@dyrected/core 2.7.1 → 2.8.0

package/dist/server.js

@@ -7,6 +7,7 @@ import {
   canViewWorkflowDraft,
   collectConfigDiagnostics,
   createWorkflowDocument,
+  evaluateDetailComputed,
   executeFieldAfterRead,
   executeFieldBeforeChange,
   generateOpenApi,
@@ -28,7 +29,7 @@ import {
   touchAuthSession,
   transitionWorkflow,
   verifyCollectionToken
-} from "./chunk-YSSHLGQ6.js";
+} from "./chunk-XX7N64NL.js";
 import {
   attachRequestMetrics,
   bindObservabilityRuntime,
@@ -865,6 +866,22 @@ var CollectionController = class {
   toHookRequestContext(c) {
     return toHookRequestContext(c.req);
   }
+  sanitizeDoc(doc) {
+    if (!doc || typeof doc !== "object") return doc;
+    if (this.collection.auth) {
+      const {
+        password: _p,
+        salt: _s,
+        resetPasswordToken: _rpt,
+        resetPasswordExpires: _rpe,
+        loginAttempts: _la,
+        lockUntil: _lu,
+        ...safeDoc
+      } = doc;
+      return safeDoc;
+    }
+    return doc;
+  }
   async evaluateAccess(c, action, options = {}) {
     const config = c.get("config");
     return resolveCollectionAccess(
@@ -1097,6 +1114,9 @@ var CollectionController = class {
         depth
       );
     }
+    if (this.collection.auth && result.docs && Array.isArray(result.docs)) {
+      result.docs = result.docs.map((d) => this.sanitizeDoc(d));
+    }
     return c.json(result);
   }
   async findOne(c) {
@@ -1113,32 +1133,51 @@ var CollectionController = class {
         id: id2
       });
       const externalSubject = localDoc?.externalSubject || id2;
-      let member = null;
       if (provider.members.get) {
-        member = await provider.members.get({ externalSubject, req: hookReq });
+        const member = await provider.members.get({
+          externalSubject,
+          req: hookReq
+        });
+        if (member) {
+          return c.json({
+            ...member,
+            id: localDoc ? localDoc.id : member.id,
+            externalSubject: member.id
+          });
+        }
       } else if (provider.members.list) {
         const listResult = await provider.members.list({ req: hookReq });
-        member = listResult.docs.find((m) => m.id === externalSubject) || null;
+        const matched = listResult.docs.find((m) => m.id === externalSubject || m.id === id2);
+        if (matched) {
+          return c.json({
+            ...matched,
+            id: localDoc ? localDoc.id : matched.id,
+            externalSubject: matched.id
+          });
+        }
       }
-      if (!member) return c.json({ message: "Not Found" }, 404);
-      return c.json({
-        ...member,
-        id: localDoc ? localDoc.id : member.id,
-        externalSubject: member.id
-      });
     }
-    const readonlyDb = createReadonlyDb(db);
     const id = c.req.param("id");
-    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
-    const user = c.get("user");
     if (!id) return c.json({ message: "Missing ID" }, 400);
-    let doc = await db.findOne({ collection: this.collection.slug, id });
-    if (!doc) return c.json({ message: "Not Found" }, 404);
+    const depth = Number.parseInt(c.req.query("depth") || "0", 10);
+    const user = c.get("user");
+    const doc = await db.findOne({
+      collection: this.collection.slug,
+      id
+    });
+    if (!doc) {
+      return c.json({ message: "Document not found" }, 404);
+    }
+    let effectiveDoc = doc;
     if (this.collection.workflow) {
-      doc = materializeWorkflowDocument(doc, this.collection.workflow, user);
-      if (!doc) return c.json({ message: "Not Found" }, 404);
+      effectiveDoc = materializeWorkflowDocument(
+        doc,
+        this.collection.workflow,
+        user
+      );
+      if (!effectiveDoc) return c.json({ message: "Document not found" }, 404);
     }
-    const access = await this.evaluateAccess(c, "read", { id, doc });
+    const access = await this.evaluateAccess(c, "read", { id, doc: effectiveDoc });
     if (!access.allowed) {
       return c.json(
         {
@@ -1148,7 +1187,11 @@ var CollectionController = class {
         403
       );
     }
-    const docWithDefaults = DefaultsService.apply(this.collection.fields, doc);
+    const docWithDefaults = DefaultsService.apply(
+      this.collection.fields,
+      effectiveDoc
+    );
+    const readonlyDb = createReadonlyDb(db);
     const docWithCollectionHooks = await runCollectionHooks(
       this.collection.hooks?.afterRead,
       {
@@ -1174,17 +1217,20 @@ var CollectionController = class {
       },
       docWithFieldHooks
     );
+    let finalDoc = docWithFieldAccess;
     if (depth > 0 && docWithFieldAccess) {
       const populationService = new PopulationService(db, config.collections);
-      const populatedDoc = await populationService.populate({
+      finalDoc = await populationService.populate({
         data: docWithFieldAccess,
         fields: this.collection.fields,
         currentDepth: 0,
         maxDepth: depth
       });
-      return c.json(populatedDoc);
