@goplusvn/core 0.1.70 → 0.1.72

package/src/crud/lib/import-request.ts

@@ -0,0 +1,99 @@
+import type { EntityConfig, FieldConfig, ImportOptions } from "../../types";
+
+import { parseFile } from "./import-export-service";
+
+/**
+ * Đọc body của một route import ở CẢ HAI dạng client đang tồn tại:
+ *
+ *  - multipart FormData `{file, format}` — ImportDialog của core gửi lên
+ *    (file xlsx/csv/json parse ngay tại server bằng parseFile);
+ *  - JSON array — đường cũ: client tự parse Excel rồi POST thẳng mảng dòng.
+ *
+ * Sau khi parse, header mỗi dòng được dịch về TÊN CỘT DB, nhận cả 3 kiểu:
+ * header legacy khai tường minh (`legacyHeaders`, vd tiếng Việt của file mẫu
+ * hệ cũ), label khai trong EntityConfig (file mẫu do ImportDialog sinh dùng
+ * label) và tên cột máy. Cột không khớp mapping nào bị bỏ qua.
+ *
+ * Trả `null` khi body không đọc được thành mảng dòng (thiếu file, JSON không
+ * phải array…) — caller trả 400.
+ */
+export async function readImportRows(
+  req: Request,
+  config: EntityConfig,
+  legacyHeaders: Record<string, string> = {},
+): Promise<Record<string, unknown>[] | null> {
+  const contentType = req.headers.get("content-type") ?? "";
+  let rawRows: unknown;
+
+  if (contentType.includes("multipart/form-data")) {
+    const form = await req.formData();
+    // Duck-type thay vì `instanceof File` — File có thể đến từ realm khác
+    // (undici vs jsdom/global) và instanceof xuyên realm luôn false.
+    const file = form.get("file") as File | string | null;
+    if (file === null || typeof file === "string") return null;
+    const formatField = form.get("format");
+    const format =
+      formatField === "csv" || formatField === "json" || formatField === "xlsx"
+        ? formatField
+        : inferFormat(file.name);
+    rawRows = await parseFile(file, format);
+  } else {
+    try {
+      rawRows = await req.json();
+    } catch {
+      return null;
+    }
+  }
+
+  if (!Array.isArray(rawRows)) return null;
+
+  // Header legacy khai tường minh thắng trước; label/tên cột từ config bù sau.
+  const headerToColumn: Record<string, string> = { ...legacyHeaders };
+  for (const field of config.fields) {
+    headerToColumn[field.name] ??= field.name;
+    headerToColumn[field.label] ??= field.name;
+  }
+
+  return rawRows.map((row) => {
+    const out: Record<string, unknown> = {};
+    for (const [key, value] of Object.entries(row as Record<string, unknown>)) {
+      const column = headerToColumn[key.trim()];
+      if (column) out[column] = value;
+    }
+    return out;
+  });
+}
+
+function inferFormat(fileName: string): ImportOptions["format"] {
+  const name = fileName.toLowerCase();
+  if (name.endsWith(".csv")) return "csv";
+  if (name.endsWith(".json")) return "json";
+  return "xlsx";
+}
+
+/**
+ * Ép ô boolean từ file import: nhận boolean thật (đường JSON cũ), chuỗi
+ * true/false/1/0/x…, và cả LABEL của option boolean trong config ("Đang làm
+ * việc", "Ngừng bán"…). Không nhận diện được → undefined (để zod default lo).
+ */
+export function coerceBooleanCell(
+  value: unknown,
+  field?: FieldConfig,
+): boolean | undefined {
+  if (typeof value === "boolean") return value;
+  if (value === undefined || value === null || value === "") return undefined;
+  const v = String(value).trim().toLowerCase();
+  if (["true", "1", "yes", "y", "x", "có", "co"].includes(v)) return true;
+  if (["false", "0", "no", "n", "không", "khong"].includes(v)) return false;
+  for (const opt of field?.options ?? []) {
+    if (
+      typeof opt === "object" &&
+      opt !== null &&
+      typeof opt.value === "boolean" &&
+      String(opt.label).trim().toLowerCase() === v
+    ) {
+      return opt.value;
+    }
+  }
+  return undefined;
+}

