fix

spacebar
persistence
2025-11-02 15:56:12 +01:00 · 2025-11-02 15:44:09 +01:00 · 2025-11-02 15:34:26 +01:00 · 2025-11-02 15:20:41 +01:00 · 2025-11-02 15:03:23 +01:00 · 2025-11-02 14:27:13 +01:00
164 changed files with 33182 additions and 13237 deletions
@@ -5,6 +5,7 @@ on:
    branches:
      - main
      - staging
+      - dev
  tags:
    - '*'

@@ -27,13 +28,52 @@ jobs:
        with:
          submodules: recursive

-      - name: Login to Docker Registry
+      - name: Derive repository metadata
+        id: repo_meta
+        run: |
+          repo="${GITHUB_REPOSITORY:-$GITEA_REPOSITORY}"
+          owner="${repo%%/*}"
+          name="${repo##*/}"
+          echo "repo_owner=$owner" >> "$GITHUB_OUTPUT"
+          echo "repo_name=$name" >> "$GITHUB_OUTPUT"
+
+      - name: Compute base tag
+        id: compute_tag
+        run: |
+          sha="${GITHUB_SHA:-$GITEA_SHA}"
+          ref_type="${GITHUB_REF_TYPE:-$GITEA_REF_TYPE}"
+          ref_name="${GITHUB_REF_NAME:-$GITEA_REF_NAME}"
+
+          if [ -z "$sha" ]; then
+            echo "base_tag=$ref_name" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          short="${sha:0:7}"
+          tag="$short"
+
+          if [ "$ref_type" = "tag" ]; then
+            tag="$ref_name"
+          elif [ "$ref_name" = "dev" ]; then
+            tag="${tag}-dev"
+          fi
+
+          echo "base_tag=$tag" >> "$GITHUB_OUTPUT"
+
+      - name: Login to local registry
        uses: docker/login-action@v2
        with:
          registry: ${{ vars.REGISTRY_URL }}
          username: ${{ vars.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_PASSWORD }}

+      - name: Login to GHCR
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ vars.GHCR_USERNAME }}
+          password: ${{ secrets.GHCR_PASSWORD }}
+
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
@@ -49,5 +89,7 @@ jobs:
          push: true
          provenance: false
          tags: |
-            ${{ vars.REGISTRY_URL }}/${{ gitea.repository }}-${{ matrix.service }}:${{ gitea.ref_type == 'tag' && gitea.ref_name || (gitea.ref_name == 'main' && 'latest' || gitea.ref_name) }}
-            ${{ vars.REGISTRY_URL }}/${{ gitea.repository }}-${{ matrix.service }}:${{ gitea.sha }}
+            ${{ vars.REGISTRY_URL }}/${{ steps.repo_meta.outputs.repo_name }}-${{ matrix.service }}:${{ steps.compute_tag.outputs.base_tag }}
+            ${{ vars.REGISTRY_URL }}/${{ steps.repo_meta.outputs.repo_name }}-${{ matrix.service }}:${{ gitea.sha }}
+            ghcr.io/paperless-dms/${{ steps.repo_meta.outputs.repo_name }}-${{ matrix.service }}:${{ steps.compute_tag.outputs.base_tag }}
+            ghcr.io/paperless-dms/${{ steps.repo_meta.outputs.repo_name }}-${{ matrix.service }}:${{ gitea.sha }}
@@ -0,0 +1,104 @@
+# Development
+
+This document collects runtime assumptions and workflows for local development,
+integration testing, and infrastructure automation.
+
+## Local Development
+
+Use the provided `papercrate.tmux` to spin up the full stack in one tmux session:
+
+```bash
+tmux -f papercrate.tmux attach
+```
+
+This creates windows for the compose stack, frontend dev server, backend API, and
+background worker using the repository-relative paths defined in the tmux file.
+Detach with `Ctrl+b d` and reattach later with the same command.
+
+The development Postgres container now seeds two database roles:
+
+- `papercrate_app_login` (password `papercrate_app`) is used by the backend and
+  is subject to row-level security policies.
+- `papercrate` remains the owner role for running Diesel migrations or other
+  maintenance tasks.
+
+When connecting manually to inspect RLS behaviour, switch to the application
+role with `SET ROLE papercrate_app_login;` before querying tenant tables.
+
+## Backend Integration Tests
+
+Integration tests require a running Postgres instance (and, optionally, Quickwit
+for OCR indexing). The repository includes a lightweight compose file for local
+runs:
+
+```bash
+docker compose -f docker-compose.test.yml up -d
+export TEST_DATABASE_URL=postgres://papercrate:papercrate_test@localhost:5433/papercrate_test
+# optional, enables Quickwit indexing jobs
+export QUICKWIT_ENDPOINT=http://localhost:7280
+export QUICKWIT_INDEX=documents
+cargo test
+```
+
+Stop the database when you are done:
+
+```bash
+docker compose -f docker-compose.test.yml down
+```
+
+The compose service uses tmpfs storage, giving each test run a clean database.
+
+## Runtime Dependencies
+
+- `ocrmypdf` (optional but recommended): Used by the OCR worker to extract text
+  from PDFs when no embedded text layer is available. Ensure it is installed and
+  available on the worker hosts if OCR is desired.
+- Quickwit (optional): The Quickwit indexer is used to ingest extracted text for
+  search. Set `QUICKWIT_ENDPOINT` and `QUICKWIT_INDEX` in the environment when
+  running workers if you want indexing jobs to run. The local compose file starts
+  a Quickwit instance on `http://localhost:7280` and seeds the `documents` index
+  automatically.
+
+## Configuration
+
+The backend reads its settings from environment variables. In particular:
+
+- `DATABASE_URL` – connection string for the primary Postgres database (required).
+- `DATABASE_MAX_POOL_SIZE` – optional override for the r2d2 connection pool size.
+  Defaults to `2`; increase it in staging/production to match expected concurrency.
+
+On startup each binary logs the effective configuration with secrets redacted
+(for example, the database password is masked). This makes it easier to confirm
+runtime settings in staging without exposing credentials.
+
+## Running Migrations in Kubernetes
+
+The backend container image ships the `diesel` CLI, so schema migrations can be
+executed as a short-lived Job (or Helm hook) before rolling out new pods. Example
+manifest:
+
+```yaml
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: papercrate-migrate
+spec:
+  template:
+    spec:
+      restartPolicy: OnFailure
+      containers:
+        - name: migrate
+          image: ghcr.io/example/papercrate-backend:<TAG>
+          command: ["/usr/local/bin/diesel", "migration", "run"]
+          env:
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: papercrate-db
+                  key: DATABASE_URL
+```
+
+Run the Job manually (`kubectl apply -f migrate-job.yaml`) or configure it as a
+Helm pre-install/pre-upgrade hook so migrations run automatically on each
+deployment. Once the Job succeeds, deploy/update the backend `Deployment` as
+usual.
@@ -1,73 +1,48 @@
 # Papercrate

-## Local Development
+![Papercrate document workspace](docs/screenshot.png)

-Use the provided `papercrate.tmux` to spin up the full stack in one tmux session:
+## Single-Host Deployment (Docker Compose)
+
+For self-hosting (for example on a Raspberry Pi), use the production-oriented
+`docker-compose.yml`. Define the required secrets in a `.env` file alongside the
+compose file before starting the stack:

 ```bash
-tmux -f papercrate.tmux attach
+cat <<'EOF' > .env
+POSTGRES_PASSWORD=change-me
+MINIO_ROOT_PASSWORD=change-me-too
+JWT_SECRET=generate-a-long-random-string
+WEBAUTHN_RP_ID=papercrate.local
+WEBAUTHN_ORIGIN=http://papercrate.local:8080
+# Optional overrides
+# CORS_ALLOWED_ORIGIN=http://papercrate.local:8080
+# REFRESH_COOKIE_SECURE=true
+EOF
+
+docker compose build
+docker compose up -d
 ```

-This creates windows for the compose stack, frontend dev server, backend API, and background worker using the repository-relative paths defined in the tmux file. Detach with `Ctrl+b d` and reattach later with the same command.
+**Important:** the WebAuthn settings must match the public URL clients will use.
+The relying party (RP) identifier is the bare host name, while the origin must
+include scheme and port. Adjust the values above if you serve Papercrate from a
+different host, domain, or HTTPS endpoint—otherwise passkey registration and
+login will fail.

-## Backend Integration Tests
+The compose file builds the backend and frontend images locally, then launches
+Postgres, MinIO, Quickwit, the API, background worker, WebDAV endpoint, and the
+SPA frontend. Once the containers report healthy, visit `http://<host>:8080`
+and use the passkey signup flow to provision the first tenant/user. Upgrades are
+as simple as `git pull` followed by `docker compose up -d`.

-Integration tests require a running Postgres instance (and, optionally, Quickwit for OCR indexing). The repository includes a lightweight compose file for local runs:
+## Screenshots

-```bash
-docker compose -f docker-compose.test.yml up -d
-export TEST_DATABASE_URL=postgres://papercrate:papercrate_test@localhost:5433/papercrate_test
-# optional, enables Quickwit indexing jobs
-export QUICKWIT_ENDPOINT=http://localhost:7280
-export QUICKWIT_INDEX=documents
-cargo test
-```
+![Document detail view](docs/detailview.png)
+![Desk overview](docs/deskview.png)
+![Document view](docs/documentview.png)

-Stop the database when you are done:
+---

-```bash
-docker compose -f docker-compose.test.yml down
-```
-
-The compose service uses tmpfs storage, giving each test run a clean database.
-
-## Runtime Dependencies
-
- `ocrmypdf` (optional but recommended): Used by the OCR worker to extract text from PDFs when no embedded text layer is available. Ensure it is installed and available on the worker hosts if OCR is desired.
- Quickwit (optional): The Quickwit indexer is used to ingest extracted text for search. Set `QUICKWIT_ENDPOINT` and `QUICKWIT_INDEX` in the environment when running workers if you want indexing jobs to run. The local compose file starts a Quickwit instance on `http://localhost:7280` and seeds the `documents` index automatically.
-
-## Configuration
-
-The backend reads its settings from environment variables (see `backend/.env` for local defaults). In particular:
-
- `DATABASE_URL` – connection string for the primary Postgres database (required).
- `DATABASE_MAX_POOL_SIZE` – optional override for the r2d2 connection pool size. Defaults to `2`; increase it in staging/production to match expected concurrency.
-
-On startup each binary logs the effective configuration with secrets redacted (for example, the database password is masked). This makes it easier to confirm the runtime settings in staging without exposing credentials.
-
-## Running Migrations in Kubernetes
-
-The backend container image ships the `diesel` CLI, so schema migrations can be executed as a short-lived Job (or Helm hook) before rolling out new pods. Example manifest:
-
-```yaml
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: papercrate-migrate
-spec:
-  template:
-    spec:
-      restartPolicy: OnFailure
-      containers:
-        - name: migrate
-          image: ghcr.io/example/papercrate-backend:<TAG>
-          command: ["/usr/local/bin/diesel", "migration", "run"]
-          env:
-            - name: DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: papercrate-db
-                  key: DATABASE_URL
-```
-
-Run the Job manually (`kubectl apply -f migrate-job.yaml`) or configure it as a Helm pre-install/pre-upgrade hook so migrations run automatically on each deployment. Once the Job succeeds, deploy/update the backend `Deployment` as usual.
+For development workflows (local stack, integration tests, migrations, and
+configuration details) see [DEVELOPMENT.md](./DEVELOPMENT.md).
@@ -41,6 +41,56 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "anstream"
+version = "0.6.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43d5b281e737544384e969a5ccad3f1cdd24b48086a0fc1b2a5262a26b8f4f4a"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
+
+[[package]]
+name = "anstyle-parse"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e231f6134f61b71076a3eab506c379d4f36122f2af15a9ff04415ea4c3339e2"
+dependencies = [
+ "windows-sys 0.60.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e0633414522a32ffaac8ac6cc8f748e090c5717661fddeea04219e2344f5f2a"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.60.2",
+]
+
 [[package]]
 name = "anyhow"
 version = "1.0.100"
@@ -59,6 +109,45 @@ dependencies = [
 "password-hash",
 ]

+[[package]]
+name = "asn1-rs"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5493c3bedbacf7fd7382c6346bbd66687d12bbaad3a89a2d2c303ee6cf20b048"
+dependencies = [
+ "asn1-rs-derive",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror 1.0.69",
+ "time",
+]
+
+[[package]]
+name = "asn1-rs-derive"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "965c2d33e53cb6b267e148a4cb0760bc01f4904c1cd4bb4002a085bb016d1490"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.106",
+ "synstructure",
+]
+
+[[package]]
+name = "asn1-rs-impl"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.106",
+]
+
 [[package]]
 name = "async-trait"
 version = "0.1.89"
@@ -593,52 +682,6 @@ dependencies = [
 "tower-service",
 ]

-[[package]]
-name = "backend"
-version = "0.1.0"
-dependencies = [
- "anyhow",
- "argon2",
- "async-trait",
- "aws-config",
- "aws-credential-types",
- "aws-sdk-s3",
- "axum",
- "axum-extra",
- "base64 0.21.7",
- "bytes",
- "chrono",
- "diesel",
- "diesel_migrations",
- "dotenv",
- "futures-util",
- "hex",
- "http-body-util",
- "hyper 1.7.0",
- "image",
- "jsonwebtoken",
- "mime_guess",
- "once_cell",
- "pdfium-render",
- "percent-encoding",
- "quick-xml",
- "rand 0.8.5",
- "reqwest",
- "serde",
- "serde_json",
- "sha2",
- "tempfile",
- "thiserror 1.0.69",
- "tokio",
- "tower 0.4.13",
- "tower-http",
- "tracing",
- "tracing-subscriber",
- "url",
- "utoipa",
- "uuid",
-]
-
 [[package]]
 name = "backtrace"
 version = "0.3.76"
@@ -688,6 +731,17 @@ version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "55248b47b0caf0546f7988906588779981c43bb1bc9d0c44087278f80cdb44ba"

+[[package]]
+name = "base64urlsafedata"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "215ee31f8a88f588c349ce2d20108b2ed96089b96b9c2b03775dc35dd72938e8"
+dependencies = [
+ "base64 0.21.7",
+ "pastey",
+ "serde",
+]
+
 [[package]]
 name = "bindgen"
 version = "0.72.1"
@@ -830,6 +884,46 @@ dependencies = [
 "libloading",
 ]

+[[package]]
+name = "clap"
+version = "4.5.51"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c26d721170e0295f191a69bd9a1f93efcdb0aff38684b61ab5750468972e5f5"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.5.51"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75835f0c7bf681bfd05abe44e965760fea999a5286c6eb2d59883634fd02011a"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.5.49"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a0b5487afeab2deb2ff4e03a807ad1a03ac532ff5a2cee5d86884440c7f7671"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.106",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1d728cc89cf3aee9ff92b05e62b19ee65a02b5702cff7d5a377e32c6ae29d8d"
+
 [[package]]
 name = "cmake"
 version = "0.1.54"
@@ -839,6 +933,12 @@ dependencies = [
 "cc",
 ]

+[[package]]
+name = "colorchoice"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+
 [[package]]
 name = "console_error_panic_hook"
 version = "0.1.7"
@@ -937,6 +1037,12 @@ dependencies = [
 "cfg-if",
 ]

+[[package]]
+name = "crunchy"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
+
 [[package]]
 name = "crypto-bigint"
 version = "0.4.9"
@@ -1004,6 +1110,12 @@ dependencies = [
 "syn 2.0.106",
 ]

+[[package]]
+name = "data-encoding"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476"
+
 [[package]]
 name = "der"
 version = "0.6.1"
@@ -1014,6 +1126,20 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "der-parser"
+version = "9.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cd0a5c643689626bec213c4d8bd4d96acc8ffdb4ad4bb6bc16abf27d5f4b553"
+dependencies = [
+ "asn1-rs",
+ "displaydoc",
+ "nom",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
 [[package]]
 name = "deranged"
 version = "0.5.4"
@@ -1175,6 +1301,15 @@ dependencies = [
 "cfg-if",
 ]

+[[package]]
+name = "envy"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f47e0157f2cb54f5ae1bd371b30a2ae4311e1c028f575cd4e81de7353215965"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -1244,6 +1379,21 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"

+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
@@ -1418,6 +1568,17 @@ dependencies = [
 "tracing",
 ]

+[[package]]
+name = "half"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b"
+dependencies = [
+ "cfg-if",
+ "crunchy",
+ "zerocopy",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.15.5"
@@ -1798,6 +1959,7 @@ checksum = "529feb3e6769d234375c4cf1ee2ce713682b8e76538cb13f9fc23e1400a591e7"
 dependencies = [
 "bytemuck",
 "byteorder-lite",
+ "image-webp",
 "moxcms",
 "num-traits",
 "png",
@@ -1805,6 +1967,16 @@ dependencies = [
 "zune-jpeg",
 ]

+[[package]]
+name = "image-webp"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "525e9ff3e1a4be2fbea1fdf0e98686a6d98b4d8f937e1bf7402245af1909e8c3"
+dependencies = [
+ "byteorder-lite",
+ "quick-error",
+]
+
 [[package]]
 name = "indexmap"
 version = "2.11.4"
@@ -1844,6 +2016,12 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
 [[package]]
 name = "itertools"
 version = "0.13.0"
@@ -2148,18 +2326,80 @@ dependencies = [
 "memchr",
 ]

+[[package]]
+name = "oid-registry"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8d8034d9489cdaf79228eb9f6a3b8d7bb32ba00d6645ebd48eef4077ceb5bd9"
+dependencies = [
+ "asn1-rs",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"

+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "openssl"
+version = "0.10.74"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24ad14dd45412269e1a30f52ad8f0664f0f4f4a89ee8fe28c3b3527021ebb654"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "once_cell",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.106",
+]
+
 [[package]]
 name = "openssl-probe"
 version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"

+[[package]]
+name = "openssl-sys"
+version = "0.9.110"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a9f0075ba3c21b09f8e8b2026584b1d18d49388648f2fbbf3c97ea8deced8e2"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "ordered-float"
+version = "2.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68f19d67e5a2795c94e73e0bb1cc1a7edeb2e28efd39e2e1c9b7a40c1108b11c"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "outref"
 version = "0.5.2"
@@ -2177,6 +2417,59 @@ dependencies = [
 "sha2",
 ]

+[[package]]
+name = "papercrate"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "argon2",
+ "async-trait",
+ "aws-config",
+ "aws-credential-types",
+ "aws-sdk-s3",
+ "axum",
+ "axum-extra",
+ "base64 0.21.7",
+ "bytes",
+ "chrono",
+ "clap",
+ "diesel",
+ "diesel_migrations",
+ "dotenv",
+ "envy",
+ "futures-util",
+ "hex",
+ "http-body-util",
+ "hyper 1.7.0",
+ "image",
+ "jsonwebtoken",
+ "mime_guess",
+ "once_cell",
+ "pdfium-render",
+ "percent-encoding",
+ "quick-xml",
+ "rand 0.8.5",
+ "reqwest",
+ "serde",
+ "serde-aux",
+ "serde_bytes",
+ "serde_cbor_2",
+ "serde_json",
+ "sha2",
+ "tempfile",
+ "thiserror 1.0.69",
+ "tokio",
+ "tower 0.4.13",
+ "tower-http",
+ "tracing",
+ "tracing-subscriber",
+ "url",
+ "utoipa",
+ "uuid",
+ "webauthn-rs",
+ "webauthn-rs-core",
+]
+
 [[package]]
 name = "parking_lot"
 version = "0.12.5"
@@ -2211,6 +2504,12 @@ dependencies = [
 "subtle",
 ]

+[[package]]
+name = "pastey"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35fb2e5f958ec131621fdd531e9fc186ed768cbe395337403ae56c17a74c68ec"
+
 [[package]]
 name = "pdfium-render"
 version = "0.8.35"
@@ -2407,6 +2706,12 @@ dependencies = [
 "num-traits",
 ]

+[[package]]
+name = "quick-error"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
+
 [[package]]
 name = "quick-xml"
 version = "0.32.0"
@@ -2687,6 +2992,15 @@ dependencies = [
 "semver",
 ]

+[[package]]
+name = "rusticata-macros"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
+dependencies = [
+ "nom",
+]
+
 [[package]]
 name = "rustix"
 version = "1.1.2"
@@ -2904,6 +3218,48 @@ dependencies = [
 "serde_derive",
 ]

+[[package]]
+name = "serde-aux"
+version = "4.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "207f67b28fe90fb596503a9bf0bf1ea5e831e21307658e177c5dfcdfc3ab8a0a"
+dependencies = [
+ "chrono",
+ "serde",
+ "serde-value",
+ "serde_json",
+]
+
+[[package]]
+name = "serde-value"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3a1a3341211875ef120e117ea7fd5228530ae7e7036a779fdc9117be6b3282c"
+dependencies = [
+ "ordered-float",
+ "serde",
+]
+
+[[package]]
+name = "serde_bytes"
+version = "0.11.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5d440709e79d88e51ac01c4b72fc6cb7314017bb7da9eeff678aa94c10e3ea8"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_cbor_2"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34aec2709de9078e077090abd848e967abab63c9fb3fdb5d4799ad359d8d482c"
+dependencies = [
+ "half",
+ "serde",
+]
+
 [[package]]
 name = "serde_core"
 version = "1.0.228"
@@ -3551,6 +3907,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"

+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
 [[package]]
 name = "utoipa"
 version = "4.2.3"
@@ -3759,6 +4121,74 @@ dependencies = [
 "wasm-bindgen",
 ]

+[[package]]
+name = "webauthn-attestation-ca"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f77a2892ec44032e6c48dad9aad1b05fada09c346ada11d8d32db119b4b4f205"
+dependencies = [
+ "base64urlsafedata",
+ "openssl",
+ "openssl-sys",
+ "serde",
+ "tracing",
+ "uuid",
+]
+
+[[package]]
+name = "webauthn-rs"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb7c3a2f9c8bddd524e47bbd427bcf3a28aa074de55d74470b42a91a41937b8e"
+dependencies = [
+ "base64urlsafedata",
+ "serde",
+ "tracing",
+ "url",
+ "uuid",
+ "webauthn-rs-core",
+]
+
+[[package]]
+name = "webauthn-rs-core"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f1d80f3146382529fe70a3ab5d0feb2413a015204ed7843f9377cd39357fc4"
+dependencies = [
+ "base64 0.21.7",
+ "base64urlsafedata",
+ "der-parser",
+ "hex",
+ "nom",
+ "openssl",
+ "openssl-sys",
+ "rand 0.8.5",
+ "rand_chacha 0.3.1",
+ "serde",
+ "serde_cbor_2",
+ "serde_json",
+ "thiserror 1.0.69",
+ "tracing",
+ "url",
+ "uuid",
+ "webauthn-attestation-ca",
+ "webauthn-rs-proto",
+ "x509-parser",
+]
+
+[[package]]
+name = "webauthn-rs-proto"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e786894f89facb9aaf1c5f6559670236723c98382e045521c76f3d5ca5047bd"
+dependencies = [
+ "base64 0.21.7",
+ "base64urlsafedata",
+ "serde",
+ "serde_json",
+ "url",
+]
+
 [[package]]
 name = "webpki-roots"
 version = "1.0.3"
@@ -3845,6 +4275,15 @@ dependencies = [
 "windows-targets 0.52.6",
 ]

+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.5",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.61.2"
@@ -4001,6 +4440,23 @@ version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ea2f10b9bb0928dfb1b42b65e1f9e36f7f54dbdf08457afefb38afcdec4fa2bb"

+[[package]]
+name = "x509-parser"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcbc162f30700d6f3f82a24bf7cc62ffe7caea42c0b2cba8bf7f3ae50cf51f69"
+dependencies = [
+ "asn1-rs",
+ "data-encoding",
+ "der-parser",
+ "lazy_static",
+ "nom",
+ "oid-registry",
+ "rusticata-macros",
+ "thiserror 1.0.69",
+ "time",
+]
+
 [[package]]
 name = "xmlparser"
 version = "0.13.6"
@@ -1,5 +1,5 @@
 [package]
-name = "backend"
+name = "papercrate"
 version = "0.1.0"
 edition = "2021"

@@ -25,6 +25,8 @@ aws-credential-types = "1.2"
 # Serialization
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
+envy = "0.4"
+serde-aux = "4.4"

 # Utilities
 tracing = "0.1"
@@ -34,7 +36,7 @@ sha2 = "0.10"
 hex = "0.4"
 bytes = "1.5"
 async-trait = "0.1"
-image = { version = "0.25", default-features = false, features = ["png", "jpeg"] }
+image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp"] }
 pdfium-render = "0.8"
 mime_guess = "2.0"
 tempfile = "3.10"
@@ -46,6 +48,7 @@ futures-util = "0.3"
 url = "2.5"
 once_cell = "1.19"
 utoipa = { version = "4.2", default-features = false, features = ["chrono", "uuid", "preserve_order"] }
+clap = { version = "4.5", features = ["derive"] }

 # Error handling
 thiserror = "1.0"
@@ -54,6 +57,9 @@ anyhow = "1.0"
 # Authentication & security
 argon2 = "0.5"
 jsonwebtoken = "9"
+webauthn-rs = { version = "0.5", features = ["danger-allow-state-serialisation", "danger-credential-internals"] }
+serde_bytes = "0.11"
+serde_cbor_2 = "0.13"

 # Misc
 rand = "0.8"
@@ -62,3 +68,23 @@ rand = "0.8"
 once_cell = "1.19"
 hyper = "1.2"
 http-body-util = "0.1"
+webauthn-rs-core = "0.5"
+
+[[bin]]
+name = "backend"
+path = "src/main.rs"
+[[bin]]
+name = "worker"
+path = "src/bin/worker.rs"
+
+[[bin]]
+name = "webdav"
+path = "src/bin/webdav.rs"
+
+[[bin]]
+name = "admin"
+path = "src/bin/admin.rs"
+
+[[bin]]
+name = "openapi-dump"
+path = "src/bin/openapi_dump.rs"
@@ -1,8 +1,10 @@
 DROP TRIGGER IF EXISTS trg_jobs_updated_at ON jobs;
 DROP FUNCTION IF EXISTS touch_jobs_updated_at();

+DROP TABLE IF EXISTS webauthn_challenges;
+DROP TABLE IF EXISTS user_passkeys;
+DROP TABLE IF EXISTS webdav_tokens;
 ALTER TABLE documents DROP CONSTRAINT IF EXISTS documents_current_version_fk;
-
 DROP TABLE IF EXISTS document_asset_objects;
 DROP TABLE IF EXISTS document_assets;
 DROP TABLE IF EXISTS document_versions;
@@ -18,4 +20,6 @@ DROP TABLE IF EXISTS user_memberships;
 DROP TABLE IF EXISTS users;
 DROP TABLE IF EXISTS tenants;

+DROP TYPE IF EXISTS tenant_status;
+
 DROP EXTENSION IF EXISTS "pgcrypto";
@@ -1,14 +1,17 @@
 CREATE EXTENSION IF NOT EXISTS "pgcrypto";

+CREATE TYPE tenant_status AS ENUM ('creating', 'active', 'suspended', 'deleting', 'error');
+
 CREATE TABLE tenants (
    id UUID PRIMARY KEY,
-    slug TEXT NOT NULL UNIQUE,
+    name TEXT NOT NULL,
    storage_root TEXT,
    quickwit_index TEXT,
-    status TEXT NOT NULL DEFAULT 'active',
    config JSONB NOT NULL DEFAULT '{}'::jsonb,
    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    status tenant_status NOT NULL,
+    created_by UUID
 );

 CREATE UNIQUE INDEX tenants_storage_root_unique
@@ -22,7 +25,6 @@ CREATE UNIQUE INDEX tenants_quickwit_index_unique
 CREATE TABLE users (
    id UUID PRIMARY KEY,
    username VARCHAR(100) NOT NULL UNIQUE,
-    password_hash VARCHAR(255) NOT NULL,
    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );
@@ -31,14 +33,13 @@ CREATE TABLE user_memberships (
    id UUID PRIMARY KEY,
    user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
    tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
-    role TEXT NOT NULL,
    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    UNIQUE (user_id, tenant_id)
 );

-CREATE INDEX user_memberships_tenant_id_idx ON user_memberships (tenant_id);
-CREATE INDEX user_memberships_user_id_idx ON user_memberships (user_id);
+CREATE INDEX user_memberships_tenant_id_idx ON user_memberships(tenant_id);
+CREATE INDEX user_memberships_user_id_idx ON user_memberships(user_id);

 CREATE TABLE folders (
    id UUID PRIMARY KEY,
@@ -51,8 +52,12 @@ CREATE TABLE folders (

 CREATE INDEX idx_folders_parent ON folders(parent_id);
 CREATE INDEX folders_tenant_id_idx ON folders(tenant_id);
-CREATE UNIQUE INDEX folders_parent_name_unique_idx
-    ON folders (COALESCE(parent_id, '00000000-0000-0000-0000-000000000000'::uuid), name);
+CREATE UNIQUE INDEX folders_tenant_parent_name_unique_idx
+    ON folders (
+        tenant_id,
+        COALESCE(parent_id, '00000000-0000-0000-0000-000000000000'::uuid),
+        name
+    );

 CREATE TABLE documents (
    id UUID PRIMARY KEY,
@@ -70,11 +75,10 @@ CREATE TABLE documents (
    tenant_id UUID NOT NULL REFERENCES tenants(id)
 );

-CREATE INDEX idx_documents_folder ON documents (folder_id);
-CREATE INDEX idx_documents_deleted_at ON documents (deleted_at);
-CREATE INDEX documents_tenant_id_idx ON documents (tenant_id);
-CREATE INDEX idx_documents_current_version_id ON documents (current_version_id);
-
+CREATE INDEX idx_documents_folder ON documents(folder_id);
+CREATE INDEX idx_documents_deleted_at ON documents(deleted_at);
+CREATE INDEX documents_tenant_id_idx ON documents(tenant_id);
+CREATE INDEX idx_documents_current_version_id ON documents(current_version_id);
 CREATE INDEX idx_documents_folder_title
    ON documents (
        COALESCE(folder_id, '00000000-0000-0000-0000-000000000000'::uuid),
@@ -82,8 +86,9 @@ CREATE INDEX idx_documents_folder_title
    )
    WHERE deleted_at IS NULL;

-CREATE UNIQUE INDEX documents_unique_folder_filename
+CREATE UNIQUE INDEX documents_tenant_folder_filename_unique
    ON documents (
+        tenant_id,
        COALESCE(folder_id, '00000000-0000-0000-0000-000000000000'::uuid),
        filename
    )
@@ -97,14 +102,13 @@ CREATE TABLE document_versions (
    size_bytes BIGINT NOT NULL,
    checksum VARCHAR(64) NOT NULL,
    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-    operations_summary JSONB NOT NULL DEFAULT '{}'::jsonb,
    metadata JSONB NOT NULL DEFAULT '{}'::jsonb,
    tenant_id UUID NOT NULL REFERENCES tenants(id),
    CONSTRAINT document_versions_unique_version UNIQUE (document_id, version_number)
 );

-CREATE INDEX idx_document_versions_document ON document_versions (document_id);
-CREATE INDEX document_versions_tenant_id_idx ON document_versions (tenant_id);
+CREATE INDEX idx_document_versions_document ON document_versions(document_id);
+CREATE INDEX document_versions_tenant_id_idx ON document_versions(tenant_id);

 ALTER TABLE documents
    ADD CONSTRAINT documents_current_version_fk
@@ -114,13 +118,14 @@ ALTER TABLE documents

 CREATE TABLE tags (
    id UUID PRIMARY KEY,
-    label VARCHAR(100) NOT NULL UNIQUE,
+    label VARCHAR(100) NOT NULL,
    color VARCHAR(7),
    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    tenant_id UUID NOT NULL REFERENCES tenants(id)
 );

-CREATE INDEX tags_tenant_id_idx ON tags (tenant_id);
+CREATE UNIQUE INDEX tags_tenant_label_unique ON tags(tenant_id, label);
+CREATE INDEX tags_tenant_id_idx ON tags(tenant_id);

 CREATE TABLE document_tags (
    document_id UUID NOT NULL REFERENCES documents(id) ON DELETE CASCADE,
@@ -131,8 +136,8 @@ CREATE TABLE document_tags (
    PRIMARY KEY (document_id, tag_id)
 );

-CREATE INDEX idx_document_tags_tag ON document_tags (tag_id);
-CREATE INDEX document_tags_tenant_id_idx ON document_tags (tenant_id);
+CREATE INDEX idx_document_tags_tag ON document_tags(tag_id);
+CREATE INDEX document_tags_tenant_id_idx ON document_tags(tenant_id);

 CREATE TABLE correspondents (
    id UUID PRIMARY KEY,
@@ -140,27 +145,25 @@ CREATE TABLE correspondents (
    metadata JSONB NOT NULL DEFAULT '{}'::jsonb,
    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-    tenant_id UUID NOT NULL REFERENCES tenants(id),
-    CONSTRAINT correspondents_name_unique UNIQUE (name)
+    tenant_id UUID NOT NULL REFERENCES tenants(id)
 );

-CREATE INDEX correspondents_tenant_id_idx ON correspondents (tenant_id);
+CREATE UNIQUE INDEX correspondents_tenant_name_unique
+    ON correspondents (tenant_id, name);
+CREATE INDEX correspondents_tenant_id_idx ON correspondents(tenant_id);

 CREATE TABLE document_correspondents (
    document_id UUID NOT NULL REFERENCES documents(id) ON DELETE CASCADE,
    correspondent_id UUID NOT NULL REFERENCES correspondents(id) ON DELETE CASCADE,
-    role VARCHAR(32) NOT NULL,
    assigned_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    assigned_by UUID REFERENCES users(id),
    tenant_id UUID NOT NULL REFERENCES tenants(id),
-    PRIMARY KEY (document_id, correspondent_id, role),
-    CONSTRAINT document_correspondents_role_check CHECK (role IN ('sender', 'receiver', 'other'))
+    PRIMARY KEY (document_id, correspondent_id)
 );

-CREATE INDEX idx_document_correspondents_document ON document_correspondents (document_id);
-CREATE INDEX idx_document_correspondents_correspondent ON document_correspondents (correspondent_id);
-CREATE INDEX idx_document_correspondents_role ON document_correspondents (role);
-CREATE INDEX document_correspondents_tenant_id_idx ON document_correspondents (tenant_id);
+CREATE INDEX idx_document_correspondents_document ON document_correspondents(document_id);
+CREATE INDEX idx_document_correspondents_correspondent ON document_correspondents(correspondent_id);
+CREATE INDEX document_correspondents_tenant_id_idx ON document_correspondents(tenant_id);

 CREATE TABLE document_assets (
    id UUID PRIMARY KEY,
@@ -175,9 +178,9 @@ CREATE TABLE document_assets (
    CONSTRAINT document_assets_cardinality_positive CHECK (cardinality IS NULL OR cardinality >= 1)
 );

-CREATE INDEX idx_document_assets_version ON document_assets (document_version_id);
-CREATE INDEX idx_document_assets_type ON document_assets (asset_type);
-CREATE INDEX document_assets_tenant_id_idx ON document_assets (tenant_id);
+CREATE INDEX idx_document_assets_version ON document_assets(document_version_id);
+CREATE INDEX idx_document_assets_type ON document_assets(asset_type);
+CREATE INDEX document_assets_tenant_id_idx ON document_assets(tenant_id);

 CREATE TABLE document_asset_objects (
    id UUID PRIMARY KEY,
@@ -191,10 +194,8 @@ CREATE TABLE document_asset_objects (
 );

 CREATE INDEX idx_document_asset_objects_asset_ordinal
-    ON document_asset_objects (asset_id, ordinal);
-
-CREATE INDEX document_asset_objects_tenant_id_idx
-    ON document_asset_objects (tenant_id);
+    ON document_asset_objects(asset_id, ordinal);
+CREATE INDEX document_asset_objects_tenant_id_idx ON document_asset_objects(tenant_id);

 CREATE TABLE jobs (
    id UUID PRIMARY KEY,
@@ -210,9 +211,9 @@ CREATE TABLE jobs (
    CONSTRAINT jobs_status_check CHECK (status IN ('queued', 'processing', 'succeeded', 'failed'))
 );

-CREATE INDEX idx_jobs_status_run_after ON jobs (status, run_after);
-CREATE INDEX idx_jobs_job_type ON jobs (job_type);
-CREATE INDEX jobs_tenant_id_idx ON jobs (tenant_id);
+CREATE INDEX idx_jobs_status_run_after ON jobs(status, run_after);
+CREATE INDEX idx_jobs_job_type ON jobs(job_type);
+CREATE INDEX jobs_tenant_id_idx ON jobs(tenant_id);

 CREATE OR REPLACE FUNCTION touch_jobs_updated_at()
 RETURNS TRIGGER AS $$
@@ -239,6 +240,56 @@ CREATE TABLE refresh_tokens (
    tenant_id UUID NOT NULL REFERENCES tenants(id)
 );

-CREATE INDEX idx_refresh_tokens_user_id ON refresh_tokens (user_id);
-CREATE INDEX idx_refresh_tokens_token_hash ON refresh_tokens (token_hash);
-CREATE INDEX refresh_tokens_tenant_id_idx ON refresh_tokens (tenant_id);
+CREATE INDEX idx_refresh_tokens_user_id ON refresh_tokens(user_id);
+CREATE INDEX idx_refresh_tokens_token_hash ON refresh_tokens(token_hash);
+CREATE INDEX refresh_tokens_tenant_id_idx ON refresh_tokens(tenant_id);
+
+CREATE TABLE webdav_tokens (
+    id UUID PRIMARY KEY,
+    user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+    token_prefix TEXT NOT NULL,
+    token_hash TEXT NOT NULL,
+    label TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    last_used_at TIMESTAMPTZ,
+    expires_at TIMESTAMPTZ,
+    revoked_at TIMESTAMPTZ
+);
+
+CREATE UNIQUE INDEX webdav_tokens_token_prefix_key ON webdav_tokens(token_prefix);
+CREATE INDEX webdav_tokens_user_tenant_idx ON webdav_tokens(user_id, tenant_id);
+
+CREATE TABLE user_passkeys (
+    id UUID PRIMARY KEY,
+    user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    credential_id BYTEA NOT NULL UNIQUE,
+    public_key BYTEA NOT NULL,
+    credential JSONB NOT NULL,
+    sign_count BIGINT NOT NULL,
+    transports TEXT[] NOT NULL DEFAULT '{}'::text[],
+    aaguid UUID,
+    nickname TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    last_used_at TIMESTAMPTZ,
+    revoked_at TIMESTAMPTZ,
+    revoked_by UUID,
+    revoked_reason TEXT
+);
+
+CREATE INDEX user_passkeys_user_id_idx ON user_passkeys(user_id);
+
+CREATE TABLE webauthn_challenges (
+    id UUID PRIMARY KEY,
+    user_id UUID REFERENCES users(id) ON DELETE CASCADE,
+    purpose TEXT NOT NULL,
+    challenge BYTEA NOT NULL,
+    state BYTEA NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    expires_at TIMESTAMPTZ NOT NULL,
+    CONSTRAINT webauthn_challenges_purpose_check CHECK (purpose IN ('registration', 'authentication'))
+);
+
+CREATE INDEX webauthn_challenges_user_id_idx ON webauthn_challenges(user_id);
+CREATE INDEX webauthn_challenges_expires_at_idx ON webauthn_challenges(expires_at);
@@ -0,0 +1,2 @@
+ALTER TABLE documents
+    RENAME COLUMN created_at TO uploaded_at;
@@ -0,0 +1,2 @@
+ALTER TABLE documents
+    RENAME COLUMN uploaded_at TO created_at;
@@ -0,0 +1,2 @@
+DROP TABLE magic_tokens;
+DROP TYPE magic_token_kind;
@@ -0,0 +1,18 @@
+CREATE TYPE magic_token_kind AS ENUM ('email_login', 'demo_login');
+
+CREATE TABLE magic_tokens (
+    id UUID PRIMARY KEY,
+    user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    kind magic_token_kind NOT NULL,
+    token_hash VARCHAR NOT NULL UNIQUE,
+    metadata JSONB NOT NULL DEFAULT '{}'::jsonb,
+    expires_at TIMESTAMPTZ NOT NULL,
+    max_uses INTEGER,
+    used_count INTEGER NOT NULL DEFAULT 0,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    created_by UUID REFERENCES users(id) ON DELETE SET NULL,
+    last_used_at TIMESTAMPTZ
+);
+
+CREATE INDEX magic_tokens_token_hash_idx ON magic_tokens (token_hash);
+CREATE INDEX magic_tokens_expires_at_idx ON magic_tokens (expires_at);
@@ -0,0 +1,28 @@
+-- Move tables and types back to the public schema
+ALTER TABLE tenant.webdav_tokens SET SCHEMA public;
+ALTER TABLE tenant.user_memberships SET SCHEMA public;
+ALTER TABLE tenant.refresh_tokens SET SCHEMA public;
+ALTER TABLE tenant.tags SET SCHEMA public;
+ALTER TABLE tenant.document_correspondents SET SCHEMA public;
+ALTER TABLE tenant.document_tags SET SCHEMA public;
+ALTER TABLE tenant.document_asset_objects SET SCHEMA public;
+ALTER TABLE tenant.document_assets SET SCHEMA public;
+ALTER TABLE tenant.document_versions SET SCHEMA public;
+ALTER TABLE tenant.documents SET SCHEMA public;
+ALTER TABLE tenant.folders SET SCHEMA public;
+ALTER TABLE tenant.correspondents SET SCHEMA public;
+
+ALTER FUNCTION shared.touch_jobs_updated_at() SET SCHEMA public;
+
+ALTER TABLE shared.magic_tokens SET SCHEMA public;
+ALTER TABLE shared.jobs SET SCHEMA public;
+ALTER TABLE shared.webauthn_challenges SET SCHEMA public;
+ALTER TABLE shared.user_passkeys SET SCHEMA public;
+ALTER TABLE shared.users SET SCHEMA public;
+ALTER TABLE shared.tenants SET SCHEMA public;
+
+ALTER TYPE shared.magic_token_kind SET SCHEMA public;
+ALTER TYPE shared.tenant_status SET SCHEMA public;
+
+DROP SCHEMA IF EXISTS tenant CASCADE;
+DROP SCHEMA IF EXISTS shared CASCADE;
@@ -0,0 +1,45 @@
+CREATE SCHEMA IF NOT EXISTS shared;
+CREATE SCHEMA IF NOT EXISTS tenant;
+
+-- Move global types and tables into the shared schema
+ALTER TYPE tenant_status SET SCHEMA shared;
+ALTER TYPE magic_token_kind SET SCHEMA shared;
+
+ALTER TABLE tenants SET SCHEMA shared;
+ALTER TABLE users SET SCHEMA shared;
+ALTER TABLE user_passkeys SET SCHEMA shared;
+ALTER TABLE webauthn_challenges SET SCHEMA shared;
+ALTER TABLE jobs SET SCHEMA shared;
+ALTER TABLE magic_tokens SET SCHEMA shared;
+
+ALTER FUNCTION touch_jobs_updated_at() SET SCHEMA shared;
+
+-- Move tenant-scoped tables into the tenant schema
+ALTER TABLE correspondents SET SCHEMA tenant;
+ALTER TABLE folders SET SCHEMA tenant;
+ALTER TABLE documents SET SCHEMA tenant;
+ALTER TABLE document_versions SET SCHEMA tenant;
+ALTER TABLE document_assets SET SCHEMA tenant;
+ALTER TABLE document_asset_objects SET SCHEMA tenant;
+ALTER TABLE document_tags SET SCHEMA tenant;
+ALTER TABLE document_correspondents SET SCHEMA tenant;
+ALTER TABLE tags SET SCHEMA tenant;
+ALTER TABLE refresh_tokens SET SCHEMA tenant;
+ALTER TABLE user_memberships SET SCHEMA tenant;
+ALTER TABLE webdav_tokens SET SCHEMA tenant;
+
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'papercrate_app') THEN
+        RETURN;
+    END IF;
+
+    GRANT USAGE ON SCHEMA shared TO papercrate_app;
+    GRANT USAGE ON SCHEMA tenant TO papercrate_app;
+    GRANT SELECT ON ALL TABLES IN SCHEMA shared TO papercrate_app;
+    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA tenant TO papercrate_app;
+
+    ALTER DEFAULT PRIVILEGES IN SCHEMA shared GRANT SELECT ON TABLES TO papercrate_app;
+    ALTER DEFAULT PRIVILEGES IN SCHEMA tenant GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO papercrate_app;
+END
+$$;
@@ -0,0 +1,51 @@
+DROP POLICY IF EXISTS tenant_membership_select_policy ON tenant.user_memberships;
+ALTER TABLE tenant.user_memberships NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE tenant.user_memberships DISABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS tenant_isolation_policy ON tenant.webdav_tokens;
+ALTER TABLE tenant.webdav_tokens NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE tenant.webdav_tokens DISABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS tenant_isolation_policy ON tenant.tags;
+ALTER TABLE tenant.tags NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE tenant.tags DISABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS tenant_refresh_token_policy ON tenant.refresh_tokens;
+ALTER TABLE tenant.refresh_tokens NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE tenant.refresh_tokens DISABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS tenant_isolation_policy ON tenant.folders;
+ALTER TABLE tenant.folders NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE tenant.folders DISABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS tenant_isolation_policy ON tenant.documents;
+ALTER TABLE tenant.documents NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE tenant.documents DISABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS tenant_isolation_policy ON tenant.document_versions;
+ALTER TABLE tenant.document_versions NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE tenant.document_versions DISABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS tenant_isolation_policy ON tenant.document_tags;
+ALTER TABLE tenant.document_tags NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE tenant.document_tags DISABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS tenant_isolation_policy ON tenant.document_correspondents;
+ALTER TABLE tenant.document_correspondents NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE tenant.document_correspondents DISABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS tenant_isolation_policy ON tenant.document_assets;
+ALTER TABLE tenant.document_assets NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE tenant.document_assets DISABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS tenant_isolation_policy ON tenant.document_asset_objects;
+ALTER TABLE tenant.document_asset_objects NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE tenant.document_asset_objects DISABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS tenant_isolation_policy ON tenant.correspondents;
+ALTER TABLE tenant.correspondents NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE tenant.correspondents DISABLE ROW LEVEL SECURITY;
+
+DROP FUNCTION IF EXISTS shared.current_refresh_token_hash();
+DROP FUNCTION IF EXISTS shared.current_user_id();
+DROP FUNCTION IF EXISTS shared.current_tenant_id();
@@ -0,0 +1,69 @@
+CREATE OR REPLACE FUNCTION shared.current_tenant_id() RETURNS uuid AS $$
+    SELECT CASE
+        WHEN setting IS NULL OR setting = '' THEN NULL
+        ELSE setting::uuid
+    END
+    FROM (SELECT current_setting('papercrate.tenant_id', true) AS setting) s;
+$$ LANGUAGE SQL STABLE;
+
+CREATE OR REPLACE FUNCTION shared.current_user_id() RETURNS uuid AS $$
+    SELECT CASE
+        WHEN setting IS NULL OR setting = '' THEN NULL
+        ELSE setting::uuid
+    END
+    FROM (SELECT current_setting('papercrate.user_id', true) AS setting) s;
+$$ LANGUAGE SQL STABLE;
+
+CREATE OR REPLACE FUNCTION shared.current_refresh_token_hash() RETURNS text AS $$
+    SELECT NULLIF(current_setting('papercrate.refresh_token_hash', true), '')
+$$ LANGUAGE SQL STABLE;
+
+-- Helper to create tenant isolation policy
+CREATE OR REPLACE FUNCTION shared.ensure_tenant_policy(table_reg regclass) RETURNS void AS $$
+BEGIN
+    EXECUTE format('ALTER TABLE %s ENABLE ROW LEVEL SECURITY', table_reg);
+    EXECUTE format('ALTER TABLE %s FORCE ROW LEVEL SECURITY', table_reg);
+    EXECUTE format(
+        'CREATE POLICY tenant_isolation_policy ON %s USING (tenant_id = shared.current_tenant_id()) WITH CHECK (tenant_id = shared.current_tenant_id())',
+        table_reg
+    );
+END;
+$$ LANGUAGE plpgsql;
+
+SELECT shared.ensure_tenant_policy('tenant.correspondents');
+SELECT shared.ensure_tenant_policy('tenant.document_asset_objects');
+SELECT shared.ensure_tenant_policy('tenant.document_assets');
+SELECT shared.ensure_tenant_policy('tenant.document_correspondents');
+SELECT shared.ensure_tenant_policy('tenant.document_tags');
+SELECT shared.ensure_tenant_policy('tenant.document_versions');
+SELECT shared.ensure_tenant_policy('tenant.documents');
+SELECT shared.ensure_tenant_policy('tenant.folders');
+SELECT shared.ensure_tenant_policy('tenant.tags');
+SELECT shared.ensure_tenant_policy('tenant.webdav_tokens');
+
+-- user_memberships has a special read policy to allow tenant discovery during login
+ALTER TABLE tenant.user_memberships ENABLE ROW LEVEL SECURITY;
+ALTER TABLE tenant.user_memberships FORCE ROW LEVEL SECURITY;
+CREATE POLICY tenant_membership_select_policy ON tenant.user_memberships
+    USING (
+        tenant_id = shared.current_tenant_id()
+        OR (
+            shared.current_user_id() IS NOT NULL
+            AND user_id = shared.current_user_id()
+        )
+    )
+    WITH CHECK (tenant_id = shared.current_tenant_id());
+
+ALTER TABLE tenant.refresh_tokens ENABLE ROW LEVEL SECURITY;
+ALTER TABLE tenant.refresh_tokens FORCE ROW LEVEL SECURITY;
+CREATE POLICY tenant_refresh_token_policy ON tenant.refresh_tokens
+    USING (
+        tenant_id = shared.current_tenant_id()
+        OR (
+            shared.current_refresh_token_hash() IS NOT NULL
+            AND token_hash = shared.current_refresh_token_hash()
+        )
+    )
+    WITH CHECK (tenant_id = shared.current_tenant_id());
+
+DROP FUNCTION shared.ensure_tenant_policy(regclass);
@@ -0,0 +1,5 @@
+DROP POLICY IF EXISTS tenant_webdav_token_policy ON tenant.webdav_tokens;
+ALTER TABLE tenant.webdav_tokens NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE tenant.webdav_tokens DISABLE ROW LEVEL SECURITY;
+
+DROP FUNCTION IF EXISTS shared.current_webdav_token_prefix();
@@ -0,0 +1,15 @@
+CREATE OR REPLACE FUNCTION shared.current_webdav_token_prefix() RETURNS text AS $$
+    SELECT NULLIF(current_setting('papercrate.webdav_token_prefix', true), '')
+$$ LANGUAGE SQL STABLE;
+
+ALTER TABLE tenant.webdav_tokens ENABLE ROW LEVEL SECURITY;
+ALTER TABLE tenant.webdav_tokens FORCE ROW LEVEL SECURITY;
+CREATE POLICY tenant_webdav_token_policy ON tenant.webdav_tokens
+    USING (
+        tenant_id = shared.current_tenant_id()
+        OR (
+            shared.current_webdav_token_prefix() IS NOT NULL
+            AND token_prefix = shared.current_webdav_token_prefix()
+        )
+    )
+    WITH CHECK (tenant_id = shared.current_tenant_id());
@@ -0,0 +1,31 @@
+DROP POLICY IF EXISTS tenant_api_token_policy ON tenant.api_tokens;
+DROP FUNCTION IF EXISTS shared.current_api_token_prefix();
+
+ALTER TABLE tenant.api_tokens DISABLE ROW LEVEL SECURITY;
+ALTER TABLE tenant.api_tokens NO FORCE ROW LEVEL SECURITY;
+
+ALTER TABLE tenant.api_tokens
+    DROP COLUMN IF EXISTS capabilities;
+
+DROP TYPE IF EXISTS shared.api_token_capability;
+
+ALTER TABLE tenant.api_tokens RENAME TO webdav_tokens;
+ALTER INDEX tenant.api_tokens_token_prefix_key RENAME TO webdav_tokens_token_prefix_key;
+ALTER INDEX tenant.api_tokens_user_tenant_idx RENAME TO webdav_tokens_user_tenant_idx;
+
+CREATE OR REPLACE FUNCTION shared.current_webdav_token_prefix() RETURNS text AS $$
+    SELECT NULLIF(current_setting('papercrate.webdav_token_prefix', true), '')
+$$ LANGUAGE SQL STABLE;
+
+ALTER TABLE tenant.webdav_tokens ENABLE ROW LEVEL SECURITY;
+ALTER TABLE tenant.webdav_tokens FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY tenant_webdav_token_policy ON tenant.webdav_tokens
+    USING (
+        tenant_id = shared.current_tenant_id()
+        OR (
+            shared.current_webdav_token_prefix() IS NOT NULL
+            AND token_prefix = shared.current_webdav_token_prefix()
+        )
+    )
+    WITH CHECK (tenant_id = shared.current_tenant_id());
@@ -0,0 +1,28 @@
+ALTER TABLE tenant.webdav_tokens RENAME TO api_tokens;
+ALTER INDEX tenant.webdav_tokens_token_prefix_key RENAME TO api_tokens_token_prefix_key;
+ALTER INDEX tenant.webdav_tokens_user_tenant_idx RENAME TO api_tokens_user_tenant_idx;
+
+DROP POLICY IF EXISTS tenant_webdav_token_policy ON tenant.api_tokens;
+DROP FUNCTION IF EXISTS shared.current_webdav_token_prefix();
+
+CREATE TYPE shared.api_token_capability AS ENUM ('api', 'webdav');
+
+ALTER TABLE tenant.api_tokens
+    ADD COLUMN capabilities shared.api_token_capability[] NOT NULL DEFAULT ARRAY['webdav']::shared.api_token_capability[];
+
+ALTER TABLE tenant.api_tokens ENABLE ROW LEVEL SECURITY;
+ALTER TABLE tenant.api_tokens FORCE ROW LEVEL SECURITY;
+
+CREATE OR REPLACE FUNCTION shared.current_api_token_prefix() RETURNS text AS $$
+    SELECT NULLIF(current_setting('papercrate.api_token_prefix', true), '')
+$$ LANGUAGE SQL STABLE;
+
+CREATE POLICY tenant_api_token_policy ON tenant.api_tokens
+    USING (
+        tenant_id = shared.current_tenant_id()
+        OR (
+            shared.current_api_token_prefix() IS NOT NULL
+            AND token_prefix = shared.current_api_token_prefix()
+        )
+    )
+    WITH CHECK (tenant_id = shared.current_tenant_id());
@@ -0,0 +1,26 @@
+CREATE OR REPLACE FUNCTION shared.current_refresh_token_hash() RETURNS text AS $$
+    SELECT NULLIF(current_setting('papercrate.refresh_token_hash', true), '')
+$$ LANGUAGE SQL STABLE;
+
+ALTER POLICY tenant_user_session_policy ON tenant.user_sessions
+    USING (
+        tenant_id = shared.current_tenant_id()
+        OR (
+            shared.current_refresh_token_hash() IS NOT NULL
+            AND token_hash = shared.current_refresh_token_hash()
+        )
+    );
+
+ALTER POLICY tenant_user_session_policy ON tenant.user_sessions
+    WITH CHECK (tenant_id = shared.current_tenant_id());
+
+ALTER POLICY tenant_user_session_policy ON tenant.user_sessions
+    RENAME TO tenant_refresh_token_policy;
+
+ALTER INDEX tenant.idx_user_sessions_user_id RENAME TO idx_refresh_tokens_user_id;
+ALTER INDEX tenant.idx_user_sessions_token_hash RENAME TO idx_refresh_tokens_token_hash;
+ALTER INDEX tenant.user_sessions_tenant_id_idx RENAME TO refresh_tokens_tenant_id_idx;
+
+ALTER TABLE tenant.user_sessions RENAME TO refresh_tokens;
+
+DROP FUNCTION IF EXISTS shared.current_user_session_hash();
@@ -0,0 +1,26 @@
+ALTER TABLE tenant.refresh_tokens RENAME TO user_sessions;
+
+ALTER INDEX tenant.idx_refresh_tokens_user_id RENAME TO idx_user_sessions_user_id;
+ALTER INDEX tenant.idx_refresh_tokens_token_hash RENAME TO idx_user_sessions_token_hash;
+ALTER INDEX tenant.refresh_tokens_tenant_id_idx RENAME TO user_sessions_tenant_id_idx;
+
+ALTER POLICY tenant_refresh_token_policy ON tenant.user_sessions
+    RENAME TO tenant_user_session_policy;
+
+CREATE OR REPLACE FUNCTION shared.current_user_session_hash() RETURNS text AS $$
+    SELECT NULLIF(current_setting('papercrate.user_session_hash', true), '')
+$$ LANGUAGE SQL STABLE;
+
+ALTER POLICY tenant_user_session_policy ON tenant.user_sessions
+    USING (
+        tenant_id = shared.current_tenant_id()
+        OR (
+            shared.current_user_session_hash() IS NOT NULL
+            AND token_hash = shared.current_user_session_hash()
+        )
+    );
+
+ALTER POLICY tenant_user_session_policy ON tenant.user_sessions
+    WITH CHECK (tenant_id = shared.current_tenant_id());
+
+DROP FUNCTION IF EXISTS shared.current_refresh_token_hash();
@@ -0,0 +1,21 @@
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'papercrate_app') THEN
+        CREATE ROLE papercrate_app NOLOGIN;
+    END IF;
+
+    IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'papercrate_app_login') THEN
+        CREATE ROLE papercrate_app_login LOGIN PASSWORD 'papercrate_app';
+        GRANT papercrate_app TO papercrate_app_login;
+    END IF;
+END
+$$;
+
+-- Ensure the login role inherits and uses a sensible search path by default
+ALTER ROLE papercrate_app_login INHERIT;
+ALTER ROLE papercrate_app_login SET search_path = 'tenant, shared, public';
+
+GRANT CONNECT ON DATABASE papercrate TO papercrate_app;
+GRANT CONNECT ON DATABASE papercrate TO papercrate_app_login;
+GRANT USAGE ON SCHEMA public TO papercrate_app;
+GRANT USAGE ON SCHEMA public TO papercrate_app_login;
@@ -0,0 +1,339 @@
+use argon2::{
+    password_hash::{PasswordHasher, SaltString},
+    Argon2,
+};
+use chrono::{NaiveDateTime, Utc};
+use diesel::prelude::*;
+use rand::rngs::OsRng;
+use rand::RngCore;
+use uuid::Uuid;
+
+use crate::{
+    error::AppError,
+    models::{ApiToken, ApiTokenCapability, NewApiToken},
+    schema::api_tokens,
+    state::PgPooledConnection,
+    tenants::{apply_api_token_prefix, clear_api_token_prefix},
+};
+
+use crate::schema::api_tokens::dsl as api_tokens_dsl;
+
+const TOKEN_PREFIX_LENGTH: usize = 12;
+const TOKEN_SECRET_LENGTH: usize = 32;
+
+/// Represents a newly issued API token and the raw secret that was generated for it.
+pub struct IssuedApiToken {
+    pub token: String,
+    pub record: ApiToken,
+}
+
+/// Creates a new API token for the supplied user/tenant combination.
+pub fn create_api_token(
+    conn: &mut PgPooledConnection,
+    user_id: Uuid,
+    tenant_id: Uuid,
+    label: Option<String>,
+    expires_at: Option<NaiveDateTime>,
+    capabilities: Vec<ApiTokenCapability>,
+) -> Result<IssuedApiToken, AppError> {
+    let capabilities = normalize_capabilities(capabilities)?;
+
+    let raw_secret = generate_secret()?;
+    let token_prefix = raw_secret[..TOKEN_PREFIX_LENGTH].to_string();
+    let token_hash = hash_secret(&raw_secret)?;
+    let new_token = NewApiToken {
+        id: Uuid::new_v4(),
+        user_id,
+        tenant_id,
+        token_prefix,
+        token_hash,
+        label,
+        expires_at,
+        capabilities,
+    };
+
+    let record = diesel::insert_into(api_tokens::table)
+        .values(&new_token)
+        .get_result::<ApiToken>(conn)?;
+
+    Ok(IssuedApiToken {
+        token: raw_secret,
+        record,
+    })
+}
+
+/// Lists API tokens belonging to a user within an optional tenant scope.
+pub fn list_api_tokens(
+    conn: &mut PgPooledConnection,
+    user_id: Uuid,
+    tenant_id: Option<Uuid>,
+) -> Result<Vec<ApiToken>, AppError> {
+    let mut query = api_tokens::table
+        .filter(api_tokens::user_id.eq(user_id))
+        .into_boxed();
+
+    if let Some(tenant_id) = tenant_id {
+        query = query.filter(api_tokens::tenant_id.eq(tenant_id));
+    }
+
+    let tokens = query
+        .order(api_tokens::created_at.asc())
+        .load::<ApiToken>(conn)?;
+
+    Ok(tokens)
+}
+
+/// Regenerates the secret value for an API token.
+pub fn regenerate_api_token(
+    conn: &mut PgPooledConnection,
+    token_id: Uuid,
+    user_id: Uuid,
+    tenant_id: Option<Uuid>,
+) -> Result<IssuedApiToken, AppError> {
+    let record = find_user_token(conn, token_id, user_id, tenant_id)?;
+
+    if record.revoked_at.is_some() {
+        return Err(AppError::bad_request(
+            "cannot regenerate a revoked API token",
+        ));
+    }
+
+    let raw_secret = generate_secret()?;
+    let token_prefix = raw_secret[..TOKEN_PREFIX_LENGTH].to_string();
+    let token_hash = hash_secret(&raw_secret)?;
+
+    let updated = diesel::update(api_tokens::table.find(record.id))
+        .set((
+            api_tokens::token_prefix.eq(&token_prefix),
+            api_tokens::token_hash.eq(&token_hash),
+            api_tokens::last_used_at.eq::<Option<NaiveDateTime>>(None),
+        ))
+        .get_result::<ApiToken>(conn)?;
+
+    Ok(IssuedApiToken {
+        token: raw_secret,
+        record: updated,
+    })
+}
+
+/// Updates the set of capabilities associated with an API token.
+pub fn update_api_token_capabilities(
+    conn: &mut PgPooledConnection,
+    token_id: Uuid,
+    user_id: Uuid,
+    tenant_id: Option<Uuid>,
+    capabilities: Vec<ApiTokenCapability>,
+) -> Result<ApiToken, AppError> {
+    let capabilities = normalize_capabilities(capabilities)?;
+
+    let token = find_user_token(conn, token_id, user_id, tenant_id)?;
+
+    if token.revoked_at.is_some() {
+        return Err(AppError::bad_request(
+            "cannot modify capabilities of a revoked API token",
+        ));
+    }
+
+    let updated = diesel::update(api_tokens::table.find(token.id))
+        .set(api_tokens::capabilities.eq(capabilities))
+        .get_result::<ApiToken>(conn)?;
+
+    Ok(updated)
+}
+
+/// Attempts to resolve an API token by its secret value while ensuring it provides the
+/// requested capability.
+pub fn find_active_token_by_secret(
+    conn: &mut PgPooledConnection,
+    tenant_id: Option<Uuid>,
+    secret: &str,
+    required_capability: ApiTokenCapability,
+) -> Result<Option<ApiToken>, AppError> {
+    if secret.len() < TOKEN_PREFIX_LENGTH {
+        return Ok(None);
+    }
+
+    let prefix = &secret[..TOKEN_PREFIX_LENGTH];
+    let candidates = with_api_token_prefix(conn, prefix, |conn| {
+        let mut query = api_tokens::table
+            .filter(api_tokens::token_prefix.eq(prefix))
+            .filter(api_tokens::revoked_at.is_null())
+            .into_boxed();
+
+        let now = Utc::now().naive_utc();
+        query = query.filter(
+            api_tokens::expires_at
+                .is_null()
+                .or(api_tokens::expires_at.gt(now)),
+        );
+
+        if let Some(tenant_id) = tenant_id {
+            query = query.filter(api_tokens::tenant_id.eq(tenant_id));
+        }
+
+        query.load::<ApiToken>(conn).map_err(AppError::from)
+    })?;
+
+    for token in candidates {
+        if !token.capabilities.contains(&required_capability) {
+            continue;
+        }
+
+        if verify_token_secret(secret, &token.token_hash)? {
+            return Ok(Some(token));
+        }
+    }
+
+    Ok(None)
+}
+
+/// Revokes an API token belonging to the specified user.
+pub fn revoke_api_token(
+    conn: &mut PgPooledConnection,
+    token_id: Uuid,
+    user_id: Uuid,
+) -> Result<(), AppError> {
+    let token = find_user_token(conn, token_id, user_id, None)?;
+
+    diesel::update(api_tokens::table.find(token.id))
+        .set(api_tokens::revoked_at.eq(Utc::now().naive_utc()))
+        .execute(conn)?;
+
+    Ok(())
+}
+
+/// Updates the last-used timestamp for a token.
+pub fn touch_api_token(conn: &mut PgPooledConnection, token_id: Uuid) -> Result<(), AppError> {
+    diesel::update(api_tokens::table.filter(api_tokens::id.eq(token_id)))
+        .set(api_tokens::last_used_at.eq(Utc::now().naive_utc()))
+        .execute(conn)?;
+    Ok(())
+}
+
+/// Verifies a secret against its stored hash representation.
+pub fn verify_token_secret(secret: &str, token_hash: &str) -> Result<bool, AppError> {
+    crate::auth::password::verify_password(secret, token_hash).map_err(|err| {
+        tracing::error!(error = ?err, "failed to verify token");
+        AppError::internal("failed to verify token")
+    })
+}
+
+fn normalize_capabilities(
+    capabilities: Vec<ApiTokenCapability>,
+) -> Result<Vec<ApiTokenCapability>, AppError> {
+    if capabilities.is_empty() {
+        return Err(AppError::bad_request("at least one capability is required"));
+    }
+
+    let mut unique = Vec::new();
+    for capability in capabilities {
+        if !unique.contains(&capability) {
+            unique.push(capability);
+        }
+    }
+
+    Ok(unique)
+}
+
+fn find_user_token(
+    conn: &mut PgPooledConnection,
+    token_id: Uuid,
+    user_id: Uuid,
+    tenant_id: Option<Uuid>,
+) -> Result<ApiToken, AppError> {
+    let mut query = api_tokens_dsl::api_tokens
+        .filter(api_tokens_dsl::id.eq(token_id))
+        .filter(api_tokens_dsl::user_id.eq(user_id))
+        .into_boxed();
+
+    if let Some(tid) = tenant_id {
+        query = query.filter(api_tokens_dsl::tenant_id.eq(tid));
+    }
+
+    query
+        .first::<ApiToken>(conn)
+        .optional()
+        .map_err(AppError::from)?
+        .ok_or_else(AppError::not_found)
+}
+
+fn with_api_token_prefix<T, F>(
+    conn: &mut PgPooledConnection,
+    prefix: &str,
+    operation: F,
+) -> Result<T, AppError>
+where
+    F: FnOnce(&mut PgPooledConnection) -> Result<T, AppError>,
+{
+    apply_api_token_prefix(conn, prefix)?;
+    let operation_result = operation(conn);
+    let clear_result = clear_api_token_prefix(conn);
+
+    if let Err(err) = clear_result {
+        return Err(err);
+    }
+
+    operation_result
+}
+
+fn generate_secret() -> Result<String, AppError> {
+    let mut buffer = [0u8; TOKEN_SECRET_LENGTH];
+    OsRng.try_fill_bytes(&mut buffer).map_err(|err| {
+        tracing::error!(error = ?err, "failed to generate token");
+        AppError::internal("failed to generate token")
+    })?;
+    Ok(hex::encode(buffer))
+}
+
+fn hash_secret(secret: &str) -> Result<String, AppError> {
+    let salt = SaltString::generate(&mut OsRng);
+    let hash = Argon2::default()
+        .hash_password(secret.as_bytes(), &salt)
+        .map_err(|err| {
+            tracing::error!(error = ?err, "failed to hash token");
+            AppError::internal("failed to hash token")
+        })?;
+    Ok(hash.to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn generated_secret_has_expected_length() {
+        let secret = generate_secret().unwrap();
+        assert_eq!(secret.len(), TOKEN_SECRET_LENGTH * 2);
+    }
+
+    #[test]
+    fn hash_and_verify_secret_round_trip() {
+        let secret = generate_secret().unwrap();
+        let hash = hash_secret(&secret).unwrap();
+        assert!(verify_token_secret(&secret, &hash).unwrap());
+        assert!(!verify_token_secret("wrong", &hash).unwrap());
+    }
+
+    #[test]
+    fn normalize_capabilities_deduplicates() {
+        let caps = normalize_capabilities(vec![
+            ApiTokenCapability::Api,
+            ApiTokenCapability::Webdav,
+            ApiTokenCapability::Api,
+        ])
+        .unwrap();
+        assert_eq!(caps.len(), 2);
+        assert!(caps.contains(&ApiTokenCapability::Api));
+        assert!(caps.contains(&ApiTokenCapability::Webdav));
+    }
+
+    #[test]
+    fn normalize_capabilities_rejects_empty() {
+        assert!(normalize_capabilities(Vec::new()).is_err());
+    }
+
+    #[test]
+    fn prefix_length_is_less_than_secret_length() {
+        assert!(TOKEN_PREFIX_LENGTH < TOKEN_SECRET_LENGTH * 2);
+    }
+}
@@ -17,6 +17,8 @@ pub struct JwtService {
    download_expiry: Duration,
    selector_audience: String,
    selector_expiry: Duration,
+    signup_audience: String,
+    signup_expiry: Duration,
 }