     }
-    return c.json(docWithFieldAccess);
+    if (finalDoc && this.collection.detail) {
+      finalDoc = await evaluateDetailComputed(this.collection.detail, finalDoc, user, readonlyDb);
+    }
+    return c.json(this.sanitizeDoc(finalDoc));
   }
   async create(c) {
     const config = c.get("config");
@@ -1956,6 +2002,63 @@ var CollectionController = class {
       201
     );
   }
+  async aggregate(c) {
+    const config = c.get("config");
+    const db = config.db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
+    const access = await this.evaluateAccess(c, "read");
+    if (!access.allowed) {
+      return c.json(
+        {
+          error: true,
+          message: `Access denied: read on ${this.collection.slug}`
+        },
+        403
+      );
+    }
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json({ message: "Invalid JSON body" }, 400);
+    }
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+      return c.json(
+        { message: "Aggregate request body must be a JSON object" },
+        400
+      );
+    }
+    const { sanitizeWhereClause } = await import("./where-sanitizer-WJ2W2QCE.js");
+    const sanitizedAggregates = {};
+    for (const [key, op] of Object.entries(body)) {
+      if (!op || typeof op !== "object" || Array.isArray(op)) {
+        return c.json(
+          {
+            message: `Aggregate operation "${key}" must be an object`
+          },
+          400
+        );
+      }
+      const operation = op;
+      let opWhere = operation.where && typeof operation.where === "object" ? operation.where : void 0;
+      if (opWhere) {
+        opWhere = sanitizeWhereClause(opWhere, this.collection.fields);
+        if (Object.keys(opWhere).length === 0) opWhere = void 0;
+      }
+      if (access.constraint) {
+        opWhere = opWhere ? mergeWhereConstraint(opWhere, access.constraint) : access.constraint;
+      }
+      sanitizedAggregates[key] = {
+        ...operation,
+        ...opWhere !== void 0 ? { where: opWhere } : { where: void 0 }
+      };
+    }
+    const result = await db.aggregate({
+      collection: this.collection.slug,
+      aggregates: sanitizedAggregates
+    });
+    return c.json(result);
+  }
 };
 
 // src/controllers/global.controller.ts
@@ -2038,17 +2141,25 @@ var GlobalController = class {
       },
       docWithFieldHooks
     );
+    let finalDoc = docWithFieldAccess;
     if (depth > 0 && docWithFieldAccess) {
       const populationService = new PopulationService(db, config.collections);
-      const populatedData = await populationService.populate({
+      finalDoc = await populationService.populate({
         data: docWithFieldAccess,
         fields: this.global.fields,
         currentDepth: 0,
         maxDepth: depth
       });
-      return c.json(populatedData);
     }
-    return c.json(docWithFieldAccess);
+    if (finalDoc && this.global.detail) {
+      finalDoc = await evaluateDetailComputed(
+        this.global.detail,
+        finalDoc,
+        user,
+        readonlyDb
+      );
+    }
+    return c.json(finalDoc);
   }
   async update(c) {
     const config = c.get("config");
@@ -3391,6 +3502,7 @@ var AdminAuthController = class {
     });
   }
   getProvider(config, id) {
+    if (!id) return void 0;
     if (config.adminAuth?.mode !== "external") return void 0;
     return config.adminAuth.providers.find((provider) => provider.id === id);
   }
@@ -3589,17 +3701,16 @@ var AdminAuthController = class {
         throw new Error("OIDC nonce verification failed.");
       }
       claims = payload;
-    } else if (tokenBody.access_token && (provider.userInfoEndpoint || discovery.userinfo_endpoint)) {
-      const userInfo = await fetch(
-        provider.userInfoEndpoint || discovery.userinfo_endpoint,
-        {
-          headers: { Authorization: `Bearer ${tokenBody.access_token}` }
-        }
-      );
+    } else {
+      const userInfoEndpoint = provider.userInfoEndpoint ?? discovery.userinfo_endpoint;
+      if (!tokenBody.access_token || !userInfoEndpoint) {
+        throw new Error("OIDC provider did not return usable identity claims.");
+      }
+      const userInfo = await fetch(userInfoEndpoint, {
+        headers: { Authorization: `Bearer ${tokenBody.access_token}` }
+      });
       if (!userInfo.ok) throw new Error("OIDC userinfo request failed.");
       claims = await userInfo.json();
-    } else {
-      throw new Error("OIDC provider did not return usable identity claims.");
     }
     return {
       identity: this.mapClaims(claims, provider.claimMapping),
@@ -4144,10 +4255,7 @@ function accessGate(config, target, action) {
       req: toHookRequestContext(c.req)
     });
     if (!allowed) {
-      return c.json(
-        { error: true, message: `Access denied: ${action} on ${target.slug}` },
-        403
-      );
+      return c.json({ error: true, message: `Access denied: ${action} on ${target.slug}` }, 403);
     }
     await next();
   };
