@dyrected/core 2.23.0 → 2.24.1

package/dist/server.js

@@ -1782,6 +1782,243 @@ var require_Jexl = __commonJS({
   }
 });
 
+// src/types/access.ts
+var init_access = __esm({
+  "src/types/access.ts"() {
+    "use strict";
+  }
+});
+
+// src/types/adapters.ts
+var init_adapters = __esm({
+  "src/types/adapters.ts"() {
+    "use strict";
+  }
+});
+
+// src/types/aggregate.ts
+var init_aggregate = __esm({
+  "src/types/aggregate.ts"() {
+    "use strict";
+  }
+});
+
+// src/types/admin.ts
+var FORM_SHELLS;
+var init_admin = __esm({
+  "src/types/admin.ts"() {
+    "use strict";
+    FORM_SHELLS = ["full", "header", "none"];
+  }
+});
+
+// src/types/admin-auth.ts
+var init_admin_auth = __esm({
+  "src/types/admin-auth.ts"() {
+    "use strict";
+  }
+});
+
+// src/types/app-config.ts
+var init_app_config = __esm({
+  "src/types/app-config.ts"() {
+    "use strict";
+  }
+});
+
+// src/types/documents.ts
+var init_documents = __esm({
+  "src/types/documents.ts"() {
+    "use strict";
+  }
+});
+
+// src/types/hooks.ts
+var init_hooks = __esm({
+  "src/types/hooks.ts"() {
+    "use strict";
+  }
+});
+
+// src/types/request.ts
+var init_request = __esm({
+  "src/types/request.ts"() {
+    "use strict";
+  }
+});
+
+// src/types/schema-config.ts
+var init_schema_config = __esm({
+  "src/types/schema-config.ts"() {
+    "use strict";
+  }
+});
+
+// src/types/schema-core.ts
+var init_schema_core = __esm({
+  "src/types/schema-core.ts"() {
+    "use strict";
+  }
+});
+
+// src/types/schema-inference.ts
+var init_schema_inference = __esm({
+  "src/types/schema-inference.ts"() {
+    "use strict";
+  }
+});
+
+// src/types/workflows.ts
+var init_workflows = __esm({
+  "src/types/workflows.ts"() {
+    "use strict";
+  }
+});
+
+// src/types/tasks.ts
+var init_tasks = __esm({
+  "src/types/tasks.ts"() {
+    "use strict";
+  }
+});
+
+// src/types/detail.ts
+var init_detail = __esm({
+  "src/types/detail.ts"() {
+    "use strict";
+  }
+});
+
+// src/types/views.ts
+var init_views = __esm({
+  "src/types/views.ts"() {
+    "use strict";
+  }
+});
+
+// src/types/ai.ts
+var ai_exports = {};
+__export(ai_exports, {
+  AI_ACTIONS_COLLECTION: () => AI_ACTIONS_COLLECTION,
+  AI_AUDIT_COLLECTION: () => AI_AUDIT_COLLECTION,
+  AI_CHUNKS_COLLECTION: () => AI_CHUNKS_COLLECTION,
+  AI_MESSAGES_COLLECTION: () => AI_MESSAGES_COLLECTION,
+  AI_THREADS_COLLECTION: () => AI_THREADS_COLLECTION,
+  isAICollection: () => isAICollection
+});
+function isAICollection(slug) {
+  return slug === AI_THREADS_COLLECTION || slug === AI_MESSAGES_COLLECTION || slug === AI_CHUNKS_COLLECTION || slug === AI_ACTIONS_COLLECTION || slug === AI_AUDIT_COLLECTION;
+}
+var AI_THREADS_COLLECTION, AI_MESSAGES_COLLECTION, AI_CHUNKS_COLLECTION, AI_ACTIONS_COLLECTION, AI_AUDIT_COLLECTION;
+var init_ai = __esm({
+  "src/types/ai.ts"() {
+    "use strict";
+    AI_THREADS_COLLECTION = "_dyrected_ai_threads";
+    AI_MESSAGES_COLLECTION = "_dyrected_ai_messages";
+    AI_CHUNKS_COLLECTION = "_dyrected_ai_chunks";
+    AI_ACTIONS_COLLECTION = "_dyrected_ai_actions";
+    AI_AUDIT_COLLECTION = "_dyrected_ai_audit";
+  }
+});
+
+// src/types/ai-errors.ts
+var DyrectedAIError;
+var init_ai_errors = __esm({
+  "src/types/ai-errors.ts"() {
+    "use strict";
+    DyrectedAIError = class _DyrectedAIError extends Error {
+      code;
+      status;
+      details;
+      constructor(code, message, status = 500, details) {
+        super(message);
+        this.name = "DyrectedAIError";
+        this.code = code;
+        this.status = status;
+        this.details = details;
+        Object.setPrototypeOf(this, _DyrectedAIError.prototype);
+      }
+      toJSON() {
+        return {
+          error: true,
+          code: this.code,
