data-primals-engine 1.1.7 → 1.1.8

package/README.md

@@ -1,4 +1,9 @@
 # Data Primals Engine
+[![Node.js CI](https://github.com/anonympins/data-primals-engine/actions/workflows/node.js.yml/badge.svg?branch=main)](https://github.com/anonympins/data-primals-engine/actions/workflows/node.js.yml)
+![](https://img.shields.io/npm/dw/data-primals-engine)
+![](https://img.shields.io/npm/last-update/data-primals-engine)
+![](https://img.shields.io/github/v/release/anonympins/data-primals-engine)
+![](https://img.shields.io/github/license/anonympins/data-primals-engine)
 
 **data-primals-engine** is a powerful and flexible **Node.js** backend framework designed to accelerate development of complex data-driven applications. Built on **Express.js** and **MongoDB**, it offers dynamic data modeling, automation workflows, advanced user management, and more.
 
@@ -35,7 +40,7 @@ npm i data-primals-engine
 ```
 or
 ```bash
-git clone https://your-repo/data-primals-engine.git
+git clone https://github.com/anonympins/data-primals-engine.git
 cd data-primals-engine
 npm install
 ```
@@ -78,7 +83,7 @@ By default, the app runs on port **7633**.
 
 ## 🧠 Concepts
 
-### 1. Models
+### Models
 Define schemas using JSON:
 ```json
 {
@@ -115,23 +120,15 @@ Define schemas using JSON:
 | model	      | Stores a model by name                                                              | –                                                                         |                                            
 | modelField	 | Stores a model field path	                                                          | –                                                                         |                                            
 
-### 2. Modules
+### Modules
 Activatable features:
 - `mongodb`, `data`, `user`, `workflow`, `file`, `assistant`, `swagger`
 
-### 3. Starter Packs
+### Starter Packs
 - **E-commerce**: Products, orders, KPIs
 - **CRM**: Contacts, leads, interactions
 - **Website/blog**: Pages, posts, i18n
 
-### 4. Workflows
-Automate business processes:
-- **Triggers**: `DataAdded`, `DataUpdated`, `Scheduled`, `Manual`
-- **Actions**: `CreateData`, `UpdateData`, `SendEmail`, `ApiCall`
-
-Example:
-> When a new order is created, email the customer, update stock, and notify logistics.
-
 ---
 
 ## 🔌 API Examples (using `curl`)
@@ -440,7 +437,7 @@ data-primals-engine/
 │   ├── engine.js // The Express engine that serves the API
 │   ├── constants.js // The inner-application constants definitions
 │   ├── packs.js // The packs that will be loaded and available with installPack() method
-│   ├── defaultModels.js // The default models available to import
+│   ├── defaultModels.js // The default models available at startup.
 │   ├── ...
 └── server.js
 ```
@@ -473,8 +470,93 @@ A workflow is composed of two main parts: **Triggers** and **Actions**.
 
 See the details of the workflow models for more details.
 
+## ⚡ Dynamic API Endpoints
+Beyond standard CRUD operations, data-primals-engine allows you to create your own custom API endpoints directly from the UI. This feature acts like a built-in serverless function environment, enabling you to write custom business logic, integrate with third-party services, or create complex data aggregations on the fly.
+
+Your code is executed in a secure, isolated sandbox, with access to the core data functions and the incoming request context.
+
+### How It Works
+Define an Endpoint: You create a new document in the endpoint model.
+Write Your Logic: In the code field, you write the JavaScript that will be executed.
+Activate: The engine automatically listens for requests on /api/actions/:path that match your endpoint's definition.
+
+### The endpoint Model
+To create a custom endpoint, you need to define a document with the following structure:
+```json
+{
+  "name": "GetContactPostCount",
+  "path": "postCount/:name",
+  "method": "GET",
+  "code": "const posts = await db.find('content', { author: { $find: { $eq: ['$lastName', request.params.name]}}}); return { postCount: posts.length };",
+  "isActive": true
+}
+```
+| Field    | Type    | Description                                                          | 
+|:---------|:--------|:---------------------------------------------------------------------|
+| name     | string  | A descriptive name for your endpoint (e.g., "Calculate User Stats"). | 
+| path     | string  | The URL path. It can include parameters like :id.                    | 
+| method   | enum    | The HTTP method: GET, POST, PUT, PATCH, or DELETE.                   | 
+| code     | code    | The JavaScript code to execute when the endpoint is called.          |
+| isActive | boolean | A flag to enable or disable the endpoint without deleting it.        |
 ---
 
+### The Execution Context
+Your JavaScript code runs in an async context and has access to several global objects that are securely injected into the sandbox:
+
+#### The context Object
+> This object contains all the information about the incoming HTTP request.
+- context.request.**body**: The parsed request body (for POST, PUT, PATCH).
+- context.request.**query**: The URL query parameters as an object.
+- context.request.**params**: The URL path parameters (e.g., username from /user-summary/:username).
+- context.request.**headers**: The incoming request headers.
+
+#### The db Object
+> A secure API to interact with the database. All methods are async and must be awaited. They automatically operate within the authenticated user's permissions.
+- await db.**create**(modelName, dataObject): Inserts a new document.
+- await db.**find**(modelName, filter): Finds multiple documents. Returns an array.
+- await db.**findOne**(modelName, filter): Finds a single document. Returns an object or null.
+- await db.**update**(modelName, filter, updateObject): Partially updates documents matching the filter (similar to a PATCH).
+- await db.**delete**(modelName, filter): Deletes documents matching the filter.
+
+#### The logger Object
+> A safe way to log messages from your script. These logs will be collected and can be returned in the API response if an error occurs, which is very useful for debugging.
+- logger.**info**(...args)
+- logger.**warn**(...args)
+- logger.**error**(...args)
+
+#### The env Object
+> Provides access to the user-defined variables stored in the env model, not the server's process.env.
+- await env.**get**(variableName): Retrieves a single environment variable's value.
+- await env.**getAll**(): Retrieves all user environment variables as an object.
+
+#### Example: Creating a User Summary Endpoint
+Let's create an endpoint that fetches a user's profile and counts how many posts they have published.
