@goplusvn/core 0.1.44 → 0.1.45

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@goplusvn/core",
   "description": "GoPlusVN Platform Kit - ERP kernel: layout, RBAC, CRUD, multi-tenant, system pages",
-  "version": "0.1.44",
+  "version": "0.1.45",
   "private": false,
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -158,7 +158,7 @@
     "swr": "^2.3.6",
     "tailwind-merge": "2.5.2",
     "vaul": "1.1.2",
-    "xlsx": "0.18.5",
+    "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
     "zod": "3.23.8"
   },
   "scripts": {

package/src/auth/proxy-gate.ts

@@ -11,7 +11,6 @@
 //   export const config = { matcher: ["/((?!_next/static|_next/image|favicon.ico|.*\\.[^/]+$).*)"] };
 
 import { NextResponse } from "next/server";
-import { getToken } from "next-auth/jwt";
 import type { NextRequest } from "next/server";
 
 export interface AuthProxyOptions {
@@ -35,7 +34,16 @@ export function createAuthProxy(options: AuthProxyOptions = {}) {
   const publicPages = options.publicPages ?? ["/sign-in"];
   const signInPath = options.signInPath ?? "/sign-in";
   const homePath = options.homePath ?? "/";
-  const readToken = options.getToken ?? ((req: NextRequest) => getToken({ req }));
+  // next-auth chỉ được LAZY-load khi app không truyền getToken riêng — app đã
+  // sang Better Auth (không cài next-auth) sẽ không dính module-not-found lúc
+  // import proxy-gate (trước đây import top-level, next-auth lại chỉ nằm ở
+  // devDependencies của core).
+  const readToken =
+    options.getToken ??
+    (async (req: NextRequest) => {
+      const { getToken } = await import("next-auth/jwt");
+      return getToken({ req });
+    });
 
   return async function proxy(request: NextRequest) {
     const { pathname, search } = request.nextUrl;

package/src/crud/crud-route-handlers.ts

@@ -22,11 +22,25 @@ type MaybePromise<T> = T | Promise<T>;
 export interface CrudHandlerDeps {
   getSession: () => MaybePromise<any | null>;
   getEntityConfig: (entity: string) => EntityConfig | undefined;
-  service: ServerCrudService;
+  /** Một service dùng chung, HOẶC resolver theo entity — app có service
+   *  chuyên biệt (auto-gen số phiếu, stock-count…) trả service riêng cho
+   *  entity đó thay vì viết factory if-chain ngoài core (seam 2026-07). */
+  service:
+    | ServerCrudService
+    | ((entity: string) => MaybePromise<ServerCrudService>);
   /** Optional error mapper (e.g. app's serverError). Defaults to a 500 JSON. */
   onError?: (error: unknown, req: Request) => Response | Promise<Response>;
 }
 
+function makeServiceResolver(
+  service: CrudHandlerDeps["service"],
+): (entity: string) => Promise<ServerCrudService> {
+  if (typeof service === "function") {
+    return async (entity) => await service(entity);
+  }
+  return async () => service;
+}
+
 const json = (data: unknown, status = 200) =>
   new Response(JSON.stringify(data), { status, headers: { "content-type": "application/json" } });
 
@@ -40,7 +54,8 @@ async function resolvePerms(session: any, config: EntityConfig, entity: string)
 
 // GET/POST for the collection route `/api/crud/[entity]`.
 export function createCrudCollectionHandlers(deps: CrudHandlerDeps) {
-  const { getSession, getEntityConfig, service, onError } = deps;
+  const { getSession, getEntityConfig, onError } = deps;
+  const resolveService = makeServiceResolver(deps.service);
   const fail = (e: unknown, req: Request) =>
     onError ? onError(e, req) : json({ error: "Internal error" }, 500);
 
