@dyrected/core 2.8.3 → 2.10.0

package/dist/controllers/collection.controller.js

@@ -1,1033 +0,0 @@
-import { PopulationService } from "../services/population.service.js";
-import { DefaultsService } from "../services/defaults.service.js";
-import { AuditService } from "../services/audit.service.js";
-import { hashPassword, verifyPassword } from "../auth/password.js";
-import { revokeAllAuthSessions } from "../auth/sessions.js";
-import { runCollectionHooks, executeFieldBeforeChange, executeFieldAfterRead, } from "../utils/hooks.js";
-import { createReadonlyDb } from "../utils/readonly-db.js";
-import { validateUpload } from "../utils/upload-validation.js";
-import { resolveAccess } from "../auth/access.js";
-import { getAdminAuthCollection } from "../utils/admin-auth.js";
-import { buildCollectionSearchWhere } from "../utils/collection-search.js";
-import { applyFieldReadAccess, applyFieldWriteAccess, mergeWhereConstraint, resolveCollectionAccess, toHookRequestContext, } from "../utils/access-control.js";
-import { WORKFLOW_HISTORY_COLLECTION, createWorkflowDocument, canViewWorkflowDraft, initializeWorkflowDocument, materializeWorkflowDocument, publishedStateName, saveWorkflowDraft, transitionWorkflow, } from "../workflows.js";
-import { getRequestLogger } from "../observability.js";
-export class CollectionController {
-    collection;
-    constructor(collection) {
-        this.collection = collection;
-    }
-    getDelegatedProvider(c) {
-        const config = c.get("config");
-        const authCollection = getAdminAuthCollection(config);
-        if (!authCollection || this.collection.slug !== authCollection.slug) {
-            return null;
-        }
-        return config.adminAuth?.providers?.find((p) => p.members) || null;
-    }
-    toHookRequestContext(c) {
-        return toHookRequestContext(c.req);
-    }
-    async evaluateAccess(c, action, options = {}) {
-        const config = c.get("config");
-        return resolveCollectionAccess(config, this.collection.slug, action, this.collection.access?.[action], {
-            id: options.id,
-            user: c.get("user"),
-            req: this.toHookRequestContext(c),
-            doc: options.doc ?? undefined,
-            data: options.data,
-        });
-    }
-    async find(c) {
-        const config = c.get("config");
-        const db = config.db;
-        if (!db)
-            return c.json({ message: "Database not configured" }, 500);
-        const provider = this.getDelegatedProvider(c);
-        if (provider && provider.members?.list) {
-            const hookReq = this.toHookRequestContext(c);
-            const limit = Number(c.req.query("limit")) || 10;
-            const page = Number(c.req.query("page")) || 1;
-            const sort = c.req.query("sort") || undefined;
-            const search = c.req.query("search") || undefined;
-            let where = undefined;
-            const whereRaw = c.req.query("where");
-            if (whereRaw) {
-                try {
-                    where = JSON.parse(decodeURIComponent(whereRaw));
-                }
-                catch { }
-            }
-            const searchWhere = await buildCollectionSearchWhere({
-                collection: this.collection,
-                search,
-                db: createReadonlyDb(db),
-                collections: config.collections,
-            });
-            if (searchWhere) {
-                where = mergeWhereConstraint(where, searchWhere);
-            }
-            const paginatedResult = await provider.members.list({
-                limit,
-                page,
-                sort,
-                where,
-                req: hookReq,
-            });
-            const mappedDocs = [];
-            for (const m of paginatedResult.docs) {
-                let localId = m.id;
-                const localDoc = await db.find({
-                    collection: this.collection.slug,
-                    where: m.id
-                        ? { externalSubject: { equals: m.id } }
-                        : { email: { equals: m.email } },
-                    limit: 1,
-                });
-                if (localDoc.docs[0]) {
-                    localId = localDoc.docs[0].id;
-                }
-                mappedDocs.push({
-                    ...m,
-                    id: localId,
-                    externalSubject: m.id,
-                });
-            }
-            return c.json({
-                ...paginatedResult,
-                docs: mappedDocs,
-            });
-        }
-        const readonlyDb = createReadonlyDb(db);
-        // Cap the page size so a caller can't request an unbounded result set.
-        const limit = Math.min(Number(c.req.query("limit")) || 10, 100);
-        const page = Number(c.req.query("page")) || 1;
-        // Default relationship depth is 1, matching the SDK default.
