@kyro-cms/core 0.9.7 → 0.9.9

package/dist/{chunk-VLK5SJRI.js → chunk-5RFGYEQ3.js}

@@ -2,15 +2,15 @@ import { PasswordPolicy, ConfigService, EmailTransport } from './chunk-6UNONDW7.
 import { usersCollection } from './chunk-XEB7PH2E.js';
 import { SQLiteAuthAdapter } from './chunk-Q72BOAPK.js';
 import { createAuditContext } from './chunk-P2YW545G.js';
-import { WEBHOOK_EVENTS } from './chunk-3UK5XBVJ.js';
-import { API_KEY_COLLECTION, generateApiKey, generateApiKeyPrefix, checkCollectionAccess, checkGlobalAccess, extractApiKeyFromRequest, validateApiKey, createApiKeyContext } from './chunk-NZEUU7QB.js';
+import { WEBHOOK_EVENTS, checkCollectionAccess, checkGlobalAccess } from './chunk-WDTTHKDS.js';
+import { API_KEY_COLLECTION, generateApiKey, generateApiKeyPrefix, extractApiKeyFromRequest, validateApiKey, createApiKeyContext } from './chunk-3AKCVYDB.js';
 import { genId, DrizzleAdapter } from './chunk-V7KZQIZ6.js';
 import { PostgresAuthAdapter } from './chunk-CJX74IYK.js';
 import { MongoDBAdapter } from './chunk-PQ72Z6WC.js';
 import { MongoDBAuthAdapter } from './chunk-7OGPN7MP.js';
 import { hasPermission } from './chunk-L4EZKIEX.js';
 import { __esm, __export, __toCommonJS } from './chunk-4CV4JOE5.js';
-import crypto, { randomBytes, createHash } from 'crypto';
+import crypto, { randomBytes, createHash, createHmac } from 'crypto';
 import { createStorage } from 'unstorage';
 import fsDriver from 'unstorage/drivers/fs';
 import { Hono } from 'hono';
@@ -1671,22 +1671,11 @@ function createLocalStorage(config) {
     }
   };
 }
-
-// src/storage/imgix.ts
 function createImgixStorage(config) {
   const signUrl = (path3, params) => {
     if (!config.signKey) return path3;
-    const signer = new TextEncoder();
-    const key = signer.encode(config.signKey);
-    const data = signer.encode(path3 + params.toString());
-    let hash = 0;
-    const combined = new Uint8Array(key.length + data.length);
-    combined.set(key);
-    combined.set(data, key.length);
-    for (let i = 0; i < combined.length; i++) {
-      hash = (hash << 5) - hash + combined[i] | 0;
-    }
-    params.set("s", Math.abs(hash).toString(16));
+    const signature = createHmac("sha256", config.signKey).update(path3 + params.toString()).digest("hex");
+    params.set("s", signature);
     return path3;
   };
   return {
@@ -2959,7 +2948,7 @@ var MediaService = class _MediaService {
     const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
     return { where, params: p, orderBy: sortDir, sortCol };
   }
-  rowToMedia(row) {
+  rowToMedia(row, origin) {
     return {
       id: row.id,
       filename: row.filename,
@@ -2969,8 +2958,8 @@ var MediaService = class _MediaService {
       fileSize: row.file_size ?? row.fileSize,
       width: row.width ?? null,
       height: row.height ?? null,
-      url: row.url,
-      thumbnailUrl: row.thumbnail_url ?? row.thumbnailUrl ?? null,
+      url: _MediaService.resolveMediaUrl(row.url, origin),
+      thumbnailUrl: _MediaService.resolveMediaUrl(row.thumbnail_url ?? row.thumbnailUrl ?? null, origin),
       folder: row.folder ?? null,
       provider: row.provider,
       alt: row.alt ?? null,
@@ -2980,6 +2969,12 @@ var MediaService = class _MediaService {
       updatedAt: row.updated_at ?? row.updatedAt
     };
   }
+  static resolveMediaUrl(url, origin) {
+    if (!url) return null;
+    if (url.startsWith("http://") || url.startsWith("https://") || url.startsWith("blob:") || url.startsWith("data:")) return url;
+    const base = (process.env.KYRO_BASE_URL || origin || "http://localhost:4321").replace(/\/+$/, "");
+    return `${base}${url.startsWith("/") ? "" : "/"}${url}`;
+  }
   async sqliteRun(sql, params = []) {
     const stmt = this.db.prepare(sql);
     const sqlLower = sql.trim().toLowerCase();
@@ -3107,17 +3102,19 @@ var MediaService = class _MediaService {
