@dyrected/core 2.8.3 → 2.10.0

package/dist/router.js

@@ -1,704 +0,0 @@
-import { CollectionController } from "./controllers/collection.controller.js";
-import { GlobalController } from "./controllers/global.controller.js";
-import { MediaController } from "./controllers/media.controller.js";
-import { AuthController } from "./controllers/auth.controller.js";
-import { AdminAuthController } from "./controllers/admin-auth.controller.js";
-import { PreviewController } from "./controllers/preview.controller.js";
-import { AuditController } from "./controllers/audit.controller.js";
-import { requireAuth, optionalAuth } from "./middleware/auth.js";
-import { generateOpenApi } from "./utils/openapi.js";
-import { getSwaggerHtml } from "./utils/swagger.js";
-import { getPublicAdminAuthConfig } from "./utils/admin-auth.js";
-import { mergeDynamicConfig } from "./utils/block-references.js";
-import { resolveBooleanAccess, toHookRequestContext, } from "./utils/access-control.js";
-import { getConfigLogger, getRequestLogger } from "./observability.js";
-/**
- * Access gate middleware for granular permissions using Jexl.
- */
-function accessGate(config, target, action) {
-    return async (c, next) => {
-        const user = c.get("user");
-        const accessExpr = target.access?.[action];
-        // If no access expression, default to public (true) for now to maintain parity with old behavior.
-        // However, if we want to be secure by default, we could change this to false.
-        if (accessExpr === undefined || accessExpr === null) {
-            return await next();
-        }
-        const allowed = await resolveBooleanAccess(config, accessExpr, {
-            user,
-            req: toHookRequestContext(c.req),
-        });
-        if (!allowed) {
-            return c.json({ error: true, message: `Access denied: ${action} on ${target.slug}` }, 403);
-        }
-        await next();
-    };
-}
-function serializeFieldForApi(f) {
-    if (!f)
-        return f;
-    const serialized = { ...f };
-    if (serialized.admin?.hooks) {
-        const hooks = { ...serialized.admin.hooks };
-        if (typeof hooks.onChange === "function") {
-            hooks.onChange = hooks.onChange.toString();
-        }
-        if (typeof hooks.options === "function") {
-            hooks.options = hooks.options.toString();
-        }
-        serialized.admin = { ...serialized.admin, hooks };
-    }
-    if (typeof serialized.options === "function" ||
-        (serialized.options &&
-            typeof serialized.options === "object" &&
-            "resolve" in serialized.options)) {
-        serialized.options = { _dynamic: true };
-    }
-    if (serialized.fields) {
-        serialized.fields = serialized.fields.map(serializeFieldForApi);
-    }
-    if (serialized.blocks && !serialized.blockReferences?.length) {
-        serialized.blocks = serialized.blocks.map((b) => ({
-            ...b,
-            fields: b.fields?.map(serializeFieldForApi),
-        }));
-    }
-    else if (serialized.blockReferences?.length) {
-        delete serialized.blocks;
-    }
-    return serialized;
-}
-function serializeBlockForApi(block) {
-    return {
-        ...block,
-        fields: block.fields?.map(serializeFieldForApi),
-    };
-}
-/**
- * Register dynamic routes based on the provided configuration.
- */
-export function registerRoutes(app, config) {
-    // Per-app cache for dynamic option resolvers that opt in via `cacheTTL`.
-    // Scoped to this config so tests and multi-tenant setups stay isolated.
-    const optionsCache = new Map();
-    // 1. Schema Endpoints
-    // Used by the SDK and Admin to understand the content structure
-    app.get("/api/schemas", optionalAuth(config), async (c) => {
-        const siteId = c.req.header("X-Site-Id");
-        const requestConfig = siteId && config.onSchemaFetch
-            ? mergeDynamicConfig(config, await config.onSchemaFetch(siteId))
-            : config;
-        const collections = [...requestConfig.collections];
-        const globals = [...requestConfig.globals];
-        const user = c.get("user");
-        const accessArgs = { user, req: toHookRequestContext(c.req) };
-        const serializeAccess = async (access) => {
-            if (typeof access === "string")
-                return access;
-            if (typeof access === "boolean")
-                return access;
-            // Named policies: inline a string/boolean policy so the admin evaluates it
-            // live against the form; resolve function policies to a static boolean.
