opacacms 0.1.0

package/src/server/handlers.ts

@@ -0,0 +1,722 @@
+import type { Context } from "hono";
+import type { Collection, Global, OpacaConfig } from "../types";
+import { logger } from "../utils/logger";
+import { generateSchemaForCollection } from "../validator";
+
+/**
+ * Hydrates a document with virtual fields and nested fields.
+ * @param doc document to hydrate
+ * @param fields fields to hydrate
+ * @param c context
+ * @returns hydrated document
+ */
+export const hydrateDoc = async (doc: any, fields: any[], c: Context, config: OpacaConfig) => {
+  if (!doc) return doc;
+
+  const user = c.get("user");
+  const session = c.get("session");
+  const apiKey = c.get("apiKey");
+
+  const hydratePromises = fields.map(async (field) => {
+    // 1. Resolve Virtual/Computed Fields
+    if (field.type === "virtual" && typeof field.resolve === "function") {
+      try {
+        doc[field.name] = await field.resolve({
+          data: doc,
+          req: c,
+          user,
+          session,
+          apiKey,
+        });
+      } catch (err) {
+        console.error(`[OpacaCMS] Failed to resolve virtual field ${field.name} `, err);
+        doc[field.name] = null;
+      }
+    }
+
+    // 2. Handle Nested Layout Fields (Recursive)
+    if (field.fields && Array.isArray(field.fields)) {
+      await hydrateDoc(doc, field.fields, c, config);
+    }
+
+    // 3. Handle Tabs (Recursive)
+    if (field.tabs && Array.isArray(field.tabs)) {
+      for (const tab of field.tabs) {
+        if (tab.fields && Array.isArray(tab.fields)) {
+          await hydrateDoc(doc, tab.fields, c, config);
+        }
+      }
+    }
+
+    // 4. Handle Groups (Recursive - value stays in place unless explicitly mapped)
+    if (field.type === "group" && field.fields && doc[field.name]) {
+      await hydrateDoc(doc[field.name], field.fields, c, config);
+    }
+
+    // 5. Handle Arrays (Recursive for each item)
+    if (field.type === "array" && field.fields && Array.isArray(doc[field.name])) {
+      await Promise.all(
+        doc[field.name].map((item: any) => hydrateDoc(item, field.fields, c, config)),
+      );
+    }
+
+    // 6. Handle Blocks (Recursive for each block type)
+    if (field.type === "blocks" && field.blocks && Array.isArray(doc[field.name])) {
+      await Promise.all(
+        doc[field.name].map((item: any) => {
+          const block = field.blocks.find((b: any) => b.slug === item.block_type);
+          if (block && block.fields) {
+            return hydrateDoc(item, block.fields, c, config);
+          }
+          return Promise.resolve();
+        }),
+      );
+    }
+    // 7. Handle Localized Fields
+    if (field.localized && doc[field.name] && typeof doc[field.name] === "object") {
+      const i18nConfig = config.i18n;
+      const requestedLocale = c.req.header("x-opaca-locale") || c.req.query("locale");
+
+      // Resolve target locale: explicit request > defaultLocale > fallback to "en"
+      const targetLocale = requestedLocale || i18nConfig?.defaultLocale || "en";
+
+      if (targetLocale !== "all") {
+        const localizedValue =
+          doc[field.name][targetLocale] ?? doc[field.name][i18nConfig?.defaultLocale || "en"] ?? "";
+        doc[field.name] = localizedValue;
+      }
+    }
+  });
+
+  await Promise.all(hydratePromises);
+  return doc;
+};
+
+/**
+ * Populates a document with related documents.
+ * This version is generic and takes the DB adapter and fields list.