+          message: this.message,
+          status: this.status,
+          details: this.details
+        };
+      }
+    };
+  }
+});
+
+// src/types/readonly-fix.ts
+var init_readonly_fix = __esm({
+  "src/types/readonly-fix.ts"() {
+    "use strict";
+  }
+});
+
+// src/types/navigation.ts
+var CURRENT_NAV_PREFERENCES_VERSION, DEFAULT_USER_NAV_PREFERENCES;
+var init_navigation = __esm({
+  "src/types/navigation.ts"() {
+    "use strict";
+    CURRENT_NAV_PREFERENCES_VERSION = 1;
+    DEFAULT_USER_NAV_PREFERENCES = {
+      _version: CURRENT_NAV_PREFERENCES_VERSION,
+      pinned: [],
+      hidden: [],
+      groupOrder: [],
+      itemOrder: {},
+      groups: [],
+      items: []
+    };
+  }
+});
+
+// src/types/email.ts
+var init_email = __esm({
+  "src/types/email.ts"() {
+    "use strict";
+  }
+});
+
+// src/types/pages.ts
+var init_pages = __esm({
+  "src/types/pages.ts"() {
+    "use strict";
+  }
+});
+
+// src/types/index.ts
+var init_types = __esm({
+  "src/types/index.ts"() {
+    "use strict";
+    init_access();
+    init_adapters();
+    init_aggregate();
+    init_admin();
+    init_admin_auth();
+    init_app_config();
+    init_documents();
+    init_hooks();
+    init_request();
+    init_schema_config();
+    init_schema_core();
+    init_schema_inference();
+    init_workflows();
+    init_tasks();
+    init_detail();
+    init_views();
+    init_ai();
+    init_ai_errors();
+    init_readonly_fix();
+    init_navigation();
+    init_email();
+    init_pages();
+  }
+});
+
 // src/utils/jexl-helpers.ts
 function slugify(val) {
   if (val === void 0 || val === null) return "";
@@ -2585,6 +2822,52 @@ function collectPreviewUrlValidationIssues(config) {
   });
   return issues;
 }
+function collectFormComponentIssues(components, path, surface, keys, issues) {
+  if (!isPlainObject(components)) return;
+  for (const key of keys) {
+    const value = components[key];
+    if (value === void 0) continue;
+    if (typeof value !== "string" || value.length === 0) {
+      issues.push({
+        path: `${path}.admin.components.${key}`,
+        surface,
+        message: `\`${key}\` must be the registry key of a component, such as "check_ins.scanForm".`,
+        expression: String(value)
+      });
+    }
+  }
+  const shell = components.formShell;
+  if (shell !== void 0 && !FORM_SHELLS.includes(shell)) {
+    issues.push({
+      path: `${path}.admin.components.formShell`,
+      surface,
+      message: `Unknown formShell "${String(shell)}". Use ${FORM_SHELLS.map((value) => `"${value}"`).join(", ")}.`,
+      expression: String(shell)
+    });
+  }
+}
+function collectAdminComponentsValidationIssues(config) {
+  const issues = [];
+  config.collections.forEach((collection, index) => {
+    collectFormComponentIssues(
+      collection.admin?.components,
+      collectionSegment(collection, index),
+      "collection.admin.components",
+      FORM_COMPONENT_KEYS,
+      issues
+    );
+  });
+  config.globals?.forEach((global, index) => {
+    collectFormComponentIssues(
+      global.admin?.components,
+      globalSegment(global, index),
+      "global.admin.components",
+      GLOBAL_FORM_COMPONENT_KEYS,
+      issues
+    );
+  });
+  return issues;
+}
 function assertValidAdminConditionsInConfig(config, source = "config") {
   const diagnostics = collectAdminConditionValidationIssues(config).map((issue) => ({
     severity: "error",
@@ -2642,7 +2925,15 @@ function collectConfigDiagnostics(config) {
     message: issue.message,
     expression: issue.expression
   }));
-  return [...hookIssues, ...accessIssues, ...adminConditionIssues, ...previewUrlIssues];
