@airoom/nextmin-node 2.0.2 → 2.0.3

package/dist/database/QueryEngine.js

@@ -126,22 +126,25 @@ class QueryEngine {
             }
             if (!attr)
                 continue;
+            const a = Array.isArray(attr) ? attr[0] : attr;
+            const attrType = a && String(a.type || '').toLowerCase();
+            const isStringField = attrType === 'string' || attrType === 'text';
             const v = Array.isArray(vRaw) ? vRaw.map(String).join(',') : String(vRaw);
             if (!v?.length)
                 continue;
             if (v.includes(',')) {
-                filter[effectiveKey] = { $in: v.split(',').map(s => this.coerceValue(s.trim())) };
+                filter[effectiveKey] = { $in: v.split(',').map(s => isStringField ? s.trim() : this.coerceValue(s.trim())) };
             }
             else if (v.startsWith('!')) {
-                filter[effectiveKey] = { $ne: this.coerceValue(v.slice(1)) };
+                filter[effectiveKey] = { $ne: isStringField ? v.slice(1) : this.coerceValue(v.slice(1)) };
             }
             else if (/^(gt|gte|lt|lte):/i.test(v)) {
                 const [op, rest] = v.split(':', 2);
                 const map = { gt: '$gt', gte: '$gte', lt: '$lt', lte: '$lte' };
-                filter[effectiveKey] = { [map[op.toLowerCase()]]: this.coerceValue(rest) };
+                filter[effectiveKey] = { [map[op.toLowerCase()]]: isStringField ? rest : this.coerceValue(rest) };
             }
             else {
-                filter[effectiveKey] = this.coerceValue(v);
+                filter[effectiveKey] = isStringField ? v : this.coerceValue(v);
             }
         }
         return filter;

package/dist/files/FileStorageAdapter.d.ts

@@ -36,6 +36,7 @@ export interface FileStorageAdapter {
     delete(key: string): Promise<{
         deleted: boolean;
     }>;
+    exists?(key: string): Promise<boolean>;
     /** Optional helpers */
     getPublicUrl?(key: string): string | null;
     getSignedUrl?(key: string, expiresInSeconds?: number): Promise<string>;

package/dist/files/LocalFileStorageAdapter.d.ts

@@ -8,6 +8,7 @@ export declare class LocalFileStorageAdapter implements FileStorageAdapter {
     private uploadDir;
     private publicUrlPrefix;
     constructor(options: LocalFileStorageOptions);
+    exists(key: string): Promise<boolean>;
     upload(input: UploadPayload): Promise<UploadResult>;
     download(key: string): Promise<{
         body: any;

package/dist/files/LocalFileStorageAdapter.js

@@ -18,11 +18,33 @@ class LocalFileStorageAdapter {
             fs_1.default.mkdirSync(this.uploadDir, { recursive: true });
         }
     }
+    async exists(key) {
+        const filePath = path_1.default.join(this.uploadDir, key);
+        return fs_1.default.existsSync(filePath);
+    }
     async upload(input) {
-        const originalName = input.originalFilename || 'unknown-file';
-        const randomId = crypto_1.default.randomBytes(4).toString('hex');
-        const uniqueName = input.key || (0, filename_1.filenameWithRandomId)(originalName, randomId);
+        let uniqueName = input.key;
+        if (!uniqueName) {
+            if (input.originalFilename) {
+                const lastDot = input.originalFilename.lastIndexOf('.');
+                const hasExt = lastDot > 0 && lastDot < input.originalFilename.length - 1;
+                const nameWithoutExt = hasExt ? input.originalFilename.slice(0, lastDot) : input.originalFilename;
+                const ext = hasExt ? input.originalFilename.slice(lastDot).toLowerCase() : '';
+                const randomId = crypto_1.default.randomBytes(4).toString('hex');
+                const cleanName = (0, filename_1.slugify)(nameWithoutExt) || randomId;
+                uniqueName = `${cleanName}${ext}`;
+            }
+            else {
+                uniqueName = crypto_1.default.randomBytes(8).toString('hex');
+            }
+        }
         const filePath = path_1.default.join(this.uploadDir, uniqueName);
+        if (fs_1.default.existsSync(filePath)) {
+            const err = new Error(`File '${uniqueName}' already exists in storage. Please rename the file manually and try again.`);
+            err.statusCode = 409;
+            err.code = 'FILE_EXISTS';
+            throw err;
+        }
         const writeStream = fs_1.default.createWriteStream(filePath);
         // Convert body to stream if it is a Buffer
         const readStream = new stream_1.Readable();

