@dyrected/core 2.5.58 → 2.5.60

package/dist/server.cjs

@@ -627,12 +627,16 @@ async function resolveAccess(config, access, args) {
     }
   }
   if (isNamedAccessPolicy(access)) {
-    const resolver = config.accessPolicies?.[access.policy];
-    if (!resolver) {
+    const policy = config.accessPolicies?.[access.policy];
+    if (policy === void 0) {
       console.error(`[dyrected/core] Unknown access policy "${access.policy}".`);
       return false;
     }
+    if (typeof policy === "string" || typeof policy === "boolean") {
+      return evaluateAccess(policy, args);
+    }
     try {
+      const resolver = policy;
       return await resolver({ ...args, params: access.params });
     } catch (err) {
       console.error(`[dyrected/core] Access policy "${access.policy}" failed:`, err);
@@ -713,6 +717,10 @@ async function resolveCollectionAccess(config, collection, action, access, args)
     allowed: await matchesAccessConstraint(config, collection, args.id, result)
   };
 }
+function resolveFieldAccessId(context) {
+  const candidate = context.id ?? context.doc?.id ?? context.data?.id;
+  return typeof candidate === "string" && candidate.length > 0 ? candidate : void 0;
+}
 async function applyFieldReadAccess(context, doc) {
   if (!doc || typeof doc !== "object") return doc;
   const result = { ...doc };
@@ -727,7 +735,8 @@ async function applyFieldReadAccess(context, doc) {
       user: context.user,
       req: context.req,
       doc: context.doc,
-      data: context.data
+      data: context.data,
+      id: resolveFieldAccessId(context)
     });
     if (!canRead) {
       delete result[field.name];
@@ -739,9 +748,10 @@ async function applyFieldReadAccess(context, doc) {
       continue;
     }
     if (field.type === "array" && field.fields && Array.isArray(value)) {
+      const childFields = field.fields;
       result[field.name] = await Promise.all(
         value.map(
-          (item) => typeof item === "object" && item !== null ? applyFieldReadAccess({ ...context, fields: field.fields }, item) : item
+          (item) => typeof item === "object" && item !== null ? applyFieldReadAccess({ ...context, fields: childFields }, item) : item
         )
       );
       continue;
@@ -752,7 +762,7 @@ async function applyFieldReadAccess(context, doc) {
           if (typeof item !== "object" || item === null) return item;
           const typedItem = item;
           const block = field.blocks?.find((candidate) => candidate.slug === typedItem.blockType);
-          if (!block) return item;
+          if (!block || !block.fields) return item;
           return applyFieldReadAccess({ ...context, fields: block.fields }, typedItem);
         })
       );
@@ -769,13 +779,15 @@ async function applyFieldWriteAccess(context, data) {
       continue;
     }
     if (!field.name || !(field.name in result)) continue;
-    const canUpdate = await resolveBooleanAccess(context.config, field.access?.update, {
+    const writeRule = context.operation === "create" ? field.access?.create ?? field.access?.update : field.access?.update;
+    const canWrite = await resolveBooleanAccess(context.config, writeRule, {
       user: context.user,
       req: context.req,
       doc: context.doc,
-      data: context.data
+      data: context.data,
+      id: resolveFieldAccessId(context)
     });
-    if (!canUpdate) {
+    if (!canWrite) {
       delete result[field.name];
       continue;
     }
@@ -786,9 +798,10 @@ async function applyFieldWriteAccess(context, data) {
       continue;
     }
     if (field.type === "array" && field.fields && Array.isArray(value)) {
+      const childFields = field.fields;
       result[field.name] = await Promise.all(
         value.map(
-          (item) => typeof item === "object" && item !== null ? applyFieldWriteAccess({ ...context, fields: field.fields }, item) : item
+          (item) => typeof item === "object" && item !== null ? applyFieldWriteAccess({ ...context, fields: childFields }, item) : item
         )
       );
       continue;
@@ -799,7 +812,7 @@ async function applyFieldWriteAccess(context, data) {
           if (typeof item !== "object" || item === null) return item;
           const typedItem = item;
           const block = field.blocks?.find((candidate) => candidate.slug === typedItem.blockType);
-          if (!block) return item;
