@svadmin/core 0.15.0 → 0.16.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/core",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Core SDK — hooks, types, context, i18n, permissions, router",
   "type": "module",
   "sideEffects": false,

package/src/context.svelte.ts

@@ -8,7 +8,7 @@ import type { RouterProvider } from './router-provider';
 
 /**
  * Accepts either:
- *   - A single DataProvider (backwards compatible)
+ *   - A single DataProvider
  *   - A record of named providers: { default: rest, cms: graphql }
  */
 export type DataProviderInput = DataProvider | Record<string, DataProvider>;

package/src/form-hooks.svelte.ts

@@ -125,8 +125,8 @@ export interface UseFormReturn<
   readonly autoSave: { status: 'idle' | 'saving' | 'saved' | 'error'; data: unknown; error: unknown };
 
   // ─── Raw query/mutation (escape hatch) ────────────────────────
-  readonly query: ReturnType<typeof createQuery> | null;
-  readonly mutation: ReturnType<typeof createMutation>;
+  readonly query: unknown;
+  readonly mutation: unknown;
 }
 
 // ─── Implementation ──────────────────────────────────────────────────
@@ -423,6 +423,6 @@ export function useForm<
 
     // Raw escape hatches
     query,
-    mutation: (action === 'edit' ? updateMut : createMut) as unknown as ReturnType<typeof createMutation>,
+    mutation: action === 'edit' ? updateMut : createMut,
   };
 }

package/src/hook-utils.svelte.ts

@@ -97,6 +97,7 @@ export function fireSuccessNotification(
   resource?: string,
 ): void {
   if (config === false) return;
+  if (!config && !defaultMessage) return;
   if (typeof config === 'function') {
     const result = config(data, values, resource);
     toast.success(result.message);

package/src/i18n.svelte.ts

@@ -163,6 +163,27 @@ const locales: Record<string, Locale> = {
     'settings.dataProvider': '数据源',
     'settings.currentEnvironment': '当前环境',
     'settings.settingsDescription': '管理您的账户和界面偏好。',
+    'settings.rolesAndPermissions': '角色与权限',
+    'settings.roles': '角色',
+    'settings.rolesDescription': '管理系统访问控制与资源权限。',
+    'settings.rbacNotSupported': '当前数据源不支持 RBAC 管理',
+    'settings.selectRoleHint': '请在左侧选择一个角色以查看权限',
+    'settings.resource': '资源',
+    'resource.posts': '文章',
+    'resource.users': '用户',
+    'resource.categories': '分类',
+    // Audit
+    'settings.auditLogs': '操作日志',
+    'settings.auditDescription': '追踪和审查所有系统操作，用于合规与调试。',
+    'settings.auditNotSupported': '当前数据源不支持操作日志',
+    'settings.searchLogs': '搜索用户、操作或资源...',
+    'settings.auditTime': '时间',
+    'settings.auditUser': '操作人',
+    'settings.auditAction': '操作',
+    'settings.auditResource': '资源',
+    'settings.auditIp': 'IP 地址',
+    'settings.auditTotal': '条记录',
+    'settings.auditSnapshot': '变更快照',
     // Profile
     'profile.title': '个人资料',
     'profile.name': '姓名',
@@ -332,6 +353,27 @@ const locales: Record<string, Locale> = {
     'settings.dataProvider': 'Data Provider',
     'settings.currentEnvironment': 'Current Environment',
     'settings.settingsDescription': 'Manage your account and interface preferences.',
+    'settings.rolesAndPermissions': 'Roles & Permissions',
+    'settings.roles': 'Roles',
+    'settings.rolesDescription': 'Manage system access control and resource permissions.',
+    'settings.rbacNotSupported': 'RBAC management is not supported by the current data provider',
+    'settings.selectRoleHint': 'Select a role on the left to view permissions',
+    'settings.resource': 'Resource',
+    'resource.posts': 'Posts',
+    'resource.users': 'Users',
+    'resource.categories': 'Categories',
+    // Audit
+    'settings.auditLogs': 'Audit Logs',
+    'settings.auditDescription': 'Track and review all system operations for compliance and debugging.',
+    'settings.auditNotSupported': 'Audit logs are not supported by the current data provider',
+    'settings.searchLogs': 'Search by user, action, or resource...',
+    'settings.auditTime': 'Time',
+    'settings.auditUser': 'User',
+    'settings.auditAction': 'Action',
+    'settings.auditResource': 'Resource',
+    'settings.auditIp': 'IP Address',
+    'settings.auditTotal': 'total records',
+    'settings.auditSnapshot': 'Change Snapshot',
     // Profile
     'profile.title': 'Profile',
     'profile.name': 'Name',

