@flowerforce/flowerbase 1.7.4 → 1.7.5-beta.0

package/dist/auth/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/auth/controller.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AASzC;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,eAAe,iBAsLxD"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/auth/controller.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAgBzC;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,eAAe,iBA0LxD"}

package/dist/auth/controller.js

@@ -16,6 +16,12 @@ const state_1 = require("../state");
 const crypto_1 = require("../utils/crypto");
 const utils_1 = require("./utils");
 const HANDLER_TYPE = 'preHandler';
+const unauthorizedSessionError = {
+    message: 'Unauthorized',
+    error: 'unauthorized',
+    errorCode: 'InvalidSession',
+    error_code: 'InvalidSession'
+};
 /**
  * Controller for handling user authentication, profile retrieval, and session management.
  * @testable
@@ -96,11 +102,13 @@ function authController(app) {
         }, function (req, res) {
             return __awaiter(this, void 0, void 0, function* () {
                 if (req.user.typ !== 'refresh') {
-                    throw new Error(utils_1.AUTH_ERRORS.INVALID_TOKEN);
+                    res.code(401).send(unauthorizedSessionError);
+                    return;
                 }
                 const authHeader = req.headers.authorization;
                 if (!(authHeader === null || authHeader === void 0 ? void 0 : authHeader.startsWith('Bearer '))) {
-                    throw new Error(utils_1.AUTH_ERRORS.INVALID_TOKEN);
+                    res.code(401).send(unauthorizedSessionError);
+                    return;
                 }
                 const refreshToken = authHeader.slice('Bearer '.length).trim();
                 const refreshTokenHash = (0, crypto_1.hashToken)(refreshToken);
@@ -110,11 +118,13 @@ function authController(app) {
                     expiresAt: { $gt: new Date() }
                 });
                 if (!storedToken) {
-                    throw new Error(utils_1.AUTH_ERRORS.INVALID_TOKEN);
+                    res.code(401).send(unauthorizedSessionError);
+                    return;
                 }
                 const auth_user = yield (db === null || db === void 0 ? void 0 : db.collection(authCollection).findOne({ _id: new this.mongo.ObjectId(req.user.sub) }));
                 if (!auth_user) {
-                    throw new Error(`User with ID ${req.user.sub} not found`);
+                    res.code(401).send(unauthorizedSessionError);
+                    return;
                 }
                 const user = userCollection && constants_1.AUTH_CONFIG.user_id_field
                     ? (yield db.collection(userCollection).findOne({ [constants_1.AUTH_CONFIG.user_id_field]: req.user.sub }))

package/dist/auth/plugins/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/jwt.ts"],"names":[],"mappings":"AAKA,KAAK,OAAO,GAAG;IACb,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAkBD;;;;;;;GAOG;iUAC8C,OAAO;AAAxD,wBA+GE"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/jwt.ts"],"names":[],"mappings":"AAKA,KAAK,OAAO,GAAG;IACb,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAkBD;;;;;;;GAOG;iUAC8C,OAAO;AAAxD,wBA4GE"}

package/dist/auth/plugins/jwt.js

@@ -95,15 +95,18 @@ exports.default = (0, fastify_plugin_1.default)(function (fastify, opts) {
         });
         fastify.decorate('createAccessToken', function (user) {
             const id = user._id.toString();
-            const userData = isRecord(user.user_data) ? Object.assign({}, user.user_data) : {};
             const customData = isRecord(user.custom_data)
-                ? Object.assign({}, user.custom_data) : Object.assign({}, userData);
-            const mergedUserData = Object.assign(Object.assign(Object.assign({}, customData), userData), { _id: id, id, email: typeof user.email === 'string' ? user.email : userData.email });
+                ? Object.assign({}, user.custom_data) : (isRecord(user.user_data) ? Object.assign({}, user.user_data) : {});
+            const authData = {
+                _id: id,
+                id,
+                email: typeof user.email === 'string' ? user.email : customData.email
+            };
             return this.jwt.sign({
                 typ: 'access',
                 id,
-                data: mergedUserData,
-                user_data: mergedUserData,
+                data: authData,
+                user_data: customData,
                 custom_data: customData
             }, {
                 iss: BAAS_ID,

