@kyro-cms/core 0.9.0 → 0.9.1

package/dist/chunk-L4EZKIEX.js

@@ -0,0 +1,185 @@
+// src/auth/rbac/roles.ts
+var DEFAULT_ROLES = [
+  {
+    name: "super_admin",
+    level: 100,
+    inherits: [],
+    description: "Full system access across all tenants"
+  },
+  {
+    name: "admin",
+    level: 90,
+    inherits: ["editor"],
+    description: "Full tenant access with all content permissions"
+  },
+  {
+    name: "editor",
+    level: 70,
+    inherits: ["author"],
+    description: "Edit and publish all content"
+  },
+  {
+    name: "author",
+    level: 50,
+    inherits: ["customer"],
+    description: "Create and edit own content"
+  },
+  {
+    name: "customer",
+    level: 30,
+    inherits: [],
+    description: "Access own data and make purchases"
+  },
+  {
+    name: "guest",
+    level: 10,
+    inherits: [],
+    description: "Public read-only access"
+  }
+];
+var ROLE_PERMISSIONS = {
+  super_admin: ["*"],
+  admin: [
+    "users:admin",
+    "users:read",
+    "users:update",
+    "audit_logs:read",
+    "posts:admin",
+    "posts:read",
+    "posts:create",
+    "posts:update",
+    "posts:delete",
+    "pages:admin",
+    "pages:read",
+    "pages:create",
+    "pages:update",
+    "pages:delete",
+    "media:admin",
+    "media:read",
+    "media:create",
+    "media:update",
+    "media:delete",
+    "categories:admin",
+    "categories:read",
+    "categories:create",
+    "categories:update",
+    "categories:delete",
+    "products:admin",
+    "products:read",
+    "products:create",
+    "products:update",
+    "products:delete",
+    "orders:admin",
+    "orders:read",
+    "orders:update",
+    "customers:admin",
+    "customers:read",
+    "customers:update",
+    "coupons:admin",
+    "coupons:read",
+    "coupons:create",
+    "coupons:update",
+    "coupons:delete",
+    "navigation:admin",
+    "navigation:read",
+    "navigation:create",
+    "navigation:update",
+    "navigation:delete",
+    "settings:admin",
+    "settings:read",
+    "settings:update",
+    "profile:admin",
+    "profile:read",
+    "profile:update"
+  ],
+  editor: [
+    "posts:admin",
+    "posts:read",
+    "posts:create",
+    "posts:update",
+    "posts:delete",
+    "pages:admin",
+    "pages:read",
+    "pages:create",
+    "pages:update",
+    "pages:delete",
+    "media:read",
+    "media:create",
+    "media:update",
+    "categories:read",
+    "categories:create",
+    "categories:update",
+    "products:read",
+    "orders:read",
+    "orders:update",
+    "navigation:read",
+    "navigation:create",
+    "navigation:update",
+    "profile:read",
+    "profile:update"
+  ],
+  author: [
+    "posts:read",
+    "posts:create",
+    "posts:update",
+    "media:read",
+    "media:create",
+    "categories:read",
+    "profile:read",
+    "profile:update"
+  ],
+  customer: ["profile:read", "profile:update", "orders:read", "orders:create"],
+  guest: ["posts:read", "pages:read", "products:read"]
+};
+function getRoleHierarchy(role, roles = DEFAULT_ROLES) {
+  const hierarchy = [role];
+  const roleMap = new Map(roles.map((r) => [r.name, r]));
+  const addInherited = (r) => {
+    const roleData = roleMap.get(r);
+    if (roleData && roleData.inherits) {
+      for (const inherited of roleData.inherits) {
+        if (!hierarchy.includes(inherited)) {
+          hierarchy.push(inherited);
+          addInherited(inherited);
+        }
+      }
+    }
+  };
+  addInherited(role);
+  return hierarchy;
+}
+
+// src/auth/rbac/checker.ts
+function hasPermission(user, permission, rolePermissions = ROLE_PERMISSIONS) {
+  if (!user || !user.role) return false;
+  const userPermissions = getUserPermissions(user, rolePermissions);
+  if (userPermissions.includes("*")) return true;
+  if (userPermissions.includes(permission)) return true;
+  const [resource, action] = permission.split(":");
+  if (userPermissions.includes(`${resource}:*`)) return true;
+  if (userPermissions.includes(`${resource}:admin`)) return true;
+  return false;
+}
+function hasAnyRole(user, checkRoles) {
+  if (!user || !user.role) return false;
+  const hierarchy = getRoleHierarchy(user.role);
+  return checkRoles.some((role) => hierarchy.includes(role));
+}
+function getUserPermissions(user, rolePermissions = ROLE_PERMISSIONS) {
+  if (!user || !user.role) return [];
+  const hierarchy = getRoleHierarchy(user.role);
+  const permissions = /* @__PURE__ */ new Set();
+  for (const role of hierarchy) {
+    const rolePerms = rolePermissions[role];
+    if (rolePerms) {
+      for (const perm of rolePerms) {
+        permissions.add(perm);
+      }
+    }
+  }
+  return Array.from(permissions);
+}
+
+export { hasAnyRole, hasPermission };
+//# sourceMappingURL=chunk-L4EZKIEX.js.map
+//# sourceMappingURL=chunk-L4EZKIEX.js.map