+  const adminComponentIssues = collectAdminComponentsValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "adminComponents",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  return [...hookIssues, ...accessIssues, ...adminConditionIssues, ...previewUrlIssues, ...adminComponentIssues];
 }
 function formatConfigDiagnostics(source, diagnostics, options = {}) {
   const color = options.color ?? false;
@@ -2682,11 +2973,12 @@ function assertValidDeclarativeAccessInConfig(config, source = "config") {
   if (diagnostics.length === 0) return;
   throw new ConfigValidationError(source, diagnostics);
 }
-var import_jexl3, SURFACE_ROOTS, ACCESS_ROOTS, ADMIN_CONDITION_RESERVED_ROOTS, PREVIEW_URL_RESERVED_ROOTS, COMPILE_CACHE, ConfigValidationError;
+var import_jexl3, SURFACE_ROOTS, ACCESS_ROOTS, ADMIN_CONDITION_RESERVED_ROOTS, PREVIEW_URL_RESERVED_ROOTS, COMPILE_CACHE, FORM_COMPONENT_KEYS, GLOBAL_FORM_COMPONENT_KEYS, ConfigValidationError;
 var init_declarative_hooks = __esm({
   "src/utils/declarative-hooks.ts"() {
     "use strict";
     import_jexl3 = __toESM(require_Jexl(), 1);
+    init_types();
     init_jexl_helpers();
     registerJexlHelpers(import_jexl3.default);
     SURFACE_ROOTS = {
@@ -2703,6 +2995,8 @@ var init_declarative_hooks = __esm({
     ADMIN_CONDITION_RESERVED_ROOTS = ["data", "siblingData", "user", "id", ...BUILTIN_JEXL_HELPERS];
     PREVIEW_URL_RESERVED_ROOTS = ["siteUrl", "id", ...BUILTIN_JEXL_HELPERS];
     COMPILE_CACHE = /* @__PURE__ */ new Map();
+    FORM_COMPONENT_KEYS = ["createForm", "editForm", "form"];
+    GLOBAL_FORM_COMPONENT_KEYS = ["editForm", "form"];
     ConfigValidationError = class extends Error {
       diagnostics;
       source;
@@ -2915,7 +3209,7 @@ async function executeFieldAfterRead(fields, doc, user, db) {
   return result;
 }
 var import_jexl4;
-var init_hooks = __esm({
+var init_hooks2 = __esm({
   "src/utils/hooks.ts"() {
     "use strict";
     import_jexl4 = __toESM(require_Jexl(), 1);
@@ -2992,7 +3286,7 @@ async function isAccessAllowed(config, access, args) {
   if (result === void 0) return true;
   return typeof result === "boolean" ? result : !!result;
 }
-var init_access = __esm({
+var init_access2 = __esm({
   "src/auth/access.ts"() {
     "use strict";
     init_jexl();
@@ -3172,7 +3466,7 @@ var TRASH_COLLECTION, INTERNAL_SYSTEM_COLLECTIONS, TRASH_COLLECTION_CONFIG;
 var init_trash = __esm({
   "src/trash.ts"() {
     "use strict";
-    init_hooks();
+    init_hooks2();
     TRASH_COLLECTION = "__trash";
     INTERNAL_SYSTEM_COLLECTIONS = /* @__PURE__ */ new Set([
       "__audit",
@@ -3398,32 +3692,7 @@ function mergeWhereConstraint(where, constraint) {
 var init_access_control = __esm({
   "src/utils/access-control.ts"() {
     "use strict";
-    init_access();
-  }
-});
-
-// src/types/ai.ts
-var ai_exports = {};
-__export(ai_exports, {
-  AI_ACTIONS_COLLECTION: () => AI_ACTIONS_COLLECTION,
-  AI_AUDIT_COLLECTION: () => AI_AUDIT_COLLECTION,
-  AI_CHUNKS_COLLECTION: () => AI_CHUNKS_COLLECTION,
-  AI_MESSAGES_COLLECTION: () => AI_MESSAGES_COLLECTION,
-  AI_THREADS_COLLECTION: () => AI_THREADS_COLLECTION,
-  isAICollection: () => isAICollection
-});
-function isAICollection(slug) {
-  return slug === AI_THREADS_COLLECTION || slug === AI_MESSAGES_COLLECTION || slug === AI_CHUNKS_COLLECTION || slug === AI_ACTIONS_COLLECTION || slug === AI_AUDIT_COLLECTION;
-}
-var AI_THREADS_COLLECTION, AI_MESSAGES_COLLECTION, AI_CHUNKS_COLLECTION, AI_ACTIONS_COLLECTION, AI_AUDIT_COLLECTION;
-var init_ai = __esm({
-  "src/types/ai.ts"() {
-    "use strict";
-    AI_THREADS_COLLECTION = "_dyrected_ai_threads";
-    AI_MESSAGES_COLLECTION = "_dyrected_ai_messages";
-    AI_CHUNKS_COLLECTION = "_dyrected_ai_chunks";
-    AI_ACTIONS_COLLECTION = "_dyrected_ai_actions";
-    AI_AUDIT_COLLECTION = "_dyrected_ai_audit";
+    init_access2();
   }
 });
 
