Merge pull request #10501 from appwrite/ser-375-update-email-verification-with-branded-design

Branded email for Console auth flows
2026-05-22 16:38:32 +00:00 · 2025-10-07 13:20:53 +02:00 · 2025-10-07 13:20:53 +02:00 · e3b1146dbb
commit e3b1146dbb
parent f653348f93 7f62b19240
13 changed files with 161 additions and 41 deletions
--- a/app/config/console.php
+++ b/app/config/console.php
@ -49,6 +49,7 @@ $console = [
        'githubSecret' => System::getEnv('_APP_CONSOLE_GITHUB_SECRET', ''),
        'githubAppid' => System::getEnv('_APP_CONSOLE_GITHUB_APP_ID', '')
    ],
+    'smtpBaseTemplate' => APP_BRANDED_EMAIL_BASE_TEMPLATE,
 ];

 return $console;
--- a/app/config/locale/templates/email-base-styled.tpl
+++ b/app/config/locale/templates/email-base-styled.tpl
@ -131,6 +131,14 @@
            .social-icon > img {
                margin: auto;
            }
+            p.security-phrase:not(:empty) {
+                opacity: 0.7;
+                margin: 0;
+                padding: 0;
+                margin-top: 32px;
+                padding-top: 32px;
+                border-top: 1px solid #e8e9f0;
+            }
        </style>
    </head>

@ -147,6 +155,7 @@
                        <img
                            height="32px"
                            src="{{logoUrl}}"
+                            alt="Appwrite logo"
                        />
                    </td>
                </tr>
@ -155,12 +164,12 @@
            <table style="margin-top: 32px">
                <tr>
                    <td>
-                        <h1>{{subject}}</h1>
+                        <h1>{{heading}}</h1>
                    </td>
                </tr>
            </table>

-            <table style="margin-top: 32px">
+            <table style="margin-top: 16px">
                <tr>
                    <td>
 {{body}}
--- a/app/config/locale/templates/email-base.tpl
+++ b/app/config/locale/templates/email-base.tpl
@ -44,6 +44,21 @@
                color: currentColor;
                word-break: break-all;
            }
+            a.button {
+                box-sizing: border-box;
+                display: inline-block;
+                text-align: center;
+                text-decoration: none;
+                padding: 9px 14px;
+                color: #ffffff;
+                background-color: #2D2D31;
+                border: 1px solid #414146;
+                border-radius: 8px;
+            }
+            a.button:hover,
+            a.button:focus {
+                opacity: 0.8;
+            }
            table {
                width: 100%;
                border-spacing: 0 !important;
@ -94,10 +109,15 @@
            h* {
                font-family: 'Poppins', sans-serif;
            }
-    
            p {
                margin-bottom: 10px;
            }
+            p.security-phrase:not(:empty) {
+                opacity: 0.7;
+                margin-top: 32px;
+                padding-top: 32px;
+                border-top: 1px solid #e8e9f0;
+            }
        </style>
    </head>