 impl JwtService {
@@ -31,6 +33,8 @@ impl JwtService {
            download_expiry: Duration::minutes(config.download_token_expiry_minutes),
            selector_audience: format!("{}:tenant-selector", config.jwt_audience),
            selector_expiry: Duration::minutes(15),
+            signup_audience: format!("{}:signup", config.jwt_audience),
+            signup_expiry: Duration::minutes(15),
        })
    }

@@ -108,6 +112,35 @@ impl JwtService {
        let data = decode::<TenantSelectionClaims>(token, &self.decoding, &validation)?;
        Ok(data.claims)
    }
+
+    pub fn generate_signup_token(
+        &self,
+        user_id: Uuid,
+        challenge_id: Uuid,
+        username: String,
+    ) -> Result<String> {
+        let now = Utc::now();
+        let exp = now + self.signup_expiry;
+        let claims = SignupClaims {
+            sub: user_id,
+            challenge_id,
+            username,
+            iss: self.issuer.clone(),
+            aud: self.signup_audience.clone(),
+            iat: now.timestamp() as usize,
+            exp: exp.timestamp() as usize,
+        };
+
+        Ok(encode(&Header::default(), &claims, &self.encoding)?)
+    }
+
+    pub fn verify_signup_token(&self, token: &str) -> Result<SignupClaims> {
+        let mut validation = Validation::default();
+        validation.set_audience(&[self.signup_audience.clone()]);
+        validation.set_issuer(&[self.issuer.clone()]);
+        let data = decode::<SignupClaims>(token, &self.decoding, &validation)?;
+        Ok(data.claims)
+    }
 }

 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -140,3 +173,14 @@ pub struct TenantSelectionClaims {
    pub iat: usize,
    pub exp: usize,
 }
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SignupClaims {
+    pub sub: Uuid,
+    pub challenge_id: Uuid,
+    pub username: String,
+    pub iss: String,
+    pub aud: String,
+    pub iat: usize,
+    pub exp: usize,
+}
@@ -1,10 +1,13 @@
+pub mod api_tokens;
 pub mod jwt;
+pub mod passkeys;
 pub mod password;

 use axum::{async_trait, extract::FromRequestParts, http::request::Parts};
 use axum_extra::headers::{authorization::Bearer, Authorization};
 use axum_extra::TypedHeader;
 use serde::{Deserialize, Serialize};
+use utoipa::ToSchema;

 use crate::{
    error::AppError,
@@ -12,7 +15,7 @@ use crate::{
 };
 use uuid::Uuid;

-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
 pub struct AuthenticatedUser {
    pub user_id: uuid::Uuid,
    pub username: String,
@@ -0,0 +1,592 @@
+use std::sync::Arc;
+
+use anyhow::{Context, Result};
+use chrono::{Duration as ChronoDuration, NaiveDateTime, Utc};
+use diesel::{dsl::count_star, prelude::*};
+use serde::{Deserialize, Serialize};
+use utoipa::ToSchema;
+use uuid::Uuid;
+use webauthn_rs::prelude::{Credential, *};
+
+use crate::{
+    config::AppConfig,
+    error::{AppError, AppResult},
+    models::{NewUserPasskey, NewWebauthnChallenge, User, UserPasskey, WebauthnChallenge},
+    schema::{user_passkeys::dsl as passkey_dsl, webauthn_challenges::dsl as challenge_dsl},
+};
+
+const PURPOSE_REGISTRATION: &str = "registration";
+const PURPOSE_AUTHENTICATION: &str = "authentication";
+const DEFAULT_CHALLENGE_TTL_MINUTES: i64 = 10;
+
+#[derive(Clone)]
+pub struct PasskeyService {
+    webauthn: Arc<Webauthn>,
+    challenge_ttl: ChronoDuration,
+}
+
+pub struct PreparedPasskey {
+    pub id: Uuid,
+    pub credential_id: Vec<u8>,
+    pub public_key: Vec<u8>,
+    pub credential: serde_json::Value,
+    pub sign_count: i64,
+    pub transports: Vec<Option<String>>,
+    pub aaguid: Option<Uuid>,
+}
+
+impl PreparedPasskey {
+    pub fn into_new_user_passkey(self, user_id: Uuid, nickname: Option<String>) -> NewUserPasskey {
+        NewUserPasskey {
+            id: self.id,
+            user_id,
+            credential_id: self.credential_id,
+            public_key: self.public_key,
+            credential: self.credential,
+            sign_count: self.sign_count,
+            transports: self.transports,
+            aaguid: self.aaguid,
+            nickname,
+        }
+    }
+}
+
+#[derive(Debug, Serialize, Deserialize, ToSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct RegistrationChallengeResponse {
+    pub challenge_id: Uuid,
+    #[serde(flatten)]
+    #[schema(value_type = Object)]
+    pub challenge: CreationChallengeResponse,
+}
+
+#[derive(Debug, Serialize, Deserialize, ToSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct AuthenticationChallengeResponse {
+    pub challenge_id: Uuid,
+    #[serde(flatten)]
+    #[schema(value_type = Object)]
+    pub challenge: RequestChallengeResponse,
+}
+
+#[derive(Debug, Serialize, Deserialize, ToSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct PasskeySummary {
+    pub id: Uuid,
+    pub nickname: Option<String>,
+    pub created_at: NaiveDateTime,
+    pub last_used_at: Option<NaiveDateTime>,
+    pub transports: Vec<String>,
+    pub revoked_at: Option<NaiveDateTime>,
+    pub revoked_reason: Option<String>,
+}
+
+impl PasskeyService {
+    pub fn try_new(config: &AppConfig) -> Result<Option<Self>> {
+        let rp_id = match config.webauthn_rp_id.as_deref().map(str::trim) {
+            Some(rp_id) if !rp_id.is_empty() => rp_id,
+            _ => return Ok(None),
+        };
+        let rp_origin = match config.webauthn_origin.as_ref().map(|s| s.trim()) {
+            Some(origin) if !origin.is_empty() => origin,
+            _ => return Ok(None),
+        };
+
+        let origin = Url::parse(rp_origin).context("invalid webauthn_origin")?;
+
+        let builder = WebauthnBuilder::new(rp_id, &origin)
+            .context("failed to initialise WebAuthn builder")?
+            .rp_name(&config.webauthn_rp_name)
+            .allow_subdomains(false)
+            .allow_any_port(false);
+
+        let webauthn = builder
+            .build()
+            .context("failed to build WebAuthn instance")?;
+
+        Ok(Some(Self {
+            webauthn: Arc::new(webauthn),
+            challenge_ttl: ChronoDuration::minutes(DEFAULT_CHALLENGE_TTL_MINUTES),
+        }))
+    }
+
+    fn prune_expired(&self, conn: &mut PgConnection) {
+        let now = Utc::now().naive_utc();
+        let _ = diesel::delete(
+            challenge_dsl::webauthn_challenges.filter(challenge_dsl::expires_at.le(now)),
+        )
+        .execute(conn);
+    }
+
+    fn begin_registration(
+        &self,
+        conn: &mut PgConnection,
+        user_id: Uuid,
+        username: &str,
+        challenge_user_id: Option<Uuid>,
+        exclude: Option<Vec<CredentialID>>,
+    ) -> AppResult<RegistrationChallengeResponse> {
+        self.prune_expired(conn);
+
+        let (challenge, state) = self
+            .webauthn
+            .start_passkey_registration(user_id, username, username, exclude)
+            .map_err(|err| {
+                tracing::error!(error = %err, "failed to start passkey registration");
+                AppError::internal("failed to start passkey registration")
+            })?;
+
+        let challenge_id = Uuid::new_v4();
+        let expires_at = (Utc::now() + self.challenge_ttl).naive_utc();
+        let challenge_bytes: Vec<u8> = challenge.public_key.challenge.clone().into();
+        let state_bytes = serde_json::to_vec(&state)
+            .context("failed to encode passkey registration state")
+            .map_err(AppError::internal)?;
+
+        let record = NewWebauthnChallenge {
+            id: challenge_id,
+            user_id: challenge_user_id,
+            purpose: PURPOSE_REGISTRATION.to_string(),
+            challenge: challenge_bytes,
+            state: state_bytes,
+            expires_at,
+        };
+
+        diesel::insert_into(challenge_dsl::webauthn_challenges)
+            .values(&record)
+            .execute(conn)?;
+
+        Ok(RegistrationChallengeResponse {
+            challenge_id,
+            challenge,
+        })
+    }
+
+    pub fn start_registration(
+        &self,
+        conn: &mut PgConnection,
+        user: &User,
+    ) -> AppResult<RegistrationChallengeResponse> {
+        let existing: Vec<UserPasskey> = passkey_dsl::user_passkeys
+            .filter(passkey_dsl::user_id.eq(user.id))
+            .filter(passkey_dsl::revoked_at.is_null())
+            .load(conn)?;
+
+        let exclude = if existing.is_empty() {
+            None
+        } else {
+            Some(
+                existing
+                    .iter()
+                    .map(|pk| CredentialID::from(pk.credential_id.clone()))
+                    .collect(),
+            )
+        };
+
+        self.begin_registration(conn, user.id, &user.username, Some(user.id), exclude)
+    }
+
+    pub fn start_signup_registration(
+        &self,
+        conn: &mut PgConnection,
+        user_id: Uuid,
+        username: &str,
+    ) -> AppResult<RegistrationChallengeResponse> {
+        self.begin_registration(conn, user_id, username, None, None)
+    }
+
+    fn complete_registration(
+        &self,
+        conn: &mut PgConnection,
+        challenge_id: Uuid,
+        credential: &RegisterPublicKeyCredential,
+        expected_user: Option<Uuid>,
+    ) -> AppResult<PreparedPasskey> {
+        let record: WebauthnChallenge = challenge_dsl::webauthn_challenges
+            .find(challenge_id)
+            .first(conn)
+            .map_err(|err| {
+                if matches!(err, diesel::result::Error::NotFound) {
+                    AppError::bad_request("challenge not found")
+                } else {
+                    AppError::from(err)
+                }
+            })?;
+
+        if record.purpose != PURPOSE_REGISTRATION {
+            return Err(AppError::bad_request("challenge is not for registration"));
+        }
+
+        if let Some(expected) = expected_user {
+            if record.user_id != Some(expected) {
+                return Err(AppError::unauthorized());
+            }
+        } else if record.user_id.is_some() {
+            return Err(AppError::bad_request(
+                "unexpected user context for signup registration",
+            ));
+        }
+
+        if record.expires_at < Utc::now().naive_utc() {
+            diesel::delete(challenge_dsl::webauthn_challenges.find(challenge_id)).execute(conn)?;
+            return Err(AppError::bad_request("challenge expired"));
+        }
+
+        let state: PasskeyRegistration = serde_json::from_slice(&record.state)
+            .context("failed to decode registration state")
+            .map_err(AppError::internal)?;
+
+        let passkey = self
+            .webauthn
+            .finish_passkey_registration(credential, &state)
+            .map_err(|err| {
+                tracing::warn!(error = %err, "passkey registration validation failed");
+                AppError::bad_request("invalid passkey attestation")
+            })?;
+
+        let credential_struct: Credential = passkey.clone().into();
+        let credential_id_vec: Vec<u8> = credential_struct.cred_id.clone().into();
+
+        let duplicate = passkey_dsl::user_passkeys
+            .filter(passkey_dsl::credential_id.eq(&credential_id_vec))
+            .first::<UserPasskey>(conn)
+            .optional()?;
+        if duplicate.is_some() {
+            diesel::delete(challenge_dsl::webauthn_challenges.find(challenge_id)).execute(conn)?;
+            return Err(AppError::conflict("credential already registered"));
+        }
+
+        let public_key_bytes = serde_cbor_2::to_vec(&credential_struct.cred)
+            .context("failed to encode credential public key")
+            .map_err(AppError::internal)?;
+
+        let transports: Vec<Option<String>> = credential_struct
+            .transports
+            .clone()
+            .unwrap_or_default()
+            .into_iter()
+            .map(|transport| Some(transport.as_ref().to_string()))
+            .collect();
+
+        let aaguid = match credential_struct.attestation.metadata {
+            AttestationMetadata::Packed { aaguid } | AttestationMetadata::Tpm { aaguid, .. } => {
+                Some(aaguid)
+            }
+            _ => None,
+        };
+
+        let credential_json = serde_json::to_value(&passkey)
+            .context("failed to serialise passkey")
+            .map_err(AppError::internal)?;
+
+        diesel::delete(challenge_dsl::webauthn_challenges.find(challenge_id)).execute(conn)?;
+
+        Ok(PreparedPasskey {
+            id: Uuid::new_v4(),
+            credential_id: credential_id_vec,
+            public_key: public_key_bytes,
+            credential: credential_json,
+            sign_count: credential_struct.counter as i64,
+            transports,
+            aaguid,
+        })
+    }
+
+    pub fn finish_registration(
+        &self,
+        conn: &mut PgConnection,
+        user: &User,
+        challenge_id: Uuid,
+        credential: RegisterPublicKeyCredential,
+        nickname: Option<String>,
+    ) -> AppResult<UserPasskey> {
+        let prepared =
+            self.complete_registration(conn, challenge_id, &credential, Some(user.id))?;
+
+        let new_passkey = prepared.into_new_user_passkey(user.id, nickname);
+
+        diesel::insert_into(passkey_dsl::user_passkeys)
+            .values(&new_passkey)
+            .execute(conn)?;
+
+        let created: UserPasskey = passkey_dsl::user_passkeys
+            .find(new_passkey.id)
+            .select(UserPasskey::as_select())
+            .first(conn)?;
+
+        Ok(created)
+    }
+
+    pub fn start_authentication(
+        &self,
+        conn: &mut PgConnection,
+        user: &User,
+    ) -> AppResult<AuthenticationChallengeResponse> {
+        self.prune_expired(conn);
+
+        let stored: Vec<UserPasskey> = passkey_dsl::user_passkeys
+            .filter(passkey_dsl::user_id.eq(user.id))
+            .filter(passkey_dsl::revoked_at.is_null())
+            .select(UserPasskey::as_select())
+            .load(conn)?;
+
+        if stored.is_empty() {
+            return Err(AppError::bad_request("no passkeys registered"));
+        }
+
+        let mut passkeys = Vec::with_capacity(stored.len());
+        for pk in &stored {
+            let passkey: Passkey = serde_json::from_value(pk.credential.clone())
+                .context("failed to parse stored passkey")
+                .map_err(AppError::internal)?;
+            passkeys.push(passkey);
+        }
+
+        let (challenge, state) = self
+            .webauthn
+            .start_passkey_authentication(&passkeys)
+            .map_err(|err| {
+                tracing::error!(error = %err, "failed to start passkey authentication");
+                AppError::internal("failed to start passkey authentication")
+            })?;
+
+        let challenge_id = Uuid::new_v4();
+        let expires_at = (Utc::now() + self.challenge_ttl).naive_utc();
+        let challenge_bytes: Vec<u8> = challenge.public_key.challenge.clone().into();
+        let state_bytes = serde_json::to_vec(&state)
+            .context("failed to encode authentication state")
+            .map_err(AppError::internal)?;
+
+        let record = NewWebauthnChallenge {
+            id: challenge_id,
+            user_id: Some(user.id),
+            purpose: PURPOSE_AUTHENTICATION.to_string(),
+            challenge: challenge_bytes,
+            state: state_bytes,
+            expires_at,
+        };
+
+        diesel::insert_into(challenge_dsl::webauthn_challenges)
+            .values(&record)
+            .execute(conn)?;
+
+        Ok(AuthenticationChallengeResponse {
+            challenge_id,
+            challenge,
+        })
+    }
+
+    pub fn list_for_user(
+        &self,
+        conn: &mut PgConnection,
+        user_id: Uuid,
+    ) -> AppResult<Vec<PasskeySummary>> {
+        let passkeys: Vec<UserPasskey> = passkey_dsl::user_passkeys
+            .filter(passkey_dsl::user_id.eq(user_id))
+            .order(passkey_dsl::created_at.asc())
+            .select(UserPasskey::as_select())
+            .load(conn)?;
+
+        Ok(passkeys.into_iter().map(PasskeySummary::from).collect())
+    }
+
+    pub fn active_passkey_count(&self, conn: &mut PgConnection, user_id: Uuid) -> AppResult<i64> {
+        let count: i64 = passkey_dsl::user_passkeys
+            .filter(passkey_dsl::user_id.eq(user_id))
+            .filter(passkey_dsl::revoked_at.is_null())
+            .select(count_star())
+            .first(conn)?;
+        Ok(count)
+    }
+
+    pub fn consume_signup_challenge(
+        &self,
+        conn: &mut PgConnection,
+        challenge_id: Uuid,
+        credential: &RegisterPublicKeyCredential,
+    ) -> AppResult<PreparedPasskey> {
+        self.complete_registration(conn, challenge_id, credential, None)
+    }
+
+    pub fn revoke_passkey(
+        &self,
+        conn: &mut PgConnection,
+        user_id: Uuid,
+        passkey_id: Uuid,
+        reason: Option<String>,
+    ) -> AppResult<()> {
+        let now = Utc::now().naive_utc();
+        let updated = diesel::update(
+            passkey_dsl::user_passkeys
+                .filter(passkey_dsl::id.eq(passkey_id))
+                .filter(passkey_dsl::user_id.eq(user_id))
+                .filter(passkey_dsl::revoked_at.is_null()),
+        )
+        .set((
+            passkey_dsl::revoked_at.eq(Some(now)),
+            passkey_dsl::revoked_reason.eq(reason),
+            passkey_dsl::updated_at.eq(now),
+        ))
+        .execute(conn)?;
+
+        if updated == 0 {
+            return Err(AppError::not_found());
+        }
+
+        Ok(())
+    }
+
+    pub fn finish_authentication(
+        &self,
+        conn: &mut PgConnection,
+        challenge_id: Uuid,
+        credential: PublicKeyCredential,
+    ) -> AppResult<(User, UserPasskey, AuthenticationResult)> {
+        let record: WebauthnChallenge = challenge_dsl::webauthn_challenges
+            .find(challenge_id)
+            .first(conn)
+            .map_err(|err| {
+                if matches!(err, diesel::result::Error::NotFound) {
+                    AppError::bad_request("challenge not found")
+                } else {
+                    AppError::from(err)
+                }
+            })?;
+
+        if record.purpose != PURPOSE_AUTHENTICATION {
+            return Err(AppError::bad_request("challenge is not for authentication"));
+        }
+
+        let user_id = record
+            .user_id
+            .ok_or_else(|| AppError::bad_request("challenge missing user context"))?;
+
+        if record.expires_at < Utc::now().naive_utc() {
+            diesel::delete(challenge_dsl::webauthn_challenges.find(challenge_id)).execute(conn)?;
+            return Err(AppError::bad_request("challenge expired"));
+        }
+
+        let state: PasskeyAuthentication = serde_json::from_slice(&record.state)
+            .context("failed to decode authentication state")
+            .map_err(AppError::internal)?;
+
+        let auth_result = self
+            .webauthn
+            .finish_passkey_authentication(&credential, &state)
+            .map_err(|err| {
+                tracing::warn!(error = %err, "passkey authentication failed");
+                AppError::unauthorized()
+            })?;
+
+        let credential_id_vec: Vec<u8> = auth_result.cred_id().clone().into();
+
+        let mut passkey: UserPasskey = passkey_dsl::user_passkeys
+            .filter(passkey_dsl::user_id.eq(user_id))
+            .filter(passkey_dsl::credential_id.eq(&credential_id_vec))
+            .filter(passkey_dsl::revoked_at.is_null())
+            .select(UserPasskey::as_select())
+            .first(conn)
+            .map_err(|err| {
+                if matches!(err, diesel::result::Error::NotFound) {
+                    AppError::unauthorized()
+                } else {
+                    AppError::from(err)
+                }
+            })?;
+
+        let mut passkey_model: Passkey = serde_json::from_value(passkey.credential.clone())
+            .context("failed to parse stored passkey")
+            .map_err(AppError::internal)?;
+
+        if auth_result.needs_update() {
+            let _ = passkey_model.update_credential(&auth_result);
+        }
+
+        let credential_struct: Credential = passkey_model.clone().into();
+        let public_key_bytes = serde_cbor_2::to_vec(&credential_struct.cred)
+            .context("failed to encode credential public key")
+            .map_err(AppError::internal)?;
+
+        let transports: Vec<Option<String>> = credential_struct
+            .transports
+            .clone()
+            .unwrap_or_default()
+            .into_iter()
+            .map(|transport| Some(transport.as_ref().to_string()))
+            .collect();
+
+        let credential_json = serde_json::to_value(&passkey_model)
+            .context("failed to serialise passkey")
+            .map_err(AppError::internal)?;
+
+        let now = Utc::now().naive_utc();
+        diesel::update(passkey_dsl::user_passkeys.find(passkey.id))
+            .set((
+                passkey_dsl::sign_count.eq(auth_result.counter() as i64),
+                passkey_dsl::transports.eq(&transports),
+                passkey_dsl::credential.eq(credential_json.clone()),
+                passkey_dsl::public_key.eq(public_key_bytes),
+                passkey_dsl::last_used_at.eq(Some(now)),
+                passkey_dsl::updated_at.eq(now),
+            ))
+            .execute(conn)?;
+
+        passkey.sign_count = auth_result.counter() as i64;
+        passkey.transports = transports;
+        passkey.credential = credential_json;
+        passkey.last_used_at = Some(now);
+        passkey.updated_at = now;
+
+        diesel::delete(challenge_dsl::webauthn_challenges.find(challenge_id)).execute(conn)?;
+
+        let user = crate::schema::users::table
+            .find(user_id)
+            .first::<User>(conn)?;
+
+        Ok((user, passkey, auth_result))
+    }
+}
+
+impl From<UserPasskey> for PasskeySummary {
+    fn from(passkey: UserPasskey) -> Self {
+        let transports = passkey
+            .transports
+            .into_iter()
+            .filter_map(|value| value)
+            .collect();
+
+        Self {
+            id: passkey.id,
+            nickname: passkey.nickname,
+            created_at: passkey.created_at,
+            last_used_at: passkey.last_used_at,
+            transports,
+            revoked_at: passkey.revoked_at,
+            revoked_reason: passkey.revoked_reason,
+        }
+    }
+}
+
+#[derive(Debug, Serialize, Deserialize, ToSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct PasskeyRegistrationFinishPayload {
+    pub challenge_id: Uuid,
+    #[schema(value_type = Object)]
+    pub credential: RegisterPublicKeyCredential,
+    #[serde(default)]
+    pub nickname: Option<String>,
+}
+
+#[derive(Debug, Serialize, Deserialize, ToSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct PasskeyLoginStartPayload {
+    pub username: String,
+}
+
+#[derive(Debug, Serialize, Deserialize, ToSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct PasskeyLoginFinishPayload {
+    pub challenge_id: Uuid,
+    #[schema(value_type = Object)]
+    pub credential: PublicKeyCredential,
+}
@@ -1,8 +1,9 @@
 use anyhow::{anyhow, Result};
 use argon2::{
-    password_hash::{PasswordHash, PasswordVerifier},
+    password_hash::{PasswordHash, PasswordHasher, PasswordVerifier, SaltString},
    Argon2,
 };
+use rand::rngs::OsRng;

 pub fn verify_password(password: &str, password_hash: &str) -> Result<bool> {
    let parsed_hash = PasswordHash::new(password_hash).map_err(|err| anyhow!(err))?;
@@ -10,3 +11,11 @@ pub fn verify_password(password: &str, password_hash: &str) -> Result<bool> {
        .verify_password(password.as_bytes(), &parsed_hash)
        .is_ok())
 }
+
+pub fn hash_password(password: &str) -> Result<String> {
+    let salt = SaltString::generate(&mut OsRng);
+    let hash = Argon2::default()
+        .hash_password(password.as_bytes(), &salt)
+        .map_err(|err| anyhow!(err))?;
+    Ok(hash.to_string())
+}
@@ -1,164 +1,112 @@
-use std::env;
 use std::sync::Arc;

 use anyhow::{anyhow, bail, Context, Result};
-use argon2::{
-    password_hash::{PasswordHasher, SaltString},
-    Argon2,
-};
+use chrono::{Duration as ChronoDuration, Utc};
+use clap::{Parser, Subcommand, ValueEnum};
 use diesel::{dsl::exists, prelude::*, select};
-use once_cell::sync::Lazy;
+use rand::{rngs::OsRng, RngCore};
 use reqwest::{Client, Method, StatusCode};
-use serde_json::json;
+use sha2::{Digest, Sha256};
 use uuid::Uuid;

-use backend::{
+use papercrate::{
    config::AppConfig,
    db::{self, PgPool},
+    documents::search::ensure_quickwit_index,
    jobs::{enqueue_job, JOB_ANALYZE_DOCUMENT},
-    models::{DocumentAsset, DocumentAssetObject, NewUser, NewUserMembership, Tenant, User},
+    models::{
+        DocumentAsset, DocumentAssetObject, MagicToken, MagicTokenKind, NewUser, NewUserMembership,
+        Tenant, TenantStatus, User,
+    },
    s3,
    schema::{
-        document_asset_objects, document_assets, documents, tenants, user_memberships, users,
+        document_asset_objects, document_assets, documents, magic_tokens, tenants,
+        user_memberships, users,
    },
    storage::{ObjectStorage, S3Storage, TenantStorage},
+    tenants::TenantService,
    utils::tracing::init_tracing,
 };

-use rand::rngs::OsRng;
+#[derive(Parser)]
+#[command(
+    name = "papercrate-admin",
+    version,
+    about = "Papercrate administration utility"
+)]
+struct Cli {
+    #[command(subcommand)]
+    command: Command,
+}

-static QUICKWIT_INDEX_TEMPLATE: Lazy<serde_json::Value> = Lazy::new(|| {
-    json!({
-        "version": "0.8",
-        "index_id": "documents",
-        "doc_mapping": {
-            "tokenizers": [
-                {
-                    "name": "substring",
-                    "type": "ngram",
-                    "min_gram": 2,
-                    "max_gram": 20,
-                    "prefix_only": false
-                }
-            ],
-            "field_mappings": [
-                { "name": "tenant_id", "type": "text", "stored": true },
-                { "name": "document_id", "type": "text", "stored": true },
-                { "name": "version_id", "type": "text", "stored": true },
-                { "name": "title", "type": "text", "tokenizer": "substring", "stored": true },
-                { "name": "text", "type": "text", "tokenizer": "substring", "record": "position" }
-            ]
-        },
-        "search_settings": {
-            "default_search_fields": ["title", "text"]
-        }
-    })
-});
-
-#[derive(Debug)]
+#[derive(Subcommand)]
 enum Command {
    CreateUser {
        username: String,
-        password: String,
-    },
-    SetPassword {
-        username: String,
-        password: String,
    },
    ListUsers,
    DeleteUser {
        username: String,
    },
    CreateTenant {
-        slug: String,
+        name: String,
+        #[arg(long = "storage-root")]
        storage_root: Option<String>,
+        #[arg(long = "quickwit-index")]
        quickwit_index: Option<String>,
    },
    DeleteTenant {
-        slug: String,
+        tenant_id: Uuid,
    },
    AddUserToTenant {
        username: String,
-        slug: String,
-        role: Option<String>,
+        tenant_id: Uuid,
    },
    RemoveUserFromTenant {
        username: String,
-        slug: String,
+        tenant_id: Uuid,
    },
    ReanalyzeDocuments {
-        slug: String,
+        tenant_id: Uuid,
    },
    ListTenants,
-    DeleteAssets(String),
-    QuickwitCreate(String),
-    QuickwitDelete(String),
+    DeleteAssets {
+        tenant_id: Uuid,
+    },
+    QuickwitCreate {
+        tenant_id: Uuid,
+    },
+    QuickwitDelete {
+        tenant_id: Uuid,
+    },
+    MagicToken {
+        username: String,
+        #[arg(long = "ttl-minutes", default_value_t = 10)]
+        ttl_minutes: i64,
+        #[arg(
+            long = "max-uses",
+            value_name = "MAX_USES",
+            help = "Maximum number of uses before the token is rejected (default: unlimited)"
+        )]
+        max_uses: Option<i32>,
+        #[arg(long = "kind", value_enum, default_value_t = MagicTokenKindArg::EmailLogin)]
+        kind: MagicTokenKindArg,
+    },
 }

-impl Command {
-    fn usage() -> &'static str {
-        "Usage: admin\n\
-            create-user <username> <password>\n\
-            set-password <username> <password>\n\
-            list-users\n\
-            delete-user <username>\n\
-            create-tenant <slug> [storage_root] [quickwit_index]\n\
-            delete-tenant <slug>\n\
-            add-user-to-tenant <username> <slug> [role]\n\
-            remove-user-from-tenant <username> <slug>\n\
-            reanalyze-documents <slug>\n\
-            list-tenants\n\
-            delete-assets <slug>\n\
-            quickwit-create-index <slug>\n\
-            quickwit-delete-index <slug>"
-    }
+#[derive(Copy, Clone, Debug, ValueEnum)]
+enum MagicTokenKindArg {
+    #[value(name = "email_login")]
+    EmailLogin,
+    #[value(name = "demo_login")]
+    DemoLogin,
+}

-    fn parse() -> Result<Self> {
-        let mut args = env::args().skip(1);
-        match args.next().as_deref() {
-            Some("create-user") => Ok(Self::CreateUser {
-                username: args.next().ok_or_else(|| anyhow!("username required"))?,
-                password: args.next().ok_or_else(|| anyhow!("password required"))?,
-            }),
-            Some("set-password") => Ok(Self::SetPassword {
-                username: args.next().ok_or_else(|| anyhow!("username required"))?,
-                password: args.next().ok_or_else(|| anyhow!("password required"))?,
-            }),
-            Some("list-users") => Ok(Self::ListUsers),
-            Some("delete-user") => Ok(Self::DeleteUser {
-                username: args.next().ok_or_else(|| anyhow!("username required"))?,
-            }),
-            Some("create-tenant") => Ok(Self::CreateTenant {
-                slug: args.next().ok_or_else(|| anyhow!("tenant slug required"))?,
-                storage_root: args.next(),
-                quickwit_index: args.next(),
-            }),
-            Some("delete-tenant") => Ok(Self::DeleteTenant {
-                slug: args.next().ok_or_else(|| anyhow!("tenant slug required"))?,
-            }),
-            Some("add-user-to-tenant") => Ok(Self::AddUserToTenant {
-                username: args.next().ok_or_else(|| anyhow!("username required"))?,
-                slug: args.next().ok_or_else(|| anyhow!("tenant slug required"))?,
-                role: args.next(),
-            }),
-            Some("remove-user-from-tenant") => Ok(Self::RemoveUserFromTenant {
-                username: args.next().ok_or_else(|| anyhow!("username required"))?,
-                slug: args.next().ok_or_else(|| anyhow!("tenant slug required"))?,
-            }),
-            Some("reanalyze-documents") => Ok(Self::ReanalyzeDocuments {
-                slug: args.next().ok_or_else(|| anyhow!("tenant slug required"))?,
-            }),
-            Some("list-tenants") => Ok(Self::ListTenants),
-            Some("delete-assets") => Ok(Self::DeleteAssets(
-                args.next().ok_or_else(|| anyhow!("tenant slug required"))?,
-            )),
-            Some("quickwit-create-index") => Ok(Self::QuickwitCreate(
-                args.next().ok_or_else(|| anyhow!("tenant slug required"))?,
-            )),
-            Some("quickwit-delete-index") => Ok(Self::QuickwitDelete(
-                args.next().ok_or_else(|| anyhow!("tenant slug required"))?,
-            )),
-            _ => Err(anyhow!(Self::usage())),
+impl From<MagicTokenKindArg> for MagicTokenKind {
+    fn from(value: MagicTokenKindArg) -> Self {
+        match value {
+            MagicTokenKindArg::EmailLogin => MagicTokenKind::EmailLogin,
+            MagicTokenKindArg::DemoLogin => MagicTokenKind::DemoLogin,
        }
    }
 }
@@ -166,50 +114,56 @@ impl Command {
 #[tokio::main]
 async fn main() -> Result<()> {
    init_tracing("info");
-    let command = Command::parse()?;
+    let cli = Cli::parse();
    let config = AppConfig::load_and_log("admin")?;
    let pool = db::init_pool_with_size(&config.database_url, config.database_max_pool_size)?;

-    match command {
-        Command::CreateUser { username, password } => create_user(&pool, &username, &password)?,
-        Command::SetPassword { username, password } => set_password(&pool, &username, &password)?,
+    match cli.command {
+        Command::CreateUser { username } => create_user(&pool, &username)?,
        Command::ListUsers => list_users(&pool)?,
        Command::DeleteUser { username } => delete_user(&pool, &username)?,
        Command::CreateTenant {
-            slug,
+            name,
            storage_root,
            quickwit_index,
-        } => create_tenant(&pool, &slug, storage_root, quickwit_index)?,
-        Command::DeleteTenant { slug } => delete_tenant(&pool, &slug)?,
+        } => create_tenant(&pool, &name, storage_root, quickwit_index)?,
+        Command::DeleteTenant { tenant_id } => delete_tenant(&pool, tenant_id)?,
        Command::AddUserToTenant {
            username,
-            slug,
-            role,
-        } => add_user_to_tenant(&pool, &username, &slug, role.as_deref())?,
-        Command::RemoveUserFromTenant { username, slug } => {
-            remove_user_from_tenant(&pool, &username, &slug)?
-        }
-        Command::ReanalyzeDocuments { slug } => reanalyze_documents(&pool, &slug)?,
+            tenant_id,
+        } => add_user_to_tenant(&pool, &username, tenant_id)?,
+        Command::RemoveUserFromTenant {
+            username,
+            tenant_id,
+        } => remove_user_from_tenant(&pool, &username, tenant_id)?,
+        Command::ReanalyzeDocuments { tenant_id } => reanalyze_documents(&pool, tenant_id)?,
        Command::ListTenants => list_tenants(&pool)?,
-        Command::DeleteAssets(slug) => delete_assets_for_tenant(&config, &pool, &slug).await?,
-        Command::QuickwitCreate(slug) => {
-            quickwit_index(&config, &pool, &slug, Method::POST).await?
+        Command::DeleteAssets { tenant_id } => {
+            delete_assets_for_tenant(&config, &pool, tenant_id).await?
        }
-        Command::QuickwitDelete(slug) => {
-            quickwit_index(&config, &pool, &slug, Method::DELETE).await?
+        Command::QuickwitCreate { tenant_id } => {
+            quickwit_index(&config, &pool, tenant_id, Method::POST).await?
+        }
+        Command::QuickwitDelete { tenant_id } => {
+            quickwit_index(&config, &pool, tenant_id, Method::DELETE).await?
+        }
+        Command::MagicToken {
+            username,
+            ttl_minutes,
+            max_uses,
+            kind,
+        } => {
+            create_magic_token(&pool, &username, ttl_minutes, max_uses, kind.into())?;
        }
    }

    Ok(())
 }

-fn create_user(pool: &PgPool, username: &str, password: &str) -> Result<()> {
+fn create_user(pool: &PgPool, username: &str) -> Result<()> {
    if username.trim().is_empty() {
        bail!("username must not be empty");
    }
-    if password.is_empty() {
-        bail!("password must not be empty");
-    }

    let mut conn = pool.get().context("failed to get database connection")?;
    let exists: bool =
@@ -218,11 +172,9 @@ fn create_user(pool: &PgPool, username: &str, password: &str) -> Result<()> {
        bail!("user '{}' already exists", username);
    }

-    let password_hash = hash_password(password)?;
    let new_user = NewUser {
        id: Uuid::new_v4(),
        username: username.to_string(),
-        password_hash,
    };

    diesel::insert_into(users::table)
@@ -233,34 +185,6 @@ fn create_user(pool: &PgPool, username: &str, password: &str) -> Result<()> {
    Ok(())
 }

-fn set_password(pool: &PgPool, username: &str, password: &str) -> Result<()> {
-    if password.is_empty() {
-        bail!("password must not be empty");
-    }
-
-    let mut conn = pool.get().context("failed to get database connection")?;
-    let password_hash = hash_password(password)?;
-
-    let updated = diesel::update(users::table.filter(users::username.eq(username)))
-        .set(users::password_hash.eq(password_hash))
-        .execute(&mut conn)?;
-
-    if updated == 0 {
-        bail!("user '{}' not found", username);
-    }
-
-    println!("updated password for '{}'", username);
-    Ok(())
-}
-
-fn hash_password(password: &str) -> Result<String> {
-    let salt = SaltString::generate(&mut OsRng);
-    let hash = Argon2::default()
-        .hash_password(password.as_bytes(), &salt)
-        .map_err(|err| anyhow!(err))?;
-    Ok(hash.to_string())
-}
-
 fn list_users(pool: &PgPool) -> Result<()> {
    let mut conn = pool.get().context("failed to get database connection")?;

@@ -271,21 +195,22 @@ fn list_users(pool: &PgPool) -> Result<()> {
    }

    for user in users_list {
-        let memberships: Vec<(Uuid, String, String)> = user_memberships::table
+        let memberships: Vec<String> = user_memberships::table
            .inner_join(tenants::table)
            .filter(user_memberships::user_id.eq(user.id))
-            .select((tenants::id, tenants::slug, user_memberships::role))
-            .order((tenants::slug.asc(), user_memberships::role.asc()))
+            .select(tenants::name)
+            .order(tenants::name.asc())
            .load(&mut conn)?;

        if memberships.is_empty() {
            println!("{} ({})", user.username, user.id);
        } else {
-            let details: Vec<String> = memberships
-                .into_iter()
-                .map(|(_, slug, role)| format!("{}: {}", slug, role))
-                .collect();
-            println!("{} ({}) -> {}", user.username, user.id, details.join(", "));
+            println!(
+                "{} ({}) -> {}",
+                user.username,
+                user.id,
+                memberships.join(", ")
+            );
        }
    }

@@ -311,77 +236,119 @@ fn delete_user(pool: &PgPool, username: &str) -> Result<()> {

 fn create_tenant(
    pool: &PgPool,
-    slug: &str,
+    name: &str,
    storage_root_arg: Option<String>,
    quickwit_index_arg: Option<String>,
 ) -> Result<()> {
-    if slug.trim().is_empty() {
-        bail!("tenant slug must not be empty");
-    }
+    let service = TenantService::new(pool.clone());
+    let tenant = service
+        .create_tenant(
+            name,
+            storage_root_arg.as_deref(),
+            quickwit_index_arg.as_deref(),
+            TenantStatus::Creating,
+            &[],
+            None,
+        )
+        .map_err(|err| anyhow!(format!("{err:?}")))?;

-    let mut conn = pool.get().context("failed to get database connection")?;
-    let exists: bool =
-        select(exists(tenants::table.filter(tenants::slug.eq(slug)))).get_result(&mut conn)?;
-    if exists {
-        bail!("tenant '{}' already exists", slug);
-    }
-
-    let id = Uuid::new_v4();
-    let storage_root = storage_root_arg
-        .map(|mut s| {
-            if s.is_empty() {
-                format!("tenants/{}/", id)
-            } else {
-                if !s.ends_with('/') {
-                    s.push('/');
-                }
-                s
-            }
-        })
-        .unwrap_or_else(|| format!("tenants/{}/", id));
-    let quickwit_index = quickwit_index_arg.unwrap_or_else(|| format!("documents-{}", id));
-
-    diesel::insert_into(tenants::table)
-        .values((
-            tenants::id.eq(id),
-            tenants::slug.eq(slug),
-            tenants::storage_root.eq(Some(storage_root.clone())),
-            tenants::quickwit_index.eq(Some(quickwit_index.clone())),
-            tenants::status.eq("active"),
-            tenants::config.eq(serde_json::json!({})),
-        ))
-        .execute(&mut conn)?;
+    let storage_root = tenant.storage_root.as_deref().unwrap_or("<none>");
+    let quickwit_index = tenant.quickwit_index.as_deref().unwrap_or("<none>");

    println!(
-        "created tenant '{}' with id {}, storage_root '{}', quickwit_index '{}'",
-        slug, id, storage_root, quickwit_index
+        "created tenant '{}' with id {}, storage_root '{}', quickwit_index '{}', status '{}'",
+        tenant.name,
+        tenant.id,
+        storage_root,
+        quickwit_index,
+        tenant.status.as_str()
    );
    Ok(())
 }

