@dyrected/core 2.13.3 → 2.13.5

package/dist/index.cjs

@@ -2085,7 +2085,7 @@ function publicMetadata(meta) {
 }
 function workflowCapabilities(workflow, user) {
   const capabilities = new Set(Array.isArray(user?.capabilities) ? user.capabilities : []);
-  const roles = Array.isArray(user?.roles) ? user.roles : [];
+  const roles = Array.isArray(user?.roles) ? user.roles : typeof user?.role === "string" ? [user.role] : [];
   for (const mapping of workflow.roles ?? []) {
     if (roles.includes(mapping.role)) mapping.capabilities.forEach((capability) => capabilities.add(capability));
   }
@@ -2476,10 +2476,12 @@ function getAdminRoleForCollection(collection) {
   return "admin";
 }
 function isUserAdmin(user, collection) {
-  if (!user || !Array.isArray(user.roles)) return false;
+  if (!user) return false;
+  const roles = Array.isArray(user.roles) ? user.roles : typeof user.role === "string" ? [user.role] : [];
+  if (roles.length === 0) return false;
   const configuredRole = getAdminRoleForCollection(collection);
-  if (user.roles.includes(configuredRole)) return true;
-  return user.roles.includes("admin") || user.roles.includes("super_admin");
+  if (roles.includes(configuredRole)) return true;
+  return roles.includes("admin") || roles.includes("super_admin");
 }
 
 // src/utils/block-references.ts
@@ -3705,7 +3707,7 @@ function normalizeConfig(config) {
           }
         ];
       }
-      if (!existingFieldNames.has("roles")) {
+      if (!existingFieldNames.has("roles") && !existingFieldNames.has("role")) {
         fields = [
           ...fields,
           {
@@ -3719,7 +3721,7 @@ function normalizeConfig(config) {
               { value: "viewer", label: "Viewer" }
             ],
             access: {
-              update: "user.roles && 'admin' in user.roles"
+              update: "user.role == 'admin' || (user.roles != null && 'admin' in user.roles)"
             }
           }
         ];
@@ -3737,10 +3739,10 @@ function normalizeConfig(config) {
               { value: "pending", label: "Pending" }
             ],
             access: {
-              update: "user.roles && 'admin' in user.roles && user.id != id"
+              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
             },
             admin: {
-              condition: `!(data.roles && "admin" in data.roles)`
+              condition: `!(data.roles && "admin" in data.roles) && data.role != "admin"`
             }
           }
         ];
@@ -3774,13 +3776,13 @@ function normalizeConfig(config) {
             }
           };
         }
-        if (field.name === "roles") {
+        if (field.name === "roles" || field.name === "role") {
           return {
             ...field,
             access: {
               ...field.access || {},
               // Must be an admin; cannot edit own roles (no self-elevation).
-              update: "user.roles && 'admin' in user.roles && user.id != id"
+              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
             }
           };
         }
@@ -3789,7 +3791,7 @@ function normalizeConfig(config) {
             ...field,
             access: {
               ...field.access || {},
-              update: "user.roles && 'admin' in user.roles && user.id != id"
+              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
             }
           };
         }

package/dist/index.js

@@ -1911,7 +1911,7 @@ function publicMetadata(meta) {
 }
 function workflowCapabilities(workflow, user) {
   const capabilities = new Set(Array.isArray(user?.capabilities) ? user.capabilities : []);
-  const roles = Array.isArray(user?.roles) ? user.roles : [];
+  const roles = Array.isArray(user?.roles) ? user.roles : typeof user?.role === "string" ? [user.role] : [];
   for (const mapping of workflow.roles ?? []) {
     if (roles.includes(mapping.role)) mapping.capabilities.forEach((capability) => capabilities.add(capability));
   }
@@ -2302,10 +2302,12 @@ function getAdminRoleForCollection(collection) {
   return "admin";
 }
 function isUserAdmin(user, collection) {
-  if (!user || !Array.isArray(user.roles)) return false;
+  if (!user) return false;
+  const roles = Array.isArray(user.roles) ? user.roles : typeof user.role === "string" ? [user.role] : [];
+  if (roles.length === 0) return false;
   const configuredRole = getAdminRoleForCollection(collection);
-  if (user.roles.includes(configuredRole)) return true;
-  return user.roles.includes("admin") || user.roles.includes("super_admin");
+  if (roles.includes(configuredRole)) return true;
+  return roles.includes("admin") || roles.includes("super_admin");
 }
 
