@ozdao/martyrs 0.2.486 → 0.2.487

package/dist/music.server.cjs

@@ -3,7 +3,9 @@ Object.defineProperties(exports, { __esModule: { value: true }, [Symbol.toString
 const globals_abac = require("./globals.abac-Cm9e8Jdk.cjs");
 const globals_logger = require("./globals.logger-CZMgIMlM.cjs");
 const globals_websocket = require("./globals.websocket-k6_B1T7k.cjs");
-const globals_crud = require("./globals.crud-Dv7UXbRM.cjs");
+const crud = require("./crud-BDIArc5A.cjs");
+const abac = require("./abac-6LjoG9u-.cjs");
+const globals_verifier = require("./globals.verifier-D68mHEBl.cjs");
 const fs$1 = require("fs");
 const path$1 = require("path");
 const common_schema = require("./common.schema-BzFEVNn3.cjs");
@@ -11,385 +13,1035 @@ const engagement_schema = require("./engagement.schema-JADHu8pj.cjs");
 const metadata_schema = require("./metadata.schema-RlxNv46L.cjs");
 const ownership_schema = require("./ownership.schema-DCosqOc1.cjs");
 const socials_schema = require("./socials.schema-CtpSF9dE.cjs");
-const index = require("./index-YNOkL1mu.cjs");
-const { getInstance: getInstance$1 } = globals_abac.globalsabac;
-const MusicController = function(app, db) {
-  const logger = new globals_logger.Logger(db);
-  const cache = new globals_logger.Cache();
-  const abac = getInstance$1(db);
-  class MusicController2 extends globals_crud.CRUD {
-    constructor(basePath, app2, db2, model, options) {
-      super(basePath, app2, db2, model, options);
-      this.logger = logger;
-      this.cache = cache;
-      this.abac = abac;
+function tracksVerifierFactory(db) {
+  const createVerifier = new globals_verifier.Verifier({
+    title: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().string().required("Track title is required").min(1, "Title cannot be empty").max(200, "Title must not exceed 200 characters")
+    },
+    artist: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().string().required("Artist is required").pattern(/^[0-9a-fA-F]{24}$/, "Invalid artist ID format")
+    },
+    album: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid album ID format")
+    },
+    fileUrl: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().string().required("File URL is required").pattern(/^https?:\/\/.+/, "Invalid file URL format")
+    },
+    coverUrl: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^https?:\/\/.+/, "Invalid cover URL format")
+    },
+    duration: {
+      rule: "optional",
+      default: 0,
+      validator: globals_verifier.Validator.schema().number().min(0, "Duration cannot be negative").max(3600, "Duration cannot exceed 1 hour")
+    },
+    genre: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().array().items(
+        globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid genre ID format")
+      )
+    },
+    releaseDate: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().date()
+    },
+    isExplicit: {
+      rule: "optional",
+      default: false,
+      validator: globals_verifier.Validator.schema().boolean()
+    },
+    lyrics: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().max(1e4, "Lyrics too long")
+    },
+    isPublic: {
+      rule: "optional",
+      default: true,
+      validator: globals_verifier.Validator.schema().boolean()
+    },
+    owner: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().object({
+        type: globals_verifier.Validator.schema().string().oneOf(["user", "organization"]),
+        target: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/)
+      })
+    }
+  });
+  const updateVerifier = new globals_verifier.Verifier({
+    _id: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().string().required("Track ID is required").pattern(/^[0-9a-fA-F]{24}$/, "Invalid track ID format")
+    },
+    title: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().min(1, "Title cannot be empty").max(200, "Title must not exceed 200 characters")
+    },
+    artist: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid artist ID format")
+    },
+    album: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid album ID format")
+    },
+    fileUrl: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^https?:\/\/.+/, "Invalid file URL format")
+    },
+    coverUrl: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^https?:\/\/.+/, "Invalid cover URL format")
+    },
+    duration: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().number().min(0, "Duration cannot be negative").max(3600, "Duration cannot exceed 1 hour")
+    },
+    genre: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().array().items(
+        globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid genre ID format")
+      )
+    },
+    releaseDate: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().date()
+    },
+    isExplicit: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().boolean()
+    },
+    lyrics: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().max(1e4, "Lyrics too long")
+    },
+    isPublic: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().boolean()
+    },
+    status: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().oneOf(["draft", "published", "archived"], "Invalid status")
     }
-    // Override the create method to handle ownership
-    async create(req, res) {
+  });
+  const readVerifier = new globals_verifier.Verifier({
+    _id: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid track ID format")
+    },
+    artist: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid artist ID format")
+    },
+    album: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid album ID format")
+    },
+    genre: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid genre ID format")
+    },
+    isPublic: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().boolean()
+    },
+    status: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().oneOf(["draft", "published", "archived"])
+    },
+    skip: {
+      rule: "optional",
+      default: 0,
+      validator: globals_verifier.Validator.schema().integer().min(0)
+    },
+    limit: {
+      rule: "optional",
+      default: 20,
+      validator: globals_verifier.Validator.schema().integer().min(1).max(100)
+    },
+    sortParam: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().oneOf(["title", "playCount", "releaseDate", "createdAt", "updatedAt"])
+    },
+    sortOrder: {
+      rule: "optional",
+      default: "desc",
+      validator: globals_verifier.Validator.schema().string().oneOf(["asc", "desc"])
+    }
+  });
+  const deleteVerifier = new globals_verifier.Verifier({
+    _id: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().string().required("Track ID is required").pattern(/^[0-9a-fA-F]{24}$/, "Invalid track ID format")
+    }
+  });
+  return {
+    createVerifier,
+    readVerifier,
+    updateVerifier,
+    deleteVerifier
+  };
+}
+const { getInstance: getInstance$4 } = abac.ABAC;
+function setupTracksRoutes(app, db) {
+  const abac2 = getInstance$4(db);
+  const verifier = tracksVerifierFactory();
+  const tracksCRUD = new crud.CRUD({
+    app,
+    db,
+    model: db.track,
+    modelName: "track",
+    basePath: "/api/tracks",
+    auth: true,
+    verifiers: {
+      create: verifier.createVerifier,
+      read: verifier.readVerifier,
+      update: verifier.updateVerifier,
+      delete: verifier.deleteVerifier
+    },
+    abac: abac2,
+    cache: {
+      enabled: true,
+      ttl: 300,
+      tags: ["tracks", "music"]
+    },
+    events: {
+      enabled: true,
+      logReads: false
+    }
+  });
+  tracksCRUD.addAction("get-by-url", {
+    method: "get",
+    path: "/url/:url",
+    auth: false,
+    handler: async (req, res) => {
       try {
-        console.log(`[MusicController] Create request received:`, {
-          userId: req.userId,
-          body: req.body
-        });
-        if (!req.userId) {
-          console.error("[MusicController] No userId found in request, auth middleware may have failed");
-          return res.status(401).json({
-            errorCode: "AUTHENTICATION_REQUIRED",
-            message: "You must be authenticated to perform this action"
-          });
-        }
-        if (!req.body.creator) {
-          req.body.creator = {
