@airoom/nextmin-node 0.1.4 → 0.1.6

package/dist/api/router/mountCrudRoutes.js

@@ -0,0 +1,754 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mountCrudRoutes = mountCrudRoutes;
+const bcrypt_1 = __importDefault(require("bcrypt"));
+const Logger_1 = __importDefault(require("../../utils/Logger"));
+const fieldCodecs_1 = require("../../utils/fieldCodecs");
+const authorize_1 = require("../../policy/authorize");
+const utils_1 = require("./utils");
+function mountCrudRoutes(ctx, modelNameLC) {
+    const { router } = ctx;
+    const basePath = `/${modelNameLC}`;
+    const mwCreate = ctx.pickAuthFor('create', modelNameLC);
+    const mwRead = ctx.pickAuthFor('read', modelNameLC);
+    const mwUpdate = ctx.pickAuthFor('update', modelNameLC);
+    const mwDelete = ctx.pickAuthFor('delete', modelNameLC);
+    const ctxFromReq = (req) => {
+        const raw = req.user?.role;
+        let roleStr = null;
+        if (typeof raw === 'string') {
+            roleStr = raw;
+        }
+        else if (Array.isArray(raw)) {
+            const first = raw[0];
+            if (typeof first === 'string')
+                roleStr = first;
+            else if (first &&
+                typeof first === 'object' &&
+                typeof first.name === 'string') {
+                roleStr = first.name;
+            }
+        }
+        else if (raw &&
+            typeof raw === 'object' &&
+            typeof raw.name === 'string') {
+            roleStr = raw.name;
+        }
+        roleStr = roleStr ? roleStr.toLowerCase() : null;
+        return {
+            isAuthenticated: !!req.user,
+            role: roleStr,
+            userId: req.user?.id ?? req.user?._id ?? null,
+            isSuperadmin: roleStr === 'superadmin',
+            apiKeyOk: true,
+        };
+    };
+    // ----------------- CREATE -----------------
+    router.post(basePath, mwCreate, async (req, res) => {
+        try {
+            const schema = ctx.getSchema(modelNameLC);
+            if (!schema.allowedMethods.create) {
+                return res
+                    .status(405)
+                    .json({ error: true, message: 'Method not allowed' });
+            }
+            const model = ctx.getModel(modelNameLC);
+            const pctx = ctxFromReq(req);
+            const schemaPolicy = {
+                allowedMethods: schema.allowedMethods,
+                access: schema.access,
+            };
+            const cdec = (0, authorize_1.authorize)(modelNameLC, 'create', schemaPolicy, pctx);
+            if (!cdec.allow) {
+                return res.status(403).json({ error: true, message: 'forbidden' });
+            }
+            let payload = (0, authorize_1.mergeCreateDefaults)(req.body, cdec.createDefaults);
+            (0, authorize_1.enforceRestrictions)(payload, cdec.restrictions, pctx);
+            if (!cdec.exposePrivate)
+                payload = (0, authorize_1.stripWriteDeny)(payload, cdec.writeDeny);
+            payload = (0, fieldCodecs_1.coerceForStorage)(schema, payload);
+            const missing = ctx.validateRequiredFields(schema, payload, 'create');
+            if (missing.length) {
+                return res.status(400).json({
+                    error: true,
+                    message: `Missing required fields: ${missing.join(', ')}`,
+                });
+            }
+            if (!schema.extends) {
+                const conflicts = await ctx.checkUniqueFields(schema, payload);
+                if (conflicts && conflicts.length > 0) {
+                    return res.status(400).json({
+                        error: true,
+                        fields: conflicts.map((field) => ({
+                            field,
+                            error: true,
+                            message: `You cannot use this ${field}. It's already been used.`,
+                        })),
+                    });
+                }
+            }
+            // Extended schema: split base + child writes
+            if (schema.extends) {
+                const baseName = String(schema.extends);
+                const baseLC = baseName.toLowerCase();
+                const baseSchema = ctx.getSchema(baseLC);
+                const baseModel = ctx.getModel(baseLC);
+                const basePayload = {};
+                const childPayload = {};
+                for (const [k, v] of Object.entries(payload)) {
+                    if (baseSchema.attributes[k])
