@dwtechs/antity 0.18.3 → 0.19.0

package/README.md

@@ -2,7 +2,7 @@
 [![License: MIT](https://img.shields.io/npm/l/@dwtechs/antity.svg?color=brightgreen)](https://opensource.org/licenses/MIT)
 [![npm version](https://badge.fury.io/js/%40dwtechs%2Fantity.svg)](https://www.npmjs.com/package/@dwtechs/antity)
 [![last version release date](https://img.shields.io/github/release-date/DWTechs/Antity.js)](https://www.npmjs.com/package/@dwtechs/antity)
-![Jest:coverage](https://img.shields.io/badge/Jest:coverage-75%25-brightgreen.svg)
+![Jest:coverage](https://img.shields.io/badge/Jest:coverage-79%25-brightgreen.svg)
 
 - [Synopsis](#synopsis)
 - [Support](#support)
@@ -45,7 +45,7 @@ $ npm i @dwtechs/antity
 import { Entity } from "@dwtechs/antity";
 import { normalizeName, normalizeNickname } from "@dwtechs/checkard";
 
-const entity = new Entity("consumers", [
+const entity = new Entity("users", [
   {
     key: "id",
     type: "integer",
@@ -89,7 +89,7 @@ const entity = new Entity("consumers", [
     max: 255,
     isTypeChecked: true,
     requiredFor: ["PUT"],
-    isPrivate: true,
+    isPrivate: false,
     sanitizer: null,
     normalizer: normalizeNickname,
     validator: null,
@@ -146,14 +146,15 @@ type Method = "PATCH" | "PUT" | "POST";
 class Property {
   key: string;
   type: Type;
-  min: number | Date | null;
-  max: number | Date | null;
+  min: number | Date;
+  max: number | Date;
   requiredFor: Method[];
   isPrivate: boolean;
   isTypeChecked: boolean;
   sanitizer: Function | null;
   normalizer: Function | null;
   validator: Function | null;
+  readOnly: boolean;
 };
 
 class Entity {
@@ -208,6 +209,28 @@ class Entity {
    * ```
    */
   getPropsByMethod(method: Method): Property[];
+
+  /**
+   * Builds a single Property instance from a plain field-definition object.
+   * Called once per entry of the `properties` array passed to the constructor.
+   *
+   * - Not meant to be called directly; override it in a subclass to build
+   *   your own `Property` subclass (e.g. a library adding its own fields)
+   *   while still reusing `Entity`'s constructor bookkeeping.
+   *
+   * @param {Record<string, unknown>} p - Plain field-definition object
+   * @returns {Property} The constructed Property instance
+   *
+   * @example
+   * ```typescript
+   * class MyEntity extends Entity {
+   *   protected createProperty(p: Record<string, unknown>): Property {
+   *     return new MyProperty(p.key, p.type, ..., p.myCustomField);
+   *   }
+   * }
+   * ```
+   */
+  protected createProperty(p: Record<string, unknown>): Property;
   
   /**
    * Normalizes an array of records by applying sanitization and normalization
@@ -219,7 +242,7 @@ class Entity {
    * - Calls next(error) on failure, next() on success
    *
    * @param {Request} req - Express request object containing rows
-   * @param {Response} _res - Express response object (not used)
+   * @param {Response} res - Express response object. Set `res.locals.allowReadOnly = true` beforehand to allow writing `readOnly` properties through this call.
    * @param {NextFunction} next - Express next function
    *
    * @returns {void}
@@ -240,7 +263,7 @@ class Entity {
    * });
    * ```
    */
-  normalizeArray: (req: Request, _res: Response, next: NextFunction) => void;
+  normalizeArray: (req: Request, res: Response, next: NextFunction) => void;
   
