@stndrds/schema 0.1.0-alpha.17 → 0.1.0-alpha.18

package/dist/runtime.js

@@ -59,21 +59,25 @@ var init_default_roles = __esm({
       /** Tenant settings and configuration */
       SETTINGS: "settings",
       /** Audit logs and activity trail */
-      AUDIT: "audit"
+      AUDIT: "audit",
+      /** File uploads and storage management */
+      FILES: "files"
     };
     ALL_SYSTEM_RESOURCES = [
       SYSTEM_RESOURCES.USERS,
       SYSTEM_RESOURCES.SCHEMA,
       SYSTEM_RESOURCES.ROLES,
       SYSTEM_RESOURCES.SETTINGS,
-      SYSTEM_RESOURCES.AUDIT
+      SYSTEM_RESOURCES.AUDIT,
+      SYSTEM_RESOURCES.FILES
     ];
     SYSTEM_RESOURCE_LABELS = {
       users: "Users",
       schema: "Schema",
       roles: "Roles & Permissions",
       settings: "Settings",
-      audit: "Audit Logs"
+      audit: "Audit Logs",
+      files: "Files"
     };
     DEFAULT_ROLES = {
       /** Full platform access - can manage everything */
@@ -131,6 +135,7 @@ __export(runtime_exports, {
   RecordService: () => RecordService,
   RelationService: () => RelationService,
   UserProfileService: () => UserProfileService,
+  UserService: () => UserService,
   ViewService: () => ViewService,
   buildAuditChanges: () => buildAuditChanges,
   createMockAdapter: () => createMockAdapter,
@@ -178,6 +183,13 @@ function formatCheckbox(value) {
 function formatNumber(value, attribute) {
   if (typeof value !== "number") return String(value);
   const decimals = attribute.decimals;
+  if (attribute.unit === "percentage") {
+    return value.toLocaleString(void 0, {
+      style: "percent",
+      minimumFractionDigits: decimals,
+      maximumFractionDigits: decimals
+    });
+  }
   return value.toLocaleString(void 0, {
     minimumFractionDigits: decimals,
     maximumFractionDigits: decimals
@@ -1404,6 +1416,24 @@ var AuditService = class {
     };
     await this.log(entry);
   }
+  /**
+   * Log a file action (upload, update, delete)
+   */
+  async logFileAction(params) {
+    const entry = {
+      tenantId: this.tenantId,
+      actorId: params.actorId,
+      actorEmail: params.actorEmail,
+      actorType: "user",
+      action: params.action,
+      resourceType: "file",
+      resourceId: params.fileId,
+      resourceLabel: params.fileName,
+      changes: params.changes ? this.redactSensitiveFields(params.changes) : void 0,
+      metadata: params.metadata
+    };
+    await this.log(entry);
+  }
   /**
    * Log a system action (no actor)
    */
@@ -1553,21 +1583,105 @@ var AuditService = class {
 
 // src/runtime/services/file.service.ts
 var FileService = class {
-  constructor(adapter, tenantId) {
+  constructor(adapter, tenantId, options) {
     this.adapter = adapter;
     this.tenantId = tenantId;
+    this.auditService = options?.auditService ?? (adapter.audit ? new AuditService(adapter, tenantId) : void 0);
+    this.userId = options?.userId;
+    this.userEmail = options?.userEmail;
   }
+  // ============================================================================
+  // UPLOAD (requires StorageAdapter)
+  // ============================================================================
   /**
-   * Create a new file record (after upload to storage)
+   * Upload a file to storage and create metadata record.
    *
-   * @param data - File metadata
+   * This method orchestrates:
+   * 1. Upload to storage (via StorageAdapter)
+   * 2. Create file metadata in database
+   * 3. Audit log the operation
+   *
+   * Requires `adapter.storage` to be configured.
