FEATURE (workspaces): Add workspaces with users management and global Postgresus settings

fix: typo redirecting to contribute/README.me

.github/workflows/ci-release.yml

@@ -138,6 +138,9 @@ jobs:
           TEST_MINIO_CONSOLE_PORT=9001
           # testing NAS
           TEST_NAS_PORT=7006
+          # testing Telegram
+          TEST_TELEGRAM_BOT_TOKEN=${{ secrets.TEST_TELEGRAM_BOT_TOKEN }}
+          TEST_TELEGRAM_CHAT_ID=${{ secrets.TEST_TELEGRAM_CHAT_ID }}
           EOF
 
       - name: Start test containers

.pre-commit-config.yaml

@@ -0,0 +1,29 @@
+# Pre-commit configuration
+# See https://pre-commit.com for more information
+repos:
+  # Frontend checks
+  - repo: local
+    hooks:
+      - id: frontend-format
+        name: Frontend Format (Prettier)
+        entry: powershell -Command "cd frontend; npm run format"
+        language: system
+        files: ^frontend/.*\.(ts|tsx|js|jsx|json|css|md)$
+        pass_filenames: false
+
+      - id: frontend-lint
+        name: Frontend Lint (ESLint)
+        entry: powershell -Command "cd frontend; npm run lint"
+        language: system
+        files: ^frontend/.*\.(ts|tsx|js|jsx)$
+        pass_filenames: false
+
+  # Backend checks
+  - repo: local
+    hooks:
+      - id: backend-format-and-lint
+        name: Backend Format & Lint (golangci-lint)
+        entry: powershell -Command "cd backend; golangci-lint fmt; golangci-lint run"
+        language: system
+        files: ^backend/.*\.go$
+        pass_filenames: false

LICENSE

@@ -1,21 +1,202 @@
-MIT License
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
 
-Copyright (c) 2025 Postgresus
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+   1. Definitions.
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+      "Licensor" shall mean the copyright owner or entity granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (which shall not include communications that are solely written
+      by You).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based upon (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and derivative works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control
+      systems, and issue tracking systems that are managed by, or on behalf
+      of, the Licensor for the purpose of discussing and improving the Work,
+      but excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to use, reproduce, modify, distribute, prepare
+      Derivative Works of, and publicly display, publicly perform,
+      sublicense, and distribute the Work and such Derivative Works in
+      Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright notice to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. When redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "license" line as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2025 Postgresus
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

README.md

@@ -5,11 +5,11 @@
   <p>Free, open source and self-hosted solution for automated PostgreSQL backups. With multiple storage options and notifications</p>
   
   <!-- Badges -->
-  [![MIT License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+  [![Apache 2.0 License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
   [![Docker Pulls](https://img.shields.io/docker/pulls/rostislavdugin/postgresus?color=brightgreen)](https://hub.docker.com/r/rostislavdugin/postgresus)
   [![Platform](https://img.shields.io/badge/platform-linux%20%7C%20macos%20%7C%20windows-lightgrey)](https://github.com/RostislavDugin/postgresus)
   
-  [![PostgreSQL](https://img.shields.io/badge/PostgreSQL-13%20%7C%2014%20%7C%2015%20%7C%2016%20%7C%2017-336791?logo=postgresql&logoColor=white)](https://www.postgresql.org/)
+  [![PostgreSQL](https://img.shields.io/badge/PostgreSQL-13%20%7C%2014%20%7C%2015%20%7C%2016%20%7C%2017%20%7C%2018-336791?logo=postgresql&logoColor=white)](https://www.postgresql.org/)
   [![Self Hosted](https://img.shields.io/badge/self--hosted-yes-brightgreen)](https://github.com/RostislavDugin/postgresus)
   [![Open Source](https://img.shields.io/badge/open%20source-❤️-red)](https://github.com/RostislavDugin/postgresus)
   
@@ -62,7 +62,7 @@
 
 - **Docker-based**: Easy deployment and management
 - **Privacy-first**: All your data stays on your infrastructure
-- **Open source**: MIT licensed, inspect every line of code
+- **Open source**: Apache 2.0 licensed, inspect every line of code
 
 ### 📦 Installation
 
@@ -154,17 +154,19 @@ docker compose up -d
 If you need to reset the admin password, you can use the built-in password reset command:
 
 ```bash
-docker exec -it postgresus ./main --new-password="YourNewSecurePassword123"
+docker exec -it postgresus ./main --new-password="YourNewSecurePassword123" --email="admin"
 ```
 
+Replace `admin` with the actual email address of the user whose password you want to reset.
+
 ---
 
 ## 📝 License
 
-This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
+This project is licensed under the Apache 2.0 License - see the [LICENSE](LICENSE) file for details.
 
 ---
 
 ## 🤝 Contributing
 
-Contributions are welcome! Read [contributing guide](contribute/readme.md) for more details, prioerities and rules are specified there. If you want to contribute, but don't know what and how - message me on Telegram [@rostislav_dugin](https://t.me/rostislav_dugin)
+Contributions are welcome! Read [contributing guide](contribute/README.md) for more details, prioerities and rules are specified there. If you want to contribute, but don't know what and how - message me on Telegram [@rostislav_dugin](https://t.me/rostislav_dugin)

backend/.cursor/rules/codestyle-rule.mdc

@@ -1,14 +1,152 @@
 ---
-description: 
-globs: 
+description:
+globs:
 alwaysApply: true
 ---
+
 Always place private methods to the bottom of file
 
-Code should look like:
+**This rule applies to ALL Go files including tests, services, controllers, repositories, etc.**
 
-type SomeService struct {
-    func PublicMethod(...) ...
+In Go, exported (public) functions/methods start with uppercase letters, while unexported (private) ones start with lowercase letters.
 
-    func privateMethod(...) ...
-}
+## Structure Order:
+
+1. Type definitions and constants
+2. Public methods/functions (uppercase)
+3. Private methods/functions (lowercase)
+
+## Examples:
+
+### Service with methods:
+
+```go
+type UserService struct {
+    repository *UserRepository
+}
+
+// Public methods first
+func (s *UserService) CreateUser(user *User) error {
+    if err := s.validateUser(user); err != nil {
+        return err
+    }
+    return s.repository.Save(user)
+}
+
+func (s *UserService) GetUser(id uuid.UUID) (*User, error) {
+    return s.repository.FindByID(id)
+}
+
+// Private methods at the bottom
+func (s *UserService) validateUser(user *User) error {
+    if user.Name == "" {
+        return errors.New("name is required")
+    }
+    return nil
+}
+```
+
+### Package-level functions:
+
+```go
+package utils
+
+// Public functions first
+func ProcessData(data []byte) (Result, error) {
+    cleaned := sanitizeInput(data)
+    return parseData(cleaned)
+}
+
+func ValidateInput(input string) bool {
+    return isValidFormat(input) && checkLength(input)
+}
+
+// Private functions at the bottom
+func sanitizeInput(data []byte) []byte {
+    // implementation
+}
+
+func parseData(data []byte) (Result, error) {
+    // implementation
+}
+
+func isValidFormat(input string) bool {
+    // implementation
+}
+
+func checkLength(input string) bool {
+    // implementation
+}
+```
+
+### Test files:
+
+```go
+package user_test
+
+// Public test functions first
+func Test_CreateUser_ValidInput_UserCreated(t *testing.T) {
+    user := createTestUser()
+    result, err := service.CreateUser(user)
+
+    assert.NoError(t, err)
+    assert.NotNil(t, result)
+}
+
+func Test_GetUser_ExistingUser_ReturnsUser(t *testing.T) {
+    user := createTestUser()
+    // test implementation
+}
+
+// Private helper functions at the bottom
+func createTestUser() *User {
+    return &User{
+        Name:  "Test User",
+        Email: "test@example.com",
+    }
+}
+
+func setupTestDatabase() *Database {
+    // setup implementation
+}
+```
+
+### Controller example:
+
+```go
+type ProjectController struct {
+    service *ProjectService
+}
+
+// Public HTTP handlers first
+func (c *ProjectController) CreateProject(ctx *gin.Context) {
+    var request CreateProjectRequest
+    if err := ctx.ShouldBindJSON(&request); err != nil {
+        c.handleError(ctx, err)
+        return
+    }
+    // handler logic
+}
+
+func (c *ProjectController) GetProject(ctx *gin.Context) {
+    projectID := c.extractProjectID(ctx)
+    // handler logic
+}
+
+// Private helper methods at the bottom
+func (c *ProjectController) handleError(ctx *gin.Context, err error) {
+    ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+}
+
+func (c *ProjectController) extractProjectID(ctx *gin.Context) uuid.UUID {
+    return uuid.MustParse(ctx.Param("projectId"))
+}
+```
+
+## Key Points:
+
+- **Exported/Public** = starts with uppercase letter (CreateUser, GetProject)
+- **Unexported/Private** = starts with lowercase letter (validateUser, handleError)
+- This improves code readability by showing the public API first
+- Private helpers are implementation details, so they go at the bottom
+- Apply this rule consistently across ALL Go files in the project

backend/.cursor/rules/comments.mdc

@@ -1,7 +1,45 @@
 ---
-description: 
-globs: 
+description:
+globs:
 alwaysApply: true
 ---
-Do not write obvious comments.
-Write meaningful code, give meaningful names
+
+## Comment Guidelines
+
+1. **No obvious comments** - Don't state what the code already clearly shows
+2. **Functions and variables should have meaningful names** - Code should be self-documenting
+3. **Comments for unclear code only** - Only add comments when code logic isn't immediately clear
+
+## Key Principles:
+
+- **Code should tell a story** - Use descriptive variable and function names
+- **Comments explain WHY, not WHAT** - The code shows what happens, comments explain business logic or complex decisions
+- **Prefer refactoring over commenting** - If code needs explaining, consider making it clearer instead
+- **API documentation is required** - Swagger comments for all HTTP endpoints are mandatory
+- **Complex algorithms deserve comments** - Mathematical formulas, business rules, or non-obvious optimizations
+
+Example of useless comment:
+
+1.
+
+```sql
+// Create projects table
+CREATE TABLE projects (
+    id                    UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    name                  TEXT NOT NULL,
+    created_at            TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+```
+
+2.
+
+```go
+// Create test project
+project := CreateTestProject(projectName, user, router)
+```
+
+3.
+
+```go
+// CreateValidLogItems creates valid log items for testing
+func CreateValidLogItems(count int, uniqueID string) []logs_receiving.LogItemRequestDTO {
+```

backend/.cursor/rules/controllers-rule.mdc

@@ -1,55 +1,133 @@
 ---
-description: 
-globs: 
+description:
+globs:
 alwaysApply: true
 ---
+
 1. When we write controller:
+
 - we combine all routes to single controller
 - names them as .WhatWeDo (not "handlers") concept
 
-2. We use gin and *gin.Context for all routes.
-Example:
+2. We use gin and \*gin.Context for all routes.
+   Example:
 
 func (c *TasksController) GetAvailableTasks(ctx *gin.Context) ...
 
 3. We document all routes with Swagger in the following format:
 
-// SignIn
-// @Summary Authenticate a user
-// @Description Authenticate a user with email and password
-// @Tags users
-// @Accept json
-// @Produce json
-// @Param request body SignInRequest true "User signin data"
-// @Success 200 {object} SignInResponse
-// @Failure 400
-// @Router /users/signin [post]
+package audit_logs
 
-Do not forget to write docs.
-You can avoid description if it is useless.
-Specify particular acceping \ producing models
+import (
+"net/http"
 
-4. All controllers should have RegisterRoutes method which receives
-RouterGroup (always put this routes on the top of file under controller definition)
+    user_models "postgresus/internal/features/users/models"
 
-Example:
+    "github.com/gin-gonic/gin"
+    "github.com/google/uuid"
 
-func (c *OrderController) RegisterRoutes(router *gin.RouterGroup) {
-	router.POST("/bots/users/orders/generate", c.GenerateOrder)
-	router.POST("/bots/users/orders/generate-by-admin", c.GenerateOrderByAdmin)
-	router.GET("/bots/users/orders/mark-as-paid-by-admin", c.MarkOrderAsPaidByAdmin)
-	router.GET("/bots/users/orders/payments-by-bot", c.GetOrderPaymentsByBot)
-	router.GET("/bots/users/orders/payments-by-user", c.GetOrderPaymentsByUser)
-	router.GET("/bots/users/orders/orders-by-user-for-admin", c.GetOrdersByUserForAdmin)
-	router.POST("/bots/users/orders/orders-by-user-for-user", c.GetOrdersByUserForUser)
-	router.POST("/bots/users/orders/order", c.GetOrder)
-	router.POST("/bots/users/orders/cancel-subscription-by-user", c.CancelSubscriptionByUser)
-	router.GET("/bots/users/orders/cancel-subscription-by-admin", c.CancelSubscriptionByAdmin)
-	router.GET(
-		"/bots/users/orders/cancel-subscriptions-by-payment-option",
-		c.CancelSubscriptionsByPaymentOption,
-	)
+)
+
+type AuditLogController struct {
+auditLogService \*AuditLogService
 }
 
-5. Check that use use valid .Query("param") and .Param("param") methods.
-If route does not have param - use .Query("query")
+func (c *AuditLogController) RegisterRoutes(router *gin.RouterGroup) {
+// All audit log endpoints require authentication (handled in main.go)
+auditRoutes := router.Group("/audit-logs")
+
+    auditRoutes.GET("/global", c.GetGlobalAuditLogs)
+    auditRoutes.GET("/users/:userId", c.GetUserAuditLogs)
+
+}
+
+// GetGlobalAuditLogs
+// @Summary Get global audit logs (ADMIN only)
+// @Description Retrieve all audit logs across the system
+// @Tags audit-logs
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param limit query int false "Limit number of results" default(100)
+// @Param offset query int false "Offset for pagination" default(0)
+// @Param beforeDate query string false "Filter logs created before this date (RFC3339 format)" format(date-time)
+// @Success 200 {object} GetAuditLogsResponse
+// @Failure 401 {object} map[string]string
+// @Failure 403 {object} map[string]string
+// @Router /audit-logs/global [get]
+func (c *AuditLogController) GetGlobalAuditLogs(ctx *gin.Context) {
+user, isOk := ctx.MustGet("user").(\*user_models.User)
+if !isOk {
+ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Invalid user type in context"})
+return
+}
+
+    request := &GetAuditLogsRequest{}
+    if err := ctx.ShouldBindQuery(request); err != nil {
+    	ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid query parameters"})
+    	return
+    }
+
+    response, err := c.auditLogService.GetGlobalAuditLogs(user, request)
+    if err != nil {
+    	if err.Error() == "only administrators can view global audit logs" {
+    		ctx.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+    		return
+    	}
+    	ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve audit logs"})
+    	return
+    }
+
+    ctx.JSON(http.StatusOK, response)
+
+}
+
+// GetUserAuditLogs
+// @Summary Get user audit logs
+// @Description Retrieve audit logs for a specific user
+// @Tags audit-logs
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param userId path string true "User ID"
+// @Param limit query int false "Limit number of results" default(100)
+// @Param offset query int false "Offset for pagination" default(0)
+// @Param beforeDate query string false "Filter logs created before this date (RFC3339 format)" format(date-time)
+// @Success 200 {object} GetAuditLogsResponse
+// @Failure 400 {object} map[string]string
+// @Failure 401 {object} map[string]string
+// @Failure 403 {object} map[string]string
+// @Router /audit-logs/users/{userId} [get]
+func (c *AuditLogController) GetUserAuditLogs(ctx *gin.Context) {
+user, isOk := ctx.MustGet("user").(\*user_models.User)
+if !isOk {
+ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Invalid user type in context"})
+return
+}
+
+    userIDStr := ctx.Param("userId")
+    targetUserID, err := uuid.Parse(userIDStr)
+    if err != nil {
+    	ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid user ID"})
+    	return
+    }
+
+    request := &GetAuditLogsRequest{}
+    if err := ctx.ShouldBindQuery(request); err != nil {
+    	ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid query parameters"})
+    	return
+    }
+
+    response, err := c.auditLogService.GetUserAuditLogs(targetUserID, user, request)
+    if err != nil {
+    	if err.Error() == "insufficient permissions to view user audit logs" {
+    		ctx.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+    		return
+    	}
+    	ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve audit logs"})
+    	return
+    }
+
+    ctx.JSON(http.StatusOK, response)
+
+}

backend/.cursor/rules/crud.mdc

@@ -0,0 +1,671 @@
+---
+alwaysApply: false
+---
+
+This is example of CRUD:
+
+------ backend/internal/features/audit_logs/controller.go ------
+
+```
+package audit_logs
+
+import (
+	"net/http"
+
+	user_models "postgresus/internal/features/users/models"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+type AuditLogController struct {
+	auditLogService *AuditLogService
+}
+
+func (c *AuditLogController) RegisterRoutes(router *gin.RouterGroup) {
+	// All audit log endpoints require authentication (handled in main.go)
+	auditRoutes := router.Group("/audit-logs")
+
+	auditRoutes.GET("/global", c.GetGlobalAuditLogs)
+	auditRoutes.GET("/users/:userId", c.GetUserAuditLogs)
+}
+
+// GetGlobalAuditLogs
+// @Summary Get global audit logs (ADMIN only)
+// @Description Retrieve all audit logs across the system
+// @Tags audit-logs
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param limit query int false "Limit number of results" default(100)
+// @Param offset query int false "Offset for pagination" default(0)
+// @Param beforeDate query string false "Filter logs created before this date (RFC3339 format)" format(date-time)
+// @Success 200 {object} GetAuditLogsResponse
+// @Failure 401 {object} map[string]string
+// @Failure 403 {object} map[string]string
+// @Router /audit-logs/global [get]
+func (c *AuditLogController) GetGlobalAuditLogs(ctx *gin.Context) {
+	user, isOk := ctx.MustGet("user").(*user_models.User)
+	if !isOk {
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Invalid user type in context"})
+		return
+	}
+
+	request := &GetAuditLogsRequest{}
+	if err := ctx.ShouldBindQuery(request); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid query parameters"})
+		return
+	}
+
+	response, err := c.auditLogService.GetGlobalAuditLogs(user, request)
+	if err != nil {
+		if err.Error() == "only administrators can view global audit logs" {
+			ctx.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+			return
+		}
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve audit logs"})
+		return
+	}
+
+	ctx.JSON(http.StatusOK, response)
+}
+
+// GetUserAuditLogs
+// @Summary Get user audit logs
+// @Description Retrieve audit logs for a specific user
+// @Tags audit-logs
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param userId path string true "User ID"
+// @Param limit query int false "Limit number of results" default(100)
+// @Param offset query int false "Offset for pagination" default(0)
+// @Param beforeDate query string false "Filter logs created before this date (RFC3339 format)" format(date-time)
+// @Success 200 {object} GetAuditLogsResponse
+// @Failure 400 {object} map[string]string
+// @Failure 401 {object} map[string]string
+// @Failure 403 {object} map[string]string
+// @Router /audit-logs/users/{userId} [get]
+func (c *AuditLogController) GetUserAuditLogs(ctx *gin.Context) {
+	user, isOk := ctx.MustGet("user").(*user_models.User)
+	if !isOk {
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Invalid user type in context"})
+		return
+	}
+
+	userIDStr := ctx.Param("userId")
+	targetUserID, err := uuid.Parse(userIDStr)
+	if err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid user ID"})
+		return
+	}
+
+	request := &GetAuditLogsRequest{}
+	if err := ctx.ShouldBindQuery(request); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid query parameters"})
+		return
+	}
+
+	response, err := c.auditLogService.GetUserAuditLogs(targetUserID, user, request)
+	if err != nil {
+		if err.Error() == "insufficient permissions to view user audit logs" {
+			ctx.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+			return
+		}
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve audit logs"})
+		return
+	}
+
+	ctx.JSON(http.StatusOK, response)
+}
+
+```
+
+------ backend/internal/features/audit_logs/controller_test.go ------
+
+```
+package audit_logs
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+	"time"
+
+	user_enums "postgresus/internal/features/users/enums"
+	users_middleware "postgresus/internal/features/users/middleware"
+	users_services "postgresus/internal/features/users/services"
+	users_testing "postgresus/internal/features/users/testing"
+	"postgresus/internal/storage"
+	test_utils "postgresus/internal/util/testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_GetGlobalAuditLogs_AdminSucceedsAndMemberGetsForbidden(t *testing.T) {
+	adminUser := users_testing.CreateTestUser(user_enums.UserRoleAdmin)
+	memberUser := users_testing.CreateTestUser(user_enums.UserRoleMember)
+	router := createRouter()
+	service := GetAuditLogService()
+	projectID := uuid.New()
+
+	// Create test logs
+	createAuditLog(service, "Test log with user", &adminUser.UserID, nil)
+	createAuditLog(service, "Test log with project", nil, &projectID)
+	createAuditLog(service, "Test log standalone", nil, nil)
+
+	// Test ADMIN can access global logs
+	var response GetAuditLogsResponse
+	test_utils.MakeGetRequestAndUnmarshal(t, router,
+		"/api/v1/audit-logs/global?limit=10", "Bearer "+adminUser.Token, http.StatusOK, &response)
+
+	assert.GreaterOrEqual(t, len(response.AuditLogs), 3)
+	assert.GreaterOrEqual(t, response.Total, int64(3))
+
+	messages := extractMessages(response.AuditLogs)
+	assert.Contains(t, messages, "Test log with user")
+	assert.Contains(t, messages, "Test log with project")
+	assert.Contains(t, messages, "Test log standalone")
+
+	// Test MEMBER cannot access global logs
+	resp := test_utils.MakeGetRequest(t, router, "/api/v1/audit-logs/global",
+		"Bearer "+memberUser.Token, http.StatusForbidden)
+	assert.Contains(t, string(resp.Body), "only administrators can view global audit logs")
+}
+
+func Test_GetUserAuditLogs_PermissionsEnforcedCorrectly(t *testing.T) {
+	adminUser := users_testing.CreateTestUser(user_enums.UserRoleAdmin)
+	user1 := users_testing.CreateTestUser(user_enums.UserRoleMember)
+	user2 := users_testing.CreateTestUser(user_enums.UserRoleMember)
+	router := createRouter()
+	service := GetAuditLogService()
+	projectID := uuid.New()
+
+	// Create test logs for different users
+	createAuditLog(service, "Test log user1 first", &user1.UserID, nil)
+	createAuditLog(service, "Test log user1 second", &user1.UserID, &projectID)
+	createAuditLog(service, "Test log user2 first", &user2.UserID, nil)
+	createAuditLog(service, "Test log user2 second", &user2.UserID, &projectID)
+	createAuditLog(service, "Test project log", nil, &projectID)
+
+	// Test ADMIN can view any user's logs
+	var user1Response GetAuditLogsResponse
+	test_utils.MakeGetRequestAndUnmarshal(t, router,
+		fmt.Sprintf("/api/v1/audit-logs/users/%s?limit=10", user1.UserID.String()),
+		"Bearer "+adminUser.Token, http.StatusOK, &user1Response)
+
+	assert.Equal(t, 2, len(user1Response.AuditLogs))
+	messages := extractMessages(user1Response.AuditLogs)
+	assert.Contains(t, messages, "Test log user1 first")
+	assert.Contains(t, messages, "Test log user1 second")
+
+	// Test user can view own logs
+	var ownLogsResponse GetAuditLogsResponse
+	test_utils.MakeGetRequestAndUnmarshal(t, router,
+		fmt.Sprintf("/api/v1/audit-logs/users/%s", user2.UserID.String()),
+		"Bearer "+user2.Token, http.StatusOK, &ownLogsResponse)
+	assert.Equal(t, 2, len(ownLogsResponse.AuditLogs))
+
+	// Test user cannot view other user's logs
+	resp := test_utils.MakeGetRequest(t, router,
+		fmt.Sprintf("/api/v1/audit-logs/users/%s", user1.UserID.String()),
+		"Bearer "+user2.Token, http.StatusForbidden)
+
+	assert.Contains(t, string(resp.Body), "insufficient permissions")
+}
+
+func Test_FilterAuditLogsByTime_ReturnsOnlyLogsBeforeDate(t *testing.T) {
+	adminUser := users_testing.CreateTestUser(user_enums.UserRoleAdmin)
+	router := createRouter()
+	service := GetAuditLogService()
+	db := storage.GetDb()
+	baseTime := time.Now().UTC()
+
+	// Create logs with different timestamps
+	createTimedLog(db, &adminUser.UserID, "Test old log", baseTime.Add(-2*time.Hour))
+	createTimedLog(db, &adminUser.UserID, "Test recent log", baseTime.Add(-30*time.Minute))
+	createAuditLog(service, "Test current log", &adminUser.UserID, nil)
+
+	// Test filtering - get logs before 1 hour ago
+	beforeTime := baseTime.Add(-1 * time.Hour)
+	var filteredResponse GetAuditLogsResponse
+	test_utils.MakeGetRequestAndUnmarshal(t, router,
+		fmt.Sprintf("/api/v1/audit-logs/global?beforeDate=%s", beforeTime.Format(time.RFC3339)),
+		"Bearer "+adminUser.Token, http.StatusOK, &filteredResponse)
+
+	// Verify only old log is returned
+	messages := extractMessages(filteredResponse.AuditLogs)
+	assert.Contains(t, messages, "Test old log")
+	assert.NotContains(t, messages, "Test recent log")
+	assert.NotContains(t, messages, "Test current log")
+
+	// Test without filter - should get all logs
+	var allResponse GetAuditLogsResponse
+	test_utils.MakeGetRequestAndUnmarshal(t, router, "/api/v1/audit-logs/global",
+		"Bearer "+adminUser.Token, http.StatusOK, &allResponse)
+	assert.GreaterOrEqual(t, len(allResponse.AuditLogs), 3)
+}
+
+func createRouter() *gin.Engine {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	SetupDependencies()
+
+	v1 := router.Group("/api/v1")
+	protected := v1.Group("").Use(users_middleware.AuthMiddleware(users_services.GetUserService()))
+	GetAuditLogController().RegisterRoutes(protected.(*gin.RouterGroup))
+
+	return router
+}
+
+```
+
+------ backend/internal/features/audit_logs/di.go ------
+
+```
+package audit_logs
+
+import (
+	users_services "postgresus/internal/features/users/services"
+	"postgresus/internal/util/logger"
+)
+
+var auditLogRepository = &AuditLogRepository{}
+var auditLogService = &AuditLogService{
+	auditLogRepository: auditLogRepository,
+	logger:             logger.GetLogger(),
+}
+var auditLogController = &AuditLogController{
+	auditLogService: auditLogService,
+}
+
+func GetAuditLogService() *AuditLogService {
+	return auditLogService
+}
+
+func GetAuditLogController() *AuditLogController {
+	return auditLogController
+}
+
+func SetupDependencies() {
+	users_services.GetUserService().SetAuditLogWriter(auditLogService)
+	users_services.GetSettingsService().SetAuditLogWriter(auditLogService)
+	users_services.GetManagementService().SetAuditLogWriter(auditLogService)
+}
+
+```
+
+------ backend/internal/features/audit_logs/dto.go ------
+
+```
+package audit_logs
+
+import "time"
+
+type GetAuditLogsRequest struct {
+	Limit      int        `form:"limit"      json:"limit"`
+	Offset     int        `form:"offset"     json:"offset"`
+	BeforeDate *time.Time `form:"beforeDate" json:"beforeDate"`
+}
+
+type GetAuditLogsResponse struct {
+	AuditLogs []*AuditLog `json:"auditLogs"`
+	Total     int64       `json:"total"`
+	Limit     int         `json:"limit"`
+	Offset    int         `json:"offset"`
+}
+
+```
+
+------ backend/internal/features/audit_logs/models.go ------
+
+```
+package audit_logs
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+type AuditLog struct {
+	ID        uuid.UUID  `json:"id"        gorm:"column:id"`
+	UserID    *uuid.UUID `json:"userId"    gorm:"column:user_id"`
+	ProjectID *uuid.UUID `json:"projectId" gorm:"column:project_id"`
+	Message   string     `json:"message"   gorm:"column:message"`
+	CreatedAt time.Time  `json:"createdAt" gorm:"column:created_at"`
+}
+
+func (AuditLog) TableName() string {
+	return "audit_logs"
+}
+
+```
+
+------ backend/internal/features/audit_logs/repository.go ------
+
+```
+package audit_logs
+
+import (
+	"postgresus/internal/storage"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+type AuditLogRepository struct{}
+
+func (r *AuditLogRepository) Create(auditLog *AuditLog) error {
+	if auditLog.ID == uuid.Nil {
+		auditLog.ID = uuid.New()
+	}
+
+	return storage.GetDb().Create(auditLog).Error
+}
+
+func (r *AuditLogRepository) GetGlobal(limit, offset int, beforeDate *time.Time) ([]*AuditLog, error) {
+	var auditLogs []*AuditLog
+
+	query := storage.GetDb().Order("created_at DESC")
+
+	if beforeDate != nil {
+		query = query.Where("created_at < ?", *beforeDate)
+	}
+
+	err := query.
+		Limit(limit).
+		Offset(offset).
+		Find(&auditLogs).Error
+
+	return auditLogs, err
+}
+
+func (r *AuditLogRepository) GetByUser(
+	userID uuid.UUID,
+	limit, offset int,
+	beforeDate *time.Time,
+) ([]*AuditLog, error) {
+	var auditLogs []*AuditLog
+
+	query := storage.GetDb().
+		Where("user_id = ?", userID).
+		Order("created_at DESC")
+
+	if beforeDate != nil {
+		query = query.Where("created_at < ?", *beforeDate)
+	}
+
+	err := query.
+		Limit(limit).
+		Offset(offset).
+		Find(&auditLogs).Error
+
+	return auditLogs, err
+}
+
+func (r *AuditLogRepository) GetByProject(
+	projectID uuid.UUID,
+	limit, offset int,
+	beforeDate *time.Time,
+) ([]*AuditLog, error) {
+	var auditLogs []*AuditLog
+
+	query := storage.GetDb().
+		Where("project_id = ?", projectID).
+		Order("created_at DESC")
+
+	if beforeDate != nil {
+		query = query.Where("created_at < ?", *beforeDate)
+	}
+
+	err := query.
+		Limit(limit).
+		Offset(offset).
+		Find(&auditLogs).Error
+
+	return auditLogs, err
+}
+
+func (r *AuditLogRepository) CountGlobal(beforeDate *time.Time) (int64, error) {
+	var count int64
+	query := storage.GetDb().Model(&AuditLog{})
+
+	if beforeDate != nil {
+		query = query.Where("created_at < ?", *beforeDate)
+	}
+
+	err := query.Count(&count).Error
+	return count, err
+}
+
+```
+
+------ backend/internal/features/audit_logs/service.go ------
+
+```
+package audit_logs
+
+import (
+	"errors"
+	"log/slog"
+	"time"
+
+	user_enums "postgresus/internal/features/users/enums"
+	user_models "postgresus/internal/features/users/models"
+
+	"github.com/google/uuid"
+)
+
+type AuditLogService struct {
+	auditLogRepository *AuditLogRepository
+	logger             *slog.Logger
+}
+
+func (s *AuditLogService) WriteAuditLog(
+	message string,
+	userID *uuid.UUID,
+	projectID *uuid.UUID,
+) {
+	auditLog := &AuditLog{
+		UserID:    userID,
+		ProjectID: projectID,
+		Message:   message,
+		CreatedAt: time.Now().UTC(),
+	}
+
+	err := s.auditLogRepository.Create(auditLog)
+	if err != nil {
+		s.logger.Error("failed to create audit log", "error", err)
+		return
+	}
+}
+
+func (s *AuditLogService) CreateAuditLog(auditLog *AuditLog) error {
+	return s.auditLogRepository.Create(auditLog)
+}
+
+func (s *AuditLogService) GetGlobalAuditLogs(
+	user *user_models.User,
+	request *GetAuditLogsRequest,
+) (*GetAuditLogsResponse, error) {
+	if user.Role != user_enums.UserRoleAdmin {
+		return nil, errors.New("only administrators can view global audit logs")
+	}
+
+	limit := request.Limit
+	if limit <= 0 || limit > 1000 {
+		limit = 100
+	}
+
+	offset := max(request.Offset, 0)
+
+	auditLogs, err := s.auditLogRepository.GetGlobal(limit, offset, request.BeforeDate)
+	if err != nil {
+		return nil, err
+	}
+
+	total, err := s.auditLogRepository.CountGlobal(request.BeforeDate)
+	if err != nil {
+		return nil, err
+	}
+
+	return &GetAuditLogsResponse{
+		AuditLogs: auditLogs,
+		Total:     total,
+		Limit:     limit,
+		Offset:    offset,
+	}, nil
+}
+
+func (s *AuditLogService) GetUserAuditLogs(
+	targetUserID uuid.UUID,
+	user *user_models.User,
+	request *GetAuditLogsRequest,
+) (*GetAuditLogsResponse, error) {
+	// Users can view their own logs, ADMIN can view any user's logs
+	if user.Role != user_enums.UserRoleAdmin && user.ID != targetUserID {
+		return nil, errors.New("insufficient permissions to view user audit logs")
+	}
+
+	limit := request.Limit
+	if limit <= 0 || limit > 1000 {
+		limit = 100
+	}
+
+	offset := max(request.Offset, 0)
+
+	auditLogs, err := s.auditLogRepository.GetByUser(targetUserID, limit, offset, request.BeforeDate)
+	if err != nil {
+		return nil, err
+	}
+
+	return &GetAuditLogsResponse{
+		AuditLogs: auditLogs,
+		Total:     int64(len(auditLogs)),
+		Limit:     limit,
+		Offset:    offset,
+	}, nil
+}
+
+func (s *AuditLogService) GetProjectAuditLogs(
+	projectID uuid.UUID,
+	request *GetAuditLogsRequest,
+) (*GetAuditLogsResponse, error) {
+	limit := request.Limit
+	if limit <= 0 || limit > 1000 {
+		limit = 100
+	}
+
+	offset := max(request.Offset, 0)
+
+	auditLogs, err := s.auditLogRepository.GetByProject(projectID, limit, offset, request.BeforeDate)
+	if err != nil {
+		return nil, err
+	}
+
+	return &GetAuditLogsResponse{
+		AuditLogs: auditLogs,
+		Total:     int64(len(auditLogs)),
+		Limit:     limit,
+		Offset:    offset,
+	}, nil
+}
+
+```
+
+------ backend/internal/features/audit_logs/service_test.go ------
+
+```
+package audit_logs
+
+import (
+	"testing"
+	"time"
+
+	user_enums "postgresus/internal/features/users/enums"
+	users_testing "postgresus/internal/features/users/testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"gorm.io/gorm"
+)
+
+func Test_AuditLogs_ProjectSpecificLogs(t *testing.T) {
+	service := GetAuditLogService()
+	user1 := users_testing.CreateTestUser(user_enums.UserRoleMember)
+	user2 := users_testing.CreateTestUser(user_enums.UserRoleMember)
+	project1ID, project2ID := uuid.New(), uuid.New()
+
+	// Create test logs for projects
+	createAuditLog(service, "Test project1 log first", &user1.UserID, &project1ID)
+	createAuditLog(service, "Test project1 log second", &user2.UserID, &project1ID)
+	createAuditLog(service, "Test project2 log first", &user1.UserID, &project2ID)
+	createAuditLog(service, "Test project2 log second", &user2.UserID, &project2ID)
+	createAuditLog(service, "Test no project log", &user1.UserID, nil)
+
+	request := &GetAuditLogsRequest{Limit: 10, Offset: 0}
+
+	// Test project 1 logs
+	project1Response, err := service.GetProjectAuditLogs(project1ID, request)
+	assert.NoError(t, err)
+	assert.Equal(t, 2, len(project1Response.AuditLogs))
+
+	messages := extractMessages(project1Response.AuditLogs)
+	assert.Contains(t, messages, "Test project1 log first")
+	assert.Contains(t, messages, "Test project1 log second")
+	for _, log := range project1Response.AuditLogs {
+		assert.Equal(t, &project1ID, log.ProjectID)
+	}
+
+	// Test project 2 logs
+	project2Response, err := service.GetProjectAuditLogs(project2ID, request)
+	assert.NoError(t, err)
+	assert.Equal(t, 2, len(project2Response.AuditLogs))
+
+	messages2 := extractMessages(project2Response.AuditLogs)
+	assert.Contains(t, messages2, "Test project2 log first")
+	assert.Contains(t, messages2, "Test project2 log second")
+
+	// Test pagination
+	limitedResponse, err := service.GetProjectAuditLogs(project1ID,
+		&GetAuditLogsRequest{Limit: 1, Offset: 0})
+	assert.NoError(t, err)
+	assert.Equal(t, 1, len(limitedResponse.AuditLogs))
+	assert.Equal(t, 1, limitedResponse.Limit)
+
+	// Test beforeDate filter
+	beforeTime := time.Now().UTC().Add(-1 * time.Minute)
+	filteredResponse, err := service.GetProjectAuditLogs(project1ID,
+		&GetAuditLogsRequest{Limit: 10, BeforeDate: &beforeTime})
+	assert.NoError(t, err)
+	for _, log := range filteredResponse.AuditLogs {
+		assert.True(t, log.CreatedAt.Before(beforeTime))
+	}
+}
+
+func createAuditLog(service *AuditLogService, message string, userID, projectID *uuid.UUID) {
+	service.WriteAuditLog(message, userID, projectID)
+}
+
+func extractMessages(logs []*AuditLog) []string {
+	messages := make([]string, len(logs))
+	for i, log := range logs {
+		messages[i] = log.Message
+	}
+	return messages
+}
+
+func createTimedLog(db *gorm.DB, userID *uuid.UUID, message string, createdAt time.Time) {
+	log := &AuditLog{
+		ID:        uuid.New(),
+		UserID:    userID,
+		Message:   message,
+		CreatedAt: createdAt,
+	}
+	db.Create(log)
+}
+
+```

backend/.cursor/rules/refactor.mdc

@@ -0,0 +1,12 @@
+---
+description:
+globs:
+alwaysApply: true
+---
+
+When applying changes, do not forget to refactor old code.
+
+You can shortify, make more readable, improve code quality, etc.
+Common logic can be extracted to functions, constants, files, etc.
+
+After each large change with more than ~50-100 lines of code - always run `make lint` (from backend root folder).

backend/.cursor/rules/tests.mdc

@@ -1,12 +1,147 @@
 ---
-description: 
-globs: 
+description:
+globs:
 alwaysApply: true
 ---
-Write tests names in the format:
 
-Test_WhatWeDo_WhatWeExpect
+After writing tests, always launch them and verify that they pass.
 
-Example:
-- Test_TestConnection_ConnectionSucceeds
-- Test_SaveNewStorage_StorageReturnedViaGet
+## Test Naming Format
+
+Use these naming patterns:
+
+- `Test_WhatWeDo_WhatWeExpect`
+- `Test_WhatWeDo_WhichConditions_WhatWeExpect`
+
+## Examples from Real Codebase:
+
+- `Test_CreateApiKey_WhenUserIsProjectOwner_ApiKeyCreated`
+- `Test_UpdateProject_WhenUserIsProjectAdmin_ProjectUpdated`
+- `Test_DeleteApiKey_WhenUserIsProjectMember_ReturnsForbidden`
+- `Test_GetProjectAuditLogs_WithDifferentUserRoles_EnforcesPermissionsCorrectly`
+- `Test_ProjectLifecycleE2E_CompletesSuccessfully`
+
+## Testing Philosophy
+
+**Prefer Controllers Over Unit Tests:**
+
+- Test through HTTP endpoints via controllers whenever possible
+- Avoid testing repositories, services in isolation - test via API instead
+- Only use unit tests for complex model logic when no API exists
+- Name test files `controller_test.go` or `service_test.go`, not `integration_test.go`
+
+**Extract Common Logic to Testing Utilities:**
+
+- Create `testing.go` or `testing/testing.go` files for shared test utilities
+- Extract router creation, user setup, models creation helpers (in API, not just structs creation)
+- Reuse common patterns across different test files
+
+**Refactor Existing Tests:**
+
+- When working with existing tests, always look for opportunities to refactor and improve
+- Extract repetitive setup code to common utilities
+- Simplify complex tests by breaking them into smaller, focused tests
+- Replace inline test data creation with reusable helper functions
+- Consolidate similar test patterns across different test files
+- Make tests more readable and maintainable for other developers
+
+## Testing Utilities Structure
+
+**Create `testing.go` or `testing/testing.go` files with common utilities:**
+
+```go
+package projects_testing
+
+// CreateTestRouter creates unified router for all controllers
+func CreateTestRouter(controllers ...ControllerInterface) *gin.Engine {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	v1 := router.Group("/api/v1")
+	protected := v1.Group("").Use(users_middleware.AuthMiddleware(users_services.GetUserService()))
+
+	for _, controller := range controllers {
+		if routerGroup, ok := protected.(*gin.RouterGroup); ok {
+			controller.RegisterRoutes(routerGroup)
+		}
+	}
+	return router
+}
+
+// CreateTestProjectViaAPI creates project through HTTP API
+func CreateTestProjectViaAPI(name string, owner *users_dto.SignInResponseDTO, router *gin.Engine) (*projects_models.Project, string) {
+	request := projects_dto.CreateProjectRequestDTO{Name: name}
+	w := MakeAPIRequest(router, "POST", "/api/v1/projects", "Bearer "+owner.Token, request)
+	// Handle response...
+	return project, owner.Token
+}
+
+// AddMemberToProject adds member via API call
+func AddMemberToProject(project *projects_models.Project, member *users_dto.SignInResponseDTO, role users_enums.ProjectRole, ownerToken string, router *gin.Engine) {
+	// Implementation...
+}
+```
+
+## Controller Test Examples
+
+**Permission-based testing:**
+
+```go
+func Test_CreateApiKey_WhenUserIsProjectOwner_ApiKeyCreated(t *testing.T) {
+	router := CreateApiKeyTestRouter(GetProjectController(), GetMembershipController())
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	project, _ := projects_testing.CreateTestProjectViaAPI("Test Project", owner, router)
+
+	request := CreateApiKeyRequestDTO{Name: "Test API Key"}
+	var response ApiKey
+	test_utils.MakePostRequestAndUnmarshal(t, router, "/api/v1/projects/api-keys/"+project.ID.String(), "Bearer "+owner.Token, request, http.StatusOK, &response)
+
+	assert.Equal(t, "Test API Key", response.Name)
+	assert.NotEmpty(t, response.Token)
+}
+```
+
+**Cross-project security testing:**
+
+```go
+func Test_UpdateApiKey_WithApiKeyFromDifferentProject_ReturnsBadRequest(t *testing.T) {
+	router := CreateApiKeyTestRouter(GetProjectController(), GetMembershipController())
+	owner1 := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	owner2 := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	project1, _ := projects_testing.CreateTestProjectViaAPI("Project 1", owner1, router)
+	project2, _ := projects_testing.CreateTestProjectViaAPI("Project 2", owner2, router)
+
+	apiKey := CreateTestApiKey("Cross Project Key", project1.ID, owner1.Token, router)
+
+	// Try to update via different project endpoint
+	request := UpdateApiKeyRequestDTO{Name: &"Hacked Key"}
+	resp := test_utils.MakePutRequest(t, router, "/api/v1/projects/api-keys/"+project2.ID.String()+"/"+apiKey.ID.String(), "Bearer "+owner2.Token, request, http.StatusBadRequest)
+
+	assert.Contains(t, string(resp.Body), "API key does not belong to this project")
+}
+```
+
+**E2E lifecycle testing:**
+
+```go
+func Test_ProjectLifecycleE2E_CompletesSuccessfully(t *testing.T) {
+	router := projects_testing.CreateTestRouter(GetProjectController(), GetMembershipController())
+
+	// 1. Create project
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	project := projects_testing.CreateTestProject("E2E Project", owner, router)
+
+	// 2. Add member
+	member := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	projects_testing.AddMemberToProject(project, member, users_enums.ProjectRoleMember, owner.Token, router)
+
+	// 3. Promote to admin
+	projects_testing.ChangeMemberRole(project, member.UserID, users_enums.ProjectRoleAdmin, owner.Token, router)
+
+	// 4. Transfer ownership
+	projects_testing.TransferProjectOwnership(project, member.UserID, owner.Token, router)
+
+	// 5. Verify new owner can manage project
+	finalProject := projects_testing.GetProject(project.ID, member.Token, router)
+	assert.Equal(t, project.ID, finalProject.ID)
+}
+```

backend/.env.development.example

@@ -27,4 +27,7 @@ TEST_POSTGRES_18_PORT=5006
 TEST_MINIO_PORT=9000
 TEST_MINIO_CONSOLE_PORT=9001
 # testing NAS
-TEST_NAS_PORT=7006
+TEST_NAS_PORT=7006
+# testing Telegram
+TEST_TELEGRAM_BOT_TOKEN=
+TEST_TELEGRAM_CHAT_ID=

backend/.gitignore

@@ -12,4 +12,5 @@ swagger/swagger.yaml
 postgresus-backend.exe
 ui/build/*
 pgdata-for-restore/
-temp/
+temp/
+cmd.exe

backend/Makefile

@@ -2,7 +2,7 @@ run:
 	go run cmd/main.go
 
 test:
-	go test -count=1 ./internal/...
+	go test -p=1 -count=1 -failfast .\internal\...
 
 lint:
 	golangci-lint fmt && golangci-lint run

backend/cmd/main.go

@@ -13,20 +13,21 @@ import (
 	"time"
 
 	"postgresus-backend/internal/config"
-	"postgresus-backend/internal/downdetect"
+	"postgresus-backend/internal/features/audit_logs"
 	"postgresus-backend/internal/features/backups/backups"
 	backups_config "postgresus-backend/internal/features/backups/config"
 	"postgresus-backend/internal/features/databases"
 	"postgresus-backend/internal/features/disk"
 	healthcheck_attempt "postgresus-backend/internal/features/healthcheck/attempt"
 	healthcheck_config "postgresus-backend/internal/features/healthcheck/config"
-	postgres_monitoring_metrics "postgresus-backend/internal/features/monitoring/postgres/metrics"
-	postgres_monitoring_settings "postgresus-backend/internal/features/monitoring/postgres/settings"
 	"postgresus-backend/internal/features/notifiers"
 	"postgresus-backend/internal/features/restores"
 	"postgresus-backend/internal/features/storages"
 	system_healthcheck "postgresus-backend/internal/features/system/healthcheck"
-	"postgresus-backend/internal/features/users"
+	users_controllers "postgresus-backend/internal/features/users/controllers"
+	users_middleware "postgresus-backend/internal/features/users/middleware"
+	users_services "postgresus-backend/internal/features/users/services"
+	workspaces_controllers "postgresus-backend/internal/features/workspaces/controllers"
 	env_utils "postgresus-backend/internal/util/env"
 	files_utils "postgresus-backend/internal/util/files"
 	"postgresus-backend/internal/util/logger"
@@ -63,13 +64,14 @@ func main() {
 		os.Exit(1)
 	}
 
-	// Handle password reset if flag is provided
-	newPassword := flag.String("new-password", "", "Set a new password for the user")
-	flag.Parse()
-	if *newPassword != "" {
-		resetPassword(*newPassword, log)
+	err = users_services.GetUserService().CreateInitialAdmin()
+	if err != nil {
+		log.Error("Failed to create initial admin", "error", err)
+		os.Exit(1)
 	}
 
+	handlePasswordReset(log)
+
 	go generateSwaggerDocs(log)
 
 	gin.SetMode(gin.ReleaseMode)
@@ -93,11 +95,33 @@ func main() {
 	startServerWithGracefulShutdown(log, ginApp)
 }
 
-func resetPassword(newPassword string, log *slog.Logger) {
+func handlePasswordReset(log *slog.Logger) {
+	audit_logs.SetupDependencies()
+
+	newPassword := flag.String("new-password", "", "Set a new password for the user")
+	email := flag.String("email", "", "Email of the user to reset password")
+
+	flag.Parse()
+
+	if *newPassword == "" {
+		return
+	}
+
+	log.Info("Found reset password command - reseting password...")
+
+	if *email == "" {
+		log.Info("No email provided, please provide an email via --email=\"some@email.com\" flag")
+		os.Exit(1)
+	}
+
+	resetPassword(*email, *newPassword, log)
+}
+
+func resetPassword(email string, newPassword string, log *slog.Logger) {
 	log.Info("Resetting password...")
 