-            if (access &&
-                typeof access === "object" &&
-                typeof access.policy === "string") {
-                const policy = requestConfig.accessPolicies?.[access.policy];
-                if (typeof policy === "string" || typeof policy === "boolean")
-                    return policy;
-            }
-            return resolveBooleanAccess(requestConfig, access, accessArgs);
-        };
-        const filteredCollections = await Promise.all(collections
-            .filter((col) => !siteId || col.shared || !col.siteId || col.siteId === siteId)
-            .map(async (col) => ({
-            slug: col.slug,
-            labels: col.labels,
-            access: {
-                read: await serializeAccess(col.access?.read),
-                create: await serializeAccess(col.access?.create),
-                update: await serializeAccess(col.access?.update),
-                delete: await serializeAccess(col.access?.delete),
-            },
-            fields: await Promise.all(col.fields.map(serializeFieldForApi).map(async (f) => ({
-                name: f.name,
-                type: f.type,
-                label: f.label,
-                required: f.required,
-                defaultValue: f.defaultValue,
-                options: f.options,
-                relationTo: f.relationTo,
-                hasMany: f.hasMany,
-                fields: f.fields,
-                blocks: f.blocks,
-                blockReferences: f.blockReferences,
-                collection: f.collection,
-                on: f.on,
-                limit: f.limit,
-                admin: f.admin,
-                access: {
-                    read: await serializeAccess(f.access?.read),
-                    create: await serializeAccess(f.access?.create),
-                    update: await serializeAccess(f.access?.update),
-                },
-            }))),
-            upload: !!col.upload,
-            auth: !!col.auth,
-            audit: !!col.audit,
-            drafts: !!col.drafts,
-            admin: col.admin,
-            workflow: col.workflow
-                ? {
-                    initialState: col.workflow.initialState,
-                    draftState: col.workflow.draftState,
-                    states: col.workflow.states,
-                    transitions: col.workflow.transitions.map((t) => ({
-                        name: t.name,
-                        label: t.label,
-                        from: t.from,
-                        to: t.to,
-                        requiredCapabilities: t.requiredCapabilities,
-                        requireComment: t.requireComment,
-                        unpublish: t.unpublish,
-                    })),
-                    roles: col.workflow.roles,
-                }
-                : undefined,
-        })));
-        const filteredGlobals = await Promise.all(globals
-            .filter((glb) => !siteId || glb.shared || !glb.siteId || glb.siteId === siteId)
-            .map(async (glb) => ({
-            slug: glb.slug,
-            label: glb.label,
-            access: {
-                read: await serializeAccess(glb.access?.read),
-                update: await serializeAccess(glb.access?.update),
-            },
-            fields: await Promise.all(glb.fields.map(serializeFieldForApi).map(async (f) => ({
-                name: f.name,
-                type: f.type,
-                label: f.label,
-                required: f.required,
-                defaultValue: f.defaultValue,
-                options: f.options,
-                relationTo: f.relationTo,
-                hasMany: f.hasMany,
-                fields: f.fields,
-                blocks: f.blocks,
-                blockReferences: f.blockReferences,
-                collection: f.collection,
-                on: f.on,
-                limit: f.limit,
-                admin: f.admin,
-                access: {
-                    read: await serializeAccess(f.access?.read),
-                    update: await serializeAccess(f.access?.update),
-                },
-            }))),
-            admin: glb.admin,
-        })));
-        return c.json({
-            blocks: requestConfig.blocks?.map(serializeBlockForApi),
-            collections: filteredCollections,
-            globals: filteredGlobals,
-            admin: requestConfig.admin || {},
-            adminAuth: getPublicAdminAuthConfig(requestConfig.adminAuth, collections),
-            hasStorage: !!requestConfig.storage,
-        });
-    });
-    app.get("/api/dyrected/options/:collection/:field", optionalAuth(config), async (c) => {
-        const { collection: colSlug, field: fieldName } = c.req.param();
-        const siteId = c.req.header("X-Site-Id");
-        // Resolve collections
