@yunsoft/yuncms-core 0.1.1 → 0.1.2

package/src/services/fields-service.js

@@ -10,7 +10,15 @@ import { BaseService } from './base-service.js';
 import { assertSchemaManager } from './schema-access.js';
 
 const FIELD_METADATA_KEYS = new Set(['readonly', 'hidden', 'sort', 'interface', 'options']);
-const FIELD_PHYSICAL_KEYS = new Set(['required', 'defaultValue', 'removeDefault', 'indexed']);
+const FIELD_PHYSICAL_KEYS = new Set([
+  'required',
+  'defaultValue',
+  'removeDefault',
+  'defaultPreset',
+  'removeDefaultPreset',
+  'autoUpdate',
+  'indexed',
+]);
 
 function assertFieldName(field) {
   assertIdentifier(field, 'field name');
@@ -18,11 +26,15 @@ function assertFieldName(field) {
   return field;
 }
 
+function invalidSchemaPayload(message) {
+  const error = new Error(message);
+  error.code = 'INVALID_SCHEMA_PAYLOAD';
+  return error;
+}
+
 function assertFieldMetadataPatch(patch) {
   if (!patch || typeof patch !== 'object' || Array.isArray(patch)) {
-    const error = new Error('Field metadata patch must be an object');
-    error.code = 'INVALID_SCHEMA_PAYLOAD';
-    throw error;
+    throw invalidSchemaPayload('Field metadata patch must be an object');
   }
   for (const key of Object.keys(patch)) {
     if (!FIELD_METADATA_KEYS.has(key)) {
@@ -32,23 +44,17 @@ function assertFieldMetadataPatch(patch) {
     }
   }
   if (Object.keys(patch).length === 0) {
-    const error = new Error('Field metadata patch cannot be empty');
-    error.code = 'INVALID_SCHEMA_PAYLOAD';
-    throw error;
+    throw invalidSchemaPayload('Field metadata patch cannot be empty');
   }
 }
 
 function assertPhysicalPatch(patch) {
   if (!patch || typeof patch !== 'object' || Array.isArray(patch)) {
-    const error = new Error('Physical field patch must be an object');
-    error.code = 'INVALID_SCHEMA_PAYLOAD';
-    throw error;
+    throw invalidSchemaPayload('Physical field patch must be an object');
   }
   const keys = Object.keys(patch);
   if (keys.length === 0) {
-    const error = new Error('Physical field patch cannot be empty');
-    error.code = 'INVALID_SCHEMA_PAYLOAD';
-    throw error;
+    throw invalidSchemaPayload('Physical field patch cannot be empty');
   }
   for (const key of keys) {
     if (!FIELD_PHYSICAL_KEYS.has(key)) {
@@ -58,24 +64,30 @@ function assertPhysicalPatch(patch) {
     }
   }
   if (Object.hasOwn(patch, 'required') && typeof patch.required !== 'boolean') {
-    const error = new Error('required must be boolean');
-    error.code = 'INVALID_SCHEMA_PAYLOAD';
-    throw error;
+    throw invalidSchemaPayload('required must be boolean');
   }
   if (Object.hasOwn(patch, 'indexed') && typeof patch.indexed !== 'boolean') {
-    const error = new Error('indexed must be boolean');
-    error.code = 'INVALID_SCHEMA_PAYLOAD';
-    throw error;
+    throw invalidSchemaPayload('indexed must be boolean');
   }
-  if (Object.hasOwn(patch, 'removeDefault') && patch.removeDefault !== true) {
-    const error = new Error('removeDefault must be true when provided');
-    error.code = 'INVALID_SCHEMA_PAYLOAD';
-    throw error;
+  if (Object.hasOwn(patch, 'autoUpdate') && typeof patch.autoUpdate !== 'boolean') {
+    throw invalidSchemaPayload('autoUpdate must be boolean');
+  }
+  for (const key of ['removeDefault', 'removeDefaultPreset']) {
+    if (Object.hasOwn(patch, key) && patch[key] !== true) {
+      throw invalidSchemaPayload(`${key} must be true when provided`);
+    }
+  }
+  if (Object.hasOwn(patch, 'defaultPreset') && patch.defaultPreset !== 'now') {
+    throw invalidSchemaPayload('defaultPreset currently supports only now');
+  }
+  if (Object.hasOwn(patch, 'defaultValue') && Object.hasOwn(patch, 'defaultPreset')) {
+    throw invalidSchemaPayload('defaultValue and defaultPreset cannot be used together');
   }
   if (Object.hasOwn(patch, 'defaultValue') && patch.removeDefault === true) {
-    const error = new Error('defaultValue and removeDefault cannot be used together');
-    error.code = 'INVALID_SCHEMA_PAYLOAD';
-    throw error;
+    throw invalidSchemaPayload('defaultValue and removeDefault cannot be used together');
+  }
+  if (Object.hasOwn(patch, 'defaultPreset') && patch.removeDefaultPreset === true) {
+    throw invalidSchemaPayload('defaultPreset and removeDefaultPreset cannot be used together');
   }
 }
 
