@yunsoft/yuncms-core 0.1.1 → 0.1.3

package/src/schema-metadata-repository.js

@@ -2,6 +2,8 @@ function encodeJson(value) {
   return value == null ? null : JSON.stringify(value);
 }
 
+const FILE_INTERFACES = new Set(['file', 'image']);
+
 export class SchemaMetadataRepository {
   constructor(database) {
     if (!database) throw new Error('Database handle is required');
@@ -10,7 +12,7 @@ export class SchemaMetadataRepository {
 
   async listCollections() {
     const [rows] = await this.database.query(
-      `SELECT collection, primary_key, note, singleton, hidden, \`system\`, metadata, created_at, updated_at
+      `SELECT collection, name, primary_key, note, singleton, hidden, \`system\`, metadata, created_at, updated_at
        FROM yuncms_collections
        ORDER BY collection ASC`,
     );
@@ -19,7 +21,7 @@ export class SchemaMetadataRepository {
 
   async readCollection(collection) {
     const [rows] = await this.database.query(
-      `SELECT collection, primary_key, note, singleton, hidden, \`system\`, metadata, created_at, updated_at
+      `SELECT collection, name, primary_key, note, singleton, hidden, \`system\`, metadata, created_at, updated_at
        FROM yuncms_collections
        WHERE collection = ?
        LIMIT 1`,
@@ -30,6 +32,7 @@ export class SchemaMetadataRepository {
 
   async createCollection({
     collection,
+    name = collection,
     primaryKey = 'id',
     note = null,
     singleton = false,
@@ -39,10 +42,11 @@ export class SchemaMetadataRepository {
   }) {
     await this.database.query(
       `INSERT INTO yuncms_collections
-       (collection, primary_key, note, singleton, hidden, \`system\`, metadata)
-       VALUES (?, ?, ?, ?, ?, ?, ?)`,
+       (collection, name, primary_key, note, singleton, hidden, \`system\`, metadata)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
       [
         collection,
+        name,
         primaryKey,
         note,
         singleton ? 1 : 0,
@@ -58,6 +62,10 @@ export class SchemaMetadataRepository {
     const assignments = [];
     const params = [];
 
+    if (Object.hasOwn(patch, 'name')) {
+      assignments.push('name = ?');
+      params.push(patch.name);
+    }
     if (Object.hasOwn(patch, 'note')) {
       assignments.push('note = ?');
       params.push(patch.note ?? null);
@@ -94,7 +102,7 @@ export class SchemaMetadataRepository {
 
   async listFields(collection) {
     const [rows] = await this.database.query(
-      `SELECT id, collection, field, type, required, readonly, hidden, sort, interface, options, schema_metadata,
+      `SELECT id, collection, field, name, type, required, readonly, hidden, sort, interface, options, schema_metadata,
               created_at, updated_at
        FROM yuncms_fields
        WHERE collection = ?
@@ -106,7 +114,7 @@ export class SchemaMetadataRepository {
 
   async readField(collection, field) {
     const [rows] = await this.database.query(
-      `SELECT id, collection, field, type, required, readonly, hidden, sort, interface, options, schema_metadata,
+      `SELECT id, collection, field, name, type, required, readonly, hidden, sort, interface, options, schema_metadata,
               created_at, updated_at
        FROM yuncms_fields
        WHERE collection = ? AND field = ?
@@ -119,6 +127,7 @@ export class SchemaMetadataRepository {
   async createField({
     collection,
     field,
+    name = field,
     type,
     required = false,
     readonly = false,
@@ -128,13 +137,19 @@ export class SchemaMetadataRepository {
     options = null,
     schemaMetadata = null,
   }) {
+    if (FILE_INTERFACES.has(fieldInterface) && type !== 'uuid') {
+      const error = new Error(`${fieldInterface} interface requires uuid storage`);
+      error.code = 'INVALID_FIELD_INTERFACE';
+      throw error;
+    }
     await this.database.query(
       `INSERT INTO yuncms_fields
-       (collection, field, type, required, readonly, hidden, sort, interface, options, schema_metadata)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+       (collection, field, name, type, required, readonly, hidden, sort, interface, options, schema_metadata)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       [
         collection,
         field,
+        name,
         type,
         required ? 1 : 0,
         readonly ? 1 : 0,
@@ -152,6 +167,20 @@ export class SchemaMetadataRepository {
     const assignments = [];
     const params = [];
 