-        const requestConfig = siteId && config.onSchemaFetch
-            ? mergeDynamicConfig(config, await config.onSchemaFetch(siteId))
-            : config;
-        let collections = [...requestConfig.collections];
-        const user = c.get("user");
-        let collection = collections.find((col) => col.slug === colSlug);
-        let field;
-        if (collection) {
-            // Check read access on collection
-            const accessExpr = collection.access?.read;
-            if (accessExpr !== undefined && accessExpr !== null) {
-                const allowed = await resolveBooleanAccess(config, accessExpr, {
-                    user,
-                    req: toHookRequestContext(c.req),
-                });
-                if (!allowed) {
-                    return c.json({ error: true, message: `Access denied: read on ${colSlug}` }, 403);
-                }
-            }
-            field = collection.fields.find((f) => f.name === fieldName);
-        }
-        else {
-            const globals = [...requestConfig.globals];
-            const glb = globals.find((g) => g.slug === colSlug);
-            if (!glb) {
-                return c.json({
-                    error: true,
-                    message: `${colSlug} not found as collection or global`,
-                }, 404);
-            }
-            // Check read access on global
-            const accessExpr = glb.access?.read;
-            if (accessExpr !== undefined && accessExpr !== null) {
-                const allowed = await resolveBooleanAccess(config, accessExpr, {
-                    user,
-                    req: toHookRequestContext(c.req),
-                });
-                if (!allowed) {
-                    return c.json({
-                        error: true,
-                        message: `Access denied: read on global ${colSlug}`,
-                    }, 403);
-                }
-            }
-            field = glb.fields.find((f) => f.name === fieldName);
-        }
-        if (!field) {
-            return c.json({
-                error: true,
-                message: `Field ${fieldName} not found in ${colSlug}`,
-            }, 404);
-        }
-        // Get the resolver
-        let resolver;
-        let cacheTTL;
-        if (typeof field.options === "function") {
-            resolver = field.options;
-        }
-        else if (field.options &&
-            typeof field.options === "object" &&
-            "resolve" in field.options) {
-            resolver = field.options.resolve;
-            cacheTTL = field.options.cacheTTL;
-        }
-        if (!resolver) {
-            return c.json({
-                error: true,
-                message: `Field ${fieldName} in ${colSlug} is not dynamic`,
-            }, 400);
-        }
-        try {
-            const db = c.get("db") || config.db;
-            // Construct a request query helper
-            const queryParams = c.req.query();
-            const reqContext = {
-                query: queryParams,
-                headers: c.req.header(),
-                raw: c.req.raw,
-            };
-            // When the resolver opts into caching, key the result by the inputs that
-            // change it: the field, the query params, and the requesting user (so a
-            // user-scoped resolver never serves another user's options).
-            const shouldCache = typeof cacheTTL === "number" && cacheTTL > 0;
-            let cacheKey = "";
-            if (shouldCache) {
-                cacheKey = JSON.stringify([
-                    siteId ?? "",
-                    colSlug,
-                    fieldName,
-                    user?.id ?? null,
-                    queryParams,
-                ]);
-                const hit = optionsCache.get(cacheKey);
-                if (hit && hit.expires > Date.now()) {
-                    return c.json(hit.value);
-                }
-            }
-            const result = await resolver({
-                db,
-                user,
-                req: reqContext,
-            });
-            if (shouldCache) {
-                optionsCache.set(cacheKey, {
-                    expires: Date.now() + cacheTTL * 1000,
-                    value: result,
-                });
-            }
-            return c.json(result);
-        }
-        catch (err) {
-            getRequestLogger(c, "router").error({
-                err,
-                msg: "Failed to resolve dynamic field options",
-                fieldName,
-            });
-            return c.json({
-                error: true,
-                message: err.message || "Failed to resolve dynamic options",
-            }, 500);
-        }
-    });
-    app.get("/api/openapi.json", (c) => {
-        return c.json(generateOpenApi(config));
-    });
