Merge branch 'main' into docs

.env.example

@@ -4,15 +4,8 @@
 NODE_ENV=development
 PORT_BACKEND=4000
 PORT_FRONTEND=3000
-# The public-facing URL of your application. This is used by the backend to configure CORS.
-APP_URL=http://localhost:3000
-# This is used by the SvelteKit Node adapter to determine the server's public-facing URL.
-# It should always be set to the value of APP_URL.
-ORIGIN=$APP_URL
 # The frequency of continuous email syncing. Default is every minutes, but you can change it to another value based on your needs.
 SYNC_FREQUENCY='* * * * *' 
-# Set to 'true' to include Junk and Trash folders in the email archive. Defaults to false.
-ALL_INCLUSIVE_ARCHIVE=false
 
 # --- Docker Compose Service Configuration ---
 # These variables are used by docker-compose.yml to configure the services. Leave them unchanged if you use Docker services for Postgresql, Valkey (Redis) and Meilisearch. If you decide to use your own instances of these services, you can substitute them with your own connection credentials.
@@ -26,8 +19,7 @@ DATABASE_URL="postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/$
 # Meilisearch
 MEILI_MASTER_KEY=aSampleMasterKey
 MEILI_HOST=http://meilisearch:7700
-# The number of emails to batch together for indexing. Defaults to 500.
-MEILI_INDEXING_BATCH=500
+
 
 
 # Redis (We use Valkey, which is Redis-compatible and open source)
@@ -36,8 +28,6 @@ REDIS_PORT=6379
 REDIS_PASSWORD=defaultredispassword
 # If you run Valkey service from Docker Compose, set the REDIS_TLS_ENABLED variable to false.
 REDIS_TLS_ENABLED=false
-# Redis username. Only required if not using the default user.
-REDIS_USER=notdefaultuser
 
 
 # --- Storage Settings ---
@@ -49,9 +39,7 @@ BODY_SIZE_LIMIT=100M
 # --- Local Storage Settings ---
 # The path inside the container where files will be stored.
 # This is mapped to a Docker volume for persistence.
-# This is not an optional variable, it is where the Open Archiver service stores application data. Set this even if you are using S3 storage.
-# Make sure the user that runs the Open Archiver service has read and write access to this path.
-# Important: It is recommended to create this path manually before installation, otherwise you may face permission and ownership problems.
+# This is only used if STORAGE_TYPE is 'local'.
 STORAGE_LOCAL_ROOT_PATH=/var/data/open-archiver
 
 # --- S3-Compatible Storage Settings ---
@@ -64,26 +52,14 @@ STORAGE_S3_REGION=
 # Set to 'true' for MinIO and other non-AWS S3 services
 STORAGE_S3_FORCE_PATH_STYLE=false
 
-# --- Storage Encryption ---
-# IMPORTANT: Generate a secure, random 32-byte hex string for this key.
-# You can use `openssl rand -hex 32` to generate a key.
-# This key is used for AES-256 encryption of files at rest.
-# This is an optional variable, if not set, files will not be encrypted.
-STORAGE_ENCRYPTION_KEY=
-
 # --- Security & Authentication ---
 
-# Enable or disable deletion of emails and ingestion sources. Defaults to false.
-ENABLE_DELETION=false
-
 # Rate Limiting
 # The window in milliseconds for which API requests are checked. Defaults to 60000 (1 minute).
 RATE_LIMIT_WINDOW_MS=60000
 # The maximum number of API requests allowed from an IP within the window. Defaults to 100.
 RATE_LIMIT_MAX_REQUESTS=100
 
-
-
 # JWT
 # IMPORTANT: Change this to a long, random, and secret string in your .env file
 JWT_SECRET=a-very-secret-key-that-you-should-change
@@ -94,7 +70,3 @@ JWT_EXPIRES_IN="7d"
 # IMPORTANT: Generate a secure, random 32-byte hex string for this
 # You can use `openssl rand -hex 32` to generate a key.
 ENCRYPTION_KEY=
-
-# Apache Tika Integration
-# ONLY active if TIKA_URL is set
-TIKA_URL=http://tika:9998

.github/FUNDING.yml

@@ -1 +0,0 @@
-github: [wayneshn]

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,33 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: bug
-assignees: ''
----
-
-**Describe the bug**
-A clear and concise description of what the bug is.
-
-**To Reproduce**
-Steps to reproduce the behavior:
-
-1. Go to '...'
-2. Click on '....'
-3. See error
-
-**Expected behavior**
-A clear and concise description of what you expected to happen.
-
-**Screenshots**
-If applicable, add screenshots to help explain your problem.
-
-**System:**
-
-- Open Archiver Version:
-
-**Relevant logs:**
-Any relevant logs (Redact sensitive information)
-
-**Additional context**
-Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,19 +0,0 @@
----
-name: Feature request
-about: Suggest an idea for this project
-title: ''
-labels: enhancement
-assignees: ''
----
-
-**Is your feature request related to a problem? Please describe.**
-A clear and concise description of what the problem is.
-
-**Describe the solution you'd like**
-A clear and concise description of what you want to happen.
-
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.
-
-**Additional context**
-Add any other context or screenshots about the feature request here.

.github/workflows/docker-deployment.yml

@@ -35,7 +35,7 @@ jobs:
               uses: docker/build-push-action@v6
               with:
                   context: .
-                  file: ./apps/open-archiver/Dockerfile
+                  file: ./docker/Dockerfile
                   platforms: linux/amd64,linux/arm64
                   push: true
                   tags: logiclabshq/open-archiver:${{ steps.sha.outputs.sha }}

.gitignore

@@ -24,7 +24,3 @@ pnpm-debug.log
 # Vitepress
 docs/.vitepress/dist
 docs/.vitepress/cache
-
-
-# TS
-**/tsconfig.tsbuildinfo

LICENSE

@@ -200,23 +200,23 @@ You may convey a work based on the Program, or the modifications to
 produce it from the Program, in the form of source code under the
 terms of section 4, provided that you also meet all of these conditions:
 
-- **a)** The work must carry prominent notices stating that you modified
-  it, and giving a relevant date.
-- **b)** The work must carry prominent notices stating that it is
-  released under this License and any conditions added under section 7.
-  This requirement modifies the requirement in section 4 to
-  “keep intact all notices”.
-- **c)** You must license the entire work, as a whole, under this
-  License to anyone who comes into possession of a copy. This
-  License will therefore apply, along with any applicable section 7
-  additional terms, to the whole of the work, and all its parts,
-  regardless of how they are packaged. This License gives no
-  permission to license the work in any other way, but it does not
-  invalidate such permission if you have separately received it.
-- **d)** If the work has interactive user interfaces, each must display
-  Appropriate Legal Notices; however, if the Program has interactive
-  interfaces that do not display Appropriate Legal Notices, your
-  work need not make them do so.
+-   **a)** The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+-   **b)** The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section 7.
+    This requirement modifies the requirement in section 4 to
+    “keep intact all notices”.
+-   **c)** You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy. This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged. This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+-   **d)** If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
 
 A compilation of a covered work with other separate and independent
 works, which are not by their nature extensions of the covered work,
@@ -235,42 +235,42 @@ of sections 4 and 5, provided that you also convey the
 machine-readable Corresponding Source under the terms of this License,
 in one of these ways:
 
-- **a)** Convey the object code in, or embodied in, a physical product
-  (including a physical distribution medium), accompanied by the
-  Corresponding Source fixed on a durable physical medium
-  customarily used for software interchange.
-- **b)** Convey the object code in, or embodied in, a physical product
-  (including a physical distribution medium), accompanied by a
-  written offer, valid for at least three years and valid for as
-  long as you offer spare parts or customer support for that product
-  model, to give anyone who possesses the object code either **(1)** a
-  copy of the Corresponding Source for all the software in the
-  product that is covered by this License, on a durable physical
-  medium customarily used for software interchange, for a price no
-  more than your reasonable cost of physically performing this
-  conveying of source, or **(2)** access to copy the
-  Corresponding Source from a network server at no charge.
-- **c)** Convey individual copies of the object code with a copy of the
-  written offer to provide the Corresponding Source. This
-  alternative is allowed only occasionally and noncommercially, and
-  only if you received the object code with such an offer, in accord
-  with subsection 6b.
-- **d)** Convey the object code by offering access from a designated
-  place (gratis or for a charge), and offer equivalent access to the
-  Corresponding Source in the same way through the same place at no
-  further charge. You need not require recipients to copy the
-  Corresponding Source along with the object code. If the place to
-  copy the object code is a network server, the Corresponding Source
-  may be on a different server (operated by you or a third party)
-  that supports equivalent copying facilities, provided you maintain
-  clear directions next to the object code saying where to find the
-  Corresponding Source. Regardless of what server hosts the
-  Corresponding Source, you remain obligated to ensure that it is
-  available for as long as needed to satisfy these requirements.
-- **e)** Convey the object code using peer-to-peer transmission, provided
-  you inform other peers where the object code and Corresponding
-  Source of the work are being offered to the general public at no
-  charge under subsection 6d.
+-   **a)** Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+-   **b)** Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either **(1)** a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or **(2)** access to copy the
+    Corresponding Source from a network server at no charge.
+-   **c)** Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source. This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+-   **d)** Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge. You need not require recipients to copy the
+    Corresponding Source along with the object code. If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source. Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+-   **e)** Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
 
 A separable portion of the object code, whose source code is excluded
 from the Corresponding Source as a System Library, need not be
@@ -344,23 +344,23 @@ Notwithstanding any other provision of this License, for material you
 add to a covered work, you may (if authorized by the copyright holders of
 that material) supplement the terms of this License with terms:
 
-- **a)** Disclaiming warranty or limiting liability differently from the
-  terms of sections 15 and 16 of this License; or
-- **b)** Requiring preservation of specified reasonable legal notices or
-  author attributions in that material or in the Appropriate Legal
-  Notices displayed by works containing it; or
-- **c)** Prohibiting misrepresentation of the origin of that material, or
-  requiring that modified versions of such material be marked in
-  reasonable ways as different from the original version; or
-- **d)** Limiting the use for publicity purposes of names of licensors or
-  authors of the material; or
-- **e)** Declining to grant rights under trademark law for use of some
-  trade names, trademarks, or service marks; or
-- **f)** Requiring indemnification of licensors and authors of that
-  material by anyone who conveys the material (or modified versions of
-  it) with contractual assumptions of liability to the recipient, for
-  any liability that these contractual assumptions directly impose on
-  those licensors and authors.
+-   **a)** Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+-   **b)** Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+-   **c)** Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+-   **d)** Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+-   **e)** Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+-   **f)** Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
 
 All other non-permissive additional terms are considered “further
 restrictions” within the meaning of section 10. If the Program as you

README.md

@@ -7,11 +7,11 @@
 [![Redis](https://img.shields.io/badge/Redis-DC382D?style=for-the-badge&logo=redis&logoColor=white)](https://redis.io)
 [![SvelteKit](https://img.shields.io/badge/SvelteKit-FF3E00?style=for-the-badge&logo=svelte&logoColor=white)](https://svelte.dev/)
 
-**A secure, sovereign, and open-source platform for email archiving.**
+**A secure, sovereign, and open-source platform for email archiving and eDiscovery.**
 
 Open Archiver provides a robust, self-hosted solution for archiving, storing, indexing, and searching emails from major platforms, including Google Workspace (Gmail), Microsoft 365, PST files, as well as generic IMAP-enabled email inboxes. Use Open Archiver to keep a permanent, tamper-proof record of your communication history, free from vendor lock-in.
 
-## Screenshots
+## 📸 Screenshots
 
 ![Open Archiver Preview](assets/screenshots/dashboard-1.png)
 _Dashboard_
@@ -22,9 +22,9 @@ _Archived emails_
 ![Open Archiver Preview](assets/screenshots/search.png)
 _Full-text search across all your emails and attachments_
 
-## Join our community!
+## 👨‍👩‍👧‍👦 Join our community!
 
-We are committed to building an engaging community around Open Archiver, and we are inviting all of you to join our community on Discord to get real-time support and connect with the team.
+We are committed to build an engaging community around Open Archiver, and we are inviting all of you to join our community on Discord to get real-time support and connect with the team.
 
 [![Discord](https://img.shields.io/badge/Join%20our%20Discord-7289DA?style=for-the-badge&logo=discord&logoColor=white)](https://discord.gg/MTtD7BhuTQ)
 
@@ -34,11 +34,11 @@ We are committed to building an engaging community around Open Archiver, and we
 
 Check out the live demo here: https://demo.openarchiver.com
 
-Username: demo@openarchiver.com
+Username: admin@local.com
 
 Password: openarchiver_demo
 
-## Key Features
+## ✨ Key Features
 
 - **Universal Ingestion**: Connect to any email provider to perform initial bulk imports and maintain continuous, real-time synchronization. Ingestion sources include:
     - IMAP connection
@@ -46,18 +46,15 @@ Password: openarchiver_demo
     - Microsoft 365
     - PST files
     - Zipped .eml files
-    - Mbox files
 
-- **Secure & Efficient Storage**: Emails are stored in the standard `.eml` format. The system uses deduplication and compression to minimize storage costs. All files are encrypted at rest.
+- **Secure & Efficient Storage**: Emails are stored in the standard `.eml` format. The system uses deduplication and compression to minimize storage costs. All data is encrypted at rest.
 - **Pluggable Storage Backends**: Support both local filesystem storage and S3-compatible object storage (like AWS S3 or MinIO).
 - **Powerful Search & eDiscovery**: A high-performance search engine indexes the full text of emails and attachments (PDF, DOCX, etc.).
 - **Thread discovery**: The ability to discover if an email belongs to a thread/conversation and present the context.
 - **Compliance & Retention**: Define granular retention policies to automatically manage the lifecycle of your data. Place legal holds on communications to prevent deletion during litigation (TBD).
-- **File Hash and Encryption**: Email and attachment file hash values are stored in the meta database upon ingestion, meaning any attempt to alter the file content will be identified, ensuring legal and regulatory compliance.
--   - Each archived email comes with an "Integrity Report" feature that indicates if the files are original.
-- **Comprehensive Auditing**: An immutable audit trail logs all system activities, ensuring you have a clear record of who accessed what and when.
+- **Comprehensive Auditing**: An immutable audit trail logs all system activities, ensuring you have a clear record of who accessed what and when (TBD).
 
-## Tech Stack
+## 🛠️ Tech Stack
 
 Open Archiver is built on a modern, scalable, and maintainable technology stack:
 
@@ -68,7 +65,7 @@ Open Archiver is built on a modern, scalable, and maintainable technology stack:
 - **Database**: PostgreSQL for metadata, user management, and audit logs
 - **Deployment**: Docker Compose deployment
 
-## Deployment
+## 📦 Deployment
 
 ### Prerequisites
 
@@ -104,7 +101,7 @@ Open Archiver is built on a modern, scalable, and maintainable technology stack:
 4.  **Access the application:**
     Once the services are running, you can access the Open Archiver web interface by navigating to `http://localhost:3000` in your web browser.
 
-## Data Source Configuration
+## ⚙️ Data Source Configuration
 
 After deploying the application, you will need to configure one or more ingestion sources to begin archiving emails. Follow our detailed guides to connect to your email provider:
 
@@ -112,7 +109,7 @@ After deploying the application, you will need to configure one or more ingestio
 - [Connecting to Microsoft 365](https://docs.openarchiver.com/user-guides/email-providers/imap.html)
 - [Connecting to a Generic IMAP Server](https://docs.openarchiver.com/user-guides/email-providers/imap.html)
 
-## Contributing
+## 🤝 Contributing
 
 We welcome contributions from the community!
 

apps/open-archiver/index.ts

@@ -1,24 +0,0 @@
-import { createServer, logger } from '@open-archiver/backend';
-import * as dotenv from 'dotenv';
-
-dotenv.config();
-
-async function start() {
-	// --- Environment Variable Validation ---
-	const { PORT_BACKEND } = process.env;
-
-	if (!PORT_BACKEND) {
-		throw new Error('Missing required environment variables for the backend: PORT_BACKEND.');
-	}
-	// Create the server instance (passing no modules for the default OSS version)
-	const app = await createServer([]);
-
-	app.listen(PORT_BACKEND, () => {
-		logger.info({}, `✅ Open Archiver (OSS) running on port ${PORT_BACKEND}`);
-	});
-}
-
-start().catch((error) => {
-	logger.error({ error }, 'Failed to start the server:', error);
-	process.exit(1);
-});

apps/open-archiver/package.json

@@ -1,18 +0,0 @@
-{
-	"name": "open-archiver-app",
-	"version": "1.0.0",
-	"private": true,
-	"scripts": {
-		"dev": "ts-node-dev --respawn --transpile-only index.ts",
-		"build": "tsc",
-		"start": "node dist/index.js"
-	},
-	"dependencies": {
-		"@open-archiver/backend": "workspace:*",
-		"dotenv": "^17.2.0"
-	},
-	"devDependencies": {
-		"@types/dotenv": "^8.2.3",
-		"ts-node-dev": "^2.0.0"
-	}
-}

apps/open-archiver/tsconfig.json

@@ -1,8 +0,0 @@
-{
-	"extends": "../../tsconfig.base.json",
-	"compilerOptions": {
-		"outDir": "dist"
-	},
-	"include": ["./**/*.ts"],
-	"references": [{ "path": "../../packages/backend" }]
-}

docker-compose.yml

@@ -10,7 +10,7 @@ services:
         env_file:
             - .env
         volumes:
-            - ${STORAGE_LOCAL_ROOT_PATH}:${STORAGE_LOCAL_ROOT_PATH}
+            - archiver-data:/var/data/open-archiver
         depends_on:
             - postgres
             - valkey
@@ -47,19 +47,11 @@ services:
         restart: unless-stopped
         environment:
             MEILI_MASTER_KEY: ${MEILI_MASTER_KEY:-aSampleMasterKey}
-            MEILI_SCHEDULE_SNAPSHOT: ${MEILI_SCHEDULE_SNAPSHOT:-86400}
         volumes:
             - meilidata:/meili_data
         networks:
             - open-archiver-net
 
-    tika:
-        image: apache/tika:3.2.2.0-full
-        container_name: tika
-        restart: always
-        networks:
-            - open-archiver-net
-
 volumes:
     pgdata:
         driver: local
@@ -67,6 +59,8 @@ volumes:
         driver: local
     meilidata:
         driver: local
+    archiver-data:
+        driver: local
 
 networks:
     open-archiver-net:

docker/Dockerfile

@@ -1,4 +1,4 @@
-# Dockerfile for the OSS version of Open Archiver
+# Dockerfile for Open Archiver
 
 ARG BASE_IMAGE=node:22-alpine
 
@@ -15,13 +15,12 @@ COPY package.json pnpm-workspace.yaml pnpm-lock.yaml* ./
 COPY packages/backend/package.json ./packages/backend/
 COPY packages/frontend/package.json ./packages/frontend/
 COPY packages/types/package.json ./packages/types/
-COPY apps/open-archiver/package.json ./apps/open-archiver/
 
 # 1. Build Stage: Install all dependencies and build the project
 FROM base AS build
 COPY packages/frontend/svelte.config.js ./packages/frontend/
 
-# Install all dependencies.
+# Install all dependencies. Use --shamefully-hoist to create a flat node_modules structure
 ENV PNPM_HOME="/pnpm"
 RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
     pnpm install --shamefully-hoist --frozen-lockfile --prod=false
@@ -29,19 +28,19 @@ RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
 # Copy the rest of the source code
 COPY . .
 
-# Build the OSS packages.
-RUN pnpm build:oss
+# Build all packages.
+RUN pnpm build
 
 # 2. Production Stage: Install only production dependencies and copy built artifacts
 FROM base AS production
 
+
 # Copy built application from build stage
 COPY --from=build /app/packages/backend/dist ./packages/backend/dist
-COPY --from=build /app/packages/backend/drizzle.config.ts ./packages/backend/drizzle.config.ts
-COPY --from=build /app/packages/backend/src/database/migrations ./packages/backend/src/database/migrations
 COPY --from=build /app/packages/frontend/build ./packages/frontend/build
 COPY --from=build /app/packages/types/dist ./packages/types/dist
-COPY --from=build /app/apps/open-archiver/dist ./apps/open-archiver/dist
+COPY --from=build /app/packages/backend/drizzle.config.ts ./packages/backend/drizzle.config.ts
+COPY --from=build /app/packages/backend/src/database/migrations ./packages/backend/src/database/migrations
 
 # Copy the entrypoint script and make it executable
 COPY docker/docker-entrypoint.sh /usr/local/bin/
@@ -54,4 +53,4 @@ EXPOSE 3000
 ENTRYPOINT ["docker-entrypoint.sh"]
 
 # Start the application
-CMD ["pnpm", "docker-start:oss"]
+CMD ["pnpm", "docker-start"]

docs/.vitepress/config.mts

@@ -6,7 +6,7 @@ export default defineConfig({
 			'script',
 			{
 				defer: '',
-				src: 'https://analytics.openarchiver.com/script.js',
+				src: 'https://analytics.zenceipt.com/script.js',
 				'data-website-id': '2c8b452e-eab5-4f82-8ead-902d8f8b976f',
 			},
 		],
@@ -33,7 +33,6 @@ export default defineConfig({
 				items: [
 					{ text: 'Get Started', link: '/' },
 					{ text: 'Installation', link: '/user-guides/installation' },
-					{ text: 'Email Integrity Check', link: '/user-guides/integrity-check' },
 					{
 						text: 'Email Providers',
 						link: '/user-guides/email-providers/',
@@ -53,7 +52,6 @@ export default defineConfig({
 							},
 							{ text: 'EML Import', link: '/user-guides/email-providers/eml' },
 							{ text: 'PST Import', link: '/user-guides/email-providers/pst' },
-							{ text: 'Mbox Import', link: '/user-guides/email-providers/mbox' },
 						],
 					},
 					{
@@ -66,20 +64,6 @@ export default defineConfig({
 							},
 						],
 					},
-					{
-						text: 'Upgrading and Migration',
-						collapsed: true,
-						items: [
-							{
-								text: 'Upgrading',
-								link: '/user-guides/upgrade-and-migration/upgrade',
-							},
-							{
-								text: 'Meilisearch Upgrade',
-								link: '/user-guides/upgrade-and-migration/meilisearch-upgrade',
-							},
-						],
-					},
 				],
 			},
 			{
@@ -92,10 +76,8 @@ export default defineConfig({
 					{ text: 'Archived Email', link: '/api/archived-email' },
 					{ text: 'Dashboard', link: '/api/dashboard' },
 					{ text: 'Ingestion', link: '/api/ingestion' },
-					{ text: 'Integrity Check', link: '/api/integrity' },
 					{ text: 'Search', link: '/api/search' },
 					{ text: 'Storage', link: '/api/storage' },
-					{ text: 'Jobs', link: '/api/jobs' },
 				],
 			},
 			{
@@ -103,7 +85,6 @@ export default defineConfig({
 				items: [
 					{ text: 'Overview', link: '/services/' },
 					{ text: 'Storage Service', link: '/services/storage-service' },
-					{ text: 'OCR Service', link: '/services/ocr-service' },
 					{
 						text: 'IAM Service',
 						items: [{ text: 'IAM Policies', link: '/services/iam-service/iam-policy' }],

docs/api/ingestion.md

@@ -19,45 +19,11 @@ The request body should be a `CreateIngestionSourceDto` object.
 ```typescript
 interface CreateIngestionSourceDto {
 	name: string;
-	provider: 'google_workspace' | 'microsoft_365' | 'generic_imap' | 'pst_import' | 'eml_import' | 'mbox_import';
+	provider: 'google' | 'microsoft' | 'generic_imap';
 	providerConfig: IngestionCredentials;
 }
 ```
 
-#### Example: Creating an Mbox Import Source with File Upload
-
-```json
-{
-	"name": "My Mbox Import",
-	"provider": "mbox_import",
-	"providerConfig": {
-		"type": "mbox_import",
-		"uploadedFileName": "emails.mbox",
-		"uploadedFilePath": "open-archiver/tmp/uuid-emails.mbox"
-	}
-}
-```
-
-#### Example: Creating an Mbox Import Source with Local File Path
-
-```json
-{
-	"name": "My Mbox Import",
-	"provider": "mbox_import",
-	"providerConfig": {
-		"type": "mbox_import",
-		"localFilePath": "/path/to/emails.mbox"
-	}
-}
-```
-
-**Note:** When using `localFilePath`, the file will not be deleted after import. When using `uploadedFilePath` (via the upload API), the file will be automatically deleted after import. The same applies to `pst_import` and `eml_import` providers.
-
-**Important regarding `localFilePath`:** When running OpenArchiver in a Docker container (which is the standard deployment), `localFilePath` refers to the path **inside the Docker container**, not on the host machine.
-To use a local file:
-1.  **Recommended:** Place your file inside the directory defined by `STORAGE_LOCAL_ROOT_PATH` (e.g., inside a `temp` folder). Since this directory is already mounted as a volume, the file will be accessible at the same path inside the container.
-2.  **Alternative:** Mount a specific directory containing your files as a volume in `docker-compose.yml`. For example, add `- /path/to/my/files:/imports` to the `volumes` section and use `/imports/myfile.pst` as the `localFilePath`.
-
 #### Responses
 
 - **201 Created:** The newly created ingestion source.