 // src/utils/block-references.ts
@@ -3531,7 +3533,7 @@ function normalizeConfig(config) {
           }
         ];
       }
-      if (!existingFieldNames.has("roles")) {
+      if (!existingFieldNames.has("roles") && !existingFieldNames.has("role")) {
         fields = [
           ...fields,
           {
@@ -3545,7 +3547,7 @@ function normalizeConfig(config) {
               { value: "viewer", label: "Viewer" }
             ],
             access: {
-              update: "user.roles && 'admin' in user.roles"
+              update: "user.role == 'admin' || (user.roles != null && 'admin' in user.roles)"
             }
           }
         ];
@@ -3563,10 +3565,10 @@ function normalizeConfig(config) {
               { value: "pending", label: "Pending" }
             ],
             access: {
-              update: "user.roles && 'admin' in user.roles && user.id != id"
+              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
             },
             admin: {
-              condition: `!(data.roles && "admin" in data.roles)`
+              condition: `!(data.roles && "admin" in data.roles) && data.role != "admin"`
             }
           }
         ];
@@ -3600,13 +3602,13 @@ function normalizeConfig(config) {
             }
           };
         }
-        if (field.name === "roles") {
+        if (field.name === "roles" || field.name === "role") {
           return {
             ...field,
             access: {
               ...field.access || {},
               // Must be an admin; cannot edit own roles (no self-elevation).
-              update: "user.roles && 'admin' in user.roles && user.id != id"
+              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
             }
           };
         }
@@ -3615,7 +3617,7 @@ function normalizeConfig(config) {
             ...field,
             access: {
               ...field.access || {},
-              update: "user.roles && 'admin' in user.roles && user.id != id"
+              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
             }
           };
         }

package/dist/server.cjs

@@ -6190,10 +6190,12 @@ function getAdminRoleForCollection(collection) {
   return "admin";
 }
 function isUserAdmin(user, collection) {
-  if (!user || !Array.isArray(user.roles)) return false;
+  if (!user) return false;
+  const roles = Array.isArray(user.roles) ? user.roles : typeof user.role === "string" ? [user.role] : [];
+  if (roles.length === 0) return false;
   const configuredRole = getAdminRoleForCollection(collection);
-  if (user.roles.includes(configuredRole)) return true;
-  return user.roles.includes("admin") || user.roles.includes("super_admin");
+  if (roles.includes(configuredRole)) return true;
+  return roles.includes("admin") || roles.includes("super_admin");
 }
 