-            type: "user",
-            // Note lowercase - must match your schema expectations
-            target: req.userId
-          };
-        }
-        if (!req.body.owner) {
-          req.body.owner = {
-            type: "user",
-            // Note lowercase - must match your schema expectations
-            target: req.userId
-          };
+        const track = await db.track.findOne({ url: req.params.url });
+        if (!track) {
+          return res.status(404).json({ error: "Track not found" });
         }
-        console.log(`[MusicController] Checking access with ABAC`);
-        const accessResult = await this.abac.checkAccess({
+        const accessResult = await abac2.checkAccess({
           user: req.userId,
-          resource: this.model.collection.collectionName,
-          action: "create",
-          data: req.body
+          resource: "tracks",
+          action: "read",
+          currentResource: track
         });
-        console.log(`[MusicController] Access check result:`, accessResult);
-        if (!accessResult.allowed) {
-          console.error(`[MusicController] Access denied:`, accessResult.reason);
+        if (!accessResult.allowed && !track.isPublic) {
           return res.status(403).json({
             errorCode: accessResult.reason,
             message: "Access Denied"
           });
         }
-        console.log(`[MusicController] Creating record with data:`, req.body);
-        const createdData = await this.model.create(req.body);
-        await this.cache.flush();
-        console.log(`[MusicController] Record created successfully:`, createdData._id);
-        res.status(201).json(createdData);
+        res.json(track);
       } catch (error) {
-        console.error(`[MusicController] Error creating record:`, error);
-        this.logger.error(`Error creating ${this.model.collection.collectionName}: ${error.message}`);
+        console.error(error);
         res.status(500).json({ error: error.message });
       }
     }
-    // Override the update method to check ownership
-    async update(req, res) {
+  });
+  tracksCRUD.addAction("recent", {
+    method: "get",
+    path: "/recent",
+    auth: false,
+    handler: async (req, res) => {
       try {
-        const resourceId = req.body._id;
-        const resource = await this.model.findById(resourceId);
-        if (!resource) {
-          return res.status(404).json({ error: "Resource not found" });
-        }
-        const accessResult = await this.abac.checkAccess({
-          user: req.userId,
-          resource: this.model.collection.collectionName,
-          action: "update",
-          data: req.body,
-          currentResource: resource
-        });
-        if (!accessResult.allowed) {
-          return res.status(403).json({
-            errorCode: accessResult.reason,
-            message: "Access Denied"
-          });
-        }
-        const updatedData = await this.model.findOneAndUpdate({ _id: resourceId }, req.body, {
-          new: true,
-          runValidators: true
-        });
-        await this.cache.flush();
-        res.json(updatedData);
+        const limit = parseInt(req.query.limit) || 10;
+        const recentTracks = await db.track.find({
+          status: "published",
+          isPublic: true
+        }).sort({ createdAt: -1 }).limit(limit);
+        res.json(recentTracks);
       } catch (error) {
-        this.logger.error(`Error updating ${this.model.collection.collectionName}: ${error.message}`);
+        console.error(error);
         res.status(500).json({ error: error.message });
       }
     }
-    // Override the delete method to check ownership
-    async delete(req, res) {
+  });
+  tracksCRUD.addAction("popular", {
+    method: "get",
+    path: "/popular",
+    auth: false,
+    handler: async (req, res) => {
       try {
-        const resourceId = req.body._id;
-        const resource = await this.model.findById(resourceId);
-        if (!resource) {
-          return res.status(404).json({ error: "Resource not found" });
-        }
-        const accessResult = await this.abac.checkAccess({
-          user: req.userId,
-          resource: this.model.collection.collectionName,
-          action: "delete",
-          data: req.body,
-          currentResource: resource
-        });
-        if (!accessResult.allowed) {
-          return res.status(403).json({
-            errorCode: accessResult.reason,
-            message: "Access Denied"
-          });
-        }
-        await this.model.findOneAndDelete({ _id: resourceId });
-        await this.cache.flush();
-        res.status(204).send();
+        const limit = parseInt(req.query.limit) || 10;
+        const popularTracks = await db.track.find({
+          status: "published",
+          isPublic: true
+        }).sort({ playCount: -1 }).limit(limit);
+        res.json(popularTracks);
       } catch (error) {
-        this.logger.error(`Error deleting ${this.model.collection.collectionName}: ${error.message}`);
+        console.error(error);
         res.status(500).json({ error: error.message });
       }
     }
-  }
-  return {
-    MusicController: MusicController2
-  };
-};
-const AlbumController = function(app, db) {
-  const { MusicController: MusicController$1 } = MusicController(app, db);
-  class AlbumController2 extends MusicController$1 {
-    constructor(app2) {
-      super("/api/albums", app2, db, db.album);
-    }
-    // Get tracks for a specific album
-    async getAlbumTracks(req, res) {
+  });
+  tracksCRUD.addAction("by-genre", {
+    method: "get",
+    path: "/genre/:genreId",
+    auth: false,
+    handler: async (req, res) => {
       try {
-        const albumId = req.params.albumId;
-        const album = await db.album.findById(albumId);
-        if (!album) {
-          return res.status(404).json({ error: "Album not found" });
-        }
-        const accessResult = await this.abac.checkAccess({
-          user: req.userId,
-          resource: "albums",
-          action: "read",
-          currentResource: album
-        });
-        if (!accessResult.allowed && !album.isPublic) {
-          return res.status(403).json({
-            errorCode: accessResult.reason,
-            message: "Access Denied"
-          });
-        }
-        const tracks = await db.track.find({ album: albumId, status: "published" }).sort({ releaseDate: -1 });
+        const tracks = await db.track.find({
+          genre: req.params.genreId,
+          status: "published",
+          isPublic: true
+        }).sort({ releaseDate: -1 });
         res.json(tracks);
       } catch (error) {
-        this.logger.error(`Error getting album tracks: ${error.message}`);
+        console.error(error);
         res.status(500).json({ error: error.message });
       }
     }
-    // Get featured albums
-    async getFeaturedAlbums(req, res) {
-      try {
-        const cacheKey = "featured-albums";
-        let featuredAlbums = await this.cache.get(cacheKey);
-        if (!featuredAlbums) {
-          featuredAlbums = await db.album.aggregate([
-            { $match: { status: "featured", isPublic: true } },
-            {
-              $lookup: {
-                from: "tracks",
-                localField: "_id",
-                foreignField: "album",
-                as: "tracks"
-              }
-            },
-            {
-              $addFields: {
-                trackCount: { $size: "$tracks" }
-              }
-            },
-            { $project: { tracks: 0 } },
-            { $sort: { releaseDate: -1 } },
-            { $limit: 10 }
-          ]);
-          await this.cache.set(cacheKey, featuredAlbums, 3600);
-        }
-        res.json(featuredAlbums);
-      } catch (error) {
-        this.logger.error(`Error getting featured albums: ${error.message}`);
-        res.status(500).json({ error: error.message });
-      }
+  });
+  return tracksCRUD;
+}
+function artistsVerifierFactory(db) {
+  const createVerifier = new globals_verifier.Verifier({
+    name: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().string().required("Artist name is required").min(1, "Name cannot be empty").max(100, "Name must not exceed 100 characters")
