create-nevela 0.7.0 → 0.8.0

package/template/laravel/src/Http/ResourceRequest.php

@@ -6,8 +6,10 @@ use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Schema;
 use Illuminate\Support\Facades\Validator as Validation;
+use Illuminate\Validation\Rules\Exists;
 use Illuminate\Validation\Rules\Unique;
 use Illuminate\Validation\Validator;
+use Nevela\Laravel\Support\Html;
 
 /**
  * Base for generated resource requests.
@@ -31,9 +33,102 @@ abstract class ResourceRequest extends FormRequest
     /** @return array<string, string> field => column */
     abstract protected function columns(): array;
 
+    /**
+     * Fields that hold rich text. A generated request with any says which.
+     *
+     * @return list<string>
+     */
+    protected function rich(): array
+    {
+        return [];
+    }
+
+    /**
+     * What a field is when a create leaves it out. A generated request with any says which.
+     *
+     * @return array<string, mixed> field => value
+     */
+    protected function defaults(): array
+    {
+        return [];
+    }
+
+    /**
+     * A create from some of the fields only: a public form's, where nobody is asked who
+     * they are and so only what the descriptor lists is taken.
+     *
+     * The rules are this request's own. A key that isn't listed is refused the way an
+     * unknown one is, and a field left out takes its default, or is left to the column.
+     *
+     * @param  list<string>  $fields  The fields that may be sent
+     * @param  array<string, mixed>  $input
+     * @return array{values: array<string, mixed>, issues: list<array{path: string, message: string}>}
+     */
+    public function forFields(array $fields, array $input): array
+    {
+        $input = self::cleaned($this->rich(), $input) + $input;
+        $issues = [];
+        foreach (array_keys($input) as $key) {
+            if (! in_array($key, $fields, true)) {
+                $issues[] = ['path' => (string) $key, 'message' => 'Unknown field.'];
+            }
+        }
+        $validator = Validation::make($input, array_intersect_key(self::withoutTrashed($this->rules()), array_flip($fields)));
+        if ($validator->fails()) {
+            self::explainTrashed($validator, $input);
+            array_push($issues, ...FlareErrors::issues($validator->errors()->toArray()));
+        }
+        if ($issues !== []) {
+            return ['values' => [], 'issues' => $issues];
+        }
+
+        $validated = $validator->validated();
+        $defaults = $this->defaults();
+        $values = [];
+        foreach ($this->columns() as $field => $column) {
+            if (array_key_exists($field, $validated)) {
+                $values[$column] = $validated[$field];
+            } elseif (array_key_exists($field, $defaults)) {
+                $values[$column] = $defaults[$field];
+            }
+        }
+
+        return ['values' => $values, 'issues' => []];
+    }
+
+    /**
+     * Rich text is cleaned before anything looks at it: what is checked for being there,
+     * and for being short enough, is the HTML that would be stored.
+     */
+    protected function prepareForValidation(): void
+    {
+        $this->merge(self::cleaned($this->rich(), $this->all()));
+    }
+
+    /**
+     * @param  list<string>  $fields
+     * @param  array<string, mixed>  $input
+     * @return array<string, mixed> The fields that were sent as text, cleaned. One with nothing left to read is empty.
+     */
+    private static function cleaned(array $fields, array $input): array
+    {
+        $clean = [];
+        foreach ($fields as $field) {
+            if (is_string($input[$field] ?? null)) {
+                $html = Html::clean($input[$field]);
+                $clean[$field] = $html === '' ? null : $html;
+            }
+        }
+
+        return $clean;
+    }
+
+    /** Tables known to have a trash. Only "yes" is remembered: the column can arrive with a migration. */
+    private static array $trashes = [];
+
     protected function validationRules()
     {
-        $rules = parent::validationRules();
+        $rules = self::withoutTrashed(parent::validationRules());
         if (! $this->isMethod('PATCH')) {
             return $rules;
         }
@@ -57,9 +152,36 @@ abstract class ResourceRequest extends FormRequest
         });
     }
 