+                        basePayload[k] = v;
+                    else if (k !== 'baseId')
+                        childPayload[k] = v;
+                }
+                if (baseLC === 'users' && basePayload.password && ctx.jwtSecret) {
+                    const salt = await bcrypt_1.default.genSalt(10);
+                    basePayload.password = await bcrypt_1.default.hash(String(basePayload.password) + ctx.jwtSecret, salt);
+                }
+                const baseConflicts = await ctx.checkUniqueFields(baseSchema, basePayload);
+                if (baseConflicts && baseConflicts.length) {
+                    return res.status(400).json({
+                        error: true,
+                        fields: baseConflicts.map((field) => ({
+                            field,
+                            error: true,
+                            message: `You cannot use this ${field}. It's already been used.`,
+                        })),
+                    });
+                }
+                const childConflicts = await ctx.checkUniqueFields(schema, childPayload);
+                if (childConflicts && childConflicts.length) {
+                    return res.status(400).json({
+                        error: true,
+                        fields: childConflicts.map((field) => ({
+                            field,
+                            error: true,
+                            message: `You cannot use this ${field}. It's already been used.`,
+                        })),
+                    });
+                }
+                const baseCreated = await baseModel.create(basePayload);
+                const childToCreate = { ...childPayload, baseId: baseCreated.id };
+                const childCreated = await model.create(childToCreate);
+                let resultDoc = { ...baseCreated, ...childCreated };
+                delete resultDoc.baseId;
+                if (cdec.exposePrivate && childCreated?.id) {
+                    const [refChild] = await model.read({ id: childCreated.id }, 1, 0, true);
+                    const [refBase] = await baseModel.read({ id: baseCreated.id }, 1, 0, true);
+                    if (refChild && refBase) {
+                        resultDoc = { ...refBase, ...refChild };
+                        delete resultDoc.baseId;
+                    }
+                }
+                const masked = cdec.exposePrivate
+                    ? (0, authorize_1.applyReadMaskOne)(resultDoc, cdec.sensitiveMask)
+                    : (0, authorize_1.applyReadMaskOne)(resultDoc, cdec.readMask);
+                return res.status(201).json({
+                    success: true,
+                    message: `${schema.modelName} has been created successfully.`,
+                    data: masked,
+                });
+            }
+            // non-extended
+            if (modelNameLC === 'users' &&
+                payload.password &&
+                ctx.jwtSecret) {
+                const salt = await bcrypt_1.default.genSalt(10);
+                payload.password = await bcrypt_1.default.hash(String(payload.password) + ctx.jwtSecret, salt);
+            }
+            const created = await model.create(payload);
+            let resultDoc = created;
+            if (cdec.exposePrivate && created?.id) {
+                const refetched = await model.read({ id: created.id }, 1, 0, true);
+                if (refetched?.[0])
+                    resultDoc = refetched[0];
+            }
+            const masked = cdec.exposePrivate
+                ? (0, authorize_1.applyReadMaskOne)(resultDoc, cdec.sensitiveMask)
+                : (0, authorize_1.applyReadMaskOne)(resultDoc, cdec.readMask);
+            return res.status(201).json({
+                success: true,
+                message: `${schema.modelName} has been created successfully.`,
+                data: masked,
+            });
+        }
+        catch (error) {
+            if (error?.code === 'MODEL_REMOVED') {
+                return res.status(410).json({ error: true, message: error.message });
+            }
+            ctx.handleWriteError(error, res);
+        }
+    });
+    // ----------------- READ (list) -----------------
+    router.get(basePath, mwRead, async (req, res) => {
+        try {
+            const schema = ctx.getSchema(modelNameLC);
+            if (!schema.allowedMethods.read) {
+                return res
+                    .status(405)