-fn delete_tenant(pool: &PgPool, slug: &str) -> Result<()> {
+fn create_magic_token(
+    pool: &PgPool,
+    username: &str,
+    ttl_minutes: i64,
+    max_uses: Option<i32>,
+    kind: MagicTokenKind,
+) -> Result<()> {
+    let mut conn = pool.get().context("failed to get database connection")?;
+
+    let user: User = users::table
+        .filter(users::username.eq(username))
+        .first(&mut conn)
+        .with_context(|| format!("user '{}' not found", username))?;
+
+    let raw_token = generate_random_token();
+    let token_hash = hash_token(&raw_token);
+    let expires_at = Utc::now() + ChronoDuration::minutes(ttl_minutes);
+
+    let new_token = MagicToken {
+        id: Uuid::new_v4(),
+        user_id: user.id,
+        kind,
+        token_hash,
+        metadata: serde_json::json!({}),
+        expires_at: expires_at.naive_utc(),
+        max_uses,
+        used_count: 0,
+        created_at: Utc::now().naive_utc(),
+        created_by: None,
+        last_used_at: None,
+    };
+
+    diesel::insert_into(magic_tokens::table)
+        .values(&new_token)
+        .execute(&mut conn)?;
+
+    println!(
+        "Magic token created for '{}' (kind: {}, expires_at: {}, max_uses: {})",
+        username,
+        kind.as_str(),
+        expires_at,
+        max_uses.map_or("∞".to_string(), |v| v.to_string())
+    );
+    println!("Token: {}", raw_token);
+
+    Ok(())
+}
+
+fn generate_random_token() -> String {
+    let mut bytes = [0u8; 32];
+    OsRng.fill_bytes(&mut bytes);
+    hex::encode(bytes)
+}
+
+fn hash_token(token: &str) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(token.as_bytes());
+    hex::encode(hasher.finalize())
+}
+
+fn delete_tenant(pool: &PgPool, tenant_id: Uuid) -> Result<()> {
    let mut conn = pool.get().context("failed to get database connection")?;

    let tenant: Tenant = tenants::table
-        .filter(tenants::slug.eq(slug))
+        .find(tenant_id)
        .first(&mut conn)
        .optional()?
-        .ok_or_else(|| anyhow!("tenant '{}' not found", slug))?;
+        .ok_or_else(|| anyhow!("tenant '{}' not found", tenant_id))?;

    let member_exists: bool = select(exists(
        user_memberships::table.filter(user_memberships::tenant_id.eq(tenant.id)),
    ))
    .get_result(&mut conn)?;
    if member_exists {
-        bail!("tenant '{}' still has user memberships", slug);
+        bail!("tenant '{}' still has user memberships", tenant.name);
    }

    diesel::delete(tenants::table.filter(tenants::id.eq(tenant.id))).execute(&mut conn)?;
-    println!("deleted tenant '{}'", slug);
+    println!("deleted tenant '{}'", tenant.name);
    Ok(())
 }

-fn add_user_to_tenant(pool: &PgPool, username: &str, slug: &str, role: Option<&str>) -> Result<()> {
+fn add_user_to_tenant(pool: &PgPool, username: &str, tenant_id: Uuid) -> Result<()> {
    let mut conn = pool.get().context("failed to get database connection")?;

    let user: User = users::table
@@ -391,33 +358,28 @@ fn add_user_to_tenant(pool: &PgPool, username: &str, slug: &str, role: Option<&s
        .ok_or_else(|| anyhow!("user '{}' not found", username))?;

    let tenant: Tenant = tenants::table
-        .filter(tenants::slug.eq(slug))
+        .find(tenant_id)
        .first(&mut conn)
        .optional()?
-        .ok_or_else(|| anyhow!("tenant '{}' not found", slug))?;
+        .ok_or_else(|| anyhow!("tenant '{}' not found", tenant_id))?;

    let membership = NewUserMembership {
        id: Uuid::new_v4(),
        user_id: user.id,
        tenant_id: tenant.id,
-        role: role.unwrap_or("user").to_string(),
    };

    diesel::insert_into(user_memberships::table)
        .values(&membership)
        .on_conflict((user_memberships::user_id, user_memberships::tenant_id))
-        .do_update()
-        .set(user_memberships::role.eq(&membership.role))
+        .do_nothing()
        .execute(&mut conn)?;

-    println!(
-        "added user '{}' to tenant '{}' with role '{}'",
-        username, slug, membership.role
-    );
+    println!("added user '{}' to tenant '{}'", username, tenant.name);
    Ok(())
 }

-fn remove_user_from_tenant(pool: &PgPool, username: &str, slug: &str) -> Result<()> {
+fn remove_user_from_tenant(pool: &PgPool, username: &str, tenant_id: Uuid) -> Result<()> {
    let mut conn = pool.get().context("failed to get database connection")?;

    let user: User = users::table
@@ -427,10 +389,10 @@ fn remove_user_from_tenant(pool: &PgPool, username: &str, slug: &str) -> Result<
        .ok_or_else(|| anyhow!("user '{}' not found", username))?;

    let tenant: Tenant = tenants::table
-        .filter(tenants::slug.eq(slug))
+        .find(tenant_id)
        .first(&mut conn)
        .optional()?
-        .ok_or_else(|| anyhow!("tenant '{}' not found", slug))?;
+        .ok_or_else(|| anyhow!("tenant '{}' not found", tenant_id))?;

    let removed = diesel::delete(
        user_memberships::table
@@ -440,21 +402,24 @@ fn remove_user_from_tenant(pool: &PgPool, username: &str, slug: &str) -> Result<
    .execute(&mut conn)?;

    if removed == 0 {
-        println!("user '{}' was not a member of tenant '{}'", username, slug);
+        println!(
+            "user '{}' was not a member of tenant '{}'",
+            username, tenant.name
+        );
    } else {
-        println!("removed user '{}' from tenant '{}'", username, slug);
+        println!("removed user '{}' from tenant '{}'", username, tenant.name);
    }
    Ok(())
 }

-fn reanalyze_documents(pool: &PgPool, slug: &str) -> Result<()> {
+fn reanalyze_documents(pool: &PgPool, tenant_id: Uuid) -> Result<()> {
    let mut conn = pool.get().context("failed to get database connection")?;

    let tenant: Tenant = tenants::table
-        .filter(tenants::slug.eq(slug))
+        .find(tenant_id)
        .first(&mut conn)
        .optional()?
-        .ok_or_else(|| anyhow!("tenant '{}' not found", slug))?;
+        .ok_or_else(|| anyhow!("tenant '{}' not found", tenant_id))?;

    let targets: Vec<(Uuid, Uuid)> = documents::table
        .filter(documents::tenant_id.eq(tenant.id))
@@ -463,7 +428,7 @@ fn reanalyze_documents(pool: &PgPool, slug: &str) -> Result<()> {
        .load(&mut conn)?;

    if targets.is_empty() {
-        println!("tenant '{}' has no active documents", slug);
+        println!("tenant '{}' has no active documents", tenant.name);
        return Ok(());
    }

@@ -486,7 +451,7 @@ fn reanalyze_documents(pool: &PgPool, slug: &str) -> Result<()> {

    println!(
        "queued {} documents for re-analysis in tenant '{}'",
-        queued, slug
+        queued, tenant.name
    );
    Ok(())
 }
@@ -494,7 +459,7 @@ fn reanalyze_documents(pool: &PgPool, slug: &str) -> Result<()> {
 fn list_tenants(pool: &PgPool) -> Result<()> {
    let mut conn = pool.get().context("failed to get database connection")?;
    let tenants: Vec<Tenant> = tenants::table
-        .order(tenants::slug.asc())
+        .order(tenants::name.asc())
        .load(&mut conn)
        .context("failed to load tenants")?;

@@ -504,7 +469,7 @@ fn list_tenants(pool: &PgPool) -> Result<()> {
    }

    for tenant in tenants {
-        println!("{} ({})", tenant.slug, tenant.id);
+        println!("{} {}", tenant.id, tenant.name);
    }

    Ok(())
@@ -513,7 +478,7 @@ fn list_tenants(pool: &PgPool) -> Result<()> {
 async fn delete_assets_for_tenant(
    config: &AppConfig,
    pool: &PgPool,
-    tenant_slug: &str,
+    tenant_id: Uuid,
 ) -> Result<()> {
    let s3_client = s3::build_client(config).await?;
    let storage: Arc<dyn ObjectStorage> =
@@ -521,28 +486,27 @@ async fn delete_assets_for_tenant(

    let mut conn = pool.get().context("failed to get database connection")?;
    let tenant: Tenant = tenants::table
-        .filter(tenants::slug.eq(tenant_slug))
+        .find(tenant_id)
        .first(&mut conn)
-        .optional()
-        .context("failed to load tenant")?
-        .ok_or_else(|| anyhow!("tenant '{}' not found", tenant_slug))?;
+        .optional()?
+        .ok_or_else(|| anyhow!("tenant '{}' not found", tenant_id))?;

    let tenant_storage = TenantStorage::new(Arc::clone(&storage), &tenant)
-        .with_context(|| format!("missing storage root for tenant {}", tenant.slug))?;
+        .with_context(|| format!("missing storage root for tenant {}", tenant.name))?;

    let assets: Vec<DocumentAsset> = document_assets::table
        .filter(document_assets::tenant_id.eq(tenant.id))
        .load(&mut conn)
-        .with_context(|| format!("failed to load assets for tenant {}", tenant.slug))?;
+        .with_context(|| format!("failed to load assets for tenant {}", tenant.name))?;

    if assets.is_empty() {
-        println!("Tenant {}: no assets", tenant.slug);
+        println!("Tenant {}: no assets", tenant.name);
        return Ok(());
    }

    println!(
        "Tenant {} ({}): deleting {} assets…",
-        tenant.slug,
+        tenant.name,
        tenant.id,
        assets.len()
    );
@@ -553,13 +517,13 @@ async fn delete_assets_for_tenant(
        .filter(document_asset_objects::tenant_id.eq(tenant.id))
        .filter(document_asset_objects::asset_id.eq_any(&asset_ids))
        .load(&mut conn)
-        .with_context(|| format!("failed to load asset objects for tenant {}", tenant.slug))?;
+        .with_context(|| format!("failed to load asset objects for tenant {}", tenant.name))?;

    for object in &objects {
        if let Err(err) = tenant_storage.delete_object(&object.s3_key).await {
            eprintln!(
                "Failed to delete object {} (tenant {}): {err}",
-                object.s3_key, tenant.slug
+                object.s3_key, tenant.name
            );
        }
    }
@@ -570,20 +534,20 @@ async fn delete_assets_for_tenant(
            .filter(document_asset_objects::asset_id.eq_any(&asset_ids)),
    )
    .execute(&mut conn)
-    .with_context(|| format!("failed to remove asset objects for tenant {}", tenant.slug))?;
+    .with_context(|| format!("failed to remove asset objects for tenant {}", tenant.name))?;

    diesel::delete(document_assets::table.filter(document_assets::tenant_id.eq(tenant.id)))
        .execute(&mut conn)
-        .with_context(|| format!("failed to remove asset records for tenant {}", tenant.slug))?;
+        .with_context(|| format!("failed to remove asset records for tenant {}", tenant.name))?;

-    println!("Tenant {}: asset records deleted.", tenant.slug);
+    println!("Tenant {}: asset records deleted.", tenant.name);
    Ok(())
 }

 async fn quickwit_index(
    config: &AppConfig,
    pool: &PgPool,
-    slug: &str,
+    tenant_id: Uuid,
    method: Method,
 ) -> Result<()> {
    let endpoint = config
@@ -593,11 +557,10 @@ async fn quickwit_index(

    let mut conn = pool.get().context("failed to get database connection")?;
    let tenant: Tenant = tenants::table
-        .filter(tenants::slug.eq(slug))
+        .find(tenant_id)
        .first(&mut conn)
-        .optional()
-        .context("failed to query tenants")?
-        .ok_or_else(|| anyhow!("tenant '{}' not found", slug))?;
+        .optional()?
+        .ok_or_else(|| anyhow!("tenant '{}' not found", tenant_id))?;

    let client = Client::new();
    let index_id = format!("documents-{}", tenant.id);
@@ -605,63 +568,19 @@ async fn quickwit_index(

    match method {
        Method::POST => {
-            let payload = render_index_template(&index_id);
-            let response = client
-                .post(format!("{}/api/v1/indexes", base_endpoint))
-                .header("content-type", "application/json")
-                .body(payload)
-                .send()
+            ensure_quickwit_index(&client, base_endpoint, &index_id)
                .await
-                .context("failed to send create index request")?;
+                .context("failed to ensure quickwit index")?;

-            match response.status() {
-                status if status.is_success() => {
-                    diesel::update(tenants::table.filter(tenants::id.eq(tenant.id)))
-                        .set(tenants::quickwit_index.eq(Some(index_id.clone())))
-                        .execute(&mut conn)
-                        .context("failed to update tenant quickwit_index")?;
+            diesel::update(tenants::table.filter(tenants::id.eq(tenant.id)))
+                .set(tenants::quickwit_index.eq(Some(index_id.clone())))
+                .execute(&mut conn)
+                .context("failed to update tenant quickwit_index")?;

-                    println!(
-                        "Tenant '{}' quickwit index set to '{}'.",
-                        tenant.slug, index_id
-                    );
-                }
-                StatusCode::CONFLICT => {
-                    let lookup = client
-                        .get(format!("{}/api/v1/indexes/{}", base_endpoint, index_id))
-                        .send()
-                        .await
-                        .context("failed to verify existing quickwit index")?;
-
-                    let lookup_status = lookup.status();
-                    if !lookup_status.is_success() {
-                        let body = lookup.text().await.unwrap_or_default();
-                        bail!(
-                            "quickwit reported conflict but index lookup failed with status {}: {}",
-                            lookup_status,
-                            body
-                        );
-                    }
-
-                    diesel::update(tenants::table.filter(tenants::id.eq(tenant.id)))
-                        .set(tenants::quickwit_index.eq(Some(index_id.clone())))
-                        .execute(&mut conn)
-                        .context("failed to update tenant quickwit_index")?;
-
-                    println!(
-                        "Tenant '{}' quickwit index set to '{}'.",
-                        tenant.slug, index_id
-                    );
-                }
-                status => {
-                    let body = response.text().await.unwrap_or_default();
-                    bail!(
-                        "quickwit create index failed with status {}: {}",
-                        status,
-                        body
-                    );
-                }
-            }
+            println!(
+                "Tenant '{}' quickwit index set to '{}'.",
+                tenant.name, index_id
+            );
        }
        Method::DELETE => {
            let response = client
@@ -677,7 +596,7 @@ async fn quickwit_index(
                        .execute(&mut conn)
                        .context("failed to clear tenant quickwit_index")?;

-                    println!("Tenant '{}' quickwit index cleared.", tenant.slug);
+                    println!("Tenant '{}' quickwit index cleared.", tenant.name);
                }
                status => {
                    let body = response.text().await.unwrap_or_default();
@@ -694,14 +613,3 @@ async fn quickwit_index(

    Ok(())
 }
-
-fn render_index_template(index_id: &str) -> String {
-    let mut template = QUICKWIT_INDEX_TEMPLATE.clone();
-    if let Some(obj) = template.as_object_mut() {
-        obj.insert(
-            "index_id".to_string(),
-            serde_json::Value::String(index_id.to_string()),
-        );
-    }
-    template.to_string()
-}
@@ -1,4 +1,4 @@
-use backend::openapi::ApiDoc;
+use papercrate::openapi::ApiDoc;
 use utoipa::OpenApi;

 fn main() {
@@ -3,7 +3,7 @@ use std::net::SocketAddr;
 use tokio::net::TcpListener;
 use tower::make::Shared;

-use backend::{routes::webdav, utils::bootstrap::init_component};
+use papercrate::{routes::webdav, utils::bootstrap::init_component};

 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
@@ -2,7 +2,7 @@ use std::time::Duration;

 use tokio::signal;

-use backend::{default_handlers, utils::bootstrap::init_component, Worker};
+use papercrate::{default_handlers, utils::bootstrap::init_component, Worker};

 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
@@ -1,36 +1,69 @@
-use std::env;
-
 use anyhow::{Context, Result};
 use url::Url;

+use serde::Deserialize;
+use serde_aux::field_attributes::deserialize_bool_from_anything;
+
 use crate::db::DEFAULT_MAX_POOL_SIZE;

-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, Deserialize)]
 pub struct AppConfig {
    pub database_url: String,
+    #[serde(default = "default_database_max_pool_size")]
    pub database_max_pool_size: u32,
+    #[serde(default = "default_server_host")]
    pub server_host: String,
+    #[serde(default = "default_server_port")]
    pub server_port: u16,
+    #[serde(default = "default_webdav_host")]
    pub webdav_host: String,
+    #[serde(default = "default_webdav_port")]
    pub webdav_port: u16,
    pub jwt_secret: String,
+    #[serde(default = "default_jwt_issuer")]
    pub jwt_issuer: String,
+    #[serde(default = "default_jwt_audience")]
    pub jwt_audience: String,
+    #[serde(default = "default_jwt_expiry_minutes")]
    pub jwt_expiry_minutes: i64,
+    #[serde(default = "default_download_token_audience")]
    pub download_token_audience: String,
+    #[serde(default = "default_download_token_expiry_minutes")]
    pub download_token_expiry_minutes: i64,
+    #[serde(default = "default_refresh_token_expiry_days")]
    pub refresh_token_expiry_days: i64,
+    #[serde(
+        default = "default_refresh_cookie_secure",
+        deserialize_with = "deserialize_bool_from_anything"
+    )]
    pub refresh_cookie_secure: bool,
+    #[serde(default)]
    pub refresh_cookie_domain: Option<String>,
+    #[serde(default)]
    pub cors_allowed_origin: Option<String>,
+    #[serde(default)]
    pub aws_endpoint_url: Option<String>,
+    #[serde(default)]
    pub aws_access_key_id: Option<String>,
+    #[serde(default)]
    pub aws_secret_access_key: Option<String>,
+    #[serde(default = "default_aws_region")]
    pub aws_region: String,
    pub s3_bucket: String,
+    #[serde(default)]
    pub quickwit_endpoint: Option<String>,
+    #[serde(default)]
    pub quickwit_index: Option<String>,
-    pub default_tenant_slug: String,
+    #[serde(default = "default_worker_max_document_bytes")]
+    pub worker_max_document_bytes: u64,
+    #[serde(default = "default_upload_body_limit_bytes")]
+    pub upload_body_limit_bytes: u64,
+    #[serde(default)]
+    pub webauthn_rp_id: Option<String>,
+    #[serde(default)]
+    pub webauthn_origin: Option<String>,
+    #[serde(default = "default_webauthn_rp_name")]
+    pub webauthn_rp_name: String,
 }

 impl AppConfig {
@@ -42,87 +75,19 @@ impl AppConfig {
            database_url = %config.redacted_database_url(),
            pool_size = config.database_max_pool_size,
            quickwit_enabled = config.quickwit_endpoint.is_some(),
+            passkeys_enabled = config.webauthn_origin.is_some(),
            s3_bucket = %config.s3_bucket,
+            worker_max_document_bytes = config.worker_max_document_bytes,
+            upload_body_limit_bytes = config.upload_body_limit_bytes,
            "loaded backend configuration"
        );
        Ok(config)
    }

    pub fn from_env() -> Result<Self> {
-        let database_url = env::var("DATABASE_URL").context("DATABASE_URL must be set")?;
-        let database_max_pool_size = env::var("DATABASE_MAX_POOL_SIZE")
-            .ok()
-            .and_then(|value| value.parse().ok())
-            .unwrap_or(DEFAULT_MAX_POOL_SIZE);
-        let server_host = env::var("SERVER_HOST").unwrap_or_else(|_| "127.0.0.1".to_string());
-        let server_port = env::var("SERVER_PORT")
-            .unwrap_or_else(|_| "3000".to_string())
-            .parse()
-            .context("SERVER_PORT must be a valid u16")?;
-        let webdav_host = env::var("WEBDAV_HOST").unwrap_or_else(|_| server_host.clone());
-        let webdav_port = env::var("WEBDAV_PORT")
-            .unwrap_or_else(|_| "3001".to_string())
-            .parse()
-            .context("WEBDAV_PORT must be a valid u16")?;
-        let jwt_secret = env::var("JWT_SECRET").context("JWT_SECRET must be set")?;
-        let jwt_issuer = env::var("JWT_ISSUER").unwrap_or_else(|_| "papercrate".to_string());
-        let jwt_audience =
-            env::var("JWT_AUDIENCE").unwrap_or_else(|_| "papercrate-clients".to_string());
-        let jwt_expiry_minutes = env::var("JWT_EXPIRY_MINUTES")
-            .unwrap_or_else(|_| "60".to_string())
-            .parse()
-            .context("JWT_EXPIRY_MINUTES must be an integer")?;
-        let download_token_audience = env::var("DOWNLOAD_TOKEN_AUDIENCE")
-            .unwrap_or_else(|_| "papercrate-download".to_string());
-        let download_token_expiry_minutes = env::var("DOWNLOAD_TOKEN_EXPIRY_MINUTES")
-            .unwrap_or_else(|_| "60".to_string())
-            .parse()
-            .context("DOWNLOAD_TOKEN_EXPIRY_MINUTES must be an integer")?;
-        let refresh_token_expiry_days = env::var("REFRESH_TOKEN_EXPIRY_DAYS")
-            .unwrap_or_else(|_| "30".to_string())
-            .parse()
-            .context("REFRESH_TOKEN_EXPIRY_DAYS must be an integer")?;
-        let refresh_cookie_secure = env::var("REFRESH_COOKIE_SECURE")
-            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
-            .unwrap_or(false);
-        let refresh_cookie_domain = env::var("REFRESH_COOKIE_DOMAIN").ok();
-        let cors_allowed_origin = env::var("CORS_ALLOWED_ORIGIN").ok();
-        let aws_endpoint_url = env::var("AWS_ENDPOINT_URL").ok();
-        let aws_access_key_id = env::var("AWS_ACCESS_KEY_ID").ok();
-        let aws_secret_access_key = env::var("AWS_SECRET_ACCESS_KEY").ok();
-        let aws_region = env::var("AWS_REGION").unwrap_or_else(|_| "us-east-1".to_string());
-        let s3_bucket = env::var("S3_BUCKET").context("S3_BUCKET must be set")?;
-        let quickwit_endpoint = env::var("QUICKWIT_ENDPOINT").ok();
-        let quickwit_index = env::var("QUICKWIT_INDEX").ok();
-        let default_tenant_slug =
-            env::var("DEFAULT_TENANT_SLUG").unwrap_or_else(|_| "admin".to_string());
-
-        Ok(Self {
-            database_url,
-            database_max_pool_size,
-            server_host,
-            server_port,
-            webdav_host,
-            webdav_port,
-            jwt_secret,
-            jwt_issuer,
-            jwt_audience,
-            jwt_expiry_minutes,
-            download_token_audience,
-            download_token_expiry_minutes,
-            refresh_token_expiry_days,
-            refresh_cookie_secure,
-            refresh_cookie_domain,
-            cors_allowed_origin,
-            aws_endpoint_url,
-            aws_access_key_id,
-            aws_secret_access_key,
-            aws_region,
-            s3_bucket,
-            quickwit_endpoint,
-            quickwit_index,
-            default_tenant_slug,
-        })
+        let config: AppConfig = envy::from_env()
+            .context("failed to parse application configuration from environment")?;
+        Ok(config.normalize())
    }

    pub fn redacted_database_url(&self) -> String {
@@ -130,6 +95,95 @@ impl AppConfig {
    }
 }

+impl AppConfig {
+    fn normalize(mut self) -> Self {
+        if self.webdav_host.is_empty() {
+            self.webdav_host = self.server_host.clone();
+        }
+
+        if self.webauthn_rp_id.is_none() {
+            self.webauthn_rp_id = Some(self.server_host.clone());
+        }
+
+        if self.webauthn_origin.is_none() {
+            let scheme = if self.server_host == "127.0.0.1" || self.server_host == "localhost" {
+                "http"
+            } else {
+                "https"
+            };
+            self.webauthn_origin = Some(format!(
+                "{scheme}://{}:{}",
+                self.server_host, self.server_port
+            ));
+        }
+        self
+    }
+}
+
+fn default_database_max_pool_size() -> u32 {
+    DEFAULT_MAX_POOL_SIZE
+}
+
+fn default_server_host() -> String {
+    "127.0.0.1".to_string()
+}
+
+fn default_server_port() -> u16 {
+    3000
+}
+
+fn default_webdav_host() -> String {
+    String::new()
+}
+
+fn default_webdav_port() -> u16 {
+    3001
+}
+
+fn default_jwt_issuer() -> String {
+    "papercrate".to_string()
+}
+
+fn default_jwt_audience() -> String {
+    "papercrate-clients".to_string()
+}
+
+fn default_jwt_expiry_minutes() -> i64 {
+    60
+}
+
+fn default_download_token_audience() -> String {
+    "papercrate-download".to_string()
+}
+
+fn default_download_token_expiry_minutes() -> i64 {
+    60
+}
+
+fn default_refresh_token_expiry_days() -> i64 {
+    30
+}
+
+fn default_refresh_cookie_secure() -> bool {
+    false
+}
+
+fn default_aws_region() -> String {
+    "us-east-1".to_string()
+}
+
+fn default_worker_max_document_bytes() -> u64 {
+    200 * 1024 * 1024
+}
+
+fn default_upload_body_limit_bytes() -> u64 {
+    128 * 1024 * 1024
+}
+
+fn default_webauthn_rp_name() -> String {
+    "Papercrate".to_string()
+}
+
 fn redact_database_url(raw: &str) -> String {
    match Url::parse(raw) {
        Ok(mut parsed) => {
@@ -1,12 +1,40 @@
 use std::time::Duration;

 use diesel::pg::PgConnection;
-use diesel::r2d2::{ConnectionManager, Pool};
+use diesel::r2d2::{ConnectionManager, CustomizeConnection, Pool};
+use diesel::RunQueryDsl;

 pub type PgPool = Pool<ConnectionManager<PgConnection>>;

 pub const DEFAULT_MAX_POOL_SIZE: u32 = 2;

+#[derive(Debug)]
+struct SchemaCustomizer;
+
+impl CustomizeConnection<PgConnection, diesel::r2d2::Error> for SchemaCustomizer {
+    fn on_acquire(&self, conn: &mut PgConnection) -> Result<(), diesel::r2d2::Error> {
+        diesel::sql_query(
+            "SELECT set_config('search_path', (
+                SELECT string_agg(schema_name, ', ')
+                FROM (
+                    SELECT 'tenant' AS schema_name WHERE EXISTS (
+                        SELECT 1 FROM pg_namespace WHERE nspname = 'tenant'
+                    )
+                    UNION ALL
+                    SELECT 'shared' AS schema_name WHERE EXISTS (
+                        SELECT 1 FROM pg_namespace WHERE nspname = 'shared'
+                    )
+                    UNION ALL
+                    SELECT 'public' AS schema_name
+                ) AS schemas
+            ), false)",
+        )
+        .execute(conn)
+        .map(|_| ())
+        .map_err(diesel::r2d2::Error::QueryError)
+    }
+}
+
 pub fn init_pool(database_url: &str) -> anyhow::Result<PgPool> {
    init_pool_with_size(database_url, DEFAULT_MAX_POOL_SIZE)
 }
@@ -17,6 +45,7 @@ pub fn init_pool_with_size(database_url: &str, max_size: u32) -> anyhow::Result<
    let pool = Pool::builder()
        .max_size(pool_size)
        .connection_timeout(Duration::from_secs(10))
+        .connection_customizer(Box::new(SchemaCustomizer))
        .build(manager)?;
    Ok(pool)
 }
@@ -0,0 +1,287 @@
+use std::collections::HashMap;
+use std::path::Path as FsPath;
+
+use diesel::prelude::*;
+use serde::Serialize;
+use serde_json::Value;
+use utoipa::ToSchema;
+use uuid::Uuid;
+
+use crate::error::{AppError, AppResult};
+use crate::models::{Document, DocumentAsset, DocumentAssetObject, DocumentVersion};
+use crate::schema::{document_asset_objects, document_assets, document_versions};
+use crate::state::AppState;
+use crate::utils::time::to_iso;
+
+#[derive(Serialize, Clone, ToSchema)]
+pub struct DocumentAssetResponse {
+    pub id: Uuid,
+    pub asset_type: String,
+    pub mime_type: String,
+    #[schema(value_type = Object)]
+    pub metadata: Value,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[schema(nullable)]
+    pub cardinality: Option<i32>,
+}
+
+#[derive(Serialize, Clone, ToSchema)]
+pub struct DocumentAssetObjectResponse {
+    pub id: Uuid,
+    pub ordinal: i32,
+    #[schema(value_type = Object)]
+    pub metadata: Value,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[schema(nullable)]
+    pub url: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[schema(nullable)]
+    pub expires_at: Option<i64>,
+}
+
+#[derive(Serialize, ToSchema)]
+pub struct DocumentAssetDetailResponse {
+    pub id: Uuid,
+    pub asset_type: String,
+    pub mime_type: String,
+    #[schema(value_type = Object)]
+    pub metadata: Value,
+    pub created_at: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[schema(nullable)]
+    pub cardinality: Option<i32>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub objects: Vec<DocumentAssetObjectResponse>,
+}
+
+#[derive(Serialize, Clone, ToSchema)]
+pub struct DocumentVersionResponse {
+    pub id: Uuid,
+    pub version_number: i32,
+    pub size_bytes: i64,
+    pub checksum: String,
+    pub created_at: String,
+    #[schema(value_type = Object)]
+    pub metadata: Value,
+}
+
+#[derive(Serialize, Clone, ToSchema)]
+pub struct DocumentVersionDetailResponse {
+    #[serde(flatten)]
+    pub version: DocumentVersionResponse,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub assets: Vec<DocumentAssetResponse>,
+    pub download_path: String,
+}
+
+pub fn build_download_path(
+    state: &AppState,
+    document: &Document,
+    user_id: Uuid,
+) -> AppResult<String> {
+    state
+        .jwt
+        .generate_download_token(document.id, user_id, document.tenant_id)
+        .map(|token| format!("/download/{token}"))
+        .map_err(|err| {
+            tracing::error!(error = ?err, "failed to generate download token");
+            AppError::internal("failed to generate download token")
+        })
+}
+
+pub fn to_version_response(version: DocumentVersion) -> DocumentVersionResponse {
+    DocumentVersionResponse {
+        id: version.id,
+        version_number: version.version_number,
+        size_bytes: version.size_bytes,
+        checksum: version.checksum,
+        created_at: to_iso(version.created_at),
+        metadata: version.metadata,
+    }
+}
+
+pub fn to_asset_summary(asset: DocumentAsset) -> DocumentAssetResponse {
+    DocumentAssetResponse {
+        id: asset.id,
+        asset_type: asset.asset_type,
+        mime_type: asset.mime_type,
+        metadata: asset.metadata,
+        cardinality: asset.cardinality,
+    }
+}
+
+pub fn to_asset_detail_response(
+    asset: DocumentAsset,
+    objects: Vec<DocumentAssetObjectResponse>,
+) -> DocumentAssetDetailResponse {
+    DocumentAssetDetailResponse {
+        id: asset.id,
+        asset_type: asset.asset_type,
+        mime_type: asset.mime_type,
+        metadata: asset.metadata,
+        created_at: to_iso(asset.created_at),
+        cardinality: asset.cardinality,
+        objects,
+    }
+}
+
+pub fn to_asset_object_response(
+    object: DocumentAssetObject,
+    url: Option<String>,
+    expires_at: Option<i64>,
+) -> DocumentAssetObjectResponse {
+    DocumentAssetObjectResponse {
+        id: object.id,
+        ordinal: object.ordinal,
+        metadata: object.metadata,
+        url,
+        expires_at,
+    }
+}
+
+pub fn delete_asset(state: &AppState, tenant_id: Uuid, asset_id: Uuid) -> AppResult<()> {
+    let mut conn = state.db_for_tenant(tenant_id)?;
+
+    diesel::delete(
+        document_assets::table
+            .filter(document_assets::id.eq(asset_id))
+            .filter(document_assets::tenant_id.eq(tenant_id)),
+    )
+    .execute(&mut conn)?;
+
+    Ok(())
+}
+
+pub async fn load_asset_responses(
+    state: &AppState,
+    tenant_id: Uuid,
+    version_id: Uuid,
+) -> AppResult<Vec<DocumentAssetResponse>> {
+    let mut conn = state.db_for_tenant(tenant_id)?;
+    let assets: Vec<(DocumentAsset, Option<DocumentAssetObject>)> = document_assets::table
+        .left_outer_join(
+            document_asset_objects::table.on(document_asset_objects::asset_id
+                .eq(document_assets::id)
+                .and(document_asset_objects::ordinal.eq(1))),
+        )
+        .filter(document_assets::document_version_id.eq(version_id))
+        .filter(document_assets::tenant_id.eq(tenant_id))
+        .order(document_assets::created_at.asc())
+        .select((
+            document_assets::all_columns,
+            document_asset_objects::all_columns.nullable(),
+        ))
+        .load(&mut conn)?;
+    drop(conn);
+
+    Ok(assets
+        .into_iter()
+        .map(|(asset, _)| to_asset_summary(asset))
+        .collect())
+}
+
+pub fn load_primary_assets(
+    state: &AppState,
+    tenant_id: Uuid,
+    documents: &[Document],
+) -> AppResult<HashMap<Uuid, (DocumentVersionResponse, Vec<DocumentAssetResponse>)>> {
+    if documents.is_empty() {
+        return Ok(HashMap::new());
+    }
+
+    let mut doc_to_version: HashMap<Uuid, Uuid> = HashMap::with_capacity(documents.len());
+    let mut version_ids: Vec<Uuid> = Vec::with_capacity(documents.len());
+    for doc in documents {
+        doc_to_version.insert(doc.id, doc.current_version_id);
+        version_ids.push(doc.current_version_id);
+    }
+
+    version_ids.sort();
+    version_ids.dedup();
+
+    let mut conn = state.db_for_tenant(tenant_id)?;
+    let versions: Vec<DocumentVersion> = document_versions::table
+        .filter(document_versions::id.eq_any(&version_ids))
+        .load(&mut conn)?;
+
+    let mut version_map: HashMap<Uuid, DocumentVersion> = HashMap::new();
+    for version in versions {
+        version_map.insert(version.id, version);
+    }
+
+    let assets: Vec<(DocumentAsset, Option<DocumentAssetObject>)> = document_assets::table
+        .left_outer_join(
+            document_asset_objects::table.on(document_asset_objects::asset_id
+                .eq(document_assets::id)
+                .and(document_asset_objects::ordinal.eq(1))),
+        )
+        .filter(document_assets::document_version_id.eq_any(&version_ids))
+        .order((
+            document_assets::document_version_id.asc(),
+            document_assets::created_at.asc(),
+        ))
+        .select((
+            document_assets::all_columns,
+            document_asset_objects::all_columns.nullable(),
+        ))
+        .load(&mut conn)?;
+
+    drop(conn);
+
+    let mut assets_by_version: HashMap<Uuid, Vec<DocumentAssetResponse>> = HashMap::new();
+    for (asset, _object) in assets {
+        let version_id = asset.document_version_id;
+        let response = to_asset_summary(asset);
+        assets_by_version
+            .entry(version_id)
+            .or_default()
+            .push(response);
+    }
+
+    let mut result: HashMap<Uuid, (DocumentVersionResponse, Vec<DocumentAssetResponse>)> =
+        HashMap::with_capacity(doc_to_version.len());
+    for (doc_id, version_id) in doc_to_version {
+        if let Some(version) = version_map.remove(&version_id) {
+            let assets = assets_by_version.remove(&version_id).unwrap_or_default();
+            result.insert(doc_id, (to_version_response(version), assets));
+        }
+    }
+
+    Ok(result)
+}
+
+pub fn derive_document_title(original: &str) -> String {
+    let trimmed = original.trim();
+    if trimmed.is_empty() {
+        return "Document".to_string();
+    }
+
+    let stem = FsPath::new(trimmed)
+        .file_stem()
+        .and_then(|s| s.to_str())
+        .map(|s| s.trim())
+        .filter(|s| !s.is_empty())
+        .map(|s| s.to_string());
+
+    stem.unwrap_or_else(|| trimmed.to_string())
+}
+
+pub fn filename_with_retained_extension(title: &str, current_filename: &str) -> String {
+    let extension = FsPath::new(current_filename)
+        .extension()
+        .and_then(|ext| ext.to_str());
+
+    if let Some(ext) = extension {
+        if title
+            .rsplit_once('.')
+            .map(|(_, existing_ext)| existing_ext.eq_ignore_ascii_case(ext))
+            .unwrap_or(false)
+        {
+            title.to_string()
+        } else {
+            format!("{title}.{ext}")
+        }
+    } else {
+        title.to_string()
+    }
+}
@@ -0,0 +1,121 @@
+use std::collections::HashMap;
+
+use chrono::Utc;
+use diesel::prelude::*;
+use serde::Serialize;
+use serde_json::Value;
+use utoipa::ToSchema;
+use uuid::Uuid;
+
+use crate::error::{AppError, AppResult};
+use crate::models::{Correspondent, DocumentCorrespondent, NewDocumentCorrespondent};
+use crate::schema::{correspondents, document_correspondents, documents};
+use crate::utils::time::to_iso;
+
+#[derive(Serialize, Clone, ToSchema)]
+pub struct DocumentCorrespondentResponse {
+    pub id: Uuid,
+    pub name: String,
+    #[schema(value_type = Object)]
+    pub metadata: Value,
+    pub assigned_at: String,
+}
+
+pub fn normalize_correspondent_ids(ids: &[Uuid]) -> AppResult<Vec<Uuid>> {
+    let mut unique: Vec<Uuid> = ids.iter().copied().collect();
+    unique.sort_unstable();
+    unique.dedup();
+
+    if unique.is_empty() {
+        return Err(AppError::bad_request(
+            "assignments must contain at least one correspondent",
+        ));
+    }
+
+    Ok(unique)
+}
+
+pub fn insert_document_correspondents(
+    conn: &mut PgConnection,
+    tenant_id: Uuid,
+    document_id: Uuid,
+    user_id: Uuid,
+    correspondent_ids: &[Uuid],
+) -> AppResult<usize> {
+    let ids = normalize_correspondent_ids(correspondent_ids)?;
+
+    let existing: Vec<Uuid> = correspondents::table
+        .filter(correspondents::id.eq_any(&ids))
+        .filter(correspondents::tenant_id.eq(tenant_id))
+        .select(correspondents::id)
+        .load(conn)?;
+
+    if existing.len() != ids.len() {
+        return Err(AppError::bad_request(
+            "one or more correspondents do not exist",
+        ));
+    }
+
+    let new_rows: Vec<NewDocumentCorrespondent> = ids
+        .into_iter()
+        .map(|correspondent_id| NewDocumentCorrespondent {
+            document_id,
+            correspondent_id,
+            assigned_by: Some(user_id),
+            tenant_id,
+        })
+        .collect();
+
+    if new_rows.is_empty() {
+        return Ok(0);
+    }
+
+    let inserted = diesel::insert_into(document_correspondents::table)
+        .values(&new_rows)
+        .on_conflict_do_nothing()
+        .execute(conn)?;
+
+    if inserted > 0 {
+        diesel::update(
+            documents::table
+                .find(document_id)
+                .filter(documents::tenant_id.eq(tenant_id)),
+        )
+        .set(documents::updated_at.eq(Utc::now().naive_utc()))
+        .execute(conn)?;
+    }
+
+    Ok(inserted)
+}
+
+pub fn load_correspondents_for_documents(
+    conn: &mut PgConnection,
+    document_ids: &[Uuid],
+) -> AppResult<HashMap<Uuid, Vec<DocumentCorrespondentResponse>>> {
+    if document_ids.is_empty() {
+        return Ok(HashMap::new());
+    }
+
+    let rows: Vec<(DocumentCorrespondent, Correspondent)> = document_correspondents::table
+        .inner_join(correspondents::table)
+        .filter(document_correspondents::document_id.eq_any(document_ids))
+        .order((
+            document_correspondents::document_id.asc(),
+            document_correspondents::assigned_at.asc(),
+        ))
+        .load(conn)?;
+
+    let mut map: HashMap<Uuid, Vec<DocumentCorrespondentResponse>> = HashMap::new();
+    for (assignment, correspondent) in rows {
+        map.entry(assignment.document_id)
+            .or_default()
+            .push(DocumentCorrespondentResponse {
+                id: correspondent.id,
+                name: correspondent.name,
+                metadata: correspondent.metadata,
+                assigned_at: to_iso(assignment.assigned_at),
+            });
+    }
+
+    Ok(map)
+}
@@ -0,0 +1,21 @@
+use diesel::dsl::exists;
+use diesel::prelude::*;
+use uuid::Uuid;
+
+use crate::error::AppResult;
+use crate::schema::folders;
+use crate::utils::validation::ensure_exists;
+
+pub fn ensure_folder_exists_on_conn(
+    conn: &mut PgConnection,
+    tenant_id: Uuid,
+    folder_id: Uuid,
+) -> AppResult<()> {
+    let exists: bool = diesel::select(exists(
+        folders::table
+            .filter(folders::id.eq(folder_id))
+            .filter(folders::tenant_id.eq(tenant_id)),
+    ))
+    .get_result(conn)?;
+    ensure_exists(exists, "folder")
+}
@@ -0,0 +1,52 @@
+use serde_json::{map::Entry, Map, Value};
+
+use crate::error::{AppError, AppResult};
+
+pub fn merge_document_metadata(existing: Value, updates: Value) -> AppResult<Value> {
+    let mut base = match existing {
+        Value::Object(map) => map,
+        Value::Null => Map::new(),
+        _ => {
+            return Err(AppError::bad_request(
+                "existing metadata is not an object; set replace=true to overwrite",
+            ));
+        }
+    };
+
+    let incoming = match updates {
+        Value::Object(map) => map,
+        _ => {
+            return Err(AppError::bad_request(
+                "metadata value must be a JSON object when replace is false",
+            ));
+        }
+    };
+
+    merge_metadata_maps(&mut base, incoming);
+    Ok(Value::Object(base))
+}
+
+fn merge_metadata_maps(target: &mut Map<String, Value>, updates: Map<String, Value>) {
+    for (key, value) in updates {
+        match target.entry(key) {
+            Entry::Occupied(mut entry) => {
+                let existing = entry.get_mut();
+                match value {
+                    Value::Object(update_map) => {
+                        if let Value::Object(existing_map) = existing {
+                            merge_metadata_maps(existing_map, update_map);
+                        } else {
+                            *existing = Value::Object(update_map);
+                        }
+                    }
+                    other => {
+                        *existing = other;
+                    }
+                }
+            }
+            Entry::Vacant(entry) => {
+                entry.insert(value);
+            }
+        }
+    }
+}
@@ -0,0 +1,6 @@
+pub mod asset;
+pub mod correspondents;
+pub mod folders;
+pub mod metadata;
+pub mod search;
+pub mod tags;
@@ -0,0 +1,290 @@
+use std::collections::HashSet;
+
+use anyhow::{anyhow, bail, Result};
+use reqwest::{Client, StatusCode};
+use serde::{Deserialize, Serialize};
+use serde_json::{json, Value};
+use tracing::{debug, error};
+use uuid::Uuid;
+
+use crate::models::{Document, DocumentVersion};
+
+pub const QUICKWIT_MAX_HITS: usize = 200;
+
+pub fn build_quickwit_query(input: &str) -> Option<String> {
+    let tokens: Vec<String> = input
+        .split_whitespace()
+        .filter(|token| !token.is_empty())
+        .map(|token| {
+            let normalized = token.to_lowercase();
+            escape_quickwit_token(&normalized)
+        })
+        .collect();
+
+    if tokens.is_empty() {
+        return None;
+    }
+
+    let parts: Vec<String> = tokens
+        .into_iter()
+        .map(|token| format!("(title:{token} OR text:{token})"))
+        .collect();
+
+    Some(parts.join(" AND "))
+}
+
+pub fn escape_quickwit_token(token: &str) -> String {
+    let mut escaped = String::with_capacity(token.len());
+    for ch in token.chars() {
+        match ch {
+            '+' | '-' | '&' | '|' | '!' | '(' | ')' | '{' | '}' | '[' | ']' | '^' | '"' | '~'
+            | '*' | '?' | ':' | '\\' | '/' => {
+                escaped.push('\\');
+                escaped.push(ch);
+            }
+            _ => escaped.push(ch),
+        }
+    }
+    escaped
+}
+
+pub async fn quickwit_search(
+    endpoint: &str,
+    index: &str,
+    tenant_id: Uuid,
+    query: &str,
+) -> Result<Vec<Uuid>> {
+    let tenant_clause = format!("tenant_id:{}", tenant_id);
+    let quickwit_query = match build_quickwit_query(query) {
+        Some(q) => {
+            debug!(%query, quickwit_query = %q, "built quickwit search query");
+            format!("{} AND ({})", tenant_clause, q)
+        }
+        None => {
+            debug!(%query, "quickwit search skipped because query produced no tokens");
+            return Ok(vec![]);
+        }
+    };
+
+    let client = Client::new();
+    let url = format!("{}/api/v1/{}/search", endpoint.trim_end_matches('/'), index);
+
+    let payload = json!({
+        "query": quickwit_query,
+        "max_hits": QUICKWIT_MAX_HITS,
+    });
+
+    debug!(%url, payload = %payload, "sending quickwit search request");
+    let response = client.post(url).json(&payload).send().await?;
+    if !response.status().is_success() {
+        let status = response.status();
+        let body = response.text().await.unwrap_or_default();
+        error!(%status, body = %body, "quickwit search request failed");
+        return Err(anyhow!(
+            "quickwit search failed with status {status}: {body}"
+        ));
+    }
+
+    let data: QuickwitSearchResponse = response.json().await?;
+    debug!("quickwit search response parsed successfully");
+    let QuickwitSearchResponse { hits } = data;
+
+    let total_hits = hits.len();
+    let mut seen = HashSet::new();
+    let mut doc_ids = Vec::with_capacity(total_hits);
+
+    for hit in hits {
+        if let Some(doc_id) = extract_document_id(&hit) {
+            if seen.insert(doc_id) {
+                doc_ids.push(doc_id);
+            }
+        }
+    }
+
+    debug!(
+        total_hits = total_hits,
+        unique_ids = doc_ids.len(),
+        "quickwit search completed"
+    );
+    Ok(doc_ids)
+}
+
+pub fn quickwit_index_template(index_id: &str) -> Value {
+    json!({
+        "version": "0.8",
+        "index_id": index_id,
+        "doc_mapping": {
+            "tokenizers": [
+                {
+                    "name": "substring",
+                    "type": "ngram",
+                    "min_gram": 2,
+                    "max_gram": 20,
+                    "prefix_only": false
+                }
+            ],
+            "field_mappings": [
+                { "name": "tenant_id", "type": "text", "stored": true },
+                { "name": "document_id", "type": "text", "stored": true },
+                { "name": "version_id", "type": "text", "stored": true },
+                { "name": "title", "type": "text", "tokenizer": "substring", "stored": true },
+                { "name": "text", "type": "text", "tokenizer": "substring", "record": "position" }
+            ]
+        },
+        "search_settings": {
+            "default_search_fields": ["title", "text"]
+        }
+    })
+}
+
+pub async fn ensure_quickwit_index(client: &Client, endpoint: &str, index_id: &str) -> Result<()> {
+    let base = endpoint.trim_end_matches('/');
+    let create_url = format!("{}/api/v1/indexes", base);
+    let payload = quickwit_index_template(index_id);
+
+    let response = client.post(&create_url).json(&payload).send().await?;
+    match response.status() {
+        status if status.is_success() => Ok(()),
+        StatusCode::CONFLICT => {
+            let lookup_url = format!("{}/api/v1/indexes/{}", base, index_id);
+            let lookup = client.get(&lookup_url).send().await?;
+            if lookup.status().is_success() {
+                Ok(())
+            } else {
+                let status = lookup.status();
+                let body = lookup.text().await.unwrap_or_default();
+                bail!("quickwit index lookup failed with status {status}: {body}");
+            }
+        }
+        status => {
+            let body = response.text().await.unwrap_or_default();
+            bail!("quickwit create index failed with status {status}: {body}");
+        }
+    }
+}
+
+pub fn extract_document_id(hit: &Value) -> Option<Uuid> {
+    for key in ["_source", "source", "fields", "stored_fields"] {
+        if let Some(value) = hit.get(key) {
+            if let Some(uuid) = extract_uuid_from_value(value) {
+                return Some(uuid);
+            }
+        }
+    }
+
+    if let Some(value) = hit.get("document_id") {
+        if let Some(uuid) = extract_uuid_from_value(value) {
+            return Some(uuid);
+        }
+    }
+
+    None
+}
+
+pub fn extract_uuid_from_value(value: &Value) -> Option<Uuid> {
+    if let Some(obj) = value.as_object() {
+        if let Some(inner) = obj.get("document_id") {
+            return parse_uuid_value(inner);
+        }
+    }
+
+    if let Some(arr) = value.as_array() {
+        for item in arr {
+            if let Some(uuid) = extract_uuid_from_value(item) {
+                return Some(uuid);
+            }
+        }
+    }
+
+    parse_uuid_value(value)
+}
+
+pub fn parse_uuid_value(value: &Value) -> Option<Uuid> {
+    if let Some(s) = value.as_str() {
+        return Uuid::parse_str(s).ok();
+    }
+
+    if let Some(arr) = value.as_array() {
+        for item in arr {
+            if let Some(uuid) = parse_uuid_value(item) {
+                return Some(uuid);
+            }
+        }
+    }
+
+    None
+}
+
+#[derive(Deserialize)]
+struct QuickwitSearchResponse {
+    #[serde(default)]
+    hits: Vec<Value>,
+}
+
+#[derive(Serialize)]
+pub struct QuickwitIngestRecord {
+    pub document_id: Uuid,
+    pub version_id: Uuid,
+    pub tenant_id: Uuid,
+    pub title: String,
+    pub text: String,
+}
+
+pub fn build_quickwit_ingest_record(
+    document: &Document,
+    version: &DocumentVersion,
+    tenant_id: Uuid,
+    text: &str,
+) -> QuickwitIngestRecord {
+    QuickwitIngestRecord {
+        document_id: document.id,
+        version_id: version.id,
+        tenant_id,
+        title: document.title.to_lowercase(),
+        text: text.to_lowercase(),
+    }
+}
+
+pub async fn quickwit_ingest(
+    client: &Client,
+    endpoint: &str,
+    index: &str,
+    records: &[QuickwitIngestRecord],
+) -> Result<()> {
+    if records.is_empty() {
+        return Ok(());
+    }
+
+    let url = format!(
+        "{}/api/v1/{}/ingest?commit=auto",
+        endpoint.trim_end_matches('/'),
+        index
+    );
+
+    let mut body = String::new();
+    for record in records {
+        let line = serde_json::to_string(record)?;
+        body.push_str(&line);
+        body.push('\n');
+    }
+
+    debug!(%url, lines = records.len(), "sending quickwit ingest request");
+    let response = client
+        .post(url)
+        .header("content-type", "application/x-ndjson")
+        .body(body)
+        .send()
+        .await?;
+
+    if !response.status().is_success() {
+        let status = response.status();
+        let body = response.text().await.unwrap_or_default();
+        error!(%status, %body, "quickwit ingest request failed");
+        return Err(anyhow!(
+            "quickwit ingest failed with status {status}: {body}"
+        ));
+    }
+
+    debug!("quickwit ingest request succeeded");
+    Ok(())
+}
@@ -0,0 +1,80 @@
+use std::collections::HashMap;
+
+use diesel::prelude::*;
+use uuid::Uuid;
+
+use crate::error::{AppError, AppResult};
+use crate::models::{Document, NewDocumentTag, Tag};
+use crate::schema::{document_tags, tags};
+
+pub fn assign_tags(
+    conn: &mut PgConnection,
+    tenant_id: Uuid,
+    document: &Document,
+    raw_tag_ids: &[Uuid],
+    assigned_by: Option<Uuid>,
+) -> AppResult<usize> {
+    if raw_tag_ids.is_empty() {
+        return Ok(0);
+    }
+
+    let mut tag_ids: Vec<Uuid> = raw_tag_ids.iter().copied().collect();
+    tag_ids.sort_unstable();
+    tag_ids.dedup();
+
+    if tag_ids.is_empty() {
+        return Ok(0);
+    }
+
+    let existing: Vec<Uuid> = tags::table
+        .filter(tags::id.eq_any(&tag_ids))
+        .filter(tags::tenant_id.eq(tenant_id))
+        .select(tags::id)
+        .load(conn)?;
+
+    if existing.len() != tag_ids.len() {
+        return Err(AppError::bad_request("one or more tags do not exist"));
+    }
+
+    let new_tags: Vec<NewDocumentTag> = tag_ids
+        .into_iter()
+        .map(|tag_id| NewDocumentTag {
+            document_id: document.id,
+            tag_id,
+            assigned_by,
+            tenant_id,
+        })
+        .collect();
+
+    if new_tags.is_empty() {
+        return Ok(0);
+    }
+
+    let inserted = diesel::insert_into(document_tags::table)
+        .values(&new_tags)
+        .on_conflict_do_nothing()
+        .execute(conn)?;
+
+    Ok(inserted)
+}
+
+pub fn load_tags_for_documents(
+    conn: &mut PgConnection,
+    document_ids: &[Uuid],
+) -> AppResult<HashMap<Uuid, Vec<Tag>>> {
+    if document_ids.is_empty() {
+        return Ok(HashMap::new());
+    }
+
+    let rows: Vec<(Uuid, Tag)> = document_tags::table
+        .inner_join(tags::table)
+        .filter(document_tags::document_id.eq_any(document_ids))
+        .select((document_tags::document_id, tags::all_columns))
+        .load(conn)?;
+
+    let mut map: HashMap<Uuid, Vec<Tag>> = HashMap::new();
+    for (doc_id, tag) in rows {
+        map.entry(doc_id).or_default().push(tag);
+    }
+    Ok(map)
+}
@@ -4,6 +4,7 @@ use axum::{
    Json,
 };
 use serde::Serialize;
+use serde_json::Value;
 use std::fmt::Display;

 pub type AppResult<T> = Result<T, AppError>;
@@ -13,6 +14,7 @@ pub struct AppError {
    status: StatusCode,
    message: String,
    code: Option<String>,
+    details: Option<Value>,
 }

 impl AppError {
@@ -21,6 +23,7 @@ impl AppError {
            status,
            message: message.into(),
            code: None,
+            details: None,
        }
    }

@@ -48,6 +51,11 @@ impl AppError {
        self.code = Some(code.into());
        self
    }
+
+    pub fn with_details(mut self, details: Value) -> Self {
+        self.details = Some(details);
+        self
+    }
 }

 impl IntoResponse for AppError {
@@ -56,6 +64,7 @@ impl IntoResponse for AppError {
        let body = Json(ErrorResponse {
            error: self.message,
            code: self.code,
+            details: self.details,
        });
        (status, body).into_response()
    }
@@ -66,13 +75,18 @@ struct ErrorResponse {
    error: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    code: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    details: Option<Value>,
 }

 impl From<diesel::result::Error> for AppError {
    fn from(value: diesel::result::Error) -> Self {
        match value {
            diesel::result::Error::NotFound => AppError::not_found(),
-            _ => AppError::internal(value),
+            other => {
+                tracing::error!(error = ?other, "database operation failed");
+                AppError::internal("database operation failed")
+            }
        }
    }
 }
@@ -19,6 +19,7 @@ pub const JOB_ANALYZE_DOCUMENT: &str = "analyze-document";
 pub const JOB_GENERATE_THUMBNAILS: &str = "generate-thumbnails";
 pub const JOB_GENERATE_OCR_TEXT: &str = "generate-ocr-text";
 pub const JOB_INDEX_DOCUMENT_TEXT: &str = "index-document-text";
+pub const JOB_PROVISION_TENANT: &str = "provision-tenant";

 #[derive(Debug, Error)]
 pub enum JobQueueError {
@@ -1,6 +1,7 @@
 pub mod auth;
 pub mod config;
 pub mod db;
+pub mod documents;
 pub mod error;
 pub mod jobs;
 pub mod models;
@@ -3,7 +3,7 @@ use std::net::SocketAddr;
 use tokio::net::TcpListener;
 use tower::make::Shared;

-use backend::{routes, utils::bootstrap::init_component};
+use papercrate::{routes, utils::bootstrap::init_component};

 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
@@ -1,7 +1,22 @@
 use chrono::NaiveDateTime;
+use diesel::deserialize::FromSql;
+use diesel::pg::{Pg, PgValue};
 use diesel::prelude::*;
+use diesel::serialize::{IsNull, Output, ToSql};
+use diesel::{deserialize, serialize, AsExpression, FromSqlRow};
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use std::fmt;
+use std::io::Write;
+use std::str;
 use uuid::Uuid;