-        const depth = c.req.query("depth") !== undefined ? Number(c.req.query("depth")) : 1;
-        const sort = c.req.query("sort") || undefined;
-        const search = c.req.query("search") || undefined;
-        const user = c.get("user");
-        let where = undefined;
-        const whereRaw = c.req.query("where");
-        if (whereRaw) {
-            try {
-                where = JSON.parse(decodeURIComponent(whereRaw));
-            }
-            catch {
-                // Not valid JSON — fall through without a where clause
-            }
-        }
-        if (where) {
-            if (this.collection.admin?.filterable === false) {
-                where = undefined;
-            }
-            else {
-                const { sanitizeWhereClause } = await import("../utils/where-sanitizer.js");
-                where = sanitizeWhereClause(where, this.collection.fields);
-                // If where ends up being an empty object after sanitization, drop it
-                if (Object.keys(where).length === 0) {
-                    where = undefined;
-                }
-            }
-        }
-        const searchWhere = await buildCollectionSearchWhere({
-            collection: this.collection,
-            search,
-            db: readonlyDb,
-            collections: config.collections,
-        });
-        if (searchWhere) {
-            where = mergeWhereConstraint(where, searchWhere);
-        }
-        // Run beforeRead collection hook
-        const beforeReadResult = await runCollectionHooks(this.collection.hooks?.beforeRead, {
-            req: c.req,
-            query: where,
-            user,
-            db: readonlyDb,
-        });
-        if (beforeReadResult !== undefined) {
-            where = beforeReadResult;
-        }
-        // Workflow drafts are never visible to unauthenticated readers. The public
-        // response is materialized from the last promoted snapshot below.
-        if (this.collection.workflow &&
-            !canViewWorkflowDraft(this.collection.workflow, user)) {
-            const publicWorkflowState = publishedStateName(this.collection.workflow);
-            where = where
-                ? {
-                    AND: [
-                        where,
-                        {
-                            OR: [
-                                { __published: { exists: true } },
-                                { __workflow: { exists: false } },
-                                { "__workflow.state": { equals: publicWorkflowState } },
-                            ],
-                        },
-                    ],
-                }
-                : {
-                    OR: [
-                        { __published: { exists: true } },
-                        { __workflow: { exists: false } },
-                        { "__workflow.state": { equals: publicWorkflowState } },
-                    ],
-                };
-        }
-        const access = await this.evaluateAccess(c, "read");
-        if (!access.allowed) {
-            return c.json({
-                error: true,
-                message: `Access denied: read on ${this.collection.slug}`,
-            }, 403);
-        }
-        if (access.constraint) {
-            where = mergeWhereConstraint(where, access.constraint);
-        }
-        let result = await db.find({
-            collection: this.collection.slug,
-            limit,
-            page,
-            sort,
-            where,
-            fields: this.collection.fields,
-        });
-        // Auto-seeding if empty and initialData is provided
-        if (result.total === 0 &&
-            this.collection.initialData &&
-            !where &&
-            page === 1) {
-            getRequestLogger(c, "collection").info({
-                msg: "Auto-seeding collection from config.initialData",
-                collection: this.collection.slug,
-            });
-            for (const data of this.collection.initialData) {
-                await db.create({ collection: this.collection.slug, data });
-            }
-            // Re-fetch result after seeding
-            result = await db.find({
-                collection: this.collection.slug,
-                limit,
-                page,
-                sort,
-                where,
-                fields: this.collection.fields,
-            });
-        }
-        result.docs = result.docs
-            .map((doc) => this.collection.workflow
-            ? materializeWorkflowDocument(doc, this.collection.workflow, user)
-            : doc)
-            .filter((doc) => doc !== null);
-        // Run afterRead hooks (both collection and field levels)
-        const processedDocs = [];
-        for (const doc of result.docs) {
-            const docWithDefaults = DefaultsService.apply(this.collection.fields, doc);
