@flowerforce/flowerbase 1.7.4 → 1.7.5-beta.1

package/src/features/triggers/utils.ts

@@ -277,6 +277,17 @@ const handleAuthenticationTrigger = async ({
   changeStream.on('error', (error) => {
     if (shouldIgnoreStreamError(error)) return
     console.error('Authentication trigger change stream error', error)
+    emitTriggerEvent({
+      status: 'error',
+      triggerName,
+      triggerType,
+      functionName,
+      meta: {
+        ...baseMeta,
+        event: 'CHANGE_STREAM'
+      },
+      error
+    })
   })
   changeStream.on('change', async function (change) {
     const operationType = change['operationType' as keyof typeof change] as
@@ -365,13 +376,6 @@ const handleAuthenticationTrigger = async ({
         updateDescription
       }
       try {
-        emitTriggerEvent({
-          status: 'fired',
-          triggerName,
-          triggerType,
-          functionName,
-          meta: { ...baseMeta, event: 'LOGOUT' }
-        })
         await GenerateContext({
           args: [{ user: userData, ...op }],
           app,
@@ -383,6 +387,13 @@ const handleAuthenticationTrigger = async ({
           services,
           runAsSystem: true
         })
+        emitTriggerEvent({
+          status: 'fired',
+          triggerName,
+          triggerType,
+          functionName,
+          meta: { ...baseMeta, event: 'LOGOUT' }
+        })
       } catch (error) {
         emitTriggerEvent({
           status: 'error',
@@ -417,13 +428,6 @@ const handleAuthenticationTrigger = async ({
         updateDescription
       }
       try {
-        emitTriggerEvent({
-          status: 'fired',
-          triggerName,
-          triggerType,
-          functionName,
-          meta: { ...baseMeta, event: 'DELETE' }
-        })
         await GenerateContext({
           args: isAutoTrigger ? [userData] : [{ user: userData, ...op }],
           app,
@@ -435,6 +439,13 @@ const handleAuthenticationTrigger = async ({
           services,
           runAsSystem: true
         })
+        emitTriggerEvent({
+          status: 'fired',
+          triggerName,
+          triggerType,
+          functionName,
+          meta: { ...baseMeta, event: 'DELETE' }
+        })
       } catch (error) {
         emitTriggerEvent({
           status: 'error',
@@ -471,13 +482,6 @@ const handleAuthenticationTrigger = async ({
         updateDescription
       }
       try {
-        emitTriggerEvent({
-          status: 'fired',
-          triggerName,
-          triggerType,
-          functionName,
-          meta: { ...baseMeta, event: 'UPDATE' }
-        })
         await GenerateContext({
           args: isAutoTrigger ? [userData] : [{ user: userData, ...op }],
           app,
@@ -489,6 +493,13 @@ const handleAuthenticationTrigger = async ({
           services,
           runAsSystem: true
         })
+        emitTriggerEvent({
+          status: 'fired',
+          triggerName,
+          triggerType,
+          functionName,
+          meta: { ...baseMeta, event: 'UPDATE' }
+        })
       } catch (error) {
         emitTriggerEvent({
           status: 'error',
@@ -575,13 +586,6 @@ const handleAuthenticationTrigger = async ({
     }
 
     try {
-      emitTriggerEvent({
-        status: 'fired',
-        triggerName,
-        triggerType,
-        functionName,
-        meta: { ...baseMeta, event: 'CREATE' }
-      })
       await GenerateContext({
         args: isAutoTrigger ? [userData] : [{ user: userData, ...op }],
         app,
@@ -593,6 +597,13 @@ const handleAuthenticationTrigger = async ({
         services,
         runAsSystem: true
       })
+      emitTriggerEvent({
+        status: 'fired',
+        triggerName,
+        triggerType,
+        functionName,
+        meta: { ...baseMeta, event: 'CREATE' }
+      })
     } catch (error) {
       emitTriggerEvent({
         status: 'error',

package/src/services/mongodb-atlas/index.ts

@@ -4,6 +4,7 @@ import isEqual from 'lodash/isEqual'
 import set from 'lodash/set'
 import unset from 'lodash/unset'
 import {
+  ChangeStreamOptions,
   ClientSession,
   ClientSessionOptions,
   Collection,
@@ -139,7 +140,73 @@ const normalizeFindOneAndUpdateOptions = (
 const buildAndQuery = (clauses: MongoFilter<Document>[]): MongoFilter<Document> =>
   clauses.length ? { $and: clauses } : {}
 