+    /**
+     * A relation points at a record that is there, and one in the trash is not: nothing
+     * lists it and its own page answers 404. Laravel's exists rule looks at the table,
+     * where a deleted record still is, so it is told to leave those out.
+     *
+     * @param  array<string, mixed>  $rules
+     * @return array<string, mixed>
+     */
+    private static function withoutTrashed(array $rules): array
+    {
+        foreach ($rules as $set) {
+            foreach (is_array($set) ? $set : [] as $rule) {
+                if (! $rule instanceof Exists) {
+                    continue;
+                }
+                // "exists:categories,id": the rule keeps its table to itself.
+                $table = (string) strtok(substr((string) $rule, strlen('exists:')), ',');
+                if (self::$trashes[$table] ?? (Schema::hasColumn($table, 'deleted_at') && (self::$trashes[$table] = true))) {
+                    $rule->withoutTrashed();
+                }
+            }
+        }
+
+        return $rules;
+    }
+
     /**
      * A unique value can be held by a record nobody can see: one in the trash. "Already
      * taken" would send someone looking through a list it isn't in, so say where it is.
+     * The same goes for a relation to a record that is in the trash.
      *
      * @param  array<string, mixed>  $data
      * @return list<array{path: string, message: string}> The messages that were replaced
@@ -82,6 +204,25 @@ abstract class ResourceRequest extends FormRequest
             $validator->errors()->add($field, $message);
             $replaced[] = ['path' => (string) $field, 'message' => $message];
         }
+        foreach ($validator->failed() as $field => $rules) {
+            // And for a failed exists rule: the table and the column, then what else it asked.
+            [$table, $column] = array_pad($rules['Exists'] ?? [], 2, null);
+            $value = $data[$field] ?? null;
+            if (! is_string($table) || ! is_string($column) || ! is_scalar($value) || ! (self::$trashes[$table] ?? false)) {
+                continue;
+            }
+            try {
+                $trashed = DB::table($table)->where($column, $value)->whereNotNull('deleted_at')->exists();
+            } catch (\Throwable) {
+                continue; // not something that could be an id at all
+            }
+            if ($trashed) {
+                $message = 'This one is in the trash. Restore it, or choose another.';
+                $validator->errors()->forget($field);
+                $validator->errors()->add($field, $message);
+                $replaced[] = ['path' => (string) $field, 'message' => $message];
+            }
+        }
 
         return $replaced;
     }
@@ -101,8 +242,9 @@ abstract class ResourceRequest extends FormRequest
      */
     public function many(array $rows): array
     {
-        $rules = $this->rules();
+        $rules = self::withoutTrashed($this->rules());
         $columns = $this->columns();
+        $defaults = $this->defaults();
         $known = array_keys($columns);
         $computed = array_map(fn (string $field) => $field.'File', $known);
         $unique = array_keys(array_filter($rules, fn ($rule) => is_array($rule) && array_filter($rule, fn ($one) => $one instanceof Unique) !== []));
@@ -124,6 +266,7 @@ abstract class ResourceRequest extends FormRequest
                     $issues[] = ['path' => (string) $key, 'message' => 'Unknown field.'];
                 }
             }
+            $row = self::cleaned($this->rich(), $row) + $row;
             $validator = Validation::make($row, $rules);
             if ($validator->fails()) {
                 self::explainTrashed($validator, $row);
@@ -152,6 +295,8 @@ abstract class ResourceRequest extends FormRequest
             foreach ($columns as $field => $column) {
                 if (array_key_exists($field, $validated)) {
                     $mapped[$column] = $validated[$field];
+                } elseif (array_key_exists($field, $defaults)) {
+                    $mapped[$column] = $defaults[$field];
                 }
             }
             $values[] = $mapped;
@@ -164,10 +309,14 @@ abstract class ResourceRequest extends FormRequest
     public function values(): array
     {
         $validated = $this->validated();
+        $defaults = $this->defaults();
         $values = [];
         foreach ($this->columns() as $field => $column) {
             if (array_key_exists($field, $validated)) {
                 $values[$column] = $validated[$field];
+            } elseif (array_key_exists($field, $defaults) && ! $this->isMethod('PATCH')) {
+                // Left out of a create, or of a replace, it is what it usually is.
+                $values[$column] = $defaults[$field];
             } elseif ($this->isMethod('PUT')) {
                 $values[$column] = null;
             }

