@dyrected/core 2.5.58 → 2.5.60

package/dist/server.d.cts

@@ -1,7 +1,7 @@
 import * as hono_types from 'hono/types';
 import * as hono from 'hono';
 import { Hono, Context } from 'hono';
-import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-oU1EGHND.cjs';
+import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-C0twGIaF.cjs';
 import * as hono_utils_http_status from 'hono/utils/http-status';
 import * as hono_utils_types from 'hono/utils/types';
 import 'lucide-react';

package/dist/server.d.ts

@@ -1,7 +1,7 @@
 import * as hono_types from 'hono/types';
 import * as hono from 'hono';
 import { Hono, Context } from 'hono';
-import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-oU1EGHND.js';
+import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-C0twGIaF.js';
 import * as hono_utils_http_status from 'hono/utils/http-status';
 import * as hono_utils_types from 'hono/utils/types';
 import 'lucide-react';

package/dist/server.js

@@ -13,7 +13,7 @@ import {
   runCollectionHooks,
   saveWorkflowDraft,
   transitionWorkflow
-} from "./chunk-L65PQYDP.js";
+} from "./chunk-2WODKOUB.js";
 
 // src/app.ts
 import { Hono } from "hono";
@@ -374,12 +374,16 @@ async function resolveAccess(config, access, args) {
     }
   }
   if (isNamedAccessPolicy(access)) {
-    const resolver = config.accessPolicies?.[access.policy];
-    if (!resolver) {
+    const policy = config.accessPolicies?.[access.policy];
+    if (policy === void 0) {
       console.error(`[dyrected/core] Unknown access policy "${access.policy}".`);
       return false;
     }
+    if (typeof policy === "string" || typeof policy === "boolean") {
+      return evaluateAccess(policy, args);
+    }
     try {
+      const resolver = policy;
       return await resolver({ ...args, params: access.params });
     } catch (err) {
       console.error(`[dyrected/core] Access policy "${access.policy}" failed:`, err);
@@ -425,6 +429,10 @@ async function resolveCollectionAccess(config, collection, action, access, args)
     allowed: await matchesAccessConstraint(config, collection, args.id, result)
   };
 }
+function resolveFieldAccessId(context) {
+  const candidate = context.id ?? context.doc?.id ?? context.data?.id;
+  return typeof candidate === "string" && candidate.length > 0 ? candidate : void 0;
+}
 async function applyFieldReadAccess(context, doc) {
   if (!doc || typeof doc !== "object") return doc;
   const result = { ...doc };
@@ -439,7 +447,8 @@ async function applyFieldReadAccess(context, doc) {
       user: context.user,
       req: context.req,
       doc: context.doc,
-      data: context.data
+      data: context.data,
+      id: resolveFieldAccessId(context)
     });
     if (!canRead) {
       delete result[field.name];
@@ -451,9 +460,10 @@ async function applyFieldReadAccess(context, doc) {
       continue;
     }
     if (field.type === "array" && field.fields && Array.isArray(value)) {
+      const childFields = field.fields;
       result[field.name] = await Promise.all(
         value.map(
-          (item) => typeof item === "object" && item !== null ? applyFieldReadAccess({ ...context, fields: field.fields }, item) : item
+          (item) => typeof item === "object" && item !== null ? applyFieldReadAccess({ ...context, fields: childFields }, item) : item
         )
       );
       continue;
@@ -464,7 +474,7 @@ async function applyFieldReadAccess(context, doc) {
           if (typeof item !== "object" || item === null) return item;
           const typedItem = item;
           const block = field.blocks?.find((candidate) => candidate.slug === typedItem.blockType);
-          if (!block) return item;
+          if (!block || !block.fields) return item;
           return applyFieldReadAccess({ ...context, fields: block.fields }, typedItem);
         })
       );
@@ -481,13 +491,15 @@ async function applyFieldWriteAccess(context, data) {