-	userService := users.GetUserService()
-	err := userService.ChangePassword(newPassword)
+	userService := users_services.GetUserService()
+	err := userService.ChangeUserPasswordByEmail(email, newPassword)
 	if err != nil {
 		log.Error("Failed to reset password", "error", err)
 		os.Exit(1)
@@ -148,42 +172,44 @@ func setUpRoutes(r *gin.Engine) {
 	// Mount Swagger UI
 	v1.GET("/docs/swagger/*any", ginSwagger.WrapHandler(swaggerFiles.Handler))
 
-	downdetectContoller := downdetect.GetDowndetectController()
-	userController := users.GetUserController()
-	notifierController := notifiers.GetNotifierController()
-	storageController := storages.GetStorageController()
-	databaseController := databases.GetDatabaseController()
-	backupController := backups.GetBackupController()
-	restoreController := restores.GetRestoreController()
-	healthcheckController := system_healthcheck.GetHealthcheckController()
-	healthcheckConfigController := healthcheck_config.GetHealthcheckConfigController()
-	healthcheckAttemptController := healthcheck_attempt.GetHealthcheckAttemptController()
-	diskController := disk.GetDiskController()
-	backupConfigController := backups_config.GetBackupConfigController()
-	postgresMonitoringSettingsController := postgres_monitoring_settings.GetPostgresMonitoringSettingsController()
-	postgresMonitoringMetricsController := postgres_monitoring_metrics.GetPostgresMonitoringMetricsController()
-
-	downdetectContoller.RegisterRoutes(v1)
+	// Public routes (only user auth routes and healthcheck should be public)
+	userController := users_controllers.GetUserController()
 	userController.RegisterRoutes(v1)
-	notifierController.RegisterRoutes(v1)
-	storageController.RegisterRoutes(v1)
-	databaseController.RegisterRoutes(v1)
-	backupController.RegisterRoutes(v1)
-	restoreController.RegisterRoutes(v1)
-	healthcheckController.RegisterRoutes(v1)
-	diskController.RegisterRoutes(v1)
-	healthcheckConfigController.RegisterRoutes(v1)
-	healthcheckAttemptController.RegisterRoutes(v1)
-	backupConfigController.RegisterRoutes(v1)
-	postgresMonitoringSettingsController.RegisterRoutes(v1)
-	postgresMonitoringMetricsController.RegisterRoutes(v1)
+	system_healthcheck.GetHealthcheckController().RegisterRoutes(v1)
+
+	// Setup auth middleware
+	userService := users_services.GetUserService()
+	authMiddleware := users_middleware.AuthMiddleware(userService)
+
+	// Protected routes
+	protected := v1.Group("")
+	protected.Use(authMiddleware)
+
+	userController.RegisterProtectedRoutes(protected)
+	workspaces_controllers.GetWorkspaceController().RegisterRoutes(protected)
+	workspaces_controllers.GetMembershipController().RegisterRoutes(protected)
+	disk.GetDiskController().RegisterRoutes(protected)
+	notifiers.GetNotifierController().RegisterRoutes(protected)
+	storages.GetStorageController().RegisterRoutes(protected)
+	databases.GetDatabaseController().RegisterRoutes(protected)
+	backups.GetBackupController().RegisterRoutes(protected)
+	restores.GetRestoreController().RegisterRoutes(protected)
+	healthcheck_config.GetHealthcheckConfigController().RegisterRoutes(protected)
+	healthcheck_attempt.GetHealthcheckAttemptController().RegisterRoutes(protected)
+	backups_config.GetBackupConfigController().RegisterRoutes(protected)
+	audit_logs.GetAuditLogController().RegisterRoutes(protected)
+	users_controllers.GetManagementController().RegisterRoutes(protected)
+	users_controllers.GetSettingsController().RegisterRoutes(protected)
 }
 
 func setUpDependencies() {
+	databases.SetupDependencies()
 	backups.SetupDependencies()
 	restores.SetupDependencies()
 	healthcheck_config.SetupDependencies()
-	postgres_monitoring_settings.SetupDependencies()
+	audit_logs.SetupDependencies()
+	notifiers.SetupDependencies()
+	storages.SetupDependencies()
 }
 
 func runBackgroundTasks(log *slog.Logger) {
@@ -205,10 +231,6 @@ func runBackgroundTasks(log *slog.Logger) {
 	go runWithPanicLogging(log, "healthcheck attempt background service", func() {
 		healthcheck_attempt.GetHealthcheckAttemptBackgroundService().Run()
 	})
-
-	go runWithPanicLogging(log, "postgres monitoring metrics background service", func() {
-		postgres_monitoring_metrics.GetPostgresMonitoringMetricsBackgroundService().Run()
-	})
 }
 
 func runWithPanicLogging(log *slog.Logger, serviceName string, fn func()) {

backend/internal/config/config.go

@@ -44,6 +44,16 @@ type EnvVariables struct {
 	TestMinioConsolePort string `env:"TEST_MINIO_CONSOLE_PORT"`
 
 	TestNASPort string `env:"TEST_NAS_PORT"`
+
+	// oauth
+	GitHubClientID     string `env:"GITHUB_CLIENT_ID"`
+	GitHubClientSecret string `env:"GITHUB_CLIENT_SECRET"`
+	GoogleClientID     string `env:"GOOGLE_CLIENT_ID"`
+	GoogleClientSecret string `env:"GOOGLE_CLIENT_SECRET"`
+
+	// testing Telegram
+	TestTelegramBotToken string `env:"TEST_TELEGRAM_BOT_TOKEN"`
+	TestTelegramChatID   string `env:"TEST_TELEGRAM_CHAT_ID"`
 }
 
 var (
@@ -173,6 +183,16 @@ func loadEnvVariables() {
 			log.Error("TEST_NAS_PORT is empty")
 			os.Exit(1)
 		}
+
+		if env.TestTelegramBotToken == "" {
+			log.Error("TEST_TELEGRAM_BOT_TOKEN is empty")
+			os.Exit(1)
+		}
+
+		if env.TestTelegramChatID == "" {
+			log.Error("TEST_TELEGRAM_CHAT_ID is empty")
+			os.Exit(1)
+		}
 	}
 
 	log.Info("Environment variables loaded successfully!")

backend/internal/downdetect/controller.go

@@ -1,37 +0,0 @@
-package downdetect
-
-import (
-	"fmt"
-	"net/http"
-
-	"github.com/gin-gonic/gin"
-)
-
-type DowndetectController struct {
-	service *DowndetectService
-}
-
-func (c *DowndetectController) RegisterRoutes(router *gin.RouterGroup) {
-	router.GET("/downdetect/is-available", c.IsAvailable)
-}
-
-// @Summary Check API availability
-// @Description Checks if the API service is available
-// @Tags downdetect
-// @Accept json
-// @Produce json
-// @Success 200
-// @Failure 500
-// @Router /downdetect/api [get]
-func (c *DowndetectController) IsAvailable(ctx *gin.Context) {
-	err := c.service.IsDbAvailable()
-	if err != nil {
-		ctx.JSON(
-			http.StatusInternalServerError,
-			gin.H{"error": fmt.Sprintf("Database is not available: %v", err)},
-		)
-		return
-	}
-
-	ctx.JSON(http.StatusOK, gin.H{"message": "API and DB are available"})
-}

backend/internal/downdetect/di.go

@@ -1,10 +0,0 @@
-package downdetect
-
-var downdetectService = &DowndetectService{}
-var downdetectController = &DowndetectController{
-	downdetectService,
-}
-
-func GetDowndetectController() *DowndetectController {
-	return downdetectController
-}

backend/internal/downdetect/service.go

@@ -1,17 +0,0 @@
-package downdetect
-
-import (
-	"postgresus-backend/internal/storage"
-)
-
-type DowndetectService struct {
-}
-
-func (s *DowndetectService) IsDbAvailable() error {
-	err := storage.GetDb().Exec("SELECT 1").Error
-	if err != nil {
-		return err
-	}
-
-	return nil
-}

backend/internal/features/audit_logs/controller.go

@@ -0,0 +1,111 @@
+package audit_logs
+
+import (
+	"net/http"
+
+	user_models "postgresus-backend/internal/features/users/models"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+type AuditLogController struct {
+	auditLogService *AuditLogService
+}
+
+func (c *AuditLogController) RegisterRoutes(router *gin.RouterGroup) {
+	// All audit log endpoints require authentication (handled in main.go)
+	auditRoutes := router.Group("/audit-logs")
+
+	auditRoutes.GET("/global", c.GetGlobalAuditLogs)
+	auditRoutes.GET("/users/:userId", c.GetUserAuditLogs)
+}
+
+// GetGlobalAuditLogs
+// @Summary Get global audit logs (ADMIN only)
+// @Description Retrieve all audit logs across the system
+// @Tags audit-logs
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param limit query int false "Limit number of results" default(100)
+// @Param offset query int false "Offset for pagination" default(0)
+// @Param beforeDate query string false "Filter logs created before this date (RFC3339 format)" format(date-time)
+// @Success 200 {object} GetAuditLogsResponse
+// @Failure 401 {object} map[string]string
+// @Failure 403 {object} map[string]string
+// @Router /audit-logs/global [get]
+func (c *AuditLogController) GetGlobalAuditLogs(ctx *gin.Context) {
+	user, isOk := ctx.MustGet("user").(*user_models.User)
+	if !isOk {
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Invalid user type in context"})
+		return
+	}
+
+	request := &GetAuditLogsRequest{}
+	if err := ctx.ShouldBindQuery(request); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid query parameters"})
+		return
+	}
+
+	response, err := c.auditLogService.GetGlobalAuditLogs(user, request)
+	if err != nil {
+		if err.Error() == "only administrators can view global audit logs" {
+			ctx.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+			return
+		}
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve audit logs"})
+		return
+	}
+
+	ctx.JSON(http.StatusOK, response)
+}
+
+// GetUserAuditLogs
+// @Summary Get user audit logs
+// @Description Retrieve audit logs for a specific user
+// @Tags audit-logs
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param userId path string true "User ID"
+// @Param limit query int false "Limit number of results" default(100)
+// @Param offset query int false "Offset for pagination" default(0)
+// @Param beforeDate query string false "Filter logs created before this date (RFC3339 format)" format(date-time)
+// @Success 200 {object} GetAuditLogsResponse
+// @Failure 400 {object} map[string]string
+// @Failure 401 {object} map[string]string
+// @Failure 403 {object} map[string]string
+// @Router /audit-logs/users/{userId} [get]
+func (c *AuditLogController) GetUserAuditLogs(ctx *gin.Context) {
+	user, isOk := ctx.MustGet("user").(*user_models.User)
+	if !isOk {
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Invalid user type in context"})
+		return
+	}
+
+	userIDStr := ctx.Param("userId")
+	targetUserID, err := uuid.Parse(userIDStr)
+	if err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid user ID"})
+		return
+	}
+
+	request := &GetAuditLogsRequest{}
+	if err := ctx.ShouldBindQuery(request); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid query parameters"})
+		return
+	}
+
+	response, err := c.auditLogService.GetUserAuditLogs(targetUserID, user, request)
+	if err != nil {
+		if err.Error() == "insufficient permissions to view user audit logs" {
+			ctx.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+			return
+		}
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve audit logs"})
+		return
+	}
+
+	ctx.JSON(http.StatusOK, response)
+}

backend/internal/features/audit_logs/controller_test.go

@@ -0,0 +1,154 @@
+package audit_logs
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+	"time"
+
+	user_enums "postgresus-backend/internal/features/users/enums"
+	users_middleware "postgresus-backend/internal/features/users/middleware"
+	users_services "postgresus-backend/internal/features/users/services"
+	users_testing "postgresus-backend/internal/features/users/testing"
+	test_utils "postgresus-backend/internal/util/testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_GetGlobalAuditLogs_WithDifferentUserRoles_EnforcesPermissionsCorrectly(t *testing.T) {
+	adminUser := users_testing.CreateTestUser(user_enums.UserRoleAdmin)
+	memberUser := users_testing.CreateTestUser(user_enums.UserRoleMember)
+	router := createRouter()
+	service := GetAuditLogService()
+	workspaceID := uuid.New()
+	testID := uuid.New().String()
+
+	// Create test logs with unique identifiers
+	userLogMessage := fmt.Sprintf("Test log with user %s", testID)
+	workspaceLogMessage := fmt.Sprintf("Test log with workspace %s", testID)
+	standaloneLogMessage := fmt.Sprintf("Test log standalone %s", testID)
+
+	createAuditLog(service, userLogMessage, &adminUser.UserID, nil)
+	createAuditLog(service, workspaceLogMessage, nil, &workspaceID)
+	createAuditLog(service, standaloneLogMessage, nil, nil)
+
+	// Test ADMIN can access global logs
+	var response GetAuditLogsResponse
+	test_utils.MakeGetRequestAndUnmarshal(t, router,
+		"/api/v1/audit-logs/global?limit=100", "Bearer "+adminUser.Token, http.StatusOK, &response)
+
+	// Verify our specific test logs are present
+	messages := extractMessages(response.AuditLogs)
+	assert.Contains(t, messages, userLogMessage)
+	assert.Contains(t, messages, workspaceLogMessage)
+	assert.Contains(t, messages, standaloneLogMessage)
+
+	// Test MEMBER cannot access global logs
+	resp := test_utils.MakeGetRequest(t, router, "/api/v1/audit-logs/global",
+		"Bearer "+memberUser.Token, http.StatusForbidden)
+	assert.Contains(t, string(resp.Body), "only administrators can view global audit logs")
+}
+
+func Test_GetUserAuditLogs_WithDifferentUserRoles_EnforcesPermissionsCorrectly(t *testing.T) {
+	adminUser := users_testing.CreateTestUser(user_enums.UserRoleAdmin)
+	user1 := users_testing.CreateTestUser(user_enums.UserRoleMember)
+	user2 := users_testing.CreateTestUser(user_enums.UserRoleMember)
+	router := createRouter()
+	service := GetAuditLogService()
+	workspaceID := uuid.New()
+	testID := uuid.New().String()
+
+	// Create test logs for different users with unique identifiers
+	user1FirstMessage := fmt.Sprintf("Test log user1 first %s", testID)
+	user1SecondMessage := fmt.Sprintf("Test log user1 second %s", testID)
+	user2FirstMessage := fmt.Sprintf("Test log user2 first %s", testID)
+	user2SecondMessage := fmt.Sprintf("Test log user2 second %s", testID)
+	workspaceLogMessage := fmt.Sprintf("Test workspace log %s", testID)
+
+	createAuditLog(service, user1FirstMessage, &user1.UserID, nil)
+	createAuditLog(service, user1SecondMessage, &user1.UserID, &workspaceID)
+	createAuditLog(service, user2FirstMessage, &user2.UserID, nil)
+	createAuditLog(service, user2SecondMessage, &user2.UserID, &workspaceID)
+	createAuditLog(service, workspaceLogMessage, nil, &workspaceID)
+
+	// Test ADMIN can view any user's logs
+	var user1Response GetAuditLogsResponse
+	test_utils.MakeGetRequestAndUnmarshal(t, router,
+		fmt.Sprintf("/api/v1/audit-logs/users/%s?limit=100", user1.UserID.String()),
+		"Bearer "+adminUser.Token, http.StatusOK, &user1Response)
+
+	// Verify user1's specific logs are present
+	messages := extractMessages(user1Response.AuditLogs)
+	assert.Contains(t, messages, user1FirstMessage)
+	assert.Contains(t, messages, user1SecondMessage)
+
+	// Count only our test logs for user1
+	testLogsCount := 0
+	for _, message := range messages {
+		if message == user1FirstMessage || message == user1SecondMessage {
+			testLogsCount++
+		}
+	}
+	assert.Equal(t, 2, testLogsCount)
+
+	// Test user can view own logs
+	var ownLogsResponse GetAuditLogsResponse
+	test_utils.MakeGetRequestAndUnmarshal(t, router,
+		fmt.Sprintf("/api/v1/audit-logs/users/%s?limit=100", user2.UserID.String()),
+		"Bearer "+user2.Token, http.StatusOK, &ownLogsResponse)
+
+	// Verify user2's specific logs are present
+	ownMessages := extractMessages(ownLogsResponse.AuditLogs)
+	assert.Contains(t, ownMessages, user2FirstMessage)
+	assert.Contains(t, ownMessages, user2SecondMessage)
+
+	// Test user cannot view other user's logs
+	resp := test_utils.MakeGetRequest(t, router,
+		fmt.Sprintf("/api/v1/audit-logs/users/%s", user1.UserID.String()),
+		"Bearer "+user2.Token, http.StatusForbidden)
+
+	assert.Contains(t, string(resp.Body), "insufficient permissions")
+}
+
+func Test_GetGlobalAuditLogs_WithBeforeDateFilter_ReturnsFilteredLogs(t *testing.T) {
+	adminUser := users_testing.CreateTestUser(user_enums.UserRoleAdmin)
+	router := createRouter()
+	baseTime := time.Now().UTC()
+
+	// Set filter time to 30 minutes ago
+	beforeTime := baseTime.Add(-30 * time.Minute)
+
+	var filteredResponse GetAuditLogsResponse
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		fmt.Sprintf(
+			"/api/v1/audit-logs/global?beforeDate=%s&limit=1000",
+			beforeTime.Format(time.RFC3339),
+		),
+		"Bearer "+adminUser.Token,
+		http.StatusOK,
+		&filteredResponse,
+	)
+
+	// Verify ALL returned logs are older than the filter time
+	for _, log := range filteredResponse.AuditLogs {
+		assert.True(t, log.CreatedAt.Before(beforeTime),
+			fmt.Sprintf("Log created at %s should be before filter time %s",
+				log.CreatedAt.Format(time.RFC3339), beforeTime.Format(time.RFC3339)))
+	}
+}
+
+func createRouter() *gin.Engine {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	SetupDependencies()
+
+	v1 := router.Group("/api/v1")
+	protected := v1.Group("").Use(users_middleware.AuthMiddleware(users_services.GetUserService()))
+	GetAuditLogController().RegisterRoutes(protected.(*gin.RouterGroup))
+
+	return router
+}

backend/internal/features/audit_logs/di.go

@@ -0,0 +1,29 @@
+package audit_logs
+
+import (
+	users_services "postgresus-backend/internal/features/users/services"
+	"postgresus-backend/internal/util/logger"
+)
+
+var auditLogRepository = &AuditLogRepository{}
+var auditLogService = &AuditLogService{
+	auditLogRepository: auditLogRepository,
+	logger:             logger.GetLogger(),
+}
+var auditLogController = &AuditLogController{
+	auditLogService: auditLogService,
+}
+
+func GetAuditLogService() *AuditLogService {
+	return auditLogService
+}
+
+func GetAuditLogController() *AuditLogController {
+	return auditLogController
+}
+
+func SetupDependencies() {
+	users_services.GetUserService().SetAuditLogWriter(auditLogService)
+	users_services.GetSettingsService().SetAuditLogWriter(auditLogService)
+	users_services.GetManagementService().SetAuditLogWriter(auditLogService)
+}

backend/internal/features/audit_logs/dto.go

@@ -0,0 +1,31 @@
+package audit_logs
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+type GetAuditLogsRequest struct {
+	Limit      int        `form:"limit"      json:"limit"`
+	Offset     int        `form:"offset"     json:"offset"`
+	BeforeDate *time.Time `form:"beforeDate" json:"beforeDate"`
+}
+
+type GetAuditLogsResponse struct {
+	AuditLogs []*AuditLogDTO `json:"auditLogs"`
+	Total     int64          `json:"total"`
+	Limit     int            `json:"limit"`
+	Offset    int            `json:"offset"`
+}
+
+type AuditLogDTO struct {
+	ID            uuid.UUID  `json:"id"            gorm:"column:id"`
+	UserID        *uuid.UUID `json:"userId"        gorm:"column:user_id"`
+	WorkspaceID   *uuid.UUID `json:"workspaceId"   gorm:"column:workspace_id"`
+	Message       string     `json:"message"       gorm:"column:message"`
+	CreatedAt     time.Time  `json:"createdAt"     gorm:"column:created_at"`
+	UserEmail     *string    `json:"userEmail"     gorm:"column:user_email"`
+	UserName      *string    `json:"userName"      gorm:"column:user_name"`
+	WorkspaceName *string    `json:"workspaceName" gorm:"column:workspace_name"`
+}

backend/internal/features/audit_logs/models.go

@@ -0,0 +1,19 @@
+package audit_logs
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+type AuditLog struct {
+	ID          uuid.UUID  `json:"id"          gorm:"column:id"`
+	UserID      *uuid.UUID `json:"userId"      gorm:"column:user_id"`
+	WorkspaceID *uuid.UUID `json:"workspaceId" gorm:"column:workspace_id"`
+	Message     string     `json:"message"     gorm:"column:message"`
+	CreatedAt   time.Time  `json:"createdAt"   gorm:"column:created_at"`
+}
+
+func (AuditLog) TableName() string {
+	return "audit_logs"
+}

backend/internal/features/audit_logs/repository.go

@@ -0,0 +1,139 @@
+package audit_logs
+
+import (
+	"postgresus-backend/internal/storage"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+type AuditLogRepository struct{}
+
+func (r *AuditLogRepository) Create(auditLog *AuditLog) error {
+	if auditLog.ID == uuid.Nil {
+		auditLog.ID = uuid.New()
+	}
+
+	return storage.GetDb().Create(auditLog).Error
+}
+
+func (r *AuditLogRepository) GetGlobal(
+	limit, offset int,
+	beforeDate *time.Time,
+) ([]*AuditLogDTO, error) {
+	var auditLogs = make([]*AuditLogDTO, 0)
+
+	sql := `
+		SELECT 
+			al.id,
+			al.user_id,
+			al.workspace_id,
+			al.message,
+			al.created_at,
+			u.email as user_email,
+			u.name as user_name,
+			w.name as workspace_name
+		FROM audit_logs al
+		LEFT JOIN users u ON al.user_id = u.id
+		LEFT JOIN workspaces w ON al.workspace_id = w.id`
+
+	args := []interface{}{}
+
+	if beforeDate != nil {
+		sql += " WHERE al.created_at < ?"
+		args = append(args, *beforeDate)
+	}
+
+	sql += " ORDER BY al.created_at DESC LIMIT ? OFFSET ?"
+	args = append(args, limit, offset)
+
+	err := storage.GetDb().Raw(sql, args...).Scan(&auditLogs).Error
+
+	return auditLogs, err
+}
+
+func (r *AuditLogRepository) GetByUser(
+	userID uuid.UUID,
+	limit, offset int,
+	beforeDate *time.Time,
+) ([]*AuditLogDTO, error) {
+	var auditLogs = make([]*AuditLogDTO, 0)
+
+	sql := `
+		SELECT 
+			al.id,
+			al.user_id,
+			al.workspace_id,
+			al.message,
+			al.created_at,
+			u.email as user_email,
+			u.name as user_name,
+			w.name as workspace_name
+		FROM audit_logs al
+		LEFT JOIN users u ON al.user_id = u.id
+		LEFT JOIN workspaces w ON al.workspace_id = w.id
+		WHERE al.user_id = ?`
+
+	args := []interface{}{userID}
+
+	if beforeDate != nil {
+		sql += " AND al.created_at < ?"
+		args = append(args, *beforeDate)
+	}
+
+	sql += " ORDER BY al.created_at DESC LIMIT ? OFFSET ?"
+	args = append(args, limit, offset)
+
+	err := storage.GetDb().Raw(sql, args...).Scan(&auditLogs).Error
+
+	return auditLogs, err
+}
+
+func (r *AuditLogRepository) GetByWorkspace(
+	workspaceID uuid.UUID,
+	limit, offset int,
+	beforeDate *time.Time,
+) ([]*AuditLogDTO, error) {
+	var auditLogs = make([]*AuditLogDTO, 0)
+
+	sql := `
+		SELECT 
+			al.id,
+			al.user_id,
+			al.workspace_id,
+			al.message,
+			al.created_at,
+			u.email as user_email,
+			u.name as user_name,
+			w.name as workspace_name
+		FROM audit_logs al
+		LEFT JOIN users u ON al.user_id = u.id
+		LEFT JOIN workspaces w ON al.workspace_id = w.id
+		WHERE al.workspace_id = ?`
+
+	args := []interface{}{workspaceID}
+
+	if beforeDate != nil {
+		sql += " AND al.created_at < ?"
+		args = append(args, *beforeDate)
+	}
+
+	sql += " ORDER BY al.created_at DESC LIMIT ? OFFSET ?"
+	args = append(args, limit, offset)
+
+	err := storage.GetDb().Raw(sql, args...).Scan(&auditLogs).Error
+
+	return auditLogs, err
+}
+
+func (r *AuditLogRepository) CountGlobal(beforeDate *time.Time) (int64, error) {
+	var count int64
+	query := storage.GetDb().Model(&AuditLog{})
+
+	if beforeDate != nil {
+		query = query.Where("created_at < ?", *beforeDate)
+	}
+
+	err := query.Count(&count).Error
+	return count, err
+}

backend/internal/features/audit_logs/service.go

@@ -0,0 +1,137 @@
+package audit_logs
+
+import (
+	"errors"
+	"log/slog"
+	"time"
+
+	user_enums "postgresus-backend/internal/features/users/enums"
+	user_models "postgresus-backend/internal/features/users/models"
+
+	"github.com/google/uuid"
+)
+
+type AuditLogService struct {
+	auditLogRepository *AuditLogRepository
+	logger             *slog.Logger
+}
+
+func (s *AuditLogService) WriteAuditLog(
+	message string,
+	userID *uuid.UUID,
+	workspaceID *uuid.UUID,
+) {
+	auditLog := &AuditLog{
+		UserID:      userID,
+		WorkspaceID: workspaceID,
+		Message:     message,
+		CreatedAt:   time.Now().UTC(),
+	}
+
+	err := s.auditLogRepository.Create(auditLog)
+	if err != nil {
+		s.logger.Error("failed to create audit log", "error", err)
+		return
+	}
+}
+
+func (s *AuditLogService) CreateAuditLog(auditLog *AuditLog) error {
+	return s.auditLogRepository.Create(auditLog)
+}
+
+func (s *AuditLogService) GetGlobalAuditLogs(
+	user *user_models.User,
+	request *GetAuditLogsRequest,
+) (*GetAuditLogsResponse, error) {
+	if user.Role != user_enums.UserRoleAdmin {
+		return nil, errors.New("only administrators can view global audit logs")
+	}
+
+	limit := request.Limit
+	if limit <= 0 || limit > 1000 {
+		limit = 100
+	}
+
+	offset := max(request.Offset, 0)
+
+	auditLogs, err := s.auditLogRepository.GetGlobal(limit, offset, request.BeforeDate)
+	if err != nil {
+		return nil, err
+	}
+
+	total, err := s.auditLogRepository.CountGlobal(request.BeforeDate)
+	if err != nil {
+		return nil, err
+	}
+
+	return &GetAuditLogsResponse{
+		AuditLogs: auditLogs,
+		Total:     total,
+		Limit:     limit,
+		Offset:    offset,
+	}, nil
+}
+
+func (s *AuditLogService) GetUserAuditLogs(
+	targetUserID uuid.UUID,
+	user *user_models.User,
+	request *GetAuditLogsRequest,
+) (*GetAuditLogsResponse, error) {
+	// Users can view their own logs, ADMIN can view any user's logs
+	if user.Role != user_enums.UserRoleAdmin && user.ID != targetUserID {
+		return nil, errors.New("insufficient permissions to view user audit logs")
+	}
+
+	limit := request.Limit
+	if limit <= 0 || limit > 1000 {
+		limit = 100
+	}
+
+	offset := max(request.Offset, 0)
+
+	auditLogs, err := s.auditLogRepository.GetByUser(
+		targetUserID,
+		limit,
+		offset,
+		request.BeforeDate,
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return &GetAuditLogsResponse{
+		AuditLogs: auditLogs,
+		Total:     int64(len(auditLogs)),
+		Limit:     limit,
+		Offset:    offset,
+	}, nil
+}
+
+func (s *AuditLogService) GetWorkspaceAuditLogs(
+	workspaceID uuid.UUID,
+	request *GetAuditLogsRequest,
+) (*GetAuditLogsResponse, error) {
+	limit := request.Limit
+	if limit <= 0 || limit > 1000 {
+		limit = 100
+	}
+
+	offset := max(request.Offset, 0)
+
+	auditLogs, err := s.auditLogRepository.GetByWorkspace(
+		workspaceID,
+		limit,
+		offset,
+		request.BeforeDate,
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return &GetAuditLogsResponse{
+		AuditLogs: auditLogs,
+		Total:     int64(len(auditLogs)),
+		Limit:     limit,
+		Offset:    offset,
+	}, nil
+}

backend/internal/features/audit_logs/service_test.go

@@ -0,0 +1,83 @@
+package audit_logs
+
+import (
+	"testing"
+	"time"
+
+	user_enums "postgresus-backend/internal/features/users/enums"
+	users_testing "postgresus-backend/internal/features/users/testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_AuditLogs_WorkspaceSpecificLogs(t *testing.T) {
+	service := GetAuditLogService()
+	user1 := users_testing.CreateTestUser(user_enums.UserRoleMember)
+	user2 := users_testing.CreateTestUser(user_enums.UserRoleMember)
+	workspace1ID, workspace2ID := uuid.New(), uuid.New()
+
+	// Create test logs for workspaces
+	createAuditLog(service, "Test workspace1 log first", &user1.UserID, &workspace1ID)
+	createAuditLog(service, "Test workspace1 log second", &user2.UserID, &workspace1ID)
+	createAuditLog(service, "Test workspace2 log first", &user1.UserID, &workspace2ID)
+	createAuditLog(service, "Test workspace2 log second", &user2.UserID, &workspace2ID)
+	createAuditLog(service, "Test no workspace log", &user1.UserID, nil)
+
+	request := &GetAuditLogsRequest{Limit: 10, Offset: 0}
+
+	// Test workspace 1 logs
+	workspace1Response, err := service.GetWorkspaceAuditLogs(workspace1ID, request)
+	assert.NoError(t, err)
+	assert.Equal(t, 2, len(workspace1Response.AuditLogs))
+
+	messages := extractMessages(workspace1Response.AuditLogs)
+	assert.Contains(t, messages, "Test workspace1 log first")
+	assert.Contains(t, messages, "Test workspace1 log second")
+	for _, log := range workspace1Response.AuditLogs {
+		assert.Equal(t, &workspace1ID, log.WorkspaceID)
+	}
+
+	// Test workspace 2 logs
+	workspace2Response, err := service.GetWorkspaceAuditLogs(workspace2ID, request)
+	assert.NoError(t, err)
+	assert.Equal(t, 2, len(workspace2Response.AuditLogs))
+
+	messages2 := extractMessages(workspace2Response.AuditLogs)
+	assert.Contains(t, messages2, "Test workspace2 log first")
+	assert.Contains(t, messages2, "Test workspace2 log second")
+
+	// Test pagination
+	limitedResponse, err := service.GetWorkspaceAuditLogs(workspace1ID,
+		&GetAuditLogsRequest{Limit: 1, Offset: 0})
+	assert.NoError(t, err)
+	assert.Equal(t, 1, len(limitedResponse.AuditLogs))
+	assert.Equal(t, 1, limitedResponse.Limit)
+
+	// Test beforeDate filter
+	beforeTime := time.Now().UTC().Add(-1 * time.Minute)
+	filteredResponse, err := service.GetWorkspaceAuditLogs(workspace1ID,
+		&GetAuditLogsRequest{Limit: 10, BeforeDate: &beforeTime})
+	assert.NoError(t, err)
+	for _, log := range filteredResponse.AuditLogs {
+		assert.True(t, log.CreatedAt.Before(beforeTime))
+		assert.NotNil(t, log.UserEmail, "User email should be present for logs with user_id")
+		assert.NotNil(
+			t,
+			log.WorkspaceName,
+			"Workspace name should be present for logs with workspace_id",
+		)
+	}
+}
+
+func createAuditLog(service *AuditLogService, message string, userID, workspaceID *uuid.UUID) {
+	service.WriteAuditLog(message, userID, workspaceID)
+}
+
+func extractMessages(logs []*AuditLogDTO) []string {
+	messages := make([]string, len(logs))
+	for i, log := range logs {
+		messages[i] = log.Message
+	}
+	return messages
+}

backend/internal/features/backups/backups/background_service_test.go

@@ -6,7 +6,9 @@ import (
 	"postgresus-backend/internal/features/intervals"
 	"postgresus-backend/internal/features/notifiers"
 	"postgresus-backend/internal/features/storages"
-	"postgresus-backend/internal/features/users"
+	users_enums "postgresus-backend/internal/features/users/enums"
+	users_testing "postgresus-backend/internal/features/users/testing"
+	workspaces_testing "postgresus-backend/internal/features/workspaces/testing"
 	"postgresus-backend/internal/util/period"
 	"testing"
 	"time"
@@ -16,10 +18,12 @@ import (
 
 func Test_MakeBackupForDbHavingBackupDayAgo_BackupCreated(t *testing.T) {
 	// setup data
-	user := users.GetTestUser()
-	storage := storages.CreateTestStorage(user.UserID)
-	notifier := notifiers.CreateTestNotifier(user.UserID)
-	database := databases.CreateTestDatabase(user.UserID, storage, notifier)
+	user := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+	router := CreateTestRouter()
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", user, router)
+	storage := storages.CreateTestStorage(workspace.ID)
+	notifier := notifiers.CreateTestNotifier(workspace.ID)
+	database := databases.CreateTestDatabase(workspace.ID, storage, notifier)
 
 	// Enable backups for the database
 	backupConfig, err := backups_config.GetBackupConfigService().GetBackupConfigByDbId(database.ID)
@@ -67,16 +71,20 @@ func Test_MakeBackupForDbHavingBackupDayAgo_BackupCreated(t *testing.T) {
 	}
 
 	databases.RemoveTestDatabase(database)
-	storages.RemoveTestStorage(storage.ID)
+	time.Sleep(50 * time.Millisecond) // Wait for cascading deletes
 	notifiers.RemoveTestNotifier(notifier)
+	storages.RemoveTestStorage(storage.ID)
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
 }
 
 func Test_MakeBackupForDbHavingHourAgoBackup_BackupSkipped(t *testing.T) {
 	// setup data
-	user := users.GetTestUser()
-	storage := storages.CreateTestStorage(user.UserID)
-	notifier := notifiers.CreateTestNotifier(user.UserID)
-	database := databases.CreateTestDatabase(user.UserID, storage, notifier)
+	user := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+	router := CreateTestRouter()
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", user, router)
+	storage := storages.CreateTestStorage(workspace.ID)
+	notifier := notifiers.CreateTestNotifier(workspace.ID)
+	database := databases.CreateTestDatabase(workspace.ID, storage, notifier)
 
 	// Enable backups for the database
 	backupConfig, err := backups_config.GetBackupConfigService().GetBackupConfigByDbId(database.ID)
@@ -124,16 +132,20 @@ func Test_MakeBackupForDbHavingHourAgoBackup_BackupSkipped(t *testing.T) {
 	}
 
 	databases.RemoveTestDatabase(database)
-	storages.RemoveTestStorage(storage.ID)
+	time.Sleep(50 * time.Millisecond) // Wait for cascading deletes
 	notifiers.RemoveTestNotifier(notifier)
+	storages.RemoveTestStorage(storage.ID)
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
 }
 
 func Test_MakeBackupHavingFailedBackupWithoutRetries_BackupSkipped(t *testing.T) {
 	// setup data
-	user := users.GetTestUser()
-	storage := storages.CreateTestStorage(user.UserID)
-	notifier := notifiers.CreateTestNotifier(user.UserID)
-	database := databases.CreateTestDatabase(user.UserID, storage, notifier)
+	user := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+	router := CreateTestRouter()
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", user, router)
+	storage := storages.CreateTestStorage(workspace.ID)
+	notifier := notifiers.CreateTestNotifier(workspace.ID)
+	database := databases.CreateTestDatabase(workspace.ID, storage, notifier)
 
 	// Enable backups for the database with retries disabled
 	backupConfig, err := backups_config.GetBackupConfigService().GetBackupConfigByDbId(database.ID)
@@ -185,16 +197,20 @@ func Test_MakeBackupHavingFailedBackupWithoutRetries_BackupSkipped(t *testing.T)
 	}
 
 	databases.RemoveTestDatabase(database)
-	storages.RemoveTestStorage(storage.ID)
+	time.Sleep(50 * time.Millisecond) // Wait for cascading deletes
 	notifiers.RemoveTestNotifier(notifier)
+	storages.RemoveTestStorage(storage.ID)
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
 }
 
 func Test_MakeBackupHavingFailedBackupWithRetries_BackupCreated(t *testing.T) {
 	// setup data
-	user := users.GetTestUser()
-	storage := storages.CreateTestStorage(user.UserID)
-	notifier := notifiers.CreateTestNotifier(user.UserID)
-	database := databases.CreateTestDatabase(user.UserID, storage, notifier)
+	user := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+	router := CreateTestRouter()
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", user, router)
+	storage := storages.CreateTestStorage(workspace.ID)
+	notifier := notifiers.CreateTestNotifier(workspace.ID)
+	database := databases.CreateTestDatabase(workspace.ID, storage, notifier)
 
 	// Enable backups for the database with retries enabled
 	backupConfig, err := backups_config.GetBackupConfigService().GetBackupConfigByDbId(database.ID)
@@ -246,16 +262,20 @@ func Test_MakeBackupHavingFailedBackupWithRetries_BackupCreated(t *testing.T) {
 	}
 
 	databases.RemoveTestDatabase(database)
-	storages.RemoveTestStorage(storage.ID)
+	time.Sleep(50 * time.Millisecond) // Wait for cascading deletes
 	notifiers.RemoveTestNotifier(notifier)
+	storages.RemoveTestStorage(storage.ID)
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
 }
 
 func Test_MakeBackupHavingFailedBackupWithRetries_RetriesCountNotExceeded(t *testing.T) {
 	// setup data
-	user := users.GetTestUser()
-	storage := storages.CreateTestStorage(user.UserID)
-	notifier := notifiers.CreateTestNotifier(user.UserID)
-	database := databases.CreateTestDatabase(user.UserID, storage, notifier)
+	user := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+	router := CreateTestRouter()
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", user, router)
+	storage := storages.CreateTestStorage(workspace.ID)
+	notifier := notifiers.CreateTestNotifier(workspace.ID)
+	database := databases.CreateTestDatabase(workspace.ID, storage, notifier)
 
 	// Enable backups for the database with retries enabled
 	backupConfig, err := backups_config.GetBackupConfigService().GetBackupConfigByDbId(database.ID)
@@ -309,6 +329,8 @@ func Test_MakeBackupHavingFailedBackupWithRetries_RetriesCountNotExceeded(t *tes
 	}
 
 	databases.RemoveTestDatabase(database)
-	storages.RemoveTestStorage(storage.ID)
+	time.Sleep(50 * time.Millisecond) // Wait for cascading deletes
 	notifiers.RemoveTestNotifier(notifier)
+	storages.RemoveTestStorage(storage.ID)
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
 }

backend/internal/features/backups/backups/controller.go

@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"postgresus-backend/internal/features/users"
+	users_middleware "postgresus-backend/internal/features/users/middleware"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
@@ -12,7 +12,6 @@ import (
 
 type BackupController struct {
 	backupService *BackupService
-	userService   *users.UserService
 }
 
 func (c *BackupController) RegisterRoutes(router *gin.RouterGroup) {
@@ -34,6 +33,12 @@ func (c *BackupController) RegisterRoutes(router *gin.RouterGroup) {
 // @Failure 500
 // @Router /backups [get]
 func (c *BackupController) GetBackups(ctx *gin.Context) {
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
 	databaseIDStr := ctx.Query("database_id")
 	if databaseIDStr == "" {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": "database_id query parameter is required"})
@@ -46,18 +51,6 @@ func (c *BackupController) GetBackups(ctx *gin.Context) {
 		return
 	}
 
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
-		return
-	}
-
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-		return
-	}
-
 	backups, err := c.backupService.GetBackups(user, databaseID)
 	if err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
@@ -80,24 +73,18 @@ func (c *BackupController) GetBackups(ctx *gin.Context) {
 // @Failure 500
 // @Router /backups [post]
 func (c *BackupController) MakeBackup(ctx *gin.Context) {
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
 	var request MakeBackupRequest
 	if err := ctx.ShouldBindJSON(&request); err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
-		return
-	}
-
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-		return
-	}
-
 	if err := c.backupService.MakeBackupWithAuth(user, request.DatabaseID); err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
@@ -117,24 +104,18 @@ func (c *BackupController) MakeBackup(ctx *gin.Context) {
 // @Failure 500
 // @Router /backups/{id} [delete]
 func (c *BackupController) DeleteBackup(ctx *gin.Context) {
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
 	id, err := uuid.Parse(ctx.Param("id"))
 	if err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": "invalid backup ID"})
 		return
 	}
 
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
-		return
-	}
-
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-		return
-	}
-
 	if err := c.backupService.DeleteBackup(user, id); err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
@@ -154,24 +135,18 @@ func (c *BackupController) DeleteBackup(ctx *gin.Context) {
 // @Failure 500
 // @Router /backups/{id}/file [get]
 func (c *BackupController) GetFile(ctx *gin.Context) {
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
 	id, err := uuid.Parse(ctx.Param("id"))
 	if err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": "invalid backup ID"})
 		return
 	}
 
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
-		return
-	}
-
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-		return
-	}
-
 	fileReader, err := c.backupService.GetBackupFile(user, id)
 	if err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
@@ -179,19 +154,16 @@ func (c *BackupController) GetFile(ctx *gin.Context) {
 	}
 	defer func() {
 		if err := fileReader.Close(); err != nil {
-			// Log the error but don't interrupt the response
 			fmt.Printf("Error closing file reader: %v\n", err)
 		}
 	}()
 
-	// Set headers for file download
 	ctx.Header("Content-Type", "application/octet-stream")
 	ctx.Header(
 		"Content-Disposition",
 		fmt.Sprintf("attachment; filename=\"backup_%s.dump\"", id.String()),
 	)
 
