nuxt-auto-crud 1.25.0 → 1.26.0

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "nuxt-auto-crud",
   "configKey": "autoCrud",
-  "version": "1.25.0",
+  "version": "1.26.0",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/server/api/_meta.get.d.ts

@@ -1,10 +1,11 @@
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<string | {
     architecture: string;
     version: string;
     resources: ({
         resource: string;
         endpoint: string;
         labelField: string;
+        methods: string[];
         fields: {
             name: string;
             type: any;
@@ -13,6 +14,7 @@ declare const _default: import("h3").EventHandler<import("h3").EventHandlerReque
             options: any;
             references: any;
             isRelation: boolean;
+            isReadOnly: boolean;
         }[];
     } | null)[];
 }>>;

package/dist/runtime/server/api/_meta.get.js

@@ -1,4 +1,4 @@
-import { eventHandler } from "h3";
+import { eventHandler, getQuery, getHeader } from "h3";
 import { getTableForModel, getAvailableModels } from "../utils/modelMapper.js";
 import { getTableColumns as getDrizzleTableColumns } from "drizzle-orm";
 import { getTableConfig } from "drizzle-orm/sqlite-core";
@@ -7,17 +7,17 @@ import { db } from "hub:db";
 import { ensureAuthenticated } from "../utils/auth.js";
 export default eventHandler(async (event) => {
   await ensureAuthenticated(event);
+  const query = getQuery(event);
+  const acceptHeader = getHeader(event, "accept") || "";
   const models = getAvailableModels().length > 0 ? getAvailableModels() : Object.keys(db?.query || {});
   const resources = models.map((model) => {
     try {
       const table = getTableForModel(model);
       const columns = getDrizzleTableColumns(table);
       const config = getTableConfig(table);
-      const fields = Object.entries(columns).filter(([name]) => !PROTECTED_FIELDS.includes(name) && !HIDDEN_FIELDS.includes(name)).map(([name, col]) => {
+      const fields = Object.entries(columns).filter(([name]) => !HIDDEN_FIELDS.includes(name)).map(([name, col]) => {
         let references = null;
-        const fk = config?.foreignKeys.find(
-          (f) => f.reference().columns[0].name === col.name
-        );
+        const fk = config?.foreignKeys.find((f) => f.reference().columns[0].name === col.name);
         if (fk) {
           references = fk.reference().foreignTable[Symbol.for("drizzle:Name")];
         } else if (col.referenceConfig?.foreignTable) {
@@ -32,7 +32,9 @@ export default eventHandler(async (event) => {
           isEnum: !!col.enumValues,
           options: col.enumValues || null,
           references,
-          isRelation: !!references
+          isRelation: !!references,
+          // Agentic Hint: Is this field writable by the user/agent?
+          isReadOnly: PROTECTED_FIELDS.includes(name)
         };
       });
       const fieldNames = fields.map((f) => f.name);
@@ -41,15 +43,49 @@ export default eventHandler(async (event) => {
         resource: model,
         endpoint: `/api/${model}`,
         labelField,
+        methods: ["GET", "POST", "PATCH", "DELETE"],
         fields
       };
     } catch {
       return null;
     }
   }).filter(Boolean);
-  return {
+  const payload = {
     architecture: "Clifland-NAC",
     version: "1.0.0-agentic",
     resources
   };
+  const currentToken = getQuery(event).token || getHeader(event, "authorization")?.split(" ")[1];
+  const tokenSuffix = currentToken ? `?token=${currentToken}` : "";
+  if (query.format === "md" || acceptHeader.includes("text/markdown")) {
+    let markdown = `# ${payload.architecture} API Manifest (v${payload.version})
+
+`;
+    payload.resources.forEach((res) => {
+      if (!res) return;
+      markdown += `### Resource: ${res.resource}
+`;
+      markdown += `- **Endpoint**: \`${res.endpoint}${tokenSuffix}\`
+`;
+      markdown += `- **Methods**: ${res.methods.join(", ")}
+`;
+      markdown += `- **Primary Label**: \`${res.labelField}\`
+
+`;
+      markdown += `| Field | Type | Required | Writable | Details |
+`;
+      markdown += `| :--- | :--- | :--- | :--- | :--- |
+`;
+      res.fields.forEach((f) => {
+        const details = f.isEnum && f.options ? `Options: ${f.options.join(", ")}` : f.references ? `Refs: ${f.references}` : "-";
+        markdown += `| ${f.name} | ${f.type} | ${f.required ? "\u2705" : "\u274C"} | ${f.isReadOnly ? "\u274C" : "\u2705"} | ${details} |
+`;
+      });
+      markdown += `
+---
+`;
+    });
+    return markdown;
+  }
+  return payload;
 });