   /**
    * Normalizes a single record by applying sanitization and normalization
@@ -252,7 +275,7 @@ class Entity {
    * - Calls next(error) on failure, next() on success
    *
    * @param {Request} req - Express request object containing a single record
-   * @param {Response} _res - Express response object (not used)
+   * @param {Response} res - Express response object. Set `res.locals.allowReadOnly = true` beforehand to allow writing `readOnly` properties through this call.
    * @param {NextFunction} next - Express next function
    *
    * @returns {void}
@@ -273,7 +296,7 @@ class Entity {
    * });
    * ```
    */
-  normalizeOne: (req: Request, _res: Response, next: NextFunction) => void;
+  normalizeOne: (req: Request, res: Response, next: NextFunction) => void;
   
   /**
    * Validates an array of rows according to property config and HTTP method.
@@ -282,7 +305,7 @@ class Entity {
    * - Calls next(error) on failure, next() on success
    *
    * @param {Request} req - Express request object containing rows
-   * @param {Response} _res - Express response object (not used)
+   * @param {Response} res - Express response object. Set `res.locals.allowReadOnly = true` beforehand to allow writing `readOnly` properties through this call.
    * @param {NextFunction} next - Express next function
    *
    * @returns {void}
@@ -302,7 +325,7 @@ class Entity {
    * });
    * ```
    */
-  validateArray: (req: Request, _res: Response, next: NextFunction) => void;
+  validateArray: (req: Request, res: Response, next: NextFunction) => void;
   