-	// Stream the file content
 	_, err = io.Copy(ctx.Writer, fileReader)
 	if err != nil {
 		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "failed to stream file"})

backend/internal/features/backups/backups/controller_test.go

@@ -0,0 +1,640 @@
+package backups
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+
+	audit_logs "postgresus-backend/internal/features/audit_logs"
+	backups_config "postgresus-backend/internal/features/backups/config"
+	"postgresus-backend/internal/features/databases"
+	"postgresus-backend/internal/features/databases/databases/postgresql"
+	"postgresus-backend/internal/features/storages"
+	local_storage "postgresus-backend/internal/features/storages/models/local"
+	users_dto "postgresus-backend/internal/features/users/dto"
+	users_enums "postgresus-backend/internal/features/users/enums"
+	users_services "postgresus-backend/internal/features/users/services"
+	users_testing "postgresus-backend/internal/features/users/testing"
+	workspaces_models "postgresus-backend/internal/features/workspaces/models"
+	workspaces_testing "postgresus-backend/internal/features/workspaces/testing"
+	test_utils "postgresus-backend/internal/util/testing"
+	"postgresus-backend/internal/util/tools"
+)
+
+func Test_GetBackups_PermissionsEnforced(t *testing.T) {
+	tests := []struct {
+		name               string
+		workspaceRole      *users_enums.WorkspaceRole
+		isGlobalAdmin      bool
+		expectSuccess      bool
+		expectedStatusCode int
+	}{
+		{
+			name:               "workspace viewer can get backups",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleViewer; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace member can get backups",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleMember; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "non-member cannot get backups",
+			workspaceRole:      nil,
+			isGlobalAdmin:      false,
+			expectSuccess:      false,
+			expectedStatusCode: http.StatusBadRequest,
+		},
+		{
+			name:               "global admin can get backups",
+			workspaceRole:      nil,
+			isGlobalAdmin:      true,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router := createTestRouter()
+			owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+			workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+			database, _ := createTestDatabaseWithBackups(workspace, owner, router)
+
+			var testUserToken string
+			if tt.isGlobalAdmin {
+				admin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+				testUserToken = admin.Token
+			} else if tt.workspaceRole != nil {
+				if *tt.workspaceRole == users_enums.WorkspaceRoleOwner {
+					testUserToken = owner.Token
+				} else {
+					member := users_testing.CreateTestUser(users_enums.UserRoleMember)
+					workspaces_testing.AddMemberToWorkspace(workspace, member, *tt.workspaceRole, owner.Token, router)
+					testUserToken = member.Token
+				}
+			} else {
+				nonMember := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				testUserToken = nonMember.Token
+			}
+
+			testResp := test_utils.MakeGetRequest(
+				t,
+				router,
+				fmt.Sprintf("/api/v1/backups?database_id=%s", database.ID.String()),
+				"Bearer "+testUserToken,
+				tt.expectedStatusCode,
+			)
+
+			if tt.expectSuccess {
+				var backups []*Backup
+				err := json.Unmarshal(testResp.Body, &backups)
+				assert.NoError(t, err)
+				assert.GreaterOrEqual(t, len(backups), 1)
+			} else {
+				assert.Contains(t, string(testResp.Body), "insufficient permissions")
+			}
+		})
+	}
+}
+
+func Test_CreateBackup_PermissionsEnforced(t *testing.T) {
+	tests := []struct {
+		name               string
+		workspaceRole      *users_enums.WorkspaceRole
+		isGlobalAdmin      bool
+		expectSuccess      bool
+		expectedStatusCode int
+	}{
+		{
+			name:               "workspace owner can create backup",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleOwner; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace member can create backup",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleMember; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace viewer can create backup",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleViewer; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "non-member cannot create backup",
+			workspaceRole:      nil,
+			isGlobalAdmin:      false,
+			expectSuccess:      false,
+			expectedStatusCode: http.StatusBadRequest,
+		},
+		{
+			name:               "global admin can create backup",
+			workspaceRole:      nil,
+			isGlobalAdmin:      true,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router := createTestRouter()
+			owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+			workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+			database := createTestDatabase("Test Database", workspace.ID, owner.Token, router)
+			enableBackupForDatabase(database.ID)
+
+			var testUserToken string
+			if tt.isGlobalAdmin {
+				admin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+				testUserToken = admin.Token
+			} else if tt.workspaceRole != nil {
+				if *tt.workspaceRole == users_enums.WorkspaceRoleOwner {
+					testUserToken = owner.Token
+				} else {
+					member := users_testing.CreateTestUser(users_enums.UserRoleMember)
+					workspaces_testing.AddMemberToWorkspace(workspace, member, *tt.workspaceRole, owner.Token, router)
+					testUserToken = member.Token
+				}
+			} else {
+				nonMember := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				testUserToken = nonMember.Token
+			}
+
+			request := MakeBackupRequest{DatabaseID: database.ID}
+			testResp := test_utils.MakePostRequest(
+				t,
+				router,
+				"/api/v1/backups",
+				"Bearer "+testUserToken,
+				request,
+				tt.expectedStatusCode,
+			)
+
+			if tt.expectSuccess {
+				assert.Contains(t, string(testResp.Body), "backup started successfully")
+			} else {
+				assert.Contains(t, string(testResp.Body), "insufficient permissions")
+			}
+		})
+	}
+}
+
+func Test_CreateBackup_AuditLogWritten(t *testing.T) {
+	router := createTestRouter()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	database := createTestDatabase("Test Database", workspace.ID, owner.Token, router)
+	enableBackupForDatabase(database.ID)
+
+	request := MakeBackupRequest{DatabaseID: database.ID}
+	test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/backups",
+		"Bearer "+owner.Token,
+		request,
+		http.StatusOK,
+	)
+
+	time.Sleep(100 * time.Millisecond)
+
+	auditLogService := audit_logs.GetAuditLogService()
+	auditLogs, err := auditLogService.GetWorkspaceAuditLogs(
+		workspace.ID,
+		&audit_logs.GetAuditLogsRequest{
+			Limit:  100,
+			Offset: 0,
+		},
+	)
+	assert.NoError(t, err)
+
+	found := false
+	for _, log := range auditLogs.AuditLogs {
+		if strings.Contains(log.Message, "Backup manually initiated") &&
+			strings.Contains(log.Message, database.Name) {
+			found = true
+			break
+		}
+	}
+	assert.True(t, found, "Audit log for backup creation not found")
+}
+
+func Test_DeleteBackup_PermissionsEnforced(t *testing.T) {
+	tests := []struct {
+		name               string
+		workspaceRole      *users_enums.WorkspaceRole
+		isGlobalAdmin      bool
+		expectSuccess      bool
+		expectedStatusCode int
+	}{
+		{
+			name:               "workspace owner can delete backup",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleOwner; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusNoContent,
+		},
+		{
+			name:               "workspace member can delete backup",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleMember; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusNoContent,
+		},
+		{
+			name:               "workspace viewer cannot delete backup",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleViewer; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      false,
+			expectedStatusCode: http.StatusBadRequest,
+		},
+		{
+			name:               "non-member cannot delete backup",
+			workspaceRole:      nil,
+			isGlobalAdmin:      false,
+			expectSuccess:      false,
+			expectedStatusCode: http.StatusBadRequest,
+		},
+		{
+			name:               "global admin can delete backup",
+			workspaceRole:      nil,
+			isGlobalAdmin:      true,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusNoContent,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router := createTestRouter()
+			owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+			workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+			database, backup := createTestDatabaseWithBackups(workspace, owner, router)
+
+			var testUserToken string
+			if tt.isGlobalAdmin {
+				admin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+				testUserToken = admin.Token
+			} else if tt.workspaceRole != nil {
+				if *tt.workspaceRole == users_enums.WorkspaceRoleOwner {
+					testUserToken = owner.Token
+				} else {
+					member := users_testing.CreateTestUser(users_enums.UserRoleMember)
+					workspaces_testing.AddMemberToWorkspace(workspace, member, *tt.workspaceRole, owner.Token, router)
+					testUserToken = member.Token
+				}
+			} else {
+				nonMember := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				testUserToken = nonMember.Token
+			}
+
+			testResp := test_utils.MakeDeleteRequest(
+				t,
+				router,
+				fmt.Sprintf("/api/v1/backups/%s", backup.ID.String()),
+				"Bearer "+testUserToken,
+				tt.expectedStatusCode,
+			)
+
+			if !tt.expectSuccess {
+				assert.Contains(t, string(testResp.Body), "insufficient permissions")
+			} else {
+				userService := users_services.GetUserService()
+				ownerUser, err := userService.GetUserFromToken(owner.Token)
+				assert.NoError(t, err)
+
+				backups, err := GetBackupService().GetBackups(ownerUser, database.ID)
+				assert.NoError(t, err)
+				assert.Equal(t, 0, len(backups))
+			}
+		})
+	}
+}
+
+func Test_DeleteBackup_AuditLogWritten(t *testing.T) {
+	router := createTestRouter()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	database, backup := createTestDatabaseWithBackups(workspace, owner, router)
+
+	test_utils.MakeDeleteRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/backups/%s", backup.ID.String()),
+		"Bearer "+owner.Token,
+		http.StatusNoContent,
+	)
+
+	time.Sleep(100 * time.Millisecond)
+
+	auditLogService := audit_logs.GetAuditLogService()
+	auditLogs, err := auditLogService.GetWorkspaceAuditLogs(
+		workspace.ID,
+		&audit_logs.GetAuditLogsRequest{
+			Limit:  100,
+			Offset: 0,
+		},
+	)
+	assert.NoError(t, err)
+
+	found := false
+	for _, log := range auditLogs.AuditLogs {
+		if strings.Contains(log.Message, "Backup deleted") &&
+			strings.Contains(log.Message, database.Name) {
+			found = true
+			break
+		}
+	}
+	assert.True(t, found, "Audit log for backup deletion not found")
+}
+
+func Test_DownloadBackup_PermissionsEnforced(t *testing.T) {
+	tests := []struct {
+		name               string
+		workspaceRole      *users_enums.WorkspaceRole
+		isGlobalAdmin      bool
+		expectSuccess      bool
+		expectedStatusCode int
+	}{
+		{
+			name:               "workspace viewer can download backup",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleViewer; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace member can download backup",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleMember; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "non-member cannot download backup",
+			workspaceRole:      nil,
+			isGlobalAdmin:      false,
+			expectSuccess:      false,
+			expectedStatusCode: http.StatusBadRequest,
+		},
+		{
+			name:               "global admin can download backup",
+			workspaceRole:      nil,
+			isGlobalAdmin:      true,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router := createTestRouter()
+			owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+			workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+			_, backup := createTestDatabaseWithBackups(workspace, owner, router)
+
+			var testUserToken string
+			if tt.isGlobalAdmin {
+				admin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+				testUserToken = admin.Token
+			} else if tt.workspaceRole != nil {
+				if *tt.workspaceRole == users_enums.WorkspaceRoleOwner {
+					testUserToken = owner.Token
+				} else {
+					member := users_testing.CreateTestUser(users_enums.UserRoleMember)
+					workspaces_testing.AddMemberToWorkspace(workspace, member, *tt.workspaceRole, owner.Token, router)
+					testUserToken = member.Token
+				}
+			} else {
+				nonMember := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				testUserToken = nonMember.Token
+			}
+
+			testResp := test_utils.MakeGetRequest(
+				t,
+				router,
+				fmt.Sprintf("/api/v1/backups/%s/file", backup.ID.String()),
+				"Bearer "+testUserToken,
+				tt.expectedStatusCode,
+			)
+
+			if !tt.expectSuccess {
+				assert.Contains(t, string(testResp.Body), "insufficient permissions")
+			}
+		})
+	}
+}
+
+func Test_DownloadBackup_AuditLogWritten(t *testing.T) {
+	router := createTestRouter()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	database, backup := createTestDatabaseWithBackups(workspace, owner, router)
+
+	test_utils.MakeGetRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/backups/%s/file", backup.ID.String()),
+		"Bearer "+owner.Token,
+		http.StatusOK,
+	)
+
+	time.Sleep(100 * time.Millisecond)
+
+	auditLogService := audit_logs.GetAuditLogService()
+	auditLogs, err := auditLogService.GetWorkspaceAuditLogs(
+		workspace.ID,
+		&audit_logs.GetAuditLogsRequest{
+			Limit:  100,
+			Offset: 0,
+		},
+	)
+	assert.NoError(t, err)
+
+	found := false
+	for _, log := range auditLogs.AuditLogs {
+		if strings.Contains(log.Message, "Backup file downloaded") &&
+			strings.Contains(log.Message, database.Name) {
+			found = true
+			break
+		}
+	}
+	assert.True(t, found, "Audit log for backup download not found")
+}
+
+func createTestRouter() *gin.Engine {
+	return CreateTestRouter()
+}
+
+func createTestDatabase(
+	name string,
+	workspaceID uuid.UUID,
+	token string,
+	router *gin.Engine,
+) *databases.Database {
+	testDbName := "test_db"
+	request := databases.Database{
+		Name:        name,
+		WorkspaceID: &workspaceID,
+		Type:        databases.DatabaseTypePostgres,
+		Postgresql: &postgresql.PostgresqlDatabase{
+			Version:  tools.PostgresqlVersion16,
+			Host:     "localhost",
+			Port:     5432,
+			Username: "postgres",
+			Password: "postgres",
+			Database: &testDbName,
+		},
+	}
+
+	w := workspaces_testing.MakeAPIRequest(
+		router,
+		"POST",
+		"/api/v1/databases/create",
+		"Bearer "+token,
+		request,
+	)
+
+	if w.Code != http.StatusCreated {
+		panic(
+			fmt.Sprintf("Failed to create database. Status: %d, Body: %s", w.Code, w.Body.String()),
+		)
+	}
+
+	var database databases.Database
+	if err := json.Unmarshal(w.Body.Bytes(), &database); err != nil {
+		panic(err)
+	}
+
+	return &database
+}
+
+func createTestStorage(workspaceID uuid.UUID) *storages.Storage {
+	storage := &storages.Storage{
+		WorkspaceID:  workspaceID,
+		Type:         storages.StorageTypeLocal,
+		Name:         "Test Storage " + uuid.New().String(),
+		LocalStorage: &local_storage.LocalStorage{},
+	}
+
+	repo := &storages.StorageRepository{}
+	storage, err := repo.Save(storage)
+	if err != nil {
+		panic(err)
+	}
+
+	return storage
+}
+
+func enableBackupForDatabase(databaseID uuid.UUID) {
+	configService := backups_config.GetBackupConfigService()
+	config, err := configService.GetBackupConfigByDbId(databaseID)
+	if err != nil {
+		panic(err)
+	}
+
+	config.IsBackupsEnabled = true
+	_, err = configService.SaveBackupConfig(config)
+	if err != nil {
+		panic(err)
+	}
+}
+
+func createTestDatabaseWithBackups(
+	workspace *workspaces_models.Workspace,
+	owner *users_dto.SignInResponseDTO,
+	router *gin.Engine,
+) (*databases.Database, *Backup) {
+	database := createTestDatabase("Test Database", workspace.ID, owner.Token, router)
+	storage := createTestStorage(workspace.ID)
+
+	configService := backups_config.GetBackupConfigService()
+	config, err := configService.GetBackupConfigByDbId(database.ID)
+	if err != nil {
+		panic(err)
+	}
+
+	config.IsBackupsEnabled = true
+	config.StorageID = &storage.ID
+	config.Storage = storage
+	_, err = configService.SaveBackupConfig(config)
+	if err != nil {
+		panic(err)
+	}
+
+	backup := createTestBackup(database, owner)
+
+	return database, backup
+}
+
+func createTestBackup(
+	database *databases.Database,
+	owner *users_dto.SignInResponseDTO,
+) *Backup {
+	userService := users_services.GetUserService()
+	user, err := userService.GetUserFromToken(owner.Token)
+	if err != nil {
+		panic(err)
+	}
+
+	storages, err := storages.GetStorageService().GetStorages(user, *database.WorkspaceID)
+	if err != nil || len(storages) == 0 {
+		panic("No storage found for workspace")
+	}
+
+	backup := &Backup{
+		ID:               uuid.New(),
+		DatabaseID:       database.ID,
+		Database:         database,
+		StorageID:        storages[0].ID,
+		Storage:          storages[0],
+		Status:           BackupStatusCompleted,
+		BackupSizeMb:     10.5,
+		BackupDurationMs: 1000,
+		CreatedAt:        time.Now().UTC(),
+	}
+
+	repo := &BackupRepository{}
+	if err := repo.Save(backup); err != nil {
+		panic(err)
+	}
+
+	// Create a dummy backup file for testing download functionality
+	dummyContent := []byte("dummy backup content for testing")
+	reader := strings.NewReader(string(dummyContent))
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	if err := storages[0].SaveFile(logger, backup.ID, reader); err != nil {
+		panic(fmt.Sprintf("Failed to create test backup file: %v", err))
+	}
+
+	return backup
+}

backend/internal/features/backups/backups/di.go

@@ -1,12 +1,13 @@
 package backups
 
 import (
+	audit_logs "postgresus-backend/internal/features/audit_logs"
 	"postgresus-backend/internal/features/backups/backups/usecases"
 	backups_config "postgresus-backend/internal/features/backups/config"
 	"postgresus-backend/internal/features/databases"
 	"postgresus-backend/internal/features/notifiers"
 	"postgresus-backend/internal/features/storages"
-	"postgresus-backend/internal/features/users"
+	workspaces_services "postgresus-backend/internal/features/workspaces/services"
 	"postgresus-backend/internal/util/logger"
 	"time"
 )
@@ -22,6 +23,8 @@ var backupService = &BackupService{
 	usecases.GetCreateBackupUsecase(),
 	logger.GetLogger(),
 	[]BackupRemoveListener{},
+	workspaces_services.GetWorkspaceService(),
+	audit_logs.GetAuditLogService(),
 }
 
 var backupBackgroundService = &BackupBackgroundService{
@@ -35,7 +38,6 @@ var backupBackgroundService = &BackupBackgroundService{
 
 var backupController = &BackupController{
 	backupService,
-	users.GetUserService(),
 }
 
 func SetupDependencies() {

backend/internal/features/backups/backups/service.go

@@ -5,11 +5,13 @@ import (
 	"fmt"
 	"io"
 	"log/slog"
+	audit_logs "postgresus-backend/internal/features/audit_logs"
 	backups_config "postgresus-backend/internal/features/backups/config"
 	"postgresus-backend/internal/features/databases"
 	"postgresus-backend/internal/features/notifiers"
 	"postgresus-backend/internal/features/storages"
 	users_models "postgresus-backend/internal/features/users/models"
+	workspaces_services "postgresus-backend/internal/features/workspaces/services"
 	"slices"
 	"time"
 
@@ -29,6 +31,9 @@ type BackupService struct {
 	logger *slog.Logger
 
 	backupRemoveListeners []BackupRemoveListener
+
+	workspaceService *workspaces_services.WorkspaceService
+	auditLogService  *audit_logs.AuditLogService
 }
 
 func (s *BackupService) AddBackupRemoveListener(listener BackupRemoveListener) {
@@ -62,12 +67,26 @@ func (s *BackupService) MakeBackupWithAuth(
 		return err
 	}
 
-	if database.UserID != user.ID {
-		return errors.New("user does not have access to this database")
+	if database.WorkspaceID == nil {
+		return errors.New("cannot create backup for database without workspace")
+	}
+
+	canAccess, _, err := s.workspaceService.CanUserAccessWorkspace(*database.WorkspaceID, user)
+	if err != nil {
+		return err
+	}
+	if !canAccess {
+		return errors.New("insufficient permissions to create backup for this database")
 	}
 
 	go s.MakeBackup(databaseID, true)
 
+	s.auditLogService.WriteAuditLog(
+		fmt.Sprintf("Backup manually initiated for database: %s", database.Name),
+		&user.ID,
+		database.WorkspaceID,
+	)
+
 	return nil
 }
 
@@ -80,8 +99,16 @@ func (s *BackupService) GetBackups(
 		return nil, err
 	}
 
-	if database.UserID != user.ID {
-		return nil, errors.New("user does not have access to this database")
+	if database.WorkspaceID == nil {
+		return nil, errors.New("cannot get backups for database without workspace")
+	}
+
+	canAccess, _, err := s.workspaceService.CanUserAccessWorkspace(*database.WorkspaceID, user)
+	if err != nil {
+		return nil, err
+	}
+	if !canAccess {
+		return nil, errors.New("insufficient permissions to access backups for this database")
 	}
 
 	backups, err := s.backupRepository.FindByDatabaseID(databaseID)
@@ -101,14 +128,32 @@ func (s *BackupService) DeleteBackup(
 		return err
 	}
 
-	if backup.Database.UserID != user.ID {
-		return errors.New("user does not have access to this backup")
+	if backup.Database.WorkspaceID == nil {
+		return errors.New("cannot delete backup for database without workspace")
+	}
+
+	canManage, err := s.workspaceService.CanUserManageDBs(*backup.Database.WorkspaceID, user)
+	if err != nil {
+		return err
+	}
+	if !canManage {
+		return errors.New("insufficient permissions to delete backup for this database")
 	}
 
 	if backup.Status == BackupStatusInProgress {
 		return errors.New("backup is in progress")
 	}
 
+	s.auditLogService.WriteAuditLog(
+		fmt.Sprintf(
+			"Backup deleted for database: %s (ID: %s)",
+			backup.Database.Name,
+			backupID.String(),
+		),
+		&user.ID,
+		backup.Database.WorkspaceID,
+	)
+
 	return s.deleteBackup(backup)
 }
 
@@ -328,8 +373,19 @@ func (s *BackupService) GetBackupFile(
 		return nil, err
 	}
 
-	if backup.Database.UserID != user.ID {
-		return nil, errors.New("user does not have access to this backup")
+	if backup.Database.WorkspaceID == nil {
+		return nil, errors.New("cannot download backup for database without workspace")
+	}
+
+	canAccess, _, err := s.workspaceService.CanUserAccessWorkspace(
+		*backup.Database.WorkspaceID,
+		user,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if !canAccess {
+		return nil, errors.New("insufficient permissions to download backup for this database")
 	}
 
 	storage, err := s.storageService.GetStorageByID(backup.StorageID)
@@ -337,6 +393,16 @@ func (s *BackupService) GetBackupFile(
 		return nil, err
 	}
 
+	s.auditLogService.WriteAuditLog(
+		fmt.Sprintf(
+			"Backup file downloaded for database: %s (ID: %s)",
+			backup.Database.Name,
+			backupID.String(),
+		),
+		&user.ID,
+		backup.Database.WorkspaceID,
+	)
+
 	return storage.GetFile(backup.ID)
 }
 

backend/internal/features/backups/backups/service_test.go

@@ -6,10 +6,13 @@ import (
 	"postgresus-backend/internal/features/databases"
 	"postgresus-backend/internal/features/notifiers"
 	"postgresus-backend/internal/features/storages"
-	"postgresus-backend/internal/features/users"
+	users_enums "postgresus-backend/internal/features/users/enums"
+	users_testing "postgresus-backend/internal/features/users/testing"
+	workspaces_testing "postgresus-backend/internal/features/workspaces/testing"
 	"postgresus-backend/internal/util/logger"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
@@ -17,15 +20,27 @@ import (
 )
 
 func Test_BackupExecuted_NotificationSent(t *testing.T) {
-	user := users.GetTestUser()
-	storage := storages.CreateTestStorage(user.UserID)
-	notifier := notifiers.CreateTestNotifier(user.UserID)
-	database := databases.CreateTestDatabase(user.UserID, storage, notifier)
+	user := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+	router := CreateTestRouter()
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", user, router)
+	storage := storages.CreateTestStorage(workspace.ID)
+	notifier := notifiers.CreateTestNotifier(workspace.ID)
+	database := databases.CreateTestDatabase(workspace.ID, storage, notifier)
 	backups_config.EnableBackupsForTestDatabase(database.ID, storage)
 
-	defer storages.RemoveTestStorage(storage.ID)
-	defer notifiers.RemoveTestNotifier(notifier)
-	defer databases.RemoveTestDatabase(database)
+	defer func() {
+		// cleanup backups first
+		backups, _ := backupRepository.FindByDatabaseID(database.ID)
+		for _, backup := range backups {
+			backupRepository.DeleteByID(backup.ID)
+		}
+
+		databases.RemoveTestDatabase(database)
+		time.Sleep(50 * time.Millisecond) // Wait for cascading deletes
+		notifiers.RemoveTestNotifier(notifier)
+		storages.RemoveTestStorage(storage.ID)
+		workspaces_testing.RemoveTestWorkspace(workspace, router)
+	}()
 
 	t.Run("BackupFailed_FailNotificationSent", func(t *testing.T) {
 		mockNotificationSender := &MockNotificationSender{}
@@ -39,6 +54,8 @@ func Test_BackupExecuted_NotificationSent(t *testing.T) {
 			&CreateFailedBackupUsecase{},
 			logger.GetLogger(),
 			[]BackupRemoveListener{},
+			nil, // workspaceService
+			nil, // auditLogService
 		}
 
 		// Set up expectations
@@ -82,6 +99,8 @@ func Test_BackupExecuted_NotificationSent(t *testing.T) {
 			&CreateSuccessBackupUsecase{},
 			logger.GetLogger(),
 			[]BackupRemoveListener{},
+			nil, // workspaceService
+			nil, // auditLogService
 		}
 
 		backupService.MakeBackup(database.ID, true)
@@ -102,6 +121,8 @@ func Test_BackupExecuted_NotificationSent(t *testing.T) {
 			&CreateSuccessBackupUsecase{},
 			logger.GetLogger(),
 			[]BackupRemoveListener{},
+			nil, // workspaceService
+			nil, // auditLogService
 		}
 
 		// capture arguments

backend/internal/features/backups/backups/testing.go

@@ -0,0 +1,20 @@
+package backups
+
+import (
+	backups_config "postgresus-backend/internal/features/backups/config"
+	"postgresus-backend/internal/features/databases"
+	workspaces_controllers "postgresus-backend/internal/features/workspaces/controllers"
+	workspaces_testing "postgresus-backend/internal/features/workspaces/testing"
+
+	"github.com/gin-gonic/gin"
+)
+
+func CreateTestRouter() *gin.Engine {
+	return workspaces_testing.CreateTestRouter(
+		workspaces_controllers.GetWorkspaceController(),
+		workspaces_controllers.GetMembershipController(),
+		databases.GetDatabaseController(),
+		backups_config.GetBackupConfigController(),
+		GetBackupController(),
+	)
+}

backend/internal/features/backups/config/controller.go

@@ -2,7 +2,7 @@ package backups_config
 
 import (
 	"net/http"
-	"postgresus-backend/internal/features/users"
+	users_middleware "postgresus-backend/internal/features/users/middleware"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
@@ -10,7 +10,6 @@ import (
 
 type BackupConfigController struct {
 	backupConfigService *BackupConfigService
-	userService         *users.UserService
 }
 
 func (c *BackupConfigController) RegisterRoutes(router *gin.RouterGroup) {
@@ -32,24 +31,18 @@ func (c *BackupConfigController) RegisterRoutes(router *gin.RouterGroup) {
 // @Failure 500
 // @Router /backup-configs/save [post]
 func (c *BackupConfigController) SaveBackupConfig(ctx *gin.Context) {
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
 	var requestDTO BackupConfig
 	if err := ctx.ShouldBindJSON(&requestDTO); err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
-		return
-	}
-
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-		return
-	}
-
 	// make sure we rely on full .Storage object
 	requestDTO.StorageID = nil
 
@@ -74,30 +67,18 @@ func (c *BackupConfigController) SaveBackupConfig(ctx *gin.Context) {
 // @Failure 404
 // @Router /backup-configs/database/{id} [get]
 func (c *BackupConfigController) GetBackupConfigByDbID(ctx *gin.Context) {
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
 	id, err := uuid.Parse(ctx.Param("id"))
 	if err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": "invalid database ID"})
 		return
 	}
 
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
-		return
-	}
-
-	_, err = c.userService.GetUserFromToken(authorizationHeader)
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-		return
-	}
-
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-		return
-	}
-
 	backupConfig, err := c.backupConfigService.GetBackupConfigByDbIdWithAuth(user, id)
 	if err != nil {
 		ctx.JSON(http.StatusNotFound, gin.H{"error": "backup configuration not found"})
@@ -113,31 +94,38 @@ func (c *BackupConfigController) GetBackupConfigByDbID(ctx *gin.Context) {
 // @Tags backup-configs
 // @Produce json
 // @Param id path string true "Storage ID"
+// @Param workspace_id query string true "Workspace ID"
 // @Success 200 {object} map[string]bool
 // @Failure 400
 // @Failure 401
 // @Failure 500
 // @Router /backup-configs/storage/{id}/is-using [get]
 func (c *BackupConfigController) IsStorageUsing(ctx *gin.Context) {
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
 	id, err := uuid.Parse(ctx.Param("id"))
 	if err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": "invalid storage ID"})
 		return
 	}
 
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
+	workspaceIDStr := ctx.Query("workspace_id")
+	if workspaceIDStr == "" {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "workspace_id query parameter is required"})
 		return
 	}
 
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
+	workspaceID, err := uuid.Parse(workspaceIDStr)
 	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "invalid workspace_id"})
 		return
 	}
 
-	isUsing, err := c.backupConfigService.IsStorageUsing(user, id)
+	isUsing, err := c.backupConfigService.IsStorageUsing(user, workspaceID, id)
 	if err != nil {
 		ctx.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return

backend/internal/features/backups/config/controller_test.go

@@ -0,0 +1,413 @@
+package backups_config
+
+import (
+	"encoding/json"
+	"net/http"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+
+	"postgresus-backend/internal/features/databases"
+	"postgresus-backend/internal/features/databases/databases/postgresql"
+	"postgresus-backend/internal/features/intervals"
+	"postgresus-backend/internal/features/storages"
+	users_enums "postgresus-backend/internal/features/users/enums"
+	users_testing "postgresus-backend/internal/features/users/testing"
+	workspaces_controllers "postgresus-backend/internal/features/workspaces/controllers"
+	workspaces_testing "postgresus-backend/internal/features/workspaces/testing"
+	"postgresus-backend/internal/util/period"
+	test_utils "postgresus-backend/internal/util/testing"
+	"postgresus-backend/internal/util/tools"
+)
+
+func createTestRouter() *gin.Engine {
+	router := workspaces_testing.CreateTestRouter(
+		workspaces_controllers.GetWorkspaceController(),
+		workspaces_controllers.GetMembershipController(),
+		databases.GetDatabaseController(),
+		GetBackupConfigController(),
+	)
+	return router
+}
+
+func Test_SaveBackupConfig_PermissionsEnforced(t *testing.T) {
+	tests := []struct {
+		name               string
+		workspaceRole      *users_enums.WorkspaceRole
+		isGlobalAdmin      bool
+		expectSuccess      bool
+		expectedStatusCode int
+	}{
+		{
+			name:               "workspace owner can save backup config",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleOwner; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace admin can save backup config",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleAdmin; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace member can save backup config",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleMember; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace viewer cannot save backup config",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleViewer; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      false,
+			expectedStatusCode: http.StatusBadRequest,
+		},
+		{
+			name:               "global admin can save backup config",
+			workspaceRole:      nil,
+			isGlobalAdmin:      true,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router := createTestRouter()
+			owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+			workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+			database := createTestDatabaseViaAPI("Test Database", workspace.ID, owner.Token, router)
+
+			var testUserToken string
+			if tt.isGlobalAdmin {
+				admin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+				testUserToken = admin.Token
+			} else if tt.workspaceRole != nil && *tt.workspaceRole == users_enums.WorkspaceRoleOwner {
+				testUserToken = owner.Token
+			} else if tt.workspaceRole != nil {
+				member := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				workspaces_testing.AddMemberToWorkspace(workspace, member, *tt.workspaceRole, owner.Token, router)
+				testUserToken = member.Token
+			}
+
+			timeOfDay := "04:00"
+			request := BackupConfig{
+				DatabaseID:       database.ID,
+				IsBackupsEnabled: true,
+				StorePeriod:      period.PeriodWeek,
+				BackupInterval: &intervals.Interval{
+					Interval:  intervals.IntervalDaily,
+					TimeOfDay: &timeOfDay,
+				},
+				SendNotificationsOn: []BackupNotificationType{
+					NotificationBackupFailed,
+				},
+				CpuCount:            2,
+				IsRetryIfFailed:     true,
+				MaxFailedTriesCount: 3,
+			}
+
+			var response BackupConfig
+			testResp := test_utils.MakePostRequestAndUnmarshal(
+				t,
+				router,
+				"/api/v1/backup-configs/save",
+				"Bearer "+testUserToken,
+				request,
+				tt.expectedStatusCode,
+				&response,
+			)
+
+			if tt.expectSuccess {
+				assert.Equal(t, database.ID, response.DatabaseID)
+				assert.True(t, response.IsBackupsEnabled)
+				assert.Equal(t, period.PeriodWeek, response.StorePeriod)
+				assert.Equal(t, 2, response.CpuCount)
+			} else {
+				assert.Contains(t, string(testResp.Body), "insufficient permissions")
+			}
+		})
+	}
+}
+
+func Test_SaveBackupConfig_WhenUserIsNotWorkspaceMember_ReturnsForbidden(t *testing.T) {
+	router := createTestRouter()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	database := createTestDatabaseViaAPI("Test Database", workspace.ID, owner.Token, router)
+
+	nonMember := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	timeOfDay := "04:00"
+	request := BackupConfig{
+		DatabaseID:       database.ID,
+		IsBackupsEnabled: true,
+		StorePeriod:      period.PeriodWeek,
+		BackupInterval: &intervals.Interval{
+			Interval:  intervals.IntervalDaily,
+			TimeOfDay: &timeOfDay,
+		},
+		SendNotificationsOn: []BackupNotificationType{
+			NotificationBackupFailed,
+		},
+		CpuCount:            2,
+		IsRetryIfFailed:     true,
+		MaxFailedTriesCount: 3,
+	}
+
+	testResp := test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/backup-configs/save",
+		"Bearer "+nonMember.Token,
+		request,
+		http.StatusBadRequest,
+	)
+
+	assert.Contains(t, string(testResp.Body), "insufficient permissions")
+}
+
+func Test_GetBackupConfigByDbID_PermissionsEnforced(t *testing.T) {
+	tests := []struct {
+		name               string
+		workspaceRole      *users_enums.WorkspaceRole
+		isGlobalAdmin      bool
+		expectSuccess      bool
+		expectedStatusCode int
+	}{
+		{
+			name:               "workspace owner can get backup config",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleOwner; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace admin can get backup config",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleAdmin; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace member can get backup config",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleMember; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace viewer can get backup config",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleViewer; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "global admin can get backup config",
+			workspaceRole:      nil,
+			isGlobalAdmin:      true,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "non-member cannot get backup config",
+			workspaceRole:      nil,
+			isGlobalAdmin:      false,
+			expectSuccess:      false,
+			expectedStatusCode: http.StatusNotFound,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router := createTestRouter()
+			owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+			workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+			database := createTestDatabaseViaAPI("Test Database", workspace.ID, owner.Token, router)
+
+			var testUserToken string
+			if tt.isGlobalAdmin {
+				admin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+				testUserToken = admin.Token
+			} else if tt.workspaceRole != nil && *tt.workspaceRole == users_enums.WorkspaceRoleOwner {
+				testUserToken = owner.Token
+			} else if tt.workspaceRole != nil {
+				member := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				workspaces_testing.AddMemberToWorkspace(workspace, member, *tt.workspaceRole, owner.Token, router)
+				testUserToken = member.Token
+			} else {
+				nonMember := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				testUserToken = nonMember.Token
+			}
+
+			var response BackupConfig
+			testResp := test_utils.MakeGetRequestAndUnmarshal(
+				t,
+				router,
+				"/api/v1/backup-configs/database/"+database.ID.String(),
+				"Bearer "+testUserToken,
+				tt.expectedStatusCode,
+				&response,
+			)
+
+			if tt.expectSuccess {
+				assert.Equal(t, database.ID, response.DatabaseID)
+				assert.NotNil(t, response.BackupInterval)
+			} else {
+				assert.Contains(t, string(testResp.Body), "backup configuration not found")
+			}
+		})
+	}
+}
+
+func Test_GetBackupConfigByDbID_ReturnsDefaultConfigForNewDatabase(t *testing.T) {
+	router := createTestRouter()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	database := createTestDatabaseViaAPI("Test Database", workspace.ID, owner.Token, router)
+
+	var response BackupConfig
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/backup-configs/database/"+database.ID.String(),
+		"Bearer "+owner.Token,
+		http.StatusOK,
+		&response,
+	)
+
+	assert.Equal(t, database.ID, response.DatabaseID)
+	assert.False(t, response.IsBackupsEnabled)
+	assert.Equal(t, period.PeriodWeek, response.StorePeriod)
+	assert.Equal(t, 1, response.CpuCount)
+	assert.True(t, response.IsRetryIfFailed)
+	assert.Equal(t, 3, response.MaxFailedTriesCount)
+	assert.NotNil(t, response.BackupInterval)
+}
+
+func Test_IsStorageUsing_PermissionsEnforced(t *testing.T) {
+	tests := []struct {
+		name               string
+		isStorageOwner     bool
+		expectSuccess      bool
+		expectedStatusCode int
+	}{
+		{
+			name:               "storage owner can check storage usage",
+			isStorageOwner:     true,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "non-storage-owner cannot check storage usage",
+			isStorageOwner:     false,
+			expectSuccess:      false,
+			expectedStatusCode: http.StatusInternalServerError,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router := createTestRouter()
+			storageOwner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+			workspace := workspaces_testing.CreateTestWorkspace(
+				"Test Workspace",
+				storageOwner,
+				router,
+			)
+			storage := createTestStorage(workspace.ID)
+
+			var testUserToken string
+			if tt.isStorageOwner {
+				testUserToken = storageOwner.Token
+			} else {
+				otherUser := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				testUserToken = otherUser.Token
+			}
+
+			if tt.expectSuccess {
+				var response map[string]bool
+				test_utils.MakeGetRequestAndUnmarshal(
+					t,
+					router,
+					"/api/v1/backup-configs/storage/"+storage.ID.String()+"/is-using?workspace_id="+workspace.ID.String(),
+					"Bearer "+testUserToken,
+					tt.expectedStatusCode,
+					&response,
+				)
+
+				isUsing, exists := response["isUsing"]
+				assert.True(t, exists)
+				assert.False(t, isUsing)
+			} else {
+				testResp := test_utils.MakeGetRequest(
+					t,
+					router,
+					"/api/v1/backup-configs/storage/"+storage.ID.String()+"/is-using?workspace_id="+workspace.ID.String(),
+					"Bearer "+testUserToken,
+					tt.expectedStatusCode,
+				)
+				assert.Contains(t, string(testResp.Body), "error")
+			}
+
+			// Cleanup
+			storages.RemoveTestStorage(storage.ID)
+			workspaces_testing.RemoveTestWorkspace(workspace, router)
+		})
+	}
+}
+
+func createTestDatabaseViaAPI(
+	name string,
+	workspaceID uuid.UUID,
+	token string,
+	router *gin.Engine,
+) *databases.Database {
+	testDbName := "test_db"
+	request := databases.Database{
+		WorkspaceID: &workspaceID,
+		Name:        name,
+		Type:        databases.DatabaseTypePostgres,
+		Postgresql: &postgresql.PostgresqlDatabase{
+			Version:  tools.PostgresqlVersion16,
+			Host:     "localhost",
+			Port:     5432,
+			Username: "postgres",
+			Password: "postgres",
+			Database: &testDbName,
+		},
+	}
+
+	w := workspaces_testing.MakeAPIRequest(
+		router,
+		"POST",
+		"/api/v1/databases/create",
+		"Bearer "+token,
+		request,
+	)
+
+	if w.Code != http.StatusCreated {
+		panic("Failed to create database")
+	}
+
+	var database databases.Database
+	if err := json.Unmarshal(w.Body.Bytes(), &database); err != nil {
+		panic(err)
+	}
+	return &database
+}
+
+func createTestStorage(workspaceID uuid.UUID) *storages.Storage {
+	return storages.CreateTestStorage(workspaceID)
+}

backend/internal/features/backups/config/di.go

@@ -3,7 +3,7 @@ package backups_config
 import (
 	"postgresus-backend/internal/features/databases"
 	"postgresus-backend/internal/features/storages"
-	"postgresus-backend/internal/features/users"
+	workspaces_services "postgresus-backend/internal/features/workspaces/services"
 )
 
 var backupConfigRepository = &BackupConfigRepository{}
@@ -11,11 +11,11 @@ var backupConfigService = &BackupConfigService{
 	backupConfigRepository,
 	databases.GetDatabaseService(),
 	storages.GetStorageService(),
+	workspaces_services.GetWorkspaceService(),
 	nil,
 }
 var backupConfigController = &BackupConfigController{
 	backupConfigService,
-	users.GetUserService(),
 }
 
 func GetBackupConfigController() *BackupConfigController {

backend/internal/features/backups/config/service.go

@@ -1,10 +1,13 @@
 package backups_config
 
 import (
+	"errors"
+
 	"postgresus-backend/internal/features/databases"
 	"postgresus-backend/internal/features/intervals"
 	"postgresus-backend/internal/features/storages"
 	users_models "postgresus-backend/internal/features/users/models"
+	workspaces_services "postgresus-backend/internal/features/workspaces/services"
 	"postgresus-backend/internal/util/period"
 
 	"github.com/google/uuid"
@@ -14,6 +17,7 @@ type BackupConfigService struct {
 	backupConfigRepository *BackupConfigRepository
 	databaseService        *databases.DatabaseService
 	storageService         *storages.StorageService
+	workspaceService       *workspaces_services.WorkspaceService
 
 	dbStorageChangeListener BackupConfigStorageChangeListener
 }
@@ -32,11 +36,23 @@ func (s *BackupConfigService) SaveBackupConfigWithAuth(
 		return nil, err
 	}
 
-	_, err := s.databaseService.GetDatabase(user, backupConfig.DatabaseID)
+	database, err := s.databaseService.GetDatabase(user, backupConfig.DatabaseID)
 	if err != nil {
 		return nil, err
 	}
 
+	if database.WorkspaceID == nil {
+		return nil, errors.New("cannot save backup config for database without workspace")
+	}
+
+	canManage, err := s.workspaceService.CanUserManageDBs(*database.WorkspaceID, user)
+	if err != nil {
+		return nil, err
+	}
+	if !canManage {
+		return nil, errors.New("insufficient permissions to modify backup configuration")
+	}
+
 	return s.SaveBackupConfig(backupConfig)
 }
 
@@ -116,6 +132,7 @@ func (s *BackupConfigService) GetBackupConfigByDbId(
 
 func (s *BackupConfigService) IsStorageUsing(
 	user *users_models.User,
+	workspaceID uuid.UUID,
 	storageID uuid.UUID,
 ) (bool, error) {
 	_, err := s.storageService.GetStorage(user, storageID)
@@ -144,6 +161,10 @@ func (s *BackupConfigService) OnDatabaseCopied(originalDatabaseID, newDatabaseID
 	}
 }
 
+func (s *BackupConfigService) CreateDisabledBackupConfig(databaseID uuid.UUID) error {
+	return s.initializeDefaultConfig(databaseID)
+}
+
 func (s *BackupConfigService) initializeDefaultConfig(
 	databaseID uuid.UUID,
 ) error {

backend/internal/features/databases/controller.go

@@ -2,15 +2,18 @@ package databases
 
 import (
 	"net/http"
-	"postgresus-backend/internal/features/users"
+	users_middleware "postgresus-backend/internal/features/users/middleware"
+	users_services "postgresus-backend/internal/features/users/services"
+	workspaces_services "postgresus-backend/internal/features/workspaces/services"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 )
 
 type DatabaseController struct {
-	databaseService *DatabaseService
-	userService     *users.UserService
+	databaseService  *DatabaseService
+	userService      *users_services.UserService
+	workspaceService *workspaces_services.WorkspaceService
 }
 
 func (c *DatabaseController) RegisterRoutes(router *gin.RouterGroup) {
@@ -28,36 +31,35 @@ func (c *DatabaseController) RegisterRoutes(router *gin.RouterGroup) {
 
 // CreateDatabase
 // @Summary Create a new database
-// @Description Create a new database configuration
+// @Description Create a new database configuration in a workspace
 // @Tags databases
 // @Accept json
 // @Produce json
-// @Param request body Database true "Database creation data"
+// @Param request body Database true "Database creation data with workspaceId"
 // @Success 201 {object} Database
 // @Failure 400
 // @Failure 401
 // @Failure 500
 // @Router /databases/create [post]
 func (c *DatabaseController) CreateDatabase(ctx *gin.Context) {
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
 	var request Database
 	if err := ctx.ShouldBindJSON(&request); err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
+	if request.WorkspaceID == nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "workspaceId is required"})
 		return
 	}
 
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-		return
-	}
-
-	database, err := c.databaseService.CreateDatabase(user, &request)
+	database, err := c.databaseService.CreateDatabase(user, *request.WorkspaceID, &request)
 	if err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
@@ -79,24 +81,18 @@ func (c *DatabaseController) CreateDatabase(ctx *gin.Context) {
 // @Failure 500
 // @Router /databases/update [post]
 func (c *DatabaseController) UpdateDatabase(ctx *gin.Context) {
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
 	var request Database
 	if err := ctx.ShouldBindJSON(&request); err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
-		return
-	}
-
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-		return
-	}
-
 	if err := c.databaseService.UpdateDatabase(user, &request); err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
@@ -116,24 +112,18 @@ func (c *DatabaseController) UpdateDatabase(ctx *gin.Context) {
 // @Failure 500
 // @Router /databases/{id} [delete]
 func (c *DatabaseController) DeleteDatabase(ctx *gin.Context) {
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
 	id, err := uuid.Parse(ctx.Param("id"))
 	if err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": "invalid database ID"})
 		return
 	}
 
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
-		return
-	}
-
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-		return
-	}
-
 	if err := c.databaseService.DeleteDatabase(user, id); err != nil {
 		ctx.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -153,24 +143,18 @@ func (c *DatabaseController) DeleteDatabase(ctx *gin.Context) {
 // @Failure 401
 // @Router /databases/{id} [get]
 func (c *DatabaseController) GetDatabase(ctx *gin.Context) {
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
 	id, err := uuid.Parse(ctx.Param("id"))
 	if err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": "invalid database ID"})
 		return
 	}
 
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
-		return
-	}
-
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-		return
-	}
-
 	database, err := c.databaseService.GetDatabase(user, id)
 	if err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
@@ -181,30 +165,38 @@ func (c *DatabaseController) GetDatabase(ctx *gin.Context) {
 }
 
 // GetDatabases
-// @Summary Get databases
-// @Description Get all databases for the authenticated user
+// @Summary Get databases by workspace
+// @Description Get all databases for a specific workspace
 // @Tags databases
 // @Produce json
+// @Param workspace_id query string true "Workspace ID"
 // @Success 200 {array} Database
+// @Failure 400
 // @Failure 401
 // @Failure 500
 // @Router /databases [get]
 func (c *DatabaseController) GetDatabases(ctx *gin.Context) {
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
 		return
 	}
 
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
+	workspaceIDStr := ctx.Query("workspace_id")
+	if workspaceIDStr == "" {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "workspace_id query parameter is required"})
 		return
 	}
 
-	databases, err := c.databaseService.GetDatabasesByUser(user)
+	workspaceID, err := uuid.Parse(workspaceIDStr)
 	if err != nil {
-		ctx.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "invalid workspace_id"})
+		return
+	}
+
+	databases, err := c.databaseService.GetDatabasesByWorkspace(user, workspaceID)
+	if err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
@@ -222,24 +214,18 @@ func (c *DatabaseController) GetDatabases(ctx *gin.Context) {
 // @Failure 500
 // @Router /databases/{id}/test-connection [post]
 func (c *DatabaseController) TestDatabaseConnection(ctx *gin.Context) {
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
 	id, err := uuid.Parse(ctx.Param("id"))
 	if err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": "invalid database ID"})
 		return
 	}
 
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
-		return
-	}
-
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-		return
-	}
-
 	if err := c.databaseService.TestDatabaseConnection(user, id); err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
@@ -259,27 +245,18 @@ func (c *DatabaseController) TestDatabaseConnection(ctx *gin.Context) {
 // @Failure 401
 // @Router /databases/test-connection-direct [post]
 func (c *DatabaseController) TestDatabaseConnectionDirect(ctx *gin.Context) {
+	_, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
 	var request Database
 	if err := ctx.ShouldBindJSON(&request); err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
-		return
-	}
-
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-		return
-	}
-
-	// Set user ID for validation purposes
-	request.UserID = user.ID
-
 	if err := c.databaseService.TestDatabaseConnectionDirect(&request); err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
@@ -294,31 +271,38 @@ func (c *DatabaseController) TestDatabaseConnectionDirect(ctx *gin.Context) {
 // @Tags databases
 // @Produce json
 // @Param id path string true "Notifier ID"
+// @Param workspace_id query string true "Workspace ID"
 // @Success 200 {object} map[string]bool
 // @Failure 400
 // @Failure 401
 // @Failure 500
 // @Router /databases/notifier/{id}/is-using [get]
 func (c *DatabaseController) IsNotifierUsing(ctx *gin.Context) {
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
 	id, err := uuid.Parse(ctx.Param("id"))
 	if err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": "invalid notifier ID"})
 		return
 	}
 
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
+	workspaceIDStr := ctx.Query("workspace_id")
+	if workspaceIDStr == "" {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "workspace_id query parameter is required"})
 		return
 	}
 
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
+	workspaceID, err := uuid.Parse(workspaceIDStr)
 	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "invalid workspace_id"})
 		return
 	}
 
-	isUsing, err := c.databaseService.IsNotifierUsing(user, id)
+	isUsing, err := c.databaseService.IsNotifierUsing(user, workspaceID, id)
 	if err != nil {
 		ctx.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -339,24 +323,18 @@ func (c *DatabaseController) IsNotifierUsing(ctx *gin.Context) {
 // @Failure 500
 // @Router /databases/{id}/copy [post]
 func (c *DatabaseController) CopyDatabase(ctx *gin.Context) {
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
 	id, err := uuid.Parse(ctx.Param("id"))
 	if err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": "invalid database ID"})
 		return
 	}
 