package/dist/features/functions/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/features/functions/controller.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AA8ChD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,kBAqKjC,CAAA"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/features/functions/controller.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAoFhD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,kBAqPjC,CAAA"}

package/dist/features/functions/controller.js

@@ -8,11 +8,21 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.functionsController = void 0;
 const bson_1 = require("bson");
 const services_1 = require("../../services");
-const state_1 = require("../../state");
 const context_1 = require("../../utils/context");
 const utils_1 = require("./utils");
 const normalizeUser = (payload) => {
@@ -47,6 +57,20 @@ const isReturnedError = (value) => {
     return typeof candidate.message === 'string' && typeof candidate.name === 'string';
 };
 const serializeEjson = (value) => JSON.stringify(bson_1.EJSON.serialize(value, { relaxed: false }));
+const isRecord = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+const sharedWatchStreams = new Map();
+let watchSubscriberCounter = 0;
+const parseWatchFilter = (args) => {
+    var _a;
+    if (!isRecord(args))
+        return undefined;
+    const candidate = (_a = (isRecord(args.filter) ? args.filter : undefined)) !== null && _a !== void 0 ? _a : (isRecord(args.query) ? args.query : undefined);
+    return candidate ? candidate : undefined;
+};
+const isReadableDocumentResult = (value) => !!value &&
+    typeof value === 'object' &&
+    !Array.isArray(value) &&
+    Object.keys(value).length > 0;
 /**
  * > Creates a pre handler for every query
  * @param app -> the fastify instance
@@ -55,7 +79,6 @@ const serializeEjson = (value) => JSON.stringify(bson_1.EJSON.serialize(value, {
  */
 const functionsController = (app_1, _a) => __awaiter(void 0, [app_1, _a], void 0, function* (app, { functionsList, rules }) {
     app.addHook('preHandler', app.jwtAuthentication);
-    const streams = {};
     app.post('/call', {
         schema: {
             tags: ['Functions']
@@ -140,10 +163,9 @@ const functionsController = (app_1, _a) => __awaiter(void 0, [app_1, _a], void 0
             throw new Error('Access token required');
         }
         const { baas_request, stitch_request } = query;
-        const config = JSON.parse(Buffer.from(baas_request || stitch_request || '', 'base64').toString('utf8'));
-        const [{ database, collection }] = config.arguments;
-        const app = state_1.StateManager.select('app');
-        const services = state_1.StateManager.select('services');
+        const decodedConfig = JSON.parse(Buffer.from(baas_request || stitch_request || '', 'base64').toString('utf8'));
+        const config = bson_1.EJSON.deserialize(decodedConfig);
+        const [_a] = config.arguments, { database, collection } = _a, watchArgs = __rest(_a, ["database", "collection"]);
         const headers = {
             'Content-Type': 'text/event-stream',
             'Cache-Control': 'no-cache',
@@ -154,31 +176,107 @@ const functionsController = (app_1, _a) => __awaiter(void 0, [app_1, _a], void 0
         };
         res.raw.writeHead(200, headers);
         res.raw.flushHeaders();
-        const requestKey = baas_request || stitch_request;
-        if (!requestKey)
-            return;
-        const changeStream = streams[requestKey];
-        if (changeStream) {
-            changeStream.on('change', (change) => {
-                res.raw.write(`data: ${serializeEjson(change)}\n\n`);
+        const streamKey = `${database}::${collection}`;
+        const subscriberId = `${Date.now()}-${watchSubscriberCounter++}`;
+        const extraFilter = parseWatchFilter(watchArgs);
+        const mongoClient = app.mongo.client;
+        let hub = sharedWatchStreams.get(streamKey);
+        if (!hub) {
+            const stream = mongoClient.db(database).collection(collection).watch([], {
+                fullDocument: 'whenAvailable'
             });
-            req.raw.on('close', () => {
-                var _a;
-                console.log("change stream closed");
-                (_a = changeStream === null || changeStream === void 0 ? void 0 : changeStream.close) === null || _a === void 0 ? void 0 : _a.call(changeStream);
-                delete streams[requestKey];
-            });
-            return;
+            hub = {
+                database,
+                collection,
+                stream,
+                subscribers: new Map()
+            };
+            sharedWatchStreams.set(streamKey, hub);
