@momentumcms/server-express 0.5.3 → 0.5.5

package/index.js

@@ -2202,8 +2202,27 @@ var MediaCollection = defineCollection({
   }
 });
 
+// libs/core/src/lib/migrations.ts
+function resolveMigrationMode(mode) {
+  if (mode === "push" || mode === "migrate")
+    return mode;
+  const env = globalThis["process"]?.env?.["NODE_ENV"];
+  if (env === "production")
+    return "migrate";
+  return "push";
+}
+
 // libs/core/src/lib/config.ts
 var MIN_PASSWORD_LENGTH = 8;
+function shouldSyncSchema(config) {
+  const explicit = config.db.syncSchema ?? "auto";
+  if (typeof explicit === "boolean")
+    return explicit;
+  if (!config.migrations)
+    return true;
+  const mode = resolveMigrationMode(config.migrations.mode);
+  return mode !== "migrate";
+}
 
 // libs/core/src/lib/seeding/seeding.types.ts
 var SEED_TRACKING_COLLECTION_SLUG = "_momentum_seeds";
@@ -2291,6 +2310,14 @@ function createSeedHelpers() {
   };
 }
 
+// libs/core/src/lib/versions/version.types.ts
+function hasVersionDrafts(collection) {
+  const v = collection.versions;
+  if (!v || typeof v === "boolean")
+    return false;
+  return !!v.drafts;
+}
+
 // libs/server-core/src/lib/field-access.ts
 function hasFieldAccessControl(fields) {
   for (const field of fields) {
@@ -2645,6 +2672,12 @@ var DocumentNotFoundError = class extends Error {
     this.name = "DocumentNotFoundError";
   }
 };
+var DraftNotVisibleError = class extends Error {
+  constructor(collection, id) {
+    super(`Draft "${id}" in collection "${collection}" is not visible to the current user`);
+    this.name = "DraftNotVisibleError";
+  }
+};
 var AccessDeniedError = class extends Error {
   constructor(operation, collection) {
     super(`Access denied for ${operation} on collection "${collection}"`);
@@ -2877,13 +2910,18 @@ var VersionOperationsImpl = class {
     }
     return "draft";
   }
-  async compare(versionId1, versionId2) {
+  async compare(versionId1, versionId2, parentId) {
     await this.checkAccess("readVersions");
     const version1 = await this.findVersionById(versionId1);
     const version2 = await this.findVersionById(versionId2);
     if (!version1 || !version2) {
       throw new Error("One or both versions not found");
     }
+    if (parentId) {
+      if (version1.parent !== parentId || version2.parent !== parentId) {
+        throw new Error("Version does not belong to the specified document");
+      }
+    }
     const data1 = version1.version;
     const data2 = version2.version;
     if (!isRecord(data1) || !isRecord(data2)) {
@@ -2938,6 +2976,9 @@ var VersionOperationsImpl = class {
   // Private Helpers
   // ============================================
   async checkAccess(operation) {
+    if (this.context.overrideAccess) {
+      return;
+    }
     const accessFn = this.collectionConfig.access?.[operation];
     if (!accessFn) {
       return;
@@ -3054,13 +3095,31 @@ function stripTransientKeys(data) {
   }
   return result;
 }
+var COMPARISON_OPS = ["gt", "gte", "lt", "lte"];
 function flattenWhereClause(where) {
   if (!where)
     return {};
   const result = {};
   for (const [field, condition] of Object.entries(where)) {
-    if (typeof condition === "object" && condition !== null && "equals" in condition) {
-      result[field] = condition["equals"];
+    if (typeof condition !== "object" || condition === null) {
+      result[field] = condition;
+      continue;
+    }
+    const condObj = condition;
+    if ("equals" in condObj) {
+      result[field] = condObj["equals"];
+      continue;
+    }
+    const ops = {};
+    let hasComparisonOp = false;
+    for (const op of COMPARISON_OPS) {
+      if (op in condObj) {
+        ops[`$${op}`] = condObj[op];
+        hasComparisonOp = true;
+      }
+    }
+    if (hasComparisonOp) {
+      result[field] = ops;
     } else {
       result[field] = condition;
     }
@@ -3094,6 +3153,12 @@ var CollectionOperationsImpl = class _CollectionOperationsImpl {
         Object.assign(whereParams, constraints);
       }
     }
+    if (hasVersionDrafts(this.collectionConfig) && !this.context.overrideAccess) {
+      const canSeeDrafts = await this.canReadDrafts();
+      if (!canSeeDrafts) {
+        whereParams["_status"] = "published";
+      }
+    }
     const query = {
       ...queryOptions,
       ...whereParams,
@@ -3149,15 +3214,24 @@ var CollectionOperationsImpl = class _CollectionOperationsImpl {
     await this.runBeforeReadHooks();
     const doc = await this.adapter.findById(this.slug, id);
     if (!doc) {
-      return null;
+      throw new DocumentNotFoundError(this.slug, id);
     }
     const softDeleteField = getSoftDeleteField(this.collectionConfig);
