@stacksjs/defaults 0.70.229 → 0.70.231

package/app/Actions/Dashboard/Models/ModelShowAction.ts

@@ -1,6 +1,8 @@
 import { Action } from '@stacksjs/actions'
-import { request } from '@stacksjs/router'
-import { loadModel, safeGet } from '../../../../resources/functions/dashboard/data'
+import { env } from '@stacksjs/env'
+import { request, response as routerResponse } from '@stacksjs/router'
+import { loadModelIfExists, safeGet } from '../../../../resources/functions/dashboard/data'
+import { isValidModelSlug, type ModelCreateField, type ModelWriteCapabilities, modelCreateFields, modelSchemaColumns, modelWriteCapabilities, slugToPascal } from './model-write'
 
 /**
  * `GET /api/dashboard/models/{slug}` (stacksjs/stacks#1838).
@@ -18,7 +20,7 @@ import { loadModel, safeGet } from '../../../../resources/functions/dashboard/da
  *   1. `globalThis[Name]` — @stacksjs/orm injects every registered model
  *      as a global, and that is the same object the rest of the dashboard
  *      queries, so scopes, casts and accessors all apply.
- *   2. `loadModel(Name)` — path-map lookup, covers models the ORM has not
+ *   2. `loadModelIfExists(Name)` — path-map lookup, covers models the ORM has not
  *      registered as a global.
  *   3. Raw SQLite — last resort for a table with no model file at all
  *      (lookup/pivot tables, or a schema added outside the ORM).
@@ -50,16 +52,14 @@ interface ResponseShape {
   source: 'orm' | 'sqlite-fallback'
   /** False for tables reached through the SQLite fallback: no model, no writes. */
   writable: boolean
+  writeCapabilities: ModelWriteCapabilities
+  createFields: ModelCreateField[]
   error: string | null
 }
 
 const DEFAULT_PER_PAGE = 25
 const MAX_PER_PAGE = 200
 
-function slugToPascal(str: string): string {
-  return str.split('-').map(w => w.charAt(0).toUpperCase() + w.slice(1)).join('')
-}
-
 function pascalToSnake(str: string): string {
   return str.replace(/([a-z])([A-Z])/g, '$1_$2').toLowerCase()
 }
@@ -86,10 +86,10 @@ const HIDDEN_COLUMNS = new Set(['password', 'remember_token', 'api_token', 'acce
 
 /**
  * Column identifiers reach the query builder as raw, unquoted SQL, so only
- * word-shaped names from the table's own column list may ever be used.
+ * valid identifiers from the table's own column list may ever be used.
  */
 function isSafeColumn(name: string, allowed: Set<string>): boolean {
-  return /^\w+$/.test(name) && allowed.has(name)
+  return /^[A-Za-z_]\w*$/.test(name) && allowed.has(name)
 }
 
 function inferType(values: unknown[]): ColumnMeta['type'] {
@@ -119,21 +119,38 @@ function queryParams(): URLSearchParams {
 }
 
 /** `filters` arrives as a JSON object so column names stay unambiguous. */
-function parseFilters(raw: string | null): Record<string, string> {
+export function parseFilters(raw: string | null): Record<string, string> {
   if (!raw) return {}
+
+  if (raw.length > 8192)
+    throw new TypeError('Model filters must be 8 KB or smaller')
+
+  let parsed: unknown
   try {
-    const parsed = JSON.parse(raw) as Record<string, unknown>
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return {}
-    const out: Record<string, string> = {}
-    for (const [key, value] of Object.entries(parsed)) {
-      if (value === null || value === undefined || value === '') continue
-      out[key] = String(value)
-    }
-    return out
+    parsed = JSON.parse(raw)
+  }
+  catch (error) {
+    throw new Error(`Could not parse model filters: ${error instanceof Error ? error.message : String(error)}`)
   }
-  catch {
-    return {}
+
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+    throw new TypeError('Model filters must be a JSON object')
+
+  const entries = Object.entries(parsed)
+  if (entries.length > 50)
+    throw new TypeError('Model filters may contain at most 50 columns')
+
+  const out: Record<string, string> = {}
+  for (const [key, value] of entries) {
+    if (!/^\w+$/.test(key))
+      throw new TypeError(`Invalid model filter column "${key}"`)
+    if (value === null || value === undefined || value === '')
+      continue
+    if (typeof value !== 'string' && typeof value !== 'number' && typeof value !== 'boolean')
+      throw new TypeError(`Model filter "${key}" must be a scalar value`)
+    out[key] = String(value)
   }
+  return out
 }
 
