data-primals-engine 1.6.3 → 1.7.0

package/src/modules/data/data.operations.js

@@ -24,7 +24,7 @@ import {
     optionsSanitizer,
     searchRequestTimeout
 } from "../../constants.js";
-import {anonymizeText, getFieldValueHash, getUserId, isDemoUser, isLocalUser} from "../../data.js";
+import {anonymizeText, encryptValue, getFieldValueHash, getUserId, isDemoUser, isLocalUser} from "../../data.js";
 import sanitizeHtml from "sanitize-html";
 import {importJobs, modelsCache, runCryptoWorkerTask, runImportExportWorker} from "./data.core.js";
 import {
@@ -37,7 +37,7 @@ import {
 } from "../mongodb.js";
 import i18n from "../../i18n.js";
 import tinycolor from 'tinycolor2';
-import {Config} from "../../config.js";
+import { Config } from "../../config.js";
 import {calculateTotalUserStorageUsage, hasPermission} from "../user.js";
 import {BSON, ObjectId} from "mongodb";
 import {runScheduledJobWithDbLock, triggerWorkflows} from "../workflow.js";
@@ -45,7 +45,7 @@ import schedule from "node-schedule";
 import {sendSseToUser} from "./data.routes.js";
 import {applyCronMask, handleScheduledJobs, runStatefulAlertJob} from "./data.scheduling.js";
 import {Event} from "../../events.js";
-import {getAllPacks} from "../../packs.js";
+import { getAllPacks } from "../../packs.js";
 import {validateModelData, validateModelStructure} from "./data.validation.js";
 import {addFile, removeFile} from "../file.js";
 import NodeCache from "node-cache";
@@ -61,7 +61,8 @@ import {
     processDocuments
 } from "./data.relations.js";
 import crypto from 'crypto';
-import cronstrue from 'cronstrue/i18n.js';
+import cronstrue from 'cronstrue/i18n.js'
+import { isConditionMet } from '../../filter.js';
 import util from "node:util";
 
 const delay = ms => new Promise(res => setTimeout(res, ms));
@@ -70,7 +71,7 @@ const IMPORT_CHUNK_DELAY_MS = 1000; // Délai en millisecondes entre le traiteme
 
 export const dataTypes = {
     object: {
-        validate: (value, field) => {
+            validate: (value, field) => {
             return value === null || isPlainObject(value);
         }
     },
@@ -111,7 +112,13 @@ export const dataTypes = {
             const ml = Math.min(Math.max(field.maxlength, 0), m);
             return value === null || typeof value === 'string' && (!ml || value.length <= ml)
         },
-        anonymize: anonymizeText
+        anonymize: anonymizeText,
+        filter: async (value, field) => {
+            if (field.encrypted && value) {
+                return encryptValue(value);
+            }
+            return value;
+        }
     },
     code: {
         validate: (value, field) => {
@@ -141,8 +148,12 @@ export const dataTypes = {
             const ml = Math.min(Math.max(field.maxlength, 0), m);
             return value === null || typeof value === 'string' && (!ml || value.length <= ml)
         },
-        filter: async (value) => {
-            return sanitizeHtml(value, optionsSanitizer);
+        filter: async (value, field) => {
+            const sanitized = sanitizeHtml(value, optionsSanitizer);
+            if (field.encrypted && sanitized) {
+                return encryptValue(sanitized);
+            }
+            return sanitized;
         },
         anonymize: anonymizeText
     },
@@ -151,7 +162,7 @@ export const dataTypes = {
             if (value === null)
                 return true;
             const m = Config.Get('maxStringLength', maxStringLength);
-            const ml = Math.min(Math.max(field.maxlength, 0), maxStringLength);
+            const ml = Math.min(Math.max(field.maxlength, 0), m);
             // La valeur peut être une chaîne de caractères...
             if (typeof value === 'string') {
                 return !ml || value.length <= ml;
@@ -693,14 +704,27 @@ export const getModel = async (modelName, user) => {
 export const getModels = async () => {
     return await getCollection('models')?.find({'$or': [{_user: {$exists: false}}]}).toArray() || [];
 }
-export const insertData = async (modelName, data, files, user, triggerWorkflow = true, waitForWorkflow = true) => {
+export const insertData = async (modelName, data, files, user, triggerWorkflow = true, waitForWorkflow = true, checkPermissions = true) => {
 