+    if (Object.hasOwn(patch, 'interface') && FILE_INTERFACES.has(patch.interface)) {
+      const existing = await this.readField(collection, field);
+      if (!existing) return null;
+      if (existing.type !== 'uuid') {
+        const error = new Error(`${patch.interface} interface requires uuid storage`);
+        error.code = 'INVALID_FIELD_INTERFACE';
+        throw error;
+      }
+    }
+
+    if (Object.hasOwn(patch, 'name')) {
+      assignments.push('name = ?');
+      params.push(patch.name);
+    }
     if (Object.hasOwn(patch, 'readonly')) {
       assignments.push('readonly = ?');
       params.push(patch.readonly ? 1 : 0);

package/src/services/auth-service.js

@@ -31,6 +31,7 @@ function publicUser(user) {
     id: user.id,
     email: user.email,
     role: user.role ?? null,
+    role_name: user.role_name ?? null,
     status: user.status,
     email_verified_at: user.email_verified_at ?? null,
   };
@@ -95,7 +96,7 @@ export class AuthService extends BaseService {
     if (tokenType(token) !== 'api') throw invalidToken();
     const [rows] = await this.database.query(
       `SELECT t.id AS api_token_id, t.user, u.email, u.role, u.status,
-              r.admin AS role_admin
+              r.name AS role_name, r.admin AS role_admin
        FROM yuncms_api_tokens t
        INNER JOIN yuncms_users u ON u.id = t.user
        LEFT JOIN yuncms_roles r ON r.id = u.role
@@ -119,6 +120,7 @@ export class AuthService extends BaseService {
     return {
       user: row.user,
       role: row.role ?? null,
+      role_name: row.role_name ?? null,
       admin: Boolean(row.role_admin),
       email: row.email,
       session: null,
@@ -141,6 +143,7 @@ export class AuthService extends BaseService {
         id: result.user,
         email: result.email,
         role: result.role,
+        role_name: result.role_name ?? null,
       },
       access_token: result.access_token,
       access_expires_at: result.access_expires_at,

package/src/services/collections-service.js

@@ -3,12 +3,14 @@ import { randomUUID } from 'node:crypto';
 import { withAdvisoryLock } from '../advisory-lock.js';
 import { assertIdentifier, quoteIdentifier } from '../identifier.js';
 import { SchemaMetadataRepository } from '../schema-metadata-repository.js';
+import { normalizeDisplayName, resolveSchemaName } from '../schema-key.js';
 import { incrementSchemaVersion } from '../schema-version.js';
+import { compileCollectionSystemFields, normalizeCollectionSystemFields } from '../system-fields.js';
 import { withConnectionTransaction } from '../transaction.js';
 import { BaseService } from './base-service.js';
 import { assertSchemaManager } from './schema-access.js';
 
-const COLLECTION_METADATA_KEYS = new Set(['note', 'singleton', 'hidden', 'metadata']);
+const COLLECTION_METADATA_KEYS = new Set(['name', 'note', 'singleton', 'hidden', 'metadata']);
 
 function assertUserCollectionName(collection) {
   assertIdentifier(collection, 'collection name');
@@ -46,6 +48,9 @@ function assertCollectionMetadataPatch(patch) {
       throw invalidSchemaPayload(`Collection ${key} must be a boolean`);
     }
   }
+  if (Object.hasOwn(patch, 'name')) {
+    patch.name = normalizeDisplayName(patch.name);
+  }
   if (Object.hasOwn(patch, 'note') && patch.note != null && typeof patch.note !== 'string') {
     throw invalidSchemaPayload('Collection note must be a string or null');
   }
@@ -70,6 +75,7 @@ function assertCollectionCreateMetadata(input) {
   )) {
     throw invalidSchemaPayload('Collection metadata must be an object or null');
   }
+  normalizeCollectionSystemFields(input.systemFields);
 }
 
 function temporaryDropName() {
@@ -91,7 +97,13 @@ export class CollectionsService extends BaseService {
   async createOne(input = {}) {
     assertSchemaManager(this.accountability);
     assertCollectionCreateMetadata(input);
-    const collection = assertUserCollectionName(input.collection);
+    const resolvedName = resolveSchemaName({
+      displayName: input.name ?? input.collection,
+      key: input.collection,
+      prefix: 'collection',
+    });
+    const collection = assertUserCollectionName(resolvedName.key);
+    const name = resolvedName.name;
     const primaryKey = input.primaryKey ?? 'id';
 
     if (primaryKey !== 'id') {
@@ -100,6 +112,8 @@ export class CollectionsService extends BaseService {
       throw error;
     }
 