+          if (!block || !block.fields) return item;
           return applyFieldWriteAccess({ ...context, fields: block.fields }, typedItem);
         })
       );
@@ -1111,7 +1124,7 @@ var CollectionController = class {
     const readonlyDb = createReadonlyDb(db);
     const limit = Number(c.req.query("limit")) || 10;
     const page = Number(c.req.query("page")) || 1;
-    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 2;
+    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
     const sort = c.req.query("sort") || void 0;
     const user = c.get("user");
     let where = void 0;
@@ -1227,7 +1240,7 @@ var CollectionController = class {
     }
     const readonlyDb = createReadonlyDb(db);
     const id = c.req.param("id");
-    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 10;
+    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
     const user = c.get("user");
     if (!id) return c.json({ message: "Missing ID" }, 400);
     let doc = await db.findOne({ collection: this.collection.slug, id });
@@ -1316,7 +1329,8 @@ var CollectionController = class {
       fields: this.collection.fields,
       user,
       req: this.toHookRequestContext(c),
-      data
+      data,
+      operation: "create"
     }, data);
     data = await executeFieldBeforeChange(this.collection.fields, data, null, user, readonlyDb);
     data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
@@ -1411,7 +1425,8 @@ var CollectionController = class {
       fields: this.collection.fields,
       user,
       req: this.toHookRequestContext(c),
-      data
+      data,
+      operation: "create"
     }, data);
     data = await executeFieldBeforeChange(this.collection.fields, data, null, user, readonlyDb);
     data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
@@ -1833,7 +1848,7 @@ var GlobalController = class {
     const db = config.db;
     if (!db) return c.json({ message: "Database not configured" }, 500);
     const readonlyDb = createReadonlyDb(db);
-    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 10;
+    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
     const user = c.get("user");
     let query = void 0;
     const beforeReadResult = await runCollectionHooks(this.global.hooks?.beforeRead, {
@@ -3052,6 +3067,150 @@ var PreviewController = class {
   }
 };
 
+// src/controllers/audit.controller.ts
+var AuditController = class {
+  parseQuery(c) {
+    const limit = Math.min(Number(c.req.query("limit")) || 50, 100);
+    const page = Math.max(Number(c.req.query("page")) || 1, 1);
+    const sort = c.req.query("sort") || "-timestamp";
+    const whereRaw = c.req.query("where");
+    if (!whereRaw) {
+      return { limit, page, sort };
+    }
+    try {
+      return {
+        limit,
+        page,
+        sort,
+        where: JSON.parse(decodeURIComponent(whereRaw))
+      };
+    } catch {
+      return { limit, page, sort };
+    }
+  }
+  emptyResult(limit, page) {
+    return {
+      docs: [],
+      total: 0,
+      limit,
+      page,
+      totalPages: 0,
+      hasNextPage: false,
+      hasPrevPage: page > 1
+    };
+  }
+  async collectAccessibleDocumentIds(db, collection, constraint) {
+    const ids = [];
+    const limit = 100;
+    let page = 1;
+    while (true) {
+      const result = await db.find({
+        collection: collection.slug,
+        where: constraint,
+        limit,
+        page
+      });
+      for (const doc of result.docs) {
+        if (typeof doc?.id === "string" && doc.id.length > 0) {
+          ids.push(doc.id);
+        }
+      }
+      if (!result.hasNextPage || page >= result.totalPages) {
+        break;
+      }
+      page += 1;
+    }
+    return ids;
+  }
+  async buildCollectionAuditScope(c, collection) {
+    const config = c.get("config");
+    const auditAccess = collection.access?.readAudit ?? collection.access?.read;
+    const access = await resolveCollectionAccess(
+      config,
+      collection.slug,
+      "read",
+      auditAccess,
+      {
+        user: c.get("user"),
+        req: toHookRequestContext(c.req)
+      }
+    );
+    if (!access.allowed) {
+      return { denied: true, where: {} };
+    }
+    let where = { collection: { equals: collection.slug } };
+    if (access.constraint) {
+      const ids = await this.collectAccessibleDocumentIds(config.db, collection, access.constraint);