-    // --- Vérification des permissions (inchangée) ---
-    if (!(isDemoUser(user) && Config.Get("useDemoAccounts")) && isLocalUser(user) && (
-        !await hasPermission(["API_ADMIN", "API_ADD_DATA", "API_ADD_DATA_" + modelName], user) ||
-        await hasPermission(["API_ADD_DATA_NOT_" + modelName], user))) {
-        // Renvoyer une structure d'erreur cohérente
-        return {success: false, error: i18n.t('api.permission.addData'), statusCode: 403};
+    if (checkPermissions) {
+        // --- Vérification des permissions ---
+        const permissionFilter = await hasPermission(["API_ADMIN", "API_ADD_DATA", "API_ADD_DATA_" + modelName], user);
+        const hasDeniedPermission = await hasPermission(["API_ADD_DATA_NOT_" + modelName], user);
+
+        if (!(isDemoUser(user) && Config.Get("useDemoAccounts")) && isLocalUser(user) && (!permissionFilter || hasDeniedPermission)) {
+            return { success: false, error: i18n.t('api.permission.addData', "You do not have permission to add this data."), statusCode: 403 };
+        }
+
+        // Si un filtre de permission existe, valider les données entrantes
+        if (typeof permissionFilter === 'object' && Object.keys(permissionFilter).length > 0) {
+            const dataArray = Array.isArray(data) ? data : [data];
+            const model = await getModel(modelName, user);
+            for (const doc of dataArray) {
+                if (!isConditionMet(model, permissionFilter, doc, [], user)) {
+                    return { success: false, error: i18n.t('api.permission.addData.filterViolation', "The data you are trying to add does not meet the required permission criteria."), statusCode: 403 };
+                }
+            }
+        }
     }
 
     const collection = await getCollectionForUser(user);
@@ -836,7 +860,7 @@ export const insertData = async (modelName, data, files, user, triggerWorkflow =
         return {success: true, data: firstInsertedDoc, insertedIds: insertedIds.map(id => id.toString())};
 
     } catch (error) { // Attrape les erreurs de permission ou de pushDataUnsecure
-        logger.error(`[insertData] Main error during insertion process for model ${modelName}: ${error.message}`, error.stack);
+        logger?.error(`[insertData] Main error during insertion process for model ${modelName}: ${error.message}`, error.stack);
         // Renvoyer une structure d'erreur cohérente
         return {
             success: false,
@@ -1084,27 +1108,40 @@ export const editData = async (modelName, filter, data, files, user, triggerWork
 const internalEditOrPatchData = async (modelName, filter, data, files, user, isPatch, triggerWorkflow = true, waitForWorkflow = false) => {
     try {
         // 1. Vérification des permissions
-        if (user.username !== 'demo' && isLocalUser(user) && (
-            !await hasPermission(["API_ADMIN", "API_EDIT_DATA", "API_EDIT_DATA_" + modelName], user) ||
-            await hasPermission(["API_EDIT_DATA_NOT_" + modelName], user))) {
-            throw new Error(i18n.t("api.permission.editData"));
+        const permissionResult = await hasPermission(["API_ADMIN", "API_EDIT_DATA", "API_EDIT_DATA_" + modelName], user);
+        const hasDeniedPermission = await hasPermission(["API_EDIT_DATA_NOT_" + modelName], user);
+
+        if (user.username !== 'demo' && isLocalUser(user) && (!permissionResult || hasDeniedPermission)) {
+            throw new Error(i18n.t("api.permission.editData", "You do not have permission to edit this data."));
         }
 
+
         const collection = await getCollectionForUser(user);
-        const model = await modelsCollection.findOne({name: modelName, _user: user.username});
+        const model = await modelsCollection.findOne({$and : [{name: modelName}, {$or: [{_user: user._user}, {_user:user.username}]}]});
         if (!model) {
             throw new Error(i18n.t("api.model.notFound", {model: modelName}));
         }
 
