adjusted

utils/buildQuery.util.js

@@ -1,6 +1,12 @@
 // utils/queryBuilder.js
 const { Sequelize, Op } = require("sequelize");
 
+// ─── Custom sort order for ENUM fields ────────────────────────────────────────
+const ENUM_SORT_ORDER = {
+  acc_type: ["admin", "staff", "user"],
+  reg_type: ["system", "google"],
+};
+
 /**
  * Builds a Sequelize `where` clause from an array of filters.
  *
@@ -12,8 +18,6 @@ function buildWhere(filters = [], allowedFields = new Set()) {
 
   for (const { id, value } of filters) {
     if (!id || value === undefined || value === null || value === "") continue;
-
-    // Reject fields not in whitelist (if whitelist is provided)
     if (allowedFields.size && !allowedFields.has(id)) continue;
 
     const values = Array.isArray(value) ? value : [value];
@@ -48,15 +52,30 @@ function buildOrder(sort = [], allowedFields = new Set()) {
 
   for (const { id, desc } of sort) {
     if (!id) continue;
-
-    // Reject fields not in whitelist (if whitelist is provided)
     if (allowedFields.size && !allowedFields.has(id)) continue;
 
-    order.push(
-      id.startsWith("personal_info.")
-        ? [Sequelize.json(id), desc ? "DESC" : "ASC"]
-        : [id, desc ? "DESC" : "ASC"]
-    );
+    // ─── ENUM fields — use CASE for custom sort order ─────────────────────
+    if (ENUM_SORT_ORDER[id]) {
+      const sequence = desc
+        ? [...ENUM_SORT_ORDER[id]].reverse()
+        :   ENUM_SORT_ORDER[id];
+
+      const caseExpr = sequence
+        .map((val, i) => `WHEN '${val}' THEN ${i}`)
+        .join(" ");
+
+      order.push([Sequelize.literal(`CASE "${id}" ${caseExpr} END`)]);
+      continue;
+    }
+
+    // ─── JSONB dot-notation fields ─────────────────────────────────────────
+    if (id.startsWith("personal_info.")) {
+      order.push([Sequelize.json(id), desc ? "DESC" : "ASC"]);
+      continue;
+    }
+
+    // ─── Regular fields ───────────────────────────────────────────────────
+    order.push([id, desc ? "DESC" : "ASC"]);
   }
 
   return order.length ? order : [["createdAt", "DESC"]];

