@goplusvn/core 0.1.71 → 0.1.72

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@goplusvn/core",
   "description": "GoPlusVN Platform Kit - ERP kernel: layout, RBAC, CRUD, multi-tenant, system pages",
-  "version": "0.1.71",
+  "version": "0.1.72",
   "private": false,
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -93,6 +93,7 @@
     "./rbac/role-service": "./src/rbac/role-service.ts",
     "./rbac/resource-service": "./src/rbac/resource-service.ts",
     "./crud/pages/entity-crud-page": "./src/crud/pages/entity-crud-page.tsx",
+    "./crud/server": "./src/crud/server.ts",
     "./auth/auth-service": "./src/auth/auth-service.ts",
     "./package.json": "./package.json",
     "./providers/brand-theme": "./src/providers/brand-theme.ts",

package/src/auth/index.ts

@@ -7,7 +7,11 @@ export * from "./auth-service";
 
 // `Permission` từng được KHAI BÁO LẠI ở đây, y hệt bản trong ../types — hai
 // nguồn sự thật cho cùng một shape. Giờ chỉ còn re-export.
-export type { Permission, PermissionMap };
+// `Session` PHẢI export từ đây: đây là kiểu tham số của checkPermission/hasRole,
+// không export thì mọi app phải viết `session as Parameters<typeof
+// checkPermission>[0]` — Session của app ({ user: SessionUser }) vốn gán thẳng
+// được vào `{ user?: unknown }`, không cần cast nào cả.
+export type { Permission, PermissionMap, Session };
 
 // ============================================================================
 // Types

package/src/configs/entities/departments.config.ts

@@ -17,6 +17,7 @@ export const departmentsConfig: EntityConfig = {
   icon: Building2,
   description: "Quản lý cơ cấu tổ chức phòng ban",
   apiEndpoint: "/api/departments",
+  modelName: "department",
   idField: "id",
   displayField: "name",
 

package/src/configs/entities/material-categories.config.ts

@@ -11,6 +11,7 @@ export const materialCategoriesConfig: EntityConfig = {
   icon: FolderTree,
   description: "Quản lý danh mục nguyên vật liệu",
   apiEndpoint: "/api/material-categories",
+  modelName: "materialCategory",
   idField: "id",
   displayField: "name",
 

package/src/crud/components/crud-export-button.tsx

@@ -53,8 +53,9 @@ export function CrudExportButton({
         search: activeSearch,
       });
 
-      // Always force format to xlsx
-      const url = `${endpoint}?${queryParams}&format=xlsx`;
+      // Always force format to xlsx. Endpoint từ getEntityEndpoints có thể đã
+      // mang sẵn query params — nối bằng "&" thay vì "?" thứ hai.
+      const url = `${endpoint}${endpoint.includes("?") ? "&" : "?"}${queryParams}&format=xlsx`;
 
       const response = await fetch(url);
       if (!response.ok) {

package/src/crud/components/crud-page.tsx

@@ -32,6 +32,7 @@ import { useRouter, useParams } from "next/navigation";
 import { CrudBulkActions } from "./crud-bulk-actions";
 import { CrudDeleteDialog } from "./crud-delete-dialog";
 import { crudService } from "../lib/crud-service";
+import { getEntityEndpoints } from "../lib/entity-endpoints";
 import { usePrefetch } from "../../hooks";
 import type { DictionaryType } from "../../hooks";
 
@@ -618,31 +619,65 @@ function CrudPageContent({
         }
 
         default: {
-          // Custom handler: Get original config to access handler function
-          // NOTE: This logic is deprecated because Core package cannot import App configs directly.
-          // Custom handlers passed via config functions are lost during serialization.
-          // If you need custom actions with handlers, please implement them via `customActions` prop
-          // or a registered event handler mechanism.
+          // Action HTTP thuần data (urlTemplate + method) — sống sót qua
+          // serializeConfig nên khai được ngay trong entity config phía server.
+          if (rowAction.urlTemplate) {
+            // Fail-closed: khai permissionAction mà user không có quyền thì thôi
+            // (menu đã ẩn, đây là chốt chặn thứ hai).
+            if (
+              rowAction.permissionAction &&
+              !permissions[rowAction.permissionAction]
+            ) {
+              return;
+            }
+            if (
+              rowAction.confirmMessage &&
+              !window.confirm(rowAction.confirmMessage)
+            ) {
+              return;
+            }
+            const url = rowAction.urlTemplate.replace(
+              /\{id\}/g,
+              encodeURIComponent(rowId),
+            );
+            const response = await fetch(url, {
+              method: rowAction.method ?? "POST",
+            });
+            if (!response.ok) {
+              let message = `${response.status} ${response.statusText}`;
+              try {
+                const body = await response.json();
+                message = body.error || body.message || message;
+              } catch {
+                // body không phải JSON — giữ status text
+              }
+              throw new Error(message);
+            }
+            await fetchData(false);
+            toast.success(t("success", "Success"), {
+              description:
+                rowAction.successMessage ??
+                tMessage("updated", { entity: config.label }),
+            });
+            break;
+          }
 