-        // 2. Récupération des documents existants et de leur hash original
-        const existingDocs = (await searchData({model: modelName, filter}, user))?.data;
+        // 2. Combinaison du filtre de la requête et du filtre de permission
+        let combinedFilter = filter;
+        if (permissionResult && typeof permissionResult === 'object' && Object.keys(permissionResult).length > 0) {
+            combinedFilter = {
+                $and: [filter, permissionResult]
+            };
+        }
+
+        // 3. Récupération des documents à modifier en utilisant le filtre combiné
+        const docsToEditQuery = await searchData({model: modelName, filter: combinedFilter}, user);
+        let existingDocs = docsToEditQuery.data;
+
         if (!existingDocs || existingDocs.length === 0) {
-            return {success: false, error: i18n.t("api.data.notFound")};
+            throw new Error(i18n.t("api.data.notFound"));
         }
+
         const ids = existingDocs.map(d => new ObjectId(d._id));
         const originalHash = existingDocs[0]._hash; // Sauvegarde du hash avant modification
  
-        // 3. Préparation des données de mise à jour en séparant les opérateurs
+        // 4. Préparation des données de mise à jour en séparant les opérateurs
         const updateSetData = {};
         const updatePushData = {};
  
@@ -1164,15 +1201,10 @@ const internalEditOrPatchData = async (modelName, filter, data, files, user, isP
             }
         }
 
-        // 4. Validation adaptée pour patch ou edit
-        if (!isPatch) {
-            const dataToValidate = {...existingDocs[0], ...updateSetData};
-            await validateModelData(dataToValidate, model, false);
-        } else {
-            await validateModelData(updateSetData, model, true);
-        }
+        // 5. Validation adaptée pour patch ou edit
+        await validateModelData(isPatch ? updateSetData : { ...existingDocs[0], ...updateSetData }, model, isPatch);
 
-        // 4.1 Validation pour les opérations $push
+        // 5.1 Validation pour les opérations $push
         for (const fieldName in updatePushData) {
             const field = model.fields.find(f => f.name === fieldName);
             if (!field) throw new Error(`Le champ '${fieldName}' pour l'opération $push n'existe pas dans le modèle '${model.name}'.`);
@@ -1197,7 +1229,7 @@ const internalEditOrPatchData = async (modelName, filter, data, files, user, isP
         }
 
 
-        // 5. Vérification des champs uniques (s'applique uniquement aux opérations $set)
+        // 6. Vérification des champs uniques (s'applique uniquement aux opérations $set)
         const uniqueFields = model.fields.filter(f => f.unique);
         for (const field of uniqueFields) {
             if (updateData[field.name] !== undefined) {
@@ -1216,7 +1248,7 @@ const internalEditOrPatchData = async (modelName, filter, data, files, user, isP
             }
         }
 
-        // 6. Traitement des relations (pour $set)
+        // 7. Traitement des relations (pour $set)
         const relationFields = model.fields.filter(f => f.type === 'relation');
         for (const field of relationFields) {
             if (updateData[field.name] !== undefined) {
@@ -1240,7 +1272,7 @@ const internalEditOrPatchData = async (modelName, filter, data, files, user, isP
             }
         }
 
-        // 7. Application des filtres de champ (pour $set)
+        // 8. Application des filtres de champ (pour $set)
         for (const field of model.fields) {
             // On saute les champs 'file' car ils ont déjà été traités
             if (field.type !== 'file' && field.itemsType !== 'file' && updateData[field.name] !== undefined && dataTypes[field.type]?.filter) {
@@ -1286,7 +1318,7 @@ const internalEditOrPatchData = async (modelName, filter, data, files, user, isP
             }
         }
 
-        // 8. Vérification des limites de stockage avant la mise à jour
+        // 9. Vérification des limites de stockage avant la mise à jour
         const originalDocsSize = calculateDataSize(existingDocs);
         const finalStateForSize = existingDocs.map(doc => {
             const updatedDoc = { ...doc, ...updateSetData };
@@ -1323,7 +1355,7 @@ const internalEditOrPatchData = async (modelName, filter, data, files, user, isP
             }
         }
 