--- a/app/config/locale/templates/email-inner-base.tpl
+++ b/app/config/locale/templates/email-inner-base.tpl
@ -1,6 +1,6 @@
 <p>{{hello}}</p>
 <p>{{body}}</p>
-<p><a href="{{redirect}}" target="_blank" style="font-size: 14px; font-family: Inter, sans-serif; color: #ffffff; text-decoration: none; background-color: #2D2D31; border-radius: 8px; padding: 9px 14px; border: 1px solid #414146; display: inline-block; text-align:center; box-sizing: border-box;">{{buttonText}}</a></p>
+<p><a href="{{redirect}}" target="_blank" class="button">{{buttonText}}</a></p>
 <p>{{footer}}</p>
 <p style="margin-bottom: 32px">
    {{thanks}}
--- a/app/config/locale/templates/email-magic-url.tpl
+++ b/app/config/locale/templates/email-magic-url.tpl
@ -5,7 +5,7 @@
 <table border="0" cellspacing="0" cellpadding="0" style="padding-top: 10px; padding-bottom: 10px; display: inline-block;">
    <tr>
        <td align="center" style="border-radius: 8px; background-color: #19191D;">
-            <a rel="noopener" target="_blank" href="{{redirect}}" style="font-size: 14px; font-family: Inter; color: #ffffff; text-decoration: none; border-radius: 8px; padding: 9px 14px; border: 1px solid #19191D; display: inline-block;">{{buttonText}}</a>
+            <a rel="noopener" target="_blank" href="{{redirect}}" class="button">{{buttonText}}</a>
        </td>
    </tr>
 </table>
--- a/app/config/locale/templates/email-mfa-challenge.tpl
+++ b/app/config/locale/templates/email-mfa-challenge.tpl
@ -5,7 +5,7 @@
 <table border="0" cellspacing="0" cellpadding="0" style="padding-top: 10px; padding-bottom: 10px; display: inline-block;">
    <tr>
        <td align="center" style="border-radius: 8px; background-color: #ffffff;">
-            <p style="font-size: 24px; text-indent: 18px; letter-spacing: 18px; font-family: 'Inter', sans-serif; color: #414146; text-decoration: none; border-radius: 8px; padding: 24px 12px; border: 1px solid #EDEDF0; display: inline-block; font-weight: bold; ">{{otp}}</p>
+            <p style="font-size: 24px; text-indent: 18px; letter-spacing: 18px; font-family: 'Inter', sans-serif; color: #414146; text-decoration: none; border-radius: 8px; margin-top: 0px; margin-bottom: 0px; padding: 24px 12px; border: 1px solid #EDEDF0; display: inline-block; font-weight: bold;">{{otp}}</p>
        </td>
    </tr>
 </table>
--- a/app/config/locale/templates/email-otp.tpl
+++ b/app/config/locale/templates/email-otp.tpl
@ -5,7 +5,7 @@
 <table border="0" cellspacing="0" cellpadding="0" style="padding-top: 10px; padding-bottom: 10px; display: inline-block;">
    <tr>
        <td align="center" style="border-radius: 8px; background-color: #ffffff;">
-            <p style="font-size: 24px; text-indent: 18px; letter-spacing: 18px; font-family: Inter; color: #414146; text-decoration: none; border-radius: 8px; padding: 24px 12px; border: 1px solid #EDEDF0; display: inline-block; font-weight: bold; ">{{otp}}</p>
+            <p style="font-size: 24px; text-indent: 18px; letter-spacing: 18px; font-family: 'Inter', sans-serif; color: #414146; text-decoration: none; border-radius: 8px; margin-top: 0px; margin-bottom: 0px; padding: 24px 12px; border: 1px solid #EDEDF0; display: inline-block; font-weight: bold; ">{{otp}}</p>
        </td>
    </tr>
 </table>
@ -15,6 +15,4 @@
 <p style="margin-bottom: 0px;">{{thanks}}</p>
 <p style="margin-top: 0px;">{{signature}}</p>

