feat(server): add global encryption module (AES-256-GCM)

Provides an injectable EncryptionService that encrypts/decrypts strings
with AES-256-GCM using a key derived from APP_SECRET with domain
separation. Payloads are base64 JSON envelopes with validated IV and
auth tag lengths, and failures surface as typed errors.

apps/client/public/locales/en-US/translation.json

@@ -1297,5 +1297,10 @@
   "Select version from {{date}}": "Select version from {{date}}",
   "Version actions for {{date}}": "Version actions for {{date}}",
   "Comparing {{newer}} and {{older}}": "Comparing {{newer}} and {{older}}",
-  "Exit compare": "Exit compare"
+  "Exit compare": "Exit compare",
+  "Search attachments...": "Search attachments...",
+  "Error loading attachments.": "Error loading attachments.",
+  "No attachments on this page yet.": "No attachments on this page yet.",
+  "Uploaded by {{name}}": "Uploaded by {{name}}",
+  "Download {{name}}": "Download {{name}}"
 }

apps/client/src/ee/ai-chat/components/chat-input.tsx

@@ -255,6 +255,7 @@ export default function ChatInput({
     },
     content: "",
     editable: true,
+    textDirection: "auto",
     immediatelyRender: true,
     shouldRerenderOnTransaction: false,
     autofocus: autofocus ? "end" : false,

apps/client/src/ee/template/components/readonly-template-editor.tsx

@@ -41,6 +41,7 @@ export default function ReadonlyTemplateEditor({
       <EditorProvider
         editable={false}
         immediatelyRender={true}
+        textDirection="auto"
         extensions={extensions}
         content={template.content}
       />

apps/client/src/ee/template/pages/template-editor.tsx

@@ -87,6 +87,7 @@ export default function TemplateEditor() {
   const editor = useEditor({
     extensions: templateExtensions,
     content: "",
+    textDirection: "auto",
     editorProps: {
       scrollThreshold: 80,
       scrollMargin: 80,

apps/client/src/features/attachments/components/attachment-file-icon.tsx

@@ -0,0 +1,59 @@
+import { ThemeIcon } from "@mantine/core";
+import {
+  IconFile,
+  IconFileTypeCsv,
+  IconFileTypeDocx,
+  IconFileTypePdf,
+  IconFileTypePpt,
+  IconFileTypeXls,
+  IconFileZip,
+  IconMovie,
+  IconMusic,
+  IconPhoto,
+  type Icon,
+} from "@tabler/icons-react";
+
+const EXT_ICONS: Record<string, { icon: Icon; color: string }> = {
+  ".pdf": { icon: IconFileTypePdf, color: "red" },
+  ".doc": { icon: IconFileTypeDocx, color: "blue" },
+  ".docx": { icon: IconFileTypeDocx, color: "blue" },
+  ".xls": { icon: IconFileTypeXls, color: "teal" },
+  ".xlsx": { icon: IconFileTypeXls, color: "teal" },
+  ".csv": { icon: IconFileTypeCsv, color: "teal" },
+  ".ppt": { icon: IconFileTypePpt, color: "orange" },
+  ".pptx": { icon: IconFileTypePpt, color: "orange" },
+  ".zip": { icon: IconFileZip, color: "gray" },
+  ".rar": { icon: IconFileZip, color: "gray" },
+  ".7z": { icon: IconFileZip, color: "gray" },
+  ".tar": { icon: IconFileZip, color: "gray" },
+  ".gz": { icon: IconFileZip, color: "gray" },
+};
+
+const MIME_ICONS: Array<{ prefix: string; icon: Icon; color: string }> = [
+  { prefix: "image/", icon: IconPhoto, color: "grape" },
+  { prefix: "video/", icon: IconMovie, color: "violet" },
+  { prefix: "audio/", icon: IconMusic, color: "pink" },
+];
+
+interface AttachmentFileIconProps {
+  fileExt?: string;
+  mimeType?: string;
+}
+
+export function AttachmentFileIcon({
+  fileExt,
+  mimeType,
+}: AttachmentFileIconProps) {
+  const byExt = fileExt ? EXT_ICONS[fileExt.toLowerCase()] : undefined;
+  const byMime = mimeType
+    ? MIME_ICONS.find((entry) => mimeType.startsWith(entry.prefix))
+    : undefined;
+  const { icon: FileIcon, color } = byExt ??
+    byMime ?? { icon: IconFile, color: "gray" };
+
+  return (
+    <ThemeIcon variant="light" color={color} size={40} radius="md">
+      <FileIcon size={22} stroke={1.5} />
+    </ThemeIcon>
+  );
+}

