@rebasepro/common 0.3.0 → 0.5.0

package/dist/util/permissions.d.ts

@@ -1,6 +1,14 @@
-import { AuthController, Entity, EntityCollection, User } from "@rebasepro/types";
-export declare function checkOperation<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authController: AuthController<USER>, entity: Entity<M> | null, targetOperation: "select" | "insert" | "update" | "delete"): boolean;
-export declare function canReadCollection<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authController: AuthController<USER>): boolean;
-export declare function canEditEntity<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authController: AuthController<USER>, path: string, entity: Entity<M> | null): boolean;
-export declare function canCreateEntity<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authController: AuthController<USER>, path: string, entity: Entity<M> | null): boolean;
-export declare function canDeleteEntity<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authController: AuthController<USER>, path: string, entity: Entity<M> | null): boolean;
+import { Entity, EntityCollection, User } from "@rebasepro/types";
+/**
+ * Minimal auth context for permission checking.
+ * Only requires the user object — avoids forcing callers to construct
+ * a full AuthController just to check permissions.
+ */
+export interface AuthContext<USER extends User = User> {
+    user: USER | null;
+}
+export declare function checkOperation<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authContext: AuthContext<USER>, entity: Entity<M> | null, targetOperation: "select" | "insert" | "update" | "delete"): boolean;
+export declare function canReadCollection<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authContext: AuthContext<USER>): boolean;
+export declare function canEditEntity<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authContext: AuthContext<USER>, path: string, entity: Entity<M> | null): boolean;
+export declare function canCreateEntity<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authContext: AuthContext<USER>, path: string, entity: Entity<M> | null): boolean;
+export declare function canDeleteEntity<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authContext: AuthContext<USER>, path: string, entity: Entity<M> | null): boolean;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/common",
   "type": "module",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Awesome Firebase/Firestore-based headless open-source CMS",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -41,8 +41,8 @@
   "dependencies": {
     "fast-equals": "6.0.0",
     "json-logic-js": "^2.0.5",
-    "@rebasepro/types": "0.3.0",
-    "@rebasepro/utils": "0.3.0"
+    "@rebasepro/types": "0.5.0",
+    "@rebasepro/utils": "0.5.0"
   },
   "devDependencies": {
     "@jest/globals": "^29.7.0",

package/src/collections/CollectionRegistry.ts

@@ -305,7 +305,7 @@ export class CollectionRegistry {
             const relation = relations.find(r => r.relationName === name);
             if (relation) {
                 // we attach the resolved relation to the property
-                (relationProperty as RelationProperty & { relation?: Relation }).relation = relation;
+                relationProperty.relation = relation;
             } else {
                 console.warn(`Could not find relation for property '${key}' with relationName: ${name}`);
             }

package/src/collections/default-collections.ts

@@ -1,14 +1,11 @@
-import { PostgresCollection } from "@rebasepro/types";
+import type { PostgresCollection } from "@rebasepro/types";
 