   /**
    * Validates a single record according to property config and HTTP method.
@@ -311,7 +334,7 @@ class Entity {
    * - Calls next(error) on failure, next() on success
    *
    * @param {Request} req - Express request object containing a single record
-   * @param {Response} _res - Express response object (not used)
+   * @param {Response} res - Express response object. Set `res.locals.allowReadOnly = true` beforehand to allow writing `readOnly` properties through this call.
    * @param {NextFunction} next - Express next function
    *
    * @returns {void}
@@ -331,7 +354,7 @@ class Entity {
    * });
    * ```
    */
-  validateOne: (req: Request, _res: Response, next: NextFunction) => void;
+  validateOne: (req: Request, res: Response, next: NextFunction) => void;
 
 ```
 **normalizeArray()**, **normalizeOne()**, **validateArray()**, and **validateOne()** methods are made to be used as Express.js middlewares.
@@ -371,23 +394,21 @@ Properties **min** and **max** of the password properties will override default
 
 ### Available options for a property
 
-Any of these can be passed into the options object for each function.
-
-| Name            | Type                     |               Description                        |  Default value  |  
-| :-------------- | :----------------------- | :----------------------------------------------- | :-------------- |
-| key             | string                   | Name of the property                             |
-| type            | Type                     | Type of the property                             |
-| min             | number \| Date           | Minimum value if applicable                      | 0 \| 1900-01-01
-| max             | number \| Date           | Maximum value if applicable                      | 999999999 \| 2200-12-31
-| requiredFor     | Methods[]                | Property is required for the listed methods only | [ "POST", "PUT", "PATCH" ]
-| isPrivate       | boolean                  | Property should not be sent in the response      | false
-| isTypeChecked   | boolean                  | Strict type check at validation                  | false
-| sanitizer       | ((v:any) => any) \| null | Custom sanitizer function                        | null
-| normalizer      | ((v:any) => any) \| null | Custom Normalizer function                       | null
-| validator       | ((v:any, min:number, max:number, typeCheck:boolean) => any) \| null         | Custom validator | null
-
-* *Min and max parameters are not used for boolean type*
-* *TypeCheck Parameter is not used for boolean, string and array types*
+Any of these can be passed into the options object for each function. **Behavior** describes exactly what `normalizeArray`/`normalizeOne`/`validateArray`/`validateOne` do with the property at runtime, depending on its value.
+
+| Name            | Type                     |  Default value  | Behavior |
+| :-------------- | :----------------------- | :-------------- | :------- |
+| key             | string                   |                  | Read/write key on each record. No behavior of its own. |
+| type            | Type                     |                  | When a value is present, selects the built-in type validator run during `validate()` — skipped entirely if `validator` is set. |
+| min             | number \| Date           | 0 \| 1900-01-01 | Passed to the `type` validator as a lower bound during `validate()`. Not used for `boolean`. |
+| max             | number \| Date           | 999999999 \| 2200-12-31 | Passed to the `type` validator as an upper bound during `validate()`. Not used for `boolean`. |
+| requiredFor     | Methods[]                | [ ]              | If the current HTTP method is in this list, `validate()` rejects the record with a 400 when the value is `null`/`undefined`. **Ignored when `readOnly` is `true`** (see below) — a `readOnly` field is never required. |
+| isPrivate       | boolean                  | false            | Not enforced by `normalize()`/`validate()`. When `true`, the key is added to `entity.privateProps` — your own response code is responsible for stripping it from output; antity.js never removes it itself. |
+| isTypeChecked   | boolean                  | false            | Passed to the `type` validator to toggle strict vs. lenient checking; the exact effect depends on `type` (e.g. a stricter locale/timezone allow-list). Not used for `boolean`, `string` or `array` types. |
+| readOnly        | boolean                  | false            | If `true`: `normalize()` **deletes** the key from the record before sanitizing/normalizing, and `validate()` **skips** it entirely (never required, never checked) — a client can never set it or trigger validation on it, whatever `requiredFor` says. Bypassed for one request by setting `res.locals.allowReadOnly = true` beforehand (trusted server-side writes only). If `false`, treated like any other property. |