+use utoipa::ToSchema;
+
+use crate::schema::sql_types::{
+    ApiTokenCapability as ApiTokenCapabilitySql, MagicTokenKind as MagicTokenKindSql,
+    TenantStatus as TenantStatusSql,
+};
 use crate::schema::*;

 #[derive(Debug, Clone, Queryable, Identifiable, Associations)]
@@ -12,7 +27,6 @@ pub struct UserMembership {
    pub id: Uuid,
    pub user_id: Uuid,
    pub tenant_id: Uuid,
-    pub role: String,
    pub created_at: NaiveDateTime,
    pub updated_at: NaiveDateTime,
 }
@@ -23,7 +37,184 @@ pub struct NewUserMembership {
    pub id: Uuid,
    pub user_id: Uuid,
    pub tenant_id: Uuid,
-    pub role: String,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, AsExpression, FromSqlRow)]
+#[diesel(sql_type = TenantStatusSql)]
+pub enum TenantStatus {
+    Creating,
+    Active,
+    Suspended,
+    Deleting,
+    Error,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, AsExpression, FromSqlRow)]
+#[diesel(sql_type = MagicTokenKindSql)]
+pub enum MagicTokenKind {
+    EmailLogin,
+    DemoLogin,
+}
+
+#[derive(
+    Debug, Clone, Copy, PartialEq, Eq, AsExpression, FromSqlRow, Serialize, Deserialize, ToSchema,
+)]
+#[diesel(sql_type = ApiTokenCapabilitySql)]
+#[serde(rename_all = "snake_case")]
+pub enum ApiTokenCapability {
+    Api,
+    Webdav,
+}
+
+impl MagicTokenKind {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            MagicTokenKind::EmailLogin => "email_login",
+            MagicTokenKind::DemoLogin => "demo_login",
+        }
+    }
+
+    pub fn variants() -> &'static [&'static str] {
+        &["email_login", "demo_login"]
+    }
+}
+
+impl ApiTokenCapability {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            ApiTokenCapability::Api => "api",
+            ApiTokenCapability::Webdav => "webdav",
+        }
+    }
+
+    pub fn variants() -> &'static [&'static str] {
+        &["api", "webdav"]
+    }
+}
+
+impl fmt::Display for MagicTokenKind {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}", self.as_str())
+    }
+}
+
+impl fmt::Display for ApiTokenCapability {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}", self.as_str())
+    }
+}
+
+impl ToSql<MagicTokenKindSql, Pg> for MagicTokenKind {
+    fn to_sql<'b>(&'b self, out: &mut Output<'b, '_, Pg>) -> serialize::Result {
+        out.write_all(self.as_str().as_bytes())?;
+        Ok(IsNull::No)
+    }
+}
+
+impl ToSql<ApiTokenCapabilitySql, Pg> for ApiTokenCapability {
+    fn to_sql<'b>(&'b self, out: &mut Output<'b, '_, Pg>) -> serialize::Result {
+        out.write_all(self.as_str().as_bytes())?;
+        Ok(IsNull::No)
+    }
+}
+
+impl FromSql<MagicTokenKindSql, Pg> for MagicTokenKind {
+    fn from_sql(bytes: PgValue<'_>) -> deserialize::Result<Self> {
+        match std::str::from_utf8(bytes.as_bytes())? {
+            "email_login" => Ok(MagicTokenKind::EmailLogin),
+            "demo_login" => Ok(MagicTokenKind::DemoLogin),
+            other => Err(Box::new(std::io::Error::new(
+                std::io::ErrorKind::InvalidData,
+                format!("invalid magic_token_kind '{other}'"),
+            ))),
+        }
+    }
+}
+
+impl FromSql<ApiTokenCapabilitySql, Pg> for ApiTokenCapability {
+    fn from_sql(bytes: PgValue<'_>) -> deserialize::Result<Self> {
+        match std::str::from_utf8(bytes.as_bytes())? {
+            "api" => Ok(ApiTokenCapability::Api),
+            "webdav" => Ok(ApiTokenCapability::Webdav),
+            other => Err(Box::new(std::io::Error::new(
+                std::io::ErrorKind::InvalidData,
+                format!("invalid api_token_capability '{other}'"),
+            ))),
+        }
+    }
+}
+
+impl str::FromStr for MagicTokenKind {
+    type Err = &'static str;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "email_login" => Ok(MagicTokenKind::EmailLogin),
+            "demo_login" => Ok(MagicTokenKind::DemoLogin),
+            _ => Err("unsupported magic token kind"),
+        }
+    }
+}
+
+impl str::FromStr for ApiTokenCapability {
+    type Err = &'static str;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "api" => Ok(ApiTokenCapability::Api),
+            "webdav" => Ok(ApiTokenCapability::Webdav),
+            _ => Err("unsupported api token capability"),
+        }
+    }
+}
+
+impl TenantStatus {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            TenantStatus::Creating => "creating",
+            TenantStatus::Active => "active",
+            TenantStatus::Suspended => "suspended",
+            TenantStatus::Deleting => "deleting",
+            TenantStatus::Error => "error",
+        }
+    }
+
+    pub fn from_str(value: &str) -> Option<Self> {
+        match value {
+            "creating" => Some(TenantStatus::Creating),
+            "active" => Some(TenantStatus::Active),
+            "suspended" => Some(TenantStatus::Suspended),
+            "deleting" => Some(TenantStatus::Deleting),
+            "error" => Some(TenantStatus::Error),
+            _ => None,
+        }
+    }
+}
+
+impl fmt::Display for TenantStatus {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}", self.as_str())
+    }
+}
+
+impl ToSql<TenantStatusSql, Pg> for TenantStatus {
+    fn to_sql<'b>(&'b self, out: &mut Output<'b, '_, Pg>) -> serialize::Result {
+        out.write_all(self.as_str().as_bytes())?;
+        Ok(IsNull::No)
+    }
+}
+
+impl FromSql<TenantStatusSql, Pg> for TenantStatus {
+    fn from_sql(bytes: PgValue<'_>) -> deserialize::Result<Self> {
+        let value = str::from_utf8(bytes.as_bytes())
+            .map_err(|err| Box::<dyn std::error::Error + Send + Sync>::from(err))?;
+        TenantStatus::from_str(value).ok_or_else(|| {
+            Box::<dyn std::error::Error + Send + Sync>::from(std::io::Error::new(
+                std::io::ErrorKind::InvalidData,
+                format!("invalid tenant status '{value}'"),
+            ))
+        })
+    }
 }

 #[derive(Debug, Clone, Queryable, Identifiable)]
@@ -31,13 +222,14 @@ pub struct NewUserMembership {
 #[diesel(primary_key(id))]
 pub struct Tenant {
    pub id: Uuid,
-    pub slug: String,
+    pub name: String,
    pub storage_root: Option<String>,
    pub quickwit_index: Option<String>,
-    pub status: String,
-    pub config: serde_json::Value,
+    pub config: Value,
    pub created_at: NaiveDateTime,
    pub updated_at: NaiveDateTime,
+    pub status: TenantStatus,
+    pub created_by: Option<Uuid>,
 }

 #[derive(Debug, Clone, Queryable, Identifiable)]
@@ -45,7 +237,6 @@ pub struct Tenant {
 pub struct User {
    pub id: Uuid,
    pub username: String,
-    pub password_hash: String,
    pub created_at: NaiveDateTime,
    pub updated_at: NaiveDateTime,
 }
@@ -55,7 +246,96 @@ pub struct User {
 pub struct NewUser {
    pub id: Uuid,
    pub username: String,
-    pub password_hash: String,
+}
+
+#[derive(Debug, Clone, Queryable, Identifiable, Associations, Selectable)]
+#[diesel(table_name = user_passkeys)]
+#[diesel(belongs_to(User))]
+pub struct UserPasskey {
+    pub id: Uuid,
+    pub user_id: Uuid,
+    pub credential_id: Vec<u8>,
+    pub public_key: Vec<u8>,
+    pub credential: serde_json::Value,
+    pub sign_count: i64,
+    pub transports: Vec<Option<String>>,
+    pub aaguid: Option<Uuid>,
+    pub nickname: Option<String>,
+    pub created_at: NaiveDateTime,
+    pub updated_at: NaiveDateTime,
+    pub last_used_at: Option<NaiveDateTime>,
+    pub revoked_at: Option<NaiveDateTime>,
+    pub revoked_by: Option<Uuid>,
+    pub revoked_reason: Option<String>,
+}
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = user_passkeys)]
+pub struct NewUserPasskey {
+    pub id: Uuid,
+    pub user_id: Uuid,
+    pub credential_id: Vec<u8>,
+    pub public_key: Vec<u8>,
+    pub credential: serde_json::Value,
+    pub sign_count: i64,
+    pub transports: Vec<Option<String>>,
+    pub aaguid: Option<Uuid>,
+    pub nickname: Option<String>,
+}
+
+#[derive(Debug, Clone, Queryable, Identifiable, Associations)]
+#[diesel(table_name = webauthn_challenges)]
+#[diesel(belongs_to(User))]
+pub struct WebauthnChallenge {
+    pub id: Uuid,
+    pub user_id: Option<Uuid>,
+    pub purpose: String,
+    pub challenge: Vec<u8>,
+    pub state: Vec<u8>,
+    pub created_at: NaiveDateTime,
+    pub expires_at: NaiveDateTime,
+}
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = webauthn_challenges)]
+pub struct NewWebauthnChallenge {
+    pub id: Uuid,
+    pub user_id: Option<Uuid>,
+    pub purpose: String,
+    pub challenge: Vec<u8>,
+    pub state: Vec<u8>,
+    pub expires_at: NaiveDateTime,
+}
+
+#[derive(Debug, Clone, Queryable, Identifiable, Associations)]
+#[diesel(table_name = api_tokens)]
+#[diesel(belongs_to(User))]
+#[diesel(belongs_to(Tenant))]
+pub struct ApiToken {
+    pub id: Uuid,
+    pub user_id: Uuid,
+    pub tenant_id: Uuid,
+    pub token_prefix: String,
+    pub token_hash: String,
+    pub label: Option<String>,
+    pub created_at: NaiveDateTime,
+    pub last_used_at: Option<NaiveDateTime>,
+    pub expires_at: Option<NaiveDateTime>,
+    pub revoked_at: Option<NaiveDateTime>,
+    pub capabilities: Vec<ApiTokenCapability>,
+}
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = api_tokens)]
+pub struct NewApiToken {
+    pub id: Uuid,
+    pub user_id: Uuid,
+    pub tenant_id: Uuid,
+    pub token_prefix: String,
+    pub token_hash: String,
+    pub label: Option<String>,
+    pub expires_at: Option<NaiveDateTime>,
+    pub capabilities: Vec<ApiTokenCapability>,
 }

 #[derive(Debug, Clone, Queryable, Identifiable)]
@@ -87,7 +367,7 @@ pub struct Document {
    pub original_name: String,
    pub content_type: Option<String>,
    pub folder_id: Option<Uuid>,
-    pub uploaded_at: NaiveDateTime,
+    pub created_at: NaiveDateTime,
    pub updated_at: NaiveDateTime,
    pub deleted_at: Option<NaiveDateTime>,
    pub metadata: serde_json::Value,
@@ -112,6 +392,22 @@ pub struct NewDocument {
    pub tenant_id: Uuid,
 }

+#[derive(Debug, Clone, Queryable, Identifiable, Insertable)]
+#[diesel(table_name = magic_tokens)]
+pub struct MagicToken {
+    pub id: Uuid,
+    pub user_id: Uuid,
+    pub kind: MagicTokenKind,
+    pub token_hash: String,
+    pub metadata: serde_json::Value,
+    pub expires_at: NaiveDateTime,
+    pub max_uses: Option<i32>,
+    pub used_count: i32,
+    pub created_at: NaiveDateTime,
+    pub created_by: Option<Uuid>,
+    pub last_used_at: Option<NaiveDateTime>,
+}
+
 #[derive(Debug, Clone, Queryable, Identifiable, Associations)]
 #[diesel(table_name = document_versions)]
 #[diesel(belongs_to(Document))]
@@ -123,7 +419,6 @@ pub struct DocumentVersion {
    pub size_bytes: i64,
    pub checksum: String,
    pub created_at: NaiveDateTime,
-    pub operations_summary: serde_json::Value,
    pub metadata: serde_json::Value,
    pub tenant_id: Uuid,
 }
@@ -137,7 +432,6 @@ pub struct NewDocumentVersion {
    pub s3_key: String,
    pub size_bytes: i64,
    pub checksum: String,
-    pub operations_summary: serde_json::Value,
    pub metadata: serde_json::Value,
    pub tenant_id: Uuid,
 }
@@ -283,11 +577,10 @@ pub struct NewCorrespondent {
 #[diesel(table_name = document_correspondents)]
 #[diesel(belongs_to(Document))]
 #[diesel(belongs_to(Correspondent))]
-#[diesel(primary_key(document_id, correspondent_id, role))]
+#[diesel(primary_key(document_id, correspondent_id))]
 pub struct DocumentCorrespondent {
    pub document_id: Uuid,
    pub correspondent_id: Uuid,
-    pub role: String,
    pub assigned_at: NaiveDateTime,
    pub assigned_by: Option<Uuid>,
    pub tenant_id: Uuid,
@@ -298,15 +591,14 @@ pub struct DocumentCorrespondent {
 pub struct NewDocumentCorrespondent {
    pub document_id: Uuid,
    pub correspondent_id: Uuid,
-    pub role: String,
    pub assigned_by: Option<Uuid>,
    pub tenant_id: Uuid,
 }

 #[derive(Debug, Clone, Queryable, Identifiable, Associations)]
-#[diesel(table_name = refresh_tokens)]
+#[diesel(table_name = user_sessions)]
 #[diesel(belongs_to(User))]
-pub struct RefreshToken {
+pub struct UserSession {
    pub id: Uuid,
    pub user_id: Uuid,
    pub token_hash: String,
@@ -319,8 +611,8 @@ pub struct RefreshToken {
 }

 #[derive(Debug, Insertable)]
-#[diesel(table_name = refresh_tokens)]
-pub struct NewRefreshToken {
+#[diesel(table_name = user_sessions)]
+pub struct NewUserSession {
    pub id: Uuid,
    pub user_id: Uuid,
    pub token_hash: String,
@@ -1,10 +1,11 @@
-use std::collections::{BTreeMap, HashMap};
+use std::collections::HashMap;

 use axum::{extract::Path, http::StatusCode, Json};
 use chrono::Utc;
 use diesel::{dsl::count_star, prelude::*, result::DatabaseErrorKind, PgConnection};
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
+use utoipa::ToSchema;
 use uuid::Uuid;

 use crate::{
@@ -14,37 +15,40 @@ use crate::{
    schema::{correspondents, document_correspondents},
    utils::{
        db::{no_content, EnsureEntity, IntoJsonResponse},
+        named_entity::{ensure_name_available, normalize_name},
        time::to_iso,
    },
 };

-#[derive(Serialize)]
+#[derive(Serialize, ToSchema)]
 pub struct CorrespondentUsage {
    pub total: i64,
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub by_role: BTreeMap<String, i64>,
 }

-#[derive(Serialize)]
+#[derive(Serialize, ToSchema)]
 pub struct CorrespondentSummary {
    pub id: Uuid,
    pub name: String,
+    #[schema(value_type = Object)]
    pub metadata: Value,
    pub created_at: String,
    pub updated_at: String,
    pub usage: CorrespondentUsage,
 }

-#[derive(Deserialize)]
+#[derive(Deserialize, ToSchema)]
 pub struct CreateCorrespondentRequest {
    pub name: String,
    #[serde(default)]
+    #[schema(nullable, value_type = Object)]
    pub metadata: Option<Value>,
 }

-#[derive(Deserialize)]
+#[derive(Deserialize, ToSchema)]
 pub struct UpdateCorrespondentRequest {
+    #[schema(nullable)]
    pub name: Option<String>,
+    #[schema(nullable, value_type = Object)]
    pub metadata: Option<Value>,
 }

@@ -55,6 +59,12 @@ struct CorrespondentChangeset<'a> {
    metadata: Option<&'a Value>,
 }

+#[utoipa::path(
+    get,
+    path = "/api/correspondents",
+    responses((status = 200, description = "Correspondents", body = [CorrespondentSummary])),
+    tag = "Correspondents"
+)]
 pub async fn list_correspondents(
    TenantScopedConn {
        mut conn,
@@ -67,36 +77,33 @@ pub async fn list_correspondents(
        .order(correspondents::name.asc())
        .load(&mut conn)?;

-    let usage_rows: Vec<(Uuid, String, i64)> = document_correspondents::table
+    let usage_rows: Vec<(Uuid, i64)> = document_correspondents::table
        .filter(document_correspondents::tenant_id.eq(tenant_id))
-        .group_by((
-            document_correspondents::correspondent_id,
-            document_correspondents::role,
-        ))
-        .select((
-            document_correspondents::correspondent_id,
-            document_correspondents::role,
-            count_star(),
-        ))
+        .group_by(document_correspondents::correspondent_id)
+        .select((document_correspondents::correspondent_id, count_star()))
        .load(&mut conn)?;

-    let mut usage_map: HashMap<Uuid, BTreeMap<String, i64>> = HashMap::new();
-    for (correspondent_id, role, count) in usage_rows {
-        usage_map
-            .entry(correspondent_id)
-            .or_default()
-            .insert(role, count);
+    let mut usage_map: HashMap<Uuid, i64> = HashMap::new();
+    for (correspondent_id, count) in usage_rows {
+        usage_map.insert(correspondent_id, count);
    }

    let mut response = Vec::with_capacity(correspondents_list.len());
    for correspondent in correspondents_list {
-        let role_counts = usage_map.remove(&correspondent.id).unwrap_or_default();
-        response.push(build_summary(correspondent, role_counts));
+        let total = usage_map.remove(&correspondent.id).unwrap_or(0);
+        response.push(build_summary(correspondent, total));
    }

    response.into_json()
 }

+#[utoipa::path(
+    post,
+    path = "/api/correspondents",
+    request_body = CreateCorrespondentRequest,
+    responses((status = 200, description = "Correspondent created", body = CorrespondentSummary)),
+    tag = "Correspondents"
+)]
 pub async fn create_correspondent(
    TenantScopedConn {
        mut conn,
@@ -105,16 +112,15 @@ pub async fn create_correspondent(
    }: TenantScopedConn,
    Json(payload): Json<CreateCorrespondentRequest>,
 ) -> AppResult<Json<CorrespondentSummary>> {
-    let name = payload.name.trim();
-    if name.is_empty() {
-        return Err(AppError::bad_request("name must not be empty"));
-    }
+    let name = normalize_name(&payload.name, || {
+        AppError::bad_request("name must not be empty")
+    })?;

    let metadata_value = normalize_metadata(payload.metadata);
    let new_id = Uuid::new_v4();
    let new_correspondent = NewCorrespondent {
        id: new_id,
-        name: name.to_string(),
+        name: name.clone(),
        metadata: metadata_value,
        tenant_id,
    };
@@ -136,9 +142,17 @@ pub async fn create_correspondent(
        .first(&mut conn)
        .one()?;

-    build_summary(correspondent, BTreeMap::new()).into_json()
+    build_summary(correspondent, 0).into_json()
 }

+#[utoipa::path(
+    patch,
+    path = "/api/correspondents/{id}",
+    params(("id" = Uuid, Path, description = "Correspondent ID")),
+    request_body = UpdateCorrespondentRequest,
+    responses((status = 200, description = "Correspondent updated", body = CorrespondentSummary)),
+    tag = "Correspondents"
+)]
 pub async fn update_correspondent(
    Path(correspondent_id): Path<Uuid>,
    TenantScopedConn {
@@ -156,21 +170,22 @@ pub async fn update_correspondent(

    let mut new_name: Option<String> = None;
    if let Some(ref candidate) = payload.name {
-        let trimmed = candidate.trim();
-        if trimmed.is_empty() {
-            return Err(AppError::bad_request("name must not be empty"));
-        }
-        if trimmed != existing.name {
-            let duplicate = correspondents::table
-                .filter(correspondents::name.eq(trimmed))
-                .filter(correspondents::id.ne(correspondent_id))
-                .filter(correspondents::tenant_id.eq(tenant_id))
-                .first::<Correspondent>(&mut conn)
-                .optional()?;
-            if duplicate.is_some() {
-                return Err(AppError::bad_request("correspondent name already exists"));
-            }
-            new_name = Some(trimmed.to_string());
+        let normalized = normalize_name(candidate, || {
+            AppError::bad_request("name must not be empty")
+        })?;
+        if normalized != existing.name {
+            ensure_name_available(
+                || {
+                    correspondents::table
+                        .filter(correspondents::name.eq(&normalized))
+                        .filter(correspondents::id.ne(correspondent_id))
+                        .filter(correspondents::tenant_id.eq(tenant_id))
+                        .first::<Correspondent>(&mut conn)
+                        .optional()
+                },
+                || AppError::bad_request("correspondent name already exists"),
+            )?;
+            new_name = Some(normalized);
        }
    }

@@ -213,6 +228,13 @@ pub async fn update_correspondent(
    build_summary(updated, usage).into_json()
 }

+#[utoipa::path(
+    delete,
+    path = "/api/correspondents/{id}",
+    params(("id" = Uuid, Path, description = "Correspondent ID")),
+    responses((status = 204, description = "Correspondent deleted")),
+    tag = "Correspondents"
+)]
 pub async fn delete_correspondent(
    Path(correspondent_id): Path<Uuid>,
    TenantScopedConn {
@@ -245,21 +267,14 @@ pub async fn delete_correspondent(
    no_content()
 }

-fn build_summary(
-    correspondent: Correspondent,
-    role_counts: BTreeMap<String, i64>,
-) -> CorrespondentSummary {
-    let total = role_counts.values().copied().sum();
+fn build_summary(correspondent: Correspondent, total: i64) -> CorrespondentSummary {
    CorrespondentSummary {
        id: correspondent.id,
        name: correspondent.name,
        metadata: correspondent.metadata,
        created_at: to_iso(correspondent.created_at),
        updated_at: to_iso(correspondent.updated_at),
-        usage: CorrespondentUsage {
-            total,
-            by_role: role_counts,
-        },
+        usage: CorrespondentUsage { total },
    }
 }

@@ -274,17 +289,29 @@ fn load_usage_for_correspondent(
    conn: &mut PgConnection,
    tenant_id: Uuid,
    correspondent_id: Uuid,
-) -> AppResult<BTreeMap<String, i64>> {
-    let rows: Vec<(String, i64)> = document_correspondents::table
+) -> AppResult<i64> {
+    let total: i64 = document_correspondents::table
        .filter(document_correspondents::correspondent_id.eq(correspondent_id))
        .filter(document_correspondents::tenant_id.eq(tenant_id))
-        .group_by(document_correspondents::role)
-        .select((document_correspondents::role, count_star()))
-        .load(conn)?;
+        .select(count_star())
+        .get_result(conn)?;

-    let mut map = BTreeMap::new();
-    for (role, count) in rows {
-        map.insert(role, count);
-    }
-    Ok(map)
+    Ok(total)
 }
+
+#[derive(utoipa::OpenApi)]
+#[openapi(
+    paths(
+        crate::routes::correspondents::list_correspondents,
+        crate::routes::correspondents::create_correspondent,
+        crate::routes::correspondents::update_correspondent,
+        crate::routes::correspondents::delete_correspondent
+    ),
+    components(schemas(
+        crate::routes::correspondents::CorrespondentSummary,
+        crate::routes::correspondents::CorrespondentUsage,
+        crate::routes::correspondents::CreateCorrespondentRequest,
+        crate::routes::correspondents::UpdateCorrespondentRequest
+    ))
+)]
+pub struct CorrespondentsApiDoc;
@@ -1,120 +0,0 @@
-use std::path::Path as FsPath;
-
-use uuid::Uuid;
-
-use crate::error::{AppError, AppResult};
-use crate::models::{Document, DocumentAsset, DocumentAssetObject, DocumentVersion};
-use crate::state::AppState;
-use crate::utils::time::to_iso;
-
-use super::{
-    DocumentAssetDetailResponse, DocumentAssetObjectResponse, DocumentAssetResponse,
-    DocumentVersionResponse,
-};
-
-pub fn build_download_path(
-    state: &AppState,
-    document: &Document,
-    user_id: Uuid,
-) -> AppResult<String> {
-    state
-        .jwt
-        .generate_download_token(document.id, user_id, document.tenant_id)
-        .map(|token| format!("/download/{token}"))
-        .map_err(|err| AppError::internal(format!("failed to generate download token: {err}")))
-}
-
-pub fn to_version_response(
-    version: DocumentVersion,
-    include_operations_summary: bool,
-) -> DocumentVersionResponse {
-    DocumentVersionResponse {
-        id: version.id,
-        version_number: version.version_number,
-        s3_key: version.s3_key,
-        size_bytes: version.size_bytes,
-        checksum: version.checksum,
-        created_at: to_iso(version.created_at),
-        metadata: version.metadata,
-        operations_summary: if include_operations_summary {
-            Some(version.operations_summary)
-        } else {
-            None
-        },
-    }
-}
-
-pub fn to_asset_summary(asset: DocumentAsset) -> DocumentAssetResponse {
-    DocumentAssetResponse {
-        id: asset.id,
-        asset_type: asset.asset_type,
-        mime_type: asset.mime_type,
-        metadata: asset.metadata,
-        cardinality: asset.cardinality,
-    }
-}
-
-pub fn to_asset_detail_response(
-    asset: DocumentAsset,
-    objects: Vec<DocumentAssetObjectResponse>,
-) -> DocumentAssetDetailResponse {
-    DocumentAssetDetailResponse {
-        id: asset.id,
-        asset_type: asset.asset_type,
-        mime_type: asset.mime_type,
-        metadata: asset.metadata,
-        created_at: to_iso(asset.created_at),
-        cardinality: asset.cardinality,
-        objects,
-    }
-}
-
-pub fn to_asset_object_response(
-    object: DocumentAssetObject,
-    url: Option<String>,
-    expires_at: Option<i64>,
-) -> DocumentAssetObjectResponse {
-    DocumentAssetObjectResponse {
-        id: object.id,
-        ordinal: object.ordinal,
-        metadata: object.metadata,
-        url,
-        expires_at,
-    }
-}
-
-pub fn derive_document_title(original: &str) -> String {
-    let trimmed = original.trim();
-    if trimmed.is_empty() {
-        return "Document".to_string();
-    }
-
-    let stem = FsPath::new(trimmed)
-        .file_stem()
-        .and_then(|s| s.to_str())
-        .map(|s| s.trim())
-        .filter(|s| !s.is_empty())
-        .map(|s| s.to_string());
-
-    stem.unwrap_or_else(|| trimmed.to_string())
-}
-
-pub fn filename_with_retained_extension(title: &str, current_filename: &str) -> String {
-    let extension = FsPath::new(current_filename)
-        .extension()
-        .and_then(|ext| ext.to_str());
-
-    if let Some(ext) = extension {
-        if title
-            .rsplit_once('.')
-            .map(|(_, existing_ext)| existing_ext.eq_ignore_ascii_case(ext))
-            .unwrap_or(false)
-        {
-            title.to_string()
-        } else {
-            format!("{title}.{ext}")
-        }
-    } else {
-        title.to_string()
-    }
-}
@@ -1,61 +0,0 @@
-use std::collections::HashSet;
-
-use uuid::Uuid;
-
-use crate::error::{AppError, AppResult};
-
-use super::CorrespondentAssignmentInput;
-
-pub const CORRESPONDENT_ROLES: &[&str] = &["sender", "receiver", "other"];
-
-pub fn normalize_role(value: &str) -> String {
-    value.trim().to_lowercase()
-}
-
-pub fn is_valid_correspondent_role(role: &str) -> bool {
-    CORRESPONDENT_ROLES.iter().any(|allowed| *allowed == role)
-}
-
-pub fn normalize_correspondent_assignments(
-    assignments: &[CorrespondentAssignmentInput],
-) -> AppResult<(Vec<(Uuid, String)>, Vec<Uuid>, Vec<String>)> {
-    let mut unique_pairs: HashSet<(Uuid, String)> = HashSet::new();
-    let mut normalized_pairs: Vec<(Uuid, String)> = Vec::new();
-    let mut role_set: HashSet<String> = HashSet::new();
-    let mut correspondent_ids: HashSet<Uuid> = HashSet::new();
-
-    for assignment in assignments {
-        let role = normalize_role(&assignment.role);
-        if role.is_empty() {
-            return Err(AppError::bad_request("role must not be empty"));
-        }
-        if !is_valid_correspondent_role(&role) {
-            return Err(AppError::bad_request(format!(
-                "invalid correspondent role '{role}'. Allowed roles: {}",
-                CORRESPONDENT_ROLES.join(", ")
-            )));
-        }
-
-        if !unique_pairs.insert((assignment.correspondent_id, role.clone())) {
-            continue;
-        }
-
-        normalized_pairs.push((assignment.correspondent_id, role.clone()));
-        role_set.insert(role);
-        correspondent_ids.insert(assignment.correspondent_id);
-    }
-
-    if normalized_pairs.is_empty() {
-        return Err(AppError::bad_request(
-            "assignments must contain at least one unique correspondent/role pair",
-        ));
-    }
-
-    let mut correspondents_vec: Vec<Uuid> = correspondent_ids.into_iter().collect();
-    correspondents_vec.sort();
-
-    let mut roles_vec: Vec<String> = role_set.into_iter().collect();
-    roles_vec.sort();
-
-    Ok((normalized_pairs, correspondents_vec, roles_vec))
-}
@@ -1,91 +0,0 @@
-use serde_json::Value;
-use uuid::Uuid;
-
-pub fn build_quickwit_query(input: &str) -> Option<String> {
-    let tokens: Vec<String> = input
-        .split_whitespace()
-        .filter(|token| !token.is_empty())
-        .map(|token| {
-            let normalized = token.to_lowercase();
-            escape_quickwit_token(&normalized)
-        })
-        .collect();
-
-    if tokens.is_empty() {
-        return None;
-    }
-
-    let parts: Vec<String> = tokens
-        .into_iter()
-        .map(|token| format!("(title:{token} OR text:{token})"))
-        .collect();
-
-    Some(parts.join(" AND "))
-}
-
-pub fn escape_quickwit_token(token: &str) -> String {
-    let mut escaped = String::with_capacity(token.len());
-    for ch in token.chars() {
-        match ch {
-            '+' | '-' | '&' | '|' | '!' | '(' | ')' | '{' | '}' | '[' | ']' | '^' | '"' | '~'
-            | '*' | '?' | ':' | '\\' | '/' => {
-                escaped.push('\\');
-                escaped.push(ch);
-            }
-            _ => escaped.push(ch),
-        }
-    }
-    escaped
-}
-
-pub fn extract_document_id(hit: &Value) -> Option<Uuid> {
-    for key in ["_source", "source", "fields", "stored_fields"] {
-        if let Some(value) = hit.get(key) {
-            if let Some(uuid) = extract_uuid_from_value(value) {
-                return Some(uuid);
-            }
-        }
-    }
-
-    if let Some(value) = hit.get("document_id") {
-        if let Some(uuid) = extract_uuid_from_value(value) {
-            return Some(uuid);
-        }
-    }
-
-    None
-}
-
-pub fn extract_uuid_from_value(value: &Value) -> Option<Uuid> {
-    if let Some(obj) = value.as_object() {
-        if let Some(inner) = obj.get("document_id") {
-            return parse_uuid_value(inner);
-        }
-    }
-
-    if let Some(arr) = value.as_array() {
-        for item in arr {
-            if let Some(uuid) = extract_uuid_from_value(item) {
-                return Some(uuid);
-            }
-        }
-    }
-
-    parse_uuid_value(value)
-}
-
-pub fn parse_uuid_value(value: &Value) -> Option<Uuid> {
-    if let Some(s) = value.as_str() {
-        return Uuid::parse_str(s).ok();
-    }
-
-    if let Some(arr) = value.as_array() {
-        for item in arr {
-            if let Some(uuid) = parse_uuid_value(item) {
-                return Some(uuid);
-            }
-        }
-    }
-
-    None
-}
@@ -4,7 +4,7 @@ use axum::{
 };
 use diesel::{dsl::exists, prelude::*, PgConnection};
 use serde::{Deserialize, Serialize};
-use serde_json::Value;
+use utoipa::{IntoParams, ToSchema};
 use uuid::Uuid;

 use crate::models::{Document, Folder, NewFolder};
@@ -15,42 +15,41 @@ use crate::{
    error::{AppError, AppResult},
 };

-use super::documents::{
-    load_correspondents_for_documents, load_primary_assets, load_tags_for_documents,
-    to_document_response, DocumentResponse,
-};
-use crate::utils::{
-    json::{classify_nullable, NullableValue},
-    time::to_iso,
-};
+use super::documents::{hydrate_documents, DocumentResponse};
+use crate::utils::{json::deserialize_patch_field, time::to_iso};

-#[derive(Deserialize)]
+#[derive(Deserialize, ToSchema)]
 pub struct CreateFolderRequest {
    pub name: String,
+    #[schema(nullable)]
    pub parent_id: Option<Uuid>,
 }

-#[derive(Deserialize)]
+#[derive(Deserialize, ToSchema)]
 pub struct EnsureFolderPathRequest {
+    #[schema(nullable)]
    pub parent_id: Option<Uuid>,
    pub segments: Vec<String>,
 }

-#[derive(Serialize)]
+#[derive(Serialize, ToSchema)]
 pub struct FolderResponse {
    pub folder: FolderInfo,
 }

-#[derive(Serialize)]
+#[derive(Serialize, ToSchema)]
 pub struct FolderContentsResponse {
+    #[schema(nullable)]
    pub folder: Option<FolderInfo>,
    pub subfolders: Vec<FolderInfo>,
    pub documents: Vec<DocumentResponse>,
 }

-#[derive(Deserialize)]
+#[derive(Deserialize, IntoParams, ToSchema)]
+#[into_params(parameter_in = Query)]
 pub struct FolderContentsQuery {
    #[serde(default = "default_include_documents")]
+    #[schema(default = true)]
    pub include_documents: bool,
 }

@@ -58,15 +57,58 @@ const fn default_include_documents() -> bool {
    true
 }

-#[derive(Serialize)]
+#[derive(Serialize, ToSchema)]
 pub struct FolderInfo {
    pub id: Uuid,
    pub name: String,
+    #[schema(nullable)]
    pub parent_id: Option<Uuid>,
    pub created_at: String,
    pub updated_at: String,
 }

+#[derive(Default, Deserialize, ToSchema)]
+pub struct UpdateFolderRequest {
+    #[serde(default, deserialize_with = "deserialize_patch_field")]
+    #[schema(nullable, value_type = Option<Uuid>)]
+    pub parent_id: Option<Option<Uuid>>,
+    #[serde(default, deserialize_with = "deserialize_patch_field")]
+    #[schema(nullable)]
+    pub name: Option<Option<String>>,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn update_folder_request_deserializes_null_parent() {
+        let req: UpdateFolderRequest =
+            serde_json::from_value(json!({ "parent_id": null })).unwrap();
+        assert!(matches!(req.parent_id, Some(None)));
+    }
+
+    #[test]
+    fn update_folder_request_deserializes_absent_parent() {
+        let req: UpdateFolderRequest = serde_json::from_value(json!({})).unwrap();
+        assert!(req.parent_id.is_none());
+    }
+
+    #[test]
+    fn update_folder_request_deserializes_null_name() {
+        let req: UpdateFolderRequest = serde_json::from_value(json!({ "name": null })).unwrap();
+        assert!(matches!(req.name, Some(None)));
+    }
+}
+
+#[utoipa::path(
+    get,
+    path = "/api/folders/{id}",
+    params(("id" = Uuid, Path, description = "Folder ID")),
+    responses((status = 200, description = "Folder detail", body = FolderResponse)),
+    tag = "Folders"
+)]
 pub async fn get_folder(
    Path(folder_id): Path<Uuid>,
    TenantScopedConn {
@@ -85,6 +127,13 @@ pub async fn get_folder(
    }))
 }

+#[utoipa::path(
+    post,
+    path = "/api/folders/path",
+    request_body = EnsureFolderPathRequest,
+    responses((status = 200, description = "Folder path ensured", body = FolderResponse)),
+    tag = "Folders"
+)]
 pub async fn ensure_folder_path(
    TenantScopedConn {
        mut conn,
@@ -109,16 +158,16 @@ pub async fn ensure_folder_path(

            let existing: Option<Folder> = if let Some(parent_id) = current_parent {
                folders::table
+                    .filter(folders::tenant_id.eq(tenant_id))
                    .filter(folders::parent_id.eq(Some(parent_id)))
                    .filter(folders::name.eq(name))
-                    .filter(folders::tenant_id.eq(tenant_id))
                    .first(conn)
                    .optional()?
            } else {
                folders::table
+                    .filter(folders::tenant_id.eq(tenant_id))
                    .filter(folders::parent_id.is_null())
                    .filter(folders::name.eq(name))
-                    .filter(folders::tenant_id.eq(tenant_id))
                    .first(conn)
                    .optional()?
            };
@@ -133,18 +182,37 @@ pub async fn ensure_folder_path(
                    tenant_id,
                };

-                diesel::insert_into(folders::table)
+                let inserted_id: Option<Uuid> = diesel::insert_into(folders::table)
                    .values(&new_folder)
-                    .execute(conn)?;
+                    .on_conflict_do_nothing()
+                    .returning(folders::id)
+                    .get_result(conn)
+                    .optional()?;

-                folders::table.find(new_folder.id).first(conn)?
+                if let Some(id) = inserted_id {
+                    folders::table
+                        .find(id)
+                        .filter(folders::tenant_id.eq(tenant_id))
+                        .first(conn)?
+                } else if let Some(parent_id) = current_parent {
+                    folders::table
+                        .filter(folders::tenant_id.eq(tenant_id))
+                        .filter(folders::parent_id.eq(Some(parent_id)))
+                        .filter(folders::name.eq(name))
+                        .first(conn)?
+                } else {
+                    folders::table
+                        .filter(folders::tenant_id.eq(tenant_id))
+                        .filter(folders::parent_id.is_null())
+                        .filter(folders::name.eq(name))
+                        .first(conn)?
+                }
            };
-
            current_parent = Some(folder.id);
            last_folder = Some(folder);
        }

-        last_folder.ok_or_else(|| AppError::internal("failed to resolve folder path".to_string()))
+        last_folder.ok_or_else(|| AppError::internal("failed to resolve folder path"))
    })?;

    Ok(Json(FolderResponse {
@@ -152,6 +220,16 @@ pub async fn ensure_folder_path(
    }))
 }

+#[utoipa::path(
+    post,
+    path = "/api/folders",
+    request_body = CreateFolderRequest,
+    responses(
+        (status = 201, description = "Folder created", body = FolderResponse),
+        (status = 200, description = "Folder already existed", body = FolderResponse)
+    ),
+    tag = "Folders"
+)]
 pub async fn create_folder(
    TenantScopedConn {
        mut conn,
@@ -159,28 +237,93 @@ pub async fn create_folder(
        ..
    }: TenantScopedConn,
    Json(payload): Json<CreateFolderRequest>,
-) -> AppResult<Json<FolderResponse>> {
+) -> AppResult<(StatusCode, Json<FolderResponse>)> {
    if payload.name.trim().is_empty() {
        return Err(AppError::bad_request("name must not be empty"));
    }

-    let new_folder = NewFolder {
-        id: Uuid::new_v4(),
-        name: payload.name.trim().to_string(),
-        parent_id: payload.parent_id,
-        tenant_id,
+    let name = payload.name.trim();
+
+    let existing: Option<Folder> = if let Some(parent_id) = payload.parent_id {
+        folders::table
+            .filter(folders::tenant_id.eq(tenant_id))
+            .filter(folders::parent_id.eq(Some(parent_id)))
+            .filter(folders::name.eq(name))
+            .first(&mut conn)
+            .optional()?
+    } else {
+        folders::table
+            .filter(folders::tenant_id.eq(tenant_id))
+            .filter(folders::parent_id.is_null())
+            .filter(folders::name.eq(name))
+            .first(&mut conn)
+            .optional()?
    };

-    diesel::insert_into(folders::table)
-        .values(&new_folder)
-        .execute(&mut conn)?;
+    let (folder, created): (Folder, bool) = if let Some(folder) = existing {
+        (folder, false)
+    } else {
+        let new_folder = NewFolder {
+            id: Uuid::new_v4(),
+            name: name.to_string(),
+            parent_id: payload.parent_id,
+            tenant_id,
+        };

-    let folder: Folder = folders::table.find(new_folder.id).first(&mut conn)?;
-    Ok(Json(FolderResponse {
+        let inserted_id: Option<Uuid> = diesel::insert_into(folders::table)
+            .values(&new_folder)
+            .on_conflict_do_nothing()
+            .returning(folders::id)
+            .get_result(&mut conn)
+            .optional()?;
+
+        if let Some(id) = inserted_id {
+            (
+                folders::table
+                    .find(id)
+                    .filter(folders::tenant_id.eq(tenant_id))
+                    .first(&mut conn)?,
+                true,
+            )
+        } else if let Some(parent_id) = payload.parent_id {
+            (
+                folders::table
+                    .filter(folders::tenant_id.eq(tenant_id))
+                    .filter(folders::parent_id.eq(Some(parent_id)))
+                    .filter(folders::name.eq(name))
+                    .first(&mut conn)?,
+                false,
+            )
+        } else {
+            (
+                folders::table
+                    .filter(folders::tenant_id.eq(tenant_id))
+                    .filter(folders::parent_id.is_null())
+                    .filter(folders::name.eq(name))
+                    .first(&mut conn)?,
+                false,
+            )
+        }
+    };
+
+    let response = Json(FolderResponse {
        folder: folder_to_info(folder),
-    }))
+    });
+
+    if created {
+        Ok((StatusCode::CREATED, response))
+    } else {
+        Ok((StatusCode::OK, response))
+    }
 }

+#[utoipa::path(
+    get,
+    path = "/api/folders/{id}/contents",
+    params(("id" = Uuid, Path, description = "Folder ID"), FolderContentsQuery),
+    responses((status = 200, description = "Folder contents", body = FolderContentsResponse)),
+    tag = "Folders"
+)]
 pub async fn list_folder_contents(
    State(state): State<AppState>,
    Path(folder_identifier): Path<String>,
@@ -230,7 +373,7 @@ pub async fn list_folder_contents(
        let docs_query = documents::table
            .filter(documents::deleted_at.is_null())
            .filter(documents::tenant_id.eq(tenant_id))
-            .order(documents::uploaded_at.desc());
+            .order(documents::created_at.desc());

        let docs: Vec<Document> = if let Some(current_folder) = folder_id {
            docs_query
@@ -242,29 +385,7 @@ pub async fn list_folder_contents(
                .load(&mut conn)?
        };

-        let doc_ids: Vec<Uuid> = docs.iter().map(|doc| doc.id).collect();
-        let tags_map = load_tags_for_documents(&mut conn, &doc_ids)?;
-        let mut correspondents_map = load_correspondents_for_documents(&mut conn, &doc_ids)?;
-        drop(conn);
-
-        let primary_versions = load_primary_assets(&state, tenant_id, &docs).await?;
-
-        let mut documents = Vec::with_capacity(doc_ids.len());
-        for doc in docs {
-            let tags = tags_map.get(&doc.id).cloned();
-            let correspondents = correspondents_map.remove(&doc.id).unwrap_or_default();
-            let current_version = primary_versions.get(&doc.id).cloned();
-            documents.push(to_document_response(
-                &state,
-                user_id,
-                doc,
-                tags,
-                correspondents,
-                current_version,
-            )?);
-        }
-
-        documents
+        hydrate_documents(&state, &mut conn, tenant_id, user_id, docs)?
    } else {
        Vec::new()
    };
@@ -276,6 +397,13 @@ pub async fn list_folder_contents(
    }))
 }

+#[utoipa::path(
+    delete,
+    path = "/api/folders/{id}",
+    params(("id" = Uuid, Path, description = "Folder ID")),
+    responses((status = 204, description = "Folder deleted")),
+    tag = "Folders"
+)]
 pub async fn delete_folder(
    Path(folder_id): Path<Uuid>,
    TenantScopedConn {
@@ -330,6 +458,14 @@ pub async fn delete_folder(
    Ok(StatusCode::NO_CONTENT)
 }

+#[utoipa::path(
+    patch,
+    path = "/api/folders/{id}",
+    params(("id" = Uuid, Path, description = "Folder ID")),
+    request_body = UpdateFolderRequest,
+    responses((status = 204, description = "Folder updated")),
+    tag = "Folders"
+)]
 pub async fn update_folder(
    Path(folder_id): Path<Uuid>,
    TenantScopedConn {
@@ -337,15 +473,8 @@ pub async fn update_folder(
        tenant_id,
        ..
    }: TenantScopedConn,
-    Json(body): Json<Value>,
+    Json(payload): Json<UpdateFolderRequest>,
 ) -> AppResult<StatusCode> {
-    if !body.is_object() {
-        return Err(AppError::bad_request("request body must be a JSON object"));
-    }
-
-    let parent_class = classify_nullable(body.get("parent_id")).map_err(AppError::bad_request)?;
-    let name_class = classify_nullable(body.get("name")).map_err(AppError::bad_request)?;
-
    conn.transaction::<(), AppError, _>(|conn| {
        let folder: Folder = folders::table
            .find(folder_id)
@@ -354,21 +483,15 @@ pub async fn update_folder(

        let mut next_parent = folder.parent_id;
        let mut parent_changed = false;
-        match parent_class {
-            NullableValue::Omitted => {}
-            NullableValue::Null => {
+        match payload.parent_id {
+            None => {}
+            Some(None) => {
                if folder.parent_id.is_some() {
                    parent_changed = true;
                }
                next_parent = None;
            }
-            NullableValue::String(value) => {
-                let trimmed = value.trim();
-                if trimmed.is_empty() {
-                    return Err(AppError::bad_request("parent_id must not be empty"));
-                }
-                let parent_id = Uuid::parse_str(trimmed)
-                    .map_err(|_| AppError::bad_request("parent_id must be a valid UUID or null"))?;
+            Some(Some(parent_id)) => {
                if parent_id == folder_id {
                    return Err(AppError::bad_request("folder cannot be its own parent"));
                }
@@ -394,12 +517,12 @@ pub async fn update_folder(

        let mut new_name = folder.name.clone();
        let mut name_changed = false;
-        match name_class {
-            NullableValue::Omitted => {}
-            NullableValue::Null => {
+        match payload.name {
+            None => {}
+            Some(None) => {
                return Err(AppError::bad_request("name cannot be null"));
            }
-            NullableValue::String(value) => {
+            Some(Some(value)) => {
                let trimmed = value.trim();
                if trimmed.is_empty() {
                    return Err(AppError::bad_request("name must not be empty"));
@@ -487,3 +610,25 @@ pub(super) fn gather_descendant_folder_ids(

    Ok(ids)
 }
+
+#[derive(utoipa::OpenApi)]
+#[openapi(
+    paths(
+        crate::routes::folders::create_folder,
+        crate::routes::folders::ensure_folder_path,
+        crate::routes::folders::get_folder,
+        crate::routes::folders::list_folder_contents,
+        crate::routes::folders::delete_folder,
+        crate::routes::folders::update_folder
+    ),
+    components(schemas(
+        crate::routes::folders::CreateFolderRequest,
+        crate::routes::folders::EnsureFolderPathRequest,
+        crate::routes::folders::FolderResponse,
+        crate::routes::folders::FolderInfo,
+        crate::routes::folders::FolderContentsQuery,
+        crate::routes::folders::FolderContentsResponse,
+        crate::routes::folders::UpdateFolderRequest
+    ))
+)]
+pub struct FoldersApiDoc;
@@ -1,6 +1,46 @@
-use axum::{http::StatusCode, response::Json};
+use axum::{extract::State, http::StatusCode, response::Json};
+use diesel::RunQueryDsl;
 use serde_json::json;

-pub async fn health_check() -> (StatusCode, Json<serde_json::Value>) {
-    (StatusCode::OK, Json(json!({ "status": "ok" })))
+use crate::state::AppState;
+
+#[derive(utoipa::OpenApi)]
+#[openapi(paths(crate::routes::health::health_check))]
+pub struct HealthApiDoc;
+
+#[utoipa::path(
+    get,
+    path = "/api/health",
+    responses((status = 200, description = "Service is healthy")),
+    tag = "Health"
+)]
+pub async fn health_check(State(state): State<AppState>) -> (StatusCode, Json<serde_json::Value>) {
+    let database_ok = match state.db_unscoped() {
+        Ok(mut conn) => diesel::sql_query("SELECT 1")
+            .execute(&mut conn)
+            .map(|_| true)
+            .unwrap_or_else(|err| {
+                tracing::error!(error = ?err, "health check database ping failed");
+                false
+            }),
+        Err(err) => {
+            tracing::error!(error = ?err, "health check database connection failed");
+            false
+        }
+    };
+
+    let status = if database_ok {
+        StatusCode::OK
+    } else {
+        StatusCode::SERVICE_UNAVAILABLE
+    };
+
+    let payload = json!({
+        "status": if database_ok { "ok" } else { "error" },
+        "checks": {
+            "database": if database_ok { "ok" } else { "unavailable" }
+        }
+    });
+
+    (status, Json(payload))
 }
@@ -2,12 +2,15 @@ use axum::http::HeaderValue;
 use axum::{
    extract::DefaultBodyLimit,
    middleware,
-    response::Json,
+    response::{Html, Json},
    routing::{delete, get, patch, post},
    Router,
 };
 use std::sync::Arc;
-use tower_http::cors::{AllowOrigin, CorsLayer};
+use tower_http::{
+    cors::{AllowOrigin, CorsLayer},
+    trace::{DefaultMakeSpan, DefaultOnFailure, DefaultOnResponse, TraceLayer},
+};
 use utoipa::OpenApi;

 use crate::{auth::AuthenticatedUser, openapi::ApiDoc, state::AppState};
@@ -17,6 +20,7 @@ pub mod correspondents;
 pub mod documents;
 pub mod folders;
 pub mod health;
+pub mod profile;
 pub mod tags;
 pub mod webdav;

@@ -50,10 +54,24 @@ pub fn create_router(state: AppState) -> Router<()> {
    };

    let auth_routes = Router::new()
+        .route("/signup/start", post(auth::signup_start))
+        .route("/signup/finish", post(auth::signup_finish))
        .route("/login", post(auth::login))
+        .route("/exchange-api-token", post(auth::api_token_exchange))
        .route("/refresh", post(auth::refresh))
        .route("/logout", post(auth::logout))
        .route("/select-tenant", post(auth::select_tenant))
+        .route("/tenants", get(auth::list_tenants))
+        .route(
+            "/passkeys/register/start",
+            post(auth::passkey_register_start),
+        )
+        .route(
+            "/passkeys/register/finish",
+            post(auth::passkey_register_finish),
+        )
+        .route("/passkeys/login/start", post(auth::passkey_login_start))
+        .route("/passkeys/login/finish", post(auth::passkey_login_finish))
        .route("/me", get(auth::me));

    let documents_routes = Router::new()
@@ -78,12 +96,17 @@ pub fn create_router(state: AppState) -> Router<()> {
                .delete(documents::delete_document)
                .patch(documents::update_document),
        )
-        .route("/:id/download", get(documents::download_document))
        .route(
            "/:id/assets",
            get(documents::list_document_assets).post(documents::request_document_assets),
        )
        .route("/:id/folder", patch(documents::move_document))
+        .route("/:id/versions", get(documents::list_document_versions))
+        .route(
+            "/:id/versions/:version_id",
+            get(documents::get_document_version),
+        )
+        .route("/:id/restore", post(documents::restore_document))
        .route("/:id/tags", post(documents::assign_tags))
        .route("/:id/tags/:tag_id", delete(documents::remove_tag))
        .route(
@@ -121,6 +144,22 @@ pub fn create_router(state: AppState) -> Router<()> {
                .delete(correspondents::delete_correspondent),
        );

+    let profile_routes = Router::new()
+        .route(
+            "/api-tokens",
+            get(profile::list_api_tokens).post(profile::create_api_token),
+        )
+        .route(
+            "/api-tokens/:id/regenerate",
+            post(profile::regenerate_api_token),
+        )
+        .route(
+            "/api-tokens/:id",
+            patch(profile::update_api_token).delete(profile::delete_api_token),
+        )
+        .route("/passkeys", get(profile::list_passkeys))
+        .route("/passkeys/:id", delete(profile::delete_passkey));
+
    let protected_state = state.clone();
    let assets_routes = Router::new().route("/:asset_id", get(documents::get_document_asset));

@@ -129,28 +168,72 @@ pub fn create_router(state: AppState) -> Router<()> {
        .nest("/api/folders", folders_routes)
        .nest("/api/tags", tags_routes)
        .nest("/api/correspondents", correspondents_routes)
+        .nest("/api/profile", profile_routes)
        .nest("/api/assets", assets_routes)
        .layer(middleware::from_extractor_with_state::<AuthenticatedUser, _>(protected_state));

-    let openapi_arc = Arc::new(ApiDoc::openapi());
-    let docs_route = Router::new().route(
-        "/api/docs/openapi.json",
-        get({
-            let spec = openapi_arc.clone();
-            move || {
-                let spec = spec.clone();
-                async move { Json((*spec).clone()) }
-            }
-        }),
-    );
+    let upload_limit = state.config.upload_body_limit_bytes;
+
+    let openapi_spec = Arc::new(ApiDoc::openapi());
+    let docs_router = Router::new()
+        .route(
+            "/api/docs",
+            get(move || async { Html(render_swagger_ui("/api/docs/openapi.json")) }),
+        )
+        .route(
+            "/api/docs/openapi.json",
+            get({
+                let spec = openapi_spec.clone();
+                move || async move { Json((*spec).clone()) }
+            }),
+        );