         }
-        streams[requestKey] = yield services['mongodb-atlas'](app, {
+        const ensureHubListeners = (currentHub) => {
+            if (currentHub.listenersBound) {
+                return;
+            }
+            const closeHub = () => __awaiter(void 0, void 0, void 0, function* () {
+                currentHub.stream.off('change', onHubChange);
+                currentHub.stream.off('error', onHubError);
+                sharedWatchStreams.delete(streamKey);
+                try {
+                    yield currentHub.stream.close();
+                }
+                catch (_a) {
+                    // Ignore stream close errors.
+                }
+            });
+            const onHubChange = (change) => __awaiter(void 0, void 0, void 0, function* () {
+                const subscribers = Array.from(currentHub.subscribers.values());
+                yield Promise.all(subscribers.map((subscriber) => __awaiter(void 0, void 0, void 0, function* () {
+                    var _a, _b, _c;
+                    const subscriberRes = subscriber.response;
+                    if (subscriberRes.writableEnded || subscriberRes.destroyed) {
+                        currentHub.subscribers.delete(subscriber.id);
+                        return;
+                    }
+                    const docId = (_b = (_a = change === null || change === void 0 ? void 0 : change.documentKey) === null || _a === void 0 ? void 0 : _a._id) !== null && _b !== void 0 ? _b : (_c = change === null || change === void 0 ? void 0 : change.fullDocument) === null || _c === void 0 ? void 0 : _c._id;
+                    if (typeof docId === 'undefined')
+                        return;
+                    const readQuery = subscriber.extraFilter
+                        ? { $and: [subscriber.extraFilter, { _id: docId }] }
+                        : { _id: docId };
+                    try {
+                        const readableDoc = yield services_1.services['mongodb-atlas'](app, {
+                            user: subscriber.user,
+                            rules
+                        })
+                            .db(currentHub.database)
+                            .collection(currentHub.collection)
+                            .findOne(readQuery);
+                        if (!isReadableDocumentResult(readableDoc))
+                            return;
+                        subscriberRes.write(`data: ${serializeEjson(change)}\n\n`);
+                    }
+                    catch (error) {
+                        subscriberRes.write(`event: error\ndata: ${formatFunctionExecutionError(error)}\n\n`);
+                        subscriberRes.end();
+                        currentHub.subscribers.delete(subscriber.id);
+                    }
+                })));
+                if (!currentHub.subscribers.size) {
+                    yield closeHub();
+                }
+            });
+            const onHubError = (error) => __awaiter(void 0, void 0, void 0, function* () {
+                for (const subscriber of currentHub.subscribers.values()) {
+                    const subscriberRes = subscriber.response;
+                    if (!subscriberRes.writableEnded && !subscriberRes.destroyed) {
+                        subscriberRes.write(`event: error\ndata: ${formatFunctionExecutionError(error)}\n\n`);
+                        subscriberRes.end();
+                    }
+                }
+                currentHub.subscribers.clear();
+                yield closeHub();
+            });
+            currentHub.stream.on('change', onHubChange);
+            currentHub.stream.on('error', onHubError);
+            currentHub.listenersBound = true;
+        };
+        ensureHubListeners(hub);
+        const subscriber = {
+            id: subscriberId,
             user,
-            rules
-        })
-            .db(database)
-            .collection(collection)
-            .watch([], { fullDocument: 'whenAvailable' });
-        streams[requestKey].on('change', (change) => {
-            res.raw.write(`data: ${serializeEjson(change)}\n\n`);
+            response: res.raw,
+            extraFilter
+        };
+        hub.subscribers.set(subscriberId, subscriber);
+        req.raw.on('close', () => {
+            const currentHub = sharedWatchStreams.get(streamKey);
+            if (!currentHub)
+                return;
+            currentHub.subscribers.delete(subscriberId);
+            if (!currentHub.subscribers.size) {
+                void currentHub.stream.close();
+                sharedWatchStreams.delete(streamKey);
+            }
         });
     }));
 });

