@dyrected/core 2.5.30 → 2.5.33

package/dist/server.d.cts

@@ -1,7 +1,7 @@
 import * as hono_types from 'hono/types';
 import * as hono from 'hono';
 import { Hono, Context } from 'hono';
-import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './index-DTrpTru7.cjs';
+import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './index-CdQwnbfh.cjs';
 import * as hono_utils_http_status from 'hono/utils/http-status';
 import * as hono_utils_types from 'hono/utils/types';
 import 'lucide-react';
@@ -217,7 +217,12 @@ declare class CollectionController {
         message: string;
     }, 500, "json">) | (Response & hono.TypedResponse<{
         message: string;
-    }, 404, "json">)>;
+    }, 404, "json">) | (Response & hono.TypedResponse<{
+        message: string;
+    }, 400, "json">) | (Response & hono.TypedResponse<{
+        error: true;
+        message: string;
+    }, 403, "json">)>;
     /**
      * POST /api/collections/:slug/:id/change-password
      *

package/dist/server.d.ts

@@ -1,7 +1,7 @@
 import * as hono_types from 'hono/types';
 import * as hono from 'hono';
 import { Hono, Context } from 'hono';
-import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './index-DTrpTru7.js';
+import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './index-CdQwnbfh.js';
 import * as hono_utils_http_status from 'hono/utils/http-status';
 import * as hono_utils_types from 'hono/utils/types';
 import 'lucide-react';
@@ -217,7 +217,12 @@ declare class CollectionController {
         message: string;
     }, 500, "json">) | (Response & hono.TypedResponse<{
         message: string;
-    }, 404, "json">)>;
+    }, 404, "json">) | (Response & hono.TypedResponse<{
+        message: string;
+    }, 400, "json">) | (Response & hono.TypedResponse<{
+        error: true;
+        message: string;
+    }, 403, "json">)>;
     /**
      * POST /api/collections/:slug/:id/change-password
      *

package/dist/server.js

@@ -1,15 +1,17 @@
 import {
   WORKFLOW_HISTORY_COLLECTION,
+  canViewWorkflowDraft,
   createWorkflowDocument,
   executeFieldAfterRead,
   executeFieldBeforeChange,
+  generateOpenApi,
   initializeWorkflowDocument,
   materializeWorkflowDocument,
   normalizeConfig,
   runCollectionHooks,
   saveWorkflowDraft,
   transitionWorkflow
-} from "./chunk-CQDVPMEU.js";
+} from "./chunk-YDOBB7MY.js";
 
 // src/app.ts
 import { Hono } from "hono";
@@ -282,6 +284,20 @@ function createReadonlyDb(db) {
   });
 }
 
+// src/auth/jexl.ts
+import jexl from "jexl";
+async function evaluateAccess(expression, context) {
+  if (expression === void 0 || expression === null) return false;
+  if (typeof expression === "boolean") return expression;
+  try {
+    const result = await jexl.eval(expression, context);
+    return !!result;
+  } catch (err) {
+    console.error("[dyrected/core] Jexl evaluation failed:", err);
+    return false;
+  }
+}
+
 // src/controllers/collection.controller.ts
 var CollectionController = class {
   collection;
@@ -326,7 +342,7 @@ var CollectionController = class {
     if (beforeReadResult !== void 0) {
       where = beforeReadResult;
     }
-    if (this.collection.workflow && !user) {
+    if (this.collection.workflow && !canViewWorkflowDraft(this.collection.workflow, user)) {
       where = where ? { AND: [where, { __published: { exists: true } }] } : { __published: { exists: true } };
     }
     let result = await db.find({
@@ -619,9 +635,28 @@ var CollectionController = class {
     const config = c.get("config");
     if (!config.db) return c.json({ message: "Database not configured" }, 500);
     if (!this.collection.workflow) return c.json({ message: "Workflows are not enabled for this collection" }, 404);
+    const documentId = c.req.param("id");
+    if (!documentId) return c.json({ message: "Missing ID" }, 400);
+    const document = await config.db.findOne({ collection: this.collection.slug, id: documentId });
+    if (!document) return c.json({ message: "Not Found" }, 404);
+    const readAccess = this.collection.access?.read;
+    if (readAccess !== void 0 && readAccess !== null) {
+      const args = { user: c.get("user"), req: c.req, doc: document };
+      const result2 = typeof readAccess === "function" ? await readAccess(args) : await evaluateAccess(readAccess, args);
+      let allowed = result2 === true;
+      if (result2 && typeof result2 === "object") {
+        const match = await config.db.find({
+          collection: this.collection.slug,
+          where: { AND: [{ id: { equals: documentId } }, result2] },
+          limit: 1
+        });
+        allowed = match.total > 0;
+      }
+      if (!allowed) return c.json({ error: true, message: `Access denied: read on ${this.collection.slug}` }, 403);
+    }
     const result = await config.db.find({
       collection: WORKFLOW_HISTORY_COLLECTION,
-      where: { collection: { equals: this.collection.slug }, documentId: { equals: c.req.param("id") } },
+      where: { collection: { equals: this.collection.slug }, documentId: { equals: documentId } },
       sort: "-createdAt",
       limit: Math.min(Number(c.req.query("limit")) || 50, 100)
     });
@@ -1643,328 +1678,6 @@ function optionalAuth() {
   };
 }
 
