@appweaver/core 1.1.6 → 1.2.0

package/resource/utils/relation-util.js

@@ -0,0 +1,344 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mapRelationInclusions = mapRelationInclusions;
+exports.mapRelationActions = mapRelationActions;
+exports.relationWriteData = relationWriteData;
+exports.missingRelationFields = missingRelationFields;
+exports.createdByConnect = createdByConnect;
+const common_1 = require("@appweaver/common");
+const context_1 = require("../../context");
+const security_1 = require("../../security");
+const errors_1 = require("../../errors");
+/**
+ * Builds the Prisma `include` clause for the relation and file fields of a resource model. A field is included when
+ * its configured output type allows it for the given action, or always when no action is specified, and the relations
+ * configured with an output count contribute to the `_count` selection instead.
+ *
+ * @param {string} resourceName - The name of the model whose relations are included.
+ * @param {ActionType} [action] - The action the inclusions are built for, matched against the configured output type
+ * of every field. When omitted, all fields whose output type is not `none` are included.
+ * @return {Object} The `include` clause mapping each included field to `true` or to its own nested `include` clause,
+ * extended with a `_count` selection for the relations configured with an output count.
+ */
+function mapRelationInclusions(resourceName, action) {
+    const inclusion = {};
+    const resourceModel = (0, context_1.injectModel)(resourceName);
+    const relationConfig = resourceModel.config.relations;
+    const fileConfig = resourceModel.config.files;
+    const relationModelProps = (0, common_1.extractSchemaProperties)(resourceModel.relationsModel);
+    const fileModelProps = (0, common_1.extractSchemaProperties)(resourceModel.filesModel);
+    // Add relation and file fields to the inclusion map if the include type is
+    // satisfied or the requested action is not specified. Also, add the count
+    // aggregation actions for relations if configured.
+    for (const key of Object.keys({
+        ...relationModelProps,
+        ...fileModelProps
+    })) {
+        const relationField = relationConfig?.[key] || fileConfig?.[key];
+        if (relationField?.output?.count) {
+            inclusion._count = inclusion._count ?? { select: {} };
+            inclusion._count.select[key] = true;
+        }
+        // Check if the relation should be included based on the output type
+        if (shouldIncludeRelation(relationField?.output?.type, action)) {
+            inclusion[key] = buildNestedInclusion(relationField, action);
+        }
+    }
+    return inclusion;
+}
+/**
+ * Maps the relation and file fields of a write payload to the Prisma nested write actions. Bare key values and arrays
+ * of them are normalized to objects first, then every item is classified: items with an id and additional data become
+ * inline updates when the parent action is an update and inline updates are enabled for the relation, items with only
+ * an id are connected, and items without an id are created inline or matched through a connect-or-create when
+ * `input.uniqueKey` is configured. On an update action, the items of the current record that are absent from the new
+ * value, as well as the relations set to null, are disconnected, or deleted when `orphanRemoval` is configured.
+ * Relations that were not loaded on the current record are left untouched.
+ *
+ * @param {string} resourceName - The name of the model the write payload belongs to.
+ * @param {'create'|'update'} action - The write action the relation actions are mapped for. Inline updates and the
+ * removal of the relations absent from the new value are only applied on an update action.
+ * @param {Object} data - The sanitized write payload whose relation and file fields are mapped. The non-relation
+ * fields are skipped, except for the null values of the array scalar fields, which are mapped to an empty array on an
+ * update action and to undefined on a create action.
+ * @param {Object} [currentData] - The currently stored record with its relations loaded, required on an update action
+ * to determine which relations to disconnect or delete.
+ * @return {RelationActions} The nested write clause per relation field, mapping each one to its `connect`, `create`,
+ * `update`, `connectOrCreate`, `disconnect` and `delete` actions, or to undefined for the relations no action can be
+ * applied to.
+ * @throws {HttpError} 400 if an inline create payload is missing required fields, or if the relation accepts no new
+ * records and an id was not provided.
+ */
+function mapRelationActions(resourceName, action, data, currentData) {
+    const relations = {};
+    const resourceModel = (0, context_1.injectModel)(resourceName);
+    const readModel = resourceModel.readModel;
+    const relationsModel = resourceModel.relationsModel;
+    const relationsConfig = resourceModel.config.relations;
+    for (const key in data) {
+        let value = data[key];
+        const relationSchema = (0, common_1.extractSchemaProperties)(relationsModel, key);
+        if (!relationSchema) {
+            // Set empty array or undefined value for null array type fields
+            if (value === null) {
+                if ((0, common_1.extractSchemaProperties)(readModel, key)?.type === 'array') {
+                    relations[key] = action === 'update' ? [] : undefined;
+                }
+                else if (action === 'create') {
+                    relations[key] = undefined;
+                }
+            }
+            // Skip mapping for non-relation fields
+            continue;
+        }
+        const config = relationsConfig?.[key];
+        // The unique key is only used to match existing records for the
+        // connect-or-create action; connect and inline update always use the id
+        const uniqueKey = config?.input?.allowCreate
+            ? config?.input?.uniqueKey || 'id'
+            : 'id';