package/dist/chunk-L4EZKIEX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth/rbac/roles.ts","../src/auth/rbac/checker.ts"],"names":[],"mappings":";AAmCO,IAAM,aAAA,GAAwB;AAAA,EACnC;AAAA,IACE,IAAA,EAAM,aAAA;AAAA,IACN,KAAA,EAAO,GAAA;AAAA,IACP,UAAU,EAAC;AAAA,IACX,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,IAAA,EAAM,OAAA;AAAA,IACN,KAAA,EAAO,EAAA;AAAA,IACP,QAAA,EAAU,CAAC,QAAQ,CAAA;AAAA,IACnB,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,IAAA,EAAM,QAAA;AAAA,IACN,KAAA,EAAO,EAAA;AAAA,IACP,QAAA,EAAU,CAAC,QAAQ,CAAA;AAAA,IACnB,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,IAAA,EAAM,QAAA;AAAA,IACN,KAAA,EAAO,EAAA;AAAA,IACP,QAAA,EAAU,CAAC,UAAU,CAAA;AAAA,IACrB,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,IAAA,EAAM,UAAA;AAAA,IACN,KAAA,EAAO,EAAA;AAAA,IACP,UAAU,EAAC;AAAA,IACX,WAAA,EAAa;AAAA,GACf;AAAA,EACA;AAAA,IACE,IAAA,EAAM,OAAA;AAAA,IACN,KAAA,EAAO,EAAA;AAAA,IACP,UAAU,EAAC;AAAA,IACX,WAAA,EAAa;AAAA;AAEjB,CAAA;AA2EO,IAAM,gBAAA,GAA6C;AAAA,EACxD,WAAA,EAAa,CAAC,GAAG,CAAA;AAAA,EAEjB,KAAA,EAAO;AAAA,IACL,aAAA;AAAA,IACA,YAAA;AAAA,IACA,cAAA;AAAA,IACA,iBAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA,cAAA;AAAA,IACA,cAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA,cAAA;AAAA,IACA,cAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA,cAAA;AAAA,IACA,cAAA;AAAA,IACA,cAAA;AAAA,IACA,kBAAA;AAAA,IACA,iBAAA;AAAA,IACA,mBAAA;AAAA,IACA,mBAAA;AAAA,IACA,mBAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA,iBAAA;AAAA,IACA,iBAAA;AAAA,IACA,iBAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,eAAA;AAAA,IACA,iBAAA;AAAA,IACA,gBAAA;AAAA,IACA,kBAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,gBAAA;AAAA,IACA,gBAAA;AAAA,IACA,gBAAA;AAAA,IACA,kBAAA;AAAA,IACA,iBAAA;AAAA,IACA,mBAAA;AAAA,IACA,mBAAA;AAAA,IACA,mBAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA,iBAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA;AAAA,GACF;AAAA,EAEA,MAAA,EAAQ;AAAA,IACN,aAAA;AAAA,IACA,YAAA;AAAA,IACA,cAAA;AAAA,IACA,cAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA,cAAA;AAAA,IACA,cAAA;AAAA,IACA,cAAA;AAAA,IACA,YAAA;AAAA,IACA,cAAA;AAAA,IACA,cAAA;AAAA,IACA,iBAAA;AAAA,IACA,mBAAA;AAAA,IACA,mBAAA;AAAA,IACA,eAAA;AAAA,IACA,aAAA;AAAA,IACA,eAAA;AAAA,IACA,iBAAA;AAAA,IACA,mBAAA;AAAA,IACA,mBAAA;AAAA,IACA,cAAA;AAAA,IACA;AAAA,GACF;AAAA,EAEA,MAAA,EAAQ;AAAA,IACN,YAAA;AAAA,IACA,cAAA;AAAA,IACA,cAAA;AAAA,IACA,YAAA;AAAA,IACA,cAAA;AAAA,IACA,iBAAA;AAAA,IACA,cAAA;AAAA,IACA;AAAA,GACF;AAAA,EAEA,QAAA,EAAU,CAAC,cAAA,EAAgB,gBAAA,EAAkB,eAAe,eAAe,CAAA;AAAA,EAE3E,KAAA,EAAO,CAAC,YAAA,EAAc,YAAA,EAAc,eAAe;AACrD,CAAA;AAEO,SAAS,gBAAA,CACd,IAAA,EACA,KAAA,GAAgB,aAAA,EACN;AACV,EAAA,MAAM,SAAA,GAAsB,CAAC,IAAI,CAAA;AACjC,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,IAAA,EAAM,CAAC,CAAC,CAAC,CAAA;AAErD,EAAA,MAAM,YAAA,GAAe,CAAC,CAAA,KAAc;AAClC,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA;AAC9B,IAAA,IAAI,QAAA,IAAY,SAAS,QAAA,EAAU;AACjC,MAAA,KAAA,MAAW,SAAA,IAAa,SAAS,QAAA,EAAU;AACzC,QAAA,IAAI,CAAC,SAAA,CAAU,QAAA,CAAS,SAAS,CAAA,EAAG;AAClC,UAAA,SAAA,CAAU,KAAK,SAAS,CAAA;AACxB,UAAA,YAAA,CAAa,SAAS,CAAA;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA;AAEA,EAAA,YAAA,CAAa,IAAI,CAAA;AACjB,EAAA,OAAO,SAAA;AACT;;;AC3PO,SAAS,aAAA,CACd,IAAA,EACA,UAAA,EACA,eAAA,GAA4C,gBAAA,EACnC;AACT,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,IAAA,CAAK,MAAM,OAAO,KAAA;AAEhC,EAAA,MAAM,eAAA,GAAkB,kBAAA,CAAmB,IAAA,EAAM,eAAe,CAAA;AAEhE,EAAA,IAAI,eAAA,CAAgB,QAAA,CAAS,GAAG,CAAA,EAAG,OAAO,IAAA;AAC1C,EAAA,IAAI,eAAA,CAAgB,QAAA,CAAS,UAAU,CAAA,EAAG,OAAO,IAAA;AAEjD,EAAA,MAAM,CAAC,QAAA,EAAU,MAAM,CAAA,GAAI,UAAA,CAAW,MAAM,GAAG,CAAA;AAC/C,EAAA,IAAI,gBAAgB,QAAA,CAAS,CAAA,EAAG,QAAQ,CAAA,EAAA,CAAI,GAAG,OAAO,IAAA;AACtD,EAAA,IAAI,gBAAgB,QAAA,CAAS,CAAA,EAAG,QAAQ,CAAA,MAAA,CAAQ,GAAG,OAAO,IAAA;AAE1D,EAAA,OAAO,KAAA;AACT;AAaO,SAAS,UAAA,CAAW,MAAgB,UAAA,EAA+B;AACxE,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,IAAA,CAAK,MAAM,OAAO,KAAA;AAEhC,EAAA,MAAM,SAAA,GAAY,gBAAA,CAAiB,IAAA,CAAK,IAAI,CAAA;AAC5C,EAAA,OAAO,WAAW,IAAA,CAAK,CAAC,SAAS,SAAA,CAAU,QAAA,CAAS,IAAI,CAAC,CAAA;AAC3D;AASO,SAAS,kBAAA,CACd,IAAA,EACA,eAAA,GAA4C,gBAAA,EAClC;AACV,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,IAAA,CAAK,IAAA,SAAa,EAAC;AAEjC,EAAA,MAAM,SAAA,GAAY,gBAAA,CAAiB,IAAA,CAAK,IAAI,CAAA;AAC5C,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAY;AAEpC,EAAA,KAAA,MAAW,QAAQ,SAAA,EAAW;AAC5B,IAAA,MAAM,SAAA,GAAY,gBAAgB,IAAI,CAAA;AACtC,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,KAAA,MAAW,QAAQ,SAAA,EAAW;AAC5B,QAAA,WAAA,CAAY,IAAI,IAAI,CAAA;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,KAAA,CAAM,KAAK,WAAW,CAAA;AAC/B","file":"chunk-L4EZKIEX.js","sourcesContent":["export interface Role {\n  name: string;\n  level: number;\n  inherits: string[];\n  description: string;\n  createdAt?: string;\n  updatedAt?: string;\n}\n\nexport interface Permission {\n  resource: string;\n  action: \"create\" | \"read\" | \"update\" | \"delete\" | \"admin\";\n  conditions?: Condition[];\n}\n\nexport interface Condition {\n  field: string;\n  operator:\n    | \"eq\"\n    | \"neq\"\n    | \"in\"\n    | \"nin\"\n    | \"gt\"\n    | \"lt\"\n    | \"gte\"\n    | \"lte\"\n    | \"contains\";\n  value: any;\n}\n\nexport interface RolePermission {\n  role: string;\n  permissions: Permission[];\n}\n\nexport const DEFAULT_ROLES: Role[] = [\n  {\n    name: \"super_admin\",\n    level: 100,\n    inherits: [],\n    description: \"Full system access across all tenants\",\n  },\n  {\n    name: \"admin\",\n    level: 90,\n    inherits: [\"editor\"],\n    description: \"Full tenant access with