     const file = new File([blob], originalName, { type: mimeType });
     return this.upload(file, folder);
   }
-  async delete(id) {
+  async delete(id, origin) {
     let item = null;
     if (this.dialect === "sqlite") {
-      item = this.sqliteGet(`SELECT * FROM ${this.mediaTable} WHERE id = ?`, [
-        id
-      ]);
+      const row = this.sqliteGet(
+        `SELECT * FROM ${this.mediaTable} WHERE id = ?`,
+        [id]
+      );
+      if (row) item = this.rowToMedia(row, origin);
     } else {
       const { media: mediaSchema } = await import('./media-7WDX4BDJ.js');
       const { eq } = await import('drizzle-orm');
       const [row] = await this.db.select().from(mediaSchema).where(eq(mediaSchema.id, id));
-      if (row) item = this.rowToMedia(row);
+      if (row) item = this.rowToMedia(row, origin);
     }
     if (!item) return;
     await this.deleteFile(item.url);
@@ -3138,7 +3135,7 @@ var MediaService = class _MediaService {
   async deleteFile(url) {
     await this.storage.delete(url);
   }
-  async rename(id, newKey) {
+  async rename(id, newKey, origin) {
     let item = null;
     if (this.dialect === "sqlite") {
       item = this.sqliteGet(`SELECT * FROM ${this.mediaTable} WHERE id = ?`, [
@@ -3148,7 +3145,7 @@ var MediaService = class _MediaService {
       const { media: mediaSchema } = await import('./media-7WDX4BDJ.js');
       const { eq } = await import('drizzle-orm');
       const [row] = await this.db.select().from(mediaSchema).where(eq(mediaSchema.id, id));
-      if (row) item = this.rowToMedia(row);
+      if (row) item = this.rowToMedia(row, origin);
     }
     if (!item) return null;
     const newUrl = await this.storage.rename(item.url, newKey);
@@ -3191,20 +3188,20 @@ var MediaService = class _MediaService {
       thumbnailUrl: updateData.thumbnailUrl ?? null
     };
   }
-  async findById(id) {
+  async findById(id, origin) {
     if (this.dialect === "sqlite") {
       const row2 = this.sqliteGet(
         `SELECT * FROM ${this.mediaTable} WHERE id = ?`,
         [id]
       );
-      return row2 ? this.rowToMedia(row2) : null;
+      return row2 ? this.rowToMedia(row2, origin) : null;
     }
     const { media: mediaSchema } = await import('./media-7WDX4BDJ.js');
     const { eq } = await import('drizzle-orm');
     const [row] = await this.db.select().from(mediaSchema).where(eq(mediaSchema.id, id));
-    return row ? this.rowToMedia(row) : null;
+    return row ? this.rowToMedia(row, origin) : null;
   }
-  async find(params = {}) {
+  async find(params = {}, origin) {
     const {
       page = 1,
       limit = 30,
@@ -3240,7 +3237,7 @@ var MediaService = class _MediaService {
         [...p, limit, offset]
       );
       return {
-        docs: rows.map((r) => this.rowToMedia(r)),
+        docs: rows.map((r) => this.rowToMedia(r, origin)),
         totalDocs: totalDocs2,
         page,
         limit,
@@ -3287,14 +3284,14 @@ var MediaService = class _MediaService {
     const [{ count }] = await this.db.select({ count: sql`count(*)` }).from(mediaSchema).where(whereClause);
     const totalDocs = Number(count);
     return {
-      docs: docs.map((r) => this.rowToMedia(r)),
+      docs: docs.map((r) => this.rowToMedia(r, origin)),
       totalDocs,
       page,
       limit,
       totalPages: Math.ceil(totalDocs / limit)
     };
   }
-  async update(id, data) {
+  async update(id, data, origin) {
     const now = this.now();
     if (this.dialect === "sqlite") {
       const sets = ["updated_at = ?"];
@@ -3313,7 +3310,7 @@ var MediaService = class _MediaService {
       }
       if (data.folder !== void 0) {
         sets.push("folder = ?");
-        p.push(data.folder || null);
+        p.push(data.folder);
       }
       p.push(id);
       await this.sqliteRun(
@@ -3324,12 +3321,12 @@ var MediaService = class _MediaService {