 /**
- * Default users collection definition.
+ * Default users collection.
  *
- * Shared between the admin UI (for navigation/display) and the backend
- * (for schema generation). Both consumers prepend this to the developer's
- * collections array and rely on generic slug-based deduplication
- * (Map keyed by slug, last-write-wins) so that developer-defined
- * collections with the same slug override this default — no hardcoded
- * string checks required.
+ * Prepended to the developer's collections array by the admin and server.
+ * Slug-based dedup (Map keyed by slug, last-write-wins) lets developers
+ * override by defining their own collection with `slug: "users"`.
  */
 export const defaultUsersCollection: PostgresCollection = {
     name: "Users",
@@ -18,62 +15,97 @@ export const defaultUsersCollection: PostgresCollection = {
     schema: "rebase",
     icon: "Users",
     group: "Settings",
+    openEntityMode: "dialog",
+    disableDefaultActions: ["copy"],
+    securityRules: [
+        { operation: "select", roles: ["admin"] },
+        { operations: ["insert", "update", "delete"], roles: ["admin"] }
+    ],
+    sort: ["createdAt", "desc"],
     properties: {
         id: {
             name: "ID",
             type: "string",
-            isId: "uuid"
+            isId: "uuid",
+            ui: { readOnly: true }
         },
         email: {
             name: "Email",
             type: "string",
             validation: { required: true, unique: true }
         },
-        password_hash: {
-            name: "Password Hash",
+        displayName: {
+            name: "Name",
             type: "string",
-            ui: { hideFromCollection: true }
-        },
-        display_name: {
-            name: "Display Name",
-            type: "string"
+            columnName: "display_name",
+            validation: { required: true }
         },
-        photo_url: {
+        photoURL: {
             name: "Photo URL",
-            type: "string"
+            type: "string",
+            columnName: "photo_url",
+            url: "image"
+        },
+        roles: {
+            name: "Roles",
+            type: "array",
+            columnType: "text[]",
+            of: {
+                name: "Role",
+                type: "string",
+                enum: {
+                    admin: "Admin",
+                    editor: "Editor",
+                    viewer: "Viewer"
+                }
+            }
+        },
+        passwordHash: {
+            name: "Password Hash",
+            type: "string",
+            columnName: "password_hash",
+            ui: { hideFromCollection: true, disabled: { hidden: true } }
         },
-        email_verified: {
+        emailVerified: {
             name: "Email Verified",
             type: "boolean",
-            defaultValue: false
+            columnName: "email_verified",
+            defaultValue: false,
+            ui: { hideFromCollection: true, disabled: { hidden: true } }
         },
-        email_verification_token: {
+        emailVerificationToken: {
             name: "Email Verification Token",
             type: "string",
-            ui: { hideFromCollection: true }
+            columnName: "email_verification_token",
+            ui: { hideFromCollection: true, disabled: { hidden: true } }
         },
-        email_verification_sent_at: {
+        emailVerificationSentAt: {
             name: "Email Verification Sent At",
             type: "date",
-            ui: { hideFromCollection: true }
+            columnName: "email_verification_sent_at",
+            ui: { hideFromCollection: true, disabled: { hidden: true } }
         },
         metadata: {
             name: "Metadata",
             type: "map",
             defaultValue: {},
-            ui: { hideFromCollection: true }
+            ui: { hideFromCollection: true, disabled: { hidden: true } }
         },
-        created_at: {
+        createdAt: {
             name: "Created At",
             type: "date",
+            columnName: "created_at",
             autoValue: "on_create",
-            ui: { readOnly: true, hideFromCollection: true }
+            ui: { readOnly: true }
         },
-        updated_at: {
+        updatedAt: {
             name: "Updated At",
             type: "date",
+            columnName: "updated_at",
             autoValue: "on_update",
-            ui: { readOnly: true, hideFromCollection: true }
+            ui: { hideFromCollection: true, disabled: { hidden: true } }
         }
-    }
+    },
+    listProperties: ["displayName", "email", "roles", "createdAt"],
+    propertiesOrder: ["id", "email", "displayName", "roles", "createdAt"]
 };

package/src/data/buildRebaseData.ts

@@ -8,7 +8,10 @@ import {
     EntityValues,
     FilterValues,
     WhereFilterOp,
-    WhereFieldValue
+    WhereFieldValue,
+    WhereFilterOpShort,
+    LogicalCondition,
+    WhereValue
 } from "@rebasepro/types";
 import { toSnakeCase } from "@rebasepro/utils";
 import { QueryBuilder } from "./query_builder";
@@ -69,11 +72,18 @@ function convertWhereToFilter(where?: Record<string, WhereFieldValue>): FilterVa
             continue;
         }
 
-        // Handle tuple: [operator, value]
-        if (Array.isArray(rawValue) && rawValue.length === 2) {
-            const [rawOp, val] = rawValue;
-            const mappedOp = operatorMap[rawOp] ?? "==";
-            filter[field] = [mappedOp, val];
+        // Handle tuple or array of tuples
+        if (Array.isArray(rawValue)) {
+            const conditions: [WhereFilterOpShort, unknown][] = Array.isArray(rawValue[0])
+                ? (rawValue as [WhereFilterOpShort, unknown][])
+                : [rawValue as [WhereFilterOpShort, unknown]];
+
+            const mappedConditions: [WhereFilterOp, unknown][] = conditions.map(([rawOp, val]) => {
+                const mappedOp = operatorMap[rawOp] ?? "==";
+                return [mappedOp, val];
+            });
+
+            filter[field] = Array.isArray(rawValue[0]) ? mappedConditions : mappedConditions[0];
             continue;
         }
 
@@ -190,6 +200,12 @@ values: {} as Record<string, unknown> }
             });
         },
 
+        deleteAll: driver.deleteAll
+            ? async (): Promise<void> => {
+                return driver.deleteAll!(slug);
+            }
+            : undefined,
+
         count: driver.countEntities
             ? async (params?: FindParams): Promise<number> => {
                 return driver.countEntities!({
@@ -238,8 +254,12 @@ values: {} as Record<string, unknown> }
             } : undefined,
 