package/dist/services/mongodb-atlas/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/mongodb-atlas/index.ts"],"names":[],"mappings":"AAuBA,OAAO,EAGL,oBAAoB,EAErB,MAAM,SAAS,CAAA;AA0uChB,QAAA,MAAM,YAAY,EAAE,oBA6BlB,CAAA;AAEF,eAAe,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/mongodb-atlas/index.ts"],"names":[],"mappings":"AAwBA,OAAO,EAGL,oBAAoB,EAErB,MAAM,SAAS,CAAA;AAk1ChB,QAAA,MAAM,YAAY,EAAE,oBA6BlB,CAAA;AAEF,eAAe,YAAY,CAAA"}

package/dist/services/mongodb-atlas/index.js

@@ -113,6 +113,53 @@ const normalizeFindOneAndUpdateOptions = (options) => {
     return Object.assign(Object.assign({}, rest), { returnDocument: returnNewDocument ? 'after' : 'before' });
 };
 const buildAndQuery = (clauses) => clauses.length ? { $and: clauses } : {};
+const toWatchMatchFilter = (value) => {
+    if (Array.isArray(value)) {
+        return value.map((item) => toWatchMatchFilter(item));
+    }
+    if (!isPlainObject(value))
+        return value;
+    return Object.entries(value).reduce((acc, [key, current]) => {
+        if (key.startsWith('$')) {
+            acc[key] = toWatchMatchFilter(current);
+            return acc;
+        }
+        acc[`fullDocument.${key}`] = toWatchMatchFilter(current);
+        return acc;
+    }, {});
+};
+const resolveWatchArgs = (pipelineOrOptions, options) => {
+    var _a;
+    const inputPipeline = Array.isArray(pipelineOrOptions) ? pipelineOrOptions : [];
+    const rawOptions = (_a = (Array.isArray(pipelineOrOptions) ? options : pipelineOrOptions)) !== null && _a !== void 0 ? _a : {};
+    if (!isPlainObject(rawOptions)) {
+        return {
+            pipeline: inputPipeline,
+            options: options,
+            extraMatches: []
+        };
+    }
+    const _b = rawOptions, { filter: watchFilter, ids } = _b, watchOptions = __rest(_b, ["filter", "ids"]);
+    const extraMatches = [];
+    if (typeof watchFilter !== 'undefined') {
+        extraMatches.push({ $match: toWatchMatchFilter(watchFilter) });
+    }
+    if (Array.isArray(ids)) {
+        extraMatches.push({
+            $match: {
+                $or: [
+                    { 'documentKey._id': { $in: ids } },
+                    { 'fullDocument._id': { $in: ids } }
+                ]
+            }
+        });
+    }
+    return {
+        pipeline: inputPipeline,
+        options: watchOptions,
+        extraMatches
+    };
+};
 const hasAtomicOperators = (data) => Object.keys(data).some((key) => key.startsWith('$'));
 const normalizeUpdatePayload = (data) => hasAtomicOperators(data) ? data : { $set: data };
 const hasOperatorExpressions = (value) => isPlainObject(value) && Object.keys(value).some((key) => key.startsWith('$'));
@@ -316,22 +363,22 @@ const getOperators = (collection, { rules, collName, user, run_as_system, monito
     };
     return {
         /**
-       * Finds a single document in a MongoDB collection with optional role-based filtering and validation.
-       *
-       * @param {Filter<Document>} query - The MongoDB query used to match the document.
-       * @param {Document} [projection] - Optional projection to select returned fields.
-       * @param {FindOneOptions} [options] - Optional settings for the findOne operation.
-       * @returns {Promise<Document | {} | null>} A promise resolving to the document if found and permitted, an empty object if access is denied, or `null` if not found.
-       *
-       * @description
-       * If `run_as_system` is enabled, the function behaves like a standard `collection.findOne(query)` with no access checks.
-       * Otherwise:
-       *  - Merges the provided query with any access control filters using `getFormattedQuery`.
-       *  - Attempts to find the document using the formatted query.
-       *  - Determines the user's role via `getWinningRole`.
-       *  - Validates the result using `checkValidation` to ensure read permission.
-       *  - If validation fails, returns an empty object; otherwise returns the validated document.
-       */
+         * Finds a single document in a MongoDB collection with optional role-based filtering and validation.
+         *
+         * @param {Filter<Document>} query - The MongoDB query used to match the document.
+         * @param {Document} [projection] - Optional projection to select returned fields.
+         * @param {FindOneOptions} [options] - Optional settings for the findOne operation.
+         * @returns {Promise<Document | {} | null>} A promise resolving to the document if found and permitted, an empty object if access is denied, or `null` if not found.
+         *
+         * @description
+         * If `run_as_system` is enabled, the function behaves like a standard `collection.findOne(query)` with no access checks.
+         * Otherwise:
+         *  - Merges the provided query with any access control filters using `getFormattedQuery`.
+         *  - Attempts to find the document using the formatted query.
+         *  - Determines the user's role via `getWinningRole`.
+         *  - Validates the result using `checkValidation` to ensure read permission.
+         *  - If validation fails, returns an empty object; otherwise returns the validated document.
+         */
         findOne: (...args_1) => __awaiter(void 0, [...args_1], void 0, function* (query = {}, projectionOrOptions, options) {
             var _a;
             try {
@@ -804,32 +851,35 @@ const getOperators = (collection, { rules, collName, user, run_as_system, monito
          *
          * This allows fine-grained control over what change events a user can observe, based on roles and filters.
          */
-        watch: (pipeline = [], options) => {
+        watch: (pipelineOrOptions = [], options) => {
             try {
+                const { pipeline, options: watchOptions, extraMatches } = resolveWatchArgs(pipelineOrOptions, options);
                 if (!run_as_system) {
                     (0, utils_3.checkDenyOperation)(normalizedRules, collection.collectionName, model_1.CRUD_OPERATIONS.READ);
                     // Apply access filters to initial change stream pipeline
                     const formattedQuery = (0, utils_3.getFormattedQuery)(filters, {}, user);
-                    const firstStep = formattedQuery.length ? {