+1. Create the Endpoint Document
+   Create a new document in the endpoint model with the following data:
+```json
+{
+    "name": "Get User Summary",
+    "path": "user-summary/:username",
+    "method": "GET",
+    "isActive": true,
+    "code": "const { username } = context.request.params;\n\n  if (!username) {\n    logger.error('Username parameter is required.');\n    return { success: false, error: 'Username is required.' };\n  }\n\n  logger.info(`Fetching summary for user: ${username}`);\n\n  // Fetch the user profile using the sandboxed db API\n  const userProfile = await db.findOne('userProfile', { username: username });\n\n  if (!userProfile) {\n    return { success: false, error: 'User not found' };\n  }\n\n  // Count the user's published posts\n  const posts = await db.find('post', { \n    authorId: userProfile._id.toString(), \n    status: 'published' \n  });\n\n  return {\n    profile: userProfile,\n    publishedPosts: posts.length\n  };\n});",
+}
+```
+2. Call the New Endpoint
+   You can now call this custom endpoint like any other API route:
+
+Expected response :
+```json
+{
+  "profile": {
+    "_id": "60d0fe4f5311236168a109ca",
+    "username": "demo",
+    "bio": "A demo user profile.",
+    "...": "..."
+  },
+  "publishedPosts": 15
+}
+```
 ## 🤝 Contributing
 
 1. Fork the repo
@@ -492,4 +574,4 @@ Distributed under the **MIT License**. See `LICENSE` file.
 
 ---
 
-## 🔼 Back to Top
+## [🔼](#) Back to Top

package/client/src/RelationField.jsx

@@ -1,16 +1,16 @@
-import React, { useState, useEffect, useRef, useCallback } from 'react';
+import React, { useState, useEffect, useRef } from 'react';
 import { useQuery, useQueryClient } from 'react-query';
 import { useModelContext } from './contexts/ModelContext.jsx';
 import { TextField } from './Field.jsx';
 import { useAuthContext } from './contexts/AuthContext.jsx';
-import {conditionToApiSearchFilter, getDataAsString, getUserId} from 'data-primals-engine/data';
+import { getDataAsString, getUserId } from 'data-primals-engine/data';
 import { FaEdit, FaTrash } from 'react-icons/fa';
 import Button from './Button.jsx';
-import {mainFieldsTypes} from "../../src/constants.js";
+import { mainFieldsTypes } from "../../src/constants.js";
 import Draggable from "./Draggable.jsx";
-import {useTranslation} from "react-i18next";
+import { useTranslation } from "react-i18next";
 
-const RelationField = ({ field, help, onFocus, onBlur, onChange, value=null }) => {
+const RelationField = ({ field, help, onFocus, onBlur, onChange, value = null }) => {
     const { models, dataByModel, setOnSuccessCallbacks, relationIds, setRelationIds } = useModelContext();
     const { name, relation: modelName } = field;
     const queryClient = useQueryClient();
@@ -19,45 +19,67 @@ const RelationField = ({ field, help, onFocus, onBlur, onChange, value=null }) =
     const [searchValue, setSearchValue] = useState('');
     const [history, setHistory] = useState([]);
     const { me } = useAuthContext();
-    const tr = useTranslation()
-    const {t, i18n} = tr
+    const tr = useTranslation();
+    const { t, i18n } = tr;
     const model = models?.find(f => f.name === modelName && f._user === me?.username);
 
     // Fetch related data based on search value
     const { data: results = [], isError, refetch } = useQuery(
-        ['api/search', model?.name, field?.name, searchValue],
+        // La clé de la requête inclut maintenant le filtre de relation pour une mise en cache correcte
+        ['api/search', model?.name, field?.name, searchValue, JSON.stringify(field.relationFilter)],
         async ({ signal }) => {
             if (!model) return [];
-            const orFilter = [];
-            let filter = {};
-            if( field.relationFilter ){
-                filter = {"$and": field.relationFilter.filter};
-            }else if ( searchValue) {
+
+            // --- DÉBUT DE LA NOUVELLE LOGIQUE DE FILTRAGE ---
+
+            // 1. On récupère le filtre permanent défini dans le modèle.
+            // S'il n'y en a pas, on utilise un objet vide qui n'aura aucun effet.
+            const permanentFilter = field.relationFilter || {};
+
+            // 2. On construit le filtre basé sur la recherche de l'utilisateur.
+            const searchFilter = {};
+            if (searchValue) {
+                const orConditions = [];
+                // Recherche sur les champs principaux (asMain)
                 model.fields.forEach(f => {
-                    if (f.asMain) {
-                        if( f.type !== 'relation' && mainFieldsTypes.includes(f.type))
-                            orFilter.push({"$regexMatch": { input: '$'+f.name, regex: searchValue}});
+                    if (f.asMain && mainFieldsTypes.includes(f.type)) {
+                        orConditions.push({ [f.name]: { "$regex": searchValue, "$options": "i" } });
                     }
-                })
-                if (!orFilter.length) {
+                });
+                // Si aucun champ principal, recherche sur les champs texte
+                if (orConditions.length === 0) {
                     model.fields.forEach(f => {
-                        if (["string", "string_t", "richtext", "url"]?.includes(f.type)) {
-                            orFilter.push({"$regexMatch": { input: '$'+f.name, regex: searchValue}});
+                        if (["string", "string_t", "richtext", "url"].includes(f.type)) {
+                            orConditions.push({ [f.name]: { "$regex": searchValue, "$options": "i" } });
                         }
                     });
-                    if (!orFilter.length) {
-                        orFilter.push({"$eq": ['_id', searchValue]});
-                    }
                 }
-                filter = {'$or':orFilter};
+                // Si toujours rien, on cherche sur l'ID (utile pour les développeurs)
+                if (orConditions.length === 0) {
+                    orConditions.push({ "_id": searchValue });
+                }
+                searchFilter['$or'] = orConditions;
             }
+
+            // 3. On combine les deux filtres avec un opérateur $and.
+            // Un document devra correspondre au filtre permanent ET au filtre de recherche.
+            const finalFilter = {
+                "$and": [
+                    permanentFilter,
+                    searchFilter
+                ]
+            };
+
+            // --- FIN DE LA NOUVELLE LOGIQUE DE FILTRAGE ---
+
             const params = new URLSearchParams();
-            params.append('_user', getUserId(me));
             params.append('model', field.relation);
-            params.append('limit', '1000');
-            params.append('depth', '2'); // Fetch related data with depth 2
+            params.append('limit', '100'); // Limite raisonnable pour les suggestions
+            params.append('depth', '2');
+
             return fetch(`/api/data/search?${params.toString()}`, {
-                body: JSON.stringify({ filter }),
+                // On envoie le filtre final et complet
+                body: JSON.stringify({ filter: finalFilter }),
                 method: 'POST',
                 signal: signal,
                 headers: { 'Content-Type': 'application/json' },
@@ -65,9 +87,11 @@ const RelationField = ({ field, help, onFocus, onBlur, onChange, value=null }) =
                 .then(e => e.json())
                 .then(e => e.data);
         },
-        { enabled: !!model }
+        { enabled: !!model && showResults } // La requête ne s'exécute que si le panneau de résultats est visible
     );
 
+    // ... (le reste du composant reste identique) ...