package/dist/files/S3FileStorageAdapter.d.ts

@@ -20,6 +20,7 @@ export declare class S3FileStorageAdapter implements FileStorageAdapter {
     private readonly forcePathStyle;
     private readonly defaultACL?;
     private readonly publicBaseUrl?;
+    private readonly credentials?;
     constructor(opts: S3AdapterOptions);
     upload(input: UploadPayload): Promise<UploadResult>;
     download(key: string): Promise<{
@@ -30,6 +31,7 @@ export declare class S3FileStorageAdapter implements FileStorageAdapter {
     delete(key: string): Promise<{
         deleted: boolean;
     }>;
+    exists(key: string): Promise<boolean>;
     getPublicUrl(key: string): string;
-    private randomKey;
+    private buildKey;
 }

package/dist/files/S3FileStorageAdapter.js

@@ -16,24 +16,49 @@ class S3FileStorageAdapter {
         this.forcePathStyle = opts.forcePathStyle ?? true; // sane default for MinIO
         this.defaultACL = opts.defaultACL;
         this.publicBaseUrl = opts.publicBaseUrl;
+        this.credentials = opts.credentials;
         this.s3 = new client_s3_1.S3Client({
             region: this.regionStr,
             endpoint: this.endpoint,
             forcePathStyle: this.forcePathStyle,
             credentials: opts.credentials,
+            requestChecksumCalculation: 'WHEN_REQUIRED',
         });
     }
     async upload(input) {
         if (!input.body)
             throw new Error('S3 upload: "body" is required');
-        const key = input.key ?? this.randomKey(input.originalFilename);
+        const key = input.key ?? this.buildKey(input.originalFilename);
+        const alreadyExists = await this.exists(key);
+        if (alreadyExists) {
+            const filename = key.split('/').pop() || key;
+            const err = new Error(`File '${filename}' already exists in storage. Please rename the file manually and try again.`);
+            err.statusCode = 409;
+            err.code = 'FILE_EXISTS';
+            throw err;
+        }
+        const sanitizedMetadata = {};
+        if (input.metadata) {
+            for (const [k, v] of Object.entries(input.metadata)) {
+                if (typeof v === 'string') {
+                    // Replace non-ascii spaces (e.g. narrow no-break space U+202F, no-break space U+00A0)
+                    // and keep only printable ASCII characters (0x20 to 0x7E) to satisfy S3 metadata specs.
+                    sanitizedMetadata[k] = v
+                        .replace(/[\u200B-\u200D\uFEFF\u202F\u00A0]/g, ' ')
+                        .replace(/[^\x20-\x7E]/g, '');
+                }
+                else {
+                    sanitizedMetadata[k] = String(v);
+                }
+            }
+        }
         // Build params without ACL by default
         const params = {
             Bucket: this.bucket,
             Key: key,
             Body: input.body,
             ContentType: input.contentType,
-            Metadata: input.metadata,
+            Metadata: sanitizedMetadata,
             CacheControl: input.contentType?.startsWith('image/')
                 ? 'public, max-age=31536000, immutable'
                 : 'public, max-age=86400',
@@ -43,7 +68,27 @@ class S3FileStorageAdapter {
         if (this.endpoint && this.defaultACL) {
             params.ACL = this.defaultACL;
         }
-        await this.s3.send(new client_s3_1.PutObjectCommand(params));
+        try {
+            await this.s3.send(new client_s3_1.PutObjectCommand(params));
+        }
+        catch (err) {
+            console.error('[R2 UPLOAD ERROR] PutObject failed:', {
+                bucket: this.bucket,
+                key: key,
+                contentType: input.contentType,
+                endpoint: this.endpoint,
+                region: this.regionStr,
+                forcePathStyle: this.forcePathStyle,
+                defaultACL: this.defaultACL,
+                hasCredentials: !!this.credentials,
+                accessKeyIdLength: this.credentials?.accessKeyId?.length,
+                secretAccessKeyLength: this.credentials?.secretAccessKey?.length,
