nuxt-auto-crud 1.19.1 → 1.20.0

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "nuxt-auto-crud",
   "configKey": "autoCrud",
-  "version": "1.19.1",
+  "version": "1.20.0",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/server/api/[model]/[id].delete.js

@@ -5,7 +5,7 @@ import { db } from "hub:db";
 import { ensureResourceAccess, formatResourceResult } from "../../utils/handler.js";
 export default eventHandler(async (event) => {
   const { model, id } = getRouterParams(event);
-  const isAdmin = await ensureResourceAccess(event, model, "delete");
+  const isAdmin = await ensureResourceAccess(event, model, "delete", { id });
   const table = getTableForModel(model);
   const singularName = getModelSingularName(model);
   const deletedRecord = await db.delete(table).where(eq(table.id, Number(id))).returning().get();

package/dist/runtime/server/api/[model]/[id].patch.js

@@ -1,4 +1,5 @@
 import { eventHandler, getRouterParams, readBody, createError } from "h3";
+import { getUserSession } from "#imports";
 import { eq } from "drizzle-orm";
 import { getTableForModel, filterUpdatableFields } from "../../utils/modelMapper.js";
 import { db } from "hub:db";
@@ -13,6 +14,15 @@ export default eventHandler(async (event) => {
   if ("updatedAt" in table) {
     payload.updatedAt = /* @__PURE__ */ new Date();
   }
+  try {
+    const session = await getUserSession(event);
+    if (session?.user?.id) {
+      if ("updatedBy" in table) {
+        payload.updatedBy = session.user.id;
+      }
+    }
+  } catch {
+  }
   const updatedRecord = await db.update(table).set(payload).where(eq(table.id, Number(id))).returning().get();
   if (!updatedRecord) {
     throw createError({

package/dist/runtime/server/api/[model]/index.post.js

@@ -1,4 +1,5 @@
 import { eventHandler, getRouterParams, readBody } from "h3";
+import { getUserSession } from "#imports";
 import { getTableForModel, filterUpdatableFields } from "../../utils/modelMapper.js";
 import { db } from "hub:db";
 import { ensureResourceAccess, formatResourceResult, hashPayloadFields } from "../../utils/handler.js";
@@ -9,6 +10,18 @@ export default eventHandler(async (event) => {
   const body = await readBody(event);
   const payload = filterUpdatableFields(model, body);
   await hashPayloadFields(payload);
+  try {
+    const session = await getUserSession(event);
+    if (session?.user?.id) {
+      if ("createdBy" in table) {
+        payload.createdBy = session.user.id;
+      }
+      if ("updatedBy" in table) {
+        payload.updatedBy = session.user.id;
+      }
+    }
+  } catch {
+  }
   const newRecord = await db.insert(table).values(payload).returning().get();
   return formatResourceResult(model, newRecord, isAdmin);
 });

package/dist/runtime/server/utils/auth.js

@@ -37,10 +37,18 @@ export async function checkAdminAccess(event, model, action, context) {
               if (model === "users" && String(context.id) === String(user.id)) {
                 return true;
               }
-              if ("userId" in table) {
-                const record = await db.select({ userId: table.userId }).from(table).where(eq(table.id, context.id)).get();
-                if (record && String(record.userId) === String(user.id)) {
-                  return true;
+              const hasCreatedBy = "createdBy" in table;
+              const hasUserId = "userId" in table;
+              if (hasCreatedBy || hasUserId) {
+                const query = db.select().from(table).where(eq(table.id, Number(context.id)));
+                const record = await query.get();
+                if (record) {
+                  if (hasCreatedBy) {
+                    if (String(record.createdBy) === String(user.id)) return true;
+                  }
+                  if (hasUserId) {
+                    if (String(record.userId) === String(user.id)) return true;
+                  }
                 }
               }
             } catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auto-crud",
-  "version": "1.19.1",
+  "version": "1.20.0",
   "description": "Exposes RESTful CRUD APIs for your Nuxt app based solely on your database migrations.",
   "author": "Cliford Pereira",
   "license": "MIT",

package/src/runtime/server/api/[model]/[id].delete.ts

@@ -9,7 +9,7 @@ import { ensureResourceAccess, formatResourceResult } from '../../utils/handler'
 