+      where = mergeWhereConstraint(where, { documentId: { in: ids } });
+    }
+    return { denied: false, where };
+  }
+  async getVisibleCollections(c) {
+    const config = c.get("config");
+    const collections = /* @__PURE__ */ new Map();
+    for (const collection of config.collections) {
+      collections.set(collection.slug, collection);
+    }
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    if (config.onSchemaFetch && siteId) {
+      const dynamic = await config.onSchemaFetch(siteId);
+      for (const collection of dynamic.collections || []) {
+        if (!collections.has(collection.slug)) {
+          collections.set(collection.slug, collection);
+        }
+      }
+    }
+    return Array.from(collections.values());
+  }
+  async findForCollection(c, collection) {
+    const config = c.get("config");
+    if (!config.db) return c.json({ message: "Database not configured" }, 500);
+    if (!collection.audit) return c.json({ message: "Audit is not enabled for this collection" }, 404);
+    const query = this.parseQuery(c);
+    const scope = await this.buildCollectionAuditScope(c, collection);
+    if (scope.denied) {
+      return c.json({ error: true, message: `Access denied: read on ${collection.slug}` }, 403);
+    }
+    const where = query.where ? mergeWhereConstraint(scope.where, query.where) : scope.where;
+    const result = await config.db.find({
+      collection: "__audit",
+      where,
+      limit: query.limit,
+      page: query.page,
+      sort: query.sort
+    });
+    return c.json(result);
+  }
+  async findAll(c) {
+    const config = c.get("config");
+    if (!config.db) return c.json({ message: "Database not configured" }, 500);
+    const query = this.parseQuery(c);
+    const collections = (await this.getVisibleCollections(c)).filter((collection) => collection.audit);
+    const scopes = [];
+    for (const collection of collections) {
+      const scope = await this.buildCollectionAuditScope(c, collection);
+      if (!scope.denied) {
+        scopes.push(scope.where);
+      }
+    }
+    if (scopes.length === 0) {
+      return c.json(this.emptyResult(query.limit, query.page));
+    }
+    let where = scopes.length === 1 ? scopes[0] : { OR: scopes };
+    if (query.where) {
+      where = mergeWhereConstraint(where, query.where);
+    }
+    const result = await config.db.find({
+      collection: "__audit",
+      where,
+      limit: query.limit,
+      page: query.page,
+      sort: query.sort
+    });
+    return c.json(result);
+  }
+};
+
 // src/middleware/auth.ts
 function getBearerToken(c) {
   const authHeader = c.req.header("Authorization");
@@ -3129,6 +3288,15 @@ function optionalAuth(config) {
 }
 
 // src/utils/openapi.ts
+function getCollectionLabels(collection) {
+  return collection.labels || { singular: collection.slug, plural: collection.slug };
+}
+function getCollectionTag(collection) {
+  return `Collection: ${getCollectionLabels(collection).plural}`;
+}
+function getGlobalTag(global) {
+  return `Global: ${global.label || global.slug}`;
+}
 function generateOpenApi(config) {
   const spec = {
     openapi: "3.0.0",
@@ -3160,15 +3328,7 @@ function generateOpenApi(config) {
         },
         WorkflowHistoryEntry: {
           type: "object",
-          required: [
-            "collection",
-            "documentId",
-            "transition",
-            "from",
-            "to",
-            "revision",
-            "createdAt"
-          ],
+          required: ["collection", "documentId", "transition", "from", "to", "revision", "createdAt"],
           properties: {
             id: { type: "string" },
             collection: { type: "string" },
@@ -3182,6 +3342,21 @@ function generateOpenApi(config) {
             createdAt: { type: "string", format: "date-time" }
           }
         },
+        AuditEntry: {
+          type: "object",
+          required: ["collection", "operation", "timestamp"],
+          properties: {
+            id: { type: "string" },
+            collection: { type: "string" },
+            documentId: { type: "string", nullable: true },
+            operation: { type: "string" },
+            user: { type: "string", nullable: true },
+            timestamp: { type: "string", format: "date-time" },
+            changes: {
