@airoom/nextmin-node 2.0.1 → 2.0.3

package/dist/api/router/mountCrudRoutes.js

@@ -36,6 +36,35 @@ async function injectActionRelatedData(ctx, schema, rows) {
     }
 }
 const utils_1 = require("./utils");
+/**
+ * For User-extending schemas: strip inherited fields from a response doc
+ * when no base user is linked (baseId is null/empty).
+ * This keeps API responses clean — no null Username, First Name, etc.
+ */
+function stripInheritedIfNoBase(doc, schema) {
+    if (!doc || !schema?.extends)
+        return doc;
+    const isUserExt = String(schema.extends).toLowerCase() === 'users';
+    if (!isUserExt)
+        return doc;
+    const hasBase = !!(doc.baseId || doc.exId);
+    if (hasBase)
+        return doc;
+    const attrs = schema.attributes || {};
+    const result = { ...doc };
+    for (const [key, attr] of Object.entries(attrs)) {
+        const head = Array.isArray(attr) ? attr[0] : attr;
+        if (head?.inherited) {
+            delete result[key];
+        }
+    }
+    return result;
+}
+function stripInheritedIfNoBaseMany(docs, schema) {
+    if (!schema?.extends)
+        return docs;
+    return docs.map(d => stripInheritedIfNoBase(d, schema));
+}
 function mountCrudRoutes(ctx, modelNameLC) {
     const { router } = ctx;
     const basePath = `/${modelNameLC}`;
@@ -93,7 +122,14 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 return res.status(403).json({ error: true, message: 'forbidden' });
             }
             let payload = (0, authorize_1.mergeCreateDefaults)(req.body, cdec.createDefaults);
-            (0, authorize_1.enforceRestrictions)(payload, cdec.restrictions, pctx);
+            // Apply schema attribute defaults if missing in the request body
+            // For extended schemas, skip defaults for inherited attributes (they belong to the base record)
+            for (const [key, attr] of Object.entries(schema.attributes || {})) {
+                if (!Array.isArray(attr) && attr?.default !== undefined && payload[key] === undefined && !attr?.inherited) {
+                    payload[key] = attr.default;
+                }
+            }
+            await (0, authorize_1.enforceRestrictions)(payload, cdec.restrictions, pctx, ctx);
             if (!cdec.exposePrivate)
                 payload = (0, authorize_1.stripWriteDeny)(payload, cdec.writeDeny);
             payload = (0, fieldCodecs_1.coerceForStorage)(schema, payload);
@@ -126,6 +162,9 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 const basePayload = {};
                 const childPayload = {};
                 for (const [k, v] of Object.entries(payload)) {
+                    if (k === 'id' || k === '_id' || k === 'exId' || k === 'createdAt' || k === 'updatedAt') {
+                        continue;
+                    }
                     if (k === 'baseId') {
                         childPayload[k] = v;
                         continue;
@@ -164,7 +203,13 @@ function mountCrudRoutes(ctx, modelNameLC) {
                     // Only attempt creation if at least one base field is provided or if it's not a UserExt?
                     // Actually, for UserExt, if baseId is missing and they didn't fill user fields (which are hidden),
                     // we should skip base creation and just create the child.
-                    if (baseMissing.length === 0 && Object.keys(basePayload).length > 0) {
+                    // For User extensions: only create a base user if meaningful user fields
+                    // are explicitly provided (not just auto-injected defaults like status, type, role)
+                    const AUTO_DEFAULT_KEYS = new Set(['status', 'type', 'role', 'createdBy']);
+                    const hasMeaningfulBaseData = isUserExt
+                        ? Object.keys(basePayload).some(k => !AUTO_DEFAULT_KEYS.has(k))
+                        : Object.keys(basePayload).length > 0;
+                    if (baseMissing.length === 0 && hasMeaningfulBaseData) {
                         if (baseLC === 'users' && basePayload.password && ctx.jwtSecret) {
                             const salt = await bcrypt_1.default.genSalt(10);
                             basePayload.password = await bcrypt_1.default.hash(String(basePayload.password) + ctx.jwtSecret, salt);
@@ -231,7 +276,7 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 return res.status(201).json({
                     success: true,
                     message: `${schema.modelName} has been created successfully.`,
-                    data: masked,
+                    data: stripInheritedIfNoBase(masked, schema),
                 });
             }
             // non-extended
@@ -275,7 +320,7 @@ function mountCrudRoutes(ctx, modelNameLC) {
             }
             const model = ctx.getModel(modelNameLC);
             const baseKeys = new Set(Object.keys(schema.attributes || {}));
-            const { limit, page, skip, sort, projection } = (0, utils_1.parseQuery)(req, baseKeys);
+            const { limit, page, skip, sort, projection, _populate } = (0, utils_1.parseQuery)(req, baseKeys);
             const q = String(req.query.q ?? '').trim();
             const searchKey = String(req.query.searchKey ?? '').trim();
             const searchKeysCSV = String(req.query.searchKeys ?? '').trim();
@@ -296,6 +341,14 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 return res.status(403).json({ error: true, message: 'forbidden' });
             }
             const finalFilter = (0, authorize_1.andFilter)(filter, rdec.queryFilter || {});
+            const countBy = String(req.query.countBy ?? '').trim();
+            if (countBy && schema.attributes[countBy]) {
+                const counts = await ctx.dbAdapter.countBy(schema.modelName, countBy, finalFilter, schema);
+                return res.status(200).json({
+                    success: true,
+                    counts,
+                });
+            }
             const isUsersModel = modelNameLC === 'user' ||
                 modelNameLC === 'users' ||
                 (schema?.modelName ?? '').toLowerCase() === 'users';
@@ -322,13 +375,14 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 let dataRows = [];
                 if (requiresBaseProcessing) {
                     // If we need to filter/sort by base fields, read ALL child rows (already hydrated by adapter)