utils/excludeJSONBPaths.js

@@ -1,73 +0,0 @@
-const { Sequelize } = require('sequelize')
-
-/**
- * Strips a key from every element in a JSONB array using PostgreSQL's
- * jsonb_agg + #- operator in a subquery.
- *
- * @param {string} column - JSONB column e.g. "personal_info"
- * @param {string} arrayField - array field name e.g. "addresses"
- * @param {string[]} keys - keys to strip from each array element e.g. ["street", "zip"]
- * @returns {string} SQL fragment
- */
-function buildArrayStrip(column, arrayField, keys) {
-    const keyRemovals = keys.reduce(
-        (acc, key) => `(${acc} #- '{${key}}')`,
-        "elem"
-    );
-
-    return `(
-    SELECT jsonb_agg(${keyRemovals})
-    FROM jsonb_array_elements("${column}"->'${arrayField}') AS elem
-  )`;
-}
-
-/**
- * Builds a Sequelize literal that strips JSONB paths at the DB level.
- * Supports:
- *  - nested keys:        "personal_info.name.given_name"
- *  - array item keys:    "personal_info.addresses[].street"
- *
- * @param {string} column - JSONB column name e.g. "personal_info"
- * @param {string[]} excludePaths - dot-notation paths
- * @returns {Array|null} Sequelize literal attribute tuple
- */
-function excludeJsonbPaths(column, excludePaths = []) {
-    // Separate nested paths from array paths
-    const nestedPaths = excludePaths.filter(
-        (p) => p.startsWith(`${column}.`) && !p.includes("[]")
-    );
-    const arrayPaths = excludePaths.filter(
-        (p) => p.startsWith(`${column}.`) && p.includes("[]")
-    );
-
-    // Group array paths by their field name
-    // e.g. { addresses: ["street", "zip"], phone_number: ["country_code"] }
-    const arrayGroups = {};
-    for (const path of arrayPaths) {
-        const stripped = path.replace(`${column}.`, "");          // addresses[].street
-        const [arrayField, key] = stripped.split("[].");           // ["addresses", "street"]
-        if (!arrayGroups[arrayField]) arrayGroups[arrayField] = [];
-        arrayGroups[arrayField].push(key);
-    }
-
-    if (!nestedPaths.length && !Object.keys(arrayGroups).length) return null;
-
-    // Start with the column and chain #- for nested paths
-    let literal = `"${column}"`;
-
-    // Strip nested keys first
-    for (const path of nestedPaths) {
-        const keys = path.replace(`${column}.`, "").split(".");
-        literal = `(${literal} #- '{${keys.join(",")}}')`;
-    }
-
-    // Then rebuild array fields with stripped keys using jsonb_set
-    for (const [arrayField, keys] of Object.entries(arrayGroups)) {
-        const arrayStrip = buildArrayStrip(column, arrayField, keys);
-        literal = `jsonb_set(${literal}, '{${arrayField}}', COALESCE(${arrayStrip}, '[]'))`;
-    }
-
-    return [Sequelize.literal(literal), column];
-}
-
-module.exports = { excludeJsonbPaths };

utils/excludeJSONBPaths.util.js

@@ -0,0 +1,94 @@
+const { Sequelize } = require('sequelize')
+
+/**
+ * Strips a key from every element in a JSONB array using PostgreSQL's
+ * jsonb_agg + #- operator in a subquery.
+ *
+ * @param {string} column - JSONB column e.g. "personal_info"
+ * @param {string} arrayField - array field name e.g. "addresses"
+ * @param {string[]} keys - keys to strip from each array element e.g. ["street", "zip"]
+ * @returns {string} SQL fragment
+ */
+function buildArrayStrip(column, arrayField, keys) {
+    const keyRemovals = keys.reduce(
+        (acc, key) => `(${acc} #- '{${key}}')`,
+        "elem"
+    );
+
+    return `(
+    SELECT jsonb_agg(${keyRemovals})
+    FROM jsonb_array_elements("${column}"->'${arrayField}') AS elem
+  )`;
+}
+
+/**
+ * Builds a Sequelize literal that strips JSONB paths at the DB level.
+ * Supports:
+ *  - nested keys:        "personal_info.name.given_name"
+ *  - array item keys:    "personal_info.addresses[].street"
+ *
+ * @param {string} column - JSONB column name e.g. "personal_info"
+ * @param {string[]} excludePaths - dot-notation paths
+ * @returns {Array|null} Sequelize literal attribute tuple
+ */
+function excludeJsonbPaths(column, excludePaths = []) {
+    const nestedPaths = excludePaths.filter(
+        (p) => p.startsWith(`${column}.`) && !p.includes("[]")
+    );
+
+    const arrayPaths = excludePaths.filter(
+        (p) => p.startsWith(`${column}.`) && p.includes("[]")
+    );
+
+    // ─── Group array paths ──────────────────────────────────────────────────────
+    // Separate bare array strips  → "personal_info.addresses[]"
+    // from key-level strips       → "personal_info.addresses[].city"
+    const bareArrayStrips = new Set();   // fields to remove entirely e.g. "addresses"
+    const arrayGroups = {};          // fields to partially strip e.g. { addresses: ["city"] }
+
+    for (const path of arrayPaths) {
+        const stripped = path.replace(`${column}.`, "");   // "addresses[].city" or "addresses[]"
+
+        if (stripped.endsWith("[]")) {
+            // ─── Bare array strip — remove the whole field ─────────────────────────
+            const arrayField = stripped.replace("[]", "");
+            bareArrayStrips.add(arrayField);
+        } else {
+            // ─── Key-level strip — remove specific keys inside each element ────────
+            const [arrayPart, key] = stripped.split("[].");   // ["addresses", "city"]
+            const arrayField = arrayPart.replace("[]", "");
+
+            // Skip if the whole array is already being stripped entirely
+            if (bareArrayStrips.has(arrayField)) continue;
+
+            if (!arrayGroups[arrayField]) arrayGroups[arrayField] = [];
+            arrayGroups[arrayField].push(key);
+        }
+    }
+
+    if (!nestedPaths.length && !bareArrayStrips.size && !Object.keys(arrayGroups).length)
+        return null;
+
+    let literal = `"${column}"`;
+
+    // ─── 1. Strip nested keys ───────────────────────────────────────────────────
+    for (const path of nestedPaths) {
+        const keys = path.replace(`${column}.`, "").split(".");
+        literal = `(${literal} #- '{${keys.join(",")}}')`;
+    }
+
+    // ─── 2. Strip entire array fields ──────────────────────────────────────────
+    for (const arrayField of bareArrayStrips) {
+        literal = `(${literal} #- '{${arrayField}}')`;
+    }
+
+    // ─── 3. Strip specific keys inside array elements ──────────────────────────
+    for (const [arrayField, keys] of Object.entries(arrayGroups)) {
+        const arrayStrip = buildArrayStrip(column, arrayField, keys);
+        literal = `jsonb_set(${literal}, '{${arrayField}}', COALESCE(${arrayStrip}, '[]'))`;
+    }
+
+    return [Sequelize.literal(literal), column];
+}
+
+module.exports = { excludeJsonbPaths };