+                    .json({ error: true, message: 'Method not allowed' });
+            }
+            const model = ctx.getModel(modelNameLC);
+            const page = Number.parseInt(String(req.query.page ?? '0'), 10) || 0;
+            const limit = Number.parseInt(String(req.query.limit ?? '10'), 10) || 10;
+            const q = String(req.query.q ?? '').trim();
+            const searchKey = String(req.query.searchKey ?? '').trim();
+            const searchKeysCSV = String(req.query.searchKeys ?? '').trim();
+            const searchMode = /^(and|or)$/i.test(String(req.query.searchMode ?? ''))
+                ? String(req.query.searchMode).toLowerCase()
+                : 'or';
+            const dateFromStr = String(req.query.dateFrom ?? '').trim();
+            const dateToStr = String(req.query.dateTo ?? '').trim();
+            let dateKey = String(req.query.dateKey ?? 'createdAt').trim();
+            const sortRaw = String(req.query.sort ?? '').trim();
+            const sortTypeRaw = String(req.query.sortType ?? '').trim();
+            const filter = {};
+            const buildSortSpec = () => {
+                const keys = (0, utils_1.splitCSV)(sortRaw);
+                const dirs = (0, utils_1.splitCSV)(sortTypeRaw);
+                const s = {};
+                keys.forEach((k, i) => {
+                    if (!schema.attributes?.[k])
+                        return;
+                    const d = dirs[i] ?? dirs[dirs.length - 1] ?? 'desc';
+                    s[k] = /^(desc|-1)$/i.test(d) ? -1 : 1;
+                });
+                if (!Object.keys(s).length)
+                    s.createdAt = -1;
+                return s;
+            };
+            // SEARCH
+            const ors = [];
+            const ands = [];
+            if (q && searchKey && schema.attributes?.[searchKey]) {
+                const p = (0, utils_1.buildPredicateForField)(searchKey, schema.attributes[searchKey], q);
+                if (p)
+                    ors.push(p);
+            }
+            if (q && searchKeysCSV) {
+                const keys = (0, utils_1.splitCSV)(searchKeysCSV);
+                const preds = keys
+                    .filter((k) => !!schema.attributes?.[k])
+                    .map((k) => (0, utils_1.buildPredicateForField)(k, schema.attributes[k], q))
+                    .filter(Boolean);
+                if (preds.length) {
+                    if (searchMode === 'and')
+                        ands.push(...preds);
+                    else
+                        ors.push(...preds);
+                }
+            }
+            if (ands.length && ors.length)
+                filter.$and = [...ands, { $or: ors }];
+            else if (ands.length)
+                filter.$and = [...(filter.$and || []), ...ands];
+            else if (ors.length)
+                filter.$or = [...(filter.$or || []), ...ors];
+            if (dateFromStr || dateToStr) {
+                if (!schema.attributes?.[dateKey]) {
+                    if (schema.attributes?.createdAt)
+                        dateKey = 'createdAt';
+                    else if (schema.attributes?.updatedAt)
+                        dateKey = 'updatedAt';
+                }
+                if (dateKey && schema.attributes?.[dateKey]) {
+                    const range = {};
+                    if (dateFromStr) {
+                        const d = new Date(dateFromStr);
+                        if (!Number.isNaN(+d))
+                            range.$gte = d;
+                    }
+                    if (dateToStr) {
+                        const d = new Date(dateToStr);
+                        if (!Number.isNaN(+d))
+                            range.$lte = d;
+                    }
+                    if (Object.keys(range).length)
+                        filter[dateKey] = range;
+                }
+            }
+            // arbitrary field filters ---- Direct field filters from req.query (e.g., ?isPublic=true&key=doctor) ----
+            const RESERVED = new Set([
+                'page',
+                'limit',
+                'q',
+                'searchKey',
+                'searchKeys',
+                'searchMode',
+                'dateFrom',
+                'dateTo',
+                'dateKey',
+                'sort',
+                'sortType',
+            ]);
+            const attrMap = schema.attributes || {};
+            const coerceQueryVal = (raw) => {
+                const s = String(raw).trim();