 // src/utils/collection-search.ts
@@ -6449,7 +6451,7 @@ function publicMetadata(meta) {
 }
 function workflowCapabilities(workflow, user) {
   const capabilities = new Set(Array.isArray(user?.capabilities) ? user.capabilities : []);
-  const roles = Array.isArray(user?.roles) ? user.roles : [];
+  const roles = Array.isArray(user?.roles) ? user.roles : typeof user?.role === "string" ? [user.role] : [];
   for (const mapping of workflow.roles ?? []) {
     if (roles.includes(mapping.role)) mapping.capabilities.forEach((capability) => capabilities.add(capability));
   }
@@ -9526,7 +9528,14 @@ var AuthController = class {
       lockedUntil: _lockedUntil,
       ...safeUser
     } = user;
-    return safeUser;
+    const roles = Array.isArray(safeUser.roles) ? safeUser.roles : typeof safeUser.role === "string" ? [safeUser.role] : [];
+    const role = typeof safeUser.role === "string" ? safeUser.role : roles[0];
+    return {
+      ...safeUser,
+      collection: safeUser.collection || this.collection.slug,
+      ...role !== void 0 ? { role } : {},
+      roles
+    };
   }
   hasField(name) {
     return (this.collection.fields || []).some((field) => field.name === name);
@@ -9654,13 +9663,16 @@ var AuthController = class {
         }
       }
     }
+    const hasRoleField = this.collection.fields?.some((f) => f.name === "role");
+    const hasRolesField = this.collection.fields?.some((f) => f.name === "roles");
+    const rolePayload = hasRoleField && !hasRolesField ? { role: initialRole } : { roles: [initialRole] };
     const hashedPassword = await hashPassword(body.password);
     const user = await db.create({
       collection: this.collection.slug,
       data: {
         ...body,
         password: hashedPassword,
-        roles: [initialRole]
+        ...rolePayload
       }
     });
     const token = await issueAuthSessionToken({
@@ -9828,7 +9840,10 @@ var AuthController = class {
       return c.json({ error: true, message: "User not found." }, 404);
     }
     const safeUser = this.sanitizeUser(user);
-    return c.json(safeUser);
+    return c.json({
+      ...safeUser,
+      collection: this.collection.slug
+    });
   }
   // ---------------------------------------------------------------------------
   // POST /refresh-token
@@ -12054,8 +12069,12 @@ async function resolveUser(payload, config) {
     return null;
   }
   const { password: _password, ...safe } = doc;
+  const roles = Array.isArray(safe.roles) ? safe.roles : typeof safe.role === "string" ? [safe.role] : [];
+  const role = typeof safe.role === "string" ? safe.role : roles[0];
   return {
     ...safe,
+    ...role !== void 0 ? { role } : {},
+    roles,
     sub: payload.sub,
     email: payload.email ?? safe.email,
     collection: payload.collection
@@ -12137,7 +12156,12 @@ function optionalAuth(config) {
           c.set("user", user);
         }
         c.set("authTokenPayload", resolved.payload);
-      } catch {
+      } catch (err) {
+        getConfigLogger(config ?? c.get("config"), "auth").warn({
+          err,
+          msg: "optionalAuth failed to resolve token",
+          path: c.req.path
+        });
       }
     }
     await next();
@@ -14638,7 +14662,7 @@ function normalizeConfig(config) {
           }
         ];
       }
-      if (!existingFieldNames.has("roles")) {
+      if (!existingFieldNames.has("roles") && !existingFieldNames.has("role")) {
         fields = [
           ...fields,
           {
@@ -14652,7 +14676,7 @@ function normalizeConfig(config) {
               { value: "viewer", label: "Viewer" }
             ],
             access: {
-              update: "user.roles && 'admin' in user.roles"
+              update: "user.role == 'admin' || (user.roles != null && 'admin' in user.roles)"
             }
           }
         ];
@@ -14670,10 +14694,10 @@ function normalizeConfig(config) {
               { value: "pending", label: "Pending" }
             ],
             access: {
-              update: "user.roles && 'admin' in user.roles && user.id != id"
+              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
             },
             admin: {
-              condition: `!(data.roles && "admin" in data.roles)`
+              condition: `!(data.roles && "admin" in data.roles) && data.role != "admin"`
             }
           }
         ];
@@ -14707,13 +14731,13 @@ function normalizeConfig(config) {
             }
           };
         }
-        if (field.name === "roles") {
+        if (field.name === "roles" || field.name === "role") {
           return {
             ...field,
             access: {
               ...field.access || {},
               // Must be an admin; cannot edit own roles (no self-elevation).
-              update: "user.roles && 'admin' in user.roles && user.id != id"
+              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
             }
           };
         }
@@ -14722,7 +14746,7 @@ function normalizeConfig(config) {
             ...field,
             access: {
               ...field.access || {},
-              update: "user.roles && 'admin' in user.roles && user.id != id"
+              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
             }
           };
         }

