@yunsoft/yuncms-core 0.1.3 → 0.1.6

package/src/services/items-service.js

@@ -3,10 +3,14 @@ import { randomUUID } from 'node:crypto';
 import { assertIdentifier, quoteIdentifier } from '../identifier.js';
 import { enforcePermissionValidation } from '../permission-validation.js';
 import {
+  assertQueryCost,
+  compileAggregate,
   compileFilter,
+  compileSearch,
   compileSelectFields,
   compileSort,
   parseItemsQuery,
+  QUERY_LIMITS,
 } from '../query.js';
 import { SchemaCache } from '../schema.js';
 import { isSystemManagedField, systemMutationEntries } from '../system-fields.js';
@@ -175,10 +179,37 @@ export class ItemsService extends BaseService {
     return entries;
   }
 
-  compileActionFilters(userFilter, permissionFilter, userSchema, fullSchema) {
+  compileActionFilters(userFilter, permissionFilter, userSchema, fullSchema, search = null) {
     const permissionSql = compileFilter(permissionFilter, fullSchema);
     const userSql = compileFilter(userFilter, userSchema);
-    return combineCompiledFilters(permissionSql, userSql);
+    const searchSql = compileSearch(search, userSchema);
+    return combineCompiledFilters(permissionSql, userSql, searchSql);
+  }
+
+  async normalizeReadQuery(rawQuery) {
+    const parsed = parseItemsQuery(rawQuery);
+    const filtered = this.emitter
+      ? await this.emitter.filter('items.query', parsed, this.hookContext({ operation: 'read' }))
+      : parsed;
+    const query = parseItemsQuery(filtered);
+    assertQueryCost(query);
+    return query;
+  }
+
+  async emitReadAction(query, rows, schema, { single = false } = {}) {
+    if (!this.emitter) return;
+    const primaryKey = schema.primary_key;
+    const keys = rows
+      .filter((row) => row && Object.hasOwn(row, primaryKey))
+      .map((row) => row[primaryKey])
+      .slice(0, QUERY_LIMITS.maxLimit);
+    await this.emitter.action('items.read', {
+      collection: this.collection,
+      query,
+      keys,
+      count: rows.length,
+      single,
+    }, this.hookContext({ operation: 'read' }));
   }
 
   async readMany(rawQuery = {}) {
@@ -187,15 +218,34 @@ export class ItemsService extends BaseService {
 
   async readManyWithMeta(rawQuery = {}) {
     const schema = await this.getCollectionSchema();
+    const query = await this.normalizeReadQuery(rawQuery);
     const permission = await this.resolvePermission('read');
     const accessSchema = schemaForFields(schema, permission.fields);
-    const query = parseItemsQuery(rawQuery);
+    const filter = this.compileActionFilters(query.filter, permission.filter, accessSchema, schema, query.search);
+    const table = quoteIdentifier(this.collection, 'collection name');
+    const aggregate = compileAggregate(query.aggregate, query.groupBy, accessSchema);
+
+    if (aggregate) {
+      const sortSql = compileSort(query.sort, accessSchema);
+      const [rows] = await this.database.query(
+        `SELECT ${aggregate.sql} FROM ${table}${filter.sql}${aggregate.groupSql}${sortSql} LIMIT ? OFFSET ?`,
+        [...filter.params, query.limit, query.offset],
+      );
+      await this.emitReadAction(query, rows, schema);
+      return {
+        data: rows,
+        meta: {
+          total_count: rows.length,
+          limit: query.limit,
+          offset: query.offset,
+          aggregate: true,
+        },
+      };
+    }
+
     const requestedFields = normalizeFields(query.fields);
     const selected = compileSelectFields(requestedFields, accessSchema);
-    const filter = this.compileActionFilters(query.filter, permission.filter, accessSchema, schema);
     const sortSql = compileSort(query.sort, accessSchema);
-    const table = quoteIdentifier(this.collection, 'collection name');
-
     const [rows] = await this.database.query(
       `SELECT ${selected.sql} FROM ${table}${filter.sql}${sortSql} LIMIT ? OFFSET ?`,
       [...filter.params, query.limit, query.offset],
@@ -204,6 +254,7 @@ export class ItemsService extends BaseService {
       `SELECT COUNT(*) AS total_count FROM ${table}${filter.sql}`,
       filter.params,
     );
+    await this.emitReadAction(query, rows, schema);
 
     return {
       data: rows,
@@ -215,6 +266,48 @@ export class ItemsService extends BaseService {
     };
   }
 