+                accessKeyIdStart: this.credentials?.accessKeyId?.slice(0, 4),
+                secretAccessKeyStart: this.credentials?.secretAccessKey?.slice(0, 4),
+            });
+            console.error('[R2 UPLOAD ERROR] Detailed Error:', err);
+            throw err;
+        }
         const url = this.getPublicUrl(key);
         return {
             provider: 's3',
@@ -73,6 +118,18 @@ class S3FileStorageAdapter {
         await this.s3.send(new client_s3_1.DeleteObjectCommand({ Bucket: this.bucket, Key: key }));
         return { deleted: true };
     }
+    async exists(key) {
+        try {
+            await this.s3.send(new client_s3_1.HeadObjectCommand({ Bucket: this.bucket, Key: key }));
+            return true;
+        }
+        catch (err) {
+            if (err.name === 'NotFound' || err.name === 'NoSuchKey' || err.$metadata?.httpStatusCode === 404) {
+                return false;
+            }
+            return false;
+        }
+    }
     getPublicUrl(key) {
         const encKey = encodeKeySegments(key);
         if (this.publicBaseUrl) {
@@ -86,19 +143,23 @@ class S3FileStorageAdapter {
         return `https://${this.bucket}.s3.${this.regionStr}.amazonaws.com/${encKey}`;
     }
     // ---- private helpers ----
-    randomKey(originalFilename) {
+    buildKey(originalFilename) {
         const ts = new Date();
         const y = ts.getUTCFullYear();
         const m = String(ts.getUTCMonth() + 1).padStart(2, '0');
         const d = String(ts.getUTCDate()).padStart(2, '0');
+        if (originalFilename) {
+            const lastDot = originalFilename.lastIndexOf('.');
+            const hasExt = lastDot > 0 && lastDot < originalFilename.length - 1;
+            const nameWithoutExt = hasExt ? originalFilename.slice(0, lastDot) : originalFilename;
+            const ext = hasExt ? originalFilename.slice(lastDot).toLowerCase() : '';
+            const randomId = Math.random().toString(36).slice(2, 10);
+            const cleanName = (0, filename_1.slugify)(nameWithoutExt) || randomId;
+            const filename = `${cleanName}${ext}`;
+            return `uploads/${y}/${m}/${d}/${filename}`;
+        }
         const randomId = Math.random().toString(36).slice(2, 10);
-        // Generate filename: slugified-name-randomid.ext or just randomid if no original name
-        const filename = originalFilename
-            ? (0, filename_1.filenameWithRandomId)(originalFilename, randomId)
-            : randomId;
-        // Path: uploads/YYYY/MM/DD/filename
-        const fullPath = `uploads/${y}/${m}/${d}/${filename}`;
-        return fullPath;
+        return `uploads/${y}/${m}/${d}/${randomId}`;
     }
 }
 exports.S3FileStorageAdapter = S3FileStorageAdapter;

package/dist/files/filename.js

@@ -16,13 +16,15 @@ function sanitizeFilename(name) {
  * Example: "My Photo (2024).jpg" → "my-photo-2024.jpg"
  */
 function slugify(text) {
+    if (!text)
+        return '';
     return text
         .toLowerCase()
         .trim()
         // Replace spaces and underscores with hyphens
         .replace(/[\s_]+/g, '-')
-        // Remove special characters except hyphens, dots, and alphanumeric
-        .replace(/[^\w\-\.]+/g, '')
+        // Remove special characters except hyphens, dots, and alphanumeric/Unicode letters & marks
+        .replace(/[^\p{L}\p{N}\p{M}\-_.]+/gu, '')
         // Replace multiple consecutive hyphens with single hyphen
         .replace(/-+/g, '-')
         // Remove leading/trailing hyphens
@@ -40,8 +42,8 @@ function filenameWithRandomId(originalName, randomId) {
     const ext = hasExt ? originalName.slice(lastDot) : '';
     // Slugify the name part
     const slugifiedName = slugify(nameWithoutExt);
-    // Combine: slugified-name-randomid.ext
-    const result = `${slugifiedName}-${randomId}${ext}`;
+    // Combine: slugified-name-randomid.ext (or randomid.ext if empty)
+    const result = slugifiedName ? `${slugifiedName}-${randomId}${ext}` : `${randomId}${ext}`;
     return result;
 }
 function withTimestampPrefix(name) {

