@nextsparkjs/core 0.1.0-beta.8 → 0.1.0-beta.82

package/dist/lib/api/entity/generic-handler.js

@@ -1,8 +1,8 @@
 import { NextResponse } from "next/server";
-import { authenticateRequest, hasRequiredScope, canBypassTeamContext } from "../auth/dual-auth";
-import { resolveEntityFromUrl, validateEntityOperation } from "./resolver";
-import { generateEntitySchemas } from "../../entities/schema-generator";
-import { queryWithRLS, mutateWithRLS, queryOneWithRLS } from "../../db";
+import { authenticateRequest, hasRequiredScope, canBypassTeamContext } from "../auth/dual-auth.js";
+import { resolveEntityFromUrl, validateEntityOperation } from "./resolver.js";
+import { generateEntitySchemas } from "../../entities/schema-generator.js";
+import { queryWithRLS, mutateWithRLS, queryOneWithRLS } from "../../db.js";
 import {
   createApiResponse,
   createApiError,
@@ -16,8 +16,11 @@ import {
   handleEntityMetadataInResponse,
   addCorsHeaders,
   handleCorsPreflightRequest
-} from "../helpers";
-import { afterEntityCreate, afterEntityUpdate, afterEntityDelete } from "../../entities/entity-hooks";
+} from "../helpers.js";
+import { afterEntityCreate, afterEntityUpdate, afterEntityDelete } from "../../entities/entity-hooks.js";
+import { extractPatternIds } from "../../blocks/pattern-resolver.js";
+import { isPatternReference } from "../../../types/pattern-reference.js";
+import { PatternUsageService } from "../../services/pattern-usage.service.js";
 async function includeTaxonomiesInData(entityConfig, items, userId) {
   var _a, _b, _c;
   if (!((_a = entityConfig.taxonomies) == null ? void 0 : _a.enabled) || !((_c = (_b = entityConfig.taxonomies) == null ? void 0 : _b.types) == null ? void 0 : _c.length) || items.length === 0) {
@@ -128,6 +131,24 @@ function parseTaxonomyFilterParams(url, entityConfig) {
 function getTableName(entityConfig) {
   return entityConfig.tableName || entityConfig.slug;
 }
+async function filterOrphanedPatternReferences(blocks, userId) {
+  if (!Array.isArray(blocks) || blocks.length === 0) return blocks;
+  const patternIds = extractPatternIds(blocks);
+  if (patternIds.length === 0) return blocks;
+  const existingIds = await PatternUsageService.getExistingPatternIds(patternIds, userId);
+  if (existingIds.size === patternIds.length) return blocks;
+  const filtered = blocks.filter((block) => {
+    if (isPatternReference(block)) {
+      const exists = existingIds.has(block.ref);
+      if (!exists) {
+        console.info(`[generic-handler] Filtering orphaned PatternReference: ${block.ref}`);
+      }
+      return exists;
+    }
+    return true;
+  });
+  return filtered;
+}
 function getTeamIdFromRequest(request) {
   return request.headers.get("x-team-id");
 }
@@ -154,7 +175,7 @@ async function validateTeamContextWithBypass(request, authResult, userId) {
   const canBypass = await canBypassTeamContext(authResult, request);
   if (canBypass) {
     console.log("[GenericHandler] Admin bypass active:", { userId, teamId: teamId || "cross-team" });
-    return { valid: true, teamId };
+    return { valid: true, teamId, isBypass: true };
   }
   if (!teamId) {
     const response = createApiError(
@@ -175,23 +196,24 @@ async function validateTeamContextWithBypass(request, authResult, userId) {
     );
     return { valid: false, error: await addCorsHeaders(response) };
   }
-  return { valid: true, teamId };
+  return { valid: true, teamId, isBypass: false };
 }
 async function handleGenericList(request) {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
+  var _a, _b, _c, _d, _e, _f, _g, _h;
   try {
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
       const response2 = createApiError("Entity not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (!validateEntityOperation(resolution.entityConfig, "list")) {
       const response2 = createApiError("List operation not supported for this entity", 405);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const authResult = await authenticateRequest(request);
     let userId = null;
     let teamId = null;
+    let isBypass = false;
     if (!authResult.success && ((_a = resolution.entityConfig.access) == null ? void 0 : _a.public)) {
