@yunsoft/yuncms-core 0.1.22 → 0.1.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yunsoft/yuncms-core",
-  "version": "0.1.22",
+  "version": "0.1.24",
   "description": "Core services, schema, authentication, permissions and storage primitives for YunCMS.",
   "license": "MIT",
   "type": "module",
@@ -31,6 +31,10 @@
   "dependencies": {
     "@aws-sdk/client-s3": "3.1100.0",
     "mysql2": "3.23.2",
-    "nodemailer": "9.1.1"
+    "nodemailer": "10.0.13"
+  },
+  "funding": {
+    "type": "github",
+    "url": "https://github.com/sponsors/Yunsoft-Software"
   }
 }

package/src/bootstrap.js

@@ -20,6 +20,7 @@ import { mcpSettingsMigration } from './migrations/0017-mcp-settings.js';
 import { publicRegistrationSettingsMigration } from './migrations/0018-public-registration-settings.js';
 import { publicRegistrationEmailVerificationMigration } from './migrations/0019-public-registration-email-verification.js';
 import { studioLocalesMigration } from './migrations/0020-studio-locales.js';
+import { aiAutomationsMigration } from './migrations/0021-ai-automations.js';
 import { readSchemaVersion } from './schema-version.js';
 import { ensurePublicRole } from './setup.js';
 
@@ -44,6 +45,7 @@ export const CORE_MIGRATIONS = Object.freeze([
   publicRegistrationSettingsMigration,
   publicRegistrationEmailVerificationMigration,
   studioLocalesMigration,
+  aiAutomationsMigration,
 ]);
 
 export const REQUIRED_CORE_MIGRATION_IDS = Object.freeze(

package/src/migrations/0021-ai-automations.js

@@ -0,0 +1,43 @@
+export const aiAutomationsMigration = Object.freeze({
+  id: '0021-ai-automations',
+  statements: [
+    `CREATE TABLE yuncms_ai_automations (
+      id CHAR(36) NOT NULL PRIMARY KEY,
+      name VARCHAR(120) NOT NULL,
+      collection VARCHAR(64) NOT NULL,
+      run_as CHAR(36) NOT NULL,
+      enabled TINYINT(1) NOT NULL DEFAULT 0,
+      on_create TINYINT(1) NOT NULL DEFAULT 1,
+      on_update TINYINT(1) NOT NULL DEFAULT 0,
+      input_fields JSON NOT NULL,
+      output_fields JSON NOT NULL,
+      instruction TEXT NOT NULL,
+      revision INT UNSIGNED NOT NULL DEFAULT 1,
+      created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+      updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+      INDEX idx_ai_automations_collection (collection, enabled),
+      CONSTRAINT fk_ai_automation_collection FOREIGN KEY (collection)
+        REFERENCES yuncms_collections (collection) ON DELETE CASCADE,
+      CONSTRAINT fk_ai_automation_user FOREIGN KEY (run_as)
+        REFERENCES yuncms_users (id) ON DELETE RESTRICT
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+    `CREATE TABLE yuncms_ai_automation_runs (
+      id CHAR(36) NOT NULL PRIMARY KEY,
+      automation_id CHAR(36) NOT NULL,
+      revision INT UNSIGNED NOT NULL,
+      item_key VARCHAR(191) NOT NULL,
+      status VARCHAR(16) NOT NULL DEFAULT 'pending',
+      attempts INT UNSIGNED NOT NULL DEFAULT 0,
+      error_code VARCHAR(100) NULL,
+      available_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+      created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+      finished_at DATETIME(3) NULL,
+      INDEX idx_ai_automation_queue (status, available_at),
+      INDEX idx_ai_automation_history (automation_id, created_at),
+      CONSTRAINT fk_ai_automation_run FOREIGN KEY (automation_id)
+        REFERENCES yuncms_ai_automations (id) ON DELETE CASCADE,
+      CONSTRAINT chk_ai_automation_run_status
+        CHECK (status IN ('pending', 'running', 'succeeded', 'failed', 'skipped'))
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+  ],
+});

package/src/query.js

@@ -222,26 +222,60 @@ export function compileAggregate(aggregate, groupBy, schema) {
   };
 }
 