package/dist/index.d.ts

@@ -8,6 +8,7 @@ export * from './files/FileStorageAdapter';
 export * from './files/S3FileStorageAdapter';
 export * from './files/LocalFileStorageAdapter';
 export * from './files/filename';
+export { reindex } from './services/IndexingService';
 /**
  * Compose the public router:
  * - JSON & urlencoded body parsers

package/dist/index.js

@@ -17,7 +17,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateApiKey = exports.Events = exports.events = exports.QueryEngine = exports.NMAdapter = void 0;
+exports.reindex = exports.generateApiKey = exports.Events = exports.events = exports.QueryEngine = exports.NMAdapter = void 0;
 exports.createNextMinRouter = createNextMinRouter;
 const express_1 = __importDefault(require("express"));
 const body_parser_1 = __importDefault(require("body-parser"));
@@ -36,6 +36,8 @@ __exportStar(require("./files/FileStorageAdapter"), exports);
 __exportStar(require("./files/S3FileStorageAdapter"), exports);
 __exportStar(require("./files/LocalFileStorageAdapter"), exports);
 __exportStar(require("./files/filename"), exports);
+var IndexingService_1 = require("./services/IndexingService");
+Object.defineProperty(exports, "reindex", { enumerable: true, get: function () { return IndexingService_1.reindex; } });
 function isMultipart(req) {
     const ct = (req.headers['content-type'] || '').toLowerCase();
     return ct.startsWith('multipart/form-data');

package/dist/models/BaseModel.d.ts

@@ -53,6 +53,10 @@ export interface Schema {
     actions?: CustomAction[];
     access?: any;
     aggregates?: AggregateSpec[];
+    publicRegisterFields?: string[];
+    roleDefaultStatuses?: Record<string, string>;
+    authServices?: string[];
+    phoneVerification?: boolean;
 }
 export interface AggregateSpec {
     sourceModel: string;

package/dist/policy/authorize.d.ts

@@ -21,5 +21,5 @@ export declare function applyReadMaskOne(doc: any, mask?: string[]): any;
 export declare function applyReadMaskMany(docs: any[], mask?: string[]): any[];
 export declare function stripWriteDeny(payload: any, deny?: string[]): any;
 export declare function mergeCreateDefaults(payload: any, defs?: Record<string, any>): any;
-export declare function enforceRestrictions(payload: any, restrictions?: Record<string, any>, _ctx?: PolicyContext): void;
+export declare function enforceRestrictions(payload: any, restrictions?: Record<string, any>, _ctx?: PolicyContext, routerCtx?: any): Promise<void>;
 export declare function andFilter(a?: Record<string, any>, b?: Record<string, any>): Record<string, any>;