-        // 8. Calcul du nouveau hash en simulant l'état final
+        // 10. Calcul du nouveau hash en simulant l'état final
         const finalStateForHash = { ...existingDocs[0], ...updateSetData };
         for (const fieldName in updatePushData) {
             let itemsToAdd;
@@ -1358,7 +1390,7 @@ const internalEditOrPatchData = async (modelName, filter, data, files, user, isP
             }
         }
 
-        // 9. *** CORRECTION LOGIQUE ***
+        // 11. *** CORRECTION LOGIQUE ***
         // On ne vérifie l'unicité que si le hash a réellement changé.
         if (newHash !== originalHash) {
             const hashCheck = await checkHash(user, model, newHash, existingDocs[0]._id.toString());
@@ -1368,7 +1400,7 @@ const internalEditOrPatchData = async (modelName, filter, data, files, user, isP
             }
         }
 
-        // 10. Exécution de la mise à jour.
+        // 12. Exécution de la mise à jour.
         // Si une opération $push est présente, nous devons utiliser une pipeline d'agrégation
         // pour gérer de manière robuste le cas où le champ cible est `null` ou n'existe pas.
         let updateCommand;
@@ -1430,7 +1462,7 @@ const internalEditOrPatchData = async (modelName, filter, data, files, user, isP
             });
         }
 
-        // 11. Tâches post-mise à jour (schedules, workflows) (inchangé)
+        // 13. Tâches post-mise à jour (schedules, workflows) (inchangé)
         if (["workflowTrigger", "alert"].includes(modelName)) {
             await handleScheduledJobs(modelName, existingDocs, collection, finalUpdateOperation.$set || {});
         }
@@ -1452,47 +1484,72 @@ const internalEditOrPatchData = async (modelName, filter, data, files, user, isP
         };
 
     } catch (error) {
-        logger.error("Erreur lors de la mise à jour de la ressource :", error);
+        logger?.error("Erreur lors de la mise à jour de la ressource :", error);
         return {success: false, error: error.message};
     }
 };
 export const deleteData = async (modelName, filter, user = {}, triggerWorkflow, waitForWorkflow = false) => {
 
     try {
-        const collection = await getCollectionForUser(user);
+        const permissionFilter = await hasPermission(["API_ADMIN", "API_DELETE_DATA", "API_DELETE_DATA_" + modelName], user);
+        const hasDeniedPermission = await hasPermission(["API_DELETE_DATA_NOT_" + modelName], user);
 
-        // --- Début de la logique de suppression ---
+        if (user?.username !== 'demo' && isLocalUser(user) && (!permissionFilter || hasDeniedPermission)) {
+            // Si l'utilisateur n'a pas la permission de base, on arrête tout de suite.
+            return { success: false, error: i18n.t("api.permission.deleteData", "You do not have permission to delete this data."), deletedCount: 0 };
+        }
 
-        // 1. Construire le filtre de base pour trouver les documents à supprimer
-        let findFilter = [];
-        if (user)
-            findFilter.push({
-                '$eq': ["$_user", user.username]
-            });
+        const collection = await getCollectionForUser(user);
 
-        // Ajouter le filtre par IDs si fourni
-        if (Array.isArray(filter) && filter.length > 0) {
-            findFilter.push({"$in": ["$_id", filter.map(m => new ObjectId(m))]});
-        }
+        // 1. Construire le filtre de recherche.
+        // Nous allons utiliser un seul objet $match avec un $and global pour combiner toutes les conditions.
+        const matchConditions = [];
 
-        // Ajouter le filtre par nom de modèle si fourni (utile si 'filter' est utilisé seul)
-        if (modelName)
-            findFilter.push({
-                '$eq': ["$_model", modelName]
-            });
+        // Conditions de base (modèle et utilisateur)
+        if (user) {
+            matchConditions.push({ $expr: { '$eq': ["$_user", user.username] } });
+        }
+        if (modelName) {
+            matchConditions.push({ _model: modelName });
+        }
 