+ */
+const populateDoc = async (db: any, fields: any[], doc: any, populateKeys: string[]) => {
+  if (!doc) return doc;
+
+  const populatePromises = fields
+    .filter((f) => {
+      const field = f as any;
+      return (
+        field.type === "relationship" &&
+        field.relationTo &&
+        populateKeys.includes(field.name) &&
+        doc[field.name]
+      );
+    })
+    .map(async (f) => {
+      const field = f as any;
+      try {
+        const relatedDoc = await db.findOne(field.relationTo, { id: doc[field.name] });
+        if (relatedDoc) {
+          doc[field.name] = relatedDoc;
+        }
+      } catch (err) {
+        console.error(`[OpacaCMS] Failed to populate relationship ${field.name} `, err);
+      }
+    });
+
+  await Promise.all(populatePromises);
+  return doc;
+};
+
+/**
+ * Creates handlers for a collection
+ * @param config opaca config
+ * @param collection collection config
+ * @param getAuth auth function
+ * @returns collection handlers
+ */
+export function createHandlers(config: OpacaConfig, collection: Collection, getAuth?: () => any) {
+  const { db } = config;
+
+  /**
+   * Checks access to a collection
+   * @param c context
+   * @param action action to check
+   * @param data data to check
+   * @returns true if access is allowed, false otherwise
+   */
+  const checkAccess = async (
+    c: Context,
+    action: keyof NonNullable<Collection["access"]>,
+    data?: unknown,
+  ) => {
+    const access = collection.access?.[action];
+
+    // 1. Check API Key Permissions
+    const apiKey = c.get("apiKey");
+
+    // Check if API Key is strictly required for this collection
+    if (collection.access?.requireApiKey && !apiKey) {
+      const user = c.get("user");
+      // Allow access for authenticated admins even without an API Key
+      if (user?.role === "admin" || (Array.isArray(user?.role) && user.role.includes("admin"))) {
+        // Proceed to normal access function check
+      } else {
+        return false;
+      }
+    }
+
+    if (apiKey) {
+      // If the key has specific permissions for this collection, we enforce them.
+      if (apiKey.permissions) {
+        const collectionPermissions = apiKey.permissions[collection.slug];
+        if (collectionPermissions) {
+          if (!collectionPermissions.includes(action as string)) {
+            return false;
+          }
+          return true;
+        }
+      }
+    }
+
+    // 2. Fallback to Collection Access Function
+    if (access === undefined) return true;
+    if (typeof access === "boolean") return access;
+
+    const user = c.get("user");
+    const session = c.get("session");
+
+    return await access({
+      req: c,
+      user,
+      session,
+      apiKey,
+      data,
+    });
+  };
+
+  /**
+   * Gets field access permissions
+   * @param c context
+   * @param operation operation type
+   * @param fields fields to check
+   * @param data data to check
+   * @returns field access permissions
+   */
+  const getFieldAccessPermissions = async (
+    c: Context,
+    operation: "read" | "create" | "update",
+    fields: any[],
+    data?: unknown,
+  ) => {
+    const permissions: Record<string, any> = {};
+    const user = c.get("user");
+    const session = c.get("session");
+    const apiKey = c.get("apiKey");
+
+    const accessArgs = {
+      req: c,
+      user,
+      session,
+      apiKey,
+      data,
+      operation,
+    };
+
+    for (const field of fields) {
+      if (field.name) {
+        if (!field.access) {
+          permissions[field.name] = { hidden: false, readOnly: false, disabled: false };
+        } else {
+          const hidden =
+            typeof field.access.hidden === "function"
+              ? await field.access.hidden(accessArgs as any)
+              : !!field.access.hidden;
+          const readOnly =
+            typeof field.access.readOnly === "function"
+              ? await field.access.readOnly(accessArgs as any)
+              : !!field.access.readOnly;
