@yunsoft/yuncms-core 0.1.3 → 0.1.5

package/src/relation-expansion.js

@@ -1,8 +1,9 @@
 import { assertIdentifier } from './identifier.js';
+import { QUERY_LIMITS } from './query.js';
 import { SchemaCache } from './schema.js';
 import { ItemsService } from './services/items-service.js';
 
-const MAX_EXPAND_FIELDS = 8;
+export const MAX_EXPAND_FIELDS = QUERY_LIMITS.maxRelationExpansions;
 const defaultSchemaCache = new SchemaCache();
 
 function expansionError(code, message, path = null) {
@@ -18,16 +19,24 @@ function normalizeDelimited(value) {
   return values.map((entry) => String(entry).trim()).filter(Boolean);
 }
 
+function assertFieldToken(field, path) {
+  try {
+    assertIdentifier(field, 'field');
+  } catch {
+    throw expansionError('INVALID_QUERY', `Invalid field: ${field}`, path);
+  }
+  return field;
+}
+
 export function parseExpandInput(value) {
   const fields = [...new Set(normalizeDelimited(value))];
   if (fields.length > MAX_EXPAND_FIELDS) {
     throw expansionError(
       'INVALID_QUERY',
-      `expand supports at most ${MAX_EXPAND_FIELDS} direct relation fields`,
+      `expand cannot contain more than ${MAX_EXPAND_FIELDS} entries`,
       'expand',
     );
   }
-
   for (const field of fields) {
     try {
       assertIdentifier(field, 'expand field');
@@ -47,73 +56,199 @@ function parseRelationMetadata(value) {
   }
 }
 
-function withExpansionFields(rawFields, expandFields) {
-  if (rawFields == null || rawFields === '') return rawFields;
-  const selected = normalizeDelimited(rawFields);
-  if (selected.includes('*')) return selected;
-  return [...new Set([...selected, ...expandFields])];
-}
-
-function withoutExpand(query = {}, expandFields = []) {
-  const base = { ...query };
-  delete base.expand;
-  if (expandFields.length > 0 && Object.hasOwn(base, 'fields')) {
-    base.fields = withExpansionFields(base.fields, expandFields);
-  }
-  return base;
-}
-
 async function schemaSnapshot(options) {
   if (options.schema) return options.schema;
   const cache = options.schemaCache ?? defaultSchemaCache;
   return cache.get(options.database);
 }
 
-function directRelation(snapshot, collection, field) {
-  const relation = snapshot.relationByManyField?.get(`${collection}.${field}`);
+function relationFromSnapshot(snapshot, collection, field) {
+  return snapshot.relationByManyField?.get(`${collection}.${field}`) ?? null;
+}
+
+function isDirectRelation(relation) {
+  if (!relation) return false;
+  const metadata = parseRelationMetadata(relation.metadata);
+  return !relation.junction_collection && metadata.kind !== 'm2m';
+}
+
+function directRelation(snapshot, collection, field, path = `fields.${field}`) {
+  const relation = relationFromSnapshot(snapshot, collection, field);
   if (!relation) {
     throw expansionError(
       'INVALID_QUERY',
       `Field is not a direct relation and cannot be expanded: ${collection}.${field}`,
-      `expand.${field}`,
+      path,
     );
   }
 
-  const metadata = parseRelationMetadata(relation.metadata);
-  if (relation.junction_collection || metadata.kind === 'm2m') {
+  if (!isDirectRelation(relation)) {
     throw expansionError(
       'UNSUPPORTED_RELATION_EXPANSION',
-      `Only direct M2O fields can be expanded in V1: ${collection}.${field}`,
-      `expand.${field}`,
+      `Only direct M2O/O2O fields can be expanded: ${collection}.${field}`,
+      path,
     );
   }
   return relation;
 }
 