-    app.get("/api/docs", (c) => {
-        return c.html(getSwaggerHtml());
-    });
-    app.get("/api/preferences/:key", requireAuth(config), async (c) => {
-        const db = config.db;
-        const user = c.get("user");
-        const key = c.req.param("key");
-        const scope = c.req.query("scope");
-        if (!db)
-            return c.json({ message: "Database not configured" }, 500);
-        if (!user?.collection || !user.sub)
-            return c.json({ error: true, message: "Authentication required." }, 401);
-        if (!key)
-            return c.json({ error: true, message: "Preference key is required." }, 400);
-        const getGlobalPreference = async () => {
-            const globalDoc = await db.findOne({
-                collection: "__global_preferences",
-                id: key,
-            });
-            return globalDoc ? globalDoc.value : null;
-        };
-        if (scope === "global") {
-            const globalValue = await getGlobalPreference();
-            return c.json({ key, value: globalValue });
-        }
-        const doc = await db.findOne({ collection: user.collection, id: user.sub });
-        if (!doc)
-            return c.json({ error: true, message: "User not found." }, 404);
-        const preferences = typeof doc.__preferences === "object" && doc.__preferences !== null
-            ? doc.__preferences
-            : {};
-        if (key in preferences) {
-            return c.json({ key, value: preferences[key] ?? null });
-        }
-        const globalValue = await getGlobalPreference();
-        return c.json({ key, value: globalValue });
-    });
-    app.put("/api/preferences/:key", requireAuth(config), async (c) => {
-        const db = config.db;
-        const user = c.get("user");
-        const key = c.req.param("key");
-        const scope = c.req.query("scope");
-        if (!db)
-            return c.json({ message: "Database not configured" }, 500);
-        if (!user?.collection || !user.sub)
-            return c.json({ error: true, message: "Authentication required." }, 401);
-        if (!key)
-            return c.json({ error: true, message: "Preference key is required." }, 400);
-        const body = await c.req.json().catch(() => ({}));
-        if (scope === "global") {
-            const isAdminUser = Array.isArray(user?.roles) && user.roles.includes("admin");
-            if (!isAdminUser) {
-                return c.json({
-                    error: true,
-                    message: "Only administrators can save global preferences.",
-                }, 403);
-            }
-            const existing = await db.findOne({
-                collection: "__global_preferences",
-                id: key,
-            });
-            if (existing) {
-                await db.update({
-                    collection: "__global_preferences",
-                    id: key,
-                    data: { value: body.value },
-                });
-            }
-            else {
-                await db.create({
-                    collection: "__global_preferences",
-                    data: { id: key, value: body.value },
-                });
-            }
-            return c.json({ key, value: body.value });
-        }
-        const doc = await db.findOne({ collection: user.collection, id: user.sub });
-        if (!doc)
-            return c.json({ error: true, message: "User not found." }, 404);
-        const preferences = typeof doc.__preferences === "object" && doc.__preferences !== null
-            ? doc.__preferences
-            : {};
-        const nextPreferences = { ...preferences, [key]: body.value };
-        await db.update({
-            collection: user.collection,
-            id: user.sub,
-            data: { __preferences: nextPreferences },
-        });
-        return c.json({ key, value: body.value });
-    });
-    app.delete("/api/preferences/:key", requireAuth(config), async (c) => {
-        const db = config.db;
-        const user = c.get("user");
-        const key = c.req.param("key");
-        const scope = c.req.query("scope");
-        if (!db)
-            return c.json({ message: "Database not configured" }, 500);
-        if (!user?.collection || !user.sub)
-            return c.json({ error: true, message: "Authentication required." }, 401);
-        if (!key)
-            return c.json({ error: true, message: "Preference key is required." }, 400);
-        if (scope === "global") {
-            const isAdminUser = Array.isArray(user?.roles) && user.roles.includes("admin");
-            if (!isAdminUser) {
-                return c.json({
-                    error: true,
-                    message: "Only administrators can delete global preferences.",
-                }, 403);
-            }