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
-		return
-	}
-
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-		return
-	}
-
 	copiedDatabase, err := c.databaseService.CopyDatabase(user, id)
 	if err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})

backend/internal/features/databases/controller_test.go

@@ -0,0 +1,770 @@
+package databases
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+
+	"postgresus-backend/internal/features/databases/databases/postgresql"
+	users_enums "postgresus-backend/internal/features/users/enums"
+	users_testing "postgresus-backend/internal/features/users/testing"
+	workspaces_controllers "postgresus-backend/internal/features/workspaces/controllers"
+	workspaces_testing "postgresus-backend/internal/features/workspaces/testing"
+	test_utils "postgresus-backend/internal/util/testing"
+	"postgresus-backend/internal/util/tools"
+)
+
+func createTestRouter() *gin.Engine {
+	router := workspaces_testing.CreateTestRouter(
+		workspaces_controllers.GetWorkspaceController(),
+		workspaces_controllers.GetMembershipController(),
+		GetDatabaseController(),
+	)
+	return router
+}
+
+func Test_CreateDatabase_PermissionsEnforced(t *testing.T) {
+	tests := []struct {
+		name               string
+		workspaceRole      *users_enums.WorkspaceRole
+		isGlobalAdmin      bool
+		expectSuccess      bool
+		expectedStatusCode int
+	}{
+		{
+			name:               "workspace owner can create database",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleOwner; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusCreated,
+		},
+		{
+			name:               "workspace member can create database",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleMember; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusCreated,
+		},
+		{
+			name:               "workspace viewer cannot create database",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleViewer; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      false,
+			expectedStatusCode: http.StatusBadRequest,
+		},
+		{
+			name:               "global admin can create database",
+			workspaceRole:      nil,
+			isGlobalAdmin:      true,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusCreated,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router := createTestRouter()
+			owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+			workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+			var testUserToken string
+			if tt.isGlobalAdmin {
+				admin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+				testUserToken = admin.Token
+			} else if tt.workspaceRole != nil && *tt.workspaceRole == users_enums.WorkspaceRoleOwner {
+				testUserToken = owner.Token
+			} else if tt.workspaceRole != nil {
+				member := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				workspaces_testing.AddMemberToWorkspace(workspace, member, *tt.workspaceRole, owner.Token, router)
+				testUserToken = member.Token
+			}
+
+			testDbName := "test_db"
+			request := Database{
+				Name:        "Test Database",
+				WorkspaceID: &workspace.ID,
+				Type:        DatabaseTypePostgres,
+				Postgresql: &postgresql.PostgresqlDatabase{
+					Version:  tools.PostgresqlVersion16,
+					Host:     "localhost",
+					Port:     5432,
+					Username: "postgres",
+					Password: "postgres",
+					Database: &testDbName,
+				},
+			}
+
+			var response Database
+			testResp := test_utils.MakePostRequestAndUnmarshal(
+				t,
+				router,
+				"/api/v1/databases/create",
+				"Bearer "+testUserToken,
+				request,
+				tt.expectedStatusCode,
+				&response,
+			)
+
+			if tt.expectSuccess {
+				assert.Equal(t, "Test Database", response.Name)
+				assert.NotEqual(t, uuid.Nil, response.ID)
+			} else {
+				assert.Contains(t, string(testResp.Body), "insufficient permissions")
+			}
+		})
+	}
+}
+
+func Test_CreateDatabase_WhenUserIsNotWorkspaceMember_ReturnsForbidden(t *testing.T) {
+	router := createTestRouter()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	nonMember := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	testDbName := "test_db"
+	request := Database{
+		Name:        "Test Database",
+		WorkspaceID: &workspace.ID,
+		Type:        DatabaseTypePostgres,
+		Postgresql: &postgresql.PostgresqlDatabase{
+			Version:  tools.PostgresqlVersion16,
+			Host:     "localhost",
+			Port:     5432,
+			Username: "postgres",
+			Password: "postgres",
+			Database: &testDbName,
+		},
+	}
+
+	testResp := test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/databases/create",
+		"Bearer "+nonMember.Token,
+		request,
+		http.StatusBadRequest,
+	)
+
+	assert.Contains(t, string(testResp.Body), "insufficient permissions")
+}
+
+func Test_UpdateDatabase_PermissionsEnforced(t *testing.T) {
+	tests := []struct {
+		name               string
+		workspaceRole      *users_enums.WorkspaceRole
+		isGlobalAdmin      bool
+		expectSuccess      bool
+		expectedStatusCode int
+	}{
+		{
+			name:               "workspace owner can update database",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleOwner; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace member can update database",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleMember; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace viewer cannot update database",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleViewer; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      false,
+			expectedStatusCode: http.StatusBadRequest,
+		},
+		{
+			name:               "global admin can update database",
+			workspaceRole:      nil,
+			isGlobalAdmin:      true,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router := createTestRouter()
+			owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+			workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+			database := createTestDatabaseViaAPI("Test Database", workspace.ID, owner.Token, router)
+
+			var testUserToken string
+			if tt.isGlobalAdmin {
+				admin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+				testUserToken = admin.Token
+			} else if tt.workspaceRole != nil && *tt.workspaceRole == users_enums.WorkspaceRoleOwner {
+				testUserToken = owner.Token
+			} else if tt.workspaceRole != nil {
+				member := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				workspaces_testing.AddMemberToWorkspace(workspace, member, *tt.workspaceRole, owner.Token, router)
+				testUserToken = member.Token
+			}
+
+			database.Name = "Updated Database"
+
+			var response Database
+			testResp := test_utils.MakePostRequestAndUnmarshal(
+				t,
+				router,
+				"/api/v1/databases/update",
+				"Bearer "+testUserToken,
+				database,
+				tt.expectedStatusCode,
+				&response,
+			)
+
+			if tt.expectSuccess {
+				assert.Equal(t, "Updated Database", response.Name)
+			} else {
+				assert.Contains(t, string(testResp.Body), "insufficient permissions")
+			}
+		})
+	}
+}
+
+func Test_UpdateDatabase_WhenUserIsNotWorkspaceMember_ReturnsForbidden(t *testing.T) {
+	router := createTestRouter()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	database := createTestDatabaseViaAPI("Test Database", workspace.ID, owner.Token, router)
+
+	nonMember := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	database.Name = "Hacked Name"
+
+	testResp := test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/databases/update",
+		"Bearer "+nonMember.Token,
+		database,
+		http.StatusBadRequest,
+	)
+
+	assert.Contains(t, string(testResp.Body), "insufficient permissions")
+}
+
+func Test_DeleteDatabase_PermissionsEnforced(t *testing.T) {
+	tests := []struct {
+		name               string
+		workspaceRole      *users_enums.WorkspaceRole
+		isGlobalAdmin      bool
+		expectSuccess      bool
+		expectedStatusCode int
+	}{
+		{
+			name:               "workspace owner can delete database",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleOwner; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusNoContent,
+		},
+		{
+			name:               "workspace member can delete database",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleMember; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusNoContent,
+		},
+		{
+			name:               "workspace viewer cannot delete database",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleViewer; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      false,
+			expectedStatusCode: http.StatusInternalServerError,
+		},
+		{
+			name:               "global admin can delete database",
+			workspaceRole:      nil,
+			isGlobalAdmin:      true,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusNoContent,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router := createTestRouter()
+			owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+			workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+			database := createTestDatabaseViaAPI("Test Database", workspace.ID, owner.Token, router)
+
+			var testUserToken string
+			if tt.isGlobalAdmin {
+				admin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+				testUserToken = admin.Token
+			} else if tt.workspaceRole != nil && *tt.workspaceRole == users_enums.WorkspaceRoleOwner {
+				testUserToken = owner.Token
+			} else if tt.workspaceRole != nil {
+				member := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				workspaces_testing.AddMemberToWorkspace(workspace, member, *tt.workspaceRole, owner.Token, router)
+				testUserToken = member.Token
+			}
+
+			testResp := test_utils.MakeDeleteRequest(
+				t,
+				router,
+				"/api/v1/databases/"+database.ID.String(),
+				"Bearer "+testUserToken,
+				tt.expectedStatusCode,
+			)
+
+			if !tt.expectSuccess {
+				assert.Contains(t, string(testResp.Body), "insufficient permissions")
+			}
+		})
+	}
+}
+
+func Test_GetDatabase_PermissionsEnforced(t *testing.T) {
+	memberRole := users_enums.WorkspaceRoleViewer
+	tests := []struct {
+		name               string
+		userRole           *users_enums.WorkspaceRole
+		isGlobalAdmin      bool
+		expectSuccess      bool
+		expectedStatusCode int
+	}{
+		{
+			name:               "workspace member can get database",
+			userRole:           &memberRole,
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "non-member cannot get database",
+			userRole:           nil,
+			isGlobalAdmin:      false,
+			expectSuccess:      false,
+			expectedStatusCode: http.StatusBadRequest,
+		},
+		{
+			name:               "global admin can get database",
+			userRole:           nil,
+			isGlobalAdmin:      true,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router := createTestRouter()
+			owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+			workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+			database := createTestDatabaseViaAPI("Test Database", workspace.ID, owner.Token, router)
+
+			var testUser string
+			if tt.isGlobalAdmin {
+				admin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+				testUser = admin.Token
+			} else if tt.userRole != nil {
+				member := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				workspaces_testing.AddMemberToWorkspace(workspace, member, *tt.userRole, owner.Token, router)
+				testUser = member.Token
+			} else {
+				nonMember := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				testUser = nonMember.Token
+			}
+
+			var response Database
+			testResp := test_utils.MakeGetRequestAndUnmarshal(
+				t,
+				router,
+				"/api/v1/databases/"+database.ID.String(),
+				"Bearer "+testUser,
+				tt.expectedStatusCode,
+				&response,
+			)
+
+			if tt.expectSuccess {
+				assert.Equal(t, database.ID, response.ID)
+				assert.Equal(t, "Test Database", response.Name)
+			} else {
+				assert.Contains(t, string(testResp.Body), "insufficient permissions")
+			}
+		})
+	}
+}
+
+func Test_GetDatabasesByWorkspace_PermissionsEnforced(t *testing.T) {
+	tests := []struct {
+		name               string
+		isMember           bool
+		isGlobalAdmin      bool
+		expectSuccess      bool
+		expectedStatusCode int
+	}{
+		{
+			name:               "workspace member can list databases",
+			isMember:           true,
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "non-member cannot list databases",
+			isMember:           false,
+			isGlobalAdmin:      false,
+			expectSuccess:      false,
+			expectedStatusCode: http.StatusBadRequest,
+		},
+		{
+			name:               "global admin can list databases",
+			isMember:           false,
+			isGlobalAdmin:      true,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router := createTestRouter()
+			owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+			workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+			createTestDatabaseViaAPI("Database 1", workspace.ID, owner.Token, router)
+			createTestDatabaseViaAPI("Database 2", workspace.ID, owner.Token, router)
+
+			var testUser string
+			if tt.isGlobalAdmin {
+				admin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+				testUser = admin.Token
+			} else if tt.isMember {
+				testUser = owner.Token
+			} else {
+				nonMember := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				testUser = nonMember.Token
+			}
+
+			if tt.expectSuccess {
+				var response []Database
+				test_utils.MakeGetRequestAndUnmarshal(
+					t,
+					router,
+					"/api/v1/databases?workspace_id="+workspace.ID.String(),
+					"Bearer "+testUser,
+					tt.expectedStatusCode,
+					&response,
+				)
+				assert.GreaterOrEqual(t, len(response), 2)
+			} else {
+				testResp := test_utils.MakeGetRequest(
+					t,
+					router,
+					"/api/v1/databases?workspace_id="+workspace.ID.String(),
+					"Bearer "+testUser,
+					tt.expectedStatusCode,
+				)
+				assert.Contains(t, string(testResp.Body), "insufficient permissions")
+			}
+		})
+	}
+}
+
+func Test_GetDatabasesByWorkspace_WhenMultipleDatabasesExist_ReturnsCorrectCount(t *testing.T) {
+	router := createTestRouter()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	createTestDatabaseViaAPI("Database 1", workspace.ID, owner.Token, router)
+	createTestDatabaseViaAPI("Database 2", workspace.ID, owner.Token, router)
+	createTestDatabaseViaAPI("Database 3", workspace.ID, owner.Token, router)
+
+	var response []Database
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/databases?workspace_id="+workspace.ID.String(),
+		"Bearer "+owner.Token,
+		http.StatusOK,
+		&response,
+	)
+
+	assert.Equal(t, 3, len(response))
+}
+
+func Test_GetDatabasesByWorkspace_EnsuresCrossWorkspaceIsolation(t *testing.T) {
+	router := createTestRouter()
+	owner1 := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace1 := workspaces_testing.CreateTestWorkspace("Workspace 1", owner1, router)
+
+	owner2 := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace2 := workspaces_testing.CreateTestWorkspace("Workspace 2", owner2, router)
+
+	createTestDatabaseViaAPI("Workspace1 DB1", workspace1.ID, owner1.Token, router)
+	createTestDatabaseViaAPI("Workspace1 DB2", workspace1.ID, owner1.Token, router)
+
+	createTestDatabaseViaAPI("Workspace2 DB1", workspace2.ID, owner2.Token, router)
+
+	var workspace1Dbs []Database
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/databases?workspace_id="+workspace1.ID.String(),
+		"Bearer "+owner1.Token,
+		http.StatusOK,
+		&workspace1Dbs,
+	)
+
+	var workspace2Dbs []Database
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/databases?workspace_id="+workspace2.ID.String(),
+		"Bearer "+owner2.Token,
+		http.StatusOK,
+		&workspace2Dbs,
+	)
+
+	assert.Equal(t, 2, len(workspace1Dbs))
+	assert.Equal(t, 1, len(workspace2Dbs))
+
+	for _, db := range workspace1Dbs {
+		assert.Equal(t, workspace1.ID, *db.WorkspaceID)
+	}
+
+	for _, db := range workspace2Dbs {
+		assert.Equal(t, workspace2.ID, *db.WorkspaceID)
+	}
+}
+
+func Test_CopyDatabase_PermissionsEnforced(t *testing.T) {
+	tests := []struct {
+		name               string
+		workspaceRole      *users_enums.WorkspaceRole
+		isGlobalAdmin      bool
+		expectSuccess      bool
+		expectedStatusCode int
+	}{
+		{
+			name:               "workspace owner can copy database",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleOwner; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusCreated,
+		},
+		{
+			name:               "workspace member can copy database",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleMember; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusCreated,
+		},
+		{
+			name:               "workspace viewer cannot copy database",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleViewer; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      false,
+			expectedStatusCode: http.StatusBadRequest,
+		},
+		{
+			name:               "global admin can copy database",
+			workspaceRole:      nil,
+			isGlobalAdmin:      true,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusCreated,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router := createTestRouter()
+			owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+			workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+			database := createTestDatabaseViaAPI("Test Database", workspace.ID, owner.Token, router)
+
+			var testUserToken string
+			if tt.isGlobalAdmin {
+				admin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+				testUserToken = admin.Token
+			} else if tt.workspaceRole != nil && *tt.workspaceRole == users_enums.WorkspaceRoleOwner {
+				testUserToken = owner.Token
+			} else if tt.workspaceRole != nil {
+				member := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				workspaces_testing.AddMemberToWorkspace(workspace, member, *tt.workspaceRole, owner.Token, router)
+				testUserToken = member.Token
+			}
+
+			var response Database
+			testResp := test_utils.MakePostRequestAndUnmarshal(
+				t,
+				router,
+				"/api/v1/databases/"+database.ID.String()+"/copy",
+				"Bearer "+testUserToken,
+				nil,
+				tt.expectedStatusCode,
+				&response,
+			)
+
+			if tt.expectSuccess {
+				assert.NotEqual(t, database.ID, response.ID)
+				assert.Contains(t, response.Name, "(Copy)")
+			} else {
+				assert.Contains(t, string(testResp.Body), "insufficient permissions")
+			}
+		})
+	}
+}
+
+func Test_CopyDatabase_CopyStaysInSameWorkspace(t *testing.T) {
+	router := createTestRouter()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	database := createTestDatabaseViaAPI("Test Database", workspace.ID, owner.Token, router)
+
+	var response Database
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/databases/"+database.ID.String()+"/copy",
+		"Bearer "+owner.Token,
+		nil,
+		http.StatusCreated,
+		&response,
+	)
+
+	assert.NotEqual(t, database.ID, response.ID)
+	assert.Equal(t, "Test Database (Copy)", response.Name)
+	assert.Equal(t, workspace.ID, *response.WorkspaceID)
+	assert.Equal(t, database.Type, response.Type)
+}
+
+func Test_TestConnection_PermissionsEnforced(t *testing.T) {
+	tests := []struct {
+		name                    string
+		isMember                bool
+		isGlobalAdmin           bool
+		expectAccessGranted     bool
+		expectedStatusCodeOnErr int
+	}{
+		{
+			name:                    "workspace member can test connection",
+			isMember:                true,
+			isGlobalAdmin:           false,
+			expectAccessGranted:     true,
+			expectedStatusCodeOnErr: http.StatusBadRequest,
+		},
+		{
+			name:                    "non-member cannot test connection",
+			isMember:                false,
+			isGlobalAdmin:           false,
+			expectAccessGranted:     false,
+			expectedStatusCodeOnErr: http.StatusBadRequest,
+		},
+		{
+			name:                    "global admin can test connection",
+			isMember:                false,
+			isGlobalAdmin:           true,
+			expectAccessGranted:     true,
+			expectedStatusCodeOnErr: http.StatusBadRequest,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router := createTestRouter()
+			owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+			workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+			database := createTestDatabaseViaAPI("Test Database", workspace.ID, owner.Token, router)
+
+			var testUser string
+			if tt.isGlobalAdmin {
+				admin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+				testUser = admin.Token
+			} else if tt.isMember {
+				testUser = owner.Token
+			} else {
+				nonMember := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				testUser = nonMember.Token
+			}
+
+			w := workspaces_testing.MakeAPIRequest(
+				router,
+				"POST",
+				"/api/v1/databases/"+database.ID.String()+"/test-connection",
+				"Bearer "+testUser,
+				nil,
+			)
+
+			body := w.Body.String()
+
+			if tt.expectAccessGranted {
+				assert.True(
+					t,
+					w.Code == http.StatusOK ||
+						(w.Code == http.StatusBadRequest && strings.Contains(body, "connect")),
+					"Expected 200 OK or 400 with connection error, got %d: %s",
+					w.Code,
+					body,
+				)
+			} else {
+				assert.Equal(t, tt.expectedStatusCodeOnErr, w.Code)
+				assert.Contains(t, body, "insufficient permissions")
+			}
+		})
+	}
+}
+
+func createTestDatabaseViaAPI(
+	name string,
+	workspaceID uuid.UUID,
+	token string,
+	router *gin.Engine,
+) *Database {
+	testDbName := "test_db"
+	request := Database{
+		Name:        name,
+		WorkspaceID: &workspaceID,
+		Type:        DatabaseTypePostgres,
+		Postgresql: &postgresql.PostgresqlDatabase{
+			Version:  tools.PostgresqlVersion16,
+			Host:     "localhost",
+			Port:     5432,
+			Username: "postgres",
+			Password: "postgres",
+			Database: &testDbName,
+		},
+	}
+
+	w := workspaces_testing.MakeAPIRequest(
+		router,
+		"POST",
+		"/api/v1/databases/create",
+		"Bearer "+token,
+		request,
+	)
+
+	if w.Code != http.StatusCreated {
+		panic(
+			fmt.Sprintf("Failed to create database. Status: %d, Body: %s", w.Code, w.Body.String()),
+		)
+	}
+
+	var database Database
+	if err := json.Unmarshal(w.Body.Bytes(), &database); err != nil {
+		panic(err)
+	}
+
+	return &database
+}

backend/internal/features/databases/di.go

@@ -1,8 +1,10 @@
 package databases
 
 import (
+	audit_logs "postgresus-backend/internal/features/audit_logs"
 	"postgresus-backend/internal/features/notifiers"
-	"postgresus-backend/internal/features/users"
+	users_services "postgresus-backend/internal/features/users/services"
+	workspaces_services "postgresus-backend/internal/features/workspaces/services"
 	"postgresus-backend/internal/util/logger"
 )
 
@@ -15,11 +17,14 @@ var databaseService = &DatabaseService{
 	[]DatabaseCreationListener{},
 	[]DatabaseRemoveListener{},
 	[]DatabaseCopyListener{},
+	workspaces_services.GetWorkspaceService(),
+	audit_logs.GetAuditLogService(),
 }
 
 var databaseController = &DatabaseController{
 	databaseService,
-	users.GetUserService(),
+	users_services.GetUserService(),
+	workspaces_services.GetWorkspaceService(),
 }
 
 func GetDatabaseService() *DatabaseService {
@@ -29,3 +34,7 @@ func GetDatabaseService() *DatabaseService {
 func GetDatabaseController() *DatabaseController {
 	return databaseController
 }
+
+func SetupDependencies() {
+	workspaces_services.GetWorkspaceService().AddWorkspaceDeletionListener(databaseService)
+}

backend/internal/features/databases/model.go

@@ -11,10 +11,13 @@ import (
 )
 
 type Database struct {
-	ID     uuid.UUID    `json:"id"     gorm:"column:id;primaryKey;type:uuid;default:gen_random_uuid()"`
-	UserID uuid.UUID    `json:"userId" gorm:"column:user_id;type:uuid;not null"`
-	Name   string       `json:"name"   gorm:"column:name;type:text;not null"`
-	Type   DatabaseType `json:"type"   gorm:"column:type;type:text;not null"`
+	ID uuid.UUID `json:"id" gorm:"column:id;primaryKey;type:uuid;default:gen_random_uuid()"`
+
+	// WorkspaceID can be null when a database is created via restore operation
+	// outside the context of any workspace
+	WorkspaceID *uuid.UUID   `json:"workspaceId" gorm:"column:workspace_id;type:uuid"`
+	Name        string       `json:"name"        gorm:"column:name;type:text;not null"`
+	Type        DatabaseType `json:"type"        gorm:"column:type;type:text;not null"`
 
 	Postgresql *postgresql.PostgresqlDatabase `json:"postgresql,omitempty" gorm:"foreignKey:DatabaseID"`
 

backend/internal/features/databases/repository.go

@@ -92,14 +92,14 @@ func (r *DatabaseRepository) FindByID(id uuid.UUID) (*Database, error) {
 	return &database, nil
 }
 
-func (r *DatabaseRepository) FindByUserID(userID uuid.UUID) ([]*Database, error) {
+func (r *DatabaseRepository) FindByWorkspaceID(workspaceID uuid.UUID) ([]*Database, error) {
 	var databases []*Database
 
 	if err := storage.
 		GetDb().
 		Preload("Postgresql").
 		Preload("Notifiers").
-		Where("user_id = ?", userID).
+		Where("workspace_id = ?", workspaceID).
 		Order("CASE WHEN health_status = 'UNAVAILABLE' THEN 1 WHEN health_status = 'AVAILABLE' THEN 2 WHEN health_status IS NULL THEN 3 ELSE 4 END, name ASC").
 		Find(&databases).Error; err != nil {
 		return nil, err

backend/internal/features/databases/service.go

@@ -2,11 +2,15 @@ package databases
 
 import (
 	"errors"
+	"fmt"
 	"log/slog"
+	"time"
+
+	audit_logs "postgresus-backend/internal/features/audit_logs"
 	"postgresus-backend/internal/features/databases/databases/postgresql"
 	"postgresus-backend/internal/features/notifiers"
 	users_models "postgresus-backend/internal/features/users/models"
-	"time"
+	workspaces_services "postgresus-backend/internal/features/workspaces/services"
 
 	"github.com/google/uuid"
 )
@@ -19,6 +23,9 @@ type DatabaseService struct {
 	dbCreationListener []DatabaseCreationListener
 	dbRemoveListener   []DatabaseRemoveListener
 	dbCopyListener     []DatabaseCopyListener
+
+	workspaceService *workspaces_services.WorkspaceService
+	auditLogService  *audit_logs.AuditLogService
 }
 
 func (s *DatabaseService) AddDbCreationListener(
@@ -41,15 +48,24 @@ func (s *DatabaseService) AddDbCopyListener(
 
 func (s *DatabaseService) CreateDatabase(
 	user *users_models.User,
+	workspaceID uuid.UUID,
 	database *Database,
 ) (*Database, error) {
-	database.UserID = user.ID
+	canManage, err := s.workspaceService.CanUserManageDBs(workspaceID, user)
+	if err != nil {
+		return nil, err
+	}
+	if !canManage {
+		return nil, errors.New("insufficient permissions to create database in this workspace")
+	}
+
+	database.WorkspaceID = &workspaceID
 
 	if err := database.Validate(); err != nil {
 		return nil, err
 	}
 
-	database, err := s.dbRepository.Save(database)
+	database, err = s.dbRepository.Save(database)
 	if err != nil {
 		return nil, err
 	}
@@ -58,6 +74,12 @@ func (s *DatabaseService) CreateDatabase(
 		listener.OnDatabaseCreated(database.ID)
 	}
 
+	s.auditLogService.WriteAuditLog(
+		fmt.Sprintf("Database created: %s", database.Name),
+		&user.ID,
+		&workspaceID,
+	)
+
 	return database, nil
 }
 
@@ -74,11 +96,18 @@ func (s *DatabaseService) UpdateDatabase(
 		return err
 	}
 
-	if existingDatabase.UserID != user.ID {
-		return errors.New("you have not access to this database")
+	if existingDatabase.WorkspaceID == nil {
+		return errors.New("cannot update database without workspace")
+	}
+
+	canManage, err := s.workspaceService.CanUserManageDBs(*existingDatabase.WorkspaceID, user)
+	if err != nil {
+		return err
+	}
+	if !canManage {
+		return errors.New("insufficient permissions to update this database")
 	}
 
-	// Validate the update
 	if err := database.ValidateUpdate(*existingDatabase, *database); err != nil {
 		return err
 	}
@@ -92,6 +121,12 @@ func (s *DatabaseService) UpdateDatabase(
 		return err
 	}
 
+	s.auditLogService.WriteAuditLog(
+		fmt.Sprintf("Database updated: %s", database.Name),
+		&user.ID,
+		existingDatabase.WorkspaceID,
+	)
+
 	return nil
 }
 
@@ -104,8 +139,16 @@ func (s *DatabaseService) DeleteDatabase(
 		return err
 	}
 
-	if existingDatabase.UserID != user.ID {
-		return errors.New("you have not access to this database")
+	if existingDatabase.WorkspaceID == nil {
+		return errors.New("cannot delete database without workspace")
+	}
+
+	canManage, err := s.workspaceService.CanUserManageDBs(*existingDatabase.WorkspaceID, user)
+	if err != nil {
+		return err
+	}
+	if !canManage {
+		return errors.New("insufficient permissions to delete this database")
 	}
 
 	for _, listener := range s.dbRemoveListener {
@@ -114,6 +157,12 @@ func (s *DatabaseService) DeleteDatabase(
 		}
 	}
 
+	s.auditLogService.WriteAuditLog(
+		fmt.Sprintf("Database deleted: %s", existingDatabase.Name),
+		&user.ID,
+		existingDatabase.WorkspaceID,
+	)
+
 	return s.dbRepository.Delete(id)
 }
 
@@ -126,21 +175,39 @@ func (s *DatabaseService) GetDatabase(
 		return nil, err
 	}
 
-	if database.UserID != user.ID {
-		return nil, errors.New("you have not access to this database")
+	if database.WorkspaceID == nil {
+		return nil, errors.New("cannot access database without workspace")
+	}
+
+	canAccess, _, err := s.workspaceService.CanUserAccessWorkspace(*database.WorkspaceID, user)
+	if err != nil {
+		return nil, err
+	}
+	if !canAccess {
+		return nil, errors.New("insufficient permissions to access this database")
 	}
 
 	return database, nil
 }
 
-func (s *DatabaseService) GetDatabasesByUser(
+func (s *DatabaseService) GetDatabasesByWorkspace(
 	user *users_models.User,
+	workspaceID uuid.UUID,
 ) ([]*Database, error) {
-	return s.dbRepository.FindByUserID(user.ID)
+	canAccess, _, err := s.workspaceService.CanUserAccessWorkspace(workspaceID, user)
+	if err != nil {
+		return nil, err
+	}
+	if !canAccess {
+		return nil, errors.New("insufficient permissions to access this workspace")
+	}
+
+	return s.dbRepository.FindByWorkspaceID(workspaceID)
 }
 
 func (s *DatabaseService) IsNotifierUsing(
 	user *users_models.User,
+	workspaceID uuid.UUID,
 	notifierID uuid.UUID,
 ) (bool, error) {
 	_, err := s.notifierService.GetNotifier(user, notifierID)
@@ -160,8 +227,16 @@ func (s *DatabaseService) TestDatabaseConnection(
 		return err
 	}
 
-	if database.UserID != user.ID {
-		return errors.New("you have not access to this database")
+	if database.WorkspaceID == nil {
+		return errors.New("cannot test connection for database without workspace")
+	}
+
+	canAccess, _, err := s.workspaceService.CanUserAccessWorkspace(*database.WorkspaceID, user)
+	if err != nil {
+		return err
+	}
+	if !canAccess {
+		return errors.New("insufficient permissions to test connection for this database")
 	}
 
 	err = database.TestConnection(s.logger)
@@ -237,13 +312,21 @@ func (s *DatabaseService) CopyDatabase(
 		return nil, err
 	}
 
-	if existingDatabase.UserID != user.ID {
-		return nil, errors.New("you have not access to this database")
+	if existingDatabase.WorkspaceID == nil {
+		return nil, errors.New("cannot copy database without workspace")
+	}
+
+	canManage, err := s.workspaceService.CanUserManageDBs(*existingDatabase.WorkspaceID, user)
+	if err != nil {
+		return nil, err
+	}
+	if !canManage {
+		return nil, errors.New("insufficient permissions to copy this database")
 	}
 
 	newDatabase := &Database{
 		ID:                     uuid.Nil,
-		UserID:                 user.ID,
+		WorkspaceID:            existingDatabase.WorkspaceID,
 		Name:                   existingDatabase.Name + " (Copy)",
 		Type:                   existingDatabase.Type,
 		Notifiers:              existingDatabase.Notifiers,
@@ -286,6 +369,12 @@ func (s *DatabaseService) CopyDatabase(
 		listener.OnDatabaseCopied(databaseID, copiedDatabase.ID)
 	}
 
+	s.auditLogService.WriteAuditLog(
+		fmt.Sprintf("Database copied: %s to %s", existingDatabase.Name, copiedDatabase.Name),
+		&user.ID,
+		existingDatabase.WorkspaceID,
+	)
+
 	return copiedDatabase, nil
 }
 
@@ -306,3 +395,19 @@ func (s *DatabaseService) SetHealthStatus(
 
 	return nil
 }
+
+func (s *DatabaseService) OnBeforeWorkspaceDeletion(workspaceID uuid.UUID) error {
+	databases, err := s.dbRepository.FindByWorkspaceID(workspaceID)
+	if err != nil {
+		return err
+	}
+
+	if len(databases) > 0 {
+		return fmt.Errorf(
+			"workspace contains %d databases that must be deleted",
+			len(databases),
+		)
+	}
+
+	return nil
+}

backend/internal/features/databases/testing.go

@@ -10,14 +10,14 @@ import (
 )
 
 func CreateTestDatabase(
-	userID uuid.UUID,
+	workspaceID uuid.UUID,
 	storage *storages.Storage,
 	notifier *notifiers.Notifier,
 ) *Database {
 	database := &Database{
-		UserID: userID,
-		Name:   "test " + uuid.New().String(),
-		Type:   DatabaseTypePostgres,
+		WorkspaceID: &workspaceID,
+		Name:        "test " + uuid.New().String(),
+		Type:        DatabaseTypePostgres,
 
 		Postgresql: &postgresql.PostgresqlDatabase{
 			Version:  tools.PostgresqlVersion16,

backend/internal/features/healthcheck/attempt/check_pg_health_uc_test.go

@@ -10,23 +10,34 @@ import (
 	healthcheck_config "postgresus-backend/internal/features/healthcheck/config"
 	"postgresus-backend/internal/features/notifiers"
 	"postgresus-backend/internal/features/storages"
-	"postgresus-backend/internal/features/users"
+	users_enums "postgresus-backend/internal/features/users/enums"
+	users_testing "postgresus-backend/internal/features/users/testing"
+	workspaces_testing "postgresus-backend/internal/features/workspaces/testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 )
 
 func Test_CheckPgHealthUseCase(t *testing.T) {
-	user := users.GetTestUser()
+	user := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
 
-	storage := storages.CreateTestStorage(user.UserID)
-	notifier := notifiers.CreateTestNotifier(user.UserID)
+	// Create workspace directly via service
+	workspace, err := workspaces_testing.CreateTestWorkspaceDirect("Test Workspace", user.UserID)
+	if err != nil {
+		t.Fatalf("Failed to create workspace: %v", err)
+	}
 
-	defer storages.RemoveTestStorage(storage.ID)
-	defer notifiers.RemoveTestNotifier(notifier)
+	storage := storages.CreateTestStorage(workspace.ID)
+	notifier := notifiers.CreateTestNotifier(workspace.ID)
+
+	defer func() {
+		storages.RemoveTestStorage(storage.ID)
+		notifiers.RemoveTestNotifier(notifier)
+		workspaces_testing.RemoveTestWorkspaceDirect(workspace.ID)
+	}()
 
 	t.Run("Test_DbAttemptFailed_DbMarkedAsUnavailable", func(t *testing.T) {
-		database := databases.CreateTestDatabase(user.UserID, storage, notifier)
+		database := databases.CreateTestDatabase(workspace.ID, storage, notifier)
 		defer databases.RemoveTestDatabase(database)
 
 		// Setup mock notifier sender
@@ -94,7 +105,7 @@ func Test_CheckPgHealthUseCase(t *testing.T) {
 	t.Run(
 		"Test_DbShouldBeConsideredAsDownOnThirdFailedAttempt_DbNotMarkerdAsDownAfterFirstAttempt",
 		func(t *testing.T) {
-			database := databases.CreateTestDatabase(user.UserID, storage, notifier)
+			database := databases.CreateTestDatabase(workspace.ID, storage, notifier)
 			defer databases.RemoveTestDatabase(database)
 
 			// Setup mock notifier sender
@@ -160,7 +171,7 @@ func Test_CheckPgHealthUseCase(t *testing.T) {
 	t.Run(
 		"Test_DbShouldBeConsideredAsDownOnThirdFailedAttempt_DbMarkerdAsDownAfterThirdFailedAttempt",
 		func(t *testing.T) {
-			database := databases.CreateTestDatabase(user.UserID, storage, notifier)
+			database := databases.CreateTestDatabase(workspace.ID, storage, notifier)
 			defer databases.RemoveTestDatabase(database)
 
 			// Make sure DB is available
@@ -237,7 +248,7 @@ func Test_CheckPgHealthUseCase(t *testing.T) {
 	)
 
 	t.Run("Test_UnavailableDbAttemptSucceed_DbMarkedAsAvailable", func(t *testing.T) {
-		database := databases.CreateTestDatabase(user.UserID, storage, notifier)
+		database := databases.CreateTestDatabase(workspace.ID, storage, notifier)
 		defer databases.RemoveTestDatabase(database)
 
 		// Make sure DB is unavailable
@@ -311,7 +322,7 @@ func Test_CheckPgHealthUseCase(t *testing.T) {
 	t.Run(
 		"Test_DbHealthcheckExecutedFast_HealthcheckNotExecutedFasterThanInterval",
 		func(t *testing.T) {
-			database := databases.CreateTestDatabase(user.UserID, storage, notifier)
+			database := databases.CreateTestDatabase(workspace.ID, storage, notifier)
 			defer databases.RemoveTestDatabase(database)
 
 			// Setup mock notifier sender

backend/internal/features/healthcheck/attempt/controller.go

@@ -2,7 +2,7 @@ package healthcheck_attempt
 
 import (
 	"net/http"
-	"postgresus-backend/internal/features/users"
+	users_middleware "postgresus-backend/internal/features/users/middleware"
 	"time"
 
 	"github.com/gin-gonic/gin"
@@ -11,7 +11,6 @@ import (
 
 type HealthcheckAttemptController struct {
 	healthcheckAttemptService *HealthcheckAttemptService
-	userService               *users.UserService
 }
 
 func (c *HealthcheckAttemptController) RegisterRoutes(router *gin.RouterGroup) {
@@ -31,9 +30,9 @@ func (c *HealthcheckAttemptController) RegisterRoutes(router *gin.RouterGroup) {
 // @Failure 401
 // @Router /healthcheck-attempts/{databaseId} [get]
 func (c *HealthcheckAttemptController) GetAttemptsByDatabase(ctx *gin.Context) {
-	user, err := c.userService.GetUserFromToken(ctx.GetHeader("Authorization"))
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
 		return
 	}
 
@@ -43,7 +42,7 @@ func (c *HealthcheckAttemptController) GetAttemptsByDatabase(ctx *gin.Context) {
 		return
 	}
 
-	afterDate := time.Now().UTC()
+	afterDate := time.Now().UTC().Add(-7 * 24 * time.Hour)
 	if afterDateStr := ctx.Query("afterDate"); afterDateStr != "" {
 		parsedDate, err := time.Parse(time.RFC3339, afterDateStr)
 		if err != nil {

backend/internal/features/healthcheck/attempt/controller_test.go

@@ -0,0 +1,261 @@
+package healthcheck_attempt
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+
+	"postgresus-backend/internal/features/databases"
+	"postgresus-backend/internal/features/databases/databases/postgresql"
+	users_enums "postgresus-backend/internal/features/users/enums"
+	users_testing "postgresus-backend/internal/features/users/testing"
+	workspaces_controllers "postgresus-backend/internal/features/workspaces/controllers"
+	workspaces_testing "postgresus-backend/internal/features/workspaces/testing"
+	test_utils "postgresus-backend/internal/util/testing"
+	"postgresus-backend/internal/util/tools"
+)
+
+func createTestRouter() *gin.Engine {
+	router := workspaces_testing.CreateTestRouter(
+		workspaces_controllers.GetWorkspaceController(),
+		workspaces_controllers.GetMembershipController(),
+		databases.GetDatabaseController(),
+		GetHealthcheckAttemptController(),
+	)
+	return router
+}
+
+func Test_GetAttemptsByDatabase_PermissionsEnforced(t *testing.T) {
+	tests := []struct {
+		name               string
+		workspaceRole      *users_enums.WorkspaceRole
+		isGlobalAdmin      bool
+		expectSuccess      bool
+		expectedStatusCode int
+	}{
+		{
+			name:               "workspace owner can get healthcheck attempts",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleOwner; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace admin can get healthcheck attempts",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleAdmin; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace member can get healthcheck attempts",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleMember; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace viewer can get healthcheck attempts",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleViewer; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "global admin can get healthcheck attempts",
+			workspaceRole:      nil,
+			isGlobalAdmin:      true,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "non-member cannot get healthcheck attempts",
+			workspaceRole:      nil,
+			isGlobalAdmin:      false,
+			expectSuccess:      false,
+			expectedStatusCode: http.StatusBadRequest,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router := createTestRouter()
+			owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+			workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+			database := createTestDatabaseViaAPI("Test Database", workspace.ID, owner.Token, router)
+
+			pastTime := time.Now().UTC().Add(-1 * time.Hour)
+			createTestHealthcheckAttemptWithTime(
+				database.ID,
+				databases.HealthStatusAvailable,
+				pastTime,
+			)
+			createTestHealthcheckAttemptWithTime(
+				database.ID,
+				databases.HealthStatusUnavailable,
+				pastTime.Add(-30*time.Minute),
+			)
+
+			var testUserToken string
+			if tt.isGlobalAdmin {
+				admin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+				testUserToken = admin.Token
+			} else if tt.workspaceRole != nil && *tt.workspaceRole == users_enums.WorkspaceRoleOwner {
+				testUserToken = owner.Token
+			} else if tt.workspaceRole != nil {
+				member := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				workspaces_testing.AddMemberToWorkspace(workspace, member, *tt.workspaceRole, owner.Token, router)
+				testUserToken = member.Token
+			} else {
+				nonMember := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				testUserToken = nonMember.Token
+			}
+
+			if tt.expectSuccess {
+				var response []*HealthcheckAttempt
+				test_utils.MakeGetRequestAndUnmarshal(
+					t,
+					router,
+					"/api/v1/healthcheck-attempts/"+database.ID.String(),
+					"Bearer "+testUserToken,
+					tt.expectedStatusCode,
+					&response,
+				)
+
+				assert.GreaterOrEqual(t, len(response), 2)
+			} else {
+				testResp := test_utils.MakeGetRequest(
+					t,
+					router,
+					"/api/v1/healthcheck-attempts/"+database.ID.String(),
+					"Bearer "+testUserToken,
+					tt.expectedStatusCode,
+				)
+				assert.Contains(t, string(testResp.Body), "forbidden")
+			}
+		})
+	}
+}
+
+func Test_GetAttemptsByDatabase_FiltersByAfterDate(t *testing.T) {
+	router := createTestRouter()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	database := createTestDatabaseViaAPI("Test Database", workspace.ID, owner.Token, router)
+
+	oldTime := time.Now().UTC().Add(-2 * time.Hour)
+	recentTime := time.Now().UTC().Add(-30 * time.Minute)
+
+	createTestHealthcheckAttemptWithTime(database.ID, databases.HealthStatusAvailable, oldTime)
+	createTestHealthcheckAttemptWithTime(database.ID, databases.HealthStatusUnavailable, recentTime)
+	createTestHealthcheckAttempt(database.ID, databases.HealthStatusAvailable)
+
+	afterDate := time.Now().UTC().Add(-1 * time.Hour)
+	var response []*HealthcheckAttempt
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		fmt.Sprintf(
+			"/api/v1/healthcheck-attempts/%s?afterDate=%s",
+			database.ID.String(),
+			afterDate.Format(time.RFC3339),
+		),
+		"Bearer "+owner.Token,
+		http.StatusOK,
+		&response,
+	)
+
+	assert.Equal(t, 2, len(response))
+	for _, attempt := range response {
+		assert.True(t, attempt.CreatedAt.After(afterDate) || attempt.CreatedAt.Equal(afterDate))
+	}
+}
+
+func Test_GetAttemptsByDatabase_ReturnsEmptyListForNewDatabase(t *testing.T) {
+	router := createTestRouter()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	database := createTestDatabaseViaAPI("Test Database", workspace.ID, owner.Token, router)
+
+	var response []*HealthcheckAttempt
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/healthcheck-attempts/"+database.ID.String(),
+		"Bearer "+owner.Token,
+		http.StatusOK,
+		&response,
+	)
+
+	assert.Equal(t, 0, len(response))
+}
+
+func createTestDatabaseViaAPI(
+	name string,
+	workspaceID uuid.UUID,
+	token string,
+	router *gin.Engine,
+) *databases.Database {
+	testDbName := "test_db"
+	request := databases.Database{
+		WorkspaceID: &workspaceID,
+		Name:        name,
+		Type:        databases.DatabaseTypePostgres,
+		Postgresql: &postgresql.PostgresqlDatabase{
+			Version:  tools.PostgresqlVersion16,
+			Host:     "localhost",
+			Port:     5432,
+			Username: "postgres",
+			Password: "postgres",
+			Database: &testDbName,
+		},
+	}
+
+	w := workspaces_testing.MakeAPIRequest(
+		router,
+		"POST",
+		"/api/v1/databases/create",
+		"Bearer "+token,
+		request,
+	)
+
+	if w.Code != http.StatusCreated {
+		panic("Failed to create database")
+	}
+
+	var database databases.Database
+	if err := json.Unmarshal(w.Body.Bytes(), &database); err != nil {
+		panic(err)
+	}
+	return &database
+}
+
+func createTestHealthcheckAttempt(databaseID uuid.UUID, status databases.HealthStatus) {
+	createTestHealthcheckAttemptWithTime(databaseID, status, time.Now().UTC())
+}
+
+func createTestHealthcheckAttemptWithTime(
+	databaseID uuid.UUID,
+	status databases.HealthStatus,
+	createdAt time.Time,
+) {
+	repo := GetHealthcheckAttemptRepository()
+	attempt := &HealthcheckAttempt{
+		ID:         uuid.New(),
+		DatabaseID: databaseID,
+		Status:     status,
+		CreatedAt:  createdAt,
+	}
+	if err := repo.Create(attempt); err != nil {
+		panic("Failed to create test healthcheck attempt: " + err.Error())
+	}
+}

backend/internal/features/healthcheck/attempt/di.go

@@ -4,7 +4,7 @@ import (
 	"postgresus-backend/internal/features/databases"
 	healthcheck_config "postgresus-backend/internal/features/healthcheck/config"
 	"postgresus-backend/internal/features/notifiers"
-	"postgresus-backend/internal/features/users"
+	workspaces_services "postgresus-backend/internal/features/workspaces/services"
 	"postgresus-backend/internal/util/logger"
 )
 
@@ -12,6 +12,7 @@ var healthcheckAttemptRepository = &HealthcheckAttemptRepository{}
 var healthcheckAttemptService = &HealthcheckAttemptService{
 	healthcheckAttemptRepository,
 	databases.GetDatabaseService(),
+	workspaces_services.GetWorkspaceService(),
 }
 
 var checkPgHealthUseCase = &CheckPgHealthUseCase{
@@ -27,7 +28,10 @@ var healthcheckAttemptBackgroundService = &HealthcheckAttemptBackgroundService{
 }
 var healthcheckAttemptController = &HealthcheckAttemptController{
 	healthcheckAttemptService,
-	users.GetUserService(),
+}
+
+func GetHealthcheckAttemptRepository() *HealthcheckAttemptRepository {
+	return healthcheckAttemptRepository
 }
 
 func GetHealthcheckAttemptService() *HealthcheckAttemptService {

backend/internal/features/healthcheck/attempt/repository.go

@@ -53,7 +53,7 @@ func (r *HealthcheckAttemptRepository) DeleteOlderThan(
 		Delete(&HealthcheckAttempt{}).Error
 }
 
-func (r *HealthcheckAttemptRepository) Insert(
+func (r *HealthcheckAttemptRepository) Create(
 	attempt *HealthcheckAttempt,
 ) error {
 	if attempt.ID == uuid.Nil {
@@ -67,6 +67,12 @@ func (r *HealthcheckAttemptRepository) Insert(
 	return storage.GetDb().Create(attempt).Error
 }
 
+func (r *HealthcheckAttemptRepository) Insert(
+	attempt *HealthcheckAttempt,
+) error {
+	return r.Create(attempt)
+}
+
 func (r *HealthcheckAttemptRepository) FindByDatabaseIDWithLimit(
 	databaseID uuid.UUID,
 	limit int,

backend/internal/features/healthcheck/attempt/service.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"postgresus-backend/internal/features/databases"
 	users_models "postgresus-backend/internal/features/users/models"
+	workspaces_services "postgresus-backend/internal/features/workspaces/services"
 	"time"
 
 	"github.com/google/uuid"
@@ -12,6 +13,7 @@ import (
 type HealthcheckAttemptService struct {
 	healthcheckAttemptRepository *HealthcheckAttemptRepository
 	databaseService              *databases.DatabaseService
+	workspaceService             *workspaces_services.WorkspaceService
 }
 
 func (s *HealthcheckAttemptService) GetAttemptsByDatabase(
@@ -24,7 +26,15 @@ func (s *HealthcheckAttemptService) GetAttemptsByDatabase(
 		return nil, err
 	}
 
-	if database.UserID != user.ID {
+	if database.WorkspaceID == nil {
+		return nil, errors.New("cannot access healthcheck attempts for databases without workspace")
+	}
+
+	canAccess, _, err := s.workspaceService.CanUserAccessWorkspace(*database.WorkspaceID, &user)
+	if err != nil {
+		return nil, err
+	}
+	if !canAccess {
 		return nil, errors.New("forbidden")
 	}
 

backend/internal/features/healthcheck/config/controller.go

@@ -2,7 +2,7 @@ package healthcheck_config
 
 import (
 	"net/http"
-	"postgresus-backend/internal/features/users"
+	users_middleware "postgresus-backend/internal/features/users/middleware"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
@@ -10,7 +10,6 @@ import (
 
 type HealthcheckConfigController struct {
 	healthcheckConfigService *HealthcheckConfigService
-	userService              *users.UserService
 }
 
 func (c *HealthcheckConfigController) RegisterRoutes(router *gin.RouterGroup) {
@@ -31,9 +30,9 @@ func (c *HealthcheckConfigController) RegisterRoutes(router *gin.RouterGroup) {
 // @Failure 401
 // @Router /healthcheck-config [post]
 func (c *HealthcheckConfigController) SaveHealthcheckConfig(ctx *gin.Context) {
-	user, err := c.userService.GetUserFromToken(ctx.GetHeader("Authorization"))
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
 		return
 	}
 