-// src/utils/openapi.ts
-function generateOpenApi(config) {
-  const spec = {
-    openapi: "3.0.0",
-    info: {
-      title: "Dyrected API",
-      version: "1.0.0",
-      description: "Automatically generated OpenAPI specification for the Dyrected project."
-    },
-    components: {
-      schemas: {},
-      securitySchemes: {
-        ApiKeyAuth: {
-          type: "apiKey",
-          in: "header",
-          name: "x-api-key"
-        }
-      }
-    },
-    paths: {},
-    security: [{ ApiKeyAuth: [] }]
-  };
-  for (const collection of config.collections) {
-    spec.components.schemas[collection.slug] = collectionToSchema(collection);
-  }
-  for (const global of config.globals) {
-    spec.components.schemas[global.slug] = globalToSchema(global);
-  }
-  for (const collection of config.collections) {
-    const slug = collection.slug;
-    const path = `/api/collections/${slug}`;
-    const labels = collection.labels || { singular: slug, plural: `${slug}s` };
-    spec.paths[path] = {
-      get: {
-        tags: ["Collections"],
-        summary: `Find ${labels.plural}`,
-        parameters: [
-          { name: "limit", in: "query", schema: { type: "integer", default: 10 } },
-          { name: "page", in: "query", schema: { type: "integer", default: 1 } },
-          { name: "where", in: "query", schema: { type: "string" }, description: "JSON filter" },
-          { name: "sort", in: "query", schema: { type: "string" }, description: "Sort field (e.g. -createdAt)" }
-        ],
-        responses: {
-          200: {
-            description: "Success",
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object",
-                  properties: {
-                    docs: { type: "array", items: { $ref: `#/components/schemas/${slug}` } },
-                    total: { type: "integer" },
-                    limit: { type: "integer" },
-                    page: { type: "integer" }
-                  }
-                }
-              }
-            }
-          }
-        }
-      },
-      post: {
-        tags: ["Collections"],
-        summary: `Create ${labels.singular}`,
-        requestBody: {
-          required: true,
-          content: {
-            "application/json": {
-              schema: { $ref: `#/components/schemas/${slug}` }
-            }
-          }
-        },
-        responses: {
-          201: {
-            description: "Created",
-            content: {
-              "application/json": {
-                schema: { $ref: `#/components/schemas/${slug}` }
-              }
-            }
-          }
-        }
-      }
-    };
-    spec.paths[`${path}/{id}`] = {
-      get: {
-        tags: ["Collections"],
-        summary: `Get a single ${labels.singular}`,
-        parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
-        responses: {
-          200: {
-            description: "Success",
-            content: {
-              "application/json": {
-                schema: { $ref: `#/components/schemas/${slug}` }
-              }
-            }
-          }
-        }
-      },
-      patch: {
-        tags: ["Collections"],
-        summary: `Update ${labels.singular}`,
-        parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
-        requestBody: {
-          required: true,
-          content: {
-            "application/json": {
-              schema: { $ref: `#/components/schemas/${slug}` }
-            }
-          }
-        },
-        responses: {
-          200: {
-            description: "Updated",
-            content: {
-              "application/json": {
-                schema: { $ref: `#/components/schemas/${slug}` }
-              }
-            }
-          }
-        }
-      },
-      delete: {
-        tags: ["Collections"],
-        summary: `Delete ${labels.singular}`,
-        parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
-        responses: {
-          204: { description: "Deleted" }
-        }
-      }
-    };
-  }
-  for (const global of config.globals) {
-    const slug = global.slug;
-    const path = `/api/globals/${slug}`;
-    spec.paths[path] = {
-      get: {
-        tags: ["Globals"],
-        summary: `Get ${global.label || slug}`,
-        responses: {
-          200: {
-            description: "Success",
-            content: {
-              "application/json": {
-                schema: { $ref: `#/components/schemas/${slug}` }
-              }
-            }
-          }
-        }
-      },
-      patch: {
-        tags: ["Globals"],
-        summary: `Update ${global.label || slug}`,
-        requestBody: {
-          required: true,
-          content: {
-            "application/json": {
-              schema: { $ref: `#/components/schemas/${slug}` }
-            }
-          }
-        },
-        responses: {
-          200: {
-            description: "Updated",
-            content: {
-              "application/json": {
-                schema: { $ref: `#/components/schemas/${slug}` }
