && !isFetching) {
+          fetchNextPage();
+        }
+      },
+      { threshold: 0.1 },
+    );
+
+    observer.observe(sentinel);
+    return () => observer.disconnect();
+  }, [fetchNextPage, hasNextPage, isFetching]);
+
+  const handleSearch = useCallback((value: string) => setSearch(value), []);
+
+  return (
+    <>
+      <SearchInput
+        onSearch={handleSearch}
+        placeholder={t("Search attachments...")}
+      />
+
+      {isLoading ? (
+        <Center py="xl">
+          <Loader size="sm" />
+        </Center>
+      ) : isError ? (
+        <Center py="xl">
+          <Text size="sm" c="dimmed">
+            {t("Error loading attachments.")}
+          </Text>
+        </Center>
+      ) : attachments.length === 0 ? (
+        <Center py="xl">
+          <Text size="sm" c="dimmed">
+            {search
+              ? t("No results found")
+              : t("No attachments on this page yet.")}
+          </Text>
+        </Center>
+      ) : (
+        <ScrollArea.Autosize mah={480} type="scroll" scrollbarSize={5}>
+          {attachments.map((attachment) => (
+            <AttachmentRow key={attachment.id} attachment={attachment} />
+          ))}
+          {hasNextPage && <div ref={loadMoreRef} style={{ height: 1 }} />}
+          {isFetchingNextPage && (
+            <Center py="sm">
+              <Loader size="sm" />
+            </Center>
+          )}
+        </ScrollArea.Autosize>
+      )}
+    </>
+  );
+}
+
+function AttachmentRow({ attachment }: { attachment: IPageAttachment }) {
+  const { t } = useTranslation();
+  const fileUrl = getFileUrl(attachment.url);
+
+  return (
+    <Group wrap="nowrap" gap="md" py="sm" pr="xs">
+      <AttachmentFileIcon
+        fileExt={attachment.fileExt}
+        mimeType={attachment.mimeType}
+      />
+
+      <div style={{ flex: 1, minWidth: 0 }}>
+        <Anchor
+          href={fileUrl}
+          target="_blank"
+          rel="noopener noreferrer"
+          size="sm"
+          fw={500}
+          c="inherit"
+          truncate="end"
+          style={{ display: "block" }}
+        >
+          {attachment.fileName}
+        </Anchor>
+        <Text size="xs" c="dimmed" mt={2} truncate="end">
+          {formatBytes(Number(attachment.fileSize))}
+          {" · "}
+          {formattedDate(new Date(attachment.createdAt))}
+        </Text>
+      </div>
+
+      {attachment.creator && (
+        <Tooltip
+          label={t("Uploaded by {{name}}", { name: attachment.creator.name })}
+          withArrow
+        >
+          <CustomAvatar
+            avatarUrl={attachment.creator.avatarUrl}
+            name={attachment.creator.name}
+            size="sm"
+          />
+        </Tooltip>
+      )}
+
+      <Tooltip label={t("Download attachment")} withArrow>
+        <ActionIcon
+          component="a"
+          href={fileUrl}
+          download={attachment.fileName}
+          target="_blank"
+          rel="noopener noreferrer"
+          variant="subtle"
+          color="gray"
+          aria-label={t("Download {{name}}", { name: attachment.fileName })}
+        >
+          <IconDownload size={18} />
+        </ActionIcon>
+      </Tooltip>
+    </Group>
+  );
+}

apps/client/src/features/attachments/queries/attachment-query.ts

@@ -0,0 +1,25 @@
+import {
+  InfiniteData,
+  keepPreviousData,
+  useInfiniteQuery,
+  UseInfiniteQueryResult,
+} from "@tanstack/react-query";
+import { getPageAttachments } from "@/features/attachments/services/attachment-service.ts";
+import { IPageAttachment } from "@/features/attachments/types/attachment.types.ts";
+import { IPagination } from "@/lib/types.ts";
+
+export function usePageAttachmentsQuery(
+  pageId: string,
+  search?: string,
+): UseInfiniteQueryResult<InfiniteData<IPagination<IPageAttachment>, unknown>> {
+  return useInfiniteQuery({
+    queryKey: ["page-attachments", pageId, search],
+    queryFn: ({ pageParam }) =>
+      getPageAttachments(pageId, { cursor: pageParam, query: search }),
+    enabled: !!pageId,
+    gcTime: 0,
+    placeholderData: keepPreviousData,
+    initialPageParam: undefined,
+    getNextPageParam: (lastPage) => lastPage.meta?.nextCursor ?? undefined,
+  });
+}

apps/client/src/features/attachments/services/attachment-service.ts

@@ -3,7 +3,17 @@ import loadImage from "blueimp-load-image";
 import {
   AvatarIconType,
   IAttachment,
+  IPageAttachment,
 } from "@/features/attachments/types/attachment.types.ts";
+import { IPagination, QueryParams } from "@/lib/types.ts";
+
+export async function getPageAttachments(
+  pageId: string,
+  params?: QueryParams,
+): Promise<IPagination<IPageAttachment>> {
+  const req = await api.post("/pages/attachments", { pageId, ...params });
+  return req.data;
+}
 
 async function compressAndResizeIcon(
   file: File,

apps/client/src/features/attachments/services/index.ts

@@ -1,4 +1,5 @@
 export {
+  getPageAttachments,
   uploadIcon,
   uploadUserAvatar,
   uploadSpaceIcon,

apps/client/src/features/attachments/types/attachment.types.ts

@@ -15,6 +15,15 @@ export interface IAttachment {
   deletedAt: string | null;
 }
 
+export interface IPageAttachment extends IAttachment {
+  url: string;
+  creator: {
+    id: string;
+    name: string;
+    avatarUrl: string | null;
+  } | null;
+}
+
 export enum AvatarIconType {
   AVATAR = "avatar",
   SPACE_ICON = "space-icon",

apps/client/src/features/comment/components/comment-editor.tsx

@@ -103,6 +103,7 @@ const CommentEditor = forwardRef(
       },
       content: defaultContent,
       editable,
+      textDirection: "auto",
       immediatelyRender: true,
       shouldRerenderOnTransaction: false,
       autofocus: (autofocus && "end") || false,

apps/client/src/features/editor/components/fixed-toolbar/groups/more-inserts-group.tsx

@@ -12,6 +12,7 @@ import {
   IconMathFunction,
   IconRotate2,
   IconSitemap,
+  IconSuperscript,
   IconTable,
   IconTag,
 } from "@tabler/icons-react";
@@ -270,6 +271,12 @@ export const MoreInsertsGroup: FC<Props> = ({ editor, templateMode }) => {
         >
           {t("Math block")}
         </Menu.Item>
+        <Menu.Item
+          leftSection={<IconSuperscript size={16} />}
+          onClick={() => editor.chain().focus().addFootnote().run()}
+        >
+          {t("Footnote")}
+        </Menu.Item>
       </Menu.Dropdown>
     </Menu>
   );

apps/client/src/features/editor/components/slash-menu/menu-items.ts

@@ -30,6 +30,7 @@ import {
   IconTag,
   IconMoodSmile,
   IconRotate2,
+  IconSuperscript,
 } from "@tabler/icons-react";
 import {
   CommandProps,
@@ -177,6 +178,16 @@ const CommandGroups: SlashMenuGroupedItemsType = {
       command: ({ editor, range }: CommandProps) =>
         editor.chain().focus().deleteRange(range).setPageBreak().run(),
     },
+    {
+      title: "Footnote",
+      description: "Insert a footnote reference.",
+      searchTerms: ["footnote", "reference", "citation", "note"],
+      icon: IconSuperscript,
+      command: ({ editor, range }: CommandProps) => {
+        editor.chain().focus().deleteRange(range).run();
+        editor.commands.addFootnote();
+      },
+    },
     {
       title: "Image",
       description: "Upload any image from your device.",

apps/client/src/features/editor/components/transclusion/transclusion-content.tsx

@@ -40,6 +40,7 @@ export default function TransclusionContent({ content }: Props) {
       <EditorProvider
         editable={false}
         immediatelyRender={true}
+        textDirection="auto"
         extensions={extensions}
         content={content as any}
       />

apps/client/src/features/editor/extensions/extensions.ts

@@ -1,5 +1,6 @@
 import { markInputRule } from "@tiptap/core";
 import { StarterKit } from "@tiptap/starter-kit";
+import { Document } from "@tiptap/extension-document";
 import { Code } from "@tiptap/extension-code";
 import { TextAlign } from "@tiptap/extension-text-align";
 import { TaskList, TaskItem } from "@tiptap/extension-list";
@@ -63,6 +64,9 @@ import {
   TransclusionReference,
   TableView,
   BaseEmbed as BaseEmbedNode,
+  Footnotes,
+  Footnote,
+  FootnoteReference,
 } from "@docmost/editor-ext";
 import {
   randomElement,
@@ -132,6 +136,7 @@ lowlight.register("scala", scala);
 // @ts-ignore
 export const mainExtensions = [
   StarterKit.configure({
+    document: false,
     heading: false,
     undoRedo: false,
     link: false,
@@ -143,6 +148,9 @@ export const mainExtensions = [
     codeBlock: false,
     code: false,
   }),
+  Document.extend({
+    content: "block+ footnotes?",
+  }),
   // Override TipTap's Code extension to fix the inline code input rule.
   // The upstream regex /(^|[^`])`([^`]+)`(?!`)$/ captures the character
   // before the opening backtick as part of the match, causing markInputRule
@@ -203,7 +211,8 @@ export const mainExtensions = [
             parentName === "tableCell" ||
             parentName === "tableHeader" ||
             parentName === "callout" ||
-            parentName === "blockquote"
+            parentName === "blockquote" ||
+            parentName === "footnote"
           ) {
             return i18n.t("Write...");
           }
@@ -417,6 +426,9 @@ export const mainExtensions = [
   }).configure(),
   Columns,
   Column,
+  Footnotes,
+  Footnote,
+  FootnoteReference,
   AutoJoiner.configure({
     elementsToJoin: [],
   }),

apps/client/src/features/editor/page-editor.tsx

@@ -249,6 +249,7 @@ function CollabPageEditor({
     {
       extensions,
       editable,
+      textDirection: "auto",
       immediatelyRender: true,
       shouldRerenderOnTransaction: false,
       editorProps: {
@@ -484,6 +485,7 @@ function StaticPageEditor({
     <EditorProvider
       editable={false}
       immediatelyRender={true}
+      textDirection="auto"
       extensions={mainExtensions}
       content={content}
       editorProps={{

apps/client/src/features/editor/readonly-page-editor.tsx

@@ -85,6 +85,7 @@ export default function ReadonlyPageEditor({
         <EditorProvider
           editable={false}
           immediatelyRender={true}
+          textDirection="auto"
           extensions={titleExtensions}
           content={title}
         ></EditorProvider>
@@ -93,6 +94,7 @@ export default function ReadonlyPageEditor({
       <EditorProvider
         editable={false}
         immediatelyRender={true}
+        textDirection="auto"
         extensions={extensions}
         content={content}
         onCreate={({ editor }) => {

apps/client/src/features/editor/styles/footnotes.css

@@ -0,0 +1,26 @@
+.ProseMirror sup a.footnote-ref {
+  color: var(--mantine-primary-color-filled);
+  text-decoration: none;
+  cursor: pointer;
+  font-weight: 600;
+}
+
+.ProseMirror sup:has(a.footnote-ref) {
+  padding: 0 1px;
+}
+
+.ProseMirror ol.footnotes {
+  margin-top: 2rem;
+  padding-top: 0.75rem;
+  font-size: 0.875rem;
+  color: var(--mantine-color-dimmed);
+  list-style-type: decimal;
+}
+
+.ProseMirror ol.footnotes:has(li) {
+  border-top: 1px solid var(--mantine-color-default-border);
+}
+
+.ProseMirror ol.footnotes li p {
+  margin: 0.15rem 0;
+}

apps/client/src/features/editor/styles/index.css

@@ -18,3 +18,4 @@
 @import "./columns.css";
 @import "./status.css";
 @import "./base-embed.css";
+@import "./footnotes.css";

apps/client/src/features/editor/styles/table.css

@@ -54,7 +54,7 @@
         var(--mantine-color-dark-5)
       );
       font-weight: bold;
-      text-align: left;
+      text-align: start;
     }
 