         // Fluent Query Builder
-        where(column: keyof M & string, operator: WhereFilterOp, value: unknown) {
-            return new QueryBuilder<M>(accessor).where(column, operator, value);
+        where(columnOrCondition: string | LogicalCondition, operator?: WhereFilterOpShort, value?: unknown) {
+            const builder = new QueryBuilder<M>(accessor);
+            if (typeof columnOrCondition === "object") {
+                return builder.where(columnOrCondition);
+            }
+            return builder.where(columnOrCondition as keyof M & string, operator!, value as WhereValue<M[keyof M & string]>);
         },
         orderBy(column: keyof M & string, ascending?: "asc" | "desc") {
             return new QueryBuilder<M>(accessor).orderBy(column, ascending);

package/src/data/query_builder.ts

@@ -1,21 +1,15 @@
-import { FindParams, Entity, FindResponse, CollectionAccessor, QueryBuilderInterface, FilterOperator } from "@rebasepro/types";
-
-/**
- * Maps standard operators to Rebase backend's string-based operators
- */
-function mapOperator(op: FilterOperator): string {
-    switch (op) {
-        case "==": return "eq";
-        case "!=": return "neq";
-        case ">": return "gt";
-        case ">=": return "gte";
-        case "<": return "lt";
-        case "<=": return "lte";
-        case "array-contains": return "cs";
-        case "array-contains-any": return "csa";
-        case "not-in": return "nin";
-        default: return op;
-    }
+import { FindParams, Entity, FindResponse, CollectionAccessor, QueryBuilderInterface, FilterOperator, LogicalCondition, WhereValue, FilterCondition } from "@rebasepro/types";
+
+export function or(...conditions: (FilterCondition | LogicalCondition)[]): LogicalCondition {
+    return { type: "or", conditions };
+}
+
+export function and(...conditions: (FilterCondition | LogicalCondition)[]): LogicalCondition {
+    return { type: "and", conditions };
+}
+
+export function cond(column: string, operator: FilterOperator, value: unknown): FilterCondition {
+    return { column, operator, value };
 }
 
 export class QueryBuilder<M extends Record<string, unknown> = Record<string, unknown>> implements QueryBuilderInterface<M> {
@@ -28,22 +22,38 @@ export class QueryBuilder<M extends Record<string, unknown> = Record<string, unk
      * @example
      * client.collection('users').where('age', '>=', 18).find()
      */
-    where(column: keyof M & string, operator: FilterOperator, value: unknown): this {
+    where<K extends keyof M & string>(column: K, operator: FilterOperator, value: WhereValue<M[K]>): this;
+    where(logicalCondition: LogicalCondition): this;
+    where(columnOrCondition: string | LogicalCondition, operator?: FilterOperator, value?: unknown): this {
+        // Handle LogicalCondition signature
+        if (typeof columnOrCondition === "object" && columnOrCondition !== null && "type" in columnOrCondition) {
+            this.params.logical = columnOrCondition as LogicalCondition;
+            return this;
+        }
+
         if (!this.params.where) {
             this.params.where = {};
         }
 
-        const mappedOp = mapOperator(operator);
-        let formattedValue = value;
+        const column = columnOrCondition as string;
+        const condition: [FilterOperator, unknown] = [operator!, value];
+        const existing = this.params.where[column];
 
-        // Handle arrays for in, nin, cs, csa
-        if (Array.isArray(value) && ["in", "nin", "cs", "csa"].includes(mappedOp)) {
-            formattedValue = `(${value.join(",")})`;
-        } else if (value === null) {
-            formattedValue = "null";
+        if (existing === undefined) {
+            this.params.where[column] = condition;
+        } else if (Array.isArray(existing) && existing.length > 0 && Array.isArray(existing[0])) {
+            (this.params.where[column] as [FilterOperator, unknown][]).push(condition);
+        } else {
+            // Convert existing single tuple/value into array of tuples
+            let firstCondition: [FilterOperator, unknown];
+            if (Array.isArray(existing) && existing.length === 2 && typeof existing[0] === "string") {
+                firstCondition = existing as [FilterOperator, unknown];
+            } else {
+                firstCondition = ["==", existing];
+            }
+            this.params.where[column] = [firstCondition, condition];
         }
 
-        this.params.where[column] = mappedOp === "eq" ? String(formattedValue) : `${mappedOp}.${formattedValue}`;
         return this;
     }
 

package/src/util/permissions.ts

@@ -1,6 +1,15 @@
-import { AuthController, CollectionWithRelations, Entity, EntityCollection, getDataSourceCapabilities, SecurityRule, User } from "@rebasepro/types";
+import { CollectionWithRelations, Entity, EntityCollection, getDataSourceCapabilities, SecurityRule, User } from "@rebasepro/types";
+
+/**
+ * Minimal auth context for permission checking.
+ * Only requires the user object — avoids forcing callers to construct
+ * a full AuthController just to check permissions.
+ */
+export interface AuthContext<USER extends User = User> {
+    user: USER | null;
+}
 