+                if (/^(true|false)$/i.test(s))
+                    return /^true$/i.test(s);
+                if (/^-?\d+(\.\d+)?$/.test(s))
+                    return Number(s);
+                if (/^null$/i.test(s))
+                    return null;
+                if (/^undefined$/i.test(s))
+                    return undefined;
+                return s;
+            };
+            for (const [k, vRaw] of Object.entries(req.query)) {
+                if (RESERVED.has(k))
+                    continue;
+                if (!Object.prototype.hasOwnProperty.call(attrMap, k))
+                    continue;
+                const v = Array.isArray(vRaw)
+                    ? vRaw.map(String).join(',')
+                    : String(vRaw);
+                if (!v?.length)
+                    continue;
+                // Operators:
+                // - "a,b,c"  -> $in
+                // - "!x"     -> $ne
+                // - "gt:10"  -> {$gt:10}, "gte:10","lt:5","lte:5"
+                // - default  -> exact match
+                const tryNumOrBool = (s) => coerceQueryVal(s);
+                if (v.includes(',')) {
+                    const arr = v
+                        .split(',')
+                        .map((s) => s.trim())
+                        .filter(Boolean)
+                        .map(tryNumOrBool);
+                    filter[k] = { $in: arr };
+                }
+                else if (v.startsWith('!')) {
+                    filter[k] = { $ne: tryNumOrBool(v.slice(1)) };
+                }
+                else if (/^(gt|gte|lt|lte):/i.test(v)) {
+                    const [op, rest] = v.split(':', 2);
+                    const map = {
+                        gt: '$gt',
+                        gte: '$gte',
+                        lt: '$lt',
+                        lte: '$lte',
+                    };
+                    filter[k] = { [map[op.toLowerCase()]]: tryNumOrBool(rest) };
+                }
+                else {
+                    filter[k] = tryNumOrBool(v);
+                }
+            }
+            const pctx = ctxFromReq(req);
+            const schemaPolicy = {
+                allowedMethods: schema.allowedMethods,
+                access: schema.access,
+            };
+            const rdec = (0, authorize_1.authorize)(modelNameLC, 'read', schemaPolicy, pctx);
+            if (!rdec.allow) {
+                return res.status(403).json({ error: true, message: 'forbidden' });
+            }
+            const baseSort = buildSortSpec();
+            const finalFilter = (0, authorize_1.andFilter)(filter, rdec.queryFilter || {});
+            const isUsersModel = modelNameLC === 'user' ||
+                modelNameLC === 'users' ||
+                (schema?.modelName ?? '').toLowerCase() === 'users';
+            const currentUserId = req?.user?.id;
+            // EXTENDED PATH
+            if (schema.extends) {
+                const baseName = String(schema.extends);
+                const baseLC = baseName.toLowerCase();
+                const baseSchema = ctx.getSchema(baseLC);
+                const baseModel = ctx.getModel(baseLC);
+                const baseKeys = new Set(Object.keys(baseSchema.attributes || {}));
+                const { child: childFilter, base: extBaseFilter } = (0, utils_1.splitFilterForExtended)(finalFilter, baseKeys);
+                const { child: childSort, base: extBaseSort } = (0, utils_1.splitSortForExtended)(baseSort, baseKeys);
+                const needPrivateForHydrate = true;
+                const requiresBaseProcessing = Object.keys(extBaseFilter).length > 0 ||
+                    Object.keys(extBaseSort).length > 0;
+                let childRows = [];
+                if (requiresBaseProcessing) {
+                    childRows = await model.read(childFilter, 0, 0, needPrivateForHydrate);
+                }
+                else {
+                    childRows = await model.read(childFilter, limit, page * limit, needPrivateForHydrate, {
+                        sort: Object.keys(childSort).length ? childSort : undefined,
+                    });
+                }
+                const baseIds = Array.from(new Set(childRows
+                    .map((r) => (0, utils_1.toIdString)(r?.baseId))
+                    .filter((s) => !!s)));
+                const baseDocs = baseIds.length
+                    ? await baseModel.read({ id: { $in: baseIds } }, baseIds.length, 0, !!rdec.exposePrivate)