+| sanitizer       | ((v:any) => any) \| null | null             | If set, `normalize()` calls it instead of the default sanitizer for any present (truthy) value. If `null`, the default trims strings — recursively for a plain object's string properties, per-element for an array. |
+| normalizer      | ((v:any) => any) \| null | null             | If set, `normalize()` calls it right after sanitizing, for any present (truthy) value. If `null`, no normalization step runs. |
+| validator       | ((v:any) => boolean) \| null | null | If set, `validate()` calls it instead of the built-in `type` validator for any present value: return `false` or throw to fail (a thrown error's message is included in the 400 response). If `null`, the built-in `type`/`min`/`max`/`isTypeChecked` validator runs. |
 
 
 ## Contributors

package/dist/antity.d.ts

@@ -24,88 +24,49 @@ SOFTWARE.
 https://github.com/DWTechs/Antity.js
 */
 
-import type { Request, Response, NextFunction } from 'express';
-declare const Methods: readonly ["PATCH", "PUT", "POST"];
-type Method = typeof Methods[number];
-type Type = 
-  "boolean" |
-  "string" |
-  "number" |
-  "integer" |
-  "float" |
-  "even" |
-  "odd" |
-  "positive" |
-  "negative" |
-  "powerOfTwo" |
-  "ascii" |
-  "array" |
-  "jwt" |
-  "symbol" |
-  "password" |
-  "email" |
-  "regex" |
-  "json" |
-  "ipAddress" |
-  "slug" |
-  "hexadecimal" |
-  "date" |
-  "timestamp" |
-  "function" |
-  "htmlElement" |
-  "htmlEventAttribute" |
-  "node" |
-  "object" |
-  "ansiEscapeCode" |
-  "locale" |
-  "timeZone";
+import { Request, Response, NextFunction } from 'express';
 
-declare class Entity {
-  private _name;
-  private _privateProps;
-  private _properties;
-  constructor(name: string, properties: Property[]);
-  get name(): string;
-  get privateProps(): string[];
-  get properties(): Property[];
-  set name(name: string);
-  getProp(key: string): Property | undefined;
-  getPropsByMethod(method: Method): Property[];
-  normalizeArray: (req: Request, _res: Response, next: NextFunction) => void;
-  normalizeOne: (req: Request, _res: Response, next: NextFunction) => void;
-  validateArray: (req: Request, _res: Response, next: NextFunction) => void;
-  validateOne: (req: Request, _res: Response, next: NextFunction) => void;
-}
+declare const METHODS: string[];
+
+type Type = "boolean" | "string" | "number" | "integer" | "float" | "even" | "odd" | "positive" | "negative" | "powerOfTwo" | "ascii" | "array" | "jwt" | "symbol" | "password" | "email" | "regex" | "json" | "ipAddress" | "slug" | "hexadecimal" | "date" | "timestamp" | "function" | "htmlElement" | "htmlEventAttribute" | "node" | "object" | "ansiEscapeCode" | "locale" | "timeZone";
+type Method = typeof METHODS[number];
 
 declare class Property {
-  [key: string]: unknown;
-  key: string;
-  type: Type;
-  min: number | Date | null;
-  max: number | Date | null;
-  isPrivate: boolean;
-  requiredFor: Method[];
-  isTypeChecked: boolean;
-  sanitizer: ((v: any) => any) | null;
-  normalizer: ((v: any) => any) | null;
-  validator: ((v: any) => any) | null;
-  constructor(
-    key: string,
-    type: Type,
-    min: number | Date | null,
-    max: number | Date | null,
-    isPrivate: boolean,
-    requiredFor: Method[],
-    isTypeChecked: boolean,
-    sanitizer: ((v: any) => any) | null,
-    normalizer: ((v: any) => any) | null,
-    validator: ((v: any) => any) | null
-  );
+    [key: string]: unknown;
+    key: string;
+    type: Type;
+    min: number | Date;
+    max: number | Date;
+    isPrivate: boolean;
+    requiredFor: Method[];
+    isTypeChecked: boolean;
+    readOnly: boolean;
+    sanitizer: ((v: any) => any) | null;
+    normalizer: ((v: any) => any) | null;
+    validator: ((v: any) => boolean) | null;
+    constructor(key: string, type: Type, min: number | Date | null, max: number | Date | null, isPrivate: boolean, requiredFor: Method[], isTypeChecked: boolean, readOnly: boolean, sanitizer: ((v: any) => any) | null, normalizer: ((v: any) => any) | null, validator: ((v: any) => boolean) | null);
+    private interval;
 }
 
-export type { Type, Method };
-export { 
-  Entity,
-  Property,
-};
+declare const STANDARD_PROP_KEYS: ReadonlySet<string>;
+declare class Entity {
+    private _name;
+    private _privateProps;
+    private _properties;
+    private _propsByMethod;
+    constructor(name: string, properties: Property[]);
+    protected createProperty(p: Record<string, unknown>): Property;
+    get name(): string;
+    get privateProps(): string[];
+    get properties(): Property[];
+    set name(name: string);
+    getProp(key: string): Property | undefined;
+    getPropsByMethod(method: Method): Property[];
+    normalizeArray: (req: Request, res: Response, next: NextFunction) => void;