@@ -65,9 +64,9 @@ func (c *HealthcheckConfigController) SaveHealthcheckConfig(ctx *gin.Context) {
 // @Failure 401
 // @Router /healthcheck-config/{databaseId} [get]
 func (c *HealthcheckConfigController) GetHealthcheckConfig(ctx *gin.Context) {
-	user, err := c.userService.GetUserFromToken(ctx.GetHeader("Authorization"))
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
 		return
 	}
 

backend/internal/features/healthcheck/config/controller_test.go

@@ -0,0 +1,328 @@
+package healthcheck_config
+
+import (
+	"encoding/json"
+	"net/http"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+
+	"postgresus-backend/internal/features/databases"
+	"postgresus-backend/internal/features/databases/databases/postgresql"
+	users_enums "postgresus-backend/internal/features/users/enums"
+	users_testing "postgresus-backend/internal/features/users/testing"
+	workspaces_controllers "postgresus-backend/internal/features/workspaces/controllers"
+	workspaces_testing "postgresus-backend/internal/features/workspaces/testing"
+	test_utils "postgresus-backend/internal/util/testing"
+	"postgresus-backend/internal/util/tools"
+)
+
+func createTestRouter() *gin.Engine {
+	router := workspaces_testing.CreateTestRouter(
+		workspaces_controllers.GetWorkspaceController(),
+		workspaces_controllers.GetMembershipController(),
+		databases.GetDatabaseController(),
+		GetHealthcheckConfigController(),
+	)
+	return router
+}
+
+func Test_SaveHealthcheckConfig_PermissionsEnforced(t *testing.T) {
+	tests := []struct {
+		name               string
+		workspaceRole      *users_enums.WorkspaceRole
+		isGlobalAdmin      bool
+		expectSuccess      bool
+		expectedStatusCode int
+	}{
+		{
+			name:               "workspace owner can save healthcheck config",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleOwner; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace admin can save healthcheck config",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleAdmin; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace member can save healthcheck config",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleMember; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace viewer cannot save healthcheck config",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleViewer; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      false,
+			expectedStatusCode: http.StatusBadRequest,
+		},
+		{
+			name:               "global admin can save healthcheck config",
+			workspaceRole:      nil,
+			isGlobalAdmin:      true,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router := createTestRouter()
+			owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+			workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+			database := createTestDatabaseViaAPI("Test Database", workspace.ID, owner.Token, router)
+
+			var testUserToken string
+			if tt.isGlobalAdmin {
+				admin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+				testUserToken = admin.Token
+			} else if tt.workspaceRole != nil && *tt.workspaceRole == users_enums.WorkspaceRoleOwner {
+				testUserToken = owner.Token
+			} else if tt.workspaceRole != nil {
+				member := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				workspaces_testing.AddMemberToWorkspace(workspace, member, *tt.workspaceRole, owner.Token, router)
+				testUserToken = member.Token
+			}
+
+			request := HealthcheckConfigDTO{
+				DatabaseID:                        database.ID,
+				IsHealthcheckEnabled:              true,
+				IsSentNotificationWhenUnavailable: true,
+				IntervalMinutes:                   5,
+				AttemptsBeforeConcideredAsDown:    3,
+				StoreAttemptsDays:                 7,
+			}
+
+			if tt.expectSuccess {
+				var response map[string]string
+				test_utils.MakePostRequestAndUnmarshal(
+					t,
+					router,
+					"/api/v1/healthcheck-config",
+					"Bearer "+testUserToken,
+					request,
+					tt.expectedStatusCode,
+					&response,
+				)
+				assert.Contains(t, response["message"], "successfully")
+			} else {
+				testResp := test_utils.MakePostRequest(
+					t,
+					router,
+					"/api/v1/healthcheck-config",
+					"Bearer "+testUserToken,
+					request,
+					tt.expectedStatusCode,
+				)
+				assert.Contains(t, string(testResp.Body), "insufficient permissions")
+			}
+		})
+	}
+}
+
+func Test_SaveHealthcheckConfig_WhenUserIsNotWorkspaceMember_ReturnsForbidden(t *testing.T) {
+	router := createTestRouter()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	database := createTestDatabaseViaAPI("Test Database", workspace.ID, owner.Token, router)
+
+	nonMember := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	request := HealthcheckConfigDTO{
+		DatabaseID:                        database.ID,
+		IsHealthcheckEnabled:              true,
+		IsSentNotificationWhenUnavailable: true,
+		IntervalMinutes:                   5,
+		AttemptsBeforeConcideredAsDown:    3,
+		StoreAttemptsDays:                 7,
+	}
+
+	testResp := test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/healthcheck-config",
+		"Bearer "+nonMember.Token,
+		request,
+		http.StatusBadRequest,
+	)
+
+	assert.Contains(t, string(testResp.Body), "insufficient permissions")
+}
+
+func Test_GetHealthcheckConfig_PermissionsEnforced(t *testing.T) {
+	tests := []struct {
+		name               string
+		workspaceRole      *users_enums.WorkspaceRole
+		isGlobalAdmin      bool
+		expectSuccess      bool
+		expectedStatusCode int
+	}{
+		{
+			name:               "workspace owner can get healthcheck config",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleOwner; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace admin can get healthcheck config",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleAdmin; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace member can get healthcheck config",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleMember; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "workspace viewer can get healthcheck config",
+			workspaceRole:      func() *users_enums.WorkspaceRole { r := users_enums.WorkspaceRoleViewer; return &r }(),
+			isGlobalAdmin:      false,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "global admin can get healthcheck config",
+			workspaceRole:      nil,
+			isGlobalAdmin:      true,
+			expectSuccess:      true,
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name:               "non-member cannot get healthcheck config",
+			workspaceRole:      nil,
+			isGlobalAdmin:      false,
+			expectSuccess:      false,
+			expectedStatusCode: http.StatusBadRequest,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router := createTestRouter()
+			owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+			workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+			database := createTestDatabaseViaAPI("Test Database", workspace.ID, owner.Token, router)
+
+			var testUserToken string
+			if tt.isGlobalAdmin {
+				admin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+				testUserToken = admin.Token
+			} else if tt.workspaceRole != nil && *tt.workspaceRole == users_enums.WorkspaceRoleOwner {
+				testUserToken = owner.Token
+			} else if tt.workspaceRole != nil {
+				member := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				workspaces_testing.AddMemberToWorkspace(workspace, member, *tt.workspaceRole, owner.Token, router)
+				testUserToken = member.Token
+			} else {
+				nonMember := users_testing.CreateTestUser(users_enums.UserRoleMember)
+				testUserToken = nonMember.Token
+			}
+
+			if tt.expectSuccess {
+				var response HealthcheckConfig
+				test_utils.MakeGetRequestAndUnmarshal(
+					t,
+					router,
+					"/api/v1/healthcheck-config/"+database.ID.String(),
+					"Bearer "+testUserToken,
+					tt.expectedStatusCode,
+					&response,
+				)
+
+				assert.Equal(t, database.ID, response.DatabaseID)
+				assert.True(t, response.IsHealthcheckEnabled)
+			} else {
+				testResp := test_utils.MakeGetRequest(
+					t,
+					router,
+					"/api/v1/healthcheck-config/"+database.ID.String(),
+					"Bearer "+testUserToken,
+					tt.expectedStatusCode,
+				)
+				assert.Contains(t, string(testResp.Body), "insufficient permissions")
+			}
+		})
+	}
+}
+
+func Test_GetHealthcheckConfig_ReturnsDefaultConfigForNewDatabase(t *testing.T) {
+	router := createTestRouter()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	database := createTestDatabaseViaAPI("Test Database", workspace.ID, owner.Token, router)
+
+	var response HealthcheckConfig
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/healthcheck-config/"+database.ID.String(),
+		"Bearer "+owner.Token,
+		http.StatusOK,
+		&response,
+	)
+
+	assert.Equal(t, database.ID, response.DatabaseID)
+	assert.True(t, response.IsHealthcheckEnabled)
+	assert.True(t, response.IsSentNotificationWhenUnavailable)
+	assert.Equal(t, 1, response.IntervalMinutes)
+	assert.Equal(t, 3, response.AttemptsBeforeConcideredAsDown)
+	assert.Equal(t, 7, response.StoreAttemptsDays)
+}
+
+func createTestDatabaseViaAPI(
+	name string,
+	workspaceID uuid.UUID,
+	token string,
+	router *gin.Engine,
+) *databases.Database {
+	testDbName := "test_db"
+	request := databases.Database{
+		WorkspaceID: &workspaceID,
+		Name:        name,
+		Type:        databases.DatabaseTypePostgres,
+		Postgresql: &postgresql.PostgresqlDatabase{
+			Version:  tools.PostgresqlVersion16,
+			Host:     "localhost",
+			Port:     5432,
+			Username: "postgres",
+			Password: "postgres",
+			Database: &testDbName,
+		},
+	}
+
+	w := workspaces_testing.MakeAPIRequest(
+		router,
+		"POST",
+		"/api/v1/databases/create",
+		"Bearer "+token,
+		request,
+	)
+
+	if w.Code != http.StatusCreated {
+		panic("Failed to create database")
+	}
+
+	var database databases.Database
+	if err := json.Unmarshal(w.Body.Bytes(), &database); err != nil {
+		panic(err)
+	}
+	return &database
+}

backend/internal/features/healthcheck/config/di.go

@@ -1,8 +1,9 @@
 package healthcheck_config
 
 import (
+	"postgresus-backend/internal/features/audit_logs"
 	"postgresus-backend/internal/features/databases"
-	"postgresus-backend/internal/features/users"
+	workspaces_services "postgresus-backend/internal/features/workspaces/services"
 	"postgresus-backend/internal/util/logger"
 )
 
@@ -10,11 +11,12 @@ var healthcheckConfigRepository = &HealthcheckConfigRepository{}
 var healthcheckConfigService = &HealthcheckConfigService{
 	databases.GetDatabaseService(),
 	healthcheckConfigRepository,
+	workspaces_services.GetWorkspaceService(),
+	audit_logs.GetAuditLogService(),
 	logger.GetLogger(),
 }
 var healthcheckConfigController = &HealthcheckConfigController{
 	healthcheckConfigService,
-	users.GetUserService(),
 }
 
 func GetHealthcheckConfigService() *HealthcheckConfigService {

backend/internal/features/healthcheck/config/service.go

@@ -2,9 +2,12 @@ package healthcheck_config
 
 import (
 	"errors"
+	"fmt"
 	"log/slog"
+	"postgresus-backend/internal/features/audit_logs"
 	"postgresus-backend/internal/features/databases"
 	users_models "postgresus-backend/internal/features/users/models"
+	workspaces_services "postgresus-backend/internal/features/workspaces/services"
 
 	"github.com/google/uuid"
 )
@@ -12,6 +15,8 @@ import (
 type HealthcheckConfigService struct {
 	databaseService             *databases.DatabaseService
 	healthcheckConfigRepository *HealthcheckConfigRepository
+	workspaceService            *workspaces_services.WorkspaceService
+	auditLogService             *audit_logs.AuditLogService
 	logger                      *slog.Logger
 }
 
@@ -33,8 +38,16 @@ func (s *HealthcheckConfigService) Save(
 		return err
 	}
 
-	if database.UserID != user.ID {
-		return errors.New("user does not have access to this database")
+	if database.WorkspaceID == nil {
+		return errors.New("cannot modify healthcheck config for databases without workspace")
+	}
+
+	canManage, err := s.workspaceService.CanUserManageDBs(*database.WorkspaceID, &user)
+	if err != nil {
+		return err
+	}
+	if !canManage {
+		return errors.New("insufficient permissions to modify healthcheck config")
 	}
 
 	healthcheckConfig := configDTO.ToDTO()
@@ -60,6 +73,12 @@ func (s *HealthcheckConfigService) Save(
 		}
 	}
 
+	s.auditLogService.WriteAuditLog(
+		fmt.Sprintf("Healthcheck config updated for database '%s'", database.Name),
+		&user.ID,
+		database.WorkspaceID,
+	)
+
 	return nil
 }
 
@@ -72,8 +91,16 @@ func (s *HealthcheckConfigService) GetByDatabaseID(
 		return nil, err
 	}
 
-	if database.UserID != user.ID {
-		return nil, errors.New("user does not have access to this database")
+	if database.WorkspaceID == nil {
+		return nil, errors.New("cannot access healthcheck config for databases without workspace")
+	}
+
+	canAccess, _, err := s.workspaceService.CanUserAccessWorkspace(*database.WorkspaceID, &user)
+	if err != nil {
+		return nil, err
+	}
+	if !canAccess {
+		return nil, errors.New("insufficient permissions to view healthcheck config")
 	}
 
 	config, err := s.healthcheckConfigRepository.GetByDatabaseID(database.ID)

backend/internal/features/monitoring/postgres/collectors/db_monitoring_service.go

@@ -1,292 +0,0 @@
-package postgres_monitoring_collectors
-
-import (
-	"context"
-	"fmt"
-	"log/slog"
-	"postgresus-backend/internal/config"
-	"postgresus-backend/internal/features/databases"
-	"postgresus-backend/internal/features/databases/databases/postgresql"
-	postgres_monitoring_metrics "postgresus-backend/internal/features/monitoring/postgres/metrics"
-	postgres_monitoring_settings "postgresus-backend/internal/features/monitoring/postgres/settings"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5"
-)
-
-type DbMonitoringBackgroundService struct {
-	databaseService           *databases.DatabaseService
-	monitoringSettingsService *postgres_monitoring_settings.PostgresMonitoringSettingsService
-	metricsService            *postgres_monitoring_metrics.PostgresMonitoringMetricService
-	logger                    *slog.Logger
-	isRunning                 int32
-	lastRunTimes              map[uuid.UUID]time.Time
-	lastRunTimesMutex         sync.RWMutex
-}
-
-func (s *DbMonitoringBackgroundService) Run() {
-	for {
-		if config.IsShouldShutdown() {
-			s.logger.Info("stopping background monitoring tasks")
-			return
-		}
-
-		s.processMonitoringTasks()
-		time.Sleep(1 * time.Second)
-	}
-}
-
-func (s *DbMonitoringBackgroundService) processMonitoringTasks() {
-	if !atomic.CompareAndSwapInt32(&s.isRunning, 0, 1) {
-		s.logger.Warn("skipping background task execution, previous task still running")
-		return
-	}
-	defer atomic.StoreInt32(&s.isRunning, 0)
-
-	dbsWithEnabledDbMonitoring, err := s.monitoringSettingsService.GetAllDbsWithEnabledDbMonitoring()
-	if err != nil {
-		s.logger.Error("failed to get all databases with enabled db monitoring", "error", err)
-		return
-	}
-
-	for _, dbSettings := range dbsWithEnabledDbMonitoring {
-		s.processDatabase(&dbSettings)
-	}
-}
-
-func (s *DbMonitoringBackgroundService) processDatabase(
-	settings *postgres_monitoring_settings.PostgresMonitoringSettings,
-) {
-	db, err := s.databaseService.GetDatabaseByID(settings.DatabaseID)
-	if err != nil {
-		s.logger.Error("failed to get database by id", "error", err)
-		return
-	}
-
-	if db.Type != databases.DatabaseTypePostgres {
-		return
-	}
-
-	if !s.isReadyForNextRun(settings) {
-		return
-	}
-
-	err = s.collectAndSaveMetrics(db, settings)
-	if err != nil {
-		s.logger.Error("failed to collect and save metrics", "error", err)
-		return
-	}
-
-	s.updateLastRunTime(db)
-}
-
-func (s *DbMonitoringBackgroundService) collectAndSaveMetrics(
-	db *databases.Database,
-	settings *postgres_monitoring_settings.PostgresMonitoringSettings,
-) error {
-	if db.Postgresql == nil {
-		return nil
-	}
-
-	s.logger.Debug("collecting metrics for database", "database_id", db.ID)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	conn, err := s.connectToDatabase(ctx, db)
-	if err != nil {
-		return fmt.Errorf("failed to connect to database: %w", err)
-	}
-
-	if conn == nil {
-		return nil
-	}
-
-	defer func() {
-		if closeErr := conn.Close(ctx); closeErr != nil {
-			s.logger.Error("Failed to close connection", "error", closeErr)
-		}
-	}()
-
-	var metrics []postgres_monitoring_metrics.PostgresMonitoringMetric
-	now := time.Now().UTC()
-
-	if settings.IsDbResourcesMonitoringEnabled {
-		dbMetrics, err := s.collectDatabaseResourceMetrics(ctx, conn, db.ID, now)
-		if err != nil {
-			s.logger.Error("failed to collect database resource metrics", "error", err)
-		} else {
-			metrics = append(metrics, dbMetrics...)
-		}
-	}
-
-	if len(metrics) > 0 {
-		if err := s.metricsService.Insert(metrics); err != nil {
-			return fmt.Errorf("failed to insert metrics: %w", err)
-		}
-		s.logger.Debug(
-			"successfully collected and saved metrics",
-			"count",
-			len(metrics),
-			"database_id",
-			db.ID,
-		)
-	}
-
-	return nil
-}
-
-func (s *DbMonitoringBackgroundService) isReadyForNextRun(
-	settings *postgres_monitoring_settings.PostgresMonitoringSettings,
-) bool {
-	s.lastRunTimesMutex.RLock()
-	defer s.lastRunTimesMutex.RUnlock()
-
-	if s.lastRunTimes == nil {
-		return true
-	}
-
-	lastRun, exists := s.lastRunTimes[settings.DatabaseID]
-	if !exists {
-		return true
-	}
-
-	return time.Since(lastRun) >= time.Duration(settings.MonitoringIntervalSeconds)*time.Second
-}
-
-func (s *DbMonitoringBackgroundService) updateLastRunTime(db *databases.Database) {
-	s.lastRunTimesMutex.Lock()
-	defer s.lastRunTimesMutex.Unlock()
-
-	if s.lastRunTimes == nil {
-		s.lastRunTimes = make(map[uuid.UUID]time.Time)
-	}
-	s.lastRunTimes[db.ID] = time.Now().UTC()
-}
-
-func (s *DbMonitoringBackgroundService) connectToDatabase(
-	ctx context.Context,
-	db *databases.Database,
-) (*pgx.Conn, error) {
-	if db.Postgresql == nil {
-		return nil, nil
-	}
-
-	if db.Postgresql.Database == nil || *db.Postgresql.Database == "" {
-		return nil, nil
-	}
-
-	connStr := s.buildConnectionString(db.Postgresql)
-	return pgx.Connect(ctx, connStr)
-}
-
-func (s *DbMonitoringBackgroundService) buildConnectionString(
-	pg *postgresql.PostgresqlDatabase,
-) string {
-	sslMode := "disable"
-	if pg.IsHttps {
-		sslMode = "require"
-	}
-
-	return fmt.Sprintf("host=%s port=%d user=%s password=%s dbname=%s sslmode=%s",
-		pg.Host,
-		pg.Port,
-		pg.Username,
-		pg.Password,
-		*pg.Database,
-		sslMode,
-	)
-}
-
-func (s *DbMonitoringBackgroundService) collectDatabaseResourceMetrics(
-	ctx context.Context,
-	conn *pgx.Conn,
-	databaseID uuid.UUID,
-	timestamp time.Time,
-) ([]postgres_monitoring_metrics.PostgresMonitoringMetric, error) {
-	var metrics []postgres_monitoring_metrics.PostgresMonitoringMetric
-
-	// Collect I/O statistics
-	ioMetrics, err := s.collectIOMetrics(ctx, conn, databaseID, timestamp)
-	if err != nil {
-		s.logger.Warn("failed to collect I/O metrics", "error", err)
-	} else {
-		metrics = append(metrics, ioMetrics...)
-	}
-
-	// Collect memory usage (approximation based on buffer usage)
-	ramMetric, err := s.collectRAMUsageMetric(ctx, conn, databaseID, timestamp)
-	if err != nil {
-		s.logger.Warn("failed to collect RAM usage metric", "error", err)
-	} else {
-		metrics = append(metrics, ramMetric)
-	}
-
-	return metrics, nil
-}
-
-func (s *DbMonitoringBackgroundService) collectIOMetrics(
-	ctx context.Context,
-	conn *pgx.Conn,
-	databaseID uuid.UUID,
-	timestamp time.Time,
-) ([]postgres_monitoring_metrics.PostgresMonitoringMetric, error) {
-	var blocksRead, blocksHit int64
-	query := `
-		SELECT 
-			COALESCE(SUM(blks_read), 0) as total_reads,
-			COALESCE(SUM(blks_hit), 0) as total_hits
-		FROM pg_stat_database 
-		WHERE datname = current_database()
-	`
-
-	err := conn.QueryRow(ctx, query).Scan(&blocksRead, &blocksHit)
-	if err != nil {
-		return nil, err
-	}
-
-	// Calculate I/O activity as total blocks accessed (PostgreSQL block size is typically 8KB)
-	const pgBlockSize = 8192 // 8KB
-	totalIOBytes := float64((blocksRead + blocksHit) * pgBlockSize)
-
-	return []postgres_monitoring_metrics.PostgresMonitoringMetric{
-		{
-			DatabaseID: databaseID,
-			Metric:     postgres_monitoring_metrics.MetricsTypeDbIO,
-			ValueType:  postgres_monitoring_metrics.MetricsValueTypeByte,
-			Value:      totalIOBytes,
-			CreatedAt:  timestamp,
-		},
-	}, nil
-}
-
-func (s *DbMonitoringBackgroundService) collectRAMUsageMetric(
-	ctx context.Context,
-	conn *pgx.Conn,
-	databaseID uuid.UUID,
-	timestamp time.Time,
-) (postgres_monitoring_metrics.PostgresMonitoringMetric, error) {
-	var sharedBuffers int64
-	query := `
-		SELECT 
-			COALESCE(SUM(blks_hit), 0) * 8192 as buffer_usage
-		FROM pg_stat_database 
-		WHERE datname = current_database()
-	`
-
-	err := conn.QueryRow(ctx, query).Scan(&sharedBuffers)
-	if err != nil {
-		return postgres_monitoring_metrics.PostgresMonitoringMetric{}, err
-	}
-
-	return postgres_monitoring_metrics.PostgresMonitoringMetric{
-		DatabaseID: databaseID,
-		Metric:     postgres_monitoring_metrics.MetricsTypeDbRAM,
-		ValueType:  postgres_monitoring_metrics.MetricsValueTypeByte,
-		Value:      float64(sharedBuffers),
-		CreatedAt:  timestamp,
-	}, nil
-}

backend/internal/features/monitoring/postgres/collectors/di.go

@@ -1,23 +0,0 @@
-package postgres_monitoring_collectors
-
-import (
-	"postgresus-backend/internal/features/databases"
-	postgres_monitoring_metrics "postgresus-backend/internal/features/monitoring/postgres/metrics"
-	postgres_monitoring_settings "postgresus-backend/internal/features/monitoring/postgres/settings"
-	"postgresus-backend/internal/util/logger"
-	"sync"
-)
-
-var dbMonitoringBackgroundService = &DbMonitoringBackgroundService{
-	databases.GetDatabaseService(),
-	postgres_monitoring_settings.GetPostgresMonitoringSettingsService(),
-	postgres_monitoring_metrics.GetPostgresMonitoringMetricsService(),
-	logger.GetLogger(),
-	0,
-	nil,
-	sync.RWMutex{},
-}
-
-func GetDbMonitoringBackgroundService() *DbMonitoringBackgroundService {
-	return dbMonitoringBackgroundService
-}

backend/internal/features/monitoring/postgres/metrics/background_service.go

@@ -1,33 +0,0 @@
-package postgres_monitoring_metrics
-
-import (
-	"postgresus-backend/internal/config"
-	"postgresus-backend/internal/util/logger"
-	"time"
-)
-
-var log = logger.GetLogger()
-
-type PostgresMonitoringMetricsBackgroundService struct {
-	metricsRepository *PostgresMonitoringMetricRepository
-}
-
-func (s *PostgresMonitoringMetricsBackgroundService) Run() {
-	for {
-		if config.IsShouldShutdown() {
-			return
-		}
-
-		s.RemoveOldMetrics()
-
-		time.Sleep(5 * time.Minute)
-	}
-}
-
-func (s *PostgresMonitoringMetricsBackgroundService) RemoveOldMetrics() {
-	monthAgo := time.Now().UTC().Add(-3 * 30 * 24 * time.Hour)
-
-	if err := s.metricsRepository.RemoveOlderThan(monthAgo); err != nil {
-		log.Error("Failed to remove old metrics", "error", err)
-	}
-}

backend/internal/features/monitoring/postgres/metrics/controller.go

@@ -1,62 +0,0 @@
-package postgres_monitoring_metrics
-
-import (
-	"net/http"
-	"postgresus-backend/internal/features/users"
-
-	"github.com/gin-gonic/gin"
-)
-
-type PostgresMonitoringMetricsController struct {
-	metricsService *PostgresMonitoringMetricService
-	userService    *users.UserService
-}
-
-func (c *PostgresMonitoringMetricsController) RegisterRoutes(router *gin.RouterGroup) {
-	router.POST("/postgres-monitoring-metrics/get", c.GetMetrics)
-}
-
-// GetMetrics
-// @Summary Get postgres monitoring metrics
-// @Description Get postgres monitoring metrics for a database within a time range
-// @Tags postgres-monitoring-metrics
-// @Accept json
-// @Produce json
-// @Param request body GetMetricsRequest true "Metrics request data"
-// @Success 200 {object} []PostgresMonitoringMetric
-// @Failure 400
-// @Failure 401
-// @Router /postgres-monitoring-metrics/get [post]
-func (c *PostgresMonitoringMetricsController) GetMetrics(ctx *gin.Context) {
-	var requestDTO GetMetricsRequest
-	if err := ctx.ShouldBindJSON(&requestDTO); err != nil {
-		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
-		return
-	}
-
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-		return
-	}
-
-	metrics, err := c.metricsService.GetMetrics(
-		user,
-		requestDTO.DatabaseID,
-		requestDTO.MetricType,
-		requestDTO.From,
-		requestDTO.To,
-	)
-	if err != nil {
-		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-
-	ctx.JSON(http.StatusOK, metrics)
-}

backend/internal/features/monitoring/postgres/metrics/di.go

@@ -1,35 +0,0 @@
-package postgres_monitoring_metrics
-
-import (
-	"postgresus-backend/internal/features/databases"
-	"postgresus-backend/internal/features/users"
-)
-
-var metricsRepository = &PostgresMonitoringMetricRepository{}
-var metricsService = &PostgresMonitoringMetricService{
-	metricsRepository,
-	databases.GetDatabaseService(),
-}
-var metricsController = &PostgresMonitoringMetricsController{
-	metricsService,
-	users.GetUserService(),
-}
-var metricsBackgroundService = &PostgresMonitoringMetricsBackgroundService{
-	metricsRepository,
-}
-
-func GetPostgresMonitoringMetricsController() *PostgresMonitoringMetricsController {
-	return metricsController
-}
-
-func GetPostgresMonitoringMetricsService() *PostgresMonitoringMetricService {
-	return metricsService
-}
-
-func GetPostgresMonitoringMetricsRepository() *PostgresMonitoringMetricRepository {
-	return metricsRepository
-}
-
-func GetPostgresMonitoringMetricsBackgroundService() *PostgresMonitoringMetricsBackgroundService {
-	return metricsBackgroundService
-}

backend/internal/features/monitoring/postgres/metrics/dto.go

@@ -1,14 +0,0 @@
-package postgres_monitoring_metrics
-
-import (
-	"time"
-
-	"github.com/google/uuid"
-)
-
-type GetMetricsRequest struct {
-	DatabaseID uuid.UUID                    `json:"databaseId" binding:"required"`
-	MetricType PostgresMonitoringMetricType `json:"metricType"`
-	From       time.Time                    `json:"from"       binding:"required"`
-	To         time.Time                    `json:"to"         binding:"required"`
-}

backend/internal/features/monitoring/postgres/metrics/enums.go

@@ -1,16 +0,0 @@
-package postgres_monitoring_metrics
-
-type PostgresMonitoringMetricType string
-
-const (
-	// db resources (don't need extensions)
-	MetricsTypeDbRAM PostgresMonitoringMetricType = "DB_RAM_USAGE"
-	MetricsTypeDbIO  PostgresMonitoringMetricType = "DB_IO_USAGE"
-)
-
-type PostgresMonitoringMetricValueType string
-
-const (
-	MetricsValueTypeByte    PostgresMonitoringMetricValueType = "BYTE"
-	MetricsValueTypePercent PostgresMonitoringMetricValueType = "PERCENT"
-)

backend/internal/features/monitoring/postgres/metrics/model.go

@@ -1,20 +0,0 @@
-package postgres_monitoring_metrics
-
-import (
-	"time"
-
-	"github.com/google/uuid"
-)
-
-type PostgresMonitoringMetric struct {
-	ID         uuid.UUID                         `json:"id"         gorm:"column:id;primaryKey;type:uuid;default:gen_random_uuid()"`
-	DatabaseID uuid.UUID                         `json:"databaseId" gorm:"column:database_id;not null;type:uuid"`
-	Metric     PostgresMonitoringMetricType      `json:"metric"     gorm:"column:metric;not null"`
-	ValueType  PostgresMonitoringMetricValueType `json:"valueType"  gorm:"column:value_type;not null"`
-	Value      float64                           `json:"value"      gorm:"column:value;not null"`
-	CreatedAt  time.Time                         `json:"createdAt"  gorm:"column:created_at;not null"`
-}
-
-func (p *PostgresMonitoringMetric) TableName() string {
-	return "postgres_monitoring_metrics"
-}

backend/internal/features/monitoring/postgres/metrics/repository.go

@@ -1,45 +0,0 @@
-package postgres_monitoring_metrics
-
-import (
-	"postgresus-backend/internal/storage"
-	"time"
-
-	"github.com/google/uuid"
-)
-
-type PostgresMonitoringMetricRepository struct{}
-
-func (r *PostgresMonitoringMetricRepository) Insert(metrics []PostgresMonitoringMetric) error {
-	return storage.GetDb().Create(&metrics).Error
-}
-
-func (r *PostgresMonitoringMetricRepository) GetByMetrics(
-	databaseID uuid.UUID,
-	metricType PostgresMonitoringMetricType,
-	from time.Time,
-	to time.Time,
-) ([]PostgresMonitoringMetric, error) {
-	var metrics []PostgresMonitoringMetric
-
-	query := storage.GetDb().
-		Where("database_id = ?", databaseID).
-		Where("created_at >= ?", from).
-		Where("created_at <= ?", to).
-		Where("metric = ?", metricType)
-
-	if err := query.
-		Order("created_at DESC").
-		Find(&metrics).Error; err != nil {
-		return nil, err
-	}
-
-	return metrics, nil
-}
-
-func (r *PostgresMonitoringMetricRepository) RemoveOlderThan(
-	olderThan time.Time,
-) error {
-	return storage.GetDb().
-		Where("created_at < ?", olderThan).
-		Delete(&PostgresMonitoringMetric{}).Error
-}

backend/internal/features/monitoring/postgres/metrics/service.go

@@ -1,42 +0,0 @@
-package postgres_monitoring_metrics
-
-import (
-	"errors"
-	"postgresus-backend/internal/features/databases"
-	users_models "postgresus-backend/internal/features/users/models"
-	"time"
-
-	"github.com/google/uuid"
-)
-
-type PostgresMonitoringMetricService struct {
-	metricsRepository *PostgresMonitoringMetricRepository
-	databaseService   *databases.DatabaseService
-}
-
-func (s *PostgresMonitoringMetricService) Insert(metrics []PostgresMonitoringMetric) error {
-	if len(metrics) == 0 {
-		return nil
-	}
-
-	return s.metricsRepository.Insert(metrics)
-}
-
-func (s *PostgresMonitoringMetricService) GetMetrics(
-	user *users_models.User,
-	databaseID uuid.UUID,
-	metricType PostgresMonitoringMetricType,
-	from time.Time,
-	to time.Time,
-) ([]PostgresMonitoringMetric, error) {
-	database, err := s.databaseService.GetDatabaseByID(databaseID)
-	if err != nil {
-		return nil, err
-	}
-
-	if database.UserID != user.ID {
-		return nil, errors.New("database not found")
-	}
-
-	return s.metricsRepository.GetByMetrics(databaseID, metricType, from, to)
-}

backend/internal/features/monitoring/postgres/metrics/service_test.go

@@ -1,227 +0,0 @@
-package postgres_monitoring_metrics
-
-import (
-	"postgresus-backend/internal/features/databases"
-	"postgresus-backend/internal/features/notifiers"
-	"postgresus-backend/internal/features/storages"
-	"postgresus-backend/internal/features/users"
-	users_models "postgresus-backend/internal/features/users/models"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/assert"
-)
-
-// Helper function to get a proper users_models.User for testing
-func getTestUserModel() *users_models.User {
-	signInResponse := users.GetTestUser()
-
-	// Get the user service to retrieve the full user model
-	userService := users.GetUserService()
-	user, err := userService.GetFirstUser()
-	if err != nil {
-		panic(err)
-	}
-
-	// Verify we got the right user
-	if user.ID != signInResponse.UserID {
-		panic("user ID mismatch")
-	}
-
-	return user
-}
-
-func Test_GetMetrics_MetricsReturned(t *testing.T) {
-	// Setup test data
-	testUser := getTestUserModel()
-	testUserResponse := users.GetTestUser()
-	storage := storages.CreateTestStorage(testUserResponse.UserID)
-	notifier := notifiers.CreateTestNotifier(testUserResponse.UserID)
-	database := databases.CreateTestDatabase(testUserResponse.UserID, storage, notifier)
-
-	defer storages.RemoveTestStorage(storage.ID)
-	defer notifiers.RemoveTestNotifier(notifier)
-	defer databases.RemoveTestDatabase(database)
-
-	// Get service and repository
-	service := GetPostgresMonitoringMetricsService()
-	repository := GetPostgresMonitoringMetricsRepository()
-
-	// Create test metrics
-	now := time.Now().UTC()
-	testMetrics := []PostgresMonitoringMetric{
-		{
-			DatabaseID: database.ID,
-			Metric:     MetricsTypeDbRAM,
-			ValueType:  MetricsValueTypeByte,
-			Value:      1024000,
-			CreatedAt:  now.Add(-2 * time.Hour),
-		},
-		{
-			DatabaseID: database.ID,
-			Metric:     MetricsTypeDbRAM,
-			ValueType:  MetricsValueTypeByte,
-			Value:      2048000,
-			CreatedAt:  now.Add(-1 * time.Hour),
-		},
-	}
-
-	// Insert test metrics
-	err := repository.Insert(testMetrics)
-	assert.NoError(t, err)
-
-	// Test getting DB RAM metrics
-	from := now.Add(-3 * time.Hour)
-	to := now
-
-	metrics, err := service.GetMetrics(testUser, database.ID, MetricsTypeDbRAM, from, to)
-	assert.NoError(t, err)
-	assert.Len(t, metrics, 2)
-
-	// Verify metrics are ordered by created_at DESC
-	assert.True(t, metrics[0].CreatedAt.After(metrics[1].CreatedAt))
-	assert.Equal(t, float64(2048000), metrics[0].Value)
-	assert.Equal(t, float64(1024000), metrics[1].Value)
-	assert.Equal(t, MetricsTypeDbRAM, metrics[0].Metric)
-	assert.Equal(t, MetricsValueTypeByte, metrics[0].ValueType)
-
-	// Test access control - create another user and test they can't access this database
-	anotherUser := &users_models.User{
-		ID: uuid.New(),
-	}
-
-	_, err = service.GetMetrics(anotherUser, database.ID, MetricsTypeDbRAM, from, to)
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "database not found")
-
-	// Test with non-existent database
-	nonExistentDbID := uuid.New()
-	_, err = service.GetMetrics(testUser, nonExistentDbID, MetricsTypeDbRAM, from, to)
-	assert.Error(t, err)
-}
-
-func Test_GetMetricsWithPagination_PaginationWorks(t *testing.T) {
-	// Setup test data
-	testUser := getTestUserModel()
-	testUserResponse := users.GetTestUser()
-	storage := storages.CreateTestStorage(testUserResponse.UserID)
-	notifier := notifiers.CreateTestNotifier(testUserResponse.UserID)
-	database := databases.CreateTestDatabase(testUserResponse.UserID, storage, notifier)
-
-	defer storages.RemoveTestStorage(storage.ID)
-	defer notifiers.RemoveTestNotifier(notifier)
-	defer databases.RemoveTestDatabase(database)
-
-	// Get repository and service
-	repository := GetPostgresMonitoringMetricsRepository()
-	service := GetPostgresMonitoringMetricsService()
-
-	// Create many test metrics for pagination testing
-	now := time.Now().UTC()
-	testMetrics := []PostgresMonitoringMetric{}
-
-	for i := 0; i < 25; i++ {
-		testMetrics = append(testMetrics, PostgresMonitoringMetric{
-			DatabaseID: database.ID,
-			Metric:     MetricsTypeDbRAM,
-			ValueType:  MetricsValueTypeByte,
-			Value:      float64(1000000 + i*100000),
-			CreatedAt:  now.Add(-time.Duration(i) * time.Minute),
-		})
-	}
-
-	// Insert test metrics
-	err := repository.Insert(testMetrics)
-	assert.NoError(t, err)
-
-	// Test getting all metrics via service (should return all 25)
-	from := now.Add(-30 * time.Minute)
-	to := now
-
-	allMetrics, err := service.GetMetrics(testUser, database.ID, MetricsTypeDbRAM, from, to)
-	assert.NoError(t, err)
-	assert.Len(t, allMetrics, 25)
-
-	// Verify they are ordered by created_at DESC (most recent first)
-	for i := 0; i < len(allMetrics)-1; i++ {
-		assert.True(t, allMetrics[i].CreatedAt.After(allMetrics[i+1].CreatedAt) ||
-			allMetrics[i].CreatedAt.Equal(allMetrics[i+1].CreatedAt))
-	}
-
-	// Note: Since the current repository doesn't have pagination methods,
-	// this test demonstrates the need for pagination but tests current behavior.
-	// TODO: Add GetByMetricsWithLimit method to repository and update service
-	t.Logf("All metrics count: %d (pagination methods should be added)", len(allMetrics))
-}
-
-func Test_GetMetricsWithFilterByType_FilterWorks(t *testing.T) {
-	// Setup test data
-	testUser := getTestUserModel()
-	testUserResponse := users.GetTestUser()
-	storage := storages.CreateTestStorage(testUserResponse.UserID)
-	notifier := notifiers.CreateTestNotifier(testUserResponse.UserID)
-	database := databases.CreateTestDatabase(testUserResponse.UserID, storage, notifier)
-
-	defer storages.RemoveTestStorage(storage.ID)
-	defer notifiers.RemoveTestNotifier(notifier)
-	defer databases.RemoveTestDatabase(database)
-
-	// Get service and repository
-	service := GetPostgresMonitoringMetricsService()
-	repository := GetPostgresMonitoringMetricsRepository()
-
-	// Create test metrics of different types
-	now := time.Now().UTC()
-	testMetrics := []PostgresMonitoringMetric{
-		// DB RAM metrics
-		{
-			DatabaseID: database.ID,
-			Metric:     MetricsTypeDbRAM,
-			ValueType:  MetricsValueTypeByte,
-			Value:      1024000,
-			CreatedAt:  now.Add(-2 * time.Hour),
-		},
-		{
-			DatabaseID: database.ID,
-			Metric:     MetricsTypeDbRAM,
-			ValueType:  MetricsValueTypeByte,
-			Value:      2048000,
-			CreatedAt:  now.Add(-1 * time.Hour),
-		},
-	}
-
-	// Insert test metrics
-	err := repository.Insert(testMetrics)
-	assert.NoError(t, err)
-
-	from := now.Add(-3 * time.Hour)
-	to := now
-
-	// Test filtering by DB RAM type
-	ramMetrics, err := service.GetMetrics(testUser, database.ID, MetricsTypeDbRAM, from, to)
-	assert.NoError(t, err)
-	assert.Len(t, ramMetrics, 2)
-	for _, metric := range ramMetrics {
-		assert.Equal(t, MetricsTypeDbRAM, metric.Metric)
-		assert.Equal(t, MetricsValueTypeByte, metric.ValueType)
-	}
-
-	// Test filtering by non-existent metric type (should return empty)
-	ioMetrics, err := service.GetMetrics(testUser, database.ID, MetricsTypeDbIO, from, to)
-	assert.NoError(t, err)
-	assert.Len(t, ioMetrics, 0)
-
-	// Test time filtering - get only recent metrics (last hour)
-	recentFrom := now.Add(-1 * time.Hour)
-	recentRamMetrics, err := service.GetMetrics(
-		testUser,
-		database.ID,
-		MetricsTypeDbRAM,
-		recentFrom,
-		to,
-	)
-	assert.NoError(t, err)
-	assert.Len(t, recentRamMetrics, 1) // Only the metric from 1 hour ago
-	assert.Equal(t, float64(2048000), recentRamMetrics[0].Value)
-}

backend/internal/features/monitoring/postgres/settings/controller.go

@@ -1,97 +0,0 @@
-package postgres_monitoring_settings
-
-import (
-	"net/http"
-	"postgresus-backend/internal/features/users"
-
-	"github.com/gin-gonic/gin"
-	"github.com/google/uuid"
-)
-
-type PostgresMonitoringSettingsController struct {
-	postgresMonitoringSettingsService *PostgresMonitoringSettingsService
-	userService                       *users.UserService
-}
-
-func (c *PostgresMonitoringSettingsController) RegisterRoutes(router *gin.RouterGroup) {
-	router.POST("/postgres-monitoring-settings/save", c.SaveSettings)
-	router.GET("/postgres-monitoring-settings/database/:id", c.GetSettingsByDbID)
-}
-
-// SaveSettings
-// @Summary Save postgres monitoring settings
-// @Description Save or update postgres monitoring settings for a database
-// @Tags postgres-monitoring-settings
-// @Accept json
-// @Produce json
-// @Param request body PostgresMonitoringSettings true "Postgres monitoring settings data"
-// @Success 200 {object} PostgresMonitoringSettings
-// @Failure 400
-// @Failure 401
-// @Router /postgres-monitoring-settings/save [post]
-func (c *PostgresMonitoringSettingsController) SaveSettings(ctx *gin.Context) {
-	var requestDTO PostgresMonitoringSettings
-	if err := ctx.ShouldBindJSON(&requestDTO); err != nil {
-		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
-		return
-	}
-
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-		return
-	}
-
-	err = c.postgresMonitoringSettingsService.Save(user, &requestDTO)
-	if err != nil {
-		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-
-	ctx.JSON(http.StatusOK, requestDTO)
-}
-
-// GetSettingsByDbID
-// @Summary Get postgres monitoring settings by database ID
-// @Description Get postgres monitoring settings for a specific database
-// @Tags postgres-monitoring-settings
-// @Produce json
-// @Param id path string true "Database ID"
-// @Success 200 {object} PostgresMonitoringSettings
-// @Failure 400
-// @Failure 401
-// @Failure 404
-// @Router /postgres-monitoring-settings/database/{id} [get]
-func (c *PostgresMonitoringSettingsController) GetSettingsByDbID(ctx *gin.Context) {
-	dbID := ctx.Param("id")
-	if dbID == "" {
-		ctx.JSON(http.StatusBadRequest, gin.H{"error": "database ID is required"})
-		return
-	}
-
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
-		return
-	}
-
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-		return
-	}
-
-	settings, err := c.postgresMonitoringSettingsService.GetByDbID(user, uuid.MustParse(dbID))
-	if err != nil {
-		ctx.JSON(http.StatusNotFound, gin.H{"error": "postgres monitoring settings not found"})
-		return
-	}
-
-	ctx.JSON(http.StatusOK, settings)
-}

backend/internal/features/monitoring/postgres/settings/di.go

@@ -1,32 +0,0 @@
-package postgres_monitoring_settings
-
-import (
-	"postgresus-backend/internal/features/databases"
-	"postgresus-backend/internal/features/users"
-)
-
-var postgresMonitoringSettingsRepository = &PostgresMonitoringSettingsRepository{}
-var postgresMonitoringSettingsService = &PostgresMonitoringSettingsService{
-	databases.GetDatabaseService(),
-	postgresMonitoringSettingsRepository,
-}
-var postgresMonitoringSettingsController = &PostgresMonitoringSettingsController{
-	postgresMonitoringSettingsService,
-	users.GetUserService(),
-}
-
-func GetPostgresMonitoringSettingsController() *PostgresMonitoringSettingsController {
-	return postgresMonitoringSettingsController
-}
-
-func GetPostgresMonitoringSettingsService() *PostgresMonitoringSettingsService {
-	return postgresMonitoringSettingsService
-}
-
-func GetPostgresMonitoringSettingsRepository() *PostgresMonitoringSettingsRepository {
-	return postgresMonitoringSettingsRepository
-}
-
-func SetupDependencies() {
-	databases.GetDatabaseService().AddDbCreationListener(postgresMonitoringSettingsService)
-}

backend/internal/features/monitoring/postgres/settings/model.go

@@ -1,72 +0,0 @@
-package postgres_monitoring_settings
-
-import (
-	"postgresus-backend/internal/features/databases"
-	"postgresus-backend/internal/util/tools"
-	"strings"
-
-	"github.com/google/uuid"
-	"gorm.io/gorm"
-)
-
-type PostgresMonitoringSettings struct {
-	DatabaseID uuid.UUID           `json:"databaseId" gorm:"primaryKey;column:database_id;not null"`
-	Database   *databases.Database `json:"database"   gorm:"foreignKey:DatabaseID"`
-
-	IsDbResourcesMonitoringEnabled bool  `json:"isDbResourcesMonitoringEnabled" gorm:"column:is_db_resources_monitoring_enabled;not null"`
-	MonitoringIntervalSeconds      int64 `json:"monitoringIntervalSeconds"      gorm:"column:monitoring_interval_seconds;not null"`
-
-	InstalledExtensions    []tools.PostgresqlExtension `json:"installedExtensions" gorm:"-"`
-	InstalledExtensionsRaw string                      `json:"-"                   gorm:"column:installed_extensions_raw"`
-}
-
-func (p *PostgresMonitoringSettings) TableName() string {
-	return "postgres_monitoring_settings"
-}
-
-func (p *PostgresMonitoringSettings) AfterFind(tx *gorm.DB) error {
-	if p.InstalledExtensionsRaw != "" {
-		rawExtensions := strings.Split(p.InstalledExtensionsRaw, ",")
-
-		p.InstalledExtensions = make([]tools.PostgresqlExtension, len(rawExtensions))
-
-		for i, ext := range rawExtensions {
-			p.InstalledExtensions[i] = tools.PostgresqlExtension(ext)
-		}
-	} else {
-		p.InstalledExtensions = []tools.PostgresqlExtension{}
-	}
-
-	return nil
-}
-
-func (p *PostgresMonitoringSettings) BeforeSave(tx *gorm.DB) error {
-	extensions := make([]string, len(p.InstalledExtensions))
-
-	for i, ext := range p.InstalledExtensions {
-		extensions[i] = string(ext)
-	}
-
-	p.InstalledExtensionsRaw = strings.Join(extensions, ",")
-
-	return nil
-}
-
-func (p *PostgresMonitoringSettings) AddInstalledExtensions(
-	extensions []tools.PostgresqlExtension,
-) {
-	for _, ext := range extensions {
-		exists := false
-
-		for _, existing := range p.InstalledExtensions {
-			if existing == ext {
-				exists = true
-				break
-			}
-		}
-
-		if !exists {
-			p.InstalledExtensions = append(p.InstalledExtensions, ext)
-		}
-	}
-}

backend/internal/features/monitoring/postgres/settings/repository.go

@@ -1,65 +0,0 @@
-package postgres_monitoring_settings
-
-import (
-	"errors"
-	"postgresus-backend/internal/storage"
-
-	"github.com/google/uuid"
-	"gorm.io/gorm"
-)
-
-type PostgresMonitoringSettingsRepository struct{}
-
-func (r *PostgresMonitoringSettingsRepository) Save(settings *PostgresMonitoringSettings) error {
-	return storage.GetDb().Save(settings).Error
-}
-
-func (r *PostgresMonitoringSettingsRepository) GetByDbID(
-	dbID uuid.UUID,
-) (*PostgresMonitoringSettings, error) {
-	var settings PostgresMonitoringSettings
-
-	if err := storage.
-		GetDb().
-		Where("database_id = ?", dbID).
-		First(&settings).Error; err != nil {
-		return nil, err
-	}
-
-	return &settings, nil
-}
-
-func (r *PostgresMonitoringSettingsRepository) GetByDbIDWithRelations(
-	dbID uuid.UUID,
-) (*PostgresMonitoringSettings, error) {
-	var settings PostgresMonitoringSettings
-
-	if err := storage.
-		GetDb().
-		Preload("Database").
-		Where("database_id = ?", dbID).
-		First(&settings).Error; err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return nil, nil
-		}
-
-		return nil, err
-	}
-
-	return &settings, nil
-}
-
-func (r *PostgresMonitoringSettingsRepository) GetAllDbsWithEnabledDbMonitoring() (
-	[]PostgresMonitoringSettings, error,
-) {
-	var settings []PostgresMonitoringSettings
-
-	if err := storage.
-		GetDb().
-		Where("is_db_resources_monitoring_enabled = ?", true).
-		Find(&settings).Error; err != nil {
-		return nil, err
-	}
-
-	return settings, nil
-}

backend/internal/features/monitoring/postgres/settings/service.go

@@ -1,92 +0,0 @@
-package postgres_monitoring_settings
-
-import (
-	"errors"
-	"postgresus-backend/internal/features/databases"
-	users_models "postgresus-backend/internal/features/users/models"
-	"postgresus-backend/internal/util/logger"
-
-	"github.com/google/uuid"
-)
-
-var log = logger.GetLogger()
-
-type PostgresMonitoringSettingsService struct {
-	databaseService                      *databases.DatabaseService
-	postgresMonitoringSettingsRepository *PostgresMonitoringSettingsRepository
-}
-
-func (s *PostgresMonitoringSettingsService) OnDatabaseCreated(dbID uuid.UUID) {
-	db, err := s.databaseService.GetDatabaseByID(dbID)
-	if err != nil {
-		return
-	}
-
-	if db.Type != databases.DatabaseTypePostgres {
-		return
-	}
-
-	settings := &PostgresMonitoringSettings{
-		DatabaseID:                     dbID,
-		IsDbResourcesMonitoringEnabled: true,
-		MonitoringIntervalSeconds:      60,
-	}
-
-	err = s.postgresMonitoringSettingsRepository.Save(settings)
-	if err != nil {
-		log.Error("failed to save postgres monitoring settings", "error", err)
-	}
-}
-
-func (s *PostgresMonitoringSettingsService) Save(
-	user *users_models.User,
-	settings *PostgresMonitoringSettings,
-) error {
-	db, err := s.databaseService.GetDatabaseByID(settings.DatabaseID)
-	if err != nil {
-		return err
-	}
-
-	if db.UserID != user.ID {
-		return errors.New("user does not have access to this database")
-	}
-
-	return s.postgresMonitoringSettingsRepository.Save(settings)
-}
-
-func (s *PostgresMonitoringSettingsService) GetByDbID(
-	user *users_models.User,
-	dbID uuid.UUID,
-) (*PostgresMonitoringSettings, error) {
-	dbSettings, err := s.postgresMonitoringSettingsRepository.GetByDbIDWithRelations(dbID)
-	if err != nil {
-		return nil, err
-	}
-
-	if dbSettings == nil {
-		s.OnDatabaseCreated(dbID)
-
-		dbSettings, err := s.postgresMonitoringSettingsRepository.GetByDbIDWithRelations(dbID)
-		if err != nil {
-			return nil, err
-		}
-
-		if dbSettings == nil {
-			return nil, errors.New("postgres monitoring settings not found")
-		}
-
-		return s.GetByDbID(user, dbID)
-	}
-
-	if dbSettings.Database.UserID != user.ID {
-		return nil, errors.New("user does not have access to this database")
-	}
-
-	return dbSettings, nil
-}
-
-func (s *PostgresMonitoringSettingsService) GetAllDbsWithEnabledDbMonitoring() (
-	[]PostgresMonitoringSettings, error,
-) {
-	return s.postgresMonitoringSettingsRepository.GetAllDbsWithEnabledDbMonitoring()
-}

backend/internal/features/monitoring/postgres/settings/service_test.go

@@ -1,108 +0,0 @@
-package postgres_monitoring_settings
-
-import (
-	"postgresus-backend/internal/features/databases"
-	"postgresus-backend/internal/features/notifiers"
-	"postgresus-backend/internal/features/storages"
-	"postgresus-backend/internal/features/users"
-	users_models "postgresus-backend/internal/features/users/models"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/assert"
-)
-
-// Helper function to get a proper users_models.User for testing
-func getTestUserModel() *users_models.User {
-	signInResponse := users.GetTestUser()
-
-	// Get the user service to retrieve the full user model
-	userService := users.GetUserService()
-	user, err := userService.GetFirstUser()
-	if err != nil {
-		panic(err)
-	}
-
-	// Verify we got the right user
-	if user.ID != signInResponse.UserID {
-		panic("user ID mismatch")
-	}
-
-	return user
-}
-
-func Test_DatabaseCreated_SettingsCreated(t *testing.T) {
-	// Get or create a test user
-	testUserResponse := users.GetTestUser()
-	storage := storages.CreateTestStorage(testUserResponse.UserID)
-	notifier := notifiers.CreateTestNotifier(testUserResponse.UserID)
-	database := databases.CreateTestDatabase(testUserResponse.UserID, storage, notifier)
-
-	defer storages.RemoveTestStorage(storage.ID)
-	defer notifiers.RemoveTestNotifier(notifier)
-	defer databases.RemoveTestDatabase(database)
-
-	// Get the monitoring settings service
-	service := GetPostgresMonitoringSettingsService()
-
-	// Execute - trigger the database creation event
-	service.OnDatabaseCreated(database.ID)
-
-	// Verify settings were created by attempting to retrieve them
-	// Note: Since we can't easily mock the extension installation without major changes,
-	// we focus on testing the settings creation and default values logic
-	settingsRepo := GetPostgresMonitoringSettingsRepository()
-	settings, err := settingsRepo.GetByDbID(database.ID)
-	assert.NoError(t, err)
-	assert.NotNil(t, settings)
-
-	// Verify default settings values
-	assert.Equal(t, database.ID, settings.DatabaseID)
-	assert.Equal(t, int64(60), settings.MonitoringIntervalSeconds)
-	assert.True(t, settings.IsDbResourcesMonitoringEnabled) // Always enabled
-}
-
-func Test_GetSettingsByDbID_SettingsReturned(t *testing.T) {
-	// Get or create a test user
-	testUser := getTestUserModel()
-	testUserResponse := users.GetTestUser()
-	storage := storages.CreateTestStorage(testUserResponse.UserID)
-	notifier := notifiers.CreateTestNotifier(testUserResponse.UserID)
-	database := databases.CreateTestDatabase(testUserResponse.UserID, storage, notifier)
-
-	defer storages.RemoveTestStorage(storage.ID)
-	defer notifiers.RemoveTestNotifier(notifier)
-	defer databases.RemoveTestDatabase(database)
-
-	service := GetPostgresMonitoringSettingsService()
-
-	// Test 1: Get settings that don't exist yet - should auto-create them
-	settings, err := service.GetByDbID(testUser, database.ID)
-	assert.NoError(t, err)
-	assert.NotNil(t, settings)
-	assert.Equal(t, database.ID, settings.DatabaseID)
-	assert.Equal(t, int64(60), settings.MonitoringIntervalSeconds)
-	assert.True(t, settings.IsDbResourcesMonitoringEnabled) // Always enabled
-
-	// Test 2: Get settings that already exist
-	existingSettings, err := service.GetByDbID(testUser, database.ID)
-	assert.NoError(t, err)
-	assert.NotNil(t, existingSettings)
-	assert.Equal(t, settings.DatabaseID, existingSettings.DatabaseID)
-	assert.Equal(t, settings.MonitoringIntervalSeconds, existingSettings.MonitoringIntervalSeconds)
-
-	// Test 3: Access control - create another user and test they can't access this database
-	anotherUser := &users_models.User{
-		ID: uuid.New(),
-		// Other fields can be empty for this test
-	}
-
-	_, err = service.GetByDbID(anotherUser, database.ID)
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "user does not have access to this database")
-
-	// Test 4: Try to get settings for non-existent database
-	nonExistentDbID := uuid.New()
-	_, err = service.GetByDbID(testUser, nonExistentDbID)
-	assert.Error(t, err) // Should fail because database doesn't exist
-}

backend/internal/features/notifiers/controller.go

@@ -2,15 +2,16 @@ package notifiers
 
 import (
 	"net/http"
-	"postgresus-backend/internal/features/users"
+	users_middleware "postgresus-backend/internal/features/users/middleware"
+	workspaces_services "postgresus-backend/internal/features/workspaces/services"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 )
 
 type NotifierController struct {
-	notifierService *NotifierService
-	userService     *users.UserService
+	notifierService  *NotifierService
+	workspaceService *workspaces_services.WorkspaceService
 }
 
 func (c *NotifierController) RegisterRoutes(router *gin.RouterGroup) {
@@ -29,35 +30,45 @@ func (c *NotifierController) RegisterRoutes(router *gin.RouterGroup) {
 // @Accept json
 // @Produce json
 // @Param Authorization header string true "JWT token"
-// @Param notifier body Notifier true "Notifier data"
+// @Param request body Notifier true "Notifier data with workspaceId"
 // @Success 200 {object} Notifier
 // @Failure 400
 // @Failure 401
+// @Failure 403
 // @Router /notifiers [post]
 func (c *NotifierController) SaveNotifier(ctx *gin.Context) {
-	user, err := c.userService.GetUserFromToken(ctx.GetHeader("Authorization"))
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
 		return
 	}
 