+        const isArrayType = relationSchema.type === 'array';
+        // Normalize array values to single values if a value type is not an array
+        if (!isArrayType && (0, common_1.isArray)(value)) {
+            value = value[0];
+        }
+        // Set null values to undefined value for create actions. On update action
+        // they will be returned as disconnected relations.
+        if (action === 'create' && value === null) {
+            relations[key] = undefined;
+            continue;
+        }
+        // Normalize plain key values or arrays to object values
+        if (isArrayType) {
+            if ((0, common_1.isArray)(value) && !(0, common_1.isPlainObject)(value[0])) {
+                value = value.map((v) => ({
+                    [uniqueKey]: v
+                }));
+            }
+        }
+        else if (!(0, common_1.isObject)(value)) {
+            // Only bare key values are wrapped. The loose object check keeps
+            // null values untouched, so they still map to a disconnect action.
+            value = { [uniqueKey]: value };
+        }
+        // Classify every relation input item into its relation write action:
+        // items with an id and additional data become inline updates (on parent
+        // update requests with inline updates enabled), items with only an id are
+        // connected, and items without an id are created inline or matched with
+        // connect-or-create, both of which require `allowCreate`
+        if (value) {
+            const items = isArrayType && (0, common_1.isArray)(value) ? value : [value];
+            const createdBy = createdByConnect(config?.model ?? resourceName);
+            const actions = {
+                connect: [],
+                update: [],
+                create: [],
+                connectOrCreate: []
+            };
+            for (const item of items) {
+                if (!(0, common_1.isPlainObject)(item)) {
+                    continue;
+                }
+                if (item.id !== undefined && item.id !== null) {
+                    const { id, ...itemData } = item;
+                    const updateData = relationWriteData(config?.model, 'update', itemData);
+                    if (action === 'update' &&
+                        config?.input?.allowUpdate &&
+                        Object.keys(updateData).length > 0) {
+                        actions.update.push({ where: { id }, data: updateData });
+                    }
+                    else {
+                        actions.connect.push({ id });
+                    }
+                }
+                else if (!config?.input?.allowCreate) {
+                    // Without inline creation the related record must already exist,
+                    // so it is created through its own endpoint first
+                    throw new errors_1.HttpError(`${resourceName} relation '${key}' does not accept new records, an id is required`, 400);
+                }
+                else {
+                    const createData = relationWriteData(config?.model, 'create', item);
+                    const missingFields = missingRelationFields(config?.model, createData);
+                    if (missingFields.length > 0) {
+                        throw new errors_1.HttpError(`${resourceName} relation '${key}' is missing required fields: ${missingFields.join(', ')}`, 400);
+                    }
+                    // A unique key matches an existing record before a new one is created
+                    if (config?.input?.uniqueKey) {
+                        actions.connectOrCreate.push({
+                            where: { [uniqueKey]: item[uniqueKey] },
+                            create: { ...createData, createdBy }
+                        });
+                    }
+                    else {
+                        actions.create.push({ ...createData, createdBy });
+                    }
+                }
+            }
+            const relationActions = {};
+            for (const [actionName, actionItems] of Object.entries(actions)) {
+                if (actionItems.length > 0) {
+                    relationActions[actionName] = isArrayType
+                        ? actionItems
+                        : actionItems[0];
+                }
+            }
+            if (Object.keys(relationActions).length > 0) {
+                relations[key] = relationActions;
+            }
+        }
+        // Map relation disconnects if keys are no longer present or the new
+        // value is null. Delete relations if orphanRemoval is set to true.
+        // Relations that are not set on the current resource are left untouched,
+        // so no relation action is applied for them.
+        if (action === 'update') {
+            const currentValue = currentData[key];
+            const removalMethod = config?.orphanRemoval ? 'delete' : 'disconnect';
+            if (currentValue && isArrayType) {
+                const newValueKeys = value?.map((v) => v[uniqueKey]) ?? [];
+                const currentValueKeys = currentValue
+                    .filter((v) => newValueKeys.indexOf(v[uniqueKey]) === -1)
+                    .map((v) => ({
+                    [uniqueKey]: v[uniqueKey]
+                }));
+                if (currentValueKeys.length > 0) {
+                    relations[key] = {
+                        [removalMethod]: currentValueKeys,
+                        ...(relations[key] ?? {})
+                    };
+                }
+            }
+            else if (currentValue && value === null) {
+                relations[key] = {
+                    [removalMethod]: { [uniqueKey]: currentValue[uniqueKey] },
+                    ...(relations[key] ?? {})
+                };
+            }
+            else if (currentValue === undefined) {
+                // The relation was not loaded on the current record, so no relation
+                // action can be applied safely
+                relations[key] = undefined;
