@yunsoft/yuncms-core 0.1.3 → 0.1.5

package/src/services/roles-service.js

@@ -3,13 +3,6 @@ import { randomUUID } from 'node:crypto';
 import { BaseService } from './base-service.js';
 import { resolveSystemResourceAccess } from './system-resource-access.js';
 
-function assertRoleManager(accountability) {
-  if (accountability.admin === true || accountability.system === true) return;
-  const error = new Error('Role management requires administrator accountability');
-  error.code = 'FORBIDDEN';
-  throw error;
-}
-
 function normalizeRoleName(name) {
   if (!name || typeof name !== 'string' || name.trim().length === 0) {
     const error = new Error('Role name is required');
@@ -25,7 +18,36 @@ function normalizeRoleName(name) {
   return normalized;
 }
 
+function assertSpecialRoleCreation(accountability, { admin = false, public: publicRole = false } = {}) {
+  if (accountability.admin === true || accountability.system === true) return;
+  if (admin || publicRole) {
+    const error = new Error('Delegated role managers cannot create administrator or public roles');
+    error.code = 'FORBIDDEN';
+    throw error;
+  }
+}
+
 export class RolesService extends BaseService {
+  async action(event, payload) {
+    if (!this.emitter) return;
+    await this.emitter.action(event, payload, {
+      accountability: this.accountability,
+      requestId: this.requestId,
+      collection: 'yuncms_roles',
+    });
+  }
+
+  async #readOneUnsafe(id) {
+    const [rows] = await this.database.query(
+      `SELECT id, name, description, admin, public, created_at, updated_at
+       FROM yuncms_roles
+       WHERE id = ?
+       LIMIT 1`,
+      [id],
+    );
+    return rows[0] ?? null;
+  }
+
   async readMany() {
     await resolveSystemResourceAccess(this, 'read', 'yuncms_roles');
     const [rows] = await this.database.query(
@@ -38,18 +60,11 @@ export class RolesService extends BaseService {
 
   async readOne(id) {
     await resolveSystemResourceAccess(this, 'read', 'yuncms_roles');
-    const [rows] = await this.database.query(
-      `SELECT id, name, description, admin, public, created_at, updated_at
-       FROM yuncms_roles
-       WHERE id = ?
-       LIMIT 1`,
-      [id],
-    );
-    return rows[0] ?? null;
+    return this.#readOneUnsafe(id);
   }
 
   async createOne(input = {}) {
-    assertRoleManager(this.accountability);
+    await resolveSystemResourceAccess(this, 'create', 'yuncms_roles');
     const name = normalizeRoleName(input.name);
 
     const admin = input.admin === true;
@@ -59,6 +74,7 @@ export class RolesService extends BaseService {
       error.code = 'INVALID_ROLE';
       throw error;
     }
+    assertSpecialRoleCreation(this.accountability, { admin, public: publicRole });
 
     if (publicRole) {
       const [rows] = await this.database.query(
@@ -83,11 +99,13 @@ export class RolesService extends BaseService {
         publicRole ? 1 : 0,
       ],
     );
-    return this.readOne(id);
+    const role = await this.#readOneUnsafe(id);
+    await this.action('roles.create', { key: id, item: role });
+    return role;
   }
 
   async updateOne(id, patch = {}) {
-    assertRoleManager(this.accountability);
+    await resolveSystemResourceAccess(this, 'update', 'yuncms_roles');
     if (!patch || typeof patch !== 'object' || Array.isArray(patch)) {
       const error = new Error('Role patch must be an object');
       error.code = 'INVALID_PAYLOAD';
@@ -100,7 +118,7 @@ export class RolesService extends BaseService {
       throw error;
     }
 
-    const existing = await this.readOne(id);
+    const existing = await this.#readOneUnsafe(id);
     if (!existing) {
       const error = new Error(`Unknown role: ${id}`);
       error.code = 'ROLE_NOT_FOUND';
@@ -123,12 +141,14 @@ export class RolesService extends BaseService {
       `UPDATE yuncms_roles SET ${assignments.join(', ')} WHERE id = ?`,
       params,
     );
-    return this.readOne(id);
+    const role = await this.#readOneUnsafe(id);
+    await this.action('roles.update', { key: id, item: role, before: existing, changes: patch });
+    return role;
   }
 
   async deleteOne(id) {
-    assertRoleManager(this.accountability);
-    const role = await this.readOne(id);
+    await resolveSystemResourceAccess(this, 'delete', 'yuncms_roles');
+    const role = await this.#readOneUnsafe(id);
     if (!role) {
       const error = new Error(`Unknown role: ${id}`);
       error.code = 'ROLE_NOT_FOUND';
@@ -156,6 +176,7 @@ export class RolesService extends BaseService {
       error.code = 'ROLE_NOT_FOUND';
       throw error;
     }
+    await this.action('roles.delete', { key: id, before: role });
     return true;
   }
-}
+}

package/src/services/users-service.js

@@ -63,6 +63,13 @@ async function assertRoleAssignable(database, role, accountability) {
   if (targetRole.admin && accountability.admin !== true && accountability.system !== true) {
     throw forbidden('Only an administrator can assign the administrator role');
   }
+  if (
+    accountability.admin !== true
+    && accountability.system !== true
+    && role !== accountability.role
+  ) {
+    throw forbidden('Delegated user managers may assign only their own role');
+  }
 }
 
 async function assertTargetManageable(database, id, accountability) {
@@ -84,6 +91,15 @@ async function assertTargetManageable(database, id, accountability) {
 }
 
 export class UsersService extends BaseService {
+  async action(event, payload) {
+    if (!this.emitter) return;
+    await this.emitter.action(event, payload, {
+      accountability: this.accountability,
+      requestId: this.requestId,
+      collection: 'yuncms_users',
+    });
+  }
+
   async #readOneUnsafe(id) {
     const [rows] = await this.database.query(
       `SELECT id, email, role, status, email_verified_at, last_access, created_at, updated_at
@@ -133,7 +149,9 @@ export class UsersService extends BaseService {
       ],
     );
 