apps/client/src/features/attachments/components/page-attachments-modal.tsx

@@ -0,0 +1,191 @@
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import {
+  ActionIcon,
+  Anchor,
+  Center,
+  Group,
+  Loader,
+  Modal,
+  ScrollArea,
+  Text,
+  Tooltip,
+} from "@mantine/core";
+import { IconDownload } from "@tabler/icons-react";
+import { useTranslation } from "react-i18next";
+import { SearchInput } from "@/components/common/search-input.tsx";
+import { CustomAvatar } from "@/components/ui/custom-avatar.tsx";
+import { usePageAttachmentsQuery } from "@/features/attachments/queries/attachment-query.ts";
+import { IPageAttachment } from "@/features/attachments/types/attachment.types.ts";
+import { AttachmentFileIcon } from "@/features/attachments/components/attachment-file-icon.tsx";
+import { formatBytes } from "@/lib";
+import { getFileUrl } from "@/lib/config.ts";
+import { formattedDate } from "@/lib/time.ts";
+
+interface PageAttachmentsModalProps {
+  pageId: string;
+  open: boolean;
+  onClose: () => void;
+}
+
+export default function PageAttachmentsModal({
+  pageId,
+  open,
+  onClose,
+}: PageAttachmentsModalProps) {
+  const { t } = useTranslation();
+
+  return (
+    <Modal
+      opened={open}
+      onClose={onClose}
+      title={t("Attachments")}
+      size={800}
+      closeButtonProps={{ "aria-label": t("Close") }}
+    >
+      <PageAttachmentsList pageId={pageId} />
+    </Modal>
+  );
+}
+
+function PageAttachmentsList({ pageId }: { pageId: string }) {
+  const { t } = useTranslation();
+  const [search, setSearch] = useState("");
+  const {
+    data,
+    isLoading,
+    isError,
+    isFetching,
+    fetchNextPage,
+    hasNextPage,
+    isFetchingNextPage,
+  } = usePageAttachmentsQuery(pageId, search);
+
+  const attachments = useMemo(
+    () => data?.pages.flatMap((page) => page.items) ?? [],
+    [data],
+  );
+
+  const loadMoreRef = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    const sentinel = loadMoreRef.current;
+    if (!sentinel || !hasNextPage) return;
+
+    const observer = new IntersectionObserver(
+      (entries) => {
+        if (entries[0].isIntersecting && !isFetching) {
+          fetchNextPage();
+        }
+      },
+      { threshold: 0.1 },
+    );
+
+    observer.observe(sentinel);
+    return () => observer.disconnect();
+  }, [fetchNextPage, hasNextPage, isFetching]);
+
+  const handleSearch = useCallback((value: string) => setSearch(value), []);
+
+  return (
+    <>
+      <SearchInput
+        onSearch={handleSearch}
+        placeholder={t("Search attachments...")}
+      />
+
+      {isLoading ? (
+        <Center py="xl">
+          <Loader size="sm" />
+        </Center>
+      ) : isError ? (
+        <Center py="xl">
+          <Text size="sm" c="dimmed">
+            {t("Error loading attachments.")}
+          </Text>
+        </Center>
+      ) : attachments.length === 0 ? (
+        <Center py="xl">
+          <Text size="sm" c="dimmed">
+            {search
+              ? t("No results found")
+              : t("No attachments on this page yet.")}
+          </Text>
+        </Center>
+      ) : (
+        <ScrollArea.Autosize mah={480} type="scroll" scrollbarSize={5}>
+          {attachments.map((attachment) => (
+            <AttachmentRow key={attachment.id} attachment={attachment} />
+          ))}
+          {hasNextPage && <div ref={loadMoreRef} style={{ height: 1 }} />}
+          {isFetchingNextPage && (
+            <Center py="sm">
+              <Loader size="sm" />
+            </Center>
+          )}
+        </ScrollArea.Autosize>
+      )}
+    </>
+  );
+}
+
+function AttachmentRow({ attachment }: { attachment: IPageAttachment }) {
+  const { t } = useTranslation();
+  const fileUrl = getFileUrl(attachment.url);
+
+  return (
+    <Group wrap="nowrap" gap="md" py="sm" pr="xs">
+      <AttachmentFileIcon
+        fileExt={attachment.fileExt}
+        mimeType={attachment.mimeType}
+      />
+
+      <div style={{ flex: 1, minWidth: 0 }}>
+        <Anchor
+          href={fileUrl}
+          target="_blank"
+          rel="noopener noreferrer"
+          size="sm"
+          fw={500}
+          c="inherit"
+          truncate="end"
+          style={{ display: "block" }}
+        >
+          {attachment.fileName}
+        </Anchor>
+        <Text size="xs" c="dimmed" mt={2} truncate="end">
+          {formatBytes(Number(attachment.fileSize))}
+          {" · "}
+          {formattedDate(new Date(attachment.createdAt))}
+        </Text>
+      </div>
+
+      {attachment.creator && (
+        <Tooltip
+          label={t("Uploaded by {{name}}", { name: attachment.creator.name })}
+          withArrow
+        >
+          <CustomAvatar
+            avatarUrl={attachment.creator.avatarUrl}
+            name={attachment.creator.name}
+            size="sm"
+          />
+        </Tooltip>
+      )}
+
+      <Tooltip label={t("Download attachment")} withArrow>
+        <ActionIcon
+          component="a"
+          href={fileUrl}
+          download={attachment.fileName}
+          target="_blank"
+          rel="noopener noreferrer"
+          variant="subtle"
+          color="gray"
+          aria-label={t("Download {{name}}", { name: attachment.fileName })}
+        >
+          <IconDownload size={18} />
+        </ActionIcon>
+      </Tooltip>
+    </Group>
+  );
+}

