@aphexcms/cms-core 0.1.17 → 0.2.1

package/dist/lib/field-validation/utils.js

@@ -1,4 +1,5 @@
 import { Rule } from './rule.js';
+import { normalizeDateFields } from './date-utils.js';
 /**
  * Check if a field is required based on its validation rules
  */
@@ -20,39 +21,106 @@ export function isFieldRequired(field) {
  * Validate a field value against its validation rules
  */
 export async function validateField(field, value, context = {}) {
-    if (!field.validation) {
-        return { isValid: true, errors: [] };
+    console.log(`[validateField] Validating field "${field.name}"`, {
+        type: field.type,
+        value,
+        hasValidation: !!field.validation
+    });
+    const allErrors = [];
+    // Add automatic validation for date/datetime/url fields based on type
+    if (field.type === 'date') {
+        const dateField = field;
+        const dateFormat = dateField.options?.dateFormat || 'YYYY-MM-DD';
+        console.log(`[validateField] Adding automatic DATE validation for "${field.name}"`, {
+            dateFormat
+        });
+        const autoRule = new Rule().date(dateFormat);
+        const markers = await autoRule.validate(value, {
+            path: [field.name],
+            ...context
+        });
+        allErrors.push(...markers.map((marker) => ({
+            level: marker.level,
+            message: marker.message
+        })));
     }
-    try {
-        const validationFunctions = Array.isArray(field.validation)
-            ? field.validation
-            : [field.validation];
-        const allErrors = [];
-        for (const validationFn of validationFunctions) {
-            const rule = validationFn(new Rule());
-            if (!(rule instanceof Rule)) {
-                console.error(`Validation function for field "${field.name}" did not return a Rule object. Make sure you are chaining validation methods and returning the result.`);
-                continue;
+    else if (field.type === 'datetime') {
+        const dateTimeField = field;
+        const dateFormat = dateTimeField.options?.dateFormat || 'YYYY-MM-DD';
+        const timeFormat = dateTimeField.options?.timeFormat || 'HH:mm';
+        console.log(`[validateField] Adding automatic DATETIME validation for "${field.name}"`, {
+            dateFormat,
+            timeFormat
+        });
+        const autoRule = new Rule().datetime(dateFormat, timeFormat);
+        const markers = await autoRule.validate(value, {
+            path: [field.name],
+            ...context
+        });
+        allErrors.push(...markers.map((marker) => ({
+            level: marker.level,
+            message: marker.message
+        })));
+    }
+    else if (field.type === 'url') {
+        // Only add automatic URL validation if there's no custom validation
+        // This allows custom validation to specify different options (scheme, allowRelative, relativeOnly)
+        if (!field.validation) {
+            console.log(`[validateField] Adding automatic URL validation for "${field.name}"`);
+            // Automatic URL validation - only validate if there's a value
+            if (value && value !== '') {
+                const autoRule = new Rule().uri();
+                const markers = await autoRule.validate(value, {
+                    path: [field.name],
+                    ...context
+                });
+                allErrors.push(...markers.map((marker) => ({
+                    level: marker.level,
+                    message: marker.message
+                })));
             }
-            const markers = await rule.validate(value, {
-                path: [field.name],
-                ...context
-            });
-            allErrors.push(...markers.map((marker) => ({
-                level: marker.level,
-                message: marker.message
-            })));
         }
-        const isValid = allErrors.filter((e) => e.level === 'error').length === 0;
-        return { isValid, errors: allErrors };
+        else {
+            console.log(`[validateField] Skipping automatic URL validation for "${field.name}" (has custom validation)`);
+        }
+    }
+    // Run user-defined validation rules if present
+    if (!field.validation) {
+        console.log(`[validateField] No custom validation rules for "${field.name}"`);
