Convert inline field definitions to Field helpers and add API security

Co-authored-by: huangyiirene <7665279+huangyiirene@users.noreply.github.com>

Author: Copilot

examples/crm/src/domains/crm/account.object.ts

@@ -24,19 +24,17 @@ export const Account = ObjectSchema.create({
     }),
 
     // Select fields with custom options
-    type: {
-      type: 'select',
+    type: Field.select({
       label: 'Account Type',
       options: [
         { label: 'Prospect', value: 'prospect', color: '#FFA500', default: true },
         { label: 'Customer', value: 'customer', color: '#00AA00' },
         { label: 'Partner', value: 'partner', color: '#0000FF' },
         { label: 'Former Customer', value: 'former', color: '#999999' },
       ]
-    },
+    }),
 
-    industry: {
-      type: 'select',
+    industry: Field.select({
       label: 'Industry',
       options: [
         { label: 'Technology', value: 'technology' },
@@ -46,7 +44,7 @@ export const Account = ObjectSchema.create({
         { label: 'Manufacturing', value: 'manufacturing' },
         { label: 'Education', value: 'education' },
       ]
-    },
+    }),
 
     // Number fields
     annual_revenue: Field.currency({ 
@@ -131,6 +129,7 @@ export const Account = ObjectSchema.create({
     trackHistory: true,     // Track field changes
     searchable: true,       // Include in global search
     apiEnabled: true,       // Expose via REST/GraphQL
+    apiMethods: ['get', 'list', 'create', 'update', 'delete', 'search', 'export'], // Whitelist allowed API operations
     files: true,            // Allow file attachments
     feedEnabled: true,      // Enable activity feed/chatter
     trash: true,            // Recycle bin support

examples/crm/src/domains/crm/case.object.ts

@@ -38,8 +38,7 @@ export const Case = ObjectSchema.create({
     }),
 
     // Case Management
-    status: {
-      type: 'select',
+    status: Field.select({
       label: 'Status',
       required: true,
       options: [
@@ -51,10 +50,9 @@ export const Case = ObjectSchema.create({
         { label: 'Resolved', value: 'resolved', color: '#00AA00' },
         { label: 'Closed', value: 'closed', color: '#006400' },
       ]
-    },
+    }),
 
-    priority: {
-      type: 'select',
+    priority: Field.select({
       label: 'Priority',
       required: true,
       options: [
@@ -63,7 +61,7 @@ export const Case = ObjectSchema.create({
         { label: 'High', value: 'high', color: '#FF4500' },
         { label: 'Critical', value: 'critical', color: '#FF0000' },
       ]
-    },
+    }),
 
     type: Field.select(['Question', 'Problem', 'Feature Request', 'Bug'], {
       label: 'Case Type',

examples/crm/src/domains/crm/lead.object.ts

@@ -67,8 +67,7 @@ export const Lead = ObjectSchema.create({
     }),
 
     // Lead Qualification
-    status: {
-      type: 'select',
+    status: Field.select({
       label: 'Lead Status',
       required: true,
       options: [
@@ -78,7 +77,7 @@ export const Lead = ObjectSchema.create({
         { label: 'Unqualified', value: 'unqualified', color: '#FF0000' },
         { label: 'Converted', value: 'converted', color: '#00AA00' },
       ]
-    },
+    }),
 
     rating: Field.rating(5, {
       label: 'Lead Score',

examples/crm/src/domains/crm/opportunity.object.ts

@@ -47,8 +47,7 @@ export const Opportunity = ObjectSchema.create({
     }),
 
     // Sales Process
-    stage: {
-      type: 'select',
+    stage: Field.select({
       label: 'Stage',
       required: true,
       options: [
@@ -60,7 +59,7 @@ export const Opportunity = ObjectSchema.create({
         { label: 'Closed Won', value: 'closed_won', color: '#00AA00' },
         { label: 'Closed Lost', value: 'closed_lost', color: '#FF0000' },
       ]
-    },
+    }),
 
     probability: Field.percent({
       label: 'Probability (%)',
@@ -141,6 +140,7 @@ export const Opportunity = ObjectSchema.create({
     trackHistory: true,    // Critical for tracking stage changes
     searchable: true,
     apiEnabled: true,
+    apiMethods: ['get', 'list', 'create', 'update', 'delete', 'aggregate', 'search'], // Whitelist allowed API operations
     files: true,           // Attach proposals, contracts
     feedEnabled: true,     // Team collaboration
     trash: true,