+              oneOf: [{ type: "string" }, { type: "object", additionalProperties: true }, { type: "null" }]
+            }
+          }
+        },
         Error: {
           type: "object",
           properties: {
@@ -3270,17 +3445,13 @@ function generateOpenApi(config) {
     get: {
       tags: ["Preferences"],
       summary: "Get an authenticated user preference",
-      parameters: [
-        { name: "key", in: "path", required: true, schema: { type: "string" } }
-      ],
+      parameters: [{ name: "key", in: "path", required: true, schema: { type: "string" } }],
       responses: { 200: { description: "Preference value" } }
     },
     put: {
       tags: ["Preferences"],
       summary: "Set an authenticated user preference",
-      parameters: [
-        { name: "key", in: "path", required: true, schema: { type: "string" } }
-      ],
+      parameters: [{ name: "key", in: "path", required: true, schema: { type: "string" } }],
       requestBody: {
         required: true,
         content: { "application/json": { schema: { type: "object" } } }
@@ -3311,6 +3482,39 @@ function generateOpenApi(config) {
       responses: { 200: { description: "Preview document data" } }
     }
   };
+  spec.paths["/api/audit"] = {
+    get: {
+      tags: ["Audit"],
+      summary: "Get audit entries across all readable audited collections",
+      parameters: [
+        { name: "limit", in: "query", schema: { type: "integer", default: 50, maximum: 100 } },
+        { name: "page", in: "query", schema: { type: "integer", default: 1 } },
+        { name: "where", in: "query", schema: { type: "string" }, description: "JSON filter" },
+        { name: "sort", in: "query", schema: { type: "string", default: "-timestamp" } }
+      ],
+      responses: {
+        200: {
+          description: "Audit entries",
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                properties: {
+                  docs: {
+                    type: "array",
+                    items: { $ref: "#/components/schemas/AuditEntry" }
+                  },
+                  total: { type: "integer" },
+                  limit: { type: "integer" },
+                  page: { type: "integer" }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  };
   for (const collection of config.collections) {
     spec.components.schemas[collection.slug] = collectionToSchema(collection);
   }
@@ -3320,10 +3524,11 @@ function generateOpenApi(config) {
   for (const collection of config.collections) {
     const slug = collection.slug;
     const path = `/api/collections/${slug}`;
-    const labels = collection.labels || { singular: slug, plural: `${slug}s` };
+    const labels = getCollectionLabels(collection);
+    const collectionTag = getCollectionTag(collection);
     spec.paths[path] = {
       get: {
-        tags: ["Collections"],
+        tags: [collectionTag],
         summary: `Find ${labels.plural}`,
         parameters: [
           {
@@ -3372,7 +3577,7 @@ function generateOpenApi(config) {
         }
       },
       post: {
-        tags: ["Collections"],
+        tags: [collectionTag],
         summary: `Create ${labels.singular}`,
         requestBody: {
           required: true,
@@ -3396,7 +3601,7 @@ function generateOpenApi(config) {
     };
     spec.paths[`${path}/{id}`] = {
       get: {
-        tags: ["Collections"],
+        tags: [collectionTag],
         summary: `Get a single ${labels.singular}`,
         parameters: [
           {
@@ -3418,7 +3623,7 @@ function generateOpenApi(config) {
         }
       },
       patch: {
-        tags: ["Collections"],
+        tags: [collectionTag],
         summary: `Update ${labels.singular}`,
         parameters: [
           {
@@ -3448,7 +3653,7 @@ function generateOpenApi(config) {
         }
       },
       delete: {
-        tags: ["Collections"],
+        tags: [collectionTag],
         summary: `Delete ${labels.singular}`,
         parameters: [
           {
@@ -3465,7 +3670,7 @@ function generateOpenApi(config) {
     };
     spec.paths[`${path}/delete-many`] = {
       delete: {
-        tags: ["Collections"],
+        tags: [collectionTag],
         summary: `Delete multiple ${labels.plural}`,
         requestBody: {
           required: true,
@@ -3484,9 +3689,46 @@ function generateOpenApi(config) {
         responses: { 200: { description: "Deleted and failed document IDs" } }
       }