     }
-    catch (error) {
-        console.error('Validation error:', error);
-        return {
-            isValid: false,
-            errors: [{ level: 'error', message: 'Validation failed' }]
-        };
+    else {
+        try {
+            const validationFunctions = Array.isArray(field.validation)
+                ? field.validation
+                : [field.validation];
+            console.log(`[validateField] Field "${field.name}" has ${validationFunctions.length} custom validation function(s)`);
+            for (const validationFn of validationFunctions) {
+                const rule = validationFn(new Rule());
+                if (!(rule instanceof Rule)) {
+                    console.error(`Validation function for field "${field.name}" did not return a Rule object. Make sure you are chaining validation methods and returning the result.`);
+                    continue;
+                }
+                const markers = await rule.validate(value, {
+                    path: [field.name],
+                    ...context
+                });
+                allErrors.push(...markers.map((marker) => ({
+                    level: marker.level,
+                    message: marker.message
+                })));
+            }
+        }
+        catch (error) {
+            console.error(`[validateField] Validation error for "${field.name}":`, error);
+            allErrors.push({ level: 'error', message: 'Validation failed' });
+        }
     }
+    const isValid = allErrors.filter((e) => e.level === 'error').length === 0;
+    console.log(`[validateField] Field "${field.name}" validation complete`, {
+        isValid,
+        errors: allErrors
+    });
+    return { isValid, errors: allErrors };
 }
 /**
  * Get validation CSS classes for input styling
@@ -66,20 +134,41 @@ export function getValidationClasses(hasErrors) {
 }
 /**
  * Validate an entire document's data against a schema
- * This function validates all fields in a schema against the provided data
- * and returns any validation errors found.
+ * This function:
+ * 1. Normalizes date fields (converts user format to ISO for storage)
+ * 2. Converts ISO dates to user format for validation
+ * 3. Validates all fields and returns errors
+ * 4. Returns normalized data (with ISO dates) for storage
  *
  * @param schema - The schema type containing field definitions
  * @param data - The document data to validate
  * @param context - Optional context to pass to field validators
- * @returns Validation result with isValid flag and array of field errors
+ * @returns Validation result with isValid flag, errors, and normalized data
  */
 export async function validateDocumentData(schema, data, context = {}) {
+    console.log('[validateDocumentData] Starting validation', {
+        schemaName: schema.name,
+        data
+    });
     const validationErrors = [];
-    // Validate each field in the schema
+    // Normalize date fields: convert to ISO for storage, user format for validation
+    const { normalizedData, dataForValidation } = normalizeDateFields(data, schema);
+    console.log('[validateDocumentData] After normalization', {
+        normalizedData,
+        dataForValidation
+    });
+    // Validate each field using the user-formatted data
     for (const field of schema.fields) {
-        const value = data[field.name];
-        const result = await validateField(field, value, { ...context, ...data });
+        const value = dataForValidation[field.name];
+        console.log(`[validateDocumentData] Validating field "${field.name}"`, {
+            type: field.type,
+            value
+        });
+        const result = await validateField(field, value, { ...context, ...dataForValidation });
+        console.log(`[validateDocumentData] Field "${field.name}" validation result`, {
+            isValid: result.isValid,
+            errors: result.errors
+        });
         if (!result.isValid) {
             const errorMessages = result.errors.filter((e) => e.level === 'error').map((e) => e.message);
             if (errorMessages.length > 0) {
@@ -90,8 +179,13 @@ export async function validateDocumentData(schema, data, context = {}) {
             }
         }
     }
-    return {
+    console.log('[validateDocumentData] Final result', {
