@delmaredigital/payload-experiments 0.2.0-rc.2 → 0.2.0-rc.3

package/dist/endpoints/preflight.js

@@ -1,7 +1,8 @@
 import { preflightData } from '../transitions/preflightData.js';
+import { routeId } from './routeId.js';
 export async function handlePreflight(req, ctx, dependencies) {
-    const id = req.routeParams?.id;
-    const result = typeof id === 'string' || typeof id === 'number' ? await preflightData(req, {
+    const id = routeId(req);
+    const result = id !== undefined ? await preflightData(req, {
         experimentId: id,
         options: ctx.options
     }, dependencies) : null;

package/dist/endpoints/previewToken.js

@@ -1,4 +1,5 @@
 import { signPreviewToken } from '../runtime/previewToken.js';
+import { routeId } from './routeId.js';
 export async function handlePreviewToken(req, { options }) {
     const headers = {
         'Cache-Control': 'no-store'
@@ -14,8 +15,8 @@ export async function handlePreviewToken(req, { options }) {
             status,
             headers
         });
-    const id = req.routeParams?.id;
-    if (typeof id !== 'string' && typeof id !== 'number') return refuse(404, 'not-found', 'Experiment not found');
+    const id = routeId(req);
+    if (id === undefined) return refuse(404, 'not-found', 'Experiment not found');
     const result = await req.payload.find({
         collection: 'xp-experiments',
         req,

package/dist/endpoints/recompute.js

@@ -1,8 +1,9 @@
 import { runResults } from '../server/runResults.js';
 import { readSnapshots, resultsError } from './results.js';
+import { routeId } from './routeId.js';
 export async function handleRecompute(req, _ctx) {
-    const id = req.routeParams?.id;
-    if (typeof id !== 'string' && typeof id !== 'number') return resultsError(404, 'not-found', 'Experiment not found');
+    const id = routeId(req);
+    if (id === undefined) return resultsError(404, 'not-found', 'Experiment not found');
     const { docs } = await req.payload.find({
         collection: 'xp-experiments',
         req,

package/dist/endpoints/results.js

@@ -1,5 +1,6 @@
 import { resultsMetadata, newestSnapshotIds } from '../db/snapshots.js';
 import { pooledExecutor } from '../db/executor.js';
+import { routeId } from './routeId.js';
 const headers = {
     'Cache-Control': 'no-store'
 };
@@ -52,8 +53,8 @@ export async function readSnapshots(req, ids, { per = 'phase', decisionId, serie
         }));
 }
 export async function handleResults(req, _ctx) {
-    const id = req.routeParams?.id;
-    if (typeof id !== 'string' && typeof id !== 'number') return resultsError(404, 'not-found', 'Experiment not found');
+    const id = routeId(req);
+    if (id === undefined) return resultsError(404, 'not-found', 'Experiment not found');
     const params = new URL(req.url ?? 'http://localhost').searchParams;
     const selected = params.get('phase');
     if (selected !== null && (!/^\d+$/.test(selected) || !Number.isSafeInteger(Number(selected)) || Number(selected) < 1)) return resultsError(400, 'invalid-body', 'Choose a valid round');

package/dist/endpoints/routeId.d.ts

@@ -0,0 +1,5 @@
+import type { PayloadRequest } from 'payload';
+import type { DocId } from '../types/contracts.js';
+/** Match Payload's relationship ID type before passing an HTTP ID to Local API or SQL. */
+export declare function experimentId(req: PayloadRequest, value: unknown): DocId | undefined;
+export declare function routeId(req: PayloadRequest): DocId | undefined;

package/dist/endpoints/routeId.js

@@ -0,0 +1,13 @@
+/** Match Payload's relationship ID type before passing an HTTP ID to Local API or SQL. */ export function experimentId(req, value) {
+    if (typeof value !== 'string' && typeof value !== 'number') return undefined;
+    const id = String(value);
+    const idType = req.payload.collections?.['xp-experiments']?.customIDType ?? req.payload.db.defaultIDType;
+    if (idType !== 'number') return id;
+    if (!/^\d+$/.test(id)) return undefined;
+    const number = Number(id);
+    // Payload's Postgres serial ids are int4; larger values would reach SQL and fail with 22003.
+    return Number.isSafeInteger(number) && number <= 2_147_483_647 ? number : undefined;
+}
+export function routeId(req) {
+    return experimentId(req, req.routeParams?.id);
+}