package/src/crud/lib/mutation-builder.test.ts

@@ -0,0 +1,114 @@
+import { describe, it, expect, vi } from "vitest";
+import { prepareMutationData } from "./mutation-builder";
+import type { EntityConfig } from "../../types";
+
+const logger = { warn: vi.fn(), error: vi.fn() };
+const SYSTEM_FIELDS = ["id", "createdAt", "updatedAt", "createdBy", "updatedBy"];
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+const makeConfig = (over: Partial<EntityConfig> = {}): EntityConfig => ({
+  name: "job-title",
+  label: "Chức danh",
+  pluralLabel: "Chức danh",
+  apiEndpoint: "/api/crud/job-titles",
+  idField: "id",
+  displayField: "name",
+  fields: [
+    { name: "id", label: "ID", type: "text" },
+    { name: "name", label: "Tên", type: "text" },
+    { name: "level", label: "Cấp", type: "number" },
+    { name: "active", label: "Kích hoạt", type: "boolean" },
+    { name: "departmentId", label: "Phòng ban", type: "select" },
+  ],
+  ...over,
+});
+
+const prepare = (
+  data: Record<string, unknown>,
+  mode: "create" | "update",
+  config?: EntityConfig,
+) => prepareMutationData({ data, config, mode, systemFields: SYSTEM_FIELDS, logger });
+
+describe("prepareMutationData", () => {
+  describe("id theo idKind", () => {
+    it('idKind mặc định ("string"): create thiếu id thì sinh UUID', () => {
+      const out = prepare({ name: "A" }, "create", makeConfig());
+      expect(out.id).toMatch(UUID_RE);
+    });
+
+    it("không có config: giữ hành vi cũ, vẫn sinh UUID", () => {
+      const out = prepare({ name: "A" }, "create");
+      expect(out.id).toMatch(UUID_RE);
+    });
+
+    it("idKind int: KHÔNG BAO GIỜ sinh id (DB autoincrement)", () => {
+      const out = prepare({ name: "A" }, "create", makeConfig({ idKind: "int" }));
+      expect("id" in out).toBe(false);
+    });
+
+    it('idKind int: id rỗng "" từ form bị bỏ hẳn key', () => {
+      const out = prepare({ id: "", name: "A" }, "create", makeConfig({ idKind: "int" }));
+      expect("id" in out).toBe(false);
+    });
+
+    it("idKind int: id chuỗi số được ép Number", () => {
+      const out = prepare({ id: "12", name: "A" }, "create", makeConfig({ idKind: "int" }));
+      expect(out.id).toBe(12);
+    });
+
+    it("idField tùy biến: sinh UUID vào đúng cột id của entity", () => {
+      const config = makeConfig({
+        idField: "code",
+        fields: [
+          { name: "code", label: "Mã", type: "text" },
+          { name: "name", label: "Tên", type: "text" },
+        ],
+      });
+      const out = prepare({ name: "A" }, "create", config);
+      expect(out.code).toMatch(UUID_RE);
+      expect("id" in out).toBe(false);
+    });
+  });
+
+  describe("coercion theo config.fields", () => {
+    it("ép number/boolean từ chuỗi form", () => {
+      const out = prepare(
+        { name: "A", level: "5", active: "true" },
+        "create",
+        makeConfig(),
+      );
+      expect(out.level).toBe(5);
+      expect(out.active).toBe(true);
+    });
+
+    it("lọc field ngoài config kèm cảnh báo", () => {
+      const out = prepare({ name: "A", hacker: "x" }, "create", makeConfig());
+      expect("hacker" in out).toBe(false);
+      expect(logger.warn).toHaveBeenCalled();
+    });
+  });
+
+  describe("empty-string FK", () => {
+    it('create: departmentId "" bị bỏ, không connect', () => {
+      const out = prepare({ name: "A", departmentId: "" }, "create", makeConfig());
+      expect("departmentId" in out).toBe(false);
+      expect("department" in out).toBe(false);
+    });
+
+    it('update: departmentId "" → disconnect relation', () => {
+      const out = prepare({ name: "A", departmentId: "" }, "update", makeConfig());
+      expect("departmentId" in out).toBe(false);
+      expect(out.department).toEqual({ disconnect: true });
+    });
+
+    it("departmentId có giá trị → connect", () => {
+      const out = prepare(
+        { name: "A", departmentId: "dep-1" },
+        "create",
+        makeConfig(),
+      );
+      expect(out.department).toEqual({ connect: { id: "dep-1" } });
+      expect("departmentId" in out).toBe(false);
+    });
+  });
+});