+
     useEffect(() => {
         setSearchValue('');
         setHistory([]);
@@ -100,7 +124,6 @@ const RelationField = ({ field, help, onFocus, onBlur, onChange, value=null }) =
         }
     }, [value]);
 
-    //console.log(field, value);
     const updateValue = () => {
         if (!field.multiple) {
             const v = history.find(d => d._id === value);
@@ -108,7 +131,7 @@ const RelationField = ({ field, help, onFocus, onBlur, onChange, value=null }) =
                 setSearchValue(getDataAsString(model, v, tr, models) || '');
                 onChange({ name, value });
             } else {
-                //onChange({ name, value: null });
+                // Ne rien faire si la valeur n'est pas dans l'historique pour éviter d'effacer
             }
         } else {
             if (Array.isArray(value)) {
@@ -133,7 +156,7 @@ const RelationField = ({ field, help, onFocus, onBlur, onChange, value=null }) =
                     return value;
                 });
             } else {
-                onChange({ name, value });
+                onChange({ name, value: selectedValues });
             }
         }
         setResultsVisible(false);
@@ -141,10 +164,6 @@ const RelationField = ({ field, help, onFocus, onBlur, onChange, value=null }) =
         e.preventDefault();
     };
 
-    useEffect(() => {
-        if (showResults) refetch();
-    }, [showResults]);
-
     const handleRemove = (element) => {
         if (!field.multiple) return;
         setSelectedValues(values => {
@@ -162,6 +181,7 @@ const RelationField = ({ field, help, onFocus, onBlur, onChange, value=null }) =
             inputRef.current.ref.setAttribute('autocomplete', 'off');
         }
     }, [inputRef]);
+
     return (
         <div onFocus={onFocus} onBlur={onBlur} className="field field-relation flex flex-row flex-start flex-1">
             {help && <div className={"flex help"}>{help}</div>}
@@ -176,17 +196,15 @@ const RelationField = ({ field, help, onFocus, onBlur, onChange, value=null }) =
                     id={field.name}
                     onFocus={e => {
                         setResultsVisible(true);
-                        queryClient.invalidateQueries(['api/search', field.name, searchValue]);
                     }}
                     value={searchValue}
                     onChange={e => {
-                        if (!e.target.value) onChange({ name, value: '' });
-                        else onChange({ name, value: '' });
+                        if (!e.target.value) onChange({ name, value: null });
                         setResultsVisible(true);
                         setSearchValue(e.target.value);
                     }}
                     onBlur={(e) => {
-                        setResultsVisible(false);
+                        setTimeout(() => setResultsVisible(false), 150); // Léger délai pour permettre le clic sur un résultat
                     }}
                 />
                 <Button
@@ -200,11 +218,6 @@ const RelationField = ({ field, help, onFocus, onBlur, onChange, value=null }) =
                     <div className="results" onKeyDown={e => {
                         if( e.key === 'Escape' )
                             setResultsVisible(false);
-                    }} onBlur={e => {
-                        const t = e.target.parentNode.children[e.target.parentNode.childElementCount-1];
-                        if(t === e.target){
-                            setResultsVisible(false);
-                        }
                     }} >
                         {!isError &&
                             (results || []).map(r => {
@@ -224,7 +237,7 @@ const RelationField = ({ field, help, onFocus, onBlur, onChange, value=null }) =
             {field.multiple && selectedValues.length > 0 && (
                 <div ref={ref} tabIndex={0} className="selected-values flex flex-border flex-row flex-no-gap flex-start flex-1">
                     <Draggable items={selectedValues} renderItem={(id,i) =>{
-                        const val = history.find(f => f._id === id) || dataByModel[modelName].find(f => f._id === id);
+                        const val = history.find(f => f._id === id) || dataByModel[modelName]?.find(f => f._id === id);
                         if (!val) {
                             return <div className="flex" key={id}>data non chargée<FaTrash onClick={() => handleRemove(id)} /></div>;
                         }
@@ -239,7 +252,6 @@ const RelationField = ({ field, help, onFocus, onBlur, onChange, value=null }) =
                     }} />
                 </div>
             )}
-
         </div>
     );
 };

package/client/src/translations.js

@@ -523,7 +523,7 @@ export const websiteTranslations = {
             "prez1.5": "Support des traductions et langues",
             "links.deploy_api": "Déployez votre API",
             "links.documentation": "Documentation",
-            "links.demo": "Essayez maintenant !",
+            "links.demo": "Démarrer la démo",
             "filterstringfield.placeholder.regex": 'Expression régulière'
 
         }
@@ -1483,7 +1483,7 @@ export const websiteTranslations = {
             "dataimporter.title": "Import data into {{model}}",
             "dataimporter.hasCsvHeaders": "Does the CSV file contain a header row?",
             "dataimporter.info": "Import your JSON or CSV file containing the required data for your model. Your data will be copied to your personal database. The transfer rate is {{constante}}",
-            "links.demo": "Try the demo!",
+            "links.demo": "Start the demo",
             "filterstringfield.placeholder.regex": 'Regular expression',
             "cgu.h1": "Terms of Use (TOU)",
             "cgu.h1.1": "1. Introduction",
@@ -2887,7 +2887,7 @@ export const websiteTranslations = {
             "dataimporter.title": "Importar datos a {{model}}",
             "dataimporter.hasCsvHeaders": "¿El archivo CSV contiene una fila de encabezado?",
             "dataimporter.info": "Importa tu archivo JSON o CSV con los datos necesarios para tu modelo. Tus datos se copiarán a tu base de datos personal. La velocidad de transferencia es {{constante}}",
-            "links.demo": "¡Prueba la demo!",
+            "links.demo": "Iniciar la demostración",