utils/modelToAttributes.util.js

@@ -5,46 +5,46 @@ const { DataTypes } = require("sequelize");
  * Maps Sequelize DataType to a simple UI type string.
  */
 function resolveType(dataType) {
-    if (!dataType) return "text";
+  if (!dataType) return "text";
 
-    const type = dataType.constructor?.key || dataType.key || "";
+  const type = dataType.constructor?.key || dataType.key || "";
 
-    if (["BIGINT", "INTEGER", "FLOAT", "DOUBLE", "DECIMAL"].includes(type)) return "number";
-    if (["DATE", "DATEONLY"].includes(type)) return "date";
-    if (["BOOLEAN"].includes(type)) return "enum";
-    if (["ENUM"].includes(type)) return "enum";
-    if (["JSONB", "JSON"].includes(type)) return "jsonb";
+  if (["BIGINT", "INTEGER", "FLOAT", "DOUBLE", "DECIMAL"].includes(type)) return "number";
+  if (["DATE", "DATEONLY"].includes(type)) return "date";
+  if (["BOOLEAN"].includes(type)) return "enum";
+  if (["ENUM"].includes(type)) return "enum";
+  if (["JSONB", "JSON"].includes(type)) return "jsonb";
 
-    return "text";
+  return "text";
 }
 
 /**
  * Resolves options (e.g. enum choices) from a Sequelize field definition.
  */
 function resolveOptions(dataType) {
-    if (!dataType) return {};
+  if (!dataType) return "text";
 
-    const type = dataType.constructor?.key || dataType.key || "";
+  const type = dataType.constructor?.key || dataType.key || "";
 
-    if (type === "ENUM") {
-        return { choices: dataType.values ?? [] };
-    }
+  if (type === "ENUM") {
+    return { choices: dataType.values ?? [] };
+  }
 
-    if (type === "BOOLEAN") {
-        return { choices: ["true", "false"] };
-    }
+  if (type === "BOOLEAN") {
+    return { choices: ["true", "false"] };
+  }
 
