@airoom/nextmin-node 1.4.6 → 2.0.1

package/dist/api/router/mountCrudRoutes.js

@@ -8,6 +8,33 @@ const bcrypt_1 = __importDefault(require("bcrypt"));
 const Logger_1 = __importDefault(require("../../utils/Logger"));
 const fieldCodecs_1 = require("../../utils/fieldCodecs");
 const authorize_1 = require("../../policy/authorize");
+const QueryEngine_1 = require("../../database/QueryEngine");
+async function injectActionRelatedData(ctx, schema, rows) {
+    const actionsWithRelated = schema.actions?.filter((a) => a.relatedModel && a.relatedField);
+    if (!actionsWithRelated?.length || rows.length === 0)
+        return;
+    const ids = rows.map((r) => String(r.id));
+    for (const action of actionsWithRelated) {
+        try {
+            const model = ctx.getModel(action.relatedModel.toLowerCase());
+            if (model) {
+                // Precise grouping lookup instead of limited read()
+                const relatedMap = await model.findFirstRelatedIds(action.relatedField, ids);
+                for (const row of rows) {
+                    if (!row._actionsData)
+                        row._actionsData = {};
+                    const matchedId = relatedMap.get(String(row.id));
+                    if (matchedId) {
+                        row._actionsData[action.relatedModel] = matchedId;
+                    }
+                }
+            }
+        }
+        catch (err) {
+            Logger_1.default.error('mountCrudRoutes', `Error fetching related data for action ${action.label}:`, err);
+        }
+    }
+}
 const utils_1 = require("./utils");
 function mountCrudRoutes(ctx, modelNameLC) {
     const { router } = ctx;
@@ -99,25 +126,62 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 const basePayload = {};
                 const childPayload = {};
                 for (const [k, v] of Object.entries(payload)) {
-                    if (baseSchema.attributes[k])
+                    if (k === 'baseId') {
+                        childPayload[k] = v;
+                        continue;
+                    }
+                    const baseAttr = baseSchema.attributes[k];
+                    const childAttr = schema.attributes[k];
+                    const bHead = Array.isArray(baseAttr) ? baseAttr[0] : baseAttr;
+                    const cHead = Array.isArray(childAttr) ? childAttr[0] : childAttr;
+                    if (bHead?.safe === true) {
                         basePayload[k] = v;
-                    else if (k !== 'baseId')
+                    }
+                    else if (cHead && !cHead.inherited) {
+                        childPayload[k] = v;
+                    }
+                    else if (baseAttr) {
+                        basePayload[k] = v;
+                    }
+                    else {
                         childPayload[k] = v;
+                    }
                 }
-                if (baseLC === 'users' && basePayload.password && ctx.jwtSecret) {
-                    const salt = await bcrypt_1.default.genSalt(10);
-                    basePayload.password = await bcrypt_1.default.hash(String(basePayload.password) + ctx.jwtSecret, salt);
+                const isUserExt = baseLC === 'users';
+                const baseId = payload.baseId;
+                let baseCreated;
+                if (isUserExt && baseId) {
+                    // Use existing user
+                    const arr = await baseModel.read({ id: baseId }, 1, 0, true);
+                    baseCreated = arr?.[0];
+                    if (!baseCreated) {
+                        return res.status(400).json({ error: true, message: 'Associate user account not found.' });
+                    }
                 }
-                const baseConflicts = await ctx.checkUniqueFields(baseSchema, basePayload);
-                if (baseConflicts && baseConflicts.length) {
-                    return res.status(400).json({
-                        error: true,
-                        fields: baseConflicts.map((field) => ({
-                            field,
-                            error: true,
-                            message: `You cannot use this ${field}. It's already been used.`,
-                        })),
-                    });
+                else {
+                    // Normal flow: create base record if we have enough data
+                    const baseMissing = ctx.validateRequiredFields(baseSchema, basePayload, 'create');
+                    // Only attempt creation if at least one base field is provided or if it's not a UserExt?
+                    // Actually, for UserExt, if baseId is missing and they didn't fill user fields (which are hidden),
+                    // we should skip base creation and just create the child.