       console.log(`[GenericHandler] Public access allowed for ${resolution.entityConfig.slug} list`);
     } else if (!authResult.success) {
@@ -205,7 +227,7 @@ async function handleGenericList(request) {
       }
       if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:read`)) {
         const response2 = createApiError("Insufficient permissions", 403);
-        return addCorsHeaders(response2);
+        return addCorsHeaders(response2, request);
       }
       userId = authResult.user.id;
       const teamValidation = await validateTeamContextWithBypass(request, authResult, userId);
@@ -213,6 +235,7 @@ async function handleGenericList(request) {
         return teamValidation.error;
       }
       teamId = teamValidation.teamId;
+      isBypass = teamValidation.isBypass;
     }
     const pagination = parsePaginationParams(request);
     const metaParams = parseMetaParams(request);
@@ -265,6 +288,9 @@ async function handleGenericList(request) {
         return `t.${columnName}`;
       });
       fields = [...systemFieldsFormatted, ...configFields].join(", ");
+      if (entityConfig.slug === "patterns") {
+        fields += ', COALESCE(pu.usage_count, 0)::int as "usageCount"';
+      }
     }
     let query;
     let queryParams;
@@ -289,7 +315,7 @@ async function handleGenericList(request) {
         query += ` AND t."teamId" = $${paramIndex++}`;
         queryParams.push(teamId);
       }
-      if (userId && !((_e = entityConfig.access) == null ? void 0 : _e.shared) && !skipUserFilter) {
+      if (userId && !((_e = entityConfig.access) == null ? void 0 : _e.shared) && !skipUserFilter && !isBypass) {
         query += ` AND t."userId" = $${paramIndex++}`;
         queryParams.push(userId);
       }
@@ -306,7 +332,7 @@ async function handleGenericList(request) {
         query += ` AND t."parentId" = $${paramIndex++}`;
         queryParams.push(parentId);
       }
-      if (userId && !((_f = entityConfig.access) == null ? void 0 : _f.shared) && !skipUserFilter) {
+      if (userId && !((_f = entityConfig.access) == null ? void 0 : _f.shared) && !skipUserFilter && !isBypass) {
         query += ` AND t."userId" = $${paramIndex++}`;
         queryParams.push(userId);
       }
@@ -320,7 +346,7 @@ async function handleGenericList(request) {
         whereConditions.push(`t."teamId" = $${paramIndex++}`);
         queryParams.push(teamId);
       }
-      if (userId && !((_g = entityConfig.access) == null ? void 0 : _g.shared) && !skipUserFilter) {
+      if (userId && !((_g = entityConfig.access) == null ? void 0 : _g.shared) && !skipUserFilter && !isBypass) {
         whereConditions.push(`t."userId" = $${paramIndex++}`);
         queryParams.push(userId);
       }
@@ -397,107 +423,32 @@ async function handleGenericList(request) {
         queryParams.push(taxonomyFilter.taxonomyId);
       }
       const whereClause = whereConditions.length > 0 ? `WHERE ${whereConditions.join(" AND ")}` : "";
+      let joinClause = "";
+      if (entityConfig.slug === "patterns") {
+        joinClause = `
+          LEFT JOIN (
+            SELECT "patternId", COUNT(*) as usage_count
+            FROM pattern_usages
+            GROUP BY "patternId"
+          ) pu ON t.id = pu."patternId"
+        `;
+      }
       query = `
-        SELECT ${fields}
+        SELECT ${fields}, COUNT(*) OVER() as total_count
         FROM "${tableName}" t
+        ${joinClause}
         ${whereClause}
         ORDER BY t."createdAt" DESC
         LIMIT $${paramIndex++} OFFSET $${paramIndex++}
       `;
       queryParams.push(pagination.limit, pagination.offset);
     }
-    const data = await queryWithRLS(query, queryParams, userId);
-    let totalResult;
-    const countWhereConditions = [];
-    const countParams = [];
-    let countParamIndex = 1;
-    if (teamId && !skipUserFilter) {
-      countWhereConditions.push(`"teamId" = $${countParamIndex++}`);
-      countParams.push(teamId);
-    }
-    if (userId && !((_h = entityConfig.access) == null ? void 0 : _h.shared) && !skipUserFilter) {
-      countWhereConditions.push(`"userId" = $${countParamIndex++}`);
-      countParams.push(userId);
-    }
-    if (searchParam && searchParam.trim() !== "") {
-      const searchTerm = searchParam.trim();