package/template/laravel/src/Http/TrashController.php

@@ -92,7 +92,7 @@ final class TrashController
     public function restore(string $slug, string $id): JsonResponse
     {
         ['descriptor' => $descriptor, 'model' => $model] = $this->resource($slug);
-        $record = $model::onlyTrashed()->find($id) ?? throw new NotFoundHttpException("No deleted {$this->noun($descriptor)} with that id.");
+        $record = $this->deleted($model, $id) ?? throw new NotFoundHttpException("No deleted {$this->noun($descriptor)} with that id.");
         if (! Trash::may('restore', $record)) {
             throw new AccessDeniedHttpException("You don't have access to this.");
         }
@@ -119,7 +119,7 @@ final class TrashController
     public function destroy(string $slug, string $id): JsonResponse|Response
     {
         ['descriptor' => $descriptor, 'model' => $model] = $this->resource($slug);
-        $record = $model::onlyTrashed()->find($id) ?? throw new NotFoundHttpException("No deleted {$this->noun($descriptor)} with that id.");
+        $record = $this->deleted($model, $id) ?? throw new NotFoundHttpException("No deleted {$this->noun($descriptor)} with that id.");
         if (! Trash::may('forceDelete', $record)) {
             throw new AccessDeniedHttpException("You don't have access to this.");
         }
@@ -167,6 +167,22 @@ final class TrashController
         return $resource;
     }
 
+    /**
+     * The deleted record with this id, if there is one.
+     *
+     * @param  class-string<\Illuminate\Database\Eloquent\Model>  $model
+     */
+    private function deleted(string $model, string $id): ?\Illuminate\Database\Eloquent\Model
+    {
+        // Where ids are integers, something that isn't one is nobody's id. Asked anyway,
+        // some databases answer with an error instead of with nothing.
+        if ((new $model)->getKeyType() === 'int' && ! preg_match('/^[0-9]{1,18}$/', $id)) {
+            return null;
+        }
+
+        return $model::onlyTrashed()->find($id);
+    }
+
     private function noun(Descriptor $descriptor): string
     {
         return strtolower($descriptor->label);

package/template/laravel/src/Http/UploadController.php

@@ -110,7 +110,8 @@ final class UploadController
     public function show(string $path): Response
     {
         // A key is letters, digits, dashes, dots and slashes. Anything else was never one.
-        if ($path === '' || str_contains($path, '..') || ! preg_match('#^[A-Za-z0-9][A-Za-z0-9._/-]*$#', $path)) {
+        // And a private file's key is not an address, whoever has it.
+        if ($path === '' || str_contains($path, '..') || ! preg_match('#^[A-Za-z0-9][A-Za-z0-9._/-]*$#', $path) || Uploads::isPrivate($path)) {
             abort(404);
         }
         $cache ='public, max-age=31536000, immutable';
@@ -152,6 +153,46 @@ final class UploadController
         ]);
     }
 
+    /**
+     * A private file, to someone who may view the record it belongs to.
+     *
+     *   GET {prefix}/_nevela/private/{slug}/{id}/{field}
+     *
+     * The address names the record and the field, and the file is found from them: there
+     * is no key in it to pass around. It is never to be kept by a cache on the way.
+     */
+    public function download(string $slug, string $id, string $field): Response
+    {
+        $descriptor = null;
+        foreach (Nevela::all() as $candidate) {
+            if ($candidate->slug === $slug) {
+                $descriptor = $candidate;
+            }
+        }
+        $definition = $descriptor?->fields[$field] ?? null;
+        $model = 'App\\Models\\'.($descriptor?->name ?? '');
+        if ($descriptor === null || $definition === null || $definition->kind !== 'file' || ! $definition->private || ! class_exists($model)
+            || ($descriptor->idType === 'int' && ! preg_match('/^[0-9]{1,18}$/', $id))) {
+            abort(404);
+        }
+        // A record in the trash is found by nobody here: trashing it exposes nothing.
+        $record = $model::query()->find($id) ?? abort(404);
+        Gate::authorize('view', $record);
+
+        $key = $record->getAttribute($definition->column());
+        $upload = Uploads::isPrivate($key) ? Upload::query()->where('key', $key)->first() : null;
+        $disk = $upload === null ? null : Storage::disk($upload->disk);
+        if ($upload === null || $disk === null || ! $disk->exists(Uploads::privatePath($key))) {
+            abort(404);
+        }
+
+        return $disk->response(Uploads::privatePath($key), $upload->name, [
+            'Content-Type' => $upload->mime,
+            'Cache-Control' => 'private, no-store',
+            'X-Content-Type-Options' => 'nosniff',
+        ], 'attachment');
+    }
+
     private static function refuse(int $status, string $message): JsonResponse
     {
         return response()->json(['error' => $message], $status);

package/template/laravel/src/Media/Uploads.php

@@ -22,6 +22,15 @@ use Throwable;
  */
 final class Uploads
 {
+    /** Who uploaded a file that came in through a public form and hasn't been used in a create yet. */
+    public const UNCLAIMED = 'public:unclaimed';
+
+    /** And one that has: it belongs to a record now, like any other. */
+    public const CLAIMED = 'public';
+
+    /** What every private file's key starts with. */
+    public const PRIVATE_PREFIX = 'private/';
+
     /** @var array<string, Upload|null> Rows already looked up in this request, by key. */
     private static array $loaded = [];
 