-        // Ajouter le filtre supplémentaire si fourni
-        if (filter && typeof filter === 'object' && Object.keys(filter).length > 0) {
-            // Fusionner prudemment le filtre supplémentaire
-            // Attention: Si 'filter' contient des clés comme _id ou _user,
-            // cela pourrait entrer en conflit. Une fusion plus robuste pourrait re nécessaire.
-            findFilter.push(filter);
-        } else {
+        // Filtre de la requête (par ID ou autre)
+        if (Array.isArray(filter) && filter.length > 0 && isObjectId(filter[0])) {
+            // Filtre par tableau d'IDs
+            matchConditions.push({ _id: { "$in": filter.map(m => new ObjectId(m)) } });
+        } else if (filter && typeof filter === 'object' && Object.keys(filter).length > 0) {
+            const firstKey = Object.keys(filter)[0];
+            // Si le filtre est une expression d'agrégation (commence par $), on l'encapsule dans $expr
+            if (firstKey.startsWith('$')) {
+                matchConditions.push({ $expr: filter });
+            } else {
+                // Sinon, on le traite comme un filtre de document standard
+                const processedFilter = {};
+                for (const key in filter) {
+                    if (key === '_id' && !isObjectId(filter[key])) {
+                        // S'assurer que la conversion ne se fait que si la chaîne est un ID valide
+                        if (ObjectId.isValid(filter[key])) {
+                            processedFilter[key] = new ObjectId(filter[key]);
+                        } else {
+                            processedFilter[key] = filter[key]; // Garder la valeur originale si non valide
+                        }
+                    } else {
+                        processedFilter[key] = filter[key];
+                    }
+                }
+                matchConditions.push(processedFilter);
+            }
+        }
 
+        // Filtre de permission
+        if (permissionFilter && typeof permissionFilter === 'object') {
+            matchConditions.push(permissionFilter);
         }
 
+        const findFilter = matchConditions.length > 0 ? { $and: matchConditions } : {};
+
         // 2. Récupérer les documents à supprimer pour vérifier leur type et annuler les schedules
-        const documentsToDelete = await collection.aggregate([{$match: {$expr: {"$and": findFilter}}}]).toArray();
+        const documentsToDelete = await collection.aggregate([{ $match: findFilter }]).toArray();
 
         if (documentsToDelete.length === 0) {
             logger.info(`[deleteData] No documents found matching the criteria for user ${user?.username}.`);
@@ -1531,15 +1588,6 @@ export const deleteData = async (modelName, filter, user = {}, triggerWorkflow,
                 await Promise.allSettled(deletePromises);
             }
 
-            // Vérification des permissions (pour chaque document trouvé)
-            if (user?.username !== 'demo' && isLocalUser(user) && (
-                !await hasPermission(["API_ADMIN", "API_DELETE_DATA", "API_DELETE_DATA_" + docToDelete._model], user) ||
-                await hasPermission(["API_DELETE_DATA_NOT_" + docToDelete._model], user))) {
-                // Si l'utilisateur n'a pas la permission pour CE document spécifique, on l'ignore
-                logger.warn(`[deleteData] User ${user.username} lacks permission to delete document ${docToDelete._id} of model ${docToDelete._model}. Skipping.`);
-                continue; // Passe au document suivant
-            }
-
             // *** Ajout de l'annulation du schedule pour workflowTrigger ***
             if (docToDelete._model === 'workflowTrigger') {
                 const jobId = `workflowTrigger_${docToDelete._id}`;
@@ -1678,9 +1726,10 @@ export const deleteData = async (modelName, filter, user = {}, triggerWorkflow,
         } else {
             logger.info(`[deleteData] No documents to delete for user ${user?.username} after permission checks or matching criteria.`);
         }
-
         const res = { success: true, deletedCount };
 
+        if (!modelNameToInvalidate)
+            return res;
         // --- CORRECTION ---
         // The event payload must match what the history listener expects: { modelName, user, before }.
         // 'documentsToDelete' contains the full documents before they were deleted.
@@ -1807,7 +1856,6 @@ export const searchData = async (query, user) => {
     // Vérifier si les données sont en cache
     const cachedData = searchCache.get(cacheKey);
     if (cachedData) {
-        console.log('Cache hit for key:', cacheKey);
         return cachedData;
     }
 