+    },
+    bio: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().max(2e3, "Bio must not exceed 2000 characters")
+    },
+    photoUrl: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^\/(?!\/)/, 'Only relative URLs starting with "/" are allowed')
+    },
+    coverUrl: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^\/(?!\/)/, 'Only relative URLs starting with "/" are allowed')
+    },
+    genre: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().array().items(
+        globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid genre ID format")
+      )
+    },
+    website: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^https?:\/\/.+/, "Invalid website URL format")
+    },
+    location: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().max(100, "Location must not exceed 100 characters")
+    },
+    owner: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().object({
+        type: globals_verifier.Validator.schema().string().oneOf(["user", "organization"]),
+        target: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/)
+      })
     }
-  }
-  const albumController = new AlbumController2(app, db);
+  });
+  const updateVerifier = new globals_verifier.Verifier({
+    _id: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().string().required("Artist ID is required").pattern(/^[0-9a-fA-F]{24}$/, "Invalid artist ID format")
+    },
+    name: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().min(1, "Name cannot be empty").max(100, "Name must not exceed 100 characters")
+    },
+    bio: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().max(2e3, "Bio must not exceed 2000 characters")
+    },
+    photoUrl: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^https?:\/\/.+/, "Invalid photo URL format")
+    },
+    coverUrl: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^https?:\/\/.+/, "Invalid cover URL format")
+    },
+    genre: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().array().items(
+        globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid genre ID format")
+      )
+    },
+    website: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^https?:\/\/.+/, "Invalid website URL format")
+    },
+    location: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().max(100, "Location must not exceed 100 characters")
+    },
+    isVerified: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().boolean()
+    },
+    status: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().oneOf(["draft", "published", "archived"], "Invalid status")
+    }
+  });
+  const readVerifier = new globals_verifier.Verifier({
+    _id: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid artist ID format")
+    },
+    genre: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid genre ID format")
+    },
+    isVerified: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().boolean()
+    },
+    status: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().oneOf(["draft", "published", "archived"])
+    },
+    location: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string()
+    },
+    skip: {
+      rule: "optional",
+      default: 0,
+      validator: globals_verifier.Validator.schema().integer().min(0)
+    },
+    limit: {
+      rule: "optional",
+      default: 20,
+      validator: globals_verifier.Validator.schema().integer().min(1).max(100)
+    },
+    sortParam: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().oneOf(["name", "popularity", "createdAt", "updatedAt"])
+    },
+    sortOrder: {
+      rule: "optional",
+      default: "desc",
+      validator: globals_verifier.Validator.schema().string().oneOf(["asc", "desc"])
+    }
+  });
+  const deleteVerifier = new globals_verifier.Verifier({
+    _id: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().string().required("Artist ID is required").pattern(/^[0-9a-fA-F]{24}$/, "Invalid artist ID format")
+    }
+  });
   return {
-    create: albumController.create.bind(albumController),
-    read: albumController.read.bind(albumController),
-    update: albumController.update.bind(albumController),
-    delete: albumController.delete.bind(albumController),
-    getAlbumTracks: albumController.getAlbumTracks.bind(albumController),
-    getFeaturedAlbums: albumController.getFeaturedAlbums.bind(albumController)
+    createVerifier,
+    readVerifier,
+    updateVerifier,
+    deleteVerifier
   };
-};
-const ArtistController = function(app, db) {
-  const { MusicController: MusicController$1 } = MusicController(app, db);
-  class ArtistController2 extends MusicController$1 {
-    constructor(app2) {
-      super("/api/artists", app2, db, db.artist);
+}
+const { getInstance: getInstance$3 } = abac.ABAC;
+function setupArtistsRoutes(app, db) {
+  const abac2 = getInstance$3(db);
+  const verifier = artistsVerifierFactory();
+  const artistsCRUD = new crud.CRUD({
+    app,
+    db,
+    model: db.artist,
+    modelName: "artist",
+    basePath: "/api/artists",
+    auth: true,
+    verifiers: {
+      create: verifier.createVerifier,
+      read: verifier.readVerifier,
+      update: verifier.updateVerifier,
+      delete: verifier.deleteVerifier
+    },
+    abac: abac2,
+    cache: {
+      enabled: true,
+      ttl: 300,
+      tags: ["artists", "music"]
+    },
+    events: {
+      enabled: true,
+      logReads: false
     }
-    // Get artist discography
-    async getDiscography(req, res) {
+  });
+  artistsCRUD.addAction("get-by-url", {
+    method: "get",
+    path: "/url/:url",
+    auth: false,
+    handler: async (req, res) => {
       try {
-        const artistId = req.params.artistId;
-        const artist = await db.artist.findById(artistId);
+        const artist = await db.artist.findOne({ url: req.params.url });
         if (!artist) {
           return res.status(404).json({ error: "Artist not found" });
         }
-        const albums = await db.album.find({
-          artist: artistId,
-          status: "published",
-          isPublic: true
-        }).sort({ releaseDate: -1 });
-        const singleTracks = await db.track.find({
+        res.json(artist);
+      } catch (error) {
+        console.error(error);
+        res.status(500).json({ error: error.message });
+      }
+    }
+  });
+  artistsCRUD.addAction("discography", {
+    method: "get",
+    path: "/:artistId/discography",
+    auth: false,
+    handler: async (req, res) => {
+      try {
+        const { artistId } = req.params;
+        const albums = await db.album.find({ artists: artistId }).populate("artists", "name").sort({ releaseDate: -1 });
+        const tracks = await db.track.find({
           artist: artistId,
-          album: { $exists: false },
           status: "published",
           isPublic: true
-        }).sort({ releaseDate: -1 });
+        }).populate("album", "title").sort({ releaseDate: -1 });
         res.json({
-          artist,
           albums,
-          singles: singleTracks
+          tracks,
+          artist: artistId
         });
       } catch (error) {
-        this.logger.error(`Error getting artist discography: ${error.message}`);
+        console.error(error);
         res.status(500).json({ error: error.message });
       }
     }
-    // Verify an artist (admin only)
-    async verifyArtist(req, res) {
+  });
+  artistsCRUD.addAction("verify-artist", {
+    method: "put",
+    path: "/:artistId/verify",
+    auth: true,
+    abac: {
+      resource: "artists",
+      action: "verify",
+      strict: true
+    },
+    handler: async (req, res) => {
       try {
-        const artistId = req.params.artistId;
-        if (!req.userRoles.includes("ROLE_ADMIN")) {
-          return res.status(403).json({ error: "Only administrators can verify artists" });
-        }
-        const artist = await db.artist.findById(artistId);
+        const { artistId } = req.params;
+        const artist = await db.artist.findByIdAndUpdate(
+          artistId,
+          { isVerified: true },
+          { new: true }
+        );
         if (!artist) {
           return res.status(404).json({ error: "Artist not found" });
         }
-        artist.isVerified = true;