package/src/crud/lib/mutation-builder.ts

@@ -1,5 +1,7 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
 import type { EntityConfig } from "../../types";
 import type { ServerCrudLogger } from "../server-service";
+import { coerceFieldValue } from "./coerce";
 
 export interface PrepareMutationDataOptions {
   data: any;
@@ -14,12 +16,16 @@ export interface PrepareMutationDataOptions {
 export function prepareMutationData(options: PrepareMutationDataOptions) {
   const { data, config, mode, systemFields, relationFieldSkip, logger, touchUpdatedAtOnCreate } = options;
 
+  const idField = config?.idField ?? "id";
+  const idKind = config?.idKind ?? "string";
+
   let filtered = data;
-  
+
   if (config) {
     // 1. Filter valid fields
     const valid = new Set(config.fields.filter((f) => !(f as any).isDisplayOnly).map((f) => f.name));
     for (const f of systemFields) valid.add(f);
+    valid.add(idField);
     filtered = {};
     for (const [k, v] of Object.entries(data)) {
       if (valid.has(k)) {
@@ -29,42 +35,28 @@ export function prepareMutationData(options: PrepareMutationDataOptions) {
       }
     }
 
-    // 2. Cast field values (boolean, number)
+    // 2. Ép kiểu tập trung theo config.fields (number/boolean/switch/date,
+    // "" cho FK → undefined) — xem coerceFieldValue.
     for (const field of config.fields) {
-      const value = filtered[field.name];
-      if (value === undefined || value === null) continue;
-      
-      if (field.type === "boolean" || field.type === "switch") {
-        let isTrue: boolean;
-        if (typeof value === "string") {
-          const lv = value.toLowerCase();
-          isTrue = lv === "true" || lv === "active" || value === "1" || value === "on";
-        } else {
-          isTrue = Boolean(value);
-        }
-        
-        if (field.type === "switch" && field.options && field.options.length >= 2) {
-          filtered[field.name] = isTrue ? (field.options[0] as any).value : (field.options[1] as any).value;
-        } else {
-          filtered[field.name] = isTrue;
-        }
-      } else if (field.type === "number" || (field.type as string) === "integer") {
-        if (typeof value === "string") {
-          if (value.trim() === "") {
-            filtered[field.name] = null;
-          } else {
-            const num = Number(value);
-            if (!isNaN(num)) filtered[field.name] = num;
-          }
-        }
-      }
+      if (!(field.name in filtered)) continue;
+      filtered[field.name] = coerceFieldValue(field, filtered[field.name]);
     }
   }
 
