npm - @goplusvn/core - Versions diffs - 0.1.12 → 0.1.14 - Mend

@goplusvn/core 0.1.12 → 0.1.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (20) hide show

package/CHANGELOG.md +83 -0
package/package.json +3 -1
package/src/auth/proxy-gate.ts +80 -0
package/src/crud/crud-route-handlers.ts +157 -0
package/src/crud/server-service.ts +312 -0
package/src/crud/server.ts +18 -0
package/src/providers/index.tsx +19 -0
package/src/rbac/role-service.ts +40 -33
package/src/styles/base.css +41 -0
package/src/ui/index.tsx +1 -0
package/src/ui/layout/customizer.tsx +12 -42
package/src/ui/layout/page-tabs.tsx +8 -42
package/src/ui/layout/sidebar.tsx +7 -5
package/src/ui/primitives/index.tsx +1 -0
package/src/ui/primitives/sidebar.tsx +25 -4
package/src/ui/shared/index.ts +6 -0
package/src/ui/shared/page-header.tsx +57 -0
package/src/ui/shared/status-indicator.tsx +173 -0
package/src/ui/shared/table-styles.ts +47 -0
package/src/ui/shared/table-sum-footer.tsx +41 -0

package/CHANGELOG.md CHANGED Viewed

@@ -1,5 +1,88 @@
 # Changelog
+## 0.1.14 — Init-completion: server-CRUD engine, auth gate, schema-tolerant RBAC, shared UI
+Đúc kết từ việc dựng app mới (wu-vpbank): những thứ MỖI app phải tự viết lại nay
+đưa vào core (xem `docs/CORE-INIT-COMPLETION-PLAN.md`). Toàn bộ **additive, backward-
+compatible** — 4 app (vinhhoa/thingtodo/wu ^0.1.13, tanloc ^0.1.3) an toàn.
+- **Server-CRUD engine** (`@goerp/core/crud/server`): `createServerCrudService`
+  (Prisma-agnostic qua DI), `getModelName`, `createAuditUserNameResolver` (schema-
+  tolerant tên user), `createCrudCollectionHandlers`/`createCrudItemHandlers` (route
+  Next.js tự gác quyền). App bỏ ~350 LOC engine tự chế.
+- **Auth request-gate** (`@goerp/core/auth/proxy-gate`): `createAuthProxy` (default-
+  deny) + `unauthorizedResponse`. proxy.ts app còn ~10 LOC.
+- **RBAC schema-tolerant**: `getRolesData(db, params, schema?)` nhận field-map
+  (`userNameField`/`userActiveField`/`userImageField`/`roleTimestamps`) → app schema
+  khác (User.fullName/active, Role không timestamps) không còn crash/tự chế.
+- **Shared UI** (`@goerp/core/ui`): PageHeader, StatusIndicator + getStatusMeta,
+  SumFooterCell + sumBy, table-styles (mẫu bảng đơn bán hàng, subpath server-safe
+  `@goerp/core/ui/shared/table-styles`); export DynamicIcon.
+Verify: core tsc 0 lỗi; wu consume toàn bộ (tsc 0/0 + render/CRUD/auth chạy đúng);
+golden vinhhoa tsc 20=20 (0 regression).
+## 0.1.13 — Customizer: make radius, density & inset/floating actually apply
+The Customizer exposed controls that stored a value but changed nothing on
+screen. Wired them up at the source so every app using core gets them working:
+- **Radius ("Bo góc") now applies.** `SettingsProvider` drives the real
+  `--radius` token from `settings.radius`; Tailwind's `@theme inline` derives
+  `rounded-sm/md/lg/xl` from it, so the whole UI re-rounds live (0 → square,
+  1rem → fully rounded). Previously nothing read `settings.radius`.
+- **Density ("Mật độ") now applies.** `SettingsProvider` sets
+  `data-density="compact"` on `<html>`; `base.css` tightens the global
+  `--spacing` scale (0.25rem → 0.215rem) so every spacing utility packs in
+  compact mode. Previously `useDensity()` was read nowhere.