-    return this.#readOneUnsafe(id);
+    const user = await this.#readOneUnsafe(id);
+    await this.action('users.create', { key: id, item: user });
+    return user;
   }
 
   async updateOne(id, patch = {}) {
@@ -163,7 +181,7 @@ export class UsersService extends BaseService {
       await assertRoleAssignable(this.database, patch.role, this.accountability);
     }
 
-    return withTransaction(this.database, async (connection) => {
+    const user = await withTransaction(this.database, async (connection) => {
       const assignments = [];
       const params = [];
 
@@ -202,6 +220,8 @@ export class UsersService extends BaseService {
       );
       return rows[0] ?? null;
     });
+    await this.action('users.update', { key: id, item: user, changes: patch });
+    return user;
   }
 
   async deleteOne(id) {
@@ -212,12 +232,14 @@ export class UsersService extends BaseService {
       error.code = 'SELF_ADMIN_MUTATION_FORBIDDEN';
       throw error;
     }
+    const before = this.emitter ? await this.#readOneUnsafe(id) : null;
     const [result] = await this.database.query('DELETE FROM yuncms_users WHERE id = ?', [id]);
     if (result.affectedRows !== 1) {
       const error = new Error(`Unknown user: ${id}`);
       error.code = 'USER_NOT_FOUND';
       throw error;
     }
+    await this.action('users.delete', { key: id, before });
     return true;
   }
 
@@ -241,7 +263,6 @@ export class UsersService extends BaseService {
       }
       await connection.query('DELETE FROM yuncms_sessions WHERE user = ?', [id]);
       await connection.commit();
-      return true;
     } catch (error) {
       try {
         await connection.rollback();
@@ -252,6 +273,9 @@ export class UsersService extends BaseService {
     } finally {
       connection.release();
     }
+
+    await this.action('users.password.update', { key: id });
+    return true;
   }
 }
 

package/src/system-permissions.js

@@ -1,4 +1,5 @@
 const ALL_ACTIONS = Object.freeze(['read', 'create', 'update', 'delete']);
+const PERMISSION_MODES = new Set(['action-only', 'filter-read']);
 
 function parseMetadata(value) {
   if (value == null) return {};
@@ -14,16 +15,28 @@ function isEnabledFlag(value) {
   return value === true || value === 1;
 }
 
+function advancedUnsupported(collectionSchema, message) {
+  const error = new Error(message ?? `System resource ${collectionSchema.collection} does not support this advanced permission rule`);
+  error.code = 'SYSTEM_PERMISSION_ADVANCED_UNSUPPORTED';
+  throw error;
+}
+
 export function systemPermissionConfig(collectionSchema) {
   if (!collectionSchema?.system) return null;
   const metadata = parseMetadata(collectionSchema.metadata);
   if (!isEnabledFlag(metadata.permissionManaged)) return null;
+  const mode = metadata.permissionMode ?? 'action-only';
+  if (!PERMISSION_MODES.has(mode)) {
+    const error = new Error(`Unsupported system permission mode for ${collectionSchema.collection}: ${mode}`);
+    error.code = 'SYSTEM_PERMISSION_MODE_UNSUPPORTED';
+    throw error;
+  }
   const allowedActions = Array.isArray(metadata.allowedActions)
     ? metadata.allowedActions.filter((action) => ALL_ACTIONS.includes(action))
     : [];
   return Object.freeze({
     resource: metadata.resource ?? collectionSchema.collection,
-    mode: metadata.permissionMode ?? 'action-only',
+    mode,
     allowedActions: Object.freeze([...new Set(allowedActions)]),
   });
 }
@@ -43,12 +56,42 @@ export function assertSystemResourceAction(collectionSchema, action) {
   return config;
 }
 
-export function assertActionOnlyPermissionPayload(collectionSchema, { fields, filter, validation } = {}) {
+export function assertSystemPermissionPayload(
+  collectionSchema,
+  action,
+  { fields, filter, validation } = {},
+) {
   const config = systemPermissionConfig(collectionSchema);
-  if (!config || config.mode !== 'action-only') return;
-  if (fields != null || filter != null || validation != null) {
-    const error = new Error(`System resource ${collectionSchema.collection} supports action-level permissions only`);
-    error.code = 'SYSTEM_PERMISSION_ADVANCED_UNSUPPORTED';
-    throw error;
+  if (!config) return;
+
+  if (config.mode === 'action-only') {
+    if (fields != null || filter != null || validation != null) {
+      advancedUnsupported(
+        collectionSchema,
+        `System resource ${collectionSchema.collection} supports action-level permissions only`,
+      );
+    }
+    return;
   }
+
+  if (config.mode === 'filter-read') {
+    if (fields != null || validation != null) {
+      advancedUnsupported(
+        collectionSchema,
+        `System resource ${collectionSchema.collection} supports only a row filter on read permissions`,
+      );
+    }
+    if (filter != null && action !== 'read') {
+      advancedUnsupported(
+        collectionSchema,
+        `System resource ${collectionSchema.collection} permits row filters only for read`,
+      );
+    }
+  }
+}
+
+export function assertActionOnlyPermissionPayload(collectionSchema, payload = {}) {
+  const config = systemPermissionConfig(collectionSchema);
+  if (!config || config.mode !== 'action-only') return;
+  return assertSystemPermissionPayload(collectionSchema, 'read', payload);
 }