@momentumcms/server-analog 0.5.3 → 0.5.4

package/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.5.4 (2026-03-07)
+
+This was a version bump only for server-analog to align it with other projects, there were no code changes.
+
 ## 0.5.0 (2026-02-23)
 
 This was a version bump only for server-analog to align it with other projects, there were no code changes.

package/index.cjs

@@ -1452,6 +1452,14 @@ var MediaCollection = defineCollection({
   }
 });
 
+// libs/core/src/lib/versions/version.types.ts
+function hasVersionDrafts(collection) {
+  const v = collection.versions;
+  if (!v || typeof v === "boolean")
+    return false;
+  return !!v.drafts;
+}
+
 // libs/server-core/src/lib/field-access.ts
 function hasFieldAccessControl(fields) {
   for (const field of fields) {
@@ -2038,13 +2046,18 @@ var VersionOperationsImpl = class {
     }
     return "draft";
   }
-  async compare(versionId1, versionId2) {
+  async compare(versionId1, versionId2, parentId) {
     await this.checkAccess("readVersions");
     const version1 = await this.findVersionById(versionId1);
     const version2 = await this.findVersionById(versionId2);
     if (!version1 || !version2) {
       throw new Error("One or both versions not found");
     }
+    if (parentId) {
+      if (version1.parent !== parentId || version2.parent !== parentId) {
+        throw new Error("Version does not belong to the specified document");
+      }
+    }
     const data1 = version1.version;
     const data2 = version2.version;
     if (!isRecord(data1) || !isRecord(data2)) {
@@ -2099,6 +2112,9 @@ var VersionOperationsImpl = class {
   // Private Helpers
   // ============================================
   async checkAccess(operation) {
+    if (this.context.overrideAccess) {
+      return;
+    }
     const accessFn = this.collectionConfig.access?.[operation];
     if (!accessFn) {
       return;
@@ -2255,6 +2271,12 @@ var CollectionOperationsImpl = class _CollectionOperationsImpl {
         Object.assign(whereParams, constraints);
       }
     }
+    if (hasVersionDrafts(this.collectionConfig) && !this.context.overrideAccess) {
+      const canSeeDrafts = await this.canReadDrafts();
+      if (!canSeeDrafts) {
+        whereParams["_status"] = "published";
+      }
+    }
     const query = {
       ...queryOptions,
       ...whereParams,
@@ -2317,6 +2339,15 @@ var CollectionOperationsImpl = class _CollectionOperationsImpl {
     doc[softDeleteField]) {
       return null;
     }
+    if (hasVersionDrafts(this.collectionConfig) && !this.context.overrideAccess) {
+      const canSeeDrafts = await this.canReadDrafts();
+      if (!canSeeDrafts) {
+        const record = doc;
+        if (record["_status"] !== "published") {
+          return null;
+        }
+      }
+    }
     if (!this.matchesDefaultWhereConstraints(doc)) {
       return null;
     }
@@ -2402,6 +2433,15 @@ var CollectionOperationsImpl = class _CollectionOperationsImpl {
     if (!this.matchesDefaultWhereConstraints(originalDoc)) {