     .column-resize-handle {

apps/client/src/features/editor/title-editor.tsx

@@ -86,6 +86,7 @@ export function TitleEditor({
     },
     editable: editable,
     content: title,
+    textDirection: "auto",
     immediatelyRender: true,
     shouldRerenderOnTransaction: false,
     editorProps: {

apps/client/src/features/page-history/atoms/history-atoms.ts

@@ -6,4 +6,13 @@ export const activeHistoryPrevIdAtom = atom<string>("");
 export const highlightChangesAtom = atom<boolean>(true);
 
 export type DiffCounts = { added: number; deleted: number; total: number };
-export const diffCountsAtom = atom<DiffCounts | null>(null);
+export const diffCountsAtom = atom<DiffCounts | null>(
+  null as DiffCounts | null,
+);
+
+export type ComparePair = { newerId: string; olderId: string };
+export const compareModeAtom = atom<boolean>(false);
+export const compareSelectionAtom = atom<string[]>([]);
+export const comparePairAtom = atom<ComparePair | null>(
+  null as ComparePair | null,
+);

apps/client/src/features/page-history/components/css/history.module.css

@@ -1,7 +1,7 @@
 .history {
-  display: block;
+  display: flex;
+  align-items: center;
   width: 100%;
-  padding: var(--mantine-spacing-md);
   color: light-dark(var(--mantine-color-black), var(--mantine-color-dark-0));
 
   @mixin hover {
@@ -12,6 +12,28 @@
   }
 }
 
+.historyButton {
+  flex: 1;
+  min-width: 0;
+  color: inherit;
+}
+
+.compareCheckbox {
+  padding-left: var(--mantine-spacing-xs);
+}
+
+.itemMenu {
+  opacity: 0;
+  margin-right: var(--mantine-spacing-xs);
+}
+
+.history:hover .itemMenu,
+.history:focus-within .itemMenu,
+.history.active .itemMenu,
+.itemMenu[aria-expanded="true"] {
+  opacity: 1;
+}
+
 .historyEditor {
   :global(.ProseMirror) {
     padding: 0 !important;
@@ -77,3 +99,8 @@
   flex: 1;
   padding: rem(16px) rem(40px);
 }
+
+.compareBanner {
+  border-bottom: rem(1px) solid
+    light-dark(var(--mantine-color-gray-3), var(--mantine-color-dark-4));
+}

apps/client/src/features/page-history/components/history-editor.tsx

@@ -31,6 +31,7 @@ export function HistoryEditor({
   const editor = useEditor({
     extensions: mainExtensions,
     editable: false,
+    textDirection: "auto",
   });
 
   useEffect(() => {
@@ -170,7 +171,6 @@ export function HistoryEditor({
     }
 
     const total = addedCount + deletedCount;
-    // @ts-ignore
     setDiffCounts({ added: addedCount, deleted: deletedCount, total });
 
     editor.setOptions({

apps/client/src/features/page-history/components/history-item.tsx

@@ -1,10 +1,21 @@
-import { Text, Group, UnstyledButton, Avatar, Tooltip } from "@mantine/core";
+import {
+  Text,
+  Group,
+  UnstyledButton,
+  Avatar,
+  Tooltip,
+  ActionIcon,
+  Checkbox,
+  Menu,
+} from "@mantine/core";
+import { IconDots } from "@tabler/icons-react";
 import { CustomAvatar } from "@/components/ui/custom-avatar.tsx";
 import { formattedDate } from "@/lib/time";
 import classes from "./css/history.module.css";
 import clsx from "clsx";
 import { IPageHistory } from "@/features/page-history/types/page.types";
 import { memo, useCallback } from "react";
+import { useTranslation } from "react-i18next";
 
 const MAX_VISIBLE_AVATARS = 5;
 
@@ -15,6 +26,13 @@ interface HistoryItemProps {
   onHover?: (id: string, index: number) => void;
   onHoverEnd?: () => void;
   isActive: boolean;
+  compareMode: boolean;
+  isChecked: boolean;
+  isCheckboxDisabled: boolean;
+  canCompare: boolean;
+  onToggleCompare: (id: string) => void;
+  onStartCompare: (id: string) => void;
+  onRestore?: (id: string, index: number) => void;
 }
 
 const HistoryItem = memo(function HistoryItem({
@@ -24,10 +42,24 @@ const HistoryItem = memo(function HistoryItem({
   onHover,
   onHoverEnd,
   isActive,
+  compareMode,
+  isChecked,
+  isCheckboxDisabled,
+  canCompare,
+  onToggleCompare,
+  onStartCompare,
+  onRestore,
 }: HistoryItemProps) {
+  const { t } = useTranslation();
+  const date = formattedDate(new Date(historyItem.createdAt));
+
   const handleClick = useCallback(() => {
-    onSelect(historyItem.id, index);
+    if (compareMode) {
-  }, [onSelect, historyItem.id, index]);
+      onToggleCompare(historyItem.id);
+    } else {
+      onSelect(historyItem.id, index);
+    }
+  }, [compareMode, onToggleCompare, onSelect, historyItem.id, index]);
 
   const handleMouseEnter = useCallback(() => {
     onHover?.(historyItem.id, index);
@@ -37,63 +69,115 @@ const HistoryItem = memo(function HistoryItem({
   const hasContributors = contributors && contributors.length > 0;
 
   return (
-    <UnstyledButton
+    <div
-      p="xs"
+      className={clsx(classes.history, { [classes.active]: isActive })}
-      onClick={handleClick}
       onMouseEnter={handleMouseEnter}
       onMouseLeave={onHoverEnd}
-      className={clsx(classes.history, { [classes.active]: isActive })}
     >
-      <Text size="sm">{formattedDate(new Date(historyItem.createdAt))}</Text>
+      {compareMode && (
+        <Checkbox
+          size="xs"
+          className={classes.compareCheckbox}
+          checked={isChecked}
+          disabled={isCheckboxDisabled}
+          onChange={() => onToggleCompare(historyItem.id)}
+          aria-label={t("Select version from {{date}}", { date })}
+        />
+      )}
 
-      <Group gap={6} wrap="nowrap" mt={4}>
+      <UnstyledButton
-        {hasContributors ? (
+        p="xs"
-          <>
+        onClick={handleClick}
-            <Tooltip.Group openDelay={300} closeDelay={100}>
+        className={classes.historyButton}
-              <Avatar.Group spacing={8}>
+      >
-                {contributors.slice(0, MAX_VISIBLE_AVATARS).map((contributor) => (
+        <Text size="sm">{date}</Text>
-                  <Tooltip key={contributor.id} label={contributor.name} withArrow>
+
-                    <CustomAvatar
+        <Group gap={6} wrap="nowrap" mt={4}>
-                      size="sm"
+          {hasContributors ? (
-                      avatarUrl={contributor.avatarUrl}
+            <>
-                      name={contributor.name}
+              <Tooltip.Group openDelay={300} closeDelay={100}>
-                    />
+                <Avatar.Group spacing={8}>
-                  </Tooltip>
+                  {contributors
-                ))}
+                    .slice(0, MAX_VISIBLE_AVATARS)
-                {contributors.length > MAX_VISIBLE_AVATARS && (
+                    .map((contributor) => (
-                  <Tooltip
+                      <Tooltip
-                    withArrow
+                        key={contributor.id}
-                    label={contributors.slice(MAX_VISIBLE_AVATARS).map((c) => (
+                        label={contributor.name}
-                      <div key={c.id}>{c.name}</div>
+                        withArrow
+                      >
+                        <CustomAvatar
+                          size="sm"
+                          avatarUrl={contributor.avatarUrl}
+                          name={contributor.name}
+                        />
+                      </Tooltip>
                     ))}
-                  >
+                  {contributors.length > MAX_VISIBLE_AVATARS && (
-                    <Avatar size="sm" color="gray">
+                    <Tooltip
-                      +{contributors.length - MAX_VISIBLE_AVATARS}
+                      withArrow
-                    </Avatar>
+                      label={contributors
-                  </Tooltip>
+                        .slice(MAX_VISIBLE_AVATARS)
-                )}
+                        .map((c) => (
-              </Avatar.Group>
+                          <div key={c.id}>{c.name}</div>
-            </Tooltip.Group>
+                        ))}
-            {contributors.length === 1 && (
+                    >
+                      <Avatar size="sm" color="gray">
+                        +{contributors.length - MAX_VISIBLE_AVATARS}
+                      </Avatar>
+                    </Tooltip>
+                  )}
+                </Avatar.Group>
+              </Tooltip.Group>
+              {contributors.length === 1 && (
+                <Text size="sm" c="dimmed" lineClamp={1}>
+                  {contributors[0].name}
+                </Text>
+              )}
+            </>
+          ) : (
+            <>
+              <CustomAvatar
+                size="sm"
+                avatarUrl={historyItem.lastUpdatedBy?.avatarUrl}
+                name={historyItem.lastUpdatedBy?.name}
+              />
               <Text size="sm" c="dimmed" lineClamp={1}>
-                {contributors[0].name}
+                {historyItem.lastUpdatedBy?.name}
               </Text>
+            </>
+          )}
+        </Group>
+      </UnstyledButton>
+
+      {!compareMode && (
+        <Menu shadow="md" width={180} position="bottom-end">
+          <Menu.Target>
+            <ActionIcon
+              variant="subtle"
+              color="gray"
+              className={classes.itemMenu}
+              aria-label={t("Version actions for {{date}}", { date })}
+              onClick={(e) => e.stopPropagation()}
+            >
+              <IconDots size={18} />
+            </ActionIcon>
+          </Menu.Target>
+          <Menu.Dropdown>
+            <Menu.Item
+              disabled={!canCompare}
+              onClick={() => onStartCompare(historyItem.id)}
+            >
+              {t("Compare")}
+            </Menu.Item>
+            {onRestore && (
+              <Menu.Item onClick={() => onRestore(historyItem.id, index)}>
+                {t("Restore")}
+              </Menu.Item>
             )}
-          </>
+          </Menu.Dropdown>
-        ) : (
+        </Menu>
-          <>
+      )}
-            <CustomAvatar
+    </div>
-              size="sm"
-              avatarUrl={historyItem.lastUpdatedBy?.avatarUrl}
-              name={historyItem.lastUpdatedBy?.name}
-            />
-            <Text size="sm" c="dimmed" lineClamp={1}>
-              {historyItem.lastUpdatedBy?.name}
-            </Text>
-          </>
-        )}
-      </Group>
-    </UnstyledButton>
   );
 });
 

apps/client/src/features/page-history/components/history-list.tsx

@@ -6,8 +6,12 @@ import HistoryItem from "@/features/page-history/components/history-item";
 import {
   activeHistoryIdAtom,
   activeHistoryPrevIdAtom,
+  compareModeAtom,
+  comparePairAtom,
+  compareSelectionAtom,
   historyAtoms,
 } from "@/features/page-history/atoms/history-atoms";
+import { resolveComparePair } from "@/features/page-history/utils/resolve-compare-pair";
 import { useAtom, useSetAtom } from "jotai";
 import { useCallback, useEffect, useMemo, useRef } from "react";
 import {
@@ -32,6 +36,9 @@ function HistoryList({ pageId }: Props) {
   const [activeHistoryId, setActiveHistoryId] = useAtom(activeHistoryIdAtom);
   const setActiveHistoryPrevId = useSetAtom(activeHistoryPrevIdAtom);
   const setHistoryModalOpen = useSetAtom(historyAtoms);
+  const [compareMode, setCompareMode] = useAtom(compareModeAtom);
+  const [compareSelection, setCompareSelection] = useAtom(compareSelectionAtom);
+  const setComparePair = useSetAtom(comparePairAtom);
 