-            const docWithCollectionHooks = await runCollectionHooks(this.collection.hooks?.afterRead, {
-                doc: docWithDefaults,
-                req: c.req,
-                user,
-                db: readonlyDb,
-            });
-            const docWithFieldHooks = await executeFieldAfterRead(this.collection.fields, docWithCollectionHooks, user, readonlyDb);
-            const docWithFieldAccess = await applyFieldReadAccess({
-                config,
-                fields: this.collection.fields,
-                user,
-                req: this.toHookRequestContext(c),
-                doc: docWithFieldHooks,
-            }, docWithFieldHooks);
-            processedDocs.push(docWithFieldAccess);
-        }
-        result.docs = processedDocs;
-        if (depth > 0) {
-            const populationService = new PopulationService(db, config.collections);
-            result = await populationService.populateResult(result, this.collection.fields, depth);
-        }
-        return c.json(result);
-    }
-    async findOne(c) {
-        const config = c.get("config");
-        const db = config.db;
-        if (!db)
-            return c.json({ message: "Database not configured" }, 500);
-        const provider = this.getDelegatedProvider(c);
-        if (provider && (provider.members?.get || provider.members?.list)) {
-            const hookReq = this.toHookRequestContext(c);
-            const id = c.req.param("id");
-            if (!id)
-                return c.json({ message: "Missing ID" }, 400);
-            const localDoc = await db.findOne({
-                collection: this.collection.slug,
-                id,
-            });
-            const externalSubject = localDoc?.externalSubject || id;
-            let member = null;
-            if (provider.members.get) {
-                member = await provider.members.get({ externalSubject, req: hookReq });
-            }
-            else if (provider.members.list) {
-                const listResult = await provider.members.list({ req: hookReq });
-                member = listResult.docs.find((m) => m.id === externalSubject) || null;
-            }
-            if (!member)
-                return c.json({ message: "Not Found" }, 404);
-            return c.json({
-                ...member,
-                id: localDoc ? localDoc.id : member.id,
-                externalSubject: member.id,
-            });
-        }
-        const readonlyDb = createReadonlyDb(db);
-        const id = c.req.param("id");
-        // Default relationship depth is 1, matching the SDK default.
-        const depth = c.req.query("depth") !== undefined ? Number(c.req.query("depth")) : 1;
-        const user = c.get("user");
-        if (!id)
-            return c.json({ message: "Missing ID" }, 400);
-        let doc = await db.findOne({ collection: this.collection.slug, id });
-        if (!doc)
-            return c.json({ message: "Not Found" }, 404);
-        if (this.collection.workflow) {
-            doc = materializeWorkflowDocument(doc, this.collection.workflow, user);
-            if (!doc)
-                return c.json({ message: "Not Found" }, 404);
-        }
-        const access = await this.evaluateAccess(c, "read", { id, doc });
-        if (!access.allowed) {
-            return c.json({
-                error: true,
-                message: `Access denied: read on ${this.collection.slug}`,
-            }, 403);
-        }
-        const docWithDefaults = DefaultsService.apply(this.collection.fields, doc);
-        // Run afterRead hooks
-        const docWithCollectionHooks = await runCollectionHooks(this.collection.hooks?.afterRead, {
-            doc: docWithDefaults,
-            req: c.req,
-            user,
-            db: readonlyDb,
-        });
-        const docWithFieldHooks = await executeFieldAfterRead(this.collection.fields, docWithCollectionHooks, user, readonlyDb);
-        const docWithFieldAccess = await applyFieldReadAccess({
-            config,
-            fields: this.collection.fields,
-            user,
-            req: this.toHookRequestContext(c),
-            doc: docWithFieldHooks,
-        }, docWithFieldHooks);
-        if (depth > 0 && docWithFieldAccess) {
-            const populationService = new PopulationService(db, config.collections);
-            const populatedDoc = await populationService.populate({
-                data: docWithFieldAccess,
-                fields: this.collection.fields,
-                currentDepth: 0,
-                maxDepth: depth,
-            });
-            return c.json(populatedDoc);
-        }
-        return c.json(docWithFieldAccess);
-    }
-    async create(c) {
-        const config = c.get("config");
-        const db = config.db;
-        if (!db)
-            return c.json({ message: "Database not configured" }, 500);
-        const provider = this.getDelegatedProvider(c);
-        if (provider && provider.members?.create) {