@@ -4187,6 +4295,80 @@ function serializeBlockForApi(block) {
     fields: block.fields?.map(serializeFieldForApi)
   };
 }
+function serializeDetailItemForApi(item) {
+  if (!item) return item;
+  if (typeof item === "string") {
+    return { type: "field", field: item };
+  }
+  if (item.type === "section") {
+    return {
+      type: "section",
+      title: item.title,
+      items: (item.items || []).map(serializeDetailItemForApi),
+      options: item.options
+    };
+  }
+  if (item.type === "tab") {
+    return {
+      type: "tab",
+      label: item.label,
+      items: (item.items || []).map(serializeDetailItemForApi),
+      options: item.options
+    };
+  }
+  if (item.type === "tabs") {
+    return {
+      type: "tabs",
+      tabs: (item.tabs || []).map(serializeDetailItemForApi),
+      options: item.options
+    };
+  }
+  if (item.type === "grid") {
+    return {
+      type: "grid",
+      columns: item.columns,
+      items: (item.items || []).map(serializeDetailItemForApi),
+      options: item.options
+    };
+  }
+  if (item.type === "repeat") {
+    return {
+      type: "repeat",
+      field: item.field,
+      items: (item.items || []).map(serializeDetailItemForApi),
+      options: item.options
+    };
+  }
+  if (item.type === "computed") {
+    return {
+      type: "computed",
+      id: item.id || item.label?.toLowerCase().replace(/[^a-z0-9]+/g, "_"),
+      label: item.label,
+      expression: item.expression,
+      options: {
+        id: item.id,
+        span: item.options?.span,
+        format: item.options?.format,
+        currency: item.options?.currency,
+        visible: item.options?.visible
+      }
+    };
+  }
+  if (item.type === "field") {
+    return {
+      type: "field",
+      field: item.field,
+      options: item.options
+    };
+  }
+  return item;
+}
+function serializeDetailForApi(detail) {
+  if (detail === false) return false;
+  if (detail === true) return true;
+  if (!detail || !Array.isArray(detail)) return void 0;
+  return detail.map(serializeDetailItemForApi);
+}
 function registerRoutes(app, config) {
   const optionsCache = /* @__PURE__ */ new Map();
   app.get("/api/schemas", optionalAuth(config), async (c) => {
@@ -4205,15 +4387,12 @@ function registerRoutes(app, config) {
       if (typeof access === "boolean") return access;
       if (access && typeof access === "object" && typeof access.policy === "string") {
         const policy = requestConfig.accessPolicies?.[access.policy];
-        if (typeof policy === "string" || typeof policy === "boolean")
-          return policy;
+        if (typeof policy === "string" || typeof policy === "boolean") return policy;
       }
       return resolveBooleanAccess(requestConfig, access, accessArgs);
     };
     const filteredCollections = await Promise.all(
-      collections.filter(
-        (col) => !siteId || col.shared || !col.siteId || col.siteId === siteId
-      ).map(async (col) => ({
+      collections.filter((col) => !siteId || col.shared || !col.siteId || col.siteId === siteId).map(async (col) => ({
         slug: col.slug,
         labels: col.labels,
         access: {
@@ -4251,6 +4430,7 @@ function registerRoutes(app, config) {
         audit: !!col.audit,
         drafts: !!col.drafts,
         admin: col.admin,
+        detail: serializeDetailForApi(col.detail),
         workflow: col.workflow ? {
           initialState: col.workflow.initialState,
           draftState: col.workflow.draftState,
@@ -4269,9 +4449,7 @@ function registerRoutes(app, config) {
       }))
     );
     const filteredGlobals = await Promise.all(
-      globals.filter(
-        (glb) => !siteId || glb.shared || !glb.siteId || glb.siteId === siteId
-      ).map(async (glb) => ({
+      globals.filter((glb) => !siteId || glb.shared || !glb.siteId || glb.siteId === siteId).map(async (glb) => ({
         slug: glb.slug,
         label: glb.label,
         access: {
@@ -4301,7 +4479,8 @@ function registerRoutes(app, config) {
             }
           }))
         ),
-        admin: glb.admin
+        admin: glb.admin,
+        detail: serializeDetailForApi(glb.detail)
       }))
     );
     return c.json({
@@ -4315,148 +4494,137 @@ function registerRoutes(app, config) {
       adminHealth: {
         emailConfigured: !!requestConfig.email,
         secureAuthSecretConfigured: !!process.env.DYRECTED_JWT_SECRET,
-        authCollectionConfigured: requestConfig.collections.some(
-          (collection) => !!collection.auth
-        ),
-        uploadCollectionConfigured: requestConfig.collections.some(
-          (collection) => !!collection.upload
-        )
+        authCollectionConfigured: requestConfig.collections.some((collection) => !!collection.auth),
+        uploadCollectionConfigured: requestConfig.collections.some((collection) => !!collection.upload)
       }
     });
   });
-  app.get(
-    "/api/dyrected/options/:collection/:field",
-    optionalAuth(config),
-    async (c) => {