package/dist/server.d.cts

@@ -2,8 +2,8 @@ import { J as DyrectedContext, D as DyrectedConfig, C as CollectionConfig, G as
 export { cV as DyrectedObservabilityRuntime, cW as RequestBodyCapture, cX as RequestTraceContext, cY as ResolvedObservabilityConfig, cZ as attachRequestMetrics, c_ as bindObservabilityRuntime, c$ as buildRequestLogger, d0 as captureRequestBody, d1 as createDyrectedApp, d2 as createObservabilityRuntime, d3 as createRequestSpan, d4 as endRequestSpan, d5 as getConfigLogger, d6 as getObservabilityRuntime, d7 as getRequestLogger, d8 as redactBody, d9 as redactHeaders, da as renderPrometheusMetrics, db as resolveObservabilityConfig, dc as shouldSampleRequest } from './app-De-3eNn1.cjs';
 import * as hono from 'hono';
 import { Hono, Context, Next } from 'hono';
-import * as hono_utils_types from 'hono/utils/types';
 import * as hono_utils_http_status from 'hono/utils/http-status';
+import * as hono_utils_types from 'hono/utils/types';
 import { LanguageModel, EmbeddingModel } from 'ai';
 import 'hono/types';
 import 'pino';
@@ -63,7 +63,9 @@ declare class AuthController {
     }, 400, "json">) | (Response & hono.TypedResponse<{
         token: string;
         user: {
-            [x: string]: hono_utils_types.JSONValue;
+            roles: any[];
+            role?: any;
+            collection: string;
         };
     }, hono_utils_http_status.ContentfulStatusCode, "json">)>;
     login(c: Context<DyrectedContext>): Promise<(Response & hono.TypedResponse<{
@@ -84,7 +86,9 @@ declare class AuthController {
     }, 429, "json">) | (Response & hono.TypedResponse<{
         token: string;
         user: {
-            [x: string]: hono_utils_types.JSONValue;
+            roles: any[];
+            role?: any;
+            collection: string;
         };
     }, hono_utils_http_status.ContentfulStatusCode, "json">)>;
     logout(c: Context<DyrectedContext>): Promise<(Response & hono.TypedResponse<{
@@ -103,7 +107,9 @@ declare class AuthController {
         error: true;
         message: string;
     }, 404, "json">) | (Response & hono.TypedResponse<{
-        [x: string]: hono_utils_types.JSONValue;
+        collection: string;
+        roles: any[];
+        role?: any;
     }, hono_utils_http_status.ContentfulStatusCode, "json">)>;
     refreshToken(c: Context<DyrectedContext>): Promise<(Response & hono.TypedResponse<{
         error: true;
@@ -160,7 +166,9 @@ declare class AuthController {
     }, 409, "json">) | (Response & hono.TypedResponse<{
         token: string;
         user: {
-            [x: string]: hono_utils_types.JSONValue;
+            roles: any[];
+            role?: any;
+            collection: string;
         };
     }, 201, "json">)>;
 }