@@ -3972,7 +4241,7 @@ var init_rag_service = __esm({
   "src/services/rag/rag.service.ts"() {
     "use strict";
     init_ai();
-    init_access();
+    init_access2();
     init_normalizer();
     init_chunker();
     init_embedding_service();
@@ -5409,7 +5678,7 @@ var init_ai_tools = __esm({
   "src/services/ai-tools.ts"() {
     "use strict";
     init_ai();
-    init_access();
+    init_access2();
     init_access_control();
     init_rag_service();
     init_ai_pii();
@@ -6441,7 +6710,7 @@ function createSessionId() {
 }
 
 // src/controllers/collection.controller.ts
-init_hooks();
+init_hooks2();
 
 // src/utils/readonly-db.ts
 var WRITE_METHODS = ["create", "update", "delete", "updateGlobal", "execute"];
@@ -6569,7 +6838,7 @@ function generateUniqueUploadFilename(filename) {
 }
 
 // src/controllers/collection.controller.ts
-init_access();
+init_access2();
 
 // src/utils/admin-auth.ts
 function getAdminAuthCollection(config) {
@@ -6832,19 +7101,8 @@ async function buildCollectionSearchWhere(args) {
 // src/utils/navigation.ts
 init_trash();
 
-// src/types/navigation.ts
-var CURRENT_NAV_PREFERENCES_VERSION = 1;
-var DEFAULT_USER_NAV_PREFERENCES = {
-  _version: CURRENT_NAV_PREFERENCES_VERSION,
-  pinned: [],
-  hidden: [],
-  groupOrder: [],
-  itemOrder: {},
-  groups: [],
-  items: []
-};
-
 // src/utils/navigation-reconciler.ts
+init_navigation();
 var normalizeKey = (val) => (val || "").toLowerCase().replace(/[^a-z0-9]/g, "-");
 function reconcileNavigation(baseTree, prefs, schemas, options) {
   if (!baseTree) {
@@ -7278,7 +7536,7 @@ function compileNavigation(config) {
         order: item.order ?? 100,
         views: [],
         badge: item.badge,
-        access: item.access
+        access: item.access || gl?.access?.read
       });
       continue;
     }
@@ -7386,7 +7644,8 @@ function compileNavigation(config) {
       icon: "Settings",
       group: groupName,
       order: 100,
-      views: []
+      views: [],
+      access: gl.access?.read
     });
   }
   const mentionedTrash = explicitNav.some((i) => i.trash || i.slug === "trash");
@@ -7469,34 +7728,23 @@ function compileNavigation(config) {
     ungrouped: sortAndSpliceItems(ungroupedItems)
   };
 }
-function pruneNavigationForUser(tree, user) {
-  const userRoles = /* @__PURE__ */ new Set();
-  if (user?.role) userRoles.add(user.role);
-  if (Array.isArray(user?.roles)) {
-    for (const r of user.roles) userRoles.add(r);
-  }
-  const isAllowed = (item) => {
-    if (!item.access) return true;
-    if (Array.isArray(item.access)) {
-      if (item.access.length === 0) return true;
-      return item.access.some((role) => userRoles.has(role));
-    }
-    return true;
+async function pruneNavigationByAccess(tree, canAccess, canAccessView) {
+  const resolveItem = async (item) => {
+    if (!await canAccess(item)) return null;
+    if (!canAccessView || !item.views?.length) return item;