   const {
     data: pageHistoryData,
@@ -79,10 +86,58 @@ function HistoryList({ pageId }: Props) {
 
   const handleSelect = useCallback(
     (id: string, index: number) => {
+      setComparePair(null);
       setActiveHistoryId(id);
       setActiveHistoryPrevId(historyItems[index + 1]?.id ?? "");
     },
-    [historyItems, setActiveHistoryId, setActiveHistoryPrevId],
+    [historyItems, setActiveHistoryId, setActiveHistoryPrevId, setComparePair],
+  );
+
+  const handleToggleCompare = useCallback(
+    (id: string) => {
+      setCompareSelection((prev) => {
+        if (prev.includes(id)) return prev.filter((item) => item !== id);
+        if (prev.length >= 2) return prev;
+        return [...prev, id];
+      });
+    },
+    [setCompareSelection],
+  );
+
+  const handleStartCompare = useCallback(
+    (id: string) => {
+      setComparePair(null);
+      setCompareMode(true);
+      setCompareSelection([id]);
+    },
+    [setComparePair, setCompareMode, setCompareSelection],
+  );
+
+  const handleCancelCompare = useCallback(() => {
+    setCompareMode(false);
+    setCompareSelection([]);
+  }, [setCompareMode, setCompareSelection]);
+
+  const handleConfirmCompare = useCallback(() => {
+    const pair = resolveComparePair(historyItems, compareSelection);
+    if (!pair) return;
+    setComparePair(pair);
+    setCompareMode(false);
+    setCompareSelection([]);
+  }, [
+    historyItems,
+    compareSelection,
+    setComparePair,
+    setCompareMode,
+    setCompareSelection,
+  ]);
+
+  const handleRestoreItem = useCallback(
+    (id: string, index: number) => {
+      handleSelect(id, index);
+      confirmRestore(id);
+    },
+    [handleSelect, confirmRestore],
   );
 
   useEffect(() => {
@@ -138,6 +193,16 @@ function HistoryList({ pageId }: Props) {
             onHover={handleHover}
             onHoverEnd={clearPrefetchTimeout}
             isActive={historyItem.id === activeHistoryId}
+            compareMode={compareMode}
+            isChecked={compareSelection.includes(historyItem.id)}
+            isCheckboxDisabled={
+              !compareSelection.includes(historyItem.id) &&
+              compareSelection.length >= 2
+            }
+            canCompare={historyItems.length >= 2}
+            onToggleCompare={handleToggleCompare}
+            onStartCompare={handleStartCompare}
+            onRestore={canRestore ? handleRestoreItem : undefined}
           />
         ))}
         {hasNextPage && <div ref={loadMoreRef} style={{ height: 1 }} />}
@@ -148,22 +213,44 @@ function HistoryList({ pageId }: Props) {
         )}
       </ScrollArea>
 
-      {canRestore && (
+      {compareMode ? (
         <>
           <Divider />
           <Group p="xs" wrap="nowrap">
             <Button
               variant="default"
               size="compact-md"
-              onClick={() => setHistoryModalOpen(false)}
+              onClick={handleCancelCompare}
             >
               {t("Cancel")}
             </Button>
-            <Button size="compact-md" onClick={confirmRestore}>
+            <Button
-              {t("Restore")}
+              size="compact-md"
+              disabled={compareSelection.length !== 2}
+              onClick={handleConfirmCompare}
+            >
+              {t("Compare")}
             </Button>
           </Group>
         </>
+      ) : (
+        canRestore && (
+          <>
+            <Divider />
+            <Group p="xs" wrap="nowrap">
+              <Button
+                variant="default"
+                size="compact-md"
+                onClick={() => setHistoryModalOpen(false)}
+              >
+                {t("Cancel")}
+              </Button>
+              <Button size="compact-md" onClick={() => confirmRestore()}>
+                {t("Restore")}
+              </Button>
+            </Group>
+          </>
+        )
       )}
     </div>
   );

apps/client/src/features/page-history/components/history-modal-body.tsx

@@ -1,5 +1,6 @@
 import {
   ActionIcon,
+  CloseButton,
   Group,
   Paper,
   ScrollArea,
@@ -12,17 +13,20 @@ import { useAtom, useAtomValue } from "jotai";
 import {
   activeHistoryIdAtom,
   activeHistoryPrevIdAtom,
+  comparePairAtom,
   diffCountsAtom,
   highlightChangesAtom,
 } from "@/features/page-history/atoms/history-atoms";
 import HistoryView from "@/features/page-history/components/history-view";
-import { useRef } from "react";
+import { useMemo, useRef } from "react";
 import { IconChevronUp, IconChevronDown } from "@tabler/icons-react";
 import { useTranslation } from "react-i18next";
 import {
   useDiffNavigation,
   useHistoryReset,
 } from "@/features/page-history/hooks";
+import { usePageHistoryListQuery } from "@/features/page-history/queries/page-history-query";
+import { formattedDate } from "@/lib/time";
 
 interface Props {
   pageId: string;
@@ -36,6 +40,28 @@ export default function HistoryModalBody({ pageId }: Props) {
   const activeHistoryPrevId = useAtomValue(activeHistoryPrevIdAtom);
   const [highlightChanges, setHighlightChanges] = useAtom(highlightChangesAtom);
   const diffCounts = useAtomValue(diffCountsAtom);
+  const [comparePair, setComparePair] = useAtom(comparePairAtom);
+
+  const { data: pageHistoryData } = usePageHistoryListQuery(pageId);
+  const historyItems = useMemo(
+    () => pageHistoryData?.pages.flatMap((page) => page.items) ?? [],
+    [pageHistoryData],
+  );
+
+  const compareLabel = useMemo(() => {
+    if (!comparePair) return null;
+    const newerItem = historyItems.find(
+      (item) => item.id === comparePair.newerId,
+    );
+    const olderItem = historyItems.find(
+      (item) => item.id === comparePair.olderId,
+    );
+    if (!newerItem || !olderItem) return null;
+    return t("Comparing {{newer}} and {{older}}", {
+      newer: formattedDate(new Date(newerItem.createdAt)),
+      older: formattedDate(new Date(olderItem.createdAt)),
+    });
+  }, [comparePair, historyItems, t]);
 
   useHistoryReset(pageId);
   const { currentChangeIndex, handlePrevChange, handleNextChange } =
@@ -50,6 +76,25 @@ export default function HistoryModalBody({ pageId }: Props) {
       </nav>
 
       <div style={{ position: "relative", flex: 1 }}>
+        {comparePair && (
+          <Group
+            justify="space-between"
+            wrap="nowrap"
+            px="md"
+            py={4}
+            className={classes.compareBanner}
+          >
+            <Text size="sm" fw={500} lineClamp={1}>
+              {compareLabel ?? t("Compare versions")}
+            </Text>
+            <CloseButton
+              size="sm"
+              aria-label={t("Exit compare")}
+              onClick={() => setComparePair(null)}
+            />
+          </Group>
+        )}
+
         <ScrollArea
           h={650}
           w="100%"
@@ -57,11 +102,18 @@ export default function HistoryModalBody({ pageId }: Props) {
           viewportRef={scrollViewportRef}
         >
           <div className={classes.sidebarRightSection}>
-            {activeHistoryId && <HistoryView />}
+            {comparePair ? (
+              <HistoryView
+                historyId={comparePair.newerId}
+                prevHistoryId={comparePair.olderId}
+              />
+            ) : (
+              activeHistoryId && <HistoryView />
+            )}
           </div>
         </ScrollArea>
 
-        {activeHistoryId && activeHistoryPrevId && (
+        {(comparePair || (activeHistoryId && activeHistoryPrevId)) && (
           <Paper
             shadow="md"
             radius="xl"

apps/client/src/features/page-history/components/history-modal-mobile.tsx

@@ -166,7 +166,7 @@ export default function HistoryModalMobile({ pageId, pageTitle }: Props) {
           <Button variant="default" onClick={() => setHistoryModalOpen(false)}>
             {t("Cancel")}
           </Button>
-          <Button onClick={confirmRestore}>{t("Restore")}</Button>
+          <Button onClick={() => confirmRestore()}>{t("Restore")}</Button>
         </Group>
       )}
 

apps/client/src/features/page-history/components/history-view.tsx

@@ -7,21 +7,29 @@ import {
   activeHistoryPrevIdAtom,
 } from "@/features/page-history/atoms/history-atoms";
 
-function HistoryView() {
+interface Props {
+  historyId?: string;
+  prevHistoryId?: string;
+}
+
+function HistoryView({ historyId, prevHistoryId }: Props) {
   const { t } = useTranslation();
-  const historyId = useAtomValue(activeHistoryIdAtom);
+  const activeId = useAtomValue(activeHistoryIdAtom);
-  const prevHistoryId = useAtomValue(activeHistoryPrevIdAtom);
+  const activePrevId = useAtomValue(activeHistoryPrevIdAtom);
+
+  const resolvedId = historyId ?? activeId;
+  const resolvedPrevId = prevHistoryId ?? activePrevId;
 
   const {
     data,
     isLoading: isLoadingCurrent,
     isError: isErrorCurrent,
-  } = usePageHistoryQuery(historyId);
+  } = usePageHistoryQuery(resolvedId);
   const {
     data: prevData,
     isLoading: isLoadingPrev,
     isError: isErrorPrev,
-  } = usePageHistoryQuery(prevHistoryId);
+  } = usePageHistoryQuery(resolvedPrevId);
 
   if (isLoadingCurrent || isLoadingPrev) {
     return <></>;

apps/client/src/features/page-history/hooks/use-history-reset.ts

@@ -3,22 +3,45 @@ import { useEffect } from "react";
 import {
   activeHistoryIdAtom,
   activeHistoryPrevIdAtom,
+  compareModeAtom,
+  comparePairAtom,
+  compareSelectionAtom,
   diffCountsAtom,
 } from "@/features/page-history/atoms/history-atoms";
 
 /**
  * Resets history state when pageId changes.
- * Clears active selection and diff counts.
+ * Clears active selection, diff counts, and compare state.
+ * Compare state also resets on unmount so reopening the modal starts clean.
  */
 export function useHistoryReset(pageId: string) {
   const [, setActiveHistoryId] = useAtom(activeHistoryIdAtom);
   const [, setActiveHistoryPrevId] = useAtom(activeHistoryPrevIdAtom);
   const [, setDiffCounts] = useAtom(diffCountsAtom);
+  const [, setCompareMode] = useAtom(compareModeAtom);
+  const [, setCompareSelection] = useAtom(compareSelectionAtom);
+  const [, setComparePair] = useAtom(comparePairAtom);
 
   useEffect(() => {
+    const resetCompare = () => {
+      setCompareMode(false);
+      setCompareSelection([]);
+      setComparePair(null);
+    };
+
     setActiveHistoryId("");
     setActiveHistoryPrevId("");
-    // @ts-ignore
     setDiffCounts(null);
-  }, [pageId, setActiveHistoryId, setActiveHistoryPrevId, setDiffCounts]);
+    resetCompare();
+
+    return resetCompare;
+  }, [
+    pageId,
+    setActiveHistoryId,
+    setActiveHistoryPrevId,
+    setDiffCounts,
+    setCompareMode,
+    setCompareSelection,
+    setComparePair,
+  ]);
 }

apps/client/src/features/page-history/hooks/use-history-restore.tsx

@@ -1,4 +1,4 @@
-import { useAtom, useAtomValue, useSetAtom } from "jotai";
+import { useAtomValue, useSetAtom } from "jotai";
 import { useCallback } from "react";
 import { useTranslation } from "react-i18next";
 import { Text } from "@mantine/core";
@@ -9,7 +9,8 @@ import {
   activeHistoryIdAtom,
   historyAtoms,
 } from "@/features/page-history/atoms/history-atoms";
-import { usePageHistoryQuery } from "@/features/page-history/queries/page-history-query";
+import { fetchPageHistory } from "@/features/page-history/queries/page-history-query";
+import { IPageHistory } from "@/features/page-history/types/page.types";
 import {
   pageEditorAtom,
   titleEditorAtom,
@@ -25,8 +26,6 @@ export function useHistoryRestore() {
   const { t } = useTranslation();
 
   const activeHistoryId = useAtomValue(activeHistoryIdAtom);
-  const { data: activeHistoryData } = usePageHistoryQuery(activeHistoryId);
-
   const mainEditor = useAtomValue(pageEditorAtom);
   const mainEditorTitle = useAtomValue(titleEditorAtom);
   const setHistoryModalOpen = useSetAtom(historyAtoms);
@@ -40,47 +39,66 @@ export function useHistoryRestore() {
     SpaceCaslSubject.Page,
   );
 
