db-model-router 1.0.5 → 1.0.7

package/demo/package-lock.json

@@ -279,9 +279,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
+      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -575,9 +575,9 @@
       }
     },
     "node_modules/db-model-router": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/db-model-router/-/db-model-router-1.0.4.tgz",
-      "integrity": "sha512-mK4GSdkybMeyxd/EM3O5bGWAGmLHk0CJSwLD10OhnOTnVN6jOOIM17gdqCFVN5dMg3W15pCP+rm8fbUl/AowuQ==",
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/db-model-router/-/db-model-router-1.0.6.tgz",
+      "integrity": "sha512-8GUCYQbWqhPpMOuweHJ3eLIzovJQDIiFRYJ2kM52KR/ryt7EM1Pn0tC+rk+kr92hdDnpVy5wXhEwKE8nxOuM1Q==",
       "license": "Apache-2.0",
       "dependencies": {
         "dotenv": "^10.0.0",
@@ -589,14 +589,14 @@
         "db-model-router": "src/cli/main.js"
       },
       "peerDependencies": {
-        "@aws-sdk/client-dynamodb": "^3.1029.0",
-        "@aws-sdk/lib-dynamodb": "^3.1029.0",
+        "@aws-sdk/client-dynamodb": "^3.1039.0",
+        "@aws-sdk/lib-dynamodb": "^3.1039.0",
         "better-sqlite3": "^12.9.0",
         "express": "^4.17.2 || ^5.0.0",
         "ioredis": "^5.10.1",
-        "mongodb": "^7.1.1",
-        "mssql": "^12.2.1",
-        "mysql2": "^3.14.4",
+        "mongodb": "^7.2.0",
+        "mssql": "^12.5.0",
+        "mysql2": "^3.22.3",
         "oracledb": "^6.10.0",
         "pg": "^8.20.0",
         "ultimate-express": "^2.0.0"
@@ -904,12 +904,12 @@
       }
     },
     "node_modules/express-rate-limit": {
-      "version": "8.4.1",
-      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.4.1.tgz",
-      "integrity": "sha512-NGVYwQSAyEQgzxX1iCM978PP9AdO/hW93gMcF6ZwQCm+rFvLsBH6w4xcXWTcliS8La5EPRN3p9wzItqBwJrfNw==",
+      "version": "8.5.1",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.5.1.tgz",
+      "integrity": "sha512-5O6KYmyJEpuPJV5hNTXKbAHWRqrzyu+OI3vUnSd2kXFubIVpG7ezpgxQy76Zo5GQZtrQBg86hF+CM/NX+cioiQ==",
       "license": "MIT",
       "dependencies": {
-        "ip-address": "10.1.0"
+        "ip-address": "^10.2.0"
       },
       "engines": {
         "node": ">= 16"
@@ -1324,9 +1324,9 @@
       }
     },
     "node_modules/ip-address": {
-      "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz",
-      "integrity": "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==",
+      "version": "10.2.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
+      "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"
@@ -1630,9 +1630,9 @@
       }
     },
     "node_modules/node-abi": {
-      "version": "3.89.0",
-      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.89.0.tgz",
-      "integrity": "sha512-6u9UwL0HlAl21+agMN3YAMXcKByMqwGx+pq+P76vii5f7hTPtKDp08/H9py6DY+cfDw7kQNTGEj/rly3IgbNQA==",
+      "version": "3.92.0",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.92.0.tgz",
+      "integrity": "sha512-KdHvFWZjEKDf0cakgFjebl371GPsISX2oZHcuyKqM7DtogIsHrqKeLTo8wBHxaXRAQlY2PsPlZmfo+9ZCxEREQ==",
       "license": "MIT",
       "dependencies": {
         "semver": "^7.3.5"
@@ -2220,9 +2220,9 @@
       "license": "MIT"
     },
     "node_modules/semver": {
-      "version": "7.7.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
-      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
+      "version": "7.8.0",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
+      "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"