@@ -3052,7 +3100,6 @@ export const exportData = async (options, user) => {
  * Installs pack models and data for a user or globally.
  * Can accept either a pack ID (to install from database) or a direct pack JSON object.
  *
- * @param {object} logger - Logger instance
  * @param {string|object} packIdentifier - Either pack ID (string) or pack JSON object
  * @param {object|null} user - User object (if installing for user) or null (for global install)
  * @param {string} [lang='en'] - Language code for localized data
@@ -3061,7 +3108,6 @@ export const exportData = async (options, user) => {
 export async function installPack(packIdentifier, user = null, lang = 'en', options = {}) {
     let pack;
     const packsCollection = getCollection('packs');
-
     // Determine if we're working with an ID or direct pack object
     if (typeof packIdentifier === 'string') {
         let p;
@@ -3101,12 +3147,19 @@ export async function installPack(packIdentifier, user = null, lang = 'en', opti
         throw new Error('Invalid pack identifier - must be either pack ID string or pack object');
     }
 
+    // Vérifier si le pack est déjà installé pour cet utilisateur
+    const existingPack = await packsCollection.findOne({ name: pack.name, _user: user?.username });
+    if (existingPack) {
+        logger?.warn(`Pack '${pack.name}' is already installed for user '${user?.username}'. Skipping installation.`);
+        return { success: true, summary: {}, errors: [], modifiedCount: 0 };
+    }
+
     const username = user ? user.username : null;
     const logPrefix = username
         ? `Installing pack '${pack.name}' for user '${username}'`
         : `Installing pack '${pack.name}' globally`;
 
-    logger.info(`--- ${logPrefix} ---`);
+    logger?.info(`--- ${logPrefix} ---`);
 
     const summary = {
         models: {installed: [], skipped: [], failed: []},
@@ -3121,9 +3174,8 @@ export async function installPack(packIdentifier, user = null, lang = 'en', opti
     if (Array.isArray(pack.models)) {
         // For user installs, check existing models
         const existingModels = user
-            ? await modelsCollection.find({_user: username}).toArray()
+            ? await modelsCollection.find({_user: user.username}).toArray()
             : await modelsCollection.find({_user: {$exists: false}}).toArray();
-
         const existingModelNames = existingModels.map(m => m.name);
 
         for (let i = 0; i < pack.models.length; i++) {
@@ -3132,8 +3184,9 @@ export async function installPack(packIdentifier, user = null, lang = 'en', opti
                 const modelName = typeof modelOrName === 'string' ? modelOrName : modelOrName?.name;
                 if (!modelName) throw new Error('Model definition in pack is missing a name.');
 
-                if (existingModelNames.includes(modelName)) {
-                    logger.debug(`[Model Install] Skipping '${modelName}': already exists`);
+                const r = typeof user?.username === 'string' && await modelsCollection.findOne({name: modelName, _user: user.username || /.*/});
+                if (r ) {
+                    logger?.debug(`[Model Install] Skipping '${modelName}': already exists`);
                     summary.models.skipped.push(modelName);
                     continue;
                 }
@@ -3160,7 +3213,7 @@ export async function installPack(packIdentifier, user = null, lang = 'en', opti
                 await modelsCollection.insertOne(preparedModel);
                 summary.models.installed.push(modelName);
             } catch (e) {
-                logger.error(e);
+                logger?.error(e);
                 const modelName = typeof modelOrName === 'string' ? modelOrName : modelOrName?.name || 'unknown';
                 errors.push(`Failed to install model '${modelName}': ${e.message}`);
                 summary.models.failed.push(modelName);
@@ -3171,8 +3224,8 @@ export async function installPack(packIdentifier, user = null, lang = 'en', opti
     // --- PHASE 2: DATA INSTALLATION ---
     const dataToInstall = {...pack.data?.all, ...pack.data?.[lang]};
     if (!dataToInstall || Object.keys(dataToInstall).length === 0) {
-        logger.warn(`Pack '${pack.name}' has no data to install.`);
-        return {success: false, summary, errors, modifiedCount: 0};
+        logger?.warn(`Pack '${pack.name}' has no data to install.`);
+        return {success: errors.length === 0, summary, errors, modifiedCount: 0};
     }
 
