@yunsoft/yuncms-core 0.1.16 → 0.1.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yunsoft/yuncms-core",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Core services, schema, authentication, permissions and storage primitives for YunCMS.",
   "license": "MIT",
   "type": "module",

package/src/dynamic-variables.js

@@ -0,0 +1,110 @@
+const NOW_PATTERN = /^\$NOW(?:\(([+-]\d+)\s+(second|minute|hour|day|week|month|year)s?\))?$/i;
+const MAX_ADJUSTMENT = 10_000;
+
+function dynamicVariableError(code, message, path = null) {
+  const error = new Error(message);
+  error.code = code;
+  if (path) error.path = path;
+  return error;
+}
+
+function normalizedNow(value) {
+  const date = value == null ? new Date() : new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    throw dynamicVariableError('INVALID_QUERY', 'Dynamic variable context contains an invalid current timestamp');
+  }
+  return date;
+}
+
+function adjustNow(now, amount, unit, path) {
+  if (!Number.isSafeInteger(amount) || Math.abs(amount) > MAX_ADJUSTMENT) {
+    throw dynamicVariableError(
+      'INVALID_QUERY',
+      `$NOW adjustment must be a signed integer between -${MAX_ADJUSTMENT} and ${MAX_ADJUSTMENT}`,
+      path,
+    );
+  }
+
+  const result = new Date(now.getTime());
+  switch (unit.toLowerCase()) {
+    case 'second': result.setUTCSeconds(result.getUTCSeconds() + amount); break;
+    case 'minute': result.setUTCMinutes(result.getUTCMinutes() + amount); break;
+    case 'hour': result.setUTCHours(result.getUTCHours() + amount); break;
+    case 'day': result.setUTCDate(result.getUTCDate() + amount); break;
+    case 'week': result.setUTCDate(result.getUTCDate() + (amount * 7)); break;
+    case 'month': result.setUTCMonth(result.getUTCMonth() + amount); break;
+    case 'year': result.setUTCFullYear(result.getUTCFullYear() + amount); break;
+    default: throw dynamicVariableError('INVALID_QUERY', `Unsupported $NOW adjustment unit: ${unit}`, path);
+  }
+  if (Number.isNaN(result.getTime())) {
+    throw dynamicVariableError('INVALID_QUERY', '$NOW adjustment produced an invalid timestamp', path);
+  }
+  return result;
+}
+
+export function resolveDynamicVariable(value, context = {}, { allowUnresolved = false, path = null } = {}) {
+  if (typeof value !== 'string') return value;
+
+  if (value === '$CURRENT_USER' || value === '$CURRENT_ROLE') {
+    if (allowUnresolved) return value;
+    const key = value === '$CURRENT_USER' ? 'user' : 'role';
+    const resolved = context?.[key];
+    if (resolved == null || resolved === '') {
+      throw dynamicVariableError(
+        'FORBIDDEN',
+        `${value} is unavailable for the current accountability context`,
+        path,
+      );
+    }
+    return String(resolved);
+  }
+
+  if (value === '$NOW' || value.toUpperCase().startsWith('$NOW(')) {
+    const match = value.match(NOW_PATTERN);
+    if (!match) {
+      throw dynamicVariableError(
+        'INVALID_QUERY',
+        'Invalid $NOW value; use $NOW or a signed adjustment such as $NOW(-1 day)',
+        path,
+      );
+    }
+    if (allowUnresolved) return value;
+    const now = normalizedNow(context?.now);
+    return match[1] ? adjustNow(now, Number(match[1]), match[2], path) : now;
+  }
+
+  if (value.startsWith('$CURRENT_USER.') || value.startsWith('$CURRENT_ROLE.')) {
+    throw dynamicVariableError(
+      'INVALID_QUERY',
+      'Nested current-user and current-role fields are not supported in YunCMS V1',
+      path,
+    );
+  }
+
+  return value;
+}
+
+export function resolveDynamicVariables(value, context = {}, options = {}) {
+  const path = options.path ?? 'filter';
+  if (Array.isArray(value)) {
+    return value.map((entry, index) => resolveDynamicVariables(entry, context, {
+      ...options,
+      path: `${path}.${index}`,
+    }));
+  }
+  if (value && typeof value === 'object' && !(value instanceof Date)) {
+    return Object.fromEntries(Object.entries(value).map(([key, entry]) => [
+      key,
+      resolveDynamicVariables(entry, context, { ...options, path: `${path}.${key}` }),
+    ]));
+  }
+  return resolveDynamicVariable(value, context, options);
+}
+
+export const DYNAMIC_FILTER_VALUES = Object.freeze([
+  '$CURRENT_USER',
+  '$CURRENT_ROLE',
+  '$NOW',
+  '$NOW(-1 day)',
+  '$NOW(+1 day)',
+]);