package/dist/server.d.ts

@@ -2,8 +2,8 @@ import { J as DyrectedContext, D as DyrectedConfig, C as CollectionConfig, G as
 export { cV as DyrectedObservabilityRuntime, cW as RequestBodyCapture, cX as RequestTraceContext, cY as ResolvedObservabilityConfig, cZ as attachRequestMetrics, c_ as bindObservabilityRuntime, c$ as buildRequestLogger, d0 as captureRequestBody, d1 as createDyrectedApp, d2 as createObservabilityRuntime, d3 as createRequestSpan, d4 as endRequestSpan, d5 as getConfigLogger, d6 as getObservabilityRuntime, d7 as getRequestLogger, d8 as redactBody, d9 as redactHeaders, da as renderPrometheusMetrics, db as resolveObservabilityConfig, dc as shouldSampleRequest } from './app-De-3eNn1.js';
 import * as hono from 'hono';
 import { Hono, Context, Next } from 'hono';
-import * as hono_utils_types from 'hono/utils/types';
 import * as hono_utils_http_status from 'hono/utils/http-status';
+import * as hono_utils_types from 'hono/utils/types';
 import { LanguageModel, EmbeddingModel } from 'ai';
 import 'hono/types';
 import 'pino';
@@ -63,7 +63,9 @@ declare class AuthController {
     }, 400, "json">) | (Response & hono.TypedResponse<{
         token: string;
         user: {
-            [x: string]: hono_utils_types.JSONValue;
+            roles: any[];
+            role?: any;
+            collection: string;
         };
     }, hono_utils_http_status.ContentfulStatusCode, "json">)>;
     login(c: Context<DyrectedContext>): Promise<(Response & hono.TypedResponse<{
@@ -84,7 +86,9 @@ declare class AuthController {
     }, 429, "json">) | (Response & hono.TypedResponse<{
         token: string;
         user: {
-            [x: string]: hono_utils_types.JSONValue;
+            roles: any[];
+            role?: any;
+            collection: string;
         };
     }, hono_utils_http_status.ContentfulStatusCode, "json">)>;
     logout(c: Context<DyrectedContext>): Promise<(Response & hono.TypedResponse<{
@@ -103,7 +107,9 @@ declare class AuthController {
         error: true;
         message: string;
     }, 404, "json">) | (Response & hono.TypedResponse<{
-        [x: string]: hono_utils_types.JSONValue;
+        collection: string;
+        roles: any[];
+        role?: any;
     }, hono_utils_http_status.ContentfulStatusCode, "json">)>;
     refreshToken(c: Context<DyrectedContext>): Promise<(Response & hono.TypedResponse<{
         error: true;
@@ -160,7 +166,9 @@ declare class AuthController {
     }, 409, "json">) | (Response & hono.TypedResponse<{
         token: string;
         user: {
-            [x: string]: hono_utils_types.JSONValue;
+            roles: any[];
+            role?: any;
+            collection: string;
         };
     }, 201, "json">)>;
 }

package/dist/server.js

@@ -6154,10 +6154,12 @@ function getAdminRoleForCollection(collection) {
   return "admin";
 }
 function isUserAdmin(user, collection) {
-  if (!user || !Array.isArray(user.roles)) return false;
+  if (!user) return false;
+  const roles = Array.isArray(user.roles) ? user.roles : typeof user.role === "string" ? [user.role] : [];
+  if (roles.length === 0) return false;
   const configuredRole = getAdminRoleForCollection(collection);
-  if (user.roles.includes(configuredRole)) return true;
-  return user.roles.includes("admin") || user.roles.includes("super_admin");
+  if (roles.includes(configuredRole)) return true;
+  return roles.includes("admin") || roles.includes("super_admin");
 }
 