docs/api/integrity.md

@@ -1,51 +0,0 @@
-# Integrity Check API
-
-The Integrity Check API provides an endpoint to verify the cryptographic hash of an archived email and its attachments against the stored values in the database. This allows you to ensure that the stored files have not been tampered with or corrupted since they were archived.
-
-## Check Email Integrity
-
-Verifies the integrity of a specific archived email and all of its associated attachments.
-
-- **URL:** `/api/v1/integrity/:id`
-- **Method:** `GET`
-- **URL Params:**
-    - `id=[string]` (required) - The UUID of the archived email to check.
-- **Permissions:** `read:archive`
-- **Success Response:**
-    - **Code:** 200 OK
-    - **Content:** `IntegrityCheckResult[]`
-
-### Response Body `IntegrityCheckResult`
-
-An array of objects, each representing the result of an integrity check for a single file (either the email itself or an attachment).
-
-| Field      | Type                      | Description                                                                 |
-| :--------- | :------------------------ | :-------------------------------------------------------------------------- |
-| `type`     | `'email' \| 'attachment'` | The type of the file being checked.                                         |
-| `id`       | `string`                  | The UUID of the email or attachment.                                        |
-| `filename` | `string` (optional)       | The filename of the attachment. This field is only present for attachments. |
-| `isValid`  | `boolean`                 | `true` if the current hash matches the stored hash, otherwise `false`.      |
-| `reason`   | `string` (optional)       | A reason for the failure. Only present if `isValid` is `false`.             |
-
-### Example Response
-
-```json
-[
-	{
-		"type": "email",
-		"id": "a1b2c3d4-e5f6-7890-1234-567890abcdef",
-		"isValid": true
-	},
-	{
-		"type": "attachment",
-		"id": "b2c3d4e5-f6a7-8901-2345-67890abcdef1",
-		"filename": "document.pdf",
-		"isValid": false,
-		"reason": "Stored hash does not match current hash."
-	}
-]
-```
-
-- **Error Response:**
-    - **Code:** 404 Not Found
-    - **Content:** `{ "message": "Archived email not found" }`

docs/api/jobs.md

@@ -1,128 +0,0 @@
-# Jobs API
-
-The Jobs API provides endpoints for monitoring the job queues and the jobs within them.
-
-## Overview
-
-Open Archiver uses a job queue system to handle asynchronous tasks like email ingestion and indexing. The system is built on Redis and BullMQ and uses a producer-consumer pattern.
-
-### Job Statuses
-
-Jobs can have one of the following statuses:
-
-- **active:** The job is currently being processed.
-- **completed:** The job has been completed successfully.
-- **failed:** The job has failed after all retry attempts.
-- **delayed:** The job is delayed and will be processed at a later time.
-- **waiting:** The job is waiting to be processed.
-- **paused:** The job is paused and will not be processed until it is resumed.
-
-### Errors
-
-When a job fails, the `failedReason` and `stacktrace` fields will contain information about the error. The `error` field will also be populated with the `failedReason` for easier access.
-
-### Job Preservation
-
-Jobs are preserved for a limited time after they are completed or failed. This means that the job counts and the jobs that you see in the API are for a limited time.
-
-- **Completed jobs:** The last 1000 completed jobs are preserved.
-- **Failed jobs:** The last 5000 failed jobs are preserved.
-
-## Get All Queues
-
-- **Endpoint:** `GET /v1/jobs/queues`
-- **Description:** Retrieves a list of all job queues and their job counts.
-- **Permissions:** `manage:all`
-- **Responses:**
-    - `200 OK`: Returns a list of queue overviews.
-    - `401 Unauthorized`: If the user is not authenticated.
-    - `403 Forbidden`: If the user does not have the required permissions.
-
-### Response Body
-
-```json
-{
-	"queues": [
-		{
-			"name": "ingestion",
-			"counts": {
-				"active": 0,
-				"completed": 56,
-				"failed": 4,
-				"delayed": 3,
-				"waiting": 0,
-				"paused": 0
-			}
-		},
-		{
-			"name": "indexing",
-			"counts": {
-				"active": 0,
-				"completed": 0,
-				"failed": 0,
-				"delayed": 0,
-				"waiting": 0,
-				"paused": 0
-			}
-		}
-	]
-}
-```
-
-## Get Queue Jobs
-
-- **Endpoint:** `GET /v1/jobs/queues/:queueName`
-- **Description:** Retrieves a list of jobs within a specific queue, with pagination and filtering by status.
-- **Permissions:** `manage:all`
-- **URL Parameters:**
-    - `queueName` (string, required): The name of the queue to retrieve jobs from.
-- **Query Parameters:**
-    - `status` (string, optional): The status of the jobs to retrieve. Can be one of `active`, `completed`, `failed`, `delayed`, `waiting`, `paused`. Defaults to `failed`.
-    - `page` (number, optional): The page number to retrieve. Defaults to `1`.
-    - `limit` (number, optional): The number of jobs to retrieve per page. Defaults to `10`.
-- **Responses:**
-    - `200 OK`: Returns a detailed view of the queue, including a paginated list of jobs.
-    - `401 Unauthorized`: If the user is not authenticated.
-    - `403 Forbidden`: If the user does not have the required permissions.
-    - `404 Not Found`: If the specified queue does not exist.
-
-### Response Body
-
-```json
-{
-	"name": "ingestion",
-	"counts": {
-		"active": 0,
-		"completed": 56,
-		"failed": 4,
-		"delayed": 3,
-		"waiting": 0,
-		"paused": 0
-	},
-	"jobs": [
-		{
-			"id": "1",
-			"name": "initial-import",
-			"data": {
-				"ingestionSourceId": "clx1y2z3a0000b4d2e5f6g7h8"
-			},
-			"state": "failed",
-			"failedReason": "Error: Connection timed out",
-			"timestamp": 1678886400000,
-			"processedOn": 1678886401000,
-			"finishedOn": 1678886402000,
-			"attemptsMade": 5,
-			"stacktrace": ["..."],
-			"returnValue": null,
-			"ingestionSourceId": "clx1y2z3a0000b4d2e5f6g7h8",
-			"error": "Error: Connection timed out"
-		}
-	],
-	"pagination": {
-		"currentPage": 1,
-		"totalPages": 1,
-		"totalJobs": 4,
-		"limit": 10
-	}
-}
-```

docs/enterprise/audit-log/api.md

@@ -1,78 +0,0 @@
-# Audit Log: API Endpoints
-
-The audit log feature exposes two API endpoints for retrieving and verifying audit log data. Both endpoints require authentication and are only accessible to users with the appropriate permissions.
-
-## Get Audit Logs
-
-Retrieves a paginated list of audit log entries, with support for filtering and sorting.
-
-- **Endpoint:** `GET /api/v1/enterprise/audit-logs`
-- **Method:** `GET`
-- **Authentication:** Required
-
-### Query Parameters
-
-| Parameter    | Type     | Description                                                                 |
-| ------------ | -------- | --------------------------------------------------------------------------- |
-| `page`       | `number` | The page number to retrieve. Defaults to `1`.                               |
-| `limit`      | `number` | The number of entries to retrieve per page. Defaults to `20`.               |
-| `startDate`  | `date`   | The start date for the date range filter.                                   |
-| `endDate`    | `date`   | The end date for the date range filter.                                     |
-| `actor`      | `string` | The actor identifier to filter by.                                          |
-| `actionType` | `string` | The action type to filter by (e.g., `LOGIN`, `CREATE`).                     |
-| `sort`       | `string` | The sort order for the results. Can be `asc` or `desc`. Defaults to `desc`. |
-
-### Response Body
-
-```json
-{
-	"data": [
-		{
-			"id": 1,
-			"previousHash": null,
-			"timestamp": "2025-10-03T00:00:00.000Z",
-			"actorIdentifier": "e8026a75-b58a-4902-8858-eb8780215f82",
-			"actorIp": "::1",
-			"actionType": "LOGIN",
-			"targetType": "User",
-			"targetId": "e8026a75-b58a-4902-8858-eb8780215f82",
-			"details": {},
-			"currentHash": "..."
-		}
-	],
-	"meta": {
-		"total": 100,
-		"page": 1,
-		"limit": 20
-	}
-}
-```
-
-## Verify Audit Log Integrity
-
-Initiates a verification process to check the integrity of the entire audit log chain.
-
-- **Endpoint:** `POST /api/v1/enterprise/audit-logs/verify`
-- **Method:** `POST`
-- **Authentication:** Required
-
-### Response Body
-
-**Success**
-
-```json
-{
-	"ok": true,
-	"message": "Audit log integrity verified successfully."
-}
-```
-
-**Failure**
-
-```json
-{
-	"ok": false,
-	"message": "Audit log chain is broken!",
-	"logId": 123
-}
-```

docs/enterprise/audit-log/audit-service.md

@@ -1,31 +0,0 @@
-# Audit Log: Backend Implementation
-
-The backend implementation of the audit log is handled by the `AuditService`, located in `packages/backend/src/services/AuditService.ts`. This service encapsulates all the logic for creating, retrieving, and verifying audit log entries.
-
-## Hashing and Verification Logic
-
-The core of the audit log's immutability lies in its hashing and verification logic.
-
-### Hash Calculation
-
-The `calculateHash` method is responsible for generating a SHA-256 hash of a log entry. To ensure consistency, it performs the following steps:
-
-1.  **Canonical Object Creation:** It constructs a new object with a fixed property order, ensuring that the object's structure is always the same.
-2.  **Timestamp Normalization:** It converts the `timestamp` to milliseconds since the epoch (`getTime()`) to avoid any precision-related discrepancies between the application and the database.
-3.  **Canonical Stringification:** It uses a custom `canonicalStringify` function to create a JSON string representation of the object. This function sorts the object keys, ensuring that the output is always the same, regardless of the in-memory property order.
-4.  **Hash Generation:** It computes a SHA-256 hash of the canonical string.
-
-### Verification Process
-
-The `verifyAuditLog` method is designed to be highly scalable and efficient, even with millions of log entries. It processes the logs in manageable chunks (e.g., 1000 at a time) to avoid loading the entire table into memory.
-
-The verification process involves the following steps:
-
-1.  **Iterative Processing:** It fetches the logs in batches within a `while` loop.
-2.  **Chain Verification:** For each log entry, it compares the `previousHash` with the `currentHash` of the preceding log. If they do not match, the chain is broken, and the verification fails.
-3.  **Hash Recalculation:** It recalculates the hash of the current log entry using the same `calculateHash` method used during creation.
-4.  **Integrity Check:** It compares the recalculated hash with the `currentHash` stored in the database. If they do not match, the log entry has been tampered with, and the verification fails.
-
-## Service Integration
-
-The `AuditService` is integrated into the application through the `AuditLogModule` (`packages/enterprise/src/modules/audit-log/audit-log.module.ts`), which registers the API routes for the audit log feature. The service's `createAuditLog` method is called from various other services throughout the application to record significant events.

docs/enterprise/audit-log/guide.md

@@ -1,39 +0,0 @@
-# Audit Log: User Interface
-
-The audit log user interface provides a comprehensive view of all significant events that have occurred within the Open Archiver system. It is designed to be intuitive and user-friendly, allowing administrators to easily monitor and review system activity.
-
-## Viewing Audit Logs
-
-The main audit log page displays a table of log entries, with the following columns:
-
-- **Timestamp:** The date and time of the event.
-- **Actor:** The identifier of the user or system process that performed the action.
-- **IP Address:** The IP address from which the action was initiated.
-- **Action:** The type of action performed, displayed as a color-coded badge for easy identification.
-- **Target Type:** The type of resource that was affected.
-- **Target ID:** The unique identifier of the affected resource.
-- **Details:** A truncated preview of the event's details. The full JSON object is displayed in a pop-up card on hover.
-
-## Filtering and Sorting
-
-The table can be sorted by timestamp by clicking the "Timestamp" header. This allows you to view the logs in either chronological or reverse chronological order.
-
-## Pagination
-
-Pagination controls are available below the table, allowing you to navigate through the entire history of audit log entries.
-
-## Verifying Log Integrity
-
-The "Verify Log Integrity" button allows you to initiate a verification process to check the integrity of the entire audit log chain. This process recalculates the hash of each log entry and compares it to the stored hash, ensuring that the cryptographic chain is unbroken and no entries have been tampered with.
-
-### Verification Responses
-
-- **Success:** A success notification is displayed, confirming that the audit log integrity has been verified successfully. This means that the log chain is complete and no entries have been tampered with.
-
-- **Failure:** An error notification is displayed, indicating that the audit log chain is broken or an entry has been tampered with. The notification will include the ID of the log entry where the issue was detected. There are two types of failures:
-    - **Audit log chain is broken:** This means that the `previousHash` of a log entry does not match the `currentHash` of the preceding entry. This indicates that one or more log entries may have been deleted or inserted into the chain.
-    - **Audit log entry is tampered!:** This means that the recalculated hash of a log entry does not match its stored `currentHash`. This indicates that the data within the log entry has been altered.
-
-## Viewing Log Details
-
-You can view the full details of any log entry by clicking on its row in the table. This will open a dialog containing all the information associated with the log entry, including the previous and current hashes.

docs/enterprise/audit-log/index.md

@@ -1,27 +0,0 @@
-# Audit Log
-
-The Audit Log is an enterprise-grade feature designed to provide a complete, immutable, and verifiable record of every significant action that occurs within the Open Archiver system. Its primary purpose is to ensure compliance with strict regulatory standards, such as the German GoBD, by establishing a tamper-proof chain of evidence for all activities.
-
-## Core Principles
-
-To fulfill its compliance and security functions, the audit log adheres to the following core principles:
-
-### 1. Immutability
-
-Every log entry is cryptographically chained to the previous one. Each new entry contains a SHA-256 hash of the preceding entry's hash, creating a verifiable chain. Any attempt to alter or delete a past entry would break this chain and be immediately detectable through the verification process.
-
-### 2. Completeness
-
-The system is designed to log every significant event without exception. This includes not only user-initiated actions (like logins, searches, and downloads) but also automated system processes, such as data ingestion and policy-based deletions.
-
-### 3. Attribution
-
-Each log entry is unambiguously linked to the actor that initiated the event. This could be a specific authenticated user, an external auditor, or an automated system process. The actor's identifier and source IP address are recorded to ensure full traceability.
-
-### 4. Clarity and Detail
-
-Log entries are structured to be detailed and human-readable, providing sufficient context for an auditor to understand the event without needing specialized system knowledge. This includes the action performed, the target resource affected, and a JSON object with specific, contextual details of the event.
-
-### 5. Verifiability
-
-The integrity of the entire audit log can be verified at any time. A dedicated process iterates through the logs from the beginning, recalculating the hash of each entry and comparing it to the stored hash, ensuring the cryptographic chain is unbroken and no entries have been tampered with.

docs/enterprise/retention-policy/api.md

@@ -1,267 +0,0 @@
-# Retention Policy: API Endpoints
-
-The retention policy feature exposes a RESTful API for managing retention policies and simulating policy evaluation against email metadata. All endpoints require authentication and the `manage:all` permission.
-
-**Base URL:** `/api/v1/enterprise/retention-policy`
-
-All endpoints also require the `RETENTION_POLICY` feature to be enabled in the enterprise license.
-
----
-
-## List All Policies
-
-Retrieves all retention policies, ordered by priority ascending.
-
-- **Endpoint:** `GET /policies`
-- **Method:** `GET`
-- **Authentication:** Required
-- **Permission:** `manage:all`
-
-### Response Body
-
-```json
-[
-    {
-        "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
-        "name": "Default 7-Year Retention",
-        "description": "Retain all emails for 7 years per regulatory requirements.",
-        "priority": 1,
-        "conditions": null,
-        "ingestionScope": null,
-        "retentionPeriodDays": 2555,
-        "isActive": true,
-        "createdAt": "2025-10-01T00:00:00.000Z",
-        "updatedAt": "2025-10-01T00:00:00.000Z"
-    }
-]
-```
-
----
-
-## Get Policy by ID
-
-Retrieves a single retention policy by its UUID.
-
-- **Endpoint:** `GET /policies/:id`
-- **Method:** `GET`
-- **Authentication:** Required
-- **Permission:** `manage:all`
-
-### Path Parameters
-
-| Parameter | Type   | Description                    |
-| --------- | ------ | ------------------------------ |
-| `id`      | `uuid` | The UUID of the policy to get. |
-
-### Response Body
-
-Returns a single policy object (same shape as the list endpoint), or `404` if not found.
-
----
-
-## Create Policy
-
-Creates a new retention policy. The policy name must be unique across the system.
-
-- **Endpoint:** `POST /policies`
-- **Method:** `POST`
-- **Authentication:** Required
-- **Permission:** `manage:all`
-
-### Request Body
-
-| Field               | Type                  | Required | Description                                                                                    |
-| ------------------- | --------------------- | -------- | ---------------------------------------------------------------------------------------------- |
-| `name`              | `string`              | Yes      | Unique policy name. Max 255 characters.                                                        |
-| `description`       | `string`              | No       | Human-readable description. Max 1000 characters.                                               |
-| `priority`          | `integer`             | Yes      | Positive integer. Lower values indicate higher priority.                                       |
-| `retentionPeriodDays` | `integer`           | Yes      | Number of days to retain matching emails. Minimum 1.                                           |
-| `actionOnExpiry`    | `string`              | Yes      | Action to take when the retention period expires. Currently only `"delete_permanently"`.        |
-| `isEnabled`         | `boolean`             | No       | Whether the policy is active. Defaults to `true`.                                              |
-| `conditions`        | `RuleGroup \| null`   | No       | Condition rules for targeting specific emails. `null` matches all emails.                      |
-| `ingestionScope`    | `string[] \| null`    | No       | Array of ingestion source UUIDs to scope the policy to. `null` applies to all sources.         |
-
-#### Conditions (RuleGroup) Schema
-
-```json
-{
-    "logicalOperator": "AND",
-    "rules": [
-        {
-            "field": "sender",
-            "operator": "domain_match",
-            "value": "example.com"
-        },
-        {
-            "field": "subject",
-            "operator": "contains",
-            "value": "invoice"
-        }
-    ]
-}
-```
-
-**Supported fields:** `sender`, `recipient`, `subject`, `attachment_type`
-
-**Supported operators:**
-
-| Operator       | Description                                                        |
-| -------------- | ------------------------------------------------------------------ |
-| `equals`       | Exact case-insensitive match.                                      |
-| `not_equals`   | Inverse of `equals`.                                               |
-| `contains`     | Case-insensitive substring match.                                  |
-| `not_contains` | Inverse of `contains`.                                             |
-| `starts_with`  | Case-insensitive prefix match.                                     |
-| `ends_with`    | Case-insensitive suffix match.                                     |
-| `domain_match` | Matches when an email address ends with `@<value>`.                |
-| `regex_match`  | ECMAScript regex (case-insensitive). Max pattern length: 200 chars.|
-
-**Validation limits:**
-- Maximum 50 rules per group.
-- Rule `value` must be between 1 and 500 characters.
-
-### Example Request
-
-```json
-{
-    "name": "Finance Department - 10 Year",
-    "description": "Extended retention for finance-related correspondence.",
-    "priority": 2,
-    "retentionPeriodDays": 3650,
-    "actionOnExpiry": "delete_permanently",
-    "conditions": {
-        "logicalOperator": "OR",
-        "rules": [
-            {
-                "field": "sender",
-                "operator": "domain_match",
-                "value": "finance.acme.com"
-            },
-            {
-                "field": "recipient",
-                "operator": "domain_match",
-                "value": "finance.acme.com"
-            }
-        ]
-    },
-    "ingestionScope": ["b2c3d4e5-f6a7-8901-bcde-f23456789012"]
-}
-```
-
-### Response
-
-- **`201 Created`** — Returns the created policy object.
-- **`409 Conflict`** — A policy with this name already exists.
-- **`422 Unprocessable Entity`** — Validation errors.
-
----
-
-## Update Policy
-
-Updates an existing retention policy. Only the fields included in the request body are modified.
-
-- **Endpoint:** `PUT /policies/:id`
-- **Method:** `PUT`
-- **Authentication:** Required
-- **Permission:** `manage:all`
-
-### Path Parameters
-
-| Parameter | Type   | Description                       |
-| --------- | ------ | --------------------------------- |
-| `id`      | `uuid` | The UUID of the policy to update. |
-
-### Request Body
-
-All fields from the create endpoint are accepted, and all are optional. Only provided fields are updated.
-
-To clear conditions (make the policy match all emails), send `"conditions": null`.
-
-To clear ingestion scope (make the policy apply to all sources), send `"ingestionScope": null`.
-
-### Response
-
-- **`200 OK`** — Returns the updated policy object.
-- **`404 Not Found`** — Policy with the given ID does not exist.
-- **`422 Unprocessable Entity`** — Validation errors.
-
----
-
-## Delete Policy
-
-Permanently deletes a retention policy. This action is irreversible.
-
-- **Endpoint:** `DELETE /policies/:id`
-- **Method:** `DELETE`
-- **Authentication:** Required
-- **Permission:** `manage:all`
-
-### Path Parameters
-
-| Parameter | Type   | Description                       |
-| --------- | ------ | --------------------------------- |
-| `id`      | `uuid` | The UUID of the policy to delete. |
-
-### Response
-
-- **`204 No Content`** — Policy successfully deleted.
-- **`404 Not Found`** — Policy with the given ID does not exist.
-
----
-
-## Evaluate Email (Policy Simulator)
-
-Evaluates a set of email metadata against all active policies and returns the applicable retention period and matching policy IDs. This endpoint does not modify any data — it is a read-only simulation tool.
-
-- **Endpoint:** `POST /policies/evaluate`
-- **Method:** `POST`
-- **Authentication:** Required
-- **Permission:** `manage:all`
-
-### Request Body
-
-| Field                              | Type       | Required | Description                                              |
-| ---------------------------------- | ---------- | -------- | -------------------------------------------------------- |
-| `emailMetadata.sender`             | `string`   | Yes      | Sender email address. Max 500 characters.                |
-| `emailMetadata.recipients`         | `string[]` | Yes      | Recipient email addresses. Max 500 entries.              |
-| `emailMetadata.subject`            | `string`   | Yes      | Email subject line. Max 2000 characters.                 |
-| `emailMetadata.attachmentTypes`    | `string[]` | Yes      | File extensions (e.g., `[".pdf", ".xml"]`). Max 100.     |
-| `emailMetadata.ingestionSourceId`  | `uuid`     | No       | Optional ingestion source UUID for scope-aware evaluation.|
-
-### Example Request
-
-```json
-{
-    "emailMetadata": {
-        "sender": "cfo@finance.acme.com",
-        "recipients": ["legal@acme.com"],
-        "subject": "Q4 Invoice Reconciliation",
-        "attachmentTypes": [".pdf", ".xlsx"],
-        "ingestionSourceId": "b2c3d4e5-f6a7-8901-bcde-f23456789012"
-    }
-}
-```
-
-### Response Body
-
-```json
-{
-    "appliedRetentionDays": 3650,
-    "actionOnExpiry": "delete_permanently",
-    "matchingPolicyIds": [
-        "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
-        "c3d4e5f6-a7b8-9012-cdef-345678901234"
-    ]
-}
-```
-
-| Field                  | Type       | Description                                                                           |
-| ---------------------- | ---------- | ------------------------------------------------------------------------------------- |
-| `appliedRetentionDays` | `integer`  | The longest retention period from all matching policies. `0` means no policy matched. |
-| `actionOnExpiry`       | `string`   | The action to take on expiry. Currently always `"delete_permanently"`.                |
-| `matchingPolicyIds`    | `string[]` | UUIDs of all policies that matched the provided metadata.                             |
-
-### Response Codes
-
-- **`200 OK`** — Evaluation completed.
-- **`422 Unprocessable Entity`** — Validation errors in the request body.

docs/enterprise/retention-policy/guide.md

@@ -1,93 +0,0 @@
-# Retention Policy: User Interface
-
-The retention policy management interface is located at **Dashboard → Compliance → Retention Policies**. It provides a comprehensive view of all configured policies and tools for creating, editing, deleting, and simulating retention rules.
-
-## Policy Table
-
-The main page displays a table of all retention policies with the following columns:
-
-- **Name:** The policy name and its UUID displayed underneath for reference.
-- **Priority:** The numeric priority value. Lower values indicate higher priority.
-- **Retention Period:** The number of days emails matching this policy are retained before expiry.
-- **Ingestion Scope:** Shows which ingestion sources the policy is restricted to. Displays "All ingestion sources" when the policy has no scope restriction, or individual source name badges when scoped.
-- **Conditions:** A summary of the rule group. Displays "No conditions (matches all emails)" for policies without conditions, or "N rule(s) (AND/OR)" for policies with conditions.
-- **Status:** A badge indicating whether the policy is Active or Inactive.
-- **Actions:** Edit and Delete buttons for each policy.
-
-The table is sorted by policy priority by default.
-
-## Creating a Policy
-
-Click the **"Create Policy"** button above the table to open the creation dialog. The form contains the following sections:
-
-### Basic Information
-
-- **Policy Name:** A unique, descriptive name for the policy.
-- **Description:** An optional detailed description of the policy's purpose.
-- **Priority:** A positive integer determining evaluation order (lower = higher priority).
-- **Retention Period (Days):** The number of days to retain matching emails.
-
-### Ingestion Scope
-
-This section controls which ingestion sources the policy applies to:
-
-- **"All ingestion sources" toggle:** When enabled, the policy applies to emails from all ingestion sources. This is the default.
-- **Per-source checkboxes:** When the "all" toggle is disabled, individual ingestion sources can be selected. Each source displays its name and provider type as a badge.
-
-### Condition Rules
-
-Conditions define which emails the policy targets. If no conditions are added, the policy matches all emails (within its ingestion scope).
-
-- **Logical Operator:** Choose **AND** (all rules must match) or **OR** (any rule must match).
-- **Add Rule:** Each rule consists of:
-    - **Field:** The email metadata field to evaluate (`sender`, `recipient`, `subject`, or `attachment_type`).
-    - **Operator:** The comparison operator (see [Supported Operators](#supported-operators) below).
-    - **Value:** The string value to compare against.
-- **Remove Rule:** Each rule has a remove button to delete it from the group.
-
-### Supported Operators
-
-| Operator       | Display Name  | Description                                                 |
-| -------------- | ------------- | ----------------------------------------------------------- |
-| `equals`       | Equals        | Exact case-insensitive match.                               |
-| `not_equals`   | Not Equals    | Inverse of equals.                                          |
-| `contains`     | Contains      | Case-insensitive substring match.                           |
-| `not_contains` | Not Contains  | Inverse of contains.                                        |
-| `starts_with`  | Starts With   | Case-insensitive prefix match.                              |
-| `ends_with`    | Ends With     | Case-insensitive suffix match.                              |
-| `domain_match` | Domain Match  | Matches when an email address ends with `@<value>`.         |
-| `regex_match`  | Regex Match   | ECMAScript regular expression (case-insensitive, max 200 chars). |
-
-### Policy Status
-
-- **Enable Policy toggle:** Controls whether the policy is active immediately upon creation.
-
-## Editing a Policy
-
-Click the **Edit** button (pencil icon) on any policy row to open the edit dialog. The form is pre-populated with the policy's current values. All fields can be modified, and the same validation rules apply as during creation.
-
-## Deleting a Policy
-
-Click the **Delete** button (trash icon) on any policy row. A confirmation dialog appears to prevent accidental deletion. Deleting a policy is irreversible. Once deleted, the policy no longer affects the lifecycle worker's evaluation of emails.
-
-## Policy Simulator
-
-The **"Simulate Policy"** button opens a simulation tool that evaluates hypothetical email metadata against all active policies without making any changes.
-
-### Simulator Input Fields
-
-- **Sender Email:** The sender address to evaluate (e.g., `cfo@finance.acme.com`).
-- **Recipients:** A comma-separated list of recipient email addresses.
-- **Subject:** The email subject line.
-- **Attachment Types:** A comma-separated list of file extensions (e.g., `.pdf, .xlsx`).
-- **Ingestion Source:** An optional dropdown to select a specific ingestion source for scope-aware evaluation. Defaults to "All sources".
-
-### Simulator Results
-
-After submission, the simulator displays:
-
-- **Applied Retention Period:** The longest retention period from all matching policies, displayed in days.
-- **Action on Expiry:** The action that would be taken when the retention period expires (currently always "Permanent Deletion").
-- **Matching Policies:** A list of all policy IDs (with their names) that matched the provided metadata. If no policies match, a message indicates that no matching policies were found.
-
-The simulator is a safe, read-only tool intended for testing and verifying policy configurations before they affect live data.