     };
+    if (collection.audit) {
+      spec.paths[`${path}/__audit`] = {
+        get: {
+          tags: [collectionTag],
+          summary: `Get ${labels.singular} audit entries`,
+          parameters: [
+            { name: "limit", in: "query", schema: { type: "integer", default: 50, maximum: 100 } },
+            { name: "page", in: "query", schema: { type: "integer", default: 1 } },
+            { name: "where", in: "query", schema: { type: "string" }, description: "JSON filter" },
+            { name: "sort", in: "query", schema: { type: "string", default: "-timestamp" } }
+          ],
+          responses: {
+            200: {
+              description: "Audit entries for this collection",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    properties: {
+                      docs: {
+                        type: "array",
+                        items: { $ref: "#/components/schemas/AuditEntry" }
+                      },
+                      total: { type: "integer" },
+                      limit: { type: "integer" },
+                      page: { type: "integer" }
+                    }
+                  }
+                }
+              }
+            },
+            403: { description: "Collection read access denied" },
+            404: { description: "Audit is not enabled for this collection" }
+          }
+        }
+      };
+    }
     spec.paths[`${path}/seed`] = {
       post: {
-        tags: ["Collections"],
+        tags: [collectionTag],
         summary: `Seed initial ${labels.plural}`,
         responses: { 200: { description: "Seeded documents" } }
       }
@@ -3494,12 +3736,12 @@ function generateOpenApi(config) {
     if (collection.upload) {
       spec.paths[`${path}/media`] = {
         get: {
-          tags: ["Media"],
+          tags: [collectionTag],
           summary: `List ${labels.plural}`,
           responses: { 200: { description: "Paginated media documents" } }
         },
         post: {
-          tags: ["Media"],
+          tags: [collectionTag],
           summary: `Upload ${labels.singular}`,
           requestBody: {
             required: true,
@@ -3518,7 +3760,7 @@ function generateOpenApi(config) {
       };
       spec.paths[`${path}/media/{filename}`] = {
         get: {
-          tags: ["Media"],
+          tags: [collectionTag],
           summary: `Serve ${labels.singular} bytes`,
           parameters: [
             {
@@ -3538,7 +3780,7 @@ function generateOpenApi(config) {
     }
     if (collection.auth) {
       const publicAuthPost = (summary) => ({
-        tags: ["Authentication"],
+        tags: [collectionTag],
         summary,
         security: [],
         requestBody: {
@@ -3580,14 +3822,14 @@ function generateOpenApi(config) {
       };
       spec.paths[`${path}/logout`] = {
         post: {
-          tags: ["Authentication"],
+          tags: [collectionTag],
           summary: `Log out of ${labels.plural}`,
           responses: { 200: { description: "Logged out" } }
         }
       };
       spec.paths[`${path}/init`] = {
         get: {
-          tags: ["Authentication"],
+          tags: [collectionTag],
           summary: `Get ${labels.plural} initialization state`,
           security: [],
           responses: { 200: { description: "Initialization state" } }
@@ -3598,14 +3840,14 @@ function generateOpenApi(config) {
       };
       spec.paths[`${path}/me`] = {
         get: {
-          tags: ["Authentication"],
+          tags: [collectionTag],
           summary: `Get the current ${labels.singular}`,
           responses: { 200: { description: "Authenticated user" } }
         }
       };
       spec.paths[`${path}/refresh-token`] = {
         post: {
-          tags: ["Authentication"],
+          tags: [collectionTag],
           summary: "Refresh an authentication token",
           responses: { 200: { description: "Refreshed token" } }
         }
@@ -3618,7 +3860,7 @@ function generateOpenApi(config) {
       };
       spec.paths[`${path}/invite`] = {
         post: {
-          tags: ["Authentication"],
+          tags: [collectionTag],
           summary: `Invite a ${labels.singular}`,
           responses: { 200: { description: "Invitation sent" } }
         }
@@ -3628,7 +3870,7 @@ function generateOpenApi(config) {
       };
       spec.paths[`${path}/{id}/change-password`] = {