         isValid: validationErrors.length === 0,
         errors: validationErrors
+    });
+    return {
+        isValid: validationErrors.length === 0,
+        errors: validationErrors,
+        normalizedData
     };
 }

package/dist/local-api/collection-api.d.ts

@@ -4,6 +4,14 @@ import type { Document } from '../types/document.js';
 import type { LocalAPIContext } from './types.js';
 import type { SchemaType } from '../types/schemas.js';
 import { PermissionChecker } from './permissions.js';
+import { type DocumentValidationResult } from '../field-validation/utils.js';
+/**
+ * Result from create/update operations that includes validation
+ */
+export interface DocumentResult<T> {
+    document: T;
+    validation: DocumentValidationResult;
+}
 /**
  * Collection API - provides type-safe operations for a single collection
  * Generic type T represents the document type for this collection
@@ -69,7 +77,7 @@ export declare class CollectionAPI<T = Document> {
      *
      * @example
      * ```typescript
-     * const page = await api.collections.pages.create(
+     * const result = await api.collections.pages.create(
      *   { organizationId: 'org_123', user },
      *   {
      *     title: 'New Page',
@@ -77,27 +85,31 @@ export declare class CollectionAPI<T = Document> {
      *     content: []
      *   }
      * );
+     * // result.document - the created document
+     * // result.validation - validation results
      * ```
      */
     create(context: LocalAPIContext, data: Omit<T, 'id' | '_meta'>, options?: {
         publish?: boolean;
-    }): Promise<T>;
+    }): Promise<DocumentResult<T>>;
     /**
      * Update an existing document
      *
      * @example
      * ```typescript
-     * const updated = await api.collections.pages.update(
+     * const result = await api.collections.pages.update(
      *   { organizationId: 'org_123', user },
      *   'doc_123',
      *   { title: 'Updated Title' },
      *   { publish: true }
      * );
+     * // result.document - the updated document
+     * // result.validation - validation results
      * ```
      */
     update(context: LocalAPIContext, id: string, data: Partial<Omit<T, 'id' | '_meta'>>, options?: {
         publish?: boolean;
-    }): Promise<T | null>;
+    }): Promise<DocumentResult<T> | null>;
     /**
      * Delete a document
      *

package/dist/local-api/collection-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collection-api.d.ts","sourceRoot":"","sources":["../../src/lib/local-api/collection-api.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AA6BlD;;;GAGG;AACH,qBAAa,aAAa,CAAC,CAAC,GAAG,QAAQ;IAErC,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,WAAW;gBAHX,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,eAAe,EAChC,OAAO,EAAE,UAAU,EACnB,WAAW,EAAE,iBAAiB;IAMvC;;OAEG;IACH,IAAI,MAAM,IAAI,UAAU,CAEvB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACG,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,GAAE,WAAW,CAAC,CAAC,CAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAqB1F;;;;;;;;;;;OAWG;IACG,QAAQ,CACb,OAAO,EAAE,eAAe,EACxB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAmBpB;;;;;;;;;;OAUG;IACG,KAAK,CACV,OAAO,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,KAAK,CAAA;KAAE,GACzC,OAAO,CAAC,MAAM,CAAC;IAWlB;;;;;;;;;;;;;;OAcG;IACG,MAAM,CACX,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAC7B,OAAO,CAAC,CAAC,CAAC;IAoCb;;;;;;;;;;;;OAYG;IACG,MAAM,CACX,OAAO,EAAE,eAAe,EACxB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC,EACtC,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAC7B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IA0CpB;;;;;;;;;;OAUG;IACG,MAAM,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAOpE;;;;;;;;;;OAUG;IACG,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAgCtE;;;;;;;;;;OAUG;IACG,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;CAUxE"}