+   *
+   * @param input - File content and metadata
    * @returns Created file record
+   * @throws Error if StorageAdapter is not configured
    *
    * @example
    * ```typescript
-   * const service = new FileService(adapter, "tenant-123");
+   * const file = await service.uploadFile({
+   *   content: fileBuffer,
+   *   fileName: "document.pdf",
+   *   mimeType: "application/pdf",
+   *   size: 12345,
+   *   uploadedBy: "user-123",
+   *   visibility: "private",
+   *   folderPath: "/documents",
+   *   tags: ["contract", "2025"],
+   * });
+   * ```
+   */
+  async uploadFile(input) {
+    if (!this.adapter.storage) {
+      throw new Error(
+        "StorageAdapter is not configured. Provide adapter.storage to use uploadFile()."
+      );
+    }
+    const uploadResult = await this.adapter.storage.upload({
+      content: input.content,
+      fileName: input.fileName,
+      mimeType: input.mimeType,
+      size: input.size,
+      tenantId: this.tenantId,
+      folderPath: input.folderPath
+    });
+    const file = await this.adapter.files.create({
+      tenantId: this.tenantId,
+      name: input.fileName,
+      originalName: input.fileName,
+      mimeType: input.mimeType,
+      size: input.size,
+      storageProvider: uploadResult.storageProvider,
+      storagePath: uploadResult.storagePath,
+      storageBucket: uploadResult.storageBucket,
+      url: uploadResult.url,
+      uploadedBy: input.uploadedBy,
+      folderPath: input.folderPath,
+      tags: input.tags,
+      visibility: input.visibility ?? "private",
+      allowedUsers: input.allowedUsers
+    });
+    if (this.auditService && this.userId) {
+      await this.auditService.logFileAction({
+        action: "file.uploaded",
+        actorId: this.userId,
+        actorEmail: this.userEmail,
+        fileId: file.id,
+        fileName: file.name,
+        metadata: {
+          mimeType: file.mimeType,
+          size: file.size,
+          visibility: file.visibility
+        }
+      });
+    }
+    return file;
+  }
+  // ============================================================================
+  // CREATE (metadata only, for external storage)
+  // ============================================================================
+  /**
+   * Create a new file record (after upload to storage).
+   *
+   * Use this method when handling storage externally (e.g., with Multer + S3).
+   * For integrated upload, use `uploadFile()` instead.
    *
-   * // After uploading to S3
+   * @param data - File metadata
+   * @returns Created file record
+   *
+   * @example
+   * ```typescript
+   * // After uploading to S3 with Multer
    * const file = await service.createFile({
    *   tenantId: "tenant-123",
    *   name: "contract-2025.pdf",
@@ -1589,8 +1703,26 @@ var FileService = class {
         `Tenant mismatch: service initialized with "${this.tenantId}" but data has "${data.tenantId}"`
       );
     }
-    return await this.adapter.files.create(data);
+    const file = await this.adapter.files.create(data);
+    if (this.auditService && this.userId) {
+      await this.auditService.logFileAction({
+        action: "file.uploaded",
+        actorId: this.userId,
+        actorEmail: this.userEmail,
+        fileId: file.id,
+        fileName: file.name,
+        metadata: {
+          mimeType: file.mimeType,
+          size: file.size,
+          visibility: file.visibility
+        }
+      });
+    }
+    return file;
   }
+  // ============================================================================
+  // READ
+  // ============================================================================
   /**
    * Get file by ID
    */
@@ -1611,6 +1743,9 @@ var FileService = class {
     }
     return file;
   }
+  // ============================================================================
+  // UPDATE
+  // ============================================================================
   /**
    * Update file metadata
    *
@@ -1619,18 +1754,44 @@ var FileService = class {
    * @returns Updated file
    */
   async updateFile(fileId, data) {
-    await this.getFileOrThrow(fileId);
-    return await this.adapter.files.update(fileId, data);
+    const existingFile = await this.getFileOrThrow(fileId);
+    const updatedFile = await this.adapter.files.update(fileId, data);
+    if (this.auditService && this.userId) {
+      const changes = [];