             "filterstringfield.placeholder.regex": 'Expresión regular',
             "cgu.h1": "Condiciones Generales de Uso (CGU)",
             "cgu.h1.1": "1. Introducción",
@@ -4298,7 +4298,7 @@ export const websiteTranslations = {
             "dataimporter.title": "Importar dados para {{model}}",
             "dataimporter.hasCsvHeaders": "O ficheiro CSV contém uma linha de cabeçalho?",
             "dataimporter.info": "Importe o seu ficheiro JSON ou CSV contendo os dados necessários para o seu modelo. Os seus dados serão copiados para a sua base de dados pessoal. A taxa de transferência é {{constante}}",
-            "links.demo": "Experimente a demonstração!",
+            "links.demo": "Iniciar a demonstração",
             "filterstringfield.placeholder.regex": 'Expressão regular',
             "cgu.h1": "Termos e Condições Gerais de Uso (TCGU)",
             "cgu.h1.1": "1. Introdução",
@@ -5681,7 +5681,7 @@ export const websiteTranslations = {
             "dataimporter.title": "Daten in {{model}} importieren",
             "dataimporter.hasCsvHeaders": "Enthält die CSV-Datei eine Kopfzeile?",
             "dataimporter.info": "Importieren Sie Ihre JSON- oder CSV-Datei mit den benötigten Daten für Ihr Modell. Ihre Daten werden in Ihre persönliche Datenbank kopiert. Die Übertragungsrate beträgt {{constante}}",
-            "links.demo": "Probieren Sie die Demo aus!",
+            "links.demo": "Demo starten",
             "filterstringfield.placeholder.regex": 'Regulärer Ausdruck',
             "cgu.h1": "Nutzungsbedingungen (TOU)",
             "cgu.h1.1": "1. Einleitung",
@@ -7087,7 +7087,7 @@ export const websiteTranslations = {
             "dataimporter.title": "Importa dati in {{model}}",
             "dataimporter.hasCsvHeaders": "Il file CSV contiene una riga di intestazione?",
             "dataimporter.info": "Importa il tuo file JSON o CSV contenente i dati necessari per il tuo modello. I tuoi dati verranno copiati nel tuo database personale. La velocità di trasferimento è {{constante}}",
-            "links.demo": "Prova la demo!",
+            "links.demo": "Avvia la demo",
             "filterstringfield.placeholder.regex": 'Espressione regolare',
             "cgu.h1": "Termini di Utilizzo (TOU)",
             "cgu.h1.1": "1. Introduzione",
@@ -8483,7 +8483,7 @@ export const websiteTranslations = {
             "dataimporter.title": "Importovat data do {{model}}",
             "dataimporter.hasCsvHeaders": "Obsahuje soubor CSV řádek záhlaví?",
             "dataimporter.info": "Importujte soubor JSON nebo CSV obsahující požadovaná data pro váš model. Vaše data budou zkopírována do vaší osobní databáze. Přenosová rychlost je {{constante}}",
-            "links.demo": "Vyzkoušejte demo!",
+            "links.demo": "Spustit demo",
             "filterstringfield.placeholder.regex": 'Regulární výraz',
             "cgu.h1": "Podmínky použití (TOU)",
             "cgu.h1.1": "1. Úvod",
@@ -9887,7 +9887,7 @@ export const websiteTranslations = {
             "dataimporter.title": "Импортировать данные в {{model}}",
             "dataimporter.hasCsvHeaders": "Содержит ли CSV-файл строку заголовка?",
             "dataimporter.info": "Импортируйте файл JSON или CSV, содержащий необходимые данные для вашей модели. Ваши данные будут скопированы в вашу личную базу данных. Скорость передачи составляет {{constante}}",
-            "links.demo": "Попробуйте демо!",
+            "links.demo": "Запустить демо",
             "filterstringfield.placeholder.regex": 'Регулярное выражение',
             "cgu.h1": "Условия использования (TOU)",
             "cgu.h1.1": "1. Введение",
@@ -11311,7 +11311,7 @@ export const websiteTranslations = {
             "dataimporter.title": "استيراد البيانات إلى {{model}}",
             "dataimporter.hasCsvHeaders": "هل يحتوي ملف CSV على صف رأس؟",
             "dataimporter.info": "استورد ملف JSON أو CSV الذي يحتوي على البيانات المطلوبة لنموذجك. سيتم نسخ بياناتك إلى قاعدة بياناتك الشخصية. معدل النقل ثابت ({{constante}}).",
-            "links.demo": "جرب النسخة التجريبية!",
+            "links.demo": "ابدأ العرض التوضيحي",
             "filterstringfield.placeholder.regex": 'تعبير عادي',
             "cgu.h1": "الشروط العامة للاستخدام (GTU)",
             "cgu.h1.1": "1. المقدمة",
@@ -12711,7 +12711,7 @@ export const websiteTranslations = {
             "dataimporter.title": "Importera data till {{model}}",
             "dataimporter.hasCsvHeaders": "Innehåller CSV-filen en rubrikrad?",
             "dataimporter.info": "Importera din JSON- eller CSV-fil som innehåller den data som krävs för din modell. Dina data kommer att kopieras till din personliga databas. Överföringshastigheten är {{constante}}",
-            "links.demo": "Testa demon!",
+            "links.demo": "Starta demon",
             "filterstringfield.placeholder.regex": 'Reguljärt uttryck',
             "cgu.h1": "Användarvillkor (Användarvillkor)",
             "cgu.h1.1": "1. Introduktion",
@@ -14112,7 +14112,7 @@ export const websiteTranslations = {
             "dataimporter.title": "Εισαγωγή δεδομένων στο {{model}}",
             "dataimporter.hasCsvHeaders": "Περιέχει το αρχείο CSV μια γραμμή κεφαλίδας;",
             "dataimporter.info": "Εισαγάγετε το αρχείο JSON που περιέχει τα απαιτούμενα δεδομένα για το μοντέλο σας. Τα δεδομένα σας θα αντιγραφούν στην προσωπική σας βάση δεδομένων. Ο ρυθμός μεταφοράς είναι {{constante}}",
-            "links.demo": "Δοκιμάστε την επίδειξη!",
+            "links.demo": "Έναρξη της επίδειξης",
             "filterstringfield.placeholder.regex": "Κανονική έκφραση",
             "cgu.h1": "Γενικοί όροι χρήσης (GTU)",
             "cgu.h1.1": "1. Εισαγωγή",
@@ -14561,6 +14561,7 @@ export const websiteTranslations = {
     },
     fa: {
         "translation": {
+            "links.demo": "شروع نسخهٔ نمایشی",
             "cb.searchOperator": "جستجوی یک عملگر...",
             "cb.changeOperator": "تغییر عملگر",
             "cb.deleteBlock": "حذف این بلوک",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "data-primals-engine",
-  "version": "1.1.7",
+  "version": "1.1.8",
   "description": "data-primals-engine is the package responsible from handling large amount of data in a practical and performant way. It can handle large amount of data in a practical and performant way. It can also get workflow models working (for automation), and fully supports internationalisation.",