         `SELECT * FROM ${this.mediaTable} WHERE id = ?`,
         [id]
       );
-      return row ? this.rowToMedia(row) : null;
+      return row ? this.rowToMedia(row, origin) : null;
     }
     const { media: mediaSchema } = await import('./media-7WDX4BDJ.js');
     const { eq } = await import('drizzle-orm');
     const [updated] = await this.db.update(mediaSchema).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(eq(mediaSchema.id, id)).returning();
-    return updated ? this.rowToMedia(updated) : null;
+    return updated ? this.rowToMedia(updated, origin) : null;
   }
   async updateMany(ids, data) {
     const now = this.now();
@@ -4116,12 +4113,13 @@ function createHonoApp(options) {
       const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
       if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
+      const origin = new URL(c.req.url).origin;
       const page = parseInt(c.req.query("page") || "1");
       const limit = parseInt(c.req.query("limit") || "30");
       const search = c.req.query("search") || "";
       const type = c.req.query("type") || "";
       const folder = c.req.query("folder") || "";
-      const result = await service.find({ page, limit, search, type, folder });
+      const result = await service.find({ page, limit, search, type, folder }, origin);
       return c.json(result);
     } catch (error) {
       console.error("[Media] find error:", error);
@@ -4205,7 +4203,8 @@ function createHonoApp(options) {
       if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       const id = c.req.param("id");
-      await service.delete(id);
+      const origin = new URL(c.req.url).origin;
+      await service.delete(id, origin);
       return c.json({ success: true });
     } catch (error) {
       console.error("[Media] delete error:", error);
@@ -4261,7 +4260,8 @@ function createHonoApp(options) {
       if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       const id = c.req.param("id");
-      const doc = await service.findById(id);
+      const origin = new URL(c.req.url).origin;
+      const doc = await service.findById(id, origin);
       if (!doc) return c.json({ error: "Media not found" }, 404);
       return c.json(doc);
     } catch (error) {
@@ -4276,8 +4276,9 @@ function createHonoApp(options) {
       const service = await getMedia();
       const id = c.req.param("id");
       const body = await c.req.json();
+      const origin = new URL(c.req.url).origin;
       if (body.folder !== void 0) {
-        const updated = await service.update(id, { folder: body.folder });
+        const updated = await service.update(id, { folder: body.folder }, origin);
         return c.json({ doc: updated });
       }
       return c.json({ error: "No valid fields to update" }, 400);
@@ -5058,6 +5059,75 @@ function createHonoApp(options) {
       return c.json({ error: error.message }, 500);
     }
   });
+  function serializeField(field) {
+    const safe = {};
+    const keys = [
+      "name",
+      "type",
+      "required",
+      "hasMany",
+      "relationTo",
+      "options",
+      "min",
+      "max",
+      "minLength",
+      "maxLength",
+      "defaultValue",
+      "label",
+      "localized",
+      "admin",
+      "unique",
+      "index",
+      "hidden",
+      "readOnly",
+      "deprecated"
+    ];
+    for (const k of keys) {
+      if (k in field) safe[k] = field[k];
+    }
+    if (field.fields) {
+      safe.fields = field.fields.map(serializeField);
+    }
+    if (field.tabs) {
+      safe.tabs = field.tabs.map((t) => ({
+        label: t.label,
+        name: t.name,
+        fields: t.fields.map(serializeField)
+      }));
+    }
+    return safe;
+  }
+  app.get("/api/__schema", async (c) => {
+    try {
+      const { user: ctxUser, apiKeyContext } = await resolveAuthContext(
+        c.req.raw,
+        authMw,
+        user,
