@dyrected/core 2.5.59 → 2.5.61

package/dist/server.d.cts

@@ -1,7 +1,7 @@
 import * as hono_types from 'hono/types';
 import * as hono from 'hono';
 import { Hono, Context } from 'hono';
-import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-C3X5BAyK.cjs';
+import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-C0uxEU7Q.cjs';
 import * as hono_utils_http_status from 'hono/utils/http-status';
 import * as hono_utils_types from 'hono/utils/types';
 import 'lucide-react';

package/dist/server.d.ts

@@ -1,7 +1,7 @@
 import * as hono_types from 'hono/types';
 import * as hono from 'hono';
 import { Hono, Context } from 'hono';
-import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-C3X5BAyK.js';
+import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-C0uxEU7Q.js';
 import * as hono_utils_http_status from 'hono/utils/http-status';
 import * as hono_utils_types from 'hono/utils/types';
 import 'lucide-react';

package/dist/server.js

@@ -13,7 +13,7 @@ import {
   runCollectionHooks,
   saveWorkflowDraft,
   transitionWorkflow
-} from "./chunk-L65PQYDP.js";
+} from "./chunk-35NM2WPO.js";
 
 // src/app.ts
 import { Hono } from "hono";
@@ -374,12 +374,16 @@ async function resolveAccess(config, access, args) {
     }
   }
   if (isNamedAccessPolicy(access)) {
-    const resolver = config.accessPolicies?.[access.policy];
-    if (!resolver) {
+    const policy = config.accessPolicies?.[access.policy];
+    if (policy === void 0) {
       console.error(`[dyrected/core] Unknown access policy "${access.policy}".`);
       return false;
     }
+    if (typeof policy === "string" || typeof policy === "boolean") {
+      return evaluateAccess(policy, args);
+    }
     try {
+      const resolver = policy;
       return await resolver({ ...args, params: access.params });
     } catch (err) {
       console.error(`[dyrected/core] Access policy "${access.policy}" failed:`, err);
@@ -487,14 +491,15 @@ async function applyFieldWriteAccess(context, data) {
       continue;
     }
     if (!field.name || !(field.name in result)) continue;
-    const canUpdate = await resolveBooleanAccess(context.config, field.access?.update, {
+    const writeRule = context.operation === "create" ? field.access?.create ?? field.access?.update : field.access?.update;
+    const canWrite = await resolveBooleanAccess(context.config, writeRule, {
       user: context.user,
       req: context.req,
       doc: context.doc,
       data: context.data,
       id: resolveFieldAccessId(context)
     });
-    if (!canUpdate) {
+    if (!canWrite) {
       delete result[field.name];
       continue;
     }
@@ -606,9 +611,9 @@ var CollectionController = class {
       });
     }
     const readonlyDb = createReadonlyDb(db);
-    const limit = Number(c.req.query("limit")) || 10;
+    const limit = Math.min(Number(c.req.query("limit")) || 10, 100);
     const page = Number(c.req.query("page")) || 1;
-    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 2;
+    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
     const sort = c.req.query("sort") || void 0;
     const user = c.get("user");
     let where = void 0;
@@ -654,7 +659,8 @@ var CollectionController = class {
       limit,
       page,
       sort,
-      where
+      where,
+      fields: this.collection.fields
     });
     if (result.total === 0 && this.collection.initialData && !where && page === 1) {
       console.log(`[dyrected/core] Auto-seeding collection "${this.collection.slug}" from config.initialData`);
@@ -666,7 +672,8 @@ var CollectionController = class {
         limit,
         page,
         sort,
-        where
+        where,
+        fields: this.collection.fields
       });
     }
     result.docs = result.docs.map((doc) => this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc).filter((doc) => doc !== null);
@@ -724,7 +731,7 @@ var CollectionController = class {
     }
     const readonlyDb = createReadonlyDb(db);
     const id = c.req.param("id");
-    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 10;
+    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
     const user = c.get("user");
     if (!id) return c.json({ message: "Missing ID" }, 400);
     let doc = await db.findOne({ collection: this.collection.slug, id });
@@ -813,7 +820,8 @@ var CollectionController = class {
       fields: this.collection.fields,
       user,
       req: this.toHookRequestContext(c),
-      data
+      data,
+      operation: "create"
     }, data);
     data = await executeFieldBeforeChange(this.collection.fields, data, null, user, readonlyDb);
     data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
@@ -908,7 +916,8 @@ var CollectionController = class {
       fields: this.collection.fields,
       user,
       req: this.toHookRequestContext(c),
-      data
+      data,
+      operation: "create"
     }, data);
     data = await executeFieldBeforeChange(this.collection.fields, data, null, user, readonlyDb);
     data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
@@ -1330,7 +1339,7 @@ var GlobalController = class {
     const db = config.db;
     if (!db) return c.json({ message: "Database not configured" }, 500);
     const readonlyDb = createReadonlyDb(db);
-    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 10;
+    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
     const user = c.get("user");
     let query = void 0;
     const beforeReadResult = await runCollectionHooks(this.global.hooks?.beforeRead, {
@@ -2554,6 +2563,150 @@ var PreviewController = class {
   }
 };
 
