@anteros/core 0.0.2 → 0.0.3

package/server/api.ts

@@ -31,7 +31,6 @@ const ActionsValues = [
     'deleteMany',
     'findOne',
     'find',
-    'findOneAndUpdate',
     'runService',
     'upload',
     'auth',
@@ -40,9 +39,86 @@ const ActionsValues = [
     'aggregate',
 ] as const;
 
+// ─── Helpers ───────────────────────────────────────────────────────────────
 
+function getAccessToken(c: any) {
+    const t = c.get('token');
+    return {
+        value: (t?.value ?? null) as string | null,
+        decoded: (t?.decoded ?? null) as Record<string, unknown> | null,
+        provided: (t?.provided ?? false) as boolean,
+        expired: (t?.expired ?? false) as boolean,
+    };
+}
+
+function errorResponse(c: any, err: any) {
+    const isAppError = err instanceof AppError;
+    const status = isAppError ? Number(err.status) : 500;
+    return c.json({
+        message: isAppError ? err.message : 'Internal server error',
+        code: isAppError ? err.code : 'INTERNAL_SERVER_ERROR',
+        meta: isAppError ? err.meta : undefined,
+    }, status);
+}
+
+function stripReadOnlyData(col: any, body: any) {
+    if (col?.api?.readOnlyFields?.length && body?.data) {
+        body.data = func.omit(body.data, col.api.readOnlyFields);
+    }
+}
+
+function stripReadOnlyUpdate(col: any, body: any) {
+    if (col?.api?.readOnlyFields?.length && body?.update) {
+        body.update = func.omit(body.update, col.api.readOnlyFields);
+    }
+}
 
-// ─── File access helper ────────────────────────────────────────────────────
+// ─── Access control helpers ──────────────────────────────────────────────────
+
+async function evaluateAccess(
+    access: { [key: string]: boolean | ((ctx: any) => boolean | Promise<boolean>) | undefined } | undefined,
+    operation: string,
+    rest: InstanceType<typeof useRest>,
+    label: string,
+    c: any,
+): Promise<void> {
+    if (!access) {
+        throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
+    }
+
+    const hasWildcard = access['*'] !== undefined;
+    const hasSpecific = access[operation] !== undefined;
+
+    if (!hasWildcard && !hasSpecific) {
+        throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
+    }
+
+    const rule = hasSpecific ? access[operation] : access['*'];
+    if (rule === undefined) return;
+
+    // Boolean `true` → allow without requiring a token
+    if (typeof rule === 'boolean') {
+        if (!rule) {
+            throw new AppError(`${label} not allowed`, { status: 401, code: 'ACCESS_DENIED' });
+        }
+        return;
+    }
+
+    // Function → requires a valid token
+    const accessToken = getAccessToken(c);
+
+    if (accessToken.expired) {
+        throw new AppError('Token expired', { status: 401, code: 'TOKEN_EXPIRED' });
+    }
+    if (!accessToken.value) {
+        throw new AppError('Authentication required', { status: 401, code: 'AUTH_REQUIRED' });
+    }
+
+    const allowed = await (rule as Function)({ rest, error: fn.error, jwt: func.jwt, token: accessToken });
+    if (!allowed) {
+        throw new AppError(`${label} not allowed`, { status: 401, code: 'ACCESS_DENIED' });
+    }
+}
 
 async function checkFileAccess(
     access: { [key: string]: boolean | ((ctx: any) => boolean | Promise<boolean>) | undefined } | undefined,
@@ -58,12 +134,10 @@ async function checkFileAccess(
     const hasWildcard = access['*'] !== undefined;
     const hasSpecific = access[operation] !== undefined;
 
-    // No matching rule at all → deny
     if (!hasWildcard && !hasSpecific) {
         throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
     }
 
-    // Specific rule takes precedence over wildcard
     const rule = hasSpecific ? access[operation] : access['*'];
     if (rule === undefined) {
         throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
@@ -78,8 +152,7 @@ async function checkFileAccess(
     }
 
     // Function → requires a valid token
-    const t = c.get('token');
-    const accessToken = { value: t?.value ?? null, decoded: t?.decoded ?? null, provided: t?.provided ?? false, expired: t?.expired ?? false };
+    const accessToken = getAccessToken(c);
 
     if (accessToken.expired) {
         throw new AppError('Token expired', { status: 401, code: 'TOKEN_EXPIRED' });
@@ -95,9 +168,23 @@ async function checkFileAccess(
     }
 }
 
-function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
+// ─── CRUD dispatch table ───────────────────────────────────────────────────
 
-    // Crud API
+type CrudHandler = (rest: InstanceType<typeof useRest>, collection: string, body: any) => Promise<any>;
+
+const crudHandlers: Record<string, CrudHandler> = {
+    aggregate:       (rest, collection, body) => rest.aggregate(collection, body?.pipeline || []),
+    find:            (rest, collection, body) => rest.find(collection, body?.params || {}),
+    findOne:         (rest, collection, body) => rest.findOne(collection, body?.id, body?.params || {}),
+    insertOne:       (rest, collection, body) => rest.insertOne(collection, body?.data),
+    insertMany:      (rest, collection, body) => rest.insertMany(collection, body?.data),
+    updateOne:       (rest, collection, body) => rest.updateOne(collection, body?.id || body?._id, body?.update || {}),
+    updateMany:      (rest, collection, body) => rest.updateMany(collection, body?.ids || body?._ids || [], body?.update || {}),
+    deleteOne:       (rest, collection, body) => rest.deleteOne(collection, body?.id || body?._id),
+    deleteMany:      (rest, collection, body) => rest.deleteMany(collection, body?.ids || body?._ids || []),
+};
+
+function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
 