+          const disabled =
+            typeof field.access.disabled === "function"
+              ? await field.access.disabled(accessArgs as any)
+              : !!field.access.disabled;
+
+          permissions[field.name] = { hidden, readOnly, disabled };
+        }
+      }
+
+      // Recursively check nested fields if any
+      if (field.fields && Array.isArray(field.fields)) {
+        const nestedPermissions = await getFieldAccessPermissions(c, operation, field.fields, data);
+        Object.assign(permissions, nestedPermissions);
+      }
+
+      if (field.tabs && Array.isArray(field.tabs)) {
+        for (const tab of field.tabs) {
+          if (tab.fields && Array.isArray(tab.fields)) {
+            const nestedPermissions = await getFieldAccessPermissions(
+              c,
+              operation,
+              tab.fields,
+              data,
+            );
+            Object.assign(permissions, nestedPermissions);
+          }
+        }
+      }
+    }
+
+    return permissions;
+  };
+
+  /**
+   * Saves a document version to the _versions table
+   */
+  const saveVersion = async (doc: any, status?: string) => {
+    if (!collection.versions) return;
+
+    const versionsTable = `${collection.slug}_versions`.toLowerCase();
+    const versionDoc = {
+      id: crypto.randomUUID(),
+      _parent_id: doc.id,
+      _version_data: JSON.stringify(doc),
+      _status: status || doc._status || "published",
+      created_at: new Date().toISOString(),
+    };
+
+    try {
+      await (db as any).unsafe(
+        `INSERT INTO ${versionsTable} (id, _parent_id, _version_data, _status, created_at) VALUES(?, ?, ?, ?, ?)`,
+        [
+          versionDoc.id,
+          versionDoc._parent_id,
+          versionDoc._version_data,
+          versionDoc._status,
+          versionDoc.created_at,
+        ],
+      );
+    } catch (err) {
+      console.error(`[OpacaCMS] Failed to save version for ${collection.slug}: `, err);
+    }
+  };
+
+  return {
+    async find(c: Context) {
+      if (!(await checkAccess(c, "read"))) {
+        return c.json({ message: "Forbidden" }, 403);
+      }
+
+      const queries = c.req.query();
+      const maxLimit = config.api?.maxLimit ?? 100;
+      const page = queries.page ? parseInt(queries.page, 10) : 1;
+      let limit = queries.limit ? parseInt(queries.limit, 10) : 10;
+      if (limit > maxLimit) limit = maxLimit;
+
+      const sort = queries.sort as string;
+      const populate = queries.populate ? queries.populate.split(",") : [];
+
+      const filter: Record<string, unknown> = {};
+      for (const [key, value] of Object.entries(queries)) {
+        if (["page", "limit", "sort", "populate", "locale", "draft"].includes(key)) continue;
+        const match = key.match(/^([^[]+)\[([^\]]+)\]$/);
+        if (match) {
+          const field = match[1] as string;
+          const op = match[2] as string;
+          if (!filter[field]) filter[field] = {};
+          (filter[field] as Record<string, unknown>)[op] = value;
+        } else {
+          filter[key] = value;
+        }
+      }
+
+      const results = await db.find(collection.slug, filter, { page, limit, sort });
+
+      if (populate.length > 0) {
+        results.docs = await Promise.all(
+          results.docs.map((doc) => populateDoc(db, collection.fields, doc, populate)),
+        );
+      }
+
+      results.docs = await Promise.all(
+        results.docs.map((doc) => hydrateDoc(doc, collection.fields, c, config)),
+      );
+
+      return c.json(results);
+    },
+
+    async findOne(c: Context) {
+      if (!(await checkAccess(c, "read"))) {
+        return c.json({ message: "Forbidden" }, 403);
+      }
+
+      const queries = c.req.query();
+      const populate = queries.populate ? queries.populate.split(",") : [];
+      const id = c.req.param("id");
+
+      let doc = await db.findOne(collection.slug, { id });
+      if (!doc) return c.json({ message: "Not found" }, 404);
+
+      if (populate.length > 0) {