+                    if (baseMissing.length === 0 && Object.keys(basePayload).length > 0) {
+                        if (baseLC === 'users' && basePayload.password && ctx.jwtSecret) {
+                            const salt = await bcrypt_1.default.genSalt(10);
+                            basePayload.password = await bcrypt_1.default.hash(String(basePayload.password) + ctx.jwtSecret, salt);
+                        }
+                        const baseConflicts = await ctx.checkUniqueFields(baseSchema, basePayload);
+                        if (baseConflicts && baseConflicts.length) {
+                            return res.status(400).json({
+                                error: true,
+                                fields: baseConflicts.map((field) => ({
+                                    field,
+                                    error: true,
+                                    message: `You cannot use this ${field}. It's already been used.`,
+                                })),
+                            });
+                        }
+                        baseCreated = await baseModel.create(basePayload);
+                    }
                 }
                 const childConflicts = await ctx.checkUniqueFields(schema, childPayload);
                 if (childConflicts && childConflicts.length) {
@@ -130,24 +194,35 @@ function mountCrudRoutes(ctx, modelNameLC) {
                         })),
                     });
                 }
-                const baseCreated = await baseModel.create(basePayload);
-                const childToCreate = { ...childPayload, baseId: baseCreated.id };
+                const childToCreate = { ...childPayload, baseId: baseCreated?.id || null };
                 const childCreated = await model.create(childToCreate);
-                let resultDoc = { ...baseCreated, ...childCreated };
-                resultDoc.exId = String(baseCreated.id);
-                resultDoc.id = String(childCreated.id);
+                let resultDoc = baseCreated
+                    ? { ...baseCreated, ...childCreated }
+                    : { ...childCreated };
+                if (baseCreated) {
+                    resultDoc.exId = String(baseCreated.id || baseCreated._id || '');
+                }
+                resultDoc.id = String(childCreated?.id || childCreated?._id || resultDoc.id || '');
                 resultDoc._id = resultDoc.id;
-                delete resultDoc.baseId;
-                delete resultDoc.baseId;
+                if (resultDoc.baseId)
+                    resultDoc.baseId = String(resultDoc.baseId);
+                // delete resultDoc.baseId; // Preserve baseId for frontend use
                 if (cdec.exposePrivate && childCreated?.id) {
                     const [refChild] = await model.read({ id: childCreated.id }, 1, 0, true);
-                    const [refBase] = await baseModel.read({ id: baseCreated.id }, 1, 0, true);
-                    if (refChild && refBase) {
-                        resultDoc = { ...refBase, ...refChild };
-                        resultDoc.exId = String(refBase.id ?? refBase._id);
+                    let refBase = null;
+                    if (baseCreated) {
+                        const [b] = await baseModel.read({ id: baseCreated.id }, 1, 0, true);
+                        refBase = b;
+                    }
+                    if (refChild) {
+                        resultDoc = refBase ? { ...refBase, ...refChild } : { ...refChild };
+                        if (refBase)
+                            resultDoc.exId = String(refBase.id ?? refBase._id);
                         resultDoc.id = String(refChild.id ?? refChild._id);
                         resultDoc._id = resultDoc.id;
-                        delete resultDoc.baseId;
+                        if (resultDoc.baseId)
+                            resultDoc.baseId = String(resultDoc.baseId);
+                        // delete resultDoc.baseId; // Preserve baseId
                     }
                 }
                 const masked = cdec.exposePrivate
@@ -199,8 +274,8 @@ function mountCrudRoutes(ctx, modelNameLC) {
                     .json({ error: true, message: 'Method not allowed' });
             }
             const model = ctx.getModel(modelNameLC);
-            const page = Number.parseInt(String(req.query.page ?? '0'), 10) || 0;
-            const limit = Number.parseInt(String(req.query.limit ?? '10'), 10) || 10;
+            const baseKeys = new Set(Object.keys(schema.attributes || {}));
+            const { limit, page, skip, sort, projection } = (0, utils_1.parseQuery)(req, baseKeys);
             const q = String(req.query.q ?? '').trim();
             const searchKey = String(req.query.searchKey ?? '').trim();
             const searchKeysCSV = String(req.query.searchKeys ?? '').trim();
@@ -210,127 +285,7 @@ function mountCrudRoutes(ctx, modelNameLC) {
             const dateFromStr = String(req.query.dateFrom ?? '').trim();
             const dateToStr = String(req.query.dateTo ?? '').trim();
             let dateKey = String(req.query.dateKey ?? 'createdAt').trim();
-            const sortRaw = String(req.query.sort ?? '').trim();
