@njinlabs/njin 0.6.0 → 0.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@njinlabs/njin",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "A modern framework for building company profiles, landing pages, and content-driven websites.",
   "type": "module",
   "keywords": ["bun", "elysia", "surrealdb", "edgejs", "cms", "framework"],

package/src/core/model/index.ts

@@ -7,6 +7,7 @@ import { runAfterHooks, runBeforeDestroyHooks, runBeforeHooks } from "./hooks";
 export type FormMeta = {
   label: string;
   unique?: boolean;
+  hideForm?: boolean;
 };
 
 export class UniqueConstraintError extends Error {
@@ -153,10 +154,16 @@ export const makeModel = <Rules extends z.ZodObject>(
     const whereParts: string[] = [];
     const params: Record<string, unknown> = {};
 
+    // Uses SurrealDB's full-text SEARCH index (see SEARCH_ANALYZER in ../../modules/surreal),
+    // not string::similarity::jaro_winkler — jaro_winkler compares two strings as a whole, so
+    // a short search term against a long field (e.g. "next.js" inside a full title) scores far
+    // below any usable threshold even though the term is clearly present. The @N@ match
+    // operator + ngram analyzer gives real substring/partial-word matching, BM25 relevance
+    // ranking, and still tolerates minor typos via shared n-grams.
     if (search && config.searchFields.length) {
-      params.search = search.toLowerCase();
+      params.search = search.trim();
       whereParts.push(
-        `(${config.searchFields.map((f) => `string::similarity::jaro_winkler(string::lowercase(${f}), $search) > 0.4`).join(" OR ")})`,
+        `(${config.searchFields.map((f, i) => `${f} @${i + 1}@ $search`).join(" OR ")})`,
       );
     }
 
@@ -190,7 +197,14 @@ export const makeModel = <Rules extends z.ZodObject>(
     // id/createdAt/updatedAt are always present on every record but aren't part of the
     // user-defined schema shape (they're injected in create()/update()) — allow sorting by them too.
     const sortableFields = new Set([...Object.keys(config.schema.shape), "id", "createdAt", "updatedAt"]);
-    const orderBy = sort && sortableFields.has(sort) ? `ORDER BY ${sort} ${order === "desc" ? "DESC" : "ASC"}` : "";
+    // An explicit sort always wins; otherwise, when searching, rank by BM25 relevance
+    // (summed across every matched search field) instead of leaving result order unspecified.
+    const orderBy =
+      sort && sortableFields.has(sort)
+        ? `ORDER BY ${sort} ${order === "desc" ? "DESC" : "ASC"}`
+        : search && config.searchFields.length
+          ? `ORDER BY (${config.searchFields.map((_, i) => `search::score(${i + 1})`).join(" + ")}) DESC`
+          : "";
 
     // Validate populate against known relation fields — prevents FETCH injection
     const fetchFields =
@@ -262,6 +276,7 @@ export const makeModel = <Rules extends z.ZodObject>(
     create,
     destroy,
     read,
+    searchFields: config.searchFields,
     show,
     table,
     update,

package/src/modules/api.ts

@@ -5,11 +5,33 @@ import z from "zod";
 import auth from "./auth";
 import elysia from "./elysia";
 
+// Removes fields marked hideForm: true from a JSON schema's properties/required,
+// recursing into nested object/array shapes so hidden fields never reach the admin panel.
+const stripHiddenFields = (node: any): void => {
+  if (!node || typeof node !== "object") return;
+
+  if (node.properties) {
+    for (const [key, prop] of Object.entries(node.properties as Record<string, any>)) {
+      if (prop?.hideForm) {
+        delete node.properties[key];
+        if (Array.isArray(node.required)) {
+          node.required = node.required.filter((r: string) => r !== key);
+        }
+      } else {
+        stripHiddenFields(prop);
+      }
+    }
+  }
+
+  if (node.items) stripHiddenFields(node.items);
+};
+
 // Shared by both models and vars groups on the /api/schema endpoint — strips
 // non-JSON-representable renderAs types (relation/multi_relation/file) into
-// plain JSON-schema shapes the admin panel can render a form from.
-const toAdminSchema = (schema: z.ZodObject) =>
-  schema.toJSONSchema({
+// plain JSON-schema shapes the admin panel can render a form from, and drops
+// any field marked hideForm: true so it never reaches the admin panel.
+const toAdminSchema = (schema: z.ZodObject) => {
+  const jsonSchema = schema.toJSONSchema({
     unrepresentable: "any",
     override: (ctx) => {
       if (ctx.jsonSchema.renderAs === "relation") {
@@ -29,6 +51,11 @@ const toAdminSchema = (schema: z.ZodObject) =>
     },
   });
 