-  const handleRestore = useCallback(() => {
+  const handleRestore = useCallback(
-    if (!activeHistoryData) return;
+    async (historyId: string) => {
-    if (
+      let historyData: IPageHistory;
-      !mainEditor ||
+      try {
-      mainEditor.isDestroyed ||
+        historyData = await fetchPageHistory(historyId);
-      !mainEditorTitle ||
+      } catch {
-      mainEditorTitle.isDestroyed
+        notifications.show({
-    ) {
+          message: t("Error fetching page data."),
-      return;
+          color: "red",
-    }
+        });
+        return;
+      }
 
-    mainEditorTitle
+      if (
-      .chain()
+        !mainEditor ||
-      .clearContent()
+        mainEditor.isDestroyed ||
-      .setContent(activeHistoryData.title, { emitUpdate: true })
+        !mainEditorTitle ||
-      .run();
+        mainEditorTitle.isDestroyed
+      ) {
+        return;
+      }
 
-    mainEditor
+      mainEditorTitle
-      .chain()
+        .chain()
-      .clearContent()
+        .clearContent()
-      .setContent(activeHistoryData.content)
+        .setContent(historyData.title, { emitUpdate: true })
-      .run();
+        .run();
 
-    setHistoryModalOpen(false);
+      mainEditor
-    notifications.show({ message: t("Successfully restored") });
+        .chain()
-  }, [activeHistoryData, mainEditor, mainEditorTitle, setHistoryModalOpen, t]);
+        .clearContent()
+        .setContent(historyData.content)
+        .run();
 
-  const confirmRestore = useCallback(() => {
+      setHistoryModalOpen(false);
-    modals.openConfirmModal({
+      notifications.show({ message: t("Successfully restored") });
-      title: t("Please confirm your action"),
+    },
-      children: (
+    [mainEditor, mainEditorTitle, setHistoryModalOpen, t],
-        <Text size="sm">
+  );
-          {t(
+
-            "Are you sure you want to restore this version? Any changes not versioned will be lost.",
+  const confirmRestore = useCallback(
-          )}
+    (historyId?: string) => {
-        </Text>
+      const targetId = historyId ?? activeHistoryId;
-      ),
+      if (!targetId) return;
-      labels: { confirm: t("Confirm"), cancel: t("Cancel") },
+
-      onConfirm: handleRestore,
+      modals.openConfirmModal({
-    });
+        title: t("Please confirm your action"),
-  }, [t, handleRestore]);
+        children: (
+          <Text size="sm">
+            {t(
+              "Are you sure you want to restore this version? Any changes not versioned will be lost.",
+            )}
+          </Text>
+        ),
+        labels: { confirm: t("Confirm"), cancel: t("Cancel") },
+        onConfirm: () => handleRestore(targetId),
+      });
+    },
+    [t, handleRestore, activeHistoryId],
+  );
 
   return { canRestore, confirmRestore };
 }

apps/client/src/features/page-history/queries/page-history-query.ts

@@ -23,6 +23,14 @@ export function prefetchPageHistory(historyId: string) {
   });
 }
 
+export function fetchPageHistory(historyId: string): Promise<IPageHistory> {
+  return queryClient.fetchQuery({
+    queryKey: ["page-history", historyId],
+    queryFn: () => getPageHistoryById(historyId),
+    staleTime: HISTORY_STALE_TIME,
+  });
+}
+
 export function usePageHistoryListQuery(
   pageId: string,
 ): UseInfiniteQueryResult<InfiniteData<IPagination<IPageHistory>, unknown>> {

apps/client/src/features/page-history/utils/resolve-compare-pair.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, it } from "vitest";
+import { resolveComparePair } from "./resolve-compare-pair";
+
+// list is newest-first, matching usePageHistoryListQuery order
+const items = [{ id: "v3" }, { id: "v2" }, { id: "v1" }];
+
+describe("resolveComparePair", () => {
+  it("orders newer before older regardless of selection order", () => {
+    expect(resolveComparePair(items, ["v1", "v3"])).toEqual({
+      newerId: "v3",
+      olderId: "v1",
+    });
+    expect(resolveComparePair(items, ["v3", "v1"])).toEqual({
+      newerId: "v3",
+      olderId: "v1",
+    });
+  });
+
+  it("returns null unless exactly two versions are selected", () => {
+    expect(resolveComparePair(items, [])).toBeNull();
+    expect(resolveComparePair(items, ["v1"])).toBeNull();
+    expect(resolveComparePair(items, ["v1", "v2", "v3"])).toBeNull();
+  });
+
+  it("returns null when a selected id is not in the list", () => {
+    expect(resolveComparePair(items, ["v1", "missing"])).toBeNull();
+  });
+
+  it("returns null when the same id is selected twice", () => {
+    expect(resolveComparePair(items, ["v2", "v2"])).toBeNull();
+  });
+});

apps/client/src/features/page-history/utils/resolve-compare-pair.ts

@@ -0,0 +1,18 @@
+import { ComparePair } from "@/features/page-history/atoms/history-atoms";
+
+/**
+ * Resolves which of the two selected versions is newer using their position
+ * in the history list (list is newest-first: lower index = newer).
+ */
+export function resolveComparePair(
+  historyItems: { id: string }[],
+  selection: string[],
+): ComparePair | null {
+  if (selection.length !== 2) return null;
+  const indexA = historyItems.findIndex((item) => item.id === selection[0]);
+  const indexB = historyItems.findIndex((item) => item.id === selection[1]);
+  if (indexA === -1 || indexB === -1 || indexA === indexB) return null;
+  return indexA < indexB
+    ? { newerId: selection[0], olderId: selection[1] }
+    : { newerId: selection[1], olderId: selection[0] };
+}

apps/client/src/features/page/components/header/page-header-menu.tsx

@@ -11,6 +11,7 @@ import {
   IconList,
   IconMarkdown,
   IconMessage,
+  IconPaperclip,
   IconPrinter,
   IconStar,
   IconStarFilled,
@@ -42,6 +43,7 @@ import {
 import { formattedDate } from "@/lib/time.ts";
 import { PageEditModeToggle } from "@/features/user/components/page-state-pref.tsx";
 import MovePageModal from "@/features/page/components/move-page-modal.tsx";
+import PageAttachmentsModal from "@/features/attachments/components/page-attachments-modal.tsx";
 import { useTimeAgo } from "@/hooks/use-time-ago.tsx";
 import { PageShareModal } from "@/ee/page-permission";
 import {
@@ -157,6 +159,10 @@ function PageActionMenu({ readOnly }: PageActionMenuProps) {
     verificationOpened,
     { open: openVerificationModal, close: closeVerificationModal },
   ] = useDisclosure(false);
+  const [
+    attachmentsOpened,
+    { open: openAttachmentsModal, close: closeAttachmentsModal },
+  ] = useDisclosure(false);
   const [pageEditor] = useAtom(pageEditorAtom);
   const pageUpdatedAt = useTimeAgo(page?.updatedAt);
   const favoriteIds = useFavoriteIds("page", page?.spaceId);
@@ -293,6 +299,15 @@ function PageActionMenu({ readOnly }: PageActionMenuProps) {
             </Menu.Item>
           )}
 
+          {!page?.isBase && (
+            <Menu.Item
+              leftSection={<IconPaperclip size={16} />}
+              onClick={openAttachmentsModal}
+            >
+              {t("Attachments")}
+            </Menu.Item>
+          )}
+
           {!readOnly && !page?.isBase && (
             <PageVerificationMenuItem
               pageId={page?.id}
@@ -395,6 +410,12 @@ function PageActionMenu({ readOnly }: PageActionMenuProps) {
         opened={verificationOpened}
         onClose={closeVerificationModal}
       />
+
+      <PageAttachmentsModal
+        pageId={page.id}
+        open={attachmentsOpened}
+        onClose={closeAttachmentsModal}
+      />
     </>
   );
 }

apps/client/src/features/space/components/sidebar/space-select.tsx

@@ -1,4 +1,4 @@
-import React, { useEffect, useState } from "react";
+import React, { useEffect, useRef, useState } from "react";
 import { useDebouncedValue } from "@mantine/hooks";
 import { Group, Select, SelectProps, Text } from "@mantine/core";
 import { useGetSpacesQuery } from "@/features/space/queries/space-query.ts";
@@ -14,6 +14,7 @@ interface SpaceSelectProps {
   width?: number;
   opened?: boolean;
   clearable?: boolean;
+  withinPortal?: boolean;
 }
 
 const renderSelectOption: SelectProps["renderOption"] = ({ option }) => (
@@ -41,6 +42,7 @@ export function SpaceSelect({
   width,
   opened,
   clearable,
+  withinPortal = true,
 }: SpaceSelectProps) {
   const { t } = useTranslation();
   const [searchValue, setSearchValue] = useState("");
@@ -50,9 +52,13 @@ export function SpaceSelect({
     limit: 50,
   });
   const [data, setData] = useState([]);
+  const fetchedSpaces = useRef(new Map<string, ISpace>());
 
   useEffect(() => {
     if (spaces) {
+      spaces.items.forEach((space: ISpace) =>
+        fetchedSpaces.current.set(space.slug, space),
+      );
       const spaceData = spaces?.items
         .filter((space: ISpace) => space.slug !== value)
         .map((space: ISpace) => {
@@ -83,14 +89,19 @@ export function SpaceSelect({
       onSearchChange={setSearchValue}
       clearable={clearable}
       variant="filled"
-      onChange={(slug) =>
+      onChange={(slug) => {
-        onChange(spaces.items?.find((item) => item.slug === slug))
+        // options accumulate across fetches; resolve against everything
-      }
+        // fetched, not just the latest query result
+        const space = slug && fetchedSpaces.current.get(slug);
+        if (space) {
+          onChange(space);
+        }
+      }}
       onClick={(e) => e.stopPropagation()}
       nothingFoundMessage={t("No space found")}
       limit={50}
       checkIconPosition="right"
-      comboboxProps={{ width, withinPortal: true, position: "bottom", keepMounted: false, dropdownPadding: 0 }}
+      comboboxProps={{ width, withinPortal, position: "bottom", keepMounted: false, dropdownPadding: 0 }}
       dropdownOpened={opened}
     />
   );

apps/client/src/features/space/components/sidebar/switch-space.tsx

@@ -70,6 +70,7 @@ export function SwitchSpace({
           onChange={(space) => handleSelect(space.slug)}
           width={300}
           opened={true}
+          withinPortal={false}
         />
       </Popover.Dropdown>
     </Popover>

apps/client/src/features/workspace/types/workspace.types.ts

@@ -31,6 +31,7 @@ export interface IWorkspace {
   allowPersonalSpaces?: boolean;
   defaultPageEditMode?: string;
   isScimEnabled?: boolean;
+  trustedOauthClients?: ITrustedOAuthClient[];
 }
 
 export interface IWorkspaceSettings {
@@ -42,6 +43,11 @@ export interface IWorkspaceSettings {
   defaultPageEditMode?: string;
 }
 