-            const sortTypeRaw = String(req.query.sortType ?? '').trim();
-            const filter = {};
-            // ---------- SEARCH ----------
-            const ors = [];
-            const ands = [];
-            if (q && searchKey && schema.attributes?.[searchKey]) {
-                const p = (0, utils_1.buildPredicateForField)(searchKey, schema.attributes[searchKey], q);
-                if (p)
-                    ors.push(p);
-            }
-            if (q && searchKeysCSV) {
-                const keys = (0, utils_1.splitCSV)(searchKeysCSV);
-                const preds = keys
-                    .filter((k) => !!schema.attributes?.[k])
-                    .map((k) => (0, utils_1.buildPredicateForField)(k, schema.attributes[k], q))
-                    .filter(Boolean);
-                if (preds.length) {
-                    if (searchMode === 'and')
-                        ands.push(...preds);
-                    else
-                        ors.push(...preds);
-                }
-            }
-            if (ands.length && ors.length)
-                filter.$and = [...ands, { $or: ors }];
-            else if (ands.length)
-                filter.$and = [...(filter.$and || []), ...ands];
-            else if (ors.length)
-                filter.$or = [...(filter.$or || []), ...ors];
-            if (dateFromStr || dateToStr) {
-                if (!schema.attributes?.[dateKey]) {
-                    if (schema.attributes?.createdAt)
-                        dateKey = 'createdAt';
-                    else if (schema.attributes?.updatedAt)
-                        dateKey = 'updatedAt';
-                }
-                if (dateKey && schema.attributes?.[dateKey]) {
-                    const range = {};
-                    if (dateFromStr) {
-                        const d = new Date(dateFromStr);
-                        if (!Number.isNaN(+d))
-                            range.$gte = d;
-                    }
-                    if (dateToStr) {
-                        const d = new Date(dateToStr);
-                        if (!Number.isNaN(+d))
-                            range.$lte = d;
-                    }
-                    if (Object.keys(range).length)
-                        filter[dateKey] = range;
-                }
-            }
-            // ---------- Direct field filters from req.query ----------
-            const RESERVED = new Set([
-                'page',
-                'limit',
-                'q',
-                'searchKey',
-                'searchKeys',
-                'searchMode',
-                'dateFrom',
-                'dateTo',
-                'dateKey',
-                'sort',
-                'sortType',
-            ]);
-            const attrMap = schema.attributes || {};
-            const coerceQueryVal = (raw) => {
-                const s = String(raw).trim();
-                if (/^(true|false)$/i.test(s))
-                    return /^true$/i.test(s);
-                if (/^-?\d+(\.\d+)?$/.test(s))
-                    return Number(s);
-                if (/^null$/i.test(s))
-                    return null;
-                if (/^undefined$/i.test(s))
-                    return undefined;
-                return s;
-            };
-            for (const [k, vRaw] of Object.entries(req.query)) {
-                if (RESERVED.has(k))
-                    continue;
-                if (!Object.prototype.hasOwnProperty.call(attrMap, k))
-                    continue;
-                const v = Array.isArray(vRaw)
-                    ? vRaw.map(String).join(',')
-                    : String(vRaw);
-                if (!v?.length)
-                    continue;
-                // Operators:
-                // - "a,b,c"  -> $in
-                // - "!x"     -> $ne
-                // - "gt:10"  -> {$gt:10}, "gte:10","lt:5","lte:5"
-                // - default  -> exact match
-                const tryNumOrBool = (s) => coerceQueryVal(s);
-                if (v.includes(',')) {
-                    const arr = v
-                        .split(',')
-                        .map((s) => s.trim())
-                        .filter(Boolean)
-                        .map(tryNumOrBool);
-                    filter[k] = { $in: arr };
-                }
-                else if (v.startsWith('!')) {
-                    filter[k] = { $ne: tryNumOrBool(v.slice(1)) };
-                }
-                else if (/^(gt|gte|lt|lte):/i.test(v)) {
-                    const [op, rest] = v.split(':', 2);
-                    const map = {
-                        gt: '$gt',
-                        gte: '$gte',
-                        lt: '$lt',
-                        lte: '$lte',
-                    };
-                    filter[k] = { [map[op.toLowerCase()]]: tryNumOrBool(rest) };
-                }
-                else {
-                    filter[k] = tryNumOrBool(v);
-                }
-            }
+            const filter = QueryEngine_1.QueryEngine.parse(req.query, schema);
             const pctx = ctxFromReq(req);
             const schemaPolicy = {
                 allowedMethods: schema.allowedMethods,