+                    : [];
+                const baseMap = new Map(baseDocs.map((b) => [String(b.id), b]));
+                let merged = childRows.map((row) => {
+                    const bid = (0, utils_1.toIdString)(row?.baseId);
+                    const b = bid ? baseMap.get(bid) : null;
+                    const m = b ? { ...b, ...row } : { ...row };
+                    delete m.baseId;
+                    return m;
+                });
+                if (Object.keys(extBaseFilter).length) {
+                    merged = merged.filter((m) => (0, utils_1.matchDoc)(m, extBaseFilter));
+                }
+                const combinedSort = { ...extBaseSort, ...childSort };
+                if (Object.keys(combinedSort).length) {
+                    merged = (0, utils_1.sortInMemory)(merged, combinedSort);
+                }
+                if (currentUserId && isUsersModel) {
+                    merged = merged.filter((r) => String(r?.id) !== String(currentUserId));
+                }
+                let totalRows;
+                let paged;
+                if (requiresBaseProcessing) {
+                    totalRows = merged.length;
+                    const start = page * limit;
+                    paged = merged.slice(start, start + limit);
+                }
+                else {
+                    totalRows = await model.count(childFilter);
+                    paged = merged.slice(0, limit);
+                }
+                const data = rdec.exposePrivate
+                    ? (0, authorize_1.applyReadMaskMany)(paged, rdec.sensitiveMask)
+                    : (0, authorize_1.applyReadMaskMany)(paged, rdec.readMask);
+                return res.status(200).json({
+                    success: true,
+                    message: `Data fetched for ${schema.modelName}`,
+                    data,
+                    pagination: { totalRows, page, limit },
+                    sort: combinedSort,
+                });
+            }
+            // NON-EXTENDED
+            const sort = baseSort;
+            const totalRows = await model.count(finalFilter);
+            let rawRows = [];
+            const exposePrivateForRead = !!rdec.exposePrivate;
+            try {
+                rawRows = await model.read(finalFilter, limit + 1, page * limit, exposePrivateForRead, { sort });
+            }
+            catch {
+                rawRows = await model.read(finalFilter, limit + 1, page * limit, exposePrivateForRead);
+                if (sort && Object.keys(sort).length) {
+                    const orderKeys = Object.keys(sort);
+                    rawRows.sort((a, b) => {
+                        for (const k of orderKeys) {
+                            const dir = sort[k];
+                            const av = a?.[k];
+                            const bv = b?.[k];
+                            const ax = av instanceof Date ? +av : (av?.toString?.() ?? av);
+                            const bx = bv instanceof Date ? +bv : (bv?.toString?.() ?? bv);
+                            if (ax == null && bx == null)
+                                continue;
+                            if (ax == null)
+                                return 1 * dir;
+                            if (bx == null)
+                                return -1 * dir;
+                            if (ax > bx)
+                                return 1 * dir;
+                            if (ax < bx)
+                                return -1 * dir;
+                        }
+                        return 0;
+                    });
+                }
+            }
+            let rows = currentUserId && isUsersModel
+                ? rawRows
+                    .filter((r) => String(r?.id) !== String(currentUserId))
+                    .slice(0, limit)
+                : rawRows.slice(0, limit);
+            const data = rdec.exposePrivate
+                ? (0, authorize_1.applyReadMaskMany)(rows, rdec.sensitiveMask)
+                : (0, authorize_1.applyReadMaskMany)(rows, rdec.readMask);
+            return res.status(200).json({
+                success: true,
+                message: `Data fetched for ${schema.modelName}`,
+                data,
+                pagination: { totalRows, page, limit },
+                sort,
+            });
+        }
+        catch (error) {
+            if (error?.code === 'MODEL_REMOVED') {
