@opengis/cms 0.0.10 → 0.0.12

package/dist/style.css

@@ -0,0 +1 @@
+.draggable-item[data-v-eefd185d]{cursor:move;-webkit-user-select:none;user-select:none;padding:4px;transition:all .2s ease;border-radius:6px;border:2px solid transparent;position:relative;z-index:1}.draggable-item[data-v-eefd185d]:hover{background-color:#f3f4f6}.draggable-item.drag-over[data-v-eefd185d]{background-color:#e0f2fe;border-color:#3b82f6;box-shadow:0 0 0 2px #3b82f633;transform:scale(1.02)}.draggable-item.dragging[data-v-eefd185d]{opacity:.5;background-color:#dbeafe;border-color:#3b82f6}.draggable-item button[data-v-eefd185d]{position:relative;z-index:2}.root-drag-over[data-v-84b80de2]{border-color:#3b82f6;background-color:#dbeafe;box-shadow:0 0 0 4px #3b82f633;transform:scale(1.01)}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengis/cms",
-  "version": "0.0.10",
+  "version": "0.0.12",
   "description": "cms",
   "type": "module",
   "author": "Softpro",
@@ -23,10 +23,10 @@
     "docs:preview": "vitepress preview docs"
   },
   "dependencies": {
-    "@opengis/fastify-auth": "^1.0.76",
-    "@opengis/fastify-file": "^1.0.45",
-    "@opengis/fastify-table": "^1.2.27",
-    "@opengis/v3-core": "^0.3.73",
+    "@opengis/fastify-auth": "1.0.85",
+    "@opengis/fastify-file": "1.0.76",
+    "@opengis/fastify-table": "1.3.42",
+    "@opengis/v3-core": "^0.3.165",
     "@opengis/v3-filter": "^0.0.74",
     "@vitejs/plugin-vue": "^5.0.4",
     "cross-env": "^7.0.3",

package/server/app.js

@@ -1,10 +1,12 @@
 import path from 'node:path';
+import { fileURLToPath } from 'url';
+
 import { config, execMigrations } from '@opengis/fastify-table/utils.js';
 
 config.prefix = config.prefix || '/api';
 const { prefix } = config;
 
-const cwd = process.cwd();
+const dirname = path.dirname(fileURLToPath(import.meta.url));
 
 export default async function (fastify) {
   // core
@@ -21,5 +23,6 @@ export default async function (fastify) {
   fastify.register(import('./routes/category/index.mjs'), { prefix });
   fastify.register(import('./routes/manager/index.mjs'), { prefix });
   fastify.register(import('./routes/media/index.mjs'), { prefix });
-  execMigrations(path.join(cwd, 'server/migrations')).catch(err => console.log(err));
+  fastify.register(import('./routes/site/index.mjs'), { prefix });
+  execMigrations(path.join(dirname, 'migrations')).catch(err => console.log(err));
 }

