millas 0.2.4 → 0.2.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "millas",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "A modern batteries-included backend framework for Node.js — built on Express, inspired by Laravel, Django, and FastAPI",
   "main": "src/index.js",
   "exports": {

package/src/admin/Admin.js

@@ -3,7 +3,8 @@
 const path        = require('path');
 const nunjucks    = require('nunjucks');
 const ActivityLog = require('./ActivityLog');
-const { AdminResource, AdminField, AdminFilter } = require('./resources/AdminResource');
+const AdminAuth   = require('./AdminAuth');
+const { AdminResource, AdminField, AdminFilter, AdminInline } = require('./resources/AdminResource');
 
 /**
  * Admin
@@ -36,6 +37,12 @@ class Admin {
 
   configure(config = {}) {
     Object.assign(this._config, config);
+
+    // Initialise auth if configured
+    if (config.auth !== undefined) {
+      AdminAuth.configure(config.auth);
+    }
+
     return this;
   }
 
@@ -72,6 +79,14 @@ class Admin {
     const prefix = this._config.prefix;
     this._njk    = this._setupNunjucks(expressApp);
 
+    // ── Auth middleware (runs before all admin routes) ──────────
+    expressApp.use(prefix, AdminAuth.middleware(prefix));
+
+    // ── Login / logout ──────────────────────────────────────────
+    expressApp.get (`${prefix}/login`,  (q, s) => this._loginPage(q, s));
+    expressApp.post(`${prefix}/login`,  (q, s) => this._loginSubmit(q, s));
+    expressApp.get (`${prefix}/logout`, (q, s) => this._logout(q, s));
+
     // Dashboard
     expressApp.get(`${prefix}`,     (q, s) => this._dashboard(q, s));
     expressApp.get(`${prefix}/`,    (q, s) => this._dashboard(q, s));
@@ -89,6 +104,8 @@ class Admin {
     expressApp.post  (`${prefix}/:resource/:id`,               (q, s) => this._update(q, s));
     expressApp.post  (`${prefix}/:resource/:id/delete`,        (q, s) => this._destroy(q, s));
     expressApp.post  (`${prefix}/:resource/bulk-delete`,       (q, s) => this._bulkDestroy(q, s));
+    expressApp.post  (`${prefix}/:resource/bulk-action`,       (q, s) => this._bulkAction(q, s));
+    expressApp.post  (`${prefix}/:resource/:id/action/:action`,(q, s) => this._rowAction(q, s));
 
     return this;
   }
@@ -216,6 +233,8 @@ class Admin {
     return {
       adminPrefix:    this._config.prefix,
       adminTitle:     this._config.title,
+      adminUser:      req.adminUser || null,
+      authEnabled:    AdminAuth.enabled,
       resources:      this.resources().map((r, idx) => ({
         slug:     r.slug,
         label:    r._getLabel(),
@@ -224,13 +243,72 @@ class Admin {
         canView:  r.canView,
         index:    idx + 1,
       })),
-      flash:          this._pullFlash(req),
+      flash:          extra._flash || {},
       activePage:     extra.activePage || null,
       activeResource: extra.activeResource || null,
       ...extra,
     };
   }
 
+  _ctxWithFlash(req, res, extra = {}) {
+    return this._ctx(req, { ...extra, _flash: AdminAuth.getFlash(req, res) });
+  }
+
+  // ─── Auth pages ───────────────────────────────────────────────────────────
+
+  async _loginPage(req, res) {
+    // Already logged in → redirect to dashboard
+    if (AdminAuth.enabled) {
+      const cookies = req.headers.cookie || '';
+      if (cookies.includes(this._config.auth?.cookieName || 'millas_admin')) {
+        // Let AdminAuth verify properly
+      }
+    }
+
+    const flash = AdminAuth.getFlash(req, res);
+    res.render('pages/login.njk', {
+      adminTitle:  this._config.title,
+      adminPrefix: this._config.prefix,
+      flash,
+      next: req.query.next || '',
+      error: null,
+    });
+  }
+
+  async _loginSubmit(req, res) {
+    const { email, password, remember, next } = req.body;
+    const prefix = this._config.prefix;
+
+    if (!AdminAuth.enabled) {
+      return res.redirect(next || prefix + '/');
+    }
+
+    try {
+      await AdminAuth.login(req, res, {
+        email,
+        password,
+        remember: remember === 'on' || remember === '1' || remember === 'true',
+      });
+
+      res.redirect(next || prefix + '/');
+    } catch (err) {
+      res.render('pages/login.njk', {
+        adminTitle:  this._config.title,
+        adminPrefix: prefix,
+        flash:       {},
+        next:        next || '',
+        error:       err.message,
+        email,        // re-fill email field
+      });
+    }
+  }
+
+  _logout(req, res) {
+    AdminAuth.logout(res);
+    AdminAuth.setFlash(res, 'success', 'You have been logged out.');
+    res.redirect(`${this._config.prefix}/login`);
+  }
+
   // ─── Pages ────────────────────────────────────────────────────────────────
 