+- **Inset / floating sidebar no longer renders a harsh frame.** Core's default
+  sidebar is deep navy, and shadcn's inset/floating paints the page frame with
+  that sidebar colour — reading as a broken-looking block. The frame is now the
+  soft `--muted` neutral, so the content floats as a card on a calm page
+  (adapts to dark mode; the rounded-xl + shadow core already applies stay).
+- **Inset / floating collapsed rail no longer looks squeezed.** In icon mode the
+  floating/inset content box is `--sidebar-width-icon + 8px` (56px) but had
+  `px-2.5` padding, leaving the pill only 36px — narrower than the default 48px
+  rail. Reduced to `px-1` so the pill is a comfortable 48px with a 4px floating
+  gutter.
+- **Inset / floating sidebar corners are softened.** The floating panel was
+  `rounded-lg` and the inset panel had NO radius (a sharp navy block whose
+  top-right corner met the header as a hard 90°). Both now use `rounded-xl`
+  (matching the inset content card) so the sidebar reads as a soft floating
+  panel — the header/sidebar junction is a gentle curve, not a rough corner.
+  The floating content area also rounds both left corners
+  (`rounded-l-xl`, clipping the sticky header + footer via overflow-hidden) so
+  its whole left edge hugs the floating sidebar with soft curves; the right
+  edge stays flush to the viewport (inset already rounds via its `rounded-xl`
+  card). Finally, the header's own BOTTOM-left corner is rounded in both
+  variants (base.css: `[data-variant=floating|inset] ~ main > header`), so its
+  divider curves into the left edge instead of ending in a hard inner corner.
+  And the content no longer touches the sidebar: inset drops its `ml-0` (so the
+  uniform `m-2` leaves a left gap) and floating gains `ml-2`, giving a small
+  gap between the sidebar and the content/header.
+- **"Ẩn ngoài" (`collapsible="offcanvas"`) can finally hide the sidebar.**
+  `AppSidebar` force-remapped `offcanvas → icon`, so the option collapsed to an
+  icon rail instead of hiding — identical to "Biểu tượng" and impossible to fully
+  hide the sidebar. The choice is now honoured as-is: offcanvas slides the
+  sidebar off-screen (reopen via the header toggle), icon → rail.
+- **Dropped the "none" (Tắt) collapsible option from the Customizer.** Locking
+  the sidebar expanded made the header collapse-toggle a no-op — a
+  conflicting/dead control. The picker now offers only offcanvas + icon, both of
+  which the toggle actually drives. (`none` remains a valid type for any code
+  that sets it directly; it's just no longer offered in the UI.)
+- **Dropped the "Bố cục" (layout: horizontal/vertical) control from the
+  Customizer.** The horizontal layout swaps the whole nav for a top menubar,
+  which turns every sidebar option ("Kiểu thanh bên", "Thu gọn thanh bên") into
+  a no-op — the same dead-control problem. The customizer now locks to the
+  vertical sidebar the apps are designed around (`defaultSettings.layout` stays
+  `vertical`; `HorizontalLayout` is untouched for code that sets it directly).
+- **Non-collapsing sidebar (`collapsible="none"`) is now readable.** It rendered
+  `bg-sidebar text-sidebar-foreground` (the deep navy), but the group labels +
+  active item are `text-primary`, giving ~1.9:1 contrast (unreadable) on that
+  navy. A non-collapsing sidebar is permanently *expanded*, so it now uses the
+  expanded surface (`bg-background` / `text-foreground`), matching the rest of
+  the design (labels-on-light) — contrast jumps to ~9:1.