    Router::new()
        .merge(download_routes)
        .merge(protected_routes)
-        .merge(docs_route)
+        .merge(docs_router)
        .nest("/api/auth", auth_routes)
        .route("/api/health", get(health::health_check))
        .with_state(state)
        .layer(cors)
-        .layer(DefaultBodyLimit::max(1024 * 1024 * 512))
+        .layer(DefaultBodyLimit::max(
+            usize::try_from(upload_limit).unwrap_or(usize::MAX),
+        ))
+        .layer(
+            TraceLayer::new_for_http()
+                .make_span_with(DefaultMakeSpan::new().level(tracing::Level::INFO))
+                .on_response(DefaultOnResponse::new().level(tracing::Level::INFO))
+                .on_failure(DefaultOnFailure::new().level(tracing::Level::ERROR)),
+        )
+}
+
+fn render_swagger_ui(spec_url: &str) -> String {
+    format!(
+        r#"<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>Papercrate API Docs</title>
+    <link rel="stylesheet" href="https://unpkg.com/swagger-ui-dist@5/swagger-ui.css" />
+    <style>
+      html {{ box-sizing: border-box; font-family: sans-serif; }}
+      *, *:before, *:after {{ box-sizing: inherit; }}
+      body {{ margin: 0; background: #fafafa; }}
+    </style>
+  </head>
+  <body>
+    <div id="swagger-ui"></div>
+    <script src="https://unpkg.com/swagger-ui-dist@5/swagger-ui-bundle.js"></script>
+    <script>
+      window.addEventListener('load', () => {{
+        window.ui = SwaggerUIBundle({{
+          url: '{spec_url}',
+          dom_id: '#swagger-ui',
+          deepLinking: true,
+        }});
+      }});
+    </script>
+  </body>
+</html>"#
+    )
 }
@@ -0,0 +1,309 @@
+use axum::{
+    extract::{Path, Query, State},
+    http::StatusCode,
+    Json,
+};
+use chrono::{DateTime, NaiveDateTime};
+use serde::{Deserialize, Serialize};
+use utoipa::ToSchema;
+use uuid::Uuid;
+
+use crate::auth::{
+    api_tokens::{
+        create_api_token as issue_token, list_api_tokens as load_tokens,
+        regenerate_api_token as rotate_token, revoke_api_token as revoke_token,
+        update_api_token_capabilities as update_capabilities,
+    },
+    passkeys::PasskeySummary,
+    TenantScopedConn,
+};
+use crate::error::{AppError, AppResult};
+use crate::models::{ApiToken, ApiTokenCapability};
+use crate::state::AppState;
+use crate::utils::{db::no_content, time::to_iso};
+
+#[derive(Debug, Serialize, ToSchema)]
+pub struct ApiTokenResponse {
+    pub id: Uuid,
+    pub tenant_id: Uuid,
+    #[schema(nullable)]
+    pub label: Option<String>,
+    pub capabilities: Vec<ApiTokenCapability>,
+    pub created_at: String,
+    #[schema(nullable)]
+    pub last_used_at: Option<String>,
+    #[schema(nullable)]
+    pub expires_at: Option<String>,
+    #[schema(nullable)]
+    pub revoked_at: Option<String>,
+}
+
+#[derive(Debug, Serialize, ToSchema)]
+pub struct ApiTokenCreatedResponse {
+    pub token: String,
+    pub token_info: ApiTokenResponse,
+}
+
+#[derive(Debug, Deserialize, ToSchema)]
+pub struct CreateApiTokenRequest {
+    #[schema(nullable)]
+    pub label: Option<String>,
+    #[schema(nullable)]
+    pub expires_at: Option<String>,
+    #[serde(default)]
+    #[schema(nullable)]
+    pub capabilities: Option<Vec<ApiTokenCapability>>,
+}
+
+#[derive(Debug, Deserialize, ToSchema)]
+pub struct UpdateApiTokenCapabilitiesRequest {
+    pub capabilities: Vec<ApiTokenCapability>,
+}
+
+#[derive(Debug, Deserialize, ToSchema)]
+pub struct RevokePasskeyQuery {
+    #[serde(default)]
+    #[schema(nullable)]
+    pub reason: Option<String>,
+}
+
+#[utoipa::path(
+    get,
+    path = "/api/profile/passkeys",
+    responses((status = 200, description = "List registered passkeys", body = [PasskeySummary])),
+    tag = "Profile"
+)]
+pub async fn list_passkeys(
+    State(state): State<AppState>,
+    TenantScopedConn {
+        mut conn, user_id, ..
+    }: TenantScopedConn,
+) -> AppResult<Json<Vec<PasskeySummary>>> {
+    let service = state
+        .passkeys
+        .as_ref()
+        .ok_or_else(|| AppError::bad_request("passkey support is disabled"))?;
+
+    let passkeys = service.list_for_user(&mut conn, user_id)?;
+    Ok(Json(passkeys))
+}
+
+#[utoipa::path(
+    get,
+    path = "/api/profile/api-tokens",
+    responses((status = 200, description = "List API tokens", body = [ApiTokenResponse])),
+    tag = "Profile"
+)]
+pub async fn list_api_tokens(
+    TenantScopedConn {
+        mut conn,
+        tenant_id,
+        user_id,
+        ..
+    }: TenantScopedConn,
+) -> AppResult<Json<Vec<ApiTokenResponse>>> {
+    let tokens = load_tokens(&mut conn, user_id, Some(tenant_id))?;
+    let responses = tokens.into_iter().map(api_token_to_response).collect();
+    Ok(Json(responses))
+}
+
+#[utoipa::path(
+    post,
+    path = "/api/profile/api-tokens",
+    request_body = CreateApiTokenRequest,
+    responses((status = 201, description = "API token created", body = ApiTokenCreatedResponse)),
+    tag = "Profile"
+)]
+pub async fn create_api_token(
+    TenantScopedConn {
+        mut conn,
+        tenant_id,
+        user_id,
+        ..
+    }: TenantScopedConn,
+    Json(payload): Json<CreateApiTokenRequest>,
+) -> AppResult<(StatusCode, Json<ApiTokenCreatedResponse>)> {
+    let expires_at = match payload.expires_at {
+        Some(ref value) => Some(parse_timestamp(value)?),
+        None => None,
+    };
+
+    let capabilities = payload
+        .capabilities
+        .unwrap_or_else(|| vec![ApiTokenCapability::Webdav]);
+
+    let issued = issue_token(
+        &mut conn,
+        user_id,
+        tenant_id,
+        payload.label.clone(),
+        expires_at,
+        capabilities,
+    )?;
+
+    let response = ApiTokenCreatedResponse {
+        token: issued.token,
+        token_info: api_token_to_response(issued.record),
+    };
+
+    Ok((StatusCode::CREATED, Json(response)))
+}
+
+#[utoipa::path(
+    post,
+    path = "/api/profile/api-tokens/{id}/regenerate",
+    params(("id" = Uuid, Path, description = "API token ID")),
+    responses((status = 200, description = "API token regenerated", body = ApiTokenCreatedResponse)),
+    tag = "Profile"
+)]
+pub async fn regenerate_api_token(
+    TenantScopedConn {
+        mut conn,
+        tenant_id,
+        user_id,
+        ..
+    }: TenantScopedConn,
+    Path(token_id): Path<Uuid>,
+) -> AppResult<Json<ApiTokenCreatedResponse>> {
+    let issued = rotate_token(&mut conn, token_id, user_id, Some(tenant_id))?;
+    let response = ApiTokenCreatedResponse {
+        token: issued.token,
+        token_info: api_token_to_response(issued.record),
+    };
+
+    Ok(Json(response))
+}
+
+#[utoipa::path(
+    patch,
+    path = "/api/profile/api-tokens/{id}",
+    params(("id" = Uuid, Path, description = "API token ID")),
+    request_body = UpdateApiTokenCapabilitiesRequest,
+    responses((status = 200, description = "API token updated", body = ApiTokenResponse)),
+    tag = "Profile"
+)]
+pub async fn update_api_token(
+    TenantScopedConn {
+        mut conn,
+        tenant_id,
+        user_id,
+        ..
+    }: TenantScopedConn,
+    Path(token_id): Path<Uuid>,
+    Json(payload): Json<UpdateApiTokenCapabilitiesRequest>,
+) -> AppResult<Json<ApiTokenResponse>> {
+    let updated = update_capabilities(
+        &mut conn,
+        token_id,
+        user_id,
+        Some(tenant_id),
+        payload.capabilities,
+    )?;
+
+    Ok(Json(api_token_to_response(updated)))
+}
+
+#[utoipa::path(
+    delete,
+    path = "/api/profile/api-tokens/{id}",
+    params(("id" = Uuid, Path, description = "API token ID")),
+    responses((status = 204, description = "API token revoked")),
+    tag = "Profile"
+)]
+pub async fn delete_api_token(
+    TenantScopedConn {
+        mut conn, user_id, ..
+    }: TenantScopedConn,
+    Path(token_id): Path<Uuid>,
+) -> AppResult<StatusCode> {
+    revoke_token(&mut conn, token_id, user_id)?;
+    no_content()
+}
+
+#[utoipa::path(
+    delete,
+    path = "/api/profile/passkeys/{id}",
+    params(
+        ("id" = Uuid, Path, description = "Passkey ID"),
+        ("reason" = Option<String>, Query, description = "Optional reason for revoking the passkey")
+    ),
+    responses((status = 204, description = "Passkey revoked")),
+    tag = "Profile"
+)]
+pub async fn delete_passkey(
+    State(state): State<AppState>,
+    TenantScopedConn {
+        mut conn, user_id, ..
+    }: TenantScopedConn,
+    Path(passkey_id): Path<Uuid>,
+    Query(query): Query<RevokePasskeyQuery>,
+) -> AppResult<StatusCode> {
+    let service = state
+        .passkeys
+        .as_ref()
+        .ok_or_else(|| AppError::bad_request("passkey support is disabled"))?;
+
+    let active_count = service.active_passkey_count(&mut conn, user_id)?;
+    if active_count <= 1 {
+        return Err(AppError::bad_request(
+            "cannot revoke the last remaining passkey",
+        ));
+    }
+
+    service.revoke_passkey(&mut conn, user_id, passkey_id, query.reason)?;
+    no_content()
+}
+
+fn api_token_to_response(token: ApiToken) -> ApiTokenResponse {
+    let ApiToken {
+        id,
+        tenant_id,
+        label,
+        created_at,
+        last_used_at,
+        expires_at,
+        revoked_at,
+        capabilities,
+        ..
+    } = token;
+
+    ApiTokenResponse {
+        id,
+        tenant_id,
+        label,
+        capabilities,
+        created_at: to_iso(created_at),
+        last_used_at: last_used_at.map(to_iso),
+        expires_at: expires_at.map(to_iso),
+        revoked_at: revoked_at.map(to_iso),
+    }
+}
+
+fn parse_timestamp(value: &str) -> AppResult<NaiveDateTime> {
+    let dt = DateTime::parse_from_rfc3339(value)
+        .map_err(|_| AppError::bad_request("invalid expires_at timestamp"))?;
+    Ok(dt.naive_utc())
+}
+
+#[derive(utoipa::OpenApi)]
+#[openapi(
+    paths(
+        crate::routes::profile::list_api_tokens,
+        crate::routes::profile::create_api_token,
+        crate::routes::profile::regenerate_api_token,
+        crate::routes::profile::update_api_token,
+        crate::routes::profile::delete_api_token,
+        crate::routes::profile::list_passkeys,
+        crate::routes::profile::delete_passkey
+    ),
+    components(schemas(
+        crate::models::ApiTokenCapability,
+        crate::routes::profile::ApiTokenResponse,
+        crate::routes::profile::ApiTokenCreatedResponse,
+        crate::routes::profile::CreateApiTokenRequest,
+        crate::routes::profile::UpdateApiTokenCapabilitiesRequest,
+        crate::routes::profile::RevokePasskeyQuery,
+        crate::auth::passkeys::PasskeySummary
+    ))
+)]
+pub struct ProfileApiDoc;
@@ -1,20 +1,24 @@
-use crate::utils::json::{classify_nullable, NullableValue};
 use axum::{extract::Path, http::StatusCode, Json};
 use diesel::{dsl::count_star, prelude::*};
 use serde::{Deserialize, Serialize};
-use serde_json::Value;
 use std::collections::HashMap;
+use utoipa::ToSchema;
 use uuid::Uuid;

 use crate::auth::TenantScopedConn;
 use crate::error::{AppError, AppResult};
 use crate::models::{NewTag, Tag};
 use crate::schema::{document_tags, tags};
-use crate::utils::db::{no_content, EnsureEntity, IntoJsonResponse};
+use crate::utils::{
+    db::{no_content, EnsureEntity, IntoJsonResponse},
+    json::deserialize_patch_field,
+    named_entity::{ensure_name_available, normalize_name},
+};

-#[derive(Deserialize)]
+#[derive(Deserialize, ToSchema)]
 pub struct CreateTagRequest {
    pub label: String,
+    #[schema(nullable)]
    pub color: Option<String>,
 }

@@ -25,14 +29,55 @@ struct UpdateTagChangeset<'a> {
    color: Option<Option<&'a str>>,
 }

-#[derive(Serialize)]
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn update_tag_request_deserializes_null_fields() {
+        let request: UpdateTagRequest = serde_json::from_value(json!({
+            "label": null,
+            "color": null
+        }))
+        .unwrap();
+        assert!(matches!(request.label, Some(None)));
+        assert!(matches!(request.color, Some(None)));
+    }
+
+    #[test]
+    fn update_tag_request_omitted_fields_are_none() {
+        let request: UpdateTagRequest = serde_json::from_value(json!({})).unwrap();
+        assert!(request.label.is_none());
+        assert!(request.color.is_none());
+    }
+}
+
+#[derive(Serialize, ToSchema)]
 pub struct TagCatalogEntry {
    pub id: Uuid,
    pub label: String,
+    #[schema(nullable)]
    pub color: Option<String>,
    pub usage_count: i64,
 }

+#[derive(Debug, Default, Deserialize, ToSchema)]
+pub struct UpdateTagRequest {
+    #[serde(default, deserialize_with = "deserialize_patch_field")]
+    #[schema(nullable, value_type = Option<String>)]
+    pub label: Option<Option<String>>,
+    #[serde(default, deserialize_with = "deserialize_patch_field")]
+    #[schema(nullable, value_type = Option<String>)]
+    pub color: Option<Option<String>>,
+}
+
+#[utoipa::path(
+    get,
+    path = "/api/tags",
+    responses((status = 200, description = "Tags", body = [TagCatalogEntry])),
+    tag = "Tags"
+)]
 pub async fn list_tags(
    TenantScopedConn {
        mut conn,
@@ -66,6 +111,13 @@ pub async fn list_tags(
    response.into_json()
 }

+#[utoipa::path(
+    post,
+    path = "/api/tags",
+    request_body = CreateTagRequest,
+    responses((status = 200, description = "Tag created", body = TagCatalogEntry)),
+    tag = "Tags"
+)]
 pub async fn create_tag(
    TenantScopedConn {
        mut conn,
@@ -74,13 +126,13 @@ pub async fn create_tag(
    }: TenantScopedConn,
    Json(payload): Json<CreateTagRequest>,
 ) -> AppResult<Json<TagCatalogEntry>> {
-    if payload.label.trim().is_empty() {
-        return Err(AppError::bad_request("label must not be empty"));
-    }
+    let label = normalize_name(&payload.label, || {
+        AppError::bad_request("label must not be empty")
+    })?;

    let new_tag = NewTag {
        id: Uuid::new_v4(),
-        label: payload.label.trim().to_string(),
+        label: label.clone(),
        color: payload.color,
        tenant_id,
    };
@@ -114,6 +166,14 @@ pub async fn create_tag(
    .into_json()
 }

+#[utoipa::path(
+    patch,
+    path = "/api/tags/{id}",
+    params(("id" = Uuid, Path, description = "Tag ID")),
+    request_body = UpdateTagRequest,
+    responses((status = 200, description = "Tag updated", body = TagCatalogEntry)),
+    tag = "Tags"
+)]
 pub async fn update_tag(
    Path(tag_id): Path<Uuid>,
    TenantScopedConn {
@@ -121,19 +181,16 @@ pub async fn update_tag(
        tenant_id,
        ..
    }: TenantScopedConn,
-    Json(body): Json<Value>,
+    Json(payload): Json<UpdateTagRequest>,
 ) -> AppResult<Json<TagCatalogEntry>> {
    let existing: Tag = tags::table
        .find(tag_id)
        .filter(tags::tenant_id.eq(tenant_id))
        .first(&mut conn)
        .one()?;
-    let label_class = classify_nullable(body.get("label")).map_err(AppError::bad_request)?;
-    let color_class = classify_nullable(body.get("color")).map_err(AppError::bad_request)?;
+    let UpdateTagRequest { label, color } = payload;

-    if matches!(label_class, NullableValue::Omitted)
-        && matches!(color_class, NullableValue::Omitted)
-    {
+    if label.is_none() && color.is_none() {
        let usage_count: i64 = document_tags::table
            .filter(document_tags::tag_id.eq(tag_id))
            .select(count_star())
@@ -149,27 +206,27 @@ pub async fn update_tag(

    let mut new_label: Option<String> = None;
    let mut label_changed = false;
-    match label_class {
-        NullableValue::Omitted => {}
-        NullableValue::Null => {
+    match label {
+        None => {}
+        Some(None) => {
            return Err(AppError::bad_request("label cannot be null"));
        }
-        NullableValue::String(value) => {
-            let trimmed = value.trim();
-            if trimmed.is_empty() {
-                return Err(AppError::bad_request("label must not be empty"));
-            }
-            if trimmed != existing.label {
-                let duplicate = tags::table
-                    .filter(tags::label.eq(trimmed))
-                    .filter(tags::id.ne(tag_id))
-                    .filter(tags::tenant_id.eq(tenant_id))
-                    .first::<Tag>(&mut conn)
-                    .optional()?;
-                if duplicate.is_some() {
-                    return Err(AppError::bad_request("tag label already exists"));
-                }
-                new_label = Some(trimmed.to_string());
+        Some(Some(value)) => {
+            let normalized =
+                normalize_name(&value, || AppError::bad_request("label must not be empty"))?;
+            if normalized != existing.label {
+                ensure_name_available(
+                    || {
+                        tags::table
+                            .filter(tags::label.eq(&normalized))
+                            .filter(tags::id.ne(tag_id))
+                            .filter(tags::tenant_id.eq(tenant_id))
+                            .first::<Tag>(&mut conn)
+                            .optional()
+                    },
+                    || AppError::bad_request("tag label already exists"),
+                )?;
+                new_label = Some(normalized);
                label_changed = true;
            }
        }
@@ -177,13 +234,13 @@ pub async fn update_tag(

    let mut color_change: Option<Option<String>> = None;
    let mut color_changed = false;
-    match color_class {
-        NullableValue::Omitted => {}
-        NullableValue::Null => {
+    match color {
+        None => {}
+        Some(None) => {
            color_change = Some(None);
            color_changed = true;
        }
-        NullableValue::String(value) => {
+        Some(Some(value)) => {
            let trimmed = value.trim();
            if trimmed.is_empty() {
                return Err(AppError::bad_request("color must not be empty"));
@@ -244,6 +301,13 @@ pub async fn update_tag(
    .into_json()
 }

+#[utoipa::path(
+    delete,
+    path = "/api/tags/{id}",
+    params(("id" = Uuid, Path, description = "Tag ID")),
+    responses((status = 204, description = "Tag deleted")),
+    tag = "Tags"
+)]
 pub async fn delete_tag(
    Path(tag_id): Path<Uuid>,
    TenantScopedConn {
@@ -276,3 +340,19 @@ pub async fn delete_tag(

    no_content()
 }
+
+#[derive(utoipa::OpenApi)]
+#[openapi(
+    paths(
+        crate::routes::tags::list_tags,
+        crate::routes::tags::create_tag,
+        crate::routes::tags::update_tag,
+        crate::routes::tags::delete_tag
+    ),
+    components(schemas(
+        crate::routes::tags::CreateTagRequest,
+        crate::routes::tags::TagCatalogEntry,
+        crate::routes::tags::UpdateTagRequest
+    ))
+)]
+pub struct TagsApiDoc;
@@ -8,6 +8,7 @@ use axum::Router;
 use base64::engine::general_purpose::STANDARD as BASE64;
 use base64::Engine;
 use diesel::prelude::*;
+use diesel::OptionalExtension;
 use diesel::PgConnection;
 use futures_util::StreamExt;
 use percent_encoding::{percent_decode_str, utf8_percent_encode, NON_ALPHANUMERIC};
@@ -15,31 +16,25 @@ use quick_xml::events::{BytesDecl, BytesEnd, BytesStart, BytesText, Event};
 use quick_xml::Writer;
 use uuid::Uuid;

-use crate::auth::password;
+use crate::auth::api_tokens::{find_active_token_by_secret, touch_api_token};
 use crate::error::{AppError, AppResult};
-use crate::models::{Document, DocumentVersion, Folder, User};
+use crate::models::{ApiTokenCapability, Document, DocumentVersion, Folder, User};
 use crate::schema::{
    document_versions::dsl as document_versions_dsl, documents::dsl as documents_dsl,
-    folders::dsl as folders_dsl, tenants::dsl as tenant_dsl,
-    user_memberships::dsl as memberships_dsl, users::dsl as users_dsl,
+    folders::dsl as folders_dsl, user_memberships::dsl as memberships_dsl, users::dsl as users_dsl,
 };
 use crate::state::AppState;
-use crate::utils::{http::inline_content_disposition, time::to_http_date};
+use crate::tenants::{apply_tenant_guc, apply_user_guc, clear_user_guc};
+use crate::utils::{error::StorageResultExt, http::inline_content_disposition, time::to_http_date};

 const REALM: &str = "Papercrate WebDAV";
 const DOWNLOAD_URL_TTL_SECONDS: u64 = 300;

-#[derive(Clone, Debug)]
-struct TenantEntry {
-    tenant_id: Uuid,
-    slug: String,
-}
-
 #[derive(Clone, Debug)]
 struct WebDavContext {
+    tenant_id: Uuid,
    _user_id: Uuid,
    _username: String,
-    tenants: Vec<TenantEntry>,
 }

 pub fn create_router() -> Router<AppState> {
@@ -89,35 +84,20 @@ async fn handle_propfind(

    let segments = parse_segments(path)?;

-    let resources = if segments.is_empty() {
-        build_account_root_resources(&context.tenants, depth)
-    } else {
-        let (requested_slug, remainder) = segments.split_first().unwrap();
-        let tenant_entry = match context
-            .tenants
-            .iter()
-            .find(|entry| entry.slug.eq_ignore_ascii_case(requested_slug))
-        {
-            Some(entry) => TenantEntry {
-                tenant_id: entry.tenant_id,
-                slug: entry.slug.clone(),
-            },
-            None => return Ok(not_found_response()),
-        };
+    let tenant_id = context.tenant_id;

-        let resolution = match resolve_path(state, &tenant_entry, remainder)? {
+    let resources = if segments.is_empty() {
+        let contents = fetch_folder_contents(state, tenant_id, None)?;
+        build_resources_for_folder(None, &[], &contents, depth)
+    } else {
+        let resolution = match resolve_path(state, tenant_id, &segments)? {
            Some(resolved) => resolved,
            None => return Ok(not_found_response()),
        };

        match resolution {
-            ResolvedPath::TenantRoot { chain } => {
-                let contents = fetch_folder_contents(state, tenant_entry.tenant_id, None)?;
-                build_resources_for_folder(None, &chain, &contents, depth)
-            }
            ResolvedPath::Folder { folder, chain } => {
-                let contents =
-                    fetch_folder_contents(state, tenant_entry.tenant_id, Some(folder.id))?;
+                let contents = fetch_folder_contents(state, tenant_id, Some(folder.id))?;
                build_resources_for_folder(Some(&folder), &chain, &contents, depth)
            }
            ResolvedPath::Document {
@@ -128,8 +108,10 @@ async fn handle_propfind(
        }
    };

-    let body = render_multistatus(&resources)
-        .map_err(|err| AppError::internal(format!("failed to render WebDAV response: {err}")))?;
+    let body = render_multistatus(&resources).map_err(|err| {
+        tracing::error!(error = ?err, "failed to render WebDAV response");
+        AppError::internal("failed to render WebDAV response")
+    })?;

    let response = Response::builder()
        .status(multi_status())
@@ -151,29 +133,13 @@ async fn handle_get_or_head(
        None => return Ok(unauthorized_response()),
    };

+    let tenant_id = context.tenant_id;
    let segments = parse_segments(path)?;
-    let (requested_slug, remainder) = match segments.split_first() {
-        Some(values) => values,
-        None => return Ok(method_not_allowed()),
-    };
-
-    let tenant_entry = match context
-        .tenants
-        .iter()
-        .find(|entry| entry.slug.eq_ignore_ascii_case(requested_slug))
-    {
-        Some(entry) => TenantEntry {
-            tenant_id: entry.tenant_id,
-            slug: entry.slug.clone(),
-        },
-        None => return Ok(not_found_response()),
-    };
-
-    if remainder.is_empty() {
+    if segments.is_empty() {
        return Ok(method_not_allowed());
    }

-    let resolution = match resolve_path(state, &tenant_entry, remainder)? {
+    let resolution = match resolve_path(state, tenant_id, &segments)? {
        Some(resolved) => resolved,
        None => return Ok(not_found_response()),
    };
@@ -307,7 +273,7 @@ fn fetch_folder_contents(
    };

    let documents: Vec<Document> = docs_query
-        .order(documents_dsl::uploaded_at.desc())
+        .order(documents_dsl::created_at.desc())
        .load(&mut conn)?;

    let version_ids: Vec<Uuid> = documents.iter().map(|doc| doc.current_version_id).collect();
@@ -354,9 +320,10 @@ async fn stream_document(
        .presign_get_object(
            &version.s3_key,
            Duration::from_secs(DOWNLOAD_URL_TTL_SECONDS),
+            None,
        )
        .await
-        .map_err(|err| AppError::internal(format!("failed to presign document download: {err}")))?;
+        .storage_context("failed to presign document download")?;

    let client = reqwest::Client::new();
    let mut request = client.request(method.clone(), url.clone());
@@ -365,18 +332,17 @@ async fn stream_document(
        request = request.header(header::RANGE, range.clone());
    }

-    let upstream = request
-        .send()
-        .await
-        .map_err(|err| AppError::internal(format!("failed to fetch document stream: {err}")))?;
+    let upstream = request.send().await.map_err(|err| {
+        tracing::error!(error = ?err, "failed to fetch document stream");
+        AppError::internal("failed to fetch document stream")
+    })?;

    let status =
        StatusCode::from_u16(upstream.status().as_u16()).unwrap_or(StatusCode::BAD_GATEWAY);

    if !(status.is_success() || status == StatusCode::PARTIAL_CONTENT) {
-        return Err(AppError::internal(format!(
-            "upstream download returned status {status}"
-        )));
+        tracing::error!(status = %status, "upstream download returned error status");
+        return Err(AppError::internal("failed to fetch document stream"));
    }

    let mut builder = Response::builder().status(status);
@@ -404,9 +370,10 @@ async fn stream_document(
    builder = builder.header(header::ETAG, format!("\"{}\"", version.id));

    if method == Method::HEAD {
-        return builder
-            .body(Body::empty())
-            .map_err(|err| AppError::internal(format!("failed to build response: {err}")));
+        return builder.body(Body::empty()).map_err(|err| {
+            tracing::error!(error = ?err, "failed to build WebDAV response");
+            AppError::internal("failed to build WebDAV response")
+        });
    }

    let stream = upstream
@@ -414,9 +381,10 @@ async fn stream_document(
        .map(|chunk| chunk.map_err(|err| std::io::Error::new(std::io::ErrorKind::Other, err)));
    let body = Body::from_stream(stream);

-    builder
-        .body(body)
-        .map_err(|err| AppError::internal(format!("failed to build response: {err}")))
+    builder.body(body).map_err(|err| {
+        tracing::error!(error = ?err, "failed to build WebDAV response");
+        AppError::internal("failed to build WebDAV response")
+    })
 }

 fn authenticate(state: &AppState, headers: &HeaderMap) -> Result<Option<WebDavContext>, AppError> {
@@ -458,55 +426,78 @@ fn authenticate(state: &AppState, headers: &HeaderMap) -> Result<Option<WebDavCo
        }
    };

-    let (username, password) = match credential_str.split_once(':') {
-        Some((username, password)) if !username.is_empty() => (username, password),
+    let (presented_username, secret) = match credential_str.split_once(':') {
+        Some((username, secret)) if !username.is_empty() => (username, secret),
        _ => return Ok(None),
    };

-    tracing::debug!(%username, "attempting webdav login");
+    tracing::debug!(presented_username = %presented_username, "attempting webdav login");
    let mut conn = state.db_unscoped()?;

-    let user: User = match users_dsl::users
-        .filter(users_dsl::username.eq(username))
-        .first(&mut conn)
-    {
+    let token = match find_active_token_by_secret(
+        &mut conn,
+        None,
+        secret,
+        ApiTokenCapability::Webdav,
+    )? {
+        Some(token) => token,
+        None => {
+            tracing::warn!(presented_username = %presented_username, "webdav token invalid or expired");
+            return Ok(None);
+        }
+    };
+
+    let user: User = match users_dsl::users.find(token.user_id).first(&mut conn) {
        Ok(user) => user,
        Err(diesel::result::Error::NotFound) => {
-            tracing::warn!(%username, "webdav user not found");
+            tracing::warn!(
+                presented_username = %presented_username,
+                user_id = %token.user_id,
+                "webdav token user missing"
+            );
            return Ok(None);
        }
        Err(err) => return Err(AppError::from(err)),
    };

-    let valid = password::verify_password(password, &user.password_hash)
-        .map_err(|_| AppError::internal("failed to verify password"))?;
+    apply_user_guc(&mut conn, user.id)?;

-    if !valid {
-        tracing::warn!(%username, "webdav password invalid");
-        return Ok(None);
-    }
-
-    let tenant_rows: Vec<(Uuid, String)> = memberships_dsl::user_memberships
-        .inner_join(tenant_dsl::tenants)
+    let membership_exists = memberships_dsl::user_memberships
        .filter(memberships_dsl::user_id.eq(user.id))
-        .select((tenant_dsl::id, tenant_dsl::slug))
-        .load(&mut conn)?;
+        .filter(memberships_dsl::tenant_id.eq(token.tenant_id))
+        .select(memberships_dsl::tenant_id)
+        .first::<Uuid>(&mut conn)
+        .optional()?;

-    if tenant_rows.is_empty() {
-        tracing::warn!(%username, "webdav user has no tenant memberships");
-        return Ok(None);
-    }
+    clear_user_guc(&mut conn)?;

-    let tenants: Vec<TenantEntry> = tenant_rows
-        .into_iter()
-        .map(|(tenant_id, slug)| TenantEntry { tenant_id, slug })
-        .collect();
+    let tenant_id = match membership_exists {
+        Some(id) => id,
+        None => {
+            tracing::warn!(
+                presented_username = %presented_username,
+                username = %user.username,
+                tenant_id = %token.tenant_id,
+                "webdav token tenant membership missing"
+            );
+            return Ok(None);
+        }
+    };

-    tracing::debug!(%username, tenant_count = tenants.len(), "webdav login success");
+    apply_tenant_guc(&mut conn, tenant_id)?;
+    touch_api_token(&mut conn, token.id)?;
+
+    tracing::debug!(
+        presented_username = %presented_username,
+        username = %user.username,
+        tenant_id = %tenant_id,
+        token_id = %token.id,
+        "webdav token login success"
+    );
    Ok(Some(WebDavContext {
+        tenant_id,
        _user_id: user.id,
        _username: user.username,
-        tenants,
    }))
 }

@@ -564,37 +555,6 @@ fn build_resources_for_folder(
    resources
 }

-fn build_account_root_resources(tenants: &[TenantEntry], depth: u8) -> Vec<DavResource> {
-    let mut resources = Vec::new();
-
-    resources.push(DavResource {
-        href: "/".to_string(),
-        display_name: "/".to_string(),
-        is_collection: true,
-        content_length: None,
-        content_type: None,
-        last_modified: None,
-    });
-
-    if depth == 0 {
-        return resources;
-    }
-
-    for tenant in tenants {
-        let href = build_href(&[tenant.slug.clone()], true);
-        resources.push(DavResource {
-            href,
-            display_name: tenant.slug.clone(),
-            is_collection: true,
-            content_length: None,
-            content_type: None,
-            last_modified: None,
-        });
-    }
-
-    resources
-}
-
 fn build_resources_for_document(
    chain: &[String],
    document: &Document,
@@ -717,9 +677,6 @@ struct DavResource {
    last_modified: Option<String>,
 }
 enum ResolvedPath {
-    TenantRoot {
-        chain: Vec<String>,
-    },
    Folder {
        folder: Folder,
        chain: Vec<String>,
@@ -733,23 +690,18 @@ enum ResolvedPath {

 fn resolve_path(
    state: &AppState,
-    tenant: &TenantEntry,
+    tenant_id: Uuid,
    segments: &[String],
 ) -> AppResult<Option<ResolvedPath>> {
-    let mut conn = state.db_for_tenant(tenant.tenant_id)?;
+    let mut conn = state.db_for_tenant(tenant_id)?;
    let mut parent_id: Option<Uuid> = None;
-    let mut chain: Vec<String> = vec![tenant.slug.clone()];
+    let mut chain: Vec<String> = Vec::new();
    let mut current_folder: Option<Folder> = None;

-    if segments.is_empty() {
-        return Ok(Some(ResolvedPath::TenantRoot { chain }));
-    }
-
    for (index, segment) in segments.iter().enumerate() {
        let is_last = index == segments.len() - 1;

-        if let Some(folder) = find_folder_by_name(&mut conn, tenant.tenant_id, parent_id, segment)?
-        {
+        if let Some(folder) = find_folder_by_name(&mut conn, tenant_id, parent_id, segment)? {
            chain.push(folder.name.clone());
            if is_last {
                return Ok(Some(ResolvedPath::Folder { folder, chain }));
@@ -761,7 +713,7 @@ fn resolve_path(

        if is_last {
            if let Some((document, version)) =
-                find_document_by_filename(&mut conn, tenant.tenant_id, parent_id, segment)?
+                find_document_by_filename(&mut conn, tenant_id, parent_id, segment)?
            {
                chain.push(document.filename.clone());
                return Ok(Some(ResolvedPath::Document {
@@ -773,7 +725,7 @@ fn resolve_path(
        }

        if let Ok(uuid) = Uuid::parse_str(segment) {
-            if let Some(folder) = find_folder_by_id(&mut conn, tenant.tenant_id, uuid)? {
+            if let Some(folder) = find_folder_by_id(&mut conn, tenant_id, uuid)? {
                if folder.parent_id != parent_id {
                    return Ok(None);
                }
@@ -786,9 +738,7 @@ fn resolve_path(
                continue;
            }

-            if let Some((document, version)) =
-                find_document_by_id(&mut conn, tenant.tenant_id, uuid)?
-            {
+            if let Some((document, version)) = find_document_by_id(&mut conn, tenant_id, uuid)? {
                if document.folder_id != parent_id {
                    return Ok(None);
                }
@@ -1,5 +1,19 @@
 // @generated automatically by Diesel CLI.

+pub mod sql_types {
+    #[derive(diesel::query_builder::QueryId, Clone, diesel::sql_types::SqlType)]
+    #[diesel(postgres_type(name = "magic_token_kind"))]
+    pub struct MagicTokenKind;
+
+    #[derive(diesel::query_builder::QueryId, Clone, diesel::sql_types::SqlType)]
+    #[diesel(postgres_type(name = "tenant_status"))]
+    pub struct TenantStatus;
+
+    #[derive(diesel::query_builder::QueryId, Clone, diesel::sql_types::SqlType)]
+    #[diesel(postgres_type(name = "api_token_capability"))]
+    pub struct ApiTokenCapability;
+}
+
 diesel::table! {
    correspondents (id) {
        id -> Uuid,
@@ -37,11 +51,9 @@ diesel::table! {
 }

 diesel::table! {
-    document_correspondents (document_id, correspondent_id, role) {
+    document_correspondents (document_id, correspondent_id) {
        document_id -> Uuid,
        correspondent_id -> Uuid,
-        #[max_length = 32]
-        role -> Varchar,
        assigned_at -> Timestamptz,
        assigned_by -> Nullable<Uuid>,
        tenant_id -> Uuid,
@@ -69,7 +81,6 @@ diesel::table! {
        #[max_length = 64]
        checksum -> Varchar,
        created_at -> Timestamptz,
-        operations_summary -> Jsonb,
        metadata -> Jsonb,
        tenant_id -> Uuid,
    }
@@ -85,7 +96,7 @@ diesel::table! {
        #[max_length = 100]
        content_type -> Nullable<Varchar>,
        folder_id -> Nullable<Uuid>,
-        uploaded_at -> Timestamptz,
+        created_at -> Timestamptz,
        updated_at -> Timestamptz,
        deleted_at -> Nullable<Timestamptz>,
        metadata -> Jsonb,
@@ -125,7 +136,26 @@ diesel::table! {
 }

 diesel::table! {
-    refresh_tokens (id) {
+    use diesel::sql_types::*;
+    use super::sql_types::MagicTokenKind;
+
+    magic_tokens (id) {
+        id -> Uuid,
+        user_id -> Uuid,
+        kind -> MagicTokenKind,
+        token_hash -> Varchar,
+        metadata -> Jsonb,
+        expires_at -> Timestamptz,
+        max_uses -> Nullable<Int4>,
+        used_count -> Int4,
+        created_at -> Timestamptz,
+        created_by -> Nullable<Uuid>,
+        last_used_at -> Nullable<Timestamptz>,
+    }
+}
+
+diesel::table! {
+    user_sessions (id) {
        id -> Uuid,
        user_id -> Uuid,
        token_hash -> Text,
@@ -151,15 +181,19 @@ diesel::table! {
 }

 diesel::table! {
+    use diesel::sql_types::*;
+    use super::sql_types::TenantStatus;
+
    tenants (id) {
        id -> Uuid,
-        slug -> Text,
+        name -> Text,
        storage_root -> Nullable<Text>,
        quickwit_index -> Nullable<Text>,
-        status -> Text,
        config -> Jsonb,
        created_at -> Timestamptz,
        updated_at -> Timestamptz,
+        status -> TenantStatus,
+        created_by -> Nullable<Uuid>,
    }
 }

@@ -168,24 +202,72 @@ diesel::table! {
        id -> Uuid,
        user_id -> Uuid,
        tenant_id -> Uuid,
-        role -> Text,
        created_at -> Timestamptz,
        updated_at -> Timestamptz,
    }
 }

+diesel::table! {
+    user_passkeys (id) {
+        id -> Uuid,
+        user_id -> Uuid,
+        credential_id -> Bytea,
+        public_key -> Bytea,
+        credential -> Jsonb,
+        sign_count -> Int8,
+        transports -> Array<Nullable<Text>>,
+        aaguid -> Nullable<Uuid>,
+        nickname -> Nullable<Text>,
+        created_at -> Timestamptz,
+        updated_at -> Timestamptz,
+        last_used_at -> Nullable<Timestamptz>,
+        revoked_at -> Nullable<Timestamptz>,
+        revoked_by -> Nullable<Uuid>,
+        revoked_reason -> Nullable<Text>,
+    }
+}
+
 diesel::table! {
    users (id) {
        id -> Uuid,
        #[max_length = 100]
        username -> Varchar,
-        #[max_length = 255]
-        password_hash -> Varchar,
        created_at -> Timestamptz,
        updated_at -> Timestamptz,
    }
 }

+diesel::table! {
+    webauthn_challenges (id) {
+        id -> Uuid,
+        user_id -> Nullable<Uuid>,
+        purpose -> Text,
+        challenge -> Bytea,
+        state -> Bytea,
+        created_at -> Timestamptz,
+        expires_at -> Timestamptz,
+    }
+}
+
+diesel::table! {
+    use diesel::sql_types::*;
+    use super::sql_types::ApiTokenCapability;
+
+    api_tokens (id) {
+        id -> Uuid,
+        user_id -> Uuid,
+        tenant_id -> Uuid,
+        token_prefix -> Text,
+        token_hash -> Text,
+        label -> Nullable<Text>,
+        created_at -> Timestamptz,
+        last_used_at -> Nullable<Timestamptz>,
+        expires_at -> Nullable<Timestamptz>,
+        revoked_at -> Nullable<Timestamptz>,
+        capabilities -> Array<ApiTokenCapability>,
+    }
+}
+
 diesel::joinable!(correspondents -> tenants (tenant_id));
 diesel::joinable!(document_asset_objects -> document_assets (asset_id));
 diesel::joinable!(document_asset_objects -> tenants (tenant_id));
@@ -204,11 +286,15 @@ diesel::joinable!(documents -> folders (folder_id));
 diesel::joinable!(documents -> tenants (tenant_id));
 diesel::joinable!(folders -> tenants (tenant_id));
 diesel::joinable!(jobs -> tenants (tenant_id));
-diesel::joinable!(refresh_tokens -> tenants (tenant_id));
-diesel::joinable!(refresh_tokens -> users (user_id));
+diesel::joinable!(user_sessions -> tenants (tenant_id));
+diesel::joinable!(user_sessions -> users (user_id));
 diesel::joinable!(tags -> tenants (tenant_id));
 diesel::joinable!(user_memberships -> tenants (tenant_id));
 diesel::joinable!(user_memberships -> users (user_id));
+diesel::joinable!(user_passkeys -> users (user_id));
+diesel::joinable!(webauthn_challenges -> users (user_id));
+diesel::joinable!(api_tokens -> tenants (tenant_id));
+diesel::joinable!(api_tokens -> users (user_id));

 diesel::allow_tables_to_appear_in_same_query!(
    correspondents,
@@ -220,9 +306,13 @@ diesel::allow_tables_to_appear_in_same_query!(
    documents,
    folders,
    jobs,
-    refresh_tokens,
+    magic_tokens,
+    user_sessions,
    tags,
    tenants,
    user_memberships,
+    user_passkeys,
    users,
+    webauthn_challenges,
+    api_tokens,
 );
@@ -7,12 +7,12 @@ use diesel::{
 use uuid::Uuid;

 use crate::{
-    auth::jwt::JwtService,
+    auth::{jwt::JwtService, passkeys::PasskeyService},
    config::AppConfig,
    db::PgPool,
    error::{AppError, AppResult},
    storage::{ObjectStorage, TenantStorage},
-    tenants::{apply_tenant_guc, TenantService},
+    tenants::{apply_tenant_guc, clear_tenant_context, clear_user_guc, TenantService},
 };

 pub type PgPooledConnection = PooledConnection<ConnectionManager<PgConnection>>;
@@ -24,6 +24,7 @@ pub struct AppState {
    storage: Arc<dyn ObjectStorage>,
    pub jwt: JwtService,
    pub tenants: TenantService,
+    pub passkeys: Option<PasskeyService>,
 }

 impl AppState {
@@ -52,12 +53,21 @@ impl AppState {
        let config = Arc::new(config);
        let tenants = TenantService::new(pool.clone());

+        let passkeys = match PasskeyService::try_new(&config) {
+            Ok(service) => service,
+            Err(err) => {
+                tracing::warn!(error = ?err, "passkey service disabled due to configuration");
+                None
+            }
+        };
+
        Self {
            pool,
            config,
            storage,
            jwt,
            tenants,
+            passkeys,
        }
    }

@@ -65,18 +75,24 @@ impl AppState {
        debug_assert!(!tenant_id.is_nil(), "nil tenant_id passed to db_for_tenant");
        let mut conn = self.db_unscoped()?;
        apply_tenant_guc(&mut conn, tenant_id)?;
+        clear_user_guc(&mut conn)?;
        Ok(conn)
    }

    pub(crate) fn db_unscoped(&self) -> AppResult<PgPooledConnection> {
-        self.pool
-            .get()
-            .map_err(|err| AppError::internal(format!("database pool error: {err}")))
+        let mut conn = self.pool.get().map_err(|err| {
+            tracing::error!(error = ?err, "database pool error");
+            AppError::internal("database pool error")
+        })?;
+        clear_tenant_context(&mut conn)?;
+        Ok(conn)
    }

    pub fn storage_for_tenant(&self, tenant_id: Uuid) -> AppResult<TenantStorage> {
        let tenant = self.tenants.get_by_id(tenant_id)?;
-        TenantStorage::new(self.storage.clone(), &tenant)
-            .map_err(|err| AppError::internal(format!("tenant storage error: {err}")))
+        TenantStorage::new(self.storage.clone(), &tenant).map_err(|err| {
+            tracing::error!(error = ?err, "tenant storage error");
+            AppError::internal("tenant storage error")
+        })
    }
 }
@@ -20,7 +20,12 @@ pub trait ObjectStorage: Send + Sync + 'static {
        content_disposition: Option<String>,
    ) -> Result<()>;

-    async fn presign_get_object(&self, key: &str, expires_in: Duration) -> Result<String>;
+    async fn presign_get_object(
+        &self,
+        key: &str,
+        expires_in: Duration,
+        response_content_disposition: Option<&str>,
+    ) -> Result<String>;

    async fn get_object(&self, key: &str) -> Result<Vec<u8>>;

@@ -73,17 +78,23 @@ impl ObjectStorage for S3Storage {
        Ok(())
    }

-    async fn presign_get_object(&self, key: &str, expires_in: Duration) -> Result<String> {
+    async fn presign_get_object(
+        &self,
+        key: &str,
+        expires_in: Duration,
+        response_content_disposition: Option<&str>,
+    ) -> Result<String> {
        let presign_config = PresigningConfig::builder()
            .expires_in(expires_in)
            .build()
            .context("failed to build S3 presigning config")?;

-        let presigned = self
-            .client
-            .get_object()
-            .bucket(&self.bucket)
-            .key(key)
+        let mut request = self.client.get_object().bucket(&self.bucket).key(key);
+        if let Some(value) = response_content_disposition {
+            request = request.response_content_disposition(value);
+        }
+
+        let presigned = request
            .presigned(presign_config)
            .await
            .context("failed to generate presigned download URL")?;
@@ -157,9 +168,16 @@ impl TenantStorage {
            .await
    }

-    pub async fn presign_get_object(&self, key: &str, expires_in: Duration) -> Result<String> {
+    pub async fn presign_get_object(
+        &self,
+        key: &str,
+        expires_in: Duration,
+        response_content_disposition: Option<&str>,
+    ) -> Result<String> {
        let qualified = self.qualify(key);
-        self.inner.presign_get_object(&qualified, expires_in).await
+        self.inner
+            .presign_get_object(&qualified, expires_in, response_content_disposition)
+            .await
    }

    pub async fn get_object(&self, key: &str) -> Result<Vec<u8>> {
@@ -1,13 +1,13 @@
-use axum::{async_trait, extract::FromRequestParts, http::request::Parts};
 use diesel::{pg::PgConnection, prelude::*, sql_types::Text};
+use serde_json::json;
 use uuid::Uuid;

 use crate::{
    db::PgPool,
    error::{AppError, AppResult},
-    models::Tenant,
+    jobs::{enqueue_job, JOB_PROVISION_TENANT},
+    models::{Tenant, TenantStatus},
    schema::tenants::dsl,
-    state::AppState,
 };

 pub struct TenantRepository;
@@ -17,9 +17,9 @@ impl TenantRepository {
        dsl::tenants.find(tenant_id).first(conn).map_err(Into::into)
    }

-    pub fn get_by_slug(conn: &mut PgConnection, slug: &str) -> AppResult<Tenant> {
+    pub fn get_by_name(conn: &mut PgConnection, name: &str) -> AppResult<Tenant> {
        dsl::tenants
-            .filter(dsl::slug.eq(slug))
+            .filter(dsl::name.eq(name))
            .first(conn)
            .map_err(Into::into)
    }
@@ -40,52 +40,175 @@ impl TenantService {
        Ok(tenant)
    }

-    pub fn get_by_slug(&self, slug: &str) -> AppResult<Tenant> {
-        let slug_owned = slug.to_owned();
-        let tenant = self.load(|conn| TenantRepository::get_by_slug(conn, &slug_owned))?;
+    pub fn get_by_name(&self, name: &str) -> AppResult<Tenant> {
+        let name_owned = name.to_owned();
+        let tenant = self.load(|conn| TenantRepository::get_by_name(conn, &name_owned))?;
        Ok(tenant)
    }

-    pub fn tenant_id_for_slug(&self, slug: &str) -> AppResult<Uuid> {
-        Ok(self.get_by_slug(slug)?.id)
+    pub fn create_tenant(
+        &self,
+        name: &str,
+        storage_root: Option<&str>,
+        quickwit_index: Option<&str>,
+        status: TenantStatus,
+        initial_members: &[Uuid],
+        created_by: Option<Uuid>,
+    ) -> AppResult<Tenant> {
+        let mut conn = self.pool.get().map_err(|err| {
+            tracing::error!(error = ?err, "database pool error");
+            AppError::internal("database pool error")
+        })?;
+        self.create_tenant_with_conn(
+            &mut conn,
+            name,
+            storage_root,
+            quickwit_index,
+            status,
+            initial_members,
+            created_by,
+        )
    }

    fn load<F>(&self, loader: F) -> AppResult<Tenant>
    where
        F: FnOnce(&mut PgConnection) -> AppResult<Tenant>,
    {
-        let mut conn = self
-            .pool
-            .get()
-            .map_err(|err| AppError::internal(format!("database pool error: {err}")))?;
+        let mut conn = self.pool.get().map_err(|err| {
+            tracing::error!(error = ?err, "database pool error");
+            AppError::internal("database pool error")
+        })?;
        let tenant = loader(&mut conn)?;
        Ok(tenant)
    }
+    pub fn create_tenant_with_conn(
+        &self,
+        conn: &mut PgConnection,
+        name: &str,
+        storage_root: Option<&str>,
+        quickwit_index: Option<&str>,
+        status: TenantStatus,
+        initial_members: &[Uuid],
+        created_by: Option<Uuid>,
+    ) -> AppResult<Tenant> {
+        let name = name.trim();
+        if name.is_empty() {
+            return Err(AppError::bad_request("tenant name must not be empty"));
+        }
+
+        let id = Uuid::new_v4();
+        let storage_root = normalize_storage_root(storage_root, id);
+        let quickwit_index = normalize_quickwit_index(quickwit_index, id);
+
+        diesel::insert_into(dsl::tenants)
+            .values((
+                dsl::id.eq(id),
+                dsl::name.eq(name),
+                dsl::storage_root.eq(Some(storage_root.clone())),
+                dsl::quickwit_index.eq(Some(quickwit_index.clone())),
+                dsl::config.eq(json!({})),
+                dsl::status.eq(status),
+                dsl::created_by.eq(created_by),
+            ))
+            .execute(conn)?;
+
+        if status == TenantStatus::Creating {
+            let payload = json!({
+                "members": initial_members,
+            });
+
+            enqueue_job(conn, id, JOB_PROVISION_TENANT, payload, None).map_err(|err| {
+                tracing::error!(error = ?err, tenant_id = %id, "failed to enqueue tenant provisioning job");
+                AppError::internal("failed to enqueue tenant provisioning job")
+            })?;
+        }
+
+        TenantRepository::get_by_id(conn, id)
+    }
 }

 pub fn apply_tenant_guc(conn: &mut PgConnection, tenant_id: Uuid) -> AppResult<()> {
-    diesel::sql_query("SELECT set_config('papercrate.tenant_id', $1, true)")
+    diesel::sql_query("SELECT set_config('papercrate.tenant_id', $1, false)")
        .bind::<Text, _>(tenant_id.to_string())
        .execute(conn)
        .map(|_| ())
        .map_err(AppError::from)
 }

-pub struct TenantContext {
-    pub tenant: Tenant,
+pub fn apply_user_guc(conn: &mut PgConnection, user_id: Uuid) -> AppResult<()> {
+    diesel::sql_query("SELECT set_config('papercrate.user_id', $1, false)")
+        .bind::<Text, _>(user_id.to_string())
+        .execute(conn)
+        .map(|_| ())
+        .map_err(AppError::from)
 }

-#[async_trait]
-impl FromRequestParts<AppState> for TenantContext {
-    type Rejection = AppError;
+pub fn clear_tenant_context(conn: &mut PgConnection) -> AppResult<()> {
+    diesel::sql_query(
+        "SELECT \
+            set_config('papercrate.tenant_id', '', false), \
+            set_config('papercrate.user_id', '', false), \
+            set_config('papercrate.user_session_hash', '', false), \
+            set_config('papercrate.api_token_prefix', '', false)",
+    )
+    .execute(conn)
+    .map(|_| ())
+    .map_err(AppError::from)
+}

-    async fn from_request_parts(
-        _parts: &mut Parts,
-        state: &AppState,
-    ) -> Result<Self, Self::Rejection> {
-        let tenant = state
-            .tenants
-            .get_by_slug(&state.config.default_tenant_slug)?;
-        Ok(Self { tenant })
+pub fn clear_user_guc(conn: &mut PgConnection) -> AppResult<()> {
+    diesel::sql_query("SELECT set_config('papercrate.user_id', '', false)")
+        .execute(conn)
+        .map(|_| ())
+        .map_err(AppError::from)
+}
+
+pub fn apply_user_session_hash(conn: &mut PgConnection, hash: &str) -> AppResult<()> {
+    diesel::sql_query("SELECT set_config('papercrate.user_session_hash', $1, false)")
+        .bind::<Text, _>(hash)
+        .execute(conn)
+        .map(|_| ())
+        .map_err(AppError::from)
+}
+
+pub fn clear_user_session_hash(conn: &mut PgConnection) -> AppResult<()> {
+    diesel::sql_query("SELECT set_config('papercrate.user_session_hash', '', false)")
+        .execute(conn)
+        .map(|_| ())
+        .map_err(AppError::from)
+}
+
+pub fn apply_api_token_prefix(conn: &mut PgConnection, prefix: &str) -> AppResult<()> {
+    diesel::sql_query("SELECT set_config('papercrate.api_token_prefix', $1, false)")
+        .bind::<Text, _>(prefix)
+        .execute(conn)
+        .map(|_| ())
+        .map_err(AppError::from)
+}
+
+pub fn clear_api_token_prefix(conn: &mut PgConnection) -> AppResult<()> {
+    diesel::sql_query("SELECT set_config('papercrate.api_token_prefix', '', false)")
+        .execute(conn)
+        .map(|_| ())
+        .map_err(AppError::from)
+}
+
+fn normalize_storage_root(raw: Option<&str>, tenant_id: Uuid) -> String {
+    match raw.map(str::trim) {
+        Some(root) if !root.is_empty() => {
+            let mut owned = root.to_owned();
+            if !owned.ends_with('/') {
+                owned.push('/');
+            }
+            owned
+        }
+        _ => format!("tenants/{tenant_id}/"),
+    }
+}
+
+fn normalize_quickwit_index(raw: Option<&str>, tenant_id: Uuid) -> String {
+    match raw.map(str::trim) {
+        Some(value) if !value.is_empty() => value.to_owned(),
+        _ => format!("documents-{tenant_id}"),
    }
 }
@@ -0,0 +1,32 @@
+use diesel::result::Error as DieselError;
+
+use crate::error::{AppError, AppResult};
+
+pub trait DbResultExt<T> {
+    fn db_context(self, context: &'static str) -> AppResult<T>;
+}
+
+impl<T> DbResultExt<T> for Result<T, DieselError> {
+    fn db_context(self, context: &'static str) -> AppResult<T> {
+        self.map_err(|err| match err {
+            DieselError::NotFound => AppError::not_found(),
+            other => {
+                tracing::error!(error = ?other, "{context}");
+                AppError::internal(context)
+            }
+        })
+    }
+}
+
+pub trait StorageResultExt<T> {
+    fn storage_context(self, context: &'static str) -> AppResult<T>;
+}
+
+impl<T> StorageResultExt<T> for Result<T, anyhow::Error> {
+    fn storage_context(self, context: &'static str) -> AppResult<T> {
+        self.map_err(|err| {
+            tracing::error!(error = ?err, "{context}");
+            AppError::internal(context)
+        })
+    }
+}
@@ -1,3 +1,4 @@
+use serde::Deserialize;
 use serde_json::Value;

 pub enum NullableValue {
@@ -14,3 +15,11 @@ pub fn classify_nullable(optional_value: Option<&Value>) -> Result<NullableValue
        Some(other) => Err(format!("expected string or null, got {other}")),
    }
 }
+
+pub fn deserialize_patch_field<'de, D, T>(deserializer: D) -> Result<Option<Option<T>>, D::Error>
+where
+    D: serde::Deserializer<'de>,
+    T: Deserialize<'de>,
+{
+    Option::<T>::deserialize(deserializer).map(Some)
+}
@@ -1,7 +1,9 @@
 pub mod bootstrap;
 pub mod db;
+pub mod error;
 pub mod http;
 pub mod json;
+pub mod named_entity;
 pub mod storage_paths;
 pub mod time;
 pub mod tracing;
@@ -0,0 +1,28 @@
+use diesel::QueryResult;
+
+use crate::error::{AppError, AppResult};
+
+/// Trim and validate a user-supplied entity name, returning an owned String.
+///
+/// The `on_empty` closure is only invoked when the trimmed name is empty, giving
+/// callers control over the concrete error that should be surfaced.
+pub fn normalize_name(raw: &str, on_empty: impl Fn() -> AppError) -> AppResult<String> {
+    let trimmed = raw.trim();
+    if trimmed.is_empty() {
+        return Err(on_empty());
+    }
+    Ok(trimmed.to_string())
+}
+
+/// Ensure that no conflicting entity exists by executing the provided query
+/// closure. If a record is returned, the `on_duplicate` closure is evaluated to
+/// produce the appropriate error.
+pub fn ensure_name_available<T>(
+    query: impl FnOnce() -> QueryResult<Option<T>>,
+    on_duplicate: impl Fn() -> AppError,
+) -> AppResult<()> {
+    if query()?.is_some() {
+        return Err(on_duplicate());
+    }
+    Ok(())
+}
@@ -3,7 +3,7 @@ use std::{collections::HashSet, sync::Arc, time::Duration};
 use async_trait::async_trait;
 use diesel::prelude::*;
 use serde::Deserialize;
-use serde_json::{json, Map, Value};
+use serde_json::json;
 use tokio::task;
 use tracing::{error, warn};
 use uuid::Uuid;
@@ -91,7 +91,12 @@ fn analyze_document(
    let version: DocumentVersion = document_versions::table
        .find(payload.document_version_id)
        .first(&mut conn)
-        .map_err(|err| format!("{err:?}"))?;
+        .map_err(|err| {
+            format!(
+                "failed to load document_version {} for tenant {}: {err:?}",
+                payload.document_version_id, tenant_id
+            )
+        })?;

    if version.document_id != payload.document_id {
        return Err("document/version mismatch".into());
@@ -100,11 +105,16 @@ fn analyze_document(
    let document: Document = documents::table
        .find(payload.document_id)
        .first(&mut conn)
-        .map_err(|err| format!("{err:?}"))?;
+        .map_err(|err| {
+            format!(
+                "failed to load document {} for tenant {}: {err:?}",
+                payload.document_id, tenant_id
+            )
+        })?;

    let tenant_id = document.tenant_id;