-    return {};
+  return {};
 }
 
 /**
  * Converts a camelCase or snake_case field name to a readable label.
  */
 function toLabel(field) {
-    return field
-        .replace(/_/g, " ")
-        .replace(/([a-z])([A-Z])/g, "$1 $2")
-        .replace(/\b\w/g, (c) => c.toUpperCase());
+  return field
+    .replace(/_/g, " ")
+    .replace(/([a-z])([A-Z])/g, "$1 $2")
+    .replace(/\b\w/g, (c) => c.toUpperCase());
 }
 
 /**
@@ -55,27 +55,29 @@ function toLabel(field) {
  * @returns {Array} flat attribute entries for each leaf path
  */
 function flattenJsonb(jsonbSchema = {}, prefix = "", exclude = []) {
-    const result = [];
+  const result = [];
 
-    for (const [key, value] of Object.entries(jsonbSchema)) {
-        const path = prefix ? `${prefix}.${key}` : key;
+  for (const [key, value] of Object.entries(jsonbSchema)) {
+    const path = prefix ? `${prefix}.${key}` : key;
 
-        if (exclude.includes(path)) continue;
+    if (exclude.includes(path)) continue;
 
-        // Nested object (no `type` key = it's a group, not a leaf)
-        if (value && typeof value === "object" && !value.type) {
-            result.push(...flattenJsonb(value, path, exclude));
-        } else {
-            result.push({
-                name: value?.label || toLabel(key),  // <-- prefer label
-                type: value?.type ?? "text",
-                field: path,
-                options: {},
-            });
-        }
+    // Nested object (no `type` key = it's a group, not a leaf)
+    if (value && typeof value === "object" && !value.type) {
+      result.push(...flattenJsonb(value, path, exclude));
+    } else {
+      result.push({
+        name: value?.label || toLabel(key),  // <-- prefer label
+        type: value?.type ?? "text",
+        field: path,
+        order: value?.order ?? Infinity,   // ← carry order from schema
+        hidden: value?.hidden ?? false,   // ← carry hidden flag
+        options: {},
+      });
     }
+  }
 
-    return result;
+  return result;
 }
 
 /**
@@ -92,13 +94,13 @@ function modelToAttributes(model, { jsonbSchemas = {}, exclude = [], timestampLa
   const attributes = [];
 
   const defaultTimestampLabels = {
-    createdAt:  "Created",
+    createdAt: "Created",
     modifiedAt: "Modified",
-    updatedAt:  "Modified",
-    deletedAt:  "Deleted",
-    createdBy:  "Created By",
-    updatedBy:  "Modified By",
-    deletedBy:  "Deleted By",
+    updatedAt: "Modified",
+    deletedAt: "Deleted",
+    createdBy: "Created By",
+    updatedBy: "Modified By",
+    deletedBy: "Deleted By",
     ...timestampLabels,
   };
 
@@ -111,13 +113,13 @@ function modelToAttributes(model, { jsonbSchemas = {}, exclude = [], timestampLa
 
   // Ordered audit sequence
   const auditSequence = [
-    { field: 'updatedAt',  type: 'date' },
+    { field: 'updatedAt', type: 'date' },
     { field: 'modifiedAt', type: 'date' },
-    { field: 'updatedBy',  type: 'text' },
-    { field: 'createdAt',  type: 'date' },
-    { field: 'createdBy',  type: 'text' },
-    { field: 'deletedAt',  type: 'date' },
-    { field: 'deletedBy',  type: 'text' },
+    { field: 'updatedBy', type: 'text' },
+    { field: 'createdAt', type: 'date' },
+    { field: 'createdBy', type: 'text' },
+    { field: 'deletedAt', type: 'date' },
+    { field: 'deletedBy', type: 'text' },
   ];
 