 ## 0.1.11 — print: force light colours on the print surface
 - **Fix faded print output in dark mode.** Print pages render under the app's

package/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "name": "@goplusvn/core",
   "description": "GoPlusVN Platform Kit - ERP kernel: layout, RBAC, CRUD, multi-tenant, system pages",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "private": false,
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -36,6 +36,8 @@
     },
     "./assets/*": "./src/assets/*",
     "./styles/*": "./src/styles/*",
+    "./auth/proxy-gate": "./src/auth/proxy-gate.ts",
+    "./ui/shared/table-styles": "./src/ui/shared/table-styles.ts",
     "./errors/app-error": "./src/errors/app-error.ts",
     "./errors/error-handler": "./src/errors/error-handler.ts",
     "./errors/server-error": "./src/errors/server-error.ts",

package/src/auth/proxy-gate.ts ADDED Viewed

@@ -0,0 +1,80 @@
+// @goerp/core/auth/proxy-gate — server-only request-gate for the Next.js
+// proxy/middleware. Default-DENY authentication (authN); route-level authZ still
+// happens via getCrudPermissions/checkPermission. Isolated in its own subpath so
+// `next/server` + `next-auth/jwt` never leak into client bundles via the auth barrel.
+//
+// Usage (app side):
+//   // src/proxy.ts
+//   import { createAuthProxy } from "@goerp/core/auth/proxy-gate";
+//   export const proxy = createAuthProxy({ homePath: "/vi" });
+//   export default proxy;
+//   export const config = { matcher: ["/((?!_next/static|_next/image|favicon.ico|.*\\.[^/]+$).*)"] };
+import { NextResponse } from "next/server";
+import { getToken } from "next-auth/jwt";
+import type { NextRequest } from "next/server";
+export interface AuthProxyOptions {
+  /** API prefixes served without a session (NextAuth + public). Default: /api/auth, /api/public. */
+  publicApiPrefixes?: string[];
+  /** Pages reachable while logged out. Default: /sign-in. */
+  publicPages?: string[];
+  /** Where to send unauthenticated page requests. Default: /sign-in. */
+  signInPath?: string;
+  /** Where to send a logged-in user who hits a guest page. Default: "/". */
+  homePath?: string;
+  /** Override token reader (tests / custom JWT). Default: next-auth getToken. */
+  getToken?: (req: NextRequest) => Promise<unknown | null>;
+}
+const startsWithAny = (pathname: string, list: string[]) =>
+  list.some((p) => pathname === p || pathname.startsWith(`${p}/`));
+export function createAuthProxy(options: AuthProxyOptions = {}) {
+  const publicApiPrefixes = options.publicApiPrefixes ?? ["/api/auth", "/api/public"];
+  const publicPages = options.publicPages ?? ["/sign-in"];
+  const signInPath = options.signInPath ?? "/sign-in";
+  const homePath = options.homePath ?? "/";
+  const readToken = options.getToken ?? ((req: NextRequest) => getToken({ req }));
+  return async function proxy(request: NextRequest) {
+    const { pathname, search } = request.nextUrl;
+    // API routes that authenticate themselves (NextAuth) or are public → pass.
+    if (startsWithAny(pathname, publicApiPrefixes)) return NextResponse.next();
+    const token = await readToken(request);
+    // Guest pages (/sign-in): bounce an already-authed user to home.
+    if (startsWithAny(pathname, publicPages)) {
+      if (token) {
+        const url = request.nextUrl.clone();
+        url.pathname = homePath;
+        url.search = "";
+        return NextResponse.redirect(url);
+      }
+      return NextResponse.next();
+    }
+    // API: default-deny (each route still does its own authZ).
+    if (pathname.startsWith("/api")) {
+      if (!token) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+      return NextResponse.next();
+    }
+    // Pages: must be signed in; preserve callbackUrl.