   "main": "src/engine.js",
   "type": "module",
@@ -43,9 +43,9 @@
     "./*": "./src/*.js"
   },
   "peerDependencies": {
+    "express": "^5.1.0",
     "react": ">=18.0.0",
-    "react-query": ">=3.0.0",
-    "express": "^5.1.0"
+    "react-query": ">=3.0.0"
   },
   "dependencies": {
     "@langchain/core": "^0.3.66",
@@ -69,6 +69,7 @@
     "express-rate-limit": "^8.0.1",
     "express-session": "^1.18.2",
     "i18next-browser-languagedetector": "^8.2.0",
+    "isolated-vm": "^4.7.2",
     "juice": "^11.0.1",
     "mathjs": "^14.6.0",
     "mongodb": "^6.18.0",
@@ -88,7 +89,6 @@
     "tar": "^7.4.3",
     "uniqid": "^5.4.0",
     "vitest": "^3.2.4",
-    "isolated-vm": "^4.7.2",
     "yaml": "^2.8.0"
   },
   "devDependencies": {
@@ -102,13 +102,12 @@
     "client"
   ],
   "keywords": [
-    "mongodb",
-    "data",
-    "primals",
+    "data-driven engine",
+    "headless CMS",
+    "backend",
     "automation",
-    "aws",
-    "bucket",
-    "S3"
+    "AWS S3",
+    "MongoDB"
   ],
   "author": "anonympins",
   "license": "MIT",

package/src/core.js

@@ -340,12 +340,13 @@ export const event_off = (name, callback) => {
 };
 
 
-export function slugify(str) {
+export function slugify(str,replacer='-', replaceUnicode=false) {
     str = str.replace(/^\s+|\s+$/g, ''); // trim leading/trailing white space
     str = str.toLowerCase(); // convert string to lowercase
-    str = str.replace(/[^a-z0-9 -]/g, '') // remove any non-alphanumeric characters
-        .replace(/\s+/g, '-') // replace spaces with hyphens
-        .replace(/-+/g, '-'); // remove consecutive hyphens
+    if( replaceUnicode)
+        str = str.replace(/[^a-z0-9 -]/g, ''); // remove any non-alphanumeric characters
+    str = str.replace(/\s+/g, replacer) // replace spaces with hyphens
+        .replace(/-+/g, replacer); // remove consecutive hyphens
     return str;
 }
 
@@ -388,4 +389,8 @@ export function object_equals( x, y ) {
     // allows x[ p ] to be set to undefined
 
     return true;
-}
+}
+
+export const isValidPath = (path) =>{
+    return /^(?:[a-z]:)?[\/\\]{0,2}(?:[.\/\\ ](?![.\/\\\n])|[^<>:"|?*.\/\\ \n])+$/gmi.test(path);
+}

package/src/engine.js

@@ -41,17 +41,35 @@ const secureContext = tls.createSecureContext({
     ca: caFile, cert: certFile, key: keyFile
 });
 
+export const dbUrl = process.env.CI ? 'mongodb://mongodb:27017' : (process.env.MONGO_DB_URL || 'mongodb://127.0.0.1:27017');
+
 const isTlsActive = !(!process.env.TLS || ["0", "false"].includes(process.env.TLS.toLowerCase()));
 
-// Connection URL
-export const dbUrl = process.env.CI ? 'mongodb://mongodb:27017' : (process.env.MONGO_DB_URL || 'mongodb://127.0.0.1:27017');
-export const MongoClient = new InternalMongoClient(dbUrl, {
-    maxPoolSize: databasePoolSize,
-    tls: isTlsActive,
-    secureContext,
-    tlsAllowInvalidCertificates,
-    tlsAllowInvalidHostnames
-});
+const clientOptions = {
+    maxPoolSize: databasePoolSize
+};
+// On ajoute les options TLS si elles sont activées
+if (isTlsActive) {
+    clientOptions.tls = true;
+    // Chemin vers le certificat de l'autorité de certification (pour faire confiance au serveur)
+    if (process.env.CA_CERT) {
+        clientOptions.tlsCAFile = process.env.CA_CERT;
+    }
+    // Chemin vers le certificat et la clé du CLIENT (pour que le serveur vous fasse confiance)
+    if (process.env.CERT_KEY) {
+        clientOptions.tlsCertificateKeyFile = process.env.CERT_KEY;
+    }
+    // Options pour le développement (à utiliser avec prudence)
+    if (tlsAllowInvalidCertificates) {
+        clientOptions.tlsAllowInvalidCertificates = true;
+    }
+    if (tlsAllowInvalidHostnames) {
+        clientOptions.tlsAllowInvalidHostnames = true;
+    }
+}
+
+export const MongoClient = new InternalMongoClient(dbUrl, clientOptions);
+
 
 // Database Name
 export const MongoDatabase = MongoClient.db(dbName);

package/src/middlewares/middleware-mongodb.js

@@ -112,7 +112,7 @@ function sanitize(target, options = {}) {
 export function middleware(options = {}) {
     const hasOnSanitize = typeof options.onSanitize === 'function';
     return function (req, res, next) {
-        ['body', 'params', 'headers', 'query'].forEach(function (key) {
+        ['body', 'fields', 'params', 'headers', 'query'].forEach(function (key) {
             if (req[key]) {
                 // The _sanitize function mutates the req[key] object in-place.
                 // We only need to capture whether it was sanitized to call the hook.

package/src/modules/data.js

@@ -3,7 +3,7 @@ import {BSON, ObjectId} from "mongodb";
 import * as util from 'node:util';
 import {promisify} from 'node:util';
 import crypto from "node:crypto";
-import {exec} from 'node:child_process';
+import {exec,execFile} from 'node:child_process';
 import sanitizeHtml from 'sanitize-html';
 import * as tar from "tar";
 import process from "node:process";
@@ -105,6 +105,7 @@ const delay = ms => new Promise(res => setTimeout(res, ms));
 
 const getBackupDir = () => process.env.BACKUP_DIR || './backups'; // Répertoire de stockage des sauvegardes
 const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
 
 let importJobs = {};
 const IMPORT_CHUNK_SIZE = 100; // Nombre d'enregistrements à traiter par lot
@@ -3489,6 +3490,24 @@ async function insertAndResolveRelations(doc, model, collection, me, idMap) {
         return existingDoc._id;
     }
 
+    for (const field of model.fields) {
+        if (field.type === 'relation' && field.relationFilter && docToProcess[field.name]) {
+            const relatedIds = Array.isArray(docToProcess[field.name]) ? docToProcess[field.name] : [docToProcess[field.name]];
+            for (const id of relatedIds) {
+                const targetCollection = await getCollectionForUser(me, field.targetModel);
+                const validationQuery = {
+                    _id: new ObjectId(id), // L'ID doit correspondre
+                    ...field.relationFilter // ET le document doit respecter le filtre
+                };
+                const relatedDoc = await targetCollection.findOne(validationQuery);
+                if (!relatedDoc) {
+                    // Si on ne trouve rien, c'est que l'ID est invalide ou ne respecte pas le filtre.
