@pramen/server 0.0.1 → 0.0.2

package/src/worker.ts

@@ -171,9 +171,9 @@ export function makeWorker(app: PramenApp) {
 
     // --- admin: list known tenants ---
     if (url.pathname === "/tenants") {
-      if (!isAdmin(identity)) return forbidden("tenants");
+      if (!isAdmin(identity)) return withCors(forbidden("tenants"), cors);
       const list = await env.KV.list({ prefix: "tenant:" });
-      return json({ ok: true, result: list.keys.map((k) => k.name.slice("tenant:".length)) });
+      return withCors(json({ ok: true, result: list.keys.map((k) => k.name.slice("tenant:".length)) }), cors);
     }
 
     // --- admin: point-in-time recovery for a tenant ---
@@ -193,10 +193,29 @@ export function makeWorker(app: PramenApp) {
 
     // --- admin: a tenant's applied schema (hash + tables) ---
     if (url.pathname === "/admin/schema") {
-      if (!isAdmin(identity)) return forbidden("schema");
+      if (!isAdmin(identity)) return withCors(forbidden("schema"), cors);
       const tenant = url.searchParams.get("tenant") ?? "main";
       const stub = env.PRAMEN.get(env.PRAMEN.idFromName(tenant));
-      return stub.fetch(new Request("https://do/__schema", { headers: { "x-pramen-tenant": tenant } }));
+      const res = await stub.fetch(new Request("https://do/__schema", { headers: { "x-pramen-tenant": tenant } }));
+      return withCors(res, cors);
+    }
+
+    // --- admin: generic data ops over a tenant's tables (browse/edit any row).
+    // Body: { tenant, table, op: list|get|create|update|delete|count, ... }. Runs
+    // in the DO under SYSTEM scope (ACL bypassed) — gated to admins here. ---
+    if (url.pathname === "/admin/data" && request.method === "POST") {
+      if (!isAdmin(identity)) return forbidden("data");
+      const body = (await request.json().catch(() => ({}))) as { tenant?: unknown };
+      const tenant = typeof body.tenant === "string" && body.tenant ? body.tenant : "main";
+      const stub = env.PRAMEN.get(env.PRAMEN.idFromName(tenant));
+      const res = await stub.fetch(
+        new Request("https://do/__admin/data", {
+          method: "POST",
+          headers: { "content-type": "application/json", "x-pramen-tenant": tenant },
+          body: JSON.stringify(body),
+        }),
+      );
+      return withCors(res, cors);
     }
 
     const isRpc = url.pathname.startsWith("/rpc/");
@@ -206,7 +225,8 @@ export function makeWorker(app: PramenApp) {
       return new Response(
         "pramen — POST /rpc/<handler> (JSON body), or WebSocket /live for live queries. " +
           "Header X-Pramen-Tenant selects the store (default: main). " +
-          "Admin: GET /tenants, POST /admin/recover {tenant,timestamp}, GET /admin/schema?tenant=.\n",
+          "Admin: GET /tenants, POST /admin/recover {tenant,timestamp}, GET /admin/schema?tenant=, " +
+          "POST /admin/data {tenant,table,op}.\n",
         { headers: { "content-type": "text/plain" } },
       );
     }