@@ -340,9 +295,6 @@ function mountCrudRoutes(ctx, modelNameLC) {
             if (!rdec.allow) {
                 return res.status(403).json({ error: true, message: 'forbidden' });
             }
-            // ---------- SORT (updated; type-safe; honors client; allows virtual keys) ----------
-            const baseKeys = new Set(Object.keys(schema.attributes || {}));
-            const baseSort = (0, utils_1.parseSort)(sortRaw, sortTypeRaw, baseKeys);
             const finalFilter = (0, authorize_1.andFilter)(filter, rdec.queryFilter || {});
             const isUsersModel = modelNameLC === 'user' ||
                 modelNameLC === 'users' ||
@@ -355,40 +307,31 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 const baseSchema = ctx.getSchema(baseLC);
                 const baseModel = ctx.getModel(baseLC);
                 const baseAttrKeys = new Set(Object.keys(baseSchema.attributes || {}));
+                const childAttrs = schema.attributes || {};
+                for (const k of Object.keys(childAttrs)) {
+                    const cHead = Array.isArray(childAttrs[k]) ? childAttrs[k][0] : childAttrs[k];
+                    if (cHead && !cHead.inherited) {
+                        baseAttrKeys.delete(k);
+                    }
+                }
                 const { child: childFilter, base: extBaseFilter } = (0, utils_1.splitFilterForExtended)(finalFilter, baseAttrKeys);
-                const { child: childSort, base: extBaseSort } = (0, utils_1.splitSortForExtended)(baseSort, baseAttrKeys);
+                const { child: childSort, base: extBaseSort } = (0, utils_1.splitSortForExtended)(sort, baseAttrKeys);
                 const needPrivateForHydrate = true;
                 const requiresBaseProcessing = Object.keys(extBaseFilter).length > 0 ||
                     Object.keys(extBaseSort).length > 0;
-                let childRows = [];
+                let dataRows = [];
                 if (requiresBaseProcessing) {
-                    childRows = await model.read(childFilter, 0, 0, needPrivateForHydrate);
+                    // If we need to filter/sort by base fields, read ALL child rows (already hydrated by adapter)
+                    dataRows = await model.read(childFilter, 0, 0, needPrivateForHydrate, { projection });
                 }
                 else {
-                    childRows = await model.read(childFilter, limit, page * limit, needPrivateForHydrate, { sort: Object.keys(childSort).length ? childSort : undefined });
+                    // Normal paginated read (already hydrated by adapter)
+                    dataRows = await model.read(childFilter, limit, skip, needPrivateForHydrate, {
+                        sort: Object.keys(childSort).length ? childSort : undefined,
+                        projection,
+                    });
                 }
-                // build base map
-                const baseIds = Array.from(new Set(childRows
-                    .map((r) => (0, utils_1.toIdString)(r?.baseId))
-                    .filter((s) => !!s)));
-                const baseDocs = baseIds.length
-                    ? await baseModel.read({ id: { $in: baseIds } }, baseIds.length, 0, !!rdec.exposePrivate)
-                    : [];
-                const baseMap = new Map(baseDocs.map((b) => [String(b.id), b]));
-                // merge, but force merged id to BASE id (single entity identity)
-                let merged = childRows.map((row) => {
-                    const bid = (0, utils_1.toIdString)(row?.baseId);
-                    const base = bid ? baseMap.get(bid) : null;
-                    const m = base ? { ...base, ...row } : { ...row };
-                    // expose base id as exId, keep child's id as id
-                    m.exId = String(base?.id ?? base?._id ?? bid ?? '');
-                    m.id = String(row?.id ?? row?._id);
-                    m._id = m.id;
-                    // optional: keep for trace/debug
-                    m.__childId = m.id;
-                    delete m.baseId;
-                    return m;
-                });
+                let merged = dataRows;
                 // apply base-level filters/sort, then DEDUPE by canonical id
                 if (Object.keys(extBaseFilter).length) {
                     merged = merged.filter((m) => (0, utils_1.matchDoc)(m, extBaseFilter));
@@ -396,10 +339,18 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 const combinedSort = { ...extBaseSort, ...childSort };
                 if (Object.keys(combinedSort).length) {
                     merged = merged.sort((a, b) => {
+                        const getField = (obj, k) => {
+                            if (obj?.[k] !== undefined)
+                                return obj[k];
+                            if (obj?.baseId && typeof obj.baseId === 'object' && obj.baseId[k] !== undefined) {
+                                return obj.baseId[k];
+                            }
+                            return undefined;
+                        };
                         for (const k of Object.keys(combinedSort)) {
                             const dir = combinedSort[k];
-                            const av = a?.[k];