+{"version":3,"file":"collection-api.d.ts","sourceRoot":"","sources":["../../src/lib/local-api/collection-api.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAwB,KAAK,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAEhG;;GAEG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC;IACZ,UAAU,EAAE,wBAAwB,CAAC;CACrC;AA4BD;;;GAGG;AACH,qBAAa,aAAa,CAAC,CAAC,GAAG,QAAQ;IAErC,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,WAAW;gBAHX,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,eAAe,EAChC,OAAO,EAAE,UAAU,EACnB,WAAW,EAAE,iBAAiB;IAMvC;;OAEG;IACH,IAAI,MAAM,IAAI,UAAU,CAEvB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACG,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,GAAE,WAAW,CAAC,CAAC,CAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAqB1F;;;;;;;;;;;OAWG;IACG,QAAQ,CACb,OAAO,EAAE,eAAe,EACxB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAmBpB;;;;;;;;;;OAUG;IACG,KAAK,CACV,OAAO,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,KAAK,CAAA;KAAE,GACzC,OAAO,CAAC,MAAM,CAAC;IAWlB;;;;;;;;;;;;;;;;OAgBG;IACG,MAAM,CACX,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAC7B,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IA4C7B;;;;;;;;;;;;;;OAcG;IACG,MAAM,CACX,OAAO,EAAE,eAAe,EACxB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC,EACtC,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAC7B,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAkEpC;;;;;;;;;;OAUG;IACG,MAAM,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAOpE;;;;;;;;;;OAUG;IACG,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAgCtE;;;;;;;;;;OAUG;IACG,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;CAUxE"}

package/dist/local-api/collection-api.js

@@ -124,7 +124,7 @@ export class CollectionAPI {
      *
      * @example
      * ```typescript
-     * const page = await api.collections.pages.create(
+     * const result = await api.collections.pages.create(
      *   { organizationId: 'org_123', user },
      *   {
      *     title: 'New Page',
@@ -132,15 +132,18 @@ export class CollectionAPI {
      *     content: []
      *   }
      * );
+     * // result.document - the created document
+     * // result.validation - validation results
      * ```
      */
     async create(context, data, options) {
         // Permission check (unless overrideAccess)
         await this.permissions.canWrite(context, this.collectionName);
-        // Validate data if publishing immediately
+        // Validate and normalize data (dates converted to ISO)
+        const validationResult = await validateDocumentData(this._schema, data, data);
         if (options?.publish) {
             await this.permissions.canPublish(context, this.collectionName);
-            const validationResult = await validateDocumentData(this._schema, data, data);
+            // Block publish if validation fails
             if (!validationResult.isValid) {
                 const errorMessage = validationResult.errors
                     .map((e) => `${e.field}: ${e.errors.join(', ')}`)
@@ -148,48 +151,73 @@ export class CollectionAPI {
                 throw new Error(`Cannot publish: validation errors - ${errorMessage}`);
             }
         }
-        // Create document with draft data
+        // Create document with normalized data (dates in ISO format)
         const document = await this.databaseAdapter.createDocument({
             organizationId: context.organizationId,
             type: this.collectionName,
-            draftData: data,
+            draftData: validationResult.normalizedData,
             createdBy: context.user?.id
         });
         // Publish immediately if requested (validation already done above)
         if (options?.publish) {
             const published = await this.databaseAdapter.publishDoc(context.organizationId, document.id);
             if (published) {
-                return transformDocument(published, 'published');
+                return {
+                    document: transformDocument(published, 'published'),
+                    validation: validationResult
+                };
             }
         }
-        return transformDocument(document, 'draft');
+        return {
+            document: transformDocument(document, 'draft'),
+            validation: validationResult
+        };
     }
     /**
      * Update an existing document
      *
      * @example
      * ```typescript
-     * const updated = await api.collections.pages.update(
+     * const result = await api.collections.pages.update(
      *   { organizationId: 'org_123', user },
      *   'doc_123',
      *   { title: 'Updated Title' },
      *   { publish: true }
      * );
+     * // result.document - the updated document