@@ -64,6 +79,7 @@ export function createCrudCollectionHandlers(deps: CrudHandlerDeps) {
           : undefined,
         filters: sp.get("filters") ? JSON.parse(sp.get("filters")!) : undefined,
       };
+      const service = await resolveService(entity);
       const data = await service.list(entity, config, params as any);
       return json(data);
     } catch (e) {
@@ -82,6 +98,7 @@ export function createCrudCollectionHandlers(deps: CrudHandlerDeps) {
       if (!perms.create) return forbidden();
 
       const body = await req.json();
+      const service = await resolveService(entity);
       if (Array.isArray(body)) {
         const results = [];
         for (const item of body) results.push(await service.create(entity, item, config));
@@ -98,7 +115,8 @@ export function createCrudCollectionHandlers(deps: CrudHandlerDeps) {
 
 // GET/PUT/PATCH/DELETE for the item route `/api/crud/[entity]/[id]`.
 export function createCrudItemHandlers(deps: CrudHandlerDeps) {
-  const { getSession, getEntityConfig, service, onError } = deps;
+  const { getSession, getEntityConfig, onError } = deps;
+  const resolveService = makeServiceResolver(deps.service);
   const fail = (e: unknown, req: Request) =>
     onError ? onError(e, req) : json({ error: "Internal error" }, 500);
 
@@ -113,7 +131,9 @@ export function createCrudItemHandlers(deps: CrudHandlerDeps) {
       if (!config) return unknownEntity();
       const perms = await resolvePerms(session, config, entity);
       if (!perms.read) return forbidden();
-      const item = await service.getById(entity, id);
+      const service = await resolveService(entity);
+      // Truyền config để detail áp cùng include như list (label thay raw FK id).
+      const item = await service.getById(entity, id, config);
       if (!item) return json({ error: "Not found" }, 404);
       return json(item);
     } catch (e) {
@@ -131,6 +151,7 @@ export function createCrudItemHandlers(deps: CrudHandlerDeps) {
       const perms = await resolvePerms(session, config, entity);
       if (!perms.update) return forbidden();
       const body = await req.json();
+      const service = await resolveService(entity);
       return json(await service.update(entity, id, body, config));
     } catch (e) {
       return fail(e, req);
@@ -146,6 +167,7 @@ export function createCrudItemHandlers(deps: CrudHandlerDeps) {
       if (!config) return unknownEntity();
       const perms = await resolvePerms(session, config, entity);
       if (!perms.delete) return forbidden();
+      const service = await resolveService(entity);
       await service.delete(entity, id);
       return new Response(null, { status: 204 });
     } catch (e) {

package/src/crud/lib/permissions.ts

@@ -1,7 +1,10 @@
 import type { CrudPermissions, EntityConfig } from "../../types";
 import type { Session } from "../../types";
 
-import { getCrudPermissionsFromSession } from "../../rbac/permissions";
+// Nguồn permission DUY NHẤT đã harden (BYPASS_AUTH chỉ hiệu lực ngoài
+// production, admin-role check chạy trước empty-permissions guard) — bản
+// divergent rbac/permissions.ts cũ đã xóa 2026-07 vì thiếu guard NODE_ENV.
+import { getCrudPermissionsFromSession } from "../../auth";
 
 /**
  * Get CRUD permissions for a user based on their session

package/src/crud/server-service.ts

@@ -22,9 +22,12 @@ type PrismaLike = Record<string, any>;
 