-    let (supported, reason) = determine_thumbnail_support(&document);
+    let (supported, _reason) = determine_thumbnail_support(&document);
    let ocr_supported = document_is_pdf(&document);

    let existing_ocr: Option<DocumentAsset> = document_assets::table
@@ -117,32 +127,6 @@ fn analyze_document(

    let skip_ocr = existing_ocr.is_some() && !payload.force;

-    let mut summary_map = match version.operations_summary {
-        Value::Object(map) => map,
-        _ => Map::new(),
-    };
-    summary_map.insert("thumbnail_supported".to_string(), Value::Bool(supported));
-    if let Some(reason) = reason {
-        summary_map.insert("thumbnail_reason".to_string(), Value::String(reason));
-    } else {
-        summary_map.remove("thumbnail_reason");
-    }
-
-    summary_map.insert("ocr_supported".to_string(), Value::Bool(ocr_supported));
-    if ocr_supported {
-        summary_map.remove("ocr_reason");
-    } else {
-        summary_map.insert(
-            "ocr_reason".to_string(),
-            Value::String("document is not a PDF".into()),
-        );
-    }
-
-    diesel::update(document_versions::table.find(version.id))
-        .set(document_versions::operations_summary.eq(Value::Object(summary_map)))
-        .execute(&mut conn)
-        .map_err(|err| format!("{err:?}"))?;
-
    if supported {
        let enqueue_result = enqueue_job(
            &mut conn,
@@ -0,0 +1,96 @@
+use std::collections::HashMap;
+
+use diesel::{prelude::*, PgConnection};
+use uuid::Uuid;
+
+use crate::models::{Document, DocumentAsset, DocumentAssetObject, DocumentVersion};
+use crate::schema::{document_asset_objects, document_assets, document_versions, documents};
+use crate::state::AppState;
+
+pub(crate) struct DocumentVersionContext {
+    pub document: Document,
+    pub version: DocumentVersion,
+    pub tenant_id: Uuid,
+}
+
+pub(crate) fn load_document_version(
+    state: &AppState,
+    tenant_id: Uuid,
+    document_id: Uuid,
+    version_id: Uuid,
+) -> Result<DocumentVersionContext, String> {
+    let mut conn = state
+        .db_for_tenant(tenant_id)
+        .map_err(|err| format!("{err:?}"))?;
+
+    let version: DocumentVersion = document_versions::table
+        .find(version_id)
+        .first(&mut conn)
+        .map_err(|err| format!("{err:?}"))?;
+
+    if version.document_id != document_id {
+        return Err("document/version mismatch".into());
+    }
+
+    let document: Document = documents::table
+        .find(document_id)
+        .first(&mut conn)
+        .map_err(|err| format!("{err:?}"))?;
+
+    Ok(DocumentVersionContext {
+        document,
+        version,
+        tenant_id,
+    })
+}
+
+pub(crate) struct LoadedAsset {
+    pub asset: DocumentAsset,
+    pub objects: Vec<DocumentAssetObject>,
+}
+
+pub(crate) fn load_version_assets(
+    conn: &mut PgConnection,
+    tenant_id: Uuid,
+    version_id: Uuid,
+    asset_types: &[&str],
+) -> Result<HashMap<String, LoadedAsset>, String> {
+    let mut query = document_assets::table
+        .filter(document_assets::document_version_id.eq(version_id))
+        .filter(document_assets::tenant_id.eq(tenant_id))
+        .into_boxed();
+
+    if !asset_types.is_empty() {
+        let types: Vec<String> = asset_types.iter().map(|ty| (*ty).to_string()).collect();
+        query = query.filter(document_assets::asset_type.eq_any(types));
+    }
+
+    let assets: Vec<DocumentAsset> = query
+        .order(document_assets::created_at.asc())
+        .load(conn)
+        .map_err(|err| format!("{err:?}"))?;
+
+    let asset_ids: Vec<Uuid> = assets.iter().map(|asset| asset.id).collect();
+
+    let mut object_map: HashMap<Uuid, Vec<DocumentAssetObject>> = HashMap::new();
+    if !asset_ids.is_empty() {
+        let objects: Vec<DocumentAssetObject> = document_asset_objects::table
+            .filter(document_asset_objects::asset_id.eq_any(&asset_ids))
+            .filter(document_asset_objects::tenant_id.eq(tenant_id))
+            .order(document_asset_objects::ordinal.asc())
+            .load(conn)
+            .map_err(|err| format!("{err:?}"))?;
+
+        for object in objects {
+            object_map.entry(object.asset_id).or_default().push(object);
+        }
+    }
+
+    let mut result = HashMap::with_capacity(assets.len());
+    for asset in assets {
+        let objects = object_map.remove(&asset.id).unwrap_or_default();
+        result.insert(asset.asset_type.clone(), LoadedAsset { asset, objects });
+    }
+
+    Ok(result)
+}
@@ -5,12 +5,12 @@ use async_trait::async_trait;
 use diesel::prelude::*;
 use reqwest::Client;
 use serde::Deserialize;
-use serde_json::json;
 use tokio::task;
 use tracing::{error, warn};
 use uuid::Uuid;

 use crate::{
+    documents::search::{build_quickwit_ingest_record, quickwit_ingest},
    jobs::JOB_INDEX_DOCUMENT_TEXT,
    models::{Document, DocumentVersion},
    schema::{document_asset_objects, document_assets, document_versions, documents},
@@ -18,7 +18,9 @@ use crate::{
    storage::TenantStorage,
 };

-use super::{ocr::OCR_TEXT_ASSET_TYPE, JobExecution, JobHandler};
+use super::{
+    fetch_version_object, handle_fetch_error, ocr::OCR_TEXT_ASSET_TYPE, JobExecution, JobHandler,
+};

 #[derive(Debug, Deserialize)]
 struct IndexPayload {
@@ -87,24 +89,26 @@ impl JobHandler for IndexDocumentTextJob {
        let client = Client::new();

        let state_clone = state.clone();
-        let context = match task::spawn_blocking(move || load_context(state_clone, &payload)).await
-        {
-            Ok(Ok(ctx)) => ctx,
-            Ok(Err(err)) => {
-                warn!(job_id = %job.id, error = %err, "index job will retry");
-                return JobExecution::Retry {
-                    delay: Duration::from_secs(30),
-                    error: err,
-                };
-            }
-            Err(join_err) => {
-                error!(job_id = %job.id, error = %join_err, "index task panicked");
-                return JobExecution::Retry {
-                    delay: Duration::from_secs(60),
-                    error: format!("worker panicked: {join_err}"),
-                };
-            }
-        };
+        let tenant_id = job.tenant_id;
+        let context =
+            match task::spawn_blocking(move || load_context(state_clone, tenant_id, payload)).await
+            {
+                Ok(Ok(ctx)) => ctx,
+                Ok(Err(err)) => {
+                    warn!(job_id = %job.id, error = %err, "index job will retry");
+                    return JobExecution::Retry {
+                        delay: Duration::from_secs(30),
+                        error: err,
+                    };
+                }
+                Err(join_err) => {
+                    error!(job_id = %job.id, error = %join_err, "index task panicked");
+                    return JobExecution::Retry {
+                        delay: Duration::from_secs(60),
+                        error: format!("worker panicked: {join_err}"),
+                    };
+                }
+            };

        if context.text_s3_key.is_none() {
            warn!(job_id = %job.id, "missing OCR text asset; failing indexing job");
@@ -114,21 +118,23 @@ impl JobHandler for IndexDocumentTextJob {
        }

        let s3_key = context.text_s3_key.unwrap();
-        let text = match storage.get_object(&s3_key).await {
-            Ok(bytes) => match String::from_utf8(bytes) {
-                Ok(text) => text,
-                Err(err) => {
-                    warn!(job_id = %job.id, error = %err, "ocr text not valid UTF-8");
-                    return JobExecution::Failed {
-                        error: "ocr text not valid UTF-8".into(),
-                    };
-                }
-            },
+        let bytes = match fetch_version_object(
+            &context.version,
+            &storage,
+            &s3_key,
+            state.config.worker_max_document_bytes,
+        )
+        .await
+        {
+            Ok(bytes) => bytes,
+            Err(err) => return handle_fetch_error(&job, err, "failed to download ocr text"),
+        };
+        let text = match String::from_utf8(bytes) {
+            Ok(text) => text,
            Err(err) => {
-                warn!(job_id = %job.id, error = %err, "failed to download ocr text");
-                return JobExecution::Retry {
-                    delay: Duration::from_secs(30),
-                    error: err.to_string(),
+                warn!(job_id = %job.id, error = %err, "ocr text not valid UTF-8");
+                return JobExecution::Failed {
+                    error: "ocr text not valid UTF-8".into(),
                };
            }
        };
@@ -140,43 +146,13 @@ impl JobHandler for IndexDocumentTextJob {
            };
        }

-        let client = client;
-        let url = format!(
-            "{}/api/v1/{}/ingest?commit=auto",
-            quickwit_endpoint, quickwit_index
-        );
-        let payload = json!({
-            "document_id": context.document.id,
-            "version_id": context.version.id,
-            "tenant_id": job.tenant_id,
-            "title": context.document.title.to_lowercase(),
-            "text": text.to_lowercase()
-        });
+        let record =
+            build_quickwit_ingest_record(&context.document, &context.version, job.tenant_id, &text);

-        let body = serde_json::to_string(&payload).unwrap();
-
-        match client
-            .post(&url)
-            .header("content-type", "application/x-ndjson")
-            .body(format!("{}\n", body))
-            .send()
-            .await
-        {
-            Ok(response) => {
-                if response.status().is_success() {
-                    JobExecution::Success
-                } else {
-                    let status = response.status();
-                    let body = response.text().await.unwrap_or_default();
-                    warn!(job_id = %job.id, %status, %body, "quickwit ingest failed");
-                    JobExecution::Retry {
-                        delay: Duration::from_secs(30),
-                        error: format!("quickwit ingest failed with status {status}"),
-                    }
-                }
-            }
+        match quickwit_ingest(&client, &quickwit_endpoint, &quickwit_index, &[record]).await {
+            Ok(()) => JobExecution::Success,
            Err(err) => {
-                warn!(job_id = %job.id, error = %err, "quickwit request failed");
+                warn!(job_id = %job.id, error = %err, "quickwit ingest failed");
                JobExecution::Retry {
                    delay: Duration::from_secs(30),
                    error: err.to_string(),
@@ -192,12 +168,18 @@ struct IndexContext {
    text_s3_key: Option<String>,
 }

-fn load_context(state: Arc<AppState>, payload: &IndexPayload) -> Result<IndexContext, String> {
-    let mut base_conn = state.db_unscoped().map_err(|err| format!("{err:?}"))?;
+fn load_context(
+    state: Arc<AppState>,
+    tenant_id: Uuid,
+    payload: IndexPayload,
+) -> Result<IndexContext, String> {
+    let mut conn = state
+        .db_for_tenant(tenant_id)
+        .map_err(|err| format!("{err:?}"))?;

    let version: DocumentVersion = document_versions::table
        .find(payload.document_version_id)
-        .first(&mut base_conn)
+        .first(&mut conn)
        .map_err(|err| format!("{err:?}"))?;

    if version.document_id != payload.document_id {
@@ -206,14 +188,7 @@ fn load_context(state: Arc<AppState>, payload: &IndexPayload) -> Result<IndexCon

    let document: Document = documents::table
        .find(payload.document_id)
-        .first(&mut base_conn)
-        .map_err(|err| format!("{err:?}"))?;
-
-    let tenant_id = document.tenant_id;
-    drop(base_conn);
-
-    let mut conn = state
-        .db_for_tenant(tenant_id)
+        .first(&mut conn)
        .map_err(|err| format!("{err:?}"))?;

    let text_s3_key: Option<String> = document_asset_objects::table
@@ -1,5 +1,6 @@
 use std::{collections::HashMap, sync::Arc, time::Duration};

+use anyhow::Error as AnyhowError;
 use async_trait::async_trait;
 use tokio::time::sleep;
 use tracing::{error, info, warn};
@@ -12,10 +13,14 @@ use crate::{
 };

 pub mod analyze;
+pub mod common;
 pub mod index;
 pub mod ocr;
+pub mod tenants;
 pub mod thumbnails;

+use tenants::ProvisionTenantJob;
+
 #[derive(Debug)]
 pub enum JobExecution {
    Success,
@@ -145,5 +150,70 @@ pub fn default_handlers() -> Vec<Arc<dyn JobHandler>> {
        Arc::new(thumbnails::GenerateThumbnailsJob::new()),
        Arc::new(ocr::GenerateOcrTextJob::new()),
        Arc::new(index::IndexDocumentTextJob::new()),
+        Arc::new(ProvisionTenantJob::new()),
    ]
 }
+
+pub(crate) fn check_worker_document_limit(
+    size_bytes: i64,
+    limit_bytes: u64,
+) -> Result<(), (u64, u64)> {
+    let size = size_bytes.max(0) as u64;
+    if size > limit_bytes {
+        Err((size, limit_bytes))
+    } else {
+        Ok(())
+    }
+}
+
+pub(crate) enum FetchVersionError {
+    TooLarge { size: u64, limit: u64 },
+    Storage(AnyhowError),
+}
+
+pub(crate) async fn fetch_version_object(
+    version: &crate::models::DocumentVersion,
+    storage: &TenantStorage,
+    s3_key: &str,
+    limit_bytes: u64,
+) -> Result<Vec<u8>, FetchVersionError> {
+    check_worker_document_limit(version.size_bytes, limit_bytes)
+        .map_err(|(size, limit)| FetchVersionError::TooLarge { size, limit })?;
+
+    storage
+        .get_object(s3_key)
+        .await
+        .map_err(FetchVersionError::Storage)
+}
+
+pub(crate) fn handle_fetch_error(
+    job: &crate::models::Job,
+    err: FetchVersionError,
+    message: &str,
+) -> JobExecution {
+    match err {
+        FetchVersionError::TooLarge { size, limit } => {
+            warn!(
+                job_id = %job.id,
+                size_bytes = size,
+                limit_bytes = limit,
+                "document exceeds worker size limit"
+            );
+            JobExecution::Failed {
+                error: format!("document size {size} bytes exceeds worker limit of {limit} bytes"),
+            }
+        }
+        FetchVersionError::Storage(err) => {
+            warn!(
+                job_id = %job.id,
+                error = %err,
+                context = message,
+                "failed to fetch object for worker"
+            );
+            JobExecution::Retry {
+                delay: Duration::from_secs(30),
+                error: err.to_string(),
+            }
+        }
+    }
+}
@@ -18,18 +18,22 @@ use tracing::{error, info, warn};
 use uuid::Uuid;

 use crate::{
+    documents::asset::delete_asset,
    jobs::{enqueue_job, JOB_GENERATE_OCR_TEXT, JOB_INDEX_DOCUMENT_TEXT},
    models::{
        Document, DocumentAsset, DocumentAssetObject, DocumentVersion, NewDocumentAsset,
        NewDocumentAssetObject,
    },
-    schema::{document_asset_objects, document_assets, document_versions, documents},
+    schema::{document_asset_objects, document_assets},
    state::AppState,
    storage::TenantStorage,
    utils::storage_paths::document_asset_object_prefix,
 };

-use super::{JobExecution, JobHandler};
+use super::{
+    common::{load_document_version, load_version_assets},
+    fetch_version_object, handle_fetch_error, JobExecution, JobHandler,
+};

 pub const OCR_TEXT_ASSET_TYPE: &str = "ocr-text";
 const MIN_TEXT_LENGTH: usize = 50;
@@ -73,40 +77,44 @@ impl JobHandler for GenerateOcrTextJob {

        let state_clone = state.clone();
        let payload_clone = payload.clone();
-        let context =
-            match task::spawn_blocking(move || load_ocr_context(state_clone, &payload_clone)).await
-            {
-                Ok(Ok(ctx)) => ctx,
-                Ok(Err(err)) => {
-                    warn!(job_id = %job.id, error = %err, "ocr job will retry");
-                    return JobExecution::Retry {
-                        delay: Duration::from_secs(30),
-                        error: err,
-                    };
-                }
-                Err(join_err) => {
-                    error!(job_id = %job.id, error = %join_err, "ocr task panicked");
-                    return JobExecution::Retry {
-                        delay: Duration::from_secs(60),
-                        error: format!("worker panicked: {join_err}"),
-                    };
-                }
-            };
+        let tenant_id = job.tenant_id;
+        let context = match task::spawn_blocking(move || {
+            load_ocr_context(state_clone, tenant_id, payload_clone)
+        })
+        .await
+        {
+            Ok(Ok(ctx)) => ctx,
+            Ok(Err(err)) => {
+                warn!(job_id = %job.id, error = %err, "ocr job will retry");
+                return JobExecution::Retry {
+                    delay: Duration::from_secs(30),
+                    error: err,
+                };
+            }
+            Err(join_err) => {
+                error!(job_id = %job.id, error = %join_err, "ocr task panicked");
+                return JobExecution::Retry {
+                    delay: Duration::from_secs(60),
+                    error: format!("worker panicked: {join_err}"),
+                };
+            }
+        };

        if context.skip {
            info!(job_id = %job.id, "ocr already present; skipping");
            return JobExecution::Success;
        }

-        let bytes = match storage.get_object(&context.version.s3_key).await {
+        let bytes = match fetch_version_object(
+            &context.version,
+            &storage,
+            &context.version.s3_key,
+            state.config.worker_max_document_bytes,
+        )
+        .await
+        {
            Ok(bytes) => bytes,
-            Err(err) => {
-                warn!(job_id = %job.id, error = %err, "failed to fetch document for ocr");
-                return JobExecution::Retry {
-                    delay: Duration::from_secs(30),
-                    error: err.to_string(),
-                };
-            }
+            Err(err) => return handle_fetch_error(&job, err, "failed to fetch document for ocr"),
        };

        let doc_meta = PdfDocumentMeta {
@@ -133,12 +141,29 @@ impl JobHandler for GenerateOcrTextJob {
            };
        };

-        if context.existing_asset.is_some() {
+        if let Some(existing_asset) = &context.existing_asset {
            for object in &context.existing_objects {
                if let Err(err) = storage.delete_object(&object.s3_key).await {
                    warn!(job_id = %job.id, error = %err, s3_key = %object.s3_key, "failed to delete existing ocr asset object");
                }
            }
+
+            let tenant_id = context.document.tenant_id;
+            let asset_id = existing_asset.id;
+            let state_clone = state.clone();
+            match task::spawn_blocking(move || {
+                delete_asset(state_clone.as_ref(), tenant_id, asset_id)
+            })
+            .await
+            {
+                Ok(Ok(())) => {}
+                Ok(Err(err)) => {
+                    warn!(job_id = %job.id, error = ?err, asset_id = %asset_id, "failed to remove ocr asset metadata after deletion");
+                }
+                Err(join_err) => {
+                    warn!(job_id = %job.id, error = %join_err, asset_id = %asset_id, "failed to remove ocr asset metadata: task panicked");
+                }
+            }
        }

        let asset_id = Uuid::new_v4();
@@ -154,7 +179,7 @@ impl JobHandler for GenerateOcrTextJob {
            .put_object(
                &s3_key,
                generation.text.into_bytes(),
-                Some("text/plain".into()),
+                Some("text/plain; charset=utf-8".into()),
                None,
            )
            .await
@@ -173,7 +198,7 @@ impl JobHandler for GenerateOcrTextJob {
        .await
        {
            Ok(Ok(())) => {
-                if let Err(err) = enqueue_index_job(&state, &payload) {
+                if let Err(err) = enqueue_index_job(&state, job.tenant_id, &payload) {
                    warn!(job_id = %job.id, error = %err, "failed to enqueue index job");
                }
                JobExecution::Success
@@ -214,55 +239,40 @@ struct OcrGeneration {
    source: &'static str,
 }

-fn load_ocr_context(state: Arc<AppState>, payload: &OcrPayload) -> Result<OcrContext, String> {
-    let mut base_conn = state.db_unscoped().map_err(|err| format!("{err:?}"))?;
-
-    let version: DocumentVersion = document_versions::table
-        .find(payload.document_version_id)
-        .first(&mut base_conn)
-        .map_err(|err| format!("{err:?}"))?;
-
-    if version.document_id != payload.document_id {
-        return Err("document/version mismatch".into());
-    }
-
-    let document: Document = documents::table
-        .find(payload.document_id)
-        .first(&mut base_conn)
-        .map_err(|err| format!("{err:?}"))?;
-
-    let tenant_id = document.tenant_id;
-    drop(base_conn);
+fn load_ocr_context(
+    state: Arc<AppState>,
+    tenant_id: Uuid,
+    payload: OcrPayload,
+) -> Result<OcrContext, String> {
+    let base = load_document_version(
+        state.as_ref(),
+        tenant_id,
+        payload.document_id,
+        payload.document_version_id,
+    )?;

    let mut conn = state
-        .db_for_tenant(tenant_id)
+        .db_for_tenant(base.tenant_id)
        .map_err(|err| format!("{err:?}"))?;

-    let existing_asset: Option<DocumentAsset> = document_assets::table
-        .filter(document_assets::document_version_id.eq(payload.document_version_id))
-        .filter(document_assets::asset_type.eq(OCR_TEXT_ASSET_TYPE))
-        .filter(document_assets::tenant_id.eq(tenant_id))
-        .first(&mut conn)
-        .optional()
-        .map_err(|err| format!("{err:?}"))?;
+    let mut assets = load_version_assets(
+        &mut conn,
+        base.tenant_id,
+        base.version.id,
+        &[OCR_TEXT_ASSET_TYPE],
+    )?;

-    let existing_objects: Vec<DocumentAssetObject> = if let Some(asset) = &existing_asset {
-        document_asset_objects::table
-            .filter(document_asset_objects::asset_id.eq(asset.id))
-            .filter(document_asset_objects::tenant_id.eq(tenant_id))
-            .order(document_asset_objects::ordinal.asc())
-            .load(&mut conn)
-            .map_err(|err| format!("{err:?}"))?
-    } else {
-        Vec::new()
-    };
+    let (existing_asset, existing_objects) = assets
+        .remove(OCR_TEXT_ASSET_TYPE)
+        .map(|entry| (Some(entry.asset), entry.objects))
+        .unwrap_or((None, Vec::new()));

-    let is_pdf = document_is_pdf(&document);
+    let is_pdf = document_is_pdf(&base.document);
    if !is_pdf {
        return Ok(OcrContext {
-            document,
-            version,
-            existing_asset: existing_asset,
+            document: base.document,
+            version: base.version,
+            existing_asset,
            existing_objects,
            skip: true,
        });
@@ -271,8 +281,8 @@ fn load_ocr_context(state: Arc<AppState>, payload: &OcrPayload) -> Result<OcrCon
    let skip = existing_asset.is_some() && !payload.force;

    Ok(OcrContext {
-        document,
-        version,
+        document: base.document,
+        version: base.version,
        existing_asset,
        existing_objects,
        skip,
@@ -479,15 +489,11 @@ fn persist_ocr_metadata(
    Ok(())
 }

-fn enqueue_index_job(state: &AppState, payload: &OcrPayload) -> Result<(), String> {
-    let mut base_conn = state.db_unscoped().map_err(|err| format!("{err:?}"))?;
-    let tenant_id: Uuid = documents::table
-        .find(payload.document_id)
-        .select(documents::tenant_id)
-        .first(&mut base_conn)
-        .map_err(|err| format!("{err:?}"))?;
-    drop(base_conn);
-
+fn enqueue_index_job(
+    state: &AppState,
+    tenant_id: Uuid,
+    payload: &OcrPayload,
+) -> Result<(), String> {
    let mut conn = state
        .db_for_tenant(tenant_id)
        .map_err(|err| format!("{err:?}"))?;
@@ -0,0 +1,187 @@
+use std::sync::Arc;
+
+use async_trait::async_trait;
+use chrono::Utc;
+use diesel::prelude::*;
+use reqwest::Client;
+use serde::Deserialize;
+use tracing::warn;
+use uuid::Uuid;
+
+use crate::documents::search::ensure_quickwit_index;
+use crate::jobs::JOB_PROVISION_TENANT;
+use crate::models::{NewUserMembership, TenantStatus};
+use crate::schema::{tenants, user_memberships};
+use crate::state::AppState;
+use crate::tenants::TenantRepository;
+use crate::workers::{JobExecution, JobHandler};
+
+pub struct ProvisionTenantJob;
+
+impl ProvisionTenantJob {
+    pub fn new() -> Self {
+        Self
+    }
+}
+
+#[async_trait]
+impl JobHandler for ProvisionTenantJob {
+    fn job_type(&self) -> &'static str {
+        JOB_PROVISION_TENANT
+    }
+
+    async fn handle(
+        &self,
+        state: Arc<AppState>,
+        job: crate::models::Job,
+        _storage: crate::storage::TenantStorage,
+    ) -> JobExecution {
+        let mut conn = match state.db_unscoped() {
+            Ok(conn) => conn,
+            Err(err) => {
+                warn!(job_id = %job.id, error = ?err, "failed to get connection for tenant provisioning");
+                return JobExecution::Retry {
+                    delay: std::time::Duration::from_secs(30),
+                    error: "database connection unavailable".into(),
+                };
+            }
+        };
+
+        let tenant = match TenantRepository::get_by_id(&mut conn, job.tenant_id) {
+            Ok(tenant) => tenant,
+            Err(err) => {
+                warn!(job_id = %job.id, error = ?err, "tenant not found for provisioning");
+                return JobExecution::Failed {
+                    error: "tenant not found".into(),
+                };
+            }
+        };
+
+        drop(conn);
+
+        let mut conn = match state.db_for_tenant(tenant.id) {
+            Ok(conn) => conn,
+            Err(err) => {
+                warn!(job_id = %job.id, error = ?err, "failed to scope connection for tenant provisioning");
+                return JobExecution::Retry {
+                    delay: std::time::Duration::from_secs(30),
+                    error: "tenant connection unavailable".into(),
+                };
+            }
+        };
+
+        if tenant.status == TenantStatus::Active {
+            warn!(
+                job_id = %job.id,
+                tenant_id = %tenant.id,
+                "tenant already active; skipping provisioning"
+            );
+            return JobExecution::Success;
+        }
+
+        if tenant.status != TenantStatus::Creating {
+            warn!(
+                job_id = %job.id,
+                tenant_id = %tenant.id,
+                status = %tenant.status.as_str(),
+                "tenant not in creating state; skipping provisioning"
+            );
+            return JobExecution::Failed {
+                error: format!(
+                    "tenant status '{}' not eligible for provisioning",
+                    tenant.status.as_str()
+                ),
+            };
+        }
+        let endpoint = match &state.config.quickwit_endpoint {
+            Some(endpoint) => endpoint.trim_end_matches('/').to_owned(),
+            None => {
+                warn!(
+                    job_id = %job.id,
+                    tenant_id = %tenant.id,
+                    "quickwit endpoint not configured; retrying"
+                );
+                return JobExecution::Retry {
+                    delay: std::time::Duration::from_secs(30),
+                    error: "quickwit endpoint not configured".into(),
+                };
+            }
+        };
+
+        let index_id = tenant
+            .quickwit_index
+            .as_deref()
+            .map(str::to_owned)
+            .unwrap_or_else(|| format!("documents-{}", tenant.id));
+
+        let client = Client::new();
+        if let Err(err) = ensure_quickwit_index(&client, &endpoint, &index_id).await {
+            warn!(
+                job_id = %job.id,
+                tenant_id = %tenant.id,
+                error = %err,
+                "failed to ensure quickwit index"
+            );
+            return JobExecution::Retry {
+                delay: std::time::Duration::from_secs(30),
+                error: err.to_string(),
+            };
+        }
+
+        if let Some(members) = ProvisionPayload::from_job(&job) {
+            for member in members {
+                let new_membership = NewUserMembership {
+                    id: Uuid::new_v4(),
+                    user_id: member,
+                    tenant_id: tenant.id,
+                };
+
+                if let Err(err) = diesel::insert_into(user_memberships::table)
+                    .values(&new_membership)
+                    .on_conflict((user_memberships::user_id, user_memberships::tenant_id))
+                    .do_nothing()
+                    .execute(&mut conn)
+                {
+                    warn!(
+                        job_id = %job.id,
+                        tenant_id = %tenant.id,
+                        user_id = %member,
+                        error = %err,
+                        "failed to assign initial membership"
+                    );
+                }
+            }
+        }
+
+        if let Err(err) = diesel::update(tenants::table.find(tenant.id))
+            .set((
+                tenants::status.eq(TenantStatus::Active),
+                tenants::quickwit_index.eq(Some(index_id)),
+                tenants::updated_at.eq(Utc::now().naive_utc()),
+            ))
+            .execute(&mut conn)
+        {
+            warn!(job_id = %job.id, error = %err, "failed to activate tenant");
+            return JobExecution::Retry {
+                delay: std::time::Duration::from_secs(30),
+                error: format!("failed to update tenant status: {err}"),
+            };
+        }
+
+        JobExecution::Success
+    }
+}
+
+#[derive(Deserialize, Default)]
+struct ProvisionPayload {
+    #[serde(default)]
+    members: Vec<Uuid>,
+}
+
+impl ProvisionPayload {
+    fn from_job(job: &crate::models::Job) -> Option<Vec<Uuid>> {
+        serde_json::from_value(job.payload.clone())
+            .map(|payload: ProvisionPayload| payload.members)
+            .ok()
+    }
+}
@@ -12,18 +12,23 @@ use tracing::{error, info, warn};
 use uuid::Uuid;

 use crate::{
+    documents::asset::delete_asset,
    jobs::JOB_GENERATE_THUMBNAILS,
    models::{
        Document, DocumentAsset, DocumentAssetObject, DocumentVersion, NewDocumentAsset,
        NewDocumentAssetObject,
    },
-    schema::{document_asset_objects, document_assets, document_versions, documents},
+    schema::{document_asset_objects, document_assets, document_versions},
    state::AppState,
    storage::TenantStorage,
    utils::storage_paths::document_asset_object_key,
 };

-use super::{analyze::determine_thumbnail_support, JobExecution, JobHandler};
+use super::{
+    analyze::determine_thumbnail_support,
+    common::{load_document_version, load_version_assets},
+    fetch_version_object, handle_fetch_error, JobExecution, JobHandler,
+};

 const THUMBNAIL_WIDTH: u32 = 512;
 const THUMBNAIL_HEIGHT: u32 = 512;
@@ -32,7 +37,7 @@ const PREVIEW_HEIGHT: u32 = THUMBNAIL_HEIGHT * 4;
 const THUMBNAIL_ASSET_TYPE: &str = "thumbnail";
 const PREVIEW_ASSET_TYPE: &str = "preview";

-#[derive(Debug, Deserialize)]
+#[derive(Debug, Deserialize, Clone)]
 struct ThumbnailPayload {
    document_id: Uuid,
    document_version_id: Uuid,
@@ -70,40 +75,45 @@ impl JobHandler for GenerateThumbnailsJob {
        };

        let state_clone = state.clone();
-        let initial =
-            match task::spawn_blocking(move || load_thumbnail_context(state_clone, &payload)).await
-            {
-                Ok(Ok(ctx)) => ctx,
-                Ok(Err(err)) => {
-                    warn!(job_id = %job.id, error = %err, "thumbnail job will retry");
-                    return JobExecution::Retry {
-                        delay: Duration::from_secs(30),
-                        error: err,
-                    };
-                }
-                Err(join_err) => {
-                    error!(job_id = %job.id, error = %join_err, "thumbnail task panicked");
-                    return JobExecution::Retry {
-                        delay: Duration::from_secs(60),
-                        error: format!("worker panicked: {join_err}"),
-                    };
-                }
-            };
+        let tenant_id = job.tenant_id;
+        let payload_for_context = payload.clone();
+        let initial = match task::spawn_blocking(move || {
+            load_thumbnail_context(state_clone, tenant_id, payload_for_context)
+        })
+        .await
+        {
+            Ok(Ok(ctx)) => ctx,
+            Ok(Err(err)) => {
+                warn!(job_id = %job.id, error = %err, "thumbnail job will retry");
+                return JobExecution::Retry {
+                    delay: Duration::from_secs(30),
+                    error: err,
+                };
+            }
+            Err(join_err) => {
+                error!(job_id = %job.id, error = %join_err, "thumbnail task panicked");
+                return JobExecution::Retry {
+                    delay: Duration::from_secs(60),
+                    error: format!("worker panicked: {join_err}"),
+                };
+            }
+        };

        if initial.skip {
            info!(job_id = %job.id, "thumbnails already exist; skipping");
            return JobExecution::Success;
        }

-        let bytes = match storage.get_object(&initial.version.s3_key).await {
+        let bytes = match fetch_version_object(
+            &initial.version,
+            &storage,
+            &initial.version.s3_key,
+            state.config.worker_max_document_bytes,
+        )
+        .await
+        {
            Ok(bytes) => bytes,
-            Err(err) => {
-                warn!(job_id = %job.id, error = %err, "thumbnail fetch failed; will retry");
-                return JobExecution::Retry {
-                    delay: Duration::from_secs(30),
-                    error: err.to_string(),
-                };
-            }
+            Err(err) => return handle_fetch_error(&job, err, "thumbnail fetch failed; will retry"),
        };

        let generation = match generate_preview_and_thumbnail(&initial.document, &bytes) {
@@ -117,8 +127,15 @@ impl JobHandler for GenerateThumbnailsJob {
            let state_clone = state.clone();
            let document_id = initial.document.id;
            let version_id = initial.version.id;
+            let tenant_id = initial.tenant_id;
            match task::spawn_blocking(move || {
-                persist_document_page_count(state_clone, document_id, version_id, page_count)
+                persist_document_page_count(
+                    state_clone,
+                    tenant_id,
+                    document_id,
+                    version_id,
+                    page_count,
+                )
            })
            .await
            {
@@ -152,7 +169,7 @@ impl JobHandler for GenerateThumbnailsJob {
            }
        }

-        if initial.existing_preview.is_some() {
+        if let Some(existing_preview) = &initial.existing_preview {
            for object in &initial.existing_preview_objects {
                if let Err(err) = storage.delete_object(&object.s3_key).await {
                    warn!(
@@ -163,9 +180,36 @@ impl JobHandler for GenerateThumbnailsJob {
                    );
                }
            }
+
+            let tenant_id = initial.document.tenant_id;
+            let asset_id = existing_preview.id;
+            let state_clone = state.clone();
+            match task::spawn_blocking(move || {
+                delete_asset(state_clone.as_ref(), tenant_id, asset_id)
+            })
+            .await
+            {
+                Ok(Ok(())) => {}
+                Ok(Err(err)) => {
+                    warn!(
+                        job_id = %job.id,
+                        error = ?err,
+                        asset_id = %asset_id,
+                        "failed to remove preview metadata after deletion"
+                    );
+                }
+                Err(join_err) => {
+                    warn!(
+                        job_id = %job.id,
+                        error = %join_err,
+                        asset_id = %asset_id,
+                        "failed to remove preview metadata: task panicked"
+                    );
+                }
+            }
        }

-        if initial.existing_thumbnail.is_some() {
+        if let Some(existing_thumbnail) = &initial.existing_thumbnail {
            for object in &initial.existing_thumbnail_objects {
                if let Err(err) = storage.delete_object(&object.s3_key).await {
                    warn!(
@@ -176,6 +220,33 @@ impl JobHandler for GenerateThumbnailsJob {
                    );
                }
            }
+
+            let tenant_id = initial.document.tenant_id;
+            let asset_id = existing_thumbnail.id;
+            let state_clone = state.clone();
+            match task::spawn_blocking(move || {
+                delete_asset(state_clone.as_ref(), tenant_id, asset_id)
+            })
+            .await
+            {
+                Ok(Ok(())) => {}
+                Ok(Err(err)) => {
+                    warn!(
+                        job_id = %job.id,
+                        error = ?err,
+                        asset_id = %asset_id,
+                        "failed to remove thumbnail metadata after deletion"
+                    );
+                }
+                Err(join_err) => {
+                    warn!(
+                        job_id = %job.id,
+                        error = %join_err,
+                        asset_id = %asset_id,
+                        "failed to remove thumbnail metadata: task panicked"
+                    );
+                }
+            }
        }

        let preview_asset_id = Uuid::new_v4();
@@ -203,7 +274,7 @@ impl JobHandler for GenerateThumbnailsJob {
                .put_object(
                    &s3_key,
                    image.image_bytes.clone(),
-                    Some("image/png".into()),
+                    Some("image/webp".into()),
                    None,
                )
                .await
@@ -244,7 +315,7 @@ impl JobHandler for GenerateThumbnailsJob {
                .put_object(
                    &s3_key,
                    image.image_bytes.clone(),
-                    Some("image/png".into()),
+                    Some("image/webp".into()),
                    None,
                )
                .await
@@ -312,6 +383,7 @@ struct ThumbnailContext {
    existing_preview: Option<DocumentAsset>,
    existing_preview_objects: Vec<DocumentAssetObject>,
    skip: bool,
+    tenant_id: Uuid,
 }

 struct GeneratedImage {
@@ -345,70 +417,43 @@ struct AssetPersistence {

 fn load_thumbnail_context(
    state: Arc<AppState>,
-    payload: &ThumbnailPayload,
+    tenant_id: Uuid,
+    payload: ThumbnailPayload,
 ) -> Result<ThumbnailContext, String> {
-    let mut conn = state.db_unscoped().map_err(|err| format!("{err:?}"))?;
+    let base = load_document_version(
+        state.as_ref(),
+        tenant_id,
+        payload.document_id,
+        payload.document_version_id,
+    )?;

-    let version: DocumentVersion = document_versions::table
-        .find(payload.document_version_id)
-        .first(&mut conn)
+    let mut conn = state
+        .db_for_tenant(base.tenant_id)
        .map_err(|err| format!("{err:?}"))?;

-    if version.document_id != payload.document_id {
-        return Err("document/version mismatch".into());
-    }
+    let mut assets = load_version_assets(
+        &mut conn,
+        base.tenant_id,
+        base.version.id,
+        &[THUMBNAIL_ASSET_TYPE, PREVIEW_ASSET_TYPE],
+    )?;

-    let document: Document = documents::table
-        .find(payload.document_id)
-        .first(&mut conn)
-        .map_err(|err| format!("{err:?}"))?;
+    let (existing_thumbnail, existing_thumbnail_objects) = assets
+        .remove(THUMBNAIL_ASSET_TYPE)
+        .map(|entry| (Some(entry.asset), entry.objects))
+        .unwrap_or((None, Vec::new()));

-    let tenant_id = document.tenant_id;
+    let (existing_preview, existing_preview_objects) = assets
+        .remove(PREVIEW_ASSET_TYPE)
+        .map(|entry| (Some(entry.asset), entry.objects))
+        .unwrap_or((None, Vec::new()));

-    let existing_assets: Vec<DocumentAsset> = document_assets::table
-        .filter(document_assets::document_version_id.eq(payload.document_version_id))
-        .filter(document_assets::asset_type.eq_any(vec![
-            THUMBNAIL_ASSET_TYPE.to_string(),
-            PREVIEW_ASSET_TYPE.to_string(),
-        ]))
-        .filter(document_assets::tenant_id.eq(tenant_id))
-        .load(&mut conn)
-        .map_err(|err| format!("{err:?}"))?;
-
-    let mut existing_thumbnail = None;
-    let mut existing_thumbnail_objects: Vec<DocumentAssetObject> = Vec::new();
-    let mut existing_preview = None;
-    let mut existing_preview_objects: Vec<DocumentAssetObject> = Vec::new();
-    for asset in existing_assets {
-        match asset.asset_type.as_str() {
-            THUMBNAIL_ASSET_TYPE => {
-                existing_thumbnail_objects = document_asset_objects::table
-                    .filter(document_asset_objects::asset_id.eq(asset.id))
-                    .filter(document_asset_objects::tenant_id.eq(tenant_id))
-                    .order(document_asset_objects::ordinal.asc())
-                    .load(&mut conn)
-                    .map_err(|err| format!("{err:?}"))?;
-                existing_thumbnail = Some(asset);
-            }
-            PREVIEW_ASSET_TYPE => {
-                existing_preview_objects = document_asset_objects::table
-                    .filter(document_asset_objects::asset_id.eq(asset.id))
-                    .filter(document_asset_objects::tenant_id.eq(tenant_id))
-                    .order(document_asset_objects::ordinal.asc())
-                    .load(&mut conn)
-                    .map_err(|err| format!("{err:?}"))?;
-                existing_preview = Some(asset);
-            }
-            _ => {}
-        }
-    }
-
-    let (supported, _) = determine_thumbnail_support(&document);
+    let (supported, _) = determine_thumbnail_support(&base.document);
    if !supported {
        return Err("thumbnail generation not supported for this document".into());
    }

-    let expected_cardinality = expected_asset_cardinality(&document, &version);
+    let expected_cardinality = expected_asset_cardinality(&base.document, &base.version);
    let preview_cardinality = existing_preview
        .as_ref()
        .and_then(|asset| asset.cardinality)
@@ -429,13 +474,14 @@ fn load_thumbnail_context(
        && !needs_regeneration;

    Ok(ThumbnailContext {
-        document,
-        version,
+        document: base.document,
+        version: base.version,
        existing_thumbnail,
        existing_thumbnail_objects,
        existing_preview,
        existing_preview_objects,
        skip,
+        tenant_id: base.tenant_id,
    })
 }

@@ -563,7 +609,7 @@ fn encode_dynamic_image(image: image::DynamicImage) -> Result<GeneratedImage, St
    let (width, height) = image.dimensions();
    let mut cursor = Cursor::new(Vec::new());
    image
-        .write_to(&mut cursor, ImageFormat::Png)
+        .write_to(&mut cursor, ImageFormat::WebP)
        .map_err(|err| err.to_string())?;
    Ok(GeneratedImage {
        image_bytes: cursor.into_inner(),
@@ -614,7 +660,7 @@ fn persist_assets_metadata(
            id: asset.asset_id,
            document_version_id: context.version.id,
            asset_type: asset.asset_type.to_string(),
-            mime_type: "image/png".to_string(),
+            mime_type: "image/webp".to_string(),
            metadata: json!({
                "generated_at": Utc::now().to_rfc3339(),
            }),
@@ -677,15 +723,13 @@ fn persist_assets_metadata(

 fn persist_document_page_count(
    state: Arc<AppState>,
+    tenant_id: Uuid,
    document_id: Uuid,
    document_version_id: Uuid,
    page_count: u32,
 ) -> Result<(), String> {
-    let mut conn = state.db_unscoped().map_err(|err| format!("{err:?}"))?;
-    let tenant_id: Uuid = documents::table
-        .find(document_id)
-        .select(documents::tenant_id)
-        .first(&mut conn)
+    let mut conn = state
+        .db_for_tenant(tenant_id)
        .map_err(|err| format!("{err:?}"))?;

    let existing_metadata: Value = document_versions::table
@@ -0,0 +1,283 @@
+mod common;
+
+use anyhow::Result;
+use axum::body::Body;
+use axum::http::{header, Method, Request, StatusCode};
+use base64::engine::general_purpose::STANDARD as BASE64;
+use base64::Engine;
+use common::{acquire_db_lock, body_to_vec, TestApp};
+use diesel::prelude::*;
+use papercrate::models::{ApiToken, ApiTokenCapability};
+use papercrate::routes::webdav;
+use papercrate::schema::api_tokens;
+use serde::Deserialize;
+use serde_json::json;
+use tower::ServiceExt;
+use uuid::Uuid;
+
+#[derive(Debug, Deserialize)]
+struct TokenInfo {
+    id: Uuid,
+    label: Option<String>,
+    last_used_at: Option<String>,
+    revoked_at: Option<String>,
+    capabilities: Vec<ApiTokenCapability>,
+}
+
+#[derive(Debug, Deserialize)]
+struct CreateTokenResponse {
+    token: String,
+    #[serde(rename = "token_info")]
+    info: TokenInfo,
+}
+
+#[derive(Debug, Deserialize)]
+struct LoginResponseView {
+    access_token: String,
+    token_type: String,
+    expires_in: i64,
+    tenant: TenantView,
+}
+
+#[derive(Debug, Deserialize)]
+struct TenantView {
+    id: Uuid,
+    name: String,
+}
+
+#[tokio::test]
+async fn api_token_crud_flow() -> Result<()> {
+    let _guard = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let username = "alice";
+    let password = "correct horse battery";
+    app.insert_user(username, password, "admin").await?;
+    let access_token = app.login_token(username, password).await?;
+
+    let created = create_token(&app, &access_token, json!({ "label": "dav" })).await?;
+    let token_id = created.info.id;
+    assert_eq!(created.info.label.as_deref(), Some("dav"));
+    assert!(created.info.last_used_at.is_none());
+    assert_eq!(created.info.capabilities, vec![ApiTokenCapability::Webdav]);
+
+    let regenerated = regenerate_token(&app, &access_token, token_id).await?;
+    assert_eq!(regenerated.info.id, token_id);
+    assert_ne!(regenerated.token, created.token);
+    assert!(regenerated.info.last_used_at.is_none());
+
+    let updated = update_token_capabilities(
+        &app,
+        &access_token,
+        token_id,
+        json!({ "capabilities": ["webdav", "api"] }),
+    )
+    .await?;
+    assert_eq!(updated.capabilities.len(), 2);
+    assert!(updated.capabilities.contains(&ApiTokenCapability::Webdav));
+    assert!(updated.capabilities.contains(&ApiTokenCapability::Api));
+
+    let listed = list_tokens(&app, &access_token).await?;
+    assert_eq!(listed.len(), 1);
+    assert_eq!(listed[0].id, token_id);
+
+    let tenant_id_for_token = app
+        .with_conn(move |conn| {
+            let tenant_id = api_tokens::table
+                .find(token_id)
+                .select(api_tokens::tenant_id)
+                .first::<Uuid>(conn)?;
+            Ok::<_, anyhow::Error>(tenant_id)
+        })
+        .await?;
+
+    let exchange = exchange_token(&app, &regenerated.token).await?;
+    assert_eq!(exchange.token_type, "Bearer");
+    assert!(!exchange.access_token.is_empty());
+    assert!(exchange.expires_in > 0);
+    assert_eq!(exchange.tenant.id, tenant_id_for_token);
+    assert!(!exchange.tenant.name.is_empty());
+
+    delete_token(&app, &access_token, token_id).await?;
+
+    let listed_after = list_tokens(&app, &access_token).await?;
+    assert_eq!(listed_after.len(), 1);
+    assert_eq!(listed_after[0].id, token_id);
+    assert!(listed_after[0].revoked_at.is_some());
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn webdav_basic_auth_uses_api_tokens() -> Result<()> {
+    let _guard = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let username = "bruce";
+    let password = "wayne";
+    app.insert_user(username, password, "admin").await?;
+    let access_token = app.login_token(username, password).await?;
+
+    let created = create_token(&app, &access_token, json!({ "label": "webdav" })).await?;
+    let token_id = created.info.id;
+
+    let router = webdav::create_router().with_state(app.state.clone());
+    let original_secret = created.token.clone();
+    let auth_header = format!(
+        "Basic {}",
+        BASE64.encode(format!("{}:{}", username, original_secret))
+    );
+
+    let propfind = Method::from_bytes(b"PROPFIND")?;
+    let success_request = Request::builder()
+        .method(propfind.clone())
+        .uri("/")
+        .header(header::AUTHORIZATION, auth_header.clone())
+        .header("depth", "0")
+        .body(Body::empty())?;
+    let response = router.clone().oneshot(success_request).await?;
+    assert_eq!(response.status(), StatusCode::MULTI_STATUS);
+
+    let used = app
+        .with_conn(move |conn| {
+            let record = api_tokens::table.find(token_id).first::<ApiToken>(conn)?;
+            Ok::<_, anyhow::Error>(record.last_used_at)
+        })
+        .await?;
+    assert!(used.is_some());
+
+    let regenerated = regenerate_token(&app, &access_token, token_id).await?;
+    assert_ne!(regenerated.token, original_secret);
+
+    let unused_after_regen = app
+        .with_conn(move |conn| {
+            let record = api_tokens::table.find(token_id).first::<ApiToken>(conn)?;
+            Ok::<_, anyhow::Error>(record.last_used_at)
+        })
+        .await?;
+    assert!(unused_after_regen.is_none());
+
+    let old_secret_request = Request::builder()
+        .method(propfind.clone())
+        .uri("/")
+        .header(
+            header::AUTHORIZATION,
+            format!(
+                "Basic {}",
+                BASE64.encode(format!("{}:{}", username, original_secret))
+            ),
+        )
+        .header("depth", "0")
+        .body(Body::empty())?;
+    let old_secret_response = router.clone().oneshot(old_secret_request).await?;
+    assert_eq!(old_secret_response.status(), StatusCode::UNAUTHORIZED);
+
+    let new_secret_header = format!(
+        "Basic {}",
+        BASE64.encode(format!("{}:{}", username, regenerated.token))
+    );
+
+    let success_request = Request::builder()
+        .method(propfind.clone())
+        .uri("/")
+        .header(header::AUTHORIZATION, new_secret_header.clone())
+        .header("depth", "0")
+        .body(Body::empty())?;
+    let response = router.clone().oneshot(success_request).await?;
+    assert_eq!(response.status(), StatusCode::MULTI_STATUS);
+
+    delete_token(&app, &access_token, token_id).await?;
+
+    let failure_request = Request::builder()
+        .method(propfind)
+        .uri("/")
+        .header(header::AUTHORIZATION, new_secret_header)
+        .header("depth", "0")
+        .body(Body::empty())?;
+    let failure_response = router.oneshot(failure_request).await?;
+    assert_eq!(failure_response.status(), StatusCode::UNAUTHORIZED);
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+async fn create_token(
+    app: &TestApp,
+    access_token: &str,
+    payload: serde_json::Value,
+) -> Result<CreateTokenResponse> {
+    let response = app
+        .post_json("/api/profile/api-tokens", &payload, Some(access_token))
+        .await?;
+    assert_eq!(response.status(), StatusCode::CREATED);
+    let body = body_to_vec(response.into_body()).await?;
+    Ok(serde_json::from_slice(&body)?)
+}
+
+async fn regenerate_token(
+    app: &TestApp,
+    access_token: &str,
+    token_id: Uuid,
+) -> Result<CreateTokenResponse> {
+    let response = app
+        .post_json(
+            &format!("/api/profile/api-tokens/{token_id}/regenerate"),
+            &json!({}),
+            Some(access_token),
+        )
+        .await?;
+    assert_eq!(response.status(), StatusCode::OK);
+    let body = body_to_vec(response.into_body()).await?;
+    Ok(serde_json::from_slice(&body)?)
+}
+
+async fn update_token_capabilities(
+    app: &TestApp,
+    access_token: &str,
+    token_id: Uuid,
+    payload: serde_json::Value,
+) -> Result<TokenInfo> {
+    let response = app
+        .patch_json(
+            &format!("/api/profile/api-tokens/{token_id}"),
+            &payload,
+            Some(access_token),
+        )
+        .await?;
+    assert_eq!(response.status(), StatusCode::OK);
+    let body = body_to_vec(response.into_body()).await?;
+    Ok(serde_json::from_slice(&body)?)
+}
+
+async fn list_tokens(app: &TestApp, access_token: &str) -> Result<Vec<TokenInfo>> {
+    let response = app
+        .get("/api/profile/api-tokens", Some(access_token))
+        .await?;
+    assert_eq!(response.status(), StatusCode::OK);
+    let body = body_to_vec(response.into_body()).await?;
+    Ok(serde_json::from_slice(&body)?)
+}
+
+async fn delete_token(app: &TestApp, access_token: &str, token_id: Uuid) -> Result<()> {
+    let response = app
+        .delete(
+            &format!("/api/profile/api-tokens/{token_id}"),
+            Some(access_token),
+        )
+        .await?;
+    assert_eq!(response.status(), StatusCode::NO_CONTENT);
+    Ok(())
+}
+async fn exchange_token(app: &TestApp, api_token: &str) -> Result<LoginResponseView> {
+    let response = app
+        .post_json(
+            "/api/auth/exchange-api-token",
+            &json!({ "api_token": api_token }),
+            None,
+        )
+        .await?;
+    assert_eq!(response.status(), StatusCode::OK);
+    let body = body_to_vec(response.into_body()).await?;
+    Ok(serde_json::from_slice(&body)?)
+}
@@ -1,15 +1,77 @@
 mod common;

-use anyhow::Result;
-use axum::http::StatusCode;
+use anyhow::{anyhow, Context, Result};
+use axum::http::{header::SET_COOKIE, StatusCode};
+use chrono::{Duration as ChronoDuration, Utc};
 use common::{acquire_db_lock, body_to_vec, TestApp};
+use diesel::prelude::*;
+use papercrate::auth::passkeys::{
+    PasskeyLoginFinishPayload, PasskeyLoginStartPayload, PasskeyRegistrationFinishPayload,
+    RegistrationChallengeResponse,
+};
+use papercrate::models::{NewUserMembership, NewUserSession, TenantStatus, UserPasskey};
+use papercrate::openapi::schemas::PasskeySummary;
+use papercrate::schema::{tenants, user_memberships, user_sessions, users};
+use rand::rngs::OsRng;
+use rand::RngCore;
 use serde::Deserialize;
+use serde_json::json;
+use sha2::{Digest, Sha256};
+use uuid::Uuid;
+use webauthn_rs_core::proto::{
+    AuthenticatorAssertionResponseRaw, AuthenticatorAttestationResponseRaw, PublicKeyCredential,
+    RegisterPublicKeyCredential,
+};