-      const { collection: colSlug, field: fieldName } = c.req.param();
-      const siteId = c.req.header("X-Site-Id");
-      const requestConfig = siteId && config.onSchemaFetch ? mergeDynamicConfig(config, await config.onSchemaFetch(siteId)) : config;
-      let collections = [...requestConfig.collections];
-      const user = c.get("user");
-      let collection = collections.find((col) => col.slug === colSlug);
-      let field;
-      if (collection) {
-        const accessExpr = collection.access?.read;
-        if (accessExpr !== void 0 && accessExpr !== null) {
-          const allowed = await resolveBooleanAccess(config, accessExpr, {
-            user,
-            req: toHookRequestContext(c.req)
-          });
-          if (!allowed) {
-            return c.json(
-              { error: true, message: `Access denied: read on ${colSlug}` },
-              403
-            );
-          }
-        }
-        field = collection.fields.find((f) => f.name === fieldName);
-      } else {
-        const globals = [...requestConfig.globals];
-        const glb = globals.find((g) => g.slug === colSlug);
-        if (!glb) {
-          return c.json(
-            {
-              error: true,
-              message: `${colSlug} not found as collection or global`
-            },
-            404
-          );
-        }
-        const accessExpr = glb.access?.read;
-        if (accessExpr !== void 0 && accessExpr !== null) {
-          const allowed = await resolveBooleanAccess(config, accessExpr, {
-            user,
-            req: toHookRequestContext(c.req)
-          });
-          if (!allowed) {
-            return c.json(
-              {
-                error: true,
-                message: `Access denied: read on global ${colSlug}`
-              },
-              403
-            );
-          }
+  app.get("/api/dyrected/options/:collection/:field", optionalAuth(config), async (c) => {
+    const { collection: colSlug, field: fieldName } = c.req.param();
+    const siteId = c.req.header("X-Site-Id");
+    const requestConfig = siteId && config.onSchemaFetch ? mergeDynamicConfig(config, await config.onSchemaFetch(siteId)) : config;
+    let collections = [...requestConfig.collections];
+    const user = c.get("user");
+    let collection = collections.find((col) => col.slug === colSlug);
+    let field;
+    if (collection) {
+      const accessExpr = collection.access?.read;
+      if (accessExpr !== void 0 && accessExpr !== null) {
+        const allowed = await resolveBooleanAccess(config, accessExpr, {
+          user,
+          req: toHookRequestContext(c.req)
+        });
+        if (!allowed) {
+          return c.json({ error: true, message: `Access denied: read on ${colSlug}` }, 403);
         }
-        field = glb.fields.find((f) => f.name === fieldName);
       }
-      if (!field) {
+      field = collection.fields.find((f) => f.name === fieldName);
+    } else {
+      const globals = [...requestConfig.globals];
+      const glb = globals.find((g) => g.slug === colSlug);
+      if (!glb) {
         return c.json(
           {
             error: true,
-            message: `Field ${fieldName} not found in ${colSlug}`
+            message: `${colSlug} not found as collection or global`
           },
           404
         );
       }
-      let resolver;
-      let cacheTTL;
-      if (typeof field.options === "function") {
-        resolver = field.options;
-      } else if (field.options && typeof field.options === "object" && "resolve" in field.options) {
-        resolver = field.options.resolve;
-        cacheTTL = field.options.cacheTTL;
-      }
-      if (!resolver) {
-        return c.json(
-          {
-            error: true,
-            message: `Field ${fieldName} in ${colSlug} is not dynamic`
-          },
-          400
-        );
-      }
-      try {
-        const db = c.get("db") || config.db;
-        const queryParams = c.req.query();
-        const reqContext = {
-          query: queryParams,
-          headers: c.req.header(),
-          raw: c.req.raw
-        };
-        const shouldCache = typeof cacheTTL === "number" && cacheTTL > 0;
-        let cacheKey = "";
-        if (shouldCache) {
-          cacheKey = JSON.stringify([
-            siteId ?? "",
-            colSlug,
-            fieldName,
-            user?.id ?? null,
-            queryParams
-          ]);
-          const hit = optionsCache.get(cacheKey);
-          if (hit && hit.expires > Date.now()) {
-            return c.json(hit.value);
-          }
-        }
-        const result = await resolver({
-          db,
+      const accessExpr = glb.access?.read;
+      if (accessExpr !== void 0 && accessExpr !== null) {
+        const allowed = await resolveBooleanAccess(config, accessExpr, {
           user,
-          req: reqContext
+          req: toHookRequestContext(c.req)
         });
-        if (shouldCache) {
-          optionsCache.set(cacheKey, {
-            expires: Date.now() + cacheTTL * 1e3,