package/demo/package.json

@@ -17,6 +17,14 @@
   "author": "",
   "license": "ISC",
   "type": "module",
+  "imports": {
+    "#root/*.js": "./*.js",
+    "#models": "./models/index.js",
+    "#models/*.js": "./models/*.js",
+    "#routes/*.js": "./routes/*.js",
+    "#commons/*.js": "./commons/*.js",
+    "#middleware/*.js": "./middleware/*.js"
+  },
   "dependencies": {
     "db-model-router": "latest",
     "dotenv": "latest",
@@ -25,6 +33,7 @@
     "better-sqlite3": "latest",
     "express-rate-limit": "latest",
     "helmet": "latest",
+    "kafkajs": "latest",
     "winston": "latest",
     "swagger-ui-express": "latest"
   },

package/demo/routes/{addresses.js → addresses/index.js}

@@ -1,5 +1,5 @@
 import dbModelRouter from "db-model-router";
-import addresses from "../models/addresses.js";
+import { addresses } from "#models";
 
 const { route } = dbModelRouter;
 

package/demo/routes/auth/index.js

@@ -0,0 +1,55 @@
+import express from "express";
+import authenticate from "#middleware/authenticate.js";
+import { verifyPassword } from "#commons/password.js";
+import { users, roles, role_permissions } from "#models";
+
+const router = express.Router();
+
+// POST /api/auth/login - Authenticate user and create session
+router.post("/login", async (req, res) => {
+  try {
+    const { email, password } = req.body;
+
+    if (!email || !password) {
+      return res.status(401).json({ message: "Invalid credentials" });
+    }
+
+    const userResults = await users.findAll({ email });
+    const user = Array.isArray(userResults) ? userResults[0] : (userResults?.data?.[0] ?? null);
+
+    if (!user) {
+      return res.status(401).json({ message: "Invalid credentials" });
+    }
+
+    const isValid = await verifyPassword(password, user.password_hash);
+    if (!isValid) {
+      return res.status(401).json({ message: "Invalid credentials" });
+    }
+
+    const role = await roles.findById(user.role_id);
+    const permsResult = await role_permissions.findAll({ role_id: user.role_id });
+    const permissionList = Array.isArray(permsResult) ? permsResult : (permsResult?.data ?? []);
+
+    req.session.user = user;
+    req.session.role = role;
+    req.session.permission = permissionList.map((p) =>
+      typeof p.permission === "string" ? JSON.parse(p.permission) : p.permission
+    );
+
+    res.json({ message: "Login successful", user: { id: user.user_id, email: user.email, name: user.name } });
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+
+// POST /api/auth/logout - Destroy session
+router.post("/logout", authenticate, (req, res) => {
+  req.session.destroy((err) => {
+    if (err) {
+      return res.status(500).json({ message: "Failed to destroy session" });
+    }
+    res.json({ message: "Logout successful" });
+  });
+});
+
+export default router;

package/demo/routes/carts/{cart_items.js → cart_items/index.js}

@@ -1,5 +1,5 @@
 import dbModelRouter from "db-model-router";
-import cart_items from "../../models/cart_items.js";
+import { cart_items } from "#models";
 
 const { route } = dbModelRouter;
 

package/demo/routes/{carts.js → carts/index.js}

@@ -1,5 +1,5 @@
 import dbModelRouter from "db-model-router";
-import carts from "../models/carts.js";
+import { carts } from "#models";
 
 const { route } = dbModelRouter;
 

package/demo/routes/{categories.js → categories/index.js}

@@ -1,5 +1,5 @@
 import dbModelRouter from "db-model-router";
-import categories from "../models/categories.js";
+import { categories } from "#models";
 
 const { route } = dbModelRouter;
 

package/demo/routes/{coupons.js → coupons/index.js}

@@ -1,5 +1,5 @@
 import dbModelRouter from "db-model-router";
-import coupons from "../models/coupons.js";
+import { coupons } from "#models";
 
 const { route } = dbModelRouter;
 

package/demo/routes/index.js

@@ -2,32 +2,38 @@ import express from "express";
 
 const router = express.Router();
 