+  async readManyForRelation({ fields = null, lookupField, values = [] } = {}) {
+    const schema = await this.getCollectionSchema();
+    const trustedLookupField = assertIdentifier(lookupField, 'relation lookup field');
+    if (!schema.fields[trustedLookupField]) {
+      throw serviceError('INVALID_QUERY', `Unknown relation lookup field: ${trustedLookupField}`, trustedLookupField);
+    }
+    if (!Array.isArray(values) || values.length === 0 || values.length > QUERY_LIMITS.maxLimit) {
+      throw serviceError(
+        'INVALID_QUERY',
+        `Relation lookup values must contain between 1 and ${QUERY_LIMITS.maxLimit} entries`,
+        trustedLookupField,
+      );
+    }
+
+    const permission = await this.resolvePermission('read');
+    const accessSchema = schemaForFields(schema, permission.fields);
+    const visibleSelection = compileSelectFields(normalizeFields(fields), accessSchema);
+    const internalSchema = {
+      ...accessSchema,
+      fields: { ...accessSchema.fields, [trustedLookupField]: schema.fields[trustedLookupField] },
+    };
+    const internalSelection = compileSelectFields([...visibleSelection.fields, trustedLookupField], internalSchema);
+    const permissionFilter = compileFilter(permission.filter, schema);
+    const table = quoteIdentifier(this.collection, 'collection name');
+    const data = [];
+
+    for (let offset = 0; offset < values.length; offset += QUERY_LIMITS.maxInValues) {
+      const chunk = values.slice(offset, offset + QUERY_LIMITS.maxInValues);
+      const filter = combineCompiledFilters(
+        permissionFilter,
+        compileFilter({ [trustedLookupField]: { _in: chunk } }, schema),
+      );
+      const [rows] = await this.database.query(
+        `SELECT ${internalSelection.sql} FROM ${table}${filter.sql} LIMIT ?`,
+        [...filter.params, chunk.length],
+      );
+      data.push(...rows);
+    }
+
+    return { data, visibleFields: visibleSelection.fields };
+  }
+
   async readOne(id, { fields = null } = {}) {
     const schema = await this.getCollectionSchema();
     const permission = await this.resolvePermission('read');
@@ -230,7 +323,9 @@ export class ItemsService extends BaseService {
       `SELECT ${selected.sql} FROM ${table}${filter.sql} LIMIT 1`,
       filter.params,
     );
-    return rows[0] ?? null;
+    const record = rows[0] ?? null;
+    if (record) await this.emitReadAction({ fields: normalizeFields(fields) }, [record], schema, { single: true });
+    return record;
   }
 
   async returnCreatedOrUpdated(id, schema) {
@@ -255,10 +350,8 @@ export class ItemsService extends BaseService {
     const values = { [schema.primary_key]: id, ...Object.fromEntries(entries) };
     const fields = Object.keys(values);
     const table = quoteIdentifier(this.collection, 'collection name');
-
     await this.database.query(
-      `INSERT INTO ${table} (${fields.map((field) => quoteIdentifier(field, 'field name')).join(', ')})
-       VALUES (${fields.map(() => '?').join(', ')})`,
+      `INSERT INTO ${table} (${fields.map((field) => quoteIdentifier(field, 'field name')).join(', ')})\n       VALUES (${fields.map(() => '?').join(', ')})`,
       fields.map((field) => values[field]),
     );
 
@@ -277,29 +370,21 @@ export class ItemsService extends BaseService {
     const staged = [];
 
     for (const payload of payloads) {
-      const filteredPayload = await this.filterMutation('items.create', payload, {
-        operation: 'create',
-        bulk: true,
-      });
+      const filteredPayload = await this.filterMutation('items.create', payload, { operation: 'create', bulk: true });
       const callerEntries = this.validatePayload(filteredPayload, schema, permission, { creating: true });
       const entries = mergeSystemEntries(callerEntries, schema, this.accountability, 'create');
       const id = randomUUID();
       const candidate = createCandidateRecord(schema, id, entries);
       enforcePermissionValidation(candidate, permission.validation, schema);
-      staged.push({
-        id,
-        values: { [schema.primary_key]: id, ...Object.fromEntries(entries) },
-      });
+      staged.push({ id, values: { [schema.primary_key]: id, ...Object.fromEntries(entries) } });
     }
 