@@ -89,15 +101,26 @@ function parseSchemaMetadata(value) {
   }
 }
 
+function assertFieldNotSystemManaged(field) {
+  if (parseSchemaMetadata(field?.schema_metadata).systemManaged === true) {
+    const error = new Error(`System-managed field cannot be changed directly: ${field.collection}.${field.field}`);
+    error.code = 'SYSTEM_SCHEMA_READ_ONLY';
+    throw error;
+  }
+}
+
 function fieldInputFromMetadata(field, schemaMetadata) {
   const input = {
     type: field.type,
     required: Boolean(field.required),
+    interface: field.interface ?? null,
   };
   if (schemaMetadata.length !== undefined && field.type === 'string') input.length = schemaMetadata.length;
   if (schemaMetadata.precision !== undefined && field.type === 'decimal') input.precision = schemaMetadata.precision;
   if (schemaMetadata.scale !== undefined && field.type === 'decimal') input.scale = schemaMetadata.scale;
   if (Object.hasOwn(schemaMetadata, 'defaultValue')) input.defaultValue = schemaMetadata.defaultValue;
+  if (schemaMetadata.defaultPreset !== undefined) input.defaultPreset = schemaMetadata.defaultPreset;
+  if (schemaMetadata.autoUpdate === true) input.autoUpdate = true;
   return input;
 }
 
@@ -246,6 +269,7 @@ export class FieldsService extends BaseService {
         error.code = 'FIELD_NOT_FOUND';
         throw error;
       }
+      assertFieldNotSystemManaged(existing);
 
       return withConnectionTransaction(connection, async () => {
         const updated = await metadata.updateFieldMetadata(collection, field, patch);
@@ -288,6 +312,7 @@ export class FieldsService extends BaseService {
         error.code = 'FIELD_NOT_FOUND';
         throw error;
       }
+      assertFieldNotSystemManaged(existing);
 
       const relation = relations.find((candidate) =>
         candidate.many_collection === collection && candidate.many_field === field);
@@ -301,8 +326,18 @@ export class FieldsService extends BaseService {
       const currentMetadata = parseSchemaMetadata(existing.schema_metadata);
       const currentInput = fieldInputFromMetadata(existing, currentMetadata);
       const nextInput = { ...currentInput, required: nextRequired };
+
       if (patch.removeDefault === true) delete nextInput.defaultValue;
-      else if (Object.hasOwn(patch, 'defaultValue')) nextInput.defaultValue = patch.defaultValue;
+      if (patch.removeDefaultPreset === true) delete nextInput.defaultPreset;
+      if (Object.hasOwn(patch, 'defaultValue')) {
+        nextInput.defaultValue = patch.defaultValue;
+        delete nextInput.defaultPreset;
+      }
+      if (Object.hasOwn(patch, 'defaultPreset')) {
+        nextInput.defaultPreset = patch.defaultPreset;
+        delete nextInput.defaultValue;
+      }
+      if (Object.hasOwn(patch, 'autoUpdate')) nextInput.autoUpdate = patch.autoUpdate;
 