package/src/index.ts

@@ -27,7 +27,7 @@ export {
 } from './hooks.svelte';
 export { matchRoute, navigate, currentPath, setActiveRouterProvider } from './router';
 export { readURLState, writeURLState } from './url-sync';
-export { setAccessControlProvider, getAccessControlProvider, getAccessControlOptions, canAccess, canAccessAsync } from './permissions';
+export { setAccessControlProvider, getAccessControlProvider, getAccessControlOptions, canAccessAsync } from './permissions';
 export { useLive, useSubscription, usePublish } from './live.svelte';
 export { toast } from './toast.svelte';
 export { notify, closeNotification, setNotificationProvider, getNotificationProvider } from './notification.svelte';
@@ -61,7 +61,7 @@ export type {
   ResourceDefinition, FieldDefinition, MenuItem,
   AuthActionResult, CheckResult,
   ResourceTypeMap, KnownResources, InferData,
-  BaseRecord,
+  BaseRecord, Role, AuditLog
 } from './types';
 export type { InvalidateScope } from './options.svelte';
 export type { LiveProvider, LiveEvent, LiveMode } from './live.svelte';

package/src/permissions.test.ts

@@ -1,6 +1,6 @@
 // Unit tests for permissions module
 import { describe, test, expect, beforeEach } from 'bun:test';
-import { setAccessControlProvider, getAccessControlProvider, getAccessControlOptions, canAccess, canAccessAsync } from './permissions';
+import { setAccessControlProvider, getAccessControlProvider, getAccessControlOptions, canAccessAsync } from './permissions';
 import type { Action, AccessControlProvider } from './permissions';
 
 describe('permissions', () => {
@@ -11,12 +11,6 @@ describe('permissions', () => {
     });
   });
 
-  test('canAccess returns { can: true } when provider is async (warns)', () => {
-    // canAccess is sync but provider.can() is async — should default to { can: true }
-    const result = canAccess('posts', 'list' as Action);
-    expect(result.can).toBe(true);
-  });
-
   test('canAccessAsync respects deny rule', async () => {
     setAccessControlProvider({
       can: async ({ action }) => {

package/src/permissions.ts

@@ -73,17 +73,7 @@ export function getAccessControlOptions() {
 }
 
 /**
- * Synchronous access check. Returns `{ can: true }` if no provider is set.
- * When a provider is registered, this warns since provider.can() is always async.
- */
-export function canAccess(resource: string, action: Action, params?: Record<string, unknown>): CanResult {
-  if (!provider) return { can: true };
-  console.warn('[permissions] canAccess called synchronously but provider.can() is async. Defaulting to { can: true }. Use canAccessAsync() instead.');
-  return { can: true };
-}
-
-/**
- * Async access check. Preferred over `canAccess()`.
+ * Async access check. Returns `{ can: true }` if no provider is registered.
  */
 export async function canAccessAsync(resource: string, action: Action, params?: Record<string, unknown>): Promise<CanResult> {
   if (!provider) return { can: true };

package/src/query-hooks.svelte.ts

@@ -75,7 +75,7 @@ export function useList<TData extends BaseRecord = BaseRecord, TError = HttpErro
   });
 