   async _dashboard(req, res) {
@@ -269,7 +347,7 @@ class Admin {
       const activityData   = ActivityLog.recent(25);
       const activityTotals = ActivityLog.totals();
 
-      res.render('pages/dashboard.njk', this._ctx(req, {
+      res.render('pages/dashboard.njk', this._ctxWithFlash(req, res, {
         pageTitle:       'Dashboard',
         activePage:      'dashboard',
         resources:       resourceData,
@@ -286,10 +364,13 @@ class Admin {
       const R = this._resolve(req.params.resource, res);
       if (!R) return;
 
-      const page   = Number(req.query.page)   || 1;
-      const search = req.query.search         || '';
-      const sort   = req.query.sort           || 'id';
-      const order  = req.query.order          || 'desc';
+      const page    = Number(req.query.page)   || 1;
+      const search  = req.query.search         || '';
+      const sort    = req.query.sort           || 'id';
+      const order   = req.query.order          || 'desc';
+      const perPage = Number(req.query.perPage) || R.perPage;
+      const year    = req.query.year  || null;
+      const month   = req.query.month || null;
 
       // Collect active filters
       const activeFilters = {};
@@ -299,25 +380,30 @@ class Admin {
         }
       }
 
-      const result = await R.fetchList({ page, search, sort, order, filters: activeFilters });
+      const result = await R.fetchList({ page, search, sort, order, perPage, filters: activeFilters, year, month });
       const rows   = result.data.map(r => r.toJSON ? r.toJSON() : r);
 
       const listFields = R.fields()
         .filter(f => !f._hidden && !f._detailOnly)
         .map(f => f.toJSON());
 
-      res.render('pages/list.njk', this._ctx(req, {
+      res.render('pages/list.njk', this._ctxWithFlash(req, res, {
         pageTitle:     R._getLabel(),
         activeResource: req.params.resource,
         resource: {
-          slug:      R.slug,
-          label:     R._getLabel(),
-          singular:  R._getLabelSingular(),
-          icon:      R.icon,
-          canCreate: R.canCreate,
-          canEdit:   R.canEdit,
-          canDelete: R.canDelete,
-          canView:   R.canView,
+          slug:             R.slug,
+          label:            R._getLabel(),
+          singular:         R._getLabelSingular(),
+          icon:             R.icon,
+          canCreate:        R.canCreate,
+          canEdit:          R.canEdit,
+          canDelete:        R.canDelete,
+          canView:          R.canView,
+          actions:          (R.actions || []).map((a, i) => ({ ...a, index: i, handler: undefined })),
+          rowActions:       R.rowActions || [],
+          listDisplayLinks: R.listDisplayLinks || [],
+          dateHierarchy:    R.dateHierarchy || null,
+          prepopulatedFields: R.prepopulatedFields || {},
         },
         rows,
         listFields,
@@ -331,6 +417,8 @@ class Admin {
         search,
         sort,
         order,
+        year,
+        month,
       }));
     } catch (err) {
       this._error(res, err);
@@ -343,7 +431,7 @@ class Admin {
       if (!R) return;
       if (!R.canCreate) return res.status(403).send('Not allowed');
 
-      res.render('pages/form.njk', this._ctx(req, {
+      res.render('pages/form.njk', this._ctxWithFlash(req, res, {
         pageTitle:     `New ${R._getLabelSingular()}`,
         activeResource: req.params.resource,
         resource: { slug: R.slug, label: R._getLabel(), singular: R._getLabelSingular(), icon: R.icon, canDelete: false },
@@ -364,14 +452,25 @@ class Admin {
       if (!R) return;
       if (!R.canCreate) return res.status(403).send('Not allowed');
 