+                    throw new Error(`La valeur '${id}' pour le champ '${field.name}' ne respecte pas le filtre de relation défini.`);
+                }
+            }
+        }
+    }
+
     // Insertion en conservant éventuellement l'ID original
     const result = docToProcess._id
         ? await collection.insertOne(docToProcess)
@@ -3708,6 +3727,33 @@ const internalEditOrPatchData = async (modelName, filter, data, files, user, isP
             }
         }
 
+        for (const field of model.fields) {
+            // On ne vérifie que si un champ de relation avec un filtre est en cours de modification.
+            if (field.type === 'relation' && field.relationFilter && updateData[field.name] !== undefined) {
+                const relatedIds = Array.isArray(updateData[field.name])
+                    ? updateData[field.name]
+                    : (updateData[field.name] ? [updateData[field.name]] : []);
+
+                for (const id of relatedIds) {
+                    if (!id || !isObjectId(id)) continue; // Ignorer les valeurs null/invalides
+
+                    const targetCollection = await getCollectionForUser(user, field.relation);
+
+                    const validationQuery = {
+                        _id: new ObjectId(id),
+                        ...field.relationFilter
+                    };
+
+                    const relatedDoc = await targetCollection.findOne(validationQuery);
+
+                    if (!relatedDoc) {
+                        // Si on ne trouve rien, c'est que l'ID est invalide ou ne respecte pas le filtre.
+                        throw new Error(`La valeur '${id}' pour le champ '${field.name}' ne respecte pas le filtre de relation défini.`);
+                    }
+                }
+            }
+        }
+
         // 8. Calcul du nouveau hash et préparation des données finales
         const finalStateForHash = { ...existingDocs[0], ...updateData };
         const newHash = getFieldValueHash(model, finalStateForHash);
@@ -5172,6 +5218,7 @@ const handleFields = async (model, data, user, isRecursiveCall = false) => {
     }
 };
 
+let restoreRequests = {};
 export const validateRestoreRequest = (username, token) => {
     const request = restoreRequests[username];
     if (!request) {
@@ -5202,20 +5249,21 @@ export const loadFromDump = async (user, options = {}) => {
         throw new Error("No encryption key found for this user. Cannot restore.");
     }
 
+    const userId = getObjectHash({user: user.username});
     // --- La logique pour trouver le fichier de backup (local ou S3) reste la même ---
     // (le code existant pour trouver/télécharger le backupFilePath va ici)
     // ...
     let backupFilePath; // Assurez-vous que cette variable est bien définie avec le chemin du fichier .tar.gz
     // Exemple simplifié :
     const backupDir = getBackupDir();
-    const backupFilenameRegex = new RegExp(`^backup_${user.username}_(\\d+)\\.tar\\.gz$`);
+    const backupFilenameRegex = new RegExp(`^backup_${userId}_(\\d+)\\.tar\\.gz$`);
     const backupFiles = fs.readdirSync(backupDir).filter(filename => backupFilenameRegex.test(filename));
     if (backupFiles.length === 0) throw new Error(`Aucun fichier de sauvegarde local trouvé pour l'utilisateur ${user.username}.`);
     const latestBackupFile = backupFiles.sort((a, b) => parseInt(b.match(backupFilenameRegex)[1], 10) - parseInt(a.match(backupFilenameRegex)[1], 10))[0];
     backupFilePath = path.join(backupDir, latestBackupFile);
     // --- Fin de la logique de recherche de fichier ---
 
-    const tmpRestoreDir = path.join(backupDir, `tmp_restore_${user.username}_${Date.now()}`);
+    const tmpRestoreDir = path.join(backupDir, `tmp_restore_${userId}_${Date.now()}`);
 
     try {
         await runCryptoWorkerTask('decrypt', { filePath: backupFilePath, password: encryptedKey });
@@ -5252,17 +5300,25 @@ export const loadFromDump = async (user, options = {}) => {
         }
 
         let command;
+        const args = [
+            '--uri', dbUrl,
+            '--db', dbName
+        ];
+
         if (modelsOnly) {
-            // Restaure uniquement la collection des modèles
-            command = `mongorestore --uri="${dbUrl}" --db=${dbName} --nsInclude="${dbName}.models" "${restoreSourceDir}"`;
+            args.push('--nsInclude', `${dbName}.models`);
         } else {
-            // Restauration complète
-            command = `mongorestore --uri="${dbUrl}" --db=${dbName} --nsInclude="${dbName}.datas" --nsInclude="${dbName}.models" "${restoreSourceDir}"`;
+            // mongorestore accepte plusieurs fois l'option --nsInclude
+            args.push('--nsInclude', `${dbName}.datas`);
+            args.push('--nsInclude', `${dbName}.models`);
         }
+        // Le répertoire source est le dernier argument
+        args.push(restoreSourceDir);
 
-        logger.info(`[${action}] Executing restore command: ${command}`);
-        await execAsync(command);
 
+        logger.info(`[${action}] Executing restore command: ${command}`);
+        await execFileAsync('mongorestore', args);
+        
         // --- Tâches Post-Restauration ---
         await scheduleAlerts();
         await scheduleWorkflowTriggers();
@@ -5301,121 +5357,90 @@ const readKeyFromFile = (user) => {
     return null;
 };
 
+// C:/Dev/data-primals-engine/src/modules/data.js
+
 export const dumpUserData = async (user) => {
-// Déterminer la clé de chiffrement
-    // Pour cet exemple, on simule la config S3. Remplace par la vraie récupération.