+          // Custom handler qua config function bị serializeConfig strip —
+          // action không có urlTemplate thì phải đi qua customActions prop.
           console.warn(
-            `Action "${action}" has no built-in handler and custom handlers via config are not supported in this architecture. Please use customActions prop.`,
+            `Action "${action}" has no built-in handler and custom handlers via config are not supported in this architecture. Please use customActions prop or declare urlTemplate.`,
           );
-
-          /* Deprecated logic removed to fix build:
-          if (entityName) {
-            try {
-              const originalConfig = getEntityConfig(entityName)
-               ...
-            }
-          }
-          */
         }
       }
     } catch (error) {
       console.error(`Error executing ${action} action:`, error);
       globalError.emit({
         title: t("error", "Error"),
-        description: tMessage("saveFailed", { entity: rowAction.label }),
+        // Ưu tiên message từ API (đọc từ body JSON) — fallback câu chung.
+        description:
+          error instanceof Error && error.message
+            ? error.message
+            : tMessage("saveFailed", { entity: rowAction.label }),
         trace: error instanceof Error ? error.stack : undefined,
       });
     }
@@ -858,18 +893,14 @@ function CrudPageContent({
                     className="h-6 hidden sm:block"
                   />
                   <div className="flex items-center gap-2 flex-wrap sm:flex-nowrap">
+                    {/* Import/Export dùng CÙNG quy tắc endpoint từ config
+                        (getEntityEndpoints) — trước đây export hardcode
+                        /api/crud/... lệch với import → 404. */}
                     {permissions.import && config.features?.import && (
                       <Suspense fallback={null}>
                         <ImportDialog
                           config={config}
-                          apiUrl={(() => {
-                            // Handle endpoint with query params correctly
-                            const baseUrl = config.apiEndpoint.split("?")[0];
-                            const queryParams = config.apiEndpoint.includes("?")
-                              ? config.apiEndpoint.split("?")[1]
-                              : "";
-                            return `${baseUrl}/import${queryParams ? `?${queryParams}` : ""}`;
-                          })()}
+                          apiUrl={getEntityEndpoints(config).import}
                           canImport={permissions.import}
                         />
                       </Suspense>
@@ -877,7 +908,7 @@ function CrudPageContent({
                     {permissions.export && config.features?.export && (
                       <Suspense fallback={null}>
                         <CrudExportButton
-                          endpoint={`/api/crud/${entityName || config.name}/export`}
+                          endpoint={getEntityEndpoints(config).export}
                           filters={filters}
                           search={search}
                           canExport={permissions.export}

package/src/crud/components/crud-row-actions.tsx

@@ -4,8 +4,11 @@ import {
   Archive,
   Copy,
   Eye,
+  History,
   MoreHorizontal,
   Pencil,
+  Pin,
+  SquareArrowOutUpRight,
   Trash2,
   CheckCircle2,
   XCircle,
@@ -81,8 +84,15 @@ export function CrudRowActions({
         return <CheckCircle2 className="mr-2 h-4 w-4" aria-hidden="true" />;
       case "reject":
         return <XCircle className="mr-2 h-4 w-4" aria-hidden="true" />;
+      case "set-default":
+        return <Pin className="mr-2 h-4 w-4" aria-hidden="true" />;
+      case "view-history":
+        return <History className="mr-2 h-4 w-4" aria-hidden="true" />;
       default:
-        return null;
+        // Action tự khai không có icon riêng — icon fallback trung tính.
+        return (
+          <SquareArrowOutUpRight className="mr-2 h-4 w-4" aria-hidden="true" />
+        );
     }
   };
 
@@ -139,9 +149,11 @@ export function CrudRowActions({
                 }
               };
 