-import addressesRoute from "./addresses.js";
-import cartsRoute from "./carts.js";
-import categoriesRoute from "./categories.js";
-import couponsRoute from "./coupons.js";
-import ordersRoute from "./orders.js";
-import productsRoute from "./products.js";
-import usersRoute from "./users.js";
-import wishlistsRoute from "./wishlists.js";
-import product_imagesChildRoute from "./products/product_images.js";
-import product_variantsChildRoute from "./products/product_variants.js";
-import product_reviewsChildRoute from "./products/product_reviews.js";
-import cart_itemsChildRoute from "./carts/cart_items.js";
-import order_itemsChildRoute from "./orders/order_items.js";
-import paymentsChildRoute from "./orders/payments.js";
-import shipmentsChildRoute from "./orders/shipments.js";
-import docsRoute from "./docs.js";
+// SaaS auth & CRUD routes
+import authRoute from "#routes/auth/index.js";
+import saasUsersRoute from "#routes/users/index.js";
+import saasTenantsRoute from "#routes/tenants/index.js";
+import saasRolesRoute from "#routes/roles/index.js";
+import saasPermissionsRoute from "#routes/roles/permissions/index.js";
+
+// Schema-generated routes
+import addressesRoute from "#routes/addresses/index.js";
+import cartsRoute from "#routes/carts/index.js";
+import categoriesRoute from "#routes/categories/index.js";
+import couponsRoute from "#routes/coupons/index.js";
+import ordersRoute from "#routes/orders/index.js";
+import productsRoute from "#routes/products/index.js";
+import wishlistsRoute from "#routes/wishlists/index.js";
+import product_imagesChildRoute from "#routes/products/product_images/index.js";
+import product_variantsChildRoute from "#routes/products/product_variants/index.js";
+import product_reviewsChildRoute from "#routes/products/product_reviews/index.js";
+import cart_itemsChildRoute from "#routes/carts/cart_items/index.js";
+import order_itemsChildRoute from "#routes/orders/order_items/index.js";
+import paymentsChildRoute from "#routes/orders/payments/index.js";
+import shipmentsChildRoute from "#routes/orders/shipments/index.js";
+import docsRoute from "#routes/docs.js";
+
+// SaaS routes
+router.use("/auth", authRoute);
+router.use("/users", saasUsersRoute);
+router.use("/tenants", saasTenantsRoute);
+router.use("/roles", saasRolesRoute);
+router.use("/roles/:role_id/permissions", saasPermissionsRoute);
 
 router.use("/docs", docsRoute);
-router.use("/addresses", addressesRoute);
-router.use("/carts", cartsRoute);
-router.use("/categories", categoriesRoute);
-router.use("/coupons", couponsRoute);
-router.use("/orders", ordersRoute);
-router.use("/products", productsRoute);
-router.use("/users", usersRoute);
-router.use("/wishlists", wishlistsRoute);
 router.use("/products/:product_id/product_images", product_imagesChildRoute);
 router.use("/products/:product_id/product_variants", product_variantsChildRoute);
 router.use("/products/:product_id/product_reviews", product_reviewsChildRoute);
@@ -36,4 +42,13 @@ router.use("/orders/:order_id/order_items", order_itemsChildRoute);
 router.use("/orders/:order_id/payments", paymentsChildRoute);
 router.use("/orders/:order_id/shipments", shipmentsChildRoute);
 
+// Schema-generated routes
+router.use("/addresses", addressesRoute);
+router.use("/carts", cartsRoute);
+router.use("/categories", categoriesRoute);
+router.use("/coupons", couponsRoute);
+router.use("/orders", ordersRoute);
+router.use("/products", productsRoute);
+router.use("/wishlists", wishlistsRoute);
+
 export default router;

package/demo/routes/{orders.js → orders/index.js}

@@ -1,5 +1,5 @@
 import dbModelRouter from "db-model-router";
-import orders from "../models/orders.js";
+import { orders } from "#models";
 
 const { route } = dbModelRouter;
 

package/demo/routes/orders/{order_items.js → order_items/index.js}

@@ -1,5 +1,5 @@
 import dbModelRouter from "db-model-router";
-import order_items from "../../models/order_items.js";
+import { order_items } from "#models";
 