apps/client/src/features/attachments/queries/attachment-query.ts

@@ -0,0 +1,25 @@
+import {
+  InfiniteData,
+  keepPreviousData,
+  useInfiniteQuery,
+  UseInfiniteQueryResult,
+} from "@tanstack/react-query";
+import { getPageAttachments } from "@/features/attachments/services/attachment-service.ts";
+import { IPageAttachment } from "@/features/attachments/types/attachment.types.ts";
+import { IPagination } from "@/lib/types.ts";
+
+export function usePageAttachmentsQuery(
+  pageId: string,
+  search?: string,
+): UseInfiniteQueryResult<InfiniteData<IPagination<IPageAttachment>, unknown>> {
+  return useInfiniteQuery({
+    queryKey: ["page-attachments", pageId, search],
+    queryFn: ({ pageParam }) =>
+      getPageAttachments(pageId, { cursor: pageParam, query: search }),
+    enabled: !!pageId,
+    gcTime: 0,
+    placeholderData: keepPreviousData,
+    initialPageParam: undefined,
+    getNextPageParam: (lastPage) => lastPage.meta?.nextCursor ?? undefined,
+  });
+}

apps/client/src/features/attachments/services/attachment-service.ts

@@ -3,7 +3,17 @@ import loadImage from "blueimp-load-image";
 import {
   AvatarIconType,
   IAttachment,
+  IPageAttachment,
 } from "@/features/attachments/types/attachment.types.ts";
+import { IPagination, QueryParams } from "@/lib/types.ts";
+
+export async function getPageAttachments(
+  pageId: string,
+  params?: QueryParams,
+): Promise<IPagination<IPageAttachment>> {
+  const req = await api.post("/pages/attachments", { pageId, ...params });
+  return req.data;
+}
 
 async function compressAndResizeIcon(
   file: File,

apps/client/src/features/attachments/services/index.ts

@@ -1,4 +1,5 @@
 export {
+  getPageAttachments,
   uploadIcon,
   uploadUserAvatar,
   uploadSpaceIcon,

apps/client/src/features/attachments/types/attachment.types.ts

@@ -15,6 +15,15 @@ export interface IAttachment {
   deletedAt: string | null;
 }
 
+export interface IPageAttachment extends IAttachment {
+  url: string;
+  creator: {
+    id: string;
+    name: string;
+    avatarUrl: string | null;
+  } | null;
+}
+
 export enum AvatarIconType {
   AVATAR = "avatar",
   SPACE_ICON = "space-icon",

apps/client/src/features/comment/components/comment-editor.tsx

@@ -103,6 +103,7 @@ const CommentEditor = forwardRef(
       },
       content: defaultContent,
       editable,
+      textDirection: "auto",
       immediatelyRender: true,
       shouldRerenderOnTransaction: false,
       autofocus: (autofocus && "end") || false,

apps/client/src/features/editor/components/transclusion/transclusion-content.tsx

@@ -40,6 +40,7 @@ export default function TransclusionContent({ content }: Props) {
       <EditorProvider
         editable={false}
         immediatelyRender={true}
+        textDirection="auto"
         extensions={extensions}
         content={content as any}
       />

apps/client/src/features/editor/page-editor.tsx

@@ -249,6 +249,7 @@ function CollabPageEditor({
     {
       extensions,
       editable,
+      textDirection: "auto",
       immediatelyRender: true,
       shouldRerenderOnTransaction: false,
       editorProps: {
@@ -484,6 +485,7 @@ function StaticPageEditor({
     <EditorProvider
       editable={false}
       immediatelyRender={true}
+      textDirection="auto"
       extensions={mainExtensions}
       content={content}
       editorProps={{

