@ai0x0/utils 0.1.1 → 0.1.2

package/es/backend/route-operation/write-operation-core.js

@@ -87,9 +87,16 @@ export function createPostOperationFactory(_ref) {
               case 13:
                 extraBody = _context.t0;
                 // 新建的行归属这次请求的作用域。默认情形下作用域就是 creatorId = 当前用户，
-                // 所以这与从前的行为逐字等价；换了归属列（比如 ownerId）时它自动跟着换。
+                // 换了归属列（比如 ownerId）时它自动跟着换。
                 // 想再记一个「谁建的」用 setBody 补 —— 那是调用方的语义，库不猜。
-                params = _objectSpread(_objectSpread(_objectSpread({}, scopeStamp(scope)), body), extraBody);
+                //
+                // **归属戳必须最后展开**，这是一条安全不变量，别为了「让调用方能覆盖」而调顺序：
+                // `.input({ body })` 只校验、**不替换**请求体（next-rest-framework 交给 handler 的
+                // clone 会重新解析原始 JSON），而 createPostAction 直接 insert，中间没有第二道
+                // schema 过滤。所以只要 body 排在戳后面，客户端在 JSON 里塞一个 `ownerId` /
+                // `creatorId` 就能把行写到别人名下 —— 调用方把该列从 schema 里 omit 掉也拦不住。
+                // 见 __tests__/route-operation-scope-stamp。
+                params = _objectSpread(_objectSpread(_objectSpread({}, body), extraBody), scopeStamp(scope));
                 if (!(table && db)) {
                   _context.next = 21;
                   break;
@@ -183,7 +190,7 @@ export function createPutOperationFactory(_ref5) {
         status: 200
       }]).handler( /*#__PURE__*/function () {
         var _ref8 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee2(req) {
-          var _yield$loadSession, loadSession, _yield$resolveAccess2, scope, body, extraBody, params, raw, data;
+          var _yield$loadSession, loadSession, _yield$resolveAccess2, scope, body, extraBody, editorId, params, raw, data;
           return _regeneratorRuntime().wrap(function _callee2$(_context2) {
             while (1) switch (_context2.prev = _context2.next) {
               case 0:
@@ -213,42 +220,38 @@ export function createPutOperationFactory(_ref5) {
                 _context2.t0 = {};
               case 14:
                 extraBody = _context2.t0;
-                _context2.t1 = _objectSpread;
-                _context2.t2 = _objectSpread;
-                _context2.next = 19;
+                _context2.next = 17;
                 return loadSession();
-              case 19:
-                _context2.t4 = _yield$loadSession = _context2.sent;
-                _context2.t3 = _context2.t4 === null;
-                if (_context2.t3) {
-                  _context2.next = 23;
+              case 17:
+                _context2.t2 = _yield$loadSession = _context2.sent;
+                _context2.t1 = _context2.t2 === null;
+                if (_context2.t1) {
+                  _context2.next = 21;
                   break;
                 }
-                _context2.t3 = _yield$loadSession === void 0;
-              case 23:
-                if (!_context2.t3) {
-                  _context2.next = 27;
+                _context2.t1 = _yield$loadSession === void 0;
+              case 21:
+                if (!_context2.t1) {
+                  _context2.next = 25;
                   break;
                 }
-                _context2.t5 = void 0;
-                _context2.next = 28;
+                _context2.t3 = void 0;
+                _context2.next = 26;
                 break;
-              case 27:
-                _context2.t5 = _yield$loadSession.userId;
-              case 28:
-                _context2.t6 = _context2.t5;
-                _context2.t7 = {
-                  editorId: _context2.t6
-                };
-                _context2.t8 = body;
-                _context2.t9 = (0, _context2.t2)(_context2.t7, _context2.t8);
-                _context2.t10 = extraBody;
-                params = (0, _context2.t1)(_context2.t9, _context2.t10);
+              case 25:
+                _context2.t3 = _yield$loadSession.userId;
+              case 26:
+                editorId = _context2.t3;
+                // editorId 同样**最后**展开：它是审计字段，让请求体覆盖等于让人随便写「是谁改的」。
+                // 理由与 POST 那边的归属戳一样，见那里的说明。
+                params = _objectSpread(_objectSpread(_objectSpread({}, body), extraBody), {}, {
+                  editorId: editorId
+                });
                 if (!(table && db)) {
-                  _context2.next = 40;
+                  _context2.next = 34;
                   break;
                 }
-                _context2.next = 37;
+                _context2.next = 31;
                 return createAction({
                   bodySchema: schemas.body,
                   db: db,
@@ -256,44 +259,44 @@ export function createPutOperationFactory(_ref5) {
                 })(params, {
                   scope: scope
                 });
-              case 37:
-                _context2.t11 = _context2.sent;
-                _context2.next = 41;
+              case 31:
+                _context2.t4 = _context2.sent;
+                _context2.next = 35;
                 break;
-              case 40:
-                _context2.t11 = params;
-              case 41:
-                raw = _context2.t11;
+              case 34:
+                _context2.t4 = params;
+              case 35:
+                raw = _context2.t4;
                 if (!handler) {
-                  _context2.next = 48;
+                  _context2.next = 42;
                   break;
                 }
-                _context2.next = 45;
+                _context2.next = 39;
                 return handler({
                   data: raw,
                   params: params,
                   req: req
                 });
-              case 45:
-                _context2.t12 = _context2.sent;
-                _context2.next = 49;
+              case 39:
+                _context2.t5 = _context2.sent;
+                _context2.next = 43;
                 break;
-              case 48:
-                _context2.t12 = raw;
-              case 49:
-                data = _context2.t12;
+              case 42:
+                _context2.t5 = raw;
+              case 43:
+                data = _context2.t5;
                 return _context2.abrupt("return", TypedNextResponse.json(data, {
                   status: 200
                 }));
-              case 53:
-                _context2.prev = 53;
-                _context2.t13 = _context2["catch"](0);
-                return _context2.abrupt("return", handleOperationError(_context2.t13, catchHandler));
-              case 56:
+              case 47:
+                _context2.prev = 47;
+                _context2.t6 = _context2["catch"](0);
+                return _context2.abrupt("return", handleOperationError(_context2.t6, catchHandler));
+              case 50:
               case "end":
                 return _context2.stop();
             }
-          }, _callee2, null, [[0, 53]]);
+          }, _callee2, null, [[0, 47]]);
         }));
         return function (_x2) {
           return _ref8.apply(this, arguments);