-                            const bv = b?.[k];
+                            const av = getField(a, k);
+                            const bv = getField(b, k);
                             const ax = av instanceof Date ? +av : av;
                             const bx = bv instanceof Date ? +bv : bv;
                             if (ax == null && bx == null)
@@ -426,7 +377,7 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 let paged;
                 if (requiresBaseProcessing) {
                     totalRows = merged.length;
-                    const start = page * limit;
+                    const start = skip;
                     paged = merged.slice(start, start + limit);
                 }
                 else {
@@ -437,6 +388,7 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 const data = rdec.exposePrivate
                     ? (0, authorize_1.applyReadMaskMany)(paged, rdec.sensitiveMask)
                     : (0, authorize_1.applyReadMaskMany)(paged, rdec.readMask);
+                await injectActionRelatedData(ctx, schema, data);
                 return res.status(200).json({
                     success: true,
                     message: `Data fetched for ${schema.modelName}`,
@@ -446,15 +398,14 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 });
             }
             // ---------- NON-EXTENDED ----------
-            const sort = baseSort;
             const totalRows = await model.count(finalFilter);
             let rawRows = [];
             const exposePrivateForRead = !!rdec.exposePrivate;
             try {
-                rawRows = await model.read(finalFilter, limit + 1, page * limit, exposePrivateForRead, { sort });
+                rawRows = await model.read(finalFilter, limit + 1, skip, exposePrivateForRead, { sort, projection });
             }
             catch {
-                rawRows = await model.read(finalFilter, limit + 1, page * limit, exposePrivateForRead);
+                rawRows = await model.read(finalFilter, limit + 1, skip, exposePrivateForRead);
                 if (sort && Object.keys(sort).length) {
                     const orderKeys = Object.keys(sort);
                     rawRows.sort((a, b) => {
@@ -487,6 +438,7 @@ function mountCrudRoutes(ctx, modelNameLC) {
             const data = rdec.exposePrivate
                 ? (0, authorize_1.applyReadMaskMany)(rows, rdec.sensitiveMask)
                 : (0, authorize_1.applyReadMaskMany)(rows, rdec.readMask);
+            await injectActionRelatedData(ctx, schema, data);
             return res.status(200).json({
                 success: true,
                 message: `Data fetched for ${schema.modelName}`,
@@ -512,6 +464,8 @@ function mountCrudRoutes(ctx, modelNameLC) {
                     .json({ error: true, message: 'Method not allowed' });
             }
             const model = ctx.getModel(modelNameLC);
+            const baseKeys = new Set(Object.keys(schema.attributes || {}));
+            const { projection } = (0, utils_1.parseQuery)(req, baseKeys);
             const pctx = ctxFromReq(req);
             const schemaPolicy = {
                 allowedMethods: schema.allowedMethods,
@@ -520,7 +474,16 @@ function mountCrudRoutes(ctx, modelNameLC) {
             const decForInclude = (0, authorize_1.authorize)(modelNameLC, 'read', schemaPolicy, pctx);
             const needPrivateForHydrate = !!schema.extends;
             const exposePrivateForRead = needPrivateForHydrate || !!decForInclude.exposePrivate;
-            const recordArr = await model.read({ id: req.params.id }, 1, 0, exposePrivateForRead);
+            const recordArr = await model.read({ id: req.params.id }, 1, 0, exposePrivateForRead, {
+                projection: (() => {
+                    if (!projection)
+                        return undefined;
+                    if (!schema.extends)
+                        return projection;
+                    // For extended schemas, ensure baseId is included for hydration
+                    return { ...projection, baseId: 1 };
+                })()
+            });
             const doc = recordArr?.[0];
             if (!doc) {
                 return res
@@ -532,22 +495,20 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 return res.status(403).json({ error: true, message: 'forbidden' });
             let toReturn = doc;
             if (schema.extends) {
-                const baseName = String(schema.extends);
-                const baseLC = baseName.toLowerCase();
-                const baseModel = ctx.getModel(baseLC);
-                const baseIdStr = (0, utils_1.toIdString)(doc?.baseId);
-                if (baseIdStr) {
-                    const [baseDoc] = await baseModel.read({ id: baseIdStr }, 1, 0, !!dec.exposePrivate);
-                    if (baseDoc) {
-                        toReturn = { ...baseDoc, ...doc };
-                        toReturn.exId = String(baseDoc.id ?? baseDoc._id ?? baseIdStr);
-                        toReturn.id = String(doc.id ?? doc._id);
-                        toReturn._id = toReturn.id;
-                        delete toReturn.baseId;
+                // Hydration is handled by adapter.