package/server/migrations/site.sql

@@ -0,0 +1,428 @@
+create schema if not exists admin;
+create table if not exists admin.users (uid text primary key default next_id());
+
+create schema if not exists site;
+create table if not exists site.categories (category_id text primary key default next_id());
+
+-- drop table if exists site.articles cascade;
+CREATE TABLE if not exists site.articles (
+    article_id text PRIMARY KEY default next_id(),
+    title VARCHAR (100) NOT NULL,
+    slug VARCHAR (50) UNIQUE,
+    content TEXT,
+    excerpt TEXT,
+    status VARCHAR not null DEFAULT 'draft' CHECK (status::text = ANY (ARRAY['draft', 'published', 'archived']::text[])),
+    published_at TIMESTAMP,
+    is_visible BOOLEAN not null DEFAULT TRUE,
+    meta_title VARCHAR,
+    meta_description TEXT,
+    created_at TIMESTAMP DEFAULT NOW(),
+    updated_at TIMESTAMP DEFAULT NOW(),
+    created_by text REFERENCES admin.users(uid),
+    updated_by text REFERENCES admin.users(uid),
+    author_id text REFERENCES admin.users(uid) ON DELETE SET NULL,
+    category_id text REFERENCES site.categories(category_id) ON DELETE SET NULL
+);
+
+CREATE INDEX if not exists idx_published_articles ON site.articles(published_at) WHERE status = 'published';
+CREATE INDEX if not exists idx_articles_status ON site.articles(status);
+CREATE INDEX if not exists idx_articles_category_id ON site.articles(category_id);
+CREATE INDEX if not exists idx_articles_author_id ON site.articles(author_id);
+CREATE INDEX if not exists idx_articles_is_visible ON site.articles(is_visible);
+CREATE INDEX if not exists idx_articles_published_at ON site.articles(published_at);
+
+COMMENT ON TABLE site.articles IS 'Articles for the site, including content, metadata, status, and authorship.';
+COMMENT ON COLUMN site.articles.article_id IS 'Primary key for the article, generated via next_id().';
+COMMENT ON COLUMN site.articles.title IS 'Title of the article.';
+COMMENT ON COLUMN site.articles.slug IS 'URL-friendly unique identifier for the article.';
+COMMENT ON COLUMN site.articles.content IS 'Full body content of the article.';
+COMMENT ON COLUMN site.articles.excerpt IS 'Optional summary or teaser text.';
+COMMENT ON COLUMN site.articles.status IS 'Publication status: draft, published, or archived.';
+COMMENT ON COLUMN site.articles.published_at IS 'Timestamp when the article was published.';
+COMMENT ON COLUMN site.articles.is_visible IS 'Boolean flag indicating if the article is visible on the site.';
+COMMENT ON COLUMN site.articles.meta_title IS 'SEO meta title for the article.';
+COMMENT ON COLUMN site.articles.meta_description IS 'SEO meta description for the article.';
+COMMENT ON COLUMN site.articles.created_at IS 'Timestamp when the article was created.';
+COMMENT ON COLUMN site.articles.updated_at IS 'Timestamp when the article was last updated.';
+COMMENT ON COLUMN site.articles.created_by IS 'User ID of the admin who created the article.';
+COMMENT ON COLUMN site.articles.updated_by IS 'User ID of the admin who last updated the article.';
+COMMENT ON COLUMN site.articles.author_id IS 'User ID of the article''s author.';
+COMMENT ON COLUMN site.articles.category_id IS 'Category ID to which the article belongs.';
+
+-- drop table if exists site.media cascade;
+CREATE TABLE if not exists site.media (
+    media_id text PRIMARY KEY default next_id(),
+    filename TEXT NOT NULL,
+    filetype TEXT NOT NULL,
+    filesize INTEGER NOT NULL,
+    url TEXT,
+    description TEXT,
+    alt text,
+    mime VARCHAR(100),
+    preview_url TEXT,
+    created_at TIMESTAMP DEFAULT NOW(),
+    updated_at TIMESTAMP DEFAULT NOW(),
+    created_by text REFERENCES admin.users(uid),
+    updated_by text REFERENCES admin.users(uid)
+);
+
+COMMENT ON TABLE site.media IS 'Stores uploaded media files with metadata, URLs, and audit info.';
+COMMENT ON COLUMN site.media.media_id IS 'Unique ID for the media item.';
+COMMENT ON COLUMN site.media.filename IS 'Original name of the uploaded file.';
+COMMENT ON COLUMN site.media.filetype IS 'Logical type of file (e.g., image, video, document).';
+COMMENT ON COLUMN site.media.filesize IS 'Size of the file in bytes.';
+COMMENT ON COLUMN site.media.url IS 'URL where the file can be accessed.';
+COMMENT ON COLUMN site.media.description IS 'Optional description or caption.';
+COMMENT ON COLUMN site.media.alt IS 'Alternative text for screen readers or image fallbacks.';
+COMMENT ON COLUMN site.media.mime IS 'MIME type indicating the file format (e.g., image/png).';
+COMMENT ON COLUMN site.media.preview_url IS 'Optional preview or thumbnail URL.';
+COMMENT ON COLUMN site.media.created_at IS 'Timestamp of when the media record was created.';
+COMMENT ON COLUMN site.media.updated_at IS 'Timestamp of the last update to the media record.';
+COMMENT ON COLUMN site.media.created_by IS 'User ID who uploaded the media.';
+COMMENT ON COLUMN site.media.updated_by IS 'User ID who last updated the media.';
+
+CREATE INDEX if not exists idx_media_filetype ON site.media(filetype);
+CREATE INDEX if not exists idx_media_filesize ON site.media(filesize);
+CREATE INDEX if not exists idx_media_mime ON site.media(mime);