   // 3. System defaults for create
   if (mode === "create") {
-    if (!filtered.id) {
-      filtered.id = crypto.randomUUID();
+    if (idKind === "int") {
+      // DB autoincrement — KHÔNG BAO GIỜ tự sinh id; id rỗng từ form thì bỏ
+      // hẳn key, id chuỗi số thì ép Number cho Prisma Int.
+      const raw = filtered[idField];
+      if (raw === undefined || raw === null || raw === "") {
+        delete filtered[idField];
+      } else if (typeof raw === "string") {
+        const num = Number(raw);
+        if (Number.isInteger(num)) filtered[idField] = num;
+      }
+    } else if (!filtered[idField]) {
+      filtered[idField] = crypto.randomUUID();
     }
     if (touchUpdatedAtOnCreate && !filtered.updatedAt) {
       filtered.updatedAt = new Date();
@@ -74,21 +66,22 @@ export function prepareMutationData(options: PrepareMutationDataOptions) {
   // 4. Transform relation fields (*Id -> connect/disconnect)
   const skip = new Set([
     "id",
+    idField,
     "createdBy",
     "updatedBy",
     "citizenId",
     "targetId",
     ...(relationFieldSkip ?? []),
   ]);
-  
+
   const prismaData = { ...filtered };
   for (const key of Object.keys(prismaData)) {
     if (skip.has(key)) continue;
-    
+
     if (key.endsWith("Id") && key.length > 2) {
       const rel = key.slice(0, -2);
       const value = prismaData[key];
-      
+
       if (value && typeof value === "string" && value.trim() !== "") {
         prismaData[rel] = { connect: { id: value } };
         delete prismaData[key];

package/src/crud/lib/permissions.test.ts

@@ -0,0 +1,57 @@
+import { describe, it, expect } from "vitest";
+import { getCrudPermissions, mergePermissions } from "./permissions";
+import type { Session } from "../../types";
+
+// Session non-admin với permissionMap gọn (resource → action codes) — đúng
+// dạng session callback nạp vào JWT.
+const staff = {
+  user: {
+    id: "u1",
+    permissionMap: { employee: ["view", "update", "reset-password"] },
+  },
+} as unknown as Session;
+
+const admin = {
+  user: { id: "a1", roles: ["SUPER_ADMIN"] },
+} as unknown as Session;
+
+describe("getCrudPermissions + extraActions (custom action từ registry)", () => {
+  it("điền custom action theo checkPermission, thiếu quyền = false", async () => {
+    const perms = await getCrudPermissions(staff, "employee", [
+      "reset-password",
+      "resync",
+    ]);
+    expect(perms.read).toBe(true);
+    expect(perms.update).toBe(true);
+    expect(perms.create).toBe(false);
+    expect(perms["reset-password"]).toBe(true);
+    expect(perms["resync"]).toBe(false);
+  });
+
+  it("admin có mọi custom action", async () => {
+    const perms = await getCrudPermissions(admin, "employee", ["resync"]);
+    expect(perms["resync"]).toBe(true);
+  });
+
+  it("extraActions trùng 8 action chuẩn không ghi đè kết quả chuẩn", async () => {
+    const perms = await getCrudPermissions(staff, "employee", ["update"]);
+    expect(perms.update).toBe(true);
+  });
+});
+
+describe("mergePermissions giữ custom action", () => {
+  it("không khai config permissions → trả nguyên map user (kể cả custom)", () => {
+    const user = { read: true, "reset-password": true };
+    expect(mergePermissions(undefined, user)).toEqual(user);
+  });
+
+  it("config permissions chỉ khai 1 key → custom action KHÔNG bị rơi mất", () => {
+    const merged = mergePermissions(
+      { create: false },
+      { create: true, read: true, "reset-password": true },
+    );
+    expect(merged.create).toBe(false);
+    expect(merged.read).toBe(true);
+    expect(merged["reset-password"]).toBe(true);
+  });
+});

package/src/crud/lib/permissions.ts

@@ -4,20 +4,29 @@ import type { Session } from "../../types";
 // Nguồn permission DUY NHẤT đã harden (BYPASS_AUTH chỉ hiệu lực ngoài
 // production, admin-role check chạy trước empty-permissions guard) — bản
 // divergent rbac/permissions.ts cũ đã xóa 2026-07 vì thiếu guard NODE_ENV.
-import { getCrudPermissionsFromSession } from "../../auth";
+import {
+  checkPermission,
+  getActionCode,
+  getCrudPermissionsFromSession,
+} from "../../auth";
 