         post: {
-          tags: ["Authentication"],
+          tags: [collectionTag],
           summary: `Change a ${labels.singular} password`,
           parameters: [
             {
@@ -3645,7 +3887,7 @@ function generateOpenApi(config) {
     if (collection.workflow) {
       spec.paths[`${path}/{id}/transitions/{transition}`] = {
         post: {
-          tags: ["Workflows"],
+          tags: [collectionTag],
           summary: `Transition ${labels.singular} workflow`,
           parameters: [
             {
@@ -3690,7 +3932,7 @@ function generateOpenApi(config) {
       };
       spec.paths[`${path}/{id}/workflow-history`] = {
         get: {
-          tags: ["Workflows"],
+          tags: [collectionTag],
           summary: `Get ${labels.singular} workflow history`,
           parameters: [
             {
@@ -3736,9 +3978,10 @@ function generateOpenApi(config) {
   for (const global of config.globals) {
     const slug = global.slug;
     const path = `/api/globals/${slug}`;
+    const globalTag = getGlobalTag(global);
     spec.paths[path] = {
       get: {
-        tags: ["Globals"],
+        tags: [globalTag],
         summary: `Get ${global.label || slug}`,
         responses: {
           200: {
@@ -3752,7 +3995,7 @@ function generateOpenApi(config) {
         }
       },
       patch: {
-        tags: ["Globals"],
+        tags: [globalTag],
         summary: `Update ${global.label || slug}`,
         requestBody: {
           required: true,
@@ -3776,7 +4019,7 @@ function generateOpenApi(config) {
     };
     spec.paths[`${path}/seed`] = {
       post: {
-        tags: ["Globals"],
+        tags: [globalTag],
         summary: `Seed ${global.label || slug}`,
         responses: { 200: { description: "Seeded global" } }
       }
@@ -3855,10 +4098,7 @@ function fieldToSchema(field) {
       break;
     case "url":
       schema = {
-        oneOf: [
-          { type: "string" },
-          { type: "object", additionalProperties: true }
-        ]
+        oneOf: [{ type: "string" }, { type: "object", additionalProperties: true }]
       };
       break;
     case "icon":
@@ -4053,6 +4293,7 @@ function serializeFieldForApi(f) {
   return serialized;
 }
 function registerRoutes(app, config) {
+  const optionsCache = /* @__PURE__ */ new Map();
   app.get("/api/schemas", optionalAuth(config), async (c) => {
     const siteId = c.req.header("X-Site-Id");
     let collections = [...config.collections];
@@ -4073,6 +4314,10 @@ function registerRoutes(app, config) {
     const serializeAccess = async (access) => {
       if (typeof access === "string") return access;
       if (typeof access === "boolean") return access;
+      if (access && typeof access === "object" && typeof access.policy === "string") {
+        const policy = config.accessPolicies?.[access.policy];
+        if (typeof policy === "string" || typeof policy === "boolean") return policy;
+      }
       return resolveBooleanAccess(config, access, accessArgs);
     };
     const filteredCollections = await Promise.all(collections.filter((col) => !siteId || col.shared || !col.siteId || col.siteId === siteId).map(async (col) => ({
@@ -4101,6 +4346,7 @@ function registerRoutes(app, config) {
         admin: f.admin,
         access: {
           read: await serializeAccess(f.access?.read),
+          create: await serializeAccess(f.access?.create),
           update: await serializeAccess(f.access?.update)
         }
       }))),
@@ -4208,10 +4454,12 @@ function registerRoutes(app, config) {
       return c.json({ error: true, message: `Field ${fieldName} not found in ${colSlug}` }, 404);
     }
     let resolver;
+    let cacheTTL;
     if (typeof field.options === "function") {
       resolver = field.options;
     } else if (field.options && typeof field.options === "object" && "resolve" in field.options) {
       resolver = field.options.resolve;
+      cacheTTL = field.options.cacheTTL;
     }
     if (!resolver) {
       return c.json({ error: true, message: `Field ${fieldName} in ${colSlug} is not dynamic` }, 400);
@@ -4224,11 +4472,32 @@ function registerRoutes(app, config) {
         headers: c.req.header(),
         raw: c.req.raw
       };
+      const shouldCache = typeof cacheTTL === "number" && cacheTTL > 0;
+      let cacheKey = "";
+      if (shouldCache) {