+     * // result.validation - validation results
      * ```
      */
     async update(context, id, data, options) {
         // Permission check (unless overrideAccess)
         await this.permissions.canWrite(context, this.collectionName);
-        // Update draft data
-        const document = await this.databaseAdapter.updateDocDraft(context.organizationId, id, data, context.user?.id);
+        // Get existing document to merge with updates
+        const existingDoc = await this.databaseAdapter.findByDocIdAdvanced(context.organizationId, id);
+        if (!existingDoc) {
+            return null;
+        }
+        // Merge existing data with updates, but only keep fields defined in schema
+        // This prevents orphaned fields from persisting when schema changes
+        const schemaFieldNames = new Set(this._schema.fields.map((f) => f.name));
+        const cleanedExisting = {};
+        // Only copy fields from existing doc that are still in the schema
+        for (const [key, value] of Object.entries(existingDoc.draftData || {})) {
+            if (schemaFieldNames.has(key)) {
+                cleanedExisting[key] = value;
+            }
+        }
+        // Merge cleaned existing data with new updates
+        const mergedData = { ...cleanedExisting, ...data };
+        // Validate and normalize the merged data
+        const validationResult = await validateDocumentData(this._schema, mergedData, mergedData);
+        // Update draft with normalized data (dates in ISO format)
+        const document = await this.databaseAdapter.updateDocDraft(context.organizationId, id, validationResult.normalizedData, context.user?.id);
         if (!document) {
             return null;
         }
-        // Validate and publish immediately if requested
         if (options?.publish) {
             await this.permissions.canPublish(context, this.collectionName);
-            // Validate the updated draft data
-            const validationResult = await validateDocumentData(this._schema, document.draftData, document.draftData);
+            // Block publish if validation fails
             if (!validationResult.isValid) {
                 const errorMessage = validationResult.errors
                     .map((e) => `${e.field}: ${e.errors.join(', ')}`)
@@ -198,10 +226,16 @@ export class CollectionAPI {
             }
             const published = await this.databaseAdapter.publishDoc(context.organizationId, document.id);
             if (published) {
-                return transformDocument(published, 'published');
+                return {
+                    document: transformDocument(published, 'published'),
+                    validation: validationResult
+                };
             }
         }
-        return transformDocument(document, 'draft');
+        return {
+            document: transformDocument(document, 'draft'),
+            validation: validationResult
+        };
     }
     /**
      * Delete a document
@@ -234,11 +268,11 @@ export class CollectionAPI {
         // Permission check (unless overrideAccess)
         await this.permissions.canPublish(context, this.collectionName);
         // Get the document to access draft data for validation
-        const document = await this.databaseAdapter.findByDocId(context.organizationId, id);
+        const document = await this.databaseAdapter.findByDocIdAdvanced(context.organizationId, id);
         if (!document || !document.draftData) {
             throw new Error('Document not found or has no draft content to publish');
         }
-        // Validate draft data before publishing
+        // Validate draft data (dates already in ISO, will be converted for validation)
         const validationResult = await validateDocumentData(this._schema, document.draftData, document.draftData);
         if (!validationResult.isValid) {
             const errorMessage = validationResult.errors

package/dist/local-api/index.d.ts

@@ -101,7 +101,7 @@ export declare function createLocalAPI(config: CMSConfig, userAdapter: DatabaseA
  * ```
  */
 export declare function getLocalAPI(): LocalAPI;
-export { CollectionAPI } from './collection-api.js';
+export { CollectionAPI, type DocumentResult } from './collection-api.js';
 export { PermissionChecker, PermissionError } from './permissions.js';