-const hasAtomicOperators = (data: Document) => Object.keys(data).some((key) => key.startsWith('$'))
+const toWatchMatchFilter = (value: unknown): unknown => {
+  if (Array.isArray(value)) {
+    return value.map((item) => toWatchMatchFilter(item))
+  }
+
+  if (!isPlainObject(value)) return value
+
+  return Object.entries(value).reduce<Record<string, unknown>>((acc, [key, current]) => {
+    if (key.startsWith('$')) {
+      acc[key] = toWatchMatchFilter(current)
+      return acc
+    }
+    acc[`fullDocument.${key}`] = toWatchMatchFilter(current)
+    return acc
+  }, {})
+}
+
+type RealmCompatibleWatchOptions = Document & {
+  filter?: MongoFilter<Document>
+  ids?: unknown[]
+}
+
+const resolveWatchArgs = (
+  pipelineOrOptions?: Document[] | RealmCompatibleWatchOptions,
+  options?: RealmCompatibleWatchOptions
+) => {
+  const inputPipeline = Array.isArray(pipelineOrOptions) ? pipelineOrOptions : []
+  const rawOptions = (Array.isArray(pipelineOrOptions) ? options : pipelineOrOptions) ?? {}
+
+  if (!isPlainObject(rawOptions)) {
+    return {
+      pipeline: inputPipeline,
+      options: options as ChangeStreamOptions | undefined,
+      extraMatches: [] as Document[]
+    }
+  }
+
+  const {
+    filter: watchFilter,
+    ids,
+    ...watchOptions
+  } = rawOptions as RealmCompatibleWatchOptions
+
+  const extraMatches: Document[] = []
+  if (typeof watchFilter !== 'undefined') {
+    extraMatches.push({ $match: toWatchMatchFilter(watchFilter) as Document })
+  }
+  if (Array.isArray(ids)) {
+    extraMatches.push({
+      $match: {
+        $or: [
+          { 'documentKey._id': { $in: ids } },
+          { 'fullDocument._id': { $in: ids } }
+        ]
+      }
+    })
+  }
+
+  return {
+    pipeline: inputPipeline,
+    options: watchOptions as ChangeStreamOptions,
+    extraMatches
+  }
+}
+
+const hasAtomicOperators = (data: Document) =>
+  Object.keys(data).some((key) => key.startsWith('$'))
 
 const normalizeUpdatePayload = (data: Document) =>
   hasAtomicOperators(data) ? data : { $set: data }
@@ -364,22 +431,22 @@ const getOperators: GetOperatorsFunction = (
 