package/dist/runtime/server/utils/auth.js

@@ -7,6 +7,13 @@ export async function checkAdminAccess(event, model, action, context) {
   if (!auth?.authentication) {
     return true;
   }
+  const authHeader = getHeader(event, "authorization");
+  const query = getQuery(event);
+  const apiToken = useRuntimeConfig(event).apiSecretToken;
+  const token = (authHeader?.startsWith("Bearer ") ? authHeader.split(" ")[1] : null) || query.token;
+  if (token && apiToken && token === apiToken) {
+    return true;
+  }
   if (auth.type === "jwt") {
     if (!auth.jwtSecret) {
       console.warn("JWT Secret is not configured but auth type is jwt");
@@ -40,8 +47,8 @@ export async function checkAdminAccess(event, model, action, context) {
               const hasCreatedBy = "createdBy" in table;
               const hasUserId = "userId" in table;
               if (hasCreatedBy || hasUserId) {
-                const query = db.select().from(table).where(eq(table.id, Number(context.id)));
-                const record = await query.get();
+                const query2 = db.select().from(table).where(eq(table.id, Number(context.id)));
+                const record = await query2.get();
                 if (record) {
                   if (hasCreatedBy) {
                     if (String(record.createdBy) === String(user.id)) return true;
@@ -73,12 +80,18 @@ export async function checkAdminAccess(event, model, action, context) {
 }
 export async function ensureAuthenticated(event) {
   const { auth } = useAutoCrudConfig();
+  const runtimeConfig = useRuntimeConfig(event);
   if (!auth?.authentication) return;
-  if (auth.type === "jwt" && auth.jwtSecret) {
-    if (!await verifyJwtToken(event, auth.jwtSecret)) {
-      throw createError({ statusCode: 401, message: "Unauthorized" });
-    }
+  const authHeader = getHeader(event, "authorization");
+  const query = getQuery(event);
+  const apiToken = runtimeConfig.apiSecretToken;
+  const token = (authHeader?.startsWith("Bearer ") ? authHeader.split(" ")[1] : null) || query.token;
+  if (token && apiToken && token === apiToken) {
     return;
   }
+  if (auth.type === "jwt" && auth.jwtSecret) {
+    if (await verifyJwtToken(event, auth.jwtSecret)) return;
+    throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
+  }
   await requireUserSession(event);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auto-crud",
-  "version": "1.25.0",
+  "version": "1.26.0",
   "description": "Exposes RESTful CRUD APIs for your Nuxt app based solely on your database migrations.",
   "author": "Cliford Pereira",
   "license": "MIT",

package/src/runtime/server/api/_meta.get.ts

@@ -1,5 +1,4 @@
-// server/api/_meta.get.ts
-import { eventHandler } from 'h3'
+import { eventHandler, getQuery, getHeader } from 'h3'
 import { getTableForModel, getAvailableModels } from '../utils/modelMapper'
 import { getTableColumns as getDrizzleTableColumns } from 'drizzle-orm'
 import { getTableConfig } from 'drizzle-orm/sqlite-core'
@@ -11,6 +10,9 @@ import { ensureAuthenticated } from '../utils/auth'
 export default eventHandler(async (event) => {
   await ensureAuthenticated(event)
 
+  const query = getQuery(event)
+  const acceptHeader = getHeader(event, 'accept') || ''
+
   const models = getAvailableModels().length > 0
     ? getAvailableModels()
     : Object.keys(db?.query || {})
@@ -21,31 +23,24 @@ export default eventHandler(async (event) => {
       const columns = getDrizzleTableColumns(table)
       const config = getTableConfig(table)
 
-      // Map columns to fields
       const fields = Object.entries(columns)
-        .filter(([name]) => !PROTECTED_FIELDS.includes(name) && !HIDDEN_FIELDS.includes(name))
+        .filter(([name]) => !HIDDEN_FIELDS.includes(name))
         .map(([name, col]) => {
           let references = null
-
-          // 1. Check for Foreign Keys via getTableConfig (Robust Drizzle Reflection)
-          // eslint-disable-next-line @typescript-eslint/no-explicit-any
-          const fk = config?.foreignKeys.find((f: any) =>
-            f.reference().columns[0].name === col.name,
-          )
+          // @ts-expect-error - Drizzle foreign key internals
+          const fk = config?.foreignKeys.find(f => f.reference().columns[0].name === col.name)
 
           if (fk) {
             // @ts-expect-error - Drizzle internals
             references = fk.reference().foreignTable[Symbol.for('drizzle:Name')]
           }
-          // 2. Fallback to inline reference config if symbol lookup fails
-          // eslint-disable-next-line @typescript-eslint/no-explicit-any
-          else if ((col as any).referenceConfig?.foreignTable) {
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            const foreignTable = (col as any).referenceConfig.foreignTable
+          // @ts-expect-error - Drizzle internal referenceConfig
+          else if (col.referenceConfig?.foreignTable) {
+            // @ts-expect-error - Drizzle internal referenceConfig
+            const foreignTable = col.referenceConfig.foreignTable
             references = foreignTable[Symbol.for('drizzle:Name')] || foreignTable.name
           }
 