     // tenant middlewares (scoped to their tenant only)
     const tenantMiddlewares = getTenantMiddlewares();
@@ -105,8 +192,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
         app.use(async (c, next) => {
             const url = new URL(c.req.url);
             const segments = url.pathname.split('/').filter(Boolean);
-            const tenantInUrl = segments[1]; // /api/:tenant/... or /services/:tenant/... etc.
-
+            const tenantInUrl = segments[1];
             if (mw._tenant_ === tenantInUrl) {
                 return mw.handler(c, next);
             }
@@ -122,8 +208,8 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
         tenant_id: string;
         action: string;
         collection: string;
-        collectionType?: string;
-        status: string;
+        collectionType?: 'document' | 'file';
+        status: 'success' | 'error';
         input?: any;
         result?: any;
         error?: { message: string; code: string } | null;
@@ -157,619 +243,341 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
         }]);
     }
 
+    // ─── Collection API ─────────────────────────────────────────────────
     app.post(API_PREFIX, async (c) => {
-        let isMultipartOrFormData = false;
         let response: any;
         let body: any;
-        let parseBody: any;
         let rest: InstanceType<typeof useRest>;
         let canAccessToAction: boolean | undefined;
 
         try {
             const ContentType = c.req.header('Content-Type');
             const { action, collection, tenant_id } = c.req.param() as { action: typeof ActionsValues[number], collection: string, tenant_id: string };
-            const { cleanDeep, useCache } = c.req.query() as ApiOptions;
-
-
-
-            // Control request params
-            if (!tenant_id) {
-                throw new AppError('Tenant ID is required', { status: 400, code: 'TENANT_ID_REQUIRED' });
-            }
-
-            if (!collection) {
-                throw new AppError('Collection is required', { status: 400, code: 'COLLECTION_REQUIRED' });
-            }
-
-            if (!action) {
-                throw new AppError('Action is required', { status: 400, code: 'ACTION_REQUIRED' });
-            }
 
+            // Validate params
+            if (!tenant_id) throw new AppError('Tenant ID is required', { status: 400, code: 'TENANT_ID_REQUIRED' });
+            if (!collection) throw new AppError('Collection is required', { status: 400, code: 'COLLECTION_REQUIRED' });
+            if (!action) throw new AppError('Action is required', { status: 400, code: 'ACTION_REQUIRED' });
 
-
-            // Content Type
-            if (ContentType?.includes('application/x-www-form-urlencoded') || ContentType?.includes('multipart/form-data')) {
-                isMultipartOrFormData = true;
-                try {
-                    parseBody = await c.req.parseBody({ all: true });
-                } catch {
-                    throw new AppError('Invalid form data', { status: 400, code: 'INVALID_FORM_DATA' });
-                }
-            }
+            // Parse body
             if (ContentType?.includes('application/json')) {
-                isMultipartOrFormData = false;
-                try {
-                    body = await c.req.json();
-                } catch {
+                try { body = await c.req.json(); } catch {
                     throw new AppError('Invalid JSON body', { status: 400, code: 'INVALID_JSON_BODY' });
                 }
+            } else if (ContentType?.includes('multipart/form-data') || ContentType?.includes('application/x-www-form-urlencoded')) {
+                try { body = await c.req.parseBody({ all: true }); } catch {
+                    throw new AppError('Invalid form data', { status: 400, code: 'INVALID_FORM_DATA' });
+                }
             }
 
-
-
             if (!cfg.tenants.find(t => t.id === tenant_id)) {
                 throw new AppError('Tenant `' + tenant_id + '` not found', { status: 400, code: 'TENANT_NOT_FOUND' });
             }
 
-
-            // Collection
-            let col = getCollection(collection, tenant_id)
+            const col = getCollection(collection, tenant_id)
             if (!col) {
                 throw new AppError('Collection `' + collection + '` not found', { status: 400, code: 'COLLECTION_NOT_FOUND' });
             }
 
-            //console.log('Has action:', col?.actions?.hasOwnProperty(action))
-
             if (!ActionsValues.includes(action as (typeof ActionsValues)[number]) && !Object.hasOwn(col?.actions ?? {}, action)) {
                 throw new AppError('Action `' + action + '` not found', { status: 400, code: 'ACTION_NOT_FOUND' });
             }
 
             const fieldOrder = ['_id', ...col.fields.map(f => f.name)];
             const privateFields = col.api?.privateFields || [];
+            const accessToken = getAccessToken(c);
 
+            rest = new useRest({ internal: false, tenant_id, useHook: true });
 