@@ -30,6 +39,27 @@ final class Uploads
         return (string) config('nevela.uploads.disk', 'public');
     }
 
+    /** Where private files are kept: a disk the web server doesn't serve. */
+    public static function privateDisk(): string
+    {
+        return (string) config('nevela.uploads.private_disk', 'local');
+    }
+
+    /**
+     * Whether a key is a private file's. It is said by the key itself, so that nothing
+     * which hands out files by key has to look anything up to know it must not.
+     */
+    public static function isPrivate(?string $key): bool
+    {
+        return is_string($key) && str_starts_with($key, self::PRIVATE_PREFIX);
+    }
+
+    /** Where a private file is on its disk, beside the originals Nevela keeps there. */
+    public static function privatePath(string $key): string
+    {
+        return 'nevela/'.$key;
+    }
+
     public static function maxBytes(): int
     {
         return (int) config('nevela.uploads.max_bytes', 10 * 1024 * 1024);
@@ -73,6 +103,23 @@ final class Uploads
         ];
         $profile = self::profile($field->profile);
 
+        // A private file is stored as it came, where the web server doesn't reach. Nothing
+        // is made from it: a thumbnail would be a copy of it on a disk anyone can read.
+        if ($field->private) {
+            $key = self::PRIVATE_PREFIX."{$base}.{$extension}";
+            self::write(Storage::disk(self::privateDisk()), self::privatePath($key), $bytes);
+            $size = str_starts_with($mime, 'image/') ? @getimagesizefromstring($bytes) : false;
+
+            return self::remember(Upload::create(['disk' => self::privateDisk()] + $row + [
+                'key' => $key,
+                'mime' => $mime,
+                'size' => strlen($bytes),
+                'width' => $size ? $size[0] : null,
+                'height' => $size ? $size[1] : null,
+                'optimised' => false,
+            ]));
+        }
+
         if ($field->isImage() && in_array($mime, ImageOptimizer::OPTIMISABLE, true)) {
             $written = [];
             $originals = Storage::disk((string) config('nevela.uploads.originals_disk', 'local'));
@@ -193,6 +240,11 @@ final class Uploads
             return null;
         }
         $upload = self::find($key);
+        // A private file has no address of its own. It is fetched through the record it
+        // belongs to (see privateRef), by someone who may view that record.
+        if (self::isPrivate($key)) {
+            return ['key' => $key, 'url' => null, 'private' => true, 'name' => $upload?->name, 'mime' => $upload?->mime, 'size' => $upload?->size];
+        }
         if ($upload === null) {
             return ['key' => $key, 'url' => self::url($key)];
         }
@@ -219,6 +271,65 @@ final class Uploads
         ];
     }
 
