@dyrected/core 2.17.0 → 2.18.0

package/dist/server.js

@@ -6084,6 +6084,72 @@ function createReadonlyDb(db) {
   });
 }
 
+// src/utils/errors.ts
+var DyrectedError = class _DyrectedError extends Error {
+  statusCode;
+  constructor(message, statusCode = 500) {
+    super(message);
+    this.name = "DyrectedError";
+    this.statusCode = statusCode;
+    Object.setPrototypeOf(this, _DyrectedError.prototype);
+  }
+};
+var ValidationError = class _ValidationError extends DyrectedError {
+  constructor(message) {
+    super(message, 400);
+    this.name = "ValidationError";
+    Object.setPrototypeOf(this, _ValidationError.prototype);
+  }
+};
+
+// src/utils/field-integrity.ts
+function* storedFields(fields) {
+  for (const field of fields ?? []) {
+    if (field.type === "row") {
+      yield* storedFields(field.fields);
+    } else if (field.name) {
+      yield field;
+    }
+  }
+}
+function sameValue(a, b) {
+  if (a === b) return true;
+  if (a === null || b === null || a === void 0 || b === void 0) return a == b;
+  if (typeof a === "object" || typeof b === "object") {
+    return JSON.stringify(a) === JSON.stringify(b);
+  }
+  return false;
+}
+function assertImmutableFieldsUnchanged(fields, data, original) {
+  for (const field of storedFields(fields)) {
+    if (!field.immutable || data[field.name] === void 0) continue;
+    if (!sameValue(data[field.name], original[field.name])) {
+      throw new ValidationError(
+        `Field "${field.label ?? field.name}" is immutable and cannot be modified.`
+      );
+    }
+  }
+}
+function normalizeMoneyFields(fields, data) {
+  let next = data;
+  for (const field of storedFields(fields)) {
+    if (field.type !== "money") continue;
+    const value = data[field.name];
+    if (value === void 0 || value === null || value === "") continue;
+    let minor;
+    if (typeof value === "number") minor = value;
+    else if (typeof value === "string" && /^-?\d+$/.test(value.trim())) minor = Number(value.trim());
+    if (minor === void 0 || !Number.isSafeInteger(minor)) {
+      throw new ValidationError(
+        `Field "${field.label ?? field.name}" must be a whole number of minor units (for example kobo or cents).`
+      );
+    }
+    if (next === data) next = { ...data };
+    next[field.name] = minor;
+  }
+  return next;
+}
+
 // src/utils/upload-validation.ts
 function isMimeAllowed(mimeType, allowed) {
   const type = (mimeType || "").toLowerCase().trim();
@@ -6679,7 +6745,7 @@ async function dispatchLifecycleEvent(config, event) {
   }
 }
 async function saveWorkflowDraft(args) {
-  const { config, collection, id, originalDoc, data, user } = args;
+  const { config, collection, id, originalDoc, data, user, beforeCommit } = args;
   const db = config.db;
   const workflow = collection.workflow;
   if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
@@ -6713,13 +6779,14 @@ async function saveWorkflowDraft(args) {
     }
     const updated = await tx.update({ collection: collection.slug, id, data: updateData });
     await persistEvent(tx, event);
+    await beforeCommit?.(tx, updated);
     return updated;
   });
   void dispatchLifecycleEvent(config, event);
   return { doc, event };
 }
 async function createWorkflowDocument(args) {
-  const { config, collection, data, user } = args;
+  const { config, collection, data, user, beforeCommit } = args;
   const db = config.db;
   if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
   let event;
@@ -6733,13 +6800,14 @@ async function createWorkflowDocument(args) {
       payload: { revision: 1, previousRevision: null }
     });
     await persistEvent(tx, event);
+    await beforeCommit?.(tx, created);
     return created;
   });
   void dispatchLifecycleEvent(config, event);
   return { doc, event };
 }
 async function transitionWorkflow(args) {
-  const { config, collection, id, transitionName, expectedRevision, comment, user, req } = args;
+  const { config, collection, id, transitionName, expectedRevision, comment, input, user, req } = args;
   const db = config.db;
   const workflow = collection.workflow;
   if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
@@ -6765,7 +6833,7 @@ async function transitionWorkflow(args) {
   if (transition.requireComment && !comment?.trim()) {