 export type { LocalAPIContext, CreateOptions, UpdateOptions } from './types.js';
 export { authToContext, requireAuth, systemContext } from './auth-helpers.js';

package/dist/local-api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/local-api/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAIjD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAE3B,CAAC,cAAc,EAAE,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;CAGjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,QAAQ;IAQnB,OAAO,CAAC,MAAM;IAPR,WAAW,EAAE,WAAW,CAAM;IACrC,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,aAAa,CAAyB;IAC9C,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,OAAO,CAA0B;gBAGhC,MAAM,EAAE,SAAS,EACzB,WAAW,EAAE,eAAe,EAC5B,aAAa,CAAC,EAAE,eAAe;IAmBhC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAgC7B;;;OAGG;IACH,OAAO,CAAC,UAAU;IAOlB;;OAEG;IACH,kBAAkB,IAAI,MAAM,EAAE;IAI9B;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIpC;;OAEG;IACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;CAGzD;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC7B,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,eAAe,EAC5B,aAAa,CAAC,EAAE,eAAe,GAC7B,QAAQ,CAGV;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,IAAI,QAAQ,CAKtC;AAGD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACnE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/local-api/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAIjD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAE3B,CAAC,cAAc,EAAE,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;CAGjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,QAAQ;IAQnB,OAAO,CAAC,MAAM;IAPR,WAAW,EAAE,WAAW,CAAM;IACrC,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,aAAa,CAAyB;IAC9C,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,OAAO,CAA0B;gBAGhC,MAAM,EAAE,SAAS,EACzB,WAAW,EAAE,eAAe,EAC5B,aAAa,CAAC,EAAE,eAAe;IAmBhC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAgC7B;;;OAGG;IACH,OAAO,CAAC,UAAU;IAOlB;;OAEG;IACH,kBAAkB,IAAI,MAAM,EAAE;IAI9B;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIpC;;OAEG;IACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;CAGzD;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC7B,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,eAAe,EAC5B,aAAa,CAAC,EAAE,eAAe,GAC7B,QAAQ,CAGV;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,IAAI,QAAQ,CAKtC;AAGD,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACnE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/routes/assets-cdn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets-cdn.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets-cdn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,eAAO,MAAM,GAAG,EAAE,cAsLjB,CAAC"}
+{"version":3,"file":"assets-cdn.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets-cdn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,eAAO,MAAM,GAAG,EAAE,cAqMjB,CAAC"}

package/dist/routes/assets-cdn.js

@@ -97,14 +97,21 @@ export const GET = async ({ params, locals, setHeaders, request }) => {
             console.warn('[Asset CDN] Private asset accessed without auth - DENIED');
             return new Response('Unauthorized - This asset is private', { status: 401 });
         }
-        // If asset is private, verify org matches
-        if (isPrivate && organizationId && organizationId !== asset.organizationId) {
-            console.warn('[Asset CDN] Org mismatch for private asset - FORBIDDEN');
-            return new Response('Forbidden', { status: 403 });
-        }
-        // Log the decision
+        // If asset is private, verify user has access to the asset's org
+        // This includes exact match OR parent org accessing child org asset (hierarchy)
         if (isPrivate && organizationId) {
-            console.log('[Asset CDN] Private asset access ALLOWED - user has auth and org matches');
+            let hasAccess = organizationId === asset.organizationId; // Same org
+            // If not same org, check if asset's org is a child of user's org (hierarchy)
+            if (!hasAccess && databaseAdapter.getChildOrganizations) {
+                const childOrgs = await databaseAdapter.getChildOrganizations(organizationId);
+                hasAccess = childOrgs.includes(asset.organizationId);