   $effect(() => {
-    if (query.isSuccess) {
+    if (query.isSuccess && options.successNotification) {
       fireSuccessNotification(options.successNotification, '', query.data, undefined, resource);
     } else if (query.isError) {
       fireErrorNotification(options.errorNotification, 'Fetch failed', query.error);

package/src/router.ts

@@ -53,9 +53,9 @@ export function matchRoute(
 /**
  * Navigate to a path. Uses RouterProvider if available, falls back to hash.
  */
-export function navigate(path: string): void {
+export function navigate(path: string, options?: { replaceState?: boolean }): void {
   if (_routerProvider) {
-    _routerProvider.go({ to: path });
+    _routerProvider.go({ to: path, type: options?.replaceState ? 'replace' : 'push' });
   } else {
     window.location.hash = '#' + path.replace(/^#/, '');
   }

package/src/routing-hooks.svelte.ts

@@ -42,7 +42,6 @@ export function useGo() {
     if (routerProvider?.go) {
       routerProvider.go({ to: targetUrl, type: options.type });
     } else {
-      // @ts-expect-error SvelteKit / internal navigate might only take 1 arg or options obj
       navigate(targetUrl, options.type === 'replace' ? { replaceState: true } : undefined);
     }
   };

package/src/table-hooks.svelte.ts

@@ -69,15 +69,15 @@ export function useTable<
 
   const querySorters = $derived(sortersMode === 'server' ? effectiveSorters : []);
   const queryFilters = $derived(filtersMode === 'server' ? effectiveFilters : []);
-  const queryPagination = paginationMode === 'server'
+  const queryPagination = $derived(paginationMode === 'server'
     ? pagination
-    : { current: 1, pageSize: 999999, mode: paginationMode as 'client' | 'off' };
+    : { current: 1, pageSize: 999999, mode: paginationMode as 'client' | 'off' });
 
   const tableQueryInfo = useList<TQueryFnData, TError>({
     resource,
-    pagination: queryPagination,
-    sorters: querySorters,
-    filters: queryFilters,
+    get pagination() { return queryPagination; },
+    get sorters() { return querySorters; },
+    get filters() { return queryFilters; },
     meta,
     dataProviderName,
     ...restOptions

package/src/types.ts

@@ -213,6 +213,13 @@ export interface CheckResult {
   logout?: boolean;
 }
 
+export interface Role {
+  id: string;
+  name: string;
+  description?: string;
+  [key: string]: unknown;
+}
+
 export interface AuthProvider {
   login: (params: Record<string, unknown>) => Promise<AuthActionResult>;
   logout: (params?: Record<string, unknown>) => Promise<AuthActionResult>;
@@ -224,9 +231,28 @@ export interface AuthProvider {
   updatePassword?: (params: Record<string, unknown>) => Promise<AuthActionResult>;
   /** Update user profile (name, avatar, etc.) */
   updateProfile?: (params: { name?: string; avatar?: string | File; [key: string]: unknown }) => Promise<AuthActionResult>;
+  /** Get list of system roles for RBAC mapping */
+  getRoles?: () => Promise<Role[]>;
+  /** Get specific role permissions as a matrix map, e.g. { "users": ["create", "read"] } */
+  getRolePermissions?: (roleId: string) => Promise<Record<string, string[]>>;
+  /** Update permissions for a specific role */
+  updateRolePermissions?: (roleId: string, permissions: Record<string, string[]>) => Promise<AuthActionResult>;
+  /** Get recent audit logs */
+  getAuditLogs?: (params?: { page?: number; pageSize?: number }) => Promise<{ data: AuditLog[]; total: number }>;
   onError?: (error: unknown) => Promise<{ redirectTo?: string; logout?: boolean }>;
 }
 