   // ── Normal fields (excluding audit) ─────────────────────────────────────────
@@ -126,7 +128,7 @@ function modelToAttributes(model, { jsonbSchemas = {}, exclude = [], timestampLa
     if (auditFields.includes(field)) continue;   // skip audit — added later in order
 
     const dataType = def.type;
-    const type = resolveType(def);
+    const type = resolveType(def.type);  // ← pass only the type
 
     if (type === "jsonb" && jsonbSchemas[field]) {
       attributes.push(...flattenJsonb(jsonbSchemas[field], field, exclude));
@@ -136,27 +138,35 @@ function modelToAttributes(model, { jsonbSchemas = {}, exclude = [], timestampLa
     if (type === "jsonb") continue;
 
     attributes.push({
-      name:    defaultTimestampLabels[field] ?? def.label ?? toLabel(field),
+      name: defaultTimestampLabels[field] ?? def.label ?? toLabel(field),
       type,
       field,
-      options: resolveOptions(def),
+      order: def.order ?? Infinity,   // ← carry order from model
+      hidden: def.hidden ?? false,    // ← carry hidden flag
+      options: resolveOptions(def.type)
     });
   }
 
+  // ─── Sort all fields globally by order ─────────────────────────────────────
+  attributes.sort((a, b) => (a.order ?? Infinity) - (b.order ?? Infinity));
+
+  // ─── Strip order from final output (frontend doesn't need it) ──────────────
+  const sorted = attributes.map(({ order: _, ...rest }) => rest);
+
   // ── Audit fields in correct sequence ────────────────────────────────────────
   for (const { field, type } of auditSequence) {
     if (exclude.includes(field)) continue;
     if (!rawAttrs[field]) continue;   // skip if field doesn't exist on model
 
-    attributes.push({
-      name:    defaultTimestampLabels[field],
+    sorted.push({
+      name: defaultTimestampLabels[field],
       type,
       field,
-      options: {},
+      options: resolveOptions(rawAttrs[field]?.type),
     });
   }
 
-  return attributes;
+  return sorted;
 }
 
 module.exports = { modelToAttributes };

utils/paginate.util.js

@@ -1,12 +1,12 @@
 // utils/paginate.util.js
 const { Sequelize } = require('sequelize');
-const { modelToAttributes } = require('./modelToAttributes');
-const { excludeJsonbPaths } = require('./excludeJsonbPaths');
+const { modelToAttributes } = require('./modelToAttributes.util');
+const { excludeJsonbPaths } = require('./excludeJSONBPaths.util');
 const { buildQuery } = require('./buildQuery.util');
 
 const PAGE_START = 1;
-const PAGE_SIZE  = 10;
-const MAX_LIMIT  = 100;
+const PAGE_SIZE = 10;
+const MAX_LIMIT = 1000;
 
 function safeParseJSON(value, fallback = []) {
   try {
@@ -44,6 +44,25 @@ function auditInclude(mdl_Users, parentAlias = 'User') {
   };
 }
 
+const auditIdToName = (row) => {
+  const map = {
+    createdBy: 'createdByName',
+    updatedBy: 'updatedByName',
+    deletedBy: 'deletedByName',
+  };
+
+  const result = { ...row };
+
+  for (const [idField, nameField] of Object.entries(map)) {
+    if (result[idField] !== null && result[idField] !== undefined) {
+      result[idField] = result[nameField] ?? result[idField];  // ← use name if available, fallback to id
+    }
+    delete result[nameField];  // ← remove the redundant *ByName fields
+  }
+
+  return result;
+};
+
 /**
  * Reusable paginated findAndCountAll
  *
@@ -58,30 +77,30 @@ function auditInclude(mdl_Users, parentAlias = 'User') {
  */
 async function paginate(model, req, {
   excludeAttributes = [],
-  jsonbSchemas      = {},
-  jsonbColumn       = null,
-  findOptions       = {},
-  auditOptions      = null,   // ← { mdl_Users, parentAlias }
+  jsonbSchemas = {},
+  jsonbColumn = null,
+  findOptions = {},
+  auditOptions = null,   // ← { mdl_Users, parentAlias }
 } = {}) {
-  const page   = Math.max(PAGE_START, parseInt(req.query.page,  10) || PAGE_START);
-  const limit  = Math.min(parseInt(req.query.limit, 10) || PAGE_SIZE, MAX_LIMIT);
+  const page = Math.max(PAGE_START, parseInt(req.query.page, 10) || PAGE_START);
+  const limit = Math.min(parseInt(req.query.limit, 10) || PAGE_SIZE, MAX_LIMIT);
   const offset = (page - PAGE_START) * limit;
 