-            // Rest Instance
-            rest = new useRest({
-                internal: false,
-                tenant_id: tenant_id,
-                useHook: true,
-            })
-
-            // Logout Action
-            if (action == 'logout') {
-                const logStart = Date.now()
+            // ── Logout ──
+            if (action === 'logout') {
+                const logStart = Date.now();
                 try {
-                    if (!col?.api?.auth?.enabled) {
-                        throw new AppError('Auth is not enabled', { status: 400, code: 'AUTH_NOT_ENABLED' });
-                    }
-                    if (!col?.api?.auth?.onLogout) {
-                        throw new AppError('Auth onLogout is not defined', { status: 400, code: 'AUTH_HANDLER_NOT_DEFINED' });
-                    }
-                    await col.api?.auth?.onLogout({
-                        rest: rest,
-                        payload: body?.payload,
-                        error: fn.error,
-                        jwt: func.jwt,
-                        req: {
-                            cookies: {
-                                delete: (name: string) => {
-                                    cookie.deleteCookie(c, name)
-                                },
-                            }
-                        }
-                    })
-
-                    await logActivity({
-                        rest, tenant_id, action: 'logout', collection,
-                        status: 'success',
-                        input: { payload: body?.payload },
-                        duration: Date.now() - logStart,
-                    })
-
-                    return c.json({ message: 'Logout successful', ok: true })
+                    if (!col?.api?.auth?.enabled) throw new AppError('Auth is not enabled', { status: 400, code: 'AUTH_NOT_ENABLED' });
+                    if (!col?.api?.auth?.onLogout) throw new AppError('Auth onLogout is not defined', { status: 400, code: 'AUTH_HANDLER_NOT_DEFINED' });
+
+                    await col.api.auth.onLogout({
+                        rest, payload: body?.payload, error: fn.error, jwt: func.jwt,
+                        cookies: { delete: (name: string) => cookie.deleteCookie(c, name) },
+                    });
+
+                    await logActivity({ rest, tenant_id, action: 'logout', collection, status: 'success', input: { payload: body?.payload }, duration: Date.now() - logStart });
+                    return c.json({ message: 'Logout successful', ok: true });
                 } catch (err: any) {
-                    await logActivity({
-                        rest, tenant_id, action: 'logout', collection,
-                        status: 'error',
-                        input: { payload: body?.payload },
-                        error: { message: err?.message, code: err?.code || 'INTERNAL_API_ERROR' },
-                        duration: Date.now() - logStart,
-                    }).catch(() => {})
-                    throw err
+                    await logActivity({ rest, tenant_id, action: 'logout', collection, status: 'error', input: { payload: body?.payload }, error: { message: err?.message, code: err?.code || 'INTERNAL_API_ERROR' }, duration: Date.now() - logStart }).catch(() => {});
+                    throw err;
                 }
             }
 
-
-
-            // Login Action
-            if (action == 'login') {
-                const logStart = Date.now()
+            // ── Login ──
+            if (action === 'login') {
+                const logStart = Date.now();
                 try {
-                    if (!col?.api?.auth?.enabled) {
-                        throw new AppError('Auth is not enabled', { status: 400, code: 'AUTH_NOT_ENABLED' });
+                    if (!col?.api?.auth?.enabled) throw new AppError('Auth is not enabled', { status: 400, code: 'AUTH_NOT_ENABLED' });
+                    if (!col?.api?.auth?.onLogin) throw new AppError('Auth onLogin is not defined', { status: 400, code: 'AUTH_HANDLER_NOT_DEFINED' });
+
+                    const authResult = await col.api.auth.onLogin({
+                        rest, payload: body?.payload, error: fn.error, jwt: func.jwt,
+                        cookies: {
+                            set: (name: string, value: string, opts?: any) => cookie.setCookie(c, name, value, opts),
+                            get: (name: string) => cookie.getCookie(c, name),
+                            delete: (name: string) => cookie.deleteCookie(c, name),
+                        },
+                    });
+
+                    if (!authResult || typeof authResult === 'function' || !('token' in authResult)) {
+                        throw new AppError('Invalid login response', { status: 401, code: 'INVALID_LOGIN' });
                     }
-                    if (!col?.api?.auth?.onLogin) {
-                        throw new AppError('Auth onLogin is not defined', { status: 400, code: 'AUTH_HANDLER_NOT_DEFINED' });
+                    if (!authResult.token) {
+                        throw new AppError('Invalid token assigned', { status: 401, code: 'INVALID_TOKEN_ASSIGNED' });
                     }
-                    const authResult = await col.api?.auth?.onLogin({
-                            rest: rest,
-                            payload: body?.payload,
-                            error: fn.error,
-                            jwt: func.jwt,
-                            req: {
-                                cookies: {
-                                    set: (name: string, value: string, options?: {
-                                        httpOnly?: boolean;
-                                        secure?: boolean;
-                                        maxAge?: number;
-                                        path?: string;
-                                        domain?: string;
-                                        sameSite?: 'lax' | 'strict' | 'none';
-                                    }) => {
-                                        cookie.setCookie(c, name, value, options)
-                                    },
-                                    get: (name: string) => {
-                                        return cookie.getCookie(c, name)
-                                    },
-                                    delete: (name: string) => {
-                                        cookie.deleteCookie(c, name)
-                                    },
-
-                                }
-                            }
-
-                        })
-
-
-
-                        if (!authResult || typeof authResult === 'function' || !('token' in authResult)) {
-                            throw new AppError('Invalid login response', { status: 401, code: 'INVALID_LOGIN' });
-                        }
-
-                        if (!authResult.token) {
-                            throw new AppError('Invalid token assigned', { status: 401, code: 'INVALID_TOKEN_ASSIGNED' });
-                        }
-
-                        const { value, error } = await func.jwt.verify(authResult.token)
-                        if (error) {
-                            throw new AppError('Invalid token', { status: 401, code: 'INVALID_TOKEN' });
-                        }
-
-                    await logActivity({
-                        rest, tenant_id, action: 'login', collection,
-                        status: 'success',
-                        input: { payload: body?.payload },
-                        result: { message: 'Login successful' },
-                        duration: Date.now() - logStart,
-                        token: { decoded: value, value: null, provided: true, expired: false },
-                    })
-
-                    return c.json({ token: authResult.token, data: authResult.data })
+
+                    const { value, error } = await func.jwt.verify(authResult.token);
+                    if (error) throw new AppError('Invalid token', { status: 401, code: 'INVALID_TOKEN' });
+
+                    await logActivity({ rest, tenant_id, action: 'login', collection, status: 'success', input: { payload: body?.payload }, result: { message: 'Login successful' }, duration: Date.now() - logStart, token: { decoded: value, value: null, provided: true, expired: false } });
+                    return c.json({ token: authResult.token, data: authResult.data });
                 } catch (err: any) {
-                    await logActivity({
-                        rest, tenant_id, action: 'login', collection,
-                        status: 'error',
-                        input: { payload: body?.payload },
-                        error: { message: err?.message, code: err?.code || 'INTERNAL_API_ERROR' },
-                        duration: Date.now() - logStart,
-                    }).catch(() => {})
-                    throw err
+                    await logActivity({ rest, tenant_id, action: 'login', collection, status: 'error', input: { payload: body?.payload }, error: { message: err?.message, code: err?.code || 'INTERNAL_API_ERROR' }, duration: Date.now() - logStart }).catch(() => {});
+                    throw err;
                 }
             }
 