+// src/controllers/audit.controller.ts
+var AuditController = class {
+  parseQuery(c) {
+    const limit = Math.min(Number(c.req.query("limit")) || 50, 100);
+    const page = Math.max(Number(c.req.query("page")) || 1, 1);
+    const sort = c.req.query("sort") || "-timestamp";
+    const whereRaw = c.req.query("where");
+    if (!whereRaw) {
+      return { limit, page, sort };
+    }
+    try {
+      return {
+        limit,
+        page,
+        sort,
+        where: JSON.parse(decodeURIComponent(whereRaw))
+      };
+    } catch {
+      return { limit, page, sort };
+    }
+  }
+  emptyResult(limit, page) {
+    return {
+      docs: [],
+      total: 0,
+      limit,
+      page,
+      totalPages: 0,
+      hasNextPage: false,
+      hasPrevPage: page > 1
+    };
+  }
+  async collectAccessibleDocumentIds(db, collection, constraint) {
+    const ids = [];
+    const limit = 100;
+    let page = 1;
+    while (true) {
+      const result = await db.find({
+        collection: collection.slug,
+        where: constraint,
+        limit,
+        page
+      });
+      for (const doc of result.docs) {
+        if (typeof doc?.id === "string" && doc.id.length > 0) {
+          ids.push(doc.id);
+        }
+      }
+      if (!result.hasNextPage || page >= result.totalPages) {
+        break;
+      }
+      page += 1;
+    }
+    return ids;
+  }
+  async buildCollectionAuditScope(c, collection) {
+    const config = c.get("config");
+    const auditAccess = collection.access?.readAudit ?? collection.access?.read;
+    const access = await resolveCollectionAccess(
+      config,
+      collection.slug,
+      "read",
+      auditAccess,
+      {
+        user: c.get("user"),
+        req: toHookRequestContext(c.req)
+      }
+    );
+    if (!access.allowed) {
+      return { denied: true, where: {} };
+    }
+    let where = { collection: { equals: collection.slug } };
+    if (access.constraint) {
+      const ids = await this.collectAccessibleDocumentIds(config.db, collection, access.constraint);
+      where = mergeWhereConstraint(where, { documentId: { in: ids } });
+    }
+    return { denied: false, where };
+  }
+  async getVisibleCollections(c) {
+    const config = c.get("config");
+    const collections = /* @__PURE__ */ new Map();
+    for (const collection of config.collections) {
+      collections.set(collection.slug, collection);
+    }
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    if (config.onSchemaFetch && siteId) {
+      const dynamic = await config.onSchemaFetch(siteId);
+      for (const collection of dynamic.collections || []) {
+        if (!collections.has(collection.slug)) {
+          collections.set(collection.slug, collection);
+        }
+      }
+    }
+    return Array.from(collections.values());
+  }
+  async findForCollection(c, collection) {
+    const config = c.get("config");
+    if (!config.db) return c.json({ message: "Database not configured" }, 500);
+    if (!collection.audit) return c.json({ message: "Audit is not enabled for this collection" }, 404);
+    const query = this.parseQuery(c);
+    const scope = await this.buildCollectionAuditScope(c, collection);
+    if (scope.denied) {
+      return c.json({ error: true, message: `Access denied: read on ${collection.slug}` }, 403);
+    }
+    const where = query.where ? mergeWhereConstraint(scope.where, query.where) : scope.where;
+    const result = await config.db.find({
+      collection: "__audit",
+      where,
+      limit: query.limit,
+      page: query.page,
+      sort: query.sort
+    });