+CREATE INDEX if not exists idx_media_created_at ON site.media(created_at);
+CREATE INDEX if not exists idx_media_created_by ON site.media(created_by);
+CREATE INDEX if not exists idx_media_updated_at ON site.media(updated_at);
+CREATE INDEX if not exists idx_media_updated_by ON site.media(updated_by);
+
+-- drop table if exists site.article_media cascade;
+CREATE TABLE if not exists site.article_media (
+    article_id text not null REFERENCES site.articles(article_id) ON DELETE CASCADE, 
+    media_id text not null REFERENCES site.media(media_id) ON DELETE CASCADE,
+    related_id text NOT NULL,
+    related_type VARCHAR(50) NOT NULL,
+    field VARCHAR(50) NOT NULL,
+    order_index INTEGER DEFAULT 0,
+    PRIMARY KEY (article_id, media_id, field)
+);
+
+COMMENT ON TABLE site.article_media IS 'Join table for associating media with articles, supporting multiple fields and order.';
+COMMENT ON COLUMN site.article_media.article_id IS 'Foreign key to the article that uses the media.';
+COMMENT ON COLUMN site.article_media.media_id IS 'Foreign key to the media file linked to the article.';
+COMMENT ON COLUMN site.article_media.related_id IS 'ID of the related entity (for polymorphic associations).';
+COMMENT ON COLUMN site.article_media.related_type IS 'Type of the related entity (e.g., article, gallery).';
+COMMENT ON COLUMN site.article_media.field IS 'Field name that defines the role of media (e.g., cover, inline).';
+COMMENT ON COLUMN site.article_media.order_index IS 'Ordering index for multiple media in the same field.';
+
+CREATE INDEX if not exists idx_article_media_related ON site.article_media(related_type, related_id);
+CREATE INDEX if not exists idx_article_media_ordering ON site.article_media(article_id, field, order_index);
+
+-- drop table if exists site.content_types cascade;
+CREATE TABLE if not exists site.content_types (
+    content_type_id text PRIMARY KEY default next_id(),
+    name VARCHAR (50) NOT NULL UNIQUE,
+    display_name VARCHAR (50) NOT NULL,
+    table_name VARCHAR(50) NOT NULL,
+    status VARCHAR (20) DEFAULT 'draft' CHECK (status::text = ANY (ARRAY['draft', 'published', 'archived']::text[])),
+    visible BOOLEAN DEFAULT TRUE, 
+    localized BOOLEAN DEFAULT FALSE,
+    type VARCHAR(20) NOT NULL DEFAULT 'collection' CHECK (type::text = ANY (ARRAY['collection', 'single']::text[])),
+    schema JSONB,
+    description TEXT,
+    icon VARCHAR (50),
+    color VARCHAR (20),
+    created_at TIMESTAMP DEFAULT NOW(),
+    updated_at TIMESTAMP DEFAULT NOW(),
+    created_by text REFERENCES admin.users(uid),
+    updated_by text REFERENCES admin.users(uid)
+);
+
+COMMENT ON TABLE site.content_types IS 'Defines reusable content structures for dynamic content management.';
+COMMENT ON COLUMN site.content_types.content_type_id IS 'Unique identifier for the content type.';
+COMMENT ON COLUMN site.content_types.name IS 'Internal name used in the system (must be unique).';
+COMMENT ON COLUMN site.content_types.display_name IS 'Human-readable label shown in UI.';
+COMMENT ON COLUMN site.content_types.table_name IS 'Physical table where entries of this type are stored.';
+COMMENT ON COLUMN site.content_types.status IS 'Status of the content type (draft, published, archived).';
+COMMENT ON COLUMN site.content_types.visible IS 'Controls whether this content type appears in admin UI.';
+COMMENT ON COLUMN site.content_types.localized IS 'Indicates whether the content type supports localization.';
+COMMENT ON COLUMN site.content_types.type IS 'Whether this content type is a collection or a single instance.';
+COMMENT ON COLUMN site.content_types.schema IS 'JSON schema defining the structure and fields of this content type.';
+COMMENT ON COLUMN site.content_types.description IS 'Optional description of the content type.';
+COMMENT ON COLUMN site.content_types.icon IS 'UI icon identifier for this type.';
+COMMENT ON COLUMN site.content_types.color IS 'UI color code or name for this type.';
+COMMENT ON COLUMN site.content_types.created_at IS 'Timestamp when the content type was created.';
+COMMENT ON COLUMN site.content_types.updated_at IS 'Timestamp when the content type was last modified.';
+COMMENT ON COLUMN site.content_types.created_by IS 'Admin user who created the content type.';
+COMMENT ON COLUMN site.content_types.updated_by IS 'Admin user who last updated the content type.';
+
+CREATE INDEX if not exists idx_content_types_status ON site.content_types(status);
+CREATE INDEX if not exists idx_content_types_visible ON site.content_types(visible);
+CREATE INDEX if not exists idx_content_types_type ON site.content_types(type);
+CREATE INDEX if not exists idx_content_types_table_name ON site.content_types(table_name);
+
+-- drop table if exists site.content_attributes cascade;
+CREATE TABLE if not exists site.content_attributes (
+    content_attribute_id text PRIMARY KEY default next_id(),
+    content_type_id text REFERENCES site.content_types(content_type_id) ON DELETE CASCADE,
+    name VARCHAR NOT NULL,
+    type VARCHAR NOT NULL,
+    is_required BOOLEAN DEFAULT FALSE,
+    is_unique BOOLEAN DEFAULT FALSE,
+    minLength numeric,
+    maxLength numeric,