+            }
+        }
+    }
+    return relations;
+}
+/**
+ * Restricts an inline relation payload to the fields the related model accepts for the given action. The request
+ * schema accepts the create and the update fields together, since the properties it does not declare are stripped
+ * before the request reaches the service, so the configured field restrictions of the related model are applied here
+ * instead.
+ *
+ * @param {string} [resourceName] - The name of the related model whose field restrictions are applied. When omitted,
+ * the payload is returned unchanged.
+ * @param {'create'|'update'} action - The write action the payload is restricted for, selecting either the relation
+ * create or the relation update model of the related resource.
+ * @param {Object} data - The inline relation payload to restrict.
+ * @return {Object} The payload reduced to the fields the related model accepts for the action, excluding the `id`
+ * field, or the payload unchanged if the related model declares no fields for it.
+ */
+function relationWriteData(resourceName, action, data) {
+    const resourceModel = resourceName
+        ? (0, context_1.injectModel)(resourceName, false)
+        : undefined;
+    const writeModel = action === 'create'
+        ? resourceModel?.relationCreateModel
+        : resourceModel?.relationUpdateModel;
+    const properties = (0, common_1.extractSchemaProperties)(writeModel);
+    if (!properties) {
+        return data;
+    }
+    return (0, common_1.pickProperties)(data, Object.keys(properties).filter((name) => name !== 'id'));
+}
+/**
+ * Lists the fields the related model requires on creation that the given inline relation payload does not provide.
+ *
+ * @param {string} [resourceName] - The name of the related model whose required fields are checked. When omitted, no
+ * fields are reported as missing.
+ * @param {Object} data - The inline relation payload to check.
+ * @return {string[]} The names of the fields the related model requires on creation that the payload leaves
+ * undefined, or an empty list if the related model declares no create schema.
+ */
+function missingRelationFields(resourceName, data) {
+    const resourceModel = resourceName
+        ? (0, context_1.injectModel)(resourceName, false)
+        : undefined;
+    const createModel = resourceModel?.relationCreateModel;
+    if (!createModel) {
+        return [];
+    }
+    const schema = createModel['$ref']
+        ? createModel['$defs']?.[createModel['$ref']]
+        : createModel;
+    return (schema?.required ?? []).filter((name) => data[name] === undefined);
+}
+/**
+ * Builds the connect action for the `createdBy` audit relation of a resource, pointing at the currently authenticated
+ * user. Returns undefined when the model does not audit the `createdById` field or when no user is authenticated.
+ *
+ * @param {string} resourceName - The name of the model the audit relation is built for.
+ * @return {{connect: {id: number}}|undefined} The connect action pointing at the id of the currently authenticated
+ * user, or undefined if the model does not audit the `createdById` field or no user is authenticated.
+ */
+function createdByConnect(resourceName) {
+    const resourceModel = (0, context_1.injectModel)(resourceName, false);
+    if (resourceModel?.config.audit?.createdById === false) {
+        return undefined;
+    }
+    const currentUser = (0, security_1.currentAuthUser)();
+    return currentUser
+        ? {
+            connect: {
+                id: currentUser.id
+            }
+        }
+        : undefined;
+}
+/**
+ * Resolves the inclusion value of a single relation field by walking its configured nested output includes
+ * recursively. Returns `true` when the relation has no nested includes to apply for the given action, or a nested
+ * `include` clause otherwise.
+ *
+ * @param {RelationField} relationField - The configuration of the relation whose inclusion value is resolved, read
+ * from its `output.include` property.
+ * @param {ActionType} [action] - The action the inclusions are built for, matched against the configured output type
+ * of every nested relation.
+ * @return {boolean|Object} True if the relation has no nested relations to include for the given action, or the
+ * nested `include` clause otherwise.
+ */
+function buildNestedInclusion(relationField, action) {
+    const nestedIncludeConfig = relationField?.output?.include;
+    if (!nestedIncludeConfig || Object.keys(nestedIncludeConfig).length === 0) {
+        return true;
+    }
+    const nestedInclusion = {};
+    for (const [nestedKey, nestedOutput] of Object.entries(nestedIncludeConfig)) {
+        // Check if the nested relation should be included
+        if (shouldIncludeRelation(nestedOutput?.type, action)) {
+            // Recursively build nested inclusions
+            nestedInclusion[nestedKey] = buildNestedInclusion({ output: nestedOutput }, action);
+        }
+    }
+    return Object.keys(nestedInclusion).length > 0
+        ? { include: nestedInclusion }
+        : true;
+}
+/**
+ * Decides whether a relation with the given configured output type is included for the given action. The `none` type
+ * is never included, the `single` type is excluded from the query action, and the `multiple` type is only included on
+ * the query action or when no action is specified.
+ *
+ * @param {OutputType} [outputType] - The configured output type of the relation. When omitted, the relation is
+ * included for every action.
+ * @param {ActionType} [action] - The action the relation would be included for. When omitted, every output type
+ * except `none` is included.
+ * @return {boolean} True if the relation should be included, false otherwise.
+ */
+function shouldIncludeRelation(outputType, action) {
+    if (outputType === 'none') {
+        return false;
+    }
+    if (outputType === 'single' && action === 'query') {
+        return false;
+    }
+    return !(outputType === 'multiple' && action && action !== 'query');
+}