 // src/utils/collection-search.ts
@@ -6413,7 +6415,7 @@ function publicMetadata(meta) {
 }
 function workflowCapabilities(workflow, user) {
   const capabilities = new Set(Array.isArray(user?.capabilities) ? user.capabilities : []);
-  const roles = Array.isArray(user?.roles) ? user.roles : [];
+  const roles = Array.isArray(user?.roles) ? user.roles : typeof user?.role === "string" ? [user.role] : [];
   for (const mapping of workflow.roles ?? []) {
     if (roles.includes(mapping.role)) mapping.capabilities.forEach((capability) => capabilities.add(capability));
   }
@@ -9490,7 +9492,14 @@ var AuthController = class {
       lockedUntil: _lockedUntil,
       ...safeUser
     } = user;
-    return safeUser;
+    const roles = Array.isArray(safeUser.roles) ? safeUser.roles : typeof safeUser.role === "string" ? [safeUser.role] : [];
+    const role = typeof safeUser.role === "string" ? safeUser.role : roles[0];
+    return {
+      ...safeUser,
+      collection: safeUser.collection || this.collection.slug,
+      ...role !== void 0 ? { role } : {},
+      roles
+    };
   }
   hasField(name) {
     return (this.collection.fields || []).some((field) => field.name === name);
@@ -9618,13 +9627,16 @@ var AuthController = class {
         }
       }
     }
+    const hasRoleField = this.collection.fields?.some((f) => f.name === "role");
+    const hasRolesField = this.collection.fields?.some((f) => f.name === "roles");
+    const rolePayload = hasRoleField && !hasRolesField ? { role: initialRole } : { roles: [initialRole] };
     const hashedPassword = await hashPassword(body.password);
     const user = await db.create({
       collection: this.collection.slug,
       data: {
         ...body,
         password: hashedPassword,
-        roles: [initialRole]
+        ...rolePayload
       }
     });
     const token = await issueAuthSessionToken({
@@ -9792,7 +9804,10 @@ var AuthController = class {
       return c.json({ error: true, message: "User not found." }, 404);
     }
     const safeUser = this.sanitizeUser(user);
-    return c.json(safeUser);
+    return c.json({
+      ...safeUser,
+      collection: this.collection.slug
+    });
   }
   // ---------------------------------------------------------------------------
   // POST /refresh-token
@@ -12023,8 +12038,12 @@ async function resolveUser(payload, config) {
     return null;
   }
   const { password: _password, ...safe } = doc;
+  const roles = Array.isArray(safe.roles) ? safe.roles : typeof safe.role === "string" ? [safe.role] : [];
+  const role = typeof safe.role === "string" ? safe.role : roles[0];
   return {
     ...safe,
+    ...role !== void 0 ? { role } : {},
+    roles,
     sub: payload.sub,
     email: payload.email ?? safe.email,
     collection: payload.collection
@@ -12106,7 +12125,12 @@ function optionalAuth(config) {
           c.set("user", user);
         }
         c.set("authTokenPayload", resolved.payload);
-      } catch {
+      } catch (err) {
+        getConfigLogger(config ?? c.get("config"), "auth").warn({
+          err,
+          msg: "optionalAuth failed to resolve token",
+          path: c.req.path
+        });
       }
     }
     await next();
@@ -14607,7 +14631,7 @@ function normalizeConfig(config) {
           }
         ];
       }
-      if (!existingFieldNames.has("roles")) {
+      if (!existingFieldNames.has("roles") && !existingFieldNames.has("role")) {
         fields = [
           ...fields,
           {
@@ -14621,7 +14645,7 @@ function normalizeConfig(config) {
               { value: "viewer", label: "Viewer" }
             ],
             access: {
-              update: "user.roles && 'admin' in user.roles"
+              update: "user.role == 'admin' || (user.roles != null && 'admin' in user.roles)"
             }
           }
         ];
@@ -14639,10 +14663,10 @@ function normalizeConfig(config) {
               { value: "pending", label: "Pending" }
             ],
             access: {
-              update: "user.roles && 'admin' in user.roles && user.id != id"
+              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
             },
             admin: {
-              condition: `!(data.roles && "admin" in data.roles)`
+              condition: `!(data.roles && "admin" in data.roles) && data.role != "admin"`
             }
           }
         ];
@@ -14676,13 +14700,13 @@ function normalizeConfig(config) {
             }
           };
         }
-        if (field.name === "roles") {
+        if (field.name === "roles" || field.name === "role") {
           return {
             ...field,
             access: {
               ...field.access || {},
               // Must be an admin; cannot edit own roles (no self-elevation).
-              update: "user.roles && 'admin' in user.roles && user.id != id"
+              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
             }
           };
         }
@@ -14691,7 +14715,7 @@ function normalizeConfig(config) {
             ...field,
             access: {
               ...field.access || {},
-              update: "user.roles && 'admin' in user.roles && user.id != id"
+              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
             }
           };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dyrected/core",
-  "version": "2.13.3",
+  "version": "2.13.5",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",