+    private BOOLEAN DEFAULT FALSE,
+    min numeric,
+    max numeric,
+    relation_type VARCHAR (20),
+    related_to VARCHAR(50),
+    default_value TEXT,
+    options JSONB,
+    enum text[], 
+    created_at TIMESTAMP DEFAULT NOW(),
+    updated_at TIMESTAMP DEFAULT NOW(),
+    created_by text REFERENCES admin.users(uid),
+    updated_by text REFERENCES admin.users(uid)
+);
+
+COMMENT ON TABLE site.content_attributes IS 'Defines fields (attributes) for a dynamic content type schema.';
+COMMENT ON COLUMN site.content_attributes.content_attribute_id IS 'Primary key for the content attribute.';
+COMMENT ON COLUMN site.content_attributes.content_type_id IS 'Foreign key to the content type this attribute belongs to.';
+COMMENT ON COLUMN site.content_attributes.name IS 'Machine name of the attribute.';
+COMMENT ON COLUMN site.content_attributes.type IS 'Data type of the attribute (e.g., text, number, boolean).';
+COMMENT ON COLUMN site.content_attributes.is_required IS 'Whether this field must be filled.';
+COMMENT ON COLUMN site.content_attributes.is_unique IS 'Whether values for this field must be unique.';
+COMMENT ON COLUMN site.content_attributes.minLength IS 'Minimum length constraint (for strings).';
+COMMENT ON COLUMN site.content_attributes.maxLength IS 'Maximum length constraint (for strings).';
+COMMENT ON COLUMN site.content_attributes.private IS 'Whether this field is hidden in public APIs.';
+COMMENT ON COLUMN site.content_attributes.min IS 'Minimum numeric value (if applicable).';
+COMMENT ON COLUMN site.content_attributes.max IS 'Maximum numeric value (if applicable).';
+COMMENT ON COLUMN site.content_attributes.relation_type IS 'Type of relation, if any (e.g., one-to-many).';
+COMMENT ON COLUMN site.content_attributes.related_to IS 'Target entity/content type this field relates to.';
+COMMENT ON COLUMN site.content_attributes.default_value IS 'Default value assigned to this field.';
+COMMENT ON COLUMN site.content_attributes.options IS 'Custom configuration or metadata in JSON format.';
+COMMENT ON COLUMN site.content_attributes.enum IS 'List of allowed enum values for this field.';
+COMMENT ON COLUMN site.content_attributes.created_at IS 'Timestamp when this attribute was created.';
+COMMENT ON COLUMN site.content_attributes.updated_at IS 'Timestamp when this attribute was last updated.';
+COMMENT ON COLUMN site.content_attributes.created_by IS 'Admin user who created the content type.';
+COMMENT ON COLUMN site.content_attributes.updated_by IS 'Admin user who last updated the content type.';
+
+CREATE INDEX if not exists idx_attributes_by_type ON site.content_attributes(content_type_id);
+CREATE INDEX if not exists idx_attributes_name ON site.content_attributes(name);
+CREATE INDEX if not exists idx_attributes_type ON site.content_attributes(type);
+
+-- drop table if exists site.article_translations cascade;
+CREATE TABLE if not exists site.article_translations (
+    article_translation_id text PRIMARY KEY default next_id(),
+    article_id text REFERENCES site.articles(article_id) ON DELETE CASCADE,
+    locale VARCHAR(10) NOT NULL,
+    title VARCHAR (100) NOT NULL,
+    content TEXT,
+    excerpt TEXT,
+    meta_title VARCHAR (100),
+    meta_description TEXT,
+    created_at TIMESTAMP DEFAULT NOW(),
+    updated_at TIMESTAMP DEFAULT NOW(),
+    created_by text REFERENCES admin.users(uid),
+    updated_by text REFERENCES admin.users(uid),
+    UNIQUE (article_id, locale)
+);
+
+COMMENT ON TABLE site.article_translations IS 'Stores translated content for articles across different locales.';
+COMMENT ON COLUMN site.article_translations.article_translation_id IS 'Primary key for the article translation.';
+COMMENT ON COLUMN site.article_translations.article_id IS 'Foreign key linking to the main article.';
+COMMENT ON COLUMN site.article_translations.locale IS 'Locale code for the translation (e.g., en, fr).';
+COMMENT ON COLUMN site.article_translations.title IS 'Translated title of the article.';
+COMMENT ON COLUMN site.article_translations.content IS 'Translated content body.';
+COMMENT ON COLUMN site.article_translations.excerpt IS 'Translated excerpt or teaser text.';
+COMMENT ON COLUMN site.article_translations.meta_title IS 'Translated SEO meta title.';
+COMMENT ON COLUMN site.article_translations.meta_description IS 'Translated SEO meta description.';
+COMMENT ON COLUMN site.article_translations.created_at IS 'Timestamp of when this translation was created.';
+COMMENT ON COLUMN site.article_translations.updated_at IS 'Timestamp of when this translation was last updated.';
+COMMENT ON COLUMN site.article_translations.created_by IS 'Admin user who created this translation.';
+COMMENT ON COLUMN site.article_translations.updated_by IS 'Admin user who last updated this translation.';
+
+CREATE INDEX if not exists idx_article_translations_article_id ON site.article_translations(article_id);
+CREATE INDEX if not exists idx_article_translations_locale ON site.article_translations(locale);
+
+-- drop table if exists site.single_type_values cascade;
+CREATE TABLE if not exists site.single_type_values (
+    single_type_value_id text PRIMARY KEY default next_id(),