-      const hasName = entityConfig.fields.some((f) => f.name === "name");
-      const hasTitle = entityConfig.fields.some((f) => f.name === "title");
-      const hasSlug = entityConfig.fields.some((f) => f.name === "slug");
-      const hasContent = entityConfig.fields.some((f) => f.name === "content");
-      if (hasName || hasTitle || hasSlug || hasContent) {
-        const searchConditions = [];
-        if (hasName) {
-          searchConditions.push(`name ILIKE $${countParamIndex}`);
-        }
-        if (hasTitle) {
-          searchConditions.push(`title ILIKE $${countParamIndex}`);
-        }
-        if (hasSlug) {
-          searchConditions.push(`slug ILIKE $${countParamIndex}`);
-        }
-        if (hasContent) {
-          searchConditions.push(`content ILIKE $${countParamIndex}`);
-        }
-        countWhereConditions.push(`(${searchConditions.join(" OR ")})`);
-        countParams.push(`%${searchTerm}%`);
-        countParamIndex++;
-      }
-    }
-    if (dateFieldName && (fromDate || toDate)) {
-      const field = entityConfig.fields.find((f) => f.name === dateFieldName);
-      if (field && (field.type === "datetime" || field.type === "date")) {
-        if (fromDate) {
-          countWhereConditions.push(`"${dateFieldName}" >= $${countParamIndex++}`);
-          countParams.push(fromDate);
-        }
-        if (toDate) {
-          countWhereConditions.push(`"${dateFieldName}" <= $${countParamIndex++}`);
-          countParams.push(toDate);
-        }
-      }
-    }
-    Object.entries(customFilters).forEach(([key, values]) => {
-      const field = entityConfig.fields.find((f) => f.name === key);
-      if (field && values.length > 0) {
-        const columnName = `"${key}"`;
-        if (field.type === "relation-multi" || key === "socialPlatformId") {
-          const orConditions = values.map(() => {
-            const condition = `${columnName}::jsonb @> $${countParamIndex++}::jsonb`;
-            return condition;
-          });
-          values.forEach((value) => {
-            countParams.push(JSON.stringify([value]));
-          });
-          countWhereConditions.push(`(${orConditions.join(" OR ")})`);
-        } else {
-          const orConditions = values.map(() => {
-            const condition = `${columnName} = $${countParamIndex++}`;
-            return condition;
-          });
-          values.forEach((value) => {
-            countParams.push(value);
-          });
-          countWhereConditions.push(`(${orConditions.join(" OR ")})`);
-        }
-      }
+    const rawData = await queryWithRLS(query, queryParams, userId);
+    const total = rawData.length > 0 ? Number(rawData[0].total_count) || 0 : 0;
+    const data = rawData.map((row) => {
+      const { total_count, ...rest } = row;
+      return rest;
     });
-    if (taxonomyFilter == null ? void 0 : taxonomyFilter.taxonomyId) {
-      countWhereConditions.push(`EXISTS (
-        SELECT 1 FROM entity_taxonomy_relations etr
-        WHERE etr."entityId" = id::text
-          AND etr."entityType" = '${entityConfig.slug}'
-          AND etr."taxonomyId" = $${countParamIndex++}
-      )`);
-      countParams.push(taxonomyFilter.taxonomyId);
-    }
-    const countWhereClause = countWhereConditions.length > 0 ? `WHERE ${countWhereConditions.join(" AND ")}` : "";
-    totalResult = await queryWithRLS(
-      `SELECT COUNT(*) as count FROM "${tableName}" ${countWhereClause}`,
-      countParams,
-      userId
-    );
-    const total = ((_i = totalResult[0]) == null ? void 0 : _i.count) || 0;
     const paginationMeta = createPaginationMeta(pagination.page, pagination.limit, total);
     let dataWithMeta = data;
     if (metaParams.includeMetadata && userId) {
@@ -520,7 +471,7 @@ async function handleGenericList(request) {
       );
     }
     let dataWithTaxonomies = dataWithChild;
-    if ((_j = entityConfig.taxonomies) == null ? void 0 : _j.enabled) {
+    if ((_h = entityConfig.taxonomies) == null ? void 0 : _h.enabled) {
       dataWithTaxonomies = await includeTaxonomiesInData(
         entityConfig,
         dataWithChild,
@@ -528,11 +479,11 @@ async function handleGenericList(request) {
       );
     }