package/dist/endpoints/summary.js

@@ -1,27 +1,40 @@
 import { checkStart } from '../transitions/checkStart.js';
 import { loadStartInputsBatch } from '../transitions/preflightData.js';
 import { readSnapshots, resultsError } from './results.js';
+import { experimentId } from './routeId.js';
 export async function handleSummary(req, { options }) {
     let ids;
     try {
-        // Split before decoding: an opaque id can itself contain a comma.
-        const raw = new URL(req.url ?? 'http://localhost').search.slice(1).split('&').find((part)=>part.split('=')[0] === 'ids')?.slice(4);
-        if (raw === undefined) return resultsError(400, 'invalid-body', 'Provide experiment ids');
-        ids = raw.split(',').map((id)=>decodeURIComponent(id.replaceAll('+', ' ')));
+        const url = new URL(req.url ?? 'http://localhost');
+        // URLSearchParams tolerates malformed escapes; preserve the existing parse refusal.
+        decodeURIComponent(url.search.replaceAll('+', ' '));
+        const values = url.searchParams.getAll('ids');
+        if (values.length === 0) return resultsError(400, 'invalid-body', 'Provide experiment ids');
+        ids = values.flatMap((value)=>value.split(',')).map((id)=>id.trim()).filter(Boolean);
     } catch  {
         return resultsError(400, 'invalid-body', 'Could not parse experiment ids');
     }
     if (ids.length > 100) return resultsError(422, 'too-many-ids', 'Request at most 100 experiments');
-    if (ids.some((id)=>!id.trim())) return resultsError(422, 'invalid-ids', 'Experiment ids must be nonempty');
-    const snapshots = await readSnapshots(req, [
-        ...new Set(ids)
-    ], {
-        per: 'experiment'
+    if (ids.length === 0) return resultsError(422, 'invalid-ids', 'Experiment ids must be nonempty');
+    const requested = ids.flatMap((key)=>{
+        const id = experimentId(req, key);
+        return id === undefined ? [] : [
+            {
+                key,
+                id
+            }
+        ];
     });
+    const uniqueIds = [
+        ...new Set(requested.map(({ id })=>id))
+    ];
+    const snapshots = uniqueIds.length ? await readSnapshots(req, uniqueIds, {
+        per: 'experiment'
+    }) : [];
     const response = Object.create(null);
-    for (const id of ids){
-        const snapshot = snapshots.find((row)=>String(typeof row.experiment === 'object' ? row.experiment.id : row.experiment) === id)?.snapshot;
-        response[id] = snapshot ? {
+    for (const { key, id } of requested){
+        const snapshot = snapshots.find((row)=>String(typeof row.experiment === 'object' ? row.experiment.id : row.experiment) === String(id))?.snapshot;
+        response[key] = snapshot ? {
             exposures: snapshot.exposures.total,
             days: Math.max(0, (Date.parse(snapshot.window.to) - Date.parse(snapshot.window.from)) / 86_400_000),
             verdict: {
@@ -35,7 +48,7 @@ export async function handleSummary(req, { options }) {
         };
     }
     try {
-        if (await options.access.manage({
+        if (uniqueIds.length && await options.access.manage({
             req
         }) === true) {
             const found = await req.payload.find({
@@ -44,26 +57,24 @@ export async function handleSummary(req, { options }) {
                 overrideAccess: false,
                 depth: 0,
                 pagination: false,
-                limit: ids.length,
+                limit: uniqueIds.length,
                 where: {
                     id: {
-                        in: [
-                            ...new Set(ids)
-                        ]
+                        in: uniqueIds
                     }
                 }
             });
             const drafts = found.docs.filter((e)=>e.status === 'draft' || e.status === 'stopped');
             const inputs = await loadStartInputsBatch(req, options, drafts, true);
-            for (const id of ids){
+            for (const { key, id } of requested){
                 // Payload normalises numeric ids (for example 01 to 1); preserve the requested response key.
-                const experiment = drafts.find((e)=>String(e.id) === id || typeof e.id === 'number' && Number(id) === e.id);
+                const experiment = drafts.find((e)=>String(e.id) === String(id));
                 if (!experiment) continue;
                 const input = inputs.get(String(experiment.id));
                 try {
-                    response[id].ready = !!input && checkStart(input).every((check)=>check.ok);
+                    response[key].ready = !!input && checkStart(input).every((check)=>check.ok);
                 } catch  {
-                    response[id].ready = false;
+                    response[key].ready = false;
                 }
             }
         }

package/dist/endpoints/transitions.js

@@ -7,6 +7,7 @@ import { decide } from '../transitions/decide.js';
 import { releaseHoldout } from '../transitions/releaseHoldout.js';
 import { makeContent } from '../transitions/makeContent.js';
 import { archive } from '../transitions/archive.js';
+import { routeId } from './routeId.js';
 const invalidBody = ()=>Response.json({
         errors: [
             {
@@ -30,8 +31,8 @@ async function body(req) {
 }
 const only = (value, keys)=>Object.keys(value).every((key)=>keys.includes(key));
 async function respond(req, action) {
-    const id = req.routeParams?.id;
-    if (typeof id !== 'string' && typeof id !== 'number') return Response.json({
+    const id = routeId(req);
+    if (id === undefined) return Response.json({
         errors: [
             {
                 code: 'not-found',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delmaredigital/payload-experiments",
-  "version": "0.2.0-rc.2",
+  "version": "0.2.0-rc.3",
   "description": "No-code A/B testing for Payload CMS and Next.js: block, page and flag experiments with holdouts, layers, exposure logging and honest statistics inside the admin — no vendor",
   "type": "module",
   "license": "MIT",