+    if (!token) {
+      const url = request.nextUrl.clone();
+      url.pathname = signInPath;
+      url.search = "";
+      if (pathname !== "/") url.searchParams.set("callbackUrl", pathname + search);
+      return NextResponse.redirect(url);
+    }
+    return NextResponse.next();
+  };
+}
+/** 401 JSON for API route catch/guard blocks. */
+export function unauthorizedResponse() {
+  return Response.json({ error: "Unauthorized" }, { status: 401 });
+}

package/src/crud/crud-route-handlers.ts ADDED Viewed

@@ -0,0 +1,157 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+// Next.js route-handler factories for the generic CRUD engine. Wires session +
+// RBAC permission gate + entity config + {@link ServerCrudService} so an app's
+// route file is one line:
+//
+//   // src/app/api/crud/[entity]/route.ts
+//   import { createCrudCollectionHandlers } from "@goerp/core/crud/server";
+//   import { getSession } from "@/lib/auth";
+//   import { getEntityConfig } from "@/configs/entities";
+//   import { crudService } from "@/lib/crud";
+//   export const { GET, POST } = createCrudCollectionHandlers({ getSession, getEntityConfig, service: crudService });
+//
+//   // src/app/api/crud/[entity]/[id]/route.ts
+//   export const { GET, PUT, PATCH, DELETE } = createCrudItemHandlers({ getSession, getEntityConfig, service: crudService });
+import type { EntityConfig } from "../types";
+import { getCrudPermissions } from "./lib/permissions";
+import type { ServerCrudService } from "./server-service";
+type MaybePromise<T> = T | Promise<T>;
+export interface CrudHandlerDeps {
+  getSession: () => MaybePromise<any | null>;
+  getEntityConfig: (entity: string) => EntityConfig | undefined;
+  service: ServerCrudService;
+  /** Optional error mapper (e.g. app's serverError). Defaults to a 500 JSON. */
+  onError?: (error: unknown, req: Request) => Response | Promise<Response>;
+}
+const json = (data: unknown, status = 200) =>
+  new Response(JSON.stringify(data), { status, headers: { "content-type": "application/json" } });
+const unauthorized = () => json({ error: "Unauthorized" }, 401);
+const forbidden = () => json({ error: "Forbidden" }, 403);
+const unknownEntity = () => json({ error: "Unknown entity" }, 404);
+async function resolvePerms(session: any, config: EntityConfig, entity: string) {
+  return getCrudPermissions(session, config.permissionResource ?? entity);
+}
+// GET/POST for the collection route `/api/crud/[entity]`.
+export function createCrudCollectionHandlers(deps: CrudHandlerDeps) {
+  const { getSession, getEntityConfig, service, onError } = deps;
+  const fail = (e: unknown, req: Request) =>
+    onError ? onError(e, req) : json({ error: "Internal error" }, 500);
+  async function GET(req: Request, ctx: { params: Promise<{ entity: string }> }) {
+    const { entity } = await ctx.params;
+    try {
+      const session = await getSession();
+      if (!session) return unauthorized();
+      const config = getEntityConfig(entity);
+      if (!config) return unknownEntity();
+      const perms = await resolvePerms(session, config, entity);
+      if (!perms.read) return forbidden();
+      const sp = new URL(req.url).searchParams;
+      const params = {
+        page: parseInt(sp.get("page") || "1", 10),
+        pageSize: parseInt(sp.get("pageSize") || "10", 10),
+        search: sp.get("search") || undefined,
+        sort: sp.get("sortField")
+          ? { field: sp.get("sortField")!, direction: (sp.get("sortDirection") as "asc" | "desc") || "asc" }
+          : undefined,
+        filters: sp.get("filters") ? JSON.parse(sp.get("filters")!) : undefined,
+      };
+      const data = await service.list(entity, config, params as any);
+      return json(data);
+    } catch (e) {
+      return fail(e, req);
+    }
+  }
+  async function POST(req: Request, ctx: { params: Promise<{ entity: string }> }) {
+    const { entity } = await ctx.params;
+    try {
+      const session = await getSession();
+      if (!session) return unauthorized();
+      const config = getEntityConfig(entity);
+      if (!config) return unknownEntity();
+      const perms = await resolvePerms(session, config, entity);
+      if (!perms.create) return forbidden();
+      const body = await req.json();
+      if (Array.isArray(body)) {
+        const results = [];
+        for (const item of body) results.push(await service.create(entity, item, config));
+        return json(results);
+      }
+      return json(await service.create(entity, body, config));
+    } catch (e) {
+      return fail(e, req);
+    }
+  }
+  return { GET, POST };
+}
+// GET/PUT/PATCH/DELETE for the item route `/api/crud/[entity]/[id]`.