docs/enterprise/retention-policy/index.md

@@ -1,55 +0,0 @@
-# Retention Policy
-
-The Retention Policy Engine is an enterprise-grade feature that automates the lifecycle management of archived emails. It enables organizations to define time-based retention rules that determine how long archived emails are kept before they are permanently deleted, ensuring compliance with data protection regulations and internal data governance policies.
-
-## Core Principles
-
-### 1. Policy-Based Automation
-
-Email deletion is never arbitrary. Every deletion is governed by one or more explicitly configured retention policies that define the retention period in days, the conditions under which the policy applies, and the action to take when an email expires. The lifecycle worker processes emails in batches on a recurring schedule, ensuring continuous enforcement without manual intervention.
-
-### 2. Condition-Based Targeting
-
-Policies can target specific subsets of archived emails using a flexible condition builder. Conditions are evaluated against email metadata fields (sender, recipient, subject, attachment type) using a variety of string-matching operators. Conditions within a policy are grouped using AND/OR logic, allowing precise control over which emails a policy applies to.
-
-### 3. Ingestion Scope
-
-Each policy can optionally be scoped to one or more ingestion sources. When an ingestion scope is set, the policy only applies to emails that were archived from those specific sources. Policies with no ingestion scope (null) apply to all emails regardless of their source.
-
-### 4. Priority and Max-Duration-Wins
-
-When multiple policies match a single email, the system applies **max-duration-wins** logic: the longest matching retention period is used. This ensures that if any policy requires an email to be kept longer, that requirement is honored. The priority field on each policy provides an ordering mechanism for administrative purposes and future conflict-resolution enhancements.
-
-### 5. Full Audit Trail
-
-Every policy lifecycle event — creation, modification, deletion, and every automated email deletion — is recorded in the immutable [Audit Log](../audit-log/index.md). Automated deletions include the IDs of the governing policies in the audit log entry, ensuring full traceability from deletion back to the rule that triggered it.
-
-### 6. Fail-Safe Behavior
-
-The system is designed to err on the side of caution:
-
-- If no policy matches an email, the email is **not** deleted.
-- If the lifecycle worker encounters an error processing a specific email, it logs the error and continues with the remaining emails in the batch.
-- Invalid regex patterns in `regex_match` rules are treated as non-matching rather than causing failures.
-
-## Feature Requirements
-
-The Retention Policy Engine requires:
-
-- An active **Enterprise license** with the `RETENTION_POLICY` feature enabled.
-- The `manage:all` permission for the authenticated user to access the policy management API and UI.
-
-## Architecture Overview
-
-The feature is composed of the following components:
-
-| Component            | Location                                                              | Description                                                  |
-| -------------------- | --------------------------------------------------------------------- | ------------------------------------------------------------ |
-| Types                | `packages/types/src/retention.types.ts`                               | Shared TypeScript types for policies, rules, and evaluation. |
-| Database Schema      | `packages/backend/src/database/schema/compliance.ts`                  | Drizzle ORM table definition for `retention_policies`.       |
-| Retention Service    | `packages/enterprise/src/modules/retention-policy/RetentionService.ts`| CRUD operations and the evaluation engine.                   |
-| API Controller       | `packages/enterprise/src/modules/retention-policy/retention-policy.controller.ts` | Express request handlers with Zod validation.    |
-| API Routes           | `packages/enterprise/src/modules/retention-policy/retention-policy.routes.ts`     | Route registration with auth and feature guards. |
-| Module               | `packages/enterprise/src/modules/retention-policy/retention-policy.module.ts`     | Enterprise module bootstrap.                     |
-| Lifecycle Worker     | `packages/enterprise/src/workers/lifecycle.worker.ts`                 | BullMQ worker for automated retention enforcement.           |
-| Frontend Page        | `packages/frontend/src/routes/dashboard/compliance/retention-policies/` | SvelteKit page for policy management and simulation.       |

docs/enterprise/retention-policy/lifecycle-worker.md

@@ -1,106 +0,0 @@
-# Retention Policy: Lifecycle Worker
-
-The lifecycle worker is the automated enforcement component of the retention policy engine. It runs as a BullMQ background worker that periodically scans all archived emails, evaluates them against active retention policies, and permanently deletes emails that have exceeded their retention period.
-
-## Location
-
-`packages/enterprise/src/workers/lifecycle.worker.ts`
-
-## How It Works
-
-### Scheduling
-
-The lifecycle worker is registered as a repeatable BullMQ cron job on the `compliance-lifecycle` queue. It is scheduled to run daily at **02:00 UTC** by default. The cron schedule is configured via:
-
-```typescript
-repeat: { pattern: '0 2 * * *' }  // daily at 02:00 UTC
-```
-
-The `scheduleLifecycleJob()` function is called once during enterprise application startup to register the repeatable job with BullMQ.
-
-### Batch Processing
-
-To avoid loading the entire `archived_emails` table into memory, the worker processes emails in configurable batches:
-
-1. **Batch size** is controlled by the `RETENTION_BATCH_SIZE` environment variable.
-2. Emails are ordered by `archivedAt` ascending.
-3. The worker iterates through batches using offset-based pagination until an empty batch is returned, indicating all emails have been processed.
-
-### Per-Email Processing Flow
-
-For each email in a batch, the worker:
-
-1. **Extracts metadata:** Builds a `PolicyEvaluationRequest` from the email's database record:
-    - `sender`: The sender email address.
-    - `recipients`: All To, CC, and BCC recipient addresses.
-    - `subject`: The email subject line.
-    - `attachmentTypes`: File extensions (e.g., `.pdf`) extracted from attachment filenames via a join query.
-    - `ingestionSourceId`: The UUID of the ingestion source that archived this email.
-
-2. **Evaluates policies:** Passes the metadata to `RetentionService.evaluateEmail()`, which returns:
-    - `appliedRetentionDays`: The longest matching retention period (0 if no policy matches).
-    - `matchingPolicyIds`: UUIDs of all matching policies.
-
-3. **Checks for expiry:**
-    - If `appliedRetentionDays === 0`, no policy matched — the email is **skipped** (not deleted).
-    - Otherwise, the email's age is calculated from its `sentAt` date.
-    - If the age in days exceeds `appliedRetentionDays`, the email has expired.
-
-4. **Deletes expired emails:** Calls `ArchivedEmailService.deleteArchivedEmail()` with:
-    - `systemDelete: true` — Bypasses the `ENABLE_DELETION` configuration guard so retention enforcement always works regardless of that global setting.
-    - `governingRule` — A string listing the matching policy IDs for the audit log entry (e.g., `"Policy IDs: abc-123, def-456"`).
-
-5. **Logs the deletion:** A structured log entry records the email ID and its age in days.
-
-### Error Handling
-
-If processing a specific email fails (e.g., due to a database error or storage issue), the error is logged and the worker continues to the next email in the batch. This ensures that a single problematic email does not block the processing of the remaining emails.
-
-If the entire job fails, BullMQ records the failure and the job ID and error are logged. Failed jobs are retained (up to 50) for debugging.
-
-## System Actor
-
-Automated deletions are attributed to a synthetic system actor in the audit log:
-
-| Field        | Value                                |
-| ------------ | ------------------------------------ |
-| ID           | `system:lifecycle-worker`            |
-| Email        | `system@open-archiver.internal`      |
-| Name         | System Lifecycle Worker              |
-| Actor IP     | `system`                             |
-
-This well-known identifier can be filtered in the [Audit Log](../audit-log/index.md) to view all retention-based deletions.
-
-## Audit Trail
-
-Every email deleted by the lifecycle worker produces an audit log entry with:
-
-- **Action type:** `DELETE`
-- **Target type:** `ArchivedEmail`
-- **Target ID:** The UUID of the deleted email
-- **Actor:** `system:lifecycle-worker`
-- **Details:** Includes `reason: "RetentionExpiration"` and `governingRule` listing the matching policy IDs
-
-This ensures that every automated deletion is fully traceable back to the specific policies that triggered it.
-
-## Configuration
-
-| Environment Variable      | Description                                          | Default |
-| ------------------------- | ---------------------------------------------------- | ------- |
-| `RETENTION_BATCH_SIZE`    | Number of emails to process per batch iteration.     | —       |
-
-## BullMQ Worker Settings
-
-| Setting              | Value                  | Description                                        |
-| -------------------- | ---------------------- | -------------------------------------------------- |
-| Queue name           | `compliance-lifecycle` | The BullMQ queue name.                             |
-| Job ID               | `lifecycle-daily`      | Stable job ID for the repeatable cron job.         |
-| `removeOnComplete`   | Keep last 10           | Completed jobs retained for monitoring.            |
-| `removeOnFail`       | Keep last 50           | Failed jobs retained for debugging.                |
-
-## Integration with Deletion Guard
-
-The core `ArchivedEmailService.deleteArchivedEmail()` method includes a deletion guard controlled by the `ENABLE_DELETION` system setting. When called with `systemDelete: true`, the lifecycle worker bypasses this guard. This design ensures that:
-
-- Manual user deletions can be disabled organization-wide via the system setting.
-- Automated retention enforcement always operates regardless of that setting, because retention compliance is a legal obligation that cannot be paused by a UI toggle.

docs/enterprise/retention-policy/retention-service.md

@@ -1,138 +0,0 @@
-# Retention Policy: Backend Implementation
-
-The backend implementation of the retention policy engine is handled by the `RetentionService`, located in `packages/enterprise/src/modules/retention-policy/RetentionService.ts`. This service encapsulates all CRUD operations for policies and the core evaluation engine that determines which policies apply to a given email.
-
-## Database Schema
-
-The `retention_policies` table is defined in `packages/backend/src/database/schema/compliance.ts` using Drizzle ORM:
-
-| Column                | Type                       | Description                                                                 |
-| --------------------- | -------------------------- | --------------------------------------------------------------------------- |
-| `id`                  | `uuid` (PK)               | Auto-generated unique identifier.                                           |
-| `name`                | `text` (unique, not null)  | Human-readable policy name.                                                 |
-| `description`         | `text`                     | Optional description.                                                       |
-| `priority`            | `integer` (not null)       | Priority for ordering. Lower = higher priority.                             |
-| `retention_period_days` | `integer` (not null)     | Number of days to retain matching emails.                                   |
-| `action_on_expiry`    | `enum` (not null)          | Action on expiry (`delete_permanently`).                                    |
-| `is_enabled`          | `boolean` (default: true)  | Whether the policy is active.                                               |
-| `conditions`          | `jsonb`                    | Serialized `RetentionRuleGroup` or null (null = matches all).               |
-| `ingestion_scope`     | `jsonb`                    | Array of ingestion source UUIDs or null (null = all sources).               |
-| `created_at`          | `timestamptz`              | Creation timestamp.                                                         |
-| `updated_at`          | `timestamptz`              | Last update timestamp.                                                      |
-
-## CRUD Operations
-
-The `RetentionService` class provides the following methods:
-
-### `createPolicy(data, actorId, actorIp)`
-
-Inserts a new policy into the database and creates an audit log entry with action type `CREATE` and target type `RetentionPolicy`. The audit log details include the policy name, retention period, priority, action on expiry, and ingestion scope.
-
-### `getPolicies()`
-
-Returns all policies ordered by priority ascending. The raw database rows are mapped through `mapDbPolicyToType()`, which converts the DB column `isEnabled` to the shared type field `isActive` and normalizes date fields to ISO strings.
-
-### `getPolicyById(id)`
-
-Returns a single policy by UUID, or null if not found.
-
-### `updatePolicy(id, data, actorId, actorIp)`
-
-Partially updates a policy — only fields present in the DTO are modified. The `updatedAt` timestamp is always set to the current time. An audit log entry is created with action type `UPDATE`, recording which fields were changed.
-
-Throws an error if the policy is not found.
-
-### `deletePolicy(id, actorId, actorIp)`
-
-Deletes a policy by UUID and creates an audit log entry with action type `DELETE`, recording the deleted policy's name. Returns `false` if the policy was not found.
-
-## Evaluation Engine
-
-The evaluation engine is the core logic that determines which policies apply to a given email. It is used by both the lifecycle worker (for automated enforcement) and the policy simulator endpoint (for testing).
-
-### `evaluateEmail(metadata)`
-
-This is the primary evaluation method. It accepts email metadata and returns:
-- `appliedRetentionDays`: The longest matching retention period (max-duration-wins).
-- `matchingPolicyIds`: UUIDs of all policies that matched.
-- `actionOnExpiry`: Always `"delete_permanently"` in the current implementation.
-
-The evaluation flow:
-
-1. **Fetch active policies:** Queries all policies where `isEnabled = true`.
-2. **Ingestion scope check:** For each policy with a non-null `ingestionScope`, the email's `ingestionSourceId` must be included in the scope array. If not, the policy is skipped.
-3. **Condition evaluation:** If the policy has no conditions (`null`), it matches all emails within scope. Otherwise, the condition rule group is evaluated.
-4. **Max-duration-wins:** If multiple policies match, the longest `retentionPeriodDays` is used.
-5. **Zero means no match:** A return value of `appliedRetentionDays = 0` indicates no policy matched — the lifecycle worker will not delete the email.
-
-### `_evaluateRuleGroup(group, metadata)`
-
-Evaluates a `RetentionRuleGroup` using AND or OR logic:
-- **AND:** Every rule in the group must pass.
-- **OR:** At least one rule must pass.
-- An empty rules array evaluates to `true`.
-
-### `_evaluateRule(rule, metadata)`
-
-Evaluates a single rule against the email metadata. All string comparisons are case-insensitive (both sides are lowercased before comparison). The behavior depends on the field:
-
-| Field             | Behavior                                                                 |
-| ----------------- | ------------------------------------------------------------------------ |
-| `sender`          | Compares against the sender email address.                               |
-| `recipient`       | Passes if **any** recipient matches the operator.                        |
-| `subject`         | Compares against the email subject.                                      |
-| `attachment_type` | Passes if **any** attachment file extension matches (e.g., `.pdf`).      |
-
-### `_applyOperator(haystack, operator, needle)`
-
-Applies a string-comparison operator between two pre-lowercased strings:
-
-| Operator       | Implementation                                                                |
-| -------------- | ----------------------------------------------------------------------------- |
-| `equals`       | `haystack === needle`                                                         |
-| `not_equals`   | `haystack !== needle`                                                         |
-| `contains`     | `haystack.includes(needle)`                                                   |
-| `not_contains` | `!haystack.includes(needle)`                                                  |
-| `starts_with`  | `haystack.startsWith(needle)`                                                 |
-| `ends_with`    | `haystack.endsWith(needle)`                                                   |
-| `domain_match` | `haystack.endsWith('@' + needle)` (auto-prepends `@` if missing)             |
-| `regex_match`  | `new RegExp(needle, 'i').test(haystack)` with safety guards (see below)       |
-
-### Security: `regex_match` Safeguards
-
-The `regex_match` operator includes protections against Regular Expression Denial of Service (ReDoS):
-
-1. **Length limit:** Patterns exceeding 200 characters (`MAX_REGEX_LENGTH`) are rejected and treated as non-matching. A warning is logged.
-2. **Error handling:** Invalid regex syntax is caught in a try/catch block and treated as non-matching. A warning is logged.
-3. **Flags:** Only the case-insensitive flag (`i`) is used. Global and multiline flags are excluded to prevent stateful matching bugs.
-
-## Request Validation
-
-The `RetentionPolicyController` (`retention-policy.controller.ts`) validates all incoming requests using Zod schemas before passing data to the service:
-
-| Constraint                  | Limit                                                          |
-| --------------------------- | -------------------------------------------------------------- |
-| Policy name                 | 1–255 characters.                                              |
-| Description                 | Max 1000 characters.                                           |
-| Priority                    | Positive integer (≥ 1).                                        |
-| Retention period            | Positive integer (≥ 1 day).                                    |
-| Rules per group             | Max 50.                                                        |
-| Rule value                  | 1–500 characters.                                              |
-| Ingestion scope entries     | Each must be a valid UUID. Empty arrays are coerced to `null`. |
-| Evaluate — sender           | Max 500 characters.                                            |
-| Evaluate — recipients       | Max 500 entries, each max 500 characters.                      |
-| Evaluate — subject          | Max 2000 characters.                                           |
-| Evaluate — attachment types | Max 100 entries, each max 50 characters.                       |
-
-## Module Registration
-
-The `RetentionPolicyModule` (`retention-policy.module.ts`) implements the `ArchiverModule` interface and registers the API routes at:
-
-```
-/{api.version}/enterprise/retention-policy
-```
-
-All routes are protected by:
-1. `requireAuth` — Ensures the request includes a valid authentication token.
-2. `featureEnabled(OpenArchiverFeature.RETENTION_POLICY)` — Ensures the enterprise license includes the retention policy feature.
-3. `requirePermission('manage', 'all')` — Ensures the user has administrative permissions.

docs/services/iam-service.md

@@ -0,0 +1,289 @@
+# IAM Policies
+
+This document provides a guide to creating and managing IAM policies in Open Archiver. It is intended for developers and administrators who need to configure granular access control for users and roles.
+
+## Policy Structure
+
+IAM policies are defined as an array of JSON objects, where each object represents a single permission rule. The structure of a policy object is as follows:
+
+```json
+{
+	"action": "read" OR ["read", "create"],
+	"subject": "ingestion" OR ["ingestion", "dashboard"],
+	"conditions": {
+		"field_name": "value"
+	},
+	"inverted": false OR true,
+}
+```
+
+- `action`: The action(s) to be performed on the subject. Can be a single string or an array of strings.
+- `subject`: The resource(s) or entity on which the action is to be performed. Can be a single string or an array of strings.
+- `conditions`: (Optional) A set of conditions that must be met for the permission to be granted.
+- `inverted`: (Optional) When set to `true`, this inverts the rule, turning it from a "can" rule into a "cannot" rule. This is useful for creating exceptions to broader permissions.
+
+## Actions
+
+The following actions are available for use in IAM policies:
+
+- `manage`: A wildcard action that grants all permissions on a subject (`create`, `read`, `update`, `delete`, `search`, `sync`).
+- `create`: Allows the user to create a new resource.
+- `read`: Allows the user to view a resource.
+- `update`: Allows the user to modify an existing resource.
+- `delete`: Allows the user to delete a resource.
+- `search`: Allows the user to search for resources.
+- `sync`: Allows the user to synchronize a resource.
+
+## Subjects
+
+The following subjects are available for use in IAM policies:
+
+- `all`: A wildcard subject that represents all resources.
+- `archive`: Represents archived emails.
+- `ingestion`: Represents ingestion sources.
+- `settings`: Represents system settings.
+- `users`: Represents user accounts.
+- `roles`: Represents user roles.
+- `dashboard`: Represents the dashboard.
+
+## Advanced Conditions with MongoDB-Style Queries
+
+Conditions are the key to creating fine-grained access control rules. They are defined as a JSON object where each key represents a field on the subject, and the value defines the criteria for that field.
+
+All conditions within a single rule are implicitly joined with an **AND** logic. This means that for a permission to be granted, the resource must satisfy _all_ specified conditions.
+
+The power of this system comes from its use of a subset of [MongoDB's query language](https://www.mongodb.com/docs/manual/), which provides a flexible and expressive way to define complex rules. These rules are translated into native queries for both the PostgreSQL database (via Drizzle ORM) and the Meilisearch engine.
+
+### Supported Operators and Examples
+
+Here is a detailed breakdown of the supported operators with examples.
+
+#### `$eq` (Equal)
+
+This is the default operator. If you provide a simple key-value pair, it is treated as an equality check.
+
+```json
+// This rule...
+{ "status": "active" }
+
+// ...is equivalent to this:
+{ "status": { "$eq": "active" } }
+```
+
+**Use Case**: Grant access to an ingestion source only if its status is `active`.
+
+#### `$ne` (Not Equal)
+
+Matches documents where the field value is not equal to the specified value.
+
+```json
+{ "provider": { "$ne": "pst_import" } }
+```
+
+**Use Case**: Allow a user to see all ingestion sources except for PST imports.
+
+#### `$in` (In Array)
+
+Matches documents where the field value is one of the values in the specified array.
+
+```json
+{
+	"id": {
+		"$in": ["INGESTION_ID_1", "INGESTION_ID_2"]
+	}
+}
+```
+
+**Use Case**: Grant an auditor access to a specific list of ingestion sources.
+
+#### `$nin` (Not In Array)
+
+Matches documents where the field value is not one of the values in the specified array.
+
+```json
+{ "provider": { "$nin": ["pst_import", "eml_import"] } }
+```
+
+**Use Case**: Hide all manual import sources from a specific user role.
+
+#### `$lt` / `$lte` (Less Than / Less Than or Equal)
+
+Matches documents where the field value is less than (`$lt`) or less than or equal to (`$lte`) the specified value. This is useful for numeric or date-based comparisons.
+
+```json
+{ "sentAt": { "$lt": "2024-01-01T00:00:00.000Z" } }
+```
+
+#### `$gt` / `$gte` (Greater Than / Greater Than or Equal)
+
+Matches documents where the field value is greater than (`$gt`) or greater than or equal to (`$gte`) the specified value.
+
+```json
+{ "sentAt": { "$lt": "2024-01-01T00:00:00.000Z" } }
+```
+
+#### `$exists`
+
+Matches documents that have (or do not have) the specified field.
+
+```json
+// Grant access only if a 'lastSyncStatusMessage' exists
+{ "lastSyncStatusMessage": { "$exists": true } }
+```
+
+## Inverted Rules: Creating Exceptions with `cannot`
+
+By default, all rules are "can" rules, meaning they grant permissions. However, you can create a "cannot" rule by adding `"inverted": true` to a policy object. This is extremely useful for creating exceptions to broader permissions.
+
+A common pattern is to grant broad access and then use an inverted rule to carve out a specific restriction.
+
+**Use Case**: Grant a user access to all ingestion sources _except_ for one specific source.
+
+This is achieved with two rules:
+
+1.  A "can" rule that grants `read` access to the `ingestion` subject.
+2.  An inverted "cannot" rule that denies `read` access for the specific ingestion `id`.
+
+```json
+[
+	{
+		"action": "read",
+		"subject": "ingestion"
+	},
+	{
+		"inverted": true,
+		"action": "read",
+		"subject": "ingestion",
+		"conditions": {
+			"id": "SPECIFIC_INGESTION_ID_TO_EXCLUDE"
+		}
+	}
+]
+```
+
+## Policy Evaluation Logic
+
+The system evaluates policies by combining all relevant rules for a user. The logic is simple:
+
+- A user has permission if at least one `can` rule allows it.
+- A permission is denied if a `cannot` (`"inverted": true`) rule explicitly forbids it, even if a `can` rule allows it. `cannot` rules always take precedence.
+
+### Dynamic Policies with Placeholders
+
+To create dynamic policies that are specific to the current user, you can use the `${user.id}` placeholder in the `conditions` object. This placeholder will be replaced with the ID of the current user at runtime.
+
+## Special Permissions for User and Role Management
+
+It is important to note that while `read` access to `users` and `roles` can be granted granularly, any actions that modify these resources (`create`, `update`, `delete`) are restricted to Super Admins.
+
+A user must have the `{ "action": "manage", "subject": "all" }` permission (Typically a Super Admin role) to manage users and roles. This is a security measure to prevent unauthorized changes to user accounts and permissions.
+
+## Policy Examples
+
+Here are several examples based on the default roles in the system, demonstrating how to combine actions, subjects, and conditions to achieve specific access control scenarios.
+
+### Administrator
+
+This policy grants a user full access to all resources using wildcards.
+
+```json
+[
+	{
+		"action": "manage",
+		"subject": "all"
+	}
+]
+```
+
+### End-User
+
+This policy allows a user to view the dashboard, create new ingestion sources, and fully manage the ingestion sources they own.
+
+```json
+[
+	{
+		"action": "read",
+		"subject": "dashboard"
+	},
+	{
+		"action": "create",
+		"subject": "ingestion"
+	},
+	{
+		"action": "manage",
+		"subject": "ingestion",
+		"conditions": {
+			"userId": "${user.id}"
+		}
+	},
+	{
+		"action": "manage",
+		"subject": "archive",
+		"conditions": {
+			"ingestionSource.userId": "${user.id}" // also needs to give permission to archived emails created by the user
+		}
+	}
+]
+```
+
+### Global Read-Only Auditor
+
+This policy grants read and search access across most of the application's resources, making it suitable for an auditor who needs to view data without modifying it.
+
+```json
+[
+	{
+		"action": ["read", "search"],
+		"subject": ["ingestion", "archive", "dashboard", "users", "roles"]
+	}
+]
+```
+
+### Ingestion Admin
+
+This policy grants full control over all ingestion sources and archives, but no other resources.
+
+```json
+[
+	{
+		"action": "manage",
+		"subject": "ingestion"
+	}
+]
+```
+
+### Auditor for Specific Ingestion Sources
+
+This policy demonstrates how to grant access to a specific list of ingestion sources using the `$in` operator.
+
+```json
+[
+	{
+		"action": ["read", "search"],
+		"subject": "ingestion",
+		"conditions": {
+			"id": {
+				"$in": ["INGESTION_ID_1", "INGESTION_ID_2"]
+			}
+		}
+	}
+]
+```
+
+### Limit Access to a Specific Mailbox
+
+This policy grants a user access to a specific ingestion source, but only allows them to see emails belonging to a single user within that source.
+
+This is achieved by defining two specific `can` rules: The rule grants `read` and `search` access to the `archive` subject, but the `userEmail` must match.
+
+```json
+[
+	{
+		"action": ["read", "search"],
+		"subject": "archive",
+		"conditions": {
+			"userEmail": "user1@example.com"
+		}
+	}
+]
+```

docs/services/ocr-service.md

@@ -1,96 +0,0 @@
-# OCR Service
-
-The OCR (Optical Character Recognition) and text extraction service is responsible for extracting plain text content from various file formats, such as PDFs, Office documents, and more. This is a crucial component for making email attachments searchable.
-
-## Overview
-
-The system employs a two-pronged approach for text extraction:
-
-1.  **Primary Extractor (Apache Tika)**: A powerful and versatile toolkit that can extract text from a wide variety of file formats. It is the recommended method for its superior performance and format support.
-2.  **Legacy Extractor**: A fallback mechanism that uses a combination of libraries (`pdf2json`, `mammoth`, `xlsx`) for common file types like PDF, DOCX, and XLSX. This is used when Apache Tika is not configured.
-
-The main logic resides in `packages/backend/src/helpers/textExtractor.ts`, which decides which extraction method to use based on the application's configuration.
-
-## Configuration
-
-To enable the primary text extraction method, you must configure the URL of an Apache Tika server instance in your environment variables.
-
-In your `.env` file, set the `TIKA_URL`:
-
-```env
-# .env.example
-
-# Apache Tika Integration
-# ONLY active if TIKA_URL is set
-TIKA_URL=http://tika:9998
-```
-
-If `TIKA_URL` is not set, the system will automatically fall back to the legacy extraction methods. The service performs a health check on startup to verify connectivity with the Tika server.
-
-## File Size Limits
-
-To prevent excessive memory usage and processing time, the service imposes a general size limit on files submitted for text extraction. Files larger than the configured limit will be skipped.
-
-- **With Apache Tika**: The maximum file size is **100MB**.
-- **With Legacy Fallback**: The maximum file size is **50MB**.
-
-## Supported File Formats
-
-The service's ability to extract text depends on whether it's using Apache Tika or the legacy fallback methods.
-
-### With Apache Tika
-
-When `TIKA_URL` is configured, the service can process a vast range of file formats. Apache Tika is designed for broad compatibility and supports hundreds of file types, including but not limited to:
-
-- Portable Document Format (PDF)
-- Microsoft Office formats (DOC, DOCX, PPT, PPTX, XLS, XLSX)
-- OpenDocument Formats (ODT, ODS, ODP)
-- Rich Text Format (RTF)
-- Plain Text (TXT, CSV, JSON, XML, HTML)
-- Image formats with OCR capabilities (PNG, JPEG, TIFF)
-- Archive formats (ZIP, TAR, GZ)
-- Email formats (EML, MSG)
-
-For a complete and up-to-date list, please refer to the official [Apache Tika documentation](https://tika.apache.org/3.2.3/formats.html).
-
-### With Legacy Fallback
-
-When Tika is not configured, text extraction is limited to the following formats:
-
-- `application/pdf` (PDF)
-- `application/vnd.openxmlformats-officedocument.wordprocessingml.document` (DOCX)
-- `application/vnd.openxmlformats-officedocument.spreadsheetml.sheet` (XLSX)
-- Plain text formats such as `text/*`, `application/json`, and `application/xml`.
-
-## Features of the Tika Integration (`OcrService`)
-
-The `OcrService` (`packages/backend/src/services/OcrService.ts`) provides several enhancements to make text extraction efficient and robust.
-
-### Caching
-
-To avoid redundant processing of the same file, the service implements a simple LRU (Least Recently Used) cache.
-
-- **Cache Key**: A SHA-256 hash of the file's buffer is used as the cache key.
-- **Functionality**: If a file with the same hash is processed again, the text content is served directly from the cache, saving significant processing time.
-- **Statistics**: The service keeps track of cache hits, misses, and the hit rate for performance monitoring.
-
-### Concurrency Management (Semaphore)
-
-Extracting text from large files can be resource-intensive. To prevent the Tika server from being overwhelmed by multiple requests for the _same file_ simultaneously (e.g., during a large import), a semaphore mechanism is used.
-
-- **Functionality**: If a request for a specific file (identified by its hash) is already in progress, any subsequent requests for the same file will wait for the first one to complete and then use its result.
-- **Benefit**: This deduplicates parallel processing efforts and reduces unnecessary load on the Tika server.
-
-### Health Check and DNS Fallback
-
-- **Availability Check**: The service includes a `checkTikaAvailability` method to verify that the Tika server is reachable and operational. This check is performed on application startup.
-- **DNS Fallback**: For convenience in Docker environments, if the Tika URL uses the hostname `tika` (e.g., `http://tika:9998`), the service will automatically attempt a fallback to `localhost` if the initial connection fails.
-
-## Legacy Fallback Methods
-
-When Tika is not available, the `extractTextLegacy` function in `textExtractor.ts` handles extraction for a limited set of MIME types:
-
-- `application/pdf`: Processed using `pdf2json`. Includes a 50MB size limit and a 5-second timeout to prevent memory issues.
-- `application/vnd.openxmlformats-officedocument.wordprocessingml.document` (DOCX): Processed using `mammoth`.
-- `application/vnd.openxmlformats-officedocument.spreadsheetml.sheet` (XLSX): Processed using `xlsx`.
-- Plain text formats (`text/*`, `application/json`, `application/xml`): Converted directly from the buffer.

docs/user-guides/email-providers/eml.md

@@ -30,14 +30,7 @@ archive.zip
 2.  Click the **Create New** button.
 3.  Select **EML Import** as the provider.
 4.  Enter a name for the ingestion source.
-5.  **Choose Import Method:**
-    *   **Upload File:** Click **Choose File** and select the zip archive containing your EML files. (Best for smaller archives)
-    *   **Local Path:** Enter the path to the zip file **inside the container**. (Best for large archives)
-
-    > **Note on Local Path:** When using Docker, the "Local Path" is relative to the container's filesystem.
-    > *   **Recommended:** Place your zip file in a `temp` folder inside your configured storage directory (`STORAGE_LOCAL_ROOT_PATH`). This path is already mounted. For example, if your storage path is `/data`, put the file in `/data/temp/emails.zip` and enter `/data/temp/emails.zip` as the path.
-    > *   **Alternative:** Mount a separate volume in `docker-compose.yml` (e.g., `- /host/path:/container/path`) and use the container path.
-
+5.  Click the **Choose File** button and select the zip archive containing your EML files.
 6.  Click the **Submit** button.
 