-            // check access for sensitive actions
-            const t = c.get('token');
-            const accessToken = { value: t?.value ?? null, decoded: t?.decoded ?? null, provided: t?.provided ?? false, expired: t?.expired ?? false };
+            // ── Access control ──
+            const access = col?.api?.access as Record<string, boolean | Function> | undefined;
 
-            // For all actions
-            if (Object.hasOwn(col?.api?.access ?? {}, '*') && !col?.api?.access?.[action]) {
-
-                if (typeof col?.api?.access?.['*'] === 'function') {
-                    canAccessToAction = await col?.api?.access?.['*']({ rest: rest, error: fn.error, jwt: func.jwt, token: accessToken })
-                }
-                if (typeof col?.api?.access?.['*'] === 'boolean') {
-
-                    canAccessToAction = col?.api?.access?.['*']
-                }
-                if (canAccessToAction !== true) {
-                    throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
+            if (access?.['*'] !== undefined && access?.[action] === undefined) {
+                if (typeof access['*'] === 'function') {
+                    canAccessToAction = await access['*']({ rest, error: fn.error, jwt: func.jwt, token: accessToken });
+                } else {
+                    canAccessToAction = access['*'] as boolean;
                 }
+                if (canAccessToAction !== true) throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
             }
 
-            // For specific actions
-            if (Object.hasOwn(col?.api?.access ?? {}, action) && col?.api?.access) {
-                if (typeof col?.api?.access?.[action] === 'function') {
-                    canAccessToAction = await col?.api?.access?.[action]({ rest: rest, error: fn.error, jwt: func.jwt, token: accessToken })
-                } else {
-                    canAccessToAction = col?.api?.access?.[action]
-                }
-                if (canAccessToAction !== true) {
-                    throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
-                }
+            if (access?.[action] !== undefined) {
+                canAccessToAction = typeof access[action] === 'function'
+                    ? await (access[action] as Function)({ rest, error: fn.error, jwt: func.jwt, token: accessToken })
+                    : access[action] as boolean;
+                if (canAccessToAction !== true) throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
             }
 
             if (canAccessToAction !== true) {
                 throw new AppError('Unauthorized', { status: 401, code: 'ACCESS_DENIED_TO_PERFORM_THIS_ACTION' });
             }
 
-
-
-            if (Object.hasOwn(col?.actions ?? {}, action) && col?.actions?.[action]) {
-                response = await col.actions?.[action]({ rest: rest, data: body?.data, error: fn.error })
-            } else if (action == 'aggregate') {
-                /* Aggregate */
-                response = await rest.aggregate(collection, body?.pipeline || [])
-            } else if (action == 'find') {
-                /* Find */
-                response = await rest.find(collection, body?.params || {})
-            } else if (action == 'findOne') {
-                /* Find One */
-                response = await rest.findOne(collection, body?.id, body?.params || {})
-            } else if (action == 'insertOne') {
-                /* Insert One */
-                if (col.api?.readOnlyFields?.length) {
-                    body.data = func.omit(body.data, col.api?.readOnlyFields)
-                }
-                response = await rest.insertOne(collection, body?.data)
-            } else if (action == 'insertMany') {
-                /* Insert Many */
-                if (col.api?.readOnlyFields?.length) {
-                    body.data = func.omit(body.data, col.api?.readOnlyFields)
+            // ── Execute action ──
+            if (col.actions?.[action]) {
+                response = await col.actions[action]({ rest, data: body?.data, error: fn.error });
+            } else {
+                const handler = crudHandlers[action];
+                if (!handler) throw new AppError('Action `' + action + '` not found', { status: 400, code: 'ACTION_NOT_FOUND' });
+
+                // Strip readOnlyFields for mutations
+                if (action === 'insertOne' || action === 'insertMany') {
+                    stripReadOnlyData(col, body);
+                } else if (action === 'updateOne' || action === 'updateMany') {
+                    stripReadOnlyUpdate(col, body);
                 }
-                response = await rest.insertMany(collection, body?.data)
-            } else if (action == 'updateOne') {
-                /* Update One */
-                if (col.api?.readOnlyFields?.length) {
-                    body.update = func.omit(body.update, col.api?.readOnlyFields)
-                }
-                response = await rest.updateOne(collection, body?.id || body?._id, body?.update || {})
-            } else if (action == 'updateMany') {
-                /* Update Many */
-                if (col.api?.readOnlyFields?.length) {
-                    body.update = func.omit(body.update, col.api?.readOnlyFields)
-                }
-                response = await rest.updateMany(collection, body?.ids || body?._ids || [], body?.update || {})
-            } else if (action == 'findOneAndUpdate') {
-                /* Find One And Update */
-                if (col.api?.readOnlyFields?.length) {
-                    body.update = func.omit(body.update, col.api?.readOnlyFields)
-                }
-                response = await rest.findOneAndUpdate(collection, body?.filter || {}, body?.update || {}, body?.options || {})
-            } else if (action == 'deleteOne') {
-                /* Delete One */
-                response = await rest.deleteOne(collection, body?.id || body?._id)
-            } else if (action == 'deleteMany') {
-                /* Delete Many */
-                response = await rest.deleteMany(collection, body?.ids || body?._ids || [])
-            }
 