+    return c.json(result);
+  }
+  async findAll(c) {
+    const config = c.get("config");
+    if (!config.db) return c.json({ message: "Database not configured" }, 500);
+    const query = this.parseQuery(c);
+    const collections = (await this.getVisibleCollections(c)).filter((collection) => collection.audit);
+    const scopes = [];
+    for (const collection of collections) {
+      const scope = await this.buildCollectionAuditScope(c, collection);
+      if (!scope.denied) {
+        scopes.push(scope.where);
+      }
+    }
+    if (scopes.length === 0) {
+      return c.json(this.emptyResult(query.limit, query.page));
+    }
+    let where = scopes.length === 1 ? scopes[0] : { OR: scopes };
+    if (query.where) {
+      where = mergeWhereConstraint(where, query.where);
+    }
+    const result = await config.db.find({
+      collection: "__audit",
+      where,
+      limit: query.limit,
+      page: query.page,
+      sort: query.sort
+    });
+    return c.json(result);
+  }
+};
+
 // src/middleware/auth.ts
 function getBearerToken(c) {
   const authHeader = c.req.header("Authorization");
@@ -2730,6 +2883,7 @@ function serializeFieldForApi(f) {
   return serialized;
 }
 function registerRoutes(app, config) {
+  const optionsCache = /* @__PURE__ */ new Map();
   app.get("/api/schemas", optionalAuth(config), async (c) => {
     const siteId = c.req.header("X-Site-Id");
     let collections = [...config.collections];
@@ -2750,6 +2904,10 @@ function registerRoutes(app, config) {
     const serializeAccess = async (access) => {
       if (typeof access === "string") return access;
       if (typeof access === "boolean") return access;
+      if (access && typeof access === "object" && typeof access.policy === "string") {
+        const policy = config.accessPolicies?.[access.policy];
+        if (typeof policy === "string" || typeof policy === "boolean") return policy;
+      }
       return resolveBooleanAccess(config, access, accessArgs);
     };
     const filteredCollections = await Promise.all(collections.filter((col) => !siteId || col.shared || !col.siteId || col.siteId === siteId).map(async (col) => ({
@@ -2778,11 +2936,14 @@ function registerRoutes(app, config) {
         admin: f.admin,
         access: {
           read: await serializeAccess(f.access?.read),
+          create: await serializeAccess(f.access?.create),
           update: await serializeAccess(f.access?.update)
         }
       }))),
       upload: !!col.upload,
       auth: !!col.auth,
+      audit: !!col.audit,
+      drafts: !!col.drafts,
       admin: col.admin,
       workflow: col.workflow ? {
         initialState: col.workflow.initialState,
@@ -2885,10 +3046,12 @@ function registerRoutes(app, config) {
       return c.json({ error: true, message: `Field ${fieldName} not found in ${colSlug}` }, 404);
     }
     let resolver;
+    let cacheTTL;
     if (typeof field.options === "function") {
       resolver = field.options;
     } else if (field.options && typeof field.options === "object" && "resolve" in field.options) {
       resolver = field.options.resolve;
+      cacheTTL = field.options.cacheTTL;
     }
     if (!resolver) {
       return c.json({ error: true, message: `Field ${fieldName} in ${colSlug} is not dynamic` }, 400);
@@ -2901,11 +3064,32 @@ function registerRoutes(app, config) {
         headers: c.req.header(),
         raw: c.req.raw
       };
+      const shouldCache = typeof cacheTTL === "number" && cacheTTL > 0;
+      let cacheKey = "";
+      if (shouldCache) {
+        cacheKey = JSON.stringify([