 export interface ServerCrudService {
   list(entity: string, config: EntityConfig, params: CrudQueryParams): Promise<CrudResponse>;
-  getById(entity: string, id: string): Promise<any>;
-  create(entity: string, data: any, config?: EntityConfig): Promise<any>;
-  update(entity: string, id: string, data: any, config?: EntityConfig): Promise<any>;
+  /** `config` (tùy chọn) để áp cùng `include` như list — detail không hiện raw FK id. */
+  getById(entity: string, id: string, config?: EntityConfig): Promise<any>;
+  /** `tx` (tùy chọn) để app chạy create CÙNG transaction với sinh số phiếu
+   *  advisory-lock (document-number yêu cầu cùng tx với insert). */
+  create(entity: string, data: any, config?: EntityConfig, tx?: PrismaLike): Promise<any>;
+  update(entity: string, id: string, data: any, config?: EntityConfig, tx?: PrismaLike): Promise<any>;
   delete(entity: string, id: string): Promise<any>;
   deleteMany(entity: string, ids: string[]): Promise<any>;
 }
@@ -43,8 +46,35 @@ export interface ServerCrudDeps {
    *  {@link createAuditUserNameResolver} if your User model exposes a name field. */
   resolveAuditNames?: (records: any[]) => Promise<any[]>;
   logger?: ServerCrudLogger;
+
+  // ── Seams 2026-07: đủ điểm cắm để app KHÔNG phải fork nguyên engine ──
+
+  /** WHERE mặc định theo entity, AND vào mọi list/count — vd 2 entity chia
+   *  chung 1 model: stock-in → { type: "in" }, stock-out → { type: "out" }. */
+  scopeWhere?: (
+    entity: string,
+    config: EntityConfig,
+  ) => Record<string, unknown> | undefined;
+  /** Field hệ thống luôn cho qua filterValidFields dù không khai trong
+   *  config.fields. Default: id + bộ audit (createdAt/updatedAt/createdBy/
+   *  updatedBy). App có cột riêng (companyId…) thì truyền thêm. */
+  systemFields?: string[];
+  /** Set updatedAt = new Date() khi create nếu payload chưa có — cho model
+   *  thiếu `@updatedAt`/default trong schema. Default: false. */
+  touchUpdatedAtOnCreate?: boolean;
+  /** Các cột `*Id` KHÔNG phải FK — bỏ qua transform connect/disconnect
+   *  (scalar như số CCCD, mã tra cứu…). Gộp thêm vào skip-list mặc định. */
+  relationFieldSkip?: string[];
 }
 
+const DEFAULT_SYSTEM_FIELDS = [
+  "id",
+  "createdAt",
+  "updatedAt",
+  "createdBy",
+  "updatedBy",
+];
+
 const MAX_PAGE_SIZE = 200;
 
 // Default plural→model resolver: strip trailing "s", camelCase kebab. Apps with
@@ -96,16 +126,18 @@ export function createServerCrudService(deps: ServerCrudDeps): ServerCrudService
     error: (m, ...r) => console.error(m, ...r),
   };
 
-  const model = (entity: string) => {
+  const systemFields = deps.systemFields ?? DEFAULT_SYSTEM_FIELDS;
+
+  const model = (entity: string, client: PrismaLike = prisma) => {
     const name = resolveModel(entity);
-    const m = prisma[name];
+    const m = client[name];
     if (!m) throw new Error(`Prisma model not found for entity: ${entity} (${name})`);
     return m;
   };
 
   const filterValidFields = (data: any, config: EntityConfig) => {
     const valid = new Set(config.fields.filter((f) => !(f as any).isDisplayOnly).map((f) => f.name));
-    valid.add("id");
+    for (const f of systemFields) valid.add(f);
     const out: Record<string, unknown> = {};
     for (const [k, v] of Object.entries(data)) {
       if (valid.has(k)) out[k] = v;
@@ -143,7 +175,16 @@ export function createServerCrudService(deps: ServerCrudDeps): ServerCrudService
 
   const transformRelationFields = (data: any, mode: "create" | "update") => {
     const out = { ...data };
-    const skip = new Set(["id", "createdBy", "updatedBy", "citizenId", "targetId"]);
+    // citizenId/targetId là legacy-default từ consumer đầu tiên — app mới khai
+    // cột scalar *Id của mình qua deps.relationFieldSkip thay vì sửa core.
+    const skip = new Set([
+      "id",
+      "createdBy",
+      "updatedBy",
+      "citizenId",
+      "targetId",
+      ...(deps.relationFieldSkip ?? []),
+    ]);
     for (const key of Object.keys(out)) {
       if (skip.has(key)) continue;
       if (key.endsWith("Id") && key.length > 2) {
@@ -181,7 +222,7 @@ export function createServerCrudService(deps: ServerCrudDeps): ServerCrudService
         return allowedFields.has(name);
       };
 