-        await artist.save();
-        await this.cache.flush();
-        res.json({ success: true, artist });
+        res.json({
+          message: "Artist verified successfully",
+          artist
+        });
       } catch (error) {
-        this.logger.error(`Error verifying artist: ${error.message}`);
+        console.error(error);
         res.status(500).json({ error: error.message });
       }
     }
-    // Get related artists
-    async getRelatedArtists(req, res) {
+  });
+  artistsCRUD.addAction("related-artists", {
+    method: "get",
+    path: "/:artistId/related",
+    auth: false,
+    handler: async (req, res) => {
       try {
-        const artistId = req.params.artistId;
+        const { artistId } = req.params;
+        const limit = parseInt(req.query.limit) || 10;
         const artist = await db.artist.findById(artistId);
         if (!artist) {
           return res.status(404).json({ error: "Artist not found" });
         }
         const relatedArtists = await db.artist.find({
           _id: { $ne: artistId },
+          // исключаем самого артиста
           genre: { $in: artist.genre },
+          // общие жанры
           status: "published"
-        }).limit(5);
+        }).limit(limit).sort({ popularity: -1 });
         res.json(relatedArtists);
       } catch (error) {
-        this.logger.error(`Error getting related artists: ${error.message}`);
+        console.error(error);
         res.status(500).json({ error: error.message });
       }
     }
-  }
-  const artistController = new ArtistController2(app, db);
+  });
+  return artistsCRUD;
+}
+function albumsVerifierFactory(db) {
+  const createVerifier = new globals_verifier.Verifier({
+    title: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().string().required("Album title is required").min(1, "Title cannot be empty").max(200, "Title must not exceed 200 characters")
+    },
+    description: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().max(1e3, "Description must not exceed 1000 characters")
+    },
+    releaseDate: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().date().required("Release date is required")
+    },
+    coverArt: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^https?:\/\/.+/, "Invalid cover art URL format")
+    },
+    artists: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().array().items(
+        globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid artist ID format")
+      ).min(1, "At least one artist is required")
+    },
+    type: {
+      rule: "optional",
+      default: "album",
+      validator: globals_verifier.Validator.schema().string().oneOf(["album", "single", "EP", "compilation"], "Invalid album type")
+    },
+    genres: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().array().items(
+        globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid genre ID format")
+      )
+    },
+    totalTracks: {
+      rule: "optional",
+      default: 0,
+      validator: globals_verifier.Validator.schema().integer().min(0, "Total tracks cannot be negative").max(100, "Too many tracks")
+    },
+    owner: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().object({
+        type: globals_verifier.Validator.schema().string().oneOf(["user", "organization"]),
+        target: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/)
+      })
+    }
+  });
+  const updateVerifier = new globals_verifier.Verifier({
+    _id: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().string().required("Album ID is required").pattern(/^[0-9a-fA-F]{24}$/, "Invalid album ID format")
+    },
+    title: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().min(1, "Title cannot be empty").max(200, "Title must not exceed 200 characters")
+    },
+    description: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().max(1e3, "Description must not exceed 1000 characters")
+    },
+    releaseDate: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().date()
+    },
+    coverArt: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^https?:\/\/.+/, "Invalid cover art URL format")
+    },
+    artists: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().array().items(
+        globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid artist ID format")
+      ).min(1, "At least one artist is required")
+    },
+    type: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().oneOf(["album", "single", "EP", "compilation"], "Invalid album type")
+    },
+    genres: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().array().items(
+        globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid genre ID format")
+      )
+    },
+    totalTracks: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().integer().min(0, "Total tracks cannot be negative").max(100, "Too many tracks")
+    },
+    status: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().oneOf(["draft", "published", "archived"], "Invalid status")
+    }
+  });
+  const readVerifier = new globals_verifier.Verifier({
+    _id: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid album ID format")
+    },
+    artists: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid artist ID format")
+    },
+    type: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().oneOf(["album", "single", "EP", "compilation"])
+    },
+    genres: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid genre ID format")
+    },
+    status: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().oneOf(["draft", "published", "archived"])
+    },
+    skip: {
+      rule: "optional",
+      default: 0,
+      validator: globals_verifier.Validator.schema().integer().min(0)
+    },
+    limit: {
+      rule: "optional",
+      default: 20,
+      validator: globals_verifier.Validator.schema().integer().min(1).max(100)
+    },
+    sortParam: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().oneOf(["title", "releaseDate", "totalTracks", "createdAt", "updatedAt"])
+    },
+    sortOrder: {
+      rule: "optional",
+      default: "desc",
+      validator: globals_verifier.Validator.schema().string().oneOf(["asc", "desc"])
+    }
+  });
+  const deleteVerifier = new globals_verifier.Verifier({
+    _id: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().string().required("Album ID is required").pattern(/^[0-9a-fA-F]{24}$/, "Invalid album ID format")
+    }
+  });
   return {
-    create: artistController.create.bind(artistController),
-    read: artistController.read.bind(artistController),
-    update: artistController.update.bind(artistController),
-    delete: artistController.delete.bind(artistController),
-    getDiscography: artistController.getDiscography.bind(artistController),
-    verifyArtist: artistController.verifyArtist.bind(artistController),
-    getRelatedArtists: artistController.getRelatedArtists.bind(artistController)
+    createVerifier,
+    readVerifier,
+    updateVerifier,
+    deleteVerifier
   };
-};
-const GenreController = function(app, db) {
-  const { MusicController: MusicController$1 } = MusicController(app, db);
-  class GenreController2 extends MusicController$1 {
-    constructor(app2) {
-      super("/api/genres", app2, db, db.genre);
+}
+const { getInstance: getInstance$2 } = abac.ABAC;
+function setupAlbumsRoutes(app, db) {
+  const abac2 = getInstance$2(db);
+  const verifier = albumsVerifierFactory();
+  const albumsCRUD = new crud.CRUD({
+    app,
+    db,
+    model: db.album,
+    modelName: "album",
+    basePath: "/api/albums",
+    auth: true,
+    verifiers: {
+      create: verifier.createVerifier,
+      read: verifier.readVerifier,
+      update: verifier.updateVerifier,
+      delete: verifier.deleteVerifier
+    },
+    abac: abac2,
+    cache: {
+      enabled: true,
+      ttl: 300,
+      tags: ["albums", "music"]
+    },
+    events: {
+      enabled: true,
+      logReads: false
     }
-    // Get tracks by genre
-    async getGenreTracks(req, res) {
+  });
+  albumsCRUD.addAction("get-by-url", {
+    method: "get",
+    path: "/url/:url",
+    auth: false,
+    handler: async (req, res) => {
       try {
-        const genreId = req.params.genreId;
-        const genre = await db.genre.findById(genreId);