     const response = createApiResponse(dataWithTaxonomies, paginationMeta);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   } catch (error) {
     console.error("Error in generic list handler:", error);
     const response = createApiError("Internal server error", 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   }
 }
 async function handleGenericCreate(request) {
@@ -541,11 +492,11 @@ async function handleGenericCreate(request) {
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
       const response2 = createApiError("Entity not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (!validateEntityOperation(resolution.entityConfig, "create")) {
       const response2 = createApiError("Create operation not supported for this entity", 405);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const authResult = await authenticateRequest(request);
     if (!authResult.success) {
@@ -559,14 +510,14 @@ async function handleGenericCreate(request) {
     }
     if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:write`)) {
       const response2 = createApiError("Insufficient permissions", 403);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     let body;
     try {
       body = await request.json();
     } catch {
       const response2 = createApiError("Invalid JSON body", 400);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const { metas, ...entityData } = body;
     const rawUserId = entityData.userId;
@@ -580,7 +531,7 @@ async function handleGenericCreate(request) {
         errors: validation.error.issues
       });
       const response2 = createApiError("Validation error", 400, validation.error.issues, "VALIDATION_ERROR");
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const validatedData = validation.data;
     const idStrategy = ((_a = entityConfig.idStrategy) == null ? void 0 : _a.type) || "uuid";
@@ -597,7 +548,7 @@ async function handleGenericCreate(request) {
     const teamId = teamValidation.teamId;
     if (!teamId) {
       const response2 = createApiError("Team context required for create operations. Include x-team-id header.", 400, void 0, "TEAM_CONTEXT_REQUIRED");
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (idStrategy === "serial") {
       insertFields = ['"userId"', '"teamId"'];
@@ -614,7 +565,8 @@ async function handleGenericCreate(request) {
     const builderRequest = isBuilderRequest(request);
     const entityHasBuilder = ((_c = entityConfig.builder) == null ? void 0 : _c.enabled) === true;
     if (builderRequest && entityHasBuilder && "blocks" in validatedData) {
-      const blocksValue = validatedData.blocks;
+      let blocksValue = validatedData.blocks;
+      blocksValue = await filterOrphanedPatternReferences(blocksValue, authResult.user.id);
       insertFields.push('"blocks"');
       placeholders.push(`$${paramCount++}::jsonb`);
       values.push(JSON.stringify(blocksValue));
@@ -729,11 +681,11 @@ async function handleGenericCreate(request) {
       console.error(`[generic-handler] Error in afterEntityCreate hook for ${entityConfig.slug}:`, hookError);
     }
     const response = createApiResponse(responseData, { created: true }, 201);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   } catch (error) {
     console.error("Error in generic create handler:", error);
     const response = createApiError("Internal server error", 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   }
 }
 async function handleGenericRead(request, { params }) {
@@ -743,15 +695,16 @@ async function handleGenericRead(request, { params }) {
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
       const response2 = createApiError("Entity not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (!validateEntityOperation(resolution.entityConfig, "read")) {
       const response2 = createApiError("Read operation not supported for this entity", 405);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const authResult = await authenticateRequest(request);
     let userId = null;
     let teamId = null;
+    let isBypass = false;
     if (!authResult.success && ((_a = resolution.entityConfig.access) == null ? void 0 : _a.public)) {
       console.log(`[GenericHandler] Public access allowed for ${resolution.entityConfig.slug} read`);