+    const systemFields = compileCollectionSystemFields(collection, input.systemFields);
+
     return withAdvisoryLock(this.database, 'yuncms:schema', async (connection) => {
       const metadata = new SchemaMetadataRepository(connection);
       const existing = await metadata.readCollection(collection);
@@ -111,11 +125,16 @@ export class CollectionsService extends BaseService {
 
       const table = quoteIdentifier(collection, 'collection name');
       let tableCreated = false;
+      const physicalDefinitions = [
+        'id CHAR(36) NOT NULL PRIMARY KEY',
+        ...systemFields.columns,
+        ...systemFields.constraints,
+      ];
 
       try {
         await connection.query(
           `CREATE TABLE ${table} (
-            id CHAR(36) NOT NULL PRIMARY KEY
+            ${physicalDefinitions.join(',\n            ')}
           ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
         );
         tableCreated = true;
@@ -123,16 +142,21 @@ export class CollectionsService extends BaseService {
         return await withConnectionTransaction(connection, async () => {
           const created = await metadata.createCollection({
             collection,
+            name,
             primaryKey,
             note: input.note ?? null,
             singleton: input.singleton === true,
             hidden: input.hidden === true,
-            metadata: input.metadata ?? null,
+            metadata: {
+              ...(input.metadata ?? {}),
+              systemFields: systemFields.fields,
+            },
           });
 
           await metadata.createField({
             collection,
             field: 'id',
+            name: 'ID',
             type: 'uuid',
             required: true,
             readonly: true,
@@ -140,6 +164,10 @@ export class CollectionsService extends BaseService {
             schemaMetadata: { primaryKey: true, length: 36 },
           });
 
+          for (const systemField of systemFields.metadata) {
+            await metadata.createField(systemField);
+          }
+
           const schemaVersion = await incrementSchemaVersion(connection);
           return { ...created, schemaVersion };
         });

package/src/services/core-services.js

@@ -11,6 +11,7 @@ import { PermissionsService } from './permissions-service.js';
 import { RelationsService } from './relations-service.js';
 import { RolesService } from './roles-service.js';
 import { StudioSettingsService } from './studio-settings-service.js';
+import { SystemCollectionFieldsService } from './system-collection-fields-service.js';
 import { UsersService } from './users-service.js';
 import { createServiceRegistry } from './service-registry.js';
 
@@ -23,6 +24,7 @@ export function createCoreServiceRegistry() {
     ItemsService,
     CollectionsService,
     FieldsService,
+    SystemCollectionFieldsService,
     RelationsService,
     UsersService,
     RolesService,

package/src/services/fields-service.js

@@ -4,13 +4,22 @@ import { withAdvisoryLock } from '../advisory-lock.js';
 import { compileFieldColumn } from '../field-types.js';
 import { assertIdentifier, quoteIdentifier } from '../identifier.js';
 import { SchemaMetadataRepository } from '../schema-metadata-repository.js';
+import { normalizeDisplayName, resolveSchemaName } from '../schema-key.js';
 import { incrementSchemaVersion } from '../schema-version.js';
 import { withConnectionTransaction } from '../transaction.js';
 import { BaseService } from './base-service.js';
 import { assertSchemaManager } from './schema-access.js';
 
-const FIELD_METADATA_KEYS = new Set(['readonly', 'hidden', 'sort', 'interface', 'options']);
-const FIELD_PHYSICAL_KEYS = new Set(['required', 'defaultValue', 'removeDefault', 'indexed']);
+const FIELD_METADATA_KEYS = new Set(['name', 'readonly', 'hidden', 'sort', 'interface', 'options']);
+const FIELD_PHYSICAL_KEYS = new Set([
+  'required',
+  'defaultValue',
+  'removeDefault',
+  'defaultPreset',
+  'removeDefaultPreset',
+  'autoUpdate',
+  'indexed',
+]);
 
 function assertFieldName(field) {
   assertIdentifier(field, 'field name');
@@ -18,11 +27,15 @@ function assertFieldName(field) {
   return field;
 }
 