-      const where: any = {};
+      const where: any = { ...(deps.scopeWhere?.(entity, config) ?? {}) };
       if (search && search.trim()) {
         const term = search.trim();
         const searchFields = config.fields.filter((f) => f.filterable && f.type === "text").map((f) => f.name);
@@ -253,21 +294,28 @@ export function createServerCrudService(deps: ServerCrudDeps): ServerCrudService
       }
     },
 
-    async getById(entity, id) {
+    async getById(entity, id, config) {
       const prismaModel = model(entity);
-      const result = await prismaModel.findUnique({ where: { id } });
+      // Áp cùng include như list — detail dialog hiện label relation thay raw FK id.
+      const include: any = {};
+      if (config?.include?.length) config.include.forEach((inc) => (include[inc] = true));
+      const includeOption = Object.keys(include).length ? { include } : {};
+      const result = await prismaModel.findUnique({ where: { id }, ...includeOption });
       if (!result) return null;
       const serialized = serializeDecimalFields(result);
       const [resolved] = await resolveAuditNames([serialized]);
       return resolved;
     },
 
-    async create(entity, data, config) {
-      const prismaModel = model(entity);
+    async create(entity, data, config, tx) {
+      const prismaModel = model(entity, tx ?? prisma);
       try {
         let filtered = config ? filterValidFields(data, config) : data;
         if (config) filtered = castFieldValues(filtered, config);
         if (!filtered.id) filtered.id = crypto.randomUUID();
+        if (deps.touchUpdatedAtOnCreate && !filtered.updatedAt) {
+          filtered.updatedAt = new Date();
+        }
         const prismaData = transformRelationFields(filtered, "create");
         return serializeDecimalFields(await prismaModel.create({ data: prismaData }));
       } catch (error) {
@@ -276,8 +324,8 @@ export function createServerCrudService(deps: ServerCrudDeps): ServerCrudService
       }
     },
 
-    async update(entity, id, data, config) {
-      const prismaModel = model(entity);
+    async update(entity, id, data, config, tx) {
+      const prismaModel = model(entity, tx ?? prisma);
       try {
         let filtered = config ? filterValidFields(data, config) : data;
         if (config) filtered = castFieldValues(filtered, config);

package/src/errors/error-handler.ts

@@ -17,11 +17,27 @@ import { AppError, toAppError } from "./app-error"
  */
 export async function withErrorHandler(
     handler: () => Promise<Response>,
-    options?: { operation?: string; req?: NextRequest | Request }
+    options?: {
+        operation?: string
+        req?: NextRequest | Request
+        /**
+         * Seam persist lỗi (2026-07): mặc định chỉ console.error — lỗi KHÔNG
+         * vào error_logs. App truyền `onError: (e, req) => serverError(e, req)`
+         * (buildServerError ở ./server-error) để lỗi được lưu bền + giữ nguyên
+         * shape response (cả hai cùng kết thúc bằng createErrorResponse).
+         */
+        onError?: (
+            error: unknown,
+            req?: NextRequest | Request
+        ) => Response | Promise<Response>
+    }
 ): Promise<Response> {
     try {
         return await handler()
     } catch (error) {
+        if (options?.onError) {
+            return options.onError(error, options.req)
+        }
         const appError = toAppError(error)
 
         const requestContext = options?.req

package/src/errors/server-error.ts

@@ -1,5 +1,4 @@
 import type { NextResponse } from "next/server"
-import { createHash } from "crypto"
 