+        cacheKey = JSON.stringify([
+          siteId ?? "",
+          colSlug,
+          fieldName,
+          user?.id ?? null,
+          queryParams
+        ]);
+        const hit = optionsCache.get(cacheKey);
+        if (hit && hit.expires > Date.now()) {
+          return c.json(hit.value);
+        }
+      }
       const result = await resolver({
         db,
         user,
         req: reqContext
       });
+      if (shouldCache) {
+        optionsCache.set(cacheKey, {
+          expires: Date.now() + cacheTTL * 1e3,
+          value: result
+        });
+      }
       return c.json(result);
     } catch (err) {
       console.error(`[dyrected/core] Failed to resolve dynamic options for field ${fieldName}:`, err);
@@ -4373,6 +4642,7 @@ function registerRoutes(app, config) {
     app.post(`${path}/invite`, requireAuth(config), (c) => authController.invite(c));
     app.post(`${path}/accept-invite`, (c) => authController.acceptInvite(c));
   }
+  const auditController = new AuditController();
   for (const collection of config.collections) {
     const path = `/api/collections/${collection.slug}`;
     const controller = new CollectionController(collection);
@@ -4380,6 +4650,9 @@ function registerRoutes(app, config) {
     app.post(path, (c) => controller.create(c));
     app.post(`${path}/media`, (c) => controller.create(c));
     app.delete(`${path}/delete-many`, (c) => controller.deleteMany(c));
+    if (collection.audit) {
+      app.get(`${path}/__audit`, (c) => auditController.findForCollection(c, collection));
+    }
     app.get(`${path}/:id`, (c) => controller.findOne(c));
     app.patch(`${path}/:id`, (c) => controller.update(c));
     app.delete(`${path}/:id`, (c) => controller.delete(c));
@@ -4402,6 +4675,24 @@ function registerRoutes(app, config) {
   const previewController = new PreviewController();
   app.post("/api/preview-token", requireAuth(config), (c) => previewController.createToken(c));
   app.get("/api/preview-data", (c) => previewController.getData(c));
+  app.get("/api/audit", (c) => auditController.findAll(c));
+  app.get("/api/collections/:slug/__audit", async (c) => {
+    const slug = c.req.param("slug");
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const config2 = c.get("config");
+    if (config2.collections.some((col) => col.slug === slug)) {
+      return c.json({ message: "Not Found" }, 404);
+    }
+    if (!config2.onSchemaFetch || !siteId) {
+      return c.json({ message: `Collection "${slug}" not found` }, 404);
+    }
+    const dynamic = await config2.onSchemaFetch(siteId);
+    const collection = dynamic.collections?.find((col) => col.slug === slug);
+    if (!collection?.audit) {
+      return c.json({ message: `Collection "${slug}" not found or has no audit log` }, 404);
+    }
+    return auditController.findForCollection(c, collection);
+  });
   app.post("/api/collections/:slug/:id/transitions/:transition", requireAuth(config), async (c) => {
     const slug = c.req.param("slug");
     const siteId = c.req.header("X-Site-Id") || c.get("siteId");
@@ -4550,6 +4841,7 @@ var AUDIT_COLLECTION = {
     { name: "timestamp", type: "date", label: "Timestamp", required: true },
     { name: "changes", type: "json", label: "Changes" }
   ],
+  access: { read: () => false, create: () => false, update: () => false, delete: () => false },
   admin: { hidden: true }
 };
 var WORKFLOW_HISTORY_COLLECTION_CONFIG = {
@@ -4654,6 +4946,12 @@ function normalizeConfig(config) {
         if (field.name === "email") {
           return {
             ...field,
+            // Email is the login identifier. Keep the integrity constraints
+            // auth relies on even when the field is explicitly redefined, so a
+            // custom `email` field can never silently drop uniqueness.
+            required: true,
+            unique: true,
+            promoted: true,
             access: {
               ...field.access || {},
               update: "!id"
@@ -4663,6 +4961,9 @@ function normalizeConfig(config) {
         if (field.name === "password") {
           return {
             ...field,
+            // Password is required to authenticate; enforce it regardless of
+            // how the field was declared.
+            required: true,
             admin: { ...field.admin || {} },
             access: {
               ...field.access || {},