       throw new DocumentNotFoundError(this.slug, id);
     }
+    if (hasVersionDrafts(this.collectionConfig) && this.adapter.createVersion) {
+      const status = originalDoc["_status"] ?? "draft";
+      await this.adapter.createVersion(this.slug, id, originalDoc, { status });
+      const versionsConfig = this.collectionConfig.versions;
+      const maxPerDoc = typeof versionsConfig === "object" && versionsConfig !== null ? versionsConfig.maxPerDoc : void 0;
+      if (maxPerDoc && this.adapter.deleteVersions) {
+        await this.adapter.deleteVersions(this.slug, id, maxPerDoc);
+      }
+    }
     let processedData = data;
     const softDeleteField = getSoftDeleteField(this.collectionConfig);
     if (softDeleteField && softDeleteField in processedData) {
@@ -2733,6 +2773,30 @@ var CollectionOperationsImpl = class _CollectionOperationsImpl {
       throw new AccessDeniedError(operation, this.slug);
     }
   }
+  /**
+   * Check if the current user can see draft documents (non-throwing).
+   * Uses `access.readDrafts` if configured, otherwise falls back to `access.update`.
+   */
+  async canReadDrafts() {
+    if (!this.context.user)
+      return false;
+    const readDraftsFn = this.collectionConfig.access?.readDrafts;
+    if (readDraftsFn) {
+      try {
+        return !!await Promise.resolve(readDraftsFn({ req: this.buildRequestContext() }));
+      } catch {
+        return false;
+      }
+    }
+    const updateFn = this.collectionConfig.access?.update;
+    if (!updateFn)
+      return true;
+    try {
+      return !!await Promise.resolve(updateFn({ req: this.buildRequestContext() }));
+    } catch {
+      return false;
+    }
+  }
   buildRequestContext() {
     return {
       user: this.context.user
@@ -3412,8 +3476,9 @@ function buildGraphQLSchema(collections) {
   }
   function getOrCreateEnum(field, parentName) {
     const key = `${parentName}_${field.name}`;
-    if (enumCache.has(key)) {
-      return enumCache.get(key);
+    const cached = enumCache.get(key);
+    if (cached) {
+      return cached;
     }
     const values = {};
     for (const opt of field.options) {
@@ -3524,8 +3589,9 @@ function buildGraphQLSchema(collections) {
     }
   }
   function getOrCreateObjectType(fields, typeName) {
-    if (typeCache.has(typeName)) {
-      return typeCache.get(typeName);
+    const cachedType = typeCache.get(typeName);
+    if (cachedType) {
+      return cachedType;
     }
     const objType = new import_graphql2.GraphQLObjectType({
       name: typeName,
@@ -3546,8 +3612,9 @@ function buildGraphQLSchema(collections) {
   }
   function getOrCreateInputType(fields, typeName) {
     const inputName = `${typeName}Input`;
-    if (inputCache.has(inputName)) {
-      return inputCache.get(inputName);
+    const cachedInput = inputCache.get(inputName);
+    if (cachedInput) {
+      return cachedInput;
     }
     const inputType = new import_graphql2.GraphQLInputObjectType({
       name: inputName,