 const { route } = dbModelRouter;
 

package/demo/routes/orders/{payments.js → payments/index.js}

@@ -1,5 +1,5 @@
 import dbModelRouter from "db-model-router";
-import payments from "../../models/payments.js";
+import { payments } from "#models";
 
 const { route } = dbModelRouter;
 

package/demo/routes/orders/{shipments.js → shipments/index.js}

@@ -1,5 +1,5 @@
 import dbModelRouter from "db-model-router";
-import shipments from "../../models/shipments.js";
+import { shipments } from "#models";
 
 const { route } = dbModelRouter;
 

package/demo/routes/{products.js → products/index.js}

@@ -1,5 +1,5 @@
 import dbModelRouter from "db-model-router";
-import products from "../models/products.js";
+import { products } from "#models";
 
 const { route } = dbModelRouter;
 

package/demo/routes/products/{product_images.js → product_images/index.js}

@@ -1,5 +1,5 @@
 import dbModelRouter from "db-model-router";
-import product_images from "../../models/product_images.js";
+import { product_images } from "#models";
 
 const { route } = dbModelRouter;
 

package/demo/routes/products/{product_reviews.js → product_reviews/index.js}

@@ -1,5 +1,5 @@
 import dbModelRouter from "db-model-router";
-import product_reviews from "../../models/product_reviews.js";
+import { product_reviews } from "#models";
 
 const { route } = dbModelRouter;
 

package/demo/routes/products/{product_variants.js → product_variants/index.js}

@@ -1,5 +1,5 @@
 import dbModelRouter from "db-model-router";
-import product_variants from "../../models/product_variants.js";
+import { product_variants } from "#models";
 
 const { route } = dbModelRouter;
 

package/demo/routes/roles/index.js

@@ -0,0 +1,75 @@
+import express from "express";
+import authenticate from "#middleware/authenticate.js";
+import tenantIsolation from "#middleware/tenantIsolation.js";
+import hasPermission from "#middleware/hasPermission.js";
+import { roles } from "#models";
+
+const router = express.Router();
+
+function userHasGlobalPermission(req) {
+  return req.session.permission.some((p) => p.scope === "global");
+}
+
+function guardSystemRole(req, res, role) {
+  if (role.tenant_id === null && !userHasGlobalPermission(req)) {
+    res.status(403).json({ message: "Cannot modify system roles" });
+    return true;
+  }
+  return false;
+}
+
+function guardGlobalPermissionEscalation(req, res) {
+  const permissions = req.body.permissions || [];
+  const hasGlobalEntry = permissions.some((p) => p.scope === "global");
+  if (hasGlobalEntry && !userHasGlobalPermission(req)) {
+    res.status(403).json({ message: "Cannot assign global permissions" });
+    return true;
+  }
+  return false;
+}
+
+router.get("/", authenticate, tenantIsolation, hasPermission("roles", "read"), async (req, res) => {
+  try {
+    const results = await roles.findAll(req.query);
+    res.json(results);
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+
+router.post("/", authenticate, tenantIsolation, hasPermission("roles", "write"), async (req, res) => {
+  try {
+    if (guardGlobalPermissionEscalation(req, res)) return;
+    const result = await roles.create(req.body);
+    res.status(201).json(result);
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+
+router.put("/:id", authenticate, tenantIsolation, hasPermission("roles", "update"), async (req, res) => {
+  try {
+    const role = await roles.findById(req.params.id);
+    if (!role) return res.status(404).json({ message: "Role not found" });
+    if (guardSystemRole(req, res, role)) return;
+    if (guardGlobalPermissionEscalation(req, res)) return;
+    const result = await roles.update(req.params.id, req.body);
+    res.json(result);
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+
+router.delete("/:id", authenticate, tenantIsolation, hasPermission("roles", "delete"), async (req, res) => {
+  try {
+    const role = await roles.findById(req.params.id);
+    if (!role) return res.status(404).json({ message: "Role not found" });
+    if (guardSystemRole(req, res, role)) return;
+    const result = await roles.delete(req.params.id);
+    res.json(result);
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+
+export default router;