-	var notifier Notifier
-	if err := ctx.ShouldBindJSON(&notifier); err != nil {
+	var request Notifier
+	if err := ctx.ShouldBindJSON(&request); err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
-	if err := notifier.Validate(); err != nil {
+	if request.WorkspaceID == uuid.Nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "workspaceId is required"})
+		return
+	}
+
+	if err := request.Validate(); err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
-	if err := c.notifierService.SaveNotifier(user, &notifier); err != nil {
+	if err := c.notifierService.SaveNotifier(user, request.WorkspaceID, &request); err != nil {
+		if err.Error() == "insufficient permissions to manage notifier in this workspace" {
+			ctx.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+			return
+		}
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
-	ctx.JSON(http.StatusOK, notifier)
+	ctx.JSON(http.StatusOK, request)
 }
 
 // GetNotifier
@@ -70,11 +81,12 @@ func (c *NotifierController) SaveNotifier(ctx *gin.Context) {
 // @Success 200 {object} Notifier
 // @Failure 400
 // @Failure 401
+// @Failure 403
 // @Router /notifiers/{id} [get]
 func (c *NotifierController) GetNotifier(ctx *gin.Context) {
-	user, err := c.userService.GetUserFromToken(ctx.GetHeader("Authorization"))
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
 		return
 	}
 
@@ -86,6 +98,10 @@ func (c *NotifierController) GetNotifier(ctx *gin.Context) {
 
 	notifier, err := c.notifierService.GetNotifier(user, id)
 	if err != nil {
+		if err.Error() == "insufficient permissions to view notifier in this workspace" {
+			ctx.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+			return
+		}
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
@@ -95,22 +111,41 @@ func (c *NotifierController) GetNotifier(ctx *gin.Context) {
 
 // GetNotifiers
 // @Summary Get all notifiers
-// @Description Get all notifiers for the current user
+// @Description Get all notifiers for a workspace
 // @Tags notifiers
 // @Produce json
 // @Param Authorization header string true "JWT token"
+// @Param workspace_id query string true "Workspace ID"
 // @Success 200 {array} Notifier
+// @Failure 400
 // @Failure 401
+// @Failure 403
 // @Router /notifiers [get]
 func (c *NotifierController) GetNotifiers(ctx *gin.Context) {
-	user, err := c.userService.GetUserFromToken(ctx.GetHeader("Authorization"))
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
 		return
 	}
 
-	notifiers, err := c.notifierService.GetNotifiers(user)
+	workspaceIDStr := ctx.Query("workspace_id")
+	if workspaceIDStr == "" {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "workspace_id query parameter is required"})
+		return
+	}
+
+	workspaceID, err := uuid.Parse(workspaceIDStr)
 	if err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "invalid workspace_id"})
+		return
+	}
+
+	notifiers, err := c.notifierService.GetNotifiers(user, workspaceID)
+	if err != nil {
+		if err.Error() == "insufficient permissions to view notifiers in this workspace" {
+			ctx.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+			return
+		}
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
@@ -128,11 +163,12 @@ func (c *NotifierController) GetNotifiers(ctx *gin.Context) {
 // @Success 200
 // @Failure 400
 // @Failure 401
+// @Failure 403
 // @Router /notifiers/{id} [delete]
 func (c *NotifierController) DeleteNotifier(ctx *gin.Context) {
-	user, err := c.userService.GetUserFromToken(ctx.GetHeader("Authorization"))
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
 		return
 	}
 
@@ -142,13 +178,11 @@ func (c *NotifierController) DeleteNotifier(ctx *gin.Context) {
 		return
 	}
 
-	notifier, err := c.notifierService.GetNotifier(user, id)
-	if err != nil {
-		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-
-	if err := c.notifierService.DeleteNotifier(user, notifier.ID); err != nil {
+	if err := c.notifierService.DeleteNotifier(user, id); err != nil {
+		if err.Error() == "insufficient permissions to manage notifier in this workspace" {
+			ctx.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+			return
+		}
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
@@ -166,11 +200,12 @@ func (c *NotifierController) DeleteNotifier(ctx *gin.Context) {
 // @Success 200
 // @Failure 400
 // @Failure 401
+// @Failure 403
 // @Router /notifiers/{id}/test [post]
 func (c *NotifierController) SendTestNotification(ctx *gin.Context) {
-	user, err := c.userService.GetUserFromToken(ctx.GetHeader("Authorization"))
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
 		return
 	}
 
@@ -181,6 +216,10 @@ func (c *NotifierController) SendTestNotification(ctx *gin.Context) {
 	}
 
 	if err := c.notifierService.SendTestNotification(user, id); err != nil {
+		if err.Error() == "insufficient permissions to test notifier in this workspace" {
+			ctx.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+			return
+		}
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
@@ -195,28 +234,44 @@ func (c *NotifierController) SendTestNotification(ctx *gin.Context) {
 // @Accept json
 // @Produce json
 // @Param Authorization header string true "JWT token"
-// @Param notifier body Notifier true "Notifier data"
+// @Param request body Notifier true "Notifier data with workspaceId"
 // @Success 200
 // @Failure 400
 // @Failure 401
+// @Failure 403
 // @Router /notifiers/direct-test [post]
 func (c *NotifierController) SendTestNotificationDirect(ctx *gin.Context) {
-	user, err := c.userService.GetUserFromToken(ctx.GetHeader("Authorization"))
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
 		return
 	}
 
-	var notifier Notifier
-	if err := ctx.ShouldBindJSON(&notifier); err != nil {
+	var request Notifier
+	if err := ctx.ShouldBindJSON(&request); err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
-	// For direct test, associate with the current user
-	notifier.UserID = user.ID
+	if request.WorkspaceID == uuid.Nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "workspaceId is required"})
+		return
+	}
 
-	if err := c.notifierService.SendTestNotificationToNotifier(&notifier); err != nil {
+	canView, _, err := c.workspaceService.CanUserAccessWorkspace(request.WorkspaceID, user)
+	if err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if !canView {
+		ctx.JSON(
+			http.StatusForbidden,
+			gin.H{"error": "insufficient permissions to test notifier in this workspace"},
+		)
+		return
+	}
+
+	if err := c.notifierService.SendTestNotificationToNotifier(&request); err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}

backend/internal/features/notifiers/controller_test.go

@@ -0,0 +1,514 @@
+package notifiers
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"postgresus-backend/internal/config"
+	audit_logs "postgresus-backend/internal/features/audit_logs"
+	telegram_notifier "postgresus-backend/internal/features/notifiers/models/telegram"
+	webhook_notifier "postgresus-backend/internal/features/notifiers/models/webhook"
+	users_enums "postgresus-backend/internal/features/users/enums"
+	users_middleware "postgresus-backend/internal/features/users/middleware"
+	users_services "postgresus-backend/internal/features/users/services"
+	users_testing "postgresus-backend/internal/features/users/testing"
+	workspaces_controllers "postgresus-backend/internal/features/workspaces/controllers"
+	workspaces_testing "postgresus-backend/internal/features/workspaces/testing"
+	test_utils "postgresus-backend/internal/util/testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_SaveNewNotifier_NotifierReturnedViaGet(t *testing.T) {
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	router := createRouter()
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	notifier := createNewNotifier(workspace.ID)
+
+	var savedNotifier Notifier
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/notifiers",
+		"Bearer "+owner.Token,
+		*notifier,
+		http.StatusOK,
+		&savedNotifier,
+	)
+
+	verifyNotifierData(t, notifier, &savedNotifier)
+	assert.NotEmpty(t, savedNotifier.ID)
+
+	// Verify notifier is returned via GET
+	var retrievedNotifier Notifier
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/notifiers/%s", savedNotifier.ID.String()),
+		"Bearer "+owner.Token,
+		http.StatusOK,
+		&retrievedNotifier,
+	)
+
+	verifyNotifierData(t, &savedNotifier, &retrievedNotifier)
+
+	// Verify notifier is returned via GET all notifiers
+	var notifiers []Notifier
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/notifiers?workspace_id=%s", workspace.ID.String()),
+		"Bearer "+owner.Token,
+		http.StatusOK,
+		&notifiers,
+	)
+
+	assert.Len(t, notifiers, 1)
+
+	deleteNotifier(t, router, savedNotifier.ID, workspace.ID, owner.Token)
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
+}
+
+func Test_UpdateExistingNotifier_UpdatedNotifierReturnedViaGet(t *testing.T) {
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	router := createRouter()
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	notifier := createNewNotifier(workspace.ID)
+
+	var savedNotifier Notifier
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/notifiers",
+		"Bearer "+owner.Token,
+		*notifier,
+		http.StatusOK,
+		&savedNotifier,
+	)
+
+	updatedName := "Updated Notifier " + uuid.New().String()
+	savedNotifier.Name = updatedName
+
+	var updatedNotifier Notifier
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/notifiers",
+		"Bearer "+owner.Token,
+		savedNotifier,
+		http.StatusOK,
+		&updatedNotifier,
+	)
+
+	assert.Equal(t, updatedName, updatedNotifier.Name)
+	assert.Equal(t, savedNotifier.ID, updatedNotifier.ID)
+
+	deleteNotifier(t, router, updatedNotifier.ID, workspace.ID, owner.Token)
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
+}
+
+func Test_DeleteNotifier_NotifierNotReturnedViaGet(t *testing.T) {
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	router := createRouter()
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	notifier := createNewNotifier(workspace.ID)
+
+	var savedNotifier Notifier
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/notifiers",
+		"Bearer "+owner.Token,
+		*notifier,
+		http.StatusOK,
+		&savedNotifier,
+	)
+
+	test_utils.MakeDeleteRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/notifiers/%s", savedNotifier.ID.String()),
+		"Bearer "+owner.Token,
+		http.StatusOK,
+	)
+
+	response := test_utils.MakeGetRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/notifiers/%s", savedNotifier.ID.String()),
+		"Bearer "+owner.Token,
+		http.StatusBadRequest,
+	)
+
+	assert.Contains(t, string(response.Body), "error")
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
+}
+
+func Test_SendTestNotificationDirect_NotificationSent(t *testing.T) {
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	router := createRouter()
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	notifier := createTelegramNotifier(workspace.ID)
+
+	response := test_utils.MakePostRequest(
+		t, router, "/api/v1/notifiers/direct-test", "Bearer "+owner.Token, *notifier, http.StatusOK,
+	)
+
+	assert.Contains(t, string(response.Body), "successful")
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
+}
+
+func Test_SendTestNotificationExisting_NotificationSent(t *testing.T) {
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	router := createRouter()
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	notifier := createTelegramNotifier(workspace.ID)
+
+	var savedNotifier Notifier
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/notifiers",
+		"Bearer "+owner.Token,
+		*notifier,
+		http.StatusOK,
+		&savedNotifier,
+	)
+
+	response := test_utils.MakePostRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/notifiers/%s/test", savedNotifier.ID.String()),
+		"Bearer "+owner.Token,
+		nil,
+		http.StatusOK,
+	)
+
+	assert.Contains(t, string(response.Body), "successful")
+
+	deleteNotifier(t, router, savedNotifier.ID, workspace.ID, owner.Token)
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
+}
+
+func Test_ViewerCanViewNotifiers_ButCannotModify(t *testing.T) {
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	viewer := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	router := createRouter()
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+	workspaces_testing.AddMemberToWorkspace(
+		workspace,
+		viewer,
+		users_enums.WorkspaceRoleViewer,
+		owner.Token,
+		router,
+	)
+
+	notifier := createNewNotifier(workspace.ID)
+
+	var savedNotifier Notifier
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/notifiers",
+		"Bearer "+owner.Token,
+		*notifier,
+		http.StatusOK,
+		&savedNotifier,
+	)
+
+	// Viewer can GET notifiers
+	var notifiers []Notifier
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/notifiers?workspace_id=%s", workspace.ID.String()),
+		"Bearer "+viewer.Token,
+		http.StatusOK,
+		&notifiers,
+	)
+	assert.Len(t, notifiers, 1)
+
+	// Viewer cannot CREATE notifier
+	newNotifier := createNewNotifier(workspace.ID)
+	test_utils.MakePostRequest(
+		t, router, "/api/v1/notifiers", "Bearer "+viewer.Token, *newNotifier, http.StatusForbidden,
+	)
+
+	// Viewer cannot UPDATE notifier
+	savedNotifier.Name = "Updated by viewer"
+	test_utils.MakePostRequest(
+		t, router, "/api/v1/notifiers", "Bearer "+viewer.Token, savedNotifier, http.StatusForbidden,
+	)
+
+	// Viewer cannot DELETE notifier
+	test_utils.MakeDeleteRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/notifiers/%s", savedNotifier.ID.String()),
+		"Bearer "+viewer.Token,
+		http.StatusForbidden,
+	)
+
+	deleteNotifier(t, router, savedNotifier.ID, workspace.ID, owner.Token)
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
+}
+
+func Test_MemberCanManageNotifiers(t *testing.T) {
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	member := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	router := createRouter()
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+	workspaces_testing.AddMemberToWorkspace(
+		workspace,
+		member,
+		users_enums.WorkspaceRoleMember,
+		owner.Token,
+		router,
+	)
+
+	notifier := createNewNotifier(workspace.ID)
+
+	// Member can CREATE notifier
+	var savedNotifier Notifier
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/notifiers",
+		"Bearer "+member.Token,
+		*notifier,
+		http.StatusOK,
+		&savedNotifier,
+	)
+	assert.NotEmpty(t, savedNotifier.ID)
+
+	// Member can UPDATE notifier
+	savedNotifier.Name = "Updated by member"
+	var updatedNotifier Notifier
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/notifiers",
+		"Bearer "+member.Token,
+		savedNotifier,
+		http.StatusOK,
+		&updatedNotifier,
+	)
+	assert.Equal(t, "Updated by member", updatedNotifier.Name)
+
+	// Member can DELETE notifier
+	test_utils.MakeDeleteRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/notifiers/%s", savedNotifier.ID.String()),
+		"Bearer "+member.Token,
+		http.StatusOK,
+	)
+
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
+}
+
+func Test_AdminCanManageNotifiers(t *testing.T) {
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	admin := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	router := createRouter()
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+	workspaces_testing.AddMemberToWorkspace(
+		workspace,
+		admin,
+		users_enums.WorkspaceRoleAdmin,
+		owner.Token,
+		router,
+	)
+
+	notifier := createNewNotifier(workspace.ID)
+
+	// Admin can CREATE, UPDATE, DELETE
+	var savedNotifier Notifier
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/notifiers",
+		"Bearer "+admin.Token,
+		*notifier,
+		http.StatusOK,
+		&savedNotifier,
+	)
+
+	savedNotifier.Name = "Updated by admin"
+	test_utils.MakePostRequest(
+		t, router, "/api/v1/notifiers", "Bearer "+admin.Token, savedNotifier, http.StatusOK,
+	)
+
+	test_utils.MakeDeleteRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/notifiers/%s", savedNotifier.ID.String()),
+		"Bearer "+admin.Token,
+		http.StatusOK,
+	)
+
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
+}
+
+func Test_UserNotInWorkspace_CannotAccessNotifiers(t *testing.T) {
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	outsider := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	router := createRouter()
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	notifier := createNewNotifier(workspace.ID)
+
+	var savedNotifier Notifier
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/notifiers",
+		"Bearer "+owner.Token,
+		*notifier,
+		http.StatusOK,
+		&savedNotifier,
+	)
+
+	// Outsider cannot GET notifiers
+	test_utils.MakeGetRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/notifiers?workspace_id=%s", workspace.ID.String()),
+		"Bearer "+outsider.Token,
+		http.StatusForbidden,
+	)
+
+	// Outsider cannot CREATE notifier
+	test_utils.MakePostRequest(
+		t, router, "/api/v1/notifiers", "Bearer "+outsider.Token, *notifier, http.StatusForbidden,
+	)
+
+	// Outsider cannot UPDATE notifier
+	test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/notifiers",
+		"Bearer "+outsider.Token,
+		savedNotifier,
+		http.StatusForbidden,
+	)
+
+	// Outsider cannot DELETE notifier
+	test_utils.MakeDeleteRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/notifiers/%s", savedNotifier.ID.String()),
+		"Bearer "+outsider.Token,
+		http.StatusForbidden,
+	)
+
+	deleteNotifier(t, router, savedNotifier.ID, workspace.ID, owner.Token)
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
+}
+
+func Test_CrossWorkspaceSecurity_CannotAccessNotifierFromAnotherWorkspace(t *testing.T) {
+	owner1 := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	owner2 := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	router := createRouter()
+	workspace1 := workspaces_testing.CreateTestWorkspace("Workspace 1", owner1, router)
+	workspace2 := workspaces_testing.CreateTestWorkspace("Workspace 2", owner2, router)
+
+	notifier1 := createNewNotifier(workspace1.ID)
+
+	var savedNotifier Notifier
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/notifiers",
+		"Bearer "+owner1.Token,
+		*notifier1,
+		http.StatusOK,
+		&savedNotifier,
+	)
+
+	// Try to access workspace1's notifier with owner2 from workspace2
+	response := test_utils.MakeGetRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/notifiers/%s", savedNotifier.ID.String()),
+		"Bearer "+owner2.Token,
+		http.StatusForbidden,
+	)
+	assert.Contains(t, string(response.Body), "insufficient permissions")
+
+	deleteNotifier(t, router, savedNotifier.ID, workspace1.ID, owner1.Token)
+	workspaces_testing.RemoveTestWorkspace(workspace1, router)
+	workspaces_testing.RemoveTestWorkspace(workspace2, router)
+}
+
+func createRouter() *gin.Engine {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+
+	v1 := router.Group("/api/v1")
+	protected := v1.Group("").Use(users_middleware.AuthMiddleware(users_services.GetUserService()))
+
+	if routerGroup, ok := protected.(*gin.RouterGroup); ok {
+		GetNotifierController().RegisterRoutes(routerGroup)
+		workspaces_controllers.GetWorkspaceController().RegisterRoutes(routerGroup)
+		workspaces_controllers.GetMembershipController().RegisterRoutes(routerGroup)
+	}
+
+	audit_logs.SetupDependencies()
+
+	return router
+}
+
+func createNewNotifier(workspaceID uuid.UUID) *Notifier {
+	return &Notifier{
+		WorkspaceID:  workspaceID,
+		Name:         "Test Notifier " + uuid.New().String(),
+		NotifierType: NotifierTypeWebhook,
+		WebhookNotifier: &webhook_notifier.WebhookNotifier{
+			WebhookURL:    "https://webhook.site/test-" + uuid.New().String(),
+			WebhookMethod: webhook_notifier.WebhookMethodPOST,
+		},
+	}
+}
+
+func createTelegramNotifier(workspaceID uuid.UUID) *Notifier {
+	env := config.GetEnv()
+	return &Notifier{
+		WorkspaceID:  workspaceID,
+		Name:         "Test Telegram Notifier " + uuid.New().String(),
+		NotifierType: NotifierTypeTelegram,
+		TelegramNotifier: &telegram_notifier.TelegramNotifier{
+			BotToken:     env.TestTelegramBotToken,
+			TargetChatID: env.TestTelegramChatID,
+		},
+	}
+}
+
+func verifyNotifierData(t *testing.T, expected *Notifier, actual *Notifier) {
+	assert.Equal(t, expected.Name, actual.Name)
+	assert.Equal(t, expected.NotifierType, actual.NotifierType)
+	assert.Equal(t, expected.WorkspaceID, actual.WorkspaceID)
+}
+
+func deleteNotifier(
+	t *testing.T,
+	router *gin.Engine,
+	notifierID, workspaceID uuid.UUID,
+	token string,
+) {
+	test_utils.MakeDeleteRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/notifiers/%s", notifierID.String()),
+		"Bearer "+token,
+		http.StatusOK,
+	)
+}

backend/internal/features/notifiers/di.go

@@ -1,7 +1,8 @@
 package notifiers
 
 import (
-	"postgresus-backend/internal/features/users"
+	audit_logs "postgresus-backend/internal/features/audit_logs"
+	workspaces_services "postgresus-backend/internal/features/workspaces/services"
 	"postgresus-backend/internal/util/logger"
 )
 
@@ -9,10 +10,12 @@ var notifierRepository = &NotifierRepository{}
 var notifierService = &NotifierService{
 	notifierRepository,
 	logger.GetLogger(),
+	workspaces_services.GetWorkspaceService(),
+	audit_logs.GetAuditLogService(),
 }
 var notifierController = &NotifierController{
 	notifierService,
-	users.GetUserService(),
+	workspaces_services.GetWorkspaceService(),
 }
 
 func GetNotifierController() *NotifierController {
@@ -22,3 +25,7 @@ func GetNotifierController() *NotifierController {
 func GetNotifierService() *NotifierService {
 	return notifierService
 }
+
+func SetupDependencies() {
+	workspaces_services.GetWorkspaceService().AddWorkspaceDeletionListener(notifierService)
+}

backend/internal/features/notifiers/model.go

@@ -15,7 +15,7 @@ import (
 
 type Notifier struct {
 	ID            uuid.UUID    `json:"id"            gorm:"column:id;primaryKey;type:uuid;default:gen_random_uuid()"`
-	UserID        uuid.UUID    `json:"userId"        gorm:"column:user_id;not null;type:uuid;index"`
+	WorkspaceID   uuid.UUID    `json:"workspaceId"   gorm:"column:workspace_id;not null;type:uuid;index"`
 	Name          string       `json:"name"          gorm:"column:name;not null;type:varchar(255)"`
 	NotifierType  NotifierType `json:"notifierType"  gorm:"column:notifier_type;not null;type:varchar(50)"`
 	LastSendError *string      `json:"lastSendError" gorm:"column:last_send_error;type:text"`

backend/internal/features/notifiers/repository.go

@@ -143,7 +143,7 @@ func (r *NotifierRepository) FindByID(id uuid.UUID) (*Notifier, error) {
 	return &notifier, nil
 }
 
-func (r *NotifierRepository) FindByUserID(userID uuid.UUID) ([]*Notifier, error) {
+func (r *NotifierRepository) FindByWorkspaceID(workspaceID uuid.UUID) ([]*Notifier, error) {
 	var notifiers []*Notifier
 
 	if err := storage.
@@ -154,7 +154,7 @@ func (r *NotifierRepository) FindByUserID(userID uuid.UUID) ([]*Notifier, error)
 		Preload("SlackNotifier").
 		Preload("DiscordNotifier").
 		Preload("TeamsNotifier").
-		Where("user_id = ?", userID).
+		Where("workspace_id = ?", workspaceID).
 		Order("name ASC").
 		Find(&notifiers).Error; err != nil {
 		return nil, err

backend/internal/features/notifiers/service.go

@@ -2,8 +2,12 @@ package notifiers
 
 import (
 	"errors"
+	"fmt"
 	"log/slog"
+
+	audit_logs "postgresus-backend/internal/features/audit_logs"
 	users_models "postgresus-backend/internal/features/users/models"
+	workspaces_services "postgresus-backend/internal/features/workspaces/services"
 
 	"github.com/google/uuid"
 )
@@ -11,32 +15,59 @@ import (
 type NotifierService struct {
 	notifierRepository *NotifierRepository
 	logger             *slog.Logger
+	workspaceService   *workspaces_services.WorkspaceService
+	auditLogService    *audit_logs.AuditLogService
 }
 
 func (s *NotifierService) SaveNotifier(
 	user *users_models.User,
+	workspaceID uuid.UUID,
 	notifier *Notifier,
 ) error {
-	if notifier.ID != uuid.Nil {
+	canManage, err := s.workspaceService.CanUserManageDBs(workspaceID, user)
+	if err != nil {
+		return err
+	}
+	if !canManage {
+		return errors.New("insufficient permissions to manage notifier in this workspace")
+	}
+
+	isUpdate := notifier.ID != uuid.Nil
+
+	if isUpdate {
 		existingNotifier, err := s.notifierRepository.FindByID(notifier.ID)
 		if err != nil {
 			return err
 		}
 
-		if existingNotifier.UserID != user.ID {
-			return errors.New("you have not access to this notifier")
+		if existingNotifier.WorkspaceID != workspaceID {
+			return errors.New("notifier does not belong to this workspace")
 		}
 
-		notifier.UserID = existingNotifier.UserID
+		notifier.WorkspaceID = existingNotifier.WorkspaceID
 	} else {
-		notifier.UserID = user.ID
+		notifier.WorkspaceID = workspaceID
 	}
 
-	_, err := s.notifierRepository.Save(notifier)
+	_, err = s.notifierRepository.Save(notifier)
 	if err != nil {
 		return err
 	}
 
+	if isUpdate {
+		s.auditLogService.WriteAuditLog(
+			fmt.Sprintf("Notifier updated: %s", notifier.Name),
+			&user.ID,
+			&workspaceID,
+		)
+	} else {
+		s.auditLogService.WriteAuditLog(
+			fmt.Sprintf("Notifier created: %s", notifier.Name),
+			&user.ID,
+			&workspaceID,
+		)
+	}
+
 	return nil
 }
 
@@ -49,11 +80,26 @@ func (s *NotifierService) DeleteNotifier(
 		return err
 	}
 
-	if notifier.UserID != user.ID {
-		return errors.New("you have not access to this notifier")
+	canManage, err := s.workspaceService.CanUserManageDBs(notifier.WorkspaceID, user)
+	if err != nil {
+		return err
+	}
+	if !canManage {
+		return errors.New("insufficient permissions to manage notifier in this workspace")
 	}
 
-	return s.notifierRepository.Delete(notifier)
+	err = s.notifierRepository.Delete(notifier)
+	if err != nil {
+		return err
+	}
+
+	s.auditLogService.WriteAuditLog(
+		fmt.Sprintf("Notifier deleted: %s", notifier.Name),
+		&user.ID,
+		&notifier.WorkspaceID,
+	)
+
+	return nil
 }
 
 func (s *NotifierService) GetNotifier(
@@ -65,8 +111,12 @@ func (s *NotifierService) GetNotifier(
 		return nil, err
 	}
 
-	if notifier.UserID != user.ID {
-		return nil, errors.New("you have not access to this notifier")
+	canView, _, err := s.workspaceService.CanUserAccessWorkspace(notifier.WorkspaceID, user)
+	if err != nil {
+		return nil, err
+	}
+	if !canView {
+		return nil, errors.New("insufficient permissions to view notifier in this workspace")
 	}
 
 	return notifier, nil
@@ -74,8 +124,17 @@ func (s *NotifierService) GetNotifier(
 
 func (s *NotifierService) GetNotifiers(
 	user *users_models.User,
+	workspaceID uuid.UUID,
 ) ([]*Notifier, error) {
-	return s.notifierRepository.FindByUserID(user.ID)
+	canView, _, err := s.workspaceService.CanUserAccessWorkspace(workspaceID, user)
+	if err != nil {
+		return nil, err
+	}
+	if !canView {
+		return nil, errors.New("insufficient permissions to view notifiers in this workspace")
+	}
+
+	return s.notifierRepository.FindByWorkspaceID(workspaceID)
 }
 
 func (s *NotifierService) SendTestNotification(
@@ -87,8 +146,12 @@ func (s *NotifierService) SendTestNotification(
 		return err
 	}
 
-	if notifier.UserID != user.ID {
-		return errors.New("you have not access to this notifier")
+	canView, _, err := s.workspaceService.CanUserAccessWorkspace(notifier.WorkspaceID, user)
+	if err != nil {
+		return err
+	}
+	if !canView {
+		return errors.New("insufficient permissions to test notifier in this workspace")
 	}
 
 	err = notifier.Send(s.logger, "Test message", "This is a test message")
@@ -143,3 +206,18 @@ func (s *NotifierService) SendNotification(
 		s.logger.Error("Failed to save notifier", "error", err)
 	}
 }
+
+func (s *NotifierService) OnBeforeWorkspaceDeletion(workspaceID uuid.UUID) error {
+	notifiers, err := s.notifierRepository.FindByWorkspaceID(workspaceID)
+	if err != nil {
+		return fmt.Errorf("failed to get notifiers for workspace deletion: %w", err)
+	}
+
+	for _, notifier := range notifiers {
+		if err := s.notifierRepository.Delete(notifier); err != nil {
+			return fmt.Errorf("failed to delete notifier %s: %w", notifier.ID, err)
+		}
+	}
+
+	return nil
+}

backend/internal/features/notifiers/testing.go

@@ -6,9 +6,9 @@ import (
 	"github.com/google/uuid"
 )
 
-func CreateTestNotifier(userID uuid.UUID) *Notifier {
+func CreateTestNotifier(workspaceID uuid.UUID) *Notifier {
 	notifier := &Notifier{
-		UserID:       userID,
+		WorkspaceID:  workspaceID,
 		Name:         "test " + uuid.New().String(),
 		NotifierType: NotifierTypeWebhook,
 		WebhookNotifier: &webhook_notifier.WebhookNotifier{

backend/internal/features/restores/controller.go

@@ -2,7 +2,7 @@ package restores
 
 import (
 	"net/http"
-	"postgresus-backend/internal/features/users"
+	users_middleware "postgresus-backend/internal/features/users/middleware"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
@@ -10,7 +10,6 @@ import (
 
 type RestoreController struct {
 	restoreService *RestoreService
-	userService    *users.UserService
 }
 
 func (c *RestoreController) RegisterRoutes(router *gin.RouterGroup) {
@@ -29,24 +28,18 @@ func (c *RestoreController) RegisterRoutes(router *gin.RouterGroup) {
 // @Failure 401
 // @Router /restores/{backupId} [get]
 func (c *RestoreController) GetRestores(ctx *gin.Context) {
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
 	backupID, err := uuid.Parse(ctx.Param("backupId"))
 	if err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": "invalid backup ID"})
 		return
 	}
 
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
-		return
-	}
-
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-		return
-	}
-
 	restores, err := c.restoreService.GetRestores(user, backupID)
 	if err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
@@ -66,6 +59,12 @@ func (c *RestoreController) GetRestores(ctx *gin.Context) {
 // @Failure 401
 // @Router /restores/{backupId}/restore [post]
 func (c *RestoreController) RestoreBackup(ctx *gin.Context) {
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
 	backupID, err := uuid.Parse(ctx.Param("backupId"))
 	if err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": "invalid backup ID"})
@@ -78,18 +77,6 @@ func (c *RestoreController) RestoreBackup(ctx *gin.Context) {
 		return
 	}
 
-	authorizationHeader := ctx.GetHeader("Authorization")
-	if authorizationHeader == "" {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header is required"})
-		return
-	}
-
-	user, err := c.userService.GetUserFromToken(authorizationHeader)
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
-		return
-	}
-
 	if err := c.restoreService.RestoreBackupWithAuth(user, backupID, requestDTO); err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return

backend/internal/features/restores/controller_test.go

@@ -0,0 +1,348 @@
+package restores
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+
+	audit_logs "postgresus-backend/internal/features/audit_logs"
+	"postgresus-backend/internal/features/backups/backups"
+	backups_config "postgresus-backend/internal/features/backups/config"
+	"postgresus-backend/internal/features/databases"
+	"postgresus-backend/internal/features/databases/databases/postgresql"
+	"postgresus-backend/internal/features/restores/models"
+	"postgresus-backend/internal/features/storages"
+	local_storage "postgresus-backend/internal/features/storages/models/local"
+	users_dto "postgresus-backend/internal/features/users/dto"
+	users_enums "postgresus-backend/internal/features/users/enums"
+	users_services "postgresus-backend/internal/features/users/services"
+	users_testing "postgresus-backend/internal/features/users/testing"
+	workspaces_controllers "postgresus-backend/internal/features/workspaces/controllers"
+	workspaces_models "postgresus-backend/internal/features/workspaces/models"
+	workspaces_testing "postgresus-backend/internal/features/workspaces/testing"
+	test_utils "postgresus-backend/internal/util/testing"
+	"postgresus-backend/internal/util/tools"
+)
+
+func createTestRouter() *gin.Engine {
+	router := workspaces_testing.CreateTestRouter(
+		workspaces_controllers.GetWorkspaceController(),
+		workspaces_controllers.GetMembershipController(),
+		databases.GetDatabaseController(),
+		backups_config.GetBackupConfigController(),
+		backups.GetBackupController(),
+		GetRestoreController(),
+	)
+	return router
+}
+
+func Test_GetRestores_WhenUserIsWorkspaceMember_RestoresReturned(t *testing.T) {
+	router := createTestRouter()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	database, backup := createTestDatabaseWithBackupForRestore(workspace, owner, router)
+
+	var restores []*models.Restore
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/restores/%s", backup.ID.String()),
+		"Bearer "+owner.Token,
+		http.StatusOK,
+		&restores,
+	)
+
+	assert.NotNil(t, restores)
+	assert.Equal(t, 0, len(restores))
+	assert.NotNil(t, database)
+}
+
+func Test_GetRestores_WhenUserIsNotWorkspaceMember_ReturnsForbidden(t *testing.T) {
+	router := createTestRouter()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	_, backup := createTestDatabaseWithBackupForRestore(workspace, owner, router)
+
+	nonMember := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	testResp := test_utils.MakeGetRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/restores/%s", backup.ID.String()),
+		"Bearer "+nonMember.Token,
+		http.StatusBadRequest,
+	)
+
+	assert.Contains(t, string(testResp.Body), "insufficient permissions")
+}
+
+func Test_GetRestores_WhenUserIsGlobalAdmin_RestoresReturned(t *testing.T) {
+	router := createTestRouter()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	_, backup := createTestDatabaseWithBackupForRestore(workspace, owner, router)
+
+	admin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+
+	var restores []*models.Restore
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/restores/%s", backup.ID.String()),
+		"Bearer "+admin.Token,
+		http.StatusOK,
+		&restores,
+	)
+
+	assert.NotNil(t, restores)
+}
+
+func Test_RestoreBackup_WhenUserIsWorkspaceMember_RestoreInitiated(t *testing.T) {
+	router := createTestRouter()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	_, backup := createTestDatabaseWithBackupForRestore(workspace, owner, router)
+
+	request := RestoreBackupRequest{
+		PostgresqlDatabase: &postgresql.PostgresqlDatabase{
+			Version:  tools.PostgresqlVersion16,
+			Host:     "localhost",
+			Port:     5432,
+			Username: "postgres",
+			Password: "postgres",
+		},
+	}
+
+	testResp := test_utils.MakePostRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/restores/%s/restore", backup.ID.String()),
+		"Bearer "+owner.Token,
+		request,
+		http.StatusOK,
+	)
+
+	assert.Contains(t, string(testResp.Body), "restore started successfully")
+}
+
+func Test_RestoreBackup_WhenUserIsNotWorkspaceMember_ReturnsForbidden(t *testing.T) {
+	router := createTestRouter()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	_, backup := createTestDatabaseWithBackupForRestore(workspace, owner, router)
+
+	nonMember := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	request := RestoreBackupRequest{
+		PostgresqlDatabase: &postgresql.PostgresqlDatabase{
+			Version:  tools.PostgresqlVersion16,
+			Host:     "localhost",
+			Port:     5432,
+			Username: "postgres",
+			Password: "postgres",
+		},
+	}
+
+	testResp := test_utils.MakePostRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/restores/%s/restore", backup.ID.String()),
+		"Bearer "+nonMember.Token,
+		request,
+		http.StatusBadRequest,
+	)
+
+	assert.Contains(t, string(testResp.Body), "insufficient permissions")
+}
+
+func Test_RestoreBackup_AuditLogWritten(t *testing.T) {
+	router := createTestRouter()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+
+	database, backup := createTestDatabaseWithBackupForRestore(workspace, owner, router)
+
+	request := RestoreBackupRequest{
+		PostgresqlDatabase: &postgresql.PostgresqlDatabase{
+			Version:  tools.PostgresqlVersion16,
+			Host:     "localhost",
+			Port:     5432,
+			Username: "postgres",
+			Password: "postgres",
+		},
+	}
+
+	test_utils.MakePostRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/restores/%s/restore", backup.ID.String()),
+		"Bearer "+owner.Token,
+		request,
+		http.StatusOK,
+	)
+
+	time.Sleep(100 * time.Millisecond)
+
+	auditLogService := audit_logs.GetAuditLogService()
+	auditLogs, err := auditLogService.GetWorkspaceAuditLogs(
+		workspace.ID,
+		&audit_logs.GetAuditLogsRequest{
+			Limit:  100,
+			Offset: 0,
+		},
+	)
+	assert.NoError(t, err)
+
+	found := false
+	for _, log := range auditLogs.AuditLogs {
+		if strings.Contains(log.Message, "Database restored from backup") &&
+			strings.Contains(log.Message, database.Name) {
+			found = true
+			break
+		}
+	}
+	assert.True(t, found, "Audit log for restore not found")
+}
+
+func createTestDatabaseWithBackupForRestore(
+	workspace *workspaces_models.Workspace,
+	owner *users_dto.SignInResponseDTO,
+	router *gin.Engine,
+) (*databases.Database, *backups.Backup) {
+	database := createTestDatabase("Test Database", workspace.ID, owner.Token, router)
+	storage := createTestStorage(workspace.ID)
+
+	configService := backups_config.GetBackupConfigService()
+	config, err := configService.GetBackupConfigByDbId(database.ID)
+	if err != nil {
+		panic(err)
+	}
+
+	config.IsBackupsEnabled = true
+	config.StorageID = &storage.ID
+	config.Storage = storage
+	_, err = configService.SaveBackupConfig(config)
+	if err != nil {
+		panic(err)
+	}
+
+	backup := createTestBackup(database, owner)
+
+	return database, backup
+}
+
+func createTestDatabase(
+	name string,
+	workspaceID uuid.UUID,
+	token string,
+	router *gin.Engine,
+) *databases.Database {
+	testDbName := "test_db"
+	request := databases.Database{
+		WorkspaceID: &workspaceID,
+		Name:        name,
+		Type:        databases.DatabaseTypePostgres,
+		Postgresql: &postgresql.PostgresqlDatabase{
+			Version:  tools.PostgresqlVersion16,
+			Host:     "localhost",
+			Port:     5432,
+			Username: "postgres",
+			Password: "postgres",
+			Database: &testDbName,
+		},
+	}
+
+	w := workspaces_testing.MakeAPIRequest(
+		router,
+		"POST",
+		"/api/v1/databases/create",
+		"Bearer "+token,
+		request,
+	)
+
+	if w.Code != http.StatusCreated {
+		panic(
+			fmt.Sprintf("Failed to create database. Status: %d, Body: %s", w.Code, w.Body.String()),
+		)
+	}
+
+	var database databases.Database
+	if err := json.Unmarshal(w.Body.Bytes(), &database); err != nil {
+		panic(err)
+	}
+
+	return &database
+}
+
+func createTestStorage(workspaceID uuid.UUID) *storages.Storage {
+	storage := &storages.Storage{
+		WorkspaceID:  workspaceID,
+		Type:         storages.StorageTypeLocal,
+		Name:         "Test Storage " + uuid.New().String(),
+		LocalStorage: &local_storage.LocalStorage{},
+	}
+
+	repo := &storages.StorageRepository{}
+	storage, err := repo.Save(storage)
+	if err != nil {
+		panic(err)
+	}
+
+	return storage
+}
+
+func createTestBackup(
+	database *databases.Database,
+	owner *users_dto.SignInResponseDTO,
+) *backups.Backup {
+	userService := users_services.GetUserService()
+	user, err := userService.GetUserFromToken(owner.Token)
+	if err != nil {
+		panic(err)
+	}
+
+	storages, err := storages.GetStorageService().GetStorages(user, *database.WorkspaceID)
+	if err != nil || len(storages) == 0 {
+		panic("No storage found for workspace")
+	}
+
+	backup := &backups.Backup{
+		ID:               uuid.New(),
+		DatabaseID:       database.ID,
+		Database:         database,
+		StorageID:        storages[0].ID,
+		Storage:          storages[0],
+		Status:           backups.BackupStatusCompleted,
+		BackupSizeMb:     10.5,
+		BackupDurationMs: 1000,
+		CreatedAt:        time.Now().UTC(),
+	}
+
+	repo := &backups.BackupRepository{}
+	if err := repo.Save(backup); err != nil {
+		panic(err)
+	}
+
+	dummyContent := []byte("dummy backup content for testing")
+	reader := strings.NewReader(string(dummyContent))
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	if err := storages[0].SaveFile(logger, backup.ID, reader); err != nil {
+		panic(fmt.Sprintf("Failed to create test backup file: %v", err))
+	}
+
+	return backup
+}

backend/internal/features/restores/di.go

@@ -1,12 +1,13 @@
 package restores
 
 import (
+	audit_logs "postgresus-backend/internal/features/audit_logs"
 	"postgresus-backend/internal/features/backups/backups"
 	backups_config "postgresus-backend/internal/features/backups/config"
 	"postgresus-backend/internal/features/databases"
 	"postgresus-backend/internal/features/restores/usecases"
 	"postgresus-backend/internal/features/storages"
-	"postgresus-backend/internal/features/users"
+	workspaces_services "postgresus-backend/internal/features/workspaces/services"
 	"postgresus-backend/internal/util/logger"
 )
 