+                // We just ensure exId and baseId consistency if hydrated.
+                if (doc) {
+                    toReturn = { ...doc };
+                    if (!toReturn.exId && toReturn.baseId) {
+                        toReturn.exId = (0, utils_1.toIdString)(toReturn.baseId);
                     }
+                    if (toReturn.id)
+                        toReturn.id = String(toReturn.id);
+                    if (toReturn._id)
+                        toReturn._id = String(toReturn._id);
+                    if (toReturn.baseId)
+                        toReturn.baseId = String(toReturn.baseId);
                 }
-                if (toReturn)
-                    delete toReturn.baseId;
             }
             const data = dec.exposePrivate
                 ? (0, authorize_1.applyReadMaskOne)(toReturn, dec.sensitiveMask)
@@ -614,25 +575,36 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 const baseLC = baseName.toLowerCase();
                 const baseSchema = ctx.getSchema(baseLC);
                 const baseModel = ctx.getModel(baseLC);
-                const baseIdRaw = before?.baseId;
-                const baseId = (0, utils_1.toIdString)(baseIdRaw);
-                if (!baseId) {
-                    return res.status(400).json({
-                        error: true,
-                        message: 'Invalid extended record: missing baseId',
-                    });
-                }
+                // Determine target baseId: prefer payload if changed, otherwise current
+                const targetBaseIdRaw = upd.baseId !== undefined ? upd.baseId : before?.baseId;
+                const targetBaseId = (0, utils_1.toIdString)(targetBaseIdRaw);
                 const baseUpd = {};
                 const childUpd = {};
                 for (const [k, v] of Object.entries(upd)) {
-                    if (k === 'baseId')
+                    if (k === 'baseId') {
+                        childUpd[k] = v;
                         continue;
-                    if (baseSchema.attributes[k])
+                    }
+                    const baseAttr = baseSchema.attributes[k];
+                    const childAttr = schema.attributes[k];
+                    const bHead = Array.isArray(baseAttr) ? baseAttr[0] : baseAttr;
+                    const cHead = Array.isArray(childAttr) ? childAttr[0] : childAttr;
+                    if (bHead?.safe === true) {
                         baseUpd[k] = v;
-                    else
+                    }
+                    else if (cHead && !cHead.inherited) {
                         childUpd[k] = v;
+                    }
+                    else if (baseAttr) {
+                        baseUpd[k] = v;
+                    }
+                    else {
+                        childUpd[k] = v;
+                    }
                 }
-                const baseConflicts = await ctx.checkUniqueFields(baseSchema, baseUpd, baseId);
+                const baseConflicts = targetBaseId
+                    ? await ctx.checkUniqueFields(baseSchema, baseUpd, targetBaseId || undefined)
+                    : null;
                 if (baseConflicts && baseConflicts.length) {
                     return res.status(400).json({
                         error: true,
@@ -670,17 +642,32 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 if (Object.keys(childUpd).length) {
                     updatedChild = await model.update(req.params.id, childUpd);
                 }
-                if (Object.keys(baseUpd).length) {
-                    await baseModel.update(baseId, baseUpd);
+                if (targetBaseId && Object.keys(baseUpd).length) {
+                    await baseModel.update(targetBaseId, baseUpd);
+                }
+                const [refChild] = await model.read({ id: String(req.params.id) }, 1, 0, true);
+                const refBase = targetBaseId
+                    ? (await baseModel.read({ id: targetBaseId }, 1, 0, true))?.[0]
+                    : null;
+                let responseDoc = refChild ? { ...refChild } : { ...updatedChild, id: req.params.id };
+                if (refChild && refBase) {
+                    // Overlap logic: prefer child value if it's set/not-empty
+                    responseDoc = { ...refBase };
+                    for (const k of Object.keys(refChild)) {
+                        const val = refChild[k];
+                        const hasValue = val != null && (!Array.isArray(val) || val.length > 0);
+                        if (hasValue) {
+                            responseDoc[k] = val;
+                        }
+                    }
                 }