-              }
-            }
-          }
-        }
-      }
-    };
-  }
-  if (config.storage) {
-    spec.paths["/api/media"] = {
-      get: {
-        tags: ["Media"],
-        summary: "List Media",
-        responses: {
-          200: {
-            description: "Success",
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object",
-                  properties: {
-                    docs: { type: "array", items: { type: "object", additionalProperties: true } }
-                  }
-                }
-              }
-            }
-          }
-        }
-      },
-      post: {
-        tags: ["Media"],
-        summary: "Upload Media",
-        requestBody: {
-          content: {
-            "multipart/form-data": {
-              schema: {
-                type: "object",
-                properties: {
-                  file: { type: "string", format: "binary" }
-                }
-              }
-            }
-          }
-        },
-        responses: {
-          201: { description: "Uploaded" }
-        }
-      }
-    };
-  }
-  return spec;
-}
-function collectionToSchema(collection) {
-  const { properties, required } = fieldsToProperties(collection.fields);
-  return {
-    type: "object",
-    properties: {
-      id: { type: "string" },
-      createdAt: { type: "string", format: "date-time" },
-      updatedAt: { type: "string", format: "date-time" },
-      ...properties
-    },
-    required: ["id", ...required]
-  };
-}
-function globalToSchema(global) {
-  const { properties, required } = fieldsToProperties(global.fields);
-  return {
-    type: "object",
-    properties,
-    required
-  };
-}
-function fieldsToProperties(fields) {
-  const props = {};
-  const required = [];
-  for (const field of fields) {
-    if (!field.name || field.type === "join" || field.type === "row") continue;
-    props[field.name] = fieldToSchema(field);
-    if (field.required) {
-      required.push(field.name);
-    }
-  }
-  return { properties: props, required };
-}
-function fieldToSchema(field) {
-  let schema = {};
-  switch (field.type) {
-    case "text":
-    case "textarea":
-    case "email":
-    case "url":
-      schema = { type: "string" };
-      break;
-    case "number":
-      schema = { type: "number" };
-      break;
-    case "boolean":
-      schema = { type: "boolean" };
-      break;
-    case "date":
-      schema = { type: "string", format: "date-time" };
-      break;
-    case "select":
-    case "radio":
-      schema = { type: "string", enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0 };
-      break;
-    case "multiSelect":
-      schema = {
-        type: "array",
-        items: { type: "string", enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0 }
-      };
-      break;
-    case "relationship":
-      schema = { type: "string", description: `ID of a ${field.relationTo} record` };
-      break;
-    case "object": {
-      const { properties, required } = fieldsToProperties(field.fields || []);
-      schema = { type: "object", properties, required };
-      break;
-    }
-    case "array": {
-      const { properties, required } = fieldsToProperties(field.fields || []);
-      schema = { type: "array", items: { type: "object", properties, required } };
-      break;
-    }
-    case "json":
-    case "richText":
-      schema = { type: "object", additionalProperties: true };
-      break;
-    case "blocks":
-      schema = {
-        type: "array",
-        items: {
-          oneOf: field.blocks?.map((block) => {
-            const { properties, required } = fieldsToProperties(block.fields);
-            return {
-              type: "object",
-              properties: {
-                blockType: { type: "string", enum: [block.slug] },
-                ...properties
-              },
-              required: ["blockType", ...required]
-            };
-          })
-        }
-      };
-      break;
-    default:
-      schema = { type: "string" };
-  }
-  if (field.label) schema.description = field.label;
-  return schema;
-}
-
 // src/utils/swagger.ts
 function getSwaggerHtml(specUrl = "/api/openapi.json") {
   return `
@@ -2014,20 +1727,6 @@ function getSwaggerHtml(specUrl = "/api/openapi.json") {
   `;
 }
 
-// src/auth/jexl.ts
-import jexl from "jexl";
-async function evaluateAccess(expression, context) {
-  if (expression === void 0 || expression === null) return false;
-  if (typeof expression === "boolean") return expression;
-  try {
-    const result = await jexl.eval(expression, context);
-    return !!result;
-  } catch (err) {
-    console.error("[dyrected/core] Jexl evaluation failed:", err);
-    return false;
-  }
-}
-
 // src/router.ts
 function accessGate(target, action) {
   return async (c, next) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dyrected/core",
-  "version": "2.5.30",
+  "version": "2.5.33",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",