 /**
  * Get CRUD permissions for a user based on their session
  * Permissions are read from session (loaded from cache in session callback)
- * Uses memoization to return stable object references with TTL
+ *
+ * `extraActions`: custom action ngoài 8 action CRUD chuẩn (khai trong registry,
+ * vd "reset-password", "resync") — mỗi cái tra checkPermission và điền vào map
+ * trả về, để RowAction.permissionAction gate được theo ĐÚNG action code thay vì
+ * mượn tạm "update". BYPASS_AUTH/admin đã xử lý bên trong checkPermission.
  */
 export async function getCrudPermissions(
   session: Session | null,
   entity: string,
+  extraActions?: string[],
 ): Promise<CrudPermissions> {
   // Get permissions from session (already loaded in JWT)
   const perms = getCrudPermissionsFromSession(session, entity);
-  return {
+  const result: CrudPermissions = {
     create: perms.create,
     read: perms.view,
     update: perms.update,
@@ -27,12 +36,20 @@ export async function getCrudPermissions(
     approve: perms.approve,
     reject: perms.reject,
   };
+  for (const action of extraActions ?? []) {
+    if (result[action] !== undefined) continue; // 8 action chuẩn đã có
+    result[action] = checkPermission(session, entity, getActionCode(action));
+  }
+  return result;
 }
 
 /**
  * Merge config permissions with user permissions
  * User permissions take precedence
  * Config permissions are optional, so undefined means "allow if user has permission"
+ *
+ * Merge theo TOÀN BỘ key của userPermissions (kể cả custom action) — bản cũ
+ * liệt kê cứng 8 key nên custom action bị rơi mất sau merge.
  */
 export function mergePermissions(
   configPermissions: EntityConfig["permissions"],
@@ -42,14 +59,9 @@ export function mergePermissions(
     return userPermissions;
   }
 
-  return {
-    create: (configPermissions.create ?? true) && userPermissions.create,
-    read: (configPermissions.read ?? true) && userPermissions.read,
-    update: (configPermissions.update ?? true) && userPermissions.update,
-    delete: (configPermissions.delete ?? true) && userPermissions.delete,
-    export: (configPermissions.export ?? true) && userPermissions.export,
-    import: (configPermissions.import ?? true) && userPermissions.import,
-    approve: (configPermissions.approve ?? true) && userPermissions.approve,
-    reject: (configPermissions.reject ?? true) && userPermissions.reject,
-  };
+  const result: CrudPermissions = {};
+  for (const key of Object.keys(userPermissions)) {
+    result[key] = (configPermissions[key] ?? true) && userPermissions[key];
+  }
+  return result;
 }

package/src/crud/lib/query-builder.ts

@@ -1,4 +1,5 @@
 import { compileFilterTree } from "./filter-tree";
+import { CrudRequestError } from "./errors";
 import type { CrudQueryParams, EntityConfig } from "../../types";
 
 export interface BuildListQueryOptions {
@@ -76,12 +77,18 @@ export function buildListQuery({
   }
 
   if (filterTree) {
-    const compiled = compileFilterTree(filterTree, {
-      isAllowed,
-      onDisallowed: (field) => {
-        if (onDisallowedFilter) onDisallowedFilter(field);
-      },
-    });
+    let compiled;
+    try {
+      compiled = compileFilterTree(filterTree, {
+        isAllowed,
+        onDisallowed: (field) => {
+          if (onDisallowedFilter) onDisallowedFilter(field);
+        },
+      });
+    } catch (e) {
+      // Cây sai cấu trúc/vượt giới hạn là lỗi CLIENT — route trả 400, không 500.
+      throw new CrudRequestError(e instanceof Error ? e.message : "filterTree không hợp lệ");
+    }
     if (compiled) {
       where.AND = [...(Array.isArray(where.AND) ? where.AND : where.AND ? [where.AND] : []), compiled];
     }

package/src/crud/lib/translate-config.ts

@@ -29,6 +29,20 @@ function translate(
   return typeof value === "string" ? value : fallback;
 }
 