+                console.log(`[Asset CDN] Checking hierarchy: user org ${organizationId} has ${childOrgs.length} children, asset org ${asset.organizationId} is child? ${hasAccess}`);
+            }
+            if (!hasAccess) {
+                console.warn(`[Asset CDN] Org ${organizationId} cannot access asset from org ${asset.organizationId} - FORBIDDEN`);
+                return new Response('Forbidden', { status: 403 });
+            }
+            console.log(`[Asset CDN] Private asset access ALLOWED - user org ${organizationId} has access to asset org ${asset.organizationId}`);
         }
         else if (!isPrivate) {
             console.log('[Asset CDN] Public asset access ALLOWED');

package/dist/routes/assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,eAAO,MAAM,IAAI,EAAE,cAiElB,CAAC;AAEF,eAAO,MAAM,GAAG,EAAE,cA4CjB,CAAC"}
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,eAAO,MAAM,IAAI,EAAE,cAuElB,CAAC;AAEF,eAAO,MAAM,GAAG,EAAE,cA4CjB,CAAC"}

package/dist/routes/assets.js

@@ -23,8 +23,12 @@ export const POST = async ({ request, locals }) => {
         // Get field metadata for privacy checking
         const schemaType = formData.get('schemaType') || undefined;
         const fieldPath = formData.get('fieldPath') || undefined;
+        // Get target organization (document's org takes precedence)
+        // This allows assets to belong to the document's org, not the uploader's org
+        const targetOrganizationId = formData.get('organizationId') || auth.organizationId;
         // Create asset upload data
         const uploadData = {
+            organizationId: targetOrganizationId, // Asset belongs to document's org
             buffer,
             originalFilename: file.name,
             mimeType: file.type,
@@ -40,7 +44,8 @@ export const POST = async ({ request, locals }) => {
             }
         };
         // Upload asset using the service
-        const asset = await assetService.uploadAsset(auth.organizationId, uploadData);
+        // The adapter will validate hierarchy access via withOrgContext
+        const asset = await assetService.uploadAsset(targetOrganizationId, uploadData);
         return json({
             success: true,
             data: asset

package/dist/routes/documents-by-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents-by-id.d.ts","sourceRoot":"","sources":["../../src/lib/routes/documents-by-id.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,GAAG,EAAE,cAuEjB,CAAC;AAGF,eAAO,MAAM,GAAG,EAAE,cAqEjB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cA+DpB,CAAC"}
+{"version":3,"file":"documents-by-id.d.ts","sourceRoot":"","sources":["../../src/lib/routes/documents-by-id.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAMpD,eAAO,MAAM,GAAG,EAAE,cAuEjB,CAAC;AAIF,eAAO,MAAM,GAAG,EAAE,cAkFjB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cA+DpB,CAAC"}

package/dist/routes/documents-by-id.js

@@ -3,6 +3,7 @@ import { json } from '@sveltejs/kit';
 import { authToContext } from '../local-api/auth-helpers.js';
 import { PermissionError } from '../local-api/permissions.js';
 // GET /api/documents/[id] - Get document by ID
+// TODO ENABLE CHILDREN ORG ACCESS BY DEFAULT - BECAUSE IF A PARENT ORG IS TRYING TO ACCESS A CHILD ORG. It should already have access to said id.
 export const GET = async ({ params, url, locals }) => {
     try {
         const { localAPI, databaseAdapter } = locals.aphexCMS;
@@ -16,7 +17,7 @@ export const GET = async ({ params, url, locals }) => {
         const depth = depthParam ? Math.max(0, Math.min(parseInt(depthParam), 5)) : 0;
         const perspective = url.searchParams.get('perspective') || 'draft';
         // First, fetch document to get its type (need this for collection-specific API)
-        const rawDoc = await databaseAdapter.findByDocId(context.organizationId, id, 0);
+        const rawDoc = await databaseAdapter.findByDocIdAdvanced(context.organizationId, id);
         if (!rawDoc) {
             return json({ success: false, error: 'Document not found' }, { status: 404 });
         }
@@ -59,6 +60,7 @@ export const GET = async ({ params, url, locals }) => {
     }
 };
 // PUT /api/documents/[id] - Update document
+// TODO ENABLE CHILDREN ORG ACCESS BY DEFAULT - BECAUSE IF A PARENT ORG IS TRYING TO ACCESS A CHILD ORG. It should already have access to said id.