 import { AppError, toAppError } from "./app-error"
 import { createErrorResponse } from "./error-handler"
@@ -68,7 +67,24 @@ function buildFingerprint(
     /* keep raw */
   }
   const raw = [message.slice(0, 200), code || "", moduleTag || "", path].join("|")
-  return createHash("sha256").update(raw).digest("hex").slice(0, 16)
+  return fingerprint16(raw)
+}
+
+/**
+ * Fingerprint 16 hex để GOM NHÓM lỗi — không phải mật mã học. FNV-1a thuần
+ * (không import "crypto" của Node) vì error path bị instrumentation/proxy kéo
+ * vào Edge bundle, nơi không có module crypto (2026-07: dev webpack vỡ vì
+ * import node:crypto ở file này).
+ */
+function fingerprint16(raw: string): string {
+  let h1 = 0x811c9dc5
+  let h2 = 0xcbf29ce4
+  for (let i = 0; i < raw.length; i++) {
+    const c = raw.charCodeAt(i)
+    h1 = Math.imul(h1 ^ c, 0x01000193) >>> 0
+    h2 = Math.imul(h2 ^ ((c << 1) | 1), 0x01000193) >>> 0
+  }
+  return h1.toString(16).padStart(8, "0") + h2.toString(16).padStart(8, "0")
 }
 
 /**

package/src/system/services/settings-service.ts

@@ -1,8 +1,54 @@
-const db: any = { systemConfig: { findUnique: async () => null, upsert: async () => null } }; // Mocked for build
-
 import { cache } from "react";
 import { revalidateTag, unstable_cache } from "next/cache";
 
+/**
+ * DB được INJECT từ app (core không import prisma client cụ thể). Trước
+ * 2026-07 chỗ này là `const db: any = {...} // Mocked for build` — mọi
+ * getSettings âm thầm trả default và saveSettings ghi vào hư không (gốc của
+ * regression "settings admin chỉnh không ăn"). App gọi
+ * `configureSettingsService(db)` MỘT lần ở composition root (cạnh chỗ tạo
+ * prisma client).
+ */
+// Structural + schema-agnostic (giống PrismaLike ở crud/server-service): args
+// để lỏng vì generated types của Prisma mỗi app một khác — chỉ chốt shape trả
+// về mà service thật sự đọc.
+export interface SettingsDb {
+  systemConfig: {
+    findUnique(args: any): Promise<{ value: string | null } | null>;
+    upsert(args: any): Promise<unknown>;
+  };
+}
+
+let configuredDb: SettingsDb | null = null;
+let warnedMissingDb = false;
+
+export function configureSettingsService(db: SettingsDb): void {
+  configuredDb = db;
+}
+
+/** Đọc: thiếu db → cảnh báo TO (một lần) + trả default — không sập build/SSR. */
+function dbForRead(): SettingsDb | null {
+  if (configuredDb) return configuredDb;
+  if (!warnedMissingDb) {
+    warnedMissingDb = true;
+    console.warn(
+      "[SettingsService] Chưa configureSettingsService(db) — mọi getSettings " +
+        "đang trả DEFAULT (setting admin chỉnh sẽ không có hiệu lực). " +
+        "Gọi configureSettingsService(db) ở composition root của app.",
+    );
+  }
+  return null;
+}
+
+/** Ghi: thiếu db → THROW. Ghi-vào-hư-không tệ hơn lỗi ồn ào. */
+function dbForWrite(): SettingsDb {
+  if (configuredDb) return configuredDb;
+  throw new Error(
+    "[SettingsService] saveSettings cần configureSettingsService(db) — " +
+      "từ chối ghi vào hư không (trước đây mock db nuốt mất dữ liệu).",
+  );
+}
+
 export interface AuditSettings {
   retentionDays: number;
   enabledResources: string[];
@@ -52,6 +98,8 @@ const DEFAULT_SALES_RULES_SETTINGS: SalesRulesSettings = {
 export class SettingsService {
   /** Get all settings cached */
   static async getSettings<T>(key: string, defaultValue: T): Promise<T> {
+    const db = dbForRead();
+    if (!db) return defaultValue;
     return unstable_cache(
       async () => {
         const config = await db.systemConfig.findUnique({
@@ -88,6 +136,7 @@ export class SettingsService {
     value: T,
     category = "general",
   ): Promise<void> {
+    const db = dbForWrite();
     await db.systemConfig.upsert({
       where: { key },
       update: {