+/**
+ * Chốt chặn cuối khi app THIẾU bản dịch: biến key kỹ thuật thành chữ đọc được
+ * ("crud.common.options.active" → "Active") thay vì lộ nguyên chuỗi key ra UI
+ * — chip trạng thái của app mới init từng hiện "crud.common.options.active".
+ */
+export function humanizeDictKey(key: string): string {
+  const last = key.split(".").pop() ?? key;
+  const words = last
+    .replace(/[-_]/g, " ")
+    .replace(/([a-z])([A-Z])/g, "$1 $2")
+    .toLowerCase();
+  return words.charAt(0).toUpperCase() + words.slice(1);
+}
+
 /**
  * Translate EntityConfig với dictionary
  * Chạy ở server-side trước khi pass xuống client
@@ -145,7 +159,7 @@ export function translateEntityConfig(
               `crud.entities.${dictKey}.fields.${field.name}.options.${valueStr}`,
               dictionary,
               optLabel.startsWith("crud.")
-                ? translate(optLabel, dictionary, optLabel)
+                ? translate(optLabel, dictionary, humanizeDictKey(optLabel))
                 : optLabel,
             ),
         };
@@ -319,7 +333,7 @@ export function translateCrudMessage(
     | undefined;
   const commonDict = (crudDict?.common as Record<string, unknown>) || {};
   const messagesDict = (commonDict.messages as Record<string, string>) || {};
-  let message = messagesDict[key] || key;
+  let message = messagesDict[key] || humanizeDictKey(key);
 
   // Replace parameters
   if (params) {

package/src/crud/pages/entity-crud-page.tsx

@@ -110,15 +110,18 @@ export async function EntityCrudPage({
       dictionary,
     );
 
-    // Get user permissions for this entity if available in session or passed explicitly?
-    // In vinhhoa/page.tsx: getCrudPermissions(session, entity) is called.
-    // We should probably rely on `session` having what we need OR generic permissions logic.
-    // The `mergePermissions` below merges generic config perms with USER perms.
-    // We need user perms.
-
-    // We can import getCrudPermissions from ../lib/permissions if it effectively uses session
     const { getCrudPermissions } = await import("../lib/permissions");
-    const userPermissions = await getCrudPermissions(session, entity);
+    // Custom action trong rowActions (permissionAction ngoài 8 action CRUD
+    // chuẩn) cũng phải vào map quyền — không gom thì nút bị fail-closed ẩn
+    // vĩnh viễn dù user CÓ quyền trong registry.
+    const extraActions = (config.rowActions ?? [])
+      .map((a) => a.permissionAction)
+      .filter((a): a is string => Boolean(a));
+    const userPermissions = await getCrudPermissions(
+      session,
+      config.permissionResource ?? entity,
+      extraActions,
+    );
 
     const permissions = mergePermissions(config.permissions, userPermissions);
 