-      await R.create(req.body);
-      ActivityLog.record('create', R.slug, null, `New ${R._getLabelSingular()}`);
+      const record = await R.create(req.body);
+      ActivityLog.record('create', R.slug, record?.id, `New ${R._getLabelSingular()}`);
+
+      const submit = req.body._submit || 'save';
+      if (submit === 'continue' && record?.id) {
+        AdminAuth.setFlash(res, 'success', `${R._getLabelSingular()} created. You may continue editing.`);
+        return res.redirect(`${this._config.prefix}/${R.slug}/${record.id}/edit`);
+      }
+      if (submit === 'add_another') {
+        AdminAuth.setFlash(res, 'success', `${R._getLabelSingular()} created. Add another below.`);
+        return res.redirect(`${this._config.prefix}/${R.slug}/create`);
+      }
+
       this._flash(req, 'success', `${R._getLabelSingular()} created successfully`);
       this._redirectWithFlash(res, `${this._config.prefix}/${R.slug}`, req._flashType, req._flashMessage);
     } catch (err) {
       if (err.status === 422) {
         const R = this._resources.get(req.params.resource);
-        return res.render('pages/form.njk', this._ctx(req, {
+        return res.render('pages/form.njk', this._ctxWithFlash(req, res, {
           pageTitle:  `New ${R._getLabelSingular()}`,
           activeResource: req.params.resource,
           resource: { slug: R.slug, label: R._getLabel(), singular: R._getLabelSingular(), icon: R.icon, canDelete: false },
@@ -395,7 +494,7 @@ class Admin {
       const record = await R.fetchOne(req.params.id);
       const data   = record.toJSON ? record.toJSON() : record;
 
-      res.render('pages/form.njk', this._ctx(req, {
+      res.render('pages/form.njk', this._ctxWithFlash(req, res, {
         pageTitle:     `Edit ${R._getLabelSingular()} #${req.params.id}`,
         activeResource: req.params.resource,
         resource: { slug: R.slug, label: R._getLabel(), singular: R._getLabelSingular(), icon: R.icon, canDelete: R.canDelete },
@@ -421,13 +520,20 @@ class Admin {
       if (method === 'PUT' || method === 'POST') {
         await R.update(req.params.id, req.body);
         ActivityLog.record('update', R.slug, req.params.id, `${R._getLabelSingular()} #${req.params.id}`);
+
+        const submit = req.body._submit || 'save';
+        if (submit === 'continue') {
+          AdminAuth.setFlash(res, 'success', 'Changes saved. You may continue editing.');
+          return res.redirect(`${this._config.prefix}/${R.slug}/${req.params.id}/edit`);
+        }
+
         this._flash(req, 'success', `${R._getLabelSingular()} updated successfully`);
         this._redirectWithFlash(res, `${this._config.prefix}/${R.slug}`, req._flashType, req._flashMessage);
       }
     } catch (err) {
       if (err.status === 422) {
         const R = this._resources.get(req.params.resource);
-        return res.render('pages/form.njk', this._ctx(req, {
+        return res.render('pages/form.njk', this._ctxWithFlash(req, res, {
           pageTitle:  `Edit ${R._getLabelSingular()} #${req.params.id}`,
           activeResource: req.params.resource,
           resource: { slug: R.slug, label: R._getLabel(), singular: R._getLabelSingular(), icon: R.icon, canDelete: R.canDelete },
@@ -471,29 +577,38 @@ class Admin {
       const record = await R.fetchOne(req.params.id);
       const data   = record.toJSON ? record.toJSON() : record;
 
-      // Build detail field groups (all non-hidden fields, grouped by tab)
       const detailFields = R.fields()
-        .filter(f => f._type !== '__tab__' && !f._hidden && !f._listOnly)
+        .filter(f => f._type !== '__tab__' && f._type !== 'fieldset' && !f._hidden && !f._listOnly)
         .map(f => f.toJSON());
 
       const tabs = this._buildTabs(R.fields());
 