-        if (!genre) {
-          return res.status(404).json({ error: "Genre not found" });
+        const album = await db.album.findOne({ url: req.params.url }).populate("artists", "name url");
+        if (!album) {
+          return res.status(404).json({ error: "Album not found" });
         }
+        res.json(album);
+      } catch (error) {
+        console.error(error);
+        res.status(500).json({ error: error.message });
+      }
+    }
+  });
+  albumsCRUD.addAction("album-tracks", {
+    method: "get",
+    path: "/:albumId/tracks",
+    auth: false,
+    handler: async (req, res) => {
+      try {
+        const { albumId } = req.params;
         const tracks = await db.track.find({
-          genre: genreId,
+          album: albumId,
           status: "published",
           isPublic: true
-        }).sort({ releaseDate: -1 }).limit(50).populate("artist", "name").populate("album", "title coverUrl");
-        res.json({
-          genre,
-          tracks
-        });
+        }).populate("artist", "name url").populate("genre", "name").sort({ trackNumber: 1, createdAt: 1 });
+        res.json(tracks);
       } catch (error) {
-        this.logger.error(`Error getting genre tracks: ${error.message}`);
+        console.error(error);
         res.status(500).json({ error: error.message });
       }
     }
-    // Get popular genres
-    async getPopularGenres(req, res) {
+  });
+  albumsCRUD.addAction("featured", {
+    method: "get",
+    path: "/featured",
+    auth: false,
+    handler: async (req, res) => {
       try {
         const limit = parseInt(req.query.limit) || 10;
-        const genres = await db.genre.find({
-          status: "published"
-        }).sort({ popularity: -1 }).limit(limit);
-        res.json(genres);
+        const featuredAlbums = await db.album.find({
+          status: "published",
+          releaseDate: {
+            $gte: new Date(Date.now() - 90 * 24 * 60 * 60 * 1e3)
+            // последние 90 дней
+          }
+        }).populate("artists", "name url").sort({ createdAt: -1 }).limit(limit);
+        res.json(featuredAlbums);
       } catch (error) {
-        this.logger.error(`Error getting popular genres: ${error.message}`);
+        console.error(error);
         res.status(500).json({ error: error.message });
       }
     }
-  }
-  const genreController = new GenreController2(app, db);
+  });
+  return albumsCRUD;
+}
+function playlistsVerifierFactory(db) {
+  const createVerifier = new globals_verifier.Verifier({
+    title: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().string().required("Playlist title is required").min(1, "Title cannot be empty").max(200, "Title must not exceed 200 characters")
+    },
+    description: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().max(1e3, "Description must not exceed 1000 characters")
+    },
+    coverUrl: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^https?:\/\/.+/, "Invalid cover URL format")
+    },
+    tracks: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().array().items(
+        globals_verifier.Validator.schema().object({
+          track: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid track ID format").required(),
+          addedAt: globals_verifier.Validator.schema().date()
+        })
+      )
+    },
+    isPublic: {
+      rule: "optional",
+      default: true,
+      validator: globals_verifier.Validator.schema().boolean()
+    },
+    isCollaborative: {
+      rule: "optional",
+      default: false,
+      validator: globals_verifier.Validator.schema().boolean()
+    },
+    collaborators: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().array().items(
+        globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid collaborator ID format")
+      )
+    },
+    owner: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().object({
+        type: globals_verifier.Validator.schema().string().oneOf(["user", "organization"]),
+        target: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/)
+      })
+    }
+  });
+  const updateVerifier = new globals_verifier.Verifier({
+    _id: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().string().required("Playlist ID is required").pattern(/^[0-9a-fA-F]{24}$/, "Invalid playlist ID format")
+    },
+    title: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().min(1, "Title cannot be empty").max(200, "Title must not exceed 200 characters")
+    },
+    description: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().max(1e3, "Description must not exceed 1000 characters")
+    },
+    coverUrl: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^https?:\/\/.+/, "Invalid cover URL format")
+    },
+    tracks: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().array().items(
+        globals_verifier.Validator.schema().object({
+          track: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid track ID format").required(),
+          addedAt: globals_verifier.Validator.schema().date()
+        })
+      )
+    },
+    isPublic: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().boolean()
+    },
+    isCollaborative: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().boolean()
+    },
+    collaborators: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().array().items(
+        globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid collaborator ID format")
+      )
+    },
+    status: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().oneOf(["draft", "published", "archived"], "Invalid status")
+    }
+  });
+  const readVerifier = new globals_verifier.Verifier({
+    _id: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid playlist ID format")
+    },
+    owner: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid owner ID format")
+    },
+    isPublic: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().boolean()
+    },
+    isCollaborative: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().boolean()
+    },
+    status: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().oneOf(["draft", "published", "archived"])
+    },
+    skip: {
+      rule: "optional",
+      default: 0,
+      validator: globals_verifier.Validator.schema().integer().min(0)
+    },
+    limit: {
+      rule: "optional",
+      default: 20,
+      validator: globals_verifier.Validator.schema().integer().min(1).max(100)
+    },
+    sortParam: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().oneOf(["title", "followers", "createdAt", "updatedAt"])
+    },
+    sortOrder: {
+      rule: "optional",
+      default: "desc",
+      validator: globals_verifier.Validator.schema().string().oneOf(["asc", "desc"])
+    }
+  });
+  const deleteVerifier = new globals_verifier.Verifier({
+    _id: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().string().required("Playlist ID is required").pattern(/^[0-9a-fA-F]{24}$/, "Invalid playlist ID format")
+    }
+  });
   return {
-    create: genreController.create.bind(genreController),
-    read: genreController.read.bind(genreController),
-    update: genreController.update.bind(genreController),
-    delete: genreController.delete.bind(genreController),
-    getGenreTracks: genreController.getGenreTracks.bind(genreController),
-    getPopularGenres: genreController.getPopularGenres.bind(genreController)
+    createVerifier,
+    readVerifier,
+    updateVerifier,
+    deleteVerifier
   };
-};
-const PlaylistController = function(app, db) {
-  const { MusicController: MusicController$1 } = MusicController(app, db);
-  class PlaylistController2 extends MusicController$1 {
-    constructor(app2, db2) {
-      super("/api/playlists", app2, db2, db2.playlist);
+}
+const { getInstance: getInstance$1 } = abac.ABAC;
+function setupPlaylistsRoutes(app, db) {
+  const abac2 = getInstance$1(db);
+  const verifier = playlistsVerifierFactory();
+  const playlistsCRUD = new crud.CRUD({
+    app,
+    db,
+    model: db.playlist,
+    modelName: "playlist",
+    basePath: "/api/playlists",
+    auth: true,
+    verifiers: {
+      create: verifier.createVerifier,
+      read: verifier.readVerifier,
+      update: verifier.updateVerifier,