+    const allowed = await Promise.all(item.views.map((view) => canAccessView(view, item)));
+    const views = item.views.filter((_, i) => allowed[i]);
+    if (views.length === item.views.length) return item;
+    if (views.length === 0 && item.type === "workspace") return null;
+    return { ...item, views };
   };
-  const prunedGroups = [];
+  const filterItems = async (items) => (await Promise.all(items.map(resolveItem))).filter((item) => item !== null);
+  const groups = [];
   for (const group of tree.groups) {
-    const visibleItems = group.items.filter(isAllowed);
-    if (visibleItems.length > 0) {
-      prunedGroups.push({
-        ...group,
-        items: visibleItems
-      });
-    }
+    const items = await filterItems(group.items);
+    if (items.length > 0) groups.push({ ...group, items });
   }
-  return {
-    groups: prunedGroups,
-    ungrouped: tree.ungrouped.filter(isAllowed)
-  };
+  return { groups, ungrouped: await filterItems(tree.ungrouped) };
 }
 function resolveAllCollectionViews(collection, config) {
   const views = [...collection.views ?? []];
@@ -10614,7 +10862,7 @@ var CollectionController = class _CollectionController {
 };
 
 // src/controllers/global.controller.ts
-init_hooks();
+init_hooks2();
 init_access_control();
 import { HTTPException as HTTPException3 } from "hono/http-exception";
 var GlobalController = class {
@@ -14791,7 +15039,7 @@ var AIController = class {
       const dynamicConfig = await activeConfig.onSchemaFetch(projectId);
       activeConfig = mergeDynamicConfig(activeConfig, dynamicConfig);
     }
-    const { isAccessAllowed: isAccessAllowed2 } = await Promise.resolve().then(() => (init_access(), access_exports));
+    const { isAccessAllowed: isAccessAllowed2 } = await Promise.resolve().then(() => (init_access2(), access_exports));
     const { validatePayloadAgainstFields: validatePayloadAgainstFields2 } = await Promise.resolve().then(() => (init_ai_tools(), ai_tools_exports));
     if (action.targetCollection) {
       const col = activeConfig.collections?.find((c2) => c2.slug === action.targetCollection);
@@ -15166,31 +15414,8 @@ function optionalAuth(config) {
   };
 }
 
-// src/types/ai-errors.ts
-var DyrectedAIError = class _DyrectedAIError extends Error {
-  code;
-  status;
-  details;
-  constructor(code, message, status = 500, details) {
-    super(message);
-    this.name = "DyrectedAIError";
-    this.code = code;
-    this.status = status;
-    this.details = details;
-    Object.setPrototypeOf(this, _DyrectedAIError.prototype);
-  }
-  toJSON() {
-    return {
-      error: true,
-      code: this.code,
-      message: this.message,
-      status: this.status,
-      details: this.details
-    };
-  }
-};
-
 // src/middleware/ai-rate-limit.ts
+init_ai_errors();
 var InMemoryRateLimitStore = class {
   windows = /* @__PURE__ */ new Map();
   constructor() {
@@ -16649,6 +16874,7 @@ function getSwaggerHtml(specUrl) {
 }
 