+export interface ITrustedOAuthClient {
+  origin: string;
+  name: string;
+}
+
 export interface IWorkspaceApiSettings {
   restrictToAdmins?: boolean;
 }

apps/client/src/lib/api-client.ts

@@ -76,6 +76,8 @@ function redirectToLogin() {
     APP_ROUTE.AUTH.MFA_CHALLENGE,
     APP_ROUTE.AUTH.MFA_SETUP_REQUIRED,
     "/invites",
+    // the oauth consent page redirects to login itself, preserving its query string
+    "/oauth/consent",
   ];
   if (!exemptPaths.some((path) => window.location.pathname.startsWith(path))) {
     const redirectTo = window.location.pathname;

apps/client/src/pages/auth/forgot-password.tsx

@@ -1,13 +1,10 @@
 import { ForgotPasswordForm } from "@/features/auth/components/forgot-password-form";
-import { getAppName } from "@/lib/config";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
-import { Helmet } from "react-helmet-async";
 
 export default function ForgotPassword() {
     return (
         <>
-            <Helmet>
+            <DocumentTitle title="Forgot Password" />
-                <title>Forgot Password - {getAppName()}</title>
-            </Helmet>
             <ForgotPasswordForm />
         </>
     );

apps/client/src/pages/auth/invite-signup.tsx

@@ -1,16 +1,13 @@
-import { Helmet } from "react-helmet-async";
 import { InviteSignUpForm } from "@/features/auth/components/invite-sign-up-form.tsx";
-import {getAppName} from "@/lib/config.ts";
 import { useTranslation } from "react-i18next";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function InviteSignup() {
   const { t } = useTranslation();
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title={t("Invitation Signup")} />
-        <title>{t("Invitation Signup")} - {getAppName()}</title>
-      </Helmet>
       <InviteSignUpForm />
     </>
   );

apps/client/src/pages/auth/login.tsx

@@ -1,18 +1,13 @@
 import { LoginForm } from "@/features/auth/components/login-form";
-import { Helmet } from "react-helmet-async";
-import { getAppName } from "@/lib/config.ts";
 import { useTranslation } from "react-i18next";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function LoginPage() {
   const { t } = useTranslation();
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title={t("Login")} />
-        <title>
-          {t("Login")} - {getAppName()}
-        </title>
-      </Helmet>
       <LoginForm />
     </>
   );

apps/client/src/pages/auth/password-reset.tsx

@@ -1,11 +1,10 @@
-import { Helmet } from "react-helmet-async";
 import { PasswordResetForm } from "@/features/auth/components/password-reset-form";
 import { Link, useSearchParams } from "react-router-dom";
 import { useVerifyUserTokenQuery } from "@/features/auth/queries/auth-query";
 import { Button, Container, Group, Text } from "@mantine/core";
 import APP_ROUTE from "@/lib/app-route";
-import { getAppName } from "@/lib/config.ts";
 import { useTranslation } from "react-i18next";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function PasswordReset() {
   const { t } = useTranslation();
@@ -23,11 +22,7 @@ export default function PasswordReset() {
   if (isError || !resetToken) {
     return (
       <>
-        <Helmet>
+        <DocumentTitle title={t("Password Reset")} />
-          <title>
-            {t("Password Reset")} - {getAppName()}
-          </title>
-        </Helmet>
         <Container my={40}>
           <Text size="lg" ta="center">
             {t("Invalid or expired password reset link")}
@@ -49,11 +44,7 @@ export default function PasswordReset() {
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title={t("Password Reset")} />
-        <title>
-          {t("Password Reset")} - {getAppName()}
-        </title>
-      </Helmet>
       <PasswordResetForm resetToken={resetToken} />
     </>
   );

apps/client/src/pages/auth/setup-workspace.tsx

@@ -1,11 +1,10 @@
 import { useWorkspacePublicDataQuery } from "@/features/workspace/queries/workspace-query.ts";
 import { SetupWorkspaceForm } from "@/features/auth/components/setup-workspace-form.tsx";
-import { Helmet } from "react-helmet-async";
 import React, { useEffect } from "react";
 import { useNavigate } from "react-router-dom";
 import APP_ROUTE from "@/lib/app-route.ts";
-import { getAppName } from "@/lib/config.ts";
 import { useTranslation } from "react-i18next";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function SetupWorkspace() {
   const { t } = useTranslation();
@@ -35,11 +34,7 @@ export default function SetupWorkspace() {
   ) {
     return (
       <>
-        <Helmet>
+        <DocumentTitle title={t("Setup Workspace")} />
-          <title>
-            {t("Setup Workspace")} - {getAppName()}
-          </title>
-        </Helmet>
         <SetupWorkspaceForm />
       </>
     );

apps/client/src/pages/dashboard/home.tsx

@@ -2,20 +2,15 @@ import { Container, Space } from "@mantine/core";
 import HomeTabs from "@/features/home/components/home-tabs";
 import HomeAiPrompt from "@/features/home/components/home-ai-prompt";
 import SpaceCarousel from "@/features/space/components/space-carousel.tsx";
-import { getAppName } from "@/lib/config.ts";
-import { Helmet } from "react-helmet-async";
 import { useTranslation } from "react-i18next";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function Home() {
   const { t } = useTranslation();
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title={t("Home")} />
-        <title>
-          {t("Home")} - {getAppName()}
-        </title>
-      </Helmet>
       <Container size={"900"} pt="xl">
         <HomeAiPrompt />
 

apps/client/src/pages/label/label-page.tsx

@@ -17,9 +17,7 @@ import {
 } from "@tabler/icons-react";
 import { Link, useParams } from "react-router-dom";
 import { useTranslation } from "react-i18next";
-import { Helmet } from "react-helmet-async";
 import { useDebouncedValue } from "@mantine/hooks";
-import { getAppName } from "@/lib/config";
 import { useLabelPagesQuery } from "@/features/label/queries/label-query.ts";
 import { useGetSpacesQuery } from "@/features/space/queries/space-query.ts";
 import { getLabelColor } from "@/features/label/utils/label-colors.ts";
@@ -29,6 +27,7 @@ import { normalizeLabelName } from "@/features/label/utils/normalize-label.ts";
 import { SpaceFilterMenu } from "@/features/space/components/space-filter-menu.tsx";
 import { EmptyState } from "@/components/ui/empty-state";
 import classes from "@/features/label/label.module.css";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function LabelPage() {
   const { t } = useTranslation();
@@ -82,11 +81,7 @@ export default function LabelPage() {
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title={labelName} />
-        <title>
-          {labelName} - {getAppName()}
-        </title>
-      </Helmet>
 
       <Container size={820} py="xl">
         <Stack gap="lg">

apps/client/src/pages/page/page.tsx

@@ -3,7 +3,6 @@ import { usePageQuery } from "@/features/page/queries/page-query";
 import { FullEditor } from "@/features/editor/full-editor";
 import { TitleEditor } from "@/features/editor/title-editor";
 import HistoryModal from "@/features/page-history/components/history-modal";
-import { Helmet } from "react-helmet-async";
 import PageHeader from "@/features/page/components/header/page-header.tsx";
 import { extractPageSlugId } from "@/lib";
 import { useGetSpaceBySlugQuery } from "@/features/space/queries/space-query.ts";
@@ -18,6 +17,7 @@ import { BaseView } from "@/ee/base/components/base-view";
 import { useHasFeature } from "@/ee/hooks/use-feature";
 import { Feature } from "@/ee/features";
 import { getPageTitle } from "@/features/page/page.utils";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 const MemoizedFullEditor = React.memo(FullEditor);
 const MemoizedTitleEditor = React.memo(TitleEditor);
 const MemoizedPageHeader = React.memo(PageHeader);
@@ -110,9 +110,10 @@ function PageContent({ pageSlug }: { pageSlug: string | undefined }) {
           paddingTop: "calc(var(--page-header-height) + 6px)",
         }}
       >
-        <Helmet>
+        <DocumentTitle
-          <title>{`${page?.icon || ""}  ${getPageTitle(page?.title, page?.isBase, t)}`}</title>
+          title={`${page?.icon || ""}  ${getPageTitle(page?.title, page?.isBase, t)}`}
-        </Helmet>
+          withAppName={false}
+        />
         <MemoizedPageHeader readOnly={!canEdit} />
         <div
           style={{
@@ -159,9 +160,10 @@ function PageContent({ pageSlug }: { pageSlug: string | undefined }) {
   return (
     page && (
       <div>
-        <Helmet>
+        <DocumentTitle
-          <title>{`${page?.icon || ""}  ${getPageTitle(page?.title, page?.isBase, t)}`}</title>
+          title={`${page?.icon || ""}  ${getPageTitle(page?.title, page?.isBase, t)}`}
-        </Helmet>
+          withAppName={false}
+        />
 
         <MemoizedPageHeader readOnly={!canEdit} />
 

apps/client/src/pages/settings/account/account-preferences.tsx

@@ -5,21 +5,16 @@ import PageWidthPref from "@/features/user/components/page-width-pref.tsx";
 import PageEditPref from "@/features/user/components/page-state-pref";
 import FixedToolbarPref from "@/features/user/components/fixed-toolbar-pref";
 import NotificationPref from "@/features/user/components/notification-pref";
-import { getAppName } from "@/lib/config.ts";
 import { Divider } from "@mantine/core";
-import { Helmet } from "react-helmet-async";
 import { useTranslation } from "react-i18next";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function AccountPreferences() {
   const { t } = useTranslation();
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title={t("Preferences")} />
-        <title>
-          {t("Preferences")} - {getAppName()}
-        </title>
-      </Helmet>
       <SettingsTitle title={t("Preferences")} />
 
       <AccountTheme />

apps/client/src/pages/settings/account/account-settings.tsx

@@ -4,22 +4,17 @@ import ChangePassword from "@/features/user/components/change-password";
 import { Divider } from "@mantine/core";
 import AccountAvatar from "@/features/user/components/account-avatar";
 import SettingsTitle from "@/components/settings/settings-title.tsx";
-import { getAppName } from "@/lib/config.ts";
-import { Helmet } from "react-helmet-async";
 import { useTranslation } from "react-i18next";
 import { AccountMfaSection } from "@/features/user/components/account-mfa-section";
 import SessionList from "@/features/session/components/session-list";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function AccountSettings() {
   const { t } = useTranslation();
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title={t("My Profile")} />
-        <title>
-          {t("My Profile")} - {getAppName()}
-        </title>
-      </Helmet>
       <SettingsTitle title={t("My Profile")} />
 
       <AccountAvatar />

apps/client/src/pages/settings/group/group-info.tsx

@@ -1,20 +1,15 @@
 import SettingsTitle from "@/components/settings/settings-title.tsx";
 import GroupMembersList from "@/features/group/components/group-members";
 import GroupDetails from "@/features/group/components/group-details";
-import { getAppName } from "@/lib/config.ts";
-import { Helmet } from "react-helmet-async";
 import { useTranslation } from "react-i18next";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function GroupInfo() {
   const { t } = useTranslation();
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title={t("Manage Group")} />
-        <title>
-          {t("Manage Group")} - {getAppName()}
-        </title>
-      </Helmet>
       <SettingsTitle title={t("Manage Group")} />
       <GroupDetails />
       <GroupMembersList />

apps/client/src/pages/settings/group/groups.tsx

@@ -3,9 +3,8 @@ import SettingsTitle from "@/components/settings/settings-title.tsx";
 import { Group } from "@mantine/core";
 import CreateGroupModal from "@/features/group/components/create-group-modal";
 import useUserRole from "@/hooks/use-user-role.tsx";
-import {getAppName} from "@/lib/config.ts";
-import {Helmet} from "react-helmet-async";
 import { useTranslation } from "react-i18next";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function Groups() {
   const { t } = useTranslation();
@@ -13,9 +12,7 @@ export default function Groups() {
 
   return (
     <>
-        <Helmet>
+      <DocumentTitle title={t("Groups")} />
-            <title>{t("Groups")} - {getAppName()}</title>
-        </Helmet>
       <SettingsTitle title={t("Groups")} />
 