   const filters = safeParseJSON(req.query.filters);
-  const sort    = safeParseJSON(req.query.sort);
+  const sort = safeParseJSON(req.query.sort);
 
   const topLevelExclude = excludeAttributes.filter((f) => !f.includes('.'));
-  const jsonbExclude    = excludeAttributes.filter((f) => f.includes('.'));
-  const jsonbAttr       = jsonbColumn ? excludeJsonbPaths(jsonbColumn, jsonbExclude) : null;
+  const jsonbExclude = excludeAttributes.filter((f) => f.includes('.'));
+  const jsonbAttr = jsonbColumn ? excludeJsonbPaths(jsonbColumn, jsonbExclude) : null;
 
-  const attributes    = modelToAttributes(model, { exclude: excludeAttributes, jsonbSchemas });
+  const attributes = modelToAttributes(model, { exclude: excludeAttributes, jsonbSchemas });
   const ALLOWED_FIELDS = attributes.map((a) => a.field);
 
   const { where, order } = buildQuery(filters, sort, ALLOWED_FIELDS);
 
   // Build attribute includes: jsonb + audit subqueries + any extra from findOptions
-  const baseIncludes  = jsonbAttr ? [jsonbAttr] : [];
-  const auditAttrs    = auditOptions
+  const baseIncludes = jsonbAttr ? [jsonbAttr] : [];
+  const auditAttrs = auditOptions
     ? auditInclude(auditOptions.mdl_Users, auditOptions.parentAlias).attributes
     : [];
   const extraIncludes = findOptions.attributes?.include ?? [];
@@ -91,7 +110,7 @@ async function paginate(model, req, {
 
   const { count, rows } = await model.findAndCountAll({
     ...restFindOptions,
-    where:  { ...where, ...(restFindOptions.where ?? {}) },
+    where: { ...where, ...(restFindOptions.where ?? {}) },
     order,
     limit,
     offset,
@@ -101,10 +120,16 @@ async function paginate(model, req, {
     },
   });
 
+  const data = rows
+    .map((row) => row.toJSON?.() ?? row)
+    .map(auditIdToName);
+
+  // ─── Flatten JSONB columns into dot-notation keys ──────────────────────────
+  const jsonbCols = jsonbColumn ? [jsonbColumn] : [];
   const totalPages = Math.ceil(count / limit);
 
   return {
-    data: rows,
+    data,
     pagination: {
       page,
       limit,

utils/token.util.js

@@ -67,4 +67,17 @@ const verifyRefreshToken = (token) =>
 const hashToken = (token) =>
   crypto.createHash('sha256').update(token).digest('hex');
 
-module.exports = { generateTokens, verifyAccessToken, verifyRefreshToken, hashToken };
+/**
+ * SHA-256 hash a token string for safe DB storage.
+ * @param {string} decoded
+ * @param {number} thresholdDays
+ * @returns {string} if expired or not
+ */
+const shouldRotateRefreshToken = (decoded, thresholdDays = 1) => {
+  const now = Math.floor(Date.now() / 1000);
+  const timeLeft = decoded.exp - now;
+  const threshold = thresholdDays * 24 * 60 * 60;
+  return timeLeft <= threshold;
+};
+
+module.exports = { generateTokens, verifyAccessToken, verifyRefreshToken, hashToken, shouldRotateRefreshToken };