 OpenArchiver will then start importing the EML files from the zip archive. The ingestion process may take some time, depending on the size of the archive.

docs/user-guides/email-providers/index.md

@@ -9,4 +9,3 @@ Choose your provider from the list below to get started:
 - [Generic IMAP Server](./imap.md)
 - [EML Import](./eml.md)
 - [PST Import](./pst.md)
-- [Mbox Import](./mbox.md)

docs/user-guides/email-providers/mbox.md

@@ -1,35 +0,0 @@
-# Mbox Ingestion
-
-Mbox is a common format for storing email messages. This guide will walk you through the process of ingesting mbox files into OpenArchiver.
-
-## 1. Exporting from Your Email Client
-
-Most email clients that support mbox exports will allow you to export a folder of emails as a single `.mbox` file. Here are the general steps:
-
-- **Mozilla Thunderbird**: Right-click on a folder, select **ImportExportTools NG**, and then choose **Export folder**.
-- **Gmail**: You can use Google Takeout to export your emails in mbox format.
-- **Other Clients**: Refer to your email client's documentation for instructions on how to export emails to an mbox file.
-
-## 2. Uploading to OpenArchiver
-
-Once you have your `.mbox` file, you can upload it to OpenArchiver through the web interface.
-
-1.  Navigate to the **Ingestion** page.
-2.  Click on the **New Ingestion** button.
-3.  Select **Mbox** as the source type.
-4.  **Choose Import Method:**
-    *   **Upload File:** Upload your `.mbox` file.
-    *   **Local Path:** Enter the path to the mbox file **inside the container**.
-
-    > **Note on Local Path:** When using Docker, the "Local Path" is relative to the container's filesystem.
-    > *   **Recommended:** Place your mbox file in a `temp` folder inside your configured storage directory (`STORAGE_LOCAL_ROOT_PATH`). This path is already mounted. For example, if your storage path is `/data`, put the file in `/data/temp/emails.mbox` and enter `/data/temp/emails.mbox` as the path.
-    > *   **Alternative:** Mount a separate volume in `docker-compose.yml` (e.g., `- /host/path:/container/path`) and use the container path.
-
-## 3. Folder Structure
-
-OpenArchiver will attempt to preserve the original folder structure of your emails. This is done by inspecting the following email headers:
-
-- `X-Gmail-Labels`: Used by Gmail to store labels.
-- `X-Folder`: A custom header used by some email clients like Thunderbird.
-
-If neither of these headers is present, the emails will be ingested into the root of the archive.

docs/user-guides/email-providers/pst.md

@@ -15,14 +15,7 @@ To ensure a successful import, you should prepare your PST file according to the
 2.  Click the **Create New** button.
 3.  Select **PST Import** as the provider.
 4.  Enter a name for the ingestion source.
-5.  **Choose Import Method:**
-    *   **Upload File:** Click **Choose File** and select the PST file from your computer. (Best for smaller files)
-    *   **Local Path:** Enter the path to the PST file **inside the container**. (Best for large files)
-
-    > **Note on Local Path:** When using Docker, the "Local Path" is relative to the container's filesystem.
-    > *   **Recommended:** Place your file in a `temp` folder inside your configured storage directory (`STORAGE_LOCAL_ROOT_PATH`). This path is already mounted. For example, if your storage path is `/data`, put the file in `/data/temp/archive.pst` and enter `/data/temp/archive.pst` as the path.
-    > *   **Alternative:** Mount a separate volume in `docker-compose.yml` (e.g., `- /host/path:/container/path`) and use the container path.
-
+5.  Click the **Choose File** button and select the PST file.
 6.  Click the **Submit** button.
 
 OpenArchiver will then start importing the emails from the PST file. The ingestion process may take some time, depending on the size of the file.

docs/user-guides/installation.md

@@ -17,22 +17,7 @@ git clone https://github.com/LogicLabs-OU/OpenArchiver.git
 cd OpenArchiver
 ```
 
-## 2. Create a Directory for Local Storage (Important)
-
-Before configuring the application, you **must** create a directory on your host machine where Open Archiver will store its data (such as emails and attachments). Manually creating this directory helps prevent potential permission issues.
-
-Foe examples, you can use this path `/var/data/open-archiver`.
-
-Run the following commands to create the directory and set the correct permissions:
-
-```bash
-sudo mkdir -p /var/data/open-archiver
-sudo chown -R $(id -u):$(id -g) /var/data/open-archiver
-```
-
-This ensures the directory is owned by your current user, which is necessary for the application to have write access. You will set this path in your `.env` file in the next step.
-
-## 3. Configure Your Environment
+## 2. Configure Your Environment
 
 The application is configured using environment variables. You'll need to create a `.env` file to store your configuration.
 
@@ -44,15 +29,9 @@ cp .env.example.docker .env
 
 Now, open the `.env` file in a text editor and customize the settings.
 
-### Key Configuration Steps
+### Important Configuration
 
-1.  **Set the Storage Path**: Find the `STORAGE_LOCAL_ROOT_PATH` variable and set it to the path you just created.
-
-    ```env
-    STORAGE_LOCAL_ROOT_PATH=/var/data/open-archiver
-    ```
-
-2.  **Secure Your Instance**: You must change the following placeholder values to secure your instance:
+You must change the following placeholder values to secure your instance:
 
 - `POSTGRES_PASSWORD`: A strong, unique password for the database.
 - `REDIS_PASSWORD`: A strong, unique password for the Valkey/Redis service.
@@ -62,10 +41,6 @@ Now, open the `.env` file in a text editor and customize the settings.
     ```bash
     openssl rand -hex 32
     ```
-- `STORAGE_ENCRYPTION_KEY`: **(Optional but Recommended)** A 32-byte hex string for encrypting emails and attachments at rest. If this key is not provided, storage encryption will be disabled. You can generate one with:
-    ```bash
-    openssl rand -hex 32
-    ```
 
 ### Storage Configuration
 
@@ -90,34 +65,29 @@ Here is a complete list of environment variables available for configuration:
 
 #### Application Settings
 
-| Variable                | Description                                                                                                                                                  | Default Value           |
-| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------- |
-| `NODE_ENV`              | The application environment.                                                                                                                                 | `development`           |
-| `PORT_BACKEND`          | The port for the backend service.                                                                                                                            | `4000`                  |
-| `PORT_FRONTEND`         | The port for the frontend service.                                                                                                                           | `3000`                  |
-| `APP_URL`               | The public-facing URL of your application. This is used by the backend to configure CORS.                                                                    | `http://localhost:3000` |
-| `ORIGIN`                | Used by the SvelteKit Node adapter to determine the server's public-facing URL. It should always be set to the value of `APP_URL` (e.g., `ORIGIN=$APP_URL`). | `http://localhost:3000` |
-| `SYNC_FREQUENCY`        | The frequency of continuous email syncing. See [cron syntax](https://crontab.guru/) for more details.                                                        | `* * * * *`             |
-| `ALL_INCLUSIVE_ARCHIVE` | Set to `true` to include all emails, including Junk and Trash folders, in the email archive.                                                                 | `false`                 |
+| Variable         | Description                                                                                           | Default Value |
+| ---------------- | ----------------------------------------------------------------------------------------------------- | ------------- |
+| `NODE_ENV`       | The application environment.                                                                          | `development` |
+| `PORT_BACKEND`   | The port for the backend service.                                                                     | `4000`        |
+| `PORT_FRONTEND`  | The port for the frontend service.                                                                    | `3000`        |
+| `SYNC_FREQUENCY` | The frequency of continuous email syncing. See [cron syntax](https://crontab.guru/) for more details. | `* * * * *`   |
 
 #### Docker Compose Service Configuration
 
 These variables are used by `docker-compose.yml` to configure the services.
 
-| Variable               | Description                                          | Default Value                                            |
-| ---------------------- | ---------------------------------------------------- | -------------------------------------------------------- |
-| `POSTGRES_DB`          | The name of the PostgreSQL database.                 | `open_archive`                                           |
-| `POSTGRES_USER`        | The username for the PostgreSQL database.            | `admin`                                                  |
-| `POSTGRES_PASSWORD`    | The password for the PostgreSQL database.            | `password`                                               |
-| `DATABASE_URL`         | The connection URL for the PostgreSQL database.      | `postgresql://admin:password@postgres:5432/open_archive` |
-| `MEILI_MASTER_KEY`     | The master key for Meilisearch.                      | `aSampleMasterKey`                                       |
-| `MEILI_HOST`           | The host for the Meilisearch service.                | `http://meilisearch:7700`                                |
-| `MEILI_INDEXING_BATCH` | The number of emails to batch together for indexing. | `500`                                                    |
-| `REDIS_HOST`           | The host for the Valkey (Redis) service.             | `valkey`                                                 |
-| `REDIS_PORT`           | The port for the Valkey (Redis) service.             | `6379`                                                   |
-| `REDIS_USER`           | Optional Redis username if ACLs are used.            |                                                          |
-| `REDIS_PASSWORD`       | The password for the Valkey (Redis) service.         | `defaultredispassword`                                   |
-| `REDIS_TLS_ENABLED`    | Enable or disable TLS for Redis.                     | `false`                                                  |
+| Variable            | Description                                     | Default Value                                            |
+| ------------------- | ----------------------------------------------- | -------------------------------------------------------- |
+| `POSTGRES_DB`       | The name of the PostgreSQL database.            | `open_archive`                                           |
+| `POSTGRES_USER`     | The username for the PostgreSQL database.       | `admin`                                                  |
+| `POSTGRES_PASSWORD` | The password for the PostgreSQL database.       | `password`                                               |
+| `DATABASE_URL`      | The connection URL for the PostgreSQL database. | `postgresql://admin:password@postgres:5432/open_archive` |
+| `MEILI_MASTER_KEY`  | The master key for Meilisearch.                 | `aSampleMasterKey`                                       |
+| `MEILI_HOST`        | The host for the Meilisearch service.           | `http://meilisearch:7700`                                |
+| `REDIS_HOST`        | The host for the Valkey (Redis) service.        | `valkey`                                                 |
+| `REDIS_PORT`        | The port for the Valkey (Redis) service.        | `6379`                                                   |
+| `REDIS_PASSWORD`    | The password for the Valkey (Redis) service.    | `defaultredispassword`                                   |
+| `REDIS_TLS_ENABLED` | Enable or disable TLS for Redis.                | `false`                                                  |
 
 #### Storage Settings
 
@@ -125,34 +95,26 @@ These variables are used by `docker-compose.yml` to configure the services.
 | ------------------------------ | ----------------------------------------------------------------------------------------------------------- | ------------------------- |
 | `STORAGE_TYPE`                 | The storage backend to use (`local` or `s3`).                                                               | `local`                   |
 | `BODY_SIZE_LIMIT`              | The maximum request body size for uploads. Can be a number in bytes or a string with a unit (e.g., `100M`). | `100M`                    |
-| `STORAGE_LOCAL_ROOT_PATH`      | The root path for Open Archiver app data.                                                                   | `/var/data/open-archiver` |
+| `STORAGE_LOCAL_ROOT_PATH`      | The root path for local file storage.                                                                       | `/var/data/open-archiver` |
 | `STORAGE_S3_ENDPOINT`          | The endpoint for S3-compatible storage (required if `STORAGE_TYPE` is `s3`).                                |                           |
 | `STORAGE_S3_BUCKET`            | The bucket name for S3-compatible storage (required if `STORAGE_TYPE` is `s3`).                             |                           |
 | `STORAGE_S3_ACCESS_KEY_ID`     | The access key ID for S3-compatible storage (required if `STORAGE_TYPE` is `s3`).                           |                           |
 | `STORAGE_S3_SECRET_ACCESS_KEY` | The secret access key for S3-compatible storage (required if `STORAGE_TYPE` is `s3`).                       |                           |
 | `STORAGE_S3_REGION`            | The region for S3-compatible storage (required if `STORAGE_TYPE` is `s3`).                                  |                           |
 | `STORAGE_S3_FORCE_PATH_STYLE`  | Force path-style addressing for S3 (optional).                                                              | `false`                   |
-| `STORAGE_ENCRYPTION_KEY`       | A 32-byte hex string for AES-256 encryption of files at rest. If not set, files will not be encrypted.      |                           |
 
 #### Security & Authentication
 
-| Variable                         | Description                                                                                                                                                                         | Default Value                              |
-| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------ |
-| `ENABLE_DELETION`                | Enable or disable deletion of emails and ingestion sources. If this option is not set, or is set to any value other than `true`, deletion will be disabled for the entire instance. | `false`                                    |
-| `JWT_SECRET`                     | A secret key for signing JWT tokens.                                                                                                                                                | `a-very-secret-key-that-you-should-change` |
-| `JWT_EXPIRES_IN`                 | The expiration time for JWT tokens.                                                                                                                                                 | `7d`                                       |
-| ~~`SUPER_API_KEY`~~ (Deprecated) | An API key with super admin privileges. (The SUPER_API_KEY is deprecated since v0.3.0 after we roll out the role-based access control system.)                                      |                                            |
-| `RATE_LIMIT_WINDOW_MS`           | The window in milliseconds for which API requests are checked.                                                                                                                      | `900000` (15 minutes)                      |
-| `RATE_LIMIT_MAX_REQUESTS`        | The maximum number of API requests allowed from an IP within the window.                                                                                                            | `100`                                      |
-| `ENCRYPTION_KEY`                 | A 32-byte hex string for encrypting sensitive data in the database.                                                                                                                 |                                            |
+| Variable                         | Description                                                                                                                                    | Default Value                              |
+| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------ |
+| `JWT_SECRET`                     | A secret key for signing JWT tokens.                                                                                                           | `a-very-secret-key-that-you-should-change` |
+| `JWT_EXPIRES_IN`                 | The expiration time for JWT tokens.                                                                                                            | `7d`                                       |
+| ~~`SUPER_API_KEY`~~ (Deprecated) | An API key with super admin privileges. (The SUPER_API_KEY is deprecated since v0.3.0 after we roll out the role-based access control system.) |                                            |
+| `RATE_LIMIT_WINDOW_MS`           | The window in milliseconds for which API requests are checked.                                                                                 | `900000` (15 minutes)                      |
+| `RATE_LIMIT_MAX_REQUESTS`        | The maximum number of API requests allowed from an IP within the window.                                                                       | `100`                                      |
+| `ENCRYPTION_KEY`                 | A 32-byte hex string for encrypting sensitive data in the database.                                                                            |                                            |
 
-#### Apache Tika Integration
-
-| Variable   | Description                                                                                                                                                                          | Default Value      |
-| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------ |
-| `TIKA_URL` | Optional. The URL of an Apache Tika server for advanced text extraction from attachments. If not set, the application falls back to built-in parsers for PDF, Word, and Excel files. | `http://tika:9998` |
-
-## 4. Run the Application
+## 3. Run the Application
 
 Once you have configured your `.env` file, you can start all the services using Docker Compose:
 
@@ -172,15 +134,13 @@ You can check the status of the running containers with:
 docker compose ps
 ```
 
-## 5. Access the Application
+## 4. Access the Application
 
 Once the services are running, you can access the Open Archiver web interface by navigating to `http://localhost:3000` in your web browser.
 
-Upon first visit, you will be redirected to the `/setup` page where you can set up your admin account. Make sure you are the first person who accesses the instance.
+You can log in with the `ADMIN_EMAIL` and `ADMIN_PASSWORD` you configured in your `.env` file.
 
-If you are not redirected to the `/setup` page but instead see the login page, there might be something wrong with the database. Restart the service and try again.
-
-## 6. Next Steps
+## 5. Next Steps
 
 After successfully deploying and logging into Open Archiver, the next step is to configure your ingestion sources to start archiving emails.
 
@@ -252,9 +212,9 @@ If you are using local storage to store your emails, based on your `docker-compo
 
 Run this command to see all the volumes on your system:
 
-```bash
-docker volume ls
-```
+    ```bash
+    docker volume ls
+    ```
 
 2.  **Identify the correct volume**:
 
@@ -264,28 +224,28 @@ Look through the list for a volume name that ends with `_archiver-data`. The par
 
 Once you've identified the correct volume name, use it in the `inspect` command. For example:
 
-```bash
-docker volume inspect <your_volume_name_here>
-```
+    ```bash
+    docker volume inspect <your_volume_name_here>
+    ```
 
 This will give you the correct `Mountpoint` path where your data is being stored. It will look something like this (the exact path will vary depending on your system):
 
-```json
-{
-	"CreatedAt": "2025-07-25T11:22:19Z",
-	"Driver": "local",
-	"Labels": {
-		"com.docker.compose.config-hash": "---",
-		"com.docker.compose.project": "---",
-		"com.docker.compose.version": "2.38.2",
-		"com.docker.compose.volume": "us8wwos0o4ok4go4gc8cog84_archiver-data"
-	},
-	"Mountpoint": "/var/lib/docker/volumes/us8wwos0o4ok4go4gc8cog84_archiver-data/_data",
-	"Name": "us8wwos0o4ok4go4gc8cog84_archiver-data",
-	"Options": null,
-	"Scope": "local"
-}
-```
+    ```json
+    {
+        "CreatedAt": "2025-07-25T11:22:19Z",
+        "Driver": "local",
+        "Labels": {
+            "com.docker.compose.config-hash": "---",
+            "com.docker.compose.project": "---",
+            "com.docker.compose.version": "2.38.2",
+            "com.docker.compose.volume": "us8wwos0o4ok4go4gc8cog84_archiver-data"
+        },
+        "Mountpoint": "/var/lib/docker/volumes/us8wwos0o4ok4go4gc8cog84_archiver-data/_data",
+        "Name": "us8wwos0o4ok4go4gc8cog84_archiver-data",
+        "Options": null,
+        "Scope": "local"
+    }
+    ```
 
 In this example, the data is located at `/var/lib/docker/volumes/us8wwos0o4ok4go4gc8cog84_archiver-data/_data`. You can then `cd` into that directory to see your files.
 
@@ -299,43 +259,71 @@ Here’s how you can do it:
 
 Open the `docker-compose.yml` file and find the `open-archiver` service. You're going to change the `volumes` section.
 
-**Change this:**
+    **Change this:**
 
-```yaml
-services:
-    open-archiver:
-    # ... other config
-    volumes:
-        - archiver-data:/var/data/open-archiver
-```
+    ```yaml
+    services:
+      open-archiver:
+        # ... other config
+        volumes:
+          - archiver-data:/var/data/open-archiver
+    ```
 
-**To this:**
+    **To this:**
 
-```yaml
-services:
-    open-archiver:
-    # ... other config
-    volumes:
-        - ./data/open-archiver:/var/data/open-archiver
-```
+    ```yaml
+    services:
+      open-archiver:
+        # ... other config
+        volumes:
+          - ./data/open-archiver:/var/data/open-archiver
+    ```
 
 You'll also want to remove the `archiver-data` volume definition at the bottom of the file, since it's no longer needed.
 
-**Remove this whole block:**
+    **Remove this whole block:**
 
-```yaml
-volumes:
-    # ... other volumes
-    archiver-data:
-        driver: local
-```
+    ```yaml
+    volumes:
+      # ... other volumes
+      archiver-data:
+          driver: local
+    ```
 
 2.  **Restart your containers**:
 
 After you've saved the changes, run the following command in your terminal to apply them. The `--force-recreate` flag will ensure the container is recreated with the new volume settings.
 
+    ```bash
+    docker-compose up -d --force-recreate
+    ```
+
+After this, any new data will be saved directly into the `./data/open-archiver` folder in your project directory.
+
+## Troubleshooting
+
+### 403 Cross-Site POST Forbidden Error
+
+If you are running the application behind a reverse proxy or have mapped the application to a different port (e.g., `3005:3000`), you may encounter a `403 Cross-site POST from submissions are forbidden` error when uploading files.
+
+To resolve this, you must set the `ORIGIN` environment variable to the URL of your application. This ensures that the backend can verify the origin of requests and prevent cross-site request forgery (CSRF) attacks.
+
+Add the following line to your `.env` file, replacing `<your_host>` and `<your_port>` with your specific values:
+
+```bash
+ORIGIN=http://<your_host>:<your_port>
+```
+
+For example, if your application is accessible at `http://localhost:3005`, you would set the variable as follows:
+
+```bash
+ORIGIN=http://localhost:3005
+```
+
+After adding the `ORIGIN` variable, restart your Docker containers for the changes to take effect:
+
 ```bash
 docker-compose up -d --force-recreate
 ```
 
-After this, any new data will be saved directly into the `./data/open-archiver` folder in your project directory.
+This will ensure that your file uploads are correctly authorized.

docs/user-guides/integrity-check.md

@@ -1,37 +0,0 @@
-# Integrity Check
-
-Open Archiver allows you to verify the integrity of your archived emails and their attachments. This guide explains how the integrity check works and what the results mean.
-
-## How It Works
-
-When an email is archived, Open Archiver calculates a unique cryptographic signature (a SHA256 hash) for the email's raw `.eml` file and for each of its attachments. These signatures are stored in the database alongside the email's metadata.
-
-The integrity check feature recalculates these signatures for the stored files and compares them to the original signatures stored in the database. This process allows you to verify that the content of your archived emails has not been altered, corrupted, or tampered with since the moment they were archived.
-
-## The Integrity Report
-
-When you view an email in the Open Archiver interface, an integrity report is automatically generated and displayed. This report provides a clear, at-a-glance status for the email file and each of its attachments.
-
-### Statuses
-
-- **Valid (Green Badge):** A "Valid" status means that the current signature of the file matches the original signature stored in the database. This is the expected status and indicates that the file's integrity is intact.
-
-- **Invalid (Red Badge):** An "Invalid" status means that the current signature of the file does _not_ match the original signature. This indicates that the file's content has changed since it was archived.
-
-### Reasons for an "Invalid" Status
-
-If a file is marked as "Invalid," you can hover over the badge to see a reason for the failure. Common reasons include:
-
-- **Stored hash does not match current hash:** This is the most common reason and indicates that the file's content has been modified. This could be due to accidental changes, data corruption, or unauthorized tampering.
-
-- **Could not read attachment file from storage:** This message indicates that the file could not be read from its storage location. This could be due to a storage system issue, a file permission problem, or because the file has been deleted.
-
-## What to Do If an Integrity Check Fails
-
-If you encounter an "Invalid" status for an email or attachment, it is important to investigate the issue. Here are some steps you can take:
-
-1.  **Check Storage:** Verify that the file exists in its storage location and that its permissions are correct.
-2.  **Review Audit Logs:** If you have audit logging enabled, review the logs for any unauthorized access or modifications to the file.
-3.  **Restore from Backup:** If you suspect data corruption, you may need to restore the affected file from a backup.
-
-The integrity check feature is a crucial tool for ensuring the long-term reliability and trustworthiness of your email archive. By regularly monitoring the integrity of your archived data, you can be confident that your records are accurate and complete.

docs/user-guides/troubleshooting/cors-errors.md

@@ -1,75 +0,0 @@
-# Troubleshooting CORS Errors
-
-Cross-Origin Resource Sharing (CORS) is a security feature that controls how web applications in one domain can request and interact with resources in another. If not configured correctly, you may encounter errors when performing actions like uploading files.
-
-This guide will help you diagnose and resolve common CORS-related issues.
-
-## Symptoms
-
-You may be experiencing a CORS issue if you see one of the following errors in your browser's developer console or in the application's logs:
-
-- `TypeError: fetch failed`
-- `Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource.`
-- `Unexpected token 'C', "Cross-site"... is not valid JSON`
-- A JSON error response similar to the following:
-    ```json
-    {
-    	"message": "CORS Error: This origin is not allowed.",
-    	"requiredOrigin": "http://localhost:3000",
-    	"receivedOrigin": "https://localhost:3000"
-    }
-    ```
-
-## Root Cause
-
-These errors typically occur when the URL you are using to access the application in your browser does not exactly match the `APP_URL` configured in your `.env` file.
-
-This can happen for several reasons:
-
-- You are accessing the application via a different port.
-- You are using a reverse proxy that changes the protocol (e.g., from `http` to `https`).
-- The SvelteKit server, in a production build, is incorrectly guessing its public-facing URL.
-
-## Solution
-
-The solution is to ensure that the application's frontend and backend are correctly configured with the public-facing URL of your instance. This is done by setting two environment variables: `APP_URL` and `ORIGIN`.
-
-1.  **Open your `.env` file** in a text editor.
-
-2.  **Set `APP_URL`**: Define the `APP_URL` variable with the exact URL you use to access the application in your browser.
-
-    ```env
-    APP_URL=http://your-domain-or-ip:3000
-    ```
-
-3.  **Set `ORIGIN`**: The SvelteKit server requires a specific `ORIGIN` variable to correctly identify itself. This should always be set to the value of your `APP_URL`.
-
-    ```env
-    ORIGIN=$APP_URL
-    ```
-
-    By using `$APP_URL`, you ensure that both variables are always in sync.
-
-### Example Configuration
-
-If you are running the application locally on port `3000`, your configuration should look like this:
-
-```env
-APP_URL=http://localhost:3000
-ORIGIN=$APP_URL
-```
-
-If your application is behind a reverse proxy and is accessible at `https://archive.mycompany.com`, your configuration should be:
-
-```env
-APP_URL=https://archive.mycompany.com
-ORIGIN=$APP_URL
-```
-
-After making these changes to your `.env` file, you must restart the application for them to take effect:
-
-```bash
-docker compose up -d --force-recreate
-```
-
-This will ensure that the backend's CORS policy and the frontend server's origin are correctly aligned, resolving the errors.