package/lib/backend/route-operation/write-operation-core.js

@@ -70,7 +70,7 @@ function createPostOperationFactory({
       });
       const body = await (0, import_operation_common.readPostBody)(req, { contentType, parseBody });
       const extraBody = await (setBody == null ? void 0 : setBody(req)) || {};
-      const params = { ...scopeStamp(scope), ...body, ...extraBody };
+      const params = { ...body, ...extraBody, ...scopeStamp(scope) };
       const raw = table && db ? (await createAction({
         bodySchema: schemas.body,
         db,
@@ -130,13 +130,8 @@ function createPutOperationFactory({
       const extraBody = await (setBody == null ? void 0 : setBody(
         req
       )) || {};
-      const params = {
-        // 「谁改的」与「能不能改」是两件事，所以这里自己取一次 —— 取值器带缓存，
-        // 上面 resolveAccess 若已取过就不会再往返一次。
-        editorId: (_a = await loadSession()) == null ? void 0 : _a.userId,
-        ...body,
-        ...extraBody
-      };
+      const editorId = (_a = await loadSession()) == null ? void 0 : _a.userId;
+      const params = { ...body, ...extraBody, editorId };
       const raw = table && db ? await createAction({
         bodySchema: schemas.body,
         db,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai0x0/utils",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "AI0x0 utils",
   "keywords": [
     "ai0x0"