     // Process link references (same as original)
@@ -3205,49 +3258,49 @@ export async function installPack(packIdentifier, user = null, lang = 'en', opti
         const documents = dataToInstall[modelName];
         if (documents.length === 0) continue;
 
-        const docsToInsert = [];
-        const modelDefForHash = await getModel(modelName, user);
+        try {
+            const docsToInsert = [];
+            const modelDefForHash = await getModel(modelName, user);
 
-        for (const docSource of documents) {
-            let docForInsert = {...docSource};
+            for (const docSource of documents) {
+                let docForInsert = {...docSource};
 
-            // Clear $link fields for first pass
-            for (const key in docForInsert) {
-                if (isPlainObject(docForInsert[key]) && docForInsert[key].$link) {
-                    docForInsert[key] = null;
+                // Clear $link fields for first pass
+                for (const key in docForInsert) {
+                    if (isPlainObject(docForInsert[key]) && docForInsert[key].$link) {
+                        docForInsert[key] = null;
+                    }
                 }
-            }
 
-            const tempId = docForInsert._temp_pack_id;
-            delete docForInsert._id;
-            delete docForInsert._temp_pack_id;
+                const tempId = docForInsert._temp_pack_id;
+                delete docForInsert._id;
+                delete docForInsert._temp_pack_id;
 
-            if (user) docForInsert._user = username;
-            
-            docForInsert._model = modelName;
-            docForInsert._hash = getFieldValueHash(modelDefForHash, docForInsert);
+                if (user) docForInsert._user = username;
 
-            // Check for existing document
-            const existingQuery = {
-                _hash: docForInsert._hash,
-                _model: modelName
-            };
+                docForInsert._model = modelName;
+                docForInsert._hash = getFieldValueHash(modelDefForHash, docForInsert);
+
+                // Check for existing document
+                const existingQuery = {
+                    _hash: docForInsert._hash,
+                    _model: modelName
+                };
 
-            if (docForInsert._env) existingQuery._env = docForInsert._env;
-            if (user) existingQuery._user = username;
+                if (docForInsert._env) existingQuery._env = docForInsert._env;
+                if (user) existingQuery._user = username;
 
-            const existingDoc = await collection.findOne(existingQuery, {projection: {_id: 1}});
-            if (existingDoc) {
-                tempIdToNewIdMap[tempId] = existingDoc._id;
-                summary.datas.skipped++;
-            } else {
-                docForInsert._temp_pack_id_for_mapping = tempId;
-                docsToInsert.push(docForInsert);
+                const existingDoc = await collection.findOne(existingQuery, {projection: {_id: 1}});
+                if (existingDoc) {
+                    tempIdToNewIdMap[tempId] = existingDoc._id;
+                    summary.datas.skipped++;
+                } else {
+                    docForInsert._temp_pack_id_for_mapping = tempId;
+                    docsToInsert.push(docForInsert);
+                }
             }
-        }
 
-        if (docsToInsert.length > 0) {
-            try {
+            if (docsToInsert.length > 0) {
                 const finalDocsToInsert = docsToInsert.map(d => {
                     const doc = {...d};
                     delete doc._temp_pack_id_for_mapping;
@@ -3265,22 +3318,22 @@ export async function installPack(packIdentifier, user = null, lang = 'en', opti
                         tempIdToNewIdMap[doc._temp_pack_id_for_mapping] = result.insertedIds[index];
                     }
                 });
-            } catch (e) {
-                summary.datas.failed += docsToInsert.length;
-                errors.push(`Error inserting batch for ${modelName}: ${e.message}`);
-                logger.error(`[Pack Install] Error on insertMany for model ${modelName}:`, e);
             }
+        } catch (e) {
+            summary.datas.failed += documents.length;
+            errors.push(`Error processing model ${modelName}: ${e.message}`);
+            logger?.error(`[Pack Install] Error processing model ${modelName}:`, e);
         }
     }
 