+    type_name VARCHAR(100) NOT NULL,
+    key VARCHAR(255) NOT NULL,
+    value TEXT,
+    value_type VARCHAR(50),
+    created_at TIMESTAMP DEFAULT NOW(),
+    updated_at TIMESTAMP DEFAULT NOW(),
+    created_by text REFERENCES admin.users(uid),
+    updated_by text REFERENCES admin.users(uid),
+    UNIQUE(type_name, key)
+);
+
+COMMENT ON TABLE site.single_type_values IS 'Stores key-value pairs for single-type settings or configurations.';
+COMMENT ON COLUMN site.single_type_values.single_type_value_id IS 'Primary key for the single type value entry.';
+COMMENT ON COLUMN site.single_type_values.type_name IS 'Type of the setting or configuration.';
+COMMENT ON COLUMN site.single_type_values.key IS 'Unique key for the setting or configuration value.';
+COMMENT ON COLUMN site.single_type_values.value IS 'The value associated with the key.';
+COMMENT ON COLUMN site.single_type_values.value_type IS 'Type of value (e.g., string, integer, boolean).';
+COMMENT ON COLUMN site.single_type_values.created_at IS 'Timestamp when the value entry was created.';
+COMMENT ON COLUMN site.single_type_values.updated_at IS 'Timestamp when the value entry was last updated.';
+COMMENT ON COLUMN site.single_type_values.created_by IS 'User who created the value entry.';
+COMMENT ON COLUMN site.single_type_values.updated_by IS 'User who last updated the value entry.';
+
+CREATE INDEX if not exists idx_single_type_values_type_name ON site.single_type_values(type_name);
+CREATE INDEX if not exists idx_single_type_values_key ON site.single_type_values(key);
+
+-- drop table if exists site.settings cascade;
+CREATE TABLE if not exists site.settings (
+    id serial PRIMARY KEY CHECK (id = 1),
+    key VARCHAR (50) NOT NULL UNIQUE,
+    value TEXT NOT NULL,
+    created_at TIMESTAMP DEFAULT NOW(),
+    updated_at TIMESTAMP DEFAULT NOW(),
+    created_by text REFERENCES admin.users(uid),
+    updated_by text REFERENCES admin.users(uid)
+);
+
+COMMENT ON TABLE site.settings IS 'Stores global settings for the site, with only one record allowed.';
+COMMENT ON COLUMN site.settings.id IS 'Unique ID for the settings table (always 1).';
+COMMENT ON COLUMN site.settings.key IS 'Unique key for the setting (e.g., "site_title").';
+COMMENT ON COLUMN site.settings.value IS 'The value associated with the key (e.g., "My Site Title").';
+COMMENT ON COLUMN site.settings.created_at IS 'Timestamp when the setting was created.';
+COMMENT ON COLUMN site.settings.updated_at IS 'Timestamp when the setting was last updated.';
+COMMENT ON COLUMN site.settings.created_by IS 'User who created the setting record.';
+COMMENT ON COLUMN site.settings.updated_by IS 'User who last updated the setting record.';
+
+CREATE INDEX if not exists idx_settings_key ON site.settings(key);
+
+-- drop table if exists site.menus cascade;
+CREATE TABLE if not exists site.menus (
+    menu_id text PRIMARY KEY default next_id(),
+    name VARCHAR(100) UNIQUE NOT NULL,
+    slug VARCHAR(100) UNIQUE NOT NULL,
+    description TEXT,
+    created_at TIMESTAMP DEFAULT NOW(),
+    updated_at TIMESTAMP DEFAULT NOW(),
+    created_by text REFERENCES admin.users(uid),
+    updated_by text REFERENCES admin.users(uid)
+);
+
+COMMENT ON TABLE site.menus IS 'Stores menu information with a name, slug, description, and audit fields.';
+COMMENT ON COLUMN site.menus.menu_id IS 'Primary key for the menu (auto-generated).';
+COMMENT ON COLUMN site.menus.name IS 'Unique name for the menu.';
+COMMENT ON COLUMN site.menus.slug IS 'Unique slug for the menu, used for URLs or other references.';
+COMMENT ON COLUMN site.menus.description IS 'Optional description of the menu.';
+COMMENT ON COLUMN site.menus.created_at IS 'Timestamp when the menu was created.';
+COMMENT ON COLUMN site.menus.updated_at IS 'Timestamp when the menu was last updated.';
+COMMENT ON COLUMN site.menus.created_by IS 'Admin user who created the menu.';
+COMMENT ON COLUMN site.menus.updated_by IS 'Admin user who last updated the menu.';
+
+CREATE INDEX if not exists idx_menus_name ON site.menus(name);
+CREATE INDEX if not exists idx_menus_slug ON site.menus(slug);
+
+-- drop table if exists site.menu_items cascade;
+CREATE TABLE if not exists site.menu_items (
+    menu_item_id text PRIMARY KEY default next_id(),
+    menu_id text NOT NULL REFERENCES site.menus(menu_id) ON DELETE CASCADE,
+    parent_id text REFERENCES site.menu_items(menu_item_id) ON DELETE CASCADE,
+    title VARCHAR(255) NOT NULL,
+    url TEXT,
+    order_index INTEGER DEFAULT 0,
+    target VARCHAR(20),
+    icon VARCHAR(100),
+    created_at TIMESTAMP DEFAULT NOW(),
+    updated_at TIMESTAMP DEFAULT NOW(),
+    created_by text REFERENCES admin.users(uid),
+    updated_by text REFERENCES admin.users(uid)
+);
+
+COMMENT ON TABLE site.menu_items IS 'Stores items within menus, supporting hierarchical (nested) structures.';
+COMMENT ON COLUMN site.menu_items.menu_item_id IS 'Primary key for the menu item (auto-generated).';
+COMMENT ON COLUMN site.menu_items.menu_id IS 'Foreign key linking to the associated menu.';
+COMMENT ON COLUMN site.menu_items.parent_id IS 'Foreign key linking to the parent menu item (for nested structure).';