-          // Semantic Normalization
           const semanticType = col.columnType.toLowerCase().replace('sqlite', '')
 
           return {
@@ -56,10 +51,11 @@ export default eventHandler(async (event) => {
             options: col.enumValues || null,
             references,
             isRelation: !!references,
+            // Agentic Hint: Is this field writable by the user/agent?
+            isReadOnly: PROTECTED_FIELDS.includes(name),
           }
         })
 
-      // 3. Implement Clifland Label Heuristic (name > title > email > id)
       const fieldNames = fields.map(f => f.name)
       const labelField = fieldNames.find(n => n === 'name')
         || fieldNames.find(n => n === 'title')
@@ -70,6 +66,7 @@ export default eventHandler(async (event) => {
         resource: model,
         endpoint: `/api/${model}`,
         labelField,
+        methods: ['GET', 'POST', 'PATCH', 'DELETE'],
         fields,
       }
     }
@@ -78,9 +75,37 @@ export default eventHandler(async (event) => {
     }
   }).filter(Boolean)
 
-  return {
+  const payload = {
     architecture: 'Clifland-NAC',
     version: '1.0.0-agentic',
     resources,
   }
+
+  const currentToken = getQuery(event).token || (getHeader(event, 'authorization')?.split(' ')[1])
+  const tokenSuffix = currentToken ? `?token=${currentToken}` : ''
+
+  // --- CONTENT NEGOTIATION FOR AGENTIC TOOLS ---
+  if (query.format === 'md' || acceptHeader.includes('text/markdown')) {
+    let markdown = `# ${payload.architecture} API Manifest (v${payload.version})\n\n`
+
+    payload.resources.forEach((res) => {
+      if (!res) return
+      markdown += `### Resource: ${res.resource}\n`
+      markdown += `- **Endpoint**: \`${res.endpoint}${tokenSuffix}\`\n`
+      markdown += `- **Methods**: ${res.methods.join(', ')}\n`
+      markdown += `- **Primary Label**: \`${res.labelField}\`\n\n`
+      markdown += `| Field | Type | Required | Writable | Details |\n`
+      markdown += `| :--- | :--- | :--- | :--- | :--- |\n`
+
+      res.fields.forEach((f) => {
+        const details = f.isEnum && f.options ? `Options: ${f.options.join(', ')}` : (f.references ? `Refs: ${f.references}` : '-')
+        markdown += `| ${f.name} | ${f.type} | ${f.required ? '✅' : '❌'} | ${f.isReadOnly ? '❌' : '✅'} | ${details} |\n`
+      })
+      markdown += `\n---\n`
+    })
+
+    return markdown
+  }
+
+  return payload
 })

package/src/runtime/server/utils/auth.ts

@@ -15,6 +15,18 @@ export async function checkAdminAccess(event: H3Event, model: string, action: st
     return true
   }
 
+  // 1. Bearer Token or Query Check (Agentic/MCP Tooling)
+  const authHeader = getHeader(event, 'authorization')
+  const query = getQuery(event)
+  const apiToken = useRuntimeConfig(event).apiSecretToken
+
+  // Extract token from Header or fallback to Query param
+  const token = (authHeader?.startsWith('Bearer ') ? authHeader.split(' ')[1] : null) || query.token
+
+  if (token && apiToken && token === apiToken) {
+    return true
+  }
+
   if (auth.type === 'jwt') {
     if (!auth.jwtSecret) {
       console.warn('JWT Secret is not configured but auth type is jwt')
@@ -113,15 +125,28 @@ export async function checkAdminAccess(event: H3Event, model: string, action: st
 
 export async function ensureAuthenticated(event: H3Event): Promise<void> {
   const { auth } = useAutoCrudConfig()
+  const runtimeConfig = useRuntimeConfig(event)
 
   if (!auth?.authentication) return
 
-  if (auth.type === 'jwt' && auth.jwtSecret) {
-    if (!await verifyJwtToken(event, auth.jwtSecret)) {
-      throw createError({ statusCode: 401, message: 'Unauthorized' })
-    }
+  // Extract Token: Priority 1: Authorization Header | Priority 2: Query String (?token=)
+  const authHeader = getHeader(event, 'authorization')
+  const query = getQuery(event)
+  const apiToken = runtimeConfig.apiSecretToken
+
+  const token = (authHeader?.startsWith('Bearer ') ? authHeader.split(' ')[1] : null) || query.token
+
+  // 1. API Token Check (Agentic/MCP)
+  if (token && apiToken && token === apiToken) {
     return
   }
 
+  // 2. JWT Check
+  if (auth.type === 'jwt' && auth.jwtSecret) {
+    if (await verifyJwtToken(event, auth.jwtSecret)) return
+    throw createError({ statusCode: 401, statusMessage: 'Unauthorized' })
+  }
+
+  // 3. Session Check (Standard UI)
   await (requireUserSession as (event: H3Event) => Promise<void>)(event)
 }