apps/client/src/features/editor/readonly-page-editor.tsx

@@ -85,6 +85,7 @@ export default function ReadonlyPageEditor({
         <EditorProvider
           editable={false}
           immediatelyRender={true}
+          textDirection="auto"
           extensions={titleExtensions}
           content={title}
         ></EditorProvider>
@@ -93,6 +94,7 @@ export default function ReadonlyPageEditor({
       <EditorProvider
         editable={false}
         immediatelyRender={true}
+        textDirection="auto"
         extensions={extensions}
         content={content}
         onCreate={({ editor }) => {

apps/client/src/features/editor/styles/table.css

@@ -54,7 +54,7 @@
         var(--mantine-color-dark-5)
       );
       font-weight: bold;
-      text-align: left;
+      text-align: start;
     }
 
     .column-resize-handle {

apps/client/src/features/editor/title-editor.tsx

@@ -86,6 +86,7 @@ export function TitleEditor({
     },
     editable: editable,
     content: title,
+    textDirection: "auto",
     immediatelyRender: true,
     shouldRerenderOnTransaction: false,
     editorProps: {

apps/client/src/features/page-history/components/history-editor.tsx

@@ -31,6 +31,7 @@ export function HistoryEditor({
   const editor = useEditor({
     extensions: mainExtensions,
     editable: false,
+    textDirection: "auto",
   });
 
   useEffect(() => {

apps/client/src/features/page/components/header/page-header-menu.tsx

@@ -11,6 +11,7 @@ import {
   IconList,
   IconMarkdown,
   IconMessage,
+  IconPaperclip,
   IconPrinter,
   IconStar,
   IconStarFilled,
@@ -42,6 +43,7 @@ import {
 import { formattedDate } from "@/lib/time.ts";
 import { PageEditModeToggle } from "@/features/user/components/page-state-pref.tsx";
 import MovePageModal from "@/features/page/components/move-page-modal.tsx";
+import PageAttachmentsModal from "@/features/attachments/components/page-attachments-modal.tsx";
 import { useTimeAgo } from "@/hooks/use-time-ago.tsx";
 import { PageShareModal } from "@/ee/page-permission";
 import {
@@ -157,6 +159,10 @@ function PageActionMenu({ readOnly }: PageActionMenuProps) {
     verificationOpened,
     { open: openVerificationModal, close: closeVerificationModal },
   ] = useDisclosure(false);
+  const [
+    attachmentsOpened,
+    { open: openAttachmentsModal, close: closeAttachmentsModal },
+  ] = useDisclosure(false);
   const [pageEditor] = useAtom(pageEditorAtom);
   const pageUpdatedAt = useTimeAgo(page?.updatedAt);
   const favoriteIds = useFavoriteIds("page", page?.spaceId);
@@ -293,6 +299,15 @@ function PageActionMenu({ readOnly }: PageActionMenuProps) {
             </Menu.Item>
           )}
 
+          {!page?.isBase && (
+            <Menu.Item
+              leftSection={<IconPaperclip size={16} />}
+              onClick={openAttachmentsModal}
+            >
+              {t("Attachments")}
+            </Menu.Item>
+          )}
+
           {!readOnly && !page?.isBase && (
             <PageVerificationMenuItem
               pageId={page?.id}
@@ -395,6 +410,12 @@ function PageActionMenu({ readOnly }: PageActionMenuProps) {
         opened={verificationOpened}
         onClose={closeVerificationModal}
       />
+
+      <PageAttachmentsModal
+        pageId={page.id}
+        open={attachmentsOpened}
+        onClose={closeAttachmentsModal}
+      />
     </>
   );
 }

apps/server/src/app.module.ts

@@ -27,6 +27,7 @@ import { LoggerModule } from './common/logger/logger.module';
 import { ClsModule } from 'nestjs-cls';
 import { NoopAuditModule } from './integrations/audit/audit.module';
 import { ThrottleModule } from './integrations/throttle/throttle.module';
+import { EncryptionModule } from './integrations/encryption/encryption.module';
 
 const enterpriseModules = [];
 try {
@@ -53,6 +54,7 @@ try {
     CoreModule,
     DatabaseModule,
     EnvironmentModule,
+    EncryptionModule,
     RedisModule.forRootAsync({
       useClass: RedisConfigService,
     }),

apps/server/src/collaboration/collaboration.util.ts

@@ -50,7 +50,12 @@ import {
   Footnote,
   FootnoteReference,
 } from '@docmost/editor-ext';
-import { generateText, getSchema, JSONContent } from '@tiptap/core';
+import {
+  extensions as coreExtensions,
+  generateText,
+  getSchema,
+  JSONContent,
+} from '@tiptap/core';
 import { generateHTML, generateJSON } from '../common/helpers/prosemirror/html';
 // @tiptap/html library works best for generating prosemirror json state but not HTML
 // see: https://github.com/ueberdosis/tiptap/issues/5352
@@ -61,6 +66,7 @@ import * as Y from 'yjs';
 import { Logger } from '@nestjs/common';
 