all content permissions\",\n  },\n  {\n    name: \"editor\",\n    level: 70,\n    inherits: [\"author\"],\n    description: \"Edit and publish all content\",\n  },\n  {\n    name: \"author\",\n    level: 50,\n    inherits: [\"customer\"],\n    description: \"Create and edit own content\",\n  },\n  {\n    name: \"customer\",\n    level: 30,\n    inherits: [],\n    description: \"Access own data and make purchases\",\n  },\n  {\n    name: \"guest\",\n    level: 10,\n    inherits: [],\n    description: \"Public read-only access\",\n  },\n];\n\nexport const DEFAULT_PERMISSIONS: Permission[] = [\n  { resource: \"users\", action: \"admin\" },\n  { resource: \"users\", action: \"read\" },\n  { resource: \"users\", action: \"create\" },\n  { resource: \"users\", action: \"update\" },\n  { resource: \"users\", action: \"delete\" },\n\n  { resource: \"audit_logs\", action: \"admin\" },\n  { resource: \"audit_logs\", action: \"read\" },\n\n  { resource: \"posts\", action: \"admin\" },\n  { resource: \"posts\", action: \"read\" },\n  { resource: \"posts\", action: \"create\" },\n  { resource: \"posts\", action: \"update\" },\n  { resource: \"posts\", action: \"delete\" },\n\n  { resource: \"pages\", action: \"admin\" },\n  { resource: \"pages\", action: \"read\" },\n  { resource: \"pages\", action: \"create\" },\n  { resource: \"pages\", action: \"update\" },\n  { resource: \"pages\", action: \"delete\" },\n\n  { resource: \"media\", action: \"admin\" },\n  { resource: \"media\", action: \"read\" },\n  { resource: \"media\", action: \"create\" },\n  { resource: \"media\", action: \"update\" },\n  { resource: \"media\", action: \"delete\" },\n\n  { resource: \"categories\", action: \"admin\" },\n  { resource: \"categories\", action: \"read\" },\n  { resource: \"categories\", action: \"create\" },\n  { resource: \"categories\", action: \"update\" },\n  { resource: \"categories\", action: \"delete\" },\n\n  { resource: \"products\", action: \"admin\" },\n  { resource: \"products\", action: \"read\" },\n  { resource: \"products\", action: \"create\" },\n  { resource: \"products\", action: \"update\" },\n  { resource: \"products\", action: \"delete\" },\n\n  { resource: \"orders\", action: \"admin\" },\n  { resource: \"orders\", action: \"read\" },\n  { resource: \"orders\", action: \"create\" },\n  { resource: \"orders\", action: \"update\" },\n  { resource: \"orders\", action: \"delete\" },\n\n  { resource: \"customers\", action: \"admin\" },\n  { resource: \"customers\", action: \"read\" },\n  { resource: \"customers\", action: \"create\" },\n  { resource: \"customers\", action: \"update\" },\n  { resource: \"customers\", action: \"delete\" },\n\n  { resource: \"coupons\", action: \"admin\" },\n  { resource: \"coupons\", action: \"read\" },\n  { resource: \"coupons\", action: \"create\" },\n  { resource: \"coupons\", action: \"update\" },\n  { resource: \"coupons\", action: \"delete\" },\n\n  { resource: \"menu\", action: \"admin\" },\n  { resource: \"menu\", action: \"read\" },\n  { resource: \"menu\", action: \"create\" },\n  { resource: \"menu\", action: \"update\" },\n  { resource: \"menu\", action: \"delete\" },\n\n  { resource: \"settings\", action: \"admin\" },\n  { resource: \"settings\", action: \"read\" },\n  { resource: \"settings\", action: \"update\" },\n\n  { resource: \"profile\", action: \"admin\" },\n  { resource: \"profile\", action: \"read\" },\n  { resource: \"profile\", action: \"update\" },\n];\n\nexport const ROLE_PERMISSIONS: Record<string, string[]> = {\n  super_admin: [\"*\"],\n\n  admin: [\n    \"users:admin\",\n    \"users:read\",\n    \"users:update\",\n    \"audit_logs:read\",\n    \"posts:admin\",\n    \"posts:read\",\n    \"posts:create\",\n    \"posts:update\",\n    \"posts:delete\",\n    \"pages:admin\",\n    \"pages:read\",\n    \"pages:create\",\n    \"pages:update\",\n    \"pages:delete\",\n    \"media:admin\",\n    \"media:read\",\n    \"media:create\",\n    \"media:update\",\n    \"media:delete\",\n    \"categories:admin\",\n    \"categories:read\",\n    \"categories:create\",\n    \"categories:update\",\n    \"categories:delete\",\n    \"products:admin\",\n    \"products:read\",\n    \"products:create\",\n    \"products:update\",\n    \"products:delete\",\n    \"orders:admin\",\n    \"orders:read\",\n    \"orders:update\",\n    \"customers:admin\",\n    \"customers:read\",\n    \"customers:update\",\n    \"coupons:admin\",\n    \"coupons:read\",\n    \"coupons:create\",\n    \"coupons:update\",\n    \"coupons:delete\",\n    \"navigation:admin\",\n    \"navigation:read\",\n    \"navigation:create\",\n    \"navigation:update\",\n    \"navigation:delete\",\n    \"settings:admin\",\n    \"settings:read\",\n    \"settings:update\",\n    \"profile:admin\",\n    \"profile:read\",\n    \"profile:update\",\n  ],\n\n  editor: [\n    \"posts:admin\",\n    \"posts:read\",\n    \"posts:create\",\n    \"posts:update\",\n    \"posts:delete\",\n    \"pages:admin\",\n    \"pages:read\",\n    \"pages:create\",\n    \"pages:update\",\n    \"pages:delete\",\n    \"media:read\",\n    \"media:create\",\n    \"media:update\",\n    \"categories:read\",\n    \"categories:create\",\n    \"categories:update\",\n    \"products:read\",\n    \"orders:read\",\n    \"orders:update\",\n    \"navigation:read\",\n    \"navigation:create\",\n    \"navigation:update\",\n    \"profile:read\",\n    \"profile:update\",\n  ],\n\n  author: [\n    \"posts:read\",\n    \"posts:create\",\n    \"posts:update\",\n    \"media:read\",\n    \"media:create\",\n    \"categories:read\",\n    \"profile:read\",\n    \"profile:update\",\n  ],\n\n  customer: [\"profile:read\", \"profile:update\", \"orders:read\", \"orders:create\"],\n\n  guest: [\"posts:read\", \"pages:read\", \"products:read\"],\n};\n\nexport function getRoleHierarchy(\n  role: string,\n  roles: Role[] = DEFAULT_ROLES,\n): string[] {\n  const hierarchy: string[] = [role];\n  const roleMap = new Map(roles.map((r) => [r.name, r]));\n\n  const addInherited = (r: string) => {\n    const roleData = roleMap.get(r);\n    if (roleData && roleData.inherits) {\n      for (const inherited of roleData.inherits) {\n        if (!hierarchy.includes(inherited)) {\n          hierarchy.push(inherited);\n          addInherited(inherited);\n        }\n      }\n    }\n  };\n\n  addInherited(role);\n  return hierarchy;\n}\n\nexport function getRoleLevel(\n  role: string,\n  roles: Role[] = DEFAULT_ROLES,\n): number {\n  const roleMap = new Map(roles.map((r) => [r.name, r]));\n  const roleData = roleMap.get(role);\n  return roleData?.level ?? 0;\n}\n\nexport function isRoleHigherOrEqual(\n  role1: string,\n  role2: string,\n  roles: Role[] = DEFAULT_ROLES,\n): boolean {\n  return getRoleLevel(role1, roles) >= getRoleLevel(role2, roles);\n}\n\nexport function canInheritRole(\n  role: string,\n  targetRole: string,\n  roles: Role[] = DEFAULT_ROLES,\n): boolean {\n  const hierarchy = getRoleHierarchy(role, roles);\n  return hierarchy.includes(targetRole);\n}\n","import type { AuthUser } from \"../types.js\";\nimport {\n  ROLE_PERMISSIONS,\n  getRoleHierarchy,\n  type Permission,\n  type Condition,\n} from \"./roles.js\";\n\nexport interface PermissionContext {\n  user: AuthUser;\n  resource?: string;\n  action?: string;\n  doc?: Record<string, any>;\n  data?: Record<string, any>;\n  tenantId?: string;\n}\n\nexport function hasPermission(\n  user: AuthUser,\n  permission: string,\n  rolePermissions: Record<string, string[]> = ROLE_PERMISSIONS,\n): boolean {\n  if (!user || !user.role) return false;\n\n  const userPermissions = getUserPermissions(user, rolePermissions);\n\n  if (userPermissions.includes(\"*\")) return true;\n  if (userPermissions.includes(permission)) return true;\n\n  const [resource, action] = permission.split(\":\");\n  if (userPermissions.includes(`${resource}:*`)) return true;\n  if (userPermissions.includes(`${resource}:admin`)) return true;\n\n  return false;\n}\n\nexport function hasRole(\n  user: AuthUser,\n  role: string,\n  roles: string[] = [],\n): boolean {\n  if (!user || !user.role) return false;\n\n  const hierarchy = getRoleHierarchy(user.role);\n  return hierarchy.includes(role);\n}\n\nexport function hasAnyRole(user: AuthUser, checkRoles: string[]): boolean {\n  if (!user || !user.role) return false;\n\n  const hierarchy = getRoleHierarchy(user.role);\n  return checkRoles.some((role) => hierarchy.includes(role));\n}\n\nexport function hasAllRoles(user: AuthUser, checkRoles: string[]): boolean {\n  if (!user || !user.role) return false;\n\n  const hierarchy = getRoleHierarchy(user.role);\n  return checkRoles.every((role) => hierarchy.includes(role));\n}\n\nexport function getUserPermissions(\n  user: AuthUser,\n  rolePermissions: Record<string, string[]> = ROLE_PERMISSIONS,\n): string[] {\n  if (!user || !user.role) return [];\n\n  const hierarchy = getRoleHierarchy(user.role);\n  const permissions = new Set<string>();\n\n  for (const role of hierarchy) {\n    const rolePerms = rolePermissions[role];\n    if (rolePerms) {\n      for (const perm of rolePerms) {\n        permissions.add(perm);\n      }\n    }\n  }\n\n  return Array.from(permissions);\n}\n\nexport function getEffectivePermissions(\n  user: AuthUser,\n  rolePermissions: Record<string, string[]> = ROLE_PERMISSIONS,\n): string[] {\n  return getUserPermissions(user, rolePermissions);\n}\n\nexport function canAccessResource(\n  user: AuthUser,\n  resource: string,\n  action: string,\n  rolePermissions: Record<string, string[]> = ROLE_PERMISSIONS,\n): boolean {\n  return hasPermission(user, `${resource}:${action}`, rolePermissions);\n}\n\nexport function filterPermissions(\n  permissions: string[],\n  resource?: string,\n): string[] {\n  if (!resource) return permissions;\n\n  return permissions.filter((perm) => {\n    const [permResource] = perm.split(\":\");\n    return permResource === resource || permResource === \"*\";\n  });\n}\n\nexport function parsePermission(permission: string): {\n  resource: string;\n  action: string;\n  condition?: Condition;\n} {\n  const [resource, action, ...rest] = permission.split(\":\");\n  return {\n    resource,\n    action,\n    condition: rest.length > 0 ? JSON.parse(rest.join(\":\")) : undefined,\n  };\n}\n\nexport function buildPermission(\n  resource: string,\n  action: string,\n  condition?: Condition,\n): string {\n  if (condition) {\n    return `${resource}:${action}:${JSON.stringify(condition)}`;\n  }\n  return `${resource}:${action}`;\n}\n\nexport function evaluateCondition(\n  condition: Condition,\n  context: Record<string, any>,\n): boolean {\n  const { field, operator, value } = condition;\n  const fieldValue = context[field];\n\n  if (fieldValue === undefined) return false;\n\n  switch (operator) {\n    case \"eq\":\n      return fieldValue === value;\n    case \"neq\":\n      return fieldValue !