@yunsoft/yuncms-core 0.1.24 → 0.1.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yunsoft/yuncms-core",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "description": "Core services, schema, authentication, permissions and storage primitives for YunCMS.",
   "license": "MIT",
   "type": "module",

package/src/query.js

@@ -47,6 +47,9 @@ function normalizeDelimited(value, label, { maxItems }) {
 
 function normalizeInteger(value, fallback, { label, min, max }) {
   if (value == null || value === '') return fallback;
+  if (typeof value === 'object' || typeof value === 'boolean') {
+    throw queryError(`${label} must be an integer between ${min} and ${max}`, label);
+  }
   const number = Number(value);
   if (!Number.isInteger(number) || number < min || number > max) {
     throw queryError(`${label} must be an integer between ${min} and ${max}`, label);

package/src/services/items-service.js

@@ -14,7 +14,7 @@ import {
 } from '../query.js';
 import { SchemaCache } from '../schema.js';
 import { isSystemManagedField, systemMutationEntries } from '../system-fields.js';
-import { withTransaction } from '../transaction.js';
+import { dispatchAfterCommit, transactionContext, withTransaction } from '../transaction.js';
 import { BaseService } from './base-service.js';
 import { PermissionsService } from './permissions-service.js';
 
@@ -139,6 +139,8 @@ export class ItemsService extends BaseService {
       accountability: this.accountability,
       collection: this.collection,
       requestId: this.requestId,
+      database: this.database,
+      transaction: transactionContext(this.database),
       ...extra,
     };
   }
@@ -150,7 +152,10 @@ export class ItemsService extends BaseService {
 
   async actionMutation(event, payload, context = {}) {
     if (!this.emitter) return;
-    await this.emitter.action(event, payload, this.hookContext(context));
+    const eventContext = this.hookContext(context);
+    const eventPayload = eventContext.transaction ? structuredClone(payload) : payload;
+    await dispatchAfterCommit(this.database, (database, transaction) =>
+      this.emitter.action(event, eventPayload, { ...eventContext, database, transaction }));
   }
 
   async getCollectionSchema(database = this.database) {
@@ -226,10 +231,10 @@ export class ItemsService extends BaseService {
     return combineCompiledFilters(permissionSql, userSql, searchSql);
   }
 
-  async normalizeReadQuery(rawQuery) {
+  async normalizeReadQuery(rawQuery, context = {}) {
     const parsed = parseItemsQuery(rawQuery);
     const filtered = this.emitter
-      ? await this.emitter.filter('items.query', parsed, this.hookContext({ operation: 'read' }))
+      ? await this.emitter.filter('items.query', parsed, this.hookContext({ ...context, operation: 'read' }))
       : parsed;
     const query = parseItemsQuery(filtered);
     assertQueryCost(query);
@@ -358,14 +363,18 @@ export class ItemsService extends BaseService {
 
   async readOne(id, { fields = null } = {}) {
     const schema = await this.getCollectionSchema();
+    const query = await this.normalizeReadQuery({ fields, limit: 1 }, { single: true, key: id });
+    if (query.aggregate) {
+      throw serviceError('INVALID_QUERY', 'Single-item reads do not support aggregate queries', 'aggregate');
+    }
     const permission = await this.resolvePermission('read');
     const accessSchema = schemaForFields(schema, permission.fields);
-    const selected = compileSelectFields(normalizeFields(fields), accessSchema);
+    const selected = compileSelectFields(query.fields, accessSchema);
     const table = quoteIdentifier(this.collection, 'collection name');
     const primaryKey = schema.primary_key;
     const dynamicVariables = this.dynamicVariables();
     const filter = combineCompiledFilters(
-      compileFilter(permission.filter, schema, { dynamicVariables }),
+      this.compileActionFilters(query.filter, permission.filter, accessSchema, schema, query.search, dynamicVariables),
       compileFilter({ [primaryKey]: { _eq: id } }, schema),
     );
     const [rows] = await this.database.query(
@@ -373,7 +382,7 @@ export class ItemsService extends BaseService {
       filter.params,
     );
     const record = rows[0] ?? null;
-    if (record) await this.emitReadAction({ fields: normalizeFields(fields) }, [record], schema, { single: true });
+    if (record) await this.emitReadAction(query, [record], schema, { single: true });
     return record;
   }
 

package/src/transaction.js

@@ -5,6 +5,33 @@ const ISOLATION_LEVELS = new Set([
   'SERIALIZABLE',
 ]);
 