-              // Check if user has permission for this custom action
-              const hasActionPermission =
-                action.action === "approve"
+              // Gate theo permissionAction khai trong config; không khai thì
+              // giữ special-case approve/reject cũ, còn lại luôn hiện.
+              const hasActionPermission = action.permissionAction
+                ? Boolean(permissions[action.permissionAction])
+                : action.action === "approve"
                   ? permissions.approve
                   : action.action === "reject"
                     ? permissions.reject

package/src/crud/crud-route-handlers.test.ts

@@ -0,0 +1,352 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+// @vitest-environment node
+// Route handler thuần Request/Response — PHẢI chạy env node: jsdom ghi đè
+// global File làm chính parser multipart của undici (req.formData) assert chết.
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import {
+  createCrudCollectionHandlers,
+  createCrudExportHandler,
+  createCrudImportHandler,
+  createCrudItemHandlers,
+} from "./crud-route-handlers";
+import { CrudRequestError } from "./lib/errors";
+import type { ServerCrudService } from "./server-service";
+import type { EntityConfig } from "../types";
+
+// Admin session → getCrudPermissionsFromSession trả full quyền, test không
+// phụ thuộc permission map.
+const session = { user: { id: "u1", roles: ["SUPER_ADMIN"] } };
+
+const config: EntityConfig = {
+  name: "job-title",
+  label: "Chức danh",
+  pluralLabel: "Chức danh",
+  apiEndpoint: "/api/crud/job-titles",
+  idField: "id",
+  displayField: "name",
+  fields: [
+    { name: "id", label: "ID", type: "text" },
+    { name: "name", label: "Tên", type: "text", filterable: true },
+    { name: "level", label: "Cấp", type: "number", filterable: true },
+  ],
+};
+
+const makeService = (): ServerCrudService => ({
+  list: vi.fn(async () => ({ data: [], total: 0, page: 1, pageSize: 10 })),
+  getById: vi.fn(async () => ({ id: "1" })),
+  create: vi.fn(async (_e, d) => d),
+  update: vi.fn(async () => ({})),
+  delete: vi.fn(async () => ({})),
+  deleteMany: vi.fn(async () => ({})),
+});
+
+const ctx = (entity: string, id?: string) => ({
+  params: Promise.resolve(id === undefined ? { entity } : { entity, id }),
+});
+
+describe("createCrudCollectionHandlers GET", () => {
+  let service: ServerCrudService;
+  let GET: ReturnType<typeof createCrudCollectionHandlers>["GET"];
+
+  beforeEach(() => {
+    service = makeService();
+    ({ GET } = createCrudCollectionHandlers({
+      getSession: () => session,
+      getEntityConfig: () => config,
+      service,
+    }));
+  });
+
+  it("filters không phải JSON → 400 (không rơi xuống 500)", async () => {
+    const req = new Request(
+      "http://t/api/crud/job-titles?filters=%7Bnot-json",
+    );
+    const res = await GET(req, ctx("job-titles") as any);
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toContain("filters");
+    expect(service.list).not.toHaveBeenCalled();
+  });
+
+  it("filterTree không phải JSON → 400", async () => {
+    const req = new Request(
+      "http://t/api/crud/job-titles?filterTree=%5Bbroken",
+    );
+    const res = await GET(req, ctx("job-titles") as any);
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toContain("filterTree");
+  });
+
+  it("giá trị filter được ép kiểu theo field config (number)", async () => {
+    const filters = JSON.stringify([
+      { name: "level", operator: "eq", value: "5" },
+    ]);
+    const req = new Request(
+      `http://t/api/crud/job-titles?filters=${encodeURIComponent(filters)}`,
+    );
+    const res = await GET(req, ctx("job-titles") as any);
+    expect(res.status).toBe(200);
+    const params = (service.list as any).mock.calls[0][2];
+    expect(params.filters).toEqual([
+      { name: "level", operator: "eq", value: 5 },
+    ]);
+  });
+
+  it("filterTree hợp lệ được parse và truyền xuống service.list", async () => {
+    const tree = JSON.stringify({
+      $and: [{ field: "name", operator: "contains", value: "a" }],
+    });
+    const req = new Request(
+      `http://t/api/crud/job-titles?filterTree=${encodeURIComponent(tree)}`,
+    );
+    const res = await GET(req, ctx("job-titles") as any);
+    expect(res.status).toBe(200);
+    const params = (service.list as any).mock.calls[0][2];
+    expect(params.filterTree).toEqual({
+      $and: [{ field: "name", operator: "contains", value: "a" }],
+    });
+  });