   return {
     /**
-   * Finds a single document in a MongoDB collection with optional role-based filtering and validation.
-   *
-   * @param {Filter<Document>} query - The MongoDB query used to match the document.
-   * @param {Document} [projection] - Optional projection to select returned fields.
-   * @param {FindOneOptions} [options] - Optional settings for the findOne operation.
-   * @returns {Promise<Document | {} | null>} A promise resolving to the document if found and permitted, an empty object if access is denied, or `null` if not found.
-   *
-   * @description
-   * If `run_as_system` is enabled, the function behaves like a standard `collection.findOne(query)` with no access checks.
-   * Otherwise:
-   *  - Merges the provided query with any access control filters using `getFormattedQuery`.
-   *  - Attempts to find the document using the formatted query.
-   *  - Determines the user's role via `getWinningRole`.
-   *  - Validates the result using `checkValidation` to ensure read permission.
-   *  - If validation fails, returns an empty object; otherwise returns the validated document.
-   */
+     * Finds a single document in a MongoDB collection with optional role-based filtering and validation.
+     *
+     * @param {Filter<Document>} query - The MongoDB query used to match the document.
+     * @param {Document} [projection] - Optional projection to select returned fields.
+     * @param {FindOneOptions} [options] - Optional settings for the findOne operation.
+     * @returns {Promise<Document | {} | null>} A promise resolving to the document if found and permitted, an empty object if access is denied, or `null` if not found.
+     *
+     * @description
+     * If `run_as_system` is enabled, the function behaves like a standard `collection.findOne(query)` with no access checks.
+     * Otherwise:
+     *  - Merges the provided query with any access control filters using `getFormattedQuery`.
+     *  - Attempts to find the document using the formatted query.
+     *  - Determines the user's role via `getWinningRole`.
+     *  - Validates the result using `checkValidation` to ensure read permission.
+     *  - If validation fails, returns an empty object; otherwise returns the validated document.
+     */
     findOne: async (query = {}, projectionOrOptions, options) => {
       try {
         const { projection, options: normalizedOptions } = resolveFindArgs(
@@ -389,9 +456,9 @@ const getOperators: GetOperatorsFunction = (
         const resolvedOptions =
           projection || normalizedOptions
             ? {
-              ...(normalizedOptions ?? {}),
-              ...(projection ? { projection } : {})
-            }
+                ...(normalizedOptions ?? {}),
+                ...(projection ? { projection } : {})
+              }
             : undefined
         const resolvedQuery = query ?? {}
         if (!run_as_system) {
@@ -429,15 +496,15 @@ const getOperators: GetOperatorsFunction = (
           })
           const { status, document } = winningRole
             ? await checkValidation(
-              winningRole,
-              {
-                type: 'read',
-                roles,
-                cursor: result,
-                expansions: {}
-              },
-              user
-            )
+                winningRole,
+                {
+                  type: 'read',
+                  roles,
+                  cursor: result,
+                  expansions: {}
+                },
+                user
+              )
             : fallbackAccess(result)
 
           // Return validated document or empty object if not permitted
@@ -490,15 +557,15 @@ const getOperators: GetOperatorsFunction = (
           })
           const { status } = winningRole
             ? await checkValidation(
-              winningRole,
-              {
-                type: 'delete',
-                roles,
-                cursor: result,
-                expansions: {}
-              },
-              user
-            )
+                winningRole,
+                {
+                  type: 'delete',
+                  roles,
+                  cursor: result,
+                  expansions: {}
+                },
+                user
+              )
             : fallbackAccess(result)
 
           if (!status) {
@@ -545,15 +612,15 @@ const getOperators: GetOperatorsFunction = (
 
           const { status, document } = winningRole
             ? await checkValidation(
-              winningRole,
-              {
-                type: 'insert',
-                roles,
-                cursor: data,
-                expansions: {}
-              },
-              user
-            )
+                winningRole,
+                {
+                  type: 'insert',
+                  roles,
+                  cursor: data,
+                  expansions: {}
+                },
+                user
+              )
             : fallbackAccess(data)
 
           if (!status || !isEqual(data, document)) {
@@ -636,15 +703,15 @@ const getOperators: GetOperatorsFunction = (
           // Validate update permissions
           const { status, document } = winningRole
             ? await checkValidation(
-              winningRole,
-              {
-                type: 'write',
-                roles,
-                cursor: docToCheck,
-                expansions: {}
-              },
-              user
-            )
+                winningRole,
+                {
+                  type: 'write',
+                  roles,
+                  cursor: docToCheck,
+                  expansions: {}
+                },
+                user
+              )
             : fallbackAccess(docToCheck)
           // Ensure no unauthorized changes are made
           const areDocumentsEqual = areUpdatedFieldsAllowed(document, docToCheck, updatedPaths)
@@ -751,15 +818,15 @@ const getOperators: GetOperatorsFunction = (
           const readRole = getWinningRole(updateResult, user, roles)
           const readResult = readRole
             ? await checkValidation(
-              readRole,
-              {
-                type: 'read',
-                roles,
-                cursor: updateResult,
-                expansions: {}
-              },
-              user
-            )
+                readRole,
+                {
+                  type: 'read',
+                  roles,
+                  cursor: updateResult,
+                  expansions: {}
+                },
+                user
+              )
             : fallbackAccess(updateResult)
 