     // --- PASS 2: REFERENCE LINKING ---
-    logger.info(`[Pack Install] Starting Pass 2: Linking ${linkQueue.length} references`);
+    logger?.info(`[Pack Install] Starting Pass 2: Linking ${linkQueue.length} references`);
     for (const linkOp of linkQueue) {
         const {sourceTempId, sourceModelName, fieldName, linkSelector} = linkOp;
         const sourceId = tempIdToNewIdMap[sourceTempId];
 
         if (!sourceId) {
-            logger.warn(`[LINK FAILED] Could not find newly inserted document for temp ID ${sourceTempId}. Skipping link.`);
+            logger?.warn(`[LINK FAILED] Could not find newly inserted document for temp ID ${sourceTempId}. Skipping link.`);
             continue;
         }
 
@@ -3292,7 +3345,7 @@ export async function installPack(packIdentifier, user = null, lang = 'en', opti
             const fieldDef = sourceModelDef.fields.find(f => f.name === fieldName);
 
             if (!fieldDef) {
-                logger.warn(`[LINK FAILED] Field '${fieldName}' not found in source model '${sourceModelName}'`);
+                logger?.warn(`[LINK FAILED] Field '${fieldName}' not found in source model '${sourceModelName}'`);
                 errors.push(`[LINK FAILED] Field '${fieldName}' not found in source model '${sourceModelName}'`);
                 summary.datas.failed++;
                 continue;
@@ -3306,7 +3359,7 @@ export async function installPack(packIdentifier, user = null, lang = 'en', opti
 
             if (!targetDocs || targetDocs.length === 0) {
                 const errorMsg = `[LINK FAILED] No target found for ${JSON.stringify(linkSelector)}`;
-                logger.warn(errorMsg);
+                logger?.warn(errorMsg);
                 errors.push(errorMsg);
                 summary.datas.failed++;
                 continue;
@@ -3325,7 +3378,7 @@ export async function installPack(packIdentifier, user = null, lang = 'en', opti
 
         } catch (e) {
             const errorMsg = `[LINK CRITICAL] Error linking ${sourceModelName}.${fieldName}: ${e.message}`;
-            logger.error(errorMsg, e.stack);
+            logger?.error(errorMsg, e.stack);
             errors.push(errorMsg);
             summary.datas.failed++;
         }
@@ -3334,7 +3387,7 @@ export async function installPack(packIdentifier, user = null, lang = 'en', opti
     if (options.installForUser && user?.username) {
         if (pack.name)
             await packsCollection.deleteOne({name: pack.name, _user: user.username});
-        logger.info(`--- Creating pack '${pack.name}' for user... ---`);
+        logger?.info(`--- Creating pack '${pack.name}' for user... ---`);
         const packToCreate = {...pack, _id: undefined, private: true, _user: user.username};
         await packsCollection.insertOne(packToCreate);
     }
@@ -3345,7 +3398,7 @@ export async function installPack(packIdentifier, user = null, lang = 'en', opti
     }
 
     const modifiedCount = summary.datas.inserted + summary.datas.updated;
-    logger.info(`--- ${logPrefix} completed ---`);
+    logger?.info(`--- ${logPrefix} completed ---`);
     return {
         success: errors.length === 0,
         summary,

package/src/modules/data/data.relations.js

@@ -534,7 +534,7 @@ function prepareDocument(doc, model, me) {
     }
 
     docToProcess._model = model.name;
-    docToProcess._user = me._user || me.username;
+    docToProcess._user = me.username || me._user;
     docToProcess._hash = getFieldValueHash(model, docToProcess);
 
     return docToProcess;
@@ -581,7 +581,8 @@ export const checkHash = async (me, model, hash, excludeId = null) => {
     const query = {
         _model: model.name,
         _hash: hash,
-        ...(excludeId && {_id: {$ne: new ObjectId(excludeId)}})
+        ...(excludeId && {_id: {$ne: new ObjectId(excludeId)}}),
+        _user: me.username
     };
 
     console.log("Query being executed:", JSON.stringify(query, null, 2));