package/src/rbac/permissions.ts

@@ -1,134 +0,0 @@
-// @goerp/core/rbac/permissions
-// Server-only permission utilities - no client/UI imports
-// Use this in Server Components and API routes to avoid bundling client code
-
-import type { Permission, Session } from "../types";
-
-// ============================================================================
-// Action Mapping
-// ============================================================================
-
-export const CRUD_ACTIONS = {
-  create: "create",
-  view: "view",
-  update: "update",
-  delete: "delete",
-  export: "export",
-  import: "import",
-  approve: "approve",
-  reject: "reject",
-} as const;
-
-export type CrudAction = keyof typeof CRUD_ACTIONS;
-
-export function getActionCode(operation: CrudAction): string {
-  return CRUD_ACTIONS[operation];
-}
-
-// ============================================================================
-// Permission Helpers
-// ============================================================================
-
-interface ExtendedUser {
-  id: string;
-  name?: string | null;
-  email?: string | null;
-  image?: string | null;
-  roles?: string[];
-  permissions?: Permission[];
-}
-
-const BYPASS_AUTH =
-  process.env.BYPASS_AUTH === "true" || process.env.BYPASS_AUTH === "1";
-
-const ADMIN_ROLE_CODES = ["admin", "SUPER_ADMIN"];
-
-export function getCrudPermissionsFromSession(
-  session: Session | null,
-  entity: string,
-): {
-  create: boolean;
-  view: boolean;
-  update: boolean;
-  delete: boolean;
-  export: boolean;
-  import: boolean;
-  approve: boolean;
-  reject: boolean;
-} {
-  if (BYPASS_AUTH) {
-    return {
-      create: true,
-      view: true,
-      update: true,
-      delete: true,
-      export: true,
-      import: true,
-      approve: true,
-      reject: true,
-    };
-  }
-
-  if (!session?.user) {
-    return {
-      create: false,
-      view: false,
-      update: false,
-      delete: false,
-      export: false,
-      import: false,
-      approve: false,
-      reject: false,
-    };
-  }
-
-  const user = session.user as ExtendedUser;
-
-  if (!user.id) {
-    return {
-      create: false,
-      view: false,
-      update: false,
-      delete: false,
-      export: false,
-      import: false,
-      approve: false,
-      reject: false,
-    };
-  }
-
-  const isAdmin = user.roles?.some((role) => ADMIN_ROLE_CODES.includes(role));
-  if (isAdmin) {
-    return {
-      create: true,
-      view: true,
-      update: true,
-      delete: true,
-      export: true,
-      import: true,
-      approve: true,
-      reject: true,
-    };
-  }
-
-  const permissions = user.permissions || [];
-  const permissionKeys = new Set(
-    permissions.map((p) => `${p.resourceCode}:${p.actionCode}`),
-  );
-
-  const hasPermission = (action: string) => {
-    const key = `${entity}:${action}`;
-    return permissionKeys.has(key);
-  };
-
-  return {
-    create: hasPermission(getActionCode("create")),
-    view: hasPermission(getActionCode("view")),
-    update: hasPermission(getActionCode("update")),
-    delete: hasPermission(getActionCode("delete")),
-    export: hasPermission(getActionCode("export")),
-    import: hasPermission(getActionCode("import")),
-    approve: hasPermission(getActionCode("approve")),
-    reject: hasPermission(getActionCode("reject")),
-  };
-}