package/dist/policy/authorize.js

@@ -59,22 +59,51 @@ function asBool(v) {
     return typeof v === 'boolean' ? v : undefined;
 }
 function ownerKey(schemaPolicy) {
-    const by = schemaPolicy?.conditions?.owner?.by;
+    const by = schemaPolicy?.conditions?.owner?.by || schemaPolicy?.access?.conditions?.owner?.by;
     return typeof by === 'string' && by.trim() ? by.trim() : 'id';
 }
-function ownerFilter(schemaPolicy, ctx) {
-    const key = ownerKey(schemaPolicy);
+function ownerFilter(schemaPolicy, ctx, modelNameLC) {
     if (!ctx.userId)
         return {};
+    const isUserModel = modelNameLC === 'users' || modelNameLC === 'user';
+    if (isUserModel) {
+        if (ctx.role === 'admin') {
+            return {
+                or: [
+                    { id: ctx.userId },
+                    { createdBy: ctx.userId }
+                ]
+            };
+        }
+        return { id: ctx.userId };
+    }
+    const key = ownerKey(schemaPolicy);
     return { [key]: ctx.userId };
 }
-function isOwnerDoc(schemaPolicy, ctx, doc) {
+function isOwnerDoc(schemaPolicy, ctx, doc, modelNameLC) {
     if (!doc || !ctx.userId)
         return false;
+    const isUserModel = modelNameLC === 'users' || modelNameLC === 'user';
+    if (isUserModel) {
+        const isSelf = String(doc.id ?? doc._id ?? '') === String(ctx.userId);
+        const isCreator = doc.createdBy && String(typeof doc.createdBy === 'object' ? (doc.createdBy.id ?? doc.createdBy._id ?? doc.createdBy) : doc.createdBy) === String(ctx.userId);
+        if (ctx.role === 'admin') {
+            return isSelf || isCreator;
+        }
+        return isSelf;
+    }
     const key = ownerKey(schemaPolicy);
     const val = doc[key];
     if (val == null)
         return false;
+    if (Array.isArray(val)) {
+        return val.some((v) => {
+            if (v == null)
+                return false;
+            const candidate = typeof v === 'object' ? (v.id ?? v._id ?? String(v)) : String(v);
+            return String(candidate) === String(ctx.userId);
+        });
+    }
     const candidate = typeof val === 'object' ? (val.id ?? val._id ?? String(val)) : String(val);
     return String(candidate) === String(ctx.userId);
 }
@@ -121,6 +150,20 @@ function authorize(modelNameLC, action, schemaPolicy, ctx, doc) {
     const allowed = !!schemaPolicy?.allowedMethods?.[action];
     if (!allowed)
         return { ...EMPTY_DECISION, allow: false };
+    // Bypass all access rules for superadmin and admin roles
+    if (ctx.isSuperadmin || ctx.role === 'superadmin' || ctx.role === 'admin') {
+        const sensitiveMask = computeSensitiveMask(schemaPolicy);
+        return {
+            allow: true,
+            readMask: sensitiveMask,
+            writeDeny: [],
+            createDefaults: {},
+            restrictions: {},
+            queryFilter: {},
+            exposePrivate: true,
+            sensitiveMask,
+        };
+    }
     const access = schemaPolicy?.access || {};
     const baseReadMask = [].concat(access?.readMask || []);
     // Auto-mask private attributes
@@ -228,7 +271,7 @@ function authorize(modelNameLC, action, schemaPolicy, ctx, doc) {
             if (action === 'read') {
                 if (doc) {
                     return finalize({
-                        allow: isOwnerDoc(schemaPolicy, ctx, doc),
+                        allow: isOwnerDoc(schemaPolicy, ctx, doc, modelNameLC),
                         readMask: effectiveReadMask,
                         writeDeny: effectiveWriteDeny,
                         createDefaults: {},
@@ -244,13 +287,13 @@ function authorize(modelNameLC, action, schemaPolicy, ctx, doc) {
                     writeDeny: effectiveWriteDeny,
                     createDefaults: {},
                     restrictions: {},
-                    queryFilter: ownerFilter(schemaPolicy, ctx),
+                    queryFilter: ownerFilter(schemaPolicy, ctx, modelNameLC),
                     exposePrivate: bypass,
                     sensitiveMask,
                 });
             }
             return finalize({
-                allow: isOwnerDoc(schemaPolicy, ctx, doc),
+                allow: isOwnerDoc(schemaPolicy, ctx, doc, modelNameLC),
                 readMask: effectiveReadMask,
                 writeDeny: effectiveWriteDeny,
                 createDefaults: {},
@@ -289,7 +332,7 @@ function authorize(modelNameLC, action, schemaPolicy, ctx, doc) {
         if (action === 'read') {
             if (doc) {
                 return finalize({
-                    allow: isOwnerDoc(schemaPolicy, ctx, doc),
+                    allow: isOwnerDoc(schemaPolicy, ctx, doc, modelNameLC),
                     readMask: effectiveReadMask,
                     writeDeny: effectiveWriteDeny,
                     createDefaults: {},
@@ -305,13 +348,13 @@ function authorize(modelNameLC, action, schemaPolicy, ctx, doc) {
                 writeDeny: effectiveWriteDeny,
                 createDefaults: {},
                 restrictions: {},
-                queryFilter: ownerFilter(schemaPolicy, ctx),
+                queryFilter: ownerFilter(schemaPolicy, ctx, modelNameLC),
                 exposePrivate: bypass,
                 sensitiveMask,
             });
         }
         return finalize({
-            allow: isOwnerDoc(schemaPolicy, ctx, doc),
+            allow: isOwnerDoc(schemaPolicy, ctx, doc, modelNameLC),
             readMask: effectiveReadMask,
             writeDeny: effectiveReadMask, // (typo guard: will be ignored by callers; leave as is)
             createDefaults: {},
@@ -360,12 +403,20 @@ function mergeCreateDefaults(payload, defs) {
         return payload;
     return { ...defs, ...payload };
 }
-function enforceRestrictions(payload, restrictions, _ctx) {
+async function enforceRestrictions(payload, restrictions, _ctx, routerCtx) {
     if (!payload || !restrictions)
         return;
     for (const [field, blocked] of Object.entries(restrictions)) {
-        if (Array.isArray(blocked) && blocked.includes(payload[field])) {
-            throw new Error(`Restricted value for field: ${field}`);
+        let val = payload[field];
+        if (val != null) {
+            if (field === 'role' && routerCtx?.normalizeRoleName) {
+                const resolvedRole = await routerCtx.normalizeRoleName(val);
+                if (resolvedRole)
+                    val = resolvedRole;
+            }
+            if (Array.isArray(blocked) && blocked.map(String).includes(String(val))) {
+                throw new Error(`Restricted value for field: ${field}`);
+            }
         }
     }
 }