+      for (const key of Object.keys(data)) {
+        if (data[key] !== void 0 && data[key] !== existingFile[key]) {
+          changes.push({
+            field: key,
+            oldValue: existingFile[key],
+            newValue: data[key]
+          });
+        }
+      }
+      if (changes.length > 0) {
+        await this.auditService.logFileAction({
+          action: "file.updated",
+          actorId: this.userId,
+          actorEmail: this.userEmail,
+          fileId,
+          fileName: updatedFile.name,
+          changes
+        });
+      }
+    }
+    return updatedFile;
   }
+  // ============================================================================
+  // DELETE
+  // ============================================================================
   /**
-   * Delete file (soft delete)
+   * Delete file (soft delete by default)
    *
    * @param fileId - File UUID
    * @param options - Delete options
    */
   async deleteFile(fileId, options) {
+    const file = await this.getFileOrThrow(fileId);
     if (options?.checkOwnership && options.userId) {
-      const file = await this.getFileOrThrow(fileId);
       if (file.uploadedBy !== options.userId) {
         throw new Error("You can only delete files you uploaded");
       }
@@ -1640,7 +1801,84 @@ var FileService = class {
     } else {
       await this.adapter.files.delete(fileId);
     }
+    if (this.auditService && this.userId) {
+      await this.auditService.logFileAction({
+        action: "file.deleted",
+        actorId: this.userId,
+        actorEmail: this.userEmail,
+        fileId,
+        fileName: file.name
+      });
+    }
+  }
+  /**
+   * Delete file from both storage and database.
+   *
+   * Requires `adapter.storage` to be configured.
+   *
+   * @param fileId - File UUID
+   * @param options - Delete options
+   * @throws Error if StorageAdapter is not configured
+   */
+  async deleteFileWithStorage(fileId, options) {
+    if (!this.adapter.storage) {
+      throw new Error(
+        "StorageAdapter is not configured. Provide adapter.storage to use deleteFileWithStorage()."
+      );
+    }
+    const file = await this.getFileOrThrow(fileId);
+    await this.adapter.storage.delete(file.storagePath);
+    if (options?.hard) {
+      await this.adapter.files.hardDelete(fileId);
+    } else {
+      await this.adapter.files.delete(fileId);
+    }
+    if (this.auditService && this.userId) {
+      await this.auditService.logFileAction({
+        action: "file.deleted",
+        actorId: this.userId,
+        actorEmail: this.userEmail,
+        fileId,
+        fileName: file.name,
+        metadata: { deletedFromStorage: true }
+      });
+    }
   }
+  /**
+   * Delete multiple files
+   *
+   * @param fileIds - Array of file UUIDs
+   * @param options - Delete options
+   */
+  async bulkDelete(fileIds, options) {
+    for (const fileId of fileIds) {
+      const file = await this.getFile(fileId);
+      if (!file) {
+        continue;
+      }
+      if (options?.deleteFromStorage && this.adapter.storage) {
+        await this.adapter.storage.delete(file.storagePath);
+      }
+      if (options?.hard) {
+        await this.adapter.files.hardDelete(fileId);
+      } else {
+        await this.adapter.files.delete(fileId);
+      }
+      if (this.auditService && this.userId) {
+        await this.auditService.logFileAction({
+          action: "file.deleted",
+          actorId: this.userId,
+          actorEmail: this.userEmail,
+          fileId,
+          fileName: file.name,
+          metadata: { deletedFromStorage: options?.deleteFromStorage ?? false }
+        });
+      }
+    }
+  }
+  // ============================================================================
+  // LIST
+  // ============================================================================
   /**
    * List files for the tenant
    */
@@ -1659,6 +1897,74 @@ var FileService = class {
   async listFilesByUploader(uploadedBy) {
     return await this.adapter.files.findByUploader(uploadedBy);
   }
+  // ============================================================================
+  // SIGNED URL
+  // ============================================================================
+  /**
+   * Get a signed URL for private file access.
+   *
+   * Checks access permissions before generating URL.
+   * Requires `adapter.storage` to be configured.