-async function validateSourceExpansions({ collection, expandFields, options, service }) {
+function readableSourceField(sourceSchema, permission, field) {
+  return Boolean(sourceSchema.fields?.[field]
+    && (!permission.fields || permission.fields.includes(field)));
+}
+
+function directReadableRelationFields(snapshot, collection, sourceSchema, permission) {
+  const prefix = `${collection}.`;
+  const fields = [];
+  for (const [key, relation] of snapshot.relationByManyField?.entries?.() ?? []) {
+    if (!key.startsWith(prefix) || !isDirectRelation(relation)) continue;
+    const field = key.slice(prefix.length);
+    if (readableSourceField(sourceSchema, permission, field)) fields.push(field);
+  }
+  return [...new Set(fields)];
+}
+
+function mergeExpansionSelection(expansions, relationField, targetField) {
+  const current = expansions.get(relationField) ?? [];
+  if (current.includes('*')) return;
+  if (targetField === '*') {
+    expansions.set(relationField, ['*']);
+    return;
+  }
+  expansions.set(relationField, [...new Set([...current, targetField])]);
+}
+
+function assertExpansionLimit(expansions, path = 'fields') {
+  if (expansions.size > MAX_EXPAND_FIELDS) {
+    throw expansionError(
+      'INVALID_QUERY',
+      `Relation expansion cannot contain more than ${MAX_EXPAND_FIELDS} fields`,
+      path,
+    );
+  }
+}
+
+function parseFieldsPlan({ value, snapshot, collection, sourceSchema, permission }) {
+  const tokens = normalizeDelimited(value);
+  if (tokens.length === 0) {
+    return { sourceFields: null, expansions: new Map() };
+  }
+
+  let sourceAll = false;
+  const sourceFields = [];
+  const expansions = new Map();
+
+  for (const token of tokens) {
+    if (token === '*') {
+      sourceAll = true;
+      continue;
+    }
+
+    if (token === '*.*') {
+      sourceAll = true;
+      for (const relationField of directReadableRelationFields(
+        snapshot,
+        collection,
+        sourceSchema,
+        permission,
+      )) {
+        mergeExpansionSelection(expansions, relationField, '*');
+      }
+      assertExpansionLimit(expansions);
+      continue;
+    }
+
+    if (!token.includes('.')) {
+      sourceFields.push(assertFieldToken(token, `fields.${token}`));
+      continue;
+    }
+
+    const parts = token.split('.');
+    if (parts.length !== 2 || !parts[0] || !parts[1]) {
+      throw expansionError(
+        'UNSUPPORTED_RELATION_EXPANSION',
+        `Only one relation depth is supported in fields: ${token}`,
+        `fields.${token}`,
+      );
+    }
+
+    const relationField = assertFieldToken(parts[0], `fields.${token}`);
+    const targetField = parts[1] === '*'
+      ? '*'
+      : assertFieldToken(parts[1], `fields.${token}`);
+
+    if (!readableSourceField(sourceSchema, permission, relationField)) {
+      throw expansionError('INVALID_QUERY', `Unknown field: ${relationField}`, `fields.${token}`);
+    }
+    directRelation(snapshot, collection, relationField, `fields.${token}`);
+    sourceFields.push(relationField);
+    mergeExpansionSelection(expansions, relationField, targetField);
+    assertExpansionLimit(expansions);
+  }
+
+  return {
+    sourceFields: sourceAll ? ['*'] : [...new Set(sourceFields)],
+    expansions,
+  };
+}
+
+function addLegacyExpansions({ query, plan, snapshot, collection, sourceSchema, permission }) {
+  for (const field of parseExpandInput(query.expand)) {
+    if (!readableSourceField(sourceSchema, permission, field)) {
+      throw expansionError('INVALID_QUERY', `Unknown field: ${field}`, `expand.${field}`);
+    }
+    directRelation(snapshot, collection, field, `expand.${field}`);
+    mergeExpansionSelection(plan.expansions, field, '*');
+    assertExpansionLimit(plan.expansions, 'expand');
+    if (plan.sourceFields && !plan.sourceFields.includes('*') && !plan.sourceFields.includes(field)) {
+      plan.sourceFields.push(field);
+    }
+  }
+  return plan;
+}
+
+async function buildSelectionPlan({ collection, query, options, service }) {
   const snapshot = await schemaSnapshot(options);
   const sourceSchema = snapshot.collections?.[collection];
   if (!sourceSchema) {
     throw expansionError('COLLECTION_NOT_FOUND', `Unknown collection: ${collection}`);
   }
-  if (expandFields.length === 0) return snapshot;
 
   const permission = await service.resolvePermission('read');
-  for (const field of expandFields) {
-    if (!sourceSchema.fields?.[field] || (permission.fields && !permission.fields.includes(field))) {
-      throw expansionError('INVALID_QUERY', `Unknown field: ${field}`, `expand.${field}`);
-    }
-    directRelation(snapshot, collection, field);
-  }
-  return snapshot;
+  const plan = parseFieldsPlan({
+    value: query.fields,
+    snapshot,
+    collection,
+    sourceSchema,
+    permission,
+  });
+  addLegacyExpansions({ query, plan, snapshot, collection, sourceSchema, permission });
+  return { ...plan, snapshot };
 }
 