-function evaluateAST<USER extends User, M extends Record<string, unknown>>(sqlString: string, auth: AuthController<USER>, entity: Entity<M> | null): boolean {
+function evaluateAST<USER extends User, M extends Record<string, unknown>>(sqlString: string, auth: AuthContext<USER>, entity: Entity<M> | null): boolean {
     // This is a client-side SQL evaluator used *only* for optimistic UI updates.
     // It parses basic AND / OR statements to evaluate RLS without backend roundtrips.
     if (!entity) return true;
@@ -111,7 +120,7 @@ function evaluateAST<USER extends User, M extends Record<string, unknown>>(sqlSt
     return true; // Optimistic fallback for anything else
 }
 
-function evaluateRule<USER extends User, M extends Record<string, unknown>>(rule: SecurityRule, auth: AuthController<USER>, entity: Entity<M> | null): boolean {
+function evaluateRule<USER extends User, M extends Record<string, unknown>>(rule: SecurityRule, auth: AuthContext<USER>, entity: Entity<M> | null): boolean {
 
     if (rule.access === "public") return true;
 
@@ -137,15 +146,12 @@ function evaluateRule<USER extends User, M extends Record<string, unknown>>(rule
 
 export function checkOperation<M extends Record<string, unknown>, USER extends User>(
     collection: EntityCollection<M>,
-    authController: AuthController<USER>,
+    authContext: AuthContext<USER>,
     entity: Entity<M> | null,
     targetOperation: "select" | "insert" | "update" | "delete"
 ): boolean {
     const securityRules = getDataSourceCapabilities(collection.driver).supportsRLS ? (collection as CollectionWithRelations).securityRules : undefined;
     if (!securityRules || securityRules.length === 0) {
-        // According to our plan: Postgres RLS implicitly denies if enabled without rules.
-        // But for Rebase we default to true if securityRules is undefined,
-        // so as not to break everything without rules. Let's assume true for now.
         return true;
     }
 
@@ -158,15 +164,13 @@ export function checkOperation<M extends Record<string, unknown>, USER extends U
 
     if (applicableRules.length === 0) return false;
 
-    // In Postgres, policies ONLY apply if the user matching the targeted roles.
-    const userRoleIds = authController.user?.roles ?? [];
+    const userRoleIds = authContext.user?.roles ?? [];
     const userRoles = [...userRoleIds, "public"];
     const roleApplicableRules = applicableRules.filter((rule: SecurityRule) => {
-        if (!rule.roles || rule.roles.length === 0) return true; // APPLIES TO PUBLIC
+        if (!rule.roles || rule.roles.length === 0) return true;
         return rule.roles.some((r: string) => userRoles.includes(r));
     });
 
-    // If no rules apply to this user's roles, the operation is implicitly denied.
     if (roleApplicableRules.length === 0) return false;
 
     let grantedByPermissive = false;
@@ -174,11 +178,11 @@ export function checkOperation<M extends Record<string, unknown>, USER extends U
 
     for (const rule of roleApplicableRules) {
         const mode = rule.mode || "permissive";
-        const passed = evaluateRule(rule, authController, entity);
+        const passed = evaluateRule(rule, authContext, entity);
 
         if (mode === "restrictive" && !passed) {
             deniedByRestrictive = true;
-            break; // Immediate deny
+            break;
         }
 
         if (mode === "permissive" && passed) {
@@ -199,37 +203,37 @@ export function checkOperation<M extends Record<string, unknown>, USER extends U
 export function canReadCollection<M extends Record<string, unknown>, USER extends User>
     (
         collection: EntityCollection<M>,
-        authController: AuthController<USER>
+        authContext: AuthContext<USER>
     ): boolean {
-    return checkOperation(collection, authController, null, "select");
+    return checkOperation(collection, authContext, null, "select");
 }
 
 export function canEditEntity<M extends Record<string, unknown>, USER extends User>
     (
         collection: EntityCollection<M>,
-        authController: AuthController<USER>,
+        authContext: AuthContext<USER>,
         path: string,
         entity: Entity<M> | null
     ): boolean {
-    return checkOperation(collection, authController, entity, "update");
+    return checkOperation(collection, authContext, entity, "update");
 }
 
 export function canCreateEntity<M extends Record<string, unknown>, USER extends User>
     (
         collection: EntityCollection<M>,
-        authController: AuthController<USER>,
+        authContext: AuthContext<USER>,
         path: string,
         entity: Entity<M> | null
     ): boolean {
-    return checkOperation(collection, authController, entity, "insert");
+    return checkOperation(collection, authContext, entity, "insert");
 }
 
 export function canDeleteEntity<M extends Record<string, unknown>, USER extends User>
     (
         collection: EntityCollection<M>,
-        authController: AuthController<USER>,
+        authContext: AuthContext<USER>,
         path: string,
         entity: Entity<M> | null
     ): boolean {
-    return checkOperation(collection, authController, entity, "delete");
+    return checkOperation(collection, authContext, entity, "delete");
 }