 export const PUT = async ({ params, request, locals }) => {
     try {
         const { localAPI, databaseAdapter } = locals.aphexCMS;
@@ -71,7 +73,7 @@ export const PUT = async ({ params, request, locals }) => {
         const documentData = body.draftData || body.data;
         const shouldPublish = body.publish || false;
         // Fetch document to get its type
-        const rawDoc = await databaseAdapter.findByDocId(context.organizationId, id, 0);
+        const rawDoc = await databaseAdapter.findByDocIdAdvanced(context.organizationId, id);
         if (!rawDoc) {
             return json({ success: false, error: 'Document not found' }, { status: 404 });
         }
@@ -84,16 +86,17 @@ export const PUT = async ({ params, request, locals }) => {
                 message: `Collection '${rawDoc.type}' not found`
             }, { status: 400 });
         }
-        // Update via LocalAPI (permission checks happen inside)
-        const updatedDocument = await collection.update(context, id, documentData, {
+        // Update via LocalAPI (permission checks and validation happen inside)
+        const result = await collection.update(context, id, documentData, {
             publish: shouldPublish
         });
-        if (!updatedDocument) {
+        if (!result) {
             return json({ success: false, error: 'Document not found' }, { status: 404 });
         }
         return json({
             success: true,
-            data: updatedDocument
+            data: result.document,
+            validation: result.validation
         });
     }
     catch (error) {
@@ -105,6 +108,14 @@ export const PUT = async ({ params, request, locals }) => {
                 message: error.message
             }, { status: 403 });
         }
+        // Validation errors from publish attempts
+        if (error instanceof Error && error.message.includes('validation errors')) {
+            return json({
+                success: false,
+                error: 'Validation failed',
+                message: error.message
+            }, { status: 400 });
+        }
         return json({
             success: false,
             error: 'Failed to update document',
@@ -122,7 +133,7 @@ export const DELETE = async ({ params, locals }) => {
             return json({ success: false, error: 'Document ID is required' }, { status: 400 });
         }
         // Fetch document to get its type
-        const rawDoc = await databaseAdapter.findByDocId(context.organizationId, id, 0);
+        const rawDoc = await databaseAdapter.findByDocIdAdvanced(context.organizationId, id);
         if (!rawDoc) {
             return json({ success: false, error: 'Document not found' }, { status: 404 });
         }

package/dist/routes/documents-publish.js

@@ -16,7 +16,7 @@ export const POST = async ({ params, locals }) => {
             }, { status: 400 });
         }
         // Fetch document to get its type
-        const rawDoc = await databaseAdapter.findByDocId(context.organizationId, id, 0);
+        const rawDoc = await databaseAdapter.findByDocIdAdvanced(context.organizationId, id);
         if (!rawDoc) {
             return json({
                 success: false,
@@ -86,7 +86,7 @@ export const DELETE = async ({ params, locals }) => {
             }, { status: 400 });
         }
         // Fetch document to get its type
-        const rawDoc = await databaseAdapter.findByDocId(context.organizationId, id, 0);
+        const rawDoc = await databaseAdapter.findByDocIdAdvanced(context.organizationId, id);
         if (!rawDoc) {
             return json({
                 success: false,

package/dist/routes/documents-query.d.ts

@@ -17,7 +17,9 @@ import type { RequestHandler } from '@sveltejs/kit';
  *   "page": 1,
  *   "sort": ["-publishedAt", "title"],
  *   "depth": 1,
- *   "perspective": "published"
+ *   "perspective": "published",
+ *   "filterOrganizationIds": ["org_child1", "org_child2"],
+ *   "includeChildOrganizations": false
  * }
  */
 export declare const POST: RequestHandler;

package/dist/routes/documents-query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents-query.d.ts","sourceRoot":"","sources":["../../src/lib/routes/documents-query.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AASpD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,IAAI,EAAE,cAqFlB,CAAC"}
+{"version":3,"file":"documents-query.d.ts","sourceRoot":"","sources":["../../src/lib/routes/documents-query.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AASpD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,IAAI,EAAE,cAuFlB,CAAC"}

package/dist/routes/documents-query.js

@@ -23,7 +23,9 @@ const DEFAULT_PAGE = 1;
  *   "page": 1,
  *   "sort": ["-publishedAt", "title"],
  *   "depth": 1,
- *   "perspective": "published"
+ *   "perspective": "published",
+ *   "filterOrganizationIds": ["org_child1", "org_child2"],
+ *   "includeChildOrganizations": false
  * }
  */
 export const POST = async ({ request, locals }) => {
@@ -60,7 +62,9 @@ export const POST = async ({ request, locals }) => {
             sort: body.sort,
             depth: body.depth !== undefined ? Math.max(0, Math.min(body.depth, 5)) : 0,
             select: body.select,
-            perspective: body.perspective || 'draft'
+            perspective: body.perspective || 'draft',
+            includeChildOrganizations: body.includeChildOrganizations,
+            filterOrganizationIds: body.filterOrganizationIds
         };
         // Query via LocalAPI
         const result = await localAPI.collections[documentType].find(context, findOptions);