     if (softDeleteField && !options?.withDeleted && // eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- T is compatible with Record<string, unknown>
     doc[softDeleteField]) {
-      return null;
+      throw new DocumentNotFoundError(this.slug, id);
+    }
+    if (hasVersionDrafts(this.collectionConfig) && !this.context.overrideAccess) {
+      const canSeeDrafts = await this.canReadDrafts();
+      if (!canSeeDrafts) {
+        const record = doc;
+        if (record["_status"] !== "published") {
+          throw new DraftNotVisibleError(this.slug, id);
+        }
+      }
     }
     if (!this.matchesDefaultWhereConstraints(doc)) {
-      return null;
+      throw new DocumentNotFoundError(this.slug, id);
     }
     const [processed] = await this.processAfterReadHooks([doc]);
     const MAX_RELATIONSHIP_DEPTH = 10;
@@ -3241,6 +3315,15 @@ var CollectionOperationsImpl = class _CollectionOperationsImpl {
     if (!this.matchesDefaultWhereConstraints(originalDoc)) {
       throw new DocumentNotFoundError(this.slug, id);
     }
+    if (hasVersionDrafts(this.collectionConfig) && this.adapter.createVersion) {
+      const status = originalDoc["_status"] ?? "draft";
+      await this.adapter.createVersion(this.slug, id, originalDoc, { status });
+      const versionsConfig = this.collectionConfig.versions;
+      const maxPerDoc = typeof versionsConfig === "object" && versionsConfig !== null ? versionsConfig.maxPerDoc : void 0;
+      if (maxPerDoc && this.adapter.deleteVersions) {
+        await this.adapter.deleteVersions(this.slug, id, maxPerDoc);
+      }
+    }
     let processedData = data;
     const softDeleteField = getSoftDeleteField(this.collectionConfig);
     if (softDeleteField && softDeleteField in processedData) {
@@ -3572,6 +3655,30 @@ var CollectionOperationsImpl = class _CollectionOperationsImpl {
       throw new AccessDeniedError(operation, this.slug);
     }
   }
+  /**
+   * Check if the current user can see draft documents (non-throwing).
+   * Uses `access.readDrafts` if configured, otherwise falls back to `access.update`.
+   */
+  async canReadDrafts() {
+    if (!this.context.user)
+      return false;
+    const readDraftsFn = this.collectionConfig.access?.readDrafts;
+    if (readDraftsFn) {
+      try {
+        return !!await Promise.resolve(readDraftsFn({ req: this.buildRequestContext() }));
+      } catch {
+        return false;
+      }
+    }
+    const updateFn = this.collectionConfig.access?.update;
+    if (!updateFn)
+      return true;
+    try {
+      return !!await Promise.resolve(updateFn({ req: this.buildRequestContext() }));
+    } catch {
+      return false;
+    }
+  }
   buildRequestContext() {
     return {
       user: this.context.user
@@ -3995,9 +4102,6 @@ function createMomentumHandlers(config) {
       const depth = typeof request.query?.["depth"] === "number" ? request.query["depth"] : void 0;
       const withDeleted = request.query?.["withDeleted"] === true;
       const doc = await api.collection(request.collectionSlug).findById(request.id, { depth, withDeleted });
-      if (!doc) {
-        return { error: "Document not found", status: 404 };
-      }
       return { doc };
     } catch (error) {
       return handleError(error);
@@ -4114,6 +4218,9 @@ function handleError(error) {
   if (error instanceof DocumentNotFoundError) {
     return { error: error.message, status: 404 };
   }
+  if (error instanceof DraftNotVisibleError) {
+    return { doc: null };
+  }
   if (error instanceof AccessDeniedError) {
     return { error: error.message, status: 403 };
   }
@@ -4566,7 +4673,10 @@ async function sendWebhook(webhook, payload, attempt = 0) {
     webhookLogger.warn(`Blocked request to disallowed URL: ${webhook.url}`);
     return;
   }
-  const body = JSON.stringify(payload);
+  const body = JSON.stringify(
+    payload,
+    (_key, value) => typeof value === "bigint" ? Number(value) : value
+  );
   const maxRetries = webhook.retries ?? 0;
   const headers = {
     "Content-Type": "application/json",
@@ -4708,7 +4818,7 @@ function startPublishScheduler(adapter, collections, options) {
         const scheduled = await adapter.findScheduledDocuments(collection.slug, now);
         for (const doc of scheduled) {
           try {
-            const api = getMomentumAPI();
+            const api = getMomentumAPI().setContext({ overrideAccess: true });
             const versionOps = api.collection(collection.slug).versions();
             if (!versionOps)
               continue;
@@ -4828,8 +4938,9 @@ function buildGraphQLSchema(collections) {
   }
   function getOrCreateEnum(field, parentName) {