-<hr style="margin-block-start: 1rem; margin-block-end: 1rem;">
-
-<p style="opacity: 0.7;">{{securityPhrase}}</p>
+<p class="security-phrase">{{securityPhrase}}</p>
--- a/app/config/locale/translations/en.json
+++ b/app/config/locale/translations/en.json
@ -5,6 +5,7 @@
    "emails.sender": "{{project}} Team",
    "emails.verification.subject": "Account Verification for {{project}}",
    "emails.verification.preview": "Verify your email to activate your {{project}} account.",
+    "emails.verification.heading": "Verify your email to start using {{project}}",
    "emails.verification.hello": "Hello {{user}},",
    "emails.verification.body": "Follow this link to verify your email address to your {{b}}{{project}}{{/b}} account.",
    "emails.verification.footer": "If you didn’t ask to verify this address, you can ignore this message.",
@ -33,6 +34,7 @@
    "emails.sessionAlert.signature": "{{project}} team",
    "emails.otpSession.subject": "OTP for {{project}} Login",
    "emails.otpSession.preview": "Use OTP {{otp}} to sign in to {{project}}. Expires in 15 minutes.",
+    "emails.otpSession.heading": "Login with OTP to use {{project}}",
    "emails.otpSession.hello": "Hello {{user}},",
    "emails.otpSession.description": "Enter the following verification code when prompted to securely sign in to your {{b}}{{project}}{{/b}} account. This code will expire in 15 minutes.",
    "emails.otpSession.clientInfo": "This sign in was requested using {{b}}{{agentClient}}{{/b}} on {{b}}{{agentDevice}}{{/b}} {{b}}{{agentOs}}{{/b}}. If you didn't request the sign in, you can safely ignore this email.",
@ -41,6 +43,7 @@
    "emails.otpSession.signature": "{{project}} team",
    "emails.mfaChallenge.subject": "Verification Code for {{project}}",
    "emails.mfaChallenge.preview": "Use code {{otp}} for two-step verification in {{project}}. Expires in 15 minutes.",
+    "emails.mfaChallenge.heading": "Complete two-step verification to use {{project}}",
    "emails.mfaChallenge.hello": "Hello {{user}},",
    "emails.mfaChallenge.description": "Enter the following code to confirm your two-step verification in {{b}}{{project}}{{/b}}. This code will expire in 15 minutes.",
    "emails.mfaChallenge.clientInfo": "This verification code was requested using {{b}}{{agentClient}}{{/b}} on {{b}}{{agentDevice}}{{/b}} {{b}}{{agentOs}}{{/b}}. If you didn't request the verification code, you can safely ignore this email.",
--- a/app/controllers/api/account.php
+++ b/app/controllers/api/account.php
@ -58,6 +58,7 @@ use Utopia\Database\Validator\Query\Limit;
 use Utopia\Database\Validator\Query\Offset;
 use Utopia\Database\Validator\UID;
 use Utopia\Locale\Locale;
+use Utopia\Storage\Validator\FileName;
 use Utopia\System\System;
 use Utopia\Validator\ArrayList;
 use Utopia\Validator\Assoc;
@ -165,7 +166,8 @@ function sendSessionAlert(Locale $locale, Document $user, Document $project, Doc
        ->setVariables($emailVariables)
        ->setRecipient($email)
        ->trigger();
-};
+}
+;


 $createSession = function (string $userId, string $secret, Request $request, Response $response, Document $user, Database $dbForProject, Document $project, Locale $locale, Reader $geodb, Event $queueForEvents, Mail $queueForMails) {
@ -838,7 +840,7 @@ App::patch('/v1/account/sessions/:sessionId')
            $session
                ->setAttribute('providerAccessToken', $oauth2->getAccessToken(''))
                ->setAttribute('providerRefreshToken', $oauth2->getRefreshToken(''))
-                ->setAttribute('providerAccessTokenExpiry', DateTime::addSeconds(new \DateTime(), (int)$oauth2->getAccessTokenExpiry('')));
+                ->setAttribute('providerAccessTokenExpiry', DateTime::addSeconds(new \DateTime(), (int) $oauth2->getAccessTokenExpiry('')));
        }

        // Save changes
@ -982,9 +984,11 @@ App::post('/v1/account/sessions/email')
        ;

        if ($project->getAttribute('auths', [])['sessionAlerts'] ?? false) {
-            if ($dbForProject->count('sessions', [
-                Query::equal('userId', [$user->getId()]),
-            ]) !== 1) {
+            if (
+                $dbForProject->count('sessions', [
+                    Query::equal('userId', [$user->getId()]),
+                ]) !== 1
+            ) {
                sendSessionAlert($locale, $user, $project, $session, $queueForMails);
            }
        }
@ -1098,7 +1102,7 @@ App::post('/v1/account/sessions/anonymous')

        Authorization::setRole(Role::user($user->getId())->toString());