 export default eventHandler(async (event) => {
   const { model, id } = getRouterParams(event) as { model: string, id: string }
-  const isAdmin = await ensureResourceAccess(event, model, 'delete')
+  const isAdmin = await ensureResourceAccess(event, model, 'delete', { id })
 
   const table = getTableForModel(model) as TableWithId
   const singularName = getModelSingularName(model)

package/src/runtime/server/api/[model]/[id].patch.ts

@@ -1,5 +1,7 @@
 // server/api/[model]/[id].patch.ts
 import { eventHandler, getRouterParams, readBody, createError } from 'h3'
+import type { H3Event } from 'h3'
+import { getUserSession } from '#imports'
 import { eq } from 'drizzle-orm'
 import { getTableForModel, filterUpdatableFields } from '../../utils/modelMapper'
 import type { TableWithId } from '../../types'
@@ -28,6 +30,20 @@ export default eventHandler(async (event) => {
     (payload as any).updatedAt = new Date()
   }
 
+  // Inject updatedBy if user is authenticated
+  try {
+    const session = await (getUserSession as (event: H3Event) => Promise<{ user: { id: string | number } | null }>)(event)
+    if (session?.user?.id) {
+      if ('updatedBy' in table) {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (payload as any).updatedBy = session.user.id
+      }
+    }
+  }
+  catch {
+    // No session available
+  }
+
   const updatedRecord = await db
     .update(table)
     .set(payload)

package/src/runtime/server/api/[model]/index.post.ts

@@ -1,5 +1,7 @@
 // server/api/[model]/index.post.ts
 import { eventHandler, getRouterParams, readBody } from 'h3'
+import type { H3Event } from 'h3'
+import { getUserSession } from '#imports'
 import { getTableForModel, filterUpdatableFields } from '../../utils/modelMapper'
 // @ts-expect-error - hub:db is a virtual alias
 import { db } from 'hub:db'
@@ -17,6 +19,27 @@ export default eventHandler(async (event) => {
   // Auto-hash fields based on config (default: ['password'])
   await hashPayloadFields(payload)
 
+  // Inject createdBy/updatedBy if user is authenticated
+  try {
+    const session = await (getUserSession as (event: H3Event) => Promise<{ user: { id: string | number } | null }>)(event)
+    if (session?.user?.id) {
+      // Check if table has columns before assigning (optional but safer if we had strict types)
+      // Since we are passing payload to .values(), extra keys might be ignored or cause error depending on driver
+      // Using 'in' table check is good practice
+      if ('createdBy' in table) {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (payload as any).createdBy = session.user.id
+      }
+      if ('updatedBy' in table) {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (payload as any).updatedBy = session.user.id
+      }
+    }
+  }
+  catch {
+    // No session available
+  }
+
   const newRecord = await db.insert(table).values(payload).returning().get()
 
   return formatResourceResult(model, newRecord as Record<string, unknown>, isAdmin)

package/src/runtime/server/utils/auth.ts

@@ -62,16 +62,27 @@ export async function checkAdminAccess(event: H3Event, model: string, action: st
                 return true
               }
 
-              // Standard case: Check 'userId' column for ownership
-              // We need to check if table has userId column.
-              // We cast to any to check property exist roughly or just try query
-              if ('userId' in table) {
-                // @ts-expect-error - dyanmic table access
-                const record = await db.select({ userId: table.userId }).from(table).where(eq(table.id, context.id)).get()
-
-                // If record exists and userId matches session user id
-                if (record && String(record.userId) === String(user.id)) {
-                  return true
+              // Standard case: Check 'createdBy' or 'userId' column for ownership
+
+              // const columns = table.columns || {}
+
+              const hasCreatedBy = 'createdBy' in table
+              const hasUserId = 'userId' in table
+
+              if (hasCreatedBy || hasUserId) {
+                // @ts-expect-error - table is dynamic
+                const query = db.select().from(table).where(eq(table.id, Number(context.id)))
+                const record = await query.get()
+
+                if (record) {
+                  // Check createdBy
+                  if (hasCreatedBy) {
+                    if (String(record.createdBy) === String(user.id)) return true
+                  }
+                  // Check userId (legacy)
+                  if (hasUserId) {
+                    if (String(record.userId) === String(user.id)) return true
+                  }
                 }
               }
             }