package/resource/utils/sort-util.d.ts

@@ -0,0 +1,20 @@
+import { ActionType, QuerySort } from '@appweaver/common';
+/**
+ * Maps a sort input to the ordered list of Prisma `orderBy` entries. The input is accepted either as a comma-separated
+ * field list, where a field prefixed with `-` is sorted in descending order, or as a (possibly nested) object of `asc`
+ * and `desc` field directions. Both forms support the same field paths: a scalar field of the
+ * model, a field of a to-one relation (`author.createdAt` or `{ author: { createdAt: 'desc' } }`), and the related
+ * record count of a to-many relation, given either as its count field (`tagsCount`) or as the relation itself
+ * (`tags`). The default `createdAt` sort is dropped when the model does not audit that field.
+ *
+ * @param {QuerySort} sort - The sort input to map, as a comma-separated field list or a sort object.
+ * @param {string} resourceName - The name of the model the sort is applied on.
+ * @param {ActionType} [action] - The action the sort is applied on, deciding which relations are included in the
+ * response and are therefore available to sort by. Defaults to the query action.
+ * @return {Object[]} One `orderBy` entry per field, in the order the fields were listed, each holding the single path
+ * of that field mapped to `asc` or `desc`. Two fields of the same relation get an entry each, since a database order
+ * entry accepts a single field path.
+ * @throws {HttpError} 400 if a field does not exist on its model, cannot be sorted by, is given an unknown sort
+ * direction, or targets a relation that the action does not include in its response.
+ */
+export declare function mapSortValues(sort: QuerySort, resourceName: string, action?: ActionType): any[];