 export const tiptapExtensions = [
+  coreExtensions.TextDirection.configure({ direction: 'auto' }),
   StarterKit.configure({
     document: false,
     codeBlock: false,

apps/server/src/core/attachment/attachment.controller.ts

@@ -53,8 +53,14 @@ import { EnvironmentService } from '../../integrations/environment/environment.s
 import { TokenService } from '../auth/services/token.service';
 import { JwtAttachmentPayload, JwtType } from '../auth/dto/jwt-payload';
 import * as path from 'path';
-import { AttachmentInfoDto, RemoveIconDto } from './dto/attachment.dto';
+import {
+  AttachmentInfoDto,
+  PageIdDto,
+  RemoveIconDto,
+} from './dto/attachment.dto';
+import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
 import { PageAccessService } from '../page/page-access/page-access.service';
+import { DomainService } from '../../integrations/environment/domain.service';
 import { AuditEvent, AuditResource } from '../../common/events/audit-events';
 import {
   AUDIT_SERVICE,
@@ -75,6 +81,7 @@ export class AttachmentController {
     private readonly environmentService: EnvironmentService,
     private readonly tokenService: TokenService,
     private readonly pageAccessService: PageAccessService,
+    private readonly domainService: DomainService,
     @Inject(AUDIT_SERVICE) private readonly auditService: IAuditService,
   ) {}
 
@@ -151,7 +158,10 @@ export class AttachmentController {
         },
       });
 
-      return res.send(fileResponse);
+      return res.send({
+        ...fileResponse,
+        url: this.buildFileUrl(workspace, fileResponse),
+      });
     } catch (err: any) {
       if (err?.statusCode === 413) {
         const errMessage = `File too large. Exceeds the ${this.environmentService.getFileUploadSizeLimit()} limit`;
@@ -411,7 +421,37 @@ export class AttachmentController {
 
     await this.pageAccessService.validateCanView(page, user);
 
-    return attachment;
+    return { ...attachment, url: this.buildFileUrl(workspace, attachment) };
+  }
+
+  @UseGuards(JwtAuthGuard)
+  @HttpCode(HttpStatus.OK)
+  @Post('pages/attachments')
+  async getPageAttachments(
+    @Body() dto: PageIdDto,
+    @Body() pagination: PaginationOptions,
+    @AuthUser() user: User,
+    @AuthWorkspace() workspace: Workspace,
+  ) {
+    const page = await this.pageRepo.findById(dto.pageId);
+    if (!page || page.workspaceId !== workspace.id) {
+      throw new NotFoundException('Page not found');
+    }
+
+    await this.pageAccessService.validateCanView(page, user);
+
+    const result = await this.attachmentRepo.findPageAttachments(
+      page.id,
+      pagination,
+    );
+
+    return {
+      ...result,
+      items: result.items.map((attachment) => ({
+        ...attachment,
+        url: this.buildFileUrl(workspace, attachment),
+      })),
+    };
   }
 
   @UseGuards(JwtAuthGuard)
@@ -465,6 +505,10 @@ export class AttachmentController {
     }
   }
 
+  private buildFileUrl(workspace: Workspace, attachment: Attachment): string {
+    return `${this.domainService.getUrl(workspace.hostname)}/api/files/${attachment.id}/${encodeURIComponent(attachment.fileName)}`;
+  }
+
   private async sendFileResponse(
     req: FastifyRequest,
     res: FastifyReply,

apps/server/src/core/attachment/dto/attachment.dto.ts

@@ -1,4 +1,11 @@
-import { IsEnum, IsIn, IsNotEmpty, IsOptional, IsUUID } from 'class-validator';
+import {
+  IsEnum,
+  IsIn,
+  IsNotEmpty,
+  IsOptional,
+  IsString,
+  IsUUID,
+} from 'class-validator';
 import { AttachmentType } from '../attachment.constants';
 
 export class AttachmentInfoDto {
@@ -7,6 +14,12 @@ export class AttachmentInfoDto {
   attachmentId: string;
 }
 