package/src/index.js

@@ -1,5 +1,11 @@
 export { DEFAULT_SERVER_PORT, loadConfig, loadEnvFileIfPresent } from './config.js';
 export { isCacheStore, MemoryCacheStore } from './cache.js';
+export {
+  DYNAMIC_FILTER_VALUES,
+  resolveDynamicVariable,
+  resolveDynamicVariables,
+} from './dynamic-variables.js';
+
 export {
   RedisClient,
   RedisCacheStore,

package/src/permission-validation.js

@@ -1,4 +1,5 @@
 import { compileFilter } from './query.js';
+import { resolveDynamicVariables } from './dynamic-variables.js';
 
 function validationError(message, path = null) {
   const error = new Error(message);
@@ -8,13 +9,19 @@ function validationError(message, path = null) {
 }
 
 function compare(operator, actual, expected) {
+  const temporalExpected = expected instanceof Date ? expected.getTime() : null;
+  const temporalActual = temporalExpected == null
+    ? actual
+    : actual instanceof Date ? actual.getTime() : new Date(actual).getTime();
+  const comparableActual = temporalExpected == null ? actual : temporalActual;
+  const comparableExpected = temporalExpected == null ? expected : temporalExpected;
   switch (operator) {
-    case '_eq': return actual === expected;
-    case '_neq': return actual !== expected;
-    case '_lt': return actual != null && actual < expected;
-    case '_lte': return actual != null && actual <= expected;
-    case '_gt': return actual != null && actual > expected;
-    case '_gte': return actual != null && actual >= expected;
+    case '_eq': return comparableActual === comparableExpected;
+    case '_neq': return comparableActual !== comparableExpected;
+    case '_lt': return comparableActual != null && comparableActual < comparableExpected;
+    case '_lte': return comparableActual != null && comparableActual <= comparableExpected;
+    case '_gt': return comparableActual != null && comparableActual > comparableExpected;
+    case '_gte': return comparableActual != null && comparableActual >= comparableExpected;
     case '_in': return expected.some((candidate) => actual === candidate);
     case '_nin': return !expected.some((candidate) => actual === candidate);
     case '_null': return expected ? actual == null : actual != null;
@@ -47,17 +54,18 @@ function evaluateNode(record, node) {
 
 export function assertPermissionValidationRule(rule, schema) {
   if (rule == null) return null;
-  compileFilter(rule, schema);
+  compileFilter(rule, schema, { allowUnresolvedDynamicVariables: true });
   return rule;
 }
 
-export function evaluatePermissionValidation(record, rule, schema) {
+export function evaluatePermissionValidation(record, rule, schema, { dynamicVariables = {} } = {}) {
   if (rule == null) return true;
   assertPermissionValidationRule(rule, schema);
-  return evaluateNode(record, rule);
+  const resolvedRule = resolveDynamicVariables(rule, dynamicVariables, { path: 'validation' });
+  return evaluateNode(record, resolvedRule);
 }
 
-export function enforcePermissionValidation(record, rule, schema, { path = 'validation' } = {}) {
-  if (evaluatePermissionValidation(record, rule, schema)) return record;
+export function enforcePermissionValidation(record, rule, schema, { path = 'validation', dynamicVariables = {} } = {}) {
+  if (evaluatePermissionValidation(record, rule, schema, { dynamicVariables })) return record;
   throw validationError('Record does not satisfy the permission validation rule', path);
 }

package/src/query.js

@@ -1,4 +1,5 @@
 import { quoteIdentifier } from './identifier.js';
+import { resolveDynamicVariables } from './dynamic-variables.js';
 
 const QUERY_KEYS = new Set(['fields', 'filter', 'sort', 'limit', 'offset', 'search', 'aggregate', 'groupBy']);
 const FILTER_OPERATORS = new Set([
@@ -289,7 +290,16 @@ function compileFilterObject(filter, schema, path, limits, state, depth) {
 