package/resource/utils/sort-util.js

@@ -0,0 +1,218 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mapSortValues = mapSortValues;
+const common_1 = require("@appweaver/common");
+const context_1 = require("../../context");
+const errors_1 = require("../../errors");
+const relation_util_1 = require("./relation-util");
+/** The audit fields every model declares unless it opts out of them. */
+const defaultAuditFields = {
+    updatedAt: true,
+    createdAt: true,
+    createdById: true
+};
+/**
+ * Maps a sort input to the ordered list of Prisma `orderBy` entries. The input is accepted either as a comma-separated
+ * field list, where a field prefixed with `-` is sorted in descending order, or as a (possibly nested) object of `asc`
+ * and `desc` field directions. Both forms support the same field paths: a scalar field of the
+ * model, a field of a to-one relation (`author.createdAt` or `{ author: { createdAt: 'desc' } }`), and the related
+ * record count of a to-many relation, given either as its count field (`tagsCount`) or as the relation itself
+ * (`tags`). The default `createdAt` sort is dropped when the model does not audit that field.
+ *
+ * @param {QuerySort} sort - The sort input to map, as a comma-separated field list or a sort object.
+ * @param {string} resourceName - The name of the model the sort is applied on.
+ * @param {ActionType} [action] - The action the sort is applied on, deciding which relations are included in the
+ * response and are therefore available to sort by. Defaults to the query action.
+ * @return {Object[]} One `orderBy` entry per field, in the order the fields were listed, each holding the single path
+ * of that field mapped to `asc` or `desc`. Two fields of the same relation get an entry each, since a database order
+ * entry accepts a single field path.
+ * @throws {HttpError} 400 if a field does not exist on its model, cannot be sorted by, is given an unknown sort
+ * direction, or targets a relation that the action does not include in its response.
+ */
+function mapSortValues(sort, resourceName, action = 'query') {
+    const inclusions = (0, relation_util_1.mapRelationInclusions)(resourceName, action);
+    const orderBy = [];
+    const mappedPaths = new Set();
+    for (const [path, direction] of sortEntries(sort)) {
+        const mappedPath = mapSortPath(resourceName, path, inclusions);
+        // Every field gets an entry of its own, since a database order entry holds
+        // a single field path, even when several of them share a relation. A field
+        // listed twice is already ordered by its first entry, so it is dropped
+        if (!mappedPath || mappedPaths.has(mappedPath)) {
+            continue;
+        }
+        mappedPaths.add(mappedPath);
+        orderBy.push((0, common_1.setValue)({}, mappedPath, direction));
+    }
+    return orderBy;
+}
+/**
+ * Flattens a sort input into the list of its field paths and directions, keeping the order the fields were declared
+ * in. String inputs are split on commas, with a `-` or `+` prefix selecting the direction, and object inputs are
+ * walked recursively, joining the nested keys with a dot.
+ *
+ * @param {QuerySort} sort - The sort input to flatten.
+ * @param {string} [parentPath] - The dot notation path of the object the walk descended from.
+ * @return {SortEntry[]} The flattened sort entries, each holding a dot notation field path and its direction.
+ * @throws {HttpError} 400 if a sort value is neither a direction nor a nested object of directions.
+ */
+function sortEntries(sort, parentPath = '') {
+    if ((0, common_1.isString)(sort)) {
+        return sort
+            .split(',')
+            .map((part) => part.trim())
+            .filter((part) => part.length > 0 && part !== '-' && part !== '+')
+            .map((part) => [
+            part.replace(/^[-+]/, ''),
+            part.startsWith('-') ? 'desc' : 'asc'
+        ]);
+    }
+    if (!(0, common_1.isPlainObject)(sort)) {
+        throw new errors_1.HttpError(`Invalid sort value${parentPath ? ` for the '${parentPath}' field` : ''}, ` +
+            'expected a field list string or a sort object', 400);
+    }
+    const entries = [];
+    for (const [field, value] of Object.entries(sort)) {
+        if (value === undefined || value === null) {
+            continue;
+        }
+        const path = parentPath ? `${parentPath}.${field}` : field;
+        if ((0, common_1.isPlainObject)(value)) {
+            entries.push(...sortEntries(value, path));
+            continue;
+        }
+        if (value !== 'asc' && value !== 'desc') {
+            throw new errors_1.HttpError(`Invalid sort direction '${value}' for the '${path}' field, expected 'asc' or 'desc'`, 400);
+        }
+        entries.push([path, value]);
+    }
+    return entries;
+}
+/**
+ * Resolves a single sort field path against the model it is applied on, validating every segment and rewriting the
+ * relation counts to their `_count` form. Relation segments are additionally checked against the relations the action
+ * includes in its response, since a relation that is not included cannot be sorted by.
+ *
+ * @param {string} resourceName - The name of the model the path starts at.
+ * @param {string} path - The dot notation field path to resolve.
+ * @param {Object} inclusions - The `include` clause of the action, as built by {@link mapRelationInclusions}.
+ * @return {string|undefined} The resolved dot notation path, or undefined when the field is the `createdAt` audit
+ * field of a model that does not audit it, in which case the sort entry is dropped.
+ * @throws {HttpError} 400 if a segment does not exist on its model, cannot be sorted by, or targets a relation the