-            value: result
-          });
+        if (!allowed) {
+          return c.json(
+            {
+              error: true,
+              message: `Access denied: read on global ${colSlug}`
+            },
+            403
+          );
         }
-        return c.json(result);
-      } catch (err) {
-        getRequestLogger(c, "router").error({
-          err,
-          msg: "Failed to resolve dynamic field options",
-          fieldName
+      }
+      field = glb.fields.find((f) => f.name === fieldName);
+    }
+    if (!field) {
+      return c.json(
+        {
+          error: true,
+          message: `Field ${fieldName} not found in ${colSlug}`
+        },
+        404
+      );
+    }
+    let resolver;
+    let cacheTTL;
+    if (typeof field.options === "function") {
+      resolver = field.options;
+    } else if (field.options && typeof field.options === "object" && "resolve" in field.options) {
+      resolver = field.options.resolve;
+      cacheTTL = field.options.cacheTTL;
+    }
+    if (!resolver) {
+      return c.json(
+        {
+          error: true,
+          message: `Field ${fieldName} in ${colSlug} is not dynamic`
+        },
+        400
+      );
+    }
+    try {
+      const db = c.get("db") || config.db;
+      const queryParams = c.req.query();
+      const reqContext = {
+        query: queryParams,
+        headers: c.req.header(),
+        raw: c.req.raw
+      };
+      const shouldCache = typeof cacheTTL === "number" && cacheTTL > 0;
+      let cacheKey = "";
+      if (shouldCache) {
+        cacheKey = JSON.stringify([
+          siteId ?? "",
+          colSlug,
+          fieldName,
+          user?.id ?? null,
+          queryParams
+        ]);
+        const hit = optionsCache.get(cacheKey);
+        if (hit && hit.expires > Date.now()) {
+          return c.json(hit.value);
+        }
+      }
+      const result = await resolver({
+        db,
+        user,
+        req: reqContext
+      });
+      if (shouldCache) {
+        optionsCache.set(cacheKey, {
+          expires: Date.now() + cacheTTL * 1e3,
+          value: result
         });
-        return c.json(
-          {
-            error: true,
-            message: err.message || "Failed to resolve dynamic options"
-          },
-          500
-        );
       }
+      return c.json(result);
+    } catch (err) {
+      getRequestLogger(c, "router").error({
+        err,
+        msg: "Failed to resolve dynamic field options",
+        fieldName
+      });
+      return c.json(
+        {
+          error: true,
+          message: err.message || "Failed to resolve dynamic options"
+        },
+        500
+      );
     }
-  );
+  });
   app.get("/api/openapi.json", (c) => {
     return c.json(generateOpenApi(config));
   });
@@ -4469,13 +4637,8 @@ function registerRoutes(app, config) {
     const key = c.req.param("key");
     const scope = c.req.query("scope");
     if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub)
-      return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key)
-      return c.json(
-        { error: true, message: "Preference key is required." },
-        400
-      );
+    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
     const getGlobalPreference = async () => {
       const globalDoc = await db.findOne({
         collection: "__global_preferences",
@@ -4502,13 +4665,8 @@ function registerRoutes(app, config) {
     const key = c.req.param("key");
     const scope = c.req.query("scope");
     if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub)
-      return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key)
-      return c.json(
-        { error: true, message: "Preference key is required." },
-        400
-      );
+    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
     const body = await c.req.json().catch(() => ({}));
     if (scope === "global") {
       const isAdminUser = Array.isArray(user?.roles) && user.roles.includes("admin");
@@ -4556,13 +4714,8 @@ function registerRoutes(app, config) {
     const key = c.req.param("key");
     const scope = c.req.query("scope");
     if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub)
-      return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key)
-      return c.json(
-        { error: true, message: "Preference key is required." },
-        400
-      );
+    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
     if (scope === "global") {
       const isAdminUser = Array.isArray(user?.roles) && user.roles.includes("admin");
       if (!isAdminUser) {
@@ -4601,41 +4754,17 @@ function registerRoutes(app, config) {
     for (const col of uploadCollections) {
       const mediaController = new MediaController(col.slug);
       const prefix = `/api/collections/${col.slug}`;
-      app.get(
-        `${prefix}/media`,
-        accessGate(config, col, "read"),
-        (c) => mediaController.find(c)
-      );
-      app.get(
-        `${prefix}/media/:filename{.+$}`,