-            const hookReq = this.toHookRequestContext(c);
-            const contentType = c.req.header("Content-Type") || "";
-            if (contentType.toLowerCase().includes("multipart/form-data")) {
-                return this.upload(c);
-            }
-            const body = await c.req.json();
-            const member = await provider.members.create({
-                data: body,
-                req: hookReq,
-            });
-            return c.json({
-                ...member,
-                id: member.id,
-                externalSubject: member.id,
-            }, 201);
-        }
-        const readonlyDb = createReadonlyDb(db);
-        const contentType = c.req.header("Content-Type") || "";
-        if (contentType.toLowerCase().includes("multipart/form-data")) {
-            return this.upload(c);
-        }
-        const body = await c.req.json();
-        const user = c.get("user");
-        const now = new Date().toISOString();
-        let data = {
-            ...body,
-            createdAt: now,
-            updatedAt: now,
-            createdBy: user?.sub ?? null,
-            updatedBy: user?.sub ?? null,
-        };
-        if (this.collection.workflow) {
-            data = initializeWorkflowDocument(data, this.collection.workflow);
-        }
-        const createAccess = await this.evaluateAccess(c, "create", { data });
-        if (!createAccess.allowed) {
-            return c.json({
-                error: true,
-                message: `Access denied: create on ${this.collection.slug}`,
-            }, 403);
-        }
-        if (this.collection.auth && data.password) {
-            data.password = await hashPassword(data.password);
-        }
-        data = await applyFieldWriteAccess({
-            config,
-            fields: this.collection.fields,
-            user,
-            req: this.toHookRequestContext(c),
-            data,
-            operation: "create",
-        }, data);
-        // Run beforeChange hooks (field-level then collection-level)
-        data = await executeFieldBeforeChange(this.collection.fields, data, null, user, readonlyDb);
-        data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
-            data,
-            req: c.req,
-            user,
-            operation: "create",
-            db: readonlyDb,
-        });
-        const doc = this.collection.workflow
-            ? (await createWorkflowDocument({
-                config,
-                collection: this.collection,
-                data,
-                user,
-            })).doc
-            : await db.create({ collection: this.collection.slug, data });
-        if (this.collection.audit && db) {
-            AuditService.log(db, {
-                operation: "create",
-                collection: this.collection.slug,
-                documentId: doc.id,
-                user: user
-                    ? { id: user.sub, collection: user.collection, email: user.email }
-                    : undefined,
-                before: null,
-                after: doc,
-            }, config);
-        }
-        // Run afterChange collection hooks (full db access)
-        await runCollectionHooks(this.collection.hooks?.afterChange, {
-            doc,
-            user,
-            req: c.req,
-            operation: "create",
-            db,
-        }, { isolated: true });
-        // Run afterRead hooks on the returned doc
-        const responseDoc = this.collection.workflow
-            ? materializeWorkflowDocument(doc, this.collection.workflow, user)
-            : doc;
-        const readDoc = await runCollectionHooks(this.collection.hooks?.afterRead, {
-            doc: responseDoc,
-            req: c.req,
-            user,
-            db: readonlyDb,
-        });
-        const finalDoc = await executeFieldAfterRead(this.collection.fields, readDoc, user, readonlyDb);
-        const accessibleDoc = await applyFieldReadAccess({
-            config,
-            fields: this.collection.fields,
-            user,
-            req: this.toHookRequestContext(c),
-            doc: finalDoc,
-        }, finalDoc);
-        return c.json(accessibleDoc, 201);
-    }
-    async upload(c) {
-        const config = c.get("config");
-        const storage = config.storage;
-        if (!storage)
-            return c.json({ message: "Storage not configured" }, 500);
-        const db = config.db;
-        if (!db)
-            return c.json({ message: "Database not configured" }, 500);
-        const readonlyDb = createReadonlyDb(db);
-        const formData = await c.req.formData();
-        const file = formData.get("file");
-        if (!file)
-            return c.json({ message: "No file uploaded" }, 400);
-        // Enforce the collection's upload restrictions (allowedMimeTypes / maxFileSize)
-        // before buffering the file into memory.