-        $session = $dbForProject->createDocument('sessions', $session-> setAttribute('$permissions', [
+        $session = $dbForProject->createDocument('sessions', $session->setAttribute('$permissions', [
            Permission::read(Role::user($user->getId())),
            Permission::update(Role::user($user->getId())),
            Permission::delete(Role::user($user->getId())),
@ -1659,13 +1663,13 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect')
                'providerEmail' => $email,
                'providerAccessToken' => $accessToken,
                'providerRefreshToken' => $refreshToken,
-                'providerAccessTokenExpiry' => DateTime::addSeconds(new \DateTime(), (int)$accessTokenExpiry),
+                'providerAccessTokenExpiry' => DateTime::addSeconds(new \DateTime(), (int) $accessTokenExpiry),
            ]));
        } else {
            $identity
                ->setAttribute('providerAccessToken', $accessToken)
                ->setAttribute('providerRefreshToken', $refreshToken)
-                ->setAttribute('providerAccessTokenExpiry', DateTime::addSeconds(new \DateTime(), (int)$accessTokenExpiry));
+                ->setAttribute('providerAccessTokenExpiry', DateTime::addSeconds(new \DateTime(), (int) $accessTokenExpiry));
            $dbForProject->updateDocument('identities', $identity->getId(), $identity);
        }

@ -1735,7 +1739,7 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect')
                'providerUid' => $oauth2ID,
                'providerAccessToken' => $accessToken,
                'providerRefreshToken' => $refreshToken,
-                'providerAccessTokenExpiry' => DateTime::addSeconds(new \DateTime(), (int)$accessTokenExpiry),
+                'providerAccessTokenExpiry' => DateTime::addSeconds(new \DateTime(), (int) $accessTokenExpiry),
                'secret' => Auth::hash($secret), // One way hash encryption to protect DB leak
                'userAgent' => $request->getUserAgent('UNKNOWN'),
                'ip' => $request->getIP(),
@ -2293,7 +2297,17 @@ App::post('/v1/account/tokens/email')

        $subject = $locale->getText("emails.otpSession.subject");
        $preview = $locale->getText("emails.otpSession.preview");
+        $heading = $locale->getText("emails.otpSession.heading");
+
        $customTemplate = $project->getAttribute('templates', [])['email.otpSession-' . $locale->default] ?? [];
+        $smtpBaseTemplate = $project->getAttribute('smtpBaseTemplate', 'email-base');
+
+        $validator = new FileName();
+        if (!$validator->isValid($smtpBaseTemplate)) {
+            throw new Exception(Exception::GENERAL_BAD_REQUEST, 'Invalid template path');
+        }
+
+        $bodyTemplate = __DIR__ . '/../../config/locale/templates/' . $smtpBaseTemplate . '.tpl';

        $detector = new Detector($request->getUserAgent('UNKNOWN'));
        $agentOs = $detector->getOS();
@ -2363,6 +2377,7 @@ App::post('/v1/account/tokens/email')
        }

        $emailVariables = [
+            'heading' => $heading,
            'direction' => $locale->getText('settings.direction'),
            // {{user}}, {{project}} and {{otp}} are required in the templates
            'user' => $user->getAttribute('name'),
@ -2376,10 +2391,23 @@ App::post('/v1/account/tokens/email')
            'team' => '',
        ];

+        if ($smtpBaseTemplate === APP_BRANDED_EMAIL_BASE_TEMPLATE) {
+            $emailVariables = array_merge($emailVariables, [
+                'accentColor' => APP_EMAIL_ACCENT_COLOR,
+                'logoUrl' => APP_EMAIL_LOGO_URL,
+                'twitterUrl' => APP_SOCIAL_TWITTER,
+                'discordUrl' => APP_SOCIAL_DISCORD,
+                'githubUrl' => APP_SOCIAL_GITHUB_APPWRITE,
+                'termsUrl' => APP_EMAIL_TERMS_URL,
+                'privacyUrl' => APP_EMAIL_PRIVACY_URL,
+            ]);
+        }
+
        $queueForMails
            ->setSubject($subject)
            ->setPreview($preview)
            ->setBody($body)
+            ->setBodyTemplate($bodyTemplate)
            ->setVariables($emailVariables)
            ->setRecipient($email)
            ->trigger();
@ -2732,10 +2760,12 @@ App::post('/v1/account/jwts')