+  stripHiddenFields(jsonSchema);
+
+  return jsonSchema;
+};
+
 const api = makeModule(() => {
   const fn = () => {};
 

package/src/modules/img.ts

@@ -85,7 +85,17 @@ const img = makeModule(() => {
       let imageData: ArrayBuffer;
 
       if (url.startsWith("/")) {
-        const resp = await fetch(`http://localhost:${getConfig().port}${url}`);
+        // A real network fetch to localhost:<port> only works when app.listen() actually bound
+        // that port — under njin-supervisor's worker mode (NJIN_WORKER=1, see core/worker.ts)
+        // nothing does, requests arrive via postMessage and are handled in-process instead, so
+        // that socket was never listening and this always failed with a connection error.
+        // Calling the same in-process Elysia instance's handle() works in both modes, and skips
+        // an unnecessary self-round-trip even outside worker mode. The origin is taken from the
+        // *incoming* request rather than hardcoded — routing itself only cares about
+        // pathname+query, but a handler further down that inspects request.url (absolute-URL
+        // generation, host-based logic, ...) should see the same scheme/host this request
+        // actually arrived on, not a fake one that may not match across environments.
+        const resp = await elysia().handle(new Request(`${new URL(request.url).origin}${url}`));
         if (!resp.ok) return new Response("Image not found", { status: 404 });
         imageData = await resp.arrayBuffer();
       } else {

package/src/modules/surreal.ts

@@ -8,6 +8,13 @@ const EMBEDDED_SCHEMES = ["mem://", "rocksdb://", "surrealkv://"];
 
 export const isRemotePath = (path: string) => REMOTE_SCHEMES.some((scheme) => path.startsWith(scheme));
 
+// Shared by every model's search index (see ../core/model/index.ts's read()) — a `class`
+// tokenizer splits on Unicode character-class boundaries (language-agnostic word
+// splitting), and the `ngram` filter indexes overlapping 2-10 char slices of each token so
+// the `@N@` match operator can find a term anywhere inside a field (not just a whole-field
+// match) and still tolerate minor typos, similar to trigram search.
+const SEARCH_ANALYZER = "njin_search";
+
 // SurrealDB's `GROUP ALL` aggregate (used for count queries) throws NotFoundError
 // on a table that has never had a row created, unlike plain SELECT. Defining every
 // table up front avoids that first-run failure (e.g. /api/setup/status before any user exists).
@@ -15,16 +22,34 @@ const ensureTables = async (db: Surreal) => {
   const { default: userModel } = await import("../models/user");
   const { default: fileModel } = await import("../models/file");
 
-  const prefixes = new Set<string>([userModel.prefix, fileModel.prefix, "vars"]);
+  const models: { prefix: string; searchFields?: string[] }[] = [userModel, fileModel];
 
   for (const factory of getConfig().models) {
     const { default: model } = await factory();
-    prefixes.add(model.prefix);
+    models.push(model);
   }
 
+  const prefixes = new Set<string>(models.map((model) => model.prefix));
+  prefixes.add("vars");
+
   for (const prefix of prefixes) {
     await db.query(`DEFINE TABLE IF NOT EXISTS ${prefix} SCHEMALESS;`);
   }
+
+  await db.query(`DEFINE ANALYZER IF NOT EXISTS ${SEARCH_ANALYZER} TOKENIZERS class FILTERS lowercase,ngram(2,10);`);
+
+  const definedIndexes = new Set<string>(); // dedupe prefix+field in case two factories share a prefix
+  for (const model of models) {
+    for (const field of model.searchFields ?? []) {
+      const key = `${model.prefix}.${field}`;
+      if (definedIndexes.has(key)) continue;
+      definedIndexes.add(key);
+
+      await db.query(
+        `DEFINE INDEX IF NOT EXISTS idx_search_${model.prefix}_${field} ON TABLE ${model.prefix} FIELDS ${field} SEARCH ANALYZER ${SEARCH_ANALYZER} BM25 HIGHLIGHTS;`,
+      );
+    }
+  }
 };
 
 const surreal = makeModule(() => {