-async function expandRows({ collection, rows, expandFields, options, ItemsServiceClass, snapshot }) {
-  if (expandFields.length === 0 || rows.length === 0) return rows;
+function baseQuery(query, sourceFields) {
+  const base = { ...query };
+  delete base.expand;
+  if (sourceFields == null) delete base.fields;
+  else base.fields = sourceFields;
+  return base;
+}
+
+function projectTarget(target, selection, visibleFields) {
+  const projectedFields = selection.includes('*') ? visibleFields : selection;
+  return Object.fromEntries(
+    projectedFields
+      .filter((field) => Object.hasOwn(target, field))
+      .map((field) => [field, target[field]]),
+  );
+}
+
+async function expandRows({ collection, rows, expansions, options, ItemsServiceClass, snapshot }) {
+  if (expansions.size === 0 || rows.length === 0) return rows;
   const effectiveSnapshot = snapshot ?? await schemaSnapshot(options);
   let expandedRows = rows.map((row) => ({ ...row }));
 
-  for (const field of expandFields) {
+  for (const [field, selection] of expansions) {
     const relation = directRelation(effectiveSnapshot, collection, field);
     const targetCollection = relation.one_collection;
     const targetKey = relation.one_field
@@ -132,21 +267,25 @@ async function expandRows({ collection, rows, expandFields, options, ItemsServic
     }
 
     const targetService = new ItemsServiceClass(targetCollection, options);
-    const targetRows = await targetService.readMany({
-      filter: { [targetKey]: { _in: values } },
-      limit: Math.min(values.length, 500),
+    const targetResult = await targetService.readManyForRelation({
+      fields: selection,
+      lookupField: targetKey,
+      values,
     });
 
     const byKey = new Map();
-    for (const target of targetRows) {
+    for (const target of targetResult.data) {
       if (!Object.hasOwn(target, targetKey)) {
         throw expansionError(
           'FORBIDDEN_FIELD',
           `Expanded relation key is not readable: ${targetCollection}.${targetKey}`,
-          `expand.${field}`,
+          `fields.${field}`,
         );
       }
-      byKey.set(String(target[targetKey]), target);
+      byKey.set(
+        String(target[targetKey]),
+        projectTarget(target, selection, targetResult.visibleFields),
+      );
     }
 
     expandedRows = expandedRows.map((row) => ({
@@ -167,17 +306,16 @@ export async function readManyWithRelations({
   ItemsServiceClass = ItemsService,
 } = {}) {
   assertIdentifier(collection, 'collection name');
-  const expandFields = parseExpandInput(query.expand);
   const service = new ItemsServiceClass(collection, options);
-  const snapshot = await validateSourceExpansions({ collection, expandFields, options, service });
-  const result = await service.readManyWithMeta(withoutExpand(query, expandFields));
+  const plan = await buildSelectionPlan({ collection, query, options, service });
+  const result = await service.readManyWithMeta(baseQuery(query, plan.sourceFields));
   const data = await expandRows({
     collection,
     rows: result.data,
-    expandFields,
+    expansions: plan.expansions,
     options,
     ItemsServiceClass,
-    snapshot,
+    snapshot: plan.snapshot,
   });
   return { ...result, data };
 }
@@ -196,21 +334,17 @@ export async function readOneWithRelations({
     }
   }
 
-  const expandFields = parseExpandInput(query.expand);
   const service = new ItemsServiceClass(collection, options);
-  const snapshot = await validateSourceExpansions({ collection, expandFields, options, service });
-  const fields = withExpansionFields(query.fields ?? null, expandFields);
-  const record = await service.readOne(id, { fields });
+  const plan = await buildSelectionPlan({ collection, query, options, service });
+  const record = await service.readOne(id, { fields: plan.sourceFields });
   if (!record) return null;
   const [expanded] = await expandRows({
     collection,
     rows: [record],
-    expandFields,
+    expansions: plan.expansions,
     options,
     ItemsServiceClass,
-    snapshot,
+    snapshot: plan.snapshot,
   });
   return expanded;
 }
-
-export { MAX_EXPAND_FIELDS };

package/src/services/files-service.js

@@ -1,5 +1,6 @@
 import { randomUUID } from 'node:crypto';
 