+function invalidSchemaPayload(message) {
+  const error = new Error(message);
+  error.code = 'INVALID_SCHEMA_PAYLOAD';
+  return error;
+}
+
 function assertFieldMetadataPatch(patch) {
   if (!patch || typeof patch !== 'object' || Array.isArray(patch)) {
-    const error = new Error('Field metadata patch must be an object');
-    error.code = 'INVALID_SCHEMA_PAYLOAD';
-    throw error;
+    throw invalidSchemaPayload('Field metadata patch must be an object');
   }
   for (const key of Object.keys(patch)) {
     if (!FIELD_METADATA_KEYS.has(key)) {
@@ -32,23 +45,18 @@ function assertFieldMetadataPatch(patch) {
     }
   }
   if (Object.keys(patch).length === 0) {
-    const error = new Error('Field metadata patch cannot be empty');
-    error.code = 'INVALID_SCHEMA_PAYLOAD';
-    throw error;
+    throw invalidSchemaPayload('Field metadata patch cannot be empty');
   }
+  if (Object.hasOwn(patch, 'name')) patch.name = normalizeDisplayName(patch.name);
 }
 
 function assertPhysicalPatch(patch) {
   if (!patch || typeof patch !== 'object' || Array.isArray(patch)) {
-    const error = new Error('Physical field patch must be an object');
-    error.code = 'INVALID_SCHEMA_PAYLOAD';
-    throw error;
+    throw invalidSchemaPayload('Physical field patch must be an object');
   }
   const keys = Object.keys(patch);
   if (keys.length === 0) {
-    const error = new Error('Physical field patch cannot be empty');
-    error.code = 'INVALID_SCHEMA_PAYLOAD';
-    throw error;
+    throw invalidSchemaPayload('Physical field patch cannot be empty');
   }
   for (const key of keys) {
     if (!FIELD_PHYSICAL_KEYS.has(key)) {
@@ -58,24 +66,30 @@ function assertPhysicalPatch(patch) {
     }
   }
   if (Object.hasOwn(patch, 'required') && typeof patch.required !== 'boolean') {
-    const error = new Error('required must be boolean');
-    error.code = 'INVALID_SCHEMA_PAYLOAD';
-    throw error;
+    throw invalidSchemaPayload('required must be boolean');
   }
   if (Object.hasOwn(patch, 'indexed') && typeof patch.indexed !== 'boolean') {
-    const error = new Error('indexed must be boolean');
-    error.code = 'INVALID_SCHEMA_PAYLOAD';
-    throw error;
+    throw invalidSchemaPayload('indexed must be boolean');
   }
-  if (Object.hasOwn(patch, 'removeDefault') && patch.removeDefault !== true) {
-    const error = new Error('removeDefault must be true when provided');
-    error.code = 'INVALID_SCHEMA_PAYLOAD';
-    throw error;
+  if (Object.hasOwn(patch, 'autoUpdate') && typeof patch.autoUpdate !== 'boolean') {
+    throw invalidSchemaPayload('autoUpdate must be boolean');
+  }
+  for (const key of ['removeDefault', 'removeDefaultPreset']) {
+    if (Object.hasOwn(patch, key) && patch[key] !== true) {
+      throw invalidSchemaPayload(`${key} must be true when provided`);
+    }
+  }
+  if (Object.hasOwn(patch, 'defaultPreset') && patch.defaultPreset !== 'now') {
+    throw invalidSchemaPayload('defaultPreset currently supports only now');
+  }
+  if (Object.hasOwn(patch, 'defaultValue') && Object.hasOwn(patch, 'defaultPreset')) {
+    throw invalidSchemaPayload('defaultValue and defaultPreset cannot be used together');
   }
   if (Object.hasOwn(patch, 'defaultValue') && patch.removeDefault === true) {
-    const error = new Error('defaultValue and removeDefault cannot be used together');
-    error.code = 'INVALID_SCHEMA_PAYLOAD';
-    throw error;
+    throw invalidSchemaPayload('defaultValue and removeDefault cannot be used together');
+  }
+  if (Object.hasOwn(patch, 'defaultPreset') && patch.removeDefaultPreset === true) {
+    throw invalidSchemaPayload('defaultPreset and removeDefaultPreset cannot be used together');
   }
 }
 
