@yunsoft/yuncms-core 0.1.2 → 0.1.5

package/src/services/collections-service.js

@@ -3,13 +3,14 @@ import { randomUUID } from 'node:crypto';
 import { withAdvisoryLock } from '../advisory-lock.js';
 import { assertIdentifier, quoteIdentifier } from '../identifier.js';
 import { SchemaMetadataRepository } from '../schema-metadata-repository.js';
+import { normalizeDisplayName, resolveSchemaName } from '../schema-key.js';
 import { incrementSchemaVersion } from '../schema-version.js';
 import { compileCollectionSystemFields, normalizeCollectionSystemFields } from '../system-fields.js';
 import { withConnectionTransaction } from '../transaction.js';
 import { BaseService } from './base-service.js';
 import { assertSchemaManager } from './schema-access.js';
 
-const COLLECTION_METADATA_KEYS = new Set(['note', 'singleton', 'hidden', 'metadata']);
+const COLLECTION_METADATA_KEYS = new Set(['name', 'note', 'singleton', 'hidden', 'metadata']);
 
 function assertUserCollectionName(collection) {
   assertIdentifier(collection, 'collection name');
@@ -47,6 +48,9 @@ function assertCollectionMetadataPatch(patch) {
       throw invalidSchemaPayload(`Collection ${key} must be a boolean`);
     }
   }
+  if (Object.hasOwn(patch, 'name')) {
+    patch.name = normalizeDisplayName(patch.name);
+  }
   if (Object.hasOwn(patch, 'note') && patch.note != null && typeof patch.note !== 'string') {
     throw invalidSchemaPayload('Collection note must be a string or null');
   }
@@ -93,7 +97,13 @@ export class CollectionsService extends BaseService {
   async createOne(input = {}) {
     assertSchemaManager(this.accountability);
     assertCollectionCreateMetadata(input);
-    const collection = assertUserCollectionName(input.collection);
+    const resolvedName = resolveSchemaName({
+      displayName: input.name ?? input.collection,
+      key: input.collection,
+      prefix: 'collection',
+    });
+    const collection = assertUserCollectionName(resolvedName.key);
+    const name = resolvedName.name;
     const primaryKey = input.primaryKey ?? 'id';
 
     if (primaryKey !== 'id') {
@@ -132,6 +142,7 @@ export class CollectionsService extends BaseService {
         return await withConnectionTransaction(connection, async () => {
           const created = await metadata.createCollection({
             collection,
+            name,
             primaryKey,
             note: input.note ?? null,
             singleton: input.singleton === true,
@@ -145,6 +156,7 @@ export class CollectionsService extends BaseService {
           await metadata.createField({
             collection,
             field: 'id',
+            name: 'ID',
             type: 'uuid',
             required: true,
             readonly: true,

package/src/services/core-services.js

@@ -11,6 +11,7 @@ import { PermissionsService } from './permissions-service.js';
 import { RelationsService } from './relations-service.js';
 import { RolesService } from './roles-service.js';
 import { StudioSettingsService } from './studio-settings-service.js';
+import { SystemCollectionFieldsService } from './system-collection-fields-service.js';
 import { UsersService } from './users-service.js';
 import { createServiceRegistry } from './service-registry.js';
 
@@ -23,6 +24,7 @@ export function createCoreServiceRegistry() {
     ItemsService,
     CollectionsService,
     FieldsService,
+    SystemCollectionFieldsService,
     RelationsService,
     UsersService,
     RolesService,

package/src/services/fields-service.js

@@ -4,12 +4,13 @@ import { withAdvisoryLock } from '../advisory-lock.js';
 import { compileFieldColumn } from '../field-types.js';
 import { assertIdentifier, quoteIdentifier } from '../identifier.js';
 import { SchemaMetadataRepository } from '../schema-metadata-repository.js';
+import { normalizeDisplayName, resolveSchemaName } from '../schema-key.js';
 import { incrementSchemaVersion } from '../schema-version.js';
 import { withConnectionTransaction } from '../transaction.js';
 import { BaseService } from './base-service.js';
 import { assertSchemaManager } from './schema-access.js';
 