-                        $match: {
-                            $and: formattedQuery
+                    const watchFormattedQuery = formattedQuery.map((condition) => toWatchMatchFilter(condition));
+                    const firstStep = watchFormattedQuery.length
+                        ? {
+                            $match: {
+                                $and: watchFormattedQuery
+                            }
                         }
-                    } : undefined;
-                    const formattedPipeline = [
-                        firstStep,
-                        ...pipeline
-                    ].filter(Boolean);
-                    const result = collection.watch(formattedPipeline, options);
+                        : undefined;
+                    const formattedPipeline = [firstStep, ...extraMatches, ...pipeline].filter(Boolean);
+                    const result = collection.watch(formattedPipeline, watchOptions);
                     const originalOn = result.on.bind(result);
                     /**
                      * Validates a change event against the user's roles.
                      *
                      * @param {Document} change - A change event from the ChangeStream.
-                     * @returns {Promise<{ status: boolean, document: Document, updatedFieldsStatus: boolean, updatedFields: Document }>}
+                     * @returns {Promise<{ status: boolean, document: Document, updatedFieldsStatus: boolean, updatedFields: Document, hasFullDocument: boolean, hasWinningRole: boolean }>}
                      */
-                    const isValidChange = (_a) => __awaiter(void 0, [_a], void 0, function* ({ fullDocument, updateDescription }) {
+                    const isValidChange = (change) => __awaiter(void 0, void 0, void 0, function* () {
+                        const { fullDocument, updateDescription } = change;
+                        const hasFullDocument = !!fullDocument;
                         const winningRole = (0, utils_2.getWinningRole)(fullDocument, user, roles);
-                        const { status, document } = winningRole
+                        const fullDocumentValidation = winningRole
                             ? yield (0, machines_1.checkValidation)(winningRole, {
                                 type: 'read',
                                 roles,
@@ -837,6 +887,7 @@ const getOperators = (collection, { rules, collName, user, run_as_system, monito
                                 expansions: {}
                             }, user)
                             : fallbackAccess(fullDocument);
+                        const { status, document } = fullDocumentValidation;
                         const { status: updatedFieldsStatus, document: updatedFields } = winningRole
                             ? yield (0, machines_1.checkValidation)(winningRole, {
                                 type: 'read',
@@ -845,15 +896,32 @@ const getOperators = (collection, { rules, collName, user, run_as_system, monito
                                 expansions: {}
                             }, user)
                             : fallbackAccess(updateDescription === null || updateDescription === void 0 ? void 0 : updateDescription.updatedFields);
-                        return { status, document, updatedFieldsStatus, updatedFields };
+                        return {
+                            status,
+                            document,
+                            updatedFieldsStatus,
+                            updatedFields,
+                            hasFullDocument,
+                            hasWinningRole: !!winningRole
+                        };
                     });
                     // Override the .on() method to apply validation before emitting events
                     result.on = (eventType, listener) => {
                         return originalOn(eventType, (change) => __awaiter(void 0, void 0, void 0, function* () {
-                            const { status, document, updatedFieldsStatus, updatedFields } = yield isValidChange(change);
-                            if (!status)
-                                return;
+                            var _a, _b, _c, _d;
+                            const { document, updatedFieldsStatus, updatedFields, hasFullDocument, hasWinningRole } = yield isValidChange(change);
                             const filteredChange = Object.assign(Object.assign({}, change), { fullDocument: document, updateDescription: Object.assign(Object.assign({}, change.updateDescription), { updatedFields: updatedFieldsStatus ? updatedFields : {} }) });
+                            console.log('[flowerbase watch] delivered change', {
+                                collection: collName,
+                                operationType: change === null || change === void 0 ? void 0 : change.operationType,
+                                eventType,
+                                hasFullDocument,
+                                hasWinningRole,
+                                updatedFieldsStatus,
+                                documentKey: ((_c = (_b = (_a = change === null || change === void 0 ? void 0 : change.documentKey) === null || _a === void 0 ? void 0 : _a._id) === null || _b === void 0 ? void 0 : _b.toString) === null || _c === void 0 ? void 0 : _c.call(_b)) ||
+                                    ((_d = change === null || change === void 0 ? void 0 : change.documentKey) === null || _d === void 0 ? void 0 : _d._id) ||
+                                    null
+                            });
                             listener(filteredChange);
                         }));
                     };
@@ -861,7 +929,7 @@ const getOperators = (collection, { rules, collName, user, run_as_system, monito
                     return result;
                 }
                 // System mode: no filtering applied
-                const result = collection.watch(pipeline, options);
+                const result = collection.watch([...extraMatches, ...pipeline], watchOptions);
                 emitMongoEvent('watch');
                 return result;
             }