+COMMENT ON COLUMN site.menu_items.title IS 'Title of the menu item.';
+COMMENT ON COLUMN site.menu_items.url IS 'URL or path for the menu item.';
+COMMENT ON COLUMN site.menu_items.order_index IS 'Index used for ordering the menu items.';
+COMMENT ON COLUMN site.menu_items.target IS 'Target attribute for the menu link (e.g., "_blank" for a new tab).';
+COMMENT ON COLUMN site.menu_items.icon IS 'Icon associated with the menu item.';
+COMMENT ON COLUMN site.menu_items.created_at IS 'Timestamp when the menu item was created.';
+COMMENT ON COLUMN site.menu_items.updated_at IS 'Timestamp when the menu item was last updated.';
+COMMENT ON COLUMN site.menu_items.created_by IS 'User who created the menu item.';
+COMMENT ON COLUMN site.menu_items.updated_by IS 'User who last updated the menu item.';
+
+CREATE INDEX if not exists idx_menu_items_menu_id ON site.menu_items(menu_id);
+CREATE INDEX if not exists idx_menu_items_parent_id ON site.menu_items(parent_id);
+CREATE INDEX if not exists idx_menu_items_order_index ON site.menu_items(order_index);
+
+-- drop table if exists site.roles cascade;
+CREATE TABLE if not exists site.roles (
+    role_id text PRIMARY KEY default next_id(),
+    name VARCHAR(100) UNIQUE NOT NULL,
+    description TEXT,
+    created_at TIMESTAMP DEFAULT NOW(),
+    updated_at TIMESTAMP DEFAULT NOW(),
+    created_by text REFERENCES admin.users(uid),
+    updated_by text REFERENCES admin.users(uid)
+);
+
+COMMENT ON TABLE site.roles IS 'Stores information about user roles, which can be used for access control and permissions.';
+COMMENT ON COLUMN site.roles.role_id IS 'Primary key for the role (auto-generated).';
+COMMENT ON COLUMN site.roles.name IS 'Unique name of the role (e.g., "admin", "editor").';
+COMMENT ON COLUMN site.roles.description IS 'Description of the role and its permissions.';
+COMMENT ON COLUMN site.roles.created_at IS 'Timestamp when the role was created.';
+COMMENT ON COLUMN site.roles.updated_at IS 'Timestamp when the role was last updated.';
+COMMENT ON COLUMN site.roles.created_by IS 'User who created the role.';
+COMMENT ON COLUMN site.roles.updated_by IS 'User who last updated the role.';
+
+CREATE INDEX if not exists idx_roles_name ON site.roles(name);
+
+-- drop table if exists site.permissions cascade;
+CREATE TABLE if not exists site.permissions (
+    permission_id text PRIMARY KEY default next_id(),
+    role_id text references site.roles(role_id), 
+    user_id text references admin.users(uid), 
+    content_type_id text references site.content_types(content_type_id),
+    subject VARCHAR(100) NOT NULL,
+    actions TEXT[] NOT NULL check (actions && (ARRAY['read', 'create', 'delete', 'edit']::text[])),
+    description TEXT,
+    created_at TIMESTAMP DEFAULT NOW(),
+    updated_at TIMESTAMP DEFAULT NOW(),
+    created_by text REFERENCES admin.users(uid),
+    updated_by text REFERENCES admin.users(uid)
+);
+
+
+COMMENT ON TABLE site.permissions IS 'Stores permissions assigned to roles or users, defining actions for specific subjects and content types.';
+COMMENT ON COLUMN site.permissions.permission_id IS 'Primary key for the permission (auto-generated).';
+COMMENT ON COLUMN site.permissions.role_id IS 'Foreign key linking to the role the permission is assigned to.';
+COMMENT ON COLUMN site.permissions.user_id IS 'Foreign key linking to the user who has the permission.';
+COMMENT ON COLUMN site.permissions.content_type_id IS 'Foreign key linking to the content type for which the permission applies.';
+COMMENT ON COLUMN site.permissions.subject IS 'Subject (e.g., "post", "comment") of the permission.';
+COMMENT ON COLUMN site.permissions.actions IS 'Array of actions allowed for the permission (e.g., ["create", "update"]).';
+COMMENT ON COLUMN site.permissions.description IS 'Description of the permission.';
+COMMENT ON COLUMN site.permissions.created_at IS 'Timestamp when the permission was created.';
+COMMENT ON COLUMN site.permissions.updated_at IS 'Timestamp when the permission was last updated.';
+COMMENT ON COLUMN site.permissions.created_by IS 'User who created the permission record.';
+COMMENT ON COLUMN site.permissions.updated_by IS 'User who last updated the permission record.';
+
+CREATE INDEX if not exists idx_permissions_role_id ON site.permissions(role_id);
+CREATE INDEX if not exists idx_permissions_user_id ON site.permissions(user_id);
+CREATE INDEX if not exists idx_permissions_content_type_id ON site.permissions(content_type_id);
+CREATE INDEX if not exists idx_permissions_subject ON site.permissions(subject);
+
+-- DROP FUNCTION site.getmenu(text);
+CREATE OR REPLACE FUNCTION site.getMenu(_name text)
+  RETURNS json AS
+$BODY$
+DECLARE
+
+BEGIN
+
+return (
+	WITH RECURSIVE menu_tree AS (
+		SELECT menu_item_id as id, parent_id, title, url, 0 AS level
+			FROM site.menu_items
+		WHERE parent_id IS NULL AND title = _name
+			UNION ALL
+		SELECT mi.menu_item_id, mi.parent_id, mi.title, mi.url, level + 1
+			FROM site.menu_items mi
+		INNER JOIN menu_tree mt ON mi.parent_id = mt.id
+	)
+	SELECT json_agg(row_to_json(menu_tree.*)) from menu_tree --ORDER BY level, id
+);
+END;
+$BODY$
+LANGUAGE plpgsql VOLATILE COST 100;