       const currentCompiled = compileFieldColumn(currentInput);
       const nextCompiled = compileFieldColumn(nextInput);
@@ -410,6 +445,7 @@ export class FieldsService extends BaseService {
         error.code = 'FIELD_NOT_FOUND';
         throw error;
       }
+      assertFieldNotSystemManaged(existing);
 
       const blockingRelation = relations.find((relation) =>
         (relation.many_collection === collection && relation.many_field === field) ||

package/src/services/files-service.js

@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto';
 
 import { BaseService } from './base-service.js';
+import { resolveSystemResourceAccess } from './system-resource-access.js';
 
 function fileError(code, message) {
   const error = new Error(message);
@@ -8,11 +9,6 @@ function fileError(code, message) {
   return error;
 }
 
-function assertFileManager(accountability) {
-  if (accountability.admin === true || accountability.system === true) return;
-  throw fileError('FORBIDDEN', 'File management requires administrator accountability in V1');
-}
-
 function normalizeFilename(value) {
   if (typeof value !== 'string') throw fileError('INVALID_PAYLOAD', 'Download filename is required');
   const filename = value.trim();
@@ -60,28 +56,32 @@ export class FilesService extends BaseService {
     });
   }
 
-  async readMany() {
-    assertFileManager(this.accountability);
+  async #readOneUnsafe(id) {
     const [rows] = await this.database.query(
       `SELECT id, storage, filename_disk, filename_download, title, mimetype, filesize,
               uploaded_by, uploaded_at, metadata
        FROM yuncms_files
-       ORDER BY uploaded_at DESC, id DESC`,
+       WHERE id = ?
+       LIMIT 1`,
+      [id],
     );
-    return rows.map(normalizeRow);
+    return normalizeRow(rows[0]);
   }
 
-  async readOne(id) {
-    assertFileManager(this.accountability);
+  async readMany() {
+    await resolveSystemResourceAccess(this, 'read', 'yuncms_files');
     const [rows] = await this.database.query(
       `SELECT id, storage, filename_disk, filename_download, title, mimetype, filesize,
               uploaded_by, uploaded_at, metadata
        FROM yuncms_files
-       WHERE id = ?
-       LIMIT 1`,
-      [id],
+       ORDER BY uploaded_at DESC, id DESC`,
     );
-    return normalizeRow(rows[0]);
+    return rows.map(normalizeRow);
+  }
+
+  async readOne(id) {
+    await resolveSystemResourceAccess(this, 'read', 'yuncms_files');
+    return this.#readOneUnsafe(id);
   }
 
   async createOne({
@@ -92,7 +92,7 @@ export class FilesService extends BaseService {
     storage = 'local',
     metadata = null,
   } = {}) {
-    assertFileManager(this.accountability);
+    await resolveSystemResourceAccess(this, 'create', 'yuncms_files');
     if (!Buffer.isBuffer(contents) && !(contents instanceof Uint8Array)) {
       throw fileError('INVALID_FILE_CONTENT', 'File contents must be Buffer or Uint8Array');
     }
@@ -124,7 +124,7 @@ export class FilesService extends BaseService {
           metadata == null ? null : JSON.stringify(metadata),
         ],
       );
-      const file = await this.readOne(id);
+      const file = await this.#readOneUnsafe(id);
       await this.action('files.create', {
         key: id,
         item: file,
@@ -144,7 +144,8 @@ export class FilesService extends BaseService {
   }
 
   async readContent(id) {
-    const file = await this.readOne(id);
+    await resolveSystemResourceAccess(this, 'read', 'yuncms_files');
+    const file = await this.#readOneUnsafe(id);
     if (!file) throw fileError('FILE_NOT_FOUND', `Unknown file: ${id}`);
     const driver = this.storage.get(file.storage);
     const contents = await driver.get(file.filename_disk);
@@ -152,7 +153,7 @@ export class FilesService extends BaseService {
   }
 
   async updateOne(id, patch = {}) {
-    assertFileManager(this.accountability);
+    await resolveSystemResourceAccess(this, 'update', 'yuncms_files');
     if (!patch || typeof patch !== 'object' || Array.isArray(patch)) {
       throw fileError('INVALID_PAYLOAD', 'File metadata patch must be an object');
     }
@@ -161,7 +162,7 @@ export class FilesService extends BaseService {
       throw fileError('INVALID_PAYLOAD', 'File update supports filenameDownload, title and metadata only');
     }
 