-const FIELD_METADATA_KEYS = new Set(['readonly', 'hidden', 'sort', 'interface', 'options']);
+const FIELD_METADATA_KEYS = new Set(['name', 'readonly', 'hidden', 'sort', 'interface', 'options']);
 const FIELD_PHYSICAL_KEYS = new Set([
   'required',
   'defaultValue',
@@ -46,6 +47,7 @@ function assertFieldMetadataPatch(patch) {
   if (Object.keys(patch).length === 0) {
     throw invalidSchemaPayload('Field metadata patch cannot be empty');
   }
+  if (Object.hasOwn(patch, 'name')) patch.name = normalizeDisplayName(patch.name);
 }
 
 function assertPhysicalPatch(patch) {
@@ -150,7 +152,13 @@ export class FieldsService extends BaseService {
   async createOne(collection, input = {}) {
     assertSchemaManager(this.accountability);
     assertIdentifier(collection, 'collection name');
-    const field = assertFieldName(input.field);
+    const resolvedName = resolveSchemaName({
+      displayName: input.name ?? input.field,
+      key: input.field,
+      prefix: 'field',
+    });
+    const field = assertFieldName(resolvedName.key);
+    const name = resolvedName.name;
 
     if (field === 'id') {
       const error = new Error('The id field is created with the collection and cannot be added again');
@@ -196,6 +204,7 @@ export class FieldsService extends BaseService {
           const created = await metadata.createField({
             collection,
             field,
+            name,
             type: input.type,
             required: input.required === true,
             readonly: input.readonly === true,

package/src/services/files-service.js

@@ -1,5 +1,6 @@
 import { randomUUID } from 'node:crypto';
 
+import { compileFilter } from '../query.js';
 import { BaseService } from './base-service.js';
 import { resolveSystemResourceAccess } from './system-resource-access.js';
 
@@ -27,6 +28,38 @@ function normalizeMimeType(value) {
   return mimetype;
 }
 
+function startsWithBytes(buffer, bytes, offset = 0) {
+  if (buffer.byteLength < offset + bytes.length) return false;
+  return bytes.every((byte, index) => buffer[offset + index] === byte);
+}
+
+function hasKnownMimeSignature(contents, mimetype) {
+  const buffer = Buffer.isBuffer(contents) ? contents : Buffer.from(contents);
+  switch (mimetype) {
+    case 'application/pdf':
+      return startsWithBytes(buffer, [0x25, 0x50, 0x44, 0x46, 0x2d]);
+    case 'image/png':
+      return startsWithBytes(buffer, [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+    case 'image/jpeg':
+      return startsWithBytes(buffer, [0xff, 0xd8, 0xff]);
+    case 'image/gif':
+      return buffer.subarray(0, 6).toString('ascii') === 'GIF87a'
+        || buffer.subarray(0, 6).toString('ascii') === 'GIF89a';
+    case 'image/webp':
+      return buffer.subarray(0, 4).toString('ascii') === 'RIFF'
+        && buffer.subarray(8, 12).toString('ascii') === 'WEBP';
+    default:
+      return null;
+  }
+}
+
+function assertMimeSignature(contents, mimetype) {
+  const matches = hasKnownMimeSignature(contents, mimetype);
+  if (matches === false) {
+    throw fileError('FILE_MIME_MISMATCH', `File contents do not match declared MIME type: ${mimetype}`);
+  }
+}
+
 function decodeJson(value) {
   if (value == null || typeof value === 'object') return value ?? null;
   try {
@@ -56,6 +89,31 @@ export class FilesService extends BaseService {
     });
   }
 