     await withTransaction(this.database, async (connection) => {
       const table = quoteIdentifier(this.collection, 'collection name');
-
       for (const entry of staged) {
         const fields = Object.keys(entry.values);
         await connection.query(
-          `INSERT INTO ${table} (${fields.map((field) => quoteIdentifier(field, 'field name')).join(', ')})
-           VALUES (${fields.map(() => '?').join(', ')})`,
+          `INSERT INTO ${table} (${fields.map((field) => quoteIdentifier(field, 'field name')).join(', ')})\n           VALUES (${fields.map(() => '?').join(', ')})`,
           fields.map((field) => entry.values[field]),
         );
       }
@@ -309,10 +394,7 @@ export class ItemsService extends BaseService {
     for (const entry of staged) {
       const record = await this.returnCreatedOrUpdated(entry.id, schema);
       records.push(record);
-      await this.actionMutation('items.create', { key: entry.id, item: record }, {
-        operation: 'create',
-        bulk: true,
-      });
+      await this.actionMutation('items.create', { key: entry.id, item: record }, { operation: 'create', bulk: true });
     }
     return records;
   }
@@ -320,15 +402,11 @@ export class ItemsService extends BaseService {
   async updateOne(id, payload = {}) {
     const schema = await this.getCollectionSchema();
     const permission = await this.resolvePermission('update');
-    const filteredPayload = await this.filterMutation('items.update', payload, {
-      operation: 'update',
-      key: id,
-    });
+    const filteredPayload = await this.filterMutation('items.update', payload, { operation: 'update', key: id });
     const callerEntries = this.validatePayload(filteredPayload, schema, permission);
     if (callerEntries.length === 0) throw serviceError('INVALID_PAYLOAD', 'Update payload cannot be empty');
     const entries = mergeSystemEntries(callerEntries, schema, this.accountability, 'update');
     const effectiveChanges = Object.fromEntries(entries);
-
     const table = quoteIdentifier(this.collection, 'collection name');
     const filter = combineCompiledFilters(
       compileFilter(permission.filter, schema),
@@ -336,10 +414,7 @@ export class ItemsService extends BaseService {
     );
 
     if (permission.validation) {
-      const [currentRows] = await this.database.query(
-        `SELECT * FROM ${table}${filter.sql} LIMIT 1`,
-        filter.params,
-      );
+      const [currentRows] = await this.database.query(`SELECT * FROM ${table}${filter.sql} LIMIT 1`, filter.params);
       const current = currentRows[0];
       if (!current) return null;
       enforcePermissionValidation({ ...current, ...effectiveChanges }, permission.validation, schema);
@@ -350,14 +425,9 @@ export class ItemsService extends BaseService {
       `UPDATE ${table} SET ${setSql}${filter.sql}`,
       [...entries.map(([, value]) => value), ...filter.params],
     );
-
     if (result.affectedRows === 0) return null;
     const record = await this.returnCreatedOrUpdated(id, schema);
-    await this.actionMutation('items.update', {
-      key: id,
-      item: record,
-      changes: effectiveChanges,
-    }, { operation: 'update' });
+    await this.actionMutation('items.update', { key: id, item: record, changes: effectiveChanges }, { operation: 'update' });
     return record;
   }
 
@@ -369,11 +439,7 @@ export class ItemsService extends BaseService {
     const schema = await this.getCollectionSchema();
     const permission = await this.resolvePermission('update');
     const accessSchema = schemaForFields(schema, permission.fields);
-    const filteredPayload = await this.filterMutation('items.update', payload, {
-      operation: 'update',
-      bulk: true,
-      filter: filterInput,
-    });
+    const filteredPayload = await this.filterMutation('items.update', payload, { operation: 'update', bulk: true, filter: filterInput });
     const callerEntries = this.validatePayload(filteredPayload, schema, permission);
     if (callerEntries.length === 0) throw serviceError('INVALID_PAYLOAD', 'Update payload cannot be empty');
     const entries = mergeSystemEntries(callerEntries, schema, this.accountability, 'update');
@@ -387,14 +453,9 @@ export class ItemsService extends BaseService {
         [...filter.params, MAX_BULK_VALIDATION_ROWS + 1],
       );
       if (rows.length > MAX_BULK_VALIDATION_ROWS) {
-        throw serviceError(
-          'VALIDATION_BULK_LIMIT',
-          `Permission validation can inspect at most ${MAX_BULK_VALIDATION_ROWS} rows per bulk update`,
-        );
-      }
-      for (const row of rows) {
-        enforcePermissionValidation({ ...row, ...effectiveChanges }, permission.validation, schema);
+        throw serviceError('VALIDATION_BULK_LIMIT', `Permission validation can inspect at most ${MAX_BULK_VALIDATION_ROWS} rows per bulk update`);
       }
+      for (const row of rows) enforcePermissionValidation({ ...row, ...effectiveChanges }, permission.validation, schema);
     }
 