@@ -89,15 +103,26 @@ function parseSchemaMetadata(value) {
   }
 }
 
+function assertFieldNotSystemManaged(field) {
+  if (parseSchemaMetadata(field?.schema_metadata).systemManaged === true) {
+    const error = new Error(`System-managed field cannot be changed directly: ${field.collection}.${field.field}`);
+    error.code = 'SYSTEM_SCHEMA_READ_ONLY';
+    throw error;
+  }
+}
+
 function fieldInputFromMetadata(field, schemaMetadata) {
   const input = {
     type: field.type,
     required: Boolean(field.required),
+    interface: field.interface ?? null,
   };
   if (schemaMetadata.length !== undefined && field.type === 'string') input.length = schemaMetadata.length;
   if (schemaMetadata.precision !== undefined && field.type === 'decimal') input.precision = schemaMetadata.precision;
   if (schemaMetadata.scale !== undefined && field.type === 'decimal') input.scale = schemaMetadata.scale;
   if (Object.hasOwn(schemaMetadata, 'defaultValue')) input.defaultValue = schemaMetadata.defaultValue;
+  if (schemaMetadata.defaultPreset !== undefined) input.defaultPreset = schemaMetadata.defaultPreset;
+  if (schemaMetadata.autoUpdate === true) input.autoUpdate = true;
   return input;
 }
 
@@ -127,7 +152,13 @@ export class FieldsService extends BaseService {
   async createOne(collection, input = {}) {
     assertSchemaManager(this.accountability);
     assertIdentifier(collection, 'collection name');
-    const field = assertFieldName(input.field);
+    const resolvedName = resolveSchemaName({
+      displayName: input.name ?? input.field,
+      key: input.field,
+      prefix: 'field',
+    });
+    const field = assertFieldName(resolvedName.key);
+    const name = resolvedName.name;
 
     if (field === 'id') {
       const error = new Error('The id field is created with the collection and cannot be added again');
@@ -173,6 +204,7 @@ export class FieldsService extends BaseService {
           const created = await metadata.createField({
             collection,
             field,
+            name,
             type: input.type,
             required: input.required === true,
             readonly: input.readonly === true,
@@ -246,6 +278,7 @@ export class FieldsService extends BaseService {
         error.code = 'FIELD_NOT_FOUND';
         throw error;
       }
+      assertFieldNotSystemManaged(existing);
 
       return withConnectionTransaction(connection, async () => {
         const updated = await metadata.updateFieldMetadata(collection, field, patch);
@@ -288,6 +321,7 @@ export class FieldsService extends BaseService {
         error.code = 'FIELD_NOT_FOUND';
         throw error;
       }
+      assertFieldNotSystemManaged(existing);
 
       const relation = relations.find((candidate) =>
         candidate.many_collection === collection && candidate.many_field === field);
@@ -301,8 +335,18 @@ export class FieldsService extends BaseService {
       const currentMetadata = parseSchemaMetadata(existing.schema_metadata);
       const currentInput = fieldInputFromMetadata(existing, currentMetadata);
       const nextInput = { ...currentInput, required: nextRequired };
+
       if (patch.removeDefault === true) delete nextInput.defaultValue;
-      else if (Object.hasOwn(patch, 'defaultValue')) nextInput.defaultValue = patch.defaultValue;
+      if (patch.removeDefaultPreset === true) delete nextInput.defaultPreset;
+      if (Object.hasOwn(patch, 'defaultValue')) {
+        nextInput.defaultValue = patch.defaultValue;
+        delete nextInput.defaultPreset;
+      }
+      if (Object.hasOwn(patch, 'defaultPreset')) {
+        nextInput.defaultPreset = patch.defaultPreset;
+        delete nextInput.defaultValue;
+      }
+      if (Object.hasOwn(patch, 'autoUpdate')) nextInput.autoUpdate = patch.autoUpdate;
 
       const currentCompiled = compileFieldColumn(currentInput);
       const nextCompiled = compileFieldColumn(nextInput);
@@ -410,6 +454,7 @@ export class FieldsService extends BaseService {
         error.code = 'FIELD_NOT_FOUND';
         throw error;
       }
+      assertFieldNotSystemManaged(existing);
 
       const blockingRelation = relations.find((relation) =>
         (relation.many_collection === collection && relation.many_field === field) ||

package/src/services/files-service.js

@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto';
 
 import { BaseService } from './base-service.js';
+import { resolveSystemResourceAccess } from './system-resource-access.js';
 
 function fileError(code, message) {
   const error = new Error(message);
@@ -8,11 +9,6 @@ function fileError(code, message) {
   return error;
 }
 
-function assertFileManager(accountability) {
-  if (accountability.admin === true || accountability.system === true) return;
-  throw fileError('FORBIDDEN', 'File management requires administrator accountability in V1');
-}
-
 function normalizeFilename(value) {
   if (typeof value !== 'string') throw fileError('INVALID_PAYLOAD', 'Download filename is required');
   const filename = value.trim();
@@ -60,28 +56,32 @@ export class FilesService extends BaseService {
     });
   }
 