package/src/crud/server-service.test.ts

@@ -0,0 +1,112 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { createServerCrudService } from "./server-service";
+import { CrudRequestError } from "./lib/errors";
+import type { EntityConfig } from "../types";
+
+const makeModel = () => ({
+  findUnique: vi.fn(async () => ({ id: 1, name: "A" })),
+  findMany: vi.fn(async () => []),
+  count: vi.fn(async () => 0),
+  create: vi.fn(async ({ data }: any) => data),
+  update: vi.fn(async () => ({ id: 1 })),
+  delete: vi.fn(async () => ({ id: 1 })),
+  deleteMany: vi.fn(async () => ({ count: 2 })),
+});
+
+const makeConfig = (over: Partial<EntityConfig> = {}): EntityConfig => ({
+  name: "job-title",
+  label: "Chức danh",
+  pluralLabel: "Chức danh",
+  apiEndpoint: "/api/crud/job-titles",
+  idField: "id",
+  displayField: "name",
+  fields: [
+    { name: "id", label: "ID", type: "text" },
+    { name: "name", label: "Tên", type: "text" },
+  ],
+  ...over,
+});
+
+const logger = { warn: vi.fn(), error: vi.fn() };
+
+describe("createServerCrudService", () => {
+  let model: ReturnType<typeof makeModel>;
+  let prisma: Record<string, any>;
+
+  beforeEach(() => {
+    model = makeModel();
+    // Model chỉ tồn tại dưới tên "jobTitle" — convention từ entity key khác
+    // ("weird-things") sẽ trượt nếu không đọc config.modelName.
+    prisma = { jobTitle: model };
+  });
+
+  it("ưu tiên config.modelName hơn convention getModelName", async () => {
+    const service = createServerCrudService({ prisma, logger });
+    const config = makeConfig({ modelName: "jobTitle" });
+    await service.getById("weird-things", "x", config);
+    expect(model.findUnique).toHaveBeenCalled();
+  });
+
+  it("thiếu modelName thì fallback convention (job-titles → jobTitle)", async () => {
+    const service = createServerCrudService({ prisma, logger });
+    await service.getById("job-titles", "x", makeConfig());
+    expect(model.findUnique).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { id: "x" } }),
+    );
+  });
+
+  it("where dùng config.idField thay vì hardcode id", async () => {
+    const service = createServerCrudService({ prisma, logger });
+    const config = makeConfig({ modelName: "jobTitle", idField: "code" });
+    await service.delete("job-titles", "JT01", config);
+    expect(model.delete).toHaveBeenCalledWith({ where: { code: "JT01" } });
+  });
+
+  it("idKind int: id trên URL được ép Number cho mọi method", async () => {
+    const service = createServerCrudService({ prisma, logger });
+    const config = makeConfig({ modelName: "jobTitle", idKind: "int" });
+
+    await service.getById("job-titles", "42", config);
+    expect(model.findUnique).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { id: 42 } }),
+    );
+
+    await service.update("job-titles", "42", { name: "B" }, config);
+    expect(model.update).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { id: 42 } }),
+    );
+
+    await service.delete("job-titles", "42", config);
+    expect(model.delete).toHaveBeenCalledWith({ where: { id: 42 } });
+  });
+
+  it("idKind int: id không phải số nguyên → CrudRequestError 400", async () => {
+    const service = createServerCrudService({ prisma, logger });
+    const config = makeConfig({ modelName: "jobTitle", idKind: "int" });
+    await expect(service.getById("job-titles", "abc", config)).rejects.toThrow(
+      CrudRequestError,
+    );
+    expect(model.findUnique).not.toHaveBeenCalled();
+  });
+
+  it("deleteMany: ép cả mảng id, một phần tử hỏng là fail cả request", async () => {
+    const service = createServerCrudService({ prisma, logger });
+    const config = makeConfig({ modelName: "jobTitle", idKind: "int" });
+
+    await service.deleteMany("job-titles", ["1", "2"], config);
+    expect(model.deleteMany).toHaveBeenCalledWith({ where: { id: { in: [1, 2] } } });
+
+    await expect(
+      service.deleteMany("job-titles", ["1", "x"], config),
+    ).rejects.toThrow(CrudRequestError);
+    expect(model.deleteMany).toHaveBeenCalledTimes(1);
+  });
+
+  it("idKind mặc định: id giữ nguyên chuỗi (UUID)", async () => {
+    const service = createServerCrudService({ prisma, logger });
+    const config = makeConfig({ modelName: "jobTitle" });
+    await service.delete("job-titles", "uuid-1", config);
+    expect(model.delete).toHaveBeenCalledWith({ where: { id: "uuid-1" } });
+  });
+});