+export function createCrudItemHandlers(deps: CrudHandlerDeps) {
+  const { getSession, getEntityConfig, service, onError } = deps;
+  const fail = (e: unknown, req: Request) =>
+    onError ? onError(e, req) : json({ error: "Internal error" }, 500);
+  type Ctx = { params: Promise<{ entity: string; id: string }> };
+  async function GET(req: Request, ctx: Ctx) {
+    const { entity, id } = await ctx.params;
+    try {
+      const session = await getSession();
+      if (!session) return unauthorized();
+      const config = getEntityConfig(entity);
+      if (!config) return unknownEntity();
+      const perms = await resolvePerms(session, config, entity);
+      if (!perms.read) return forbidden();
+      const item = await service.getById(entity, id);
+      if (!item) return json({ error: "Not found" }, 404);
+      return json(item);
+    } catch (e) {
+      return fail(e, req);
+    }
+  }
+  async function PUT(req: Request, ctx: Ctx) {
+    const { entity, id } = await ctx.params;
+    try {
+      const session = await getSession();
+      if (!session) return unauthorized();
+      const config = getEntityConfig(entity);
+      if (!config) return unknownEntity();
+      const perms = await resolvePerms(session, config, entity);
+      if (!perms.update) return forbidden();
+      const body = await req.json();
+      return json(await service.update(entity, id, body, config));
+    } catch (e) {
+      return fail(e, req);
+    }
+  }
+  async function DELETE(req: Request, ctx: Ctx) {
+    const { entity, id } = await ctx.params;
+    try {
+      const session = await getSession();
+      if (!session) return unauthorized();
+      const config = getEntityConfig(entity);
+      if (!config) return unknownEntity();
+      const perms = await resolvePerms(session, config, entity);
+      if (!perms.delete) return forbidden();
+      await service.delete(entity, id);
+      return new Response(null, { status: 204 });
+    } catch (e) {
+      return fail(e, req);
+    }
+  }
+  return { GET, PUT, PATCH: PUT, DELETE };
+}

package/src/crud/server-service.ts ADDED Viewed

@@ -0,0 +1,312 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+// Generic server-side CRUD engine (Prisma-backed) for @goerp/core.
+//
+// Core is schema-agnostic, so this is a FACTORY: the consuming app injects its
+// own Prisma client + entity→model resolver. The engine itself (query building,
+// filter/sort/search allowlist, relation connect/disconnect, Decimal serialize)
+// lives here so every app stops re-implementing it.
+//
+// Usage (app side):
+//   import { createServerCrudService, getModelName } from "@goerp/core/crud/server";
+//   import { prisma } from "@/lib/prisma";
+//   const MODEL_MAP = { customers: "customer", "fee-schedules": "feeSchedule" };
+//   export const crudService = createServerCrudService({
+//     prisma,
+//     getModelName: (e) => getModelName(e, MODEL_MAP),
+//   });
+import type { CrudQueryParams, CrudResponse, EntityConfig } from "../types";
+import { serializeDecimalFields } from "../utils/serialize";
+type PrismaLike = Record<string, any>;
+export interface ServerCrudService {
+  list(entity: string, config: EntityConfig, params: CrudQueryParams): Promise<CrudResponse>;
+  getById(entity: string, id: string): Promise<any>;
+  create(entity: string, data: any, config?: EntityConfig): Promise<any>;
+  update(entity: string, id: string, data: any, config?: EntityConfig): Promise<any>;
+  delete(entity: string, id: string): Promise<any>;
+  deleteMany(entity: string, ids: string[]): Promise<any>;
+}
+export interface ServerCrudLogger {
+  warn(message: string, ...rest: unknown[]): void;
+  error(message: string, ...rest: unknown[]): void;
+}
+export interface ServerCrudDeps {
+  /** The app's PrismaClient instance. */
+  prisma: PrismaLike;
+  /** Resolve a plural entity key → Prisma model name. Defaults to {@link getModelName}. */
+  getModelName?: (entity: string) => string;
+  /** Optional: enrich rows with createdByName/updatedByName. Schema-tolerant — inject
+   *  {@link createAuditUserNameResolver} if your User model exposes a name field. */
+  resolveAuditNames?: (records: any[]) => Promise<any[]>;
+  logger?: ServerCrudLogger;
+}
+const MAX_PAGE_SIZE = 200;
+// Default plural→model resolver: strip trailing "s", camelCase kebab. Apps with
+// irregular names pass a map: getModelName(entity, { "fee-schedules": "feeSchedule" }).