 export function compileFilter(filter, schema, options = {}) {
   if (!filter) return { sql: '', params: [] };
-  const limits = { ...QUERY_LIMITS, ...options };
-  const compiled = compileFilterObject(filter, schema, 'filter', limits, { nodes: 0 }, 1);
+  const {
+    dynamicVariables = {},
+    allowUnresolvedDynamicVariables = false,
+    ...limitOptions
+  } = options;
+  const limits = { ...QUERY_LIMITS, ...limitOptions };
+  const resolvedFilter = resolveDynamicVariables(filter, dynamicVariables, {
+    allowUnresolved: allowUnresolvedDynamicVariables,
+    path: 'filter',
+  });
+  const compiled = compileFilterObject(resolvedFilter, schema, 'filter', limits, { nodes: 0 }, 1);
   return { sql: ` WHERE ${compiled.sql}`, params: compiled.params };
 }

package/src/relation-expansion.js

@@ -419,7 +419,13 @@ async function readRowsByLookup({
     },
   };
   const selection = compileSelectFields([...new Set([...visibleFields, ...trustedInternal])], internalSchema);
-  const permissionFilter = compileFilter(permission.filter, schema);
+  const permissionFilter = compileFilter(permission.filter, schema, {
+    dynamicVariables: {
+      user: service.accountability?.user ?? null,
+      role: service.accountability?.role ?? null,
+      now: new Date(),
+    },
+  });
   const table = quoteIdentifier(service.collection, 'collection name');
   const data = [];
 

package/src/services/auth-service.js

@@ -38,6 +38,7 @@ function publicUser(user) {
     email: user.email,
     role: user.role ?? null,
     role_name: user.role_name ?? null,
+    admin: Boolean(user.role_admin ?? user.admin),
     status: user.status,
     email_verified_at: user.email_verified_at ?? null,
   };
@@ -191,6 +192,7 @@ export class AuthService extends BaseService {
         email: result.email,
         role: result.role,
         role_name: result.role_name ?? null,
+        admin: result.admin === true,
       },
       access_token: result.access_token,
       access_expires_at: result.access_expires_at,

package/src/services/external-auth-service.js

@@ -59,6 +59,7 @@ function publicUser(user) {
     email: user.email,
     role: user.role ?? null,
     role_name: user.role_name ?? null,
+    admin: Boolean(user.role_admin ?? user.admin),
     status: user.status,
     email_verified_at: user.email_verified_at ?? null,
   };

package/src/services/files-service.js

@@ -101,7 +101,13 @@ export class FilesService extends BaseService {
           'System schema is required to enforce a filtered Files permission',
         );
       }
-      const compiled = compileFilter(permission.filter, collectionSchema);
+      const compiled = compileFilter(permission.filter, collectionSchema, {
+        dynamicVariables: {
+          user: this.accountability.user,
+          role: this.accountability.role,
+          now: new Date(),
+        },
+      });
       sql = compiled.sql;
       params = [...compiled.params];
     }

package/src/services/items-service.js

@@ -65,7 +65,7 @@ function combineCompiledFilters(...filters) {
   };
 }
 
-function createCandidateRecord(schema, id, entries) {
+function createCandidateRecord(schema, id, entries, now = new Date()) {
   const provided = Object.fromEntries(entries);
   const candidate = {};
 
@@ -80,7 +80,7 @@ function createCandidateRecord(schema, id, entries) {
     }
     const metadata = parseMetadata(fieldSchema.schema_metadata);
     if (metadata.defaultPreset === 'now') {
-      candidate[fieldSchema.field] = new Date();
+      candidate[fieldSchema.field] = now;
       continue;
     }
     candidate[fieldSchema.field] = Object.hasOwn(metadata, 'defaultValue')
@@ -150,6 +150,14 @@ export class ItemsService extends BaseService {
     return permissions.resolve(action, this.collection);
   }
 
+  dynamicVariables(now = new Date()) {
+    return {
+      user: this.accountability.user,
+      role: this.accountability.role,
+      now,
+    };
+  }
+
   validatePayload(payload, schema, permission, { creating = false } = {}) {
     if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
       throw serviceError('INVALID_PAYLOAD', 'Payload must be an object');
@@ -179,9 +187,9 @@ export class ItemsService extends BaseService {
     return entries;
   }
 
-  compileActionFilters(userFilter, permissionFilter, userSchema, fullSchema, search = null) {
-    const permissionSql = compileFilter(permissionFilter, fullSchema);
-    const userSql = compileFilter(userFilter, userSchema);
+  compileActionFilters(userFilter, permissionFilter, userSchema, fullSchema, search = null, dynamicVariables = this.dynamicVariables()) {
+    const permissionSql = compileFilter(permissionFilter, fullSchema, { dynamicVariables });
+    const userSql = compileFilter(userFilter, userSchema, { dynamicVariables });
     const searchSql = compileSearch(search, userSchema);
     return combineCompiledFilters(permissionSql, userSql, searchSql);
   }
@@ -221,7 +229,14 @@ export class ItemsService extends BaseService {
     const query = await this.normalizeReadQuery(rawQuery);
     const permission = await this.resolvePermission('read');
     const accessSchema = schemaForFields(schema, permission.fields);
-    const filter = this.compileActionFilters(query.filter, permission.filter, accessSchema, schema, query.search);
+    const filter = this.compileActionFilters(
+      query.filter,
+      permission.filter,
+      accessSchema,
+      schema,
+      query.search,
+      this.dynamicVariables(),
+    );
     const table = quoteIdentifier(this.collection, 'collection name');
     const aggregate = compileAggregate(query.aggregate, query.groupBy, accessSchema);
 