+   *
+   * @param fileId - File UUID
+   * @param userId - User requesting access
+   * @param options - Signed URL options
+   * @returns Signed URL
+   * @throws Error if user doesn't have access or StorageAdapter is not configured
+   *
+   * @example
+   * ```typescript
+   * const url = await service.getSignedUrl("file-123", "user-456", {
+   *   expiresIn: 3600, // 1 hour
+   * });
+   * ```
+   */
+  async getSignedUrl(fileId, userId, options) {
+    const file = await this.getFileOrThrow(fileId);
+    const hasAccess = await this.checkAccess(fileId, userId);
+    if (!hasAccess) {
+      throw new Error("Access denied to this file");
+    }
+    if (file.visibility === "public") {
+      return file.url;
+    }
+    if (!this.adapter.storage) {
+      return file.url;
+    }
+    return await this.adapter.storage.getSignedUrl(file.storagePath, options);
+  }
+  // ============================================================================
+  // ACCESS CONTROL
+  // ============================================================================
+  /**
+   * Check if user has access to a file
+   *
+   * @param fileId - File UUID
+   * @param userId - User ID to check
+   * @returns true if user can access the file
+   */
+  async checkAccess(fileId, userId) {
+    const file = await this.getFile(fileId);
+    if (!file) {
+      return false;
+    }
+    if (file.visibility === "public") {
+      return true;
+    }
+    if (file.uploadedBy === userId) {
+      return true;
+    }
+    if (file.visibility === "restricted") {
+      return file.allowedUsers?.includes(userId) ?? false;
+    }
+    return false;
+  }
+  /**
+   * @deprecated Use checkAccess() instead
+   */
+  canAccess(fileId, userId) {
+    return this.checkAccess(fileId, userId);
+  }
   /**
    * Change file visibility
    *
@@ -1702,29 +2008,9 @@ var FileService = class {
       allowedUsers: newAllowed
     });
   }
-  /**
-   * Check if user has access to a file
-   *
-   * @param fileId - File UUID
-   * @param userId - User ID to check
-   * @returns true if user can access the file
-   */
-  async canAccess(fileId, userId) {
-    const file = await this.getFile(fileId);
-    if (!file) {
-      return false;
-    }
-    if (file.visibility === "public") {
-      return true;
-    }
-    if (file.uploadedBy === userId) {
-      return true;
-    }
-    if (file.visibility === "restricted") {
-      return file.allowedUsers?.includes(userId) ?? false;
-    }
-    return false;
-  }
+  // ============================================================================
+  // ORGANIZATION
+  // ============================================================================
   /**
    * Move file to different folder
    */
@@ -1769,6 +2055,7 @@ var SchemaErrorCode = {
   // Protected Resources
   PROTECTED_OBJECT: "SCHEMA_PROTECTED_OBJECT",
   PROTECTED_ATTRIBUTE: "SCHEMA_PROTECTED_ATTRIBUTE",
+  PROTECTED_VIEW: "SCHEMA_PROTECTED_VIEW",
   PROTECTED_ROLE: "SCHEMA_PROTECTED_ROLE",
   // Permissions
   FORBIDDEN: "SCHEMA_FORBIDDEN",
@@ -1833,7 +2120,7 @@ var ValidationError = class _ValidationError extends SchemaError {
 };
 var ProtectedResourceError = class extends SchemaError {
   constructor(resourceType, resourceName, operation) {
-    const code = resourceType === "object" ? SchemaErrorCode.PROTECTED_OBJECT : SchemaErrorCode.PROTECTED_ATTRIBUTE;
+    const code = resourceType === "object" ? SchemaErrorCode.PROTECTED_OBJECT : resourceType === "view" ? SchemaErrorCode.PROTECTED_VIEW : SchemaErrorCode.PROTECTED_ATTRIBUTE;
     super(`Cannot ${operation} system ${resourceType} "${resourceName}"`, code, {
       resourceType,
       resourceName,
@@ -2598,10 +2885,12 @@ var fileConfigSchema = baseConfigSchema.extend({
   maxFiles: import_zod4.z.number().int().min(1).optional(),
   maxSize: import_zod4.z.number().int().min(1).optional(),
   allowedTypes: import_zod4.z.array(import_zod4.z.string()).optional(),