+                response = await handler(rest, collection, body);
+            }
 
-            /* Private Fields */
+            // Strip private fields from response
             if (privateFields.length > 0) {
-                response = func.omit(response!, privateFields, fieldOrder)
+                response = func.omit(response!, privateFields, fieldOrder);
             }
 
-            return c.json(response)
-
+            return c.json(response);
 
         } catch (err: any) {
-            console.error(err?.message || err)
-            const isAppError = err instanceof AppError;
-            const status = isAppError ? Number(err.status) : 500;
-            return c.json({
-                message: isAppError ? err.message : 'Internal server error',
-                code: isAppError ? err.code : 'INTERNAL_SERVER_ERROR',
-                meta: isAppError ? err.meta : undefined,
-            }, status as any);
+            return errorResponse(c, err);
         }
+    });
 
-    })
-
-
-    // Service API
+    // ─── Service API ────────────────────────────────────────────────────
     app.post(SERVICE_PREFIX, async (c) => {
         try {
             const ContentType = c.req.header('Content-Type');
-            let isMultipartOrFormData = false;
-            let response: any;
             let body: any;
-            let parseBody: any;
-            let rest: InstanceType<typeof useRest>;
 
-            // Content Type
-            if (ContentType?.includes('application/x-www-form-urlencoded') || ContentType?.includes('multipart/form-data')) {
-                isMultipartOrFormData = true;
-                try {
-                    parseBody = await c.req.parseBody({ all: true });
-                } catch {
-                    throw new AppError('Invalid form data', { status: 400, code: 'INVALID_FORM_DATA' });
-                }
-            }
             if (ContentType?.includes('application/json')) {
-                isMultipartOrFormData = false;
-                try {
-                    body = await c.req.json();
-                } catch {
+                try { body = await c.req.json(); } catch {
                     throw new AppError('Invalid JSON body', { status: 400, code: 'INVALID_JSON_BODY' });
                 }
+            } else if (ContentType?.includes('multipart/form-data') || ContentType?.includes('application/x-www-form-urlencoded')) {
+                try { body = await c.req.parseBody({ all: true }); } catch {
+                    throw new AppError('Invalid form data', { status: 400, code: 'INVALID_FORM_DATA' });
+                }
             }
 
             const { service, tenant_id } = c.req.param() as { service: string, tenant_id: string };
-            if (!tenant_id) {
-                throw new AppError('Tenant ID is required', { status: 400, code: 'TENANT_ID_REQUIRED' });
-            }
-            if (!service) {
-                throw new AppError('Service is required', { status: 400, code: 'SERVICE_REQUIRED' });
-            }
+            if (!tenant_id) throw new AppError('Tenant ID is required', { status: 400, code: 'TENANT_ID_REQUIRED' });
+            if (!service) throw new AppError('Service is required', { status: 400, code: 'SERVICE_REQUIRED' });
 
-            let serviceInstance = cfg.services?.find(s => s.name === service && s._tenant_ === tenant_id) as Service;
+            const serviceInstance = cfg.services?.find(s => s.name === service && s._tenant_ === tenant_id) as Service;
             const { action } = c.req.param() as { action: string };
-            if (!serviceInstance) {
-                throw new AppError('Service `' + service + '` not found', { status: 400, code: 'SERVICE_NOT_FOUND' });
-            }
-            if (!serviceInstance.enabled) {
-                throw new AppError('Service `' + service + '` is not enabled', { status: 400, code: 'SERVICE_NOT_ENABLED' });
-            }
-            if (!Object.hasOwn(serviceInstance.actions, action) || !serviceInstance.actions?.[action]) {
-                throw new AppError('Service `' + service + '` is not defined', { status: 400, code: 'SERVICE_NOT_DEFINED' });
+            if (!serviceInstance) throw new AppError('Service `' + service + '` not found', { status: 400, code: 'SERVICE_NOT_FOUND' });
+            if (!serviceInstance.enabled) throw new AppError('Service `' + service + '` is not enabled', { status: 400, code: 'SERVICE_NOT_ENABLED' });
+            if (!serviceInstance.actions?.[action]) throw new AppError('Service `' + service + '` is not defined', { status: 400, code: 'SERVICE_NOT_DEFINED' });
+
+            const rest = new useRest({ internal: false, tenant_id });
+
+            // Access control (same logic as checkFileAccess)
+            const serviceAccess = serviceInstance.api?.access as Record<string, boolean | Function> | undefined;
+            await evaluateAccess(serviceAccess as any, action, rest, action, c);
+
+            // Re-read accessToken for the action handler
+            const accessToken = getAccessToken(c);
+
+            const logStart = Date.now();
+            try {
+                const response = await serviceInstance.actions[action]({
+                    data: body?.data, error: fn.error, io, jwt: func.jwt, token: accessToken, rest,
+                });
+
+                await logActivity({ rest, tenant_id, action, collection: service, status: 'success', input: body?.data, result: response, duration: Date.now() - logStart, token: { decoded: accessToken.decoded, value: null, provided: true, expired: false } });
+                return c.json(response);
+            } catch (err: any) {
+                await logActivity({ rest, tenant_id, action, collection: service, status: 'error', input: body?.data, error: { message: err?.message, code: err?.code || 'INTERNAL_SERVICE_ERROR' }, duration: Date.now() - logStart, token: { decoded: accessToken.decoded, value: null, provided: true, expired: false } }).catch(() => {});
+                throw err;
             }
+        } catch (err: any) {
+            return errorResponse(c, err);
+        }
+    });
 
