domma-cms 0.3.0 → 0.5.0

package/server/routes/api/collections.js

@@ -24,12 +24,27 @@
  * DELETE /collections/:slug/public/:id   - Delete entry (if api.delete enabled)
  */
 import {
-    listCollections, getCollection, createCollection, updateCollection, deleteCollection,
-    listEntries, getEntry, createEntry, updateEntry, deleteEntry, clearEntries,
-    exportEntries, importEntries
+    clearEntries,
+    createCollection,
+    createEntry,
+    deleteCollection,
+    deleteEntry,
+    exportEntries,
+    getCollection,
+    getEntry,
+    importEntries,
+    listCollections,
+    listEntries,
+    updateCollection,
+    updateEntry
 } from '../../services/collections.js';
-import { authenticate, requirePermission } from '../../middleware/auth.js';
-import { getRoleLevel, invalidate as invalidateUserTypes } from '../../services/userTypes.js';
+import {authenticate, requireAdmin, requirePermission} from '../../middleware/auth.js';
+import {getRoleLevel, invalidate as invalidateRoles} from '../../services/roles.js';
+import {getConfig, saveConfig} from '../../config.js';
+import {PRESET_COLLECTION_SLUGS} from '../../services/presetCollections.js';
+import {ensureFormForCollection} from '../../services/forms.js';
+
+const ALL_PRESET_SLUGS = new Set(['roles', 'user-profiles', ...PRESET_COLLECTION_SLUGS]);
 
 /**
  * Resolve the role level number for a named role.
@@ -76,34 +91,71 @@ async function checkPublicAccess(schema, operation, request, reply) {
 }
 
 export async function collectionsRoutes(fastify) {
-    const guard = { preHandler: [authenticate, requirePermission('collections')] };
+    const canRead = {preHandler: [authenticate, requirePermission('collections', 'read')]};
+    const canCreate = {preHandler: [authenticate, requirePermission('collections', 'create')]};
+    const canUpdate = {preHandler: [authenticate, requirePermission('collections', 'update')]};
+    const canDelete = {preHandler: [authenticate, requirePermission('collections', 'delete')]};
 
     // -------------------------------------------------------------------------
     // Collection CRUD (schema management)
     // -------------------------------------------------------------------------
 
-    fastify.get('/collections', guard, async () => {
+    fastify.get('/collections', canRead, async () => {
         return listCollections();
     });
 
-    fastify.post('/collections', guard, async (request, reply) => {
-        const { title, slug, description, fields, api } = request.body || {};
+    fastify.get('/collections/pro-status', canRead, async () => {
+    try {
+      const connections = getConfig('connections');
+      const names = Object.keys(connections).filter(k => k !== '_comment');
+      return {pro: names.length > 0, connections: names};
+    } catch {
+      return {pro: false, connections: []};
+    }
+  });
+
+  fastify.get('/collections/connections', {preHandler: [authenticate, requireAdmin]}, async () => {
+    try {
+      const {_comment, ...rest} = getConfig('connections');
+      return rest;
+    } catch {
+      return {};
+    }
+  });
+
+  fastify.put('/collections/connections', {preHandler: [authenticate, requireAdmin]}, async (request, reply) => {
+    const data = request.body;
+    if (!data || typeof data !== 'object' || Array.isArray(data)) {
+      return reply.status(400).send({error: 'Invalid connections data'});
+    }
+    for (const [name, conn] of Object.entries(data)) {
+      if (!conn.type || !conn.uri || !conn.database) {
+        return reply.status(400).send({error: `Connection "${name}" requires type, uri, and database`});
+      }
+    }
+    saveConfig('connections', data);
+    return {success: true};
+  });
+
+    fastify.post('/collections', canCreate, async (request, reply) => {
+      const {title, slug, description, fields, api, storage} = request.body || {};
         if (!title) return reply.status(400).send({ error: 'title is required' });
         try {
-            const schema = await createCollection({ title, slug, description, fields, api });
+          const schema = await createCollection({title, slug, description, fields, api, storage});
+            await ensureFormForCollection(schema);
             return reply.status(201).send(schema);
         } catch (err) {
             return reply.status(409).send({ error: err.message });
         }
     });
 
-    fastify.get('/collections/:slug', guard, async (request, reply) => {
+    fastify.get('/collections/:slug', canRead, async (request, reply) => {
         const schema = await getCollection(request.params.slug);
         if (!schema) return reply.status(404).send({ error: 'Collection not found' });
         return schema;
     });
 
-    fastify.put('/collections/:slug', guard, async (request, reply) => {
+    fastify.put('/collections/:slug', canUpdate, async (request, reply) => {
         try {
             return await updateCollection(request.params.slug, request.body || {});
         } catch (err) {
@@ -111,8 +163,8 @@ export async function collectionsRoutes(fastify) {
         }
     });
 