@@ -288,7 +303,8 @@ export class ItemsService extends BaseService {
       fields: { ...accessSchema.fields, [trustedLookupField]: schema.fields[trustedLookupField] },
     };
     const internalSelection = compileSelectFields([...visibleSelection.fields, trustedLookupField], internalSchema);
-    const permissionFilter = compileFilter(permission.filter, schema);
+    const dynamicVariables = this.dynamicVariables();
+    const permissionFilter = compileFilter(permission.filter, schema, { dynamicVariables });
     const table = quoteIdentifier(this.collection, 'collection name');
     const data = [];
 
@@ -315,8 +331,9 @@ export class ItemsService extends BaseService {
     const selected = compileSelectFields(normalizeFields(fields), accessSchema);
     const table = quoteIdentifier(this.collection, 'collection name');
     const primaryKey = schema.primary_key;
+    const dynamicVariables = this.dynamicVariables();
     const filter = combineCompiledFilters(
-      compileFilter(permission.filter, schema),
+      compileFilter(permission.filter, schema, { dynamicVariables }),
       compileFilter({ [primaryKey]: { _eq: id } }, schema),
     );
     const [rows] = await this.database.query(
@@ -342,10 +359,13 @@ export class ItemsService extends BaseService {
     const permission = await this.resolvePermission('create');
     const filteredPayload = await this.filterMutation('items.create', payload, { operation: 'create' });
     const callerEntries = this.validatePayload(filteredPayload, schema, permission, { creating: true });
-    const entries = mergeSystemEntries(callerEntries, schema, this.accountability, 'create');
+    const now = new Date();
+    const entries = mergeSystemEntries(callerEntries, schema, this.accountability, 'create', now);
     const id = randomUUID();
-    const candidate = createCandidateRecord(schema, id, entries);
-    enforcePermissionValidation(candidate, permission.validation, schema);
+    const candidate = createCandidateRecord(schema, id, entries, now);
+    enforcePermissionValidation(candidate, permission.validation, schema, {
+      dynamicVariables: this.dynamicVariables(now),
+    });
 
     const values = { [schema.primary_key]: id, ...Object.fromEntries(entries) };
     const fields = Object.keys(values);
@@ -368,14 +388,17 @@ export class ItemsService extends BaseService {
     const schema = await this.getCollectionSchema();
     const permission = await this.resolvePermission('create');
     const staged = [];
+    const now = new Date();
 
     for (const payload of payloads) {
       const filteredPayload = await this.filterMutation('items.create', payload, { operation: 'create', bulk: true });
       const callerEntries = this.validatePayload(filteredPayload, schema, permission, { creating: true });
-      const entries = mergeSystemEntries(callerEntries, schema, this.accountability, 'create');
+      const entries = mergeSystemEntries(callerEntries, schema, this.accountability, 'create', now);
       const id = randomUUID();
-      const candidate = createCandidateRecord(schema, id, entries);
-      enforcePermissionValidation(candidate, permission.validation, schema);
+      const candidate = createCandidateRecord(schema, id, entries, now);
+      enforcePermissionValidation(candidate, permission.validation, schema, {
+        dynamicVariables: this.dynamicVariables(now),
+      });
       staged.push({ id, values: { [schema.primary_key]: id, ...Object.fromEntries(entries) } });
     }
 
@@ -405,11 +428,13 @@ export class ItemsService extends BaseService {
     const filteredPayload = await this.filterMutation('items.update', payload, { operation: 'update', key: id });
     const callerEntries = this.validatePayload(filteredPayload, schema, permission);
     if (callerEntries.length === 0) throw serviceError('INVALID_PAYLOAD', 'Update payload cannot be empty');
-    const entries = mergeSystemEntries(callerEntries, schema, this.accountability, 'update');
+    const now = new Date();
+    const dynamicVariables = this.dynamicVariables(now);
+    const entries = mergeSystemEntries(callerEntries, schema, this.accountability, 'update', now);
     const effectiveChanges = Object.fromEntries(entries);
     const table = quoteIdentifier(this.collection, 'collection name');
     const filter = combineCompiledFilters(
-      compileFilter(permission.filter, schema),
+      compileFilter(permission.filter, schema, { dynamicVariables }),
       compileFilter({ [schema.primary_key]: { _eq: id } }, schema),
     );
 