package/dist/utils/initializer/exposeRoutes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exposeRoutes.d.ts","sourceRoot":"","sources":["../../../src/utils/initializer/exposeRoutes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAOzC;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAU,SAAS,eAAe,kBAmF1D,CAAA"}
+{"version":3,"file":"exposeRoutes.d.ts","sourceRoot":"","sources":["../../../src/utils/initializer/exposeRoutes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAOzC;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAU,SAAS,eAAe,kBAqF1D,CAAA"}

package/dist/utils/initializer/exposeRoutes.js

@@ -59,6 +59,7 @@ const exposeRoutes = (fastify) => __awaiter(void 0, void 0, void 0, function* ()
                 const db = fastify.mongo.client.db(constants_1.DB_NAME);
                 const { email, password } = req.body;
                 const hashedPassword = yield (0, crypto_1.hashPassword)(password);
+                const now = new Date();
                 const users = db.collection(authCollection).find();
                 const list = yield (users === null || users === void 0 ? void 0 : users.toArray());
                 if (list === null || list === void 0 ? void 0 : list.length) {
@@ -71,6 +72,7 @@ const exposeRoutes = (fastify) => __awaiter(void 0, void 0, void 0, function* ()
                     email: email,
                     password: hashedPassword,
                     status: 'confirmed',
+                    createdAt: now,
                     custom_data: {}
                 });
                 yield (db === null || db === void 0 ? void 0 : db.collection(authCollection).updateOne({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowerforce/flowerbase",
-  "version": "1.7.4",
+  "version": "1.7.5-beta.0",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/auth/controller.ts