-            // Token verification
-            const t = c.get('token');
-            const accessToken = { value: t?.value ?? null, decoded: t?.decoded ?? null, provided: t?.provided ?? false, expired: t?.expired ?? false };
+    // ─── File Upload ────────────────────────────────────────────────────
+    app.post(UPLOAD_PREFIX, async (c) => {
+        try {
+            const { tenant_id, collection } = c.req.param() as { tenant_id: string; collection: string };
 
-            if (accessToken.expired) {
-                throw new AppError('Token expired', { status: 401, code: 'TOKEN_EXPIRED' });
+            if (!cfg.tenants.find(t => t.id === tenant_id)) {
+                throw new AppError('Tenant `' + tenant_id + '` not found', { status: 400, code: 'TENANT_NOT_FOUND' });
             }
-            if (!accessToken.value) {
-                throw new AppError('Authentication required', { status: 401, code: 'AUTH_REQUIRED' });
+
+            const colUpload = getFileCollection(collection, tenant_id);
+            if (!colUpload) {
+                throw new AppError('File collection `' + collection + '` not found', { status: 400, code: 'FILE_COLLECTION_NOT_FOUND' });
             }
+            await checkFileAccess(colUpload?.api?.access as any, 'upload', tenant_id, c);
 
-            rest = new useRest({
-                internal: false,
-                tenant_id: tenant_id,
-            })
+            const contentType = c.req.header('Content-Type') || '';
+            if (!contentType.includes('multipart/form-data')) {
+                throw new AppError('Content-Type must be multipart/form-data', { code: 'INVALID_CONTENT_TYPE', status: 400 });
+            }
 
-            // Access control
-            let canAccessToService: boolean | undefined;
+            const formData = await c.req.parseBody();
+            const fileField = formData['file'] || formData['upload'];
+            if (!fileField || !(fileField instanceof File)) {
+                throw new AppError('No file provided. Use field name "file" or "upload".', { code: 'FILE_REQUIRED', status: 400 });
+            }
 
-            if (Object.hasOwn(serviceInstance?.api?.access ?? {}, '*') && !serviceInstance?.api?.access?.[action]) {
-                if (typeof serviceInstance?.api?.access?.['*'] === 'function') {
-                    canAccessToService = await serviceInstance.api.access['*']({ rest, error: fn.error, jwt: func.jwt, token: accessToken });
-                }
-                if (typeof serviceInstance?.api?.access?.['*'] === 'boolean') {
-                    canAccessToService = serviceInstance.api.access['*'];
-                }
-                if (!canAccessToService) {
-                    throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
+            const data: Record<string, any> = {};
+            for (const [key, value] of Object.entries(formData)) {
+                if (key !== 'file' && key !== 'upload' && !(value instanceof File)) {
+                    data[key] = value;
                 }
             }
 
-            if (Object.hasOwn(serviceInstance?.api?.access ?? {}, action) && serviceInstance?.api?.access) {
-                if (typeof serviceInstance?.api?.access?.[action] === 'function') {
-                    canAccessToService = await serviceInstance.api.access[action]({ rest, error: fn.error, jwt: func.jwt, token: accessToken });
-                } else {
-                    canAccessToService = serviceInstance.api.access[action];
-                }
-                if (!canAccessToService) {
-                    throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
-                }
+            const result = await handleUpload({ collection, tenant_id, file: fileField, data });
+            return c.json(result);
+        } catch (err: any) {
+            return errorResponse(c, err);
+        }
+    });
+
+    // ─── File Serve ─────────────────────────────────────────────────────
+    app.get(FILES_PREFIX, async (c) => {
+        try {
+            const { tenant_id, collection } = c.req.param() as { tenant_id: string; collection: string };
+
+            if (!cfg.tenants.find(t => t.id === tenant_id)) {
+                throw new AppError('Tenant `' + tenant_id + '` not found', { status: 400, code: 'TENANT_NOT_FOUND' });
             }
 
-            if (canAccessToService !== true) {
-                throw new AppError('Unauthorized', { status: 401, code: 'ACCESS_DENIED_TO_PERFORM_THIS_ACTION' });
+            const colServe = getFileCollection(collection, tenant_id);
+            if (!colServe) {
+                throw new AppError('File collection `' + collection + '` not found', { status: 400, code: 'FILE_COLLECTION_NOT_FOUND' });
             }
+            await checkFileAccess(colServe?.api?.access as any, 'read', tenant_id, c);
 
-            const logStart = Date.now()
+            const filename = basename(c.req.param('file') as string);
+            if (!filename || filename.startsWith('.') || filename.includes('..') || filename.includes('/')) {
+                throw new AppError('Invalid filename', { status: 400, code: 'INVALID_FILENAME' });
+            }
+            const fileId = filename.replace(/\.[^.]+$/, '');
+
+            const query = c.req.query();
+            const transform = query.w || query.width || query.h || query.height || query.format
+                ? {
+                    width: query.w ? Number(query.w) : query.width ? Number(query.width) : undefined,
+                    height: query.h ? Number(query.h) : query.height ? Number(query.height) : undefined,
+                    format: (query.format as 'webp' | 'jpeg' | 'png' | 'avif') || undefined,
+                    quality: query.q ? Number(query.q) : query.quality ? Number(query.quality) : undefined,
+                }
+                : undefined;
 