 /**
@@ -161,6 +178,9 @@ export default new Action({
   apiResponse: true,
   async handle(req: { getParam?: (name: string) => unknown, route?: { params?: { slug?: string } } }) {
     const slug = String(req?.getParam?.('slug') ?? req?.route?.params?.slug ?? '')
+    if (!isValidModelSlug(slug))
+      return routerResponse.json({ message: 'Model slug must be lowercase kebab-case.' }, 400)
+
     const modelName = slugToPascal(slug)
     const tableName = pluralize(pascalToSnake(modelName))
 
@@ -170,7 +190,15 @@ export default new Action({
     const requestedSort = (params.get('sort') || '').trim()
     const dir: 'asc' | 'desc' = params.get('dir') === 'asc' ? 'asc' : 'desc'
     const q = (params.get('q') || '').trim()
-    const filters = parseFilters(params.get('filters'))
+    let filters: Record<string, string>
+    try {
+      filters = parseFilters(params.get('filters'))
+    }
+    catch (error) {
+      return routerResponse.json({
+        message: error instanceof Error ? error.message : 'Model filters are invalid.',
+      }, 422)
+    }
 
     const response: ResponseShape = {
       modelName,
@@ -190,25 +218,36 @@ export default new Action({
       filters,
       source: 'orm',
       writable: false,
+      writeCapabilities: { create: false, update: false, destroy: false },
+      createFields: [],
       error: null,
     }
 
-    const Model = resolveOrmModel(modelName) ?? await loadModel(modelName)
-    const hasOrm = Boolean(Model) && !Model._isStub && typeof Model.where === 'function'
+    const Model = resolveOrmModel(modelName) ?? await loadModelIfExists(modelName)
+    const hasOrm = Boolean(Model) && typeof Model.where === 'function'
 
     if (hasOrm) {
       try {
+        response.tableName = String(Model.table || tableName)
         // The column list has to come from a real row: the ORM does not
-        // expose a schema reflection API, and the filter/sort allowlist
-        // must be built from actual columns rather than user input.
+        // expose a database schema reflection API. Empty tables fall back
+        // to the model definition, which is also the migration source.
         const probe = await Model.orderByDesc('id').take(1).get() as Array<Record<string, unknown>>
         const first = Array.isArray(probe) ? probe[0] : undefined
         const shape = first && typeof first === 'object'
           ? ((first as { attributes?: Record<string, unknown> }).attributes ?? first)
           : {}
         response.columns = Object.keys(shape).filter(k => typeof k === 'string' && !k.startsWith('_'))
+        if (response.columns.length === 0)
+          response.columns = modelSchemaColumns(Model)
 
         const allowed = new Set(response.columns.filter(c => !HIDDEN_COLUMNS.has(c)))
+        const unknownFilter = Object.keys(filters).find(column => !isSafeColumn(column, allowed))
+        if (unknownFilter)
+          return routerResponse.json({ message: `Unknown model filter column "${unknownFilter}".` }, 422)
+        if (requestedSort && !isSafeColumn(requestedSort, allowed))
+          return routerResponse.json({ message: `Unknown model sort column "${requestedSort}".` }, 422)
+
         const sort = isSafeColumn(requestedSort, allowed)
           ? requestedSort
           : (allowed.has('id') ? 'id' : (response.columns[0] ?? ''))
@@ -239,15 +278,19 @@ export default new Action({
         // A multi-column search has no ORM expression, so hand that one
         // query to the SQLite path — without recording an error, because it
         // is a gap in the builder's vocabulary, not a failure.
-        if (q && searchColumns.length !== 1)
+        if (q && searchColumns.length > 1)
           throw new SearchUnsupported()
 
-        response.totalCount = await build().count()
-        const rows = await build()
-          .orderBy(sort, dir)
-          .skip((page - 1) * perPage)
-          .take(perPage)
-          .get() as Array<Record<string, unknown>>
+        response.totalCount = q && searchColumns.length === 0
+          ? 0
+          : await build().count()
+        const rows = response.totalCount === 0
+          ? []
+          : await build()
+              .orderBy(sort, dir)
+              .skip((page - 1) * perPage)
+              .take(perPage)
+              .get() as Array<Record<string, unknown>>
 