       continue;
     }
     if (!field.name || !(field.name in result)) continue;
-    const canUpdate = await resolveBooleanAccess(context.config, field.access?.update, {
+    const writeRule = context.operation === "create" ? field.access?.create ?? field.access?.update : field.access?.update;
+    const canWrite = await resolveBooleanAccess(context.config, writeRule, {
       user: context.user,
       req: context.req,
       doc: context.doc,
-      data: context.data
+      data: context.data,
+      id: resolveFieldAccessId(context)
     });
-    if (!canUpdate) {
+    if (!canWrite) {
       delete result[field.name];
       continue;
     }
@@ -498,9 +510,10 @@ async function applyFieldWriteAccess(context, data) {
       continue;
     }
     if (field.type === "array" && field.fields && Array.isArray(value)) {
+      const childFields = field.fields;
       result[field.name] = await Promise.all(
         value.map(
-          (item) => typeof item === "object" && item !== null ? applyFieldWriteAccess({ ...context, fields: field.fields }, item) : item
+          (item) => typeof item === "object" && item !== null ? applyFieldWriteAccess({ ...context, fields: childFields }, item) : item
         )
       );
       continue;
@@ -511,7 +524,7 @@ async function applyFieldWriteAccess(context, data) {
           if (typeof item !== "object" || item === null) return item;
           const typedItem = item;
           const block = field.blocks?.find((candidate) => candidate.slug === typedItem.blockType);
-          if (!block) return item;
+          if (!block || !block.fields) return item;
           return applyFieldWriteAccess({ ...context, fields: block.fields }, typedItem);
         })
       );
@@ -600,7 +613,7 @@ var CollectionController = class {
     const readonlyDb = createReadonlyDb(db);
     const limit = Number(c.req.query("limit")) || 10;
     const page = Number(c.req.query("page")) || 1;
-    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 2;
+    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
     const sort = c.req.query("sort") || void 0;
     const user = c.get("user");
     let where = void 0;
@@ -716,7 +729,7 @@ var CollectionController = class {
     }
     const readonlyDb = createReadonlyDb(db);
     const id = c.req.param("id");
-    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 10;
+    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
     const user = c.get("user");
     if (!id) return c.json({ message: "Missing ID" }, 400);
     let doc = await db.findOne({ collection: this.collection.slug, id });
@@ -805,7 +818,8 @@ var CollectionController = class {
       fields: this.collection.fields,
       user,
       req: this.toHookRequestContext(c),
-      data
+      data,
+      operation: "create"
     }, data);
     data = await executeFieldBeforeChange(this.collection.fields, data, null, user, readonlyDb);
     data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
@@ -900,7 +914,8 @@ var CollectionController = class {
       fields: this.collection.fields,
       user,
       req: this.toHookRequestContext(c),
-      data
+      data,
+      operation: "create"
     }, data);
     data = await executeFieldBeforeChange(this.collection.fields, data, null, user, readonlyDb);
     data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
@@ -1322,7 +1337,7 @@ var GlobalController = class {
     const db = config.db;
     if (!db) return c.json({ message: "Database not configured" }, 500);
     const readonlyDb = createReadonlyDb(db);
-    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 10;
+    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
     const user = c.get("user");
     let query = void 0;
     const beforeReadResult = await runCollectionHooks(this.global.hooks?.beforeRead, {
@@ -2546,6 +2561,150 @@ var PreviewController = class {
   }
 };
 