-      res.render('pages/detail.njk', this._ctx(req, {
+      // Load inline related records
+      const inlineData = await Promise.all(
+        (R.inlines || []).map(async (inline) => {
+          const rows = await inline.fetchRows(data[R.model.primaryKey || 'id']);
+          return { ...inline.toJSON(), rows };
+        })
+      );
+
+      res.render('pages/detail.njk', this._ctxWithFlash(req, res, {
         pageTitle:      `${R._getLabelSingular()} #${req.params.id}`,
         activeResource: req.params.resource,
         resource: {
-          slug:      R.slug,
-          label:     R._getLabel(),
-          singular:  R._getLabelSingular(),
-          icon:      R.icon,
-          canEdit:   R.canEdit,
-          canDelete: R.canDelete,
-          canCreate: R.canCreate,
+          slug:       R.slug,
+          label:      R._getLabel(),
+          singular:   R._getLabelSingular(),
+          icon:       R.icon,
+          canEdit:    R.canEdit,
+          canDelete:  R.canDelete,
+          canCreate:  R.canCreate,
+          rowActions: R.rowActions || [],
         },
-        record:       data,
+        record:      data,
         detailFields,
         tabs,
-        hasTabs:      tabs.length > 1,
+        hasTabs:     tabs.length > 1,
+        inlines:     inlineData,
       }));
     } catch (err) {
       this._error(res, err);
@@ -523,14 +638,72 @@ class Admin {
     }
   }
 
-  // ─── Global search ────────────────────────────────────────────────────────
+  // ─── Bulk custom action ───────────────────────────────────────────────────
+
+  async _bulkAction(req, res) {
+    try {
+      const R = this._resolve(req.params.resource, res);
+      if (!R) return;
+
+      const actionIndex = Number(req.body.actionIndex);
+      const ids = Array.isArray(req.body.ids) ? req.body.ids : [req.body.ids].filter(Boolean);
+      const action = (R.actions || [])[actionIndex];
+
+      if (!action) {
+        this._flash(req, 'error', 'Unknown action.');
+        return this._redirectWithFlash(res, `${this._config.prefix}/${R.slug}`, req._flashType, req._flashMessage);
+      }
+
+      if (!ids.length) {
+        this._flash(req, 'error', 'No records selected.');
+        return this._redirectWithFlash(res, `${this._config.prefix}/${R.slug}`, req._flashType, req._flashMessage);
+      }
+
+      await action.handler(ids, R.model);
+      ActivityLog.record('update', R.slug, null, `Bulk action "${action.label}" on ${ids.length} records`);
+      this._flash(req, 'success', `Action "${action.label}" applied to ${ids.length} record${ids.length > 1 ? 's' : ''}.`);
+      this._redirectWithFlash(res, `${this._config.prefix}/${R.slug}`, req._flashType, req._flashMessage);
+    } catch (err) {
+      this._error(res, err);
+    }
+  }
+
+  // ─── Per-row custom action ────────────────────────────────────────────────
+
+  async _rowAction(req, res) {
+    try {
+      const R = this._resolve(req.params.resource, res);
+      if (!R) return;
+
+      const actionName = req.params.action;
+      const rowAction  = (R.rowActions || []).find(a => a.action === actionName);
+
+      if (!rowAction || !rowAction.handler) {
+        return res.status(404).send(`Row action "${actionName}" not found.`);
+      }
+
+      const record = await R.fetchOne(req.params.id);
+      const result = await rowAction.handler(record, R.model);
+
+      // If handler returns a redirect URL, use it; otherwise go back to list
+      const redirect = (typeof result === 'string' && result.startsWith('/'))
+        ? result
+        : `${this._config.prefix}/${R.slug}`;
+
+      ActivityLog.record('update', R.slug, req.params.id, `Action "${rowAction.label}" on #${req.params.id}`);
+      this._flash(req, 'success', rowAction.successMessage || `Action "${rowAction.label}" completed.`);
+      this._redirectWithFlash(res, redirect, req._flashType, req._flashMessage);
+    } catch (err) {
+      this._error(res, err);
+    }
+  }
 
   async _search(req, res) {
     try {
       const q = (req.query.q || '').trim();
 
       if (!q) {
-        return res.render('pages/search.njk', this._ctx(req, {
+        return res.render('pages/search.njk', this._ctxWithFlash(req, res, {
           pageTitle: 'Search',
           activePage: 'search',
           query: '',
@@ -564,7 +737,7 @@ class Admin {
       const filtered = results.filter(Boolean);
       const total    = filtered.reduce((s, r) => s + r.total, 0);
 