        $response
            ->setStatusCode(Response::STATUS_CODE_CREATED)
-            ->dynamic(new Document(['jwt' => $jwt->encode([
-                'userId' => $user->getId(),
-                'sessionId' => $current->getId(),
-            ])]), Response::MODEL_JWT);
+            ->dynamic(new Document([
+                'jwt' => $jwt->encode([
+                    'userId' => $user->getId(),
+                    'sessionId' => $current->getId(),
+                ])
+            ]), Response::MODEL_JWT);
    });

 App::get('/v1/account/prefs')
@ -3480,12 +3510,12 @@ App::put('/v1/account/recovery')
        $hooks->trigger('passwordValidator', [$dbForProject, $project, $password, &$user, true]);

        $profile = $dbForProject->updateDocument('users', $profile->getId(), $profile
-                ->setAttribute('password', $newPassword)
-                ->setAttribute('passwordHistory', $history)
-                ->setAttribute('passwordUpdate', DateTime::now())
-                ->setAttribute('hash', Auth::DEFAULT_ALGO)
-                ->setAttribute('hashOptions', Auth::DEFAULT_ALGO_OPTIONS)
-                ->setAttribute('emailVerification', true));
+            ->setAttribute('password', $newPassword)
+            ->setAttribute('passwordHistory', $history)
+            ->setAttribute('passwordUpdate', DateTime::now())
+            ->setAttribute('hash', Auth::DEFAULT_ALGO)
+            ->setAttribute('hashOptions', Auth::DEFAULT_ALGO_OPTIONS)
+            ->setAttribute('emailVerification', true));

        $user->setAttributes($profile->getArrayCopy());

@ -3603,7 +3633,17 @@ App::post('/v1/account/verifications/email')
        $body = $locale->getText("emails.verification.body");
        $preview = $locale->getText("emails.verification.preview");
        $subject = $locale->getText("emails.verification.subject");
+        $heading = $locale->getText("emails.verification.heading");
+
        $customTemplate = $project->getAttribute('templates', [])['email.verification-' . $locale->default] ?? [];
+        $smtpBaseTemplate = $project->getAttribute('smtpBaseTemplate', 'email-base');
+
+        $validator = new FileName();
+        if (!$validator->isValid($smtpBaseTemplate)) {
+            throw new Exception(Exception::GENERAL_BAD_REQUEST, 'Invalid template path');
+        }
+
+        $bodyTemplate = __DIR__ . '/../../config/locale/templates/' . $smtpBaseTemplate . '.tpl';

        $message = Template::fromFile(__DIR__ . '/../../config/locale/templates/email-inner-base.tpl');
        $message
@ -3663,6 +3703,7 @@ App::post('/v1/account/verifications/email')
        }

        $emailVariables = [
+            'heading' => $heading,
            'direction' => $locale->getText('settings.direction'),
            // {{user}}, {{redirect}} and {{project}} are required in default and custom templates
            'user' => $user->getAttribute('name'),
@ -3672,10 +3713,23 @@ App::post('/v1/account/verifications/email')
            'team' => '',
        ];

+        if ($smtpBaseTemplate === APP_BRANDED_EMAIL_BASE_TEMPLATE) {
+            $emailVariables = array_merge($emailVariables, [
+                'accentColor' => APP_EMAIL_ACCENT_COLOR,
+                'logoUrl' => APP_EMAIL_LOGO_URL,
+                'twitterUrl' => APP_SOCIAL_TWITTER,
+                'discordUrl' => APP_SOCIAL_DISCORD,
+                'githubUrl' => APP_SOCIAL_GITHUB_APPWRITE,
+                'termsUrl' => APP_EMAIL_TERMS_URL,
+                'privacyUrl' => APP_EMAIL_PRIVACY_URL,
+            ]);
+        }
+
        $queueForMails
            ->setSubject($subject)
            ->setPreview($preview)
            ->setBody($body)
+            ->setBodyTemplate($bodyTemplate)
            ->setVariables($emailVariables)
            ->setRecipient($user->getAttribute('email'))
            ->setName($user->getAttribute('name') ?? '')
@ -4704,7 +4758,17 @@ App::post('/v1/account/mfa/challenge')