+export class PageIdDto {
+  @IsString()
+  @IsNotEmpty()
+  pageId: string;
+}
+
 export class RemoveIconDto {
   @IsEnum(AttachmentType)
   @IsIn([

apps/server/src/database/repos/attachment/attachment.repo.ts

@@ -1,5 +1,8 @@
 import { Injectable } from '@nestjs/common';
 import { InjectKysely } from 'nestjs-kysely';
+import { ExpressionBuilder, sql } from 'kysely';
+import { jsonObjectFrom } from 'kysely/helpers/postgres';
+import { DB } from '@docmost/db/types/db';
 import { KyselyDB, KyselyTransaction } from '@docmost/db/types/kysely.types';
 import { dbOrTx } from '@docmost/db/utils';
 import {
@@ -8,6 +11,8 @@ import {
   UpdatableAttachment,
 } from '@docmost/db/types/entity.types';
 import { AttachmentType } from '../../../core/attachment/attachment.constants';
+import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
+import { executeWithCursorPagination } from '@docmost/db/pagination/cursor-pagination';
 
 @Injectable()
 export class AttachmentRepo {
@@ -89,6 +94,41 @@ export class AttachmentRepo {
       .execute();
   }
 
+  async findPageAttachments(pageId: string, pagination: PaginationOptions) {
+    let query = this.db
+      .selectFrom('attachments')
+      .select(this.baseFields)
+      .select((eb) => this.withCreator(eb))
+      .where('pageId', '=', pageId)
+      .where('type', '=', AttachmentType.File)
+      .where('deletedAt', 'is', null);
+
+    if (pagination.query) {
+      query = query.where(
+        sql`f_unaccent(file_name)`,
+        'ilike',
+        sql`f_unaccent(${'%' + pagination.query + '%'})`,
+      );
+    }
+
+    return executeWithCursorPagination(query, {
+      perPage: pagination.limit,
+      cursor: pagination.cursor,
+      beforeCursor: pagination.beforeCursor,
+      fields: [{ expression: 'id', direction: 'desc' }],
+      parseCursor: (cursor) => ({ id: cursor.id }),
+    });
+  }
+
+  withCreator(eb: ExpressionBuilder<DB, 'attachments'>) {
+    return jsonObjectFrom(
+      eb
+        .selectFrom('users')
+        .select(['users.id', 'users.name', 'users.avatarUrl'])
+        .whereRef('users.id', '=', 'attachments.creatorId'),
+    ).as('creator');
+  }
+
   async findByIds(
     ids: string[],
     opts?: {

apps/server/src/integrations/encryption/encryption.errors.ts

@@ -0,0 +1,13 @@
+export class UnableToInitialize extends Error {
+  constructor(message: string) {
+    super(`Unable to initialize the encryption service: ${message}`);
+    this.name = 'UnableToInitialize';
+  }
+}
+
+export class UnableToDecrypt extends Error {
+  constructor(reason: string) {
+    super(`Unable to decrypt the ciphertext: ${reason}`);
+    this.name = 'UnableToDecrypt';
+  }
+}

apps/server/src/integrations/encryption/encryption.module.ts

@@ -0,0 +1,9 @@
+import { Global, Module } from '@nestjs/common';
+import { EncryptionService } from './encryption.service';
+
+@Global()
+@Module({
+  providers: [EncryptionService],
+  exports: [EncryptionService],
+})
+export class EncryptionModule {}