         // Flatten to plain JSON-safe objects — proxy models and
         // accessor-rich rows do not serialise cleanly across the wire.
@@ -259,9 +302,14 @@ export default new Action({
         })
       }
       catch (e) {
-        response.source = 'sqlite-fallback'
-        if (!(e instanceof SearchUnsupported))
-          response.error = e instanceof Error ? e.message : String(e)
+        if (e instanceof SearchUnsupported) {
+          response.source = 'sqlite-fallback'
+        }
+        else {
+          return routerResponse.json({
+            message: `Could not query model ${modelName}: ${e instanceof Error ? e.message : String(e)}`,
+          }, 503)
+        }
       }
     }
     else {
@@ -271,13 +319,25 @@ export default new Action({
     if (response.source === 'sqlite-fallback') {
       try {
         const { Database } = await import('bun:sqlite')
-        const db = new Database('database/stacks.sqlite')
+        const db = new Database(env.DB_DATABASE_PATH || 'database/stacks.sqlite', { readonly: true })
         try {
-          const tableInfo = db.query(`PRAGMA table_info(${tableName})`).all() as Array<{ name: string, type: string }>
+          if (!/^[A-Za-z_]\w*$/.test(response.tableName))
+            return routerResponse.json({ message: `Model table "${response.tableName}" is not a safe SQL identifier.` }, 500)
+
+          const tableInfo = db.query(`PRAGMA table_info(${response.tableName})`).all() as Array<{ name: string, type: string }>
+          if (tableInfo.length === 0)
+            return routerResponse.json({ message: `Model table "${response.tableName}" does not exist.` }, 404)
+
           response.columns = tableInfo.map(c => c.name)
 
           if (response.columns.length > 0) {
             const allowed = new Set(response.columns.filter(c => !HIDDEN_COLUMNS.has(c)))
+            const unknownFilter = Object.keys(filters).find(column => !isSafeColumn(column, allowed))
+            if (unknownFilter)
+              return routerResponse.json({ message: `Unknown model filter column "${unknownFilter}".` }, 422)
+            if (requestedSort && !isSafeColumn(requestedSort, allowed))
+              return routerResponse.json({ message: `Unknown model sort column "${requestedSort}".` }, 422)
+
             const sort = isSafeColumn(requestedSort, allowed)
               ? requestedSort
               : (allowed.has('id') ? 'id' : response.columns[0])
@@ -303,10 +363,10 @@ export default new Action({
             }
             const whereSql = wheres.length > 0 ? ` WHERE ${wheres.join(' AND ')}` : ''
 
-            const countRow = db.query(`SELECT COUNT(*) as count FROM ${tableName}${whereSql}`).get(...values as any[]) as { count?: number } | null
+            const countRow = db.query(`SELECT COUNT(*) as count FROM ${response.tableName}${whereSql}`).get(...values as any[]) as { count?: number } | null
             response.totalCount = countRow?.count ?? 0
             response.rows = db
-              .query(`SELECT * FROM ${tableName}${whereSql} ORDER BY ${sort} ${dir.toUpperCase()} LIMIT ? OFFSET ?`)
+              .query(`SELECT * FROM ${response.tableName}${whereSql} ORDER BY ${sort} ${dir.toUpperCase()} LIMIT ? OFFSET ?`)
               .all(...values as any[], perPage, (page - 1) * perPage) as Array<Record<string, unknown>>
             response.error = null
           }
@@ -316,14 +376,21 @@ export default new Action({
         }
       }
       catch (e) {
-        response.error = e instanceof Error ? e.message : String(e)
+        return routerResponse.json({
+          message: `Could not query table ${response.tableName}: ${e instanceof Error ? e.message : String(e)}`,
+        }, 503)
       }
     }
 
-    // Writability follows the existence of a model, not which engine
-    // answered this particular query: a multi-column search is served by
-    // SQLite even for a model that is perfectly writable.
-    response.writable = hasOrm
+    // Writability follows the model's declared useApi routes, not which
+    // engine answered this particular query. A multi-column search can be
+    // served by SQLite for a model that still creates and updates through
+    // the ORM.
+    response.writeCapabilities = hasOrm
+      ? modelWriteCapabilities(Model)
+      : { create: false, update: false, destroy: false }
+    response.writable = Object.values(response.writeCapabilities).some(Boolean)
+    response.createFields = response.writeCapabilities.create ? modelCreateFields(Model) : []
     response.displayColumns = response.columns.filter(col => !HIDDEN_COLUMNS.has(col) && !col.startsWith('_'))
     response.columnMeta = response.displayColumns.map(name => ({
       name,