-    const s3Config = user.configS3; // Supposons que l'objet 'user' passé contient déjà 'configS3'
+    const s3Config = user.configS3;
     const backupDir = getBackupDir();
+    const userId = getObjectHash({ user: user.username });
+    const backupFilename = `backup_${userId}`;
+    const timestamp = Date.now();
+
+    // Déclarer les chemins ici pour qu'ils soient accessibles dans tout le scope de la fonction
+    const localTempDumpDir = path.join(backupDir, `${backupFilename}_${timestamp}_temp`);
+    const finalArchiveName = `${backupFilename}_${timestamp}.tar.gz`;
+    const localArchivePath = path.join(backupDir, finalArchiveName);
 
     let encryptedKey = readKeyFromFile(user);
     if (!encryptedKey) {
         encryptedKey = generateAndStoreKey(user);
-        logger.info('Encryption key générée.');
-    } else {
-        logger.info('Encryption key chargée.');
     }
 
     try {
-        // Déterminer la fréquence de la sauvegarde
         const backupFrequency = await engine.userProvider.getBackupFrequency(user);
-
         logger.info(`Fréquence de sauvegarde : ${backupFrequency}.`);
 
-        // Définir le nom du fichier de sauvegarde et les chemins
-        const backupFilename = `backup_${user.username}`; //nom corrigé
-        const backupFileBasePath = path.join(backupDir, backupFilename); //chemin corrigé
-        const backupFilePath = `${backupFileBasePath}_${Date.now()}`;
-        const backupFilenameBase = `backup_${user.username}`;
-        const timestamp = Date.now();
-        const localTempDumpDir = path.join(backupDir, `${backupFilenameBase}_${timestamp}_temp`); // Répertoire temporaire local
-        const finalArchiveName = `${backupFilenameBase}_${timestamp}.tar.gz`; // Nom de l'archive finale
-        const localArchivePath = path.join(backupDir, finalArchiveName); // Chemin
-
-        logger.info(`Chemin du fichier de sauvegarde : ${backupFilePath}.`);
-
-        // Ajoute les filtres sur les collections et l'utilisateur
         const collections = await MongoDatabase.listCollections().toArray();
-        let query;
-        let col;
         for (const collection of collections) {
-
-            const colls = [await getUserCollectionName(user), 'models'];
-            if( colls.includes(collection.name) ){
-
-                // Exécuter mongodump avec les filtres appropriés
-                let command = `mongodump --uri="${dbUrl}" --db=${dbName} --out=${localTempDumpDir} `;
-
-                query = JSON.stringify({_user : user.username }); // Filtrer par _user
-                col = ` --collection=${collection.name}`;
-                command += `${col} --query ${JSON.stringify(query)}`;
-
-                logger.info(`Exécution de la commande : ${command}`);
-                await execAsync(command);
+            const collsToBackup = [await getUserCollectionName(user), 'models'];
+            if (collsToBackup.includes(collection.name)) {
+                const query = { _user: user.username };
+                const args = [
+                    '--uri', dbUrl,
+                    '--db', dbName,
+                    '--out', localTempDumpDir,
+                    '--collection', collection.name,
+                    '--query', JSON.stringify(query)
+                ];
+                logger.info(`Exécution de la commande : mongodump ${args.join(' ')}`);
+                await execFileAsync('mongodump', args);
             }
-
         }
 
-
-        // Zipper le contenu du répertoire de dump temporaire
-        // Le répertoire zippé sera `localTempDumpDir/${dbName}` si mongodump a créé ce sous-dossier
-        const dumpSourceDir = path.join(localTempDumpDir, dbName); // Le répertoire que mongodump a créé
+        const dumpSourceDir = path.join(localTempDumpDir, dbName);
         if (fs.existsSync(dumpSourceDir)) {
             await tar.create({ gzip: true, file: localArchivePath, C: localTempDumpDir }, [dbName]);
             logger.info(`Archive de sauvegarde locale créée : ${localArchivePath}`);
         } else {
-            throw new Error(`Le répertoire de dump ${dumpSourceDir} n'a pas été trouvé après mongodump.`);
+            logger.warn(`Le répertoire de dump ${dumpSourceDir} était vide. Aucune archive n'a été créée.`);
+            // On s'arrête ici car il n'y a rien à traiter
+            return Promise.resolve();
         }
 
-        // Chiffrer le fichier local avant l'upload si tu le souhaites (optionnel si le bucket S3 est déjà chiffré)
-        await encryptFile(localArchivePath, encryptedKey); // Ta fonction existante
+        await encryptFile(localArchivePath, encryptedKey);
 
         if (s3Config && s3Config.bucketName) {
-            logger.info(`Téléversement de la sauvegarde vers S3 pour l'utilisateur ${user.username}. Bucket: ${s3Config.bucketName}`);
             await uploadToS3(s3Config, localArchivePath, finalArchiveName);
-            logger.info(`Sauvegarde téléversée avec succès vers S3 pour ${user.username}.`);
-            // Optionnel: supprimer l'archive locale après l'upload S3 réussi
-            fs.unlinkSync(localArchivePath);
-            logger.info(`Archive locale ${localArchivePath} supprimée après l'upload S3.`);
+            fs.unlinkSync(localArchivePath); // Supprime l'archive locale après l'upload
         } else {
-            logger.info(`Aucune configuration S3 trouvée pour ${user.username}. La sauvegarde reste locale : ${localArchivePath}.`);
-            // Si pas de S3, le fichier chiffré localement (si encryptFile a été appelé) reste.
-            // Si tu ne chiffres pas localement et pas de S3, c'est l'archive .tar.gz qui reste.
-        }
-
-        // Supprimer le répertoire de dump temporaire
-        if (fs.existsSync(localTempDumpDir)) {
-            fs.rmSync(localTempDumpDir, { recursive: true, force: true });
-            logger.info(`Répertoire de dump temporaire ${localTempDumpDir} supprimé.`);
+            logger.info(`Aucune configuration S3 trouvée. La sauvegarde reste locale : ${localArchivePath}.`);
         }
 
         logger.info(`Sauvegarde réussie pour l'utilisateur ${user.username}.`);
-        // La gestion de la rotation des sauvegardes devra être adaptée
-        // si les sauvegardes sont sur S3 (lister depuis S3, supprimer depuis S3).
-        await manageBackupRotation(user, backupFrequency, s3Config); // Passer s3Config
+        await manageBackupRotation(user, backupFrequency, s3Config);
 
-        return Promise.resolve();
     } catch (error) {
         logger.error(`Erreur lors de la sauvegarde pour l'utilisateur ${user.username}:`, error);
-        // Nettoyage en cas d'erreur
-        const localTempDumpDir = path.join(backupDir, `backup_${user.username}_${Date.now()}_temp`); // Recalculer pour être sûr
-        if (fs.existsSync(localTempDumpDir)) {
-            fs.rmSync(localTempDumpDir, { recursive: true, force: true });
-        }
-        const localArchivePath = path.join(backupDir, `backup_${user.username}_${Date.now()}.tar.gz`); // Recalculer
+        // Nettoyage de l'archive si elle a été créée avant l'erreur
         if (fs.existsSync(localArchivePath)) {
             fs.unlinkSync(localArchivePath);
         }
-        throw error; // Relancer l'erreur
+        throw error; // Relancer l'erreur pour que l'appelant soit informé
+    } finally {
+        // --- NETTOYAGE GARANTI ---
+        // Ce bloc s'exécute toujours, que la sauvegarde réussisse ou échoue.