package/dist/schemas/Users.json

@@ -68,13 +68,18 @@
       "default": "user",
       "required": true,
       "safe": true
+    },
+    "createdBy": {
+      "type": "ObjectId",
+      "ref": "Users",
+      "private": true
     }
   },
   "allowedMethods": {
     "create": true,
     "read": true,
     "update": true,
-    "delete": false
+    "delete": true
   },
   "access": {
     "public": {
@@ -87,14 +92,14 @@
       "create": false,
       "read": "owner",
       "update": "owner",
-      "delete": false
+      "delete": "owner"
     },
     "roles": {
       "admin": {
         "create": true,
         "read": true,
-        "update": true,
-        "delete": false
+        "update": "owner",
+        "delete": "owner"
       },
       "superadmin": {
         "create": true,
@@ -141,17 +146,22 @@
         "status": "pending"
       },
       "roles.admin": {
-        "status": "active"
+        "status": "active",
+        "createdBy": "$CTX.userId"
       },
       "roles.superadmin": {
-        "status": "active"
+        "status": "active",
+        "createdBy": "$CTX.userId"
       }
     },
     "restrictions": {
-      "roles.admin.cannotAssign": {
-        "role": [
-          "superadmin"
-        ]
+      "roles": {
+        "admin": {
+          "role": [
+            "superadmin",
+            "admin"
+          ]
+        }
       }
     }
   }

package/dist/services/IndexingService.d.ts

@@ -0,0 +1,24 @@
+import { ChatWidgetConfig } from '../api/apiRouter';
+export declare class IndexingService {
+    private chatWidget;
+    private force;
+    private dbAdapter?;
+    private itemKeyToId;
+    constructor(chatWidget: ChatWidgetConfig, force?: boolean, dbAdapter?: any);
+    private getManifestPath;
+    private readManifest;
+    private writeManifest;
+    private getScrapedPagesDir;
+    private writeScrapedPageLocal;
+    private deleteScrapedPageLocal;
+    private fetchSitemapUrls;
+    crawlSite(siteUrl: string, startPaths?: string[], concurrency?: number): Promise<Map<string, string>>;
+    private extractInternalLinks;
+    private indexDatabaseSchemas;
+    runIndex(): Promise<void>;
+}
+export declare function reindex(config: {
+    chatWidget: ChatWidgetConfig;
+    force?: boolean;
+    dbAdapter?: any;
+}): Promise<void>;