           const sanitizedDoc = readResult.status ? (readResult.document ?? updateResult) : {}
@@ -806,9 +873,9 @@ const getOperators: GetOperatorsFunction = (
         const resolvedOptions =
           projection || normalizedOptions
             ? {
-              ...(normalizedOptions ?? {}),
-              ...(projection ? { projection } : {})
-            }
+                ...(normalizedOptions ?? {}),
+                ...(projection ? { projection } : {})
+              }
             : undefined
         if (!run_as_system) {
           checkDenyOperation(normalizedRules, collection.collectionName, CRUD_OPERATIONS.READ)
@@ -839,15 +906,15 @@ const getOperators: GetOperatorsFunction = (
                 })
                 const { status, document } = winningRole
                   ? await checkValidation(
-                    winningRole,
-                    {
-                      type: 'read',
-                      roles,
-                      cursor: currentDoc,
-                      expansions: {}
-                    },
-                    user
-                  )
+                      winningRole,
+                      {
+                        type: 'read',
+                        roles,
+                        cursor: currentDoc,
+                        expansions: {}
+                      },
+                      user
+                    )
                   : fallbackAccess(currentDoc)
 
                 return status ? document : undefined
@@ -928,63 +995,85 @@ const getOperators: GetOperatorsFunction = (
      *
      * This allows fine-grained control over what change events a user can observe, based on roles and filters.
      */
-    watch: (pipeline = [], options) => {
+    watch: (pipelineOrOptions = [], options) => {
       try {
+        const {
+          pipeline,
+          options: watchOptions,
+          extraMatches
+        } = resolveWatchArgs(pipelineOrOptions as Document[] | RealmCompatibleWatchOptions, options as RealmCompatibleWatchOptions)
+
         if (!run_as_system) {
-          checkDenyOperation(normalizedRules, collection.collectionName, CRUD_OPERATIONS.READ)
+          checkDenyOperation(
+            normalizedRules,
+            collection.collectionName,
+            CRUD_OPERATIONS.READ
+          )
           // Apply access filters to initial change stream pipeline
           const formattedQuery = getFormattedQuery(filters, {}, user)
+          const watchFormattedQuery = formattedQuery.map(
+            (condition) => toWatchMatchFilter(condition) as MongoFilter<Document>
+          )
 
-          const firstStep = formattedQuery.length ? {
-            $match: {
-              $and: formattedQuery
-            }
-          } : undefined
+          const firstStep = watchFormattedQuery.length
+            ? {
+                $match: {
+                  $and: watchFormattedQuery
+                }
+              }
+            : undefined
 
-          const formattedPipeline = [
-            firstStep,
-            ...pipeline
-          ].filter(Boolean) as Document[]
+          const formattedPipeline = [firstStep, ...extraMatches, ...pipeline].filter(Boolean) as Document[]
 
-          const result = collection.watch(formattedPipeline, options)
+          const result = collection.watch(formattedPipeline, watchOptions)
           const originalOn = result.on.bind(result)
 
           /**
            * Validates a change event against the user's roles.
            *
            * @param {Document} change - A change event from the ChangeStream.
-           * @returns {Promise<{ status: boolean, document: Document, updatedFieldsStatus: boolean, updatedFields: Document }>}
+           * @returns {Promise<{ status: boolean, document: Document, updatedFieldsStatus: boolean, updatedFields: Document, hasFullDocument: boolean, hasWinningRole: boolean }>}
            */
-          const isValidChange = async ({ fullDocument, updateDescription }: Document) => {
+          const isValidChange = async (change: Document) => {
+            const { fullDocument, updateDescription } = change
+            const hasFullDocument = !!fullDocument
             const winningRole = getWinningRole(fullDocument, user, roles)
 
-            const { status, document } = winningRole
+            const fullDocumentValidation = winningRole
               ? await checkValidation(
-                winningRole,
-                {
-                  type: 'read',
-                  roles,
-                  cursor: fullDocument,
-                  expansions: {}
-                },
-                user
-              )
+                  winningRole,
+                  {
+                    type: 'read',
+                    roles,
+                    cursor: fullDocument,
+                    expansions: {}
+                  },
+                  user
+                )
               : fallbackAccess(fullDocument)
+            const { status, document } = fullDocumentValidation
 
             const { status: updatedFieldsStatus, document: updatedFields } = winningRole
               ? await checkValidation(
-                winningRole,
-                {
-                  type: 'read',
-                  roles,
-                  cursor: updateDescription?.updatedFields,
-                  expansions: {}
-                },
-                user
-              )
+                  winningRole,
+                  {
+                    type: 'read',
+                    roles,
+                    cursor: updateDescription?.updatedFields,
+                    expansions: {}
+                  },
+                  user
+                )
               : fallbackAccess(updateDescription?.updatedFields)
 