apps/server/src/integrations/encryption/encryption.service.spec.ts

@@ -0,0 +1,184 @@
+import { Test, TestingModule } from '@nestjs/testing';
+import { EncryptionService } from './encryption.service';
+import { UnableToDecrypt, UnableToInitialize } from './encryption.errors';
+import { EnvironmentService } from '../environment/environment.service';
+
+const APP_SECRET = 'test-app-secret-with-plenty-of-entropy-1234567890';
+
+const buildService = (appSecret: string | undefined) => {
+  const env = { getAppSecret: () => appSecret } as EnvironmentService;
+  return new EncryptionService(env);
+};
+
+const decodeEnvelope = (encrypted: string) =>
+  JSON.parse(Buffer.from(encrypted, 'base64').toString()) as {
+    iv: string;
+    authTag: string;
+    cipherText: string;
+  };
+
+const encodeEnvelope = (envelope: {
+  iv: string;
+  authTag: string;
+  cipherText: string;
+}) => Buffer.from(JSON.stringify(envelope)).toString('base64');
+
+describe('EncryptionService', () => {
+  let service: EncryptionService;
+
+  beforeEach(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [
+        EncryptionService,
+        {
+          provide: EnvironmentService,
+          useValue: { getAppSecret: () => APP_SECRET },
+        },
+      ],
+    }).compile();
+
+    service = module.get<EncryptionService>(EncryptionService);
+  });
+
+  describe('initialization', () => {
+    it('compiles via Nest DI', () => {
+      expect(service).toBeDefined();
+    });
+
+    it('throws UnableToInitialize when APP_SECRET is missing', () => {
+      expect(() => buildService(undefined)).toThrow(UnableToInitialize);
+      expect(() => buildService('')).toThrow(UnableToInitialize);
+    });
+  });
+
+  describe('encrypt + decrypt round-trip', () => {
+    it('decrypts back to the original plaintext', () => {
+      const plaintext = 'hello world';
+      const encrypted = service.encrypt(plaintext);
+      expect(service.decrypt(encrypted)).toBe(plaintext);
+    });
+
+    it('handles empty string', () => {
+      const encrypted = service.encrypt('');
+      expect(service.decrypt(encrypted)).toBe('');
+    });
+
+    it('handles unicode (multi-byte UTF-8)', () => {
+      const plaintext = 'héllo 🔐 世界';
+      const encrypted = service.encrypt(plaintext);
+      expect(service.decrypt(encrypted)).toBe(plaintext);
+    });
+
+    it('handles long plaintext (>1 block)', () => {
+      const plaintext = 'a'.repeat(10_000);
+      const encrypted = service.encrypt(plaintext);
+      expect(service.decrypt(encrypted)).toBe(plaintext);
+    });
+
+    it('produces distinct ciphertexts for the same plaintext (random IV)', () => {
+      const plaintext = 'same input';
+      const a = service.encrypt(plaintext);
+      const b = service.encrypt(plaintext);
+      expect(a).not.toBe(b);
+      expect(service.decrypt(a)).toBe(plaintext);
+      expect(service.decrypt(b)).toBe(plaintext);
+    });
+  });
+
+  describe('cross-key isolation', () => {
+    it('cannot decrypt ciphertext produced under a different APP_SECRET', () => {
+      const other = buildService('totally-different-secret-value-9876543210');
+      const encrypted = service.encrypt('secret');
+      expect(() => other.decrypt(encrypted)).toThrow(UnableToDecrypt);
+    });
+  });
+
+  describe('tamper detection', () => {
+    it('rejects modified ciphertext', () => {
+      const encrypted = service.encrypt('hello');
+      const env = decodeEnvelope(encrypted);
+      const tamperedCipher = Buffer.from(env.cipherText, 'base64');
+      tamperedCipher[0] ^= 0x01;
+      const tampered = encodeEnvelope({
+        ...env,
+        cipherText: tamperedCipher.toString('base64'),
+      });
+      expect(() => service.decrypt(tampered)).toThrow(UnableToDecrypt);
+    });
+
+    it('rejects modified auth tag', () => {
+      const encrypted = service.encrypt('hello');
+      const env = decodeEnvelope(encrypted);
+      const tamperedTag = Buffer.from(env.authTag, 'base64');
+      tamperedTag[0] ^= 0x01;
+      const tampered = encodeEnvelope({
+        ...env,
+        authTag: tamperedTag.toString('base64'),
+      });
+      expect(() => service.decrypt(tampered)).toThrow(UnableToDecrypt);
+    });
+
+    it('rejects modified IV', () => {
+      const encrypted = service.encrypt('hello');
+      const env = decodeEnvelope(encrypted);
+      const tamperedIV = Buffer.from(env.iv, 'base64');
+      tamperedIV[0] ^= 0x01;
+      const tampered = encodeEnvelope({
+        ...env,
+        iv: tamperedIV.toString('base64'),
+      });
+      expect(() => service.decrypt(tampered)).toThrow(UnableToDecrypt);
+    });
+  });
+
+  describe('malformed payloads', () => {
+    it('rejects non-base64 garbage', () => {
+      expect(() => service.decrypt('!!!not-valid-base64!!!')).toThrow(
+        UnableToDecrypt,
+      );
+    });
+
+    it('rejects base64 of non-JSON', () => {
+      const garbage = Buffer.from('not json at all').toString('base64');
+      expect(() => service.decrypt(garbage)).toThrow(UnableToDecrypt);
+    });
+
+    it('rejects JSON missing required fields', () => {
+      const partial = encodeEnvelope({
+        iv: Buffer.alloc(12).toString('base64'),
+        authTag: Buffer.alloc(16).toString('base64'),
+      } as never);
+      expect(() => service.decrypt(partial)).toThrow(UnableToDecrypt);
+    });
+
+    it('rejects wrong-length IV', () => {
+      const encrypted = service.encrypt('hello');
+      const env = decodeEnvelope(encrypted);
+      const bad = encodeEnvelope({
+        ...env,
+        iv: Buffer.alloc(8).toString('base64'),
+      });
+      expect(() => service.decrypt(bad)).toThrow(UnableToDecrypt);
+    });
+
+    it('rejects wrong-length auth tag', () => {
+      const encrypted = service.encrypt('hello');
+      const env = decodeEnvelope(encrypted);
+      const bad = encodeEnvelope({
+        ...env,
+        authTag: Buffer.alloc(8).toString('base64'),
+      });
+      expect(() => service.decrypt(bad)).toThrow(UnableToDecrypt);
+    });
+  });
+
+  describe('envelope format', () => {
+    it('returns base64 of JSON envelope with iv (12B), authTag (16B), cipherText', () => {
+      const encrypted = service.encrypt('hello');
+      const env = decodeEnvelope(encrypted);
+      expect(Buffer.from(env.iv, 'base64')).toHaveLength(12);
+      expect(Buffer.from(env.authTag, 'base64')).toHaveLength(16);
+      expect(Buffer.from(env.cipherText, 'base64').length).toBeGreaterThan(0);
+    });
+  });
+});