@@ -19,10 +20,11 @@ var restoreService = &RestoreService{
 	usecases.GetRestoreBackupUsecase(),
 	databases.GetDatabaseService(),
 	logger.GetLogger(),
+	workspaces_services.GetWorkspaceService(),
+	audit_logs.GetAuditLogService(),
 }
 var restoreController = &RestoreController{
 	restoreService,
-	users.GetUserService(),
 }
 
 var restoreBackgroundService = &RestoreBackgroundService{

backend/internal/features/restores/service.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	audit_logs "postgresus-backend/internal/features/audit_logs"
 	"postgresus-backend/internal/features/backups/backups"
 	backups_config "postgresus-backend/internal/features/backups/config"
 	"postgresus-backend/internal/features/databases"
@@ -12,6 +13,7 @@ import (
 	"postgresus-backend/internal/features/restores/usecases"
 	"postgresus-backend/internal/features/storages"
 	users_models "postgresus-backend/internal/features/users/models"
+	workspaces_services "postgresus-backend/internal/features/workspaces/services"
 	"postgresus-backend/internal/util/tools"
 	"time"
 
@@ -26,6 +28,8 @@ type RestoreService struct {
 	restoreBackupUsecase *usecases.RestoreBackupUsecase
 	databaseService      *databases.DatabaseService
 	logger               *slog.Logger
+	workspaceService     *workspaces_services.WorkspaceService
+	auditLogService      *audit_logs.AuditLogService
 }
 
 func (s *RestoreService) OnBeforeBackupRemove(backup *backups.Backup) error {
@@ -58,8 +62,19 @@ func (s *RestoreService) GetRestores(
 		return nil, err
 	}
 
-	if backup.Database.UserID != user.ID {
-		return nil, errors.New("user does not have access to this backup")
+	if backup.Database.WorkspaceID == nil {
+		return nil, errors.New("cannot get restores for database without workspace")
+	}
+
+	canAccess, _, err := s.workspaceService.CanUserAccessWorkspace(
+		*backup.Database.WorkspaceID,
+		user,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if !canAccess {
+		return nil, errors.New("insufficient permissions to access restores for this backup")
 	}
 
 	return s.restoreRepository.FindByBackupID(backupID)
@@ -75,8 +90,19 @@ func (s *RestoreService) RestoreBackupWithAuth(
 		return err
 	}
 
-	if backup.Database.UserID != user.ID {
-		return errors.New("user does not have access to this backup")
+	if backup.Database.WorkspaceID == nil {
+		return errors.New("cannot restore backup for database without workspace")
+	}
+
+	canAccess, _, err := s.workspaceService.CanUserAccessWorkspace(
+		*backup.Database.WorkspaceID,
+		user,
+	)
+	if err != nil {
+		return err
+	}
+	if !canAccess {
+		return errors.New("insufficient permissions to restore this backup")
 	}
 
 	backupDatabase, err := s.databaseService.GetDatabase(user, backup.DatabaseID)
@@ -105,6 +131,16 @@ func (s *RestoreService) RestoreBackupWithAuth(
 		}
 	}()
 
+	s.auditLogService.WriteAuditLog(
+		fmt.Sprintf(
+			"Database restored from backup %s for database: %s",
+			backupID.String(),
+			backup.Database.Name,
+		),
+		&user.ID,
+		backup.Database.WorkspaceID,
+	)
+
 	return nil
 }
 

backend/internal/features/storages/controller.go

@@ -2,15 +2,16 @@ package storages
 
 import (
 	"net/http"
-	"postgresus-backend/internal/features/users"
+	users_middleware "postgresus-backend/internal/features/users/middleware"
+	workspaces_services "postgresus-backend/internal/features/workspaces/services"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 )
 
 type StorageController struct {
-	storageService *StorageService
-	userService    *users.UserService
+	storageService   *StorageService
+	workspaceService *workspaces_services.WorkspaceService
 }
 
 func (c *StorageController) RegisterRoutes(router *gin.RouterGroup) {
@@ -29,35 +30,45 @@ func (c *StorageController) RegisterRoutes(router *gin.RouterGroup) {
 // @Accept json
 // @Produce json
 // @Param Authorization header string true "JWT token"
-// @Param storage body Storage true "Storage data"
+// @Param request body Storage true "Storage data with workspaceId"
 // @Success 200 {object} Storage
 // @Failure 400
 // @Failure 401
+// @Failure 403
 // @Router /storages [post]
 func (c *StorageController) SaveStorage(ctx *gin.Context) {
-	user, err := c.userService.GetUserFromToken(ctx.GetHeader("Authorization"))
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
 		return
 	}
 
-	var storage Storage
-	if err := ctx.ShouldBindJSON(&storage); err != nil {
+	var request Storage
+	if err := ctx.ShouldBindJSON(&request); err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
-	if err := storage.Validate(); err != nil {
+	if request.WorkspaceID == uuid.Nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "workspaceId is required"})
+		return
+	}
+
+	if err := request.Validate(); err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
-	if err := c.storageService.SaveStorage(user, &storage); err != nil {
+	if err := c.storageService.SaveStorage(user, request.WorkspaceID, &request); err != nil {
+		if err.Error() == "insufficient permissions to manage storage in this workspace" {
+			ctx.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+			return
+		}
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
-	ctx.JSON(http.StatusOK, storage)
+	ctx.JSON(http.StatusOK, request)
 }
 
 // GetStorage
@@ -70,11 +81,12 @@ func (c *StorageController) SaveStorage(ctx *gin.Context) {
 // @Success 200 {object} Storage
 // @Failure 400
 // @Failure 401
+// @Failure 403
 // @Router /storages/{id} [get]
 func (c *StorageController) GetStorage(ctx *gin.Context) {
-	user, err := c.userService.GetUserFromToken(ctx.GetHeader("Authorization"))
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
 		return
 	}
 
@@ -86,6 +98,10 @@ func (c *StorageController) GetStorage(ctx *gin.Context) {
 
 	storage, err := c.storageService.GetStorage(user, id)
 	if err != nil {
+		if err.Error() == "insufficient permissions to view storage in this workspace" {
+			ctx.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+			return
+		}
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
@@ -95,22 +111,41 @@ func (c *StorageController) GetStorage(ctx *gin.Context) {
 
 // GetStorages
 // @Summary Get all storages
-// @Description Get all storages for the current user
+// @Description Get all storages for a workspace
 // @Tags storages
 // @Produce json
 // @Param Authorization header string true "JWT token"
+// @Param workspace_id query string true "Workspace ID"
 // @Success 200 {array} Storage
+// @Failure 400
 // @Failure 401
+// @Failure 403
 // @Router /storages [get]
 func (c *StorageController) GetStorages(ctx *gin.Context) {
-	user, err := c.userService.GetUserFromToken(ctx.GetHeader("Authorization"))
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
 		return
 	}
 
-	storages, err := c.storageService.GetStorages(user)
+	workspaceIDStr := ctx.Query("workspace_id")
+	if workspaceIDStr == "" {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "workspace_id query parameter is required"})
+		return
+	}
+
+	workspaceID, err := uuid.Parse(workspaceIDStr)
 	if err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "invalid workspace_id"})
+		return
+	}
+
+	storages, err := c.storageService.GetStorages(user, workspaceID)
+	if err != nil {
+		if err.Error() == "insufficient permissions to view storages in this workspace" {
+			ctx.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+			return
+		}
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
@@ -128,11 +163,12 @@ func (c *StorageController) GetStorages(ctx *gin.Context) {
 // @Success 200
 // @Failure 400
 // @Failure 401
+// @Failure 403
 // @Router /storages/{id} [delete]
 func (c *StorageController) DeleteStorage(ctx *gin.Context) {
-	user, err := c.userService.GetUserFromToken(ctx.GetHeader("Authorization"))
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
 		return
 	}
 
@@ -143,6 +179,10 @@ func (c *StorageController) DeleteStorage(ctx *gin.Context) {
 	}
 
 	if err := c.storageService.DeleteStorage(user, id); err != nil {
+		if err.Error() == "insufficient permissions to manage storage in this workspace" {
+			ctx.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+			return
+		}
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
@@ -160,11 +200,12 @@ func (c *StorageController) DeleteStorage(ctx *gin.Context) {
 // @Success 200
 // @Failure 400
 // @Failure 401
+// @Failure 403
 // @Router /storages/{id}/test [post]
 func (c *StorageController) TestStorageConnection(ctx *gin.Context) {
-	user, err := c.userService.GetUserFromToken(ctx.GetHeader("Authorization"))
-	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
 		return
 	}
 
@@ -175,6 +216,10 @@ func (c *StorageController) TestStorageConnection(ctx *gin.Context) {
 	}
 
 	if err := c.storageService.TestStorageConnection(user, id); err != nil {
+		if err.Error() == "insufficient permissions to test storage in this workspace" {
+			ctx.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+			return
+		}
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
@@ -189,33 +234,49 @@ func (c *StorageController) TestStorageConnection(ctx *gin.Context) {
 // @Accept json
 // @Produce json
 // @Param Authorization header string true "JWT token"
-// @Param storage body Storage true "Storage data"
+// @Param request body Storage true "Storage data with workspaceId"
 // @Success 200
 // @Failure 400
 // @Failure 401
+// @Failure 403
 // @Router /storages/direct-test [post]
 func (c *StorageController) TestStorageConnectionDirect(ctx *gin.Context) {
-	user, err := c.userService.GetUserFromToken(ctx.GetHeader("Authorization"))
+	user, ok := users_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	var request Storage
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	if request.WorkspaceID == uuid.Nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "workspaceId is required"})
+		return
+	}
+
+	canView, _, err := c.workspaceService.CanUserAccessWorkspace(request.WorkspaceID, user)
 	if err != nil {
-		ctx.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if !canView {
+		ctx.JSON(
+			http.StatusForbidden,
+			gin.H{"error": "insufficient permissions to test storage in this workspace"},
+		)
 		return
 	}
 
-	var storage Storage
-	if err := ctx.ShouldBindJSON(&storage); err != nil {
+	if err := request.Validate(); err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
-	// For direct test, associate with the current user
-	storage.UserID = user.ID
-
-	if err := storage.Validate(); err != nil {
-		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-
-	if err := c.storageService.TestStorageConnectionDirect(&storage); err != nil {
+	if err := c.storageService.TestStorageConnectionDirect(&request); err != nil {
 		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}

backend/internal/features/storages/controller_test.go

@@ -1,25 +1,40 @@
 package storages
 
 import (
+	"fmt"
 	"net/http"
-	local_storage "postgresus-backend/internal/features/storages/models/local"
-	"postgresus-backend/internal/features/users"
-	test_utils "postgresus-backend/internal/util/testing"
 	"testing"
 
+	audit_logs "postgresus-backend/internal/features/audit_logs"
+	local_storage "postgresus-backend/internal/features/storages/models/local"
+	users_enums "postgresus-backend/internal/features/users/enums"
+	users_middleware "postgresus-backend/internal/features/users/middleware"
+	users_services "postgresus-backend/internal/features/users/services"
+	users_testing "postgresus-backend/internal/features/users/testing"
+	workspaces_controllers "postgresus-backend/internal/features/workspaces/controllers"
+	workspaces_testing "postgresus-backend/internal/features/workspaces/testing"
+	test_utils "postgresus-backend/internal/util/testing"
+
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 )
 
 func Test_SaveNewStorage_StorageReturnedViaGet(t *testing.T) {
-	user := users.GetTestUser()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
 	router := createRouter()
-	storage := createNewStorage(user.UserID)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+	storage := createNewStorage(workspace.ID)
 
 	var savedStorage Storage
 	test_utils.MakePostRequestAndUnmarshal(
-		t, router, "/api/v1/storages", user.Token, storage, http.StatusOK, &savedStorage,
+		t,
+		router,
+		"/api/v1/storages",
+		"Bearer "+owner.Token,
+		*storage,
+		http.StatusOK,
+		&savedStorage,
 	)
 
 	verifyStorageData(t, storage, &savedStorage)
@@ -30,8 +45,8 @@ func Test_SaveNewStorage_StorageReturnedViaGet(t *testing.T) {
 	test_utils.MakeGetRequestAndUnmarshal(
 		t,
 		router,
-		"/api/v1/storages/"+savedStorage.ID.String(),
-		user.Token,
+		fmt.Sprintf("/api/v1/storages/%s", savedStorage.ID.String()),
+		"Bearer "+owner.Token,
 		http.StatusOK,
 		&retrievedStorage,
 	)
@@ -41,181 +56,408 @@ func Test_SaveNewStorage_StorageReturnedViaGet(t *testing.T) {
 	// Verify storage is returned via GET all storages
 	var storages []Storage
 	test_utils.MakeGetRequestAndUnmarshal(
-		t, router, "/api/v1/storages", user.Token, http.StatusOK, &storages,
+		t,
+		router,
+		fmt.Sprintf("/api/v1/storages?workspace_id=%s", workspace.ID.String()),
+		"Bearer "+owner.Token,
+		http.StatusOK,
+		&storages,
 	)
 
 	assert.Contains(t, storages, savedStorage)
 
-	RemoveTestStorage(savedStorage.ID)
+	deleteStorage(t, router, savedStorage.ID, workspace.ID, owner.Token)
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
 }
 
 func Test_UpdateExistingStorage_UpdatedStorageReturnedViaGet(t *testing.T) {
-	user := users.GetTestUser()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
 	router := createRouter()
-	storage := createNewStorage(user.UserID)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+	storage := createNewStorage(workspace.ID)
 
-	// Save initial storage
 	var savedStorage Storage
 	test_utils.MakePostRequestAndUnmarshal(
-		t, router, "/api/v1/storages", user.Token, storage, http.StatusOK, &savedStorage,
+		t,
+		router,
+		"/api/v1/storages",
+		"Bearer "+owner.Token,
+		*storage,
+		http.StatusOK,
+		&savedStorage,
 	)
 
-	// Modify storage name
 	updatedName := "Updated Storage " + uuid.New().String()
 	savedStorage.Name = updatedName
 
-	// Update storage
 	var updatedStorage Storage
 	test_utils.MakePostRequestAndUnmarshal(
-		t, router, "/api/v1/storages", user.Token, savedStorage, http.StatusOK, &updatedStorage,
+		t,
+		router,
+		"/api/v1/storages",
+		"Bearer "+owner.Token,
+		savedStorage,
+		http.StatusOK,
+		&updatedStorage,
 	)
 
-	// Verify updated data
 	assert.Equal(t, updatedName, updatedStorage.Name)
 	assert.Equal(t, savedStorage.ID, updatedStorage.ID)
 
-	// Verify through GET
-	var retrievedStorage Storage
-	test_utils.MakeGetRequestAndUnmarshal(
-		t,
-		router,
-		"/api/v1/storages/"+updatedStorage.ID.String(),
-		user.Token,
-		http.StatusOK,
-		&retrievedStorage,
-	)
-
-	verifyStorageData(t, &updatedStorage, &retrievedStorage)
-
-	// Verify storage is returned via GET all storages
-	var storages []Storage
-	test_utils.MakeGetRequestAndUnmarshal(
-		t, router, "/api/v1/storages", user.Token, http.StatusOK, &storages,
-	)
-
-	assert.Contains(t, storages, updatedStorage)
-
-	RemoveTestStorage(updatedStorage.ID)
+	deleteStorage(t, router, updatedStorage.ID, workspace.ID, owner.Token)
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
 }
 
 func Test_DeleteStorage_StorageNotReturnedViaGet(t *testing.T) {
-	user := users.GetTestUser()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
 	router := createRouter()
-	storage := createNewStorage(user.UserID)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+	storage := createNewStorage(workspace.ID)
 
-	// Save initial storage
 	var savedStorage Storage
 	test_utils.MakePostRequestAndUnmarshal(
-		t, router, "/api/v1/storages", user.Token, storage, http.StatusOK, &savedStorage,
+		t,
+		router,
+		"/api/v1/storages",
+		"Bearer "+owner.Token,
+		*storage,
+		http.StatusOK,
+		&savedStorage,
 	)
 
-	// Delete storage
 	test_utils.MakeDeleteRequest(
-		t, router, "/api/v1/storages/"+savedStorage.ID.String(), user.Token, http.StatusOK,
+		t,
+		router,
+		fmt.Sprintf("/api/v1/storages/%s", savedStorage.ID.String()),
+		"Bearer "+owner.Token,
+		http.StatusOK,
 	)
 
-	// Try to get deleted storage, should return error
 	response := test_utils.MakeGetRequest(
-		t, router, "/api/v1/storages/"+savedStorage.ID.String(), user.Token, http.StatusBadRequest,
+		t,
+		router,
+		fmt.Sprintf("/api/v1/storages/%s", savedStorage.ID.String()),
+		"Bearer "+owner.Token,
+		http.StatusBadRequest,
 	)
 
 	assert.Contains(t, string(response.Body), "error")
-
-	// Verify storage is not returned via GET all storages
-	var storages []Storage
-	test_utils.MakeGetRequestAndUnmarshal(
-		t, router, "/api/v1/storages", user.Token, http.StatusOK, &storages,
-	)
-
-	assert.NotContains(t, storages, savedStorage)
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
 }
 
 func Test_TestDirectStorageConnection_ConnectionEstablished(t *testing.T) {
-	user := users.GetTestUser()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
 	router := createRouter()
-	storage := createNewStorage(user.UserID)
-
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+	storage := createNewStorage(workspace.ID)
 	response := test_utils.MakePostRequest(
-		t, router, "/api/v1/storages/direct-test", user.Token, storage, http.StatusOK,
+		t, router, "/api/v1/storages/direct-test", "Bearer "+owner.Token, *storage, http.StatusOK,
 	)
 
 	assert.Contains(t, string(response.Body), "successful")
+
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
 }
 
 func Test_TestExistingStorageConnection_ConnectionEstablished(t *testing.T) {
-	user := users.GetTestUser()
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
 	router := createRouter()
-	storage := createNewStorage(user.UserID)
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+	storage := createNewStorage(workspace.ID)
 
 	var savedStorage Storage
 	test_utils.MakePostRequestAndUnmarshal(
-		t, router, "/api/v1/storages", user.Token, storage, http.StatusOK, &savedStorage,
+		t,
+		router,
+		"/api/v1/storages",
+		"Bearer "+owner.Token,
+		*storage,
+		http.StatusOK,
+		&savedStorage,
 	)
 
-	// Test connection to existing storage
 	response := test_utils.MakePostRequest(
 		t,
 		router,
-		"/api/v1/storages/"+savedStorage.ID.String()+"/test",
-		user.Token,
+		fmt.Sprintf("/api/v1/storages/%s/test", savedStorage.ID.String()),
+		"Bearer "+owner.Token,
 		nil,
 		http.StatusOK,
 	)
 
 	assert.Contains(t, string(response.Body), "successful")
 
-	RemoveTestStorage(savedStorage.ID)
+	deleteStorage(t, router, savedStorage.ID, workspace.ID, owner.Token)
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
 }
 
-func Test_CallAllMethodsWithoutAuth_UnauthorizedErrorReturned(t *testing.T) {
+func Test_ViewerCanViewStorages_ButCannotModify(t *testing.T) {
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	viewer := users_testing.CreateTestUser(users_enums.UserRoleMember)
 	router := createRouter()
-	storage := createNewStorage(uuid.New())
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+	workspaces_testing.AddMemberToWorkspace(
+		workspace,
+		viewer,
+		users_enums.WorkspaceRoleViewer,
+		owner.Token,
+		router,
+	)
+	storage := createNewStorage(workspace.ID)
 
-	// Test endpoints without auth
-	endpoints := []struct {
-		method string
-		url    string
-		body   interface{}
-	}{
-		{"GET", "/api/v1/storages", nil},
-		{"GET", "/api/v1/storages/" + uuid.New().String(), nil},
-		{"POST", "/api/v1/storages", storage},
-		{"DELETE", "/api/v1/storages/" + uuid.New().String(), nil},
-		{"POST", "/api/v1/storages/" + uuid.New().String() + "/test", nil},
-		{"POST", "/api/v1/storages/direct-test", storage},
-	}
+	var savedStorage Storage
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/storages",
+		"Bearer "+owner.Token,
+		*storage,
+		http.StatusOK,
+		&savedStorage,
+	)
 
-	for _, endpoint := range endpoints {
-		testUnauthorizedEndpoint(t, router, endpoint.method, endpoint.url, endpoint.body)
-	}
+	// Viewer can GET storages
+	var storages []Storage
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/storages?workspace_id=%s", workspace.ID.String()),
+		"Bearer "+viewer.Token,
+		http.StatusOK,
+		&storages,
+	)
+	assert.Len(t, storages, 1)
+
+	// Viewer cannot CREATE storage
+	newStorage := createNewStorage(workspace.ID)
+	test_utils.MakePostRequest(
+		t, router, "/api/v1/storages", "Bearer "+viewer.Token, *newStorage, http.StatusForbidden,
+	)
+
+	// Viewer cannot UPDATE storage
+	savedStorage.Name = "Updated by viewer"
+	test_utils.MakePostRequest(
+		t, router, "/api/v1/storages", "Bearer "+viewer.Token, savedStorage, http.StatusForbidden,
+	)
+
+	// Viewer cannot DELETE storage
+	test_utils.MakeDeleteRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/storages/%s", savedStorage.ID.String()),
+		"Bearer "+viewer.Token,
+		http.StatusForbidden,
+	)
+
+	deleteStorage(t, router, savedStorage.ID, workspace.ID, owner.Token)
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
 }
 
-func testUnauthorizedEndpoint(
-	t *testing.T,
-	router *gin.Engine,
-	method, url string,
-	body interface{},
-) {
-	test_utils.MakeRequest(t, router, test_utils.RequestOptions{
-		Method:         method,
-		URL:            url,
-		Body:           body,
-		ExpectedStatus: http.StatusUnauthorized,
-	})
+func Test_MemberCanManageStorages(t *testing.T) {
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	member := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	router := createRouter()
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+	workspaces_testing.AddMemberToWorkspace(
+		workspace,
+		member,
+		users_enums.WorkspaceRoleMember,
+		owner.Token,
+		router,
+	)
+	storage := createNewStorage(workspace.ID)
+
+	// Member can CREATE storage
+	var savedStorage Storage
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/storages",
+		"Bearer "+member.Token,
+		*storage,
+		http.StatusOK,
+		&savedStorage,
+	)
+	assert.NotEmpty(t, savedStorage.ID)
+
+	// Member can UPDATE storage
+	savedStorage.Name = "Updated by member"
+	var updatedStorage Storage
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/storages",
+		"Bearer "+member.Token,
+		savedStorage,
+		http.StatusOK,
+		&updatedStorage,
+	)
+	assert.Equal(t, "Updated by member", updatedStorage.Name)
+
+	// Member can DELETE storage
+	test_utils.MakeDeleteRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/storages/%s", savedStorage.ID.String()),
+		"Bearer "+member.Token,
+		http.StatusOK,
+	)
+
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
+}
+
+func Test_AdminCanManageStorages(t *testing.T) {
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	admin := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	router := createRouter()
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+	workspaces_testing.AddMemberToWorkspace(
+		workspace,
+		admin,
+		users_enums.WorkspaceRoleAdmin,
+		owner.Token,
+		router,
+	)
+	storage := createNewStorage(workspace.ID)
+
+	// Admin can CREATE, UPDATE, DELETE
+	var savedStorage Storage
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/storages",
+		"Bearer "+admin.Token,
+		*storage,
+		http.StatusOK,
+		&savedStorage,
+	)
+
+	savedStorage.Name = "Updated by admin"
+	test_utils.MakePostRequest(
+		t, router, "/api/v1/storages", "Bearer "+admin.Token, savedStorage, http.StatusOK,
+	)
+
+	test_utils.MakeDeleteRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/storages/%s", savedStorage.ID.String()),
+		"Bearer "+admin.Token,
+		http.StatusOK,
+	)
+
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
+}
+
+func Test_UserNotInWorkspace_CannotAccessStorages(t *testing.T) {
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	outsider := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	router := createRouter()
+	workspace := workspaces_testing.CreateTestWorkspace("Test Workspace", owner, router)
+	storage := createNewStorage(workspace.ID)
+
+	var savedStorage Storage
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/storages",
+		"Bearer "+owner.Token,
+		*storage,
+		http.StatusOK,
+		&savedStorage,
+	)
+
+	// Outsider cannot GET storages
+	test_utils.MakeGetRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/storages?workspace_id=%s", workspace.ID.String()),
+		"Bearer "+outsider.Token,
+		http.StatusForbidden,
+	)
+
+	// Outsider cannot CREATE storage
+	test_utils.MakePostRequest(
+		t, router, "/api/v1/storages", "Bearer "+outsider.Token, *storage, http.StatusForbidden,
+	)
+
+	// Outsider cannot UPDATE storage
+	test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/storages",
+		"Bearer "+outsider.Token,
+		savedStorage,
+		http.StatusForbidden,
+	)
+
+	// Outsider cannot DELETE storage
+	test_utils.MakeDeleteRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/storages/%s", savedStorage.ID.String()),
+		"Bearer "+outsider.Token,
+		http.StatusForbidden,
+	)
+
+	deleteStorage(t, router, savedStorage.ID, workspace.ID, owner.Token)
+	workspaces_testing.RemoveTestWorkspace(workspace, router)
+}
+
+func Test_CrossWorkspaceSecurity_CannotAccessStorageFromAnotherWorkspace(t *testing.T) {
+	owner1 := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	owner2 := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	router := createRouter()
+	workspace1 := workspaces_testing.CreateTestWorkspace("Workspace 1", owner1, router)
+	workspace2 := workspaces_testing.CreateTestWorkspace("Workspace 2", owner2, router)
+	storage1 := createNewStorage(workspace1.ID)
+
+	var savedStorage Storage
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/storages",
+		"Bearer "+owner1.Token,
+		*storage1,
+		http.StatusOK,
+		&savedStorage,
+	)
+
+	// Try to access workspace1's storage with owner2 from workspace2
+	response := test_utils.MakeGetRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/storages/%s", savedStorage.ID.String()),
+		"Bearer "+owner2.Token,
+		http.StatusForbidden,
+	)
+	assert.Contains(t, string(response.Body), "insufficient permissions")
+
+	deleteStorage(t, router, savedStorage.ID, workspace1.ID, owner1.Token)
+	workspaces_testing.RemoveTestWorkspace(workspace1, router)
+	workspaces_testing.RemoveTestWorkspace(workspace2, router)
 }
 
 func createRouter() *gin.Engine {
 	gin.SetMode(gin.TestMode)
 	router := gin.New()
-	controller := GetStorageController()
+
 	v1 := router.Group("/api/v1")
-	controller.RegisterRoutes(v1)
+	protected := v1.Group("").Use(users_middleware.AuthMiddleware(users_services.GetUserService()))
+
+	if routerGroup, ok := protected.(*gin.RouterGroup); ok {
+		GetStorageController().RegisterRoutes(routerGroup)
+		workspaces_controllers.GetWorkspaceController().RegisterRoutes(routerGroup)
+		workspaces_controllers.GetMembershipController().RegisterRoutes(routerGroup)
+	}
+
+	audit_logs.SetupDependencies()
+
 	return router
 }
 
-func createNewStorage(userID uuid.UUID) *Storage {
+func createNewStorage(workspaceID uuid.UUID) *Storage {
 	return &Storage{
-		UserID:       userID,
+		WorkspaceID:  workspaceID,
 		Type:         StorageTypeLocal,
 		Name:         "Test Storage " + uuid.New().String(),
 		LocalStorage: &local_storage.LocalStorage{},
@@ -225,5 +467,20 @@ func createNewStorage(userID uuid.UUID) *Storage {
 func verifyStorageData(t *testing.T, expected *Storage, actual *Storage) {
 	assert.Equal(t, expected.Name, actual.Name)
 	assert.Equal(t, expected.Type, actual.Type)
-	assert.Equal(t, expected.UserID, actual.UserID)
+	assert.Equal(t, expected.WorkspaceID, actual.WorkspaceID)
+}
+
+func deleteStorage(
+	t *testing.T,
+	router *gin.Engine,
+	storageID, workspaceID uuid.UUID,
+	token string,
+) {
+	test_utils.MakeDeleteRequest(
+		t,
+		router,
+		fmt.Sprintf("/api/v1/storages/%s", storageID.String()),
+		"Bearer "+token,
+		http.StatusOK,
+	)
 }

backend/internal/features/storages/di.go

@@ -1,16 +1,19 @@
 package storages
 
 import (
-	"postgresus-backend/internal/features/users"
+	audit_logs "postgresus-backend/internal/features/audit_logs"
+	workspaces_services "postgresus-backend/internal/features/workspaces/services"
 )
 
 var storageRepository = &StorageRepository{}
 var storageService = &StorageService{
 	storageRepository,
+	workspaces_services.GetWorkspaceService(),
+	audit_logs.GetAuditLogService(),
 }
 var storageController = &StorageController{
 	storageService,
-	users.GetUserService(),
+	workspaces_services.GetWorkspaceService(),
 }
 
 func GetStorageService() *StorageService {
@@ -20,3 +23,7 @@ func GetStorageService() *StorageService {
 func GetStorageController() *StorageController {
 	return storageController
 }
+
+func SetupDependencies() {
+	workspaces_services.GetWorkspaceService().AddWorkspaceDeletionListener(storageService)
+}

backend/internal/features/storages/model.go

@@ -14,7 +14,7 @@ import (
 
 type Storage struct {
 	ID            uuid.UUID   `json:"id"            gorm:"column:id;primaryKey;type:uuid;default:gen_random_uuid()"`
-	UserID        uuid.UUID   `json:"userId"        gorm:"column:user_id;not null;type:uuid;index"`
+	WorkspaceID   uuid.UUID   `json:"workspaceId"   gorm:"column:workspace_id;not null;type:uuid;index"`
 	Type          StorageType `json:"type"          gorm:"column:type;not null;type:text"`
 	Name          string      `json:"name"          gorm:"column:name;not null;type:text"`
 	LastSaveError *string     `json:"lastSaveError" gorm:"column:last_save_error;type:text"`

backend/internal/features/storages/models/s3/model.go

@@ -1,6 +1,7 @@
 package s3_storage
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"fmt"
@@ -129,7 +130,7 @@ func (s *S3Storage) TestConnection() error {
 		return err
 	}
 
-	// Create a context with 5 second timeout
+	// Create a context with 10 second timeout
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
@@ -147,6 +148,35 @@ func (s *S3Storage) TestConnection() error {
 		return fmt.Errorf("bucket '%s' does not exist", s.S3Bucket)
 	}
 
+	// Test write and delete permissions by uploading and removing a small test file
+	testFileID := uuid.New().String() + "-test"
+	testData := []byte("test connection")
+	testReader := bytes.NewReader(testData)
+
+	// Upload test file
+	_, err = client.PutObject(
+		ctx,
+		s.S3Bucket,
+		testFileID,
+		testReader,
+		int64(len(testData)),
+		minio.PutObjectOptions{},
+	)
+	if err != nil {
+		return fmt.Errorf("failed to upload test file to S3: %w", err)
+	}
+
+	// Delete test file
+	err = client.RemoveObject(
+		ctx,
+		s.S3Bucket,
+		testFileID,
+		minio.RemoveObjectOptions{},
+	)
+	if err != nil {
+		return fmt.Errorf("failed to delete test file from S3: %w", err)
+	}
+
 	return nil
 }
 

backend/internal/features/storages/repository.go

@@ -104,7 +104,7 @@ func (r *StorageRepository) FindByID(id uuid.UUID) (*Storage, error) {
 	return &s, nil
 }
 
-func (r *StorageRepository) FindByUserID(userID uuid.UUID) ([]*Storage, error) {
+func (r *StorageRepository) FindByWorkspaceID(workspaceID uuid.UUID) ([]*Storage, error) {
 	var storages []*Storage
 
 	if err := db.
@@ -113,7 +113,7 @@ func (r *StorageRepository) FindByUserID(userID uuid.UUID) ([]*Storage, error) {
 		Preload("S3Storage").
 		Preload("GoogleDriveStorage").
 		Preload("NASStorage").
-		Where("user_id = ?", userID).
+		Where("workspace_id = ?", workspaceID).
 		Order("name ASC").
 		Find(&storages).Error; err != nil {
 		return nil, err

backend/internal/features/storages/service.go

@@ -2,39 +2,70 @@ package storages
 
 import (
 	"errors"
+	"fmt"
+
+	audit_logs "postgresus-backend/internal/features/audit_logs"
 	users_models "postgresus-backend/internal/features/users/models"
+	workspaces_services "postgresus-backend/internal/features/workspaces/services"
 
 	"github.com/google/uuid"
 )
 
 type StorageService struct {
 	storageRepository *StorageRepository
+	workspaceService  *workspaces_services.WorkspaceService
+	auditLogService   *audit_logs.AuditLogService
 }
 
 func (s *StorageService) SaveStorage(
 	user *users_models.User,
+	workspaceID uuid.UUID,
 	storage *Storage,
 ) error {
-	if storage.ID != uuid.Nil {
+	canManage, err := s.workspaceService.CanUserManageDBs(workspaceID, user)
+	if err != nil {
+		return err
+	}
+	if !canManage {
+		return errors.New("insufficient permissions to manage storage in this workspace")
+	}
+
+	isUpdate := storage.ID != uuid.Nil
+
+	if isUpdate {
 		existingStorage, err := s.storageRepository.FindByID(storage.ID)
 		if err != nil {
 			return err
 		}
 
-		if existingStorage.UserID != user.ID {
-			return errors.New("you have not access to this storage")
+		if existingStorage.WorkspaceID != workspaceID {
+			return errors.New("storage does not belong to this workspace")
 		}
 
-		storage.UserID = existingStorage.UserID
+		storage.WorkspaceID = existingStorage.WorkspaceID
 	} else {
-		storage.UserID = user.ID
+		storage.WorkspaceID = workspaceID
 	}
 
-	_, err := s.storageRepository.Save(storage)
+	_, err = s.storageRepository.Save(storage)
 	if err != nil {
 		return err
 	}
 
+	if isUpdate {
+		s.auditLogService.WriteAuditLog(
+			fmt.Sprintf("Storage updated: %s", storage.Name),
+			&user.ID,
+			&workspaceID,
+		)
+	} else {
+		s.auditLogService.WriteAuditLog(
+			fmt.Sprintf("Storage created: %s", storage.Name),
+			&user.ID,
+			&workspaceID,
+		)
+	}
+
 	return nil
 }
 
@@ -47,11 +78,26 @@ func (s *StorageService) DeleteStorage(
 		return err
 	}
 
-	if storage.UserID != user.ID {
-		return errors.New("you have not access to this storage")
+	canManage, err := s.workspaceService.CanUserManageDBs(storage.WorkspaceID, user)
+	if err != nil {
+		return err
+	}
+	if !canManage {
+		return errors.New("insufficient permissions to manage storage in this workspace")
 	}
 
-	return s.storageRepository.Delete(storage)
+	err = s.storageRepository.Delete(storage)
+	if err != nil {
+		return err
+	}
+
+	s.auditLogService.WriteAuditLog(
+		fmt.Sprintf("Storage deleted: %s", storage.Name),
+		&user.ID,
+		&storage.WorkspaceID,
+	)
+
+	return nil
 }
 
 func (s *StorageService) GetStorage(
@@ -63,8 +109,12 @@ func (s *StorageService) GetStorage(
 		return nil, err
 	}
 
-	if storage.UserID != user.ID {
-		return nil, errors.New("you have not access to this storage")
+	canView, _, err := s.workspaceService.CanUserAccessWorkspace(storage.WorkspaceID, user)
+	if err != nil {
+		return nil, err
+	}
+	if !canView {
+		return nil, errors.New("insufficient permissions to view storage in this workspace")
 	}
 
 	return storage, nil
@@ -72,8 +122,17 @@ func (s *StorageService) GetStorage(
 
 func (s *StorageService) GetStorages(
 	user *users_models.User,
+	workspaceID uuid.UUID,
 ) ([]*Storage, error) {
-	return s.storageRepository.FindByUserID(user.ID)
+	canView, _, err := s.workspaceService.CanUserAccessWorkspace(workspaceID, user)
+	if err != nil {
+		return nil, err
+	}
+	if !canView {
+		return nil, errors.New("insufficient permissions to view storages in this workspace")
+	}
+
+	return s.storageRepository.FindByWorkspaceID(workspaceID)
 }
 
 func (s *StorageService) TestStorageConnection(
@@ -85,8 +144,12 @@ func (s *StorageService) TestStorageConnection(
 		return err
 	}
 
-	if storage.UserID != user.ID {
-		return errors.New("you have not access to this storage")
+	canView, _, err := s.workspaceService.CanUserAccessWorkspace(storage.WorkspaceID, user)
+	if err != nil {
+		return err
+	}
+	if !canView {
+		return errors.New("insufficient permissions to test storage in this workspace")
 	}
 
 	err = storage.TestConnection()
@@ -116,3 +179,18 @@ func (s *StorageService) GetStorageByID(
 ) (*Storage, error) {
 	return s.storageRepository.FindByID(id)
 }
+
+func (s *StorageService) OnBeforeWorkspaceDeletion(workspaceID uuid.UUID) error {
+	storages, err := s.storageRepository.FindByWorkspaceID(workspaceID)
+	if err != nil {
+		return fmt.Errorf("failed to get storages for workspace deletion: %w", err)
+	}
+
+	for _, storage := range storages {
+		if err := s.storageRepository.Delete(storage); err != nil {
+			return fmt.Errorf("failed to delete storage %s: %w", storage.ID, err)
+		}
+	}
+
+	return nil
+}

backend/internal/features/storages/testing.go

@@ -6,9 +6,9 @@ import (
 	"github.com/google/uuid"
 )
 
-func CreateTestStorage(userID uuid.UUID) *Storage {
+func CreateTestStorage(workspaceID uuid.UUID) *Storage {
 	storage := &Storage{
-		UserID:       userID,
+		WorkspaceID:  workspaceID,
 		Type:         StorageTypeLocal,
 		Name:         "Test Storage " + uuid.New().String(),
 		LocalStorage: &local_storage.LocalStorage{},

backend/internal/features/tests/postgresql_backup_restore_test.go

@@ -129,7 +129,7 @@ func testBackupRestoreForVersion(t *testing.T, pgVersion string, port string) {
 	}
 
 	storage := &storages.Storage{
-		UserID:       uuid.New(),
+		WorkspaceID:  uuid.New(),
 		Type:         storages.StorageTypeLocal,
 		Name:         "Test Storage",
 		LocalStorage: &local_storage.LocalStorage{},

backend/internal/features/users/controller.go

@@ -1,98 +0,0 @@
-package users
-
-import (
-	"net/http"
-
-	"github.com/gin-gonic/gin"
-	"golang.org/x/time/rate"
-)
-
-type UserController struct {
-	userService   *UserService
-	signinLimiter *rate.Limiter
-}
-
-func (c *UserController) RegisterRoutes(router *gin.RouterGroup) {
-	router.POST("/users/signup", c.SignUp)
-	router.POST("/users/signin", c.SignIn)
-	router.GET("/users/is-any-user-exist", c.IsAnyUserExist)
-}
-
-// SignUp
-// @Summary Register a new user
-// @Description Register a new user with email and password
-// @Tags users
-// @Accept json
-// @Produce json
-// @Param request body SignUpRequest true "User signup data"
-// @Success 200
-// @Failure 400
-// @Router /users/signup [post]
-func (c *UserController) SignUp(ctx *gin.Context) {
-	var request SignUpRequest
-	if err := ctx.ShouldBindJSON(&request); err != nil {
-		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request format"})
-		return
-	}
-
-	err := c.userService.SignUp(&request)
-	if err != nil {
-		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-
-	ctx.JSON(http.StatusOK, gin.H{"message": "User created successfully"})
-}
-
-// SignIn
-// @Summary Authenticate a user
-// @Description Authenticate a user with email and password
-// @Tags users
-// @Accept json
-// @Produce json
-// @Param request body SignInRequest true "User signin data"
-// @Success 200 {object} SignInResponse
-// @Failure 400
-// @Failure 429 {object} map[string]string "Rate limit exceeded"
-// @Router /users/signin [post]
-func (c *UserController) SignIn(ctx *gin.Context) {
-	// We use rate limiter to prevent brute force attacks
-	if !c.signinLimiter.Allow() {
-		ctx.JSON(
-			http.StatusTooManyRequests,
-			gin.H{"error": "Rate limit exceeded. Please try again later."},
-		)
-		return
-	}
-
-	var request SignInRequest
-	if err := ctx.ShouldBindJSON(&request); err != nil {
-		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request format"})
-		return
-	}
-
-	response, err := c.userService.SignIn(&request)
-	if err != nil {
-		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-
-	ctx.JSON(http.StatusOK, response)
-}
-
-// IsAnyUserExist
-// @Summary Check if any user exists
-// @Description Check if any user exists in the system
-// @Tags users
-// @Produce json
-// @Success 200 {object} map[string]bool
-// @Router /users/is-any-user-exist [get]
-func (c *UserController) IsAnyUserExist(ctx *gin.Context) {
-	isExist, err := c.userService.IsAnyUserExist()
-	if err != nil {
-		ctx.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
-		return
-	}
-
-	ctx.JSON(http.StatusOK, gin.H{"isExist": isExist})
-}

backend/internal/features/users/controllers/di.go

@@ -0,0 +1,32 @@
+package users_controllers
+
+import (
+	users_services "postgresus-backend/internal/features/users/services"
+
+	"golang.org/x/time/rate"
+)
+
+var userController = &UserController{
+	users_services.GetUserService(),
+	rate.NewLimiter(rate.Limit(3), 3), // 3 rps with 3 burst
+}
+
+var settingsController = &SettingsController{
+	users_services.GetSettingsService(),
+}
+
+var managementController = &ManagementController{
+	users_services.GetManagementService(),
+}
+
+func GetUserController() *UserController {
+	return userController
+}
+
+func GetSettingsController() *SettingsController {
+	return settingsController
+}
+
+func GetManagementController() *ManagementController {
+	return managementController
+}

backend/internal/features/users/controllers/e2e_test.go

@@ -0,0 +1,263 @@
+package users_controllers
+
+import (
+	"net/http"
+	"testing"
+
+	users_dto "postgresus-backend/internal/features/users/dto"
+	users_enums "postgresus-backend/internal/features/users/enums"
+	users_middleware "postgresus-backend/internal/features/users/middleware"
+	users_services "postgresus-backend/internal/features/users/services"
+	users_testing "postgresus-backend/internal/features/users/testing"
+	test_utils "postgresus-backend/internal/util/testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"golang.org/x/time/rate"
+)
+
+func Test_AdminLifecycleE2E_CompletesSuccessfully(t *testing.T) {
+	router := createE2ETestRouter()
+
+	users_testing.RecreateInitialAdmin()
+
+	// 1. Set initial admin password
+	adminPasswordRequest := users_dto.SetAdminPasswordRequestDTO{
+		Password: "adminpassword123",
+	}
+
+	test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/users/admin/set-password",
+		"",
+		adminPasswordRequest,
+		http.StatusOK,
+	)
+
+	// 2. Admin signs in
+	adminSigninRequest := users_dto.SignInRequestDTO{
+		Email:    "admin",
+		Password: "adminpassword123",
+	}
+
+	var adminSigninResponse users_dto.SignInResponseDTO
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/users/signin",
+		"",
+		adminSigninRequest,
+		http.StatusOK,
+		&adminSigninResponse,
+	)
+
+	// 3. Admin invites a user
+	workspaceID := uuid.New()
+	workspaceRole := users_enums.WorkspaceRoleMember
+	invitedUserEmail := "invited" + uuid.New().String() + "@example.com"
+	inviteRequest := users_dto.InviteUserRequestDTO{
+		Email:                 invitedUserEmail,
+		IntendedWorkspaceID:   &workspaceID,
+		IntendedWorkspaceRole: &workspaceRole,
+	}
+	test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/users/invite",
+		"Bearer "+adminSigninResponse.Token,
+		inviteRequest,
+		http.StatusOK,
+	)
+
+	// 4. Invited user signs up
+	userSignupRequest := users_dto.SignUpRequestDTO{
+		Email:    invitedUserEmail,
+		Password: "userpassword123",
+		Name:     "Invited User",
+	}
+	test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/users/signup",
+		"",
+		userSignupRequest,
+		http.StatusOK,
+	)
+
+	// 5. User signs in
+	userSigninRequest := users_dto.SignInRequestDTO{
+		Email:    invitedUserEmail,
+		Password: "userpassword123",
+	}
+
+	var userSigninResponse users_dto.SignInResponseDTO
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/users/signin",
+		"",
+		userSigninRequest,
+		http.StatusOK,
+		&userSigninResponse,
+	)
+
+	// 6. Admin lists users and sees new user
+	var listUsersResponse users_dto.ListUsersResponseDTO
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/users",
+		"Bearer "+adminSigninResponse.Token,
+		http.StatusOK,
+		&listUsersResponse,
+	)
+	assert.GreaterOrEqual(t, len(listUsersResponse.Users), 2) // Admin + new user
+}
+
+func Test_UserLifecycleE2E_CompletesSuccessfully(t *testing.T) {
+	router := createE2ETestRouter()
+	users_testing.ResetSettingsToDefaults()
+
+	// 1. User registers
+	userEmail := "testuser" + uuid.New().String() + "@example.com"
+	userSignupRequest := users_dto.SignUpRequestDTO{
+		Email:    userEmail,
+		Password: "userpassword123",
+		Name:     "Test User",
+	}
+
+	test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/users/signup",
+		"",
+		userSignupRequest,
+		http.StatusOK,
+	)
+
+	// 2. User signs in
+	userSigninRequest := users_dto.SignInRequestDTO{
+		Email:    userEmail,
+		Password: "userpassword123",
+	}
+
+	var signinResponse users_dto.SignInResponseDTO
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/users/signin",
+		"",
+		userSigninRequest,
+		http.StatusOK,
+		&signinResponse,
+	)
+	assert.NotEmpty(t, signinResponse.Token)
+	assert.NotEqual(t, uuid.Nil, signinResponse.UserID)
+
+	// 3. User gets own profile
+	var profileResponse users_dto.UserProfileResponseDTO
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/users/"+signinResponse.UserID.String(),
+		"Bearer "+signinResponse.Token,
+		http.StatusOK,
+		&profileResponse,
+	)
+	assert.Equal(t, signinResponse.UserID, profileResponse.ID)
+	assert.Equal(t, userEmail, profileResponse.Email)
+	assert.Equal(t, users_enums.UserRoleMember, profileResponse.Role)
+	assert.True(t, profileResponse.IsActive)
+}
+
+// Test router creation helpers
+func createUserTestRouter() *gin.Engine {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+
+	v1 := router.Group("/api/v1")
+
+	// Register public routes
+	GetUserController().RegisterRoutes(v1)
+
+	// Register protected routes with auth middleware
+	protected := v1.Group("").Use(users_middleware.AuthMiddleware(users_services.GetUserService()))
+	GetUserController().RegisterProtectedRoutes(protected.(*gin.RouterGroup))
+	GetUserController().SetSignInLimiter(rate.NewLimiter(rate.Limit(100), 100))
+
+	// Setup audit log service
+	users_services.GetUserService().SetAuditLogWriter(&AuditLogWriterStub{})
+
+	return router
+}
+
+func createSettingsTestRouter() *gin.Engine {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+
+	v1 := router.Group("/api/v1")
+
+	// Register protected routes with auth middleware
+	protected := v1.Group("").Use(users_middleware.AuthMiddleware(users_services.GetUserService()))
+	GetSettingsController().RegisterRoutes(protected.(*gin.RouterGroup))
+
+	// Setup audit log service
+	users_services.GetUserService().SetAuditLogWriter(&AuditLogWriterStub{})
+	users_services.GetSettingsService().SetAuditLogWriter(&AuditLogWriterStub{})
+	users_services.GetManagementService().SetAuditLogWriter(&AuditLogWriterStub{})
+
+	return router
+}
+
+func createManagementTestRouter() *gin.Engine {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+
+	v1 := router.Group("/api/v1")
+
+	// Register protected routes with auth middleware
+	protected := v1.Group("").Use(users_middleware.AuthMiddleware(users_services.GetUserService()))
+	GetManagementController().RegisterRoutes(protected.(*gin.RouterGroup))
+
+	// Setup audit log service
+	users_services.GetUserService().SetAuditLogWriter(&AuditLogWriterStub{})
+	users_services.GetSettingsService().SetAuditLogWriter(&AuditLogWriterStub{})
+	users_services.GetManagementService().SetAuditLogWriter(&AuditLogWriterStub{})
+
+	return router
+}
+
+func createE2ETestRouter() *gin.Engine {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+
+	v1 := router.Group("/api/v1")
+
+	// Register all routes
+	GetUserController().RegisterRoutes(v1)
+
+	// Register protected routes with auth middleware
+	protected := v1.Group("").Use(users_middleware.AuthMiddleware(users_services.GetUserService()))
+	GetUserController().RegisterProtectedRoutes(protected.(*gin.RouterGroup))
+	GetSettingsController().RegisterRoutes(protected.(*gin.RouterGroup))
+	GetManagementController().RegisterRoutes(protected.(*gin.RouterGroup))
+
+	// Setup audit log service
+	users_services.GetUserService().SetAuditLogWriter(&AuditLogWriterStub{})
+	users_services.GetSettingsService().SetAuditLogWriter(&AuditLogWriterStub{})
+	users_services.GetManagementService().SetAuditLogWriter(&AuditLogWriterStub{})
+
+	return router
+}
+
+type AuditLogWriterStub struct{}
+
+func (a *AuditLogWriterStub) WriteAuditLog(
+	message string,
+	userID *uuid.UUID,
+	workspaceID *uuid.UUID,
+) {
+	// do nothing
+}