package/app/Actions/Dashboard/Models/ModelStoreAction.ts

@@ -0,0 +1,39 @@
+import { Action } from '@stacksjs/actions'
+import { toSnakeCaseKeys } from '@stacksjs/orm'
+import { request } from '@stacksjs/router'
+import { prepareModelFields, resolveWritableModel } from './model-write'
+
+export default new Action({
+  name: 'Dashboard Model Store',
+  description: 'Creates one row through a model declared useApi store contract.',
+  method: 'POST',
+  apiResponse: true,
+  async handle(req: {
+    getParam?: (name: string) => unknown
+    all?: () => Record<string, unknown>
+    route?: { params?: { slug?: string } }
+  }) {
+    const resolved = await resolveWritableModel(String(req?.getParam?.('slug') ?? req?.route?.params?.slug ?? ''), 'store')
+    if ('error' in resolved)
+      return { ok: false, error: resolved.error }
+
+    const input = (req.all?.() ?? (request as any).all?.() ?? {}) as Record<string, unknown>
+    const raw = input.fields
+    const body = (raw && typeof raw === 'object' && !Array.isArray(raw)) ? raw as Record<string, unknown> : {}
+    const { data, errors } = prepareModelFields(resolved.Model, body)
+
+    if (Object.keys(errors).length > 0)
+      return { ok: false, error: 'Validation failed.', errors }
+    if (Object.keys(data).length === 0)
+      return { ok: false, error: 'No fillable fields in the request body.' }
+
+    try {
+      const row = await resolved.Model.create(toSnakeCaseKeys(data))
+      const id = row?.id ?? row?.attributes?.id ?? null
+      return { ok: true, id }
+    }
+    catch (error) {
+      return { ok: false, error: error instanceof Error ? error.message : String(error) }
+    }
+  },
+})

package/app/Actions/Dashboard/Models/ModelUpdateAction.ts

@@ -1,6 +1,7 @@
 import { Action } from '@stacksjs/actions'
+import { toSnakeCaseKeys } from '@stacksjs/orm'
 import { request } from '@stacksjs/router'
-import { parseRowId, PROTECTED_COLUMNS, resolveWritableModel } from './model-write'
+import { parseRowId, prepareModelFields, resolveWritableModel } from './model-write'
 
 /**
  * `PATCH /api/dashboard/models/{slug}/{id}`.
@@ -20,7 +21,7 @@ export default new Action({
     all?: () => Record<string, unknown>
     route?: { params?: { slug?: string, id?: string } }
   }) {
-    const resolved = await resolveWritableModel(String(req?.getParam?.('slug') ?? req?.route?.params?.slug ?? ''))
+    const resolved = await resolveWritableModel(String(req?.getParam?.('slug') ?? req?.route?.params?.slug ?? ''), 'update')
     if ('error' in resolved)
       return { ok: false, error: resolved.error }
 
@@ -37,11 +38,10 @@ export default new Action({
     const input = (req.all?.() ?? (request as any).all?.() ?? {}) as Record<string, unknown>
     const raw = input.fields
     const body = (raw && typeof raw === 'object' && !Array.isArray(raw)) ? raw as Record<string, unknown> : {}
-    const changes: Record<string, unknown> = {}
-    for (const [key, value] of Object.entries(body)) {
-      if (!/^\w+$/.test(key) || PROTECTED_COLUMNS.has(key)) continue
-      changes[key] = value
-    }
+    const prepared = prepareModelFields(resolved.Model, body, true)
+    if (Object.keys(prepared.errors).length > 0)
+      return { ok: false, error: 'Validation failed.', errors: prepared.errors }
+    const changes = toSnakeCaseKeys(prepared.data)
     if (Object.keys(changes).length === 0)
       return { ok: false, error: 'No writable fields in the request body.' }
 
@@ -49,7 +49,7 @@ export default new Action({
       const row = await resolved.Model.find(id)
       if (!row)
         return { ok: false, error: `${resolved.modelName} ${id} not found.` }
-      await row.update(changes)
+      await resolved.Model.update(id, changes)
       return { ok: true, id, changed: Object.keys(changes) }
     }
     catch (e) {

package/app/Actions/Dashboard/Models/ModelsIndexAction.ts

@@ -1,8 +1,8 @@
 import { Action } from '@stacksjs/actions'
-import { readdirSync } from 'node:fs'
+import { existsSync, readdirSync } from 'node:fs'
 import { join } from 'node:path'
 import process from 'node:process'
-import { loadModel, safeCount } from '../../../../resources/functions/dashboard/data'
+import { countRows } from '../../../../resources/functions/dashboard/data'
 