     const key = `${parentName}_${field.name}`;
-    if (enumCache.has(key)) {
-      return enumCache.get(key);
+    const cached = enumCache.get(key);
+    if (cached) {
+      return cached;
     }
     const values = {};
     for (const opt of field.options) {
@@ -4940,8 +5051,9 @@ function buildGraphQLSchema(collections) {
     }
   }
   function getOrCreateObjectType(fields, typeName) {
-    if (typeCache.has(typeName)) {
-      return typeCache.get(typeName);
+    const cachedType = typeCache.get(typeName);
+    if (cachedType) {
+      return cachedType;
     }
     const objType = new GraphQLObjectType({
       name: typeName,
@@ -4962,8 +5074,9 @@ function buildGraphQLSchema(collections) {
   }
   function getOrCreateInputType(fields, typeName) {
     const inputName = `${typeName}Input`;
-    if (inputCache.has(inputName)) {
-      return inputCache.get(inputName);
+    const cachedInput = inputCache.get(inputName);
+    if (cachedInput) {
+      return cachedInput;
     }
     const inputType = new GraphQLInputObjectType({
       name: inputName,
@@ -5084,7 +5197,14 @@ function buildGraphQLSchema(collections) {
           const api = getMomentumAPI();
           const ctx = buildAPIContext(context);
           const contextApi = Object.keys(ctx).length > 0 ? api.setContext(ctx) : api;
-          return contextApi.collection(col.slug).findById(args.id);
+          try {
+            return await contextApi.collection(col.slug).findById(args.id);
+          } catch (err) {
+            if (err instanceof Error && err.name === "DocumentNotFoundError") {
+              return null;
+            }
+            throw err;
+          }
         }
       };
       queryFields[plural.charAt(0).toLowerCase() + plural.slice(1)] = {
@@ -6375,6 +6495,22 @@ var RateLimiter = class _RateLimiter {
   }
 };
 
+// libs/server-core/src/lib/schema-sync.ts
+async function syncDatabaseSchema(config, log) {
+  if (shouldSyncSchema(config)) {
+    if (config.db.adapter.initialize) {
+      log.info("Initializing database schema...");
+      await config.db.adapter.initialize(config.collections);
+    }
+    if (config.db.adapter.initializeGlobals && config.globals && config.globals.length > 0) {
+      log.info(`Initializing globals table for ${config.globals.length} global(s)...`);
+      await config.db.adapter.initializeGlobals(config.globals);
+    }
+  } else {
+    log.info("Skipping automatic schema sync (migration mode). Run migrations separately.");
+  }
+}
+
 // libs/server-core/src/lib/shared-server-utils.ts
 function sanitizeErrorMessage(error, fallback) {
   if (!(error instanceof Error))
@@ -6792,6 +6928,10 @@ function momentumApiMiddleware(config) {
       res.json(result);
     } catch (error) {
       const message = sanitizeErrorMessage(error, "Unknown error");
+      if (error instanceof Error && error.name === "AccessDeniedError") {
+        res.status(403).json({ error: "Access denied" });
+        return;
+      }
       res.status(500).json({ error: "Failed to fetch versions", message });
     }
   });
@@ -6820,6 +6960,10 @@ function momentumApiMiddleware(config) {
       res.json(version);
     } catch (error) {
       const message = sanitizeErrorMessage(error, "Unknown error");
+      if (error instanceof Error && error.name === "AccessDeniedError") {
+        res.status(403).json({ error: "Access denied" });
+        return;
+      }
       res.status(500).json({ error: "Failed to fetch version", message });
     }
   });
@@ -6858,6 +7002,10 @@ function momentumApiMiddleware(config) {
         res.status(400).json({ error: "Version parent mismatch", message });
         return;
       }
+      if (error instanceof Error && error.name === "AccessDeniedError") {
+        res.status(403).json({ error: "Access denied" });
+        return;
+      }
       res.status(500).json({ error: "Failed to restore version", message });
     }
   });
@@ -6879,6 +7027,10 @@ function momentumApiMiddleware(config) {
       res.json({ doc: published, message: "Document published successfully" });
     } catch (error) {
       const message = sanitizeErrorMessage(error, "Unknown error");
+      if (error instanceof Error && error.name === "AccessDeniedError") {
+        res.status(403).json({ error: "Access denied" });
+        return;
+      }
       res.status(500).json({ error: "Failed to publish document", message });
     }
   });
@@ -6908,6 +7060,10 @@ function momentumApiMiddleware(config) {
       res.json(result);
     } catch (error) {
       const message = sanitizeErrorMessage(error, "Unknown error");
+      if (error instanceof Error && error.name === "AccessDeniedError") {