-function compileOperator(fieldSql, operator, value, path, limits) {
+function datetimeFilterValue(value, path, { allowUnresolvedDynamicVariables = false } = {}) {
+  // Schema-only permission validation keeps recognized dynamic values unresolved.
+  // resolveDynamicVariables already validates their syntax before compilation.
+  if (allowUnresolvedDynamicVariables && typeof value === 'string'
+    && (value === '$NOW' || value.toUpperCase().startsWith('$NOW('))) return value;
+  if (value instanceof Date) {
+    if (Number.isNaN(value.getTime()) || value.getUTCFullYear() < 1000 || value.getUTCFullYear() > 9999) {
+      throw queryError('Invalid datetime filter value', path);
+    }
+    return value;
+  }
+  const match = typeof value === 'string'
+    ? /^(\d{4})-(\d{2})-(\d{2})([T ])(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,6}))?(Z|[+-]\d{2}:\d{2})?$/u.exec(value)
+    : null;
+  if (!match || (match[4] === 'T' ? !match[9] : Boolean(match[9]))) {
+    throw queryError('Datetime filters require a timezone-bearing ISO value or a MySQL datetime', path);
+  }
+  const [, year, month, day, , hour, minute, second, , zone] = match;
+  const daysInMonth = new Date(Date.UTC(Number(year), Number(month), 0)).getUTCDate();
+  if (Number(year) < 1000 || Number(month) < 1 || Number(month) > 12
+    || Number(day) < 1 || Number(day) > daysInMonth
+    || Number(hour) > 23 || Number(minute) > 59 || Number(second) > 59) {
+    throw queryError('Invalid datetime filter value', path);
+  }
+  if (!zone) return value;
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime()) || date.getUTCFullYear() < 1000 || date.getUTCFullYear() > 9999) {
+    throw queryError('Invalid datetime filter value', path);
+  }
+  return date;
+}
+
+function compileOperator(fieldSql, operator, value, path, limits, field) {
   if (!FILTER_OPERATORS.has(operator)) throw queryError(`Unknown filter operator: ${operator}`, path);
+  const temporal = field.type === 'datetime' || field.type === 'timestamp';
+  const normalize = (entry) => temporal ? datetimeFilterValue(entry, path, limits) : entry;
   switch (operator) {
     case '_eq':
       if (value === null) throw queryError('Use _null for NULL comparisons', path);
-      return { sql: `${fieldSql} = ?`, params: [value] };
+      return { sql: `${fieldSql} = ?`, params: [normalize(value)] };
     case '_neq':
       if (value === null) throw queryError('Use _nnull for NULL comparisons', path);
-      return { sql: `${fieldSql} <> ?`, params: [value] };
-    case '_lt': return { sql: `${fieldSql} < ?`, params: [value] };
-    case '_lte': return { sql: `${fieldSql} <= ?`, params: [value] };
-    case '_gt': return { sql: `${fieldSql} > ?`, params: [value] };
-    case '_gte': return { sql: `${fieldSql} >= ?`, params: [value] };
+      return { sql: `${fieldSql} <> ?`, params: [normalize(value)] };
+    case '_lt': return { sql: `${fieldSql} < ?`, params: [normalize(value)] };
+    case '_lte': return { sql: `${fieldSql} <= ?`, params: [normalize(value)] };
+    case '_gt': return { sql: `${fieldSql} > ?`, params: [normalize(value)] };
+    case '_gte': return { sql: `${fieldSql} >= ?`, params: [normalize(value)] };
     case '_in':
     case '_nin': {
       if (!Array.isArray(value)) throw queryError(`${operator} requires an array`, path);
       if (value.length > limits.maxInValues) throw queryError(`${operator} accepts at most ${limits.maxInValues} values`, path);
       if (value.length === 0) return { sql: operator === '_in' ? '0 = 1' : '1 = 1', params: [] };
       const placeholders = value.map(() => '?').join(', ');
-      return { sql: `${fieldSql} ${operator === '_in' ? 'IN' : 'NOT IN'} (${placeholders})`, params: value };
+      return { sql: `${fieldSql} ${operator === '_in' ? 'IN' : 'NOT IN'} (${placeholders})`, params: value.map(normalize) };
     }
     case '_null':
     case '_nnull': {
@@ -272,12 +306,12 @@ function compileFilterObject(filter, schema, path, limits, state, depth) {
       for (const child of children) params.push(...child.params);
       continue;
     }
-    resolveField(schema, key, `${path}.${key}`);
+    const field = resolveField(schema, key, `${path}.${key}`);
     if (!value || typeof value !== 'object' || Array.isArray(value)) throw queryError('Field filters must be operator objects', `${path}.${key}`);
     const fieldSql = quoteIdentifier(key, 'field name');
     const fieldFragments = [];
     for (const [operator, operatorValue] of Object.entries(value)) {
-      const compiled = compileOperator(fieldSql, operator, operatorValue, `${path}.${key}.${operator}`, limits);
+      const compiled = compileOperator(fieldSql, operator, operatorValue, `${path}.${key}.${operator}`, limits, field);
       fieldFragments.push(compiled.sql);
       params.push(...compiled.params);
     }
@@ -295,7 +329,7 @@ export function compileFilter(filter, schema, options = {}) {
     allowUnresolvedDynamicVariables = false,
     ...limitOptions
   } = options;
-  const limits = { ...QUERY_LIMITS, ...limitOptions };
+  const limits = { ...QUERY_LIMITS, ...limitOptions, allowUnresolvedDynamicVariables };
   const resolvedFilter = resolveDynamicVariables(filter, dynamicVariables, {
     allowUnresolved: allowUnresolvedDynamicVariables,
     path: 'filter',