-    const before = await this.readOne(id);
+    const before = await this.#readOneUnsafe(id);
     if (!before) throw fileError('FILE_NOT_FOUND', `Unknown file: ${id}`);
 
     const assignments = [];
@@ -185,7 +186,7 @@ export class FilesService extends BaseService {
       params,
     );
     if (result.affectedRows !== 1) throw fileError('FILE_NOT_FOUND', `Unknown file: ${id}`);
-    const file = await this.readOne(id);
+    const file = await this.#readOneUnsafe(id);
     await this.action('files.update', {
       key: id,
       before,
@@ -196,8 +197,8 @@ export class FilesService extends BaseService {
   }
 
   async deleteOne(id) {
-    assertFileManager(this.accountability);
-    const file = await this.readOne(id);
+    await resolveSystemResourceAccess(this, 'delete', 'yuncms_files');
+    const file = await this.#readOneUnsafe(id);
     if (!file) throw fileError('FILE_NOT_FOUND', `Unknown file: ${id}`);
 
     const [result] = await this.database.query('DELETE FROM yuncms_files WHERE id = ?', [id]);

package/src/services/items-service.js

@@ -9,6 +9,7 @@ import {
   parseItemsQuery,
 } from '../query.js';
 import { SchemaCache } from '../schema.js';
+import { isSystemManagedField, systemMutationEntries } from '../system-fields.js';
 import { withTransaction } from '../transaction.js';
 import { BaseService } from './base-service.js';
 import { PermissionsService } from './permissions-service.js';
@@ -74,6 +75,10 @@ function createCandidateRecord(schema, id, entries) {
       continue;
     }
     const metadata = parseMetadata(fieldSchema.schema_metadata);
+    if (metadata.defaultPreset === 'now') {
+      candidate[fieldSchema.field] = new Date();
+      continue;
+    }
     candidate[fieldSchema.field] = Object.hasOwn(metadata, 'defaultValue')
       ? metadata.defaultValue
       : null;
@@ -82,6 +87,10 @@ function createCandidateRecord(schema, id, entries) {
   return candidate;
 }
 
+function mergeSystemEntries(entries, schema, accountability, operation, now = new Date()) {
+  return [...entries, ...systemMutationEntries(schema, accountability, operation, now)];
+}
+
 export class ItemsService extends BaseService {
   constructor(collection, options = {}) {
     super(options);
@@ -114,6 +123,12 @@ export class ItemsService extends BaseService {
     if (!collectionSchema) {
       throw serviceError('COLLECTION_NOT_FOUND', `Unknown collection: ${this.collection}`);
     }
+    if (collectionSchema.system) {
+      throw serviceError(
+        'SYSTEM_COLLECTION_USE_DEDICATED_SERVICE',
+        `System collection ${this.collection} must be accessed through its dedicated service`,
+      );
+    }
     return collectionSchema;
   }
 