+// src/controllers/audit.controller.ts
+var AuditController = class {
+  parseQuery(c) {
+    const limit = Math.min(Number(c.req.query("limit")) || 50, 100);
+    const page = Math.max(Number(c.req.query("page")) || 1, 1);
+    const sort = c.req.query("sort") || "-timestamp";
+    const whereRaw = c.req.query("where");
+    if (!whereRaw) {
+      return { limit, page, sort };
+    }
+    try {
+      return {
+        limit,
+        page,
+        sort,
+        where: JSON.parse(decodeURIComponent(whereRaw))
+      };
+    } catch {
+      return { limit, page, sort };
+    }
+  }
+  emptyResult(limit, page) {
+    return {
+      docs: [],
+      total: 0,
+      limit,
+      page,
+      totalPages: 0,
+      hasNextPage: false,
+      hasPrevPage: page > 1
+    };
+  }
+  async collectAccessibleDocumentIds(db, collection, constraint) {
+    const ids = [];
+    const limit = 100;
+    let page = 1;
+    while (true) {
+      const result = await db.find({
+        collection: collection.slug,
+        where: constraint,
+        limit,
+        page
+      });
+      for (const doc of result.docs) {
+        if (typeof doc?.id === "string" && doc.id.length > 0) {
+          ids.push(doc.id);
+        }
+      }
+      if (!result.hasNextPage || page >= result.totalPages) {
+        break;
+      }
+      page += 1;
+    }
+    return ids;
+  }
+  async buildCollectionAuditScope(c, collection) {
+    const config = c.get("config");
+    const auditAccess = collection.access?.readAudit ?? collection.access?.read;
+    const access = await resolveCollectionAccess(
+      config,
+      collection.slug,
+      "read",
+      auditAccess,
+      {
+        user: c.get("user"),
+        req: toHookRequestContext(c.req)
+      }
+    );
+    if (!access.allowed) {
+      return { denied: true, where: {} };
+    }
+    let where = { collection: { equals: collection.slug } };
+    if (access.constraint) {
+      const ids = await this.collectAccessibleDocumentIds(config.db, collection, access.constraint);
+      where = mergeWhereConstraint(where, { documentId: { in: ids } });
+    }
+    return { denied: false, where };
+  }
+  async getVisibleCollections(c) {
+    const config = c.get("config");
+    const collections = /* @__PURE__ */ new Map();
+    for (const collection of config.collections) {
+      collections.set(collection.slug, collection);
+    }
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    if (config.onSchemaFetch && siteId) {
+      const dynamic = await config.onSchemaFetch(siteId);
+      for (const collection of dynamic.collections || []) {
+        if (!collections.has(collection.slug)) {
+          collections.set(collection.slug, collection);
+        }
+      }
+    }
+    return Array.from(collections.values());
+  }
+  async findForCollection(c, collection) {
+    const config = c.get("config");
+    if (!config.db) return c.json({ message: "Database not configured" }, 500);
+    if (!collection.audit) return c.json({ message: "Audit is not enabled for this collection" }, 404);
+    const query = this.parseQuery(c);
+    const scope = await this.buildCollectionAuditScope(c, collection);
+    if (scope.denied) {
+      return c.json({ error: true, message: `Access denied: read on ${collection.slug}` }, 403);
+    }
+    const where = query.where ? mergeWhereConstraint(scope.where, query.where) : scope.where;
+    const result = await config.db.find({
+      collection: "__audit",
+      where,
+      limit: query.limit,
+      page: query.page,
+      sort: query.sort
+    });
+    return c.json(result);
+  }
+  async findAll(c) {
+    const config = c.get("config");
+    if (!config.db) return c.json({ message: "Database not configured" }, 500);
+    const query = this.parseQuery(c);
+    const collections = (await this.getVisibleCollections(c)).filter((collection) => collection.audit);
+    const scopes = [];
+    for (const collection of collections) {
+      const scope = await this.buildCollectionAuditScope(c, collection);
+      if (!scope.denied) {
+        scopes.push(scope.where);
+      }
+    }
+    if (scopes.length === 0) {
+      return c.json(this.emptyResult(query.limit, query.page));
+    }
+    let where = scopes.length === 1 ? scopes[0] : { OR: scopes };
+    if (query.where) {
+      where = mergeWhereConstraint(where, query.where);
+    }
+    const result = await config.db.find({
+      collection: "__audit",
+      where,
+      limit: query.limit,
+      page: query.page,
+      sort: query.sort
+    });
+    return c.json(result);
+  }
+};
+
 // src/middleware/auth.ts
 function getBearerToken(c) {
   const authHeader = c.req.header("Authorization");
@@ -2722,6 +2881,7 @@ function serializeFieldForApi(f) {
   return serialized;
 }
 function registerRoutes(app, config) {
+  const optionsCache = /* @__PURE__ */ new Map();
   app.get("/api/schemas", optionalAuth(config), async (c) => {
     const siteId = c.req.header("X-Site-Id");
     let collections = [...config.collections];
@@ -2742,6 +2902,10 @@ function registerRoutes(app, config) {