+const transactions = new WeakMap();
+
+export function transactionContext(database) {
+  return transactions.has(database) ? Object.freeze({ managed: true, state: 'active' }) : null;
+}
+
+export async function dispatchAfterCommit(database, action) {
+  const transaction = transactions.get(database);
+  if (transaction) {
+    transaction.actions.push(action);
+    return;
+  }
+  await action(database, null);
+}
+
+function validateOperation(database, operation) {
+  if (!database) throw new Error('Database connection is required');
+  if (typeof operation !== 'function') throw new Error('Transaction operation is required');
+}
+
+function joinTransaction(connection, operation, options) {
+  if (options.isolationLevel && String(options.isolationLevel).toUpperCase() !== transactions.get(connection).isolationLevel) {
+    throw new Error('A nested transaction cannot change the outer isolation level');
+  }
+  return operation(connection);
+}
+
 async function setIsolationLevel(connection, isolationLevel) {
   if (!isolationLevel) return;
   const level = String(isolationLevel).toUpperCase();
@@ -14,17 +41,16 @@ async function setIsolationLevel(connection, isolationLevel) {
   await connection.query(`SET TRANSACTION ISOLATION LEVEL ${level}`);
 }
 
-export async function withConnectionTransaction(connection, operation, options = {}) {
-  if (!connection) throw new Error('Database connection is required');
-  if (typeof operation !== 'function') throw new Error('Transaction operation is required');
-
+async function executeTransaction(connection, operation, options) {
   await setIsolationLevel(connection, options.isolationLevel);
   await connection.beginTransaction();
+  const transaction = { actions: [], isolationLevel: options.isolationLevel ? String(options.isolationLevel).toUpperCase() : null };
+  transactions.set(connection, transaction);
 
   try {
     const result = await operation(connection);
     await connection.commit();
-    return result;
+    return { result, actions: transaction.actions };
   } catch (error) {
     try {
       await connection.rollback();
@@ -32,15 +58,36 @@ export async function withConnectionTransaction(connection, operation, options =
       error.rollbackError = rollbackError;
     }
     throw error;
+  } finally {
+    transactions.delete(connection);
   }
 }
 
+async function finishActions(committed, database) {
+  const context = Object.freeze({ managed: true, state: 'committed' });
+  for (const action of committed.actions) await action(database, context);
+  return committed.result;
+}
+
+export async function withConnectionTransaction(connection, operation, options = {}) {
+  validateOperation(connection, operation);
+  if (transactions.has(connection)) return joinTransaction(connection, operation, options);
+  const committed = await executeTransaction(connection, operation, options);
+  // This connection belongs to the caller and remains usable for post-commit actions.
+  return finishActions(committed, connection);
+}
+
 export async function withTransaction(pool, operation, options = {}) {
+  validateOperation(pool, operation);
+  if (transactions.has(pool)) return joinTransaction(pool, operation, options);
+  if (typeof pool.getConnection !== 'function') return withConnectionTransaction(pool, operation, options);
   const connection = await pool.getConnection();
-
+  let committed;
   try {
-    return await withConnectionTransaction(connection, operation, options);
+    committed = await executeTransaction(connection, operation, options);
   } finally {
     connection.release();
   }
+  // Return the borrowed connection before hooks acquire connections from the pool.
+  return finishActions(committed, pool);
 }