       <Group my="md" justify="flex-end">

apps/client/src/pages/settings/shares/shares.tsx

@@ -1,22 +1,17 @@
 import SettingsTitle from "@/components/settings/settings-title.tsx";
-import { Helmet } from "react-helmet-async";
-import { getAppName } from "@/lib/config.ts";
 import { useTranslation } from "react-i18next";
 import ShareList from "@/features/share/components/share-list.tsx";
 import { Alert, Text } from "@mantine/core";
 import { IconInfoCircle } from "@tabler/icons-react";
 import React from "react";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function Shares() {
   const { t } = useTranslation();
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title={t("Public sharing")} />
-        <title>
-          {t("Public sharing")} - {getAppName()}
-        </title>
-      </Helmet>
       <SettingsTitle title={t("Public sharing")} />
 
       <Alert variant="light" color="blue" icon={<IconInfoCircle />}>

apps/client/src/pages/settings/space/spaces.tsx

@@ -3,9 +3,8 @@ import SpaceList from "@/features/space/components/space-list.tsx";
 import useUserRole from "@/hooks/use-user-role.tsx";
 import { Group } from "@mantine/core";
 import CreateSpaceModal from "@/features/space/components/create-space-modal.tsx";
-import { Helmet } from "react-helmet-async";
-import { getAppName } from "@/lib/config.ts";
 import { useTranslation } from "react-i18next";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function Spaces() {
   const { t } = useTranslation();
@@ -13,11 +12,7 @@ export default function Spaces() {
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title={t("Spaces")} />
-        <title>
-          {t("Spaces")} - {getAppName()}
-        </title>
-      </Helmet>
       <SettingsTitle title={t("Spaces")} />
 
       <Group my="md" justify="flex-end">

apps/client/src/pages/settings/workspace/workspace-members.tsx

@@ -6,11 +6,10 @@ import { useEffect, useState } from "react";
 import { useNavigate, useSearchParams } from "react-router-dom";
 import WorkspaceInvitesTable from "@/features/workspace/components/members/components/workspace-invites-table.tsx";
 import useUserRole from "@/hooks/use-user-role.tsx";
-import { getAppName } from "@/lib/config.ts";
-import { Helmet } from "react-helmet-async";
 import { useTranslation } from "react-i18next";
 import { useAtom } from "jotai";
 import { workspaceAtom } from "@/features/user/atoms/current-user-atom.ts";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function WorkspaceMembers() {
   const { t } = useTranslation();
@@ -38,11 +37,7 @@ export default function WorkspaceMembers() {
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title={t("Members")} />
-        <title>
-          {t("Members")} - {getAppName()}
-        </title>
-      </Helmet>
       <SettingsTitle title={t("Members")} />
 
       {/* <WorkspaceInviteSection /> */}

apps/client/src/pages/settings/workspace/workspace-settings.tsx

@@ -2,21 +2,19 @@ import SettingsTitle from "@/components/settings/settings-title.tsx";
 import WorkspaceNameForm from "@/features/workspace/components/settings/components/workspace-name-form";
 import WorkspaceIcon from "@/features/workspace/components/settings/components/workspace-icon.tsx";
 import { useTranslation } from "react-i18next";
-import { getAppName, isCloud } from "@/lib/config.ts";
+import { isCloud } from "@/lib/config.ts";
-import { Helmet } from "react-helmet-async";
 import ManageHostname from "@/ee/components/manage-hostname.tsx";
 import { Divider } from "@mantine/core";
 import AllowMemberTemplates from "@/ee/security/components/allow-member-templates.tsx";
 import WorkspaceDefaultPageEditMode from "@/features/workspace/components/settings/components/workspace-default-page-edit-mode.tsx";
 import PersonalSpacesSetting from "@/ee/personal-space/components/personal-spaces-setting.tsx";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function WorkspaceSettings() {
   const { t } = useTranslation();
   return (
     <>
-      <Helmet>
+      <DocumentTitle title="Workspace Settings" />
-        <title>Workspace Settings - {getAppName()}</title>
-      </Helmet>
       <SettingsTitle title={t("General")} />
       <WorkspaceIcon />
       <WorkspaceNameForm />

apps/client/src/pages/share/shared-page.tsx

@@ -1,5 +1,4 @@
 import { useNavigate, useParams } from "react-router-dom";
-import { Helmet } from "react-helmet-async";
 import { useTranslation } from "react-i18next";
 import { useSharePageQuery } from "@/features/share/queries/share-query.ts";
 import { Container } from "@mantine/core";
@@ -14,6 +13,7 @@ import {
   sharedTreeDataAtom,
 } from "@/features/share/atoms/shared-page-atom.ts";
 import { isPageInTree } from "@/features/share/utils.ts";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function SharedPage() {
   const { t } = useTranslation();
@@ -56,12 +56,14 @@ export default function SharedPage() {
 
   return (
     <div>
-      <Helmet>
+      <DocumentTitle
-        <title>{`${data?.page?.title || t("untitled")}`}</title>
+        title={data?.page?.title || t("untitled")}
+        withAppName={false}
+      >
         {!data?.share.searchIndexing && (
           <meta name="robots" content="noindex" />
         )}
-      </Helmet>
+      </DocumentTitle>
 
       <Container fluid={fullWidth} size={fullWidth ? undefined : 900} p={0}>
         <ReadonlyPageEditor

apps/client/src/pages/space/space-home.tsx

@@ -2,8 +2,7 @@ import {Container} from "@mantine/core";
 import SpaceHomeTabs from "@/features/space/components/space-home-tabs.tsx";
 import {useParams} from "react-router-dom";
 import {useGetSpaceBySlugQuery} from "@/features/space/queries/space-query.ts";
-import {getAppName} from "@/lib/config.ts";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
-import {Helmet} from "react-helmet-async";
 
 export default function SpaceHome() {
     const {spaceSlug} = useParams();
@@ -11,9 +10,7 @@ export default function SpaceHome() {
 
     return (
         <>
-            <Helmet>
+            <DocumentTitle title={space?.name || 'Overview'} />
-                <title>{space?.name || 'Overview'} - {getAppName()}</title>
-            </Helmet>
             <Container size={"900"} pt="xl">
                 {space && <SpaceHomeTabs/>}
             </Container>

apps/client/src/pages/spaces/spaces.tsx

@@ -1,13 +1,12 @@
 import { Container, Title, Text, Group, Box } from "@mantine/core";
 import { useTranslation } from "react-i18next";
-import { Helmet } from "react-helmet-async";
-import { getAppName } from "@/lib/config";
 import { useGetSpacesQuery } from "@/features/space/queries/space-query";
 import CreateSpaceModal from "@/features/space/components/create-space-modal";
 import { AllSpacesList } from "@/features/space/components/spaces-page";
 import FavoriteSpacesGrid from "@/features/space/components/spaces-page/favorite-spaces-grid";
 import { usePaginateAndSearch } from "@/hooks/use-paginate-and-search";
 import useUserRole from "@/hooks/use-user-role";
+import { DocumentTitle } from "@/components/ui/document-title.tsx";
 
 export default function Spaces() {
   const { t } = useTranslation();
@@ -22,11 +21,7 @@ export default function Spaces() {
 
   return (
     <>
-      <Helmet>
+      <DocumentTitle title={t("Spaces")} />
-        <title>
-          {t("Spaces")} - {getAppName()}
-        </title>
-      </Helmet>
 
       <Container size={"800"} pt="xl">
         <Group justify="space-between" mb="xl">

apps/server/package.json

@@ -43,6 +43,7 @@
     "@fastify/cookie": "11.0.2",
     "@fastify/multipart": "10.0.0",
     "@fastify/static": "10.1.2",
+    "@jmondi/oauth2-server": "^4.3.7",
     "@keyv/redis": "5.1.6",
     "@langchain/core": "1.1.46",
     "@langchain/textsplitters": "1.0.1",
@@ -51,19 +52,19 @@
     "@nestjs-labs/nestjs-ioredis": "11.0.4",
     "@nestjs/bullmq": "11.0.4",
     "@nestjs/cache-manager": "3.1.3",
-    "@nestjs/common": "11.1.27",
+    "@nestjs/common": "11.1.28",
     "@nestjs/config": "4.0.4",
     "@nestjs/core": "11.1.27",
     "@nestjs/event-emitter": "3.1.0",
     "@nestjs/jwt": "11.0.2",
     "@nestjs/mapped-types": "2.1.1",
     "@nestjs/passport": "11.0.5",
-    "@nestjs/platform-fastify": "11.1.27",
+    "@nestjs/platform-fastify": "11.1.28",
-    "@nestjs/platform-socket.io": "11.1.27",
+    "@nestjs/platform-socket.io": "11.1.28",
     "@nestjs/schedule": "6.1.3",
     "@nestjs/terminus": "11.1.1",
     "@nestjs/throttler": "6.5.0",
-    "@nestjs/websockets": "11.1.27",
+    "@nestjs/websockets": "11.1.28",
     "@node-saml/passport-saml": "5.1.0",
     "@socket.io/redis-adapter": "8.3.0",
     "ai": "6.0.134",
@@ -90,8 +91,8 @@
     "ldapts": "8.1.7",
     "mammoth": "1.12.0",
     "mime-types": "3.0.2",
-    "msgpackr": "^1.11.9",
+    "msgpackr": "1.11.9",
-    "nanoid": "5.1.7",
+    "nanoid": "5.1.16",
     "nestjs-cls": "6.2.0",
     "nestjs-kysely": "3.1.2",
     "nestjs-pino": "4.6.1",
@@ -102,7 +103,7 @@
     "passport-google-oauth20": "2.0.0",
     "passport-jwt": "4.0.1",
     "pg-tsquery": "8.4.2",
-    "pgvector": "^0.2.1",
+    "pgvector": "0.2.1",
     "pino-http": "11.0.0",
     "pino-pretty": "13.1.3",
     "postgres": "3.4.8",

apps/server/src/app.module.ts

@@ -27,6 +27,7 @@ import { LoggerModule } from './common/logger/logger.module';
 import { ClsModule } from 'nestjs-cls';
 import { NoopAuditModule } from './integrations/audit/audit.module';
 import { ThrottleModule } from './integrations/throttle/throttle.module';
+import { EncryptionModule } from './integrations/encryption/encryption.module';
 
 const enterpriseModules = [];
 try {
@@ -53,6 +54,7 @@ try {
     CoreModule,
     DatabaseModule,
     EnvironmentModule,
+    EncryptionModule,
     RedisModule.forRootAsync({
       useClass: RedisConfigService,
     }),

apps/server/src/collaboration/collaboration.util.ts

@@ -1,4 +1,5 @@
 import { StarterKit } from '@tiptap/starter-kit';
+import { Document } from '@tiptap/extension-document';
 import { TextAlign } from '@tiptap/extension-text-align';
 import { Superscript } from '@tiptap/extension-superscript';
 import SubScript from '@tiptap/extension-subscript';
@@ -45,8 +46,16 @@ import {
   TransclusionSource,
   TransclusionReference,
   BaseEmbed,
+  Footnotes,
+  Footnote,
+  FootnoteReference,
 } from '@docmost/editor-ext';
-import { generateText, getSchema, JSONContent } from '@tiptap/core';
+import {
+  extensions as coreExtensions,
+  generateText,
+  getSchema,
+  JSONContent,
+} from '@tiptap/core';
 import { generateHTML, generateJSON } from '../common/helpers/prosemirror/html';
 // @tiptap/html library works best for generating prosemirror json state but not HTML
 // see: https://github.com/ueberdosis/tiptap/issues/5352
@@ -57,12 +66,17 @@ import * as Y from 'yjs';
 import { Logger } from '@nestjs/common';
 
 export const tiptapExtensions = [
+  coreExtensions.TextDirection.configure({ direction: 'auto' }),
   StarterKit.configure({
+    document: false,
     codeBlock: false,
     link: false,
     trailingNode: false,
     heading: false,
   }),
+  Document.extend({
+    content: 'block+ footnotes?',
+  }),
   Heading,
   UniqueID.configure({
     types: ['heading', 'paragraph', 'transclusionSource'],
@@ -110,7 +124,10 @@ export const tiptapExtensions = [
   Status,
   TransclusionSource,
   TransclusionReference,
-  BaseEmbed
+  BaseEmbed,
+  Footnotes,
+  Footnote,
+  FootnoteReference,
 ] as any;
 
 export function jsonToHtml(tiptapJson: any) {

apps/server/src/common/decorators/oauth-scope.decorator.ts

@@ -0,0 +1,8 @@
+import { SetMetadata } from '@nestjs/common';
+
+export const OAUTH_SCOPE_KEY = 'oauthScope';
+
+export type OAuthRouteScope = 'read' | 'write';
+
+export const OAuthScope = (scope: OAuthRouteScope) =>
+  SetMetadata(OAUTH_SCOPE_KEY, scope);

apps/server/src/common/decorators/require-session-auth.decorator.ts

@@ -0,0 +1,6 @@
+import { SetMetadata } from '@nestjs/common';
+
+export const REQUIRE_SESSION_AUTH_KEY = 'requireSessionAuth';
+
+export const RequireSessionAuth = () =>
+  SetMetadata(REQUIRE_SESSION_AUTH_KEY, true);

apps/server/src/common/events/audit-events.ts

@@ -23,6 +23,11 @@ export const AuditEvent = {
   API_KEY_UPDATED: 'api_key.updated',
   API_KEY_DELETED: 'api_key.deleted',
 