package/server/routes/site/controllers/deleteMedia.js

@@ -0,0 +1,47 @@
+import path from 'node:path';
+import { existsSync } from 'node:fs';
+import { rm } from 'node:fs/promises';
+
+import { config, dataDelete, getFolder, pgClients } from "@opengis/fastify-table/utils.js";
+
+const rootDir = getFolder(config, 'local');
+
+export default async function deleteMedia({
+    pg = pgClients.client, params = {}, user = {}, method = 'DELETE',
+}, reply) {
+    if (!config.debug && method !== 'DELETE') {
+        return reply.status(403).send('access restricted');
+    }
+
+    if (!params?.id) {
+        return reply.status(400).send('not enough params: id');
+    }
+
+    if (!pg.pk?.['site.media']) {
+        return reply.status(404).send('table not found');
+    }
+
+    const { url: relpath, id } = await pg.query(
+        'select media_id as id, url from site.media where media_id = $1 and url is not null',
+        [params.id],
+    ).then(el => el.rows?.[0] || {});
+
+    if (!id) {
+        return reply.status(404).send('media not found: ' + params.id);
+    }
+
+    const res = await dataDelete({
+        pg,
+        id,
+        table: 'site.media',
+        uid: user?.uid || 0,
+    });
+
+    const filepath = path.join(rootDir, relpath);
+
+    if (existsSync(filepath)) {
+        await rm(filepath, { recursive: true });
+    }
+
+    return { id, ...res || {} };
+}