-            await db.delete({ collection: "__global_preferences", id: key });
-            return c.json({ success: true });
-        }
-        const doc = await db.findOne({ collection: user.collection, id: user.sub });
-        if (!doc)
-            return c.json({ error: true, message: "User not found." }, 404);
-        const preferences = typeof doc.__preferences === "object" && doc.__preferences !== null
-            ? { ...doc.__preferences }
-            : {};
-        delete preferences[key];
-        await db.update({
-            collection: user.collection,
-            id: user.sub,
-            data: { __preferences: preferences },
-        });
-        return c.json({ success: true });
-    });
-    // Global Media Fallback (Proxies to the 'media' collection)
-    app.get("/api/media/:filename{.+$}", async (c) => {
-        const mediaController = new MediaController("media");
-        return mediaController.serve(c);
-    });
-    app.get("/media/:filename{.+$}", async (c) => {
-        const mediaController = new MediaController("media");
-        return mediaController.serve(c);
-    });
-    // 2. Media Routes (Conditional & Dynamic)
-    if (config.storage) {
-        const uploadCollections = config.collections.filter((c) => c.upload);
-        // Register routes for each upload-enabled collection
-        for (const col of uploadCollections) {
-            const mediaController = new MediaController(col.slug);
-            const prefix = `/api/collections/${col.slug}`;
-            app.get(`${prefix}/media`, accessGate(config, col, "read"), (c) => mediaController.find(c));
-            app.get(`${prefix}/media/:filename{.+$}`, (c) => mediaController.serve(c));
-            app.post(`${prefix}/media`, accessGate(config, col, "create"), (c) => mediaController.upload(c));
-            app.delete(`${prefix}/media/:id`, accessGate(config, col, "delete"), (c) => mediaController.delete(c));
-        }
-    }
-    // 2b. Admin Auth Routes
-    const adminAuthController = new AdminAuthController(config);
-    app.get("/api/admin/auth/providers", (c) => adminAuthController.providers(c));
-    app.get("/api/admin/auth/:provider/start", (c) => adminAuthController.start(c));
-    app.get("/api/admin/auth/:provider/callback", (c) => adminAuthController.callback(c));
-    app.post("/api/admin/auth/:provider/exchange", (c) => adminAuthController.exchange(c));
-    app.post("/api/admin/logout", (c) => adminAuthController.logout(c));
-    // 3. Auth Routes — for collections with auth: true
-    for (const collection of config.collections) {
-        if (!collection.auth)
-            continue;
-        const path = `/api/collections/${collection.slug}`;
-        const authController = new AuthController(collection);
-        app.post(`${path}/login`, (c) => authController.login(c));
-        app.post(`${path}/logout`, (c) => authController.logout(c));
-        app.get(`${path}/init`, (c) => authController.init(c));
-        app.post(`${path}/first-user`, (c) => authController.registerFirstUser(c));
-        // /me and /refresh-token require a valid token
-        app.get(`${path}/me`, requireAuth(config), (c) => authController.me(c));
-        app.post(`${path}/refresh-token`, requireAuth(config), (c) => authController.refreshToken(c));
-        app.post(`${path}/forgot-password`, (c) => authController.forgotPassword(c));
-        app.post(`${path}/reset-password`, (c) => authController.resetPassword(c));
-        app.post(`${path}/invite`, requireAuth(config), (c) => authController.invite(c));
-        app.post(`${path}/accept-invite`, (c) => authController.acceptInvite(c));
-    }
-    // 4. Collection Routes (Static)
-    const auditController = new AuditController();
-    for (const collection of config.collections) {
-        const path = `/api/collections/${collection.slug}`;
-        const controller = new CollectionController(collection);
-        app.get(path, (c) => controller.find(c));
-        app.post(path, (c) => controller.create(c));
-        app.post(`${path}/media`, (c) => controller.create(c));
-        // delete-many must be registered before /:id to avoid the wildcard swallowing it
-        app.delete(`${path}/delete-many`, (c) => controller.deleteMany(c));
-        if (collection.audit) {
-            app.get(`${path}/__audit`, (c) => auditController.findForCollection(c, collection));
-        }
-        app.get(`${path}/:id`, (c) => controller.findOne(c));
-        app.patch(`${path}/:id`, (c) => controller.update(c));
-        app.delete(`${path}/:id`, (c) => controller.delete(c));
-        // Dedicated password-change endpoint (auth collections only)
-        if (collection.auth) {
-            app.post(`${path}/:id/change-password`, requireAuth(config), (c) => controller.changePassword(c));
-        }