-            try {
-                response = await serviceInstance.actions?.[action]({
-                    data: body?.data,
-                    error: fn.error,
-                    io: io,
-                    jwt: func.jwt,
-                    token: accessToken,
-                    rest,
-                })
-
-                await logActivity({
-                    rest, tenant_id, action, collection: service,
-                    status: 'success',
-                    input: body?.data,
-                    result: response,
-                    duration: Date.now() - logStart,
-                    token: { decoded: accessToken.decoded, value: null, provided: true, expired: false },
-                })
-
-                return c.json(response)
-            } catch (err: any) {
-                await logActivity({
-                    rest, tenant_id, action, collection: service,
-                    status: 'error',
-                    input: body?.data,
-                    error: { message: err?.message, code: err?.code || 'INTERNAL_SERVICE_ERROR' },
-                    duration: Date.now() - logStart,
-                    token: { decoded: accessToken.decoded, value: null, provided: true, expired: false },
-                }).catch(() => {})
-                throw err
+            const result = await handleServe(tenant_id, collection, fileId, filename, transform);
+            if (!result) {
+                throw new AppError('File not found', { code: 'FILE_NOT_FOUND', status: 404 });
             }
+
+            c.header('Content-Type', result.mimetype);
+            if (result.size) c.header('Content-Length', String(result.size));
+            c.header('Cache-Control', 'public, max-age=31536000, immutable');
+            return c.newResponse(result.stream);
         } catch (err: any) {
-            console.error(err?.message || err)
-            const isAppError = err instanceof AppError;
-            const status = isAppError ? Number(err.status) : 500;
-            return c.json({
-                message: isAppError ? err.message : 'Internal server error',
-                code: isAppError ? err.code : 'INTERNAL_SERVER_ERROR',
-                meta: isAppError ? err.meta : undefined,
-            }, status as any);
+            return errorResponse(c, err);
         }
-    })
-
+    });
 
-  // Upload API
-  app.post(UPLOAD_PREFIX, async (c) => {
-    try {
-      const { tenant_id, collection } = c.req.param() as { tenant_id: string; collection: string };
+    // ─── File Delete ────────────────────────────────────────────────────
+    app.delete(FILES_PREFIX, async (c) => {
+        try {
+            const { tenant_id, collection } = c.req.param() as { tenant_id: string; collection: string };
 
-      if (!cfg.tenants.find(t => t.id === tenant_id)) {
-        throw new AppError('Tenant `' + tenant_id + '` not found', { status: 400, code: 'TENANT_NOT_FOUND' });
-      }
+            if (!cfg.tenants.find(t => t.id === tenant_id)) {
+                throw new AppError('Tenant `' + tenant_id + '` not found', { status: 400, code: 'TENANT_NOT_FOUND' });
+            }
 
-      // Check access
-      const colUpload = getFileCollection(collection, tenant_id);
-      if (!colUpload) {
-        throw new AppError('File collection `' + collection + '` not found', { status: 400, code: 'FILE_COLLECTION_NOT_FOUND' });
-      }
-      await checkFileAccess(colUpload?.api?.access as any, 'upload', tenant_id, c);
+            const colDelete = getFileCollection(collection, tenant_id);
+            if (!colDelete) {
+                throw new AppError('File collection `' + collection + '` not found', { status: 400, code: 'FILE_COLLECTION_NOT_FOUND' });
+            }
+            await checkFileAccess(colDelete?.api?.access as any, 'delete', tenant_id, c);
 
-      const contentType = c.req.header('Content-Type') || '';
-      if (!contentType.includes('multipart/form-data')) {
-        throw new AppError('Content-Type must be multipart/form-data', {
-          code: 'INVALID_CONTENT_TYPE', status: 400,
-        });
-      }
+            const fileId = c.req.param('file') as string;
+            if (!fileId || fileId.startsWith('.') || fileId.includes('..') || fileId.includes('/')) {
+                throw new AppError('Invalid file id', { status: 400, code: 'INVALID_FILE_ID' });
+            }
 
-      const formData = await c.req.parseBody();
-      const fileField = formData['file'] || formData['upload'];
-      if (!fileField || !(fileField instanceof File)) {
-        throw new AppError('No file provided. Use field name "file" or "upload".', {
-          code: 'FILE_REQUIRED', status: 400,
-        });
-      }
+            await handleDelete(tenant_id, collection, fileId);
+            return c.json({ message: 'File deleted', ok: true });
+        } catch (err: any) {
+            return errorResponse(c, err);
+        }
+    });
 