     throw Object.assign(new Error(`A comment is required for "${transition.label}".`), { statusCode: 400 });
   }
-  const hookContext = { transition, from: meta.state, to: transition.to, doc: original, user, comment, req, db };
+  const hookContext = { transition, from: meta.state, to: transition.to, doc: original, user, comment, input, req, db };
   for (const hook of workflow.hooks?.beforeTransition ?? []) await hook(hookContext);
   const events = [
     createLifecycleEvent({
@@ -6819,6 +6887,19 @@ async function transitionWorkflow(args) {
     if (targetState.published) data.__published = working;
     if (transition.unpublish) data.__published = null;
     const next = await tx.update({ collection: collection.slug, id, data });
+    if (transition.onTransition) {
+      await transition.onTransition({
+        transition,
+        from: lockedMeta.state,
+        to: transition.to,
+        doc: locked,
+        input,
+        comment,
+        user,
+        req,
+        tx
+      });
+    }
     await tx.create({
       collection: WORKFLOW_HISTORY_COLLECTION,
       data: {
@@ -7458,6 +7539,7 @@ var CollectionController = class {
       updatedBy: user?.sub ?? null
     };
     data = DefaultsService.apply(this.collection.fields, data);
+    data = normalizeMoneyFields(this.collection.fields, data);
     if (this.collection.workflow) {
       data = initializeWorkflowDocument(data, this.collection.workflow);
     }
@@ -7505,12 +7587,18 @@ var CollectionController = class {
     if (!data.id) {
       data = { ...data, id: generateDocumentId(this.collection) };
     }
+    const beforeCommit = this.buildBeforeCommit(c, "create", user);
     const doc = this.collection.workflow ? (await createWorkflowDocument({
       config,
       collection: this.collection,
       data,
-      user
-    })).doc : await db.create({ collection: this.collection.slug, data });
+      user,
+      beforeCommit
+    })).doc : await this.persistInTransaction(
+      db,
+      beforeCommit,
+      (writer) => writer.create({ collection: this.collection.slug, data })
+    );
     if (this.collection.audit && db) {
       AuditService.log(db, {
         operation: "create",
@@ -7744,6 +7832,36 @@ var CollectionController = class {
     const body = await c.req.json();
     return this.performUpdate(c, id, body);
   }
+  /**
+   * Builds the callback that runs the collection's `beforeCommit` hooks inside
+   * the write transaction, or `undefined` when the collection has none.
+   */
+  buildBeforeCommit(c, operation, user, previousDoc) {
+    const hooks = this.collection.hooks?.beforeCommit;
+    if (!hooks?.length) return void 0;
+    return async (tx, doc) => {
+      for (const hook of hooks) {
+        await hook({ doc, previousDoc, req: this.toHookRequestContext(c), user, operation, tx });
+      }
+    };
+  }
+  /**
+   * Runs a single write. When `beforeCommit` hooks exist the write and the
+   * hooks share one transaction, so a throwing hook rolls the write back.
+   */
+  async persistInTransaction(db, beforeCommit, write) {
+    if (!beforeCommit) return write(db);
+    if (!db.transaction) {
+      throw new Error(
+        `Collection "${this.collection.slug}" defines beforeCommit hooks but the configured database adapter does not support transactions.`
+      );
+    }
+    return db.transaction(async (tx) => {
+      const doc = await write(tx);
+      await beforeCommit(tx, doc);
+      return doc;
+    });
+  }
   /**
    * Core update pipeline shared by PATCH requests and operational actions:
    * auth-field stripping, timestamps, access enforcement, field write access,
@@ -7785,6 +7903,7 @@ var CollectionController = class {
         403
       );
     }
+    data = normalizeMoneyFields(this.collection.fields, data);
     let before = null;
     if (this.collection.audit) {
       before = originalDoc;
@@ -7818,14 +7937,21 @@ var CollectionController = class {
       surface: "collection.beforeChange",
       path: `collection:${this.collection.slug}.hooks.beforeChange`
     });
+    assertImmutableFieldsUnchanged(this.collection.fields, data, originalDoc);
+    const beforeCommit = this.buildBeforeCommit(c, "update", user, originalDoc);
     const doc = this.collection.workflow ? (await saveWorkflowDraft({