+          siteId ?? "",
+          colSlug,
+          fieldName,
+          user?.id ?? null,
+          queryParams
+        ]);
+        const hit = optionsCache.get(cacheKey);
+        if (hit && hit.expires > Date.now()) {
+          return c.json(hit.value);
+        }
+      }
       const result = await resolver({
         db,
         user,
         req: reqContext
       });
+      if (shouldCache) {
+        optionsCache.set(cacheKey, {
+          expires: Date.now() + cacheTTL * 1e3,
+          value: result
+        });
+      }
       return c.json(result);
     } catch (err) {
       console.error(`[dyrected/core] Failed to resolve dynamic options for field ${fieldName}:`, err);
@@ -3050,6 +3234,7 @@ function registerRoutes(app, config) {
     app.post(`${path}/invite`, requireAuth(config), (c) => authController.invite(c));
     app.post(`${path}/accept-invite`, (c) => authController.acceptInvite(c));
   }
+  const auditController = new AuditController();
   for (const collection of config.collections) {
     const path = `/api/collections/${collection.slug}`;
     const controller = new CollectionController(collection);
@@ -3057,6 +3242,9 @@ function registerRoutes(app, config) {
     app.post(path, (c) => controller.create(c));
     app.post(`${path}/media`, (c) => controller.create(c));
     app.delete(`${path}/delete-many`, (c) => controller.deleteMany(c));
+    if (collection.audit) {
+      app.get(`${path}/__audit`, (c) => auditController.findForCollection(c, collection));
+    }
     app.get(`${path}/:id`, (c) => controller.findOne(c));
     app.patch(`${path}/:id`, (c) => controller.update(c));
     app.delete(`${path}/:id`, (c) => controller.delete(c));
@@ -3076,9 +3264,32 @@ function registerRoutes(app, config) {
     app.patch(path, (c) => controller.update(c));
     app.post(`${path}/seed`, (c) => controller.seed(c));
   }
+  if (!process.env.DYRECTED_JWT_SECRET) {
+    console.warn(
+      '[dyrected] DYRECTED_JWT_SECRET is not set \u2014 token-mode live preview is signing with an insecure default. Set DYRECTED_JWT_SECRET before relying on `previewMode: "token"` in production.'
+    );
+  }
   const previewController = new PreviewController();
   app.post("/api/preview-token", requireAuth(config), (c) => previewController.createToken(c));
   app.get("/api/preview-data", (c) => previewController.getData(c));
+  app.get("/api/audit", (c) => auditController.findAll(c));
+  app.get("/api/collections/:slug/__audit", async (c) => {
+    const slug = c.req.param("slug");
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const config2 = c.get("config");
+    if (config2.collections.some((col) => col.slug === slug)) {
+      return c.json({ message: "Not Found" }, 404);
+    }
+    if (!config2.onSchemaFetch || !siteId) {
+      return c.json({ message: `Collection "${slug}" not found` }, 404);
+    }
+    const dynamic = await config2.onSchemaFetch(siteId);
+    const collection = dynamic.collections?.find((col) => col.slug === slug);
+    if (!collection?.audit) {
+      return c.json({ message: `Collection "${slug}" not found or has no audit log` }, 404);
+    }
+    return auditController.findForCollection(c, collection);
+  });
   app.post("/api/collections/:slug/:id/transitions/:transition", requireAuth(config), async (c) => {
     const slug = c.req.param("slug");
     const siteId = c.req.header("X-Site-Id") || c.get("siteId");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dyrected/core",
-  "version": "2.5.59",
+  "version": "2.5.61",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",