-  async readMany() {
-    assertFileManager(this.accountability);
+  async #readOneUnsafe(id) {
     const [rows] = await this.database.query(
       `SELECT id, storage, filename_disk, filename_download, title, mimetype, filesize,
               uploaded_by, uploaded_at, metadata
        FROM yuncms_files
-       ORDER BY uploaded_at DESC, id DESC`,
+       WHERE id = ?
+       LIMIT 1`,
+      [id],
     );
-    return rows.map(normalizeRow);
+    return normalizeRow(rows[0]);
   }
 
-  async readOne(id) {
-    assertFileManager(this.accountability);
+  async readMany() {
+    await resolveSystemResourceAccess(this, 'read', 'yuncms_files');
     const [rows] = await this.database.query(
       `SELECT id, storage, filename_disk, filename_download, title, mimetype, filesize,
               uploaded_by, uploaded_at, metadata
        FROM yuncms_files
-       WHERE id = ?
-       LIMIT 1`,
-      [id],
+       ORDER BY uploaded_at DESC, id DESC`,
     );
-    return normalizeRow(rows[0]);
+    return rows.map(normalizeRow);
+  }
+
+  async readOne(id) {
+    await resolveSystemResourceAccess(this, 'read', 'yuncms_files');
+    return this.#readOneUnsafe(id);
   }
 
   async createOne({
@@ -92,7 +92,7 @@ export class FilesService extends BaseService {
     storage = 'local',
     metadata = null,
   } = {}) {
-    assertFileManager(this.accountability);
+    await resolveSystemResourceAccess(this, 'create', 'yuncms_files');
     if (!Buffer.isBuffer(contents) && !(contents instanceof Uint8Array)) {
       throw fileError('INVALID_FILE_CONTENT', 'File contents must be Buffer or Uint8Array');
     }
@@ -124,7 +124,7 @@ export class FilesService extends BaseService {
           metadata == null ? null : JSON.stringify(metadata),
         ],
       );
-      const file = await this.readOne(id);
+      const file = await this.#readOneUnsafe(id);
       await this.action('files.create', {
         key: id,
         item: file,
@@ -144,7 +144,8 @@ export class FilesService extends BaseService {
   }
 
   async readContent(id) {
-    const file = await this.readOne(id);
+    await resolveSystemResourceAccess(this, 'read', 'yuncms_files');
+    const file = await this.#readOneUnsafe(id);
     if (!file) throw fileError('FILE_NOT_FOUND', `Unknown file: ${id}`);
     const driver = this.storage.get(file.storage);
     const contents = await driver.get(file.filename_disk);
@@ -152,7 +153,7 @@ export class FilesService extends BaseService {
   }
 
   async updateOne(id, patch = {}) {
-    assertFileManager(this.accountability);
+    await resolveSystemResourceAccess(this, 'update', 'yuncms_files');
     if (!patch || typeof patch !== 'object' || Array.isArray(patch)) {
       throw fileError('INVALID_PAYLOAD', 'File metadata patch must be an object');
     }
@@ -161,7 +162,7 @@ export class FilesService extends BaseService {
       throw fileError('INVALID_PAYLOAD', 'File update supports filenameDownload, title and metadata only');
     }
 
-    const before = await this.readOne(id);
+    const before = await this.#readOneUnsafe(id);
     if (!before) throw fileError('FILE_NOT_FOUND', `Unknown file: ${id}`);
 
     const assignments = [];
@@ -185,7 +186,7 @@ export class FilesService extends BaseService {
       params,
     );
     if (result.affectedRows !== 1) throw fileError('FILE_NOT_FOUND', `Unknown file: ${id}`);
-    const file = await this.readOne(id);
+    const file = await this.#readOneUnsafe(id);
     await this.action('files.update', {
       key: id,
       before,
@@ -196,8 +197,8 @@ export class FilesService extends BaseService {
   }
 
   async deleteOne(id) {
-    assertFileManager(this.accountability);
-    const file = await this.readOne(id);
+    await resolveSystemResourceAccess(this, 'delete', 'yuncms_files');
+    const file = await this.#readOneUnsafe(id);
     if (!file) throw fileError('FILE_NOT_FOUND', `Unknown file: ${id}`);
 
     const [result] = await this.database.query('DELETE FROM yuncms_files WHERE id = ?', [id]);