-        const uploadConfig = typeof this.collection.upload === "object"
-            ? this.collection.upload
-            : undefined;
-        const validationError = validateUpload(file, uploadConfig);
-        if (validationError) {
-            return c.json({ message: validationError.message }, validationError.status);
-        }
-        const buffer = new Uint8Array(await file.arrayBuffer());
-        const siteId = c.get("siteId");
-        const workspaceId = c.get("workspaceId");
-        const prefix = workspaceId ? `${workspaceId}/${siteId}` : siteId;
-        const fileData = await storage.upload({
-            filename: file.name,
-            buffer,
-            mimeType: file.type,
-            prefix,
-        });
-        const otherData = {};
-        formData.forEach((value, key) => {
-            if (key !== "file" && typeof value === "string") {
-                otherData[key] = value;
-            }
-        });
-        const user = c.get("user");
-        const now = new Date().toISOString();
-        let data = {
-            ...otherData,
-            ...fileData,
-            createdAt: now,
-            updatedAt: now,
-            createdBy: user?.sub ?? null,
-            updatedBy: user?.sub ?? null,
-        };
-        const createAccess = await this.evaluateAccess(c, "create", { data });
-        if (!createAccess.allowed) {
-            return c.json({
-                error: true,
-                message: `Access denied: create on ${this.collection.slug}`,
-            }, 403);
-        }
-        data = await applyFieldWriteAccess({
-            config,
-            fields: this.collection.fields,
-            user,
-            req: this.toHookRequestContext(c),
-            data,
-            operation: "create",
-        }, data);
-        // Run beforeChange hooks for upload too
-        data = await executeFieldBeforeChange(this.collection.fields, data, null, user, readonlyDb);
-        data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
-            data,
-            req: c.req,
-            user,
-            operation: "create",
-            db: readonlyDb,
-        });
-        const doc = await db.create({
-            collection: this.collection.slug,
-            data,
-        });
-        // Run afterChange hooks for uploads (full db access)
-        await runCollectionHooks(this.collection.hooks?.afterChange, {
-            doc,
-            user,
-            req: c.req,
-            operation: "create",
-            db,
-        }, { isolated: true });
-        // Run afterRead hooks
-        const responseDoc = this.collection.workflow
-            ? materializeWorkflowDocument(doc, this.collection.workflow, user)
-            : doc;
-        const readDoc = await runCollectionHooks(this.collection.hooks?.afterRead, {
-            doc: responseDoc,
-            req: c.req,
-            user,
-            db: readonlyDb,
-        });
-        const finalDoc = await executeFieldAfterRead(this.collection.fields, readDoc, user, readonlyDb);
-        const accessibleDoc = await applyFieldReadAccess({
-            config,
-            fields: this.collection.fields,
-            user,
-            req: this.toHookRequestContext(c),
-            doc: finalDoc,
-        }, finalDoc);
-        return c.json(accessibleDoc, 201);
-    }
-    async update(c) {
-        const config = c.get("config");
-        const db = config.db;
-        if (!db)
-            return c.json({ message: "Database not configured" }, 500);
-        const provider = this.getDelegatedProvider(c);
-        if (provider && provider.members?.update) {
-            const hookReq = this.toHookRequestContext(c);
-            const id = c.req.param("id");
-            if (!id)
-                return c.json({ message: "Missing ID" }, 400);
-            const body = await c.req.json();
-            const localDoc = await db.findOne({
-                collection: this.collection.slug,
-                id,
-            });
-            const externalSubject = localDoc?.externalSubject || id;
-            const member = await provider.members.update({
-                externalSubject,
-                data: body,
-                req: hookReq,
-            });
-            return c.json({
-                ...member,
-                id: localDoc ? localDoc.id : member.id,
-                externalSubject: member.id,
-            });
-        }
-        const readonlyDb = createReadonlyDb(db);
-        const id = c.req.param("id");
-        if (!id)
-            return c.json({ message: "Missing ID" }, 400);
-        const body = await c.req.json();
-        const user = c.get("user");
-        // Strip auth-only fields from general updates — use /change-password for that
-        let data = { ...body };
-        if (this.collection.auth) {
-            delete data.password;
-            delete data.oldPassword;
-            delete data.confirmPassword;
-        }
-        Object.assign(data, {
-            updatedAt: new Date().toISOString(),
-            updatedBy: user?.sub ?? null,
-        });
-        const originalDoc = await db.findOne({
-            collection: this.collection.slug,
-            id,
-        });
-        if (!originalDoc)
-            return c.json({ message: "Not Found" }, 404);
-        const updateAccess = await this.evaluateAccess(c, "update", {
-            id,
-            doc: originalDoc,
-            data,
-        });
-        if (!updateAccess.allowed) {
-            return c.json({
-                error: true,
-                message: `Access denied: update on ${this.collection.slug}`,
-            }, 403);
-        }
-        let before = null;
-        if (this.collection.audit) {
-            before = originalDoc;
-        }
-        data = await applyFieldWriteAccess({
-            config,
-            fields: this.collection.fields,
-            user,
-            req: this.toHookRequestContext(c),
-            doc: originalDoc,