 // src/router.ts
+init_access2();
 init_access_control();
 init_trash();
 init_declarative_hooks();
@@ -16878,6 +17104,20 @@ function registerRoutes(app, config) {
       }
       return resolveBooleanAccess(requestConfig, access, accessArgs);
     };
+    const filterReadableViews = async (views) => {
+      const readable = await Promise.all(
+        views.map(async (view) => {
+          if (view?.access?.read === void 0) return true;
+          try {
+            const result = await resolveAccess(requestConfig, view.access.read, accessArgs);
+            return result === void 0 || result !== false;
+          } catch {
+            return false;
+          }
+        })
+      );
+      return views.filter((_, i) => readable[i]);
+    };
     const filteredCollections = await Promise.all(
       collections.filter((col) => !INTERNAL_SYSTEM_COLLECTIONS.has(col.slug) && (!siteId || col.shared || !col.siteId || col.siteId === siteId)).map(async (col) => ({
         slug: col.slug,
@@ -16934,7 +17174,9 @@ function registerRoutes(app, config) {
         audit: !!col.audit,
         drafts: !!col.drafts,
         defaultView: col.defaultView ?? col.admin?.defaultView,
-        views: await Promise.all((col.views || []).map((view) => serializeViewForApi(view, serializeAccess))),
+        views: await Promise.all(
+          (await filterReadableViews(col.views || [])).map((view) => serializeViewForApi(view, serializeAccess))
+        ),
         actions: await serializeActionsForApi(col.actions, serializeAccess),
         admin: col.admin,
         detail: serializeDetailForApi(col.detail),
@@ -17402,10 +17644,29 @@ function registerRoutes(app, config) {
     });
     return c.json({ success: true });
   });
-  app.get("/api/admin/navigation", optionalAuth(config), async (c) => {
+  const createNavAccessChecker = (c) => {
     const user = c.get("user");
+    const roles = /* @__PURE__ */ new Set([...user?.role ? [user.role] : [], ...Array.isArray(user?.roles) ? user.roles : []]);
+    const args = { user, req: toHookRequestContext(c.req) };
+    const allows = async (rule) => {
+      if (rule === void 0 || rule === null) return true;
+      if (Array.isArray(rule)) return rule.length === 0 || rule.some((r) => roles.has(r));
+      try {
+        const result = await resolveAccess(config, rule, args);
+        return result === void 0 || result !== false;
+      } catch {
+        return false;
+      }
+    };
+    return {
+      canAccess: (item) => allows(item.access),
+      canAccessView: (view) => allows(view.access?.read)
+    };
+  };
+  app.get("/api/admin/navigation", optionalAuth(config), async (c) => {
     const compiled = compileNavigation(config);
-    const pruned = pruneNavigationForUser(compiled, user);
+    const { canAccess, canAccessView } = createNavAccessChecker(c);
+    const pruned = await pruneNavigationByAccess(compiled, canAccess, canAccessView);
     return c.json(pruned);
   });
   app.on(["GET", "POST"], "/api/admin/navigation/badges", optionalAuth(config), async (c) => {
@@ -17461,12 +17722,17 @@ function registerRoutes(app, config) {
         ...(reconciled.groups || []).flatMap((g) => g.items || [])
       ];
     } else {
-      const pruned = pruneNavigationForUser(compiled, user);
+      const pruned = await pruneNavigationByAccess(compiled, createNavAccessChecker(c).canAccess);
       allItems = [
         ...pruned.ungrouped,
         ...pruned.groups.flatMap((g) => g.items)
       ];
     }
+    if (userNavPrefs) {
+      const { canAccess } = createNavAccessChecker(c);
+      const allowed = await Promise.all(allItems.map((item) => canAccess(item)));
+      allItems = allItems.filter((_, i) => allowed[i]);
+    }
     const badges = {};
     const requestsByCollection = /* @__PURE__ */ new Map();
     let reqCounter = 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dyrected/core",
-  "version": "2.23.0",
+  "version": "2.24.1",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",