@@ -4,9 +4,16 @@ import { AUTH_CONFIG, DB_NAME, DEFAULT_CONFIG } from '../constants'
 import { StateManager } from '../state'
 import { hashToken } from '../utils/crypto'
 import { SessionCreatedDto } from './dtos'
-import { AUTH_ENDPOINTS, AUTH_ERRORS } from './utils'
+import { AUTH_ENDPOINTS } from './utils'
 
 const HANDLER_TYPE = 'preHandler'
+const unauthorizedSessionError = {
+  message: 'Unauthorized',
+  error: 'unauthorized',
+  errorCode: 'InvalidSession',
+  error_code: 'InvalidSession'
+} as const
+type UnauthorizedSessionReply = typeof unauthorizedSessionError
 
 /**
  * Controller for handling user authentication, profile retrieval, and session management.
@@ -90,7 +97,7 @@ export async function authController(app: FastifyInstance) {
    * @param {import('fastify').FastifyReply} res - The response object.
    * @returns {Promise<SessionCreatedDto>} A promise resolving with the newly created session data.
    */
-  app.post<{ Reply: SessionCreatedDto }>(
+  app.post<{ Reply: SessionCreatedDto | UnauthorizedSessionReply }>(
     AUTH_ENDPOINTS.SESSION,
     {
       schema: {
@@ -99,12 +106,14 @@ export async function authController(app: FastifyInstance) {
     },
     async function (req, res) {
       if (req.user.typ !== 'refresh') {
-        throw new Error(AUTH_ERRORS.INVALID_TOKEN)
+        res.code(401).send(unauthorizedSessionError)
+        return
       }
 
       const authHeader = req.headers.authorization
       if (!authHeader?.startsWith('Bearer ')) {
-        throw new Error(AUTH_ERRORS.INVALID_TOKEN)
+        res.code(401).send(unauthorizedSessionError)
+        return
       }
       const refreshToken = authHeader.slice('Bearer '.length).trim()
       const refreshTokenHash = hashToken(refreshToken)
@@ -114,7 +123,8 @@ export async function authController(app: FastifyInstance) {
         expiresAt: { $gt: new Date() }
       })
       if (!storedToken) {
-        throw new Error(AUTH_ERRORS.INVALID_TOKEN)
+        res.code(401).send(unauthorizedSessionError)
+        return
       }
 
       const auth_user = await db
@@ -122,7 +132,8 @@ export async function authController(app: FastifyInstance) {
         .findOne({ _id: new this.mongo.ObjectId(req.user.sub) })
 
       if (!auth_user) {
-        throw new Error(`User with ID ${req.user.sub} not found`)
+        res.code(401).send(unauthorizedSessionError)
+        return
       }
 
       const user = userCollection && AUTH_CONFIG.user_id_field

package/src/auth/plugins/jwt.test.ts

@@ -140,7 +140,7 @@ describe('jwtAuthentication', () => {
     expect(decoded.id).toBe(authId.toHexString())
     expect(decoded.sub).toBe(authId.toHexString())
     expect(decoded.data._id).toBe(authId.toHexString())
-    expect(decoded.user_data._id).toBe(authId.toHexString())
+    expect(decoded.user_data._id).toBe(linkedId.toHexString())
     expect(decoded.custom_data._id).toBe(linkedId.toHexString())
     expect(decoded.custom_data.role).toBe('owner')
   })

package/src/auth/plugins/jwt.ts

@@ -101,24 +101,21 @@ export default fp(async function (fastify, opts: Options) {
 
   fastify.decorate('createAccessToken', function (user: WithId<Document>) {
     const id = user._id.toString()
-    const userData = isRecord(user.user_data) ? { ...user.user_data } : {}
     const customData = isRecord(user.custom_data)
       ? { ...user.custom_data }
-      : { ...userData }
-    const mergedUserData = {
-      ...customData,
-      ...userData,
+      : (isRecord(user.user_data) ? { ...user.user_data } : {})
+    const authData = {
       _id: id,
       id,
-      email: typeof user.email === 'string' ? user.email : userData.email
+      email: typeof user.email === 'string' ? user.email : customData.email
     }
 
     return this.jwt.sign(
       {
         typ: 'access',
         id,
-        data: mergedUserData,
-        user_data: mergedUserData,
+        data: authData,
+        user_data: customData,
         custom_data: customData
       },
       {