+export function getModelName(entity: string, map?: Record<string, string>): string {
+  if (map && map[entity]) return map[entity];
+  return entity.replace(/s$/, "").replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+}
+// Opt-in audit-name resolver. Overwrites createdByName/updatedByName from a User
+// model. `nameField` handles schema drift (vinhhoa: "name", wu: "fullName").
+export function createAuditUserNameResolver(opts: {
+  prisma: PrismaLike;
+  userModel?: string;
+  nameField?: string;
+}): (records: any[]) => Promise<any[]> {
+  const { prisma, userModel = "user", nameField = "name" } = opts;
+  return async (records: any[]) => {
+    if (!records.length) return records;
+    const ids = new Set<string>();
+    for (const r of records) {
+      if (r?.createdBy) ids.add(r.createdBy);
+      if (r?.updatedBy) ids.add(r.updatedBy);
+    }
+    if (!ids.size) return records;
+    try {
+      const users = await prisma[userModel].findMany({
+        where: { id: { in: Array.from(ids) } },
+        select: { id: true, [nameField]: true },
+      });
+      const nameOf = new Map<string, string>(users.map((u: any) => [u.id, u[nameField] || u.id]));
+      return records.map((r) => ({
+        ...r,
+        createdByName: r.createdBy ? nameOf.get(r.createdBy) ?? r.createdBy : null,
+        updatedByName: r.updatedBy ? nameOf.get(r.updatedBy) ?? r.updatedBy : null,
+      }));
+    } catch {
+      return records;
+    }
+  };
+}
+export function createServerCrudService(deps: ServerCrudDeps): ServerCrudService {
+  const prisma = deps.prisma;
+  const resolveModel = deps.getModelName ?? ((e: string) => getModelName(e));
+  const resolveAuditNames = deps.resolveAuditNames ?? (async (r: any[]) => r);
+  const log: ServerCrudLogger = deps.logger ?? {
+    warn: (m, ...r) => console.warn(m, ...r),
+    error: (m, ...r) => console.error(m, ...r),
+  };
+  const model = (entity: string) => {
+    const name = resolveModel(entity);
+    const m = prisma[name];
+    if (!m) throw new Error(`Prisma model not found for entity: ${entity} (${name})`);
+    return m;
+  };
+  const filterValidFields = (data: any, config: EntityConfig) => {
+    const valid = new Set(config.fields.filter((f) => !(f as any).isDisplayOnly).map((f) => f.name));
+    valid.add("id");
+    const out: Record<string, unknown> = {};
+    for (const [k, v] of Object.entries(data)) {
+      if (valid.has(k)) out[k] = v;
+      else log.warn(`Filtering out invalid field "${k}" for entity "${config.name}"`);
+    }
+    return out;
+  };
+  const castFieldValues = (data: any, config: EntityConfig) => {
+    const out = { ...data };
+    for (const field of config.fields) {
+      const value = out[field.name];
+      if (value === undefined || value === null) continue;
+      if (field.type === "boolean" || field.type === "switch") {
+        let isTrue: boolean;
+        if (typeof value === "string") {
+          const lv = value.toLowerCase();
+          isTrue = lv === "true" || lv === "active" || value === "1" || value === "on";
+        } else isTrue = Boolean(value);
+        if (field.type === "switch" && field.options && field.options.length >= 2) {
+          out[field.name] = isTrue ? (field.options[0] as any).value : (field.options[1] as any).value;
+        } else out[field.name] = isTrue;
+      } else if (field.type === "number" || (field.type as string) === "integer") {
+        if (typeof value === "string") {
+          if (value.trim() === "") out[field.name] = null;
+          else {
+            const num = Number(value);
+            if (!isNaN(num)) out[field.name] = num;
+          }
+        }
+      }
+    }
+    return out;
+  };
+  const transformRelationFields = (data: any, mode: "create" | "update") => {
+    const out = { ...data };
+    const skip = new Set(["id", "createdBy", "updatedBy", "citizenId", "targetId"]);