== value;\n    case \"in\":\n      return Array.isArray(value) && value.includes(fieldValue);\n    case \"nin\":\n      return Array.isArray(value) && !value.includes(fieldValue);\n    case \"gt\":\n      return fieldValue > value;\n    case \"lt\":\n      return fieldValue < value;\n    case \"gte\":\n      return fieldValue >= value;\n    case \"lte\":\n      return fieldValue <= value;\n    case \"contains\":\n      if (typeof fieldValue === \"string\") {\n        return fieldValue.includes(value);\n      }\n      if (Array.isArray(fieldValue)) {\n        return fieldValue.includes(value);\n      }\n      return false;\n    default:\n      return false;\n  }\n}\n\nexport function evaluateConditions(\n  conditions: Condition[],\n  context: Record<string, any>,\n): boolean {\n  if (!conditions || conditions.length === 0) return true;\n\n  return conditions.every((condition) => evaluateCondition(condition, context));\n}\n\nexport function resolveConditionValue(\n  value: any,\n  context: Record<string, any>,\n): any {\n  if (typeof value !== \"string\") return value;\n\n  if (value.startsWith(\"${\") && value.endsWith(\"}\")) {\n    const path = value.slice(2, -1);\n    const keys = path.split(\".\");\n    let resolved = context;\n\n    for (const key of keys) {\n      if (resolved === undefined || resolved === null) return undefined;\n      resolved = resolved[key];\n    }\n\n    return resolved;\n  }\n\n  return value;\n}\n\nexport function evaluateConditionWithContext(\n  condition: Condition,\n  context: Record<string, any>,\n): boolean {\n  const resolvedCondition = {\n    ...condition,\n    value: resolveConditionValue(condition.value, context),\n  };\n\n  return evaluateCondition(resolvedCondition, context);\n}\n\nexport class PermissionChecker {\n  private rolePermissions: Record<string, string[]>;\n\n  constructor(rolePermissions: Record<string, string[]> = ROLE_PERMISSIONS) {\n    this.rolePermissions = rolePermissions;\n  }\n\n  check(user: AuthUser, permission: string): boolean {\n    return hasPermission(user, permission, this.rolePermissions);\n  }\n\n  checkRole(user: AuthUser, role: string): boolean {\n    return hasRole(user, role);\n  }\n\n  checkAnyRole(user: AuthUser, roles: string[]): boolean {\n    return hasAnyRole(user, roles);\n  }\n\n  checkAllRoles(user: AuthUser, roles: string[]): boolean {\n    return hasAllRoles(user, roles);\n  }\n\n  getPermissions(user: AuthUser): string[] {\n    return getUserPermissions(user, this.rolePermissions);\n  }\n\n  canAccess(user: AuthUser, resource: string, action: string): boolean {\n    return canAccessResource(user, resource, action, this.rolePermissions);\n  }\n\n  filterByResource(permissions: string[], resource: string): string[] {\n    return filterPermissions(permissions, resource);\n  }\n}\n"]}

package/dist/{chunk-REK7AYOC.js → chunk-L5UKKZQN.js}

@@ -1,8 +1,52 @@
-import { evaluateAccess } from './chunk-SDMNUYVU.js';
-import { GraphQLObjectType, GraphQLString, GraphQLInputObjectType, GraphQLInt, GraphQLBoolean, GraphQLList, GraphQLNonNull, GraphQLSchema, GraphQLFloat } from 'graphql';
+import { hasApiKeyPermission, evaluateAccess } from './chunk-CJONKRHJ.js';
+import { hasPermission } from './chunk-L4EZKIEX.js';
+import { GraphQLObjectType, GraphQLString, GraphQLInputObjectType, GraphQLBoolean, GraphQLInt, GraphQLList, GraphQLNonNull, GraphQLSchema, GraphQLFloat } from 'graphql';
 
 async function checkGraphQLAccess(collection, operation, context) {
   const accessRule = collection.access?.[operation];
+  if (context.apiKey?.permissions?.length > 0) {
+    const resource = collection.slug;
+    const action = operation === "read" ? "read" : operation === "create" ? "create" : "update";
+    const permission = `${resource}:${action}`;
+    if (!hasApiKeyPermission(context.apiKey.permissions, permission) && !hasApiKeyPermission(context.apiKey.permissions, `${resource}:admin`)) {
+      return { allowed: false };
+    }
+  }
+  if (context.user) {
+    const resource = collection.slug;
+    const action = operation === "read" ? "read" : operation === "create" ? "create" : operation === "update" ? "update" : "delete";
+    const permission = `${resource}:${action}`;
+    const userHasPermission = hasPermission(
+      { id: context.user.id, email: context.user.email, role: context.user.role },
+      permission
+    );
+    if (!userHasPermission && !hasPermission(
+      { id: context.user.id, email: context.user.email, role: context.user.role },
+      `${resource}:admin`
+    )) {
+      if (!accessRule) {