backend/internal/features/users/controllers/management_controller.go

@@ -0,0 +1,260 @@
+package users_controllers
+
+import (
+	"fmt"
+	"net/http"
+
+	user_dto "postgresus-backend/internal/features/users/dto"
+	user_enums "postgresus-backend/internal/features/users/enums"
+	user_middleware "postgresus-backend/internal/features/users/middleware"
+	users_services "postgresus-backend/internal/features/users/services"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+type ManagementController struct {
+	managementService *users_services.UserManagementService
+}
+
+func (c *ManagementController) RegisterRoutes(router *gin.RouterGroup) {
+	router.GET("/users", user_middleware.RequireRole(user_enums.UserRoleAdmin), c.GetUsers)
+	router.GET("/users/:id", c.GetUserProfile)
+	router.POST(
+		"/users/:id/deactivate",
+		user_middleware.RequireRole(user_enums.UserRoleAdmin),
+		c.DeactivateUser,
+	)
+	router.POST(
+		"/users/:id/activate",
+		user_middleware.RequireRole(user_enums.UserRoleAdmin),
+		c.ActivateUser,
+	)
+	router.PUT(
+		"/users/:id/role",
+		user_middleware.RequireRole(user_enums.UserRoleAdmin),
+		c.ChangeUserRole,
+	)
+}
+
+// ListUsers
+// @Summary List users
+// @Description Get list of users (admin only)
+// @Tags user-management
+// @Produce json
+// @Security BearerAuth
+// @Param limit query int false "Number of items per page" default(20)
+// @Param offset query int false "Page offset" default(0)
+// @Param beforeDate query string false "Filter users created before this date (RFC3339 format)" format(date-time)
+// @Param query query string false "Search by email or name (case-insensitive)"
+// @Success 200 {object} users_dto.ListUsersResponseDTO
+// @Failure 401 {object} map[string]string "Unauthorized"
+// @Failure 403 {object} map[string]string "Forbidden"
+// @Router /users [get]
+func (c *ManagementController) GetUsers(ctx *gin.Context) {
+	fmt.Println("GetUsers")
+
+	user, ok := user_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	request := &user_dto.ListUsersRequestDTO{}
+	if err := ctx.ShouldBindQuery(request); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid query parameters"})
+		return
+	}
+
+	// Set defaults if not provided
+	if request.Limit <= 0 || request.Limit > 100 {
+		request.Limit = 20
+	}
+	if request.Offset < 0 {
+		request.Offset = 0
+	}
+
+	users, total, err := c.managementService.GetUsers(
+		user,
+		request.Limit,
+		request.Offset,
+		request.BeforeDate,
+		request.Query,
+	)
+	if err != nil {
+		ctx.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+		return
+	}
+
+	// Convert to response format
+	userProfiles := make([]user_dto.UserProfileResponseDTO, len(users))
+	for i, u := range users {
+		userProfiles[i] = user_dto.UserProfileResponseDTO{
+			ID:        u.ID,
+			Email:     u.Email,
+			Name:      u.Name,
+			Role:      u.Role,
+			IsActive:  u.IsActiveUser(),
+			CreatedAt: u.CreatedAt,
+		}
+	}
+
+	response := user_dto.ListUsersResponseDTO{
+		Users: userProfiles,
+		Total: total,
+	}
+
+	ctx.JSON(http.StatusOK, response)
+}
+
+// GetUserProfile
+// @Summary Get user profile
+// @Description Get user profile information (users can view own profile, admins can view any)
+// @Tags user-management
+// @Produce json
+// @Security BearerAuth
+// @Param id path string true "User ID"
+// @Success 200 {object} users_dto.UserProfileResponseDTO
+// @Failure 400 {object} map[string]string "Bad request"
+// @Failure 401 {object} map[string]string "Unauthorized"
+// @Failure 403 {object} map[string]string "Forbidden"
+// @Router /users/{id} [get]
+func (c *ManagementController) GetUserProfile(ctx *gin.Context) {
+	currentUser, ok := user_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	userIDStr := ctx.Param("id")
+	userID, err := uuid.Parse(userIDStr)
+	if err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid user ID"})
+		return
+	}
+
+	user, err := c.managementService.GetUserProfile(userID, currentUser)
+	if err != nil {
+		ctx.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+		return
+	}
+
+	profile := user_dto.UserProfileResponseDTO{
+		ID:        user.ID,
+		Email:     user.Email,
+		Name:      user.Name,
+		Role:      user.Role,
+		IsActive:  user.IsActiveUser(),
+		CreatedAt: user.CreatedAt,
+	}
+
+	ctx.JSON(http.StatusOK, profile)
+}
+
+// DeactivateUser
+// @Summary Deactivate user
+// @Description Deactivate a user account (admin only)
+// @Tags user-management
+// @Security BearerAuth
+// @Param id path string true "User ID"
+// @Success 200 {object} map[string]string
+// @Failure 400 {object} map[string]string "Bad request"
+// @Failure 401 {object} map[string]string "Unauthorized"
+// @Failure 403 {object} map[string]string "Forbidden"
+// @Router /users/{id}/deactivate [post]
+func (c *ManagementController) DeactivateUser(ctx *gin.Context) {
+	currentUser, ok := user_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	userIDStr := ctx.Param("id")
+	userID, err := uuid.Parse(userIDStr)
+	if err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid user ID"})
+		return
+	}
+
+	if err := c.managementService.DeactivateUser(userID, currentUser); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	ctx.JSON(http.StatusOK, gin.H{"message": "User deactivated successfully"})
+}
+
+// ActivateUser
+// @Summary Activate user
+// @Description Activate a user account (admin only)
+// @Tags user-management
+// @Security BearerAuth
+// @Param id path string true "User ID"
+// @Success 200 {object} map[string]string
+// @Failure 400 {object} map[string]string "Bad request"
+// @Failure 401 {object} map[string]string "Unauthorized"
+// @Failure 403 {object} map[string]string "Forbidden"
+// @Router /users/{id}/activate [post]
+func (c *ManagementController) ActivateUser(ctx *gin.Context) {
+	currentUser, ok := user_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	userIDStr := ctx.Param("id")
+	userID, err := uuid.Parse(userIDStr)
+	if err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid user ID"})
+		return
+	}
+
+	if err := c.managementService.ActivateUser(userID, currentUser); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	ctx.JSON(http.StatusOK, gin.H{"message": "User activated successfully"})
+}
+
+// ChangeUserRole
+// @Summary Change user role
+// @Description Change a user's role (admin only)
+// @Tags user-management
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param id path string true "User ID"
+// @Param request body users_dto.ChangeUserRoleRequestDTO true "Role change data"
+// @Success 200 {object} map[string]string
+// @Failure 400 {object} map[string]string "Bad request"
+// @Failure 401 {object} map[string]string "Unauthorized"
+// @Failure 403 {object} map[string]string "Forbidden"
+// @Router /users/{id}/role [put]
+func (c *ManagementController) ChangeUserRole(ctx *gin.Context) {
+	currentUser, ok := user_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	userIDStr := ctx.Param("id")
+	userID, err := uuid.Parse(userIDStr)
+	if err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid user ID"})
+		return
+	}
+
+	var request user_dto.ChangeUserRoleRequestDTO
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request format"})
+		return
+	}
+
+	if err := c.managementService.ChangeUserRole(userID, request.Role, currentUser); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	ctx.JSON(http.StatusOK, gin.H{"message": "User role changed successfully"})
+}

backend/internal/features/users/controllers/management_controller_test.go

@@ -0,0 +1,808 @@
+package users_controllers
+
+import (
+	"net/http"
+	"testing"
+	"time"
+
+	"postgresus-backend/internal/features/audit_logs"
+	users_dto "postgresus-backend/internal/features/users/dto"
+	users_enums "postgresus-backend/internal/features/users/enums"
+	users_middleware "postgresus-backend/internal/features/users/middleware"
+	users_services "postgresus-backend/internal/features/users/services"
+	users_testing "postgresus-backend/internal/features/users/testing"
+	workspaces_controllers "postgresus-backend/internal/features/workspaces/controllers"
+	workspaces_dto "postgresus-backend/internal/features/workspaces/dto"
+	workspaces_testing "postgresus-backend/internal/features/workspaces/testing"
+	test_utils "postgresus-backend/internal/util/testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_GetUsersList_WhenUserIsAdmin_ReturnsUsers(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create admin user and get token
+	testUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+
+	var response users_dto.ListUsersResponseDTO
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/users",
+		"Bearer "+testUser.Token,
+		http.StatusOK,
+		&response,
+	)
+
+	assert.NotNil(t, response.Users)
+	assert.GreaterOrEqual(t, response.Total, int64(1)) // At least the test user should exist
+}
+
+func Test_GetUsersList_WhenUserIsMember_ReturnsForbidden(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create member user and get token
+	testUser := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	resp := test_utils.MakeGetRequest(
+		t,
+		router,
+		"/api/v1/users",
+		"Bearer "+testUser.Token,
+		http.StatusForbidden,
+	)
+	assert.Contains(t, string(resp.Body), "permissions")
+}
+
+func Test_GetUsersList_WithPagination_RespectsLimits(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create admin user and get token
+	testUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+
+	var response users_dto.ListUsersResponseDTO
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/users?limit=5&offset=0",
+		"Bearer "+testUser.Token,
+		http.StatusOK,
+		&response,
+	)
+
+	assert.NotNil(t, response.Users)
+	assert.LessOrEqual(t, len(response.Users), 5) // Should respect limit
+}
+
+func Test_GetUsersList_WithBeforeDateFilter_ReturnsFilteredUsers(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create admin user and get token
+	testUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+
+	// Test with beforeDate filter
+	beforeDate := "2024-01-01T00:00:00Z"
+	var response users_dto.ListUsersResponseDTO
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/users?beforeDate="+beforeDate,
+		"Bearer "+testUser.Token,
+		http.StatusOK,
+		&response,
+	)
+
+	assert.NotNil(t, response.Users)
+	// All returned users should have been created before the specified date
+	for _, user := range response.Users {
+		assert.True(t, user.CreatedAt.Before(time.Date(2024, 1, 1, 0, 0, 0, 0, time.UTC)))
+	}
+}
+
+func Test_GetUsersList_WithInvalidDateFilter_ReturnsBadRequest(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create admin user and get token
+	testUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+
+	// Test with invalid date format
+	resp := test_utils.MakeGetRequest(
+		t,
+		router,
+		"/api/v1/users?beforeDate=invalid-date",
+		"Bearer "+testUser.Token,
+		http.StatusBadRequest,
+	)
+	assert.Contains(t, string(resp.Body), "Invalid query parameters")
+}
+
+func Test_GetUsersList_WithSearchQuery_ReturnsFilteredUsers(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create admin user and get token
+	adminUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+
+	// Create test users with specific emails and names
+	user1 := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	user2 := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	// Test searching by email (partial match)
+	emailPart := user1.Email[:5]
+	var emailResponse users_dto.ListUsersResponseDTO
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/users?query="+emailPart,
+		"Bearer "+adminUser.Token,
+		http.StatusOK,
+		&emailResponse,
+	)
+
+	assert.NotNil(t, emailResponse.Users)
+	found := false
+	for _, u := range emailResponse.Users {
+		if u.ID == user1.UserID {
+			found = true
+			break
+		}
+	}
+	assert.True(t, found, "Expected user1 to be in search results")
+
+	// Test case-insensitive search
+	upperEmailPart := user2.Email[:5]
+	var caseInsensitiveResponse users_dto.ListUsersResponseDTO
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/users?query="+upperEmailPart,
+		"Bearer "+adminUser.Token,
+		http.StatusOK,
+		&caseInsensitiveResponse,
+	)
+
+	assert.NotNil(t, caseInsensitiveResponse.Users)
+	found = false
+	for _, u := range caseInsensitiveResponse.Users {
+		if u.ID == user2.UserID {
+			found = true
+			break
+		}
+	}
+	assert.True(t, found, "Expected user2 to be in case-insensitive search results")
+
+	// Test searching by name
+	var nameResponse users_dto.ListUsersResponseDTO
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/users?query=Test",
+		"Bearer "+adminUser.Token,
+		http.StatusOK,
+		&nameResponse,
+	)
+
+	assert.NotNil(t, nameResponse.Users)
+	assert.GreaterOrEqual(t, len(nameResponse.Users), 1, "Should find users with 'Test' in name")
+}
+
+func Test_GetUsersList_WithoutAuth_ReturnsUnauthorized(t *testing.T) {
+	router := createManagementTestRouter()
+
+	test_utils.MakeGetRequest(t, router, "/api/v1/users", "", http.StatusUnauthorized)
+}
+
+func Test_GetUserProfile_WhenAccessingOwnProfile_ReturnsProfile(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create member user and get token
+	testUser := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	var response users_dto.UserProfileResponseDTO
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/users/"+testUser.UserID.String(),
+		"Bearer "+testUser.Token,
+		http.StatusOK,
+		&response,
+	)
+
+	assert.Equal(t, testUser.UserID, response.ID)
+	assert.Equal(t, users_enums.UserRoleMember, response.Role)
+}
+
+func Test_GetUserProfile_WhenUserIsAdmin_ReturnsProfile(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create both admin and regular user
+	adminUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+	regularUser := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	var response users_dto.UserProfileResponseDTO
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/users/"+regularUser.UserID.String(),
+		"Bearer "+adminUser.Token,
+		http.StatusOK,
+		&response,
+	)
+
+	assert.Equal(t, regularUser.UserID, response.ID)
+}
+
+func Test_GetUserProfile_WhenAccessingOtherUserAsMember_ReturnsForbidden(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create two member users
+	user1 := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	user2 := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	test_utils.MakeGetRequest(
+		t,
+		router,
+		"/api/v1/users/"+user2.UserID.String(),
+		"Bearer "+user1.Token,
+		http.StatusForbidden,
+	)
+}
+
+func Test_GetUserProfile_WithNonExistentUser_ReturnsForbidden(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create admin user and get token
+	testUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+
+	// Try to access non-existent user
+	test_utils.MakeGetRequest(
+		t,
+		router,
+		"/api/v1/users/00000000-0000-0000-0000-000000000000",
+		"Bearer "+testUser.Token,
+		http.StatusForbidden,
+	)
+}
+
+func Test_GetUserProfile_WithInvalidUserID_ReturnsBadRequest(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create admin user and get token
+	testUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+
+	resp := test_utils.MakeGetRequest(
+		t,
+		router,
+		"/api/v1/users/invalid-uuid",
+		"Bearer "+testUser.Token,
+		http.StatusBadRequest,
+	)
+	assert.Contains(t, string(resp.Body), "Invalid user ID")
+}
+
+func Test_DeactivateUser_WhenUserIsAdmin_UserDeactivated(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create admin and target user
+	adminUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+	targetUser := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	resp := test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/users/"+targetUser.UserID.String()+"/deactivate",
+		"Bearer "+adminUser.Token,
+		nil,
+		http.StatusOK,
+	)
+	assert.Contains(t, string(resp.Body), "User deactivated successfully")
+}
+
+func Test_DeactivateUser_WhenUserIsMember_ReturnsForbidden(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create two member users
+	user1 := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	user2 := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/users/"+user2.UserID.String()+"/deactivate",
+		"Bearer "+user1.Token,
+		nil,
+		http.StatusForbidden,
+	)
+}
+
+func Test_DeactivateUser_WhenDeactivatingOwnAccount_ReturnsBadRequest(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create admin user
+	adminUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+
+	resp := test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/users/"+adminUser.UserID.String()+"/deactivate",
+		"Bearer "+adminUser.Token,
+		nil,
+		http.StatusBadRequest,
+	)
+	assert.Contains(t, string(resp.Body), "cannot deactivate your own account")
+}
+
+func Test_ActivateUser_WhenUserIsAdmin_UserActivated(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create admin and target user
+	adminUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+	targetUser := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	// First deactivate the user
+	test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/users/"+targetUser.UserID.String()+"/deactivate",
+		"Bearer "+adminUser.Token,
+		nil,
+		http.StatusOK,
+	)
+
+	// Now activate the user
+	resp := test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/users/"+targetUser.UserID.String()+"/activate",
+		"Bearer "+adminUser.Token,
+		nil,
+		http.StatusOK,
+	)
+	assert.Contains(t, string(resp.Body), "User activated successfully")
+}
+
+func Test_ActivateUser_WhenUserIsMember_ReturnsForbidden(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create two member users
+	user1 := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	user2 := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/users/"+user2.UserID.String()+"/activate",
+		"Bearer "+user1.Token,
+		nil,
+		http.StatusForbidden,
+	)
+}
+
+func Test_ChangeUserRole_WhenUserIsRootAdmin_RoleChanged(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create root admin and target user
+	rootAdmin := users_testing.ReacreateInitAdminAndGetAccess()
+	targetUser := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	request := users_dto.ChangeUserRoleRequestDTO{
+		Role: users_enums.UserRoleAdmin,
+	}
+
+	resp := test_utils.MakePutRequest(
+		t,
+		router,
+		"/api/v1/users/"+targetUser.UserID.String()+"/role",
+		"Bearer "+rootAdmin.Token,
+		request,
+		http.StatusOK,
+	)
+	assert.Contains(t, string(resp.Body), "User role changed successfully")
+}
+
+func Test_ChangeUserRole_WhenUserIsMember_ReturnsForbidden(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create two member users
+	user1 := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	user2 := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	request := users_dto.ChangeUserRoleRequestDTO{
+		Role: users_enums.UserRoleAdmin,
+	}
+
+	test_utils.MakePutRequest(
+		t,
+		router,
+		"/api/v1/users/"+user2.UserID.String()+"/role",
+		"Bearer "+user1.Token,
+		request,
+		http.StatusForbidden,
+	)
+}
+
+func Test_ChangeUserRole_WhenChangingOwnRole_ReturnsBadRequest(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create admin user
+	adminUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+
+	request := users_dto.ChangeUserRoleRequestDTO{
+		Role: users_enums.UserRoleMember,
+	}
+
+	resp := test_utils.MakePutRequest(
+		t,
+		router,
+		"/api/v1/users/"+adminUser.UserID.String()+"/role",
+		"Bearer "+adminUser.Token,
+		request,
+		http.StatusBadRequest,
+	)
+	assert.Contains(t, string(resp.Body), "cannot change your own role")
+}
+
+func Test_ChangeUserRole_WithInvalidRole_ReturnsBadRequest(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create admin and target user
+	adminUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+	targetUser := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	// Test with invalid JSON structure containing invalid role
+	resp := test_utils.MakeRequest(t, router, test_utils.RequestOptions{
+		Method:         "PUT",
+		URL:            "/api/v1/users/" + targetUser.UserID.String() + "/role",
+		Body:           map[string]string{"role": "INVALID_ROLE"},
+		AuthToken:      "Bearer " + adminUser.Token,
+		ExpectedStatus: http.StatusBadRequest,
+	})
+
+	assert.NotEmpty(t, resp.Body)
+}
+
+func Test_ChangeUserRole_WithInvalidJSON_ReturnsBadRequest(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create admin and target user
+	adminUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+	targetUser := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	// Test with invalid JSON structure
+	resp := test_utils.MakeRequest(t, router, test_utils.RequestOptions{
+		Method:         "PUT",
+		URL:            "/api/v1/users/" + targetUser.UserID.String() + "/role",
+		Body:           "invalid json",
+		AuthToken:      "Bearer " + adminUser.Token,
+		ExpectedStatus: http.StatusBadRequest,
+	})
+
+	assert.Contains(t, string(resp.Body), "Invalid request format")
+}
+
+// Tests for root admin restrictions
+func Test_ChangeUserRole_WhenRegularAdminPromotesToAdmin_ReturnsBadRequest(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create regular admin and target user
+	regularAdmin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+	targetUser := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	request := users_dto.ChangeUserRoleRequestDTO{
+		Role: users_enums.UserRoleAdmin,
+	}
+
+	resp := test_utils.MakePutRequest(
+		t,
+		router,
+		"/api/v1/users/"+targetUser.UserID.String()+"/role",
+		"Bearer "+regularAdmin.Token,
+		request,
+		http.StatusBadRequest,
+	)
+	assert.Contains(
+		t,
+		string(resp.Body),
+		"only the root admin user can promote users to admin or demote admin users",
+	)
+}
+
+func Test_ChangeUserRole_WhenRegularAdminDemotesAdmin_ReturnsBadRequest(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create regular admin and admin target user
+	regularAdmin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+	adminTargetUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+
+	request := users_dto.ChangeUserRoleRequestDTO{
+		Role: users_enums.UserRoleMember,
+	}
+
+	resp := test_utils.MakePutRequest(
+		t,
+		router,
+		"/api/v1/users/"+adminTargetUser.UserID.String()+"/role",
+		"Bearer "+regularAdmin.Token,
+		request,
+		http.StatusBadRequest,
+	)
+	assert.Contains(
+		t,
+		string(resp.Body),
+		"only the root admin user can promote users to admin or demote admin users",
+	)
+}
+
+func Test_DeactivateUser_WhenRegularAdminDeactivatesAdmin_ReturnsBadRequest(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create regular admin and admin target user
+	regularAdmin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+	adminTargetUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+
+	resp := test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/users/"+adminTargetUser.UserID.String()+"/deactivate",
+		"Bearer "+regularAdmin.Token,
+		nil,
+		http.StatusBadRequest,
+	)
+	assert.Contains(t, string(resp.Body), "only the root admin user can deactivate admin accounts")
+}
+
+func Test_ActivateUser_WhenRegularAdminActivatesAdmin_ReturnsBadRequest(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create regular admin and admin target user
+	regularAdmin := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+	adminTargetUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+
+	resp := test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/users/"+adminTargetUser.UserID.String()+"/activate",
+		"Bearer "+regularAdmin.Token,
+		nil,
+		http.StatusBadRequest,
+	)
+	assert.Contains(t, string(resp.Body), "only the root admin user can activate admin accounts")
+}
+
+func Test_ChangeUserRole_WhenRootAdminPromotesToAdmin_RoleChanged(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create root admin and target user
+	rootAdmin := users_testing.ReacreateInitAdminAndGetAccess()
+	targetUser := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	request := users_dto.ChangeUserRoleRequestDTO{
+		Role: users_enums.UserRoleAdmin,
+	}
+
+	resp := test_utils.MakePutRequest(
+		t,
+		router,
+		"/api/v1/users/"+targetUser.UserID.String()+"/role",
+		"Bearer "+rootAdmin.Token,
+		request,
+		http.StatusOK,
+	)
+	assert.Contains(t, string(resp.Body), "User role changed successfully")
+}
+
+func Test_ChangeUserRole_WhenRootAdminDemotesAdmin_RoleChanged(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create root admin and admin target user
+	rootAdmin := users_testing.ReacreateInitAdminAndGetAccess()
+	adminTargetUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+
+	request := users_dto.ChangeUserRoleRequestDTO{
+		Role: users_enums.UserRoleMember,
+	}
+
+	resp := test_utils.MakePutRequest(
+		t,
+		router,
+		"/api/v1/users/"+adminTargetUser.UserID.String()+"/role",
+		"Bearer "+rootAdmin.Token,
+		request,
+		http.StatusOK,
+	)
+	assert.Contains(t, string(resp.Body), "User role changed successfully")
+}
+
+func Test_DeactivateUser_WhenRootAdminDeactivatesAdmin_UserDeactivated(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create root admin and admin target user
+	rootAdmin := users_testing.ReacreateInitAdminAndGetAccess()
+	adminTargetUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+
+	resp := test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/users/"+adminTargetUser.UserID.String()+"/deactivate",
+		"Bearer "+rootAdmin.Token,
+		nil,
+		http.StatusOK,
+	)
+	assert.Contains(t, string(resp.Body), "User deactivated successfully")
+}
+
+func Test_ActivateUser_WhenRootAdminActivatesAdmin_UserActivated(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create root admin and admin target user
+	rootAdmin := users_testing.ReacreateInitAdminAndGetAccess()
+	adminTargetUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+
+	// First deactivate the admin user
+	test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/users/"+adminTargetUser.UserID.String()+"/deactivate",
+		"Bearer "+rootAdmin.Token,
+		nil,
+		http.StatusOK,
+	)
+
+	// Now activate the admin user
+	resp := test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/users/"+adminTargetUser.UserID.String()+"/activate",
+		"Bearer "+rootAdmin.Token,
+		nil,
+		http.StatusOK,
+	)
+	assert.Contains(t, string(resp.Body), "User activated successfully")
+}
+
+func Test_ChangeUserRole_WhenRootAdminChangesOwnRole_ReturnsBadRequest(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create root admin
+	rootAdmin := users_testing.ReacreateInitAdminAndGetAccess()
+
+	request := users_dto.ChangeUserRoleRequestDTO{
+		Role: users_enums.UserRoleMember,
+	}
+
+	resp := test_utils.MakePutRequest(
+		t,
+		router,
+		"/api/v1/users/"+rootAdmin.UserID.String()+"/role",
+		"Bearer "+rootAdmin.Token,
+		request,
+		http.StatusBadRequest,
+	)
+	assert.Contains(t, string(resp.Body), "cannot change your own role")
+}
+
+func Test_DeactivateUser_WhenRootAdminDeactivatesOwnAccount_ReturnsBadRequest(t *testing.T) {
+	router := createManagementTestRouter()
+
+	// Create root admin
+	rootAdmin := users_testing.ReacreateInitAdminAndGetAccess()
+
+	resp := test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/users/"+rootAdmin.UserID.String()+"/deactivate",
+		"Bearer "+rootAdmin.Token,
+		nil,
+		http.StatusBadRequest,
+	)
+	assert.Contains(t, string(resp.Body), "cannot deactivate your own account")
+}
+
+func Test_InviteUserToWorkspace_MembershipReceivedAfterSignUp(t *testing.T) {
+	router := createInviteWorkspaceTestRouter()
+	users_testing.EnableMemberInvitations()
+	users_testing.EnableExternalRegistrations()
+	defer users_testing.ResetSettingsToDefaults()
+
+	// 1. Create workspace owner and workspace
+	owner := users_testing.CreateTestUser(users_enums.UserRoleMember)
+	workspace, _ := workspaces_testing.CreateTestWorkspaceViaAPI(
+		"Invite Test Workspace",
+		owner,
+		router,
+	)
+
+	// 2. Invite non-existing user to workspace
+	inviteEmail := "invited-" + uuid.New().String() + "@example.com"
+	inviteResponse := workspaces_testing.InviteMemberToWorkspace(
+		workspace,
+		inviteEmail,
+		users_enums.WorkspaceRoleMember,
+		owner.Token,
+		router,
+	)
+
+	assert.Equal(t, workspaces_dto.AddStatusInvited, inviteResponse.Status)
+
+	// 3. Sign up the invited user
+	signUpRequest := users_dto.SignUpRequestDTO{
+		Email:    inviteEmail,
+		Password: "testpassword123",
+		Name:     "Invited User",
+	}
+
+	resp := test_utils.MakePostRequest(
+		t,
+		router,
+		"/api/v1/users/signup",
+		"",
+		signUpRequest,
+		http.StatusOK,
+	)
+	assert.Contains(t, string(resp.Body), "User created successfully")
+
+	// 4. Sign in the newly registered user
+	signInRequest := users_dto.SignInRequestDTO{
+		Email:    inviteEmail,
+		Password: "testpassword123",
+	}
+
+	var signInResponse users_dto.SignInResponseDTO
+	test_utils.MakePostRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/users/signin",
+		"",
+		signInRequest,
+		http.StatusOK,
+		&signInResponse,
+	)
+
+	// 5. Verify user is automatically added as member to workspace
+	var membersResponse workspaces_dto.GetMembersResponseDTO
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/workspaces/memberships/"+workspace.ID.String()+"/members",
+		"Bearer "+signInResponse.Token,
+		http.StatusOK,
+		&membersResponse,
+	)
+
+	var foundMember *workspaces_dto.WorkspaceMemberResponseDTO
+	for _, member := range membersResponse.Members {
+		if member.UserID == signInResponse.UserID {
+			foundMember = &member
+			break
+		}
+	}
+
+	assert.NotNil(
+		t,
+		foundMember,
+		"Invited user should be automatically added as workspace member after sign up",
+	)
+	assert.Equal(t, users_enums.WorkspaceRoleMember, foundMember.Role)
+	assert.Equal(t, inviteEmail, foundMember.Email)
+}
+
+func createInviteWorkspaceTestRouter() *gin.Engine {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+
+	v1 := router.Group("/api/v1")
+
+	GetUserController().RegisterRoutes(v1)
+
+	protected := v1.Group("").Use(users_middleware.AuthMiddleware(users_services.GetUserService()))
+
+	GetManagementController().RegisterRoutes(protected.(*gin.RouterGroup))
+	GetUserController().RegisterProtectedRoutes(protected.(*gin.RouterGroup))
+	workspaces_controllers.GetWorkspaceController().RegisterRoutes(protected.(*gin.RouterGroup))
+	workspaces_controllers.GetMembershipController().RegisterRoutes(protected.(*gin.RouterGroup))
+	audit_logs.SetupDependencies()
+
+	return router
+}

backend/internal/features/users/controllers/settings_controller.go

@@ -0,0 +1,81 @@
+package users_controllers
+
+import (
+	"net/http"
+
+	user_enums "postgresus-backend/internal/features/users/enums"
+	user_middleware "postgresus-backend/internal/features/users/middleware"
+	user_models "postgresus-backend/internal/features/users/models"
+	users_services "postgresus-backend/internal/features/users/services"
+
+	"github.com/gin-gonic/gin"
+)
+
+type SettingsController struct {
+	settingsService *users_services.SettingsService
+}
+
+func (c *SettingsController) RegisterRoutes(router *gin.RouterGroup) {
+	router.GET("/users/settings", c.GetUsersSettings)
+	router.PUT(
+		"/users/settings",
+		user_middleware.RequireRole(user_enums.UserRoleAdmin),
+		c.UpdateUsersSettings,
+	)
+}
+
+// GetUsersSettings
+// @Summary Get users settings
+// @Description Get global users settings (admin only)
+// @Tags settings
+// @Produce json
+// @Security BearerAuth
+// @Success 200 {object} users_models.UsersSettings
+// @Failure 401 {object} map[string]string "Unauthorized"
+// @Failure 403 {object} map[string]string "Forbidden"
+// @Failure 500 {object} map[string]string "Internal server error"
+// @Router /users/settings [get]
+func (c *SettingsController) GetUsersSettings(ctx *gin.Context) {
+	settings, err := c.settingsService.GetSettings()
+	if err != nil {
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get settings"})
+		return
+	}
+
+	ctx.JSON(http.StatusOK, settings)
+}
+
+// UpdateUsersSettings
+// @Summary Update users settings
+// @Description Update global users settings (admin only)
+// @Tags settings
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param request body users_models.UsersSettings true "Settings update data"
+// @Success 200 {object} users_models.UsersSettings
+// @Failure 400 {object} map[string]string "Bad request"
+// @Failure 401 {object} map[string]string "Unauthorized"
+// @Failure 403 {object} map[string]string "Forbidden"
+// @Router /users/settings [put]
+func (c *SettingsController) UpdateUsersSettings(ctx *gin.Context) {
+	user, ok := user_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	var request user_models.UsersSettings
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request format"})
+		return
+	}
+
+	settings, err := c.settingsService.UpdateSettings(request, user)
+	if err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	ctx.JSON(http.StatusOK, settings)
+}

backend/internal/features/users/controllers/settings_controller_test.go

@@ -0,0 +1,182 @@
+package users_controllers
+
+import (
+	"net/http"
+	"testing"
+
+	users_enums "postgresus-backend/internal/features/users/enums"
+	users_models "postgresus-backend/internal/features/users/models"
+	users_testing "postgresus-backend/internal/features/users/testing"
+	test_utils "postgresus-backend/internal/util/testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_GetUserSettings_WhenUserIsAdmin_ReturnsSettings(t *testing.T) {
+	users_testing.ResetSettingsToDefaults()
+	router := createSettingsTestRouter()
+
+	// Create admin user and get token
+	testUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+
+	var response users_models.UsersSettings
+	test_utils.MakeGetRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/users/settings",
+		"Bearer "+testUser.Token,
+		http.StatusOK,
+		&response,
+	)
+
+	// Default settings should be true for all
+	assert.True(t, response.IsAllowExternalRegistrations)
+	assert.True(t, response.IsAllowMemberInvitations)
+	assert.True(t, response.IsMemberAllowedToCreateWorkspaces)
+}
+
+func Test_GetUserSettings_WhenUserIsMember_ReturnsSettings(t *testing.T) {
+	users_testing.ResetSettingsToDefaults()
+	router := createSettingsTestRouter()
+
+	// Create member user and get token
+	testUser := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	_ = test_utils.MakeGetRequest(
+		t,
+		router,
+		"/api/v1/users/settings",
+		"Bearer "+testUser.Token,
+		http.StatusOK,
+	)
+}
+
+func Test_GetUserSettings_WithoutAuth_ReturnsUnauthorized(t *testing.T) {
+	users_testing.ResetSettingsToDefaults()
+	router := createSettingsTestRouter()
+
+	test_utils.MakeGetRequest(t, router, "/api/v1/users/settings", "", http.StatusUnauthorized)
+}
+
+func Test_UpdateUserSettings_WhenUserIsAdmin_SettingsUpdated(t *testing.T) {
+	users_testing.ResetSettingsToDefaults()
+	router := createSettingsTestRouter()
+
+	// Create admin user and get token
+	testUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+
+	// Update some settings
+	request := users_models.UsersSettings{
+		IsAllowExternalRegistrations:      false,
+		IsAllowMemberInvitations:          true,
+		IsMemberAllowedToCreateWorkspaces: false,
+	}
+
+	var response users_models.UsersSettings
+	test_utils.MakePutRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/users/settings",
+		"Bearer "+testUser.Token,
+		request,
+		http.StatusOK,
+		&response,
+	)
+
+	// Check that settings were updated
+	assert.False(t, response.IsAllowExternalRegistrations)
+	assert.True(t, response.IsAllowMemberInvitations)
+	assert.False(t, response.IsMemberAllowedToCreateWorkspaces)
+}
+
+func Test_UpdateUserSettings_WithPartialData_SettingsUpdated(t *testing.T) {
+	users_testing.ResetSettingsToDefaults()
+	router := createSettingsTestRouter()
+
+	// Create admin user and get token
+	testUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+
+	// Update only one setting
+	request := users_models.UsersSettings{
+		IsAllowExternalRegistrations: false,
+		// Other fields will use default values
+		IsAllowMemberInvitations:          true,
+		IsMemberAllowedToCreateWorkspaces: true,
+	}
+
+	var response users_models.UsersSettings
+	test_utils.MakePutRequestAndUnmarshal(
+		t,
+		router,
+		"/api/v1/users/settings",
+		"Bearer "+testUser.Token,
+		request,
+		http.StatusOK,
+		&response,
+	)
+
+	// Check that only the specified setting was updated
+	assert.False(t, response.IsAllowExternalRegistrations)
+	// These should remain true (default values)
+	assert.True(t, response.IsAllowMemberInvitations)
+	assert.True(t, response.IsMemberAllowedToCreateWorkspaces)
+}
+
+func Test_UpdateUserSettings_WhenUserIsMember_ReturnsForbidden(t *testing.T) {
+	users_testing.ResetSettingsToDefaults()
+	router := createSettingsTestRouter()
+
+	// Create member user and get token
+	testUser := users_testing.CreateTestUser(users_enums.UserRoleMember)
+
+	request := users_models.UsersSettings{
+		IsAllowExternalRegistrations: false,
+	}
+
+	resp := test_utils.MakePutRequest(
+		t,
+		router,
+		"/api/v1/users/settings",
+		"Bearer "+testUser.Token,
+		request,
+		http.StatusForbidden,
+	)
+	assert.Contains(t, string(resp.Body), "Insufficient permissions")
+}
+
+func Test_UpdateUserSettings_WithInvalidJSON_ReturnsBadRequest(t *testing.T) {
+	users_testing.ResetSettingsToDefaults()
+	router := createSettingsTestRouter()
+
+	// Create admin user and get token
+	testUser := users_testing.CreateTestUser(users_enums.UserRoleAdmin)
+
+	// Test with invalid JSON structure
+	resp := test_utils.MakeRequest(t, router, test_utils.RequestOptions{
+		Method:         "PUT",
+		URL:            "/api/v1/users/settings",
+		Body:           "invalid json",
+		AuthToken:      "Bearer " + testUser.Token,
+		ExpectedStatus: http.StatusBadRequest,
+	})
+
+	assert.Contains(t, string(resp.Body), "Invalid request format")
+}
+
+func Test_UpdateUserSettings_WithoutAuth_ReturnsUnauthorized(t *testing.T) {
+	users_testing.ResetSettingsToDefaults()
+	router := createSettingsTestRouter()
+
+	request := users_models.UsersSettings{
+		IsAllowExternalRegistrations: false,
+	}
+
+	test_utils.MakePutRequest(
+		t,
+		router,
+		"/api/v1/users/settings",
+		"",
+		request,
+		http.StatusUnauthorized,
+	)
+}

backend/internal/features/users/controllers/user_controller.go

@@ -0,0 +1,343 @@
+package users_controllers
+
+import (
+	"net/http"
+
+	"postgresus-backend/internal/config"
+	user_dto "postgresus-backend/internal/features/users/dto"
+	user_middleware "postgresus-backend/internal/features/users/middleware"
+	users_services "postgresus-backend/internal/features/users/services"
+
+	"github.com/gin-gonic/gin"
+	"golang.org/x/time/rate"
+)
+
+type UserController struct {
+	userService   *users_services.UserService
+	signinLimiter *rate.Limiter
+}
+
+func (c *UserController) RegisterRoutes(router *gin.RouterGroup) {
+	router.POST("/users/signup", c.SignUp)
+	router.POST("/users/signin", c.SignIn)
+
+	// Admin password setup (no auth required)
+	router.GET("/users/admin/has-password", c.IsAdminHasPassword)
+	router.POST("/users/admin/set-password", c.SetAdminPassword)
+
+	// OAuth callbacks
+	router.POST("/auth/github/callback", c.HandleGitHubOAuth)
+	router.POST("/auth/google/callback", c.HandleGoogleOAuth)
+}
+
+func (c *UserController) RegisterProtectedRoutes(router *gin.RouterGroup) {
+	router.GET("/users/me", c.GetCurrentUser)
+	router.PUT("/users/me", c.UpdateUserInfo)
+	router.PUT("/users/change-password", c.ChangePassword)
+	router.POST("/users/invite", c.InviteUser)
+}
+
+func (c *UserController) SetSignInLimiter(limiter *rate.Limiter) {
+	c.signinLimiter = limiter
+}
+
+// SignUp
+// @Summary Register a new user
+// @Description Register a new user with email and password
+// @Tags users
+// @Accept json
+// @Produce json
+// @Param request body users_dto.SignUpRequestDTO true "User signup data"
+// @Success 200
+// @Failure 400
+// @Router /users/signup [post]
+func (c *UserController) SignUp(ctx *gin.Context) {
+	var request user_dto.SignUpRequestDTO
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request format"})
+		return
+	}
+
+	err := c.userService.SignUp(&request)
+	if err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	ctx.JSON(http.StatusOK, gin.H{"message": "User created successfully"})
+}
+
+// SignIn
+// @Summary Authenticate a user
+// @Description Authenticate a user with email and password
+// @Tags users
+// @Accept json
+// @Produce json
+// @Param request body users_dto.SignInRequestDTO true "User signin data"
+// @Success 200 {object} users_dto.SignInResponseDTO
+// @Failure 400
+// @Failure 429 {object} map[string]string "Rate limit exceeded"
+// @Router /users/signin [post]
+func (c *UserController) SignIn(ctx *gin.Context) {
+	// We use rate limiter to prevent brute force attacks
+	if !c.signinLimiter.Allow() {
+		ctx.JSON(
+			http.StatusTooManyRequests,
+			gin.H{"error": "Rate limit exceeded. Please try again later."},
+		)
+		return
+	}
+
+	var request user_dto.SignInRequestDTO
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request format"})
+		return
+	}
+
+	response, err := c.userService.SignIn(&request)
+	if err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	ctx.JSON(http.StatusOK, response)
+}
+
+// Admin password endpoints
+func (c *UserController) IsAdminHasPassword(ctx *gin.Context) {
+	hasPassword, err := c.userService.IsRootAdminHasPassword()
+	if err != nil {
+		ctx.JSON(
+			http.StatusInternalServerError,
+			gin.H{"error": err.Error()},
+		)
+		return
+	}
+
+	ctx.JSON(http.StatusOK, user_dto.IsAdminHasPasswordResponseDTO{HasPassword: hasPassword})
+}
+
+func (c *UserController) SetAdminPassword(ctx *gin.Context) {
+	var request user_dto.SetAdminPasswordRequestDTO
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	if err := c.userService.SetRootAdminPassword(request.Password); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	ctx.JSON(http.StatusOK, gin.H{"message": "Admin password set successfully"})
+}
+
+// ChangePassword
+// @Summary Change user password
+// @Description Change the password for the currently authenticated user
+// @Tags users
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param request body users_dto.ChangePasswordRequestDTO true "New password data"
+// @Success 200 {object} map[string]string
+// @Failure 400 {object} map[string]string
+// @Failure 401 {object} map[string]string
+// @Router /users/change-password [put]
+func (c *UserController) ChangePassword(ctx *gin.Context) {
+	user, ok := user_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	var request user_dto.ChangePasswordRequestDTO
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request format"})
+		return
+	}
+
+	if request.NewPassword == "" {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "New password is required"})
+		return
+	}
+
+	if len(request.NewPassword) < 8 {
+		ctx.JSON(
+			http.StatusBadRequest,
+			gin.H{"error": "New password must be at least 8 characters long"},
+		)
+		return
+	}
+
+	if err := c.userService.ChangeUserPassword(user.ID, request.NewPassword); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	ctx.JSON(http.StatusOK, gin.H{"message": "Password changed successfully"})
+}
+
+// InviteUser
+// @Summary Invite a new user
+// @Description Invite a new user to the system with optional workspace assignment
+// @Tags users
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param request body users_dto.InviteUserRequestDTO true "User invitation data"
+// @Success 200 {object} users_dto.InviteUserResponseDTO
+// @Failure 400 {object} map[string]string
+// @Failure 401 {object} map[string]string
+// @Failure 403 {object} map[string]string
+// @Router /users/invite [post]
+func (c *UserController) InviteUser(ctx *gin.Context) {
+	user, ok := user_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	var request user_dto.InviteUserRequestDTO
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request format"})
+		return
+	}
+
+	response, err := c.userService.InviteUser(&request, user)
+	if err != nil {
+		if err.Error() == "insufficient permissions to invite users" {
+			ctx.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+			return
+		}
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	ctx.JSON(http.StatusOK, response)
+}
+
+// GetCurrentUser
+// @Summary Get current user profile
+// @Description Get the profile information of the currently authenticated user
+// @Tags users
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Success 200 {object} users_dto.UserProfileResponseDTO
+// @Failure 401 {object} map[string]string
+// @Router /users/me [get]
+func (c *UserController) GetCurrentUser(ctx *gin.Context) {
+	user, ok := user_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	profile := c.userService.GetCurrentUserProfile(user)
+	ctx.JSON(http.StatusOK, profile)
+}
+
+// UpdateUserInfo
+// @Summary Update current user information
+// @Description Update name and/or email for the currently authenticated user
+// @Tags users
+// @Accept json
+// @Produce json
+// @Security BearerAuth
+// @Param request body users_dto.UpdateUserInfoRequestDTO true "User info update data"
+// @Success 200 {object} map[string]string
+// @Failure 400 {object} map[string]string
+// @Failure 401 {object} map[string]string
+// @Router /users/me [put]
+func (c *UserController) UpdateUserInfo(ctx *gin.Context) {
+	user, ok := user_middleware.GetUserFromContext(ctx)
+	if !ok {
+		ctx.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return
+	}
+
+	var request user_dto.UpdateUserInfoRequestDTO
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request format"})
+		return
+	}
+
+	if request.Name == nil && request.Email == nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "No fields to update"})
+		return
+	}
+
+	if err := c.userService.UpdateUserInfo(user.ID, &request); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	ctx.JSON(http.StatusOK, gin.H{"message": "User info updated successfully"})
+}
+
+// HandleGitHubOAuth
+// @Summary Handle GitHub OAuth callback
+// @Description Exchange GitHub authorization code for JWT token
+// @Tags auth
+// @Accept json
+// @Produce json
+// @Param request body users_dto.OAuthCallbackRequestDTO true "OAuth callback data"
+// @Success 200 {object} users_dto.OAuthCallbackResponseDTO
+// @Failure 400 {object} map[string]string
+// @Failure 501 {object} map[string]string
+// @Router /auth/github/callback [post]
+func (c *UserController) HandleGitHubOAuth(ctx *gin.Context) {
+	env := config.GetEnv()
+	if env.GitHubClientID == "" || env.GitHubClientSecret == "" {
+		ctx.JSON(http.StatusNotImplemented, gin.H{"error": "GitHub OAuth is not configured"})
+		return
+	}
+
+	var request user_dto.OAuthCallbackRequestDTO
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request format"})
+		return
+	}
+
+	response, err := c.userService.HandleGitHubOAuth(request.Code, request.RedirectUri)
+	if err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	ctx.JSON(http.StatusOK, response)
+}
+
+// HandleGoogleOAuth
+// @Summary Handle Google OAuth callback
+// @Description Exchange Google authorization code for JWT token
+// @Tags auth
+// @Accept json
+// @Produce json
+// @Param request body users_dto.OAuthCallbackRequestDTO true "OAuth callback data"
+// @Success 200 {object} users_dto.OAuthCallbackResponseDTO
+// @Failure 400 {object} map[string]string
+// @Failure 501 {object} map[string]string
+// @Router /auth/google/callback [post]
+func (c *UserController) HandleGoogleOAuth(ctx *gin.Context) {
+	env := config.GetEnv()
+	if env.GoogleClientID == "" || env.GoogleClientSecret == "" {
+		ctx.JSON(http.StatusNotImplemented, gin.H{"error": "Google OAuth is not configured"})
+		return
+	}
+
+	var request user_dto.OAuthCallbackRequestDTO
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request format"})
+		return
+	}
+
+	response, err := c.userService.HandleGoogleOAuth(request.Code, request.RedirectUri)
+	if err != nil {
+		ctx.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	ctx.JSON(http.StatusOK, response)
+}