docs/user-guides/upgrade-and-migration/meilisearch-upgrade.md

@@ -1,141 +0,0 @@
-# Upgrading Meilisearch
-
-Meilisearch, the search engine used by Open Archiver, requires a manual data migration process when upgrading to a new version. This is because Meilisearch databases are only compatible with the specific version that created them.
-
-If an Open Archiver upgrade includes a major Meilisearch version change, you will need to migrate your search index by following the process below.
-
-## Experimental: Dumpless Upgrade
-
-> **Warning:** This feature is currently **experimental**. We do not recommend using it for production environments until it is marked as stable. Please use the [standard migration process](#standard-migration-process-recommended) instead. Proceed with caution.
-
-Meilisearch recently introduced an experimental "dumpless" upgrade method. This allows you to migrate the database to a new Meilisearch version without manually creating and importing a dump. However, please note that **dumpless upgrades are not currently atomic**. If the process fails, your database may become corrupted, resulting in data loss.
-
-**Prerequisite: Create a Snapshot**
-
-Before attempting a dumpless upgrade, you **must** take a snapshot of your instance. This ensures you have a recovery point if the upgrade fails. Learn how to create snapshots in the [official Meilisearch documentation](https://www.meilisearch.com/docs/learn/data_backup/snapshots).
-
-### How to Enable
-
-To perform a dumpless upgrade, you need to configure your Meilisearch instance with the experimental flag. You can do this in one of two ways:
-
-**Option 1: Using an Environment Variable**
-
-Add the `MEILI_EXPERIMENTAL_DUMPLESS_UPGRADE` environment variable to your `docker-compose.yml` file for the Meilisearch service.
-
-```yaml
-services:
-  meilisearch:
-    image: getmeili/meilisearch:v1.x # The new version you want to upgrade to
-    environment:
-      - MEILI_MASTER_KEY=${MEILI_MASTER_KEY}
-      - MEILI_EXPERIMENTAL_DUMPLESS_UPGRADE=true
-```
-
-**Option 2: Using a CLI Option**
-
-Alternatively, you can pass the `--experimental-dumpless-upgrade` flag in the command section of your `docker-compose.yml`.
-
-```yaml
-services:
-  meilisearch:
-    image: getmeili/meilisearch:v1.x # The new version you want to upgrade to
-    command: meilisearch --experimental-dumpless-upgrade
-```
-
-After updating your configuration, restart your container:
-
-```bash
-docker compose up -d
-```
-
-Meilisearch will attempt to migrate your database to the new version automatically.
-
----
-
-## Standard Migration Process (Recommended)
-
-For self-hosted instances using Docker Compose, the recommended migration process involves creating a data dump from your current Meilisearch instance, upgrading the Docker image, and then importing that dump into the new version.
-
-### Step 1: Create a Dump
-
-Before upgrading, you must create a dump of your existing Meilisearch data. You can do this by sending a POST request to the `/dumps` endpoint of the Meilisearch API.
-
-1.  **Find your Meilisearch container name**:
-
-    ```bash
-    docker compose ps
-    ```
-
-    Look for the service name that corresponds to Meilisearch, usually `meilisearch`.
-
-2.  **Execute the dump command**:
-    You will need your Meilisearch Admin API key, which can be found in your `.env` file as `MEILI_MASTER_KEY`.
-
-    ```bash
-    curl -X POST 'http://localhost:7700/dumps' \
-      -H "Authorization: Bearer YOUR_MEILI_MASTER_KEY"
-    ```
-
-    This will start the dump creation process. The dump file will be created inside the `meili_data` volume used by the Meilisearch container.
-
-3.  **Monitor the dump status**:
-    The dump creation request returns a `taskUid`. You can use this to check the status of the dump.
-
-    For more details on dump and import, see the [official Meilisearch documentation](https://www.meilisearch.com/docs/learn/update_and_migration/updating).
-
-### Step 2: Upgrade Your Open Archiver Instance
-
-Once the dump is successfully created, you can proceed with the standard Open Archiver upgrade process.
-
-1.  **Pull the latest changes and Docker images**:
-
-    ```bash
-    git pull
-    docker compose pull
-    ```
-
-2.  **Stop the running services**:
-    ```bash
-    docker compose down
-    ```
-
-### Step 3: Import the Dump
-
-Now, you need to restart the services while telling Meilisearch to import from your dump file.
-
-1.  **Modify `docker-compose.yml`**:
-    You need to temporarily add the `--import-dump` flag to the Meilisearch service command. Find the `meilisearch` service in your `docker-compose.yml` and modify the `command` section.
-
-    You will need the name of your dump file. It will be a `.dump` file located in the directory mapped to `/meili_data` inside the container.
-
-    ```yaml
-    services:
-        meilisearch:
-            # ... other service config
-            command:
-                [
-                    '--master-key=${MEILI_MASTER_KEY}',
-                    '--env=production',
-                    '--import-dump=/meili_data/dumps/YOUR_DUMP_FILE.dump',
-                ]
-    ```
-
-2.  **Restart the services**:
-    ```bash
-    docker compose up -d
-    ```
-    Meilisearch will now start and import the data from the dump file. This may take some time depending on the size of your index.
-
-### Step 4: Clean Up
-
-Once the import is complete and you have verified that your search is working correctly, you should remove the `--import-dump` flag from your `docker-compose.yml` to prevent it from running on every startup.
-
-1.  **Remove the `--import-dump` line** from the `command` section of the `meilisearch` service in `docker-compose.yml`.
-2.  **Restart the services** one last time:
-    ```bash
-    docker compose up -d
-    ```
-
-Your Meilisearch instance is now upgraded and running with your migrated data.
-
-For more advanced scenarios or troubleshooting, please refer to the **[official Meilisearch migration guide](https://www.meilisearch.com/docs/learn/update_and_migration/updating)**.

docs/user-guides/upgrade-and-migration/upgrade.md

@@ -1,42 +0,0 @@
-# Upgrading Your Instance
-
-This guide provides instructions for upgrading your Open Archiver instance to the latest version.
-
-## Checking for New Versions
-
-Open Archiver automatically checks for new versions and will display a notification in the footer of the web interface when an update is available. You can find a list of all releases and their release notes on the [GitHub Releases](https://github.com/LogicLabs-OU/OpenArchiver/releases) page.
-
-## Upgrading Your Instance
-
-To upgrade your Open Archiver instance, follow these steps:
-
-1.  **Pull the latest changes from the repository**:
-
-    ```bash
-    git pull
-    ```
-
-2.  **Pull the latest Docker images**:
-
-    ```bash
-    docker compose pull
-    ```
-
-3.  **Restart the services with the new images**:
-    ```bash
-    docker compose up -d
-    ```
-
-This will restart your Open Archiver instance with the latest version of the application.
-
-## Migrating Data
-
-When you upgrade to a new version, database migrations are applied automatically when the application starts up. This ensures that your database schema is always up-to-date with the latest version of the application.
-
-No manual intervention is required for database migrations.
-
-## Upgrading Meilisearch
-
-When an Open Archiver update includes a major version change for Meilisearch, you will need to manually migrate your search data. This process is not covered by the standard upgrade commands.
-
-For detailed instructions, please see the [Meilisearch Upgrade Guide](./meilisearch-upgrade.md).

open-archiver.yml

@@ -1,79 +0,0 @@
-# documentation: https://openarchiver.com
-# slogan: A self-hosted, open-source email archiving solution with full-text search capability.
-# tags: email archiving,email,compliance,search
-# logo: svgs/openarchiver.svg
-# port: 3000
-
-services:
-    open-archiver:
-        image: logiclabshq/open-archiver:latest
-        environment:
-            - SERVICE_URL_3000
-            - SERVICE_URL=${SERVICE_URL_3000}
-            - PORT_BACKEND=${PORT_BACKEND:-4000}
-            - PORT_FRONTEND=${PORT_FRONTEND:-3000}
-            - NODE_ENV=${NODE_ENV:-production}
-            - SYNC_FREQUENCY=${SYNC_FREQUENCY:-* * * * *}
-            - POSTGRES_DB=${POSTGRES_DB:-open_archive}
-            - POSTGRES_USER=${POSTGRES_USER:-admin}
-            - POSTGRES_PASSWORD=${SERVICE_PASSWORD_POSTGRES}
-            - DATABASE_URL=postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
-            - MEILI_MASTER_KEY=${SERVICE_PASSWORD_MEILISEARCH}
-            - MEILI_HOST=http://meilisearch:7700
-            - REDIS_HOST=valkey
-            - REDIS_PORT=6379
-            - REDIS_USER=default
-            - REDIS_PASSWORD=${SERVICE_PASSWORD_VALKEY}
-            - REDIS_TLS_ENABLED=false
-            - STORAGE_TYPE=${STORAGE_TYPE:-local}
-            - STORAGE_LOCAL_ROOT_PATH=${STORAGE_LOCAL_ROOT_PATH:-/var/data/open-archiver}
-            - BODY_SIZE_LIMIT=${BODY_SIZE_LIMIT:-100M}
-            - STORAGE_S3_ENDPOINT=${STORAGE_S3_ENDPOINT}
-            - STORAGE_S3_BUCKET=${STORAGE_S3_BUCKET}
-            - STORAGE_S3_ACCESS_KEY_ID=${STORAGE_S3_ACCESS_KEY_ID}
-            - STORAGE_S3_SECRET_ACCESS_KEY=${STORAGE_S3_SECRET_ACCESS_KEY}
-            - STORAGE_S3_REGION=${STORAGE_S3_REGION}
-            - STORAGE_S3_FORCE_PATH_STYLE=${STORAGE_S3_FORCE_PATH_STYLE:-false}
-            - JWT_SECRET=${SERVICE_BASE64_128_JWT}
-            - JWT_EXPIRES_IN=${JWT_EXPIRES_IN:-7d}
-            - ENCRYPTION_KEY=${SERVICE_BASE64_64_ENCRYPTIONKEY}
-            - RATE_LIMIT_WINDOW_MS=${RATE_LIMIT_WINDOW_MS:-60000}
-            - RATE_LIMIT_MAX_REQUESTS=${RATE_LIMIT_MAX_REQUESTS:-100}
-        volumes:
-            - archiver-data:/var/data/open-archiver
-        depends_on:
-            postgres:
-                condition: service_healthy
-            valkey:
-                condition: service_started
-            meilisearch:
-                condition: service_started
-
-    postgres:
-        image: postgres:17-alpine
-        environment:
-            - POSTGRES_DB=${POSTGRES_DB}
-            - POSTGRES_USER=${POSTGRES_USER}
-            - POSTGRES_PASSWORD=${SERVICE_PASSWORD_POSTGRES}
-            - LC_ALL=C
-        volumes:
-            - pgdata:/var/lib/postgresql/data
-        healthcheck:
-            test: ['CMD-SHELL', 'pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}']
-            interval: 10s
-            timeout: 20s
-            retries: 10
-
-    valkey:
-        image: valkey/valkey:8-alpine
-        command: valkey-server --requirepass ${SERVICE_PASSWORD_VALKEY}
-        volumes:
-            - valkeydata:/data
-
-    meilisearch:
-        image: getmeili/meilisearch:v1.15
-        environment:
-            - MEILI_MASTER_KEY=${SERVICE_PASSWORD_MEILISEARCH}
-            - MEILI_SCHEDULE_SNAPSHOT=86400
-        volumes:
-            - meilidata:/meili_data

package.json

@@ -1,24 +1,16 @@
 {
 	"name": "open-archiver",
-	"version": "0.4.2",
 	"private": true,
-	"license": "SEE LICENSE IN LICENSE file",
 	"scripts": {
-		"build:oss": "pnpm --filter \"./packages/*\" --filter \"!./packages/enterprise\" --filter \"./apps/open-archiver\" build",
-		"build:enterprise": "cross-env VITE_ENTERPRISE_MODE=true pnpm build",
-		"start:oss": "dotenv -- concurrently \"node apps/open-archiver/dist/index.js\" \"pnpm --filter @open-archiver/frontend start\"",
-		"start:enterprise": "dotenv -- concurrently \"node apps/open-archiver-enterprise/dist/index.js\" \"pnpm --filter @open-archiver/frontend start\"",
-		"dev:enterprise": "cross-env VITE_ENTERPRISE_MODE=true dotenv -- pnpm --filter \"@open-archiver/*\" --filter \"open-archiver-enterprise-app\" --parallel dev",
-		"dev:oss": "dotenv -- pnpm --filter \"./packages/*\" --filter \"!./packages/@open-archiver/enterprise\" --filter \"open-archiver-app\" --parallel dev",
-		"build": "pnpm --filter \"./packages/*\" --filter \"./apps/*\" build",
-		"start": "dotenv -- pnpm --filter \"open-archiver-app\" --parallel start",
+		"dev": "dotenv -- pnpm --filter \"./packages/*\" --parallel dev",
+		"build": "pnpm --filter \"./packages/*\" build",
+		"start": "dotenv -- pnpm --filter \"./packages/*\" --parallel start",
 		"start:workers": "dotenv -- concurrently \"pnpm --filter @open-archiver/backend start:ingestion-worker\" \"pnpm --filter @open-archiver/backend start:indexing-worker\" \"pnpm --filter @open-archiver/backend start:sync-scheduler\"",
 		"start:workers:dev": "dotenv -- concurrently \"pnpm --filter @open-archiver/backend start:ingestion-worker:dev\" \"pnpm --filter @open-archiver/backend start:indexing-worker:dev\" \"pnpm --filter @open-archiver/backend start:sync-scheduler:dev\"",
 		"db:generate": "dotenv -- pnpm --filter @open-archiver/backend db:generate",
 		"db:migrate": "dotenv -- pnpm --filter @open-archiver/backend db:migrate",
 		"db:migrate:dev": "dotenv -- pnpm --filter @open-archiver/backend db:migrate:dev",
-		"docker-start:oss": "concurrently \"pnpm start:workers\" \"pnpm start:oss\"",
-		"docker-start:enterprise": "concurrently \"pnpm start:workers\" \"pnpm start:enterprise\"",
+		"docker-start": "concurrently \"pnpm start:workers\" \"pnpm start\"",
 		"docs:dev": "vitepress dev docs --port 3009",
 		"docs:build": "vitepress build docs",
 		"docs:preview": "vitepress preview docs",
@@ -30,7 +22,6 @@
 		"dotenv-cli": "8.0.0"
 	},
 	"devDependencies": {
-		"cross-env": "^10.0.0",
 		"prettier": "^3.6.2",
 		"prettier-plugin-svelte": "^3.4.0",
 		"prettier-plugin-tailwindcss": "^0.6.14",

packages/backend/package.json

@@ -2,13 +2,12 @@
 	"name": "@open-archiver/backend",
 	"version": "0.1.0",
 	"private": true,
-	"license": "SEE LICENSE IN LICENSE file",
 	"main": "dist/index.js",
-	"types": "dist/index.d.ts",
 	"scripts": {
+		"dev": "ts-node-dev --respawn --transpile-only src/index.ts ",
 		"build": "tsc && pnpm copy-assets",
-		"dev": "tsc --watch",
 		"copy-assets": "cp -r src/locales dist/locales",
+		"start": "node dist/index.js",
 		"start:ingestion-worker": "node dist/workers/ingestion.worker.js",
 		"start:indexing-worker": "node dist/workers/indexing.worker.js",
 		"start:sync-scheduler": "node dist/jobs/schedulers/sync-scheduler.js",
@@ -32,7 +31,6 @@
 		"bcryptjs": "^3.0.2",
 		"bullmq": "^5.56.3",
 		"busboy": "^1.6.0",
-		"cors": "^2.8.5",
 		"cross-fetch": "^4.1.0",
 		"deepmerge-ts": "^7.1.5",
 		"dotenv": "^17.2.0",
@@ -60,22 +58,24 @@
 		"pst-extractor": "^1.11.0",
 		"reflect-metadata": "^0.2.2",
 		"sqlite3": "^5.1.7",
-		"xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
+		"tsconfig-paths": "^4.2.0",
+		"xlsx": "^0.18.5",
 		"yauzl": "^3.2.0",
 		"zod": "^4.1.5"
 	},
 	"devDependencies": {
+		"@bull-board/api": "^6.11.0",
+		"@bull-board/express": "^6.11.0",
 		"@types/archiver": "^6.0.3",
 		"@types/busboy": "^1.5.4",
-		"@types/cors": "^2.8.19",
 		"@types/express": "^5.0.3",
 		"@types/mailparser": "^3.4.6",
 		"@types/microsoft-graph": "^2.40.1",
 		"@types/multer": "^2.0.0",
 		"@types/node": "^24.0.12",
 		"@types/yauzl": "^2.10.3",
+		"bull-board": "^2.1.3",
 		"ts-node-dev": "^2.0.0",
-		"tsconfig-paths": "^4.2.0",
 		"typescript": "^5.8.3"
 	}
 }

packages/backend/src/api/controllers/api-key.controller.ts

@@ -1,7 +1,6 @@
 import { Request, Response } from 'express';
 import { ApiKeyService } from '../../services/ApiKeyService';
 import { z } from 'zod';
-import { UserService } from '../../services/UserService';
 import { config } from '../../config';
 
 const generateApiKeySchema = z.object({
@@ -15,30 +14,20 @@ const generateApiKeySchema = z.object({
 		.positive('Only positive number is allowed')
 		.max(730, 'The API key must expire within 2 years / 730 days.'),
 });
+
 export class ApiKeyController {
-	private userService = new UserService();
-	public generateApiKey = async (req: Request, res: Response) => {
+	public async generateApiKey(req: Request, res: Response) {
+		if (config.app.isDemo) {
+			return res.status(403).json({ message: req.t('errors.demoMode') });
+		}
 		try {
-			if (config.app.isDemo) {
-				return res.status(403).json({ message: req.t('errors.demoMode') });
-			}
 			const { name, expiresInDays } = generateApiKeySchema.parse(req.body);
 			if (!req.user || !req.user.sub) {
 				return res.status(401).json({ message: 'Unauthorized' });
 			}
 			const userId = req.user.sub;
-			const actor = await this.userService.findById(userId);
-			if (!actor) {
-				return res.status(401).json({ message: 'Unauthorized' });
-			}
 
-			const key = await ApiKeyService.generate(
-				userId,
-				name,
-				expiresInDays,
-				actor,
-				req.ip || 'unknown'
-			);
+			const key = await ApiKeyService.generate(userId, name, expiresInDays);
 
 			res.status(201).json({ key });
 		} catch (error) {
@@ -49,9 +38,9 @@ export class ApiKeyController {
 			}
 			res.status(500).json({ message: req.t('errors.internalServerError') });
 		}
-	};
+	}
 
-	public getApiKeys = async (req: Request, res: Response) => {
+	public async getApiKeys(req: Request, res: Response) {
 		if (!req.user || !req.user.sub) {
 			return res.status(401).json({ message: 'Unauthorized' });
 		}
@@ -59,9 +48,9 @@ export class ApiKeyController {
 		const keys = await ApiKeyService.getKeys(userId);
 
 		res.status(200).json(keys);
-	};
+	}
 
-	public deleteApiKey = async (req: Request, res: Response) => {
+	public async deleteApiKey(req: Request, res: Response) {
 		if (config.app.isDemo) {
 			return res.status(403).json({ message: req.t('errors.demoMode') });
 		}
@@ -70,12 +59,8 @@ export class ApiKeyController {
 			return res.status(401).json({ message: 'Unauthorized' });
 		}
 		const userId = req.user.sub;
-		const actor = await this.userService.findById(userId);
-		if (!actor) {
-			return res.status(401).json({ message: 'Unauthorized' });
-		}
-		await ApiKeyService.deleteKey(id, userId, actor, req.ip || 'unknown');
+		await ApiKeyService.deleteKey(id, userId);
 
 		res.status(204).send({ message: req.t('apiKeys.deleteSuccess') });
-	};
+	}
 }

packages/backend/src/api/controllers/archived-email.controller.ts

@@ -1,10 +1,8 @@
 import { Request, Response } from 'express';
 import { ArchivedEmailService } from '../../services/ArchivedEmailService';
-import { UserService } from '../../services/UserService';
-import { checkDeletionEnabled } from '../../helpers/deletionGuard';
+import { config } from '../../config';
 
 export class ArchivedEmailController {
-	private userService = new UserService();
 	public getArchivedEmails = async (req: Request, res: Response): Promise<Response> => {
 		try {
 			const { ingestionSourceId } = req.params;
@@ -37,17 +35,8 @@ export class ArchivedEmailController {
 			if (!userId) {
 				return res.status(401).json({ message: req.t('errors.unauthorized') });
 			}
-			const actor = await this.userService.findById(userId);
-			if (!actor) {
-				return res.status(401).json({ message: req.t('errors.unauthorized') });
-			}
 
-			const email = await ArchivedEmailService.getArchivedEmailById(
-				id,
-				userId,
-				actor,
-				req.ip || 'unknown'
-			);
+			const email = await ArchivedEmailService.getArchivedEmailById(id, userId);
 			if (!email) {
 				return res.status(404).json({ message: req.t('archivedEmail.notFound') });
 			}
@@ -59,18 +48,12 @@ export class ArchivedEmailController {
 	};
 
 	public deleteArchivedEmail = async (req: Request, res: Response): Promise<Response> => {
+		if (config.app.isDemo) {
+			return res.status(403).json({ message: req.t('errors.demoMode') });
+		}
 		try {
-			checkDeletionEnabled();
 			const { id } = req.params;
-			const userId = req.user?.sub;
-			if (!userId) {
-				return res.status(401).json({ message: req.t('errors.unauthorized') });
-			}
-			const actor = await this.userService.findById(userId);
-			if (!actor) {
-				return res.status(401).json({ message: req.t('errors.unauthorized') });
-			}
-			await ArchivedEmailService.deleteArchivedEmail(id, actor, req.ip || 'unknown');
+			await ArchivedEmailService.deleteArchivedEmail(id);
 			return res.status(204).send();
 		} catch (error) {
 			console.error(`Delete archived email ${req.params.id} error:`, error);

packages/backend/src/api/controllers/auth.controller.ts

@@ -44,7 +44,7 @@ export class AuthController {
 				{ email, password, first_name, last_name },
 				true
 			);
-			const result = await this.#authService.login(email, password, req.ip || 'unknown');
+			const result = await this.#authService.login(email, password);
 			return res.status(201).json(result);
 		} catch (error) {
 			console.error('Setup error:', error);
@@ -60,7 +60,7 @@ export class AuthController {
 		}
 
 		try {
-			const result = await this.#authService.login(email, password, req.ip || 'unknown');
+			const result = await this.#authService.login(email, password);
 
 			if (!result) {
 				return res.status(401).json({ message: req.t('auth.login.invalidCredentials') });

packages/backend/src/api/controllers/iam.controller.ts

@@ -3,6 +3,7 @@ import { IamService } from '../../services/IamService';
 import { PolicyValidator } from '../../iam-policy/policy-validator';
 import type { CaslPolicy } from '@open-archiver/types';
 import { logger } from '../../config/logger';
+import { config } from '../../config';
 
 export class IamController {
 	#iamService: IamService;
@@ -41,6 +42,9 @@ export class IamController {
 	};
 
 	public createRole = async (req: Request, res: Response) => {
+		if (config.app.isDemo) {
+			return res.status(403).json({ message: req.t('errors.demoMode') });
+		}
 		const { name, policies } = req.body;
 
 		if (!name || !policies) {
@@ -65,6 +69,9 @@ export class IamController {
 	};
 
 	public deleteRole = async (req: Request, res: Response) => {
+		if (config.app.isDemo) {
+			return res.status(403).json({ message: req.t('errors.demoMode') });
+		}
 		const { id } = req.params;
 
 		try {
@@ -76,6 +83,9 @@ export class IamController {
 	};
 
 	public updateRole = async (req: Request, res: Response) => {
+		if (config.app.isDemo) {
+			return res.status(403).json({ message: req.t('errors.demoMode') });
+		}
 		const { id } = req.params;
 		const { name, policies } = req.body;
 

packages/backend/src/api/controllers/ingestion.controller.ts

@@ -7,11 +7,9 @@ import {
 	SafeIngestionSource,
 } from '@open-archiver/types';
 import { logger } from '../../config/logger';
-import { UserService } from '../../services/UserService';
-import { checkDeletionEnabled } from '../../helpers/deletionGuard';
+import { config } from '../../config';
 
 export class IngestionController {
-	private userService = new UserService();
 	/**
 	 * Converts an IngestionSource object to a safe version for client-side consumption
 	 * by removing the credentials.
@@ -24,22 +22,16 @@ export class IngestionController {
 	}
 
 	public create = async (req: Request, res: Response): Promise<Response> => {
+		if (config.app.isDemo) {
+			return res.status(403).json({ message: req.t('errors.demoMode') });
+		}
 		try {
 			const dto: CreateIngestionSourceDto = req.body;
 			const userId = req.user?.sub;
 			if (!userId) {
 				return res.status(401).json({ message: req.t('errors.unauthorized') });
 			}
-			const actor = await this.userService.findById(userId);
-			if (!actor) {
-				return res.status(401).json({ message: req.t('errors.unauthorized') });
-			}
-			const newSource = await IngestionService.create(
-				dto,
-				userId,
-				actor,
-				req.ip || 'unknown'
-			);
+			const newSource = await IngestionService.create(dto, userId);
 			const safeSource = this.toSafeIngestionSource(newSource);
 			return res.status(201).json(safeSource);
 		} catch (error: any) {
@@ -82,23 +74,13 @@ export class IngestionController {
 	};
 
 	public update = async (req: Request, res: Response): Promise<Response> => {
+		if (config.app.isDemo) {
+			return res.status(403).json({ message: req.t('errors.demoMode') });
+		}
 		try {
 			const { id } = req.params;
 			const dto: UpdateIngestionSourceDto = req.body;
-			const userId = req.user?.sub;
-			if (!userId) {
-				return res.status(401).json({ message: req.t('errors.unauthorized') });
-			}
-			const actor = await this.userService.findById(userId);
-			if (!actor) {
-				return res.status(401).json({ message: req.t('errors.unauthorized') });
-			}
-			const updatedSource = await IngestionService.update(
-				id,
-				dto,
-				actor,
-				req.ip || 'unknown'
-			);
+			const updatedSource = await IngestionService.update(id, dto);
 			const safeSource = this.toSafeIngestionSource(updatedSource);
 			return res.status(200).json(safeSource);
 		} catch (error) {
@@ -111,31 +93,26 @@ export class IngestionController {
 	};
 
 	public delete = async (req: Request, res: Response): Promise<Response> => {
+		if (config.app.isDemo) {
+			return res.status(403).json({ message: req.t('errors.demoMode') });
+		}
 		try {
-			checkDeletionEnabled();
 			const { id } = req.params;
-			const userId = req.user?.sub;
-			if (!userId) {
-				return res.status(401).json({ message: req.t('errors.unauthorized') });
-			}
-			const actor = await this.userService.findById(userId);
-			if (!actor) {
-				return res.status(401).json({ message: req.t('errors.unauthorized') });
-			}
-			await IngestionService.delete(id, actor, req.ip || 'unknown');
+			await IngestionService.delete(id);
 			return res.status(204).send();
 		} catch (error) {
 			console.error(`Delete ingestion source ${req.params.id} error:`, error);
 			if (error instanceof Error && error.message === 'Ingestion source not found') {
 				return res.status(404).json({ message: req.t('ingestion.notFound') });
-			} else if (error instanceof Error) {
-				return res.status(400).json({ message: error.message });
 			}
 			return res.status(500).json({ message: req.t('errors.internalServerError') });
 		}
 	};
 
 	public triggerInitialImport = async (req: Request, res: Response): Promise<Response> => {
+		if (config.app.isDemo) {
+			return res.status(403).json({ message: req.t('errors.demoMode') });
+		}
 		try {
 			const { id } = req.params;
 			await IngestionService.triggerInitialImport(id);
@@ -150,22 +127,12 @@ export class IngestionController {
 	};
 
 	public pause = async (req: Request, res: Response): Promise<Response> => {
+		if (config.app.isDemo) {
+			return res.status(403).json({ message: req.t('errors.demoMode') });
+		}
 		try {
 			const { id } = req.params;
-			const userId = req.user?.sub;
-			if (!userId) {
-				return res.status(401).json({ message: req.t('errors.unauthorized') });
-			}
-			const actor = await this.userService.findById(userId);
-			if (!actor) {
-				return res.status(401).json({ message: req.t('errors.unauthorized') });
-			}
-			const updatedSource = await IngestionService.update(
-				id,
-				{ status: 'paused' },
-				actor,
-				req.ip || 'unknown'
-			);
+			const updatedSource = await IngestionService.update(id, { status: 'paused' });
 			const safeSource = this.toSafeIngestionSource(updatedSource);
 			return res.status(200).json(safeSource);
 		} catch (error) {
@@ -178,17 +145,12 @@ export class IngestionController {
 	};
 
 	public triggerForceSync = async (req: Request, res: Response): Promise<Response> => {
+		if (config.app.isDemo) {
+			return res.status(403).json({ message: req.t('errors.demoMode') });
+		}
 		try {
 			const { id } = req.params;
-			const userId = req.user?.sub;
-			if (!userId) {
-				return res.status(401).json({ message: req.t('errors.unauthorized') });
-			}
-			const actor = await this.userService.findById(userId);
-			if (!actor) {
-				return res.status(401).json({ message: req.t('errors.unauthorized') });
-			}
-			await IngestionService.triggerForceSync(id, actor, req.ip || 'unknown');
+			await IngestionService.triggerForceSync(id);
 			return res.status(202).json({ message: req.t('ingestion.forceSyncTriggered') });
 		} catch (error) {
 			console.error(`Trigger force sync for ${req.params.id} error:`, error);