package/server/routes/site/controllers/downloadMedia.js

@@ -0,0 +1,48 @@
+import path from 'node:path';
+import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+
+import { config, getFolder, pgClients } from "@opengis/fastify-table/utils.js";
+
+const rootDir = getFolder(config, 'local');
+
+export default async function downloadMedia({
+    pg = pgClients.client, params = {}, query = {},
+}, reply) {
+    if (!params?.id) {
+        return reply.status(400).send('not enough params: id');
+    }
+
+    if (!pg.pk?.['site.media']) {
+        return reply.status(404).send('table not found');
+    }
+
+    const { filename, mime, id, url: relpath } = await pg.query(
+        'select media_id as id, filename, mime, url from site.media where media_id = $1 and url is not null',
+        [params.id],
+    ).then(el => el.rows?.[0] || {});
+
+    if (!id) {
+        return reply.status(404).send('media not found: ' + params.id);
+    }
+
+    const filepath = path.join(rootDir, relpath);
+
+    if (!existsSync(filepath)) {
+        return reply.status(404).send('file not found');
+    }
+
+    const buffer = await readFile(filepath, { buffer: true });
+
+    // skip xml load for preview
+    if (query.preview && path.extname(filename) !== '.xml') {
+        return reply.headers({ 'Content-Type': mime }).send(buffer);
+    }
+
+    return reply
+        .headers({
+            'Content-Type': mime,
+            'Content-Disposition': `attachment; filename=${filename || path.basename(filepath)}`,
+        })
+        .send(buffer);
+}

package/server/routes/site/controllers/getPermissions.js

@@ -0,0 +1,16 @@
+import { pgClients } from '@opengis/fastify-table/utils.js';
+
+export default async function getPermissions(req, reply) {
+    const { pg = pgClients.client, params = {}, user = {} } = req;
+
+    if (!user?.uid) {
+        return reply.status(401).send('unauthorized');
+    }
+
+    const { rows = [] } = await pg.query(
+        `select * from site.permissions where ${params.id ? 'user_id=$1' : 'true'}`,
+        [params.id].filter(Boolean),
+    );
+
+    return { permissions: rows };
+}

package/server/routes/site/controllers/listMedia.js

@@ -0,0 +1,60 @@
+import path from 'node:path';
+import { existsSync, mkdirSync } from 'node:fs';
+import { readdir, stat } from 'node:fs/promises';
+
+import { config, getFolder, pgClients } from '@opengis/fastify-table/utils.js';
+
+const rootDir = getFolder(config, 'local');
+mkdirSync(path.join(rootDir, 'media'), { recursive: true });
+
+export default async function listMedia(req, reply) {
+    const { pg = pgClients.client, query = {} } = req;
+    const { subdir = '' } = query;
+
+    if (!pg.pk?.['site.media']) {
+        return reply.status(404).send('table not found');
+    }
+
+    if (typeof subdir !== 'string' || subdir.includes('..')) {
+        return reply.status(403).send('invalid params: subdir');
+    }
+
+    const relpath = path.join('/media', subdir).replace(/\\/g, '/');
+    const dirpath = path.join(rootDir, relpath).replace(/\\/g, '/');
+
+    if (!existsSync(dirpath)) {
+        return { data: [], relpath, msg: 'directory not exists' };
+    }
+
+    const { rows = [] } = await pg.query(
+        `select 
+            media_id as id, filename, filetype, filesize, url, description, alt,
+            mime, preview_url, created_at, updated_at, created_by, updated_by
+        from site.media
+        where url ~ $1`,
+        [relpath],
+    );
+
+    if (!rows.length && false) {
+        return { data: [], relpath, msg: 'empty rows' };
+    }
+
+    const isDirectory = (await stat(dirpath)).isDirectory();
+
+    const items = isDirectory ? await readdir(dirpath, { withFileTypes: true }) : [];
+
+    rows.forEach(row => Object.assign(row, {
+        url: `${req.routeOptions.url}/${row.id}/file`,
+        filepath: row.url,
+        metadata: `${req.routeOptions.url}/${row.id}`,
+        exists: !!items.find(el => el.isFile() && el.name === path.basename(row.url))
+    }));
+
+    const result = { relpath, data: rows };
+
+    if (config.debug) {
+        Object.assign(result, { rootDir });
+    }
+
+    return result;
+}