+        doc = await populateDoc(db, collection.fields, doc, populate);
+      }
+
+      doc = await hydrateDoc(doc, collection.fields, c, config);
+
+      const permissions = await getFieldAccessPermissions(c, "read", collection.fields, doc);
+      const cleanDoc = { ...doc } as any;
+      for (const [field, perm] of Object.entries(permissions)) {
+        if ((perm as any).hidden) {
+          delete cleanDoc[field];
+        }
+      }
+
+      return c.json(cleanDoc);
+    },
+
+    async create(c: Context) {
+      const body = await c.req.json();
+      if (!(await checkAccess(c, "create", body))) {
+        return c.json({ message: "Forbidden" }, 403);
+      }
+
+      // Handle Slug Auto-generation
+      for (const field of collection.fields) {
+        if (field.type === "slug" && !body[field.name]) {
+          const fromValue = body[field.from];
+          if (fromValue && typeof fromValue === "string") {
+            const formatted = field.format
+              ? field.format(fromValue)
+              : fromValue
+                  .toLowerCase()
+                  .replace(/[^a-z0-9]+/g, "-")
+                  .replace(/^-+|-+$/g, "");
+            body[field.name] = formatted;
+          }
+        }
+      }
+
+      const schema = generateSchemaForCollection(collection);
+      const validation = schema.safeParse(body);
+      if (!validation.success) {
+        return c.json({ message: "Validation Error", errors: validation.error.format() }, 400);
+      }
+
+      let data = validation.data;
+      const locale = c.req.header("x-opaca-locale");
+
+      // Wrap localized fields if a specific locale is provided
+      if (locale && locale !== "all") {
+        for (const field of collection.fields) {
+          if (field.name && field.localized && data[field.name] !== undefined) {
+            data[field.name] = { [locale]: data[field.name] };
+          }
+        }
+      }
+      if (collection.hooks?.beforeCreate) {
+        data = (await collection.hooks.beforeCreate(data as never)) as any;
+      }
+
+      const doc = await db.create(collection.slug, data as Record<string, unknown>);
+
+      if (collection.hooks?.afterCreate) {
+        await collection.hooks.afterCreate(doc as never);
+      }
+
+      if (collection.webhooks) {
+        const afterCreateWebhooks = collection.webhooks.filter((w) =>
+          w.events.includes("afterCreate"),
+        );
+        for (const webhook of afterCreateWebhooks) {
+          const hookPromise = fetch(webhook.url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", ...webhook.headers },
+            body: JSON.stringify(doc),
+          }).catch((e) => logger.error(`Webhook afterCreate failed for ${collection.slug}: `, e));
+          if (c.executionCtx?.waitUntil) {
+            c.executionCtx.waitUntil(hookPromise);
+          }
+        }
+      }
+
+      if (collection.versions) {
+        await saveVersion(doc, body._status);
+      }
+
+      const hydratedDoc = await hydrateDoc(doc, collection.fields, c, config);
+
+      return c.json(hydratedDoc, 201);
+    },
+
+    async update(c: Context) {
+      const id = c.req.param("id");
+      const body = await c.req.json();
+      if (!(await checkAccess(c, "update", body))) {
+        return c.json({ message: "Forbidden" }, 403);
+      }
+
+      // Handle Slug Auto-generation
+      for (const field of collection.fields) {
+        if (field.type === "slug" && !body[field.name]) {
+          const fromValue = body[field.from];
+          if (fromValue && typeof fromValue === "string") {
+            const formatted = field.format
+              ? field.format(fromValue)
+              : fromValue
+                  .toLowerCase()
+                  .replace(/[^a-z0-9]+/g, "-")
+                  .replace(/^-+|-+$/g, "");
+            body[field.name] = formatted;
+          }
+        }
+      }
+
+      const schema = generateSchemaForCollection(collection, true);
+      const validation = schema.safeParse(body);