+  #compileReadScope(permission, id = null) {
+    let sql = '';
+    let params = [];
+
+    if (permission?.filter) {
+      const collectionSchema = this.schema?.collections?.yuncms_files;
+      if (!collectionSchema) {
+        throw fileError(
+          'SYSTEM_SCHEMA_REQUIRED',
+          'System schema is required to enforce a filtered Files permission',
+        );
+      }
+      const compiled = compileFilter(permission.filter, collectionSchema);
+      sql = compiled.sql;
+      params = [...compiled.params];
+    }
+
+    if (id != null) {
+      sql = sql ? `${sql} AND id = ?` : ' WHERE id = ?';
+      params.push(id);
+    }
+
+    return { sql, params };
+  }
+
   async #readOneUnsafe(id) {
     const [rows] = await this.database.query(
       `SELECT id, storage, filename_disk, filename_download, title, mimetype, filesize,
@@ -68,20 +126,34 @@ export class FilesService extends BaseService {
     return normalizeRow(rows[0]);
   }
 
+  async #readOneAuthorized(id, permission) {
+    const scope = this.#compileReadScope(permission, id);
+    const [rows] = await this.database.query(
+      `SELECT id, storage, filename_disk, filename_download, title, mimetype, filesize,
+              uploaded_by, uploaded_at, metadata
+       FROM yuncms_files${scope.sql}
+       LIMIT 1`,
+      scope.params,
+    );
+    return normalizeRow(rows[0]);
+  }
+
   async readMany() {
-    await resolveSystemResourceAccess(this, 'read', 'yuncms_files');
+    const permission = await resolveSystemResourceAccess(this, 'read', 'yuncms_files');
+    const scope = this.#compileReadScope(permission);
     const [rows] = await this.database.query(
       `SELECT id, storage, filename_disk, filename_download, title, mimetype, filesize,
               uploaded_by, uploaded_at, metadata
-       FROM yuncms_files
+       FROM yuncms_files${scope.sql}
        ORDER BY uploaded_at DESC, id DESC`,
+      scope.params,
     );
     return rows.map(normalizeRow);
   }
 
   async readOne(id) {
-    await resolveSystemResourceAccess(this, 'read', 'yuncms_files');
-    return this.#readOneUnsafe(id);
+    const permission = await resolveSystemResourceAccess(this, 'read', 'yuncms_files');
+    return this.#readOneAuthorized(id, permission);
   }
 
   async createOne({
@@ -100,6 +172,7 @@ export class FilesService extends BaseService {
 
     const filename = normalizeFilename(filenameDownload);
     const normalizedMime = normalizeMimeType(mimetype);
+    assertMimeSignature(contents, normalizedMime);
     const driver = this.storage.get(storage);
     const id = randomUUID();
     const filenameDisk = id;
@@ -144,8 +217,8 @@ export class FilesService extends BaseService {
   }
 
   async readContent(id) {
-    await resolveSystemResourceAccess(this, 'read', 'yuncms_files');
-    const file = await this.#readOneUnsafe(id);
+    const permission = await resolveSystemResourceAccess(this, 'read', 'yuncms_files');
+    const file = await this.#readOneAuthorized(id, permission);
     if (!file) throw fileError('FILE_NOT_FOUND', `Unknown file: ${id}`);
     const driver = this.storage.get(file.storage);
     const contents = await driver.get(file.filename_disk);
@@ -225,4 +298,9 @@ export class FilesService extends BaseService {
   }
 }
 
-export { normalizeFilename, normalizeMimeType };
+export {
+  assertMimeSignature,
+  hasKnownMimeSignature,
+  normalizeFilename,
+  normalizeMimeType,
+};

package/src/services/items-service.js

@@ -7,6 +7,7 @@ import {
   compileSelectFields,
   compileSort,
   parseItemsQuery,
+  QUERY_LIMITS,
 } from '../query.js';
 import { SchemaCache } from '../schema.js';
 import { isSystemManagedField, systemMutationEntries } from '../system-fields.js';
@@ -215,6 +216,58 @@ export class ItemsService extends BaseService {
     };
   }
 