 /**
  * `GET /api/dashboard/models` (stacksjs/stacks#1838).
@@ -24,9 +24,13 @@ interface ModelRow {
   name: string
   table: string
   href: string
-  count: number
+  count: number | null
+  attributeCount: number
   category: string
   source: 'userland' | 'framework'
+  apiUri: string
+  apiRoutes: string[]
+  error: string | null
 }
 
 interface ModelGroup {
@@ -52,21 +56,19 @@ function pluralize(word: string): string {
 
 function walkModels(dir: string, recursive: boolean): Array<{ name: string, file: string }> {
   const out: Array<{ name: string, file: string }> = []
-  try {
-    const entries = readdirSync(dir, { withFileTypes: true })
-    for (const ent of entries) {
-      const full = join(dir, ent.name)
-      if (ent.isDirectory()) {
-        if (recursive) out.push(...walkModels(full, true))
-        continue
-      }
-      if (!ent.name.endsWith('.ts')) continue
-      if (ent.name.startsWith('_') || ent.name === 'index.ts' || ent.name === 'README.ts') continue
-      out.push({ name: ent.name.replace('.ts', ''), file: full })
+  if (!existsSync(dir))
+    return out
+
+  const entries = readdirSync(dir, { withFileTypes: true })
+  for (const ent of entries) {
+    const full = join(dir, ent.name)
+    if (ent.isDirectory()) {
+      if (recursive) out.push(...walkModels(full, true))
+      continue
     }
-  }
-  catch {
-    // Missing directory — return what we have.
+    if (!ent.name.endsWith('.ts')) continue
+    if (ent.name.startsWith('_') || ent.name === 'index.ts' || ent.name === 'README.ts') continue
+    out.push({ name: ent.name.replace('.ts', ''), file: full })
   }
   return out
 }
@@ -112,37 +114,57 @@ export default new Action({
       }
     }
 
-    const enriched: ModelRow[] = []
-    for (const m of merged) {
+    const enriched = await Promise.all(merged.map(async (m): Promise<ModelRow> => {
+      let Model: any
       try {
-        const Model = await loadModel(m.name)
-        const count = await safeCount(Model)
-        enriched.push({
-          name: m.name,
-          table: pluralize(pascalToSnake(m.name)),
-          href: `/models/${pascalToKebab(m.name)}`,
-          count,
-          category: categorize(m),
-          source: m.source,
-        })
+        const module = await import(m.file)
+        Model = module.default ?? module
       }
-      catch {
-        enriched.push({
+      catch (error) {
+        return {
           name: m.name,
           table: pluralize(pascalToSnake(m.name)),
           href: `/models/${pascalToKebab(m.name)}`,
-          count: 0,
+          count: null,
+          attributeCount: 0,
           category: categorize(m),
           source: m.source,
-        })
+          apiUri: '',
+          apiRoutes: [],
+          error: error instanceof Error ? error.message : String(error),
+        }
       }
-    }
+
+      const api = Model.traits?.useApi
+      let count: number | null = null
+      let error: string | null = null
+      try {
+        count = await countRows(Model)
+      }
+      catch (cause) {
+        error = cause instanceof Error ? cause.message : String(cause)
+      }
+
+      return {
+        name: m.name,
+        table: String(Model.table || pluralize(pascalToSnake(m.name))),
+        href: `/models/${pascalToKebab(m.name)}`,
+        count,
+        attributeCount: Object.keys(Model.attributes || {}).length,
+        category: categorize(m),
+        source: m.source,
+        apiUri: typeof api === 'object' && typeof api.uri === 'string' ? `/api/${api.uri}` : '',
+        apiRoutes: typeof api === 'object' && Array.isArray(api.routes) ? api.routes.map(String) : [],
+        error,
+      }
+    }))
 
     enriched.sort((a, b) => a.name.localeCompare(b.name))
 
     const totalModels = enriched.length
-    const totalRecords = enriched.reduce((sum, m) => sum + m.count, 0)
+    const totalRecords = enriched.reduce((sum, m) => sum + (m.count ?? 0), 0)
     const userlandCount = enriched.filter(m => m.source === 'userland').length
+    const unavailableModels = enriched.filter(m => m.error !== null).length
 
     const groupMap: Record<string, ModelRow[]> = {}
     for (const m of enriched) {
@@ -163,6 +185,7 @@ export default new Action({
       totalModels,
       totalRecords,
       userlandCount,
+      unavailableModels,
       categoryGroups,
     }
   },