     const setSql = entries.map(([field]) => `${quoteIdentifier(field, 'field name')} = ?`).join(', ');
@@ -402,35 +463,23 @@ export class ItemsService extends BaseService {
       `UPDATE ${table} SET ${setSql}${filter.sql}`,
       [...entries.map(([, value]) => value), ...filter.params],
     );
-    await this.actionMutation('items.update', {
-      filter: filterInput,
-      changes: effectiveChanges,
-      affected: result.affectedRows,
-    }, { operation: 'update', bulk: true });
+    await this.actionMutation('items.update', { filter: filterInput, changes: effectiveChanges, affected: result.affectedRows }, { operation: 'update', bulk: true });
     return result.affectedRows;
   }
 
   async deleteOne(id) {
     const schema = await this.getCollectionSchema();
     const permission = await this.resolvePermission('delete');
-    const filtered = await this.filterMutation('items.delete', { key: id }, {
-      operation: 'delete',
-      key: id,
-    });
+    const filtered = await this.filterMutation('items.delete', { key: id }, { operation: 'delete', key: id });
     const key = filtered?.key ?? id;
     const table = quoteIdentifier(this.collection, 'collection name');
     const filter = combineCompiledFilters(
       compileFilter(permission.filter, schema),
       compileFilter({ [schema.primary_key]: { _eq: key } }, schema),
     );
-    const [result] = await this.database.query(
-      `DELETE FROM ${table}${filter.sql}`,
-      filter.params,
-    );
+    const [result] = await this.database.query(`DELETE FROM ${table}${filter.sql}`, filter.params);
     const deleted = result.affectedRows > 0;
-    if (deleted) {
-      await this.actionMutation('items.delete', { key }, { operation: 'delete' });
-    }
+    if (deleted) await this.actionMutation('items.delete', { key }, { operation: 'delete' });
     return deleted;
   }
 
@@ -442,26 +491,17 @@ export class ItemsService extends BaseService {
     const schema = await this.getCollectionSchema();
     const permission = await this.resolvePermission('delete');
     const accessSchema = schemaForFields(schema, permission.fields);
-    const filtered = await this.filterMutation('items.delete', { filter: filterInput }, {
-      operation: 'delete',
-      bulk: true,
-    });
+    const filtered = await this.filterMutation('items.delete', { filter: filterInput }, { operation: 'delete', bulk: true });
     const effectiveFilter = filtered?.filter ?? filterInput;
     if (!effectiveFilter || typeof effectiveFilter !== 'object' || Array.isArray(effectiveFilter) || Object.keys(effectiveFilter).length === 0) {
       throw serviceError('FILTER_REQUIRED', 'deleteMany hook result must preserve a non-empty filter');
     }
     const filter = this.compileActionFilters(effectiveFilter, permission.filter, accessSchema, schema);
     const table = quoteIdentifier(this.collection, 'collection name');
-    const [result] = await this.database.query(
-      `DELETE FROM ${table}${filter.sql}`,
-      filter.params,
-    );
-    await this.actionMutation('items.delete', {
-      filter: effectiveFilter,
-      affected: result.affectedRows,
-    }, { operation: 'delete', bulk: true });
+    const [result] = await this.database.query(`DELETE FROM ${table}${filter.sql}`, filter.params);
+    await this.actionMutation('items.delete', { filter: effectiveFilter, affected: result.affectedRows }, { operation: 'delete', bulk: true });
     return result.affectedRows;
   }
 }
 
-export { MAX_BULK_VALIDATION_ROWS, createCandidateRecord };
+export { MAX_BULK_VALIDATION_ROWS, createCandidateRecord };

package/src/services/permissions-service.js

@@ -4,7 +4,7 @@ import { assertPermissionValidationRule } from '../permission-validation.js';
 import { compileFilter } from '../query.js';
 import { SchemaCache } from '../schema.js';
 import {
-  assertActionOnlyPermissionPayload,
+  assertSystemPermissionPayload,
   assertSystemResourceAction,
   isPermissionManagedSystemResource,
 } from '../system-permissions.js';
@@ -86,6 +86,15 @@ export class PermissionsService extends BaseService {
     this.schemaCache = options.schemaCache ?? defaultSchemaCache;
   }
 