packages/backend/src/api/controllers/integrity.controller.ts

@@ -1,29 +0,0 @@
-import { Request, Response } from 'express';
-import { IntegrityService } from '../../services/IntegrityService';
-import { z } from 'zod';
-
-const checkIntegritySchema = z.object({
-	id: z.string().uuid(),
-});
-
-export class IntegrityController {
-	private integrityService = new IntegrityService();
-
-	public checkIntegrity = async (req: Request, res: Response) => {
-		try {
-			const { id } = checkIntegritySchema.parse(req.params);
-			const results = await this.integrityService.checkEmailIntegrity(id);
-			res.status(200).json(results);
-		} catch (error) {
-			if (error instanceof z.ZodError) {
-				return res
-					.status(400)
-					.json({ message: req.t('api.requestBodyInvalid'), errors: error.message });
-			}
-			if (error instanceof Error && error.message === 'Archived email not found') {
-				return res.status(404).json({ message: req.t('errors.notFound') });
-			}
-			res.status(500).json({ message: req.t('errors.internalServerError') });
-		}
-	};
-}

packages/backend/src/api/controllers/jobs.controller.ts

@@ -1,42 +0,0 @@
-import { Request, Response } from 'express';
-import { JobsService } from '../../services/JobsService';
-import {
-	IGetQueueJobsRequestParams,
-	IGetQueueJobsRequestQuery,
-	JobStatus,
-} from '@open-archiver/types';
-
-export class JobsController {
-	private jobsService: JobsService;
-
-	constructor() {
-		this.jobsService = new JobsService();
-	}
-
-	public getQueues = async (req: Request, res: Response) => {
-		try {
-			const queues = await this.jobsService.getQueues();
-			res.status(200).json({ queues });
-		} catch (error) {
-			res.status(500).json({ message: 'Error fetching queues', error });
-		}
-	};
-
-	public getQueueJobs = async (req: Request, res: Response) => {
-		try {
-			const { queueName } = req.params as unknown as IGetQueueJobsRequestParams;
-			const { status, page, limit } = req.query as unknown as IGetQueueJobsRequestQuery;
-			const pageNumber = parseInt(page, 10) || 1;
-			const limitNumber = parseInt(limit, 10) || 10;
-			const queueDetails = await this.jobsService.getQueueDetails(
-				queueName,
-				status,
-				pageNumber,
-				limitNumber
-			);
-			res.status(200).json(queueDetails);
-		} catch (error) {
-			res.status(500).json({ message: 'Error fetching queue jobs', error });
-		}
-	};
-}

packages/backend/src/api/controllers/search.controller.ts

@@ -31,8 +31,7 @@ export class SearchController {
 					limit: limit ? parseInt(limit as string) : 10,
 					matchingStrategy: matchingStrategy as MatchingStrategies,
 				},
-				userId,
-				req.ip || 'unknown'
+				userId
 			);
 
 			res.status(200).json(results);

packages/backend/src/api/controllers/settings.controller.ts

@@ -1,9 +1,8 @@
 import type { Request, Response } from 'express';
 import { SettingsService } from '../../services/SettingsService';
-import { UserService } from '../../services/UserService';
+import { config } from '../../config';
 
 const settingsService = new SettingsService();
-const userService = new UserService();
 
 export const getSystemSettings = async (req: Request, res: Response) => {
 	try {
@@ -18,18 +17,10 @@ export const getSystemSettings = async (req: Request, res: Response) => {
 export const updateSystemSettings = async (req: Request, res: Response) => {
 	try {
 		// Basic validation can be performed here if necessary
-		if (!req.user || !req.user.sub) {
-			return res.status(401).json({ message: 'Unauthorized' });
+		if (config.app.isDemo) {
+			return res.status(403).json({ message: req.t('errors.demoMode') });
 		}
-		const actor = await userService.findById(req.user.sub);
-		if (!actor) {
-			return res.status(401).json({ message: 'Unauthorized' });
-		}
-		const updatedSettings = await settingsService.updateSystemSettings(
-			req.body,
-			actor,
-			req.ip || 'unknown'
-		);
+		const updatedSettings = await settingsService.updateSystemSettings(req.body);
 		res.status(200).json(updatedSettings);
 	} catch (error) {
 		// A more specific error could be logged here

packages/backend/src/api/controllers/upload.controller.ts

@@ -7,7 +7,6 @@ import { config } from '../../config/index';
 export const uploadFile = async (req: Request, res: Response) => {
 	const storage = new StorageService();
 	const bb = busboy({ headers: req.headers });
-	const uploads: Promise<void>[] = [];
 	let filePath = '';
 	let originalFilename = '';
 
@@ -15,11 +14,10 @@ export const uploadFile = async (req: Request, res: Response) => {
 		originalFilename = filename.filename;
 		const uuid = randomUUID();
 		filePath = `${config.storage.openArchiverFolderName}/tmp/${uuid}-${originalFilename}`;
-		uploads.push(storage.put(filePath, file));
+		storage.put(filePath, file);
 	});
 
-	bb.on('finish', async () => {
-		await Promise.all(uploads);
+	bb.on('finish', () => {
 		res.json({ filePath });
 	});
 

packages/backend/src/api/controllers/user.controller.ts

@@ -21,39 +21,27 @@ export const getUser = async (req: Request, res: Response) => {
 };
 
 export const createUser = async (req: Request, res: Response) => {
+	if (config.app.isDemo) {
+		return res.status(403).json({ message: req.t('errors.demoMode') });
+	}
 	const { email, first_name, last_name, password, roleId } = req.body;
-	if (!req.user || !req.user.sub) {
-		return res.status(401).json({ message: 'Unauthorized' });
-	}
-	const actor = await userService.findById(req.user.sub);
-	if (!actor) {
-		return res.status(401).json({ message: 'Unauthorized' });
-	}
 
 	const newUser = await userService.createUser(
 		{ email, first_name, last_name, password },
-		roleId,
-		actor,
-		req.ip || 'unknown'
+		roleId
 	);
 	res.status(201).json(newUser);
 };
 
 export const updateUser = async (req: Request, res: Response) => {
+	if (config.app.isDemo) {
+		return res.status(403).json({ message: req.t('errors.demoMode') });
+	}
 	const { email, first_name, last_name, roleId } = req.body;
-	if (!req.user || !req.user.sub) {
-		return res.status(401).json({ message: 'Unauthorized' });
-	}
-	const actor = await userService.findById(req.user.sub);
-	if (!actor) {
-		return res.status(401).json({ message: 'Unauthorized' });
-	}
 	const updatedUser = await userService.updateUser(
 		req.params.id,
 		{ email, first_name, last_name },
-		roleId,
-		actor,
-		req.ip || 'unknown'
+		roleId
 	);
 	if (!updatedUser) {
 		return res.status(404).json({ message: req.t('user.notFound') });
@@ -62,6 +50,9 @@ export const updateUser = async (req: Request, res: Response) => {
 };
 
 export const deleteUser = async (req: Request, res: Response) => {
+	if (config.app.isDemo) {
+		return res.status(403).json({ message: req.t('errors.demoMode') });
+	}
 	const userCountResult = await db.select({ count: sql<number>`count(*)` }).from(schema.users);
 
 	const isOnlyUser = Number(userCountResult[0].count) === 1;
@@ -70,76 +61,6 @@ export const deleteUser = async (req: Request, res: Response) => {
 			message: req.t('user.cannotDeleteOnlyUser'),
 		});
 	}
-	if (!req.user || !req.user.sub) {
-		return res.status(401).json({ message: 'Unauthorized' });
-	}
-	const actor = await userService.findById(req.user.sub);
-	if (!actor) {
-		return res.status(401).json({ message: 'Unauthorized' });
-	}
-	await userService.deleteUser(req.params.id, actor, req.ip || 'unknown');
+	await userService.deleteUser(req.params.id);
 	res.status(204).send();
 };
-
-export const getProfile = async (req: Request, res: Response) => {
-	if (!req.user || !req.user.sub) {
-		return res.status(401).json({ message: 'Unauthorized' });
-	}
-	const user = await userService.findById(req.user.sub);
-	if (!user) {
-		return res.status(404).json({ message: req.t('user.notFound') });
-	}
-	res.json(user);
-};
-
-export const updateProfile = async (req: Request, res: Response) => {
-	if (config.app.isDemo) {
-		return res.status(403).json({ message: req.t('errors.demoMode') });
-	}
-	const { email, first_name, last_name } = req.body;
-	if (!req.user || !req.user.sub) {
-		return res.status(401).json({ message: 'Unauthorized' });
-	}
-	const actor = await userService.findById(req.user.sub);
-	if (!actor) {
-		return res.status(401).json({ message: 'Unauthorized' });
-	}
-	const updatedUser = await userService.updateUser(
-		req.user.sub,
-		{ email, first_name, last_name },
-		undefined,
-		actor,
-		req.ip || 'unknown'
-	);
-	res.json(updatedUser);
-};
-
-export const updatePassword = async (req: Request, res: Response) => {
-	if (config.app.isDemo) {
-		return res.status(403).json({ message: req.t('errors.demoMode') });
-	}
-	const { currentPassword, newPassword } = req.body;
-	if (!req.user || !req.user.sub) {
-		return res.status(401).json({ message: 'Unauthorized' });
-	}
-	const actor = await userService.findById(req.user.sub);
-	if (!actor) {
-		return res.status(401).json({ message: 'Unauthorized' });
-	}
-
-	try {
-		await userService.updatePassword(
-			req.user.sub,
-			currentPassword,
-			newPassword,
-			actor,
-			req.ip || 'unknown'
-		);
-		res.status(200).json({ message: 'Password updated successfully' });
-	} catch (e: any) {
-		if (e.message === 'Invalid current password') {
-			return res.status(400).json({ message: e.message });
-		}
-		throw e;
-	}
-};

packages/backend/src/api/middleware/rateLimiter.ts

@@ -1,4 +1,4 @@
-import { rateLimit, ipKeyGenerator } from 'express-rate-limit';
+import rateLimit from 'express-rate-limit';
 import { config } from '../../config';
 
 const windowInMinutes = Math.ceil(config.api.rateLimit.windowMs / 60000);
@@ -6,11 +6,6 @@ const windowInMinutes = Math.ceil(config.api.rateLimit.windowMs / 60000);
 export const rateLimiter = rateLimit({
 	windowMs: config.api.rateLimit.windowMs,
 	max: config.api.rateLimit.max,
-	keyGenerator: (req, res) => {
-		// Use the real IP address of the client, even if it's behind a proxy.
-		// `app.set('trust proxy', true)` in `server.ts`.
-		return ipKeyGenerator(req.ip || 'unknown');
-	},
 	message: {
 		status: 429,
 		message: `Too many requests from this IP, please try again after ${windowInMinutes} minutes`,

packages/backend/src/api/routes/api-key.routes.ts

@@ -3,7 +3,7 @@ import { ApiKeyController } from '../controllers/api-key.controller';
 import { requireAuth } from '../middleware/requireAuth';
 import { AuthService } from '../../services/AuthService';
 
-export const apiKeyRoutes = (authService: AuthService): Router => {
+export const apiKeyRoutes = (authService: AuthService) => {
 	const router = Router();
 	const controller = new ApiKeyController();
 

packages/backend/src/api/routes/integrity.routes.ts

@@ -1,16 +0,0 @@
-import { Router } from 'express';
-import { IntegrityController } from '../controllers/integrity.controller';
-import { requireAuth } from '../middleware/requireAuth';
-import { requirePermission } from '../middleware/requirePermission';
-import { AuthService } from '../../services/AuthService';
-
-export const integrityRoutes = (authService: AuthService): Router => {
-	const router = Router();
-	const controller = new IntegrityController();
-
-	router.use(requireAuth(authService));
-
-	router.get('/:id', requirePermission('read', 'archive'), controller.checkIntegrity);
-
-	return router;
-};

packages/backend/src/api/routes/jobs.routes.ts

@@ -1,25 +0,0 @@
-import { Router } from 'express';
-import { JobsController } from '../controllers/jobs.controller';
-import { requireAuth } from '../middleware/requireAuth';
-import { requirePermission } from '../middleware/requirePermission';
-import { AuthService } from '../../services/AuthService';
-
-export const createJobsRouter = (authService: AuthService): Router => {
-	const router = Router();
-	const jobsController = new JobsController();
-
-	router.use(requireAuth(authService));
-
-	router.get(
-		'/queues',
-		requirePermission('manage', 'all', 'user.requiresSuperAdminRole'),
-		jobsController.getQueues
-	);
-	router.get(
-		'/queues/:queueName',
-		requirePermission('manage', 'all', 'user.requiresSuperAdminRole'),
-		jobsController.getQueueJobs
-	);
-
-	return router;
-};

packages/backend/src/api/routes/user.routes.ts

@@ -11,10 +11,6 @@ export const createUserRouter = (authService: AuthService): Router => {
 
 	router.get('/', requirePermission('read', 'users'), userController.getUsers);
 
-	router.get('/profile', userController.getProfile);
-	router.patch('/profile', userController.updateProfile);
-	router.post('/profile/password', userController.updatePassword);
-
 	router.get('/:id', requirePermission('read', 'users'), userController.getUser);
 
 	/**

packages/backend/src/api/server.ts

@@ -1,170 +0,0 @@
-import express, { Express } from 'express';
-import cors from 'cors';
-import dotenv from 'dotenv';
-import { AuthController } from './controllers/auth.controller';
-import { IngestionController } from './controllers/ingestion.controller';
-import { ArchivedEmailController } from './controllers/archived-email.controller';
-import { StorageController } from './controllers/storage.controller';
-import { SearchController } from './controllers/search.controller';
-import { IamController } from './controllers/iam.controller';
-import { createAuthRouter } from './routes/auth.routes';
-import { createIamRouter } from './routes/iam.routes';
-import { createIngestionRouter } from './routes/ingestion.routes';
-import { createArchivedEmailRouter } from './routes/archived-email.routes';
-import { createStorageRouter } from './routes/storage.routes';
-import { createSearchRouter } from './routes/search.routes';
-import { createDashboardRouter } from './routes/dashboard.routes';
-import { createUploadRouter } from './routes/upload.routes';
-import { createUserRouter } from './routes/user.routes';
-import { createSettingsRouter } from './routes/settings.routes';
-import { apiKeyRoutes } from './routes/api-key.routes';
-import { integrityRoutes } from './routes/integrity.routes';
-import { createJobsRouter } from './routes/jobs.routes';
-import { AuthService } from '../services/AuthService';
-import { AuditService } from '../services/AuditService';
-import { UserService } from '../services/UserService';
-import { IamService } from '../services/IamService';
-import { StorageService } from '../services/StorageService';
-import { SearchService } from '../services/SearchService';
-import { SettingsService } from '../services/SettingsService';
-import i18next from 'i18next';
-import FsBackend from 'i18next-fs-backend';
-import i18nextMiddleware from 'i18next-http-middleware';
-import path from 'path';
-import { logger } from '../config/logger';
-import { rateLimiter } from './middleware/rateLimiter';
-import { config } from '../config';
-import { OpenArchiverFeature } from '@open-archiver/types';
-// Define the "plugin" interface
-export interface ArchiverModule {
-	initialize: (app: Express, authService: AuthService) => Promise<void>;
-	name: OpenArchiverFeature;
-}
-
-export let authService: AuthService;
-
-export async function createServer(modules: ArchiverModule[] = []): Promise<Express> {
-	// Load environment variables
-	dotenv.config();
-
-	// --- Environment Variable Validation ---
-	const { JWT_SECRET, JWT_EXPIRES_IN } = process.env;
-
-	if (!JWT_SECRET || !JWT_EXPIRES_IN) {
-		throw new Error(
-			'Missing required environment variables for the backend: JWT_SECRET, JWT_EXPIRES_IN.'
-		);
-	}
-
-	// --- Dependency Injection Setup ---
-	const auditService = new AuditService();
-	const userService = new UserService();
-	authService = new AuthService(userService, auditService, JWT_SECRET, JWT_EXPIRES_IN);
-	const authController = new AuthController(authService, userService);
-	const ingestionController = new IngestionController();
-	const archivedEmailController = new ArchivedEmailController();
-	const storageService = new StorageService();
-	const storageController = new StorageController(storageService);
-	const searchService = new SearchService();
-	const searchController = new SearchController();
-	const iamService = new IamService();
-	const iamController = new IamController(iamService);
-	const settingsService = new SettingsService();
-
-	// --- i18next Initialization ---
-	const initializeI18next = async () => {
-		const systemSettings = await settingsService.getSystemSettings();
-		const defaultLanguage = systemSettings?.language || 'en';
-		logger.info({ language: defaultLanguage }, 'Default language');
-		await i18next.use(FsBackend).init({
-			lng: defaultLanguage,
-			fallbackLng: defaultLanguage,
-			ns: ['translation'],
-			defaultNS: 'translation',
-			backend: {
-				loadPath: path.resolve(__dirname, '../locales/{{lng}}/{{ns}}.json'),
-			},
-		});
-	};
-
-	// Initialize i18next
-	await initializeI18next();
-	logger.info({}, 'i18next initialized');
-
-	// Configure the Meilisearch index on startup
-	logger.info({}, 'Configuring email index...');
-	await searchService.configureEmailIndex();
-
-	const app = express();
-
-	// --- CORS ---
-	app.use(
-		cors({
-			origin: process.env.APP_URL || 'http://localhost:3000',
-			credentials: true,
-		})
-	);
-
-	// Trust the proxy to get the real IP address of the client.
-	// This is important for audit logging and security.
-	app.set('trust proxy', true);
-
-	// --- Routes ---
-	const authRouter = createAuthRouter(authController);
-	const ingestionRouter = createIngestionRouter(ingestionController, authService);
-	const archivedEmailRouter = createArchivedEmailRouter(archivedEmailController, authService);
-	const storageRouter = createStorageRouter(storageController, authService);
-	const searchRouter = createSearchRouter(searchController, authService);
-	const dashboardRouter = createDashboardRouter(authService);
-	const iamRouter = createIamRouter(iamController, authService);
-	const uploadRouter = createUploadRouter(authService);
-	const userRouter = createUserRouter(authService);
-	const settingsRouter = createSettingsRouter(authService);
-	const apiKeyRouter = apiKeyRoutes(authService);
-	const integrityRouter = integrityRoutes(authService);
-	const jobsRouter = createJobsRouter(authService);
-
-	// Middleware for all other routes
-	app.use((req, res, next) => {
-		// exclude certain API endpoints from the rate limiter, for example status, system settings
-		const excludedPatterns = [/^\/v\d+\/auth\/status$/, /^\/v\d+\/settings\/system$/];
-		for (const pattern of excludedPatterns) {
-			if (pattern.test(req.path)) {
-				return next();
-			}
-		}
-		rateLimiter(req, res, next);
-	});
-	app.use(express.json());
-	app.use(express.urlencoded({ extended: true }));
-
-	// i18n middleware
-	app.use(i18nextMiddleware.handle(i18next));
-
-	app.use(`/${config.api.version}/auth`, authRouter);
-	app.use(`/${config.api.version}/iam`, iamRouter);
-	app.use(`/${config.api.version}/upload`, uploadRouter);
-	app.use(`/${config.api.version}/ingestion-sources`, ingestionRouter);
-	app.use(`/${config.api.version}/archived-emails`, archivedEmailRouter);
-	app.use(`/${config.api.version}/storage`, storageRouter);
-	app.use(`/${config.api.version}/search`, searchRouter);
-	app.use(`/${config.api.version}/dashboard`, dashboardRouter);
-	app.use(`/${config.api.version}/users`, userRouter);
-	app.use(`/${config.api.version}/settings`, settingsRouter);
-	app.use(`/${config.api.version}/api-keys`, apiKeyRouter);
-	app.use(`/${config.api.version}/integrity`, integrityRouter);
-	app.use(`/${config.api.version}/jobs`, jobsRouter);
-
-	// Load all provided extension modules
-	for (const module of modules) {
-		await module.initialize(app, authService);
-		console.log(`🏢 Enterprise module loaded: ${module.name}`);
-	}
-	app.get('/', (req, res) => {
-		res.send('Backend is running!!');
-	});
-
-	console.log('✅ Core OSS modules loaded.');
-
-	return app;
-}

packages/backend/src/config/api.ts

@@ -9,5 +9,4 @@ export const apiConfig = {
 			? parseInt(process.env.RATE_LIMIT_MAX_REQUESTS, 10)
 			: 100, // limit each IP to 100 requests per windowMs
 	},
-	version: 'v1',
 };

packages/backend/src/config/app.ts

@@ -4,8 +4,6 @@ export const app = {
 	nodeEnv: process.env.NODE_ENV || 'development',
 	port: process.env.PORT_BACKEND ? parseInt(process.env.PORT_BACKEND, 10) : 4000,
 	encryptionKey: process.env.ENCRYPTION_KEY,
-	syncFrequency: process.env.SYNC_FREQUENCY || '* * * * *', //default to 1 minute
-	enableDeletion: process.env.ENABLE_DELETION === 'true',
-	allInclusiveArchive: process.env.ALL_INCLUSIVE_ARCHIVE === 'true',
 	isDemo: process.env.IS_DEMO === 'true',
+	syncFrequency: process.env.SYNC_FREQUENCY || '* * * * *', //default to 1 minute
 };

packages/backend/src/config/index.ts

@@ -1,6 +1,6 @@
 import { storage } from './storage';
 import { app } from './app';
-import { searchConfig, meiliConfig } from './search';
+import { searchConfig } from './search';
 import { connection as redisConfig } from './redis';
 import { apiConfig } from './api';
 
@@ -8,7 +8,6 @@ export const config = {
 	storage,
 	app,
 	search: searchConfig,
-	meili: meiliConfig,
 	redis: redisConfig,
 	api: apiConfig,
 };

packages/backend/src/config/logger.ts

@@ -2,7 +2,6 @@ import pino from 'pino';
 
 export const logger = pino({
 	level: process.env.LOG_LEVEL || 'info',
-	redact: ['password'],
 	transport: {
 		target: 'pino-pretty',
 		options: {

packages/backend/src/config/redis.ts

@@ -1,20 +1,15 @@
 import 'dotenv/config';
-import { type ConnectionOptions } from 'bullmq';
 
 /**
  * @see https://github.com/taskforcesh/bullmq/blob/master/docs/gitbook/guide/connections.md
  */
-const connectionOptions: ConnectionOptions = {
+const connectionOptions: any = {
 	host: process.env.REDIS_HOST || 'localhost',
 	port: (process.env.REDIS_PORT && parseInt(process.env.REDIS_PORT, 10)) || 6379,
 	password: process.env.REDIS_PASSWORD,
 	enableReadyCheck: true,
 };
 
-if (process.env.REDIS_USER) {
-	connectionOptions.username = process.env.REDIS_USER;
-}
-
 if (process.env.REDIS_TLS_ENABLED === 'true') {
 	connectionOptions.tls = {
 		rejectUnauthorized: false,

packages/backend/src/config/search.ts

@@ -4,9 +4,3 @@ export const searchConfig = {
 	host: process.env.MEILI_HOST || 'http://127.0.0.1:7700',
 	apiKey: process.env.MEILI_MASTER_KEY || '',
 };
-
-export const meiliConfig = {
-	indexingBatchSize: process.env.MEILI_INDEXING_BATCH
-		? parseInt(process.env.MEILI_INDEXING_BATCH)
-		: 500,
-};

packages/backend/src/config/storage.ts

@@ -2,14 +2,9 @@ import { StorageConfig } from '@open-archiver/types';
 import 'dotenv/config';
 
 const storageType = process.env.STORAGE_TYPE;
-const encryptionKey = process.env.STORAGE_ENCRYPTION_KEY;
 const openArchiverFolderName = 'open-archiver';
 let storageConfig: StorageConfig;
 
-if (encryptionKey && !/^[a-fA-F0-9]{64}$/.test(encryptionKey)) {
-	throw new Error('STORAGE_ENCRYPTION_KEY must be a 64-character hex string (32 bytes)');
-}
-
 if (storageType === 'local') {
 	if (!process.env.STORAGE_LOCAL_ROOT_PATH) {
 		throw new Error('STORAGE_LOCAL_ROOT_PATH is not defined in the environment variables');
@@ -18,7 +13,6 @@ if (storageType === 'local') {
 		type: 'local',
 		rootPath: process.env.STORAGE_LOCAL_ROOT_PATH,
 		openArchiverFolderName: openArchiverFolderName,
-		encryptionKey: encryptionKey,
 	};
 } else if (storageType === 's3') {
 	if (
@@ -38,7 +32,6 @@ if (storageType === 'local') {
 		region: process.env.STORAGE_S3_REGION,
 		forcePathStyle: process.env.STORAGE_S3_FORCE_PATH_STYLE === 'true',
 		openArchiverFolderName: openArchiverFolderName,
-		encryptionKey: encryptionKey,
 	};
 } else {
 	throw new Error(`Invalid STORAGE_TYPE: ${storageType}`);

packages/backend/src/database/index.ts

@@ -1,4 +1,4 @@
-import { drizzle, PostgresJsDatabase } from 'drizzle-orm/postgres-js';
+import { drizzle } from 'drizzle-orm/postgres-js';
 import postgres from 'postgres';
 import 'dotenv/config';
 