-            data,
-        }, data);
-        // Run beforeChange hooks (field-level then collection-level)
-        data = await executeFieldBeforeChange(this.collection.fields, data, originalDoc, user, readonlyDb);
-        data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
-            data,
-            doc: originalDoc,
-            req: c.req,
-            user,
-            operation: "update",
-            db: readonlyDb,
-        });
-        const doc = this.collection.workflow
-            ? (await saveWorkflowDraft({
-                config,
-                collection: this.collection,
-                id,
-                originalDoc,
-                data,
-                user,
-            })).doc
-            : await db.update({ collection: this.collection.slug, id, data });
-        if (this.collection.audit && db) {
-            AuditService.log(db, {
-                operation: "update",
-                collection: this.collection.slug,
-                documentId: id,
-                user: user
-                    ? { id: user.sub, collection: user.collection, email: user.email }
-                    : undefined,
-                before,
-                after: doc,
-            }, config);
-        }
-        // Run afterChange collection hooks (full db access)
-        await runCollectionHooks(this.collection.hooks?.afterChange, {
-            doc,
-            previousDoc: originalDoc,
-            user,
-            req: c.req,
-            operation: "update",
-            db,
-        }, { isolated: true });
-        const responseDoc = this.collection.workflow
-            ? materializeWorkflowDocument(doc, this.collection.workflow, user)
-            : doc;
-        // Run afterRead hooks
-        const readDoc = await runCollectionHooks(this.collection.hooks?.afterRead, {
-            doc: responseDoc,
-            req: c.req,
-            user,
-            db: readonlyDb,
-        });
-        const finalDoc = await executeFieldAfterRead(this.collection.fields, readDoc, user, readonlyDb);
-        const accessibleDoc = await applyFieldReadAccess({
-            config,
-            fields: this.collection.fields,
-            user,
-            req: this.toHookRequestContext(c),
-            doc: finalDoc,
-        }, finalDoc);
-        return c.json(accessibleDoc);
-    }
-    async transition(c) {
-        const config = c.get("config");
-        if (!config.db)
-            return c.json({ message: "Database not configured" }, 500);
-        if (!this.collection.workflow)
-            return c.json({ message: "Workflows are not enabled for this collection" }, 404);
-        const id = c.req.param("id");
-        const transitionName = c.req.param("transition");
-        const body = (await c.req.json().catch(() => ({})));
-        try {
-            const doc = await transitionWorkflow({
-                config,
-                collection: this.collection,
-                id: id,
-                transitionName: transitionName,
-                expectedRevision: body.expectedRevision,
-                comment: body.comment,
-                user: c.get("user"),
-                req: { query: c.req.query(), headers: c.req.header(), raw: c.req.raw },
-            });
-            return c.json(materializeWorkflowDocument(doc, this.collection.workflow, c.get("user")));
-        }
-        catch (error) {
-            const status = typeof error.statusCode === "number"
-                ? error.statusCode
-                : 500;
-            return c.json({
-                error: true,
-                message: error instanceof Error ? error.message : String(error),
-            }, status);
-        }
-    }
-    async workflowHistory(c) {
-        const config = c.get("config");
-        if (!config.db)
-            return c.json({ message: "Database not configured" }, 500);
-        if (!this.collection.workflow)
-            return c.json({ message: "Workflows are not enabled for this collection" }, 404);
-        const documentId = c.req.param("id");
-        if (!documentId)
-            return c.json({ message: "Missing ID" }, 400);
-        const document = await config.db.findOne({
-            collection: this.collection.slug,
-            id: documentId,
-        });
-        if (!document)
-            return c.json({ message: "Not Found" }, 404);
-        const readAccess = this.collection.access?.read;
-        if (readAccess !== undefined && readAccess !== null) {
-            const args = { user: c.get("user"), req: c.req, doc: document };
-            const result = await resolveAccess(config, readAccess, args);
-            let allowed = result === true;
-            if (result && typeof result === "object") {
-                const match = await config.db.find({
-                    collection: this.collection.slug,
-                    where: { AND: [{ id: { equals: documentId } }, result] },
-                    limit: 1,
-                });
-                allowed = match.total > 0;
-            }
-            if (!allowed)
-                return c.json({
-                    error: true,
-                    message: `Access denied: read on ${this.collection.slug}`,
-                }, 403);
-        }
-        const result = await config.db.find({
-            collection: WORKFLOW_HISTORY_COLLECTION,
-            where: {
-                collection: { equals: this.collection.slug },
-                documentId: { equals: documentId },
-            },
-            sort: "-createdAt",
-            limit: Math.min(Number(c.req.query("limit")) || 50, 100),
-        });
-        return c.json(result);
-    }
-    /**
-     * POST /api/collections/:slug/:id/change-password
-     *
-     * Dedicated endpoint for password changes. Requires the caller to supply:
-     *   { oldPassword, newPassword, confirmPassword }
-     *
-     * Rules:
-     *  - Only the account owner or an admin may change the password.