+import { compileFilter } from '../query.js';
 import { BaseService } from './base-service.js';
 import { resolveSystemResourceAccess } from './system-resource-access.js';
 
@@ -27,6 +28,38 @@ function normalizeMimeType(value) {
   return mimetype;
 }
 
+function startsWithBytes(buffer, bytes, offset = 0) {
+  if (buffer.byteLength < offset + bytes.length) return false;
+  return bytes.every((byte, index) => buffer[offset + index] === byte);
+}
+
+function hasKnownMimeSignature(contents, mimetype) {
+  const buffer = Buffer.isBuffer(contents) ? contents : Buffer.from(contents);
+  switch (mimetype) {
+    case 'application/pdf':
+      return startsWithBytes(buffer, [0x25, 0x50, 0x44, 0x46, 0x2d]);
+    case 'image/png':
+      return startsWithBytes(buffer, [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+    case 'image/jpeg':
+      return startsWithBytes(buffer, [0xff, 0xd8, 0xff]);
+    case 'image/gif':
+      return buffer.subarray(0, 6).toString('ascii') === 'GIF87a'
+        || buffer.subarray(0, 6).toString('ascii') === 'GIF89a';
+    case 'image/webp':
+      return buffer.subarray(0, 4).toString('ascii') === 'RIFF'
+        && buffer.subarray(8, 12).toString('ascii') === 'WEBP';
+    default:
+      return null;
+  }
+}
+
+function assertMimeSignature(contents, mimetype) {
+  const matches = hasKnownMimeSignature(contents, mimetype);
+  if (matches === false) {
+    throw fileError('FILE_MIME_MISMATCH', `File contents do not match declared MIME type: ${mimetype}`);
+  }
+}
+
 function decodeJson(value) {
   if (value == null || typeof value === 'object') return value ?? null;
   try {
@@ -56,6 +89,31 @@ export class FilesService extends BaseService {
     });
   }
 
+  #compileReadScope(permission, id = null) {
+    let sql = '';
+    let params = [];
+
+    if (permission?.filter) {
+      const collectionSchema = this.schema?.collections?.yuncms_files;
+      if (!collectionSchema) {
+        throw fileError(
+          'SYSTEM_SCHEMA_REQUIRED',
+          'System schema is required to enforce a filtered Files permission',
+        );
+      }
+      const compiled = compileFilter(permission.filter, collectionSchema);
+      sql = compiled.sql;
+      params = [...compiled.params];
+    }
+
+    if (id != null) {
+      sql = sql ? `${sql} AND id = ?` : ' WHERE id = ?';
+      params.push(id);
+    }
+
+    return { sql, params };
+  }
+
   async #readOneUnsafe(id) {
     const [rows] = await this.database.query(
       `SELECT id, storage, filename_disk, filename_download, title, mimetype, filesize,
@@ -68,20 +126,34 @@ export class FilesService extends BaseService {
     return normalizeRow(rows[0]);
   }
 
+  async #readOneAuthorized(id, permission) {
+    const scope = this.#compileReadScope(permission, id);
+    const [rows] = await this.database.query(
+      `SELECT id, storage, filename_disk, filename_download, title, mimetype, filesize,
+              uploaded_by, uploaded_at, metadata
+       FROM yuncms_files${scope.sql}
+       LIMIT 1`,
+      scope.params,
+    );
+    return normalizeRow(rows[0]);
+  }
+
   async readMany() {
-    await resolveSystemResourceAccess(this, 'read', 'yuncms_files');
+    const permission = await resolveSystemResourceAccess(this, 'read', 'yuncms_files');
+    const scope = this.#compileReadScope(permission);
     const [rows] = await this.database.query(
       `SELECT id, storage, filename_disk, filename_download, title, mimetype, filesize,
               uploaded_by, uploaded_at, metadata
-       FROM yuncms_files
+       FROM yuncms_files${scope.sql}
        ORDER BY uploaded_at DESC, id DESC`,
+      scope.params,
     );
     return rows.map(normalizeRow);
   }
 
   async readOne(id) {
-    await resolveSystemResourceAccess(this, 'read', 'yuncms_files');
-    return this.#readOneUnsafe(id);
+    const permission = await resolveSystemResourceAccess(this, 'read', 'yuncms_files');
+    return this.#readOneAuthorized(id, permission);
   }
 