-            return { status, document, updatedFieldsStatus, updatedFields }
+            return {
+              status,
+              document,
+              updatedFieldsStatus,
+              updatedFields,
+              hasFullDocument,
+              hasWinningRole: !!winningRole
+            }
           }
 
           // Override the .on() method to apply validation before emitting events
@@ -993,9 +1082,13 @@ const getOperators: GetOperatorsFunction = (
             listener: EventsDescription[EventKey]
           ) => {
             return originalOn(eventType, async (change: Document) => {
-              const { status, document, updatedFieldsStatus, updatedFields } =
-                await isValidChange(change)
-              if (!status) return
+              const {
+                document,
+                updatedFieldsStatus,
+                updatedFields,
+                hasFullDocument,
+                hasWinningRole
+              } = await isValidChange(change)
 
               const filteredChange = {
                 ...change,
@@ -1006,6 +1099,18 @@ const getOperators: GetOperatorsFunction = (
                 }
               }
 
+              console.log('[flowerbase watch] delivered change', {
+                collection: collName,
+                operationType: change?.operationType,
+                eventType,
+                hasFullDocument,
+                hasWinningRole,
+                updatedFieldsStatus,
+                documentKey:
+                  change?.documentKey?._id?.toString?.() ||
+                  change?.documentKey?._id ||
+                  null
+              })
               listener(filteredChange)
             })
           }
@@ -1014,7 +1119,7 @@ const getOperators: GetOperatorsFunction = (
         }
 
         // System mode: no filtering applied
-        const result = collection.watch(pipeline, options)
+        const result = collection.watch([...extraMatches, ...pipeline], watchOptions)
         emitMongoEvent('watch')
         return result
       } catch (error) {
@@ -1105,15 +1210,15 @@ const getOperators: GetOperatorsFunction = (
 
               const { status, document } = winningRole
                 ? await checkValidation(
-                  winningRole,
-                  {
-                    type: 'insert',
-                    roles,
-                    cursor: currentDoc,
-                    expansions: {}
-                  },
-                  user
-                )
+                    winningRole,
+                    {
+                      type: 'insert',
+                      roles,
+                      cursor: currentDoc,
+                      expansions: {}
+                    },
+                    user
+                  )
                 : fallbackAccess(currentDoc)
 
               return status ? document : undefined
@@ -1166,15 +1271,15 @@ const getOperators: GetOperatorsFunction = (
 
               const { status, document } = winningRole
                 ? await checkValidation(
-                  winningRole,
-                  {
-                    type: 'write',
-                    roles,
-                    cursor: currentDoc,
-                    expansions: {}
-                  },
-                  user
-                )
+                    winningRole,
+                    {
+                      type: 'write',
+                      roles,
+                      cursor: currentDoc,
+                      expansions: {}
+                    },
+                    user
+                  )
                 : fallbackAccess(currentDoc)
 
               return status ? document : undefined
@@ -1236,15 +1341,15 @@ const getOperators: GetOperatorsFunction = (
 
               const { status, document } = winningRole
                 ? await checkValidation(
-                  winningRole,
-                  {
-                    type: 'delete',
-                    roles,
-                    cursor: currentDoc,
-                    expansions: {}
-                  },
-                  user
-                )
+                    winningRole,
+                    {
+                      type: 'delete',
+                      roles,
+                      cursor: currentDoc,
+                      expansions: {}
+                    },
+                    user
+                  )
                 : fallbackAccess(currentDoc)
 
               return status ? document : undefined

package/src/utils/initializer/exposeRoutes.ts

@@ -49,6 +49,7 @@ export const exposeRoutes = async (fastify: FastifyInstance) => {
       const db = fastify.mongo.client.db(DB_NAME)
       const { email, password } = req.body
       const hashedPassword = await hashPassword(password)
+      const now = new Date()
 
       const users = db.collection(authCollection!).find()
 
@@ -65,6 +66,7 @@ export const exposeRoutes = async (fastify: FastifyInstance) => {
         email: email,
         password: hashedPassword,
         status: 'confirmed',
+        createdAt: now,
         custom_data: {}
       })