+ * action does not include in its response.
+ */
+function mapSortPath(resourceName, path, inclusions) {
+    const segments = path.split('.').filter((segment) => segment.length > 0);
+    const mappedSegments = [];
+    let modelName = resourceName;
+    let modelInclusions = inclusions;
+    for (const [index, field] of segments.entries()) {
+        const model = (0, context_1.injectModel)(modelName, false);
+        if (!model) {
+            throw new errors_1.HttpError(`Cannot sort by the '${path}' field, the '${modelName}' model is not loaded`, 400);
+        }
+        const isLast = index === segments.length - 1;
+        const relation = relationField(model, field);
+        // A scalar field ends the path, so it is the only segment a relation of the
+        // same name cannot shadow
+        if (!relation && isScalarField(model, field)) {
+            if (!isLast) {
+                throw new errors_1.HttpError(`Cannot sort by the '${path}' field, '${field}' is not a relation of the ${model.name} model`, 400);
+            }
+            // The default sort still names the createdAt field on the models that do
+            // not audit it, so the entry is dropped instead of rejected
+            if (field === 'createdAt' && model.config.audit?.createdAt === false) {
+                return undefined;
+            }
+            mappedSegments.push(field);
+            break;
+        }
+        // A count field sorts by the number of related records, which the database
+        // orders by through the _count aggregation of the relation
+        if (!relation && isLast && (0, common_1.isCountField)(field)) {
+            const countedField = field.slice(0, -'Count'.length);
+            const countedRelation = relationField(model, countedField);
+            if (countedRelation && isFieldArray(countedRelation)) {
+                mappedSegments.push(countedField, '_count');
+                break;
+            }
+        }
+        if (!relation) {
+            throw new errors_1.HttpError(`Cannot sort by the '${path}' field, '${field}' is not a sortable field of the ${model.name} model`, 400);
+        }
+        // A to-many relation holds no single value to sort by, so it is sorted by
+        // the number of its related records instead
+        if (isFieldArray(relation)) {
+            if (!isLast) {
+                throw new errors_1.HttpError(`Cannot sort by the '${path}' field, the '${field}' relation holds a list of records, ` +
+                    `sort by the '${(0, common_1.countFieldName)(field)}' field instead`, 400);
+            }
+            mappedSegments.push(field, '_count');
+            break;
+        }
+        if (isLast) {
+            throw new errors_1.HttpError(`Cannot sort by the '${path}' field, the '${field}' relation requires a nested field to sort by`, 400);
+        }
+        const inclusion = modelInclusions?.[field];
+        if (!inclusion) {
+            throw new errors_1.HttpError(`Cannot sort by the '${path}' field, the '${field}' relation is not included in the response`, 400);
+        }
+        mappedSegments.push(field);
+        modelName = (0, common_1.capitalize)(relatedModelName(model, field));
+        modelInclusions = (0, common_1.isPlainObject)(inclusion) ? inclusion.include : undefined;
+    }
+    return mappedSegments.join('.');
+}
+/**
+ * Reads the relation or file field configuration of a model field.
+ *
+ * @param {ResourceModel} model - The model the field belongs to.
+ * @param {string} field - The name of the field to read.
+ * @return {RelationField|FileField|undefined} The relation or file configuration of the field, or undefined when the
+ * field is not a relation.
+ */
+function relationField(model, field) {
+    return model.config.relations?.[field] ?? model.config.files?.[field];
+}
+/**
+ * Resolves the model name a relation or file field of a model points at.
+ *
+ * @param {ResourceModel} model - The model the relation belongs to.
+ * @param {string} field - The name of the relation field.
+ * @return {string} The name of the related model, which is always `File` for a file field.
+ */
+function relatedModelName(model, field) {
+    return model.config.relations?.[field]?.model ?? 'File';
+}
+/**
+ * Determines whether a relation or file field holds a list of related records, which can only be sorted by their
+ * count.
+ *
+ * @param {RelationField|FileField} field - The relation or file field configuration.
+ * @return {boolean} True when the field holds a list of related records.
+ */
+function isFieldArray(field) {
+    return 'model' in field ? (0, common_1.isRelationArray)(field) : field.array === true;
+}
+/**
+ * Determines whether a model field is a scalar column the database can sort by. The id and the audited fields are
+ * always sortable, the configured scalars are sortable unless they are hidden or hold a list of values, and the
+ * virtual fields are never sortable, since they have no column of their own.
+ *
+ * @param {ResourceModel} model - The model the field belongs to.
+ * @param {string} field - The name of the field to check.
+ * @return {boolean} True when the field can be sorted by.
+ */
+function isScalarField(model, field) {
+    if (field === 'id') {
+        return true;
+    }
+    const auditFields = { ...defaultAuditFields, ...(model.config.audit ?? {}) };
+    if (field in auditFields) {
+        // The createdAt field of a model that does not audit it is still accepted,
+        // so the default sort value does not have to be adjusted per model
+        return auditFields[field] === true || field === 'createdAt';
+    }
+    const scalar = model.config.scalars?.[field];
+    return !!scalar && !scalar.hidden && scalar.array !== true;
+}