+                return res.status(410).json({ error: true, message: error.message });
+            }
+            return res.status(400).json({ error: true, message: error.message });
+        }
+    });
+    // ----------------- READ (by id) -----------------
+    router.get(`${basePath}/:id`, mwRead, async (req, res) => {
+        try {
+            const schema = ctx.getSchema(modelNameLC);
+            if (!schema.allowedMethods.read) {
+                return res
+                    .status(405)
+                    .json({ error: true, message: 'Method not allowed' });
+            }
+            const model = ctx.getModel(modelNameLC);
+            const pctx = ctxFromReq(req);
+            const schemaPolicy = {
+                allowedMethods: schema.allowedMethods,
+                access: schema.access,
+            };
+            const decForInclude = (0, authorize_1.authorize)(modelNameLC, 'read', schemaPolicy, pctx);
+            const needPrivateForHydrate = !!schema.extends;
+            const exposePrivateForRead = needPrivateForHydrate || !!decForInclude.exposePrivate;
+            const recordArr = await model.read({ id: req.params.id }, 1, 0, exposePrivateForRead);
+            const doc = recordArr?.[0];
+            if (!doc) {
+                return res
+                    .status(404)
+                    .json({ error: true, message: `${schema.modelName} not found` });
+            }
+            const dec = (0, authorize_1.authorize)(modelNameLC, 'read', schemaPolicy, pctx, doc);
+            if (!dec.allow)
+                return res.status(403).json({ error: true, message: 'forbidden' });
+            let toReturn = doc;
+            if (schema.extends) {
+                const baseName = String(schema.extends);
+                const baseLC = baseName.toLowerCase();
+                const baseModel = ctx.getModel(baseLC);
+                const baseIdStr = (0, utils_1.toIdString)(doc?.baseId);
+                if (baseIdStr) {
+                    const [baseDoc] = await baseModel.read({ id: baseIdStr }, 1, 0, !!dec.exposePrivate);
+                    if (baseDoc) {
+                        toReturn = { ...baseDoc, ...doc };
+                    }
+                }
+                if (toReturn)
+                    delete toReturn.baseId;
+            }
+            const data = dec.exposePrivate
+                ? (0, authorize_1.applyReadMaskOne)(toReturn, dec.sensitiveMask)
+                : (0, authorize_1.applyReadMaskOne)(toReturn, dec.readMask);
+            return res.status(200).json({
+                success: true,
+                message: `${schema.modelName} found`,
+                data,
+            });
+        }
+        catch (error) {
+            if (error?.code === 'MODEL_REMOVED')
+                return res.status(410).json({ error: true, message: error.message });
+            Logger_1.default.error('error', error.message);
+            res.status(400).json({ error: true, message: error.message });
+        }
+    });
+    // ----------------- UPDATE -----------------
+    router.put(`${basePath}/:id`, mwUpdate, async (req, res) => {
+        try {
+            const schema = ctx.getSchema(modelNameLC);
+            if (!schema.allowedMethods.update) {
+                return res
+                    .status(405)
+                    .json({ error: true, message: 'Method not allowed' });
+            }
+            const model = ctx.getModel(modelNameLC);
+            const beforeArr = await model.read({ id: req.params.id }, 1, 0, true);
+            const before = beforeArr?.[0];
+            const pctx = ctxFromReq(req);
+            const schemaPolicy = {
+                allowedMethods: schema.allowedMethods,
+                access: schema.access,
+            };
+            const udec = (0, authorize_1.authorize)(modelNameLC, 'update', schemaPolicy, pctx, before);
+            if (!udec.allow) {
+                return res.status(403).json({ error: true, message: 'forbidden' });
+            }
+            let upd = { ...req.body };
+            (0, authorize_1.enforceRestrictions)(upd, udec.restrictions, pctx);
+            if (!udec.exposePrivate)
+                upd = (0, authorize_1.stripWriteDeny)(upd, udec.writeDeny);
+            upd = (0, fieldCodecs_1.coerceForStorage)(schema, upd);
+            if (modelNameLC === 'users' &&
+                Object.prototype.hasOwnProperty.call(upd, 'password')) {
+                if (!upd.password) {