-      res.render('pages/search.njk', this._ctx(req, {
+      res.render('pages/search.njk', this._ctxWithFlash(req, res, {
         pageTitle:  `Search: ${q}`,
         activePage: 'search',
         query:      q,
@@ -641,25 +814,32 @@ class Admin {
    * them as text instead of inputs.
    */
   _formFields(R) {
-    const readonlySet = new Set(R.readonlyFields || []);
-    let currentTab = null;
-    const result = [];
+    const readonlySet  = new Set(R.readonlyFields || []);
+    const prepopFields = R.prepopulatedFields || {};
+    let   currentTab   = null;
+    let   currentFieldset = null;
+    const result       = [];
 
     for (const f of R.fields()) {
-      // Tab separator — update current tab context, don't add to form fields
       if (f._type === 'tab') {
-        currentTab = f._label;
+        currentTab      = f._label;
+        currentFieldset = null;
+        continue;
+      }
+      if (f._type === 'fieldset') {
+        // Include fieldset headers as sentinel objects
+        result.push({ _isFieldset: true, label: f._label, tab: currentTab });
+        currentFieldset = f._label;
         continue;
       }
-
-      // Skip id, list-only, and fully hidden fields
       if (f._type === 'id' || f._listOnly || f._hidden) continue;
 
-      const json = f.toJSON();
-      json.tab = currentTab;
-      json.required = !f._nullable;
+      const json        = f.toJSON();
+      json.tab          = currentTab;
+      json.fieldset     = currentFieldset;
+      json.required     = !f._nullable;
+      json.prepopulate  = prepopFields[f._name] || f._prepopulate || null;
 
-      // Mark as readonly if in readonlyFields array or flagged on field itself
       if (readonlySet.has(f._name) || f._readonly) {
         json.isReadonly = true;
       }
@@ -685,11 +865,14 @@ class Admin {
         tabs.push(current);
         continue;
       }
-      if (f._hidden || f._listOnly) continue;
-      if (!current) {
-        current = { label: null, fields: [] };
-        tabs.push(current);
+      if (f._type === 'fieldset') {
+        // Fieldsets are embedded as sentinel entries within a tab's fields
+        if (!current) { current = { label: null, fields: [] }; tabs.push(current); }
+        current.fields.push({ _isFieldset: true, label: f._label });
+        continue;
       }
+      if (f._hidden || f._listOnly) continue;
+      if (!current) { current = { label: null, fields: [] }; tabs.push(current); }
       current.fields.push(f.toJSON());
     }
 
@@ -726,26 +909,21 @@ class Admin {
     `);
   }
 
-  // ─── Flash messages (stored in query string for stateless operation) ───────
+  // ─── Flash (cookie-based) ─────────────────────────────────────────────────
+
   _flash(req, type, message) {
-    // Store in a simple query param on redirect
     req._flashType    = type;
     req._flashMessage = message;
   }
 
   _pullFlash(req) {
-    const type = req.query._flash_type;
-    const msg  = req.query._flash_msg;
-    if (type && msg) return { [type]: decodeURIComponent(msg) };
-    // Check set by _flash helper (pre-redirect)
     if (req._flashType) return { [req._flashType]: req._flashMessage };
     return {};
   }
 
-  // Override redirect to include flash in URL
   _redirectWithFlash(res, url, type, message) {
-    const sep = url.includes('?') ? '&' : '?';
-    res.redirect(`${url}${sep}_flash_type=${type}&_flash_msg=${encodeURIComponent(message)}`);
+    if (type && message) AdminAuth.setFlash(res, type, message);
+    res.redirect(url);
   }
 
   _autoResource(ModelClass) {
@@ -764,3 +942,4 @@ module.exports.Admin         = Admin;
 module.exports.AdminResource = AdminResource;
 module.exports.AdminField    = AdminField;
 module.exports.AdminFilter   = AdminFilter;
+module.exports.AdminInline   = AdminInline;