                $subject = $locale->getText("emails.mfaChallenge.subject");
                $preview = $locale->getText("emails.mfaChallenge.preview");
+                $heading = $locale->getText("emails.mfaChallenge.heading");
+
                $customTemplate = $project->getAttribute('templates', [])['email.mfaChallenge-' . $locale->default] ?? [];
+                $smtpBaseTemplate = $project->getAttribute('smtpBaseTemplate', 'email-base');
+
+                $validator = new FileName();
+                if (!$validator->isValid($smtpBaseTemplate)) {
+                    throw new Exception(Exception::GENERAL_BAD_REQUEST, 'Invalid template path');
+                }
+
+                $bodyTemplate = __DIR__ . '/../../config/locale/templates/' . $smtpBaseTemplate . '.tpl';

                $detector = new Detector($request->getUserAgent('UNKNOWN'));
                $agentOs = $detector->getOS();
@ -4768,6 +4832,7 @@ App::post('/v1/account/mfa/challenge')
                }

                $emailVariables = [
+                    'heading' => $heading,
                    'direction' => $locale->getText('settings.direction'),
                    // {{user}}, {{project}} and {{otp}} are required in the templates
                    'user' => $user->getAttribute('name'),
@ -4775,13 +4840,26 @@ App::post('/v1/account/mfa/challenge')
                    'otp' => $code,
                    'agentDevice' => $agentDevice['deviceBrand'] ?? $agentDevice['deviceBrand'] ?? 'UNKNOWN',
                    'agentClient' => $agentClient['clientName'] ?? 'UNKNOWN',
-                    'agentOs' => $agentOs['osName'] ?? 'UNKNOWN'
+                    'agentOs' => $agentOs['osName'] ?? 'UNKNOWN',
                ];

+                if ($smtpBaseTemplate === APP_BRANDED_EMAIL_BASE_TEMPLATE) {
+                    $emailVariables = array_merge($emailVariables, [
+                        'accentColor' => APP_EMAIL_ACCENT_COLOR,
+                        'logoUrl' => APP_EMAIL_LOGO_URL,
+                        'twitterUrl' => APP_SOCIAL_TWITTER,
+                        'discordUrl' => APP_SOCIAL_DISCORD,
+                        'githubUrl' => APP_SOCIAL_GITHUB_APPWRITE,
+                        'termsUrl' => APP_EMAIL_TERMS_URL,
+                        'privacyUrl' => APP_EMAIL_PRIVACY_URL,
+                    ]);
+                }
+
                $queueForMails
                    ->setSubject($subject)
                    ->setPreview($preview)
                    ->setBody($body)
+                    ->setBodyTemplate($bodyTemplate)
                    ->setVariables($emailVariables)
                    ->setRecipient($user->getAttribute('email'))
                    ->trigger();
@ -4904,8 +4982,8 @@ App::put('/v1/account/mfa/challenge')
        $dbForProject->updateDocument('sessions', $session->getId(), $session);

        $queueForEvents
-                    ->setParam('userId', $user->getId())
-                    ->setParam('sessionId', $session->getId());
+            ->setParam('userId', $user->getId())
+            ->setParam('sessionId', $session->getId());

        $response->dynamic($session, Response::MODEL_SESSION);
    });
@ -4968,7 +5046,7 @@ App::post('/v1/account/targets/push')
                ],
                'providerId' => !empty($providerId) ? $providerId : null,
                'providerInternalId' => !empty($providerId) ? $provider->getSequence() : null,
-                'providerType' =>  MESSAGE_TYPE_PUSH,
+                'providerType' => MESSAGE_TYPE_PUSH,
                'userId' => $user->getId(),
                'userInternalId' => $user->getSequence(),
                'sessionId' => $session->getId(),
@ -5143,8 +5221,8 @@ App::get('/v1/account/identities')
        $queries[] = Query::equal('userInternalId', [$user->getSequence()]);