-                    dataRows = await model.read(childFilter, 0, 0, needPrivateForHydrate, { projection });
+                    dataRows = await model.read(childFilter, 0, 0, needPrivateForHydrate, { projection, _populate });
                 }
                 else {
                     // Normal paginated read (already hydrated by adapter)
                     dataRows = await model.read(childFilter, limit, skip, needPrivateForHydrate, {
                         sort: Object.keys(childSort).length ? childSort : undefined,
                         projection,
+                        _populate,
                     });
                 }
                 let merged = dataRows;
@@ -369,9 +423,6 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 }
                 // **dedupe**: one row per base entity
                 merged = (0, utils_1.dedupeBy)(merged, (r) => String(r.exId || r.id || r._id || ''));
-                if (currentUserId && isUsersModel) {
-                    merged = merged.filter((r) => String(r?.id) !== String(currentUserId));
-                }
                 // pagination + totals
                 let totalRows;
                 let paged;
@@ -392,7 +443,7 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 return res.status(200).json({
                     success: true,
                     message: `Data fetched for ${schema.modelName}`,
-                    data,
+                    data: stripInheritedIfNoBaseMany(data, schema),
                     pagination: { totalRows, page, limit },
                     sort: combinedSort,
                 });
@@ -402,7 +453,7 @@ function mountCrudRoutes(ctx, modelNameLC) {
             let rawRows = [];
             const exposePrivateForRead = !!rdec.exposePrivate;
             try {
-                rawRows = await model.read(finalFilter, limit + 1, skip, exposePrivateForRead, { sort, projection });
+                rawRows = await model.read(finalFilter, limit + 1, skip, exposePrivateForRead, { sort, projection, _populate });
             }
             catch {
                 rawRows = await model.read(finalFilter, limit + 1, skip, exposePrivateForRead);
@@ -430,11 +481,7 @@ function mountCrudRoutes(ctx, modelNameLC) {
                     });
                 }
             }
-            let rows = currentUserId && isUsersModel
-                ? rawRows
-                    .filter((r) => String(r?.id) !== String(currentUserId))
-                    .slice(0, limit)
-                : rawRows.slice(0, limit);
+            let rows = rawRows.slice(0, limit);
             const data = rdec.exposePrivate
                 ? (0, authorize_1.applyReadMaskMany)(rows, rdec.sensitiveMask)
                 : (0, authorize_1.applyReadMaskMany)(rows, rdec.readMask);
@@ -516,7 +563,7 @@ function mountCrudRoutes(ctx, modelNameLC) {
             return res.status(200).json({
                 success: true,
                 message: `${schema.modelName} found`,
-                data,
+                data: stripInheritedIfNoBase(data, schema),
             });
         }
         catch (error) {
@@ -548,9 +595,18 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 return res.status(403).json({ error: true, message: 'forbidden' });
             }
             let upd = { ...req.body };
-            (0, authorize_1.enforceRestrictions)(upd, udec.restrictions, pctx);
+            await (0, authorize_1.enforceRestrictions)(upd, udec.restrictions, pctx, ctx);
             if (!udec.exposePrivate)
                 upd = (0, authorize_1.stripWriteDeny)(upd, udec.writeDeny);
+            // Enforce schema readOnly / non-editable fields on update
+            if (schema?.attributes) {
+                for (const [attrName, attrDef] of Object.entries(schema.attributes)) {
+                    const a = Array.isArray(attrDef) ? attrDef[0] : attrDef;
+                    if (a?.readOnly === true || a?.editable === false) {
+                        delete upd[attrName];
+                    }
+                }
+            }
             upd = (0, fieldCodecs_1.coerceForStorage)(schema, upd);
             if (modelNameLC === 'users' &&
                 Object.prototype.hasOwnProperty.call(upd, 'password')) {
@@ -581,6 +637,9 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 const baseUpd = {};
                 const childUpd = {};
                 for (const [k, v] of Object.entries(upd)) {
+                    if (k === 'id' || k === '_id' || k === 'exId' || k === 'createdAt' || k === 'updatedAt') {
+                        continue;
+                    }
                     if (k === 'baseId') {
                         childUpd[k] = v;
                         continue;
@@ -640,7 +699,7 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 }
                 let updatedChild = before;
                 if (Object.keys(childUpd).length) {
-                    updatedChild = await model.update(req.params.id, childUpd);
+                    updatedChild = await model.update(req.params.id, childUpd, false, before);
                 }
                 if (targetBaseId && Object.keys(baseUpd).length) {
                     await baseModel.update(targetBaseId, baseUpd);
@@ -672,7 +731,7 @@ function mountCrudRoutes(ctx, modelNameLC) {
                 const masked = udec.exposePrivate
                     ? (0, authorize_1.applyReadMaskOne)(responseDoc, udec.sensitiveMask)
                     : (0, authorize_1.applyReadMaskOne)(responseDoc, udec.readMask);
-                return res.json(masked);
+                return res.json(stripInheritedIfNoBase(masked, schema));
             }
             // non-extended
             const conflicts = await ctx.checkUniqueFields(schema, upd, req.params.id);
@@ -687,7 +746,7 @@ function mountCrudRoutes(ctx, modelNameLC) {
                     })),
                 });
             }
-            const updatedRecord = await model.update(req.params.id, upd);
+            const updatedRecord = await model.update(req.params.id, upd, false, before);
             let responseDoc = updatedRecord;
             if (udec.exposePrivate && updatedRecord?.id) {
                 const refetched = await model.read({ id: updatedRecord.id }, 1, 0, true);