+        return { allowed: false };
+      }
+    }
+  }
+  if (!accessRule) {
+    if (!context.user && !context.apiKey) {
+      return { allowed: false };
+    }
+    return { allowed: true };
+  }
+  const result = await evaluateAccess(accessRule, {
+    req: context.req,
+    user: context.user,
+    tenantID: context.tenantID
+  });
+  if (typeof result === "boolean") {
+    return { allowed: result };
+  }
+  return { allowed: true, extraWhere: result };
+}
+async function checkGlobalAccess(global, operation, context) {
+  const accessRule = global.access?.[operation];
   if (!accessRule) {
     if (!context.user) {
       return { allowed: false };
@@ -21,9 +65,9 @@ async function checkGraphQLAccess(collection, operation, context) {
   if (typeof result === "boolean") {
     return { allowed: result };
   }
-  return { allowed: true, extraWhere: result };
+  return { allowed: true };
 }
-function fieldToGraphQLType(field, registry) {
+function fieldToGraphQLType(field, registry, collectionTypes, isInputType = false) {
   switch (field.type) {
     case "text":
     case "email":
@@ -47,13 +91,19 @@ function fieldToGraphQLType(field, registry) {
     // JSON as string
     case "relationship":
       if (typeof field.relationTo === "string") {
+        if (isInputType) {
+          return GraphQLString;
+        }
+        if (collectionTypes?.[field.relationTo]) {
+          return collectionTypes[field.relationTo];
+        }
         const relatedCollection = registry.getCollection(field.relationTo);
         if (relatedCollection) {
           return new GraphQLObjectType({
             name: `${field.relationTo}_ref`,
             fields: () => ({
               id: { type: GraphQLString },
-              ...buildFieldsFromCollection(relatedCollection, registry)
+              ...buildFieldsFromCollection(relatedCollection, registry, collectionTypes)
             })
           });
         }
@@ -76,12 +126,12 @@ function fieldToGraphQLType(field, registry) {
       return GraphQLString;
   }
 }
-function buildFieldsFromCollection(config, registry) {
+function buildFieldsFromCollection(config, registry, collectionTypes) {
   const fields = {};
   for (const field of config.fields) {
     if (field.name && field.admin?.hidden !== true) {
       fields[field.name] = {
-        type: field.required ? new GraphQLNonNull(fieldToGraphQLType(field, registry)) : fieldToGraphQLType(field, registry),
+        type: field.required ? new GraphQLNonNull(fieldToGraphQLType(field, registry, collectionTypes)) : fieldToGraphQLType(field, registry, collectionTypes),
         description: field.admin?.description || field.label
       };
     }
@@ -89,7 +139,7 @@ function buildFieldsFromCollection(config, registry) {
   return fields;
 }
 function buildGraphQLSchema(options) {
-  const { registry, db, user, req, tenantID, settings } = options;
+  const { registry, db, user, req, tenantID, apiKey, settings } = options;
   const apiAccess = settings?.access?.apiAccess;
   if (apiAccess?.graphqlEnabled === false) {
     throw new Error("GraphQL API is disabled");
@@ -103,7 +153,7 @@ function buildGraphQLSchema(options) {
       name: `${collection.slug.replace(/-/g, "_")}_type`,
       fields: () => ({
         id: { type: GraphQLString },
-        ...buildFieldsFromCollection(collection, registry),
+        ...buildFieldsFromCollection(collection, registry, collectionTypes),
         ...collection.timestamps ? {
           createdAt: { type: GraphQLString },
           updatedAt: { type: GraphQLString }
@@ -117,7 +167,7 @@ function buildGraphQLSchema(options) {
     for (const field of collection.fields) {
       if (field.name && field.name !== "id") {
         inputFields[field.name] = {
-          type: fieldToGraphQLType(field, registry)
+          type: fieldToGraphQLType(field, registry, collectionTypes, true)
         };
       }
     }
@@ -127,6 +177,7 @@ function buildGraphQLSchema(options) {
     });
   }
   const globalTypes = {};
+  const globalInputTypes = {};
   for (const global of globals) {
     globalTypes[global.slug] = new GraphQLObjectType({
       name: `${global.slug.replace(/-/g, "_")}_global_type`,
@@ -134,16 +185,31 @@ function buildGraphQLSchema(options) {
         id: { type: GraphQLString },
         ...buildFieldsFromCollection(
           { slug: global.slug, fields: global.fields },
-          registry
+          registry,
+          collectionTypes
         )
       })
     });
+    globalInputTypes[global.slug] = new GraphQLInputObjectType({
+      name: `${global.slug.replace(/-/g, "_")}_global_input`,
+      fields: () => {
+        const inputFields = {};
+        for (const field of global.fields) {
+          if (field.name && field.name !== "id") {
+            inputFields[field.name] = {
+              type: fieldToGraphQLType(field, registry, collectionTypes, true)
+            };
+          }
+        }
+        return inputFields;
+      }
+    });
   }
   const queryFields = {};
   for (const collection of collections) {
     const type = collectionTypes[collection.slug];
     if (!type) continue;