+      if (!validation.success) {
+        return c.json({ message: "Validation Error", errors: validation.error.format() }, 400);
+      }
+
+      let data = validation.data;
+      const locale = c.req.header("x-opaca-locale");
+
+      // Merge into localized fields if a specific locale is provided
+      if (locale && locale !== "all") {
+        let existing: any = null;
+        for (const field of collection.fields) {
+          if (field.name && field.localized && data[field.name] !== undefined) {
+            if (!existing) {
+              existing = await db.findOne(collection.slug, { id });
+            }
+            const currentObj = (existing?.[field.name] || {}) as Record<string, any>;
+            data[field.name] = { ...currentObj, [locale]: data[field.name] };
+          }
+        }
+      }
+      if (collection.hooks?.beforeUpdate) {
+        data = (await collection.hooks.beforeUpdate(data as never)) as any;
+      }
+
+      const doc = await db.update(collection.slug, { id }, data as Record<string, unknown>);
+
+      if (collection.hooks?.afterUpdate) {
+        await collection.hooks.afterUpdate(doc as never);
+      }
+
+      if (collection.webhooks) {
+        const afterUpdateWebhooks = collection.webhooks.filter((w) =>
+          w.events.includes("afterUpdate"),
+        );
+        for (const webhook of afterUpdateWebhooks) {
+          const hookPromise = fetch(webhook.url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", ...webhook.headers },
+            body: JSON.stringify(doc),
+          }).catch((e) => logger.error(`Webhook afterUpdate failed for ${collection.slug}: `, e));
+          if (c.executionCtx?.waitUntil) {
+            c.executionCtx.waitUntil(hookPromise);
+          }
+        }
+      }
+
+      if (collection.versions) {
+        await saveVersion(doc, body._status);
+      }
+
+      const hydratedDoc = await hydrateDoc(doc, collection.fields, c, config);
+
+      return c.json(hydratedDoc);
+    },
+
+    async delete(c: Context) {
+      if (!(await checkAccess(c, "delete"))) {
+        return c.json({ message: "Forbidden" }, 403);
+      }
+
+      const id = c.req.param("id");
+
+      // Optionally fetch doc before deleting to pass to webhook
+      let docToPass: any = { id };
+      try {
+        if (
+          collection.webhooks &&
+          collection.webhooks.some((w) => w.events.includes("afterDelete"))
+        ) {
+          docToPass = await db.findOne(collection.slug, { id });
+        }
+      } catch (e) {
+        // Ignore
+      }
+
+      if (collection.hooks?.beforeDelete) {
+        await collection.hooks.beforeDelete(id as never);
+      }
+
+      await db.delete(collection.slug, { id });
+
+      if (collection.hooks?.afterDelete) {
+        await collection.hooks.afterDelete(id as never);
+      }
+
+      if (collection.webhooks) {
+        const afterDeleteWebhooks = collection.webhooks.filter((w) =>
+          w.events.includes("afterDelete"),
+        );
+        for (const webhook of afterDeleteWebhooks) {
+          const hookPromise = fetch(webhook.url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", ...webhook.headers },
+            body: JSON.stringify(docToPass || { id }),
+          }).catch((e) => logger.error(`Webhook afterDelete failed for ${collection.slug}: `, e));
+          if (c.executionCtx?.waitUntil) {
+            c.executionCtx.waitUntil(hookPromise);
+          }
+        }
+      }
+
+      return c.json({ message: "Deleted" });
+    },
+
+    async findVersions(c: Context) {
+      if (!(await checkAccess(c, "read"))) {
+        return c.json({ message: "Forbidden" }, 403);
+      }
+      const parentId = c.req.query("parentId");
+      const versionsTable = `${collection.slug} _versions`.toLowerCase();
+
+      const query = parentId
+        ? `SELECT * FROM ${versionsTable} WHERE _parent_id = ? ORDER BY created_at DESC`
+        : `SELECT * FROM ${versionsTable} ORDER BY created_at DESC`;
+      const params = parentId ? [parentId] : [];