@@ -12,4 +12,3 @@ if (!process.env.DATABASE_URL) {
 const connectionString = encodeDatabaseUrl(process.env.DATABASE_URL);
 const client = postgres(connectionString);
 export const db = drizzle(client, { schema });
-export type Database = PostgresJsDatabase<typeof schema>;

packages/backend/src/database/migrations/0020_panoramic_wolverine.sql

@@ -1 +0,0 @@
-ALTER TYPE "public"."ingestion_provider" ADD VALUE 'mbox_import';

packages/backend/src/database/migrations/0021_nosy_veda.sql

@@ -1,9 +0,0 @@
-CREATE TYPE "public"."audit_log_action" AS ENUM('CREATE', 'READ', 'UPDATE', 'DELETE', 'LOGIN', 'LOGOUT', 'SETUP', 'IMPORT', 'PAUSE', 'SYNC', 'UPLOAD', 'SEARCH', 'DOWNLOAD', 'GENERATE');--> statement-breakpoint
-CREATE TYPE "public"."audit_log_target_type" AS ENUM('ApiKey', 'ArchivedEmail', 'Dashboard', 'IngestionSource', 'Role', 'SystemSettings', 'User', 'File');--> statement-breakpoint
-ALTER TABLE "audit_logs" ALTER COLUMN "target_type" SET DATA TYPE "public"."audit_log_target_type" USING "target_type"::"public"."audit_log_target_type";--> statement-breakpoint
-ALTER TABLE "audit_logs" ADD COLUMN "previous_hash" varchar(64);--> statement-breakpoint
-ALTER TABLE "audit_logs" ADD COLUMN "actor_ip" text;--> statement-breakpoint
-ALTER TABLE "audit_logs" ADD COLUMN "action_type" "audit_log_action" NOT NULL;--> statement-breakpoint
-ALTER TABLE "audit_logs" ADD COLUMN "current_hash" varchar(64) NOT NULL;--> statement-breakpoint
-ALTER TABLE "audit_logs" DROP COLUMN "action";--> statement-breakpoint
-ALTER TABLE "audit_logs" DROP COLUMN "is_tamper_evident";

packages/backend/src/database/migrations/0022_complete_triton.sql

@@ -1,4 +0,0 @@
-ALTER TABLE "attachments" DROP CONSTRAINT "attachments_content_hash_sha256_unique";--> statement-breakpoint
-ALTER TABLE "attachments" ADD COLUMN "ingestion_source_id" uuid;--> statement-breakpoint
-ALTER TABLE "attachments" ADD CONSTRAINT "attachments_ingestion_source_id_ingestion_sources_id_fk" FOREIGN KEY ("ingestion_source_id") REFERENCES "public"."ingestion_sources"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-CREATE UNIQUE INDEX "source_hash_unique" ON "attachments" USING btree ("ingestion_source_id","content_hash_sha256");

packages/backend/src/database/migrations/0023_swift_swordsman.sql

@@ -1,2 +0,0 @@
-DROP INDEX "source_hash_unique";--> statement-breakpoint
-CREATE INDEX "source_hash_idx" ON "attachments" USING btree ("ingestion_source_id","content_hash_sha256");

packages/backend/src/database/migrations/0024_careful_black_panther.sql

@@ -1,51 +0,0 @@
-CREATE TABLE "email_legal_holds" (
-	"email_id" uuid NOT NULL,
-	"legal_hold_id" uuid NOT NULL,
-	CONSTRAINT "email_legal_holds_email_id_legal_hold_id_pk" PRIMARY KEY("email_id","legal_hold_id")
-);
---> statement-breakpoint
-CREATE TABLE "email_retention_labels" (
-	"email_id" uuid NOT NULL,
-	"label_id" uuid NOT NULL,
-	"applied_at" timestamp with time zone DEFAULT now() NOT NULL,
-	"applied_by_user_id" uuid,
-	CONSTRAINT "email_retention_labels_email_id_label_id_pk" PRIMARY KEY("email_id","label_id")
-);
---> statement-breakpoint
-CREATE TABLE "retention_events" (
-	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
-	"event_name" varchar(255) NOT NULL,
-	"event_type" varchar(100) NOT NULL,
-	"event_timestamp" timestamp with time zone NOT NULL,
-	"target_criteria" jsonb NOT NULL,
-	"created_at" timestamp with time zone DEFAULT now() NOT NULL
-);
---> statement-breakpoint
-CREATE TABLE "retention_labels" (
-	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
-	"name" varchar(255) NOT NULL,
-	"retention_period_days" integer NOT NULL,
-	"description" text,
-	"created_at" timestamp with time zone DEFAULT now() NOT NULL
-);
---> statement-breakpoint
-ALTER TABLE "legal_holds" DROP CONSTRAINT "legal_holds_custodian_id_custodians_id_fk";
---> statement-breakpoint
-ALTER TABLE "legal_holds" DROP CONSTRAINT "legal_holds_case_id_ediscovery_cases_id_fk";
---> statement-breakpoint
-ALTER TABLE "legal_holds" ALTER COLUMN "case_id" DROP NOT NULL;--> statement-breakpoint
-ALTER TABLE "legal_holds" ADD COLUMN "name" varchar(255) NOT NULL;--> statement-breakpoint
-ALTER TABLE "legal_holds" ADD COLUMN "is_active" boolean DEFAULT true NOT NULL;--> statement-breakpoint
-ALTER TABLE "legal_holds" ADD COLUMN "created_at" timestamp with time zone DEFAULT now() NOT NULL;--> statement-breakpoint
-ALTER TABLE "legal_holds" ADD COLUMN "updated_at" timestamp with time zone DEFAULT now() NOT NULL;--> statement-breakpoint
-ALTER TABLE "email_legal_holds" ADD CONSTRAINT "email_legal_holds_email_id_archived_emails_id_fk" FOREIGN KEY ("email_id") REFERENCES "public"."archived_emails"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "email_legal_holds" ADD CONSTRAINT "email_legal_holds_legal_hold_id_legal_holds_id_fk" FOREIGN KEY ("legal_hold_id") REFERENCES "public"."legal_holds"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "email_retention_labels" ADD CONSTRAINT "email_retention_labels_email_id_archived_emails_id_fk" FOREIGN KEY ("email_id") REFERENCES "public"."archived_emails"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "email_retention_labels" ADD CONSTRAINT "email_retention_labels_label_id_retention_labels_id_fk" FOREIGN KEY ("label_id") REFERENCES "public"."retention_labels"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "email_retention_labels" ADD CONSTRAINT "email_retention_labels_applied_by_user_id_users_id_fk" FOREIGN KEY ("applied_by_user_id") REFERENCES "public"."users"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "legal_holds" ADD CONSTRAINT "legal_holds_case_id_ediscovery_cases_id_fk" FOREIGN KEY ("case_id") REFERENCES "public"."ediscovery_cases"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "legal_holds" DROP COLUMN "custodian_id";--> statement-breakpoint
-ALTER TABLE "legal_holds" DROP COLUMN "hold_criteria";--> statement-breakpoint
-ALTER TABLE "legal_holds" DROP COLUMN "applied_by_identifier";--> statement-breakpoint
-ALTER TABLE "legal_holds" DROP COLUMN "applied_at";--> statement-breakpoint
-ALTER TABLE "legal_holds" DROP COLUMN "removed_at";

packages/backend/src/database/migrations/0025_peaceful_grim_reaper.sql

@@ -1,3 +0,0 @@
-ALTER TYPE "public"."audit_log_target_type" ADD VALUE 'RetentionPolicy' BEFORE 'Role';--> statement-breakpoint
-ALTER TYPE "public"."audit_log_target_type" ADD VALUE 'SystemEvent' BEFORE 'SystemSettings';--> statement-breakpoint
-ALTER TABLE "retention_policies" ADD COLUMN "ingestion_scope" jsonb DEFAULT 'null'::jsonb;

packages/backend/src/database/migrations/meta/_journal.json

@@ -1,188 +1,146 @@
 {
-  "version": "7",
-  "dialect": "postgresql",
-  "entries": [
-    {
-      "idx": 0,
-      "version": "7",
-      "when": 1752225352591,
-      "tag": "0000_amusing_namora",
-      "breakpoints": true
-    },
-    {
-      "idx": 1,
-      "version": "7",
-      "when": 1752326803882,
-      "tag": "0001_odd_night_thrasher",
-      "breakpoints": true
-    },
-    {
-      "idx": 2,
-      "version": "7",
-      "when": 1752332648392,
-      "tag": "0002_lethal_quentin_quire",
-      "breakpoints": true
-    },
-    {
-      "idx": 3,
-      "version": "7",
-      "when": 1752332967084,
-      "tag": "0003_petite_wrecker",
-      "breakpoints": true
-    },
-    {
-      "idx": 4,
-      "version": "7",
-      "when": 1752606108876,
-      "tag": "0004_sleepy_paper_doll",
-      "breakpoints": true
-    },
-    {
-      "idx": 5,
-      "version": "7",
-      "when": 1752606327253,
-      "tag": "0005_chunky_sue_storm",
-      "breakpoints": true
-    },
-    {
-      "idx": 6,
-      "version": "7",
-      "when": 1753112018514,
-      "tag": "0006_majestic_caretaker",
-      "breakpoints": true
-    },
-    {
-      "idx": 7,
-      "version": "7",
-      "when": 1753190159356,
-      "tag": "0007_handy_archangel",
-      "breakpoints": true
-    },
-    {
-      "idx": 8,
-      "version": "7",
-      "when": 1753370737317,
-      "tag": "0008_eminent_the_spike",
-      "breakpoints": true
-    },
-    {
-      "idx": 9,
-      "version": "7",
-      "when": 1754337938241,
-      "tag": "0009_late_lenny_balinger",
-      "breakpoints": true
-    },
-    {
-      "idx": 10,
-      "version": "7",
-      "when": 1754420780849,
-      "tag": "0010_perpetual_lightspeed",
-      "breakpoints": true
-    },
-    {
-      "idx": 11,
-      "version": "7",
-      "when": 1754422064158,
-      "tag": "0011_tan_blackheart",
-      "breakpoints": true
-    },
-    {
-      "idx": 12,
-      "version": "7",
-      "when": 1754476962901,
-      "tag": "0012_warm_the_stranger",
-      "breakpoints": true
-    },
-    {
-      "idx": 13,
-      "version": "7",
-      "when": 1754659373517,
-      "tag": "0013_classy_talkback",
-      "breakpoints": true
-    },
-    {
-      "idx": 14,
-      "version": "7",
-      "when": 1754831765718,
-      "tag": "0014_foamy_vapor",
-      "breakpoints": true
-    },
-    {
-      "idx": 15,
-      "version": "7",
-      "when": 1755443936046,
-      "tag": "0015_wakeful_norman_osborn",
-      "breakpoints": true
-    },
-    {
-      "idx": 16,
-      "version": "7",
-      "when": 1755780572342,
-      "tag": "0016_lonely_mariko_yashida",
-      "breakpoints": true
-    },
-    {
-      "idx": 17,
-      "version": "7",
-      "when": 1755961566627,
-      "tag": "0017_tranquil_shooting_star",
-      "breakpoints": true
-    },
-    {
-      "idx": 18,
-      "version": "7",
-      "when": 1756911118035,
-      "tag": "0018_flawless_owl",
-      "breakpoints": true
-    },
-    {
-      "idx": 19,
-      "version": "7",
-      "when": 1756937533843,
-      "tag": "0019_confused_scream",
-      "breakpoints": true
-    },
-    {
-      "idx": 20,
-      "version": "7",
-      "when": 1757860242528,
-      "tag": "0020_panoramic_wolverine",
-      "breakpoints": true
-    },
-    {
-      "idx": 21,
-      "version": "7",
-      "when": 1759412986134,
-      "tag": "0021_nosy_veda",
-      "breakpoints": true
-    },
-    {
-      "idx": 22,
-      "version": "7",
-      "when": 1759701622932,
-      "tag": "0022_complete_triton",
-      "breakpoints": true
-    },
-    {
-      "idx": 23,
-      "version": "7",
-      "when": 1760354094610,
-      "tag": "0023_swift_swordsman",
-      "breakpoints": true
-    },
-    {
-      "idx": 24,
-      "version": "7",
-      "when": 1772842674479,
-      "tag": "0024_careful_black_panther",
-      "breakpoints": true
-    },
-    {
-      "idx": 25,
-      "version": "7",
-      "when": 1773013461190,
-      "tag": "0025_peaceful_grim_reaper",
-      "breakpoints": true
-    }
-  ]
-}
+	"version": "7",
+	"dialect": "postgresql",
+	"entries": [
+		{
+			"idx": 0,
+			"version": "7",
+			"when": 1752225352591,
+			"tag": "0000_amusing_namora",
+			"breakpoints": true
+		},
+		{
+			"idx": 1,
+			"version": "7",
+			"when": 1752326803882,
+			"tag": "0001_odd_night_thrasher",
+			"breakpoints": true
+		},
+		{
+			"idx": 2,
+			"version": "7",
+			"when": 1752332648392,
+			"tag": "0002_lethal_quentin_quire",
+			"breakpoints": true
+		},
+		{
+			"idx": 3,
+			"version": "7",
+			"when": 1752332967084,
+			"tag": "0003_petite_wrecker",
+			"breakpoints": true
+		},
+		{
+			"idx": 4,
+			"version": "7",
+			"when": 1752606108876,
+			"tag": "0004_sleepy_paper_doll",
+			"breakpoints": true
+		},
+		{
+			"idx": 5,
+			"version": "7",
+			"when": 1752606327253,
+			"tag": "0005_chunky_sue_storm",
+			"breakpoints": true
+		},
+		{
+			"idx": 6,
+			"version": "7",
+			"when": 1753112018514,
+			"tag": "0006_majestic_caretaker",
+			"breakpoints": true
+		},
+		{
+			"idx": 7,
+			"version": "7",
+			"when": 1753190159356,
+			"tag": "0007_handy_archangel",
+			"breakpoints": true
+		},
+		{
+			"idx": 8,
+			"version": "7",
+			"when": 1753370737317,
+			"tag": "0008_eminent_the_spike",
+			"breakpoints": true
+		},
+		{
+			"idx": 9,
+			"version": "7",
+			"when": 1754337938241,
+			"tag": "0009_late_lenny_balinger",
+			"breakpoints": true
+		},
+		{
+			"idx": 10,
+			"version": "7",
+			"when": 1754420780849,
+			"tag": "0010_perpetual_lightspeed",
+			"breakpoints": true
+		},
+		{
+			"idx": 11,
+			"version": "7",
+			"when": 1754422064158,
+			"tag": "0011_tan_blackheart",
+			"breakpoints": true
+		},
+		{
+			"idx": 12,
+			"version": "7",
+			"when": 1754476962901,
+			"tag": "0012_warm_the_stranger",
+			"breakpoints": true
+		},
+		{
+			"idx": 13,
+			"version": "7",
+			"when": 1754659373517,
+			"tag": "0013_classy_talkback",
+			"breakpoints": true
+		},
+		{
+			"idx": 14,
+			"version": "7",
+			"when": 1754831765718,
+			"tag": "0014_foamy_vapor",
+			"breakpoints": true
+		},
+		{
+			"idx": 15,
+			"version": "7",
+			"when": 1755443936046,
+			"tag": "0015_wakeful_norman_osborn",
+			"breakpoints": true
+		},
+		{
+			"idx": 16,
+			"version": "7",
+			"when": 1755780572342,
+			"tag": "0016_lonely_mariko_yashida",
+			"breakpoints": true
+		},
+		{
+			"idx": 17,
+			"version": "7",
+			"when": 1755961566627,
+			"tag": "0017_tranquil_shooting_star",
+			"breakpoints": true
+		},
+		{
+			"idx": 18,
+			"version": "7",
+			"when": 1756911118035,
+			"tag": "0018_flawless_owl",
+			"breakpoints": true
+		},
+		{
+			"idx": 19,
+			"version": "7",
+			"when": 1756937533843,
+			"tag": "0019_confused_scream",
+			"breakpoints": true
+		}
+	]
+}

packages/backend/src/database/schema.ts

@@ -7,5 +7,3 @@ export * from './schema/ingestion-sources';
 export * from './schema/users';
 export * from './schema/system-settings';
 export * from './schema/api-keys';
-export * from './schema/audit-logs';
-export * from './schema/enums';

packages/backend/src/database/schema/attachments.ts

@@ -1,23 +1,15 @@
 import { relations } from 'drizzle-orm';
-import { pgTable, text, uuid, bigint, primaryKey, index } from 'drizzle-orm/pg-core';
+import { pgTable, text, uuid, bigint, primaryKey } from 'drizzle-orm/pg-core';
 import { archivedEmails } from './archived-emails';
-import { ingestionSources } from './ingestion-sources';
 
-export const attachments = pgTable(
-	'attachments',
-	{
-		id: uuid('id').primaryKey().defaultRandom(),
-		filename: text('filename').notNull(),
-		mimeType: text('mime_type'),
-		sizeBytes: bigint('size_bytes', { mode: 'number' }).notNull(),
-		contentHashSha256: text('content_hash_sha256').notNull(),
-		storagePath: text('storage_path').notNull(),
-		ingestionSourceId: uuid('ingestion_source_id').references(() => ingestionSources.id, {
-			onDelete: 'cascade',
-		}),
-	},
-	(table) => [index('source_hash_idx').on(table.ingestionSourceId, table.contentHashSha256)]
-);
+export const attachments = pgTable('attachments', {
+	id: uuid('id').primaryKey().defaultRandom(),
+	filename: text('filename').notNull(),
+	mimeType: text('mime_type'),
+	sizeBytes: bigint('size_bytes', { mode: 'number' }).notNull(),
+	contentHashSha256: text('content_hash_sha256').notNull().unique(),
+	storagePath: text('storage_path').notNull(),
+});
 
 export const emailAttachments = pgTable(
 	'email_attachments',

packages/backend/src/database/schema/audit-logs.ts

@@ -1,34 +1,12 @@
-import { bigserial, jsonb, pgTable, text, timestamp, varchar } from 'drizzle-orm/pg-core';
-import { auditLogActionEnum, auditLogTargetTypeEnum } from './enums';
+import { bigserial, boolean, jsonb, pgTable, text, timestamp } from 'drizzle-orm/pg-core';
 
 export const auditLogs = pgTable('audit_logs', {
-	// A unique, sequential, and gapless primary key for ordering.
 	id: bigserial('id', { mode: 'number' }).primaryKey(),
-
-	// The SHA-256 hash of the preceding log entry's `currentHash`.
-	previousHash: varchar('previous_hash', { length: 64 }),
-
-	// A high-precision, UTC timestamp of when the event occurred.
 	timestamp: timestamp('timestamp', { withTimezone: true }).notNull().defaultNow(),
-
-	// A stable identifier for the actor who performed the action.
 	actorIdentifier: text('actor_identifier').notNull(),
-
-	// The IP address from which the action was initiated.
-	actorIp: text('actor_ip'),
-
-	// A standardized, machine-readable identifier for the event.
-	actionType: auditLogActionEnum('action_type').notNull(),
-
-	// The type of resource that was affected by the action.
-	targetType: auditLogTargetTypeEnum('target_type'),
-
-	// The unique identifier of the affected resource.
+	action: text('action').notNull(),
+	targetType: text('target_type'),
 	targetId: text('target_id'),
-
-	// A JSON object containing specific, contextual details of the event.
 	details: jsonb('details'),
-
-	// The SHA-256 hash of this entire log entry's contents.
-	currentHash: varchar('current_hash', { length: 64 }).notNull(),
+	isTamperEvident: boolean('is_tamper_evident').default(false),
 });

packages/backend/src/database/schema/compliance.ts

@@ -5,14 +5,11 @@ import {
 	jsonb,
 	pgEnum,
 	pgTable,
-	primaryKey,
 	text,
 	timestamp,
 	uuid,
-	varchar,
 } from 'drizzle-orm/pg-core';
-import { archivedEmails } from './archived-emails';
-import { users } from './users';
+import { custodians } from './custodians';
 
 // --- Enums ---
 
@@ -32,45 +29,10 @@ export const retentionPolicies = pgTable('retention_policies', {
 	actionOnExpiry: retentionActionEnum('action_on_expiry').notNull(),
 	isEnabled: boolean('is_enabled').notNull().default(true),
 	conditions: jsonb('conditions'),
-	/**
-	 * Array of ingestion source UUIDs this policy is restricted to.
-	 * null means the policy applies to all ingestion sources.
-	 */
-	ingestionScope: jsonb('ingestion_scope').$type<string[] | null>().default(null),
 	createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
 	updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
 });
 
-export const retentionLabels = pgTable('retention_labels', {
-	id: uuid('id').defaultRandom().primaryKey(),
-	name: varchar('name', { length: 255 }).notNull(),
-	retentionPeriodDays: integer('retention_period_days').notNull(),
-	description: text('description'),
-	createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
-});
-
-export const emailRetentionLabels = pgTable('email_retention_labels', {
-	emailId: uuid('email_id')
-		.references(() => archivedEmails.id, { onDelete: 'cascade' })
-		.notNull(),
-	labelId: uuid('label_id')
-		.references(() => retentionLabels.id, { onDelete: 'cascade' })
-		.notNull(),
-	appliedAt: timestamp('applied_at', { withTimezone: true }).notNull().defaultNow(),
-	appliedByUserId: uuid('applied_by_user_id').references(() => users.id),
-}, (t) => [
-	primaryKey({ columns: [t.emailId, t.labelId] }),
-]);
-
-export const retentionEvents = pgTable('retention_events', {
-	id: uuid('id').defaultRandom().primaryKey(),
-	eventName: varchar('event_name', { length: 255 }).notNull(),
-	eventType: varchar('event_type', { length: 100 }).notNull(),
-	eventTimestamp: timestamp('event_timestamp', { withTimezone: true }).notNull(),
-	targetCriteria: jsonb('target_criteria').notNull(),
-	createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
-});
-
 export const ediscoveryCases = pgTable('ediscovery_cases', {
 	id: uuid('id').primaryKey().defaultRandom(),
 	name: text('name').notNull().unique(),
@@ -82,31 +44,18 @@ export const ediscoveryCases = pgTable('ediscovery_cases', {
 });
 
 export const legalHolds = pgTable('legal_holds', {
-	id: uuid('id').defaultRandom().primaryKey(),
-	name: varchar('name', { length: 255 }).notNull(),
+	id: uuid('id').primaryKey().defaultRandom(),
+	caseId: uuid('case_id')
+		.notNull()
+		.references(() => ediscoveryCases.id, { onDelete: 'cascade' }),
+	custodianId: uuid('custodian_id').references(() => custodians.id, { onDelete: 'cascade' }),
+	holdCriteria: jsonb('hold_criteria'),
 	reason: text('reason'),
-	isActive: boolean('is_active').notNull().default(true),
-	// Optional link to ediscovery cases for backward compatibility or future use
-	caseId: uuid('case_id').references(() => ediscoveryCases.id, { onDelete: 'set null' }),
-	createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
-	updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
+	appliedByIdentifier: text('applied_by_identifier').notNull(),
+	appliedAt: timestamp('applied_at', { withTimezone: true }).notNull().defaultNow(),
+	removedAt: timestamp('removed_at', { withTimezone: true }),
 });
 
-export const emailLegalHolds = pgTable(
-	'email_legal_holds',
-	{
-		emailId: uuid('email_id')
-			.references(() => archivedEmails.id, { onDelete: 'cascade' })
-			.notNull(),
-		legalHoldId: uuid('legal_hold_id')
-			.references(() => legalHolds.id, { onDelete: 'cascade' })
-			.notNull(),
-	},
-	(t) => [
-		primaryKey({ columns: [t.emailId, t.legalHoldId] }),
-	],
-);
-
 export const exportJobs = pgTable('export_jobs', {
 	id: uuid('id').primaryKey().defaultRandom(),
 	caseId: uuid('case_id').references(() => ediscoveryCases.id, { onDelete: 'set null' }),
@@ -121,51 +70,20 @@ export const exportJobs = pgTable('export_jobs', {
 
 // --- Relations ---
 
-export const retentionPoliciesRelations = relations(retentionPolicies, ({ many }) => ({
-	// Add relations if needed
+export const ediscoveryCasesRelations = relations(ediscoveryCases, ({ many }) => ({
+	legalHolds: many(legalHolds),
+	exportJobs: many(exportJobs),
 }));
 
-export const retentionLabelsRelations = relations(retentionLabels, ({ many }) => ({
-	emailRetentionLabels: many(emailRetentionLabels),
-}));
-
-export const emailRetentionLabelsRelations = relations(emailRetentionLabels, ({ one }) => ({
-	label: one(retentionLabels, {
-		fields: [emailRetentionLabels.labelId],
-		references: [retentionLabels.id],
-	}),
-	email: one(archivedEmails, {
-		fields: [emailRetentionLabels.emailId],
-		references: [archivedEmails.id],
-	}),
-	appliedByUser: one(users, {
-		fields: [emailRetentionLabels.appliedByUserId],
-		references: [users.id],
-	}),
-}));
-
-export const legalHoldsRelations = relations(legalHolds, ({ one, many }) => ({
-	emailLegalHolds: many(emailLegalHolds),
+export const legalHoldsRelations = relations(legalHolds, ({ one }) => ({
 	ediscoveryCase: one(ediscoveryCases, {
 		fields: [legalHolds.caseId],
 		references: [ediscoveryCases.id],
 	}),
-}));
-
-export const emailLegalHoldsRelations = relations(emailLegalHolds, ({ one }) => ({
-	legalHold: one(legalHolds, {
-		fields: [emailLegalHolds.legalHoldId],
-		references: [legalHolds.id],
+	custodian: one(custodians, {
+		fields: [legalHolds.custodianId],
+		references: [custodians.id],
 	}),
-	email: one(archivedEmails, {
-		fields: [emailLegalHolds.emailId],
-		references: [archivedEmails.id],
-	}),
-}));
-
-export const ediscoveryCasesRelations = relations(ediscoveryCases, ({ many }) => ({
-	legalHolds: many(legalHolds),
-	exportJobs: many(exportJobs),
 }));
 
 export const exportJobsRelations = relations(exportJobs, ({ one }) => ({

packages/backend/src/database/schema/enums.ts

@@ -1,5 +0,0 @@
-import { pgEnum } from 'drizzle-orm/pg-core';
-import { AuditLogActions, AuditLogTargetTypes } from '@open-archiver/types';
-
-export const auditLogActionEnum = pgEnum('audit_log_action', AuditLogActions);
-export const auditLogTargetTypeEnum = pgEnum('audit_log_target_type', AuditLogTargetTypes);

packages/backend/src/database/schema/ingestion-sources.ts

@@ -8,7 +8,6 @@ export const ingestionProviderEnum = pgEnum('ingestion_provider', [
 	'generic_imap',
 	'pst_import',
 	'eml_import',
-	'mbox_import',
 ]);
 
 export const ingestionStatusEnum = pgEnum('ingestion_status', [

packages/backend/src/helpers/deletionGuard.ts

@@ -1,18 +0,0 @@
-import { config } from '../config';
-import i18next from 'i18next';
-
-interface DeletionOptions {
-	allowSystemDelete?: boolean;
-}
-
-export function checkDeletionEnabled(options?: DeletionOptions) {
-	// If system delete is allowed (e.g. by retention policy), bypass the config check
-	if (options?.allowSystemDelete) {
-		return;
-	}
-
-	if (!config.app.enableDeletion) {
-		const errorMessage = i18next.t('Deletion is disabled for this instance.');
-		throw new Error(errorMessage);
-	}
-}

packages/backend/src/helpers/textExtractor.ts

@@ -1,10 +1,7 @@
 import PDFParser from 'pdf2json';
 import mammoth from 'mammoth';
 import xlsx from 'xlsx';
-import { logger } from '../config/logger';
-import { OcrService } from '../services/OcrService';
 
-// Legacy PDF extraction (with improved memory management)
 function extractTextFromPdf(buffer: Buffer): Promise<string> {
 	return new Promise((resolve) => {
 		const pdfParser = new PDFParser(null, true);
@@ -13,57 +10,28 @@ function extractTextFromPdf(buffer: Buffer): Promise<string> {
 		const finish = (text: string) => {
 			if (completed) return;
 			completed = true;
-
-			// explicit cleanup
-			try {
-				pdfParser.removeAllListeners();
-			} catch (e) {
-				// Ignore cleanup errors
-			}
-
+			pdfParser.removeAllListeners();
 			resolve(text);
 		};
 
-		pdfParser.on('pdfParser_dataError', (err: any) => {
-			logger.warn('PDF parsing error:', err?.parserError || 'Unknown error');
-			finish('');
-		});
-
-		pdfParser.on('pdfParser_dataReady', () => {
-			try {
-				const text = pdfParser.getRawTextContent();
-				finish(text || '');
-			} catch (err) {
-				logger.warn('Error getting PDF text content:', err);
-				finish('');
-			}
-		});
+		pdfParser.on('pdfParser_dataError', () => finish(''));
+		pdfParser.on('pdfParser_dataReady', () => finish(pdfParser.getRawTextContent()));
 
 		try {
 			pdfParser.parseBuffer(buffer);
 		} catch (err) {
-			logger.error('Error parsing PDF buffer:', err);
+			console.error('Error parsing PDF buffer', err);
 			finish('');
 		}
 
-		// reduced Timeout for better performance
-		// setTimeout(() => {
-		// 	logger.warn('PDF parsing timed out');
-		// 	finish('');
-		// }, 5000);
+		// Prevent hanging if the parser never emits events
+		setTimeout(() => finish(''), 10000);
 	});
 }
 
-// Legacy text extraction for various formats
-async function extractTextLegacy(buffer: Buffer, mimeType: string): Promise<string> {
+export async function extractText(buffer: Buffer, mimeType: string): Promise<string> {
 	try {
 		if (mimeType === 'application/pdf') {
-			// Check PDF size (memory protection)
-			if (buffer.length > 50 * 1024 * 1024) {
-				// 50MB Limit
-				logger.warn('PDF too large for legacy extraction, skipping');
-				return '';
-			}
 			return await extractTextFromPdf(buffer);
 		}
 