+    /**
+     * A private file as a record shows it: what it is, and the address it is fetched from,
+     * which names the record and the field and never the key.
+     *
+     * @return array<string, mixed>|null
+     */
+    public static function privateRef(?string $key, string $slug, mixed $id, string $field): ?array
+    {
+        $ref = self::ref($key);
+        if ($ref === null || ! self::isPrivate($key)) {
+            return $ref;
+        }
+
+        return ['url' => route('nevela.private.show', ['slug' => $slug, 'id' => $id, 'field' => $field])] + $ref;
+    }
+
+    /**
+     * Remove a private file for good: from its disk, and the record of it. For when the
+     * record it belonged to has been removed for good.
+     */
+    public static function discard(string $key): void
+    {
+        if (! self::isPrivate($key)) {
+            return;
+        }
+        $upload = Upload::query()->where('key', $key)->first();
+        Storage::disk($upload?->disk ?? self::privateDisk())->delete(self::privatePath($key));
+        $upload?->delete();
+        unset(self::$loaded[$key]);
+    }
+
+    /**
+     * Remove what visitors uploaded and never used: a form that was started and left.
+     * Each such file waits an hour for its create (PublicController::CLAIM_SECONDS), and
+     * goes after that, with anything that was made from it.
+     *
+     * @return int How many were removed
+     */
+    public static function purgeUnclaimed(int $olderThanSeconds = 3600): int
+    {
+        $removed = 0;
+        Upload::query()->where('uploaded_by', self::UNCLAIMED)->where('created_at', '<', now()->subSeconds($olderThanSeconds))->orderBy('id')
+            ->chunkById(200, function ($uploads) use (&$removed) {
+                foreach ($uploads as $upload) {
+                    $disk = Storage::disk($upload->disk);
+                    $disk->delete(self::isPrivate($upload->key) ? self::privatePath($upload->key) : $upload->key);
+                    $disk->delete(array_column($upload->renditions ?? [], 'key'));
+                    if ($upload->original_key !== null) {
+                        Storage::disk((string) config('nevela.uploads.originals_disk', 'local'))->delete($upload->original_key);
+                    }
+                    unset(self::$loaded[$upload->key]);
+                    $upload->delete();
+                    $removed++;
+                }
+            });
+
+        return $removed;
+    }
+
     public static function forget(): void
     {
         self::$loaded = [];

package/template/laravel/src/Nevela.php

@@ -7,6 +7,7 @@ use Illuminate\Database\UniqueConstraintViolationException;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
 use InvalidArgumentException;
 use Nevela\Laravel\Media\Uploads;
 use Nevela\Laravel\Support\Descriptor;
@@ -21,7 +22,7 @@ use Nevela\Laravel\Support\Naming;
 final class Nevela
 {
     /** Written by `pnpm release`; the same number as the repository's git tag. */
-    public const VERSION = '0.7.0';
+    public const VERSION = '0.8.0';
 
     /** @var array<string, Descriptor> */
     private static array $descriptors = [];
@@ -76,7 +77,18 @@ final class Nevela
      */
     public static function list(Builder $query, string $name, Request $request, string $resourceClass): JsonResponse
     {
-        $resource = self::resource($name);
+        return self::listFor($query, self::resource($name), $request, $resourceClass);
+    }
+
+    /**
+     * The same, for a descriptor that was handed over and not looked up: the public list
+     * is the resource with only the fields anyone may see, so nothing else can be sorted,
+     * filtered or searched by.
+     *
+     * @param  class-string<\Illuminate\Http\Resources\Json\JsonResource>  $resourceClass
+     */
+    public static function listFor(Builder $query, Descriptor $resource, Request $request, string $resourceClass): JsonResponse
+    {
         $list = ListQuery::parse($resource, $request->query(), (int) config('nevela.per_page', 25), (int) config('nevela.max_per_page', 100));
         if (! $list->ok()) {
             return response()->json(['error' => 'Invalid query.', 'issues' => $list->issues], 400);
@@ -124,12 +136,32 @@ final class Nevela
         }
 
         foreach ($list->filters as $filter) {
+            $field = $resource->fields[$filter['field']] ?? null;
+            if ($filter['value'] !== null && $field?->kind === 'belongsTo' && ! self::couldBeId((string) $field->target, (string) $filter['value'])) {
+                // Nothing belongs to a record that can't exist. Asked anyway, some databases
+                // answer a number column given letters with an error instead of with no rows.
+                $query->whereRaw('1 = 0');
+
+                continue;
+            }
             $filter['value'] === null
                 ? $query->whereNull($filter['column'])
                 : $query->where($filter['column'], $filter['value']);
         }
     }
 
+    /** Whether a value has the shape of one of a resource's ids: digits, or a UUID. */
+    private static function couldBeId(string $name, string $value): bool
+    {
+        try {
+            $integers = self::resource($name)->idType === 'int';
+        } catch (InvalidArgumentException) {
+            return true; // not a resource this app describes: its ids are its own business
+        }
+
+        return $integers ? preg_match('/^[0-9]{1,18}$/', $value) === 1 : Str::isUuid($value);
+    }
+
     /**
      * GET /{slug}/_insights?unit=day|week|month&q&filter[field] → { total, unit, series, breakdown }.
      *
@@ -318,6 +350,26 @@ final class Nevela
         return Uploads::ref($key);
     }
 