+        res.status(403).json({ error: "Access denied" });
+        return;
+      }
       res.status(500).json({ error: "Failed to schedule publish", message });
     }
   });
@@ -6929,6 +7085,10 @@ function momentumApiMiddleware(config) {
       res.json({ message: "Scheduled publish cancelled" });
     } catch (error) {
       const message = sanitizeErrorMessage(error, "Unknown error");
+      if (error instanceof Error && error.name === "AccessDeniedError") {
+        res.status(403).json({ error: "Access denied" });
+        return;
+      }
       res.status(500).json({ error: "Failed to cancel scheduled publish", message });
     }
   });
@@ -6950,6 +7110,10 @@ function momentumApiMiddleware(config) {
       res.json({ doc: unpublished, message: "Document unpublished successfully" });
     } catch (error) {
       const message = sanitizeErrorMessage(error, "Unknown error");
+      if (error instanceof Error && error.name === "AccessDeniedError") {
+        res.status(403).json({ error: "Access denied" });
+        return;
+      }
       res.status(500).json({ error: "Failed to unpublish document", message });
     }
   });
@@ -6972,6 +7136,10 @@ function momentumApiMiddleware(config) {
       res.json({ version: draft, message: "Draft saved successfully" });
     } catch (error) {
       const message = sanitizeErrorMessage(error, "Unknown error");
+      if (error instanceof Error && error.name === "AccessDeniedError") {
+        res.status(403).json({ error: "Access denied" });
+        return;
+      }
       res.status(500).json({ error: "Failed to save draft", message });
     }
   });
@@ -6997,10 +7165,15 @@ function momentumApiMiddleware(config) {
         });
         return;
       }
-      const differences = await versionOps.compare(versionId1, versionId2);
+      const parentId = req.params["id"];
+      const differences = await versionOps.compare(versionId1, versionId2, parentId);
       res.json({ differences });
     } catch (error) {
       const message = sanitizeErrorMessage(error, "Unknown error");
+      if (error instanceof Error && error.name === "AccessDeniedError") {
+        res.status(403).json({ error: "Access denied" });
+        return;
+      }
       res.status(500).json({ error: "Failed to compare versions", message });
     }
   });
@@ -7053,12 +7226,7 @@ function momentumApiMiddleware(config) {
       } else {
         const api = getMomentumAPI();
         const contextApi = user ? api.setContext({ user }) : api;
-        const dbDoc = await contextApi.collection(slug2).findById(id);
-        if (!dbDoc) {
-          res.status(404).json({ error: "Document not found" });
-          return;
-        }
-        doc = dbDoc;
+        doc = await contextApi.collection(slug2).findById(id);
       }
       const emailField = getEmailBuilderFieldName(collectionConfig);
       const html = emailField ? await renderEmailPreviewHTML(doc, emailField) : renderPreviewHTML({ doc, collection: collectionConfig });
@@ -7251,7 +7419,13 @@ function momentumApiMiddleware(config) {
               return { docs: r.docs, totalDocs: r.totalDocs };
             },
             findById: async (slug2, id) => {
-              return await ctxApi.collection(slug2).findById(id);
+              try {
+                return await ctxApi.collection(slug2).findById(id);
+              } catch (err) {
+                if (err instanceof Error && err.name === "DocumentNotFoundError")
+                  return null;
+                throw err;
+              }
             },
             count: (slug2) => ctxApi.collection(slug2).count(),
             create: async (slug2, data) => {
@@ -8649,14 +8823,7 @@ function initializeMomentum(config, options = {}) {
       }
     }
     setPluginMiddleware(pluginMiddleware2);
-    if (config.db.adapter.initialize) {
-      log.info("Initializing database schema...");
-      await config.db.adapter.initialize(config.collections);
-    }
-    if (config.db.adapter.initializeGlobals && config.globals && config.globals.length > 0) {
-      log.info(`Initializing globals table for ${config.globals.length} global(s)...`);
-      await config.db.adapter.initializeGlobals(config.globals);
-    }
+    await syncDatabaseSchema(config, log);
     log.info("Initializing API...");
     const api = initializeMomentumAPI(config);
     const runOnStart = config.seeding?.options?.runOnStart ?? "development";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@momentumcms/server-express",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "description": "Express adapter for Momentum CMS with Angular SSR support",
   "license": "MIT",
   "author": "Momentum CMS Contributors",