-  verification: fileVerificationConfigSchema.optional()
+  verification: fileVerificationConfigSchema.optional(),
+  multiple: import_zod4.z.boolean().optional()
 });
 var userConfigSchema = baseConfigSchema.extend({
-  allowedRoles: import_zod4.z.array(import_zod4.z.string()).optional()
+  allowedRoles: import_zod4.z.array(import_zod4.z.string()).optional(),
+  multiple: import_zod4.z.boolean().optional()
 });
 var relationConfigSchema = baseConfigSchema.extend({
   targets: import_zod4.z.array(relationTargetSchema).min(1),
@@ -2723,20 +3012,39 @@ function createLocationValidator(_attr) {
 function createTimestampValidator(_attr) {
   return import_zod4.z.number().int().positive();
 }
-function createFileValidator(_attr) {
-  return import_zod4.z.string().uuid();
+function createFileValidator(attr) {
+  const uuidSchema = import_zod4.z.uuid({
+    message: `${attr.label} must be a valid file ID`
+  });
+  if (attr.multiple) {
+    let arraySchema = import_zod4.z.array(uuidSchema);
+    if (attr.maxFiles) {
+      arraySchema = arraySchema.max(
+        attr.maxFiles,
+        `${attr.label} cannot have more than ${attr.maxFiles} file${attr.maxFiles > 1 ? "s" : ""}`
+      );
+    }
+    return arraySchema;
+  }
+  return uuidSchema;
 }
-function createUserValidator(_attr) {
-  return import_zod4.z.string().uuid();
+function createUserValidator(attr) {
+  const uuidSchema = import_zod4.z.uuid({
+    message: `${attr.label} must be a valid user ID`
+  });
+  if (attr.multiple) {
+    return import_zod4.z.array(uuidSchema);
+  }
+  return uuidSchema;
 }
 function createSingleRelationValidator(attr) {
-  const uuidSchema = import_zod4.z.string().uuid({
+  const uuidSchema = import_zod4.z.uuid({
     message: `${attr.label} must be a valid record ID`
   });
   return import_zod4.z.union([uuidSchema, import_zod4.z.null()]);
 }
 function createMultiRelationValidator(attr) {
-  const uuidSchema = import_zod4.z.string().uuid({
+  const uuidSchema = import_zod4.z.uuid({
     message: `Each ${attr.label} item must be a valid record ID`
   });
   let arraySchema = import_zod4.z.array(uuidSchema);
@@ -4426,6 +4734,123 @@ var RelationService = class {
   }
 };
 
+// src/runtime/services/user.service.ts
+var UserService = class {
+  constructor(adapter, tenantId) {
+    this.adapter = adapter;
+    this.tenantId = tenantId;
+  }
+  /**
+   * Validate all user attributes in the data
+   *
+   * @param schema - Object schema containing attribute definitions
+   * @param data - Record data to validate
+   * @returns Validation result with errors if any
+   *
+   * @example
+   * ```typescript
+   * const result = await userService.validateUsers(schema, {
+   *   assignee: "user-123",
+   *   watchers: ["user-456", "user-789"]
+   * });
+   *
+   * if (!result.valid) {
+   *   console.log(result.errors);
+   *   // [{ attribute: "assignee", message: "User not found", invalidIds: ["user-123"] }]
+   * }
+   * ```
+   */
+  async validateUsers(schema, data) {
+    const errors = [];
+    const userAttrs = schema.attributes.filter(
+      (attr) => attr.type === "user"
+    );
+    for (const attr of userAttrs) {
+      const value = data[attr.name];
+      if (value === void 0 || value === null) {
+        continue;
+      }
+      const attrErrors = await this.validateUserAttribute(attr, value);
+      errors.push(...attrErrors);
+    }
+    return {
+      valid: errors.length === 0,
+      errors
+    };
+  }
+  /**
+   * Validate a single user attribute value
+   */
+  async validateUserAttribute(attr, value) {
+    const errors = [];
+    const ids = this.extractIds(attr, value);
+    if (ids.length === 0) {
+      return errors;
+    }
+    const invalidIds = [];
+    const roleErrors = [];
+    for (const id of ids) {
+      const user = await this.adapter.userProfiles.findById(id);
+      if (!user) {
+        invalidIds.push(id);
+        continue;
+      }