+    /**
+     * The same for a private file: what it is, and the address it is fetched from by
+     * someone who may view the record, which names the record and never the file's key.
+     *
+     * @return array<string, mixed>|null
+     */
+    public static function privateFile(?string $key, string $slug, mixed $id, string $field): ?array
+    {
+        return Uploads::privateRef($key, $slug, $id, $field);
+    }
+
+    /**
+     * A rich text field's HTML, as it is safe to show: only the tags and attributes in
+     * config('nevela.rich_text'). Generated API resources send every rich text field through it.
+     */
+    public static function html(?string $html): ?string
+    {
+        return $html === null ? null : Support\Html::clean($html);
+    }
+
     /** Whether a request is one Nevela answers (so errors use Flare's shape). */
     public static function handles(Request $request): bool
     {

package/template/laravel/src/NevelaServiceProvider.php

@@ -13,6 +13,7 @@ use Illuminate\Support\Facades\Route;
 use Illuminate\Support\ServiceProvider;
 use Nevela\Laravel\Access\Access;
 use Nevela\Laravel\Access\Permissions;
+use Nevela\Laravel\Console\AdoptCommand;
 use Nevela\Laravel\Console\DevCommand;
 use Nevela\Laravel\Console\GenerateCommand;
 use Nevela\Laravel\Console\MakeResourceCommand;
@@ -31,7 +32,9 @@ use Nevela\Laravel\Http\FlareErrors;
 use Nevela\Laravel\Http\Auth\AccountController;
 use Nevela\Laravel\Http\Auth\SecurityController;
 use Nevela\Laravel\Http\Auth\SignInController;
+use Nevela\Laravel\Http\PublicThrottle;
 use Nevela\Laravel\Http\TokenController;
+use Nevela\Laravel\Http\ActionController;
 use Nevela\Laravel\Http\TrashController;
 use Nevela\Laravel\Http\UploadController;
 use Nevela\Laravel\Media\Uploads;
@@ -58,7 +61,7 @@ final class NevelaServiceProvider extends ServiceProvider
 
             $this->publishes([__DIR__.'/../config/nevela.php' => config_path('nevela.php')], 'nevela-config');
             $this->commands([
-                MakeResourceCommand::class, GenerateCommand::class, SeedCommand::class, UserCommand::class,
+                MakeResourceCommand::class, AdoptCommand::class, GenerateCommand::class, SeedCommand::class, UserCommand::class,
                 UpdateCommand::class, DevCommand::class, StatusCommand::class, VersionCommand::class, SetupCommand::class,
                 TrashCommand::class,
             ]);
@@ -172,12 +175,21 @@ final class NevelaServiceProvider extends ServiceProvider
             'app' => Nevela::fingerprint(),
         ]))->name('nevela.ping');
 
+        Route::aliasMiddleware('nevela.throttle', PublicThrottle::class);
+
+        // What a resource's "public" section opens: no sign-in, and each route its own throttle.
+        if (is_file($open = base_path('routes/nevela-public.php'))) {
+            Route::prefix(trim($prefix.'/public', '/'))->middleware('api')->name('nevela.public.')->group($open);
+        }
+
         // Stored files. Open, like any image on a website: the key is the secret.
         Route::prefix($prefix)->middleware('api')->get('_nevela/files/{path}', [UploadController::class, 'show'])
             ->where('path', '.*')->name('nevela.files.show');
 
         Route::prefix($prefix)->middleware(config('nevela.middleware', ['api', 'auth:sanctum']))->name('nevela.')->group(function () {
             Route::put('_nevela/uploads/{resource}/{field}', [UploadController::class, 'store'])->name('uploads.store');
+            // A private file: only for someone who may view the record it belongs to.
+            Route::get('_nevela/private/{slug}/{id}/{field}', [UploadController::class, 'download'])->name('private.show');
 
             // The image profiles, for a client that wants to know which renditions exist.
             Route::get('_nevela/profiles', fn () => response()->json([
@@ -221,6 +233,10 @@ final class NevelaServiceProvider extends ServiceProvider
                 'data' => array_map(fn ($d) => $d->toArray(), Nevela::all()),
             ]))->name('resources');
 
+            // A resource's own actions: on one record, and on the list or a selection from it.
+            Route::post('{slug}/_actions/{action}', [ActionController::class, 'collection'])->name('actions.collection');
+            Route::post('{slug}/{id}/_actions/{action}', [ActionController::class, 'record'])->name('actions.record');
+
             if (is_file($routes = base_path('routes/nevela.php'))) {
                 require $routes;
             }