-        // Workflow routes — only registered when the collection has a workflow configured
-        if (collection.workflow) {
-            app.post(`${path}/:id/transitions/:transition`, requireAuth(config), (c) => controller.transition(c));
-            app.get(`${path}/:id/workflow-history`, requireAuth(config), (c) => controller.workflowHistory(c));
-        }
-    }
-    // 5. Global Routes (Static)
-    for (const global of config.globals) {
-        const path = `/api/globals/${global.slug}`;
-        const controller = new GlobalController(global);
-        app.get(path, (c) => controller.get(c));
-        app.patch(path, (c) => controller.update(c));
-    }
-    // 6. Preview Routes
-    if (!process.env.DYRECTED_JWT_SECRET) {
-        getConfigLogger(config, "router").warn({
-            msg: "DYRECTED_JWT_SECRET is not set; token-mode live preview is signing with an insecure default",
-        });
-    }
-    const previewController = new PreviewController();
-    app.post("/api/preview-token", requireAuth(config), (c) => previewController.createToken(c));
-    app.get("/api/preview-data", (c) => previewController.getData(c));
-    app.get("/api/audit", (c) => auditController.findAll(c));
-    // 7. Dynamic Routes (Tenant-specific)
-    // This handles collections/globals defined via sync:schema and fetched via onSchemaFetch
-    // 7a. Audit and workflow sub-routes for dynamic tenant collections.
-    // Must be registered BEFORE the /:id? catch-all so Hono doesn't swallow deeper paths.
-    // Pattern: GET  /api/collections/:slug/__audit
-    //          POST /api/collections/:slug/:id/transitions/:transition
-    //          GET  /api/collections/:slug/:id/workflow-history
-    app.get("/api/collections/:slug/__audit", async (c) => {
-        const slug = c.req.param("slug");
-        const siteId = c.req.header("X-Site-Id") || c.get("siteId");
-        const config = c.get("config");
-        if (config.collections.some((col) => col.slug === slug)) {
-            return c.json({ message: "Not Found" }, 404);
-        }
-        if (!config.onSchemaFetch || !siteId) {
-            return c.json({ message: `Collection "${slug}" not found` }, 404);
-        }
-        const requestConfig = mergeDynamicConfig(config, await config.onSchemaFetch(siteId));
-        const collection = requestConfig.collections.find((col) => col.slug === slug);
-        if (!collection?.audit) {
-            return c.json({ message: `Collection "${slug}" not found or has no audit log` }, 404);
-        }
-        return auditController.findForCollection(c, collection);
-    });
-    app.post("/api/collections/:slug/:id/transitions/:transition", requireAuth(config), async (c) => {
-        const slug = c.req.param("slug");
-        const siteId = c.req.header("X-Site-Id") || c.get("siteId");
-        const config = c.get("config");
-        // Skip if static — static workflow routes are registered directly above;
-        // if this wildcard fires for a static slug it means the sub-path is unknown.
-        if (config.collections.some((col) => col.slug === slug)) {
-            return c.json({ message: "Not Found" }, 404);
-        }
-        if (!config.onSchemaFetch || !siteId) {
-            return c.json({ message: `Collection "${slug}" not found` }, 404);
-        }
-        const requestConfig = mergeDynamicConfig(config, await config.onSchemaFetch(siteId));
-        const collection = requestConfig.collections.find((col) => col.slug === slug);
-        if (!collection?.workflow) {
-            return c.json({ message: `Collection "${slug}" not found or has no workflow` }, 404);
-        }
-        const controller = new CollectionController(collection);
-        return controller.transition(c);
-    });
-    app.get("/api/collections/:slug/:id/workflow-history", requireAuth(config), async (c) => {
-        const slug = c.req.param("slug");
-        const siteId = c.req.header("X-Site-Id") || c.get("siteId");
-        const config = c.get("config");
-        if (config.collections.some((col) => col.slug === slug)) {
-            return c.json({ message: "Not Found" }, 404);
-        }
-        if (!config.onSchemaFetch || !siteId) {
-            return c.json({ message: `Collection "${slug}" not found` }, 404);
-        }
-        const requestConfig = mergeDynamicConfig(config, await config.onSchemaFetch(siteId));
-        const collection = requestConfig.collections.find((col) => col.slug === slug);
-        if (!collection?.workflow) {
-            return c.json({ message: `Collection "${slug}" not found or has no workflow` }, 404);
-        }
-        const controller = new CollectionController(collection);
-        return controller.workflowHistory(c);
-    });
-    // 7b. Core dynamic catch-all for tenant collections (list, create, findOne, update, delete).