@@ -150,8 +165,9 @@ export class ItemsService extends BaseService {
       for (const fieldSchema of Object.values(schema.fields)) {
         if (!fieldSchema.required || fieldSchema.field === schema.primary_key) continue;
         if (Object.hasOwn(payload, fieldSchema.field)) continue;
+        if (isSystemManagedField(fieldSchema)) continue;
         const metadata = parseMetadata(fieldSchema.schema_metadata);
-        if (Object.hasOwn(metadata, 'defaultValue')) continue;
+        if (Object.hasOwn(metadata, 'defaultValue') || metadata.defaultPreset != null) continue;
         throw serviceError('REQUIRED_FIELD_MISSING', `Required field is missing: ${fieldSchema.field}`, fieldSchema.field);
       }
     }
@@ -230,7 +246,8 @@ export class ItemsService extends BaseService {
     const schema = await this.getCollectionSchema();
     const permission = await this.resolvePermission('create');
     const filteredPayload = await this.filterMutation('items.create', payload, { operation: 'create' });
-    const entries = this.validatePayload(filteredPayload, schema, permission, { creating: true });
+    const callerEntries = this.validatePayload(filteredPayload, schema, permission, { creating: true });
+    const entries = mergeSystemEntries(callerEntries, schema, this.accountability, 'create');
     const id = randomUUID();
     const candidate = createCandidateRecord(schema, id, entries);
     enforcePermissionValidation(candidate, permission.validation, schema);
@@ -264,7 +281,8 @@ export class ItemsService extends BaseService {
         operation: 'create',
         bulk: true,
       });
-      const entries = this.validatePayload(filteredPayload, schema, permission, { creating: true });
+      const callerEntries = this.validatePayload(filteredPayload, schema, permission, { creating: true });
+      const entries = mergeSystemEntries(callerEntries, schema, this.accountability, 'create');
       const id = randomUUID();
       const candidate = createCandidateRecord(schema, id, entries);
       enforcePermissionValidation(candidate, permission.validation, schema);
@@ -306,8 +324,10 @@ export class ItemsService extends BaseService {
       operation: 'update',
       key: id,
     });
-    const entries = this.validatePayload(filteredPayload, schema, permission);
-    if (entries.length === 0) throw serviceError('INVALID_PAYLOAD', 'Update payload cannot be empty');
+    const callerEntries = this.validatePayload(filteredPayload, schema, permission);
+    if (callerEntries.length === 0) throw serviceError('INVALID_PAYLOAD', 'Update payload cannot be empty');
+    const entries = mergeSystemEntries(callerEntries, schema, this.accountability, 'update');
+    const effectiveChanges = Object.fromEntries(entries);
 
     const table = quoteIdentifier(this.collection, 'collection name');
     const filter = combineCompiledFilters(
@@ -322,7 +342,7 @@ export class ItemsService extends BaseService {
       );
       const current = currentRows[0];
       if (!current) return null;
-      enforcePermissionValidation({ ...current, ...filteredPayload }, permission.validation, schema);
+      enforcePermissionValidation({ ...current, ...effectiveChanges }, permission.validation, schema);
     }
 
     const setSql = entries.map(([field]) => `${quoteIdentifier(field, 'field name')} = ?`).join(', ');
@@ -336,7 +356,7 @@ export class ItemsService extends BaseService {
     await this.actionMutation('items.update', {
       key: id,
       item: record,
-      changes: filteredPayload,
+      changes: effectiveChanges,
     }, { operation: 'update' });
     return record;
   }
@@ -354,8 +374,10 @@ export class ItemsService extends BaseService {
       bulk: true,
       filter: filterInput,
     });
-    const entries = this.validatePayload(filteredPayload, schema, permission);
-    if (entries.length === 0) throw serviceError('INVALID_PAYLOAD', 'Update payload cannot be empty');
+    const callerEntries = this.validatePayload(filteredPayload, schema, permission);
+    if (callerEntries.length === 0) throw serviceError('INVALID_PAYLOAD', 'Update payload cannot be empty');
+    const entries = mergeSystemEntries(callerEntries, schema, this.accountability, 'update');
+    const effectiveChanges = Object.fromEntries(entries);
     const filter = this.compileActionFilters(filterInput, permission.filter, accessSchema, schema);
     const table = quoteIdentifier(this.collection, 'collection name');
 
@@ -371,7 +393,7 @@ export class ItemsService extends BaseService {
         );
       }
       for (const row of rows) {
-        enforcePermissionValidation({ ...row, ...filteredPayload }, permission.validation, schema);
+        enforcePermissionValidation({ ...row, ...effectiveChanges }, permission.validation, schema);
       }
     }
 
@@ -382,7 +404,7 @@ export class ItemsService extends BaseService {
     );
     await this.actionMutation('items.update', {
       filter: filterInput,
-      changes: filteredPayload,
+      changes: effectiveChanges,
       affected: result.affectedRows,
     }, { operation: 'update', bulk: true });
     return result.affectedRows;
@@ -442,4 +464,4 @@ export class ItemsService extends BaseService {
   }
 }
 