+        if (fs.existsSync(localTempDumpDir)) {
+            fs.rmSync(localTempDumpDir, { recursive: true, force: true });
+            logger.info(`Répertoire de dump temporaire ${localTempDumpDir} supprimé.`);
+        }
     }
-}
-
+};
 async function manageBackupRotation(user, backupFrequency, s3Config = null) { // Accepter s3Config
-    const userId = user.username; // ou user._id selon ce que tu utilises dans les noms de fichiers
-
+    const userId = getObjectHash({user:user.username});
     let filesToManage = [];
 
     if (s3Config && s3Config.bucketName) {
-        logger.info(`Gestion de la rotation des sauvegardes S3 pour ${userId}.`);
+        logger.info(`Gestion de la rotation des sauvegardes S3 pour ${userid}.`);
         const s3Backups = await listS3Backups(s3Config);
         // Filtrer pour ne garder que les backups de cet utilisateur et trier
         filesToManage = s3Backups

package/test/data.backup.integration.test.js

@@ -86,7 +86,7 @@ afterAll(async () => {
         fs.readdirSync(backupDir).forEach(file => {
             fs.unlinkSync(path.join(backupDir, file));
         });
-        // Optional: fs.rmdirSync(backupDir); // Remove the directory itself
+        fs.rmdirSync(backupDir); // Remove the directory itself
     }
 });
 
@@ -132,5 +132,7 @@ describe('Data Backup and Restore Integration', () => {
         expect(docAfterRestore.testField).toBe('Initial Value');
         expect(docAfterRestore.optionalField).toBe(123);
 
+        console.log("Tests passed for backup and restore");
+
     }, 15000); // Timeout augmenté pour les opérations de fichiers
 });

package/test/data.integration.test.js

@@ -1,13 +1,13 @@
 // __tests__/data.integration.test.js
 import { ObjectId } from 'mongodb';
-import {expect, describe, it, beforeEach, beforeAll} from 'vitest';
+import {expect, describe, it, beforeEach, beforeAll, afterAll} from 'vitest';
 import { Config } from '../src/config.js';
 
 import {
     insertData,
     editData,
     deleteData,
-    searchData, installPack
+    searchData, installPack, deleteModels, createModel
 } from 'data-primals-engine/modules/data';
 
 import {
@@ -120,11 +120,12 @@ async function setupTestContext() {
     };
 }
 
+let engine;
 describe('Intégration des fonctions CRUD de données avec validation complète', () => {
 
     beforeAll(async () =>{
         Config.Set("modules", ["mongodb", "data", "file", "bucket", "workflow","user", "assistant"]);
-        await initEngine();
+        engine = await initEngine();
 
     })
 
@@ -788,5 +789,103 @@ describe('Intégration des fonctions CRUD de données avec validation complète'
             expect(validModel).not.toBeNull();
         });
     });
+    // In test/data.integration.test.js
+
+    describe('relationFilter validation', () => {
+        let user;
+        let activeProductId, inactiveProductId;
+
+        // Model names are kept in French to match the database, but variables are in English.
+        const productModel = {
+            name: 'produitTestFiltre',
+            description: '',
+            fields: [
+                { name: 'name', type: 'string' },
+                { name: 'actif', type: 'boolean', default: false }
+            ]
+        };
+        const orderModel = {
+            name: 'commandeTestFiltre',
+            description: '',
+            fields: [
+                { name: 'ref', type: 'string' },
+                {
+                    name: 'produit',
+                    type: 'relation',
+                    relation: 'produitTestFiltre',
+                    relationFilter: { actif: true } // Only link active products
+                }
+            ]
+        };
+
+        // Set up the context once for all tests in this describe block.
+        beforeAll(async () => {
+            user = await engine.userProvider.findUserByUsername('demo');
+            // Cleanup before starting to ensure a clean state
+            await deleteModels({ name: productModel.name, _user: user.username });
+            await deleteModels({ name: orderModel.name, _user: user.username });
+            await deleteData(productModel.name, [], {}, user);
+            await deleteData(orderModel.name, [], {}, user);
+
+            // Create models
+            await createModel({ ...productModel, _user: user.username });
+            await createModel({ ...orderModel, _user: user.username });
+
+            // Create test data
+            const activeProduct = await insertData(productModel.name, { name: 'Active Product', actif: true }, {}, user);
+            const inactiveProduct = await insertData(productModel.name, { name: 'Inactive Product', actif: false }, {}, user);
+
+            activeProductId = activeProduct.insertedIds[0];
+            inactiveProductId = inactiveProduct.insertedIds[0];
+        });
+
+        // Clean up everything after all tests in this block have run.
+        afterAll(async () => {
+            await deleteModels({ name: productModel.name, _user: user.username });
+            await deleteModels({ name: orderModel.name, _user: user.username });
+            await deleteData(productModel.name, [], {}, user);
+            await deleteData(orderModel.name, [], {}, user);
+        });
+
+        it('should ALLOW inserting data with a valid relation', async () => {
+            const result = await insertData(orderModel.name, { ref: 'CMD-OK', produit: activeProductId }, {}, user);
+            expect(result.success).toBe(true);
+            expect(result.insertedIds).toHaveLength(1);
+            // Cleanup the created order for test isolation
+            await deleteData(orderModel.name, result.insertedIds, {}, user);
+        });
+
+        it('should REJECT inserting data with a relation that does not respect the filter', async () => {
+            const result = await insertData(orderModel.name, { ref: 'CMD-FAIL', produit: inactiveProductId }, {}, user);
+            expect(result.success).toBe(false);
+            expect(result.error).toContain('produit');
+        });
+
+        it('should ALLOW updating data with a valid relation', async () => {
+            // First, create a valid order
+            const initialOrder = await insertData(orderModel.name, { ref: 'CMD-TO-EDIT', produit: activeProductId }, {}, user);
 
+            // Update it (even with the same value, this tests the code path)
+            const result = await editData(orderModel.name, { _id: initialOrder.insertedIds[0] }, { produit: activeProductId }, {}, user);
+
+            expect(result.success).toBe(true);
+            // The hash might not change if only metadata like _updatedAt changes, so modifiedCount can be 0 or 1.
+            expect(result.modifiedCount).toBeGreaterThanOrEqual(0);
+
+            // Cleanup
+            await deleteData(orderModel.name, initialOrder.insertedIds, {}, user);
+        });
+
+        it('should REJECT updating data with a relation that does not respect the filter', async () => {
+            // First, create a valid order
+            const initialOrder = await insertData(orderModel.name, { ref: 'CMD-TO-EDIT-FAIL', produit: activeProductId }, {}, user);
+
+            // Attempt to link it to an inactive product, expecting it to fail.
+            const result = await editData(orderModel.name, { _id: initialOrder.insertedIds[0] }, { produit: inactiveProductId }, {}, user);
+            expect(result.success).toBe(false);
+            expect(result.error).toContain('produit');
+            // Cleanup
+            await deleteData(orderModel.name, initialOrder.insertedIds, {}, user);
+        });
+    });
 });