+      delete: verifier.deleteVerifier
+    },
+    abac: abac2,
+    cache: {
+      enabled: true,
+      ttl: 300,
+      tags: ["playlists", "music"]
+    },
+    events: {
+      enabled: true,
+      logReads: false
     }
-    // Add track to playlist
-    async addTrack(req, res) {
+  });
+  playlistsCRUD.addAction("get-by-url", {
+    method: "get",
+    path: "/url/:url",
+    auth: false,
+    handler: async (req, res) => {
       try {
-        const { playlistId, trackId } = req.params;
-        const playlist = await db.playlist.findById(playlistId);
+        const playlist = await db.playlist.findOne({ url: req.params.url }).populate({
+          path: "tracks.track",
+          select: "-lyrics"
+        });
         if (!playlist) {
           return res.status(404).json({ error: "Playlist not found" });
         }
-        const accessResult = await this.abac.checkAccess({
-          user: req.userId,
-          resource: "playlists",
-          action: "update",
-          currentResource: playlist
-        });
-        if (!accessResult.allowed) {
-          return res.status(403).json({
-            errorCode: accessResult.reason,
-            message: "Access Denied"
-          });
+        if (!playlist.isPublic) {
+          if (!req.userId) {
+            return res.status(403).json({ error: "Access denied to private playlist" });
+          }
+          const isOwner = playlist.owner.target.toString() === req.userId;
+          const isCollaborator = playlist.collaborators.some((collab) => collab.toString() === req.userId);
+          if (!isOwner && !isCollaborator) {
+            return res.status(403).json({ error: "Access denied to private playlist" });
+          }
+        }
+        res.json(playlist);
+      } catch (error) {
+        console.error(error);
+        res.status(500).json({ error: error.message });
+      }
+    }
+  });
+  playlistsCRUD.addAction("user-playlists", {
+    method: "get",
+    path: "/user/:userId?",
+    auth: true,
+    handler: async (req, res) => {
+      try {
+        const userId = req.params.userId || req.userId;
+        const query = { "owner.target": userId };
+        if (userId !== req.userId) {
+          query.isPublic = true;
         }
+        const playlists = await db.playlist.find(query).populate("tracks.track", "title artist").sort({ updatedAt: -1 });
+        res.json(playlists);
+      } catch (error) {
+        console.error(error);
+        res.status(500).json({ error: error.message });
+      }
+    }
+  });
+  playlistsCRUD.addAction("add-track", {
+    method: "post",
+    path: "/:playlistId/tracks/:trackId",
+    auth: true,
+    abac: {
+      resource: "playlists",
+      action: "update"
+    },
+    handler: async (req, res) => {
+      try {
+        const { playlistId, trackId } = req.params;
         const track = await db.track.findById(trackId);
         if (!track) {
           return res.status(404).json({ error: "Track not found" });
         }
-        const trackExists = playlist.tracks.some((item) => item.track.toString() === trackId);
+        const playlist = await db.playlist.findById(playlistId);
+        if (!playlist) {
+          return res.status(404).json({ error: "Playlist not found" });
+        }
+        const trackExists = playlist.tracks.some((t) => t.track.toString() === trackId);
         if (trackExists) {
           return res.status(400).json({ error: "Track already in playlist" });
         }
@@ -398,96 +1050,253 @@ const PlaylistController = function(app, db) {
           addedAt: /* @__PURE__ */ new Date()
         });
         await playlist.save();
-        await this.cache.flush();
-        res.json(playlist);
+        res.json({
+          message: "Track added to playlist successfully",
+          playlist
+        });
       } catch (error) {
-        this.logger.error(`Error adding track to playlist: ${error.message}`);
+        console.error(error);
         res.status(500).json({ error: error.message });
       }
     }
-    // Remove track from playlist
-    async removeTrack(req, res) {
+  });
+  playlistsCRUD.addAction("remove-track", {
+    method: "delete",
+    path: "/:playlistId/tracks/:trackId",
+    auth: true,
+    abac: {
+      resource: "playlists",
+      action: "update"
+    },
+    handler: async (req, res) => {
       try {
         const { playlistId, trackId } = req.params;
         const playlist = await db.playlist.findById(playlistId);
         if (!playlist) {
           return res.status(404).json({ error: "Playlist not found" });
         }
-        const accessResult = await this.abac.checkAccess({
-          user: req.userId,
-          resource: "playlists",
-          action: "update",
-          currentResource: playlist
-        });
-        if (!accessResult.allowed) {
-          return res.status(403).json({
-            errorCode: accessResult.reason,
-            message: "Access Denied"
-          });
-        }
-        playlist.tracks = playlist.tracks.filter((item) => item.track.toString() !== trackId);
+        playlist.tracks = playlist.tracks.filter(
+          (t) => t.track.toString() !== trackId
+        );
         await playlist.save();
-        await this.cache.flush();
-        res.json(playlist);
-      } catch (error) {
-        this.logger.error(`Error removing track from playlist: ${error.message}`);
-        res.status(500).json({ error: error.message });
-      }
-    }
-    // Get user playlists
-    async getUserPlaylists(req, res) {
-      try {
-        const userId = req.params.userId || req.userId;
-        const playlists = await db.playlist.find({
-          $or: [{ "owner.target": userId, "owner.type": "User" }, { collaborators: userId }]
-        }).sort({ updatedAt: -1 });
-        res.json(playlists);
+        res.json({
+          message: "Track removed from playlist successfully",
+          playlist
+        });
       } catch (error) {
-        this.logger.error(`Error getting user playlists: ${error.message}`);
+        console.error(error);
         res.status(500).json({ error: error.message });
       }
     }
-    // Add collaborator to playlist
-    async addCollaborator(req, res) {
+  });
+  playlistsCRUD.addAction("add-collaborator", {
+    method: "post",
+    path: "/:playlistId/collaborators/:userId",
+    auth: true,
+    abac: {
+      resource: "playlists",
+      action: "update"
+    },
+    handler: async (req, res) => {
       try {
         const { playlistId, userId } = req.params;
         const playlist = await db.playlist.findById(playlistId);
         if (!playlist) {
           return res.status(404).json({ error: "Playlist not found" });
         }
-        if (playlist.owner.target.toString() !== req.userId) {
-          return res.status(403).json({ error: "Only playlist owner can add collaborators" });
-        }
-        const user = await db.mongoose.model("User").findById(userId);
-        if (!user) {
-          return res.status(404).json({ error: "User not found" });
-        }
         if (playlist.collaborators.includes(userId)) {
           return res.status(400).json({ error: "User is already a collaborator" });
         }
         playlist.collaborators.push(userId);
         playlist.isCollaborative = true;
         await playlist.save();
-        await this.cache.flush();
-        res.json(playlist);
+        res.json({
+          message: "Collaborator added successfully",
+          playlist
+        });
       } catch (error) {
-        this.logger.error(`Error adding collaborator to playlist: ${error.message}`);
+        console.error(error);
         res.status(500).json({ error: error.message });
       }
     }
-  }
-  const playlistController = new PlaylistController2(app, db);
+  });
+  return playlistsCRUD;
+}
+function genresVerifierFactory(db) {
+  const createVerifier = new globals_verifier.Verifier({
+    name: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().string().required("Genre name is required").min(1, "Name cannot be empty").max(50, "Name must not exceed 50 characters")
+    },
+    description: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().max(500, "Description must not exceed 500 characters")