        /**
-            * Get cursor document if there was a cursor query, we use array_filter and reset for reference $cursor to $queries
-            */
+         * Get cursor document if there was a cursor query, we use array_filter and reset for reference $cursor to $queries
+         */
        $cursor = \array_filter($queries, function ($query) {
            return \in_array($query->getMethod(), [Query::TYPE_CURSOR_AFTER, Query::TYPE_CURSOR_BEFORE]);
        });
--- a/app/init/constants.php
+++ b/app/init/constants.php
@ -85,6 +85,7 @@ const APP_PLATFORM_CLIENT = 'client';
 const APP_PLATFORM_CONSOLE = 'console';
 const APP_VCS_GITHUB_USERNAME = 'Appwrite';
 const APP_VCS_GITHUB_EMAIL = 'team@appwrite.io';
+const APP_BRANDED_EMAIL_BASE_TEMPLATE = 'email-base-styled';

 // Database Reconnect
 const DATABASE_RECONNECT_SLEEP = 2;
--- a/composer.lock
+++ b/composer.lock
@ -4566,16 +4566,16 @@
        },
        {
            "name": "utopia-php/storage",
-            "version": "0.18.13",
+            "version": "0.18.14",
            "source": {
                "type": "git",
                "url": "https://github.com/utopia-php/storage.git",
-                "reference": "3d8ce53ae042173bf230445e996056c5f65ded22"
+                "reference": "4f14ec952c6f4006dd0613e55bbf7631814fbc00"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/utopia-php/storage/zipball/3d8ce53ae042173bf230445e996056c5f65ded22",
-                "reference": "3d8ce53ae042173bf230445e996056c5f65ded22",
+                "url": "https://api.github.com/repos/utopia-php/storage/zipball/4f14ec952c6f4006dd0613e55bbf7631814fbc00",
+                "reference": "4f14ec952c6f4006dd0613e55bbf7631814fbc00",
                "shasum": ""
            },
            "require": {
@ -4618,9 +4618,9 @@
            ],
            "support": {
                "issues": "https://github.com/utopia-php/storage/issues",
-                "source": "https://github.com/utopia-php/storage/tree/0.18.13"
+                "source": "https://github.com/utopia-php/storage/tree/0.18.14"
            },
-            "time": "2025-05-26T13:10:35+00:00"
+            "time": "2025-10-07T10:21:47+00:00"
        },
        {
            "name": "utopia-php/swoole",
--- a/src/Appwrite/Platform/Workers/Mails.php
+++ b/src/Appwrite/Platform/Workers/Mails.php
@ -82,6 +82,7 @@ class Mails extends Action
        $preview = $payload['preview'] ?? '';

        $variables['subject'] = $subject;
+        $variables['heading'] = $variables['heading'] ?? $subject;
        $variables['year'] = date("Y");

        $attachment = $payload['attachment'] ?? [];
--- a/tests/e2e/Services/Account/AccountBase.php
+++ b/tests/e2e/Services/Account/AccountBase.php
@ -152,6 +152,8 @@ trait AccountBase

    public function testEmailOTPSession(): void
    {
+        $isConsoleProject = $this->getProject()['$id'] === 'console';
+
        $response = $this->client->call(Client::METHOD_POST, '/account/tokens/email', array_merge([
            'origin' => 'http://localhost',
            'content-type' => 'application/json',
@ -183,6 +185,13 @@ trait AccountBase
        $this->assertNotEmpty($code);
        $this->assertStringContainsStringIgnoringCase('Use OTP ' . $code . ' to sign in to '. $this->getProject()['name'] . '. Expires in 15 minutes.', $lastEmail['text']);

+        // Only Console project has branded logo in email.
+        if ($isConsoleProject) {
+            $this->assertStringContainsStringIgnoringCase('Appwrite logo', $lastEmail['html']);
+        } else {
+            $this->assertStringNotContainsStringIgnoringCase('Appwrite logo', $lastEmail['html']);
+        }
+
        $response = $this->client->call(Client::METHOD_POST, '/account/sessions/token', array_merge([
            'origin' => 'http://localhost',
            'content-type' => 'application/json',