+    for (const key of Object.keys(out)) {
+      if (skip.has(key)) continue;
+      if (key.endsWith("Id") && key.length > 2) {
+        const rel = key.slice(0, -2);
+        const value = out[key];
+        if (value && typeof value === "string" && value.trim() !== "") {
+          out[rel] = { connect: { id: value } };
+          delete out[key];
+        } else if (value === null || value === undefined || value === "") {
+          if (mode === "update") out[rel] = { disconnect: true };
+          delete out[key];
+        }
+      }
+    }
+    return out;
+  };
+  return {
+    async list(entity, config, params) {
+      const prismaModel = model(entity);
+      const { page = 1, pageSize = 10, search, sort, filters } = params;
+      const safePage = Math.max(1, Number(page) || 1);
+      const safePageSize = Math.min(Math.max(1, Number(pageSize) || 10), MAX_PAGE_SIZE);
+      const skip = (safePage - 1) * safePageSize;
+      const take = safePageSize;
+      const allowedFields = new Set<string>([
+        ...config.fields.map((f) => f.name),
+        "id", "createdAt", "updatedAt", "createdBy", "updatedBy", config.idField || "id",
+      ]);
+      const allowedRelations = new Set<string>(config.include || []);
+      const isAllowed = (name: string) => {
+        if (!name) return false;
+        if (name.includes(".")) return allowedRelations.has(name.split(".")[0]);
+        return allowedFields.has(name);
+      };
+      const where: any = {};
+      if (search && search.trim()) {
+        const term = search.trim();
+        const searchFields = config.fields.filter((f) => f.filterable && f.type === "text").map((f) => f.name);
+        if (searchFields.length) where.OR = searchFields.map((f) => ({ [f]: { contains: term, mode: "insensitive" } }));
+      }
+      if (filters && filters.length) {
+        for (const filter of filters) {
+          const { name, value, operator } = filter as any;
+          if (value === undefined || value === null || (Array.isArray(value) && value.length === 0)) continue;
+          if (!isAllowed(name)) {
+            log.warn(`Ignoring filter on disallowed field "${name}" for entity "${entity}"`);
+            continue;
+          }
+          let target = where;
+          let key = name;
+          if (name.includes(".")) {
+            const parts = name.split(".");
+            key = parts.pop()!;
+            for (const p of parts) { if (!target[p]) target[p] = {}; target = target[p]; }
+          }
+          const op = operator as string;
+          if (op === "contains") target[key] = { contains: value, mode: "insensitive" };
+          else if (op === "in") target[key] = { in: value };
+          else if (op === "notIn") target[key] = { notIn: value };
+          else if (op === "eq") target[key] = value;
+          else if (op === "ne") target[key] = { not: value };
+          else if (op === "gt") target[key] = { gt: value };
+          else if (op === "gte") target[key] = { gte: value };
+          else if (op === "lt") target[key] = { lt: value };
+          else if (op === "lte") target[key] = { lte: value };
+          else if (op === "startsWith") target[key] = { startsWith: value, mode: "insensitive" };
+          else if (op === "endsWith") target[key] = { endsWith: value, mode: "insensitive" };
+          else if (op === "isNull") target[key] = null;
+          else if (op === "isNotNull") target[key] = { not: null };
+          else target[key] = value;
+        }
+      }
+      const orderBy: any = {};
+      const applySort = (field: string, direction: any) => {
+        if (field.includes(".")) {
+          const parts = field.split(".");
+          const leaf = parts.pop()!;
+          let t = orderBy;
+          for (const p of parts) { t[p] = t[p] || {}; t = t[p]; }