+  // OAuth
+  OAUTH_CLIENT_REGISTERED: 'oauth_client.registered',
+  OAUTH_GRANT_CREATED: 'oauth_grant.created',
+  OAUTH_GRANT_REVOKED: 'oauth_grant.revoked',
+
   // SCIM Tokens
   SCIM_TOKEN_CREATED: 'scim_token.created',
   SCIM_TOKEN_UPDATED: 'scim_token.updated',
@@ -124,6 +129,8 @@ export const AuditResource = {
   COMMENT: 'comment',
   SHARE: 'share',
   API_KEY: 'api_key',
+  OAUTH_CLIENT: 'oauth_client',
+  OAUTH_GRANT: 'oauth_grant',
   SCIM_TOKEN: 'scim_token',
   SSO_PROVIDER: 'sso_provider',
   WORKSPACE_INVITATION: 'workspace_invitation',

apps/server/src/common/events/event.contants.ts

@@ -12,6 +12,8 @@ export enum EventName {
   SPACE_UPDATED = 'space.updated',
   SPACE_DELETED = 'space.deleted',
 
+  USER_PASSWORD_RESET = 'user.password.reset',
+
   WORKSPACE_CREATED = 'workspace.created',
   WORKSPACE_UPDATED = 'workspace.updated',
   WORKSPACE_DELETED = 'workspace.deleted',

apps/server/src/common/features.ts

@@ -23,6 +23,7 @@ export const Feature = {
   PERSONAL_SPACES: 'spaces:personal',
   DOCX_EXPORT: 'export:docx',
   BASES: 'bases',
+  OAUTH: 'oauth',
 } as const;
 
 export type FeatureKey = (typeof Feature)[keyof typeof Feature];

apps/server/src/common/guards/jwt-auth.guard.spec.ts

@@ -0,0 +1,186 @@
+import {
+  ExecutionContext,
+  ForbiddenException,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { JwtAuthGuard } from './jwt-auth.guard';
+import { OAUTH_SCOPE_KEY } from '../decorators/oauth-scope.decorator';
+import { REQUIRE_SESSION_AUTH_KEY } from '../decorators/require-session-auth.decorator';
+import { JwtType } from '../../core/auth/dto/jwt-payload';
+
+const handlerSentinel = () => 'handler';
+const classSentinel = class Controller {};
+
+function createCtx(): ExecutionContext {
+  return {
+    getHandler: () => handlerSentinel,
+    getClass: () => classSentinel,
+  } as any;
+}
+
+function createGuard(scopeMetadata?: unknown, requireSession?: boolean) {
+  const reflector = {
+    getAllAndOverride: jest.fn((key: string) =>
+      key === REQUIRE_SESSION_AUTH_KEY ? requireSession : scopeMetadata,
+    ),
+  } as any;
+  const environmentService = {
+    isCloud: jest.fn().mockReturnValue(false),
+  } as any;
+  const guard = new JwtAuthGuard(reflector, environmentService);
+  return { guard, reflector };
+}
+
+function oauthUser(scopes: string[]) {
+  return {
+    user: { id: 'user_1' },
+    workspace: { id: 'ws_1' },
+    oauth: { grantId: 'grant_1', scopes },
+  };
+}
+
+describe('JwtAuthGuard.handleRequest', () => {
+  it('rethrows the strategy error', () => {
+    const { guard } = createGuard();
+    const err = new UnauthorizedException('bad token');
+
+    expect(() => guard.handleRequest(err, null, null, createCtx())).toThrow(err);
+  });
+
+  it('throws UnauthorizedException when there is no user', () => {
+    const { guard } = createGuard();
+
+    expect(() => guard.handleRequest(null, null, null, createCtx())).toThrow(
+      UnauthorizedException,
+    );
+  });
+
+  it('returns a non-oauth user untouched without consulting scope metadata', () => {
+    const { guard, reflector } = createGuard();
+    const user = { user: { id: 'user_1' }, workspace: { id: 'ws_1' } };
+
+    expect(guard.handleRequest(null, user, null, createCtx())).toBe(user);
+    expect(reflector.getAllAndOverride).not.toHaveBeenCalledWith(
+      OAUTH_SCOPE_KEY,
+      expect.anything(),
+    );
+  });
+
+  it('forbids an oauth user on a route without scope metadata', () => {
+    const { guard, reflector } = createGuard(undefined);
+
+    expect(() =>
+      guard.handleRequest(null, oauthUser(['read', 'write']), null, createCtx()),
+    ).toThrow(ForbiddenException);
+    expect(reflector.getAllAndOverride).toHaveBeenCalledWith(OAUTH_SCOPE_KEY, [
+      handlerSentinel,
+      classSentinel,
+    ]);
+  });
+
+  it('passes read scope on a read route', () => {
+    const { guard } = createGuard('read');
+    const user = oauthUser(['read']);
+
+    expect(guard.handleRequest(null, user, null, createCtx())).toBe(user);
+  });
+
+  it('forbids read scope on a write route with insufficient_scope', () => {
+    const { guard } = createGuard('write');
+
+    expect(() =>
+      guard.handleRequest(null, oauthUser(['read']), null, createCtx()),
+    ).toThrow('insufficient_scope');
+  });
+
+  it('passes write scope on a read route', () => {
+    const { guard } = createGuard('read');
+    const user = oauthUser(['write']);
+
+    expect(guard.handleRequest(null, user, null, createCtx())).toBe(user);
+  });
+
+  it('passes write scope on a write route', () => {
+    const { guard } = createGuard('write');
+    const user = oauthUser(['write']);
+
+    expect(guard.handleRequest(null, user, null, createCtx())).toBe(user);
+  });
+
+  describe('session-only routes', () => {
+    const sessionUser = {
+      user: { id: 'user_1' },
+      workspace: { id: 'ws_1' },
+      authType: JwtType.ACCESS,
+    };
+
+    it('allows a signed-in session', () => {
+      const { guard } = createGuard(undefined, true);
+
+      expect(guard.handleRequest(null, sessionUser, null, createCtx())).toBe(
+        sessionUser,
+      );
+    });
+
+    it('forbids an api key', () => {
+      const { guard } = createGuard(undefined, true);
+      const apiKeyUser = {
+        user: { id: 'user_1' },
+        workspace: { id: 'ws_1' },
+        authType: JwtType.API_KEY,
+      };
+
+      expect(() =>
+        guard.handleRequest(null, apiKeyUser, null, createCtx()),
+      ).toThrow('This action requires an interactive user session');
+    });
+
+    it('forbids an oauth token even when it carries write scope', () => {
+      const { guard } = createGuard('write', true);
+      const user = { ...oauthUser(['write']), authType: JwtType.OAUTH_ACCESS };
+
+      expect(() => guard.handleRequest(null, user, null, createCtx())).toThrow(
+        'This action requires an interactive user session',
+      );
+    });
+
+    it('leaves api keys working on routes without the marker', () => {
+      const { guard } = createGuard(undefined, undefined);
+      const apiKeyUser = {
+        user: { id: 'user_1' },
+        workspace: { id: 'ws_1' },
+        authType: JwtType.API_KEY,
+      };
+
+      expect(guard.handleRequest(null, apiKeyUser, null, createCtx())).toBe(
+        apiKeyUser,
+      );
+    });
+  });
+
+  it('lets handler metadata override class metadata', () => {
+    const metadataByTarget = new Map<unknown, string>([
+      [handlerSentinel, 'write'],
+      [classSentinel, 'read'],
+    ]);
+    const reflector = {
+      getAllAndOverride: jest.fn((key: string, targets: unknown[]) => {
+        if (key === REQUIRE_SESSION_AUTH_KEY) {
+          return undefined;
+        }
+        for (const target of targets) {
+          if (metadataByTarget.has(target)) {
+            return metadataByTarget.get(target);
+          }
+        }
+        return undefined;
+      }),
+    } as any;
+    const environmentService = { isCloud: jest.fn().mockReturnValue(false) } as any;
+    const guard = new JwtAuthGuard(reflector, environmentService);
+
+    expect(() =>
+      guard.handleRequest(null, oauthUser(['read']), null, createCtx()),
+    ).toThrow('insufficient_scope');
+  });
+});

apps/server/src/common/guards/jwt-auth.guard.ts

@@ -1,16 +1,26 @@
 import {
   ExecutionContext,
+  ForbiddenException,
   Injectable,
+  Logger,
   UnauthorizedException,
 } from '@nestjs/common';
 import { AuthGuard } from '@nestjs/passport';
 import { IS_PUBLIC_KEY } from '../decorators/public.decorator';
+import {
+  OAUTH_SCOPE_KEY,
+  OAuthRouteScope,
+} from '../decorators/oauth-scope.decorator';
+import { REQUIRE_SESSION_AUTH_KEY } from '../decorators/require-session-auth.decorator';
+import { JwtType } from '../../core/auth/dto/jwt-payload';
 import { Reflector } from '@nestjs/core';
 import { EnvironmentService } from '../../integrations/environment/environment.service';
 import { addDays } from 'date-fns';
 
 @Injectable()
 export class JwtAuthGuard extends AuthGuard('jwt') {
+  private logger = new Logger('JwtAuthGuard');
+
   constructor(
     private reflector: Reflector,
     private environmentService: EnvironmentService,
@@ -36,6 +46,39 @@ export class JwtAuthGuard extends AuthGuard('jwt') {
       throw err || new UnauthorizedException();
     }
 