-      // Extract custom fields from form data (exclude file keys)
-      const data: Record<string, any> = {};
-      for (const [key, value] of Object.entries(formData)) {
-        if (key !== 'file' && key !== 'upload' && !(value instanceof File)) {
-          data[key] = value;
+    // ─── Public config ──────────────────────────────────────────────────
+    app.get('/_dnax/config/:tenant_id', (c) => {
+        const t = c.get('token');
+        if (!t?.value) {
+            return c.json({ message: 'Authentication required', code: 'AUTH_REQUIRED' }, 401);
         }
-      }
-
-      const result = await handleUpload({
-        collection,
-        tenant_id,
-        file: fileField,
-        data,
-      });
-
-      return c.json(result);
-    } catch (err: any) {
-      const isAppError = err instanceof AppError;
-      const status = isAppError ? Number(err.status) : 500;
-      return c.json({
-        message: isAppError ? err.message : 'Internal server error',
-        code: isAppError ? err.code : 'INTERNAL_SERVER_ERROR',
-      }, status as any);
-    }
-  })
-
-  // Serve files
-  app.get(FILES_PREFIX, async (c) => {
-    try {
-      const { tenant_id, collection } = c.req.param() as { tenant_id: string; collection: string };
-
-      if (!cfg.tenants.find(t => t.id === tenant_id)) {
-        throw new AppError('Tenant `' + tenant_id + '` not found', { status: 400, code: 'TENANT_NOT_FOUND' });
-      }
-
-      // Check access
-      const colServe = getFileCollection(collection, tenant_id);
-      if (!colServe) {
-        throw new AppError('File collection `' + collection + '` not found', { status: 400, code: 'FILE_COLLECTION_NOT_FOUND' });
-      }
-      await checkFileAccess(colServe?.api?.access as any, 'read', tenant_id, c);
-
-      const filename = basename(c.req.param('file') as string);
-      if (!filename || filename.startsWith('.') || filename.includes('..') || filename.includes('/')) {
-        throw new AppError('Invalid filename', { status: 400, code: 'INVALID_FILENAME' });
-      }
-      const fileId = filename.replace(/\.[^.]+$/, ''); // remove extension to get the ID
-
-      // Parse optional transformation query params
-      const query = c.req.query();
-      const transform = query.w || query.width || query.h || query.height || query.format
-        ? {
-            width: query.w ? Number(query.w) : query.width ? Number(query.width) : undefined,
-            height: query.h ? Number(query.h) : query.height ? Number(query.height) : undefined,
-            format: (query.format as 'webp' | 'jpeg' | 'png' | 'avif') || undefined,
-            quality: query.q ? Number(query.q) : query.quality ? Number(query.quality) : undefined,
-          }
-        : undefined;
-
-      const result = await handleServe(tenant_id, collection, fileId, filename, transform);
-      if (!result) {
-        throw new AppError('File not found', { code: 'FILE_NOT_FOUND', status: 404 });
-      }
-
-      c.header('Content-Type', result.mimetype);
-      if (result.size) c.header('Content-Length', String(result.size));
-      c.header('Cache-Control', 'public, max-age=31536000, immutable');
-
-      return c.newResponse(result.stream);
-    } catch (err: any) {
-      const isAppError = err instanceof AppError;
-      const status = isAppError ? Number(err.status) : 500;
-      return c.json({
-        message: isAppError ? err.message : 'Internal server error',
-        code: isAppError ? err.code : 'INTERNAL_SERVER_ERROR',
-      }, status as any);
-    }
-  })
-
-  // Delete file
-  app.delete(FILES_PREFIX, async (c) => {
-    try {
-      const { tenant_id, collection } = c.req.param() as { tenant_id: string; collection: string };
-
-      if (!cfg.tenants.find(t => t.id === tenant_id)) {
-        throw new AppError('Tenant `' + tenant_id + '` not found', { status: 400, code: 'TENANT_NOT_FOUND' });
-      }
-
-      // Check access
-      const colDelete = getFileCollection(collection, tenant_id);
-      if (!colDelete) {
-        throw new AppError('File collection `' + collection + '` not found', { status: 400, code: 'FILE_COLLECTION_NOT_FOUND' });
-      }
-      await checkFileAccess(colDelete?.api?.access as any, 'delete', tenant_id, c);
-
-      const fileId = c.req.param('file') as string;
-      if (!fileId || fileId.startsWith('.') || fileId.includes('..') || fileId.includes('/')) {
-        throw new AppError('Invalid file id', { status: 400, code: 'INVALID_FILE_ID' });
-      }
-
-      await handleDelete(tenant_id, collection, fileId);
-
-      return c.json({ message: 'File deleted', ok: true });
-    } catch (err: any) {
-      const isAppError = err instanceof AppError;
-      const status = isAppError ? Number(err.status) : 500;
-      return c.json({
-        message: isAppError ? err.message : 'Internal server error',
-        code: isAppError ? err.code : 'INTERNAL_SERVER_ERROR',
-      }, status as any);
-    }
-  })
-
-  // Public config endpoint — filtered by tenant (auth required)
-  app.get('/_dnax/config/:tenant_id', (c) => {
-      const t = c.get('token');
-      if (!t?.value) {
-          return c.json({ message: 'Authentication required', code: 'AUTH_REQUIRED' }, 401);
-      }
-      const { tenant_id } = c.req.param() as { tenant_id: string };
-    const config = safePublicConfig();
-
-      return c.json({
-        tenants: config?.tenants?.filter(t => t.id === tenant_id),
-        collections: config?.collections?.filter(c => c._tenant_ === tenant_id),
-        services: config?.services?.filter(s => s._tenant_ === tenant_id),
-        fileCollections: config?.fileCollections?.filter(fc => fc._tenant_ === tenant_id),
-      });
-  })
+        const { tenant_id } = c.req.param() as { tenant_id: string };
+        const config = safePublicConfig();
+
+        return c.json({
+            tenants: config?.tenants?.filter(t => t.id === tenant_id),
+            collections: config?.collections?.filter(c => c._tenant_ === tenant_id),
+            services: config?.services?.filter(s => s._tenant_ === tenant_id),
+            fileCollections: config?.fileCollections?.filter(fc => fc._tenant_ === tenant_id),
+        });
+    });
 
 }
 
-
 export {
     initializeApi
 }