+          t[leaf] = direction;
+        } else orderBy[field] = direction;
+      };
+      if (sort && isAllowed(sort.field)) applySort(sort.field, sort.direction);
+      else if (config.defaultSort) applySort(config.defaultSort.field, config.defaultSort.direction);
+      else if (config.fields.some((f) => f.name === "createdAt")) orderBy.createdAt = "desc";
+      else orderBy[config.idField || "id"] = "desc";
+      const include: any = {};
+      if (config.include?.length) config.include.forEach((inc) => (include[inc] = true));
+      const includeOption = Object.keys(include).length ? { include } : {};
+      try {
+        const [total, data] = await Promise.all([
+          prismaModel.count({ where }),
+          prismaModel.findMany({ where, orderBy, skip, take, ...includeOption }),
+        ]);
+        const serialized = serializeDecimalFields(data);
+        const resolved = await resolveAuditNames(serialized as any[]);
+        return { data: resolved, total, page: safePage, pageSize: safePageSize } as CrudResponse;
+      } catch (error) {
+        log.error(`Error listing ${entity}:`, error);
+        throw error;
+      }
+    },
+    async getById(entity, id) {
+      const prismaModel = model(entity);
+      const result = await prismaModel.findUnique({ where: { id } });
+      if (!result) return null;
+      const serialized = serializeDecimalFields(result);
+      const [resolved] = await resolveAuditNames([serialized]);
+      return resolved;
+    },
+    async create(entity, data, config) {
+      const prismaModel = model(entity);
+      try {
+        let filtered = config ? filterValidFields(data, config) : data;
+        if (config) filtered = castFieldValues(filtered, config);
+        if (!filtered.id) filtered.id = crypto.randomUUID();
+        const prismaData = transformRelationFields(filtered, "create");
+        return serializeDecimalFields(await prismaModel.create({ data: prismaData }));
+      } catch (error) {
+        log.error(`Error creating ${entity}:`, error);
+        throw error;
+      }
+    },
+    async update(entity, id, data, config) {
+      const prismaModel = model(entity);
+      try {
+        let filtered = config ? filterValidFields(data, config) : data;
+        if (config) filtered = castFieldValues(filtered, config);
+        const prismaData = transformRelationFields(filtered, "update");
+        return serializeDecimalFields(await prismaModel.update({ where: { id }, data: prismaData }));
+      } catch (error) {
+        log.error(`Error updating ${entity}:`, error);
+        throw error;
+      }
+    },
+    async delete(entity, id) {
+      const prismaModel = model(entity);
+      try {
+        return await prismaModel.delete({ where: { id } });
+      } catch (error) {
+        log.error(`Error deleting ${entity}:`, error);
+        throw error;
+      }
+    },
+    async deleteMany(entity, ids) {
+      const prismaModel = model(entity);
+      try {
+        return await prismaModel.deleteMany({ where: { id: { in: ids } } });
+      } catch (error) {
+        log.error(`Error deleting many ${entity}:`, error);
+        throw error;
+      }
+    },
+  };
+}

package/src/crud/server.ts CHANGED Viewed

@@ -6,3 +6,21 @@ export {
   getCrudPermissions,
   mergePermissions,
 } from './lib/permissions'
+// Generic Prisma-backed CRUD engine + Next.js route-handler factories.
+// Apps inject their PrismaClient + entity→model map; the engine lives in core.
+export {
+  createServerCrudService,
+  getModelName,
+  createAuditUserNameResolver,
+} from './server-service'
+export type {
+  ServerCrudService,
+  ServerCrudDeps,
+  ServerCrudLogger,
+} from './server-service'
+export {
+  createCrudCollectionHandlers,
+  createCrudItemHandlers,
+} from './crud-route-handlers'
+export type { CrudHandlerDeps } from './crud-route-handlers'