-     *  - Non-admin callers MUST provide a valid oldPassword.
-     *  - newPassword and confirmPassword must match.
-     */
-    async changePassword(c) {
-        const config = c.get("config");
-        const db = config.db;
-        if (!db)
-            return c.json({ message: "Database not configured" }, 500);
-        if (!this.collection.auth) {
-            return c.json({ message: "This collection does not support authentication" }, 400);
-        }
-        const id = c.req.param("id");
-        if (!id)
-            return c.json({ message: "Missing ID" }, 400);
-        const user = c.get("user");
-        if (!user)
-            return c.json({ message: "Authentication required" }, 401);
-        const body = await c.req.json().catch(() => null);
-        const { oldPassword, newPassword, confirmPassword } = body ?? {};
-        if (!newPassword) {
-            return c.json({ message: "newPassword is required" }, 400);
-        }
-        if (newPassword !== confirmPassword) {
-            return c.json({ message: "Passwords do not match" }, 400);
-        }
-        if (newPassword.length < 8) {
-            return c.json({ message: "Password must be at least 8 characters" }, 400);
-        }
-        const isAdmin = Array.isArray(user.roles) && user.roles.includes("admin");
-        const isSelf = user.sub === id;
-        if (!isAdmin && !isSelf) {
-            return c.json({ message: "You are not authorised to change this password" }, 403);
-        }
-        // Non-admins must verify their current password
-        if (!isAdmin) {
-            if (!oldPassword) {
-                return c.json({ message: "Current password is required" }, 400);
-            }
-            const existing = await db.findOne({
-                collection: this.collection.slug,
-                id,
-            });
-            if (!existing)
-                return c.json({ message: "User not found" }, 404);
-            const valid = await verifyPassword(oldPassword, existing.password);
-            if (!valid) {
-                return c.json({ message: "Invalid current password" }, 400);
-            }
-        }
-        const hashed = await hashPassword(newPassword);
-        await db.update({
-            collection: this.collection.slug,
-            id,
-            data: {
-                password: hashed,
-                loginAttempts: 0,
-                lockedUntil: null,
-                updatedAt: new Date().toISOString(),
-                updatedBy: user.sub,
-            },
-        });
-        await revokeAllAuthSessions(config, {
-            userId: id,
-            collection: this.collection.slug,
-        });
-        if (this.collection.audit) {
-            AuditService.log(db, {
-                operation: "update",
-                collection: this.collection.slug,
-                documentId: id,
-                user: { id: user.sub, collection: user.collection, email: user.email },
-                before: null,
-                after: { id },
-            }, config);
-        }
-        return c.json({ success: true, message: "Password updated successfully" });
-    }
-    async delete(c) {
-        const config = c.get("config");
-        const db = config.db;
-        if (!db)
-            return c.json({ message: "Database not configured" }, 500);
-        const provider = this.getDelegatedProvider(c);
-        if (provider && provider.members?.delete) {
-            const hookReq = this.toHookRequestContext(c);
-            const id = c.req.param("id");
-            if (!id)
-                return c.json({ message: "Missing ID" }, 400);
-            const localDoc = await db.findOne({
-                collection: this.collection.slug,
-                id,
-            });
-            const externalSubject = localDoc?.externalSubject || id;
-            await provider.members.delete({ externalSubject, req: hookReq });
-            return c.json({ message: "Deleted" });
-        }
-        const readonlyDb = createReadonlyDb(db);
-        const id = c.req.param("id");
-        if (!id)
-            return c.json({ message: "Missing ID" }, 400);
-        const user = c.get("user");
-        const doc = await db.findOne({ collection: this.collection.slug, id });
-        if (!doc)
-            return c.json({ message: "Not Found" }, 404);
-        const deleteAccess = await this.evaluateAccess(c, "delete", { id, doc });
-        if (!deleteAccess.allowed) {
-            return c.json({
-                error: true,
-                message: `Access denied: delete on ${this.collection.slug}`,
-            }, 403);
-        }
-        let before = null;
-        if (this.collection.audit) {
-            before = doc;
-        }
-        // Run beforeDelete collection hook
-        await runCollectionHooks(this.collection.hooks?.beforeDelete, {
-            id,
-            doc,
-            user,
-            req: c.req,
-            db: readonlyDb,
-        });
-        await db.delete({ collection: this.collection.slug, id });
-        if (this.collection.audit && db) {
-            AuditService.log(db, {