-                const [refChild] = await model.read({ id: String(updatedChild.id) }, 1, 0, true);
-                const [refBase] = await baseModel.read({ id: baseId }, 1, 0, true);
-                let responseDoc = refChild && refBase ? { ...refBase, ...refChild } : updatedChild;
                 if (responseDoc) {
-                    responseDoc.exId = String(baseId);
-                    responseDoc.id = String((refChild?.id ?? updatedChild?.id));
+                    responseDoc.exId = String(targetBaseId || '');
+                    responseDoc.id = String(req.params.id);
                     responseDoc._id = responseDoc.id;
-                    delete responseDoc.baseId;
+                    if (responseDoc.baseId)
+                        responseDoc.baseId = String(responseDoc.baseId);
+                    // delete (responseDoc as any).baseId;
                 }
                 const masked = udec.exposePrivate
                     ? (0, authorize_1.applyReadMaskOne)(responseDoc, udec.sensitiveMask)

package/dist/api/router/mountFindRoutes.js

@@ -83,31 +83,7 @@ function mountFindRoutes(ctx) {
             else {
                 items = await ctx.getModel(targetLC).read({ id: { $in: ids } }, limit, skip, !!tDec.exposePrivate);
             }
-            // extended hydration if needed
-            if (targetSchema.extends && Array.isArray(items) && items.length) {
-                const baseName = String(targetSchema.extends);
-                const baseLC = baseName.toLowerCase();
-                const baseModel = ctx.getModel(baseLC);
-                const baseIds = Array.from(new Set(items.map((it) => it?.baseId).filter(Boolean)));
-                if (baseIds.length) {
-                    const baseDocs = await baseModel.read({ id: { $in: baseIds } }, baseIds.length, 0, !!tDec.exposePrivate);
-                    const baseMap = new Map(baseDocs.map((b) => [String(b?.id ?? b?._id), b]));
-                    items = items.map((it) => {
-                        const bid = String(it?.baseId || "");
-                        const b = bid ? baseMap.get(bid) : null;
-                        const merged = b ? { ...b, ...it } : { ...it };
-                        delete merged.baseId;
-                        return merged;
-                    });
-                }
-                else {
-                    items = items.map((it) => {
-                        const copy = { ...it };
-                        delete copy.baseId;
-                        return copy;
-                    });
-                }
-            }
+            // extended hydration is handled by adapter.read/findMany
             const masked = tDec.exposePrivate ? (0, authorize_1.applyReadMaskMany)(items, tDec.sensitiveMask) : (0, authorize_1.applyReadMaskMany)(items, tDec.readMask);
             const totalRows = ids.length;
             return res.status(200).json({
@@ -163,30 +139,7 @@ function mountFindRoutes(ctx) {
                 totalRows = all.length;
                 items = all.slice(skip, skip + limit);
             }
-            if (targetSchema.extends && Array.isArray(items) && items.length) {
-                const baseName = String(targetSchema.extends);
-                const baseLC = baseName.toLowerCase();
-                const baseModel = ctx.getModel(baseLC);
-                const baseIds = Array.from(new Set(items.map((it) => it?.baseId).filter(Boolean)));
-                if (baseIds.length) {
-                    const baseDocs = await baseModel.read({ id: { $in: baseIds } }, baseIds.length, 0, !!tDec.exposePrivate);
-                    const baseMap = new Map(baseDocs.map((b) => [String(b?.id ?? b?._id), b]));
-                    items = items.map((it) => {
-                        const bid = String(it?.baseId || "");
-                        const b = bid ? baseMap.get(bid) : null;
-                        const merged = b ? { ...b, ...it } : { ...it };
-                        delete merged.baseId;
-                        return merged;
-                    });
-                }
-                else {
-                    items = items.map((it) => {
-                        const copy = { ...it };
-                        delete copy.baseId;
-                        return copy;
-                    });
-                }
-            }
+            // extended hydration is handled by adapter.read/findMany
             const masked = tDec.exposePrivate ? (0, authorize_1.applyReadMaskMany)(items, tDec.sensitiveMask) : (0, authorize_1.applyReadMaskMany)(items, tDec.readMask);
             return res.status(200).json({
                 success: true,