@@ -417,7 +442,7 @@ export class ItemsService extends BaseService {
       const [currentRows] = await this.database.query(`SELECT * FROM ${table}${filter.sql} LIMIT 1`, filter.params);
       const current = currentRows[0];
       if (!current) return null;
-      enforcePermissionValidation({ ...current, ...effectiveChanges }, permission.validation, schema);
+      enforcePermissionValidation({ ...current, ...effectiveChanges }, permission.validation, schema, { dynamicVariables });
     }
 
     const setSql = entries.map(([field]) => `${quoteIdentifier(field, 'field name')} = ?`).join(', ');
@@ -442,9 +467,11 @@ export class ItemsService extends BaseService {
     const filteredPayload = await this.filterMutation('items.update', payload, { operation: 'update', bulk: true, filter: filterInput });
     const callerEntries = this.validatePayload(filteredPayload, schema, permission);
     if (callerEntries.length === 0) throw serviceError('INVALID_PAYLOAD', 'Update payload cannot be empty');
-    const entries = mergeSystemEntries(callerEntries, schema, this.accountability, 'update');
+    const now = new Date();
+    const dynamicVariables = this.dynamicVariables(now);
+    const entries = mergeSystemEntries(callerEntries, schema, this.accountability, 'update', now);
     const effectiveChanges = Object.fromEntries(entries);
-    const filter = this.compileActionFilters(filterInput, permission.filter, accessSchema, schema);
+    const filter = this.compileActionFilters(filterInput, permission.filter, accessSchema, schema, null, dynamicVariables);
     const table = quoteIdentifier(this.collection, 'collection name');
 
     if (permission.validation) {
@@ -455,7 +482,9 @@ export class ItemsService extends BaseService {
       if (rows.length > MAX_BULK_VALIDATION_ROWS) {
         throw serviceError('VALIDATION_BULK_LIMIT', `Permission validation can inspect at most ${MAX_BULK_VALIDATION_ROWS} rows per bulk update`);
       }
-      for (const row of rows) enforcePermissionValidation({ ...row, ...effectiveChanges }, permission.validation, schema);
+      for (const row of rows) {
+        enforcePermissionValidation({ ...row, ...effectiveChanges }, permission.validation, schema, { dynamicVariables });
+      }
     }
 
     const setSql = entries.map(([field]) => `${quoteIdentifier(field, 'field name')} = ?`).join(', ');
@@ -473,8 +502,9 @@ export class ItemsService extends BaseService {
     const filtered = await this.filterMutation('items.delete', { key: id }, { operation: 'delete', key: id });
     const key = filtered?.key ?? id;
     const table = quoteIdentifier(this.collection, 'collection name');
+    const dynamicVariables = this.dynamicVariables();
     const filter = combineCompiledFilters(
-      compileFilter(permission.filter, schema),
+      compileFilter(permission.filter, schema, { dynamicVariables }),
       compileFilter({ [schema.primary_key]: { _eq: key } }, schema),
     );
     const [result] = await this.database.query(`DELETE FROM ${table}${filter.sql}`, filter.params);

package/src/services/permissions-service.js

@@ -223,7 +223,7 @@ export class PermissionsService extends BaseService {
     const fields = normalizePermissionFields(input.fields ?? null, collectionSchema);
     const filter = input.filter ?? null;
     const validation = input.validation ?? null;
-    if (filter !== null) compileFilter(filter, collectionSchema);
+    if (filter !== null) compileFilter(filter, collectionSchema, { allowUnresolvedDynamicVariables: true });
     assertPermissionValidationRule(validation, collectionSchema);
 
     const [roleRows] = await this.database.query(
@@ -290,7 +290,7 @@ export class PermissionsService extends BaseService {
       params.push(fields == null ? null : JSON.stringify(fields));
     }
     if (Object.hasOwn(patch, 'filter')) {
-      if (patch.filter != null) compileFilter(patch.filter, collectionSchema);
+      if (patch.filter != null) compileFilter(patch.filter, collectionSchema, { allowUnresolvedDynamicVariables: true });
       assignments.push('filter = ?');
       params.push(patch.filter == null ? null : JSON.stringify(patch.filter));
     }