-    queryFields[`${collection.slug}Find`] = {
+    queryFields[`${collection.slug.replace(/-/g, "_")}Find`] = {
       type: new GraphQLObjectType({
         name: `${collection.slug.replace(/-/g, "_")}_find_result`,
         fields: {
@@ -159,17 +225,22 @@ function buildGraphQLSchema(options) {
         where: { type: GraphQLString },
         sort: { type: GraphQLString },
         limit: { type: GraphQLInt },
-        page: { type: GraphQLInt }
+        page: { type: GraphQLInt },
+        draft: { type: GraphQLBoolean }
       },
       resolve: async (_, args, context) => {
         const access = await checkGraphQLAccess(collection, "read", {
           user,
           req,
-          tenantID
+          tenantID,
+          apiKey
         });
         if (!access.allowed) {
           throw new Error("Access denied");
         }
+        if (tenantID) {
+          db.setTenantContext({ tenantId: tenantID, userId: user?.id ?? "", role: user?.role, isSuperAdmin: user?.role === "super_admin" });
+        }
         let where = {};
         if (args.where) {
           try {
@@ -180,39 +251,48 @@ function buildGraphQLSchema(options) {
         if (access.extraWhere) {
           where = { ...where, ...access.extraWhere };
         }
+        const isDraft = args.draft ?? !!user;
         return db.find({
           collection: collection.slug,
           where,
           sort: args.sort,
           limit: args.limit || 10,
           page: args.page || 1,
-          tenantID
+          tenantID,
+          draft: isDraft
         });
       }
     };
-    queryFields[`${collection.slug}FindByID`] = {
+    queryFields[`${collection.slug.replace(/-/g, "_")}FindByID`] = {
       type,
       args: {
-        id: { type: new GraphQLNonNull(GraphQLString) }
+        id: { type: new GraphQLNonNull(GraphQLString) },
+        draft: { type: GraphQLBoolean }
       },
       resolve: async (_, args, context) => {
         const access = await checkGraphQLAccess(collection, "read", {
           user,
           req,
-          tenantID
+          tenantID,
+          apiKey
         });
         if (!access.allowed) {
           throw new Error("Access denied");
         }
+        if (tenantID) {
+          db.setTenantContext({ tenantId: tenantID, userId: user?.id ?? "", role: user?.role, isSuperAdmin: user?.role === "super_admin" });
+        }
+        const isDraft = args.draft ?? !!user;
         const doc = await db.findByID({
           collection: collection.slug,
           id: args.id,
-          tenantID
+          tenantID,
+          draft: isDraft
         });
         return doc;
       }
     };
-    queryFields[`${collection.slug}Count`] = {
+    queryFields[`${collection.slug.replace(/-/g, "_")}Count`] = {
       type: new GraphQLObjectType({
         name: `${collection.slug.replace(/-/g, "_")}_count`,
         fields: {
@@ -226,7 +306,8 @@ function buildGraphQLSchema(options) {
         const access = await checkGraphQLAccess(collection, "read", {
           user,
           req,
-          tenantID
+          tenantID,
+          apiKey
         });
         if (!access.allowed) {
           return { totalDocs: 0 };
@@ -250,9 +331,20 @@ function buildGraphQLSchema(options) {
   for (const global of globals) {
     const type = globalTypes[global.slug];
     if (!type) continue;
-    queryFields[`${global.slug}Get`] = {
+    queryFields[`${global.slug.replace(/-/g, "_")}Get`] = {
       type,
       resolve: async () => {
+        const access = await checkGlobalAccess(global, "read", {
+          user,
+          req,
+          tenantID
+        });
+        if (!access.allowed) {
+          throw new Error("Access denied: cannot read global");
+        }
+        if (tenantID) {
+          db.setTenantContext({ tenantId: tenantID, userId: user?.id ?? "", role: user?.role, isSuperAdmin: user?.role === "super_admin" });
+        }
         return db.findOne({
           collection: `_globals_${global.slug}`,
           where: {},
@@ -270,7 +362,7 @@ function buildGraphQLSchema(options) {
     const type = collectionTypes[collection.slug];
     const inputType = collectionInputTypes[collection.slug];
     if (!type || !inputType) continue;
-    mutationFields[`${collection.slug}Create`] = {
+    mutationFields[`${collection.slug.replace(/-/g, "_")}Create`] = {
       type: new GraphQLObjectType({
         name: `${collection.slug.replace(/-/g, "_")}_create_result`,
         fields: {
@@ -285,11 +377,15 @@ function buildGraphQLSchema(options) {
         const access = await checkGraphQLAccess(collection, "create", {
           user,
           req,
-          tenantID
+          tenantID,
+          apiKey
         });
         if (!access.allowed) {
           throw new Error("Access denied: cannot create");
         }
+        if (tenantID) {
+          db.setTenantContext({ tenantId: tenantID, userId: user?.id ?? "", role: user?.role, isSuperAdmin: user?.role === "super_admin" });
+        }
         const schema = registry.getCreateZodSchema(collection.slug);
         const validated = schema.parse(args.data);
         const doc = await db.create({