+                    delete upd.password;
+                }
+                else if (ctx.jwtSecret) {
+                    const salt = await bcrypt_1.default.genSalt(10);
+                    upd.password = await bcrypt_1.default.hash(String(upd.password) + ctx.jwtSecret, salt);
+                }
+            }
+            const missing = ctx.validateRequiredFields(schema, upd, 'update');
+            if (missing.length) {
+                return res.status(400).json({
+                    error: true,
+                    message: `Missing required fields: ${missing.join(', ')}`,
+                });
+            }
+            // Extended
+            if (schema.extends) {
+                const baseName = String(schema.extends);
+                const baseLC = baseName.toLowerCase();
+                const baseSchema = ctx.getSchema(baseLC);
+                const baseModel = ctx.getModel(baseLC);
+                const baseIdRaw = before?.baseId;
+                const baseId = (0, utils_1.toIdString)(baseIdRaw);
+                if (!baseId) {
+                    return res.status(400).json({
+                        error: true,
+                        message: 'Invalid extended record: missing baseId',
+                    });
+                }
+                const baseUpd = {};
+                const childUpd = {};
+                for (const [k, v] of Object.entries(upd)) {
+                    if (k === 'baseId')
+                        continue;
+                    if (baseSchema.attributes[k])
+                        baseUpd[k] = v;
+                    else
+                        childUpd[k] = v;
+                }
+                const baseConflicts = await ctx.checkUniqueFields(baseSchema, baseUpd, baseId);
+                if (baseConflicts && baseConflicts.length) {
+                    return res.status(400).json({
+                        error: true,
+                        message: 'There are some error while updating record.',
+                        fields: baseConflicts.map((field) => ({
+                            field,
+                            error: true,
+                            message: `You cannot use this ${field}. It's already been used.`,
+                        })),
+                    });
+                }
+                const childConflicts = await ctx.checkUniqueFields(schema, childUpd, req.params.id);
+                if (childConflicts && childConflicts.length) {
+                    return res.status(400).json({
+                        error: true,
+                        message: 'There are some error while updating record.',
+                        fields: childConflicts.map((field) => ({
+                            field,
+                            error: true,
+                            message: `You cannot use this ${field}. It's already been used.`,
+                        })),
+                    });
+                }
+                if (baseLC === 'users' &&
+                    Object.prototype.hasOwnProperty.call(baseUpd, 'password')) {
+                    if (!baseUpd.password) {
+                        delete baseUpd.password;
+                    }
+                    else if (ctx.jwtSecret) {
+                        const salt = await bcrypt_1.default.genSalt(10);
+                        baseUpd.password = await bcrypt_1.default.hash(String(baseUpd.password) + ctx.jwtSecret, salt);
+                    }
+                }
+                let updatedChild = before;
+                if (Object.keys(childUpd).length) {
+                    updatedChild = await model.update(req.params.id, childUpd);
+                }
+                if (Object.keys(baseUpd).length) {
+                    await baseModel.update(baseId, baseUpd);
+                }
+                const [refChild] = await model.read({ id: String(updatedChild.id) }, 1, 0, true);
+                const [refBase] = await baseModel.read({ id: baseId }, 1, 0, true);
+                let responseDoc = refChild && refBase ? { ...refBase, ...refChild } : updatedChild;
+                if (responseDoc)
+                    delete responseDoc.baseId;
+                const masked = udec.exposePrivate
+                    ? (0, authorize_1.applyReadMaskOne)(responseDoc, udec.sensitiveMask)
+                    : (0, authorize_1.applyReadMaskOne)(responseDoc, udec.readMask);
+                return res.json(masked);
+            }
+            // non-extended