-    fastify.delete('/collections/:slug', guard, async (request, reply) => {
-        if (request.params.slug === 'user-types') {
+    fastify.delete('/collections/:slug', canDelete, async (request, reply) => {
+        if (ALL_PRESET_SLUGS.has(request.params.slug)) {
             return reply.status(403).send({ error: 'Cannot delete a preset collection' });
         }
         try {
@@ -127,7 +179,7 @@ export async function collectionsRoutes(fastify) {
     // Entry CRUD
     // -------------------------------------------------------------------------
 
-    fastify.get('/collections/:slug/entries', guard, async (request, reply) => {
+    fastify.get('/collections/:slug/entries', canRead, async (request, reply) => {
         const schema = await getCollection(request.params.slug);
         if (!schema) return reply.status(404).send({ error: 'Collection not found' });
         const { page, limit, sort, order, search } = request.query;
@@ -140,30 +192,30 @@ export async function collectionsRoutes(fastify) {
         });
     });
 
-    fastify.get('/collections/:slug/entries/:id', guard, async (request, reply) => {
+    fastify.get('/collections/:slug/entries/:id', canRead, async (request, reply) => {
         const entry = await getEntry(request.params.slug, request.params.id);
         if (!entry) return reply.status(404).send({ error: 'Entry not found' });
         return entry;
     });
 
-    fastify.post('/collections/:slug/entries', guard, async (request, reply) => {
+    fastify.post('/collections/:slug/entries', canCreate, async (request, reply) => {
         const user = request.user;
         try {
             const entry = await createEntry(request.params.slug, request.body?.data || {}, {
                 createdBy: user?.id || null,
                 source:    'admin'
             });
-            if (request.params.slug === 'user-types') await invalidateUserTypes();
+            if (request.params.slug === 'roles') await invalidateRoles();
             return reply.status(201).send(entry);
         } catch (err) {
             return reply.status(400).send({ error: err.message });
         }
     });
 
-    fastify.put('/collections/:slug/entries/:id', guard, async (request, reply) => {
+    fastify.put('/collections/:slug/entries/:id', canUpdate, async (request, reply) => {
         try {
             const entry = await updateEntry(request.params.slug, request.params.id, request.body?.data || {});
-            if (request.params.slug === 'user-types') await invalidateUserTypes();
+            if (request.params.slug === 'roles') await invalidateRoles();
             return entry;
         } catch (err) {
             const status = err.message === 'Entry not found' ? 404 : 400;
@@ -171,16 +223,16 @@ export async function collectionsRoutes(fastify) {
         }
     });
 
-    fastify.delete('/collections/:slug/entries/:id', guard, async (request, reply) => {
-        if (request.params.slug === 'user-types') {
-            const entry = await getEntry('user-types', request.params.id);
+    fastify.delete('/collections/:slug/entries/:id', canDelete, async (request, reply) => {
+        if (request.params.slug === 'roles') {
+            const entry = await getEntry('roles', request.params.id);
             if (entry?.data?.level === 0) {
                 return reply.status(403).send({ error: 'Cannot delete the root admin role' });
             }
         }
         try {
             await deleteEntry(request.params.slug, request.params.id);
-            if (request.params.slug === 'user-types') await invalidateUserTypes();
+            if (request.params.slug === 'roles') await invalidateRoles();
             return { success: true };
         } catch (err) {
             return reply.status(404).send({ error: err.message });
@@ -188,7 +240,7 @@ export async function collectionsRoutes(fastify) {
     });
 
     // Clear all entries — DELETE /collections/:slug/entries (no :id)
-    fastify.delete('/collections/:slug/entries', guard, async (request, reply) => {
+    fastify.delete('/collections/:slug/entries', canDelete, async (request, reply) => {
         try {
             await clearEntries(request.params.slug);
             return { success: true };
@@ -201,7 +253,7 @@ export async function collectionsRoutes(fastify) {
     // Export / Import
     // -------------------------------------------------------------------------
 
-    fastify.get('/collections/:slug/export', guard, async (request, reply) => {
+    fastify.get('/collections/:slug/export', canRead, async (request, reply) => {
         const format = request.query.format === 'csv' ? 'csv' : 'json';
         try {
             const output = await exportEntries(request.params.slug, format);
@@ -218,7 +270,7 @@ export async function collectionsRoutes(fastify) {
         }
     });
 
-    fastify.post('/collections/:slug/import', guard, async (request, reply) => {
+    fastify.post('/collections/:slug/import', canCreate, async (request, reply) => {
         const user    = request.user;
         const entries = request.body?.entries;
         if (!Array.isArray(entries)) return reply.status(400).send({ error: 'entries must be an array' });