@@ -300,7 +396,7 @@ function buildGraphQLSchema(options) {
         return { doc, message: "Created successfully" };
       }
     };
-    mutationFields[`${collection.slug}Update`] = {
+    mutationFields[`${collection.slug.replace(/-/g, "_")}Update`] = {
       type: new GraphQLObjectType({
         name: `${collection.slug.replace(/-/g, "_")}_update_result`,
         fields: {
@@ -310,17 +406,33 @@ function buildGraphQLSchema(options) {
       }),
       args: {
         id: { type: new GraphQLNonNull(GraphQLString) },
-        data: { type: new GraphQLNonNull(inputType) }
+        data: { type: new GraphQLNonNull(inputType) },
+        baseUpdatedAt: { type: GraphQLString }
       },
       resolve: async (_, args, context) => {
         const access = await checkGraphQLAccess(collection, "update", {
           user,
           req,
-          tenantID
+          tenantID,
+          apiKey
         });
         if (!access.allowed) {
           throw new Error("Access denied: cannot update");
         }
+        if (tenantID) {
+          db.setTenantContext({ tenantId: tenantID, userId: user?.id ?? "", role: user?.role, isSuperAdmin: user?.role === "super_admin" });
+        }
+        if (args.baseUpdatedAt) {
+          const originalDoc = await db.findByID({
+            collection: collection.slug,
+            id: args.id,
+            tenantID,
+            draft: true
+          });
+          if (originalDoc && originalDoc.updatedAt && args.baseUpdatedAt !== originalDoc.updatedAt) {
+            throw new Error(`Revision conflict: document has changed since ${args.baseUpdatedAt}. Current updatedAt: ${originalDoc.updatedAt}`);
+          }
+        }
         const schema = registry.getUpdateZodSchema(collection.slug);
         const validated = schema.parse(args.data);
         const doc = await db.update({
@@ -332,7 +444,7 @@ function buildGraphQLSchema(options) {
         return { doc, message: "Updated successfully" };
       }
     };
-    mutationFields[`${collection.slug}Delete`] = {
+    mutationFields[`${collection.slug.replace(/-/g, "_")}Delete`] = {
       type: new GraphQLObjectType({
         name: `${collection.slug.replace(/-/g, "_")}_delete_result`,
         fields: {
@@ -347,11 +459,15 @@ function buildGraphQLSchema(options) {
         const access = await checkGraphQLAccess(collection, "delete", {
           user,
           req,
-          tenantID
+          tenantID,
+          apiKey
         });
         if (!access.allowed) {
           throw new Error("Access denied: cannot delete");
         }
+        if (tenantID) {
+          db.setTenantContext({ tenantId: tenantID, userId: user?.id ?? "", role: user?.role, isSuperAdmin: user?.role === "super_admin" });
+        }
         const doc = await db.delete({
           collection: collection.slug,
           id: args.id,
@@ -361,6 +477,56 @@ function buildGraphQLSchema(options) {
       }
     };
   }
+  for (const global of globals) {
+    const inputType = globalInputTypes[global.slug];
+    if (!inputType) continue;
+    mutationFields[`${global.slug.replace(/-/g, "_")}Update`] = {
+      type: new GraphQLObjectType({
+        name: `${global.slug.replace(/-/g, "_")}_update_result`,
+        fields: {
+          doc: { type: globalTypes[global.slug] || GraphQLString },
+          message: { type: GraphQLString }
+        }
+      }),
+      args: {
+        data: { type: new GraphQLNonNull(inputType) }
+      },
+      resolve: async (_, args, context) => {
+        const access = await checkGlobalAccess(global, "update", {
+          user,
+          req,
+          tenantID
+        });
+        if (!access.allowed) {
+          throw new Error("Access denied: cannot update global");
+        }
+        if (tenantID) {
+          db.setTenantContext({ tenantId: tenantID, userId: user?.id ?? "", role: user?.role, isSuperAdmin: user?.role === "super_admin" });
+        }
+        const doc = await db.findOne({
+          collection: `_globals_${global.slug}`,
+          where: {},
+          tenantID
+        });
+        let result;
+        if (doc) {
+          result = await db.update({
+            collection: `_globals_${global.slug}`,
+            id: doc.id,
+            data: args.data,
+            tenantID
+          });
+        } else {
+          result = await db.create({
+            collection: `_globals_${global.slug}`,
+            data: args.data,
+            tenantID
+          });
+        }
+        return { doc: result, message: "Updated successfully" };
+      }
+    };
+  }
   const Mutation = new GraphQLObjectType({
     name: "Mutation",
     fields: mutationFields
@@ -376,10 +542,11 @@ function createGraphQLSchema(registry, db, options) {
     db,
     user: options?.user,
     req: options?.req,
-    tenantID: options?.tenantID
+    tenantID: options?.tenantID,
+    apiKey: options?.apiKey
   });
 }
 
 export { buildGraphQLSchema, createGraphQLSchema };
-//# sourceMappingURL=chunk-REK7AYOC.js.map
-//# sourceMappingURL=chunk-REK7AYOC.js.map
+//# sourceMappingURL=chunk-L5UKKZQN.js.map
+//# sourceMappingURL=chunk-L5UKKZQN.js.map