-export { MAX_BULK_VALIDATION_ROWS, createCandidateRecord };
+export { MAX_BULK_VALIDATION_ROWS, createCandidateRecord };

package/src/services/permissions-service.js

@@ -3,6 +3,11 @@ import { randomUUID } from 'node:crypto';
 import { assertPermissionValidationRule } from '../permission-validation.js';
 import { compileFilter } from '../query.js';
 import { SchemaCache } from '../schema.js';
+import {
+  assertActionOnlyPermissionPayload,
+  assertSystemResourceAction,
+  isPermissionManagedSystemResource,
+} from '../system-permissions.js';
 import { BaseService } from './base-service.js';
 
 const ACTIONS = new Set(['create', 'read', 'update', 'delete']);
@@ -81,6 +86,17 @@ export class PermissionsService extends BaseService {
     this.schemaCache = options.schemaCache ?? defaultSchemaCache;
   }
 
+  async #collectionSchema(collection) {
+    const snapshot = this.schema ?? await this.schemaCache.get(this.database);
+    const collectionSchema = snapshot.collections?.[collection];
+    if (!collectionSchema) {
+      const error = new Error(`Unknown permission collection: ${collection}`);
+      error.code = 'COLLECTION_NOT_FOUND';
+      throw error;
+    }
+    return collectionSchema;
+  }
+
   async resolve(action, collection) {
     assertAction(action);
     const key = cacheKey(this.accountability, action, collection);
@@ -102,6 +118,19 @@ export class PermissionsService extends BaseService {
         throw forbidden(`No role is available for ${action} access to ${collection}`);
       }
 
+      const collectionSchema = await this.#collectionSchema(collection);
+      if (collectionSchema.system) {
+        if (!isPermissionManagedSystemResource(collectionSchema)) {
+          throw forbidden(`System resource is not delegatable: ${collection}`);
+        }
+        try {
+          assertSystemResourceAction(collectionSchema, action);
+        } catch (error) {
+          if (error.code === 'SYSTEM_PERMISSION_ACTION_PROTECTED') throw forbidden(error.message);
+          throw error;
+        }
+      }
+
       const [rows] = await this.database.query(
         `SELECT id, role, collection, action, fields, filter, validation
          FROM yuncms_permissions
@@ -154,17 +183,6 @@ export class PermissionsService extends BaseService {
     return normalizePermissionRow(rows[0]);
   }
 
-  async #collectionSchema(collection) {
-    const snapshot = this.schema ?? await this.schemaCache.get(this.database);
-    const collectionSchema = snapshot.collections?.[collection];
-    if (!collectionSchema) {
-      const error = new Error(`Unknown permission collection: ${collection}`);
-      error.code = 'COLLECTION_NOT_FOUND';
-      throw error;
-    }
-    return collectionSchema;
-  }
-
   async createOne(input = {}) {
     assertPermissionManager(this.accountability);
     const action = assertAction(input.action);
@@ -180,6 +198,16 @@ export class PermissionsService extends BaseService {
     }
 
     const collectionSchema = await this.#collectionSchema(input.collection);
+    if (collectionSchema.system) {
+      if (!isPermissionManagedSystemResource(collectionSchema)) {
+        const error = new Error(`System resource permissions are protected: ${input.collection}`);
+        error.code = 'SYSTEM_PERMISSION_RESOURCE_PROTECTED';
+        throw error;
+      }
+      assertSystemResourceAction(collectionSchema, action);
+      assertActionOnlyPermissionPayload(collectionSchema, input);
+    }
+
     const fields = normalizePermissionFields(input.fields ?? null, collectionSchema);
     const filter = input.filter ?? null;
     const validation = input.validation ?? null;
@@ -187,14 +215,20 @@ export class PermissionsService extends BaseService {
     assertPermissionValidationRule(validation, collectionSchema);
 
     const [roleRows] = await this.database.query(
-      'SELECT id FROM yuncms_roles WHERE id = ? LIMIT 1',
+      'SELECT id, admin, public FROM yuncms_roles WHERE id = ? LIMIT 1',
       [input.role],
     );
-    if (!roleRows[0]) {
+    const role = roleRows[0];
+    if (!role) {
       const error = new Error(`Unknown permission role: ${input.role}`);
       error.code = 'ROLE_NOT_FOUND';
       throw error;
     }
+    if (collectionSchema.system && role.public) {
+      const error = new Error('Public role cannot be granted access to protected system resources');
+      error.code = 'PUBLIC_SYSTEM_ACCESS_FORBIDDEN';
+      throw error;
+    }
 