+});
+
+describe("createCrudItemHandlers", () => {
+  it("service ném CrudRequestError → map ra status của lỗi (400)", async () => {
+    const service = makeService();
+    (service.delete as any).mockRejectedValue(
+      new CrudRequestError('Id không hợp lệ cho "job-titles": "abc" (idKind=int cần số nguyên)'),
+    );
+    const { DELETE } = createCrudItemHandlers({
+      getSession: () => session,
+      getEntityConfig: () => config,
+      service,
+    });
+    const req = new Request("http://t/api/crud/job-titles/abc", {
+      method: "DELETE",
+    });
+    const res = await DELETE(req, ctx("job-titles", "abc") as any);
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error).toContain("Id không hợp lệ");
+  });
+
+  it("DELETE truyền config xuống service (idField/idKind/modelName)", async () => {
+    const service = makeService();
+    const { DELETE } = createCrudItemHandlers({
+      getSession: () => session,
+      getEntityConfig: () => config,
+      service,
+    });
+    const req = new Request("http://t/api/crud/job-titles/1", {
+      method: "DELETE",
+    });
+    const res = await DELETE(req, ctx("job-titles", "1") as any);
+    expect(res.status).toBe(204);
+    expect(service.delete).toHaveBeenCalledWith("job-titles", "1", config);
+  });
+});
+
+describe("createCrudExportHandler", () => {
+  const staffNoExport = {
+    user: { id: "u2", permissionMap: { "job-title": ["view"] } },
+  };
+
+  it("thiếu quyền export → 403", async () => {
+    const { GET } = createCrudExportHandler({
+      getSession: () => staffNoExport,
+      getEntityConfig: () => config,
+      service: makeService(),
+    });
+    const req = new Request("http://t/api/crud/job-titles/export");
+    const res = await GET(req, ctx("job-titles") as any);
+    expect(res.status).toBe(403);
+  });
+
+  it("format lạ → 400", async () => {
+    const { GET } = createCrudExportHandler({
+      getSession: () => session,
+      getEntityConfig: () => config,
+      service: makeService(),
+    });
+    const req = new Request("http://t/api/crud/job-titles/export?format=pdf");
+    const res = await GET(req, ctx("job-titles") as any);
+    expect(res.status).toBe(400);
+  });
+
+  it("json: kéo đủ các trang qua service.list, tôn trọng filter/sort", async () => {
+    const service = makeService();
+    // Trang 1 đầy (2 dòng = pageSize), trang 2 vơi → dừng.
+    (service.list as any)
+      .mockResolvedValueOnce({ data: [{ id: "1" }, { id: "2" }], total: 3, page: 1, pageSize: 2 })
+      .mockResolvedValueOnce({ data: [{ id: "3" }], total: 3, page: 2, pageSize: 2 });
+    const { GET } = createCrudExportHandler({
+      getSession: () => session,
+      getEntityConfig: () => config,
+      service,
+      pageSize: 2,
+    });
+    const filters = encodeURIComponent(
+      JSON.stringify([{ name: "level", operator: "eq", value: "3" }]),
+    );
+    const req = new Request(
+      `http://t/api/crud/job-titles/export?format=json&sortField=name&sortDirection=desc&filters=${filters}`,
+    );
+    const res = await GET(req, ctx("job-titles") as any);
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-disposition")).toContain(".json");
+    const rows = JSON.parse(await res.text());
+    expect(rows.map((r: any) => r.id)).toEqual(["1", "2", "3"]);
+    // Filter chuỗi "3" đã ép number theo field type trước khi vào engine.
+    expect((service.list as any).mock.calls[0][2].filters[0].value).toBe(3);
+    expect((service.list as any).mock.calls[0][2].sort).toEqual({
+      field: "name",
+      direction: "desc",
+    });
+  });
+
+  it("csv: có BOM cho Excel + đúng content-type", async () => {
+    const service = makeService();
+    (service.list as any).mockResolvedValueOnce({
+      data: [{ name: "Kỹ sư" }],
+      total: 1, page: 1, pageSize: 500,
+    });
+    const { GET } = createCrudExportHandler({
+      getSession: () => session,
+      getEntityConfig: () => config,
+      service,
+    });
+    const req = new Request("http://t/api/crud/job-titles/export?format=csv");
+    const res = await GET(req, ctx("job-titles") as any);
+    // Response.text() strip BOM khi decode — soi bytes thô để chắc BOM đã gửi.
+    const bytes = new Uint8Array(await res.arrayBuffer());
+    expect([bytes[0], bytes[1], bytes[2]]).toEqual([0xef, 0xbb, 0xbf]);
+    const text = new TextDecoder().decode(bytes);
+    expect(text).toContain("Kỹ sư");
+    expect(res.headers.get("content-type")).toContain("text/csv");
+  });
+