     const serializeAccess = async (access) => {
       if (typeof access === "string") return access;
       if (typeof access === "boolean") return access;
+      if (access && typeof access === "object" && typeof access.policy === "string") {
+        const policy = config.accessPolicies?.[access.policy];
+        if (typeof policy === "string" || typeof policy === "boolean") return policy;
+      }
       return resolveBooleanAccess(config, access, accessArgs);
     };
     const filteredCollections = await Promise.all(collections.filter((col) => !siteId || col.shared || !col.siteId || col.siteId === siteId).map(async (col) => ({
@@ -2770,6 +2934,7 @@ function registerRoutes(app, config) {
         admin: f.admin,
         access: {
           read: await serializeAccess(f.access?.read),
+          create: await serializeAccess(f.access?.create),
           update: await serializeAccess(f.access?.update)
         }
       }))),
@@ -2877,10 +3042,12 @@ function registerRoutes(app, config) {
       return c.json({ error: true, message: `Field ${fieldName} not found in ${colSlug}` }, 404);
     }
     let resolver;
+    let cacheTTL;
     if (typeof field.options === "function") {
       resolver = field.options;
     } else if (field.options && typeof field.options === "object" && "resolve" in field.options) {
       resolver = field.options.resolve;
+      cacheTTL = field.options.cacheTTL;
     }
     if (!resolver) {
       return c.json({ error: true, message: `Field ${fieldName} in ${colSlug} is not dynamic` }, 400);
@@ -2893,11 +3060,32 @@ function registerRoutes(app, config) {
         headers: c.req.header(),
         raw: c.req.raw
       };
+      const shouldCache = typeof cacheTTL === "number" && cacheTTL > 0;
+      let cacheKey = "";
+      if (shouldCache) {
+        cacheKey = JSON.stringify([
+          siteId ?? "",
+          colSlug,
+          fieldName,
+          user?.id ?? null,
+          queryParams
+        ]);
+        const hit = optionsCache.get(cacheKey);
+        if (hit && hit.expires > Date.now()) {
+          return c.json(hit.value);
+        }
+      }
       const result = await resolver({
         db,
         user,
         req: reqContext
       });
+      if (shouldCache) {
+        optionsCache.set(cacheKey, {
+          expires: Date.now() + cacheTTL * 1e3,
+          value: result
+        });
+      }
       return c.json(result);
     } catch (err) {
       console.error(`[dyrected/core] Failed to resolve dynamic options for field ${fieldName}:`, err);
@@ -3042,6 +3230,7 @@ function registerRoutes(app, config) {
     app.post(`${path}/invite`, requireAuth(config), (c) => authController.invite(c));
     app.post(`${path}/accept-invite`, (c) => authController.acceptInvite(c));
   }
+  const auditController = new AuditController();
   for (const collection of config.collections) {
     const path = `/api/collections/${collection.slug}`;
     const controller = new CollectionController(collection);
@@ -3049,6 +3238,9 @@ function registerRoutes(app, config) {
     app.post(path, (c) => controller.create(c));
     app.post(`${path}/media`, (c) => controller.create(c));
     app.delete(`${path}/delete-many`, (c) => controller.deleteMany(c));
+    if (collection.audit) {
+      app.get(`${path}/__audit`, (c) => auditController.findForCollection(c, collection));
+    }
     app.get(`${path}/:id`, (c) => controller.findOne(c));
     app.patch(`${path}/:id`, (c) => controller.update(c));
     app.delete(`${path}/:id`, (c) => controller.delete(c));
@@ -3071,6 +3263,24 @@ function registerRoutes(app, config) {
   const previewController = new PreviewController();
   app.post("/api/preview-token", requireAuth(config), (c) => previewController.createToken(c));
   app.get("/api/preview-data", (c) => previewController.getData(c));
+  app.get("/api/audit", (c) => auditController.findAll(c));
+  app.get("/api/collections/:slug/__audit", async (c) => {
+    const slug = c.req.param("slug");
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const config2 = c.get("config");
+    if (config2.collections.some((col) => col.slug === slug)) {
+      return c.json({ message: "Not Found" }, 404);
+    }
+    if (!config2.onSchemaFetch || !siteId) {
+      return c.json({ message: `Collection "${slug}" not found` }, 404);
+    }
+    const dynamic = await config2.onSchemaFetch(siteId);
+    const collection = dynamic.collections?.find((col) => col.slug === slug);
+    if (!collection?.audit) {
+      return c.json({ message: `Collection "${slug}" not found or has no audit log` }, 404);
+    }
+    return auditController.findForCollection(c, collection);
+  });
   app.post("/api/collections/:slug/:id/transitions/:transition", requireAuth(config), async (c) => {
     const slug = c.req.param("slug");
     const siteId = c.req.header("X-Site-Id") || c.get("siteId");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dyrected/core",
-  "version": "2.5.58",
+  "version": "2.5.60",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",