+  async readManyForRelation({ fields = null, lookupField, values = [] } = {}) {
+    const schema = await this.getCollectionSchema();
+    const trustedLookupField = assertIdentifier(lookupField, 'relation lookup field');
+    if (!schema.fields[trustedLookupField]) {
+      throw serviceError(
+        'INVALID_QUERY',
+        `Unknown relation lookup field: ${trustedLookupField}`,
+        trustedLookupField,
+      );
+    }
+    if (!Array.isArray(values) || values.length === 0 || values.length > QUERY_LIMITS.maxLimit) {
+      throw serviceError(
+        'INVALID_QUERY',
+        `Relation lookup values must contain between 1 and ${QUERY_LIMITS.maxLimit} entries`,
+        trustedLookupField,
+      );
+    }
+
+    const permission = await this.resolvePermission('read');
+    const accessSchema = schemaForFields(schema, permission.fields);
+    const visibleSelection = compileSelectFields(normalizeFields(fields), accessSchema);
+    const internalSchema = {
+      ...accessSchema,
+      fields: {
+        ...accessSchema.fields,
+        [trustedLookupField]: schema.fields[trustedLookupField],
+      },
+    };
+    const internalSelection = compileSelectFields(
+      [...visibleSelection.fields, trustedLookupField],
+      internalSchema,
+    );
+    const permissionFilter = compileFilter(permission.filter, schema);
+    const table = quoteIdentifier(this.collection, 'collection name');
+    const data = [];
+
+    for (let offset = 0; offset < values.length; offset += QUERY_LIMITS.maxInValues) {
+      const chunk = values.slice(offset, offset + QUERY_LIMITS.maxInValues);
+      const filter = combineCompiledFilters(
+        permissionFilter,
+        compileFilter({ [trustedLookupField]: { _in: chunk } }, schema),
+      );
+      const [rows] = await this.database.query(
+        `SELECT ${internalSelection.sql} FROM ${table}${filter.sql} LIMIT ?`,
+        [...filter.params, chunk.length],
+      );
+      data.push(...rows);
+    }
+
+    return { data, visibleFields: visibleSelection.fields };
+  }
+
   async readOne(id, { fields = null } = {}) {
     const schema = await this.getCollectionSchema();
     const permission = await this.resolvePermission('read');
@@ -464,4 +517,4 @@ export class ItemsService extends BaseService {
   }
 }
 
-export { MAX_BULK_VALIDATION_ROWS, createCandidateRecord };
+export { MAX_BULK_VALIDATION_ROWS, createCandidateRecord };

package/src/services/permissions-service.js

@@ -4,7 +4,7 @@ import { assertPermissionValidationRule } from '../permission-validation.js';
 import { compileFilter } from '../query.js';
 import { SchemaCache } from '../schema.js';
 import {
-  assertActionOnlyPermissionPayload,
+  assertSystemPermissionPayload,
   assertSystemResourceAction,
   isPermissionManagedSystemResource,
 } from '../system-permissions.js';
@@ -86,6 +86,15 @@ export class PermissionsService extends BaseService {
     this.schemaCache = options.schemaCache ?? defaultSchemaCache;
   }
 
+  async action(event, payload) {
+    if (!this.emitter) return;
+    await this.emitter.action(event, payload, {
+      accountability: this.accountability,
+      requestId: this.requestId,
+      collection: 'yuncms_permissions',
+    });
+  }
+
   async #collectionSchema(collection) {
     const snapshot = this.schema ?? await this.schemaCache.get(this.database);
     const collectionSchema = snapshot.collections?.[collection];
@@ -100,7 +109,10 @@ export class PermissionsService extends BaseService {
   async resolve(action, collection) {
     assertAction(action);
     const key = cacheKey(this.accountability, action, collection);
-    if (this.permissionCache?.has(key)) return this.permissionCache.get(key);
+    if (this.permissionCache) {
+      const cached = await this.permissionCache.get(key);
+      if (cached !== undefined) return cached;
+    }
 
     let permission;
     if (this.accountability.admin === true || this.accountability.system === true) {
@@ -159,7 +171,7 @@ export class PermissionsService extends BaseService {
       };
     }
 