+  it("maxRows cắt bớt dòng thừa", async () => {
+    const service = makeService();
+    (service.list as any).mockResolvedValue({
+      data: [{ id: "a" }, { id: "b" }],
+      total: 100, page: 1, pageSize: 2,
+    });
+    const { GET } = createCrudExportHandler({
+      getSession: () => session,
+      getEntityConfig: () => config,
+      service,
+      pageSize: 2,
+      maxRows: 3,
+    });
+    const req = new Request("http://t/api/crud/job-titles/export?format=json");
+    const res = await GET(req, ctx("job-titles") as any);
+    const rows = JSON.parse(await res.text());
+    expect(rows).toHaveLength(3);
+  });
+});
+
+describe("createCrudImportHandler", () => {
+  it("thiếu quyền import → 403", async () => {
+    const { POST } = createCrudImportHandler({
+      getSession: () => ({ user: { id: "u2", permissionMap: { "job-title": ["view"] } } }),
+      getEntityConfig: () => config,
+      service: makeService(),
+    });
+    const req = new Request("http://t/api/crud/job-titles/import", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: "[]",
+    });
+    const res = await POST(req, ctx("job-titles") as any);
+    expect(res.status).toBe(403);
+  });
+
+  it("JSON array: mỗi dòng qua service.create, header label dịch về tên cột", async () => {
+    const service = makeService();
+    const { POST } = createCrudImportHandler({
+      getSession: () => session,
+      getEntityConfig: () => config,
+      service,
+    });
+    const req = new Request("http://t/api/crud/job-titles/import", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify([{ "Tên": "Kỹ sư", "Cấp": "2" }]),
+    });
+    const res = await POST(req, ctx("job-titles") as any);
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body).toMatchObject({ success: true, imported: 1, failed: 0 });
+    expect((service.create as any).mock.calls[0][1]).toEqual({
+      name: "Kỹ sư",
+      level: "2",
+    });
+  });
+
+  it("dòng lỗi không chặn dòng sau — gom vào errors", async () => {
+    const service = makeService();
+    (service.create as any)
+      .mockRejectedValueOnce(new Error("Tên đã tồn tại"))
+      .mockResolvedValueOnce({});
+    const { POST } = createCrudImportHandler({
+      getSession: () => session,
+      getEntityConfig: () => config,
+      service,
+    });
+    const req = new Request("http://t/api/crud/job-titles/import", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify([{ name: "A" }, { name: "B" }]),
+    });
+    const res = await POST(req, ctx("job-titles") as any);
+    const body = await res.json();
+    expect(body.success).toBe(false);
+    expect(body.imported).toBe(1);
+    expect(body.failed).toBe(1);
+    expect(body.errors[0]).toMatchObject({ row: 1, message: "Tên đã tồn tại" });
+  });
+
+  it("multipart {file, format} từ ImportDialog: parse tại server", async () => {
+    const service = makeService();
+    const { POST } = createCrudImportHandler({
+      getSession: () => session,
+      getEntityConfig: () => config,
+      service,
+    });
+    // Dựng multipart thô — File/FormData của môi trường test (jsdom) khác
+    // realm với undici Request, đưa thẳng vào body sẽ hỏng serialize.
+    const boundary = "----vitest-boundary";
+    const body =
+      `--${boundary}\r\n` +
+      `Content-Disposition: form-data; name="file"; filename="rows.json"\r\n` +
+      `Content-Type: application/json\r\n\r\n` +
+      JSON.stringify([{ name: "Từ file" }]) +
+      `\r\n--${boundary}\r\n` +
+      `Content-Disposition: form-data; name="format"\r\n\r\n` +
+      `json\r\n--${boundary}--\r\n`;
+    const req = new Request("http://t/api/crud/job-titles/import", {
+      method: "POST",
+      headers: { "content-type": `multipart/form-data; boundary=${boundary}` },
+      body,
+    });
+    const res = await POST(req, ctx("job-titles") as any);
+    expect(res.status).toBe(200);
+    const result = await res.json();
+    expect(result.imported).toBe(1);
+    expect((service.create as any).mock.calls[0][1]).toEqual({ name: "Từ file" });
+  });
+
+  it("body không phải array → 400", async () => {
+    const { POST } = createCrudImportHandler({
+      getSession: () => session,
+      getEntityConfig: () => config,
+      service: makeService(),
+    });
+    const req = new Request("http://t/api/crud/job-titles/import", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ not: "array" }),
+    });
+    const res = await POST(req, ctx("job-titles") as any);
+    expect(res.status).toBe(400);
+  });
+});