@@ -82,7 +50,7 @@ async function extractTextLegacy(buffer: Buffer, mimeType: string): Promise<stri
 				const sheetText = xlsx.utils.sheet_to_txt(sheet);
 				fullText += sheetText + '\n';
 			}
-			return fullText.trim();
+			return fullText;
 		}
 
 		if (
@@ -92,56 +60,11 @@ async function extractTextLegacy(buffer: Buffer, mimeType: string): Promise<stri
 		) {
 			return buffer.toString('utf-8');
 		}
-
-		return '';
 	} catch (error) {
-		logger.error(`Error extracting text from attachment with MIME type ${mimeType}:`, error);
-
-		// Force garbage collection if available
-		if (global.gc) {
-			global.gc();
-		}
-
-		return '';
-	}
-}
-
-// Main extraction function
-export async function extractText(buffer: Buffer, mimeType: string): Promise<string> {
-	// Input validation
-	if (!buffer || buffer.length === 0) {
-		return '';
-	}
-
-	if (!mimeType) {
-		logger.warn('No MIME type provided for text extraction');
-		return '';
-	}
-
-	// General size limit
-	const maxSize = process.env.TIKA_URL ? 100 * 1024 * 1024 : 50 * 1024 * 1024; // 100MB for Tika, 50MB for Legacy
-	if (buffer.length > maxSize) {
-		logger.warn(
-			`File too large for text extraction: ${buffer.length} bytes (limit: ${maxSize})`
-		);
-		return '';
-	}
-
-	// Decide between Tika and legacy
-	const tikaUrl = process.env.TIKA_URL;
-
-	if (tikaUrl) {
-		// Tika decides what it can parse
-		logger.debug(`Using Tika for text extraction: ${mimeType}`);
-		const ocrService = new OcrService();
-		try {
-			return await ocrService.extractTextWithTika(buffer, mimeType);
-		} catch (error) {
-			logger.error({ error }, 'OCR text extraction failed, returning empty string');
-			return '';
-		}
-	} else {
-		// extract using legacy mode
-		return await extractTextLegacy(buffer, mimeType);
+		console.error(`Error extracting text from attachment with MIME type ${mimeType}:`, error);
+		return ''; // Return empty string on failure
 	}
+
+	console.warn(`Unsupported MIME type for text extraction: ${mimeType}`);
+	return ''; // Return empty string for unsupported types
 }

packages/backend/src/hooks/RetentionHook.ts

@@ -1,36 +0,0 @@
-import { logger } from '../config/logger';
-
-export type DeletionCheck = (emailId: string) => Promise<boolean>;
-
-export class RetentionHook {
-	private static checks: DeletionCheck[] = [];
-
-	/**
-	 * Registers a function that checks if an email can be deleted.
-	 * The function should return true if deletion is allowed, false otherwise.
-	 */
-	static registerCheck(check: DeletionCheck) {
-		this.checks.push(check);
-	}
-
-	/**
-	 * Verifies if an email can be deleted by running all registered checks.
-	 * If ANY check returns false, deletion is blocked.
-	 */
-	static async canDelete(emailId: string): Promise<boolean> {
-		for (const check of this.checks) {
-			try {
-				const allowed = await check(emailId);
-				if (!allowed) {
-					logger.info(`Deletion blocked by retention check for email ${emailId}`);
-					return false;
-				}
-			} catch (error) {
-				logger.error(`Error in retention check for email ${emailId}:`, error);
-				// Fail safe: if a check errors, assume we CANNOT delete to be safe
-				return false;
-			}
-		}
-		return true;
-	}
-}

packages/backend/src/index.ts

@@ -1,12 +1,155 @@
-export { createServer, ArchiverModule } from './api/server';
-export { logger } from './config/logger';
-export { config } from './config';
-export * from './services/AuthService';
-export * from './services/AuditService';
-export * from './api/middleware/requireAuth';
-export * from './api/middleware/requirePermission';
-export { db } from './database';
-export * from './database/schema';
-export { AuditService } from './services/AuditService';
-export * from './config'
-export * from './jobs/queues'
+import express from 'express';
+import dotenv from 'dotenv';
+import { AuthController } from './api/controllers/auth.controller';
+import { IngestionController } from './api/controllers/ingestion.controller';
+import { ArchivedEmailController } from './api/controllers/archived-email.controller';
+import { StorageController } from './api/controllers/storage.controller';
+import { SearchController } from './api/controllers/search.controller';
+import { IamController } from './api/controllers/iam.controller';
+import { requireAuth } from './api/middleware/requireAuth';
+import { createAuthRouter } from './api/routes/auth.routes';
+import { createIamRouter } from './api/routes/iam.routes';
+import { createIngestionRouter } from './api/routes/ingestion.routes';
+import { createArchivedEmailRouter } from './api/routes/archived-email.routes';
+import { createStorageRouter } from './api/routes/storage.routes';
+import { createSearchRouter } from './api/routes/search.routes';
+import { createDashboardRouter } from './api/routes/dashboard.routes';
+import { createUploadRouter } from './api/routes/upload.routes';
+import { createUserRouter } from './api/routes/user.routes';
+import { createSettingsRouter } from './api/routes/settings.routes';
+import { apiKeyRoutes } from './api/routes/api-key.routes';
+import { AuthService } from './services/AuthService';
+import { UserService } from './services/UserService';
+import { IamService } from './services/IamService';
+import { StorageService } from './services/StorageService';
+import { SearchService } from './services/SearchService';
+import { SettingsService } from './services/SettingsService';
+import i18next from 'i18next';
+import FsBackend from 'i18next-fs-backend';
+import i18nextMiddleware from 'i18next-http-middleware';
+import path from 'path';
+import { logger } from './config/logger';
+import { rateLimiter } from './api/middleware/rateLimiter';
+
+// Load environment variables
+dotenv.config();
+
+// --- Environment Variable Validation ---
+const { PORT_BACKEND, JWT_SECRET, JWT_EXPIRES_IN } = process.env;
+
+if (!PORT_BACKEND || !JWT_SECRET || !JWT_EXPIRES_IN) {
+	throw new Error(
+		'Missing required environment variables for the backend: PORT_BACKEND, JWT_SECRET, JWT_EXPIRES_IN.'
+	);
+}
+
+// --- i18next Initialization ---
+const initializeI18next = async () => {
+	const systemSettings = await settingsService.getSystemSettings();
+	const defaultLanguage = systemSettings?.language || 'en';
+	logger.info({ language: defaultLanguage }, 'Default language');
+	await i18next.use(FsBackend).init({
+		lng: defaultLanguage,
+		fallbackLng: defaultLanguage,
+		ns: ['translation'],
+		defaultNS: 'translation',
+		backend: {
+			loadPath: path.resolve(__dirname, './locales/{{lng}}/{{ns}}.json'),
+		},
+	});
+};
+
+// --- Dependency Injection Setup ---
+
+const userService = new UserService();
+const authService = new AuthService(userService, JWT_SECRET, JWT_EXPIRES_IN);
+const authController = new AuthController(authService, userService);
+const ingestionController = new IngestionController();
+const archivedEmailController = new ArchivedEmailController();
+const storageService = new StorageService();
+const storageController = new StorageController(storageService);
+const searchService = new SearchService();
+const searchController = new SearchController();
+const iamService = new IamService();
+const iamController = new IamController(iamService);
+const settingsService = new SettingsService();
+
+// --- Express App Initialization ---
+const app = express();
+
+// --- Routes ---
+const authRouter = createAuthRouter(authController);
+const ingestionRouter = createIngestionRouter(ingestionController, authService);
+const archivedEmailRouter = createArchivedEmailRouter(archivedEmailController, authService);
+const storageRouter = createStorageRouter(storageController, authService);
+const searchRouter = createSearchRouter(searchController, authService);
+const dashboardRouter = createDashboardRouter(authService);
+const iamRouter = createIamRouter(iamController, authService);
+const uploadRouter = createUploadRouter(authService);
+const userRouter = createUserRouter(authService);
+const settingsRouter = createSettingsRouter(authService);
+const apiKeyRouter = apiKeyRoutes(authService);
+// upload route is added before middleware because it doesn't use the json middleware.
+app.use('/v1/upload', uploadRouter);
+
+// Middleware for all other routes
+app.use((req, res, next) => {
+	// exclude certain API endpoints from the rate limiter, for example status, system settings
+	const excludedPatterns = [/^\/v\d+\/auth\/status$/, /^\/v\d+\/settings\/system$/];
+	for (const pattern of excludedPatterns) {
+		if (pattern.test(req.path)) {
+			return next();
+		}
+	}
+	rateLimiter(req, res, next);
+});
+app.use(express.json());
+app.use(express.urlencoded({ extended: true }));
+
+// i18n middleware
+app.use(i18nextMiddleware.handle(i18next));
+
+app.use('/v1/auth', authRouter);
+app.use('/v1/iam', iamRouter);
+app.use('/v1/ingestion-sources', ingestionRouter);
+app.use('/v1/archived-emails', archivedEmailRouter);
+app.use('/v1/storage', storageRouter);
+app.use('/v1/search', searchRouter);
+app.use('/v1/dashboard', dashboardRouter);
+app.use('/v1/users', userRouter);
+app.use('/v1/settings', settingsRouter);
+app.use('/v1/api-keys', apiKeyRouter);
+
+// Example of a protected route
+app.get('/v1/protected', requireAuth(authService), (req, res) => {
+	res.json({
+		message: 'You have accessed a protected route!',
+		user: req.user, // The user payload is attached by the requireAuth middleware
+	});
+});
+
+app.get('/', (req, res) => {
+	res.send('Backend is running!');
+});
+
+// --- Server Start ---
+const startServer = async () => {
+	try {
+		// Initialize i18next
+		await initializeI18next();
+		logger.info({}, 'i18next initialized');
+
+		// Configure the Meilisearch index on startup
+		logger.info({}, 'Configuring email index...');
+		await searchService.configureEmailIndex();
+
+		app.listen(PORT_BACKEND, () => {
+			logger.info({}, `Backend listening at http://localhost:${PORT_BACKEND}`);
+		});
+	} catch (error) {
+		logger.error({ error }, 'Failed to start the server:', error);
+		process.exit(1);
+	}
+};
+
+startServer();

packages/backend/src/jobs/processors/index-email.processor.ts

@@ -3,15 +3,14 @@ import { IndexingService } from '../../services/IndexingService';
 import { SearchService } from '../../services/SearchService';
 import { StorageService } from '../../services/StorageService';
 import { DatabaseService } from '../../services/DatabaseService';
-import { PendingEmail } from '@open-archiver/types';
 
 const searchService = new SearchService();
 const storageService = new StorageService();
 const databaseService = new DatabaseService();
 const indexingService = new IndexingService(databaseService, searchService, storageService);
 
-export default async function (job: Job<{ emails: PendingEmail[] }>) {
-	const { emails } = job.data;
-	console.log(`Indexing email batch with ${emails.length} emails`);
-	await indexingService.indexEmailBatch(emails);
+export default async function (job: Job<{ emailId: string }>) {
+	const { emailId } = job.data;
+	console.log(`Indexing email with ID: ${emailId}`);
+	await indexingService.indexEmailById(emailId);
 }

packages/backend/src/jobs/processors/process-mailbox.processor.ts

@@ -1,19 +1,9 @@
 import { Job } from 'bullmq';
-import {
-	IProcessMailboxJob,
-	SyncState,
-	ProcessMailboxError,
-	PendingEmail,
-} from '@open-archiver/types';
+import { IProcessMailboxJob, SyncState, ProcessMailboxError } from '@open-archiver/types';
 import { IngestionService } from '../../services/IngestionService';
 import { logger } from '../../config/logger';
 import { EmailProviderFactory } from '../../services/EmailProviderFactory';
 import { StorageService } from '../../services/StorageService';
-import { IndexingService } from '../../services/IndexingService';
-import { SearchService } from '../../services/SearchService';
-import { DatabaseService } from '../../services/DatabaseService';
-import { config } from '../../config';
-import { indexingQueue } from '../queues';
 
 /**
  * This processor handles the ingestion of emails for a single user's mailbox.
@@ -25,15 +15,9 @@ import { indexingQueue } from '../queues';
  */
 export const processMailboxProcessor = async (job: Job<IProcessMailboxJob, SyncState, string>) => {
 	const { ingestionSourceId, userEmail } = job.data;
-	const BATCH_SIZE: number = config.meili.indexingBatchSize;
-	let emailBatch: PendingEmail[] = [];
 
 	logger.info({ ingestionSourceId, userEmail }, `Processing mailbox for user`);
 
-	const searchService = new SearchService();
-	const storageService = new StorageService();
-	const databaseService = new DatabaseService();
-
 	try {
 		const source = await IngestionService.findById(ingestionSourceId);
 		if (!source) {
@@ -42,48 +26,22 @@ export const processMailboxProcessor = async (job: Job<IProcessMailboxJob, SyncS
 
 		const connector = EmailProviderFactory.createConnector(source);
 		const ingestionService = new IngestionService();
+		const storageService = new StorageService();
 
-		// Create a callback to check for duplicates without fetching full email content
-		const checkDuplicate = async (messageId: string) => {
-			return await IngestionService.doesEmailExist(messageId, ingestionSourceId);
-		};
-
-		for await (const email of connector.fetchEmails(
-			userEmail,
-			source.syncState,
-			checkDuplicate
-		)) {
+		// Pass the sync state for the entire source, the connector will handle per-user logic if necessary
+		for await (const email of connector.fetchEmails(userEmail, source.syncState)) {
 			if (email) {
-				const processedEmail = await ingestionService.processEmail(
-					email,
-					source,
-					storageService,
-					userEmail
-				);
-				if (processedEmail) {
-					emailBatch.push(processedEmail);
-					if (emailBatch.length >= BATCH_SIZE) {
-						await indexingQueue.add('index-email-batch', { emails: emailBatch });
-						emailBatch = [];
-					}
-				}
+				await ingestionService.processEmail(email, source, storageService, userEmail);
 			}
 		}
 
-		if (emailBatch.length > 0) {
-			await indexingQueue.add('index-email-batch', { emails: emailBatch });
-			emailBatch = [];
-		}
-
 		const newSyncState = connector.getUpdatedSyncState(userEmail);
+
 		logger.info({ ingestionSourceId, userEmail }, `Finished processing mailbox for user`);
+
+		// Return the new sync state to be aggregated by the parent flow
 		return newSyncState;
 	} catch (error) {
-		if (emailBatch.length > 0) {
-			await indexingQueue.add('index-email-batch', { emails: emailBatch });
-			emailBatch = [];
-		}
-
 		logger.error({ err: error, ingestionSourceId, userEmail }, 'Error processing mailbox');
 		const errorMessage = error instanceof Error ? error.message : 'An unknown error occurred';
 		const processMailboxError: ProcessMailboxError = {

packages/backend/src/jobs/processors/sync-cycle-finished.processor.ts

@@ -51,7 +51,7 @@ export default async (job: Job<ISyncCycleFinishedJob, any, string>) => {
 
 		const finalSyncState = deepmerge(
 			...successfulJobs.filter((s) => s && Object.keys(s).length > 0)
-		) as SyncState;
+		);
 
 		const source = await IngestionService.findById(ingestionSourceId);
 		let status: IngestionStatus = 'active';
@@ -63,9 +63,7 @@ export default async (job: Job<ISyncCycleFinishedJob, any, string>) => {
 		let message: string;
 
 		// Check for a specific rate-limit message from the successful jobs
-		const rateLimitMessage = successfulJobs.find(
-			(j) => j.statusMessage && j.statusMessage.includes('rate limit')
-		)?.statusMessage;
+		const rateLimitMessage = successfulJobs.find((j) => j.statusMessage)?.statusMessage;
 
 		if (failedJobs.length > 0) {
 			status = 'error';

packages/backend/src/jobs/queues.ts

@@ -27,9 +27,3 @@ export const indexingQueue = new Queue('indexing', {
 	connection,
 	defaultJobOptions,
 });
-
-// Queue for the Data Lifecycle Manager (retention policy enforcement)
-export const complianceLifecycleQueue = new Queue('compliance-lifecycle', {
-	connection,
-	defaultJobOptions,
-});

packages/backend/src/jobs/schedulers/sync-scheduler.ts

@@ -8,7 +8,6 @@ const scheduleContinuousSync = async () => {
 		'schedule-continuous-sync',
 		{},
 		{
-			jobId: 'schedule-continuous-sync',
 			repeat: {
 				pattern: config.app.syncFrequency,
 			},

packages/backend/src/locales/bg/translation.json

@@ -1,69 +0,0 @@
-{
-	"auth": {
-		"setup": {
-			"allFieldsRequired": "Изискват се поща, парола и име",
-			"alreadyCompleted": "Настройката вече е завършена."
-		},
-		"login": {
-			"emailAndPasswordRequired": "Изискват се поща и парола",
-			"invalidCredentials": "Невалидни идентификационни данни"
-		}
-	},
-	"errors": {
-		"internalServerError": "Възникна вътрешна грешка в сървъра",
-		"demoMode": "Тази операция не е разрешена в демо режим",
-		"unauthorized": "Неоторизирано",
-		"unknown": "Възникна неизвестна грешка",
-		"noPermissionToAction": "Нямате разрешение да извършите текущото действие."
-	},
-	"user": {
-		"notFound": "Потребителят не е открит",
-		"cannotDeleteOnlyUser": "Опитвате се да изтриете единствения потребител в базата данни, това не е позволено.",
-		"requiresSuperAdminRole": "За управление на потребители е необходима роля на супер администратор."
-	},
-	"iam": {
-		"failedToGetRoles": "Неуспешно получаване на роли.",
-		"roleNotFound": "Ролята не е намерена.",
-		"failedToGetRole": "Неуспешно получаване на роля.",
-		"missingRoleFields": "Липсват задължителни полета: име и политика.",
-		"invalidPolicy": "Невалидно твърдение за политика:",
-		"failedToCreateRole": "Създаването на роля неуспешно.",
-		"failedToDeleteRole": "Изтриването на роля неуспешно.",
-		"missingUpdateFields": "Липсват полета за актуализиране: име или политики.",
-		"failedToUpdateRole": "Актуализирането на ролята неуспешно.",
-		"requiresSuperAdminRole": "За управление на роли е необходима роля на супер администратор."
-	},
-	"settings": {
-		"failedToRetrieve": "Неуспешно извличане на настройките",
-		"failedToUpdate": "Неуспешно актуализиране на настройките",
-		"noPermissionToUpdate": "Нямате разрешение да актуализирате системните настройки."
-	},
-	"dashboard": {
-		"permissionRequired": "Необходимо ви е разрешение за четене на таблото, за да видите данните от него."
-	},
-	"ingestion": {
-		"failedToCreate": "Създаването на източник за приемане не бе успешно поради грешка при свързване.",
-		"notFound": "Източникът за приемане не е намерен",
-		"initialImportTriggered": "Първоначалният импорт е задействан успешно.",
-		"forceSyncTriggered": "Принудителното синхронизиране е задействано успешно."
-	},
-	"archivedEmail": {
-		"notFound": "Архивираната поща не е намерена"
-	},
-	"search": {
-		"keywordsRequired": "Ключовите думи са задължителни"
-	},
-	"storage": {
-		"filePathRequired": "Пътят към файла е задължителен",
-		"invalidFilePath": "Невалиден път към файла",
-		"fileNotFound": "Файлът не е намерен",
-		"downloadError": "Грешка при изтегляне на файла"
-	},
-	"apiKeys": {
-		"generateSuccess": "API ключът е генериран успешно.",
-		"deleteSuccess": "API ключът е успешно изтрит."
-	},
-	"api": {
-		"requestBodyInvalid": "Невалидно съдържание на заявката."
-	}
-}

packages/backend/src/locales/de/translation.json

@@ -14,8 +14,7 @@
 		"demoMode": "Dieser Vorgang ist im Demo-Modus nicht zulässig.",
 		"unauthorized": "Unbefugt",
 		"unknown": "Ein unbekannter Fehler ist aufgetreten",
-		"noPermissionToAction": "Sie haben keine Berechtigung, die aktuelle Aktion auszuführen.",
-		"deletion_disabled": "Das Löschen ist für diese Instanz deaktiviert."
+		"noPermissionToAction": "Sie haben keine Berechtigung, die aktuelle Aktion auszuführen."
 	},
 	"user": {
 		"notFound": "Benutzer nicht gefunden",

packages/backend/src/locales/en/translation.json

@@ -14,8 +14,7 @@
 		"demoMode": "This operation is not allowed in demo mode.",
 		"unauthorized": "Unauthorized",
 		"unknown": "An unknown error occurred",
-		"noPermissionToAction": "You don't have the permission to perform the current action.",
-		"deletion_disabled": "Deletion is disabled for this instance."
+		"noPermissionToAction": "You don't have the permission to perform the current action."
 	},
 	"user": {
 		"notFound": "User not found",

packages/backend/src/services/ApiKeyService.ts

@@ -3,47 +3,28 @@ import { db } from '../database';
 import { apiKeys } from '../database/schema/api-keys';
 import { CryptoService } from './CryptoService';
 import { and, eq } from 'drizzle-orm';
-import { ApiKey, User } from '@open-archiver/types';
-import { AuditService } from './AuditService';
+import { ApiKey } from '@open-archiver/types';
 
 export class ApiKeyService {
-	private static auditService = new AuditService();
 	public static async generate(
 		userId: string,
 		name: string,
-		expiresInDays: number,
-		actor: User,
-		actorIp: string
+		expiresInDays: number
 	): Promise<string> {
 		const key = randomBytes(32).toString('hex');
 		const expiresAt = new Date();
 		expiresAt.setDate(expiresAt.getDate() + expiresInDays);
 		const keyHash = createHash('sha256').update(key).digest('hex');
 
-		try {
-			await db.insert(apiKeys).values({
-				userId,
-				name,
-				key: CryptoService.encrypt(key),
-				keyHash,
-				expiresAt,
-			});
-
-			await this.auditService.createAuditLog({
-				actorIdentifier: actor.id,
-			actionType: 'GENERATE',
-			targetType: 'ApiKey',
-			targetId: name,
-			actorIp,
-			details: {
-				keyName: name,
-			},
+		await db.insert(apiKeys).values({
+			userId,
+			name,
+			key: CryptoService.encrypt(key),
+			keyHash,
+			expiresAt,
 		});
 
 		return key;
-		} catch (error) {
-			throw error;
-		}
 	}
 
 	public static async getKeys(userId: string): Promise<ApiKey[]> {
@@ -65,19 +46,8 @@ export class ApiKeyService {
 			.filter((k): k is NonNullable<typeof k> => k !== null);
 	}
 
-	public static async deleteKey(id: string, userId: string, actor: User, actorIp: string) {
-		const [key] = await db.select().from(apiKeys).where(eq(apiKeys.id, id));
+	public static async deleteKey(id: string, userId: string) {
 		await db.delete(apiKeys).where(and(eq(apiKeys.id, id), eq(apiKeys.userId, userId)));
-		await this.auditService.createAuditLog({
-			actorIdentifier: actor.id,
-			actionType: 'DELETE',
-			targetType: 'ApiKey',
-			targetId: id,
-			actorIp,
-			details: {
-				keyName: key?.name,
-			},
-		});
 	}
 	/**
 	 *

packages/backend/src/services/ArchivedEmailService.ts

@@ -17,10 +17,6 @@ import type {
 import { StorageService } from './StorageService';
 import { SearchService } from './SearchService';
 import type { Readable } from 'stream';
-import { AuditService } from './AuditService';
-import { User } from '@open-archiver/types';
-import { checkDeletionEnabled } from '../helpers/deletionGuard';
-import { RetentionHook } from '../hooks/RetentionHook';
 
 interface DbRecipients {
 	to: { name: string; address: string }[];
@@ -38,7 +34,6 @@ async function streamToBuffer(stream: Readable): Promise<Buffer> {
 }
 
 export class ArchivedEmailService {
-	private static auditService = new AuditService();
 	private static mapRecipients(dbRecipients: unknown): Recipient[] {
 		const { to = [], cc = [], bcc = [] } = dbRecipients as DbRecipients;
 
@@ -103,9 +98,7 @@ export class ArchivedEmailService {
 
 	public static async getArchivedEmailById(
 		emailId: string,
-		userId: string,
-		actor: User,
-		actorIp: string
+		userId: string
 	): Promise<ArchivedEmail | null> {
 		const email = await db.query.archivedEmails.findFirst({
 			where: eq(archivedEmails.id, emailId),
@@ -125,15 +118,6 @@ export class ArchivedEmailService {
 			return null;
 		}
 
-		await this.auditService.createAuditLog({
-			actorIdentifier: actor.id,
-			actionType: 'READ',
-			targetType: 'ArchivedEmail',
-			targetId: emailId,
-			actorIp,
-			details: {},
-		});
-
 		let threadEmails: ThreadEmail[] = [];
 
 		if (email.threadId) {
@@ -195,25 +179,7 @@ export class ArchivedEmailService {
 		return mappedEmail;
 	}
 
-	public static async deleteArchivedEmail(
-		emailId: string,
-		actor: User,
-		actorIp: string,
-		options: {
-			systemDelete?: boolean;
-			/**
-			 * Human-readable name of the retention rule that triggered deletion
-			 */
-			governingRule?: string;
-		} = {}
-	): Promise<void> {
-		checkDeletionEnabled({ allowSystemDelete: options.systemDelete });
-
-		const canDelete = await RetentionHook.canDelete(emailId);
-		if (!canDelete) {
-			throw new Error('Deletion blocked by retention policy (Legal Hold or similar).');
-		}
-
+	public static async deleteArchivedEmail(emailId: string): Promise<void> {
 		const [email] = await db
 			.select()
 			.from(archivedEmails)
@@ -227,7 +193,7 @@ export class ArchivedEmailService {
 
 		// Load and handle attachments before deleting the email itself
 		if (email.hasAttachments) {
-			const attachmentsForEmail = await db
+			const emailAttachmentsResult = await db
 				.select({
 					attachmentId: attachments.id,
 					storagePath: attachments.storagePath,
@@ -237,33 +203,37 @@ export class ArchivedEmailService {
 				.where(eq(emailAttachments.emailId, emailId));
 
 			try {
-				for (const attachment of attachmentsForEmail) {
-					// Delete the link between this email and the attachment record.
-					await db
-						.delete(emailAttachments)
-						.where(
-							and(
-								eq(emailAttachments.emailId, emailId),
-								eq(emailAttachments.attachmentId, attachment.attachmentId)
-							)
-						);
-
-					// Check if any other emails are linked to this attachment record.
-					const [recordRefCount] = await db
-						.select({ count: count() })
+				for (const attachment of emailAttachmentsResult) {
+					const [refCount] = await db
+						.select({ count: count(emailAttachments.emailId) })
 						.from(emailAttachments)
 						.where(eq(emailAttachments.attachmentId, attachment.attachmentId));
 
-					// If no other emails are linked to this record, it's safe to delete it and the file.
-					if (recordRefCount.count === 0) {
+					if (refCount.count === 1) {
 						await storage.delete(attachment.storagePath);
+						await db
+							.delete(emailAttachments)
+							.where(
+								and(
+									eq(emailAttachments.emailId, emailId),
+									eq(emailAttachments.attachmentId, attachment.attachmentId)
+								)
+							);
 						await db
 							.delete(attachments)
 							.where(eq(attachments.id, attachment.attachmentId));
+					} else {
+						await db
+							.delete(emailAttachments)
+							.where(
+								and(
+									eq(emailAttachments.emailId, emailId),
+									eq(emailAttachments.attachmentId, attachment.attachmentId)
+								)
+							);
 					}
 				}
-			} catch (error) {
-				console.error('Failed to delete email attachments', error);
+			} catch {
 				throw new Error('Failed to delete email attachments');
 			}
 		}
@@ -275,23 +245,5 @@ export class ArchivedEmailService {
 		await searchService.deleteDocuments('emails', [emailId]);
 
 		await db.delete(archivedEmails).where(eq(archivedEmails.id, emailId));
-
-		// Build audit details: system-initiated deletions carry retention context
-		// for GoBD compliance; manual deletions record only the reason.
-		const auditDetails: Record<string, unknown> = {
-			reason: options.systemDelete ? 'RetentionExpiration' : 'ManualDeletion',
-		};
-		if (options.systemDelete && options.governingRule) {
-			auditDetails.governingRule = options.governingRule;
-		}
-
-		await this.auditService.createAuditLog({
-			actorIdentifier: actor.id,
-			actionType: 'DELETE',
-			targetType: 'ArchivedEmail',
-			targetId: emailId,
-			actorIp,
-			details: auditDetails,
-		});
 	}
 }