     } else if (!authResult.success) {
@@ -765,7 +718,7 @@ async function handleGenericRead(request, { params }) {
       }
       if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:read`)) {
         const response2 = createApiError("Insufficient permissions", 403);
-        return addCorsHeaders(response2);
+        return addCorsHeaders(response2, request);
       }
       userId = authResult.user.id;
       const teamValidation = await validateTeamContextWithBypass(request, authResult, userId);
@@ -773,6 +726,7 @@ async function handleGenericRead(request, { params }) {
         return teamValidation.error;
       }
       teamId = teamValidation.teamId;
+      isBypass = teamValidation.isBypass;
     }
     const entityConfig = resolution.entityConfig;
     const tableName = getTableName(entityConfig);
@@ -802,14 +756,14 @@ async function handleGenericRead(request, { params }) {
       query += ` AND t."teamId" = $${paramIndex++}`;
       queryParams.push(teamId);
     }
-    if (userId && !((_c = entityConfig.access) == null ? void 0 : _c.shared)) {
+    if (userId && !((_c = entityConfig.access) == null ? void 0 : _c.shared) && !isBypass) {
       query += ` AND t."userId" = $${paramIndex++}`;
       queryParams.push(userId);
     }
     const items = await queryWithRLS(query, queryParams, userId);
     if (!items[0]) {
       const response2 = createApiError("Item not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const item = items[0];
     const metaParams = parseMetaParams(request);
@@ -845,11 +799,11 @@ async function handleGenericRead(request, { params }) {
       itemWithTaxonomies = itemsWithTaxonomies[0] || itemWithChild;
     }
     const response = createApiResponse(itemWithTaxonomies);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   } catch (error) {
     console.error("Error in generic read handler:", error);
     const response = createApiError("Internal server error", 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   }
 }
 async function handleGenericUpdate(request, { params }) {
@@ -859,11 +813,11 @@ async function handleGenericUpdate(request, { params }) {
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
       const response2 = createApiError("Entity not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (!validateEntityOperation(resolution.entityConfig, "update")) {
       const response2 = createApiError("Update operation not supported for this entity", 405);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const authResult = await authenticateRequest(request);
     if (!authResult.success) {
@@ -877,7 +831,7 @@ async function handleGenericUpdate(request, { params }) {
     }
     if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:write`)) {
       const response2 = createApiError("Insufficient permissions", 403);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const teamValidation = await validateTeamContextWithBypass(request, authResult, authResult.user.id);
     if (!teamValidation.valid) {
@@ -886,14 +840,14 @@ async function handleGenericUpdate(request, { params }) {
     const teamId = teamValidation.teamId;
     if (!teamId) {
       const response2 = createApiError("Team context required for update operations. Include x-team-id header.", 400, void 0, "TEAM_CONTEXT_REQUIRED");
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     let body;
     try {
       body = await request.json();
     } catch {
       const response2 = createApiError("Invalid JSON body", 400);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const { metas, ...entityData } = body;
     const entityConfig = resolution.entityConfig;
@@ -906,7 +860,7 @@ async function handleGenericUpdate(request, { params }) {
         errors: validation.error.issues
       });
       const response2 = createApiError("Validation error", 400, validation.error.issues, "VALIDATION_ERROR");
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const validatedData = validation.data;
     const updates = [];
@@ -915,8 +869,10 @@ async function handleGenericUpdate(request, { params }) {
     const builderRequest = isBuilderRequest(request);
     const entityHasBuilder = ((_a = entityConfig.builder) == null ? void 0 : _a.enabled) === true;