+      if (user.tenantId !== this.tenantId) {
+        invalidIds.push(id);
+        continue;
+      }
+      if (attr.allowedRoles && attr.allowedRoles.length > 0) {
+        if (!attr.allowedRoles.includes(user.role)) {
+          roleErrors.push(id);
+        }
+      }
+    }
+    if (invalidIds.length > 0) {
+      errors.push({
+        attribute: attr.name,
+        message: `Invalid or non-existent users for ${attr.label}`,
+        invalidIds
+      });
+    }
+    if (roleErrors.length > 0) {
+      errors.push({
+        attribute: attr.name,
+        message: `Users do not have required role for ${attr.label}. Allowed roles: ${attr.allowedRoles?.join(", ")}`,
+        invalidIds: roleErrors
+      });
+    }
+    return errors;
+  }
+  /**
+   * Extract IDs from user value based on multiple flag
+   */
+  extractIds(attr, value) {
+    if (attr.multiple) {
+      if (!Array.isArray(value)) {
+        return [];
+      }
+      return value.filter((v) => typeof v === "string" && v !== "");
+    }
+    if (typeof value === "string" && value !== "") {
+      return [value];
+    }
+    return [];
+  }
+  /**
+   * Validate users and throw if invalid
+   */
+  async validateUsersOrThrow(schema, data) {
+    const result = await this.validateUsers(schema, data);
+    if (!result.valid) {
+      const errors = result.errors.map((e) => ({
+        path: [e.attribute],
+        message: e.message
+      }));
+      throw new ValidationError("User validation failed", errors);
+    }
+  }
+};
+
 // src/runtime/services/record.service.ts
 var RecordService = class {
   constructor(adapter, tenantId, options) {
@@ -4433,6 +4858,7 @@ var RecordService = class {
     this.tenantId = tenantId;
     this.schemaService = new ObjectSchemaService(adapter, registry);
     this.relationService = new RelationService(adapter, registry);
+    this.userService = new UserService(adapter, tenantId);
     this.hookRegistry = options?.hookRegistry ?? new NoopHookRegistry();
     this.permissionService = options?.permissionService;
     this.auditService = options?.auditService ?? (adapter.audit ? new AuditService(adapter, tenantId) : void 0);
@@ -4573,6 +4999,9 @@ var RecordService = class {
       if (!options?.skipRelationValidation) {
         await this.relationService.validateRelationsOrThrow(schema, data);
       }
+      if (!options?.skipUserValidation) {
+        await this.userService.validateUsersOrThrow(schema, data);
+      }
     }
     const completionStatus = computeRecordStatus(schema, data);
     const label = await this.computeLabel(schema, data);
@@ -4684,6 +5113,9 @@ var RecordService = class {
       if (!options?.skipRelationValidation) {
         await this.relationService.validateRelationsOrThrow(schema, data);
       }
+      if (!options?.skipUserValidation) {
+        await this.userService.validateUsersOrThrow(schema, data);
+      }
     }
     const completionStatus = computeRecordStatus(schema, mergedData);
     const label = await this.computeLabel(schema, mergedData);
@@ -5341,7 +5773,7 @@ var ViewService = class {
       throw new NotFoundError("View", viewId);
     }
     if (dbView.system) {
-      throw new ProtectedResourceError("attribute", dbView.name, "modify");
+      throw new ProtectedResourceError("view", dbView.name, "modify");
     }
     const updated = await this.adapter.views.update(viewId, {
       label: input.label,
@@ -5364,7 +5796,7 @@ var ViewService = class {
       throw new NotFoundError("View", viewId);
     }
     if (dbView.system) {
-      throw new ProtectedResourceError("attribute", dbView.name, "delete");
+      throw new ProtectedResourceError("view", dbView.name, "delete");
     }
     await this.adapter.views.delete(viewId);
   }
@@ -5790,6 +6222,7 @@ var NoopGeocodingAdapter = class {
   RecordService,
   RelationService,
   UserProfileService,
+  UserService,
   ViewService,
   buildAuditChanges,
   createMockAdapter,