package/index.js

@@ -1419,6 +1419,14 @@ var MediaCollection = defineCollection({
   }
 });
 
+// libs/core/src/lib/versions/version.types.ts
+function hasVersionDrafts(collection) {
+  const v = collection.versions;
+  if (!v || typeof v === "boolean")
+    return false;
+  return !!v.drafts;
+}
+
 // libs/server-core/src/lib/field-access.ts
 function hasFieldAccessControl(fields) {
   for (const field of fields) {
@@ -2005,13 +2013,18 @@ var VersionOperationsImpl = class {
     }
     return "draft";
   }
-  async compare(versionId1, versionId2) {
+  async compare(versionId1, versionId2, parentId) {
     await this.checkAccess("readVersions");
     const version1 = await this.findVersionById(versionId1);
     const version2 = await this.findVersionById(versionId2);
     if (!version1 || !version2) {
       throw new Error("One or both versions not found");
     }
+    if (parentId) {
+      if (version1.parent !== parentId || version2.parent !== parentId) {
+        throw new Error("Version does not belong to the specified document");
+      }
+    }
     const data1 = version1.version;
     const data2 = version2.version;
     if (!isRecord(data1) || !isRecord(data2)) {
@@ -2066,6 +2079,9 @@ var VersionOperationsImpl = class {
   // Private Helpers
   // ============================================
   async checkAccess(operation) {
+    if (this.context.overrideAccess) {
+      return;
+    }
     const accessFn = this.collectionConfig.access?.[operation];
     if (!accessFn) {
       return;
@@ -2222,6 +2238,12 @@ var CollectionOperationsImpl = class _CollectionOperationsImpl {
         Object.assign(whereParams, constraints);
       }
     }
+    if (hasVersionDrafts(this.collectionConfig) && !this.context.overrideAccess) {
+      const canSeeDrafts = await this.canReadDrafts();
+      if (!canSeeDrafts) {
+        whereParams["_status"] = "published";
+      }
+    }
     const query = {
       ...queryOptions,
       ...whereParams,
@@ -2284,6 +2306,15 @@ var CollectionOperationsImpl = class _CollectionOperationsImpl {
     doc[softDeleteField]) {
       return null;
     }
+    if (hasVersionDrafts(this.collectionConfig) && !this.context.overrideAccess) {
+      const canSeeDrafts = await this.canReadDrafts();
+      if (!canSeeDrafts) {
+        const record = doc;
+        if (record["_status"] !== "published") {
+          return null;
+        }
+      }
+    }
     if (!this.matchesDefaultWhereConstraints(doc)) {
       return null;
     }
@@ -2369,6 +2400,15 @@ var CollectionOperationsImpl = class _CollectionOperationsImpl {
     if (!this.matchesDefaultWhereConstraints(originalDoc)) {
       throw new DocumentNotFoundError(this.slug, id);
     }
+    if (hasVersionDrafts(this.collectionConfig) && this.adapter.createVersion) {
+      const status = originalDoc["_status"] ?? "draft";
+      await this.adapter.createVersion(this.slug, id, originalDoc, { status });
+      const versionsConfig = this.collectionConfig.versions;
+      const maxPerDoc = typeof versionsConfig === "object" && versionsConfig !== null ? versionsConfig.maxPerDoc : void 0;
+      if (maxPerDoc && this.adapter.deleteVersions) {
+        await this.adapter.deleteVersions(this.slug, id, maxPerDoc);
+      }
+    }
     let processedData = data;
     const softDeleteField = getSoftDeleteField(this.collectionConfig);
     if (softDeleteField && softDeleteField in processedData) {
@@ -2700,6 +2740,30 @@ var CollectionOperationsImpl = class _CollectionOperationsImpl {
       throw new AccessDeniedError(operation, this.slug);
     }
   }
+  /**
+   * Check if the current user can see draft documents (non-throwing).
+   * Uses `access.readDrafts` if configured, otherwise falls back to `access.update`.
+   */
+  async canReadDrafts() {
+    if (!this.context.user)
+      return false;
+    const readDraftsFn = this.collectionConfig.access?.readDrafts;
+    if (readDraftsFn) {
+      try {
+        return !!await Promise.resolve(readDraftsFn({ req: this.buildRequestContext() }));
+      } catch {
+        return false;
+      }
+    }
+    const updateFn = this.collectionConfig.access?.update;
+    if (!updateFn)
+      return true;
+    try {
+      return !!await Promise.resolve(updateFn({ req: this.buildRequestContext() }));
+    } catch {
+      return false;
+    }
+  }
   buildRequestContext() {
     return {
       user: this.context.user
@@ -3392,8 +3456,9 @@ function buildGraphQLSchema(collections) {
   }
   function getOrCreateEnum(field, parentName) {
     const key = `${parentName}_${field.name}`;
-    if (enumCache.has(key)) {
-      return enumCache.get(key);
+    const cached = enumCache.get(key);
+    if (cached) {
+      return cached;
     }
     const values = {};
     for (const opt of field.options) {
@@ -3504,8 +3569,9 @@ function buildGraphQLSchema(collections) {
     }
   }
   function getOrCreateObjectType(fields, typeName) {
-    if (typeCache.has(typeName)) {
-      return typeCache.get(typeName);
+    const cachedType = typeCache.get(typeName);
+    if (cachedType) {
+      return cachedType;
     }
     const objType = new GraphQLObjectType({
       name: typeName,
@@ -3526,8 +3592,9 @@ function buildGraphQLSchema(collections) {
   }
   function getOrCreateInputType(fields, typeName) {
     const inputName = `${typeName}Input`;
-    if (inputCache.has(inputName)) {
-      return inputCache.get(inputName);
+    const cachedInput = inputCache.get(inputName);
+    if (cachedInput) {
+      return cachedInput;
     }
     const inputType = new GraphQLInputObjectType({
       name: inputName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@momentumcms/server-analog",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "Nitro/h3 adapter for Momentum CMS with Analog.js support",
   "license": "MIT",
   "author": "Momentum CMS Contributors",