+    },
+    iconUrl: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^https?:\/\/.+/, "Invalid icon URL format")
+    },
+    popularity: {
+      rule: "optional",
+      default: 0,
+      validator: globals_verifier.Validator.schema().number().min(0, "Popularity cannot be negative").max(100, "Popularity cannot exceed 100")
+    }
+  });
+  const updateVerifier = new globals_verifier.Verifier({
+    _id: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().string().required("Genre ID is required").pattern(/^[0-9a-fA-F]{24}$/, "Invalid genre ID format")
+    },
+    name: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().min(1, "Name cannot be empty").max(50, "Name must not exceed 50 characters")
+    },
+    description: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().max(500, "Description must not exceed 500 characters")
+    },
+    iconUrl: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^https?:\/\/.+/, "Invalid icon URL format")
+    },
+    popularity: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().number().min(0, "Popularity cannot be negative").max(100, "Popularity cannot exceed 100")
+    },
+    status: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().oneOf(["draft", "published", "archived"], "Invalid status")
+    }
+  });
+  const readVerifier = new globals_verifier.Verifier({
+    _id: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().pattern(/^[0-9a-fA-F]{24}$/, "Invalid genre ID format")
+    },
+    name: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string()
+    },
+    status: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().oneOf(["draft", "published", "archived"])
+    },
+    skip: {
+      rule: "optional",
+      default: 0,
+      validator: globals_verifier.Validator.schema().integer().min(0)
+    },
+    limit: {
+      rule: "optional",
+      default: 20,
+      validator: globals_verifier.Validator.schema().integer().min(1).max(100)
+    },
+    sortParam: {
+      rule: "optional",
+      validator: globals_verifier.Validator.schema().string().oneOf(["name", "popularity", "createdAt", "updatedAt"])
+    },
+    sortOrder: {
+      rule: "optional",
+      default: "desc",
+      validator: globals_verifier.Validator.schema().string().oneOf(["asc", "desc"])
+    }
+  });
+  const deleteVerifier = new globals_verifier.Verifier({
+    _id: {
+      rule: "required",
+      validator: globals_verifier.Validator.schema().string().required("Genre ID is required").pattern(/^[0-9a-fA-F]{24}$/, "Invalid genre ID format")
+    }
+  });
   return {
-    create: playlistController.create.bind(playlistController),
-    read: playlistController.read.bind(playlistController),
-    update: playlistController.update.bind(playlistController),
-    delete: playlistController.delete.bind(playlistController),
-    addTrack: playlistController.addTrack.bind(playlistController),
-    removeTrack: playlistController.removeTrack.bind(playlistController),
-    getUserPlaylists: playlistController.getUserPlaylists.bind(playlistController),
-    addCollaborator: playlistController.addCollaborator.bind(playlistController)
+    createVerifier,
+    readVerifier,
+    updateVerifier,
+    deleteVerifier
   };
-};
+}
+const { getInstance } = abac.ABAC;
+function setupGenresRoutes(app, db) {
+  const abac2 = getInstance(db);
+  const verifier = genresVerifierFactory();
+  const genresCRUD = new crud.CRUD({
+    app,
+    db,
+    model: db.genre,
+    modelName: "genre",
+    basePath: "/api/genres",
+    auth: true,
+    verifiers: {
+      create: verifier.createVerifier,
+      read: verifier.readVerifier,
+      update: verifier.updateVerifier,
+      delete: verifier.deleteVerifier
+    },
+    abac: abac2,
+    cache: {
+      enabled: true,
+      ttl: 300,
+      tags: ["genres", "music"]
+    },
+    events: {
+      enabled: true,
+      logReads: false
+    }
+  });
+  genresCRUD.addAction("get-by-url", {
+    method: "get",
+    path: "/url/:url",
+    auth: false,
+    handler: async (req, res) => {
+      try {
+        const genre = await db.genre.findOne({ url: req.params.url });
+        if (!genre) {
+          return res.status(404).json({ error: "Genre not found" });
+        }
+        res.json(genre);
+      } catch (error) {
+        console.error(error);
+        res.status(500).json({ error: error.message });
+      }
+    }
+  });
+  genresCRUD.addAction("genre-tracks", {
+    method: "get",
+    path: "/:genreId/tracks",
+    auth: false,
+    handler: async (req, res) => {
+      try {
+        const { genreId } = req.params;
+        const limit = parseInt(req.query.limit) || 50;
+        const skip = parseInt(req.query.skip) || 0;
+        const tracks = await db.track.find({
+          genre: genreId,
+          status: "published",
+          isPublic: true
+        }).populate("artist", "name url").populate("album", "title url").sort({ playCount: -1, releaseDate: -1 }).skip(skip).limit(limit);
+        res.json(tracks);
+      } catch (error) {
+        console.error(error);
+        res.status(500).json({ error: error.message });
+      }
+    }
+  });
+  genresCRUD.addAction("popular", {
+    method: "get",
+    path: "/popular",
+    auth: false,
+    handler: async (req, res) => {
+      try {
+        const limit = parseInt(req.query.limit) || 20;
+        const popularGenres = await db.genre.find({ status: "published" }).sort({ popularity: -1 }).limit(limit);
+        res.json(popularGenres);
+      } catch (error) {
+        console.error(error);
+        res.status(500).json({ error: error.message });
+      }
+    }
+  });
+  return genresCRUD;
+}
 const SearchController = function(app, db) {
   const logger = new globals_logger.Logger(db);
   const cache = new globals_logger.Cache();
@@ -551,7 +1360,7 @@ const SearchController = function(app, db) {
 const StreamController = function(app, db, publicPath) {
   const { getInstance: getInstance2 } = globals_abac.globalsabac;
   const logger = new globals_logger.Logger(db);
-  const abac = getInstance2(db);
+  const abac2 = getInstance2(db);
   async function streamAudio(req, res) {
     try {
       const trackId = req.params.trackId;
@@ -559,7 +1368,7 @@ const StreamController = function(app, db, publicPath) {
       if (!track) {
         return res.status(404).json({ error: "Track not found" });
       }
-      const accessResult = await abac.checkAccess({
+      const accessResult = await abac2.checkAccess({
         user: req.userId,
         resource: "tracks",
         action: "read",
@@ -1014,199 +1823,6 @@ const musicPolicies = function initializeMusicPolicies(abacAccessControl) {
   });
   return abacAccessControl;
 };
-const albumRoutes = function(app, db, origins, publicPath) {
-  const controller = AlbumController(app, db);
-  const { authJwt } = index.middlewareIndexFactory(db);
-  app.post("/api/albums/create", [authJwt.verifyToken], controller.create);
-  app.get("/api/albums/read", controller.read);
-  app.put("/api/albums/update", [authJwt.verifyToken], controller.update);
-  app.delete("/api/albums/delete", [authJwt.verifyToken], controller.delete);
-  app.get("/api/albums/:albumId/tracks", controller.getAlbumTracks);
-  app.get("/api/albums/featured", controller.getFeaturedAlbums);
-  app.get("/api/albums/url/:url", async (req, res) => {
-    try {
-      const album = await db.album.findOne({ url: req.params.url }).populate("artist");
-      if (!album) {
-        return res.status(404).json({ error: "Album not found" });
-      }
-      res.json(album);
-    } catch (error) {
-      console.error(error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-};
-const artistRoutes = function(app, db, origins, publicPath) {
-  const controller = ArtistController(app, db);
-  const { authJwt } = index.middlewareIndexFactory(db);
-  app.post("/api/artists/create", [authJwt.verifyToken], controller.create);
-  app.get("/api/artists/read", controller.read);
-  app.put("/api/artists/update", [authJwt.verifyToken], controller.update);
-  app.delete("/api/artists/delete", [authJwt.verifyToken], controller.delete);
-  app.get("/api/artists/:artistId/discography", controller.getDiscography);