       config,
       collection: this.collection,
       id,
       originalDoc,
       data,
-      user
-    })).doc : await db.update({ collection: this.collection.slug, id, data });
+      user,
+      beforeCommit
+    })).doc : await this.persistInTransaction(
+      db,
+      beforeCommit,
+      (writer) => writer.update({ collection: this.collection.slug, id, data })
+    );
     if (this.collection.audit && db) {
       AuditService.log(db, {
         operation: "update",
@@ -8052,6 +8178,7 @@ var CollectionController = class {
         transitionName,
         expectedRevision: body.expectedRevision,
         comment: body.comment,
+        input: body.input,
         user: c.get("user"),
         req: { query: c.req.query(), headers: c.req.header(), raw: c.req.raw }
       });
@@ -9383,6 +9510,20 @@ var MediaFolderController = class {
   }
 };
 
+// src/utils/admin-url.ts
+var DEFAULT_ADMIN_PATH = "/admin";
+function resolveAdminUrl(c, config, clientUrl) {
+  const configured = config.admin?.adminUrl?.trim() || process.env.DYRECTED_ADMIN_URL?.trim() || (typeof clientUrl === "string" ? clientUrl.trim() : "") || DEFAULT_ADMIN_PATH;
+  try {
+    return new URL(configured, c.req.url).toString();
+  } catch {
+    return configured;
+  }
+}
+function appendQueryParam(url, key, value) {
+  return `${url}${url.includes("?") ? "&" : "?"}${key}=${encodeURIComponent(value)}`;
+}
+
 // src/controllers/auth.controller.ts
 import { randomBytes as randomBytes3 } from "crypto";
 
@@ -10058,8 +10199,7 @@ var AuthController = class {
         },
         "1h"
       );
-      const resetUrl = body?.resetUrl;
-      const url = resetUrl ? `${resetUrl}${resetUrl.includes("?") ? "&" : "?"}token=${encodeURIComponent(resetToken)}` : void 0;
+      const url = appendQueryParam(resolveAdminUrl(c, config, body?.resetUrl), "token", resetToken);
       try {
         const { subject, html } = buildResetPasswordEmail(config, {
           token: resetToken,
@@ -10191,8 +10331,7 @@ var AuthController = class {
       },
       "7d"
     );
-    const inviteUrl = body?.inviteUrl;
-    const url = inviteUrl ? `${inviteUrl}${inviteUrl.includes("?") ? "&" : "?"}inviteToken=${encodeURIComponent(inviteToken)}` : void 0;
+    const url = appendQueryParam(resolveAdminUrl(c, config, body?.inviteUrl), "inviteToken", inviteToken);
     try {
       const { subject, html } = buildInviteEmail(config, {
         token: inviteToken,
@@ -12471,7 +12610,12 @@ function generateOpenApi(config) {
           type: "object",
           properties: {
             expectedRevision: { type: "integer", minimum: 1 },
-            comment: { type: "string" }
+            comment: { type: "string" },
+            input: {
+              type: "object",
+              additionalProperties: true,
+              description: "Extra data passed to the transition's onTransition handler."
+            }
           }
         },
         WorkflowHistoryEntry: {
@@ -13634,6 +13778,9 @@ function fieldToSchema(field) {
     case "number":
       schema = { type: "number" };
       break;
+    case "money":
+      schema = { type: "integer", description: "Amount in minor units (for example kobo or cents)." };
+      break;
     case "boolean":
       schema = { type: "boolean" };
       break;
@@ -14453,6 +14600,30 @@ function serializeDetailForApi(detail) {
   if (!detail || !Array.isArray(detail)) return void 0;
   return detail.map(serializeDetailItemForApi);
 }
+async function serializeActionsForApi(actions, serializeAccess) {
+  const serializeAccessConfig = async (access) => {
+    if (!access) return void 0;
+    const serialized = {};
+    for (const key of ["read", "create", "update", "delete"]) {
+      if (access[key] !== void 0) serialized[key] = await serializeAccess(access[key]);
+    }
+    return serialized;
+  };
+  return Promise.all(
+    (actions || []).map(async (action) => ({
+      name: action.name,
+      label: action.label,
+      icon: action.icon,
+      type: action.type ?? "row",
+      confirm: action.confirm,
+      submitLabel: action.submitLabel,
+      fields: action.fields?.map(serializeFieldForApi),
+      mutation: action.mutation,
+      // Self-hosted handlers are intentionally omitted: they never leave the server.