   async createOne({
@@ -100,6 +172,7 @@ export class FilesService extends BaseService {
 
     const filename = normalizeFilename(filenameDownload);
     const normalizedMime = normalizeMimeType(mimetype);
+    assertMimeSignature(contents, normalizedMime);
     const driver = this.storage.get(storage);
     const id = randomUUID();
     const filenameDisk = id;
@@ -144,8 +217,8 @@ export class FilesService extends BaseService {
   }
 
   async readContent(id) {
-    await resolveSystemResourceAccess(this, 'read', 'yuncms_files');
-    const file = await this.#readOneUnsafe(id);
+    const permission = await resolveSystemResourceAccess(this, 'read', 'yuncms_files');
+    const file = await this.#readOneAuthorized(id, permission);
     if (!file) throw fileError('FILE_NOT_FOUND', `Unknown file: ${id}`);
     const driver = this.storage.get(file.storage);
     const contents = await driver.get(file.filename_disk);
@@ -225,4 +298,9 @@ export class FilesService extends BaseService {
   }
 }
 
-export { normalizeFilename, normalizeMimeType };
+export {
+  assertMimeSignature,
+  hasKnownMimeSignature,
+  normalizeFilename,
+  normalizeMimeType,
+};

package/src/services/items-service.js

@@ -7,6 +7,7 @@ import {
   compileSelectFields,
   compileSort,
   parseItemsQuery,
+  QUERY_LIMITS,
 } from '../query.js';
 import { SchemaCache } from '../schema.js';
 import { isSystemManagedField, systemMutationEntries } from '../system-fields.js';
@@ -215,6 +216,58 @@ export class ItemsService extends BaseService {
     };
   }
 
+  async readManyForRelation({ fields = null, lookupField, values = [] } = {}) {
+    const schema = await this.getCollectionSchema();
+    const trustedLookupField = assertIdentifier(lookupField, 'relation lookup field');
+    if (!schema.fields[trustedLookupField]) {
+      throw serviceError(
+        'INVALID_QUERY',
+        `Unknown relation lookup field: ${trustedLookupField}`,
+        trustedLookupField,
+      );
+    }
+    if (!Array.isArray(values) || values.length === 0 || values.length > QUERY_LIMITS.maxLimit) {
+      throw serviceError(
+        'INVALID_QUERY',
+        `Relation lookup values must contain between 1 and ${QUERY_LIMITS.maxLimit} entries`,
+        trustedLookupField,
+      );
+    }
+
+    const permission = await this.resolvePermission('read');
+    const accessSchema = schemaForFields(schema, permission.fields);
+    const visibleSelection = compileSelectFields(normalizeFields(fields), accessSchema);
+    const internalSchema = {
+      ...accessSchema,
+      fields: {
+        ...accessSchema.fields,
+        [trustedLookupField]: schema.fields[trustedLookupField],
+      },
+    };
+    const internalSelection = compileSelectFields(
+      [...visibleSelection.fields, trustedLookupField],
+      internalSchema,
+    );
+    const permissionFilter = compileFilter(permission.filter, schema);
+    const table = quoteIdentifier(this.collection, 'collection name');
+    const data = [];
+
+    for (let offset = 0; offset < values.length; offset += QUERY_LIMITS.maxInValues) {
+      const chunk = values.slice(offset, offset + QUERY_LIMITS.maxInValues);
+      const filter = combineCompiledFilters(
+        permissionFilter,
+        compileFilter({ [trustedLookupField]: { _in: chunk } }, schema),
+      );
+      const [rows] = await this.database.query(
+        `SELECT ${internalSelection.sql} FROM ${table}${filter.sql} LIMIT ?`,
+        [...filter.params, chunk.length],
+      );
+      data.push(...rows);
+    }
+
+    return { data, visibleFields: visibleSelection.fields };
+  }
+
   async readOne(id, { fields = null } = {}) {
     const schema = await this.getCollectionSchema();
     const permission = await this.resolvePermission('read');
@@ -464,4 +517,4 @@ export class ItemsService extends BaseService {
   }
 }
 
-export { MAX_BULK_VALIDATION_ROWS, createCandidateRecord };
+export { MAX_BULK_VALIDATION_ROWS, createCandidateRecord };

package/src/services/permissions-service.js

@@ -4,7 +4,7 @@ import { assertPermissionValidationRule } from '../permission-validation.js';
 import { compileFilter } from '../query.js';
 import { SchemaCache } from '../schema.js';
 import {
-  assertActionOnlyPermissionPayload,
+  assertSystemPermissionPayload,
   assertSystemResourceAction,
   isPermissionManagedSystemResource,
 } from '../system-permissions.js';
@@ -86,6 +86,15 @@ export class PermissionsService extends BaseService {
     this.schemaCache = options.schemaCache ?? defaultSchemaCache;
   }
 