-    app.all("/api/collections/:slug/:id?", async (c) => {
-        const slug = c.req.param("slug");
-        const id = c.req.param("id");
-        const siteId = c.req.header("X-Site-Id") || c.get("siteId");
-        const config = c.get("config");
-        // Skip if static (already handled by routes above)
-        if (config.collections.some((col) => col.slug === slug)) {
-            return c.json({ message: "Method Not Allowed" }, 405);
-        }
-        if (config.onSchemaFetch && siteId) {
-            const requestConfig = mergeDynamicConfig(config, await config.onSchemaFetch(siteId));
-            let collection = requestConfig.collections.find((col) => col.slug === slug);
-            if (!collection && slug === "media") {
-                collection = {
-                    slug: "media",
-                    labels: { singular: "Media", plural: "Media" },
-                    upload: true,
-                    fields: [],
-                };
-            }
-            if (collection) {
-                // Handle auth sub-routes for dynamic auth collections
-                if (collection.auth && id) {
-                    const authController = new AuthController(collection);
-                    const method = c.req.method;
-                    if (method === "POST" && id === "login")
-                        return authController.login(c);
-                    if (method === "POST" && id === "logout")
-                        return authController.logout(c);
-                    if (method === "GET" && id === "me")
-                        return authController.me(c);
-                    if (method === "POST" && id === "refresh-token")
-                        return authController.refreshToken(c);
-                    if (method === "POST" && id === "forgot-password")
-                        return authController.forgotPassword(c);
-                    if (method === "POST" && id === "reset-password")
-                        return authController.resetPassword(c);
-                }
-                const controller = new CollectionController(collection);
-                const method = c.req.method;
-                if (id) {
-                    if (method === "GET")
-                        return controller.findOne(c);
-                    if (method === "PATCH")
-                        return controller.update(c);
-                    if (method === "DELETE" && id === "delete-many")
-                        return controller.deleteMany(c);
-                    if (method === "DELETE")
-                        return controller.delete(c);
-                    if (method === "POST" && id === "media")
-                        return controller.create(c);
-                }
-                else {
-                    if (method === "GET")
-                        return controller.find(c);
-                    if (method === "POST")
-                        return controller.create(c);
-                }
-            }
-        }
-        return c.json({ message: `Collection "${slug}" not found` }, 404);
-    });
-    app.all("/api/globals/:slug/:id?", async (c) => {
-        const slug = c.req.param("slug");
-        const id = c.req.param("id");
-        const siteId = c.req.header("X-Site-Id") || c.get("siteId");
-        const config = c.get("config");
-        // Skip if static
-        if (config.globals.some((glb) => glb.slug === slug)) {
-            return c.json({ message: "Method Not Allowed" }, 405);
-        }
-        if (config.onSchemaFetch && siteId) {
-            const requestConfig = mergeDynamicConfig(config, await config.onSchemaFetch(siteId));
-            const global = requestConfig.globals.find((glb) => glb.slug === slug);
-            if (global) {
-                const controller = new GlobalController(global);
-                const method = c.req.method;
-                if (!id) {
-                    if (method === "GET")
-                        return controller.get(c);
-                    if (method === "PATCH")
-                        return controller.update(c);
-                }
-            }
-        }
-        return c.json({ message: `Global "${slug}" not found` }, 404);
-    });
-}
-//# sourceMappingURL=router.js.map