-    this.permissionCache?.set(key, permission);
+    if (this.permissionCache) await this.permissionCache.set(key, permission);
     return permission;
   }
 
@@ -205,7 +217,7 @@ export class PermissionsService extends BaseService {
         throw error;
       }
       assertSystemResourceAction(collectionSchema, action);
-      assertActionOnlyPermissionPayload(collectionSchema, input);
+      assertSystemPermissionPayload(collectionSchema, action, input);
     }
 
     const fields = normalizePermissionFields(input.fields ?? null, collectionSchema);
@@ -224,11 +236,6 @@ export class PermissionsService extends BaseService {
       error.code = 'ROLE_NOT_FOUND';
       throw error;
     }
-    if (collectionSchema.system && role.public) {
-      const error = new Error('Public role cannot be granted access to protected system resources');
-      error.code = 'PUBLIC_SYSTEM_ACCESS_FORBIDDEN';
-      throw error;
-    }
 
     const id = randomUUID();
     await this.database.query(
@@ -244,8 +251,10 @@ export class PermissionsService extends BaseService {
         validation == null ? null : JSON.stringify(validation),
       ],
     );
-    this.permissionCache?.clear();
-    return this.readOne(id);
+    if (this.permissionCache) await this.permissionCache.clear();
+    const permission = await this.readOne(id);
+    await this.action('permissions.create', { key: id, item: permission });
+    return permission;
   }
 
   async updateOne(id, patch = {}) {
@@ -269,7 +278,9 @@ export class PermissionsService extends BaseService {
       throw error;
     }
     const collectionSchema = await this.#collectionSchema(existing.collection);
-    if (collectionSchema.system) assertActionOnlyPermissionPayload(collectionSchema, patch);
+    if (collectionSchema.system) {
+      assertSystemPermissionPayload(collectionSchema, existing.action, patch);
+    }
 
     const assignments = [];
     const params = [];
@@ -294,12 +305,20 @@ export class PermissionsService extends BaseService {
       `UPDATE yuncms_permissions SET ${assignments.join(', ')} WHERE id = ?`,
       params,
     );
-    this.permissionCache?.clear();
-    return this.readOne(id);
+    if (this.permissionCache) await this.permissionCache.clear();
+    const permission = await this.readOne(id);
+    await this.action('permissions.update', {
+      key: id,
+      before: existing,
+      item: permission,
+      changes: patch,
+    });
+    return permission;
   }
 
   async deleteOne(id) {
     assertPermissionManager(this.accountability);
+    const before = this.emitter ? await this.readOne(id) : null;
     const [result] = await this.database.query(
       'DELETE FROM yuncms_permissions WHERE id = ?',
       [id],
@@ -309,7 +328,8 @@ export class PermissionsService extends BaseService {
       error.code = 'PERMISSION_NOT_FOUND';
       throw error;
     }
-    this.permissionCache?.clear();
+    if (this.permissionCache) await this.permissionCache.clear();
+    await this.action('permissions.delete', { key: id, before });
     return true;
   }
 }

package/src/services/roles-service.js

@@ -3,13 +3,6 @@ import { randomUUID } from 'node:crypto';
 import { BaseService } from './base-service.js';
 import { resolveSystemResourceAccess } from './system-resource-access.js';
 
-function assertRoleManager(accountability) {
-  if (accountability.admin === true || accountability.system === true) return;
-  const error = new Error('Role management requires administrator accountability');
-  error.code = 'FORBIDDEN';
-  throw error;
-}
-
 function normalizeRoleName(name) {
   if (!name || typeof name !== 'string' || name.trim().length === 0) {
     const error = new Error('Role name is required');
@@ -25,7 +18,36 @@ function normalizeRoleName(name) {
   return normalized;
 }
 