package/demo/routes/roles/permissions/index.js

@@ -0,0 +1,47 @@
+import express from "express";
+import authenticate from "#middleware/authenticate.js";
+import tenantIsolation from "#middleware/tenantIsolation.js";
+import hasPermission from "#middleware/hasPermission.js";
+import { role_permissions } from "#models";
+
+const router = express.Router({ mergeParams: true });
+
+router.get("/", authenticate, tenantIsolation, hasPermission("permissions", "read"), async (req, res) => {
+  try {
+    const query = { ...req.query, role_id: req.params.role_id };
+    const results = await role_permissions.findAll(query);
+    res.json(results);
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+
+router.post("/", authenticate, tenantIsolation, hasPermission("permissions", "write"), async (req, res) => {
+  try {
+    const data = { ...req.body, role_id: req.params.role_id };
+    const result = await role_permissions.create(data);
+    res.status(201).json(result);
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+
+router.put("/:permission_id", authenticate, tenantIsolation, hasPermission("permissions", "update"), async (req, res) => {
+  try {
+    const result = await role_permissions.update(req.params.permission_id, req.body);
+    res.json(result);
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+
+router.delete("/:permission_id", authenticate, tenantIsolation, hasPermission("permissions", "delete"), async (req, res) => {
+  try {
+    const result = await role_permissions.delete(req.params.permission_id);
+    res.json(result);
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+
+export default router;

package/demo/routes/tenants/index.js

@@ -0,0 +1,45 @@
+import express from "express";
+import authenticate from "#middleware/authenticate.js";
+import tenantIsolation from "#middleware/tenantIsolation.js";
+import hasPermission from "#middleware/hasPermission.js";
+import { tenants } from "#models";
+
+const router = express.Router();
+
+router.get("/", authenticate, tenantIsolation, hasPermission("tenants", "read"), async (req, res) => {
+  try {
+    const results = await tenants.findAll(req.query);
+    res.json(results);
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+
+router.post("/", authenticate, tenantIsolation, hasPermission("tenants", "write"), async (req, res) => {
+  try {
+    const result = await tenants.create(req.body);
+    res.status(201).json(result);
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+
+router.put("/:id", authenticate, tenantIsolation, hasPermission("tenants", "update"), async (req, res) => {
+  try {
+    const result = await tenants.update(req.params.id, req.body);
+    res.json(result);
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+
+router.delete("/:id", authenticate, tenantIsolation, hasPermission("tenants", "delete"), async (req, res) => {
+  try {
+    const result = await tenants.delete(req.params.id);
+    res.json(result);
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+
+export default router;

package/demo/routes/users/index.js

@@ -0,0 +1,45 @@
+import express from "express";
+import authenticate from "#middleware/authenticate.js";
+import tenantIsolation from "#middleware/tenantIsolation.js";
+import hasPermission from "#middleware/hasPermission.js";
+import { users } from "#models";
+
+const router = express.Router();
+
+router.get("/", authenticate, tenantIsolation, hasPermission("users", "read"), async (req, res) => {
+  try {
+    const results = await users.findAll(req.query);
+    res.json(results);
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+
+router.post("/", authenticate, tenantIsolation, hasPermission("users", "write"), async (req, res) => {
+  try {
+    const result = await users.create(req.body);
+    res.status(201).json(result);
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+
+router.put("/:id", authenticate, tenantIsolation, hasPermission("users", "update"), async (req, res) => {
+  try {
+    const result = await users.update(req.params.id, req.body);
+    res.json(result);
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+
+router.delete("/:id", authenticate, tenantIsolation, hasPermission("users", "delete"), async (req, res) => {
+  try {
+    const result = await users.delete(req.params.id);
+    res.json(result);
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+
+export default router;

package/demo/routes/{wishlists.js → wishlists/index.js}

@@ -1,5 +1,5 @@
 import dbModelRouter from "db-model-router";
-import wishlists from "../models/wishlists.js";
+import { wishlists } from "#models";
 
 const { route } = dbModelRouter;