 #[derive(Deserialize)]
 struct AuthenticatedUser {
    username: String,
 }

+#[derive(Deserialize)]
+struct ApiErrorResponse {
+    error: String,
+    #[serde(default)]
+    _code: Option<String>,
+}
+
+#[derive(Deserialize)]
+struct LoginTenant {
+    id: Uuid,
+    name: String,
+}
+
+#[derive(Deserialize)]
+struct LoginResponse {
+    access_token: String,
+    tenant: LoginTenant,
+}
+
+#[derive(Deserialize)]
+struct SignupStartResponse {
+    signup_token: String,
+    challenge: RegistrationChallengeResponse,
+}
+
+#[derive(Deserialize)]
+struct TenantSelectionResponse {
+    #[serde(rename = "access_token")]
+    _access_token: String,
+    #[serde(rename = "tenants")]
+    _tenants: Vec<TenantSummary>,
+}
+
+#[derive(Deserialize)]
+struct TenantListResponse {
+    tenants: Vec<TenantSummary>,
+}
+
+#[derive(Deserialize)]
+struct TenantSummary {
+    id: Uuid,
+    name: String,
+}
+
 #[tokio::test]
 async fn login_and_me_roundtrip() -> Result<()> {
    let _lock = acquire_db_lock().await;
@@ -18,9 +80,9 @@ async fn login_and_me_roundtrip() -> Result<()> {
    let password = "s3cret";
    app.insert_user("alice", password, "admin").await?;

-    let token = app.login_token("alice", password).await?;
+    let (login, _) = login_with_session(&app, "alice", password).await?;

-    let response = app.get("/api/auth/me", Some(&token)).await?;
+    let response = app.get("/api/auth/me", Some(&login.access_token)).await?;
    assert_eq!(response.status(), StatusCode::OK);
    let body = body_to_vec(response.into_body()).await?;
    let user: AuthenticatedUser = serde_json::from_slice(&body)?;
@@ -30,3 +92,565 @@ async fn login_and_me_roundtrip() -> Result<()> {
    app.cleanup().await?;
    Ok(())
 }
+
+#[tokio::test]
+async fn login_rejects_unknown_user() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let payload = json!({ "username": "ghost", "password": "nope" });
+    let response = app.post_json("/api/auth/login", &payload, None).await?;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    let body = body_to_vec(response.into_body()).await?;
+    let err: ApiErrorResponse = serde_json::from_slice(&body)?;
+    assert_eq!(err.error, "password authentication is no longer supported");
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn signup_start_and_finish_require_valid_passkey() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let payload = json!({ "username": "signup-user" });
+
+    let response = app
+        .post_json("/api/auth/signup/start", &payload, None)
+        .await?;
+    assert_eq!(response.status(), StatusCode::OK);
+    let body = body_to_vec(response.into_body()).await?;
+    let start: SignupStartResponse = serde_json::from_slice(&body)?;
+    assert!(!start.signup_token.is_empty());
+    assert_ne!(start.challenge.challenge_id, Uuid::nil());
+
+    app.with_conn(|conn| {
+        let exists: bool = diesel::select(diesel::dsl::exists(
+            users::table.filter(users::username.eq("signup-user")),
+        ))
+        .get_result(conn)?;
+        assert!(!exists);
+        Ok(())
+    })
+    .await?;
+
+    let finish_payload = json!({
+        "signup_token": start.signup_token,
+        "credential": fake_register_credential(),
+    });
+    let finish_response = app
+        .post_json("/api/auth/signup/finish", &finish_payload, None)
+        .await?;
+    assert_eq!(finish_response.status(), StatusCode::BAD_REQUEST);
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn passkey_register_start_creates_challenge() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let password = "secret";
+    app.insert_user("passkey-user", password, "admin").await?;
+
+    let (login, _) = login_with_session(&app, "passkey-user", password).await?;
+
+    let response = app
+        .post_json(
+            "/api/auth/passkeys/register/start",
+            &json!({}),
+            Some(&login.access_token),
+        )
+        .await?;
+
+    assert_eq!(response.status(), StatusCode::OK);
+    let body = body_to_vec(response.into_body()).await?;
+    let challenge: RegistrationChallengeResponse = serde_json::from_slice(&body)?;
+    assert_ne!(challenge.challenge_id, Uuid::nil());
+    let challenge_id = challenge.challenge_id;
+
+    app.with_conn(move |conn| {
+        use diesel::dsl::{exists, select};
+        use papercrate::schema::webauthn_challenges::dsl;
+
+        let exists: bool = select(exists(
+            dsl::webauthn_challenges.filter(dsl::id.eq(challenge_id)),
+        ))
+        .get_result(conn)?;
+        assert!(exists, "challenge not persisted");
+        Ok(())
+    })
+    .await?;
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn passkey_register_finish_rejects_unknown_challenge() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let password = "secret";
+    app.insert_user("passkey-register", password, "admin")
+        .await?;
+    let (login, _) = login_with_session(&app, "passkey-register", password).await?;
+
+    let payload = PasskeyRegistrationFinishPayload {
+        challenge_id: Uuid::new_v4(),
+        credential: fake_register_credential(),
+        nickname: None,
+    };
+
+    let response = app
+        .post_json(
+            "/api/auth/passkeys/register/finish",
+            &payload,
+            Some(&login.access_token),
+        )
+        .await?;
+
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn passkey_login_start_requires_passkey() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let password = "secret";
+    app.insert_user("passkey-login", password, "admin").await?;
+
+    let payload = PasskeyLoginStartPayload {
+        username: "passkey-login".to_string(),
+    };
+
+    let response = app
+        .post_json("/api/auth/passkeys/login/start", &payload, None)
+        .await?;
+
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn passkey_login_start_unknown_user_returns_not_found() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let payload = PasskeyLoginStartPayload {
+        username: "nobody".to_string(),
+    };
+
+    let response = app
+        .post_json("/api/auth/passkeys/login/start", &payload, None)
+        .await?;
+
+    assert_eq!(response.status(), StatusCode::NOT_FOUND);
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn passkey_login_finish_rejects_invalid_challenge() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let payload = PasskeyLoginFinishPayload {
+        challenge_id: Uuid::new_v4(),
+        credential: fake_authentication_credential(),
+    };
+
+    let response = app
+        .post_json("/api/auth/passkeys/login/finish", &payload, None)
+        .await?;
+
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn list_passkeys_returns_entries() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let password = "secret";
+    let user_id = app.insert_user("passkey-owner", password, "admin").await?;
+    app.insert_passkey(user_id, Some("Laptop")).await?;
+
+    let (session, _) = login_with_session(&app, "passkey-owner", password).await?;
+
+    let response = app
+        .get("/api/profile/passkeys", Some(&session.access_token))
+        .await?;
+    assert_eq!(response.status(), StatusCode::OK);
+
+    let body = body_to_vec(response.into_body()).await?;
+    let summaries: Vec<PasskeySummary> = serde_json::from_slice(&body)?;
+    assert_eq!(summaries.len(), 1);
+    assert_eq!(summaries[0].nickname.as_deref(), Some("Laptop"));
+    assert!(summaries[0].revoked_at.is_none());
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn delete_passkey_soft_revokes() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let password = "secret";
+    let user_id = app.insert_user("passkey-delete", password, "admin").await?;
+    let passkey_id = app.insert_passkey(user_id, Some("Phone")).await?;
+    app.insert_passkey(user_id, Some("Backup")).await?;
+    let (session, _) = login_with_session(&app, "passkey-delete", password).await?;
+
+    let response = app
+        .delete(
+            &format!("/api/profile/passkeys/{}?reason=lost", passkey_id),
+            Some(&session.access_token),
+        )
+        .await?;
+    assert_eq!(response.status(), StatusCode::NO_CONTENT);
+
+    app.with_conn(move |conn| {
+        use papercrate::schema::user_passkeys::dsl as passkey_dsl;
+
+        let record = passkey_dsl::user_passkeys
+            .find(passkey_id)
+            .first::<UserPasskey>(conn)?;
+        assert!(record.revoked_at.is_some());
+        assert_eq!(record.revoked_reason.as_deref(), Some("lost"));
+        Ok(())
+    })
+    .await?;
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn delete_passkey_prevents_last() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let password = "secret";
+    let user_id = app.insert_user("passkey-guard", password, "admin").await?;
+    let first_id = app.insert_passkey(user_id, Some("Key A")).await?;
+    let last_id = app.insert_passkey(user_id, Some("Key B")).await?;
+    let (session, _) = login_with_session(&app, "passkey-guard", password).await?;
+
+    let response = app
+        .delete(
+            &format!("/api/profile/passkeys/{}", first_id),
+            Some(&session.access_token),
+        )
+        .await?;
+    assert_eq!(response.status(), StatusCode::NO_CONTENT);
+
+    let block_response = app
+        .delete(
+            &format!("/api/profile/passkeys/{}", last_id),
+            Some(&session.access_token),
+        )
+        .await?;
+    assert_eq!(block_response.status(), StatusCode::BAD_REQUEST);
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+fn fake_register_credential() -> RegisterPublicKeyCredential {
+    RegisterPublicKeyCredential {
+        id: "fake-passkey".to_string(),
+        raw_id: vec![1, 2, 3, 4].into(),
+        response: AuthenticatorAttestationResponseRaw {
+            attestation_object: vec![5, 6, 7, 8].into(),
+            client_data_json: vec![9, 10, 11, 12].into(),
+            transports: None,
+        },
+        type_: "public-key".to_string(),
+        extensions: Default::default(),
+    }
+}
+
+fn fake_authentication_credential() -> PublicKeyCredential {
+    PublicKeyCredential {
+        id: "fake-auth".to_string(),
+        raw_id: vec![1, 2, 3].into(),
+        response: AuthenticatorAssertionResponseRaw {
+            authenticator_data: vec![4, 5, 6].into(),
+            client_data_json: vec![7, 8, 9].into(),
+            signature: vec![10, 11, 12].into(),
+            user_handle: None,
+        },
+        extensions: Default::default(),
+        type_: "public-key".to_string(),
+    }
+}
+
+#[tokio::test]
+async fn login_rejects_invalid_password() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let password = "valid";
+    app.insert_user("robin", password, "admin").await?;
+
+    let payload = json!({ "username": "robin", "password": "wrong" });
+    let response = app.post_json("/api/auth/login", &payload, None).await?;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    let body = body_to_vec(response.into_body()).await?;
+    let err: ApiErrorResponse = serde_json::from_slice(&body)?;
+    assert_eq!(err.error, "password authentication is no longer supported");
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn refresh_rotates_refresh_token() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let password = "rotate";
+    app.insert_user("rita", password, "admin").await?;
+
+    let (login, refresh_cookie) = login_with_session(&app, "rita", password).await?;
+
+    let response = app
+        .post_json_with_cookie("/api/auth/refresh", &json!({}), None, Some(&refresh_cookie))
+        .await?;
+    assert_eq!(response.status(), StatusCode::OK);
+    let new_cookie = extract_refresh_cookie(response.headers())?;
+    let body = body_to_vec(response.into_body()).await?;
+    let refreshed: LoginResponse = serde_json::from_slice(&body)?;
+    assert_eq!(refreshed.tenant.name, login.tenant.name);
+
+    let me_response = app
+        .get("/api/auth/me", Some(&refreshed.access_token))
+        .await?;
+    assert_eq!(me_response.status(), StatusCode::OK);
+
+    let retry = app
+        .post_json_with_cookie("/api/auth/refresh", &json!({}), None, Some(&refresh_cookie))
+        .await?;
+    assert_eq!(retry.status(), StatusCode::UNAUTHORIZED);
+
+    // new cookie should differ from old to avoid reuse
+    assert_ne!(new_cookie, refresh_cookie);
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn logout_revokes_refresh_token() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let password = "logout";
+    app.insert_user("logan", password, "admin").await?;
+
+    let (login, refresh_cookie) = login_with_session(&app, "logan", password).await?;
+
+    let response = app
+        .post_json_with_cookie(
+            "/api/auth/logout",
+            &json!({}),
+            Some(&login.access_token),
+            Some(&refresh_cookie),
+        )
+        .await?;
+    assert_eq!(response.status(), StatusCode::NO_CONTENT);
+    let cleared_cookie = extract_refresh_cookie(response.headers())?;
+    assert!(cleared_cookie.ends_with("="));
+
+    let after_logout = app
+        .post_json_with_cookie("/api/auth/refresh", &json!({}), None, Some(&refresh_cookie))
+        .await?;
+    assert_eq!(after_logout.status(), StatusCode::UNAUTHORIZED);
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn me_requires_authentication() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let unauthenticated = app.get("/api/auth/me", None).await?;
+    assert_eq!(unauthenticated.status(), StatusCode::UNAUTHORIZED);
+
+    let invalid = app.get("/api/auth/me", Some("invalid")).await?;
+    assert_eq!(invalid.status(), StatusCode::UNAUTHORIZED);
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn login_returns_tenant_selection_when_multiple_memberships() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let password = "multipass";
+    let user_id = app.insert_user("multipass", password, "admin").await?;
+
+    let secondary_name = "secondary".to_string();
+    let name_for_insert = secondary_name.clone();
+    let secondary_id = Uuid::new_v4();
+    app.with_conn(move |conn| {
+        diesel::insert_into(tenants::table)
+            .values((
+                tenants::id.eq(secondary_id),
+                tenants::name.eq(&name_for_insert),
+                tenants::status.eq(TenantStatus::Active),
+            ))
+            .execute(conn)?;
+
+        let membership = NewUserMembership {
+            id: Uuid::new_v4(),
+            user_id,
+            tenant_id: secondary_id,
+        };
+
+        diesel::insert_into(user_memberships::table)
+            .values(&membership)
+            .execute(conn)?;
+        Ok(())
+    })
+    .await?;
+
+    let (login, refresh_cookie) = login_with_session(&app, "multipass", password).await?;
+
+    let tenants_response = app
+        .get("/api/auth/tenants", Some(&login.access_token))
+        .await?;
+    assert_eq!(tenants_response.status(), StatusCode::OK);
+    let tenants_body = body_to_vec(tenants_response.into_body()).await?;
+    let tenant_list: TenantListResponse = serde_json::from_slice(&tenants_body)?;
+    assert!(tenant_list.tenants.len() >= 2);
+
+    let secondary = tenant_list
+        .tenants
+        .iter()
+        .find(|tenant| tenant.name == secondary_name)
+        .map(|t| t.id)
+        .context("secondary tenant missing from listing")?;
+
+    let select_response = app
+        .post_json_with_cookie(
+            "/api/auth/select-tenant",
+            &json!({ "tenant_id": secondary }),
+            Some(&login.access_token),
+            Some(&refresh_cookie),
+        )
+        .await?;
+    assert_eq!(select_response.status(), StatusCode::OK);
+    let select_body = body_to_vec(select_response.into_body()).await?;
+    let rotated: LoginResponse = serde_json::from_slice(&select_body)?;
+    assert_eq!(rotated.tenant.id, secondary);
+    assert_eq!(rotated.tenant.name, secondary_name);
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+async fn login_with_session(
+    app: &TestApp,
+    username: &str,
+    _password: &str,
+) -> Result<(LoginResponse, String)> {
+    let username = username.to_string();
+    let state = app.state.clone();
+    app.with_conn(move |conn| {
+        use papercrate::schema::user_memberships::dsl as memberships_dsl;
+        use papercrate::schema::users::dsl as users_dsl;
+
+        let user: papercrate::models::User = users_dsl::users
+            .filter(users_dsl::username.eq(&username))
+            .first(conn)?;
+
+        let membership: papercrate::models::UserMembership = memberships_dsl::user_memberships
+            .filter(memberships_dsl::user_id.eq(user.id))
+            .first(conn)?;
+
+        let tenant: papercrate::models::Tenant =
+            tenants::table.find(membership.tenant_id).first(conn)?;
+
+        let now = Utc::now();
+        let access_token = state
+            .jwt
+            .generate_token(user.id, tenant.id, &user.username)
+            .map_err(|err| anyhow!(err))?;
+
+        let session_value = generate_session_token();
+        let session_hash = hash_session_token(&session_value);
+        let refresh_expires_at = now + ChronoDuration::days(state.config.refresh_token_expiry_days);
+
+        let new_session = NewUserSession {
+            id: Uuid::new_v4(),
+            user_id: user.id,
+            token_hash: session_hash,
+            issued_at: now.naive_utc(),
+            expires_at: refresh_expires_at.naive_utc(),
+            tenant_id: tenant.id,
+        };
+
+        diesel::insert_into(user_sessions::table)
+            .values(&new_session)
+            .execute(conn)?;
+
+        let login = LoginResponse {
+            access_token,
+            tenant: LoginTenant {
+                id: tenant.id,
+                name: tenant.name.clone(),
+            },
+        };
+
+        let cookie = format!("refresh_token={session_value}");
+        Ok((login, cookie))
+    })
+    .await
+}
+
+fn extract_refresh_cookie(headers: &axum::http::HeaderMap) -> Result<String> {
+    let header_value = headers
+        .get(SET_COOKIE)
+        .context("missing set-cookie header")?
+        .to_str()
+        .context("invalid set-cookie header")?;
+    let cookie = header_value
+        .split(';')
+        .next()
+        .context("set-cookie missing cookie value")?
+        .to_string();
+    Ok(cookie)
+}
+
+fn generate_session_token() -> String {
+    let mut bytes = [0u8; 32];
+    OsRng.fill_bytes(&mut bytes);
+    hex::encode(bytes)
+}
+
+fn hash_session_token(value: &str) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(value.as_bytes());
+    hex::encode(hasher.finalize())
+}
@@ -6,15 +6,9 @@ use std::time::Duration;
 use anyhow::{anyhow, ensure, Context, Result};
 use async_trait::async_trait;
 use axum::body::Body;
-use axum::http::{Method, Request, StatusCode};
+use axum::http::{header, Method, Request};
 use axum::Router;
-use backend::auth::jwt::JwtService;
-use backend::config::AppConfig;
-use backend::db::{self, PgPool};
-use backend::models::{Job, NewUser, NewUserMembership, Tenant};
-use backend::routes;
-use backend::state::AppState;
-use backend::storage::ObjectStorage;
+use chrono::{Duration as ChronoDuration, Utc};
 use diesel::connection::SimpleConnection;
 use diesel::prelude::*;
 use diesel::OptionalExtension;
@@ -22,17 +16,37 @@ use diesel::PgConnection;
 use diesel_migrations::{embed_migrations, EmbeddedMigrations, MigrationHarness};
 use http_body_util::BodyExt;
 use once_cell::sync::Lazy;
+use papercrate::auth::jwt::JwtService;
+use papercrate::config::AppConfig;
+use papercrate::db::{self, PgPool};
+use papercrate::models::{
+    Job, NewUser, NewUserMembership, NewUserPasskey, NewUserSession, Tenant, TenantStatus, User,
+    UserMembership,
+};
+use papercrate::routes;
+use papercrate::schema::user_sessions::dsl as session_dsl;
+use papercrate::state::AppState;
+use papercrate::storage::ObjectStorage;
 use rand::rngs::OsRng;
-use serde::{Deserialize, Serialize};
-use serde_json;
+use rand::RngCore;
+use serde::Serialize;
+use serde_json::{self, json};
+use sha2::{Digest, Sha256};
 use tokio::sync::Mutex;
 use tower::util::ServiceExt;
 use uuid::Uuid;

 const MIGRATIONS: EmbeddedMigrations = embed_migrations!("migrations");
+const RESET_DATABASE_SQL: &str = "DROP SCHEMA IF EXISTS tenant CASCADE;\n\
+     DROP SCHEMA IF EXISTS shared CASCADE;\n\
+     DROP SCHEMA IF EXISTS public CASCADE;\n\
+     CREATE SCHEMA public;\n\
+     GRANT ALL ON SCHEMA public TO public;";

 static DB_LOCK: Lazy<Mutex<()>> = Lazy::new(|| Mutex::new(()));

+const TEST_TENANT_NAME: &str = "test_tenant";
+
 #[allow(dead_code)]
 #[derive(Clone)]
 pub struct StoredObject {
@@ -140,7 +154,11 @@ impl TestApp {
            s3_bucket: "test-bucket".to_string(),
            quickwit_endpoint: None,
            quickwit_index: None,
-            default_tenant_slug: "admin".to_string(),
+            worker_max_document_bytes: 200 * 1024 * 1024,
+            upload_body_limit_bytes: 128 * 1024 * 1024,
+            webauthn_rp_id: Some("localhost".to_string()),
+            webauthn_origin: Some("http://localhost".to_string()),
+            webauthn_rp_name: "Papercrate".to_string(),
        };

        let pool = db::init_pool_with_size(&config.database_url, config.database_max_pool_size)?;
@@ -186,10 +204,11 @@ impl TestApp {

    #[allow(dead_code)]
    pub async fn storage_key_for(&self, key: &str) -> Result<String> {
+        self.ensure_default_tenant().await?;
        let tenant = self
            .state
            .tenants
-            .get_by_slug(&self.state.config.default_tenant_slug)
+            .get_by_name(TEST_TENANT_NAME)
            .map_err(|err| anyhow!("default tenant not found: {:?}", err))?;
        let root = tenant
            .storage_root
@@ -198,23 +217,15 @@ impl TestApp {
        Ok(format!("{}{}", root, key))
    }

-    pub async fn insert_user(&self, username: &str, password: &str, role: &str) -> Result<Uuid> {
+    pub async fn insert_user(&self, username: &str, _password: &str, _role: &str) -> Result<Uuid> {
        let username = username.to_string();
-        let password = password.to_string();
-        let role = role.to_string();
-        let tenant_id = self
-            .state
-            .tenants
-            .tenant_id_for_slug(&self.state.config.default_tenant_slug)
-            .map_err(|err| anyhow!("default tenant not found: {:?}", err))?;
+        let tenant_id = self.ensure_default_tenant().await?;
        self.with_conn(move |conn| {
-            let password_hash = hash_password(&password)?;
            let user = NewUser {
                id: Uuid::new_v4(),
                username,
-                password_hash,
            };
-            diesel::insert_into(backend::schema::users::table)
+            diesel::insert_into(papercrate::schema::users::table)
                .values(&user)
                .execute(conn)
                .context("failed to insert user")?;
@@ -223,10 +234,9 @@ impl TestApp {
                id: Uuid::new_v4(),
                user_id: user.id,
                tenant_id,
-                role,
            };

-            diesel::insert_into(backend::schema::user_memberships::table)
+            diesel::insert_into(papercrate::schema::user_memberships::table)
                .values(&membership)
                .execute(conn)
                .context("failed to insert user membership")?;
@@ -235,14 +245,42 @@ impl TestApp {
        .await
    }

+    pub async fn insert_passkey(&self, user_id: Uuid, nickname: Option<&str>) -> Result<Uuid> {
+        let passkey_id = Uuid::new_v4();
+        let nickname = nickname.map(|value| value.to_string());
+        self.with_conn(move |conn| {
+            let credential_id = passkey_id.as_bytes().to_vec();
+            let public_key = passkey_id.as_bytes().iter().copied().collect::<Vec<u8>>();
+            let passkey = NewUserPasskey {
+                id: passkey_id,
+                user_id,
+                credential_id,
+                public_key,
+                credential: json!({ "dummy": passkey_id.to_string() }),
+                sign_count: 0,
+                transports: vec![Some("usb".to_string())],
+                aaguid: None,
+                nickname,
+            };
+
+            diesel::insert_into(papercrate::schema::user_passkeys::table)
+                .values(&passkey)
+                .execute(conn)
+                .context("failed to insert passkey")?;
+
+            Ok(passkey_id)
+        })
+        .await
+    }
+
    async fn ensure_default_tenant(&self) -> Result<Uuid> {
-        let slug_value = self.state.config.default_tenant_slug.clone();
+        let name_value = TEST_TENANT_NAME.to_string();
        let quickwit_enabled = self.state.config.quickwit_endpoint.is_some();
        self.with_conn(move |conn| {
-            use backend::schema::tenants::dsl as tenants_dsl;
+            use papercrate::schema::tenants::dsl as tenants_dsl;

            let existing = tenants_dsl::tenants
-                .filter(tenants_dsl::slug.eq(&slug_value))
+                .filter(tenants_dsl::name.eq(&name_value))
                .first::<Tenant>(conn)
                .optional()
                .context("failed to load default tenant")?;
@@ -274,9 +312,10 @@ impl TestApp {
                diesel::insert_into(tenants_dsl::tenants)
                    .values((
                        tenants_dsl::id.eq(new_id),
-                        tenants_dsl::slug.eq(&slug_value),
+                        tenants_dsl::name.eq(&name_value),
                        tenants_dsl::storage_root.eq(Some(root)),
                        tenants_dsl::quickwit_index.eq(quickwit_value),
+                        tenants_dsl::status.eq(TenantStatus::Active),
                    ))
                    .execute(conn)
                    .context("failed to insert default tenant")?;
@@ -289,86 +328,65 @@ impl TestApp {
        .await
    }

-    pub async fn login_token(&self, username: &str, password: &str) -> Result<String> {
-        #[derive(Serialize)]
-        struct LoginPayload<'a> {
-            username: &'a str,
-            password: &'a str,
-        }
+    pub async fn login_token(&self, username: &str, _password: &str) -> Result<String> {
+        let (access_token, _, _) = self.create_session(username).await?;
+        Ok(access_token)
+    }

-        let response = self
-            .post_json(
-                "/api/auth/login",
-                &LoginPayload { username, password },
-                None,
-            )
-            .await?;
+    pub async fn create_session(&self, username: &str) -> Result<(String, String, Uuid)> {
+        let username = username.to_string();
+        let state = self.state.clone();
+        self.with_conn(move |conn| {
+            use papercrate::schema::tenants::dsl as tenants_dsl;
+            use papercrate::schema::user_memberships::dsl as memberships_dsl;
+            use papercrate::schema::users::dsl as users_dsl;

-        ensure!(
-            response.status() == StatusCode::OK,
-            "login failed with status {}",
-            response.status()
-        );
+            let user: User = users_dsl::users
+                .filter(users_dsl::username.eq(&username))
+                .first(conn)?;

-        let body = body_to_vec(response.into_body()).await?;
-        #[derive(Deserialize)]
-        struct LoginResponse {
-            access_token: String,
-        }
+            let membership: UserMembership = memberships_dsl::user_memberships
+                .filter(memberships_dsl::user_id.eq(user.id))
+                .first(conn)?;

-        if let Ok(parsed) = serde_json::from_slice::<LoginResponse>(&body) {
-            return Ok(parsed.access_token);
-        }
+            let tenant: Tenant = tenants_dsl::tenants
+                .find(membership.tenant_id)
+                .first(conn)?;

-        #[derive(Deserialize)]
-        struct TenantSummary {
-            tenant_id: Uuid,
-            _slug: String,
-        }
+            let now = Utc::now();
+            let access_token = state
+                .jwt
+                .generate_token(user.id, tenant.id, &user.username)
+                .map_err(|err| anyhow!(err))?;

-        #[derive(Deserialize)]
-        struct TenantSelectionResponse {
-            selection_token: String,
-            tenants: Vec<TenantSummary>,
-        }
+            let session_value = generate_session_token();
+            let session_hash = hash_session_token(&session_value);
+            let refresh_expires_at =
+                now + ChronoDuration::days(state.config.refresh_token_expiry_days);

-        let selection: TenantSelectionResponse = serde_json::from_slice(&body)?;
-        ensure!(
-            !selection.tenants.is_empty(),
-            "login returned no tenant options",
-        );
+            let new_session = NewUserSession {
+                id: Uuid::new_v4(),
+                user_id: user.id,
+                token_hash: session_hash,
+                issued_at: now.naive_utc(),
+                expires_at: refresh_expires_at.naive_utc(),
+                tenant_id: tenant.id,
+            };

-        #[derive(Serialize)]
-        struct SelectTenantPayload {
-            tenant_id: Uuid,
-        }
+            diesel::insert_into(session_dsl::user_sessions)
+                .values(&new_session)
+                .execute(conn)?;

-        let target_tenant = selection.tenants[0].tenant_id;
-        let select_response = self
-            .post_json(
-                "/api/auth/select-tenant",
-                &SelectTenantPayload {
-                    tenant_id: target_tenant,
-                },
-                Some(&selection.selection_token),
-            )
-            .await?;
-
-        ensure!(
-            select_response.status() == StatusCode::OK,
-            "tenant selection failed with status {}",
-            select_response.status()
-        );
-
-        let select_body = body_to_vec(select_response.into_body()).await?;
-        let parsed: LoginResponse = serde_json::from_slice(&select_body)?;
-        Ok(parsed.access_token)
+            let cookie = format!("refresh_token={session_value}");
+            Ok((access_token, cookie, tenant.id))
+        })
+        .await
    }

    #[allow(dead_code)]
    pub async fn clear_jobs(&self) -> Result<()> {
        self.with_conn(|conn| {
-            use backend::schema::jobs::dsl::jobs as jobs_table;
+            use papercrate::schema::jobs::dsl::jobs as jobs_table;
            diesel::delete(jobs_table)
                .execute(conn)
                .context("failed to clear jobs")?;
@@ -381,7 +399,7 @@ impl TestApp {
    pub async fn jobs_by_type(&self, ty: &str) -> Result<Vec<Job>> {
        let ty = ty.to_string();
        self.with_conn(move |conn| {
-            use backend::schema::jobs::dsl::{job_type as job_type_col, jobs as jobs_table};
+            use papercrate::schema::jobs::dsl::{job_type as job_type_col, jobs as jobs_table};
            let rows = jobs_table
                .filter(job_type_col.eq(&ty))
                .load::<Job>(conn)
@@ -396,6 +414,16 @@ impl TestApp {
        path: &str,
        payload: &T,
        token: Option<&str>,
+    ) -> Result<hyper::Response<Body>> {
+        self.post_json_with_cookie(path, payload, token, None).await
+    }
+
+    pub async fn post_json_with_cookie<T: Serialize + ?Sized>(
+        &self,
+        path: &str,
+        payload: &T,
+        token: Option<&str>,
+        cookie: Option<&str>,
    ) -> Result<hyper::Response<Body>> {
        let body = serde_json::to_vec(payload)?;
        let mut builder = Request::builder()
@@ -405,6 +433,9 @@ impl TestApp {
        if let Some(token) = token {
            builder = builder.header("authorization", format!("Bearer {token}"));
        }
+        if let Some(cookie) = cookie {
+            builder = builder.header(header::COOKIE, cookie);
+        }
        let request = builder.body(Body::from(body))?;
        Ok(self
            .router
@@ -479,14 +510,14 @@ impl TestApp {
        folder_id: Option<Uuid>,
        token: &str,
    ) -> Result<hyper::Response<Body>> {
-        self.upload_document_with_options(
+        let extras = UploadExtras::empty();
+        self.upload_document_with_extras(
            path,
            filename,
            content_type,
            data,
            folder_id,
-            None,
-            None,
+            extras,
            token,
        )
        .await
@@ -502,6 +533,36 @@ impl TestApp {
        title: Option<&str>,
        metadata_json: Option<&str>,
        token: &str,
+    ) -> Result<hyper::Response<Body>> {
+        let extras = UploadExtras {
+            title,
+            metadata_json,
+            tag_ids_json: None,
+            correspondents_json: None,
+            issued_at: None,
+            skip_existing: false,
+        };
+        self.upload_document_with_extras(
+            path,
+            filename,
+            content_type,
+            data,
+            folder_id,
+            extras,
+            token,
+        )
+        .await
+    }
+
+    pub async fn upload_document_with_extras(
+        &self,
+        path: &str,
+        filename: &str,
+        content_type: &str,
+        data: &[u8],
+        folder_id: Option<Uuid>,
+        extras: UploadExtras<'_>,
+        token: &str,
    ) -> Result<hyper::Response<Body>> {
        let boundary = format!("boundary-{}", Uuid::new_v4());
        let mut body = Vec::new();
@@ -524,20 +585,46 @@ impl TestApp {
            body.extend(b"\r\n");
        }

-        if let Some(title_value) = title {
+        if let Some(title_value) = extras.title {
            body.extend(format!("--{boundary}\r\n").as_bytes());
            body.extend(b"Content-Disposition: form-data; name=\"title\"\r\n\r\n");
            body.extend(title_value.as_bytes());
            body.extend(b"\r\n");
        }

-        if let Some(metadata_value) = metadata_json {
+        if let Some(metadata_value) = extras.metadata_json {
            body.extend(format!("--{boundary}\r\n").as_bytes());
            body.extend(b"Content-Disposition: form-data; name=\"metadata\"\r\n\r\n");
            body.extend(metadata_value.as_bytes());
            body.extend(b"\r\n");
        }

+        if let Some(tag_ids_value) = extras.tag_ids_json {
+            body.extend(format!("--{boundary}\r\n").as_bytes());
+            body.extend(b"Content-Disposition: form-data; name=\"tag_ids\"\r\n\r\n");
+            body.extend(tag_ids_value.as_bytes());
+            body.extend(b"\r\n");
+        }
+
+        if let Some(correspondents_value) = extras.correspondents_json {
+            body.extend(format!("--{boundary}\r\n").as_bytes());
+            body.extend(b"Content-Disposition: form-data; name=\"correspondents\"\r\n\r\n");
+            body.extend(correspondents_value.as_bytes());
+            body.extend(b"\r\n");
+        }
+
+        if let Some(issued_at_value) = extras.issued_at {
+            body.extend(format!("--{boundary}\r\n").as_bytes());
+            body.extend(b"Content-Disposition: form-data; name=\"issued_at\"\r\n\r\n");
+            body.extend(issued_at_value.as_bytes());
+            body.extend(b"\r\n");
+        }
+
+        if extras.skip_existing {
+            body.extend(format!("--{boundary}\r\n").as_bytes());
+            body.extend(b"Content-Disposition: form-data; name=\"skip_existing\"\r\n\r\ntrue\r\n");
+        }
+
        body.extend(format!("--{boundary}--\r\n").as_bytes());

        let builder = Request::builder()
@@ -558,7 +645,7 @@ impl TestApp {
            .expect("infallible response"))
    }

-    async fn with_conn<F, T>(&self, f: F) -> Result<T>
+    pub async fn with_conn<F, T>(&self, f: F) -> Result<T>
    where
        F: FnOnce(&mut PgConnection) -> Result<T> + Send + 'static,
        T: Send + 'static,
@@ -575,6 +662,28 @@ impl TestApp {
    }
 }

+pub struct UploadExtras<'a> {
+    pub title: Option<&'a str>,
+    pub metadata_json: Option<&'a str>,
+    pub tag_ids_json: Option<&'a str>,
+    pub correspondents_json: Option<&'a str>,
+    pub issued_at: Option<&'a str>,
+    pub skip_existing: bool,
+}
+
+impl<'a> UploadExtras<'a> {
+    pub fn empty() -> Self {
+        Self {
+            title: None,
+            metadata_json: None,
+            tag_ids_json: None,
+            correspondents_json: None,
+            issued_at: None,
+            skip_existing: false,
+        }
+    }
+}
+
 pub async fn acquire_db_lock() -> tokio::sync::MutexGuard<'static, ()> {
    DB_LOCK.lock().await
 }
@@ -587,12 +696,76 @@ pub async fn body_to_vec(body: Body) -> Result<Vec<u8>> {
    Ok(collected.to_bytes().to_vec())
 }

+#[cfg(test)]
+mod helper_tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn create_session_and_login_token_provide_access() -> Result<()> {
+        let _lock = acquire_db_lock().await;
+        let app = TestApp::new().await?;
+
+        let username = "helper-login";
+        let password = "irrelevant";
+        app.insert_user(username, password, "admin").await?;
+
+        let (access, refresh, refresh_id) = app.create_session(username).await?;
+        assert!(!access.is_empty(), "access token should not be empty");
+        assert!(!refresh.is_empty(), "refresh token should not be empty");
+        assert_ne!(
+            refresh_id,
+            Uuid::nil(),
+            "refresh token id should be assigned"
+        );
+
+        let bearer = app.login_token(username, password).await?;
+        assert!(!bearer.is_empty(), "login_token must yield bearer");
+
+        app.cleanup().await?;
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn insert_passkey_and_upload_with_options_succeeds() -> Result<()> {
+        let _lock = acquire_db_lock().await;
+        let app = TestApp::new().await?;
+        let username = "helper-passkey";
+        let password = "unused";
+        let user_id = app.insert_user(username, password, "admin").await?;
+
+        let passkey_id = app.insert_passkey(user_id, Some("Laptop")).await?;
+        assert_ne!(passkey_id, Uuid::nil());
+
+        let bearer = app.login_token(username, password).await?;
+        let response = app
+            .upload_document_with_options(
+                "/api/documents",
+                "helper.txt",
+                "text/plain",
+                b"helper-content",
+                None,
+                Some("Helper Note"),
+                Some("{\"category\":\"note\"}"),
+                &bearer,
+            )
+            .await?;
+        assert!(response.status().is_success());
+
+        app.cleanup().await?;
+        Ok(())
+    }
+}
+
 async fn prepare_database(pool: &PgPool) -> Result<()> {
    let pool = pool.clone();
    tokio::task::spawn_blocking(move || -> Result<()> {
        let mut conn = pool
            .get()
            .map_err(|err| anyhow!("failed to acquire connection: {err}"))?;
+        conn.batch_execute(RESET_DATABASE_SQL)
+            .map_err(|err| anyhow!("failed to reset schema: {err}"))?;
+        conn.batch_execute("DROP TABLE IF EXISTS __diesel_schema_migrations;")
+            .map_err(|err| anyhow!("failed to drop diesel schema table: {err}"))?;
        conn.run_pending_migrations(MIGRATIONS)
            .map_err(|err| anyhow!("failed to run migrations: {err}"))?;
        truncate_all(&mut conn)?;
@@ -605,33 +778,38 @@ async fn prepare_database(pool: &PgPool) -> Result<()> {
 fn truncate_all(conn: &mut PgConnection) -> Result<()> {
    conn.batch_execute(
        "TRUNCATE TABLE \
-            document_asset_objects, \
-            document_assets, \
-            document_correspondents, \
-            correspondents, \
-            document_tags, \
-            document_versions, \
-            documents, \
-            folders, \
-            jobs, \
-            refresh_tokens, \
-            tags, \
-            user_memberships, \
-            users, \
-            tenants \
+            tenant.document_asset_objects, \
+            tenant.document_assets, \
+            tenant.document_correspondents, \
+            tenant.correspondents, \
+            tenant.document_tags, \
+            tenant.document_versions, \
+            tenant.documents, \
+            tenant.folders, \
+            shared.jobs, \
+            tenant.user_sessions, \
+            tenant.tags, \
+            tenant.api_tokens, \
+            shared.webauthn_challenges, \
+            shared.user_passkeys, \
+            tenant.user_memberships, \
+            shared.users, \
+            shared.magic_tokens, \
+            shared.tenants \
        RESTART IDENTITY CASCADE;",
    )
    .context("failed to truncate tables")?;
    Ok(())
 }

-fn hash_password(password: &str) -> Result<String> {
-    use argon2::password_hash::{PasswordHasher, SaltString};
-    use argon2::Argon2;
+fn generate_session_token() -> String {
+    let mut bytes = [0u8; 32];
+    OsRng.fill_bytes(&mut bytes);
+    hex::encode(bytes)
+}

-    let salt = SaltString::generate(&mut OsRng);
-    Ok(Argon2::default()
-        .hash_password(password.as_bytes(), &salt)
-        .map_err(|err| anyhow!("failed to hash password: {err}"))?
-        .to_string())
+fn hash_session_token(value: &str) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(value.as_bytes());
+    hex::encode(hasher.finalize())
 }
@@ -0,0 +1,277 @@
+mod common;
+
+use anyhow::Result;
+use common::{acquire_db_lock, body_to_vec, TestApp};
+use serde::Deserialize;
+use serde_json::json;
+use uuid::Uuid;
+
+#[derive(Deserialize)]
+struct DocumentDetail {
+    document: DocumentSummary,
+}
+
+#[derive(Deserialize)]
+struct DocumentSummary {
+    id: Uuid,
+    #[serde(rename = "title")]
+    _title: String,
+    #[serde(default)]
+    correspondents: Vec<DocumentCorrespondentSummary>,
+}
+
+#[derive(Deserialize)]
+struct DocumentCorrespondentSummary {
+    id: Uuid,
+    name: String,
+}
+
+#[derive(Deserialize)]
+struct CorrespondentSummary {
+    id: Uuid,
+}
+
+#[derive(Deserialize)]
+struct BulkCorrespondentResult {
+    assigned: usize,
+    removed: usize,
+}
+
+struct TestContext {
+    app: TestApp,
+    token: String,
+    document_ids: Vec<Uuid>,
+    sender_id: Uuid,
+    receiver_id: Uuid,
+}
+
+impl TestContext {
+    const SENDER_NAME: &'static str = "Acme Corp";
+    const RECEIVER_NAME: &'static str = "Bank Ltd";
+
+    async fn new(prefix: &str) -> Result<Self> {
+        let app = TestApp::new().await?;
+        let username = format!("{prefix}_user");
+        let password = format!("{prefix}_pw");
+        app.insert_user(&username, &password, "admin").await?;
+        let token = app.login_token(&username, &password).await?;
+
+        let first_id =
+            upload_document(&app, &token, &format!("{prefix}-one.txt"), b"letter one").await?;
+        let second_id =
+            upload_document(&app, &token, &format!("{prefix}-two.txt"), b"letter two").await?;
+        let sender_id = create_correspondent(&app, &token, Self::SENDER_NAME).await?;
+        let receiver_id = create_correspondent(&app, &token, Self::RECEIVER_NAME).await?;
+
+        Ok(Self {
+            app,
+            token,
+            document_ids: vec![first_id, second_id],
+            sender_id,
+            receiver_id,
+        })
+    }
+
+    async fn assign(&self, correspondent_ids: &[Uuid]) -> Result<BulkCorrespondentResult> {
+        self.assign_with_action(correspondent_ids, None).await
+    }
+
+    async fn assign_with_action(
+        &self,
+        correspondent_ids: &[Uuid],
+        action: Option<&str>,
+    ) -> Result<BulkCorrespondentResult> {
+        let assignments: Vec<_> = correspondent_ids
+            .iter()
+            .map(|id| json!({ "correspondent_id": id }))
+            .collect();
+
+        let mut payload = json!({
+            "document_ids": self.document_ids,
+            "assignments": assignments,
+        });
+
+        if let Some(action) = action {
+            if let Some(obj) = payload.as_object_mut() {
+                obj.insert("action".to_string(), json!(action));
+            }
+        }
+
+        let response = self
+            .app
+            .post_json(
+                "/api/documents/bulk/correspondents",
+                &payload,
+                Some(&self.token),
+            )
+            .await?;
+        assert!(response.status().is_success());
+        let body = body_to_vec(response.into_body()).await?;
+        Ok(serde_json::from_slice(&body)?)
+    }
+
+    async fn fetch_correspondents(
+        &self,
+        document_id: Uuid,
+    ) -> Result<Vec<DocumentCorrespondentSummary>> {
+        let detail = fetch_document_detail(&self.app, &self.token, document_id).await?;
+        Ok(detail.document.correspondents)
+    }
+
+    async fn create_correspondent(&self, name: &str) -> Result<Uuid> {
+        create_correspondent(&self.app, &self.token, name).await
+    }
+}
+
+#[tokio::test]
+async fn bulk_assign_correspondents_adds_new_links() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let context = TestContext::new("corresp_add").await?;
+
+    let result = context
+        .assign(&[context.sender_id, context.receiver_id])
+        .await?;
+    assert_eq!(result.assigned, 4);
+    assert_eq!(result.removed, 0);
+
+    for doc_id in &context.document_ids {
+        let correspondents = context.fetch_correspondents(*doc_id).await?;
+        let names: Vec<_> = correspondents
+            .iter()
+            .map(|entry| entry.name.as_str())
+            .collect();
+        assert!(names.contains(&TestContext::SENDER_NAME));
+        assert!(names.contains(&TestContext::RECEIVER_NAME));
+        let ids: Vec<_> = correspondents.iter().map(|entry| entry.id).collect();
+        assert!(ids.contains(&context.sender_id));
+        assert!(ids.contains(&context.receiver_id));
+    }
+
+    context.app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn bulk_assign_correspondents_is_idempotent() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let context = TestContext::new("corresp_idempotent").await?;
+
+    context
+        .assign(&[context.sender_id, context.receiver_id])
+        .await?;
+    let repeat = context
+        .assign(&[context.sender_id, context.receiver_id])
+        .await?;
+    assert_eq!(repeat.assigned, 0);
+    assert_eq!(repeat.removed, 0);
+
+    context.app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn bulk_remove_correspondents_detaches_links() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let context = TestContext::new("corresp_remove").await?;
+
+    context
+        .assign(&[context.sender_id, context.receiver_id])
+        .await?;
+    let removal = context
+        .assign_with_action(&[context.sender_id], Some("remove"))
+        .await?;
+    assert_eq!(removal.assigned, 0);
+    assert_eq!(removal.removed, 2);
+
+    for doc_id in &context.document_ids {
+        let correspondents = context.fetch_correspondents(*doc_id).await?;
+        assert_eq!(correspondents.len(), 1);
+        let entry = &correspondents[0];
+        assert_eq!(entry.id, context.receiver_id);
+        assert_eq!(entry.name, TestContext::RECEIVER_NAME);
+    }
+
+    context.app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn bulk_assign_correspondents_appends_new_entries() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let context = TestContext::new("corresp_append").await?;
+
+    context
+        .assign(&[context.sender_id, context.receiver_id])
+        .await?;
+    context
+        .assign_with_action(&[context.sender_id], Some("remove"))
+        .await?;
+
+    let charlie_name = "Charlie";
+    let charlie_id = context.create_correspondent(charlie_name).await?;
+    let add_result = context.assign(&[charlie_id]).await?;
+    assert_eq!(add_result.assigned, 2);
+    assert_eq!(add_result.removed, 0);
+
+    for doc_id in &context.document_ids {
+        let correspondents = context.fetch_correspondents(*doc_id).await?;
+        assert_eq!(correspondents.len(), 2);
+        let ids: Vec<_> = correspondents.iter().map(|entry| entry.id).collect();
+        assert!(ids.contains(&context.receiver_id));
+        assert!(ids.contains(&charlie_id));
+        let names: Vec<_> = correspondents
+            .iter()
+            .map(|entry| entry.name.as_str())
+            .collect();
+        assert!(names.contains(&TestContext::RECEIVER_NAME));
+        assert!(names.contains(&charlie_name));
+    }
+
+    context.app.cleanup().await?;
+    Ok(())
+}
+
+async fn upload_document(
+    app: &TestApp,
+    token: &str,
+    filename: &str,
+    contents: &[u8],
+) -> Result<Uuid> {
+    let response = app
+        .upload_document(
+            "/api/documents",
+            filename,
+            "text/plain",
+            contents,
+            None,
+            token,
+        )
+        .await?;
+    assert!(response.status().is_success());
+    let body = body_to_vec(response.into_body()).await?;
+    let detail: DocumentDetail = serde_json::from_slice(&body)?;
+    Ok(detail.document.id)
+}
+
+async fn create_correspondent(app: &TestApp, token: &str, name: &str) -> Result<Uuid> {
+    let response = app
+        .post_json("/api/correspondents", &json!({ "name": name }), Some(token))
+        .await?;
+    assert!(response.status().is_success());
+    let body = body_to_vec(response.into_body()).await?;
+    let summary: CorrespondentSummary = serde_json::from_slice(&body)?;
+    Ok(summary.id)
+}
+
+async fn fetch_document_detail(
+    app: &TestApp,
+    token: &str,
+    document_id: Uuid,
+) -> Result<DocumentDetail> {
+    let response = app
+        .get(&format!("/api/documents/{document_id}"), Some(token))
+        .await?;
+    assert!(response.status().is_success());
+    let body = body_to_vec(response.into_body()).await?;
+    Ok(serde_json::from_slice(&body)?)
+}
@@ -73,7 +73,7 @@ async fn folder_move_and_delete_flow() -> Result<()> {
            Some(&token),
        )
        .await?;
-    assert_eq!(folder_resp.status(), StatusCode::OK);
+    assert_eq!(folder_resp.status(), StatusCode::CREATED);
    let folder_body = body_to_vec(folder_resp.into_body()).await?;
    let folder: FolderResponse = serde_json::from_slice(&folder_body)?;

@@ -164,7 +164,7 @@ async fn update_folder_parent_to_root() -> Result<()> {
            Some(&token),
        )
        .await?;
-    assert_eq!(parent_resp.status(), StatusCode::OK);
+    assert_eq!(parent_resp.status(), StatusCode::CREATED);
    let parent_body = body_to_vec(parent_resp.into_body()).await?;
    let parent: FolderResponse = serde_json::from_slice(&parent_body)?;

@@ -179,7 +179,7 @@ async fn update_folder_parent_to_root() -> Result<()> {
            Some(&token),
        )
        .await?;
-    assert_eq!(child_resp.status(), StatusCode::OK);
+    assert_eq!(child_resp.status(), StatusCode::CREATED);
    let child_body = body_to_vec(child_resp.into_body()).await?;
    let child: FolderResponse = serde_json::from_slice(&child_body)?;

@@ -232,14 +232,14 @@ async fn ensure_path_creates_nested_folders() -> Result<()> {
    let first_resp = app
        .post_json("/api/folders/path", &base_path, Some(&token))
        .await?;
-    assert_eq!(first_resp.status(), StatusCode::OK);
+    assert!(first_resp.status().is_success());
    let first_body = body_to_vec(first_resp.into_body()).await?;
    let first_folder: FolderResponse = serde_json::from_slice(&first_body)?;

    let second_resp = app
        .post_json("/api/folders/path", &base_path, Some(&token))
        .await?;
-    assert_eq!(second_resp.status(), StatusCode::OK);
+    assert!(second_resp.status().is_success());
    let second_body = body_to_vec(second_resp.into_body()).await?;
    let second_folder: FolderResponse = serde_json::from_slice(&second_body)?;
    assert_eq!(second_folder.folder.id, first_folder.folder.id);
@@ -293,6 +293,118 @@ async fn ensure_path_creates_nested_folders() -> Result<()> {
    Ok(())
 }

+#[tokio::test]
+async fn create_folder_is_idempotent() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let password = "idempotent";
+    app.insert_user("folders-idem", password, "admin").await?;
+    let token = app.login_token("folders-idem", password).await?;
+
+    let payload = CreateFolder {
+        name: "Archive",
+        parent_id: None,
+    };
+
+    let first_resp = app
+        .post_json("/api/folders", &payload, Some(&token))
+        .await?;
+    assert_eq!(first_resp.status(), StatusCode::CREATED);
+    let first_body = body_to_vec(first_resp.into_body()).await?;
+    let first_folder: FolderResponse = serde_json::from_slice(&first_body)?;
+
+    let second_resp = app
+        .post_json("/api/folders", &payload, Some(&token))
+        .await?;
+    assert_eq!(second_resp.status(), StatusCode::OK);
+    let second_body = body_to_vec(second_resp.into_body()).await?;
+    let second_folder: FolderResponse = serde_json::from_slice(&second_body)?;
+
+    assert_eq!(first_folder.folder.id, second_folder.folder.id);
+
+    let root_contents = app.get("/api/folders/root/contents", Some(&token)).await?;
+    let root_body = body_to_vec(root_contents.into_body()).await?;
+    let root: FolderContents = serde_json::from_slice(&root_body)?;
+    let occurrences = root
+        .subfolders
+        .iter()
+        .filter(|folder| folder.id == first_folder.folder.id)
+        .count();
+    assert_eq!(occurrences, 1);
+
+    app.cleanup().await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn ensure_folder_path_is_idempotent() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let password = "pathpass";
+    app.insert_user("path-admin", password, "admin").await?;
+    let token = app.login_token("path-admin", password).await?;
+
+    let segments = ["500 Immobilien", "501 Kreuzweg 2", "501.01 Rechtliches"];
+    let payload = EnsureFolderPath {
+        parent_id: None,
+        segments: &segments,
+    };
+
+    let first_resp = app
+        .post_json("/api/folders/path", &payload, Some(&token))
+        .await?;
+    assert!(first_resp.status().is_success());
+    let first_body = body_to_vec(first_resp.into_body()).await?;
+    let first_folder: FolderResponse = serde_json::from_slice(&first_body)?;
+
+    let second_resp = app
+        .post_json("/api/folders/path", &payload, Some(&token))
+        .await?;
+    assert!(second_resp.status().is_success());
+    let second_body = body_to_vec(second_resp.into_body()).await?;
+    let second_folder: FolderResponse = serde_json::from_slice(&second_body)?;
+
+    assert_eq!(first_folder.folder.id, second_folder.folder.id);
+
+    // Verify intermediate folders are not duplicated
+    let root_contents = app.get("/api/folders/root/contents", Some(&token)).await?;
+    let root_body = body_to_vec(root_contents.into_body()).await?;
+    let root: FolderContents = serde_json::from_slice(&root_body)?;
+    let root_occurrences = root
+        .subfolders
+        .iter()
+        .filter(|folder| folder.name == segments[0])
+        .count();
+    assert_eq!(root_occurrences, 1);
+
+    let level_one = root
+        .subfolders
+        .iter()
+        .find(|folder| folder.name == segments[0])
+        .map(|folder| folder.id)
+        .expect("root segment not created");
+
+    let level_one_contents = app
+        .get(
+            &format!("/api/folders/{}/contents", level_one),
+            Some(&token),
+        )
+        .await?;
+    let level_one_body = body_to_vec(level_one_contents.into_body()).await?;
+    let level_one_folders: FolderContents = serde_json::from_slice(&level_one_body)?;
+    let level_one_occurrences = level_one_folders
+        .subfolders
+        .iter()
+        .filter(|folder| folder.name == segments[1])
+        .count();
+    assert_eq!(level_one_occurrences, 1);
+
+    app.cleanup().await?;
+    Ok(())
+}
+
 #[tokio::test]
 async fn folder_rename_updates_name_and_child_paths() -> Result<()> {
    let _lock = acquire_db_lock().await;
@@ -312,7 +424,7 @@ async fn folder_rename_updates_name_and_child_paths() -> Result<()> {
            Some(&token),
        )
        .await?;
-    assert_eq!(parent_resp.status(), StatusCode::OK);
+    assert_eq!(parent_resp.status(), StatusCode::CREATED);
    let parent_body = body_to_vec(parent_resp.into_body()).await?;
    let parent: FolderResponse = serde_json::from_slice(&parent_body)?;

@@ -326,7 +438,7 @@ async fn folder_rename_updates_name_and_child_paths() -> Result<()> {
            Some(&token),
        )
        .await?;
-    assert_eq!(child_resp.status(), StatusCode::OK);
+    assert_eq!(child_resp.status(), StatusCode::CREATED);
    let child_body = body_to_vec(child_resp.into_body()).await?;
    let child: FolderResponse = serde_json::from_slice(&child_body)?;

@@ -3,10 +3,22 @@ mod common;
 use anyhow::Result;
 use axum::http::StatusCode;
 use common::{acquire_db_lock, body_to_vec, TestApp};
+use diesel::prelude::*;
+use papercrate::models::{NewUser, NewUserMembership, Tag, TenantStatus};
+use papercrate::schema::{
+    tags::dsl as tags_dsl, tenants::dsl as tenants_dsl, user_memberships::dsl as memberships_dsl,
+    users::dsl as users_dsl,
+};
 use serde::Deserialize;
 use serde::Serialize;
 use uuid::Uuid;