+  async action(event, payload) {
+    if (!this.emitter) return;
+    await this.emitter.action(event, payload, {
+      accountability: this.accountability,
+      requestId: this.requestId,
+      collection: 'yuncms_permissions',
+    });
+  }
+
   async #collectionSchema(collection) {
     const snapshot = this.schema ?? await this.schemaCache.get(this.database);
     const collectionSchema = snapshot.collections?.[collection];
@@ -100,7 +109,10 @@ export class PermissionsService extends BaseService {
   async resolve(action, collection) {
     assertAction(action);
     const key = cacheKey(this.accountability, action, collection);
-    if (this.permissionCache?.has(key)) return this.permissionCache.get(key);
+    if (this.permissionCache) {
+      const cached = await this.permissionCache.get(key);
+      if (cached !== undefined) return cached;
+    }
 
     let permission;
     if (this.accountability.admin === true || this.accountability.system === true) {
@@ -159,7 +171,7 @@ export class PermissionsService extends BaseService {
       };
     }
 
-    this.permissionCache?.set(key, permission);
+    if (this.permissionCache) await this.permissionCache.set(key, permission);
     return permission;
   }
 
@@ -205,7 +217,7 @@ export class PermissionsService extends BaseService {
         throw error;
       }
       assertSystemResourceAction(collectionSchema, action);
-      assertActionOnlyPermissionPayload(collectionSchema, input);
+      assertSystemPermissionPayload(collectionSchema, action, input);
     }
 
     const fields = normalizePermissionFields(input.fields ?? null, collectionSchema);
@@ -224,11 +236,6 @@ export class PermissionsService extends BaseService {
       error.code = 'ROLE_NOT_FOUND';
       throw error;
     }
-    if (collectionSchema.system && role.public) {
-      const error = new Error('Public role cannot be granted access to protected system resources');
-      error.code = 'PUBLIC_SYSTEM_ACCESS_FORBIDDEN';
-      throw error;
-    }
 
     const id = randomUUID();
     await this.database.query(
@@ -244,8 +251,10 @@ export class PermissionsService extends BaseService {
         validation == null ? null : JSON.stringify(validation),
       ],
     );
-    this.permissionCache?.clear();
-    return this.readOne(id);
+    if (this.permissionCache) await this.permissionCache.clear();
+    const permission = await this.readOne(id);
+    await this.action('permissions.create', { key: id, item: permission });
+    return permission;
   }
 
   async updateOne(id, patch = {}) {
@@ -269,7 +278,9 @@ export class PermissionsService extends BaseService {
       throw error;
     }
     const collectionSchema = await this.#collectionSchema(existing.collection);
-    if (collectionSchema.system) assertActionOnlyPermissionPayload(collectionSchema, patch);
+    if (collectionSchema.system) {
+      assertSystemPermissionPayload(collectionSchema, existing.action, patch);
+    }
 
     const assignments = [];
     const params = [];
@@ -294,12 +305,20 @@ export class PermissionsService extends BaseService {
       `UPDATE yuncms_permissions SET ${assignments.join(', ')} WHERE id = ?`,
       params,
     );
-    this.permissionCache?.clear();
-    return this.readOne(id);
+    if (this.permissionCache) await this.permissionCache.clear();
+    const permission = await this.readOne(id);
+    await this.action('permissions.update', {
+      key: id,
+      before: existing,
+      item: permission,
+      changes: patch,
+    });
+    return permission;
   }
 
   async deleteOne(id) {
     assertPermissionManager(this.accountability);
+    const before = this.emitter ? await this.readOne(id) : null;
     const [result] = await this.database.query(
       'DELETE FROM yuncms_permissions WHERE id = ?',
       [id],
@@ -309,7 +328,8 @@ export class PermissionsService extends BaseService {
       error.code = 'PERMISSION_NOT_FOUND';
       throw error;
     }
-    this.permissionCache?.clear();
+    if (this.permissionCache) await this.permissionCache.clear();
+    await this.action('permissions.delete', { key: id, before });
     return true;
   }
 }

package/src/services/roles-service.js

@@ -3,13 +3,6 @@ import { randomUUID } from 'node:crypto';
 import { BaseService } from './base-service.js';
 import { resolveSystemResourceAccess } from './system-resource-access.js';
 