apps/server/src/integrations/encryption/encryption.service.ts

@@ -0,0 +1,108 @@
+// https://github.com/nhedger/nestjs-encryption - MIT
+import { Injectable } from '@nestjs/common';
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  randomBytes,
+} from 'node:crypto';
+import { UnableToDecrypt, UnableToInitialize } from './encryption.errors';
+import { EnvironmentService } from '../environment/environment.service';
+
+const ALGORITHM = 'aes-256-gcm';
+const KEY_DOMAIN = 'docmost:encryption:v1';
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+
+type AEADPayload<TFormat = string | Buffer> = {
+  iv: TFormat;
+  authTag: TFormat;
+  cipherText: TFormat;
+};
+
+@Injectable()
+export class EncryptionService {
+  private readonly key: Buffer;
+
+  constructor(environmentService: EnvironmentService) {
+    const appSecret = environmentService.getAppSecret();
+    if (!appSecret) {
+      throw new UnableToInitialize('APP_SECRET is not set.');
+    }
+    this.key = createHash('sha256')
+      .update(KEY_DOMAIN)
+      .update(appSecret)
+      .digest();
+  }
+
+  public encrypt(plaintext: string): string {
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, this.key, iv);
+    const cipherText = Buffer.concat([
+      cipher.update(plaintext, 'utf8'),
+      cipher.final(),
+    ]);
+    const authTag = cipher.getAuthTag();
+
+    const aead: AEADPayload<string> = {
+      iv: iv.toString('base64'),
+      authTag: authTag.toString('base64'),
+      cipherText: cipherText.toString('base64'),
+    };
+
+    return Buffer.from(JSON.stringify(aead)).toString('base64');
+  }
+
+  public decrypt(encrypted: string): string {
+    try {
+      const { iv, authTag, cipherText } = this.decodeAEADPayload(encrypted);
+      const decipher = createDecipheriv(ALGORITHM, this.key, iv);
+      decipher.setAuthTag(authTag);
+      const decrypted = Buffer.concat([
+        decipher.update(cipherText),
+        decipher.final(),
+      ]);
+      return decrypted.toString('utf8');
+    } catch (e: unknown) {
+      throw new UnableToDecrypt((e as Error).message);
+    }
+  }
+
+  private decodeAEADPayload(encodedPayload: string): AEADPayload<Buffer> {
+    const payload = Buffer.from(encodedPayload, 'base64');
+
+    let deserializedPkg: Record<string, unknown>;
+    try {
+      deserializedPkg = JSON.parse(payload.toString());
+    } catch {
+      throw new Error('The decoded AEAD payload is not a valid JSON string.');
+    }
+
+    for (const field of ['iv', 'authTag', 'cipherText']) {
+      if (!Object.prototype.hasOwnProperty.call(deserializedPkg, field)) {
+        throw new Error(`The AEAD payload is missing the ${field} field.`);
+      }
+    }
+
+    const iv = Buffer.from(deserializedPkg.iv as string, 'base64');
+    if (iv.length !== IV_LENGTH) {
+      throw new Error(
+        `The decoded IV is not the correct length. Expected ${IV_LENGTH} bytes, got ${iv.length} bytes.`,
+      );
+    }
+
+    const authTag = Buffer.from(deserializedPkg.authTag as string, 'base64');
+    if (authTag.length !== AUTH_TAG_LENGTH) {
+      throw new Error(
+        `The decoded auth tag is not the correct length. Expected ${AUTH_TAG_LENGTH} bytes, got ${authTag.length} bytes.`,
+      );
+    }
+
+    const cipherText = Buffer.from(
+      deserializedPkg.cipherText as string,
+      'base64',
+    );
+
+    return { iv, authTag, cipherText };
+  }
+}

packages/editor-ext/src/lib/prosemirror-docx/schema.ts

@@ -192,6 +192,7 @@ export const defaultAsyncNodes: NodeSerializerAsync = {
   // No usable static export representation: skip without failing.
   subpages() {},
   transclusionReference() {},
+  base() {},
 };
 
 export const defaultMarks: MarkSerializer = {