package/security/create-auth-resources.js

@@ -58,7 +58,7 @@ function createAuthModel(config) {
     const authModelRelations = {
         roles: {
             model: 'Role',
-            array: true,
+            type: 'manyToMany',
             input: {
                 type: 'all'
             },
@@ -75,8 +75,8 @@ function createAuthModel(config) {
             ? {
                 apiKeys: {
                     model: 'ApiKey',
+                    type: 'oneToMany',
                     mappedBy: (0, common_1.uncapitalize)(config.name),
-                    array: true,
                     input: {
                         type: 'none'
                     },

package/security/helper.js

@@ -244,7 +244,7 @@ function checkScopeAccess(url, authScope) {
     const securityPrefix = common_1.config.SECURITY_ROUTE_PREFIX.replace(/\/$/, '');
     const accountPrefix = common_1.config.SECURITY_ACCOUNT_ROUTE_PREFIX.replace(/\/$/, '');
     const refreshPath = `${securityPrefix}/refresh`;
-    const twoFASendPath = `${accountPrefix}/2fa-send-code`;
+    const twoFASendPath = `${accountPrefix}/send-2fa-code`;
     const twoFAVerifyPath = `${accountPrefix}/verify-2fa-code`;
     const scopeConfigs = [
         {

package/security/resources/api-key/model.js

@@ -41,6 +41,7 @@ exports.default = shouldCreateModel
                 relations: {
                     [(0, common_1.uncapitalize)(authModel.name)]: {
                         model: authModel.name,
+                        type: 'oneToMany',
                         mappedBy: 'apiKeys',
                         owner: true,
                         input: {

package/security/resources/api-key/service.d.ts

@@ -1,3 +1,3 @@
 import { ApiKey } from '../../../types';
-declare const _default: import("@appweaver/common").Ctor<import("../../..").ResourceService<ApiKey, ApiKey, ApiKey, any, any>> | undefined;
+declare const _default: import("@appweaver/common").Ctor<import("../../..").ResourceService<ApiKey, ApiKey, ApiKey, any, import("@appweaver/common").QueryFilter<ApiKey>>> | undefined;
 export default _default;

package/security/resources/role/model.js

@@ -13,7 +13,7 @@ exports.default = (0, factory_1.createModel)({
     relations: {
         permissions: {
             model: 'Permission',
-            array: true
+            type: 'manyToMany'
         }
     },
     read: {

package/server/create-server.js

@@ -45,7 +45,10 @@ function createServer() {
     const server = (0, fastify_1.default)({
         ajv: {
             customOptions: {
-                removeAdditional: 'all'
+                removeAdditional: 'all',
+                // Query filter schemas declare plain values as a list of accepted
+                // primitive types, so the validator does not coerce them
+                allowUnionTypes: true
             },
             plugins: [(ajv) => ajv.addKeyword('example')]
         },

package/server/register-route.js

@@ -16,6 +16,7 @@ function registerRoute(handler, config) {
     const tempServer = (0, fastify_1.default)({
         logger: false,
         ajv: {
+            customOptions: { allowUnionTypes: true },
             plugins: [(ajv) => ajv.addKeyword('example')]
         }
     });