     const id = randomUUID();
     await this.database.query(
@@ -235,6 +269,7 @@ export class PermissionsService extends BaseService {
       throw error;
     }
     const collectionSchema = await this.#collectionSchema(existing.collection);
+    if (collectionSchema.system) assertActionOnlyPermissionPayload(collectionSchema, patch);
 
     const assignments = [];
     const params = [];

package/src/services/roles-service.js

@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto';
 
 import { BaseService } from './base-service.js';
+import { resolveSystemResourceAccess } from './system-resource-access.js';
 
 function assertRoleManager(accountability) {
   if (accountability.admin === true || accountability.system === true) return;
@@ -26,7 +27,7 @@ function normalizeRoleName(name) {
 
 export class RolesService extends BaseService {
   async readMany() {
-    assertRoleManager(this.accountability);
+    await resolveSystemResourceAccess(this, 'read', 'yuncms_roles');
     const [rows] = await this.database.query(
       `SELECT id, name, description, admin, public, created_at, updated_at
        FROM yuncms_roles
@@ -36,7 +37,7 @@ export class RolesService extends BaseService {
   }
 
   async readOne(id) {
-    assertRoleManager(this.accountability);
+    await resolveSystemResourceAccess(this, 'read', 'yuncms_roles');
     const [rows] = await this.database.query(
       `SELECT id, name, description, admin, public, created_at, updated_at
        FROM yuncms_roles
@@ -157,4 +158,4 @@ export class RolesService extends BaseService {
     }
     return true;
   }
-}
+}

package/src/services/sessions-service.js

@@ -20,6 +20,7 @@ function identityFromRow(row) {
   return {
     user: row.user,
     role: row.role ?? null,
+    role_name: row.role_name ?? null,
     admin: Boolean(row.role_admin),
     email: row.email,
     session: row.session_id,
@@ -71,7 +72,7 @@ export class SessionsService extends BaseService {
     const hash = hashToken(token);
     const [rows] = await this.database.query(
       `SELECT s.id AS session_id, s.user, u.email, u.role, u.status,
-              r.admin AS role_admin
+              r.name AS role_name, r.admin AS role_admin
        FROM yuncms_sessions s
        INNER JOIN yuncms_users u ON u.id = s.user
        LEFT JOIN yuncms_roles r ON r.id = u.role
@@ -105,7 +106,7 @@ export class SessionsService extends BaseService {
     const oldHash = hashToken(token);
     const [rows] = await this.database.query(
       `SELECT s.id AS session_id, s.user, u.email, u.role, u.status,
-              r.admin AS role_admin
+              r.name AS role_name, r.admin AS role_admin
        FROM yuncms_sessions s
        INNER JOIN yuncms_users u ON u.id = s.user
        LEFT JOIN yuncms_roles r ON r.id = u.role
@@ -164,7 +165,6 @@ export class SessionsService extends BaseService {
       error.code = 'FORBIDDEN';
       throw error;
     }
-
     const [result] = await this.database.query(
       'DELETE FROM yuncms_sessions WHERE user = ?',
       [userId],

package/src/services/system-resource-access.js

@@ -0,0 +1,23 @@
+import { PermissionsService } from './permissions-service.js';
+
+export async function resolveSystemResourceAccess(service, action, collection) {
+  if (service.accountability.admin === true || service.accountability.system === true) {
+    return {
+      fullAccess: true,
+      action,
+      collection,
+      role: service.accountability.role ?? null,
+    };
+  }
+
+  const permissions = new PermissionsService({
+    accountability: service.accountability,
+    database: service.database,
+    schema: service.schema,
+    emitter: service.emitter,
+    logger: service.logger,
+    permissionCache: service.permissionCache,
+    requestId: service.requestId,
+  });
+  return permissions.resolve(action, collection);
+}