+      access: action.access ? await serializeAccessConfig(action.access) : void 0
+    }))
+  );
+}
 async function serializeViewForApi(view, serializeAccess) {
   if (!view) return view;
   const serializeAccessConfig = async (access) => {
@@ -14479,20 +14650,7 @@ async function serializeViewForApi(view, serializeAccess) {
     features: view.features,
     actionOrder: view.actionOrder,
     components: view.components,
-    actions: await Promise.all(
-      (view.actions || []).map(async (action) => ({
-        name: action.name,
-        label: action.label,
-        icon: action.icon,
-        type: action.type ?? "row",
-        confirm: action.confirm,
-        submitLabel: action.submitLabel,
-        fields: action.fields?.map(serializeFieldForApi),
-        mutation: action.mutation,
-        // Self-hosted handlers are intentionally omitted: they never leave the server.
-        access: action.access ? await serializeAccessConfig(action.access) : void 0
-      }))
-    ),
+    actions: await serializeActionsForApi(view.actions, serializeAccess),
     access: view.access ? await serializeAccessConfig(view.access) : void 0
   };
 }
@@ -14574,6 +14732,7 @@ function registerRoutes(app, config) {
         drafts: !!col.drafts,
         defaultView: col.defaultView ?? col.admin?.defaultView,
         views: await Promise.all((col.views || []).map((view) => serializeViewForApi(view, serializeAccess))),
+        actions: await serializeActionsForApi(col.actions, serializeAccess),
         admin: col.admin,
         detail: serializeDetailForApi(col.detail),
         workflow: col.workflow ? {
@@ -15454,6 +15613,31 @@ function registerRoutes(app, config) {
   });
 }
 
+// src/tasks.ts
+var TASK_LOCKS_COLLECTION = "__task_locks";
+var TASK_LOCKS_COLLECTION_CONFIG = {
+  slug: TASK_LOCKS_COLLECTION,
+  labels: { singular: "Task lock", plural: "Task locks" },
+  fields: [
+    { name: "name", type: "text", required: true },
+    // Numeric and promoted so the lock compare-and-set is a real column comparison.
+    { name: "lockedUntil", type: "number", required: true, promoted: true },
+    { name: "lockedBy", type: "text" },
+    { name: "lastScheduledFor", type: "date" },
+    { name: "lastStartedAt", type: "date" },
+    { name: "lastFinishedAt", type: "date" },
+    { name: "lastStatus", type: "text" },
+    { name: "lastError", type: "textarea" }
+  ],
+  access: {
+    read: ({ user }) => !!user?.roles?.includes("admin"),
+    create: () => false,
+    update: () => false,
+    delete: () => false
+  },
+  admin: { hidden: true }
+};
+
 // src/utils/config.ts
 var AUDIT_COLLECTION_SLUG = "__audit";
 var SYSTEM_FIELDS = [
@@ -15605,6 +15789,7 @@ function normalizeConfig(config) {
   const globals = schemaAwareConfig?.globals || [];
   const needsAudit = collections.some((col) => col.audit);
   const needsWorkflow = collections.some((col) => col.workflow || col.drafts);
+  const needsTasks = (config.tasks?.length ?? 0) > 0;
   const needsAuthSessions = collections.some((col) => !!col.auth);
   const adminAuthCollectionSlug = getAdminAuthCollection({
     collections,
@@ -15837,6 +16022,9 @@ function normalizeConfig(config) {
   if (needsWorkflow && !normalizedCollections.some((col) => col.slug === LIFECYCLE_EVENTS_COLLECTION)) {
     systemCollections.push(LIFECYCLE_EVENTS_COLLECTION_CONFIG);
   }
+  if (needsTasks && !normalizedCollections.some((col) => col.slug === TASK_LOCKS_COLLECTION)) {
+    systemCollections.push(TASK_LOCKS_COLLECTION_CONFIG);
+  }
   if (needsAuthSessions && !normalizedCollections.some((col) => col.slug === AUTH_SESSIONS_COLLECTION)) {
     systemCollections.push(AUTH_SESSIONS_COLLECTION_CONFIG);
   }
@@ -16206,6 +16394,7 @@ export {
   revokeAllAuthSessions,
   revokeAuthSession,
   sendEmail,
+  serializeActionsForApi,
   serializeDetailForApi,
   serializeViewForApi,
   shouldSampleRequest,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dyrected/core",
-  "version": "2.17.0",
+  "version": "2.18.0",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",