+function assertSpecialRoleCreation(accountability, { admin = false, public: publicRole = false } = {}) {
+  if (accountability.admin === true || accountability.system === true) return;
+  if (admin || publicRole) {
+    const error = new Error('Delegated role managers cannot create administrator or public roles');
+    error.code = 'FORBIDDEN';
+    throw error;
+  }
+}
+
 export class RolesService extends BaseService {
+  async action(event, payload) {
+    if (!this.emitter) return;
+    await this.emitter.action(event, payload, {
+      accountability: this.accountability,
+      requestId: this.requestId,
+      collection: 'yuncms_roles',
+    });
+  }
+
+  async #readOneUnsafe(id) {
+    const [rows] = await this.database.query(
+      `SELECT id, name, description, admin, public, created_at, updated_at
+       FROM yuncms_roles
+       WHERE id = ?
+       LIMIT 1`,
+      [id],
+    );
+    return rows[0] ?? null;
+  }
+
   async readMany() {
     await resolveSystemResourceAccess(this, 'read', 'yuncms_roles');
     const [rows] = await this.database.query(
@@ -38,18 +60,11 @@ export class RolesService extends BaseService {
 
   async readOne(id) {
     await resolveSystemResourceAccess(this, 'read', 'yuncms_roles');
-    const [rows] = await this.database.query(
-      `SELECT id, name, description, admin, public, created_at, updated_at
-       FROM yuncms_roles
-       WHERE id = ?
-       LIMIT 1`,
-      [id],
-    );
-    return rows[0] ?? null;
+    return this.#readOneUnsafe(id);
   }
 
   async createOne(input = {}) {
-    assertRoleManager(this.accountability);
+    await resolveSystemResourceAccess(this, 'create', 'yuncms_roles');
     const name = normalizeRoleName(input.name);
 
     const admin = input.admin === true;
@@ -59,6 +74,7 @@ export class RolesService extends BaseService {
       error.code = 'INVALID_ROLE';
       throw error;
     }
+    assertSpecialRoleCreation(this.accountability, { admin, public: publicRole });
 
     if (publicRole) {
       const [rows] = await this.database.query(
@@ -83,11 +99,13 @@ export class RolesService extends BaseService {
         publicRole ? 1 : 0,
       ],
     );
-    return this.readOne(id);
+    const role = await this.#readOneUnsafe(id);
+    await this.action('roles.create', { key: id, item: role });
+    return role;
   }
 
   async updateOne(id, patch = {}) {
-    assertRoleManager(this.accountability);
+    await resolveSystemResourceAccess(this, 'update', 'yuncms_roles');
     if (!patch || typeof patch !== 'object' || Array.isArray(patch)) {
       const error = new Error('Role patch must be an object');
       error.code = 'INVALID_PAYLOAD';
@@ -100,7 +118,7 @@ export class RolesService extends BaseService {
       throw error;
     }
 
-    const existing = await this.readOne(id);
+    const existing = await this.#readOneUnsafe(id);
     if (!existing) {
       const error = new Error(`Unknown role: ${id}`);
       error.code = 'ROLE_NOT_FOUND';
@@ -123,12 +141,14 @@ export class RolesService extends BaseService {
       `UPDATE yuncms_roles SET ${assignments.join(', ')} WHERE id = ?`,
       params,
     );
-    return this.readOne(id);
+    const role = await this.#readOneUnsafe(id);
+    await this.action('roles.update', { key: id, item: role, before: existing, changes: patch });
+    return role;
   }
 
   async deleteOne(id) {
-    assertRoleManager(this.accountability);
-    const role = await this.readOne(id);
+    await resolveSystemResourceAccess(this, 'delete', 'yuncms_roles');
+    const role = await this.#readOneUnsafe(id);
     if (!role) {
       const error = new Error(`Unknown role: ${id}`);
       error.code = 'ROLE_NOT_FOUND';
@@ -156,6 +176,7 @@ export class RolesService extends BaseService {
       error.code = 'ROLE_NOT_FOUND';
       throw error;
     }
+    await this.action('roles.delete', { key: id, before: role });
     return true;
   }
-}
+}