-                operation: "delete",
-                collection: this.collection.slug,
-                documentId: id,
-                user: user
-                    ? { id: user.sub, collection: user.collection, email: user.email }
-                    : undefined,
-                before,
-                after: null,
-            }, config);
-        }
-        // Run afterDelete collection hook (full db access)
-        await runCollectionHooks(this.collection.hooks?.afterDelete, {
-            id,
-            doc,
-            user,
-            req: c.req,
-            db,
-        }, { isolated: true });
-        return c.json({ message: "Deleted" });
-    }
-    async deleteMany(c) {
-        const config = c.get("config");
-        const db = config.db;
-        if (!db)
-            return c.json({ message: "Database not configured" }, 500);
-        const readonlyDb = createReadonlyDb(db);
-        const user = c.get("user");
-        // ids may arrive as a query-string array (?ids[]=a&ids[]=b) or JSON body
-        let ids = [];
-        try {
-            const body = await c.req.json().catch(() => null);
-            if (body?.ids && Array.isArray(body.ids)) {
-                ids = body.ids;
-            }
-        }
-        catch {
-            // fall through to query-string
-        }
-        if (!ids.length) {
-            const raw = c.req.queries("ids") ?? c.req.queries("ids[]") ?? [];
-            ids = raw.filter(Boolean);
-        }
-        if (!ids.length)
-            return c.json({ message: "No IDs provided" }, 400);
-        const deleted = [];
-        const failed = [];
-        for (const id of ids) {
-            try {
-                const doc = await db.findOne({ collection: this.collection.slug, id });
-                if (!doc) {
-                    failed.push({ id, error: "Not Found" });
-                    continue;
-                }
-                const deleteAccess = await this.evaluateAccess(c, "delete", {
-                    id,
-                    doc,
-                });
-                if (!deleteAccess.allowed) {
-                    failed.push({ id, error: "Access denied" });
-                    continue;
-                }
-                let before = null;
-                if (this.collection.audit) {
-                    before = doc;
-                }
-                // Run beforeDelete hooks
-                await runCollectionHooks(this.collection.hooks?.beforeDelete, {
-                    id,
-                    doc,
-                    user,
-                    req: c.req,
-                    db: readonlyDb,
-                });
-                await db.delete({ collection: this.collection.slug, id });
-                deleted.push(id);
-                if (this.collection.audit) {
-                    AuditService.log(db, {
-                        operation: "delete",
-                        collection: this.collection.slug,
-                        documentId: id,
-                        user: user
-                            ? { id: user.sub, collection: user.collection, email: user.email }
-                            : undefined,
-                        before,
-                        after: null,
-                    }, config);
-                }
-                // Run afterDelete hooks (full db access)
-                await runCollectionHooks(this.collection.hooks?.afterDelete, {
-                    id,
-                    doc,
-                    user,
-                    req: c.req,
-                    db,
-                }, { isolated: true });
-            }
-            catch (err) {
-                failed.push({ id, error: err?.message ?? "Unknown error" });
-            }
-        }
-        return c.json({
-            message: `Deleted ${deleted.length} document(s)`,
-            deleted,
-            ...(failed.length ? { failed } : {}),
-        });
-    }
-    async seed(c) {
-        const config = c.get("config");
-        const db = config.db;
-        if (!db)
-            return c.json({ message: "Database not configured" }, 500);
-        const body = await c.req.json();
-        const initialData = body.data;
-        if (!initialData || !Array.isArray(initialData)) {
-            return c.json({ message: "Invalid initial data" }, 400);
-        }
-        const result = await db.find({
-            collection: this.collection.slug,
-            limit: 1,
-        });
-        if (result.total > 0) {
-            return c.json({ message: "Collection is not empty, skipping seed" });
-        }
-        getRequestLogger(c, "collection").info({
-            msg: "Auto-seeding collection",
-            collection: this.collection.slug,
-        });
-        const createdDocs = [];
-        for (const data of initialData) {
-            const doc = await db.create({ collection: this.collection.slug, data });
-            createdDocs.push(doc);
-        }
-        return c.json({ message: "Seed successful", count: createdDocs.length }, 201);
-    }
-}
-//# sourceMappingURL=collection.controller.js.map