-        (c) => mediaController.serve(c)
-      );
-      app.post(
-        `${prefix}/media`,
-        accessGate(config, col, "create"),
-        (c) => mediaController.upload(c)
-      );
-      app.delete(
-        `${prefix}/media/:id`,
-        accessGate(config, col, "delete"),
-        (c) => mediaController.delete(c)
-      );
+      app.get(`${prefix}/media`, accessGate(config, col, "read"), (c) => mediaController.find(c));
+      app.get(`${prefix}/media/:filename{.+$}`, (c) => mediaController.serve(c));
+      app.post(`${prefix}/media`, accessGate(config, col, "create"), (c) => mediaController.upload(c));
+      app.delete(`${prefix}/media/:id`, accessGate(config, col, "delete"), (c) => mediaController.delete(c));
     }
   }
   const adminAuthController = new AdminAuthController(config);
   app.get("/api/admin/auth/providers", (c) => adminAuthController.providers(c));
-  app.get(
-    "/api/admin/auth/:provider/start",
-    (c) => adminAuthController.start(c)
-  );
-  app.get(
-    "/api/admin/auth/:provider/callback",
-    (c) => adminAuthController.callback(c)
-  );
-  app.post(
-    "/api/admin/auth/:provider/exchange",
-    (c) => adminAuthController.exchange(c)
-  );
+  app.get("/api/admin/auth/:provider/start", (c) => adminAuthController.start(c));
+  app.get("/api/admin/auth/:provider/callback", (c) => adminAuthController.callback(c));
+  app.post("/api/admin/auth/:provider/exchange", (c) => adminAuthController.exchange(c));
   app.post("/api/admin/logout", (c) => adminAuthController.logout(c));
   for (const collection of config.collections) {
     if (!collection.auth) continue;
@@ -4646,21 +4775,10 @@ function registerRoutes(app, config) {
     app.get(`${path}/init`, (c) => authController.init(c));
     app.post(`${path}/first-user`, (c) => authController.registerFirstUser(c));
     app.get(`${path}/me`, requireAuth(config), (c) => authController.me(c));
-    app.post(
-      `${path}/refresh-token`,
-      requireAuth(config),
-      (c) => authController.refreshToken(c)
-    );
-    app.post(
-      `${path}/forgot-password`,
-      (c) => authController.forgotPassword(c)
-    );
+    app.post(`${path}/refresh-token`, requireAuth(config), (c) => authController.refreshToken(c));
+    app.post(`${path}/forgot-password`, (c) => authController.forgotPassword(c));
     app.post(`${path}/reset-password`, (c) => authController.resetPassword(c));
-    app.post(
-      `${path}/invite`,
-      requireAuth(config),
-      (c) => authController.invite(c)
-    );
+    app.post(`${path}/invite`, requireAuth(config), (c) => authController.invite(c));
     app.post(`${path}/accept-invite`, (c) => authController.acceptInvite(c));
   }
   const auditController = new AuditController();
@@ -4671,33 +4789,19 @@ function registerRoutes(app, config) {
     app.post(path, (c) => controller.create(c));
     app.post(`${path}/media`, (c) => controller.create(c));
     app.delete(`${path}/delete-many`, (c) => controller.deleteMany(c));
+    app.post(`${path}/aggregate`, (c) => controller.aggregate(c));
     if (collection.audit) {
-      app.get(
-        `${path}/__audit`,
-        (c) => auditController.findForCollection(c, collection)
-      );
+      app.get(`${path}/__audit`, (c) => auditController.findForCollection(c, collection));
     }
     app.get(`${path}/:id`, (c) => controller.findOne(c));
     app.patch(`${path}/:id`, (c) => controller.update(c));
     app.delete(`${path}/:id`, (c) => controller.delete(c));
     if (collection.auth) {
-      app.post(
-        `${path}/:id/change-password`,
-        requireAuth(config),
-        (c) => controller.changePassword(c)
-      );
+      app.post(`${path}/:id/change-password`, requireAuth(config), (c) => controller.changePassword(c));
     }
     if (collection.workflow) {
-      app.post(
-        `${path}/:id/transitions/:transition`,
-        requireAuth(config),
-        (c) => controller.transition(c)
-      );
-      app.get(
-        `${path}/:id/workflow-history`,
-        requireAuth(config),
-        (c) => controller.workflowHistory(c)
-      );
+      app.post(`${path}/:id/transitions/:transition`, requireAuth(config), (c) => controller.transition(c));
+      app.get(`${path}/:id/workflow-history`, requireAuth(config), (c) => controller.workflowHistory(c));
     }
   }
   for (const global of config.globals) {
@@ -4712,11 +4816,7 @@ function registerRoutes(app, config) {
     });
   }
   const previewController = new PreviewController();
-  app.post(
-    "/api/preview-token",
-    requireAuth(config),
-    (c) => previewController.createToken(c)
-  );
+  app.post("/api/preview-token", requireAuth(config), (c) => previewController.createToken(c));
   app.get("/api/preview-data", (c) => previewController.getData(c));
   app.get("/api/audit", (c) => auditController.findAll(c));
   app.get("/api/collections/:slug/__audit", async (c) => {
@@ -4729,81 +4829,49 @@ function registerRoutes(app, config) {
     if (!config2.onSchemaFetch || !siteId) {