+        tenantID
+      );
+      if (!ctxUser && !apiKeyContext) {
+        return c.json({ error: "Unauthorized" }, 401);
+      }
+      const cols = registry.getCollections().filter(
+        (col) => col.slug !== "users" && col.slug !== "audit_logs"
+      );
+      const serialized = cols.map((col) => ({
+        slug: col.slug,
+        label: col.label,
+        labelPlural: col.labelPlural,
+        singularLabel: col.singularLabel,
+        timestamps: col.timestamps,
+        auth: !!col.auth,
+        tenantScoped: !!col.tenantScoped,
+        upload: col.upload ? { staticDir: col.upload.staticDir, imageSizes: col.upload.imageSizes, mimeTypes: col.upload.mimeTypes } : void 0,
+        fields: col.fields.map(serializeField)
+      }));
+      return c.json(serialized);
+    } catch (error) {
+      console.error("[Schema] error:", error);
+      return c.json({ error: error.message }, 500);
+    }
+  });
   const collections = registry.getCollections();
   for (const collection of collections) {
     let computeDiff2 = function(a, b) {
@@ -5103,10 +5173,20 @@ function createHonoApp(options) {
         const sort = url.searchParams.get("sort") || void 0;
         const depth = parseInt(url.searchParams.get("depth") || "0");
         const select = url.searchParams.get("select")?.split(",") || void 0;
-        const isDraftRequest = !!ctxUser;
+        const draftParam = url.searchParams.get("draft");
+        const isDraftRequest = draftParam === "true" ? true : draftParam === "false" ? false : !!ctxUser;
+        let where = {};
+        const whereRaw = url.searchParams.get("where");
+        if (whereRaw) {
+          try {
+            where = JSON.parse(whereRaw);
+          } catch {
+            return c.json({ error: "Invalid JSON in where parameter" }, 400);
+          }
+        }
         const result = await db.find({
           collection: slug,
-          where: {},
+          where,
           sort,
           limit,
           page,
@@ -5295,7 +5375,8 @@ function createHonoApp(options) {
         const url = new URL(c.req.url);
         const depth = parseInt(url.searchParams.get("depth") || "0");
         const select = url.searchParams.get("select")?.split(",") || void 0;
-        const isDraftRequest = !!ctxUser;
+        const draftParam = url.searchParams.get("draft");
+        const isDraftRequest = draftParam === "true" ? true : draftParam === "false" ? false : !!ctxUser;
         let doc = await db.findByID({
           collection: slug,
           id,
@@ -6282,7 +6363,6 @@ function createHonoApp(options) {
           data: doc,
           message: "Version restored successfully"
         });
-        return c.json({ data: doc, message: "Restored successfully" });
       } catch (error) {
         return c.json({ error: error.message }, 500);
       }
@@ -6368,6 +6448,13 @@ Sent at: ${(/* @__PURE__ */ new Date()).toLocaleString()}`
       });
     }
   }
+  app.onError((err, c) => {
+    console.error(`[API Error] ${c.req.method} ${c.req.path}:`, err);
+    return c.json(
+      { error: err.message || "Internal server error", code: "INTERNAL_ERROR" },
+      500
+    );
+  });
   return app;
 }
 function createRESTAPI(registry, db, options) {
@@ -6384,5 +6471,5 @@ function createRESTAPI(registry, db, options) {
 }
 
 export { AuditLogger, AuthRoutes, InMemoryAuditLogger, InMemoryRateLimiter, MediaService, createAuditContext2 as createAuditContext, createCloudinaryStorage, createFtpStorage, createHonoApp, createLocalStorage, createRESTAPI, createS3Storage, getAppSecret, getDefaultRegistry, getEncryptionKey, getSessionConfig, init_secret, loadSecrets, resolveProvider, setDbAdapter };
-//# sourceMappingURL=chunk-VLK5SJRI.js.map
-//# sourceMappingURL=chunk-VLK5SJRI.js.map
+//# sourceMappingURL=chunk-5RFGYEQ3.js.map
+//# sourceMappingURL=chunk-5RFGYEQ3.js.map