-function assertRoleManager(accountability) {
-  if (accountability.admin === true || accountability.system === true) return;
-  const error = new Error('Role management requires administrator accountability');
-  error.code = 'FORBIDDEN';
-  throw error;
-}
-
 function normalizeRoleName(name) {
   if (!name || typeof name !== 'string' || name.trim().length === 0) {
     const error = new Error('Role name is required');
@@ -25,7 +18,36 @@ function normalizeRoleName(name) {
   return normalized;
 }
 
+function assertSpecialRoleCreation(accountability, { admin = false, public: publicRole = false } = {}) {
+  if (accountability.admin === true || accountability.system === true) return;
+  if (admin || publicRole) {
+    const error = new Error('Delegated role managers cannot create administrator or public roles');
+    error.code = 'FORBIDDEN';
+    throw error;
+  }
+}
+
 export class RolesService extends BaseService {
+  async action(event, payload) {
+    if (!this.emitter) return;
+    await this.emitter.action(event, payload, {
+      accountability: this.accountability,
+      requestId: this.requestId,
+      collection: 'yuncms_roles',
+    });
+  }
+
+  async #readOneUnsafe(id) {
+    const [rows] = await this.database.query(
+      `SELECT id, name, description, admin, public, created_at, updated_at
+       FROM yuncms_roles
+       WHERE id = ?
+       LIMIT 1`,
+      [id],
+    );
+    return rows[0] ?? null;
+  }
+
   async readMany() {
     await resolveSystemResourceAccess(this, 'read', 'yuncms_roles');
     const [rows] = await this.database.query(
@@ -38,18 +60,11 @@ export class RolesService extends BaseService {
 
   async readOne(id) {
     await resolveSystemResourceAccess(this, 'read', 'yuncms_roles');
-    const [rows] = await this.database.query(
-      `SELECT id, name, description, admin, public, created_at, updated_at
-       FROM yuncms_roles
-       WHERE id = ?
-       LIMIT 1`,
-      [id],
-    );
-    return rows[0] ?? null;
+    return this.#readOneUnsafe(id);
   }
 
   async createOne(input = {}) {
-    assertRoleManager(this.accountability);
+    await resolveSystemResourceAccess(this, 'create', 'yuncms_roles');
     const name = normalizeRoleName(input.name);
 
     const admin = input.admin === true;
@@ -59,6 +74,7 @@ export class RolesService extends BaseService {
       error.code = 'INVALID_ROLE';
       throw error;
     }
+    assertSpecialRoleCreation(this.accountability, { admin, public: publicRole });
 
     if (publicRole) {
       const [rows] = await this.database.query(
@@ -83,11 +99,13 @@ export class RolesService extends BaseService {
         publicRole ? 1 : 0,
       ],
     );
-    return this.readOne(id);
+    const role = await this.#readOneUnsafe(id);
+    await this.action('roles.create', { key: id, item: role });
+    return role;
   }
 
   async updateOne(id, patch = {}) {
-    assertRoleManager(this.accountability);
+    await resolveSystemResourceAccess(this, 'update', 'yuncms_roles');
     if (!patch || typeof patch !== 'object' || Array.isArray(patch)) {
       const error = new Error('Role patch must be an object');
       error.code = 'INVALID_PAYLOAD';
@@ -100,7 +118,7 @@ export class RolesService extends BaseService {
       throw error;
     }
 
-    const existing = await this.readOne(id);
+    const existing = await this.#readOneUnsafe(id);
     if (!existing) {
       const error = new Error(`Unknown role: ${id}`);
       error.code = 'ROLE_NOT_FOUND';
@@ -123,12 +141,14 @@ export class RolesService extends BaseService {
       `UPDATE yuncms_roles SET ${assignments.join(', ')} WHERE id = ?`,
       params,
     );
-    return this.readOne(id);
+    const role = await this.#readOneUnsafe(id);
+    await this.action('roles.update', { key: id, item: role, before: existing, changes: patch });
+    return role;
   }
 
   async deleteOne(id) {
-    assertRoleManager(this.accountability);
-    const role = await this.readOne(id);
+    await resolveSystemResourceAccess(this, 'delete', 'yuncms_roles');
+    const role = await this.#readOneUnsafe(id);
     if (!role) {
       const error = new Error(`Unknown role: ${id}`);
       error.code = 'ROLE_NOT_FOUND';
@@ -156,6 +176,7 @@ export class RolesService extends BaseService {
       error.code = 'ROLE_NOT_FOUND';
       throw error;
     }
+    await this.action('roles.delete', { key: id, before: role });
     return true;
   }
-}
+}