       return c.json({ message: `Collection "${slug}" not found` }, 404);
     }
-    const requestConfig = mergeDynamicConfig(
-      config2,
-      await config2.onSchemaFetch(siteId)
-    );
-    const collection = requestConfig.collections.find(
-      (col) => col.slug === slug
-    );
+    const requestConfig = mergeDynamicConfig(config2, await config2.onSchemaFetch(siteId));
+    const collection = requestConfig.collections.find((col) => col.slug === slug);
     if (!collection?.audit) {
-      return c.json(
-        { message: `Collection "${slug}" not found or has no audit log` },
-        404
-      );
+      return c.json({ message: `Collection "${slug}" not found or has no audit log` }, 404);
     }
     return auditController.findForCollection(c, collection);
   });
-  app.post(
-    "/api/collections/:slug/:id/transitions/:transition",
-    requireAuth(config),
-    async (c) => {
-      const slug = c.req.param("slug");
-      const siteId = c.req.header("X-Site-Id") || c.get("siteId");
-      const config2 = c.get("config");
-      if (config2.collections.some((col) => col.slug === slug)) {
-        return c.json({ message: "Not Found" }, 404);
-      }
-      if (!config2.onSchemaFetch || !siteId) {
-        return c.json({ message: `Collection "${slug}" not found` }, 404);
-      }
-      const requestConfig = mergeDynamicConfig(
-        config2,
-        await config2.onSchemaFetch(siteId)
-      );
-      const collection = requestConfig.collections.find(
-        (col) => col.slug === slug
-      );
-      if (!collection?.workflow) {
-        return c.json(
-          { message: `Collection "${slug}" not found or has no workflow` },
-          404
-        );
-      }
-      const controller = new CollectionController(collection);
-      return controller.transition(c);
+  app.post("/api/collections/:slug/:id/transitions/:transition", requireAuth(config), async (c) => {
+    const slug = c.req.param("slug");
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const config2 = c.get("config");
+    if (config2.collections.some((col) => col.slug === slug)) {
+      return c.json({ message: "Not Found" }, 404);
     }
-  );
-  app.get(
-    "/api/collections/:slug/:id/workflow-history",
-    requireAuth(config),
-    async (c) => {
-      const slug = c.req.param("slug");
-      const siteId = c.req.header("X-Site-Id") || c.get("siteId");
-      const config2 = c.get("config");
-      if (config2.collections.some((col) => col.slug === slug)) {
-        return c.json({ message: "Not Found" }, 404);
-      }
-      if (!config2.onSchemaFetch || !siteId) {
-        return c.json({ message: `Collection "${slug}" not found` }, 404);
-      }
-      const requestConfig = mergeDynamicConfig(
-        config2,
-        await config2.onSchemaFetch(siteId)
-      );
-      const collection = requestConfig.collections.find(
-        (col) => col.slug === slug
-      );
-      if (!collection?.workflow) {
-        return c.json(
-          { message: `Collection "${slug}" not found or has no workflow` },
-          404
-        );
-      }
-      const controller = new CollectionController(collection);
-      return controller.workflowHistory(c);
+    if (!config2.onSchemaFetch || !siteId) {
+      return c.json({ message: `Collection "${slug}" not found` }, 404);
     }
-  );
+    const requestConfig = mergeDynamicConfig(config2, await config2.onSchemaFetch(siteId));
+    const collection = requestConfig.collections.find((col) => col.slug === slug);
+    if (!collection?.workflow) {
+      return c.json({ message: `Collection "${slug}" not found or has no workflow` }, 404);
+    }
+    const controller = new CollectionController(collection);
+    return controller.transition(c);
+  });
+  app.get("/api/collections/:slug/:id/workflow-history", requireAuth(config), async (c) => {
+    const slug = c.req.param("slug");
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const config2 = c.get("config");
+    if (config2.collections.some((col) => col.slug === slug)) {
+      return c.json({ message: "Not Found" }, 404);
+    }
+    if (!config2.onSchemaFetch || !siteId) {
+      return c.json({ message: `Collection "${slug}" not found` }, 404);
+    }
+    const requestConfig = mergeDynamicConfig(config2, await config2.onSchemaFetch(siteId));
+    const collection = requestConfig.collections.find((col) => col.slug === slug);
+    if (!collection?.workflow) {
+      return c.json({ message: `Collection "${slug}" not found or has no workflow` }, 404);
+    }
+    const controller = new CollectionController(collection);
+    return controller.workflowHistory(c);
+  });
   app.all("/api/collections/:slug/:id?", async (c) => {
     const slug = c.req.param("slug");
     const id = c.req.param("id");
@@ -4813,13 +4881,8 @@ function registerRoutes(app, config) {
       return c.json({ message: "Method Not Allowed" }, 405);
     }
     if (config2.onSchemaFetch && siteId) {
-      const requestConfig = mergeDynamicConfig(