     if (builderRequest && entityHasBuilder && "blocks" in entityData) {
+      let blocksData = entityData.blocks;
+      blocksData = await filterOrphanedPatternReferences(blocksData, authResult.user.id);
       updates.push(`"blocks" = $${paramCount++}::jsonb`);
-      values.push(JSON.stringify(entityData.blocks));
+      values.push(JSON.stringify(blocksData));
     }
     const originalKeys = Object.keys(entityData);
     const fieldsToUpdate = Object.entries(validatedData).filter(([key]) => originalKeys.includes(key));
@@ -972,7 +928,7 @@ async function handleGenericUpdate(request, { params }) {
     const metadataWasProvided = metas && typeof metas === "object" && Object.keys(metas).length > 0;
     if (updates.length === 0 && !metadataWasProvided) {
       const response2 = createApiError("No fields to update", 400);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (updates.length > 0) {
       updates.push(`"updatedAt" = CURRENT_TIMESTAMP`);
@@ -998,7 +954,7 @@ async function handleGenericUpdate(request, { params }) {
       const result = await mutateWithRLS(updateQuery, values, authResult.user.id);
       if (!result.rows || result.rows.length === 0) {
         const response2 = createApiError("Item not found", 404);
-        return addCorsHeaders(response2);
+        return addCorsHeaders(response2, request);
       }
       updatedItem = result.rows[0];
     } else {
@@ -1011,7 +967,7 @@ async function handleGenericUpdate(request, { params }) {
       const result = await queryWithRLS(selectQuery, selectValues, authResult.user.id);
       if (!result || result.length === 0) {
         const response2 = createApiError("Item not found", 404);
-        return addCorsHeaders(response2);
+        return addCorsHeaders(response2, request);
       }
       updatedItem = result[0];
     }
@@ -1047,11 +1003,11 @@ async function handleGenericUpdate(request, { params }) {
       console.error(`[generic-handler] Error in afterEntityUpdate hook for ${entityConfig.slug}:`, hookError);
     }
     const response = createApiResponse(responseData);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   } catch (error) {
     console.error("Error in generic update handler:", error);
     const response = createApiError("Internal server error", 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   }
 }
 async function handleGenericDelete(request, { params }) {
@@ -1061,11 +1017,11 @@ async function handleGenericDelete(request, { params }) {
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
       const response2 = createApiError("Entity not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (!validateEntityOperation(resolution.entityConfig, "delete")) {
       const response2 = createApiError("Delete operation not supported for this entity", 405);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const authResult = await authenticateRequest(request);
     if (!authResult.success) {
@@ -1079,7 +1035,7 @@ async function handleGenericDelete(request, { params }) {
     }
     if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:write`)) {
       const response2 = createApiError("Insufficient permissions", 403);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const teamValidation = await validateTeamContextWithBypass(request, authResult, authResult.user.id);
     if (!teamValidation.valid) {
@@ -1088,7 +1044,7 @@ async function handleGenericDelete(request, { params }) {
     const teamId = teamValidation.teamId;
     if (!teamId) {
       const response2 = createApiError("Team context required for delete operations. Include x-team-id header.", 400, void 0, "TEAM_CONTEXT_REQUIRED");
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const entityConfig = resolution.entityConfig;
     const tableName = getTableName(entityConfig);
@@ -1111,7 +1067,7 @@ async function handleGenericDelete(request, { params }) {
     const result = await mutateWithRLS(deleteQuery, deleteParams, authResult.user.id);
     if (!result.rows || result.rows.length === 0) {
       const response2 = createApiError("Item not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     try {
       await afterEntityDelete(entityConfig.slug, id, authResult.user.id);