+export interface AuditLog {
+  id: string | number;
+  userId?: string | number;
+  userName?: string;
+  action: string;
+  resource?: string;
+  createdAt: string | Date;
+  ipAddress?: string;
+  details?: Record<string, unknown> | string;
+}
+
 // ─── NotificationProvider ─────────────────────────────────────
 
 export interface NotificationProvider {
@@ -291,7 +317,7 @@ export interface FieldDefinition {
   label: string;
   type: 'text' | 'number' | 'boolean' | 'date' | 'select' | 'multiselect' | 'tags'
     | 'textarea' | 'richtext' | 'image' | 'images' | 'json' | 'relation' | 'color'
-    | 'url' | 'email' | 'phone' | 'file' | 'markdown' | 'password';
+    | 'url' | 'email' | 'phone' | 'file' | 'markdown' | 'password' | 'array';
   required?: boolean;
   searchable?: boolean;
   sortable?: boolean;
@@ -308,6 +334,8 @@ export interface FieldDefinition {
   resource?: string;       // related resource name
   optionLabel?: string;    // field to use as label
   optionValue?: string;    // field to use as value
+  // Array support
+  subFields?: FieldDefinition[]; // nested fields for array types
   // Validation
   validate?: (value: unknown) => string | null;
   // Grouping
@@ -336,7 +364,7 @@ export interface FieldDefinition {
  */
 export interface ResourceTypeMap {}
 
-/** When ResourceTypeMap is empty → string (backward compatible); otherwise → registered keys */
+/** When ResourceTypeMap is empty → string; otherwise → registered keys */
 export type KnownResources = keyof ResourceTypeMap extends never
   ? string
   : Extract<keyof ResourceTypeMap, string>

package/src/useCan.ts

@@ -22,36 +22,28 @@ export interface UseCanResult {
 
 /**
  * Reactive permission check backed by TanStack Query for caching and deduplication.
+ * Accepts a getter function for Svelte 5 fine-grained reactivity.
  *
  * @example
  * ```ts
- * // Simple usage (backward compatible)
- * const can = useCan('posts', 'delete');
+ * const can = useCan(() => ({ resource: 'posts', action: 'delete', params: { id: 1 } }));
  * if (can.allowed) { ... }
- *
- * // With options object
- * const can = useCan({ resource: 'posts', action: 'delete', params: { id: 1 } });
  * ```
  */
-export function useCan(resourceOrOptions: string | UseCanOptions, action?: Action, params?: Record<string, unknown>): UseCanResult {
-  // Normalize arguments: support both (resource, action, params) and (options) signatures
-  const options: UseCanOptions = typeof resourceOrOptions === 'string'
-    ? { resource: resourceOrOptions, action: action ?? 'list', params }
-    : resourceOrOptions;
-
-  // @tanstack/svelte-query v6 Accessor pattern
-  const query = createQuery<CanResult>(() => ({
-    queryKey: ['useCan', options.resource, options.action, options.params] as const,
-    queryFn: () => canAccessAsync(options.resource, options.action, options.params),
-    enabled: options.queryOptions?.enabled ?? true,
-    staleTime: options.queryOptions?.staleTime ?? 5 * 60 * 1000, // 5 min default cache
-  }));
+export function useCan(options: () => UseCanOptions): UseCanResult {
+  const query = createQuery<CanResult>(() => {
+    const opts = options();
+    return {
+      queryKey: ['useCan', opts.resource, opts.action, opts.params] as const,
+      queryFn: () => canAccessAsync(opts.resource, opts.action, opts.params),
+      enabled: opts.queryOptions?.enabled ?? true,
+      staleTime: opts.queryOptions?.staleTime ?? 5 * 60 * 1000,
+    };
+  });
 
-  // Access via query store — use safe property access with fallbacks
   return {
     get allowed() { return (query.data as CanResult | undefined)?.can ?? true; },
     get reason() { return (query.data as CanResult | undefined)?.reason; },
     get isLoading() { return query.isLoading; },
   };
 }
-