-        config2,
-        await config2.onSchemaFetch(siteId)
-      );
-      let collection = requestConfig.collections.find(
-        (col) => col.slug === slug
-      );
+      const requestConfig = mergeDynamicConfig(config2, await config2.onSchemaFetch(siteId));
+      let collection = requestConfig.collections.find((col) => col.slug === slug);
       if (!collection && slug === "media") {
         collection = {
           slug: "media",
@@ -4832,25 +4895,19 @@ function registerRoutes(app, config) {
         if (collection.auth && id) {
           const authController = new AuthController(collection);
           const method2 = c.req.method;
-          if (method2 === "POST" && id === "login")
-            return authController.login(c);
-          if (method2 === "POST" && id === "logout")
-            return authController.logout(c);
+          if (method2 === "POST" && id === "login") return authController.login(c);
+          if (method2 === "POST" && id === "logout") return authController.logout(c);
           if (method2 === "GET" && id === "me") return authController.me(c);
-          if (method2 === "POST" && id === "refresh-token")
-            return authController.refreshToken(c);
-          if (method2 === "POST" && id === "forgot-password")
-            return authController.forgotPassword(c);
-          if (method2 === "POST" && id === "reset-password")
-            return authController.resetPassword(c);
+          if (method2 === "POST" && id === "refresh-token") return authController.refreshToken(c);
+          if (method2 === "POST" && id === "forgot-password") return authController.forgotPassword(c);
+          if (method2 === "POST" && id === "reset-password") return authController.resetPassword(c);
         }
         const controller = new CollectionController(collection);
         const method = c.req.method;
         if (id) {
           if (method === "GET") return controller.findOne(c);
           if (method === "PATCH") return controller.update(c);
-          if (method === "DELETE" && id === "delete-many")
-            return controller.deleteMany(c);
+          if (method === "DELETE" && id === "delete-many") return controller.deleteMany(c);
           if (method === "DELETE") return controller.delete(c);
           if (method === "POST" && id === "media") return controller.create(c);
         } else {
@@ -4870,10 +4927,7 @@ function registerRoutes(app, config) {
       return c.json({ message: "Method Not Allowed" }, 405);
     }
     if (config2.onSchemaFetch && siteId) {
-      const requestConfig = mergeDynamicConfig(
-        config2,
-        await config2.onSchemaFetch(siteId)
-      );
+      const requestConfig = mergeDynamicConfig(config2, await config2.onSchemaFetch(siteId));
       const global = requestConfig.globals.find((glb) => glb.slug === slug);
       if (global) {
         const controller = new GlobalController(global);
@@ -4912,7 +4966,7 @@ function resolveClientIp(req, trustProxy = false) {
     const value = normalizeIp(req.headers[header]);
     if (value) return value;
   }
-  if (trustProxy) {
+  if (trustProxy === true || typeof trustProxy === "number") {
     const forwardedFor = pickForwardedFor(req.headers, trustProxy);
     if (forwardedFor) return forwardedFor;
   }
@@ -4924,6 +4978,7 @@ function pickForwardedFor(headers, trustProxy) {
     const chain2 = forwardedHeader.split(",").map((entry) => normalizeIp(entry)).filter((entry) => !!entry);
     if (chain2.length > 0) {
       if (trustProxy === true) return chain2[0];
+      if (trustProxy <= 0) return null;
       const trustedHops2 = Math.max(1, Math.floor(trustProxy));
       const candidateIndex2 = Math.max(0, chain2.length - trustedHops2);
       return chain2[candidateIndex2] ?? chain2[0];
@@ -4936,6 +4991,7 @@ function pickForwardedFor(headers, trustProxy) {
   const chain = matches.map((match) => normalizeIp(match[1])).filter((entry) => !!entry);
   if (chain.length === 0) return null;
   if (trustProxy === true) return chain[0];
+  if (trustProxy <= 0) return null;
   const trustedHops = Math.max(1, Math.floor(trustProxy));
   const candidateIndex = Math.max(0, chain.length - trustedHops);
   return chain[candidateIndex] ?? chain[0];
@@ -5139,7 +5195,7 @@ async function createDyrectedApp(rawConfig) {
   app.use("*", cors(config.cors ? { origin: config.cors.origins } : {}));
   app.get("/health", (c) => c.json({ status: "ok", version: "0.0.1" }));
   if (observability.config.metrics.enabled && observability.config.metrics.exporter === "prometheus" && observability.prometheusExporter) {
-    app.get(observability.config.metrics.path, async (c) => {
+    app.get(observability.config.metrics.path, async (_c) => {
       const metrics = await renderPrometheusMetrics(
         observability.prometheusExporter
       );
@@ -5195,5 +5251,6 @@ export {
   registerRoutes,
   renderPrometheusMetrics,
   resolveObservabilityConfig,
+  serializeDetailForApi,
   shouldSampleRequest
 };