@@ -1119,15 +1075,15 @@ async function handleGenericDelete(request, { params }) {
       console.error(`[generic-handler] Error in afterEntityDelete hook for ${entityConfig.slug}:`, hookError);
     }
     const response = createApiResponse({ success: true, id });
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   } catch (error) {
     console.error("Error in generic delete handler:", error);
     const response = createApiError("Internal server error", 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   }
 }
-async function handleGenericOptions() {
-  return handleCorsPreflightRequest();
+async function handleGenericOptions(request) {
+  return handleCorsPreflightRequest(request);
 }
 async function handleDistinctJsonbField(entityConfig, fieldName, url, userId) {
   var _a;

package/dist/lib/api/entity/public-resolver.js

@@ -1,4 +1,4 @@
-import { entityRegistry, ensureInitialized } from "../../entities/registry";
+import { entityRegistry, ensureInitialized } from "../../entities/registry.js";
 import { existsSync } from "fs";
 import { join } from "path";
 async function resolvePublicEntityFromUrl(pathname) {

package/dist/lib/api/entity/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAIxD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,YAAY,GAAG,IAAI,CAAA;IACjC,iBAAiB,EAAE,OAAO,CAAA;IAC1B,aAAa,EAAE,OAAO,CAAA;CACvB;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAkDtF;AA2CD;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAQ5D;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAC1D,OAAO,CAyBT"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAIxD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,YAAY,GAAG,IAAI,CAAA;IACjC,iBAAiB,EAAE,OAAO,CAAA;IAC1B,aAAa,EAAE,OAAO,CAAA;CACvB;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAkDtF;AA2CD;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAQ5D;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAC1D,OAAO,CAkBT"}

package/dist/lib/api/entity/resolver.js

@@ -1,4 +1,4 @@
-import { entityRegistry, ensureInitialized } from "../../entities/registry";
+import { entityRegistry, ensureInitialized } from "../../entities/registry.js";
 import { existsSync } from "fs";
 import { join } from "path";
 async function resolveEntityFromUrl(pathname) {
@@ -76,20 +76,16 @@ async function getGenericEntities() {
   return allEntities.filter((entity) => entity.enabled).map((entity) => entity.slug).filter((slug) => !isCorePath(slug));
 }
 function validateEntityOperation(entityConfig, operation) {
-  var _a, _b, _c, _d, _e, _f;
   if (!entityConfig.enabled) {
     return false;
   }
   switch (operation) {
     case "list":
     case "read":
-      return entityConfig.enabled;
     case "create":
-      return entityConfig.enabled && (((_b = (_a = entityConfig.permissions) == null ? void 0 : _a.actions) == null ? void 0 : _b.some((a) => a.action === "create")) ?? true);
     case "update":
-      return entityConfig.enabled && (((_d = (_c = entityConfig.permissions) == null ? void 0 : _c.actions) == null ? void 0 : _d.some((a) => a.action === "update")) ?? true);
     case "delete":
-      return entityConfig.enabled && (((_f = (_e = entityConfig.permissions) == null ? void 0 : _e.actions) == null ? void 0 : _f.some((a) => a.action === "delete")) ?? true);
+      return entityConfig.enabled;
     default:
       return false;
   }

package/dist/lib/api/entity-handler.js

@@ -1,5 +1,5 @@
-import { auth } from "../auth";
-import { entityRegistry, ensureInitialized } from "../entities/registry";
+import { auth } from "../auth.js";
+import { entityRegistry, ensureInitialized } from "../entities/registry.js";
 import {
   createApiResponse,
   createApiError,
@@ -9,8 +9,8 @@ import {
   includeEntityMetadata,
   processEntityMetadata,
   handleEntityMetadataInResponse
-} from "./helpers";
-import { afterEntityCreate, afterEntityUpdate, afterEntityDelete } from "../entities/entity-hooks";
+} from "./helpers.js";
+import { afterEntityCreate, afterEntityUpdate, afterEntityDelete } from "../entities/entity-hooks.js";
 async function checkBasicAuth(request, entityName) {
   try {
     const session = await auth.api.getSession({ headers: request.headers });