+            const conflicts = await ctx.checkUniqueFields(schema, upd, req.params.id);
+            if (conflicts && conflicts.length) {
+                return res.status(400).json({
+                    error: true,
+                    message: 'There are some error while updating record.',
+                    fields: conflicts.map((field) => ({
+                        field,
+                        error: true,
+                        message: `You cannot use this ${field}. It's already been used.`,
+                    })),
+                });
+            }
+            const updatedRecord = await model.update(req.params.id, upd);
+            let responseDoc = updatedRecord;
+            if (udec.exposePrivate && updatedRecord?.id) {
+                const refetched = await model.read({ id: updatedRecord.id }, 1, 0, true);
+                if (refetched?.[0])
+                    responseDoc = refetched[0];
+            }
+            const masked = udec.exposePrivate
+                ? (0, authorize_1.applyReadMaskOne)(responseDoc, udec.sensitiveMask)
+                : (0, authorize_1.applyReadMaskOne)(responseDoc, udec.readMask);
+            return res.json(masked);
+        }
+        catch (error) {
+            if (error?.code === 'MODEL_REMOVED') {
+                return res.status(410).json({ error: true, message: error.message });
+            }
+            ctx.handleWriteError(error, res);
+        }
+    });
+    // ----------------- DELETE -----------------
+    router.delete(`${basePath}/:id`, mwDelete, async (req, res) => {
+        try {
+            const schema = ctx.getSchema(modelNameLC);
+            if (!schema.allowedMethods.delete) {
+                return res
+                    .status(405)
+                    .json({ error: true, message: 'Method not allowed' });
+            }
+            const model = ctx.getModel(modelNameLC);
+            const docArr = await model.read({ id: req.params.id }, 1, 0, true);
+            const doc = docArr?.[0];
+            const pctx = ctxFromReq(req);
+            const schemaPolicy = {
+                allowedMethods: schema.allowedMethods,
+                access: schema.access,
+            };
+            const ddec = (0, authorize_1.authorize)(modelNameLC, 'delete', schemaPolicy, pctx, doc);
+            if (!ddec.allow)
+                return res.status(403).json({ error: true, message: 'forbidden' });
+            if (schema.extends) {
+                const baseName = String(schema.extends);
+                const baseLC = baseName.toLowerCase();
+                const baseModel = ctx.getModel(baseLC);
+                const baseId = doc?.baseId;
+                const deletedChild = await model.delete(req.params.id);
+                if (baseId) {
+                    try {
+                        await baseModel.delete(String(baseId));
+                    }
+                    catch { }
+                }
+                const merged = baseId
+                    ? { ...deletedChild, baseId: undefined }
+                    : deletedChild;
+                const masked = ddec.exposePrivate
+                    ? (0, authorize_1.applyReadMaskOne)(merged, ddec.sensitiveMask)
+                    : (0, authorize_1.applyReadMaskOne)(merged, ddec.readMask);
+                return res.json({
+                    success: true,
+                    message: `We have deleted the record successfully.`,
+                    data: masked,
+                });
+            }
+            const deletedRecord = await model.delete(req.params.id);
+            if (!deletedRecord) {
+                return res
+                    .status(404)
+                    .json({ error: true, message: `${schema.modelName} not found` });
+            }
+            const masked = ddec.exposePrivate
+                ? (0, authorize_1.applyReadMaskOne)(deletedRecord, ddec.sensitiveMask)
+                : (0, authorize_1.applyReadMaskOne)(deletedRecord, ddec.readMask);
+            return res.json({
+                success: true,
+                message: `We have deleted the record successfully.`,
+                data: masked,
+            });
+        }
+        catch (error) {
+            if (error?.code === 'MODEL_REMOVED')
+                return res.status(410).json({ error: true, message: error.message });
+            res.status(400).json({ error: true, message: error.message });
+        }
+    });
+}