+  async action(event, payload) {
+    if (!this.emitter) return;
+    await this.emitter.action(event, payload, {
+      accountability: this.accountability,
+      requestId: this.requestId,
+      collection: 'yuncms_permissions',
+    });
+  }
+
   async #collectionSchema(collection) {
     const snapshot = this.schema ?? await this.schemaCache.get(this.database);
     const collectionSchema = snapshot.collections?.[collection];
@@ -100,7 +109,10 @@ export class PermissionsService extends BaseService {
   async resolve(action, collection) {
     assertAction(action);
     const key = cacheKey(this.accountability, action, collection);
-    if (this.permissionCache?.has(key)) return this.permissionCache.get(key);
+    if (this.permissionCache) {
+      const cached = await this.permissionCache.get(key);
+      if (cached !== undefined) return cached;
+    }
 
     let permission;
     if (this.accountability.admin === true || this.accountability.system === true) {
@@ -159,7 +171,7 @@ export class PermissionsService extends BaseService {
       };
     }
 
-    this.permissionCache?.set(key, permission);
+    if (this.permissionCache) await this.permissionCache.set(key, permission);
     return permission;
   }
 
@@ -205,7 +217,7 @@ export class PermissionsService extends BaseService {
         throw error;
       }
       assertSystemResourceAction(collectionSchema, action);
-      assertActionOnlyPermissionPayload(collectionSchema, input);
+      assertSystemPermissionPayload(collectionSchema, action, input);
     }
 
     const fields = normalizePermissionFields(input.fields ?? null, collectionSchema);
@@ -224,11 +236,6 @@ export class PermissionsService extends BaseService {
       error.code = 'ROLE_NOT_FOUND';
       throw error;
     }
-    if (collectionSchema.system && role.public) {
-      const error = new Error('Public role cannot be granted access to protected system resources');
-      error.code = 'PUBLIC_SYSTEM_ACCESS_FORBIDDEN';
-      throw error;
-    }
 
     const id = randomUUID();
     await this.database.query(
@@ -244,8 +251,10 @@ export class PermissionsService extends BaseService {
         validation == null ? null : JSON.stringify(validation),
       ],
     );
-    this.permissionCache?.clear();
-    return this.readOne(id);
+    if (this.permissionCache) await this.permissionCache.clear();
+    const permission = await this.readOne(id);
+    await this.action('permissions.create', { key: id, item: permission });
+    return permission;
   }
 
   async updateOne(id, patch = {}) {
@@ -269,7 +278,9 @@ export class PermissionsService extends BaseService {
       throw error;
     }
     const collectionSchema = await this.#collectionSchema(existing.collection);
-    if (collectionSchema.system) assertActionOnlyPermissionPayload(collectionSchema, patch);
+    if (collectionSchema.system) {
+      assertSystemPermissionPayload(collectionSchema, existing.action, patch);
+    }
 
     const assignments = [];
     const params = [];
@@ -294,12 +305,20 @@ export class PermissionsService extends BaseService {
       `UPDATE yuncms_permissions SET ${assignments.join(', ')} WHERE id = ?`,
       params,
     );
-    this.permissionCache?.clear();
-    return this.readOne(id);
+    if (this.permissionCache) await this.permissionCache.clear();
+    const permission = await this.readOne(id);
+    await this.action('permissions.update', {
+      key: id,
+      before: existing,
+      item: permission,
+      changes: patch,
+    });
+    return permission;
   }
 
   async deleteOne(id) {
     assertPermissionManager(this.accountability);
+    const before = this.emitter ? await this.readOne(id) : null;
     const [result] = await this.database.query(
       'DELETE FROM yuncms_permissions WHERE id = ?',
       [id],
@@ -309,7 +328,8 @@ export class PermissionsService extends BaseService {
       error.code = 'PERMISSION_NOT_FOUND';
       throw error;
     }
-    this.permissionCache?.clear();
+    if (this.permissionCache) await this.permissionCache.clear();
+    await this.action('permissions.delete', { key: id, before });
     return true;
   }
 }