+    const requiresSession = this.reflector.getAllAndOverride<boolean>(
+      REQUIRE_SESSION_AUTH_KEY,
+      [ctx.getHandler(), ctx.getClass()],
+    );
+    if (requiresSession && user.authType !== JwtType.ACCESS) {
+      this.logger.warn(
+        `session-only endpoint ${ctx.getClass()?.name}.${ctx.getHandler()?.name} refused authType ${user.authType}`,
+      );
+      throw new ForbiddenException(
+        'This action requires an interactive user session',
+      );
+    }
+
+    if (user.oauth) {
+      const required = this.reflector.getAllAndOverride<
+        OAuthRouteScope | undefined
+      >(OAUTH_SCOPE_KEY, [ctx.getHandler(), ctx.getClass()]);
+      if (!required) {
+        this.logger.warn(
+          `oauth scope check: no @OAuthScope metadata on ${ctx.getClass()?.name}.${ctx.getHandler()?.name}`,
+        );
+        throw new ForbiddenException('OAuth tokens cannot access this endpoint');
+      }
+      const scopes: string[] = user.oauth.scopes ?? [];
+      const satisfied =
+        required === 'read'
+          ? scopes.includes('read') || scopes.includes('write')
+          : scopes.includes('write');
+      if (!satisfied) {
+        throw new ForbiddenException('insufficient_scope');
+      }
+    }
+
     this.setJoinedWorkspacesCookie(user, ctx);
     return user;
   }

apps/server/src/common/helpers/security-headers.spec.ts

@@ -0,0 +1,66 @@
+import {
+  resolveFrameHeader,
+  resolveFrameHeadersForPath,
+  SecurityHeader,
+} from './security-headers';
+
+describe('resolveFrameHeader', () => {
+  it('denies framing with X-Frame-Options when embedding is off', () => {
+    expect(resolveFrameHeader(false, [])).toEqual({
+      name: 'X-Frame-Options',
+      value: 'SAMEORIGIN',
+    });
+  });
+
+  it('returns null when embedding is on but no origins are configured', () => {
+    expect(resolveFrameHeader(true, [])).toBeNull();
+  });
+
+  it('emits a frame-ancestors CSP for the allowed origins', () => {
+    expect(resolveFrameHeader(true, ['https://a.example', 'https://b.example']))
+      .toEqual({
+        name: 'Content-Security-Policy',
+        value: "frame-ancestors 'self' https://a.example https://b.example",
+      });
+  });
+});
+
+describe('resolveFrameHeadersForPath', () => {
+  const configured: SecurityHeader = {
+    name: 'Content-Security-Policy',
+    value: "frame-ancestors 'self' https://a.example",
+  };
+
+  it.each(['/oauth/consent', '/oauth/consent/nested'])(
+    'force-denies %s regardless of configured header',
+    (path) => {
+      expect(resolveFrameHeadersForPath(path, configured)).toEqual([
+        { name: 'X-Frame-Options', value: 'DENY' },
+        { name: 'Content-Security-Policy', value: "frame-ancestors 'none'" },
+      ]);
+    },
+  );
+
+  it('force-denies consent even when the global header is absent', () => {
+    expect(resolveFrameHeadersForPath('/oauth/consent', null)).toEqual([
+      { name: 'X-Frame-Options', value: 'DENY' },
+      { name: 'Content-Security-Policy', value: "frame-ancestors 'none'" },
+    ]);
+  });
+
+  it('does not match an unrelated path that merely contains the prefix', () => {
+    expect(
+      resolveFrameHeadersForPath('/oauth/consenting-adults', configured),
+    ).toEqual([configured]);
+  });
+
+  it('passes the configured header through for other paths', () => {
+    expect(resolveFrameHeadersForPath('/home', configured)).toEqual([
+      configured,
+    ]);
+  });
+
+  it('returns nothing for other paths when no header is configured', () => {
+    expect(resolveFrameHeadersForPath('/home', null)).toEqual([]);
+  });
+});

apps/server/src/common/helpers/security-headers.ts

@@ -17,3 +17,19 @@ export function resolveFrameHeader(
     value: `frame-ancestors 'self' ${allowedOrigins.join(' ')}`,
   };
 }
+
+// Deny OAuth consent in iframe
+export const OAUTH_CONSENT_PATH = '/oauth/consent';
+
+export function resolveFrameHeadersForPath(
+  path: string,
+  configuredHeader: SecurityHeader | null,
+): SecurityHeader[] {
+  if (path === OAUTH_CONSENT_PATH || path.startsWith(`${OAUTH_CONSENT_PATH}/`)) {
+    return [
+      { name: 'X-Frame-Options', value: 'DENY' },
+      { name: 'Content-Security-Policy', value: "frame-ancestors 'none'" },
+    ];
+  }
+  return configuredHeader ? [configuredHeader] : [];
+}

apps/server/src/core/attachment/attachment.controller.ts

@@ -24,6 +24,7 @@ import * as bytes from 'bytes';
 import { AuthUser } from '../../common/decorators/auth-user.decorator';
 import { AuthWorkspace } from '../../common/decorators/auth-workspace.decorator';
 import { JwtAuthGuard } from '../../common/guards/jwt-auth.guard';
+import { OAuthScope } from '../../common/decorators/oauth-scope.decorator';
 import { Attachment, User, Workspace } from '@docmost/db/types/entity.types';
 import { StorageService } from '../../integrations/storage/storage.service';
 import {
@@ -53,8 +54,14 @@ import { EnvironmentService } from '../../integrations/environment/environment.s
 import { TokenService } from '../auth/services/token.service';
 import { JwtAttachmentPayload, JwtType } from '../auth/dto/jwt-payload';
 import * as path from 'path';
-import { AttachmentInfoDto, RemoveIconDto } from './dto/attachment.dto';
+import {
+  AttachmentInfoDto,
+  PageIdDto,
+  RemoveIconDto,
+} from './dto/attachment.dto';
+import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
 import { PageAccessService } from '../page/page-access/page-access.service';
+import { DomainService } from '../../integrations/environment/domain.service';
 import { AuditEvent, AuditResource } from '../../common/events/audit-events';
 import {
   AUDIT_SERVICE,
@@ -75,6 +82,7 @@ export class AttachmentController {
     private readonly environmentService: EnvironmentService,
     private readonly tokenService: TokenService,
     private readonly pageAccessService: PageAccessService,
+    private readonly domainService: DomainService,
     @Inject(AUDIT_SERVICE) private readonly auditService: IAuditService,
   ) {}
 
@@ -151,7 +159,10 @@ export class AttachmentController {
         },
       });
 
-      return res.send(fileResponse);
+      return res.send({
+        ...fileResponse,
+        url: this.buildFileUrl(workspace, fileResponse),
+      });
     } catch (err: any) {
       if (err?.statusCode === 413) {
         const errMessage = `File too large. Exceeds the ${this.environmentService.getFileUploadSizeLimit()} limit`;
@@ -165,6 +176,7 @@ export class AttachmentController {
 
   @UseGuards(JwtAuthGuard)
   @Get('/files/:fileId/:fileName')
+  @OAuthScope('read')
   async getFile(
     @Req() req: FastifyRequest,
     @Res() res: FastifyReply,
@@ -411,7 +423,38 @@ export class AttachmentController {
 
     await this.pageAccessService.validateCanView(page, user);
 
-    return attachment;
+    return { ...attachment, url: this.buildFileUrl(workspace, attachment) };
+  }
+
+  @UseGuards(JwtAuthGuard)
+  @HttpCode(HttpStatus.OK)
+  @Post('pages/attachments')
+  @OAuthScope('read')
+  async getPageAttachments(
+    @Body() dto: PageIdDto,
+    @Body() pagination: PaginationOptions,
+    @AuthUser() user: User,
+    @AuthWorkspace() workspace: Workspace,
+  ) {
+    const page = await this.pageRepo.findById(dto.pageId);
+    if (!page || page.workspaceId !== workspace.id) {
+      throw new NotFoundException('Page not found');
+    }
+
+    await this.pageAccessService.validateCanView(page, user);
+
+    const result = await this.attachmentRepo.findPageAttachments(
+      page.id,
+      pagination,
+    );
+
+    return {
+      ...result,
+      items: result.items.map((attachment) => ({
+        ...attachment,
+        url: this.buildFileUrl(workspace, attachment),
+      })),
+    };
   }
 
   @UseGuards(JwtAuthGuard)
@@ -465,6 +508,10 @@ export class AttachmentController {
     }
   }
 
+  private buildFileUrl(workspace: Workspace, attachment: Attachment): string {
+    return `${this.domainService.getUrl(workspace.hostname)}/api/files/${attachment.id}/${encodeURIComponent(attachment.fileName)}`;
+  }
+
   private async sendFileResponse(
     req: FastifyRequest,
     res: FastifyReply,

apps/server/src/core/attachment/dto/attachment.dto.ts

@@ -1,4 +1,11 @@
-import { IsEnum, IsIn, IsNotEmpty, IsOptional, IsUUID } from 'class-validator';
+import {
+  IsEnum,
+  IsIn,
+  IsNotEmpty,
+  IsOptional,
+  IsString,
+  IsUUID,
+} from 'class-validator';
 import { AttachmentType } from '../attachment.constants';
 
 export class AttachmentInfoDto {
@@ -7,6 +14,12 @@ export class AttachmentInfoDto {
   attachmentId: string;
 }
 
+export class PageIdDto {
+  @IsString()
+  @IsNotEmpty()
+  pageId: string;
+}
+
 export class RemoveIconDto {
   @IsEnum(AttachmentType)
   @IsIn([

apps/server/src/core/auth/auth.controller.ts

@@ -12,7 +12,7 @@ import {
 } from '@nestjs/common';
 import { SkipThrottle, ThrottlerGuard } from '@nestjs/throttler';
 import {
-  AI_CHAT_THROTTLER,
+  ALL_NAMED_THROTTLERS_SKIPPED,
   AUTH_THROTTLER,
 } from '../../integrations/throttle/throttler-names';
 import { LoginDto } from './dto/login.dto';
@@ -38,7 +38,7 @@ import {
   IAuditService,
 } from '../../integrations/audit/audit.service';
 
-@SkipThrottle({ [AI_CHAT_THROTTLER]: true })
+@SkipThrottle({ ...ALL_NAMED_THROTTLERS_SKIPPED, [AUTH_THROTTLER]: false })
 @UseGuards(ThrottlerGuard)
 @Controller('auth')
 export class AuthController {

apps/server/src/core/auth/dto/jwt-payload.ts

@@ -7,6 +7,7 @@ export enum JwtType {
   API_KEY = 'api_key',
   PDF_RENDER = 'pdf_render',
   PDF_EXPORT_DOWNLOAD = 'pdf_export_download',
+  OAUTH_ACCESS = 'oauth_access',
 }
 export type JwtPayload = {
   sub: string;
@@ -59,3 +60,14 @@ export type JwtPdfExportDownloadPayload = {
   workspaceId: string;
   type: 'pdf_export_download';
 };
+
+export type JwtOAuthPayload = {
+  sub: string;
+  workspaceId: string;
+  grantId: string;
+  scope: string;
+  aud: string;
+  iss: string;
+  jti: string;
+  type: JwtType.OAUTH_ACCESS;
+};

apps/server/src/core/auth/services/auth.service.ts

@@ -2,6 +2,7 @@ import {
   BadRequestException,
   Inject,
   Injectable,
+  Logger,
   NotFoundException,
   UnauthorizedException,
 } from '@nestjs/common';
@@ -40,9 +41,13 @@ import {
   IAuditService,
 } from '../../../integrations/audit/audit.service';
 import { EnvironmentService } from '../../../integrations/environment/environment.service';
+import { EventEmitter2 } from '@nestjs/event-emitter';
+import { EventName } from '../../../common/events/event.contants';
 
 @Injectable()
 export class AuthService {
+  private readonly logger = new Logger(AuthService.name);
+
   constructor(
     private signupService: SignupService,
     private tokenService: TokenService,
@@ -53,6 +58,7 @@ export class AuthService {
     private mailService: MailService,
     private domainService: DomainService,
     private environmentService: EnvironmentService,
+    private eventEmitter: EventEmitter2,
     @InjectKysely() private readonly db: KyselyDB,
     @Inject(AUDIT_SERVICE) private readonly auditService: IAuditService,
   ) {}
@@ -261,6 +267,19 @@ export class AuthService {
 
     await this.userSessionRepo.deleteByUserId(user.id, workspace.id);
 
+    // A failed revocation must not block the reset itself; log loudly instead.
+    try {
+      await this.eventEmitter.emitAsync(EventName.USER_PASSWORD_RESET, {
+        userId: user.id,
+        workspaceId: workspace.id,
+      });
+    } catch (err) {
+      this.logger.error(
+        `failed to revoke oauth grants for user ${user.id} after password reset`,
+        err,
+      );
+    }
+
     this.auditService.setActorId(user.id);
     this.auditService.log({
       event: AuditEvent.USER_PASSWORD_RESET,