-  app.put("/api/artists/:artistId/verify", [authJwt.verifyToken, authJwt.isAdmin], controller.verifyArtist);
-  app.get("/api/artists/:artistId/related", controller.getRelatedArtists);
-  app.get("/api/artists/url/:url", async (req, res) => {
-    try {
-      const artist = await db.artist.findOne({ url: req.params.url });
-      if (!artist) {
-        return res.status(404).json({ error: "Artist not found" });
-      }
-      res.json(artist);
-    } catch (error) {
-      console.error(error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-};
-const genreRoutes = function(app, db, origins, publicPath) {
-  const controller = GenreController(app, db);
-  const { authJwt } = index.middlewareIndexFactory(db);
-  app.post("/api/genres/create", [authJwt.verifyToken, authJwt.isAdmin], controller.create);
-  app.get("/api/genres/read", controller.read);
-  app.put("/api/genres/update", [authJwt.verifyToken, authJwt.isAdmin], controller.update);
-  app.delete("/api/genres/delete", [authJwt.verifyToken, authJwt.isAdmin], controller.delete);
-  app.get("/api/genres/:genreId/tracks", controller.getGenreTracks);
-  app.get("/api/genres/popular", controller.getPopularGenres);
-  app.get("/api/genres/url/:url", async (req, res) => {
-    try {
-      const genre = await db.genre.findOne({ url: req.params.url });
-      if (!genre) {
-        return res.status(404).json({ error: "Genre not found" });
-      }
-      res.json(genre);
-    } catch (error) {
-      console.error(error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-};
-const { getInstance } = globals_abac.globalsabac;
-const musicRoutes = function(app, db, origins, publicPath) {
-  const { MusicController: MusicController$1 } = MusicController(app, db);
-  const { authJwt } = index.middlewareIndexFactory(db);
-  const controller = new MusicController$1("/api/tracks", app, db, db.track, {
-    disableDefaultRoutes: true
-  });
-  const abac = getInstance(db);
-  app.post(
-    "/api/tracks/create",
-    [
-      authJwt.verifyToken(),
-      // Auth middleware
-      (req, res, next) => {
-        console.log("[Route] /api/tracks/create - Request received");
-        console.log("[Route] User ID from token:", req.userId);
-        next();
-      }
-    ],
-    controller.create.bind(controller)
-    // Bind to ensure 'this' context
-  );
-  app.get("/api/tracks/read", controller.read.bind(controller));
-  app.put("/api/tracks/update", [authJwt.verifyToken], controller.update.bind(controller));
-  app.delete("/api/tracks/delete", [authJwt.verifyToken], controller.delete.bind(controller));
-  app.get("/api/tracks/url/:url", async (req, res) => {
-    try {
-      const track = await db.track.findOne({ url: req.params.url });
-      if (!track) {
-        return res.status(404).json({ error: "Track not found" });
-      }
-      const accessResult = await abac.checkAccess({
-        user: req.userId,
-        resource: "tracks",
-        action: "read",
-        currentResource: track
-      });
-      if (!accessResult.allowed && !track.isPublic) {
-        return res.status(403).json({
-          errorCode: accessResult.reason,
-          message: "Access Denied"
-        });
-      }
-      res.json(track);
-    } catch (error) {
-      console.error(error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-  app.get("/api/tracks/recent", async (req, res) => {
-    try {
-      const limit = parseInt(req.query.limit) || 10;
-      const recentTracks = await db.track.find({
-        status: "published",
-        isPublic: true
-      }).sort({ createdAt: -1 }).limit(limit);
-      res.json(recentTracks);
-    } catch (error) {
-      console.error(error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-  app.get("/api/tracks/popular", async (req, res) => {
-    try {
-      const limit = parseInt(req.query.limit) || 10;
-      const popularTracks = await db.track.find({
-        status: "published",
-        isPublic: true
-      }).sort({ playCount: -1 }).limit(limit);
-      res.json(popularTracks);
-    } catch (error) {
-      console.error(error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-  app.get("/api/tracks/genre/:genreId", async (req, res) => {
-    try {
-      const tracks = await db.track.find({
-        genre: req.params.genreId,
-        status: "published",
-        isPublic: true
-      }).sort({ releaseDate: -1 });
-      res.json(tracks);
-    } catch (error) {
-      console.error(error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-};
-const playlistRoutes = function(app, db, origins, publicPath) {
-  const controller = PlaylistController(app, db);
-  const { authJwt } = index.middlewareIndexFactory(db);
-  app.post("/api/playlists/create", [authJwt.verifyToken], controller.create);
-  app.get("/api/playlists/read", controller.read);
-  app.put("/api/playlists/update", [authJwt.verifyToken], controller.update);
-  app.delete("/api/playlists/delete", [authJwt.verifyToken], controller.delete);
-  app.get("/api/playlists/user/:userId?", [authJwt.verifyToken], controller.getUserPlaylists);
-  app.post("/api/playlists/:playlistId/tracks/:trackId", [authJwt.verifyToken], controller.addTrack);
-  app.delete("/api/playlists/:playlistId/tracks/:trackId", [authJwt.verifyToken], controller.removeTrack);
-  app.post("/api/playlists/:playlistId/collaborators/:userId", [authJwt.verifyToken], controller.addCollaborator);
-  app.get("/api/playlists/url/:url", async (req, res) => {
-    try {
-      const playlist = await db.playlist.findOne({ url: req.params.url }).populate({
-        path: "tracks.track",
-        select: "-lyrics"
-      });
-      if (!playlist) {
-        return res.status(404).json({ error: "Playlist not found" });
-      }
-      if (!playlist.isPublic) {
-        if (!req.userId) {
-          return res.status(403).json({ error: "Access denied to private playlist" });
-        }
-        const isOwner = playlist.owner.target.toString() === req.userId;
-        const isCollaborator = playlist.collaborators.some((collab) => collab.toString() === req.userId);
-        if (!isOwner && !isCollaborator) {
-          return res.status(403).json({ error: "Access denied to private playlist" });
-        }
-      }
-      res.json(playlist);
-    } catch (error) {
-      console.error(error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-};
 const searchRoutes = function(app, db, origins, publicPath) {
   const controller = SearchController(app, db);
   app.get("/api/music/search", controller.search);
@@ -1349,17 +1965,17 @@ function initializeMusic({ app, db, wss, origins, publicPath }) {
   db.playHistory = PlayHistoryModel(db);
   console.log("server publioc is", publicPath);
   if (app) {
-    musicRoutes(app, db);
-    playlistRoutes(app, db);
-    albumRoutes(app, db);
-    artistRoutes(app, db);
+    setupTracksRoutes(app, db);
+    setupArtistsRoutes(app, db);
+    setupAlbumsRoutes(app, db);
+    setupPlaylistsRoutes(app, db);
+    setupGenresRoutes(app, db);
     streamRoutes(app, db, origins, publicPath);
     searchRoutes(app, db);
-    genreRoutes(app, db);
   }
   const { getInstance: getInstance2 } = globals_abac.globalsabac;
-  const abac = getInstance2(db);
-  musicPolicies(abac);
+  const abac2 = getInstance2(db);
+  musicPolicies(abac2);
   const { WebSocketManager } = globals_websocket.WebSocketManager;
   if (global.webSocketManager && global.webSocketManager instanceof WebSocketManager) {
     global.webSocketManager.registerModule("music-streaming", StreamingHandler(db).handleStreamingMessage);
@@ -1377,22 +1993,20 @@ const models = {
   PlayHistoryModel
 };
 const routes = {
-  musicRoutes,
-  playlistRoutes,
-  albumRoutes,
-  artistRoutes,
+  // NEW CRUD Routes
+  setupTracksRoutes,
+  setupArtistsRoutes,
+  setupAlbumsRoutes,
+  setupPlaylistsRoutes,
+  setupGenresRoutes,
+  // Legacy routes
   streamRoutes,
-  searchRoutes,
-  genreRoutes
+  searchRoutes
 };
 const controllers = {
-  MusicController,
-  PlaylistController,
-  AlbumController,
-  ArtistController,
+  // Keep only non-CRUD controllers
   StreamController,
-  SearchController,
-  GenreController
+  SearchController
 };
 const music_server = {
   initialize: initializeMusic,