+
+      try {
+        const rows = (await (db as any).unsafe(query, params)) as any[];
+        return c.json({ docs: rows });
+      } catch (err) {
+        return c.json({ message: "Failed to fetch versions", error: (err as any).message }, 500);
+      }
+    },
+
+    async restoreVersion(c: Context) {
+      if (!(await checkAccess(c, "update"))) {
+        return c.json({ message: "Forbidden" }, 403);
+      }
+      const versionId = c.req.param("versionId");
+      const versionsTable = `${collection.slug} _versions`.toLowerCase();
+
+      try {
+        const versionRows = (await (db as any).unsafe(
+          `SELECT * FROM ${versionsTable} WHERE id = ? `,
+          [versionId],
+        )) as any[];
+        if (versionRows.length === 0) return c.json({ message: "Version not found" }, 404);
+
+        const version = versionRows[0];
+        const data = JSON.parse(version._version_data);
+
+        // Remove ID and other internal fields for update
+        const id = version._parent_id;
+        delete data.id;
+        delete data.created_at;
+        delete data.updated_at;
+
+        const doc = await db.update(collection.slug, { id }, data);
+        await saveVersion(doc, "published"); // Save a new version tracking the restoration
+
+        return c.json(doc);
+      } catch (err) {
+        return c.json({ message: "Failed to restore version", error: (err as any).message }, 500);
+      }
+    },
+  };
+}
+
+/**
+ * Creates handlers for global collections
+ * @param config opaca config
+ * @param globalConfig global config
+ * @param getAuth auth function
+ * @returns global handlers
+ */
+export function createGlobalHandlers(
+  config: OpacaConfig,
+  globalConfig: Global,
+  getAuth?: () => any,
+) {
+  const { db } = config;
+
+  /**
+   * Checks access to a global collection
+   * @param c context
+   * @param action action to check
+   * @param data data to check
+   * @returns true if access is allowed, false otherwise
+   */
+  const checkAccess = async (
+    c: Context,
+    action: keyof NonNullable<Global["access"]>,
+    data?: unknown,
+  ) => {
+    const access = globalConfig.access?.[action];
+    if (access === undefined) return true;
+    if (typeof access === "boolean") return access;
+
+    const user = c.get("user");
+    const session = c.get("session");
+    const apiKey = c.get("apiKey");
+
+    return await access({
+      req: c,
+      user,
+      session,
+      apiKey,
+      data,
+    });
+  };
+
+  return {
+    async find(c: Context) {
+      if (!(await checkAccess(c, "read"))) {
+        return c.json({ message: "Forbidden" }, 403);
+      }
+
+      if (!db.findGlobal) {
+        return c.json({ message: "Globals are not supported by this database adapter" }, 501);
+      }
+
+      const doc = await db.findGlobal(globalConfig.slug);
+      const hydratedDoc = await hydrateDoc(doc || {}, globalConfig.fields, c, config);
+      return c.json(hydratedDoc);
+    },
+
+    async update(c: Context) {
+      const body = await c.req.json();
+
+      if (!(await checkAccess(c, "update", body))) {
+        return c.json({ message: "Forbidden" }, 403);
+      }
+
+      if (!db.updateGlobal) {
+        return c.json({ message: "Globals are not supported by this database adapter" }, 501);
+      }
+
+      const schema = generateSchemaForCollection(globalConfig, true);
+      const validation = schema.safeParse(body);
+
+      if (!validation.success) {
+        logger.error(
+          `Validation Error on Global ${globalConfig.slug}: `,
+          validation.error.format(),
+        );
+        return c.json(
+          {
+            message: "Validation Error",
+            errors: validation.error.format(),
+          },
+          400,
+        );
+      }
+
+      const doc = await db.updateGlobal(globalConfig.slug, validation.data);
+      const hydratedDoc = await hydrateDoc(doc, globalConfig.fields, c, config);
+
+      return c.json(hydratedDoc);
+    },
+  };
+}