+#[derive(Serialize)]
+struct CreateTagPayload<'a> {
+    label: &'a str,
+    color: Option<&'a str>,
+}
+
 #[derive(Deserialize)]
 struct DocumentDetail {
    document: DocumentInfo,
@@ -61,12 +73,6 @@ async fn tag_assignment_flow() -> Result<()> {
    let upload_body = body_to_vec(upload.into_body()).await?;
    let detail: DocumentDetail = serde_json::from_slice(&upload_body)?;

-    #[derive(Serialize)]
-    struct CreateTagPayload<'a> {
-        label: &'a str,
-        color: Option<&'a str>,
-    }
-
    let create_tag = app
        .post_json(
            "/api/tags",
@@ -172,3 +178,89 @@ async fn tag_assignment_flow() -> Result<()> {
    app.cleanup().await?;
    Ok(())
 }
+
+#[tokio::test]
+async fn tags_are_isolated_between_tenants() -> Result<()> {
+    let _lock = acquire_db_lock().await;
+    let app = TestApp::new().await?;
+
+    let password_a = "tenant-a";
+    app.insert_user("alice", password_a, "admin").await?;
+    let token_a = app.login_token("alice", password_a).await?;
+
+    let shared_label = "Shared Label";
+
+    let create_a = app
+        .post_json(
+            "/api/tags",
+            &CreateTagPayload {
+                label: shared_label,
+                color: Some("#123456"),
+            },
+            Some(&token_a),
+        )
+        .await?;
+    assert_eq!(create_a.status(), StatusCode::OK);
+
+    let tenant_b_id = Uuid::new_v4();
+    let user_b_id = Uuid::new_v4();
+    app.with_conn(move |conn| {
+        let storage_root = format!("test-tenants/{tenant_b_id}/");
+        diesel::insert_into(tenants_dsl::tenants)
+            .values((
+                tenants_dsl::id.eq(tenant_b_id),
+                tenants_dsl::name.eq("tenant-b"),
+                tenants_dsl::storage_root.eq(Some(storage_root)),
+                tenants_dsl::status.eq(TenantStatus::Active),
+            ))
+            .execute(conn)?;
+
+        let new_user = NewUser {
+            id: user_b_id,
+            username: "bob".to_string(),
+        };
+        diesel::insert_into(users_dsl::users)
+            .values(&new_user)
+            .execute(conn)?;
+
+        let membership = NewUserMembership {
+            id: Uuid::new_v4(),
+            user_id: user_b_id,
+            tenant_id: tenant_b_id,
+        };
+        diesel::insert_into(memberships_dsl::user_memberships)
+            .values(&membership)
+            .execute(conn)?;
+
+        Ok::<_, anyhow::Error>(())
+    })
+    .await?;
+
+    let token_b = app.login_token("bob", "").await?;
+
+    let create_b = app
+        .post_json(
+            "/api/tags",
+            &CreateTagPayload {
+                label: shared_label,
+                color: Some("#654321"),
+            },
+            Some(&token_b),
+        )
+        .await?;
+    assert_eq!(create_b.status(), StatusCode::OK);
+
+    app.with_conn(move |conn| {
+        let tags: Vec<Tag> = tags_dsl::tags
+            .filter(tags_dsl::label.eq(shared_label))
+            .order(tags_dsl::tenant_id.asc())
+            .load(conn)?;
+
+        assert_eq!(tags.len(), 2);
+        assert_ne!(tags[0].tenant_id, tags[1].tenant_id);
+        Ok::<_, anyhow::Error>(())
+    })
+    .await?;
+
+    Ok(())
+}
@@ -45,24 +45,11 @@ services:
      S3_BUCKET: documents
      JWT_SECRET: change-me-super-secret
      QUICKWIT_ENDPOINT: http://quickwit-test:7280
-      DEFAULT_TENANT_SLUG: admin
    entrypoint: []
    command: >
      /bin/sh -c "
        echo 'Running database migrations' &&
-        diesel migration run &&
-        echo 'Ensuring tenant admin exists' &&
-        if papercrate-admin list-tenants | grep -q '^admin '; then
-          echo 'tenant admin already exists';
-        else
-          papercrate-admin create-tenant admin;
-        fi &&
-        echo 'Ensuring demo user credentials' &&
-        (papercrate-admin create-user admin adminadmin || papercrate-admin set-password admin adminadmin) &&
-        echo 'Ensuring demo membership' &&
-        papercrate-admin add-user-to-tenant admin admin admin &&
-        echo 'Ensuring Quickwit index for admin tenant' &&
-        papercrate-admin quickwit-create-index admin
+        diesel migration run
      "
    user: root
    restart: "no"
@@ -1,30 +1,62 @@
+version: "3.9"
+
+x-app-env: &app-env
+  DATABASE_URL: postgres://papercrate_app_login:${APP_DATABASE_PASSWORD:-papercrate_app}@postgres:5432/papercrate
+  DATABASE_MAX_POOL_SIZE: ${DATABASE_MAX_POOL_SIZE:-8}
+  SERVER_HOST: 0.0.0.0
+  SERVER_PORT: 3000
+  WEBDAV_HOST: 0.0.0.0
+  WEBDAV_PORT: 3001
+  JWT_SECRET: ${JWT_SECRET:?JWT_SECRET must be set}
+  JWT_ISSUER: ${JWT_ISSUER:-papercrate}
+  JWT_AUDIENCE: ${JWT_AUDIENCE:-papercrate-clients}
+  JWT_EXPIRY_MINUTES: ${JWT_EXPIRY_MINUTES:-60}
+  DOWNLOAD_TOKEN_AUDIENCE: ${DOWNLOAD_TOKEN_AUDIENCE:-papercrate-download}
+  DOWNLOAD_TOKEN_EXPIRY_MINUTES: ${DOWNLOAD_TOKEN_EXPIRY_MINUTES:-60}
+  REFRESH_TOKEN_EXPIRY_DAYS: ${REFRESH_TOKEN_EXPIRY_DAYS:-30}
+  REFRESH_COOKIE_SECURE: ${REFRESH_COOKIE_SECURE:-false}
+  REFRESH_COOKIE_DOMAIN: ${REFRESH_COOKIE_DOMAIN:-}
+  CORS_ALLOWED_ORIGIN: ${CORS_ALLOWED_ORIGIN:-}
+  AWS_ENDPOINT_URL: http://minio:9000
+  AWS_ACCESS_KEY_ID: ${MINIO_ROOT_USER:-papercrate}
+  AWS_SECRET_ACCESS_KEY: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD must be set}
+  AWS_REGION: ${AWS_REGION:-us-east-1}
+  S3_BUCKET: ${S3_BUCKET:-documents}
+  QUICKWIT_ENDPOINT: http://quickwit:7280
+  QUICKWIT_INDEX: ${QUICKWIT_INDEX:-documents}
+  WORKER_MAX_DOCUMENT_BYTES: ${WORKER_MAX_DOCUMENT_BYTES:-209715200}
+  UPLOAD_BODY_LIMIT_BYTES: ${UPLOAD_BODY_LIMIT_BYTES:-134217728}
+  WEBAUTHN_RP_ID: ${WEBAUTHN_RP_ID:-papercrate.local}
+  WEBAUTHN_ORIGIN: ${WEBAUTHN_ORIGIN:-https://papercrate.local}
+  WEBAUTHN_RP_NAME: ${WEBAUTHN_RP_NAME:-Papercrate}
+  RUST_LOG: ${RUST_LOG:-info}
+
 services:
  postgres:
    image: postgres:16-alpine
+    restart: unless-stopped
    environment:
      POSTGRES_USER: papercrate
-      POSTGRES_PASSWORD: papercrate_dev
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}
      POSTGRES_DB: papercrate
-    ports:
-      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
-      - ./backend/migrations:/docker-entrypoint-initdb.d
+      - ./backend/postgres-init:/docker-entrypoint-initdb.d
    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U papercrate"]
-      interval: 5s
+      test: ["CMD-SHELL", "pg_isready -U papercrate -d papercrate"]
+      interval: 10s
      timeout: 5s
      retries: 5
+    ports:
+      - "${POSTGRES_PORT:-5432}:5432"

  minio:
    image: minio/minio:latest
    command: server /data --console-address ":9001"
+    restart: unless-stopped
    environment:
-      MINIO_ROOT_USER: minioadmin
-      MINIO_ROOT_PASSWORD: minioadmin
-    ports:
-      - "9000:9000"  # S3 API
-      - "9001:9001"  # Console
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-papercrate}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD must be set}
    volumes:
      - minio_data:/data
    healthcheck:
@@ -32,28 +64,35 @@ services:
      interval: 30s
      timeout: 20s
      retries: 3
+    ports:
+      - "${MINIO_API_PORT:-9000}:9000"
+      - "${MINIO_CONSOLE_PORT:-9001}:9001"

  createbuckets:
    image: minio/mc:latest
    depends_on:
      minio:
        condition: service_healthy
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-papercrate}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD must be set}
+      S3_BUCKET: ${S3_BUCKET:-documents}
    entrypoint: >
      /bin/sh -c "
-      /usr/bin/mc alias set myminio http://minio:9000 minioadmin minioadmin;
-      /usr/bin/mc mb myminio/documents --ignore-existing;
-      /usr/bin/mc anonymous set download myminio/documents;
-      exit 0;
+        set -e;
+        /usr/bin/mc alias set papercrate http://minio:9000 $${MINIO_ROOT_USER} $${MINIO_ROOT_PASSWORD};
+        /usr/bin/mc mb papercrate/$${S3_BUCKET} --ignore-existing;
+        exit 0;
      "
+    restart: "no"

  quickwit:
    image: quickwit/quickwit:0.8.2
    command: ["run"]
+    restart: unless-stopped
    environment:
      QW_ENABLE_API_AUTH: "false"
      QW_DATA_DIR: /quickwit/data
-    ports:
-      - "7280:7280"
    volumes:
      - quickwit_data:/quickwit/data
    healthcheck:
@@ -61,45 +100,80 @@ services:
      interval: 10s
      timeout: 5s
      retries: 5
+    ports:
+      - "${QUICKWIT_PORT:-7280}:7280"

-  admin-bootstrap:
+  backend:
    build:
      context: ./backend
+    image: papercrate/backend:latest
    depends_on:
      postgres:
        condition: service_healthy
+      minio:
+        condition: service_healthy
+      createbuckets:
+        condition: service_completed_successfully
      quickwit:
        condition: service_healthy
+      migrator:
+        condition: service_completed_successfully
    environment:
-      DATABASE_URL: postgres://papercrate:papercrate_dev@postgres:5432/papercrate
-      DATABASE_MAX_POOL_SIZE: 2
-      AWS_ENDPOINT_URL: http://minio:9000
-      AWS_ACCESS_KEY_ID: minioadmin
-      AWS_SECRET_ACCESS_KEY: minioadmin
-      AWS_REGION: us-east-1
-      S3_BUCKET: documents
-      JWT_SECRET: change-me-super-secret
-      QUICKWIT_ENDPOINT: http://quickwit:7280
-      DEFAULT_TENANT_SLUG: admin
-    entrypoint: []
-    command: >
-      /bin/sh -c "
-        echo 'Running database migrations' &&
-        diesel migration run &&
-        echo 'Ensuring tenant admin exists' &&
-        if papercrate-admin list-tenants | grep -q '^admin '; then
-          echo 'tenant admin already exists';
-        else
-          papercrate-admin create-tenant admin;
-        fi &&
-        echo 'Ensuring demo user credentials' &&
-        (papercrate-admin create-user admin adminadmin || papercrate-admin set-password admin adminadmin) &&
-        echo 'Ensuring demo membership' &&
-        papercrate-admin add-user-to-tenant admin admin admin &&
-        echo 'Ensuring Quickwit index for admin tenant' &&
-        papercrate-admin quickwit-create-index admin
-      "
-    user: root
+      <<: *app-env
+    ports:
+      - "${API_PORT:-3000}:3000"
+    healthcheck:
+      test: ["CMD", "curl", "-sf", "http://localhost:3000/api/health"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+
+  worker:
+    image: papercrate/backend:latest
+    depends_on:
+      backend:
+        condition: service_healthy
+    environment:
+      <<: *app-env
+    entrypoint: ["/usr/local/bin/papercrate-worker"]
+    restart: unless-stopped
+
+  webdav:
+    image: papercrate/backend:latest
+    depends_on:
+      backend:
+        condition: service_healthy
+    environment:
+      <<: *app-env
+    entrypoint: ["/usr/local/bin/papercrate-webdav"]
+    ports:
+      - "${WEBDAV_PORT:-3001}:3001"
+    restart: unless-stopped
+
+  frontend:
+    build:
+      context: ./frontend
+    image: papercrate/frontend:latest
+    environment:
+      API_PROXY_PASS: http://backend:3000
+    depends_on:
+      backend:
+        condition: service_healthy
+    ports:
+      - "${FRONTEND_PORT:-8080}:80"
+    restart: unless-stopped
+
+  migrator:
+    image: papercrate/backend:latest
+    depends_on:
+      postgres:
+        condition: service_healthy
+    environment:
+      <<: *app-env
+      DATABASE_URL: postgres://papercrate:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}@postgres:5432/papercrate
+    entrypoint: ["/usr/local/bin/diesel"]
+    command: ["migration", "run"]
    restart: "no"

 volumes:
@@ -0,0 +1,95 @@
+services:
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: papercrate
+      POSTGRES_PASSWORD: papercrate_dev
+      POSTGRES_DB: papercrate
+    ports:
+      - "5432:5432"
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+      - ./backend/postgres-init:/docker-entrypoint-initdb.d
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U papercrate"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  minio:
+    image: minio/minio:latest
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ROOT_USER: minioadmin
+      MINIO_ROOT_PASSWORD: minioadmin
+    ports:
+      - "9000:9000"  # S3 API
+      - "9001:9001"  # Console
+    volumes:
+      - minio_data:/data
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
+      interval: 30s
+      timeout: 20s
+      retries: 3
+
+  createbuckets:
+    image: minio/mc:latest
+    depends_on:
+      minio:
+        condition: service_healthy
+    entrypoint: >
+      /bin/sh -c "
+      /usr/bin/mc alias set myminio http://minio:9000 minioadmin minioadmin;
+      /usr/bin/mc mb myminio/documents --ignore-existing;
+      /usr/bin/mc anonymous set download myminio/documents;
+      exit 0;
+      "
+
+  quickwit:
+    image: quickwit/quickwit:0.8.2
+    command: ["run"]
+    environment:
+      QW_ENABLE_API_AUTH: "false"
+      QW_DATA_DIR: /quickwit/data
+    ports:
+      - "7280:7280"
+    volumes:
+      - quickwit_data:/quickwit/data
+    healthcheck:
+      test: ["CMD", "curl", "-sf", "http://127.0.0.1:7280/api/v1/version"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  admin-bootstrap:
+    build:
+      context: ./backend
+    depends_on:
+      postgres:
+        condition: service_healthy
+      quickwit:
+        condition: service_healthy
+    environment:
+      DATABASE_URL: postgres://papercrate:papercrate_dev@postgres:5432/papercrate
+      DATABASE_MAX_POOL_SIZE: 2
+      AWS_ENDPOINT_URL: http://minio:9000
+      AWS_ACCESS_KEY_ID: minioadmin
+      AWS_SECRET_ACCESS_KEY: minioadmin
+      AWS_REGION: us-east-1
+      S3_BUCKET: documents
+      JWT_SECRET: change-me-super-secret
+      QUICKWIT_ENDPOINT: http://quickwit:7280
+    entrypoint: []
+    command: >
+      /bin/sh -c "
+        echo 'Running database migrations' &&
+        diesel migration run
+      "
+    user: root
+    restart: "no"
+
+volumes:
+  postgres_data:
+  minio_data:
+  quickwit_data:
@@ -5,8 +5,8 @@ Unless noted otherwise, endpoints below require a valid `Authorization: Bearer <

 Authentication
 --------------
- POST /api/auth/login - Exchange username/password for an access token and refresh cookie (public).
- POST /api/auth/refresh - Rotate the refresh cookie and return a new access token (public, requires refresh cookie).
+- POST /api/auth/login - Exchange username/password for an access token and refresh cookie (public). Returns the active tenant as `{ tenant: { id, name } }`. When multiple tenants are available, the response contains an `access_token` (tenant-selector token) and tenant list instead.
+- POST /api/auth/refresh - Rotate the refresh cookie and return a new access token (public, requires refresh cookie). Response also includes the current tenant `{ tenant: { id, name } }`.
 - POST /api/auth/logout - Revoke the caller's refresh tokens and clear the cookie.
 - GET  /api/auth/me - Return the authenticated principal payload.

@@ -16,22 +16,24 @@ Health

 Documents
 ---------
- GET  /api/documents - List or search documents. Optional filters: `folder_id` (defaults to root when omitted), `include_deleted`, `include_descendants` (defaults to true when a `folder_id` is provided and no other override is supplied), `query` (Quickwit full-text), `tags` (comma-separated tag UUIDs), and `correspondents` (comma-separated correspondent UUIDs). Each entry includes tags, correspondent assignments, and current version info.
+- GET  /api/documents - List or search documents. Optional filters: `folder_id` (defaults to root when omitted), `include_descendants` (defaults to true unless explicitly set to `false` without filters), `status` (`active`, `deleted`, or `all`; defaults to `active`), `query` (Quickwit full-text), `tags` (comma-separated tag UUIDs), and `correspondents` (comma-separated correspondent UUIDs). Each entry includes tags, correspondent assignments, and current version info.
 - GET  /api/documents/check?checksum=<sha256> - Lightweight checksum preflight. Returns `exists=false` when no document with the supplied SHA-256 checksum is present; otherwise returns `exists=true` plus the current document metadata.
- POST /api/documents - Upload a document via multipart form-data. Required field: `file`. Optional fields: `title`, `folder_id`, JSON `metadata`, JSON array `tag_ids`, JSON array `correspondents` (each with `correspondent_id` and `role`), and `issued_at` (RFC3339). When `title` is supplied, the stored filename becomes `<title><original_extension>`. Include `skip_existing=true` to receive `204 No Content` instead of reusing a matching document.
+- POST /api/documents - Upload a document via multipart form-data. Required field: `file`. Optional fields: `title`, `folder_id`, JSON `metadata`, JSON array `tag_ids`, JSON array `correspondents` (each with `correspondent_id`), and `issued_at` (RFC3339). When `title` is supplied, the stored filename becomes `<title><original_extension>`. Include `skip_existing=true` to receive `204 No Content` instead of reusing a matching document.
 - POST /api/documents/bulk/move - Move multiple documents to a target folder.
 - POST /api/documents/bulk/tags - Add or remove tags across multiple documents.
- POST /api/documents/bulk/correspondents - Bulk correspondent actions. Default `action=add` replaces existing assignments for the provided roles before adding the supplied correspondents; `action=remove` drops the specified correspondent/role pairs.
+- POST /api/documents/bulk/correspondents - Bulk correspondent actions. Use `action=add` (default) to attach correspondents or `action=remove` to detach the provided correspondents.
 - POST /api/documents/bulk/reanalyze - Queue re-analysis jobs for selected documents.
 - GET  /api/documents/:id - Retrieve metadata and current version details for a document.
 - PATCH /api/documents/:id - Update document metadata (currently title).
 - DELETE /api/documents/:id - Soft-delete a document.
- GET  /api/documents/:id/download - Create a pre-signed download URL for the current version.
 - PATCH /api/documents/:id/folder - Move a document to another folder.
+- POST /api/documents/:id/restore - Restore a soft-deleted document. Optional body `{ "folder_id": <uuid> }` to send it to a specific folder; defaults to the original folder or root if missing.
+- GET  /api/documents/:id/versions - List version history for a document.
+- GET  /api/documents/:id/versions/:version_id - Fetch metadata and assets for a specific version.
 - POST /api/documents/:id/tags - Assign one or more tags to a document.
 - DELETE /api/documents/:id/tags/:tag_id - Remove a single tag from a document.
- POST /api/documents/:id/correspondents - Assign correspondents to roles (`assignments[]` with `correspondent_id` and `role`; optional `replace=true` overwrites existing assignments for those roles). Valid roles: `sender`, `receiver`, `other`.
- DELETE /api/documents/:id/correspondents/:correspondent_id - Remove a correspondent assignment (requires `role` query string).
+- POST /api/documents/:id/correspondents - Assign correspondents (`assignments[]` with `correspondent_id`; optional `replace=true` overwrites existing assignments).
+- DELETE /api/documents/:id/correspondents/:correspondent_id - Remove a correspondent assignment.

 Document Assets
 ---------------
@@ -62,7 +64,7 @@ Tags

 Correspondents
 --------------
- GET  /api/correspondents - List correspondents with usage totals and per-role counts (roles: `sender`, `receiver`, `other`).
+- GET  /api/correspondents - List correspondents with usage totals.
 - POST /api/correspondents - Create a correspondent (name + optional metadata JSON).
 - PATCH /api/correspondents/:id - Update name and/or metadata.
 - DELETE /api/correspondents/:id - Remove a correspondent; fails with 400 if referenced by any document.
@@ -0,0 +1,92 @@
+# Document Data Model
+
+This note describes the core persistence model for documents: the metadata held in
+`documents`, how versions are tracked, and the way auxiliary assets are stored.
+
+## documents
+
+Each row represents the logical document a user interacts with in the UI. Key
+fields:
+
+- `id (uuid)` – Stable identifier used in API paths.
+- `tenant_id (uuid)` – Multi-tenancy boundary; all joins filter by this.
+- `title (varchar)` – Display name editable via PATCH.
+- `filename / original_name (varchar)` – Current storage filename vs. the name
+  captured during upload.
+- `folder_id (uuid, nullable)` – Parent folder, `NULL` means root.
+- `metadata (jsonb)` – Arbitrary structured metadata (source import details,
+  custom fields, etc.).
+- `issued_at (timestamptz, nullable)` – User-provided timestamp for when the
+  document was issued (invoice date, etc.).
+- `current_version_id (uuid)` – FK pointing at the active `document_versions`
+  row; updated whenever a new version is promoted.
+- `deleted_at (timestamptz, nullable)` – Soft-delete marker; non-NULL rows are
+  treated as living in the trash.
+- `created_at / updated_at (timestamptz)` – Audit stamps; `updated_at` reflects
+  metadata or version changes.
+
+Other indexes enforce per-tenant uniqueness for `(folder, filename)` and support
+common queries (folder listing, trash filtering).
+
+## document_versions
+
+Every binary revision lives here. Fields of interest:
+
+- `document_id (uuid)` – Back-reference to the logical document.
+- `version_number (int)` – Monotonic per document (1, 2, …); enforced via
+  `UNIQUE(document_id, version_number)`.
+- `s3_key (varchar)` – Object storage path for the binary (used for download).
+- `size_bytes`, `checksum` – Stored metadata about the binary; checksum is a
+  hex-encoded SHA-256 hash used for dedupe/conflicts.
+- `metadata (jsonb)` – Small metadata blob specific to the version (extracted
+  text summary, processing hints, etc.).
+- `tenant_id (uuid)` – Mirrors the owning document’s tenant.
+
+The row referenced by `documents.current_version_id` is treated as the latest
+revision. Older versions remain queryable for download or audit.
+
+## Assets
+
+A document version can have zero or more derived artifacts (thumbnails, OCR
+output, previews). These are modelled via:
+
+- `document_assets`
+  - `document_version_id` – FK to the owning version.
+  - `asset_type (text)` – Logical type identifier (e.g. `thumbnail`, `ocr_text`).
+  - `mime_type (text)` – Media type for consumers.
+  - `metadata (jsonb)` – Asset-specific metadata (dimensions, page count, etc.).
+  - `cardinality (int, nullable)` – Optional hint for multi-object assets.
+  - `tenant_id (uuid)` – Tenant scoping.
+  - Uniqueness on `(document_version_id, asset_type)` ensures one logical asset
+    per type; multi-object cases are stored in `document_asset_objects`.
+
+- `document_asset_objects`
+  - `asset_id` – FK to `document_assets`.
+  - `ordinal (int)` – 1-based position for multi-part assets.
+  - `s3_key (text)` – Object storage key for the binary blob.
+  - `metadata (jsonb)` – Per-object metadata if needed (e.g. page number).
+
+Simple assets (single thumbnail) live solely in `document_assets`. Complex ones
+(e.g. per-page previews) use `document_asset_objects` to point at multiple S3
+objects under a single logical asset.
+
+## Related tables
+
+- `document_tags` and `document_correspondents` provide many-to-many
+  relationships for categorisation.
+- `jobs` records background work (OCR, thumbnails, indexing) keyed by tenant.
+- `api_tokens`, `user_sessions`, and `user_passkeys` live alongside but do
+  not alter the document schema directly.
+
+## Lifecycle summary
+
+1. Upload creates a `documents` row and an initial `document_versions` entry.
+2. Workers generate derived assets, inserting rows into `document_assets`
+   (and possibly `document_asset_objects`).
+3. When a new version is promoted, a fresh `document_versions` row is written
+   and `documents.current_version_id` is updated atomically.
+4. Soft-deleting the document sets `deleted_at`; restore clears it and the
+   document reappears in listings.
+
+This schema allows arbitrary metadata expansion while maintaining a clear
+separation between logical documents, their version history, and derived assets.
@@ -0,0 +1,56 @@
+# Bucket CORS for Presigned Asset Fetches
+
+The frontend loads certain assets (e.g. OCR text) with `fetch()` against their presigned URLs
+(see `frontend/src/preview/DocumentViewerPanel.jsx`). Browsers will block that request unless
+the storage bucket sends CORS headers that allow the frontend origin. Configure a rule that
+includes:
+
+* the list of allowed origins (your production, staging, or local domains)
+* `GET` (and optionally other methods you expose)
+* permissive request headers (usually `"*"` is fine for presigned URLs)
+* exposed response headers if the frontend needs them (`etag`, `content-length`, etc.)
+
+## Example CORS document
+
+```json
+{
+  "CORSRules": [
+    {
+      "AllowedOrigins": ["https://app.example"],
+      "AllowedMethods": ["GET"],
+      "AllowedHeaders": ["*"],
+      "ExposeHeaders": ["etag", "content-length", "content-type"],
+      "MaxAgeSeconds": 300
+    }
+  ]
+}
+```
+
+Replace `https://app.example` with each domain that must fetch presigned assets. Add additional
+rules if different origins require different methods.
+
+## Applying the rule
+
+### AWS S3 CLI
+```bash
+aws s3api put-bucket-cors \
+  --bucket <bucket-name> \
+  --cors-configuration file://cors.json \
+  [--endpoint-url <custom-endpoint>]
+```
+Save the JSON payload as `cors.json`. When targeting S3-compatible providers (e.g. Hetzner, Ceph RGW),
+pass their endpoint via `--endpoint-url`.
+
+### s3cmd (Ceph RGW / generic S3)
+```bash
+s3cmd setcors cors.json s3://<bucket-name>
+```
+
+### MinIO Client (`mc`)
+```bash
+mc alias set storage <endpoint> <access-key> <secret-key>
+mc anonymous set-json storage/<bucket-name> cors.json
+```
+
+Most dashboards expose a similar form—paste the JSON rule into the CORS section for the bucket.
+Once the rule is active, browsers will allow the frontend to read presigned assets with fetch().
@@ -0,0 +1,2 @@
+dist
+node_modules
@@ -0,0 +1,31 @@
+{
+  "env": {
+    "browser": true,
+    "es2021": true
+  },
+  "extends": [
+    "eslint:recommended",
+    "plugin:react/recommended",
+    "plugin:react-hooks/recommended"
+  ],
+  "parserOptions": {
+    "ecmaFeatures": {
+      "jsx": true
+    },
+    "ecmaVersion": "latest",
+    "sourceType": "module"
+  },
+  "settings": {
+    "react": {
+      "version": "detect"
+    }
+  },
+  "rules": {
+    "no-use-before-define": [
+      "error",
+      { "functions": false, "classes": true, "variables": true }
+    ],
+    "react/react-in-jsx-scope": "off",
+    "react/prop-types": "off"
+  }
+}
@@ -12,10 +12,9 @@ RUN npm run build
 FROM nginx:alpine
 WORKDIR /usr/share/nginx/html

-COPY nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=build /app/dist ./

-ENV API_BASE_URL=""
+ENV API_PROXY_PASS=""

 COPY docker-entrypoint.sh /docker-entrypoint.sh
 RUN chmod +x /docker-entrypoint.sh
@@ -39,7 +39,7 @@ npm run build
 - Drag-and-drop moves (documents between folders) and file uploads (window-wide or onto a folder)
 - Search box plus tag chips filter documents across the selected folder and all descendants
 - Tag management (create/assign/remove) from the detail panel
- Login via the seeded admin account (`admin` / `adminadmin`) with stored JWT session
+- Login with a WebAuthn passkey created through the signup flow (no baked-in demo account)
 - Inline status banner for quick feedback on API interactions

 ## Assets
@@ -1,11 +1,56 @@
 #!/bin/sh
 set -euo pipefail

-API_BASE_URL_TRIMMED="${API_BASE_URL:-}"
-API_BASE_URL_TRIMMED="${API_BASE_URL_TRIMMED%%/}"
+API_PROXY_PASS_TRIMMED="${API_PROXY_PASS:-}"
+API_PROXY_PASS_TRIMMED="${API_PROXY_PASS_TRIMMED%%/}"

-cat <<CONFIG > /usr/share/nginx/html/config.js
-window.__PAPERCRATE_API_BASE_URL = "${API_BASE_URL_TRIMMED}";
-CONFIG
+MAX_BODY_SIZE_RAW="${UPLOAD_BODY_LIMIT_BYTES:-}"
+if [ -n "$MAX_BODY_SIZE_RAW" ]; then
+    MAX_BODY_SIZE=$(printf '%sm' "$((MAX_BODY_SIZE_RAW / (1024 * 1024)))")
+else
+    MAX_BODY_SIZE="128m"
+fi
+
+cat <<BASE > /etc/nginx/conf.d/default.conf
+server {
+    listen 80;
+    server_name _;
+
+    client_max_body_size ${MAX_BODY_SIZE};
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    location / {
+        try_files \$uri /index.html;
+    }
+BASE
+
+if [ -n "$API_PROXY_PASS_TRIMMED" ]; then
+cat <<PROXY >> /etc/nginx/conf.d/default.conf
+
+    location /api/ {
+        client_max_body_size ${MAX_BODY_SIZE};
+        proxy_pass ${API_PROXY_PASS_TRIMMED};
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+
+    location /download/ {
+        client_max_body_size ${MAX_BODY_SIZE};
+        proxy_pass ${API_PROXY_PASS_TRIMMED};
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+PROXY
+fi
+
+cat <<'ENDCFG' >> /etc/nginx/conf.d/default.conf
+}
+ENDCFG

 exec "$@"
@@ -1,11 +0,0 @@
-server {
-    listen 80;
-    server_name _;
-
-    root /usr/share/nginx/html;
-    index index.html;
-
-    location / {
-        try_files $uri /index.html;
-    }
-}
@@ -6,9 +6,10 @@
  "scripts": {
    "dev": "webpack serve --mode development --open",
    "build": "webpack --mode production",
-    "lint": "echo \"No linting configured\""
+    "lint": "eslint src --ext .js,.jsx"
  },
  "dependencies": {
+    "@fontsource/inter": "^5.2.8",
    "@tabler/icons-react": "3.11.0",
    "axios": "1.7.7",
    "react": "18.3.1",
@@ -19,6 +20,10 @@
    "@babel/core": "7.26.0",
    "@babel/preset-env": "7.26.0",
    "@babel/preset-react": "7.26.3",
+    "eslint": "8.57.0",
+    "eslint-plugin-react": "7.37.1",
+    "eslint-plugin-react-hooks": "4.6.0",
+    "@svgr/webpack": "8.1.0",
    "babel-loader": "9.2.1",
    "css-loader": "7.1.2",
    "dotenv": "16.4.5",
@@ -26,7 +31,6 @@
    "style-loader": "4.0.0",
    "webpack": "5.95.0",
    "webpack-cli": "5.1.4",
-    "webpack-dev-server": "5.1.0",
-    "@svgr/webpack": "8.1.0"
+    "webpack-dev-server": "5.1.0"
  }
 }
@@ -1 +0,0 @@
-window.__PAPERCRATE_API_BASE_URL = window.__PAPERCRATE_API_BASE_URL || '';
@@ -0,0 +1,362 @@
+/* Desktop workspace styles */
+.desk-main {
+  flex: 1;
+  display: flex;
+  flex-direction: column;
+  min-height: 0;
+}
+
+.desk-item {
+  position: absolute;
+  display: block;
+  width: auto;
+  cursor: grab;
+  touch-action: none;
+  transform-origin: center center;
+  transition: box-shadow 0.16s ease;
+  outline: none;
+  will-change: transform;
+}
+
+.desk-shell {
+  flex: 1;
+  display: flex;
+  flex-direction: column;
+  grid-column: 2 / -1;
+  min-height: 0;
+  position: relative;
+}
+
+.desk-canvas {
+  flex: 1;
+  position: relative;
+  overflow: hidden;
+  margin: 0;
+}
+
+.desk-empty {
+  height: 100%;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 3rem;
+  text-align: center;
+  color: var(--muted);
+  font-size: 0.95rem;
+}
+
+
+
+.desk-item__body {
+  flex-grow: 1;
+  width: 100%;
+  height: 100%;
+}
+
+.desk-item:focus-visible {
+  outline: 2px solid var(--accent);
+  outline-offset: 4px;
+}
+
+.desk-item.is-dragging {
+  cursor: grabbing;
+  transition: none;
+}
+
+.desk-item.is-tag-target .desk-item__card {
+  outline: 0.35rem dashed var(--accent);
+  outline-offset: 0.35rem;
+}
+
+.desk-item.is-tag-pending .desk-item__card {
+  outline: 0.25rem solid var(--accent-outline);
+  outline-offset: 0.25rem;
+}
+
+.desk-item.is-filtered-out {
+  opacity: 0.12;
+  pointer-events: none;
+  filter: blur(15px) grayscale(100%);
+  transition: opacity 0.6s ease, filter 0.28s ease;
+  z-index: 0 !important;
+}
+
+.desk-item.is-selected {
+  z-index: 5;
+}
+
+.desk-item.is-selected .desk-item__card {
+  box-shadow:
+    0 0 0 0.18rem color-mix(in oklch, var(--accent) 45%, transparent),
+    0 0 0.35rem 0 color-mix(in oklch, var(--accent) 28%, transparent),
+    0 12px 28px -14px color-mix(in oklch, var(--accent) 20%, transparent),
+    0 10px 24px var(--shadow-medium);
+}
+
+.desk-item.is-selected .desk-item__title {
+  color: var(--accent);
+}
+
+.desk-item__tags {
+  --tag-scale: 1;
+  position: absolute;
+  top: 0;
+  right: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 0.35rem;
+  align-items: flex-end;
+  transform-origin: top right;
+  transform: scale(var(--tag-scale)) translate(-0.5em, 0.5em);
+  transition: transform 0.28s ease;
+}
+
+
+.tag-chip--draggable {
+  user-select: none;
+  pointer-events: auto;
+  cursor: grab;
+  transition: transform 0.16s ease, opacity 0.2s ease, box-shadow 0.2s ease;
+  box-shadow: 2px 2px 4px var(--shadow-medium);
+}
+
+.desk-help-overlay {
+  position: fixed;
+  inset: 0;
+  z-index: 1400;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: clamp(1.5rem, 4vw, 3rem);
+  pointer-events: none;
+}
+
+.desk-help-overlay__backdrop {
+  position: absolute;
+  inset: 0;
+  background: var(--surface-overlay);
+  backdrop-filter: blur(8px);
+  pointer-events: auto;
+}
+
+.desk-help-overlay__content {
+  position: relative;
+  width: min(640px, 92vw);
+  max-height: min(80vh, 640px);
+  background: var(--surface);
+  border: 1px solid var(--border);
+  box-shadow: 0 24px 64px var(--shadow-strong);
+  border-radius: 1.25rem;
+  display: flex;
+  flex-direction: column;
+  pointer-events: auto;
+  overflow: hidden;
+}
+
+.desk-help-overlay__header,
+.desk-help-overlay__footer {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 1rem 1.25rem;
+}
+
+.desk-help-overlay__header {
+  border-bottom: 1px solid var(--border);
+}
+
+.desk-help-overlay__header h2 {
+  margin: 0;
+  font-size: 1.15rem;
+  font-weight: 600;
+}
+
+.desk-help-overlay__body {
+  padding: 1rem 1.25rem 1.5rem;
+  overflow-y: auto;
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+  line-height: 1.55;
+}
+
+.desk-help-overlay__body p {
+  margin: 0;
+  color: var(--muted);
+}
+
+.desk-help-overlay__list {
+  margin: 0;
+  padding-left: 1.1rem;
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+}
+
+.desk-help-overlay__list li {
+  color: var(--fg);
+}
+
+.desk-help-overlay__body kbd {
+  display: inline-block;
+  padding: 0.15rem 0.4rem;
+  border-radius: 0.4rem;
+  border: 1px solid var(--border-strong);
+  background: var(--surface-subtle);
+  font-size: 0.85em;
+  line-height: 1;
+  font-family: inherit;
+}
+
+.desk-help-overlay__footer {
+  border-top: 1px solid var(--border);
+  justify-content: flex-end;
+  gap: 0.5rem;
+}
+
+.tag-chip--draggable:active {
+  cursor: grabbing;
+}
+
+.tag-chip--draggable.is-drag-hidden {
+  opacity: 0.4;
+  pointer-events: none;
+}
+
+.desk-item__tags .tag-chip {
+  font-size: 0.85rem;
+  padding: 0.18rem 0.55rem;
+  gap: 0.3rem;
+}
+
+
+.desk-card__nav {
+  position: absolute;
+  bottom: 1.8rem;
+  left: 50%;
+  transform: translateX(-50%);
+  transform-origin: center;
+  display: flex;
+  gap: 1.5rem;
+  opacity: 0;
+  pointer-events: none;
+  transition: opacity 0.2s ease;
+}
+
+.desk-item__card:hover .desk-card__nav {
+  opacity: 1;
+  pointer-events: auto;
+}
+
+.desk-card__nav-button {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 2.4em;
+  height: 2.4em;
+  padding: 0.25em;
+  border-radius: 50%;
+  border: none;
+  background: var(--preview-nav-bg);
+  color: var(--preview-nav-fg);
+  cursor: pointer;
+  transition: background 0.15s ease, opacity 0.15s ease;
+}
+
+.desk-card__nav-button:hover:not([disabled]) {
+  background: var(--preview-nav-bg-hover);
+}
+
+.desk-card__nav-button:disabled {
+  opacity: 0.4;
+  cursor: default;
+}
+
+.desk-card__nav-button:focus-visible {
+  outline: 2px solid var(--accent);
+  outline-offset: 2px;
+}
+
+.desk-card__nav-button svg {
+  width: 100%;
+  height: 100%;
+}
+
+.desk-item__tags .tag-chip--tear-pending {
+  opacity: 0.35;
+}
+
+body.desk-cursor-remove,
+body.desk-cursor-remove * {
+  cursor: not-allowed !important;
+}
+
+.desk-item__shadow {
+  display: none;
+}
+
+.desk-item__card {
+  position: relative;
+  border-radius: 0;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 100%;
+  height: 100%;
+  box-shadow: 0 12px 32px var(--shadow-medium);
+  overflow: hidden;
+}
+
+.desk-item__card img {
+  width: 100%;
+  height: 100%;
+  object-fit: contain;
+  display: block;
+  pointer-events: none;
+  user-select: none;
+  -webkit-user-drag: none;
+}
+
+.desk-item__card--empty {
+  box-shadow: 0 12px 32px var(--shadow-medium);
+  background:
+    radial-gradient(circle at 42% 38%, color-mix(in oklch, var(--surface-subtle) 75%, var(--selection) 25%), color-mix(in oklch, var(--surface-subtle) 85%, var(--selection) 15%) 70%),
+    linear-gradient(135deg, color-mix(in oklch, var(--surface-subtle) 88%, var(--selection-soft) 12%) 0%, color-mix(in oklch, var(--surface-subtle) 65%, var(--shadow-faint) 35%) 100%);
+  width: 100%;
+  height: 100%;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: 0.5rem;
+}
+
+.desk-item__placeholder {
+  font-size: 0.95rem;
+  font-weight: 500;
+  letter-spacing: normal;
+  color: var(--muted);
+}
+
+.desk-item__empty {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  width: 100%;
+  height: 100%;
+  gap: 0.5rem;
+  padding: 1rem;
+  text-align: center;
+}
+
+.desk-item__title {
+  font-size: 0.95rem;
+  font-weight: 500;
+  color: var(--fg);
+  max-width: 90%;
+  overflow: hidden;
+  overflow-wrap: anywhere;
+  word-break: break-word;
+  white-space: normal;
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
nils	4ec19dbd70	fix ci / docker (frontend, frontend/Dockerfile, frontend) (push) Failing after 15m41s Details ci / docker (backend, backend/Dockerfile, backend) (push) Failing after 15m46s Details	2025-11-02 15:56:12 +01:00
nils	f8ab674b84	spacebar	2025-11-02 15:44:09 +01:00
nils	866a31b89d	persistence	2025-11-02 15:34:26 +01:00
nils	4f296ac1e3	fix	2025-11-02 15:20:41 +01:00
nils	d6a6d1233c	various	2025-11-02 15:03:23 +01:00
nils	8f86a71c39	fix	2025-11-02 14:27:13 +01:00
nils	1cddc3c373	fix	2025-11-02 14:20:11 +01:00
nils	bd2669af4d	viewer	2025-11-02 14:12:40 +01:00
nils	65495a07b2	fix	2025-11-02 14:08:08 +01:00
nils	a30b6eaa02	backend 409 on document conflict	2025-11-02 13:22:16 +01:00
nils	9ddaa59155	desktop selection	2025-11-02 13:12:36 +01:00
nils	5bf64fc5f3	icons	2025-11-02 12:22:02 +01:00
nils	824db2087c	dbltap	2025-11-02 12:17:32 +01:00
nils	1135873968	ui	2025-11-02 12:12:11 +01:00
nils	e7e7881772	playful	2025-11-02 04:40:07 +01:00
nils	f7b274c1ec	cors	2025-11-02 02:57:02 +01:00
nils	b561f46d2c	content disposition	2025-11-02 02:26:40 +01:00
nils	b9c95437d2	details	2025-11-02 02:05:05 +01:00
nils	7d8595b63f	rename	2025-11-02 01:18:24 +01:00
nils	32d627fd6d	fix	2025-11-02 00:42:47 +01:00
nils	09430c6f40	refactor	2025-11-02 00:35:32 +01:00
nils	49998fa23d	DocumentsPanel	2025-11-02 00:23:25 +01:00
nils	14077d26d7	style	2025-11-01 23:50:30 +01:00
nils	40832ff1c3	styling	2025-11-01 23:49:04 +01:00
nils	0b8f856876	folder-selection	2025-11-01 23:37:12 +01:00
nils	16ac16cd30	ui	2025-11-01 22:49:50 +01:00
nils	326a6042ec	api-tokens	2025-11-01 22:46:04 +01:00
nils	8efe2d19ba	user_sessions	2025-11-01 22:45:46 +01:00
nils	1c5b920e13	gitea-workflow	2025-11-01 21:43:32 +01:00
nils	00f5d3adea	api-tokens	2025-11-01 21:42:52 +01:00
nils	f6ceff5444	selection	2025-11-01 20:28:00 +01:00
nils	9559a1b5e2	fix	2025-11-01 19:59:39 +01:00
nils	e752361f39	sidebar	2025-11-01 19:50:29 +01:00
nils	41c9ae30e9	fix	2025-11-01 19:45:16 +01:00
nils	03bc311403	detailpanel	2025-11-01 19:39:51 +01:00
nils	366f716b1c	more screenshots	2025-11-01 15:13:47 +01:00
nils	3731fe8e40	clean	2025-11-01 15:01:35 +01:00
nils	3c416600a6	screenshot	2025-11-01 14:57:37 +01:00
nils	6f6ee59461	fix	2025-11-01 13:59:46 +01:00
nils	9aed7ec524	fix	2025-11-01 13:51:43 +01:00
nils	816c880e8e	cleanup	2025-11-01 13:40:10 +01:00
nils	816910ca40	fix	2025-11-01 04:29:08 +01:00
nils	6eb3f8a3d9	detailpanel	2025-11-01 04:22:51 +01:00
nils	303ece0529	detailpanel	2025-11-01 04:16:31 +01:00
nils	fd13edae6d	build ci / docker (frontend, frontend/Dockerfile, frontend) (push) Successful in 16m11s Details ci / docker (backend, backend/Dockerfile, backend) (push) Successful in 16m16s Details	2025-11-01 02:52:04 +01:00
nils	09492f452f	Revert "build" This reverts commit `b6bc5391cf`.	2025-11-01 02:07:58 +01:00
nils	b6bc5391cf	build	2025-11-01 02:00:16 +01:00
nils	ac91efc421	foo	2025-11-01 01:46:14 +01:00
nils	2fba3236ad	Add GHCR build/publish workflow	2025-11-01 00:34:51 +01:00
nils	18352caabe	webdav token regeneration	2025-10-31 20:37:07 +01:00
nils	e9731ec691	webdav fix	2025-10-31 20:10:42 +01:00
nils	175387f0d3	rls	2025-10-31 19:13:11 +01:00
nils	2d8a4432cc	style	2025-10-31 18:19:52 +01:00
nils	c146084f75	fix	2025-10-31 17:44:33 +01:00
nils	1fcd265eb9	breadcrumbs	2025-10-31 17:43:00 +01:00
nils	1a1e9a80c3	breadcrumbs	2025-10-31 17:24:39 +01:00
nils	d14d263e8f	health	2025-10-31 15:55:55 +01:00
nils	48bed9a9fe	magic token login	2025-10-31 15:16:30 +01:00
nils	91dd3289a9	deskview	2025-10-31 14:27:30 +01:00
nils	b969cae524	screenshot	2025-10-31 13:52:48 +01:00
nils	aaf9fd1bce	fix	2025-10-31 13:44:26 +01:00
nils	b254c651a7	fixes	2025-10-31 13:39:06 +01:00
nils	3af656b09f	modalheader	2025-10-31 13:19:39 +01:00
nils	321b0d84ae	panelheader	2025-10-31 13:12:09 +01:00
nils	6b4a4af5f1	fix	2025-10-31 12:56:17 +01:00
nils	faf8fec9c7	revert document types	2025-10-31 12:56:09 +01:00
nils	0a87f33d89	style	2025-10-31 02:34:11 +01:00
nils	eacab2ced6	cleanup	2025-10-31 02:19:38 +01:00
nils	f796932cd8	cleanup	2025-10-31 02:06:38 +01:00
nils	17db827e3a	cleanup	2025-10-31 01:52:51 +01:00
nils	722c2f9a5c	tests	2025-10-31 01:26:24 +01:00
nils	fa43bc749e	cleanup	2025-10-31 01:19:01 +01:00
nils	5b5916ff92	openapi cleanup	2025-10-31 00:39:22 +01:00
nils	5ca7dc9678	cleanup	2025-10-31 00:38:52 +01:00
nils	39d1d80383	cleanup	2025-10-31 00:28:48 +01:00
nils	813ce24aeb	document types	2025-10-31 00:13:16 +01:00
nils	3941ec61d3	rename	2025-10-30 23:12:30 +01:00
nils	4a3cb63263	created_at swagger	2025-10-30 23:03:57 +01:00
nils	5386724e0d	docs	2025-10-30 22:18:30 +01:00
nils	85f3d90329	frontend cleanup	2025-10-30 18:17:01 +01:00
nils	bb34a47fa8	squash database migrations	2025-10-30 17:53:00 +01:00
nils	7fae0e44ac	fix	2025-10-30 16:56:23 +01:00
nils	80d21ed0a1	deployment	2025-10-30 16:21:52 +01:00
nils	67fd787a14	cleanup	2025-10-30 14:41:15 +01:00
nils	86be6256a4	fix	2025-10-30 02:45:54 +01:00
nils	c65a3d2c40	hue control	2025-10-30 02:38:48 +01:00
nils	9fe97f2b8a	move folder creation to sidebar	2025-10-30 02:18:33 +01:00
nils	e5d44c13b4	folder create idempotency	2025-10-30 02:15:53 +01:00
nils	f89c6bb259	no-password	2025-10-30 01:43:07 +01:00
nils	b9966f82a0	frontend signup	2025-10-30 01:33:31 +01:00
nils	84f4cd05f4	backend signup	2025-10-30 01:15:26 +01:00
nils	4d14d5a3d4	passkeys	2025-10-30 00:22:01 +01:00
nils	d72792fe0a	loginview	2025-10-29 23:39:49 +01:00
nils	48da6b9c67	menu	2025-10-29 23:30:07 +01:00
nils	e3f8590ba2	colors	2025-10-29 23:20:47 +01:00
nils	384483b14c	colors	2025-10-29 23:10:51 +01:00
nils	eb3eae3fac	upload limit	2025-10-29 22:49:48 +01:00
nils	dfa2c1c0e2	limit	2025-10-29 22:47:38 +01:00
nils	22f4d42c19	fixes	2025-10-29 22:46:44 +01:00
nils	4a116e013c	fix	2025-10-29 22:38:07 +01:00
nils	5fe0da1a65	tenants	2025-10-29 22:27:32 +01:00
nils	7a6ac5f0be	fix	2025-10-29 22:19:54 +01:00
nils	15f79d3d8b	no hover	2025-10-29 22:14:18 +01:00
nils	05914b147d	fix	2025-10-29 22:08:45 +01:00
nils	abc0116945	linting, tenant slug -> name	2025-10-29 18:26:59 +01:00
nils	b6bcb72165	linting	2025-10-29 18:03:21 +01:00
nils	ca30b20873	feat(auth): add WebAuthn passkey support with migrations, routes, and tests	2025-10-29 17:50:14 +01:00
nils	ec6e7f04f2	frontend lint	2025-10-29 17:40:11 +01:00
nils	1cc0aafc1a	backend signup	2025-10-29 15:09:16 +01:00
nils	abe3fc777c	fix	2025-10-29 12:32:42 +01:00
nils	6354f7e189	quickwit	2025-10-29 12:08:33 +01:00
nils	3731b90f6c	frontend	2025-10-29 12:08:01 +01:00
nils	433485bcf0	cleanup	2025-10-29 12:07:40 +01:00
nils	f1f2dee701	frontend	2025-10-29 12:02:24 +01:00
nils	2a17f2d333	backend dry	2025-10-29 11:52:19 +01:00
nils	788858f0c1	worker: ocr upload as utf8	2025-10-29 11:16:22 +01:00
nils	ee8955574f	error handling	2025-10-29 11:14:19 +01:00
nils	ac27a9ab36	tests	2025-10-29 10:46:21 +01:00
nils	2de3dc30bf	frontend	2025-10-29 10:42:44 +01:00
nils	4d30c4c58f	label	2025-10-29 10:24:18 +01:00
nils	0052dff119	serve api on same origin at /api	2025-10-29 01:52:48 +01:00
nils	3bdca88144	stuff	2025-10-29 00:53:59 +01:00
nils	4b18429945	work	2025-10-29 00:40:13 +01:00
nils	d9b2297eca	backend: webdav tokens	2025-10-29 00:12:58 +01:00
nils	b4282c2b4b	frontend cleanup	2025-10-29 00:02:44 +01:00
nils	8554fbd6e5	frontend	2025-10-28 23:32:46 +01:00
nils	550bb7f0eb	fix	2025-10-28 13:53:29 +01:00
nils	cc37fdde9a	fix	2025-10-28 13:08:44 +01:00
nils	e351638e52	frontend	2025-10-28 12:34:43 +01:00
nils	90a642c1c5	desktop view	2025-10-28 12:17:20 +01:00
nils	e150b81190	rename skeuo to desktop	2025-10-28 10:41:56 +01:00
nils	94578475ea	appconfig	2025-10-28 02:52:41 +01:00
nils	92c491b742	auth tests	2025-10-28 02:27:10 +01:00
nils	eb93a2131f	refactor	2025-10-28 02:05:38 +01:00
nils	1e177580c9	stuff	2025-10-28 01:38:19 +01:00
nils	7df9a6415a	refactor	2025-10-28 01:18:35 +01:00
nils	1179f4fcd4	frontend tweaks, preview workspace	2025-10-28 00:43:54 +01:00
nils	709d32050e	backend tracing	2025-10-28 00:30:45 +01:00
nils	b9d84fa72b	remove download endpoint	2025-10-28 00:17:57 +01:00
nils	7abc10acde	backend	2025-10-28 00:01:40 +01:00
nils	9be0e3b5c4	frontend	2025-10-28 00:01:16 +01:00
nils	ed0f0fb759	backend	2025-10-27 22:45:16 +01:00
nils	2d80515ad5	backend	2025-10-27 22:25:43 +01:00
nils	50125f4659	document updates	2025-10-27 22:06:33 +01:00
nils	a6da34740f	drag thumbs	2025-10-27 21:20:54 +01:00
nils	7ed06ccdcf	drag	2025-10-27 21:06:29 +01:00
nils	db07e0debb	increase icon size in grid view	2025-10-27 20:55:29 +01:00
nils	a0be094cbd	table	2025-10-27 20:53:51 +01:00
nils	7366d2e16b	frontend: tags	2025-10-27 20:29:21 +01:00
nils	82aa8948cf	tenants	2025-10-27 11:32:22 +01:00
nils	84a3a9a5b5	skeuo aspect ratio	2025-10-27 01:55:37 +01:00
nils	b260065245	frontend: folders	2025-10-27 01:31:06 +01:00
nils	264316eb29	Merge remote-tracking branch 'origin/frontend' ci / docker (backend, backend/Dockerfile, backend) (push) Successful in 18m23s Details ci / docker (frontend, frontend/Dockerfile, frontend) (push) Successful in 18m2s Details	2025-10-27 00:22:00 +01:00
nils	c625c80958	folders ci / docker (backend, backend/Dockerfile, backend) (push) Has been cancelled Details ci / docker (frontend, frontend/Dockerfile, frontend) (push) Has been cancelled Details	2025-10-27 00:20:53 +01:00
nils	6a04d29eed	metadata	2025-10-27 00:17:15 +01:00
nils	10e28cc5e2	previewzoomoverlay	2025-10-27 00:14:10 +01:00
nils	970678986a	sidebar shadow	2025-10-26 23:15:12 +01:00
nils	40e45f3a01	previewzoomoverlay	2025-10-26 21:01:48 +01:00
nils	518b79bec6	stuff	2025-10-26 20:29:43 +01:00
nils	01fb4e308a	cleanup	2025-10-26 19:46:32 +01:00
nils	b6300ffa30	panel actions	2025-10-26 19:14:35 +01:00
nils	b163a07e84	lazy-thumbnails	2025-10-26 10:36:47 +01:00
nils	42a3a53314	panning	2025-10-26 02:52:26 +02:00
nils	4a06fa82eb	cache warming	2025-10-26 02:19:19 +02:00
nils	80238bb7a1	zoom	2025-10-26 02:05:31 +02:00
nils	dcbd46531e	preview zoom	2025-10-26 01:45:37 +02:00
nils	0864b39336	panel actions	2025-10-26 01:04:21 +02:00
nils	2a0c96bb4c	detail panel	2025-10-26 00:28:40 +02:00
nils	c53213a357	cleanup	2025-10-25 23:49:51 +02:00
nils	dc633783e0	frontend	2025-10-24 15:13:37 +02:00
nils	e33ab71fac	move to sidebar	2025-10-24 14:07:09 +02:00
				`@@ -1 +0,0 @@`
				`window.__PAPERCRATE_API_BASE_URL = window.__PAPERCRATE_API_BASE_URL \|\| '';`