+    normalizeOne: (req: Request, res: Response, next: NextFunction) => void;
+    validateArray: (req: Request, res: Response, next: NextFunction) => void;
+    validateOne: (req: Request, res: Response, next: NextFunction) => void;
+}
 
+export { Entity, Property, STANDARD_PROP_KEYS };
+export type { Method, Type };

package/dist/antity.js

@@ -24,7 +24,7 @@ SOFTWARE.
 https://github.com/DWTechs/Antity.js
 */
 
-import { isBoolean, isStringOfLength, isValidNumber, isValidInteger, isValidFloat, isEven, isOdd, isPositive, isNegative, isPowerOfTwo, isAscii, isArrayOfLength, isEmail, isRegex, isJson, isJWT, isSymbol, isIpAddress, isSlug, isHexadecimal, isValidDate, isValidTimestamp, isFunction, isHtmlElement, isHtmlEventAttribute, isNode, isObject, isAnsiEscapeCode, isLocale, isTimeZone, isString, isProperty, isArray, isIn, isDate, isNumber, isInteger, isNil } from '@dwtechs/checkard';
+import { isBoolean, isStringOfLength, isValidNumber, isValidInteger, isValidFloat, isEven, isOdd, isPositive, isNegative, isPowerOfTwo, isAscii, isArrayOfLength, isEmail, isRegex, isJson, isJWT, isSymbol, isIpAddress, isSlug, isHexadecimal, isValidDate, isValidTimestamp, isFunction, isHtmlElement, isHtmlEventAttribute, isNode, isObject, isAnsiEscapeCode, isLocale, isTimeZone, isString, isProperty, isArray, isIn, isDate, isNumber, isNil } from '@dwtechs/checkard';
 import { log } from '@dwtechs/winstan';
 import { isValidPassword } from '@dwtechs/passken';
 
@@ -46,34 +46,34 @@ const Types = {
         validate: (v, min, max, _typeCheck) => isStringOfLength(v, min, max, true)
     },
     number: {
-        validate: (v, min, max, typeCheck) => isValidNumber(v, min || undefined, max || undefined, typeCheck || undefined, true)
+        validate: (v, min, max, typeCheck) => isValidNumber(v, min, max, typeCheck, true)
     },
     integer: {
-        validate: (v, min, max, typeCheck) => isValidInteger(v, min ?? undefined, max ?? undefined, typeCheck || undefined, true)
+        validate: (v, min, max, typeCheck) => isValidInteger(v, min, max, typeCheck, true)
     },
     float: {
-        validate: (v, min, max, typeCheck) => isValidFloat(v, min || undefined, max || undefined, typeCheck || undefined, true)
+        validate: (v, min, max, typeCheck) => isValidFloat(v, min, max, typeCheck, true)
     },
     even: {
-        validate: (v, _min, _max, typeCheck) => isEven(v, typeCheck || undefined, true)
+        validate: (v, _min, _max, typeCheck) => isEven(v, typeCheck, true)
     },
     odd: {
-        validate: (v, _min, _max, typeCheck) => isOdd(v, typeCheck || undefined, true)
+        validate: (v, _min, _max, typeCheck) => isOdd(v, typeCheck, true)
     },
     positive: {
-        validate: (v, _min, _max, typeCheck) => isPositive(v, typeCheck || undefined, true)
+        validate: (v, _min, _max, typeCheck) => isPositive(v, typeCheck, true)
     },
     negative: {
-        validate: (v, _min, _max, typeCheck) => isNegative(v, typeCheck || undefined, true)
+        validate: (v, _min, _max, typeCheck) => isNegative(v, typeCheck, true)
     },
     powerOfTwo: {
-        validate: (v, _min, _max, typeCheck) => isPowerOfTwo(v, typeCheck || undefined, true)
+        validate: (v, _min, _max, typeCheck) => isPowerOfTwo(v, typeCheck, true)
     },
     ascii: {
-        validate: (v, _min, _max, typeCheck) => isAscii(v, typeCheck || undefined, true)
+        validate: (v, _min, _max, typeCheck) => isAscii(v, typeCheck, true)
     },
     array: {
-        validate: (v, min, max, _typeCheck) => isArrayOfLength(v, min || undefined, max || undefined, true)
+        validate: (v, min, max, _typeCheck) => isArrayOfLength(v, min, max, true)
     },
     password: {
         validate: (v, min, max, _typeCheck) => {
@@ -92,7 +92,7 @@ const Types = {
         validate: (v, _min, _max, _typeCheck) => isEmail(v, true)
     },
     regex: {
-        validate: (v, _min, _max, typeCheck) => isRegex(v, typeCheck || undefined, true)
+        validate: (v, _min, _max, typeCheck) => isRegex(v, typeCheck, true)
     },
     json: {
         validate: (v, _min, _max, _typeCheck) => isJson(v, true)
@@ -113,10 +113,10 @@ const Types = {
         validate: (v, _min, _max, _typeCheck) => isHexadecimal(v, true)
     },
     date: {
-        validate: (v, min, max, _typeCheck) => isValidDate(v, min || undefined, max || undefined, true)
+        validate: (v, min, max, _typeCheck) => isValidDate(v, min, max, true)
     },
     timestamp: {
-        validate: (v, min, max, typeCheck) => isValidTimestamp(v, min || undefined, max || undefined, typeCheck || undefined, true)
+        validate: (v, min, max, typeCheck) => isValidTimestamp(v, min, max, typeCheck, true)
     },
     function: {
         validate: (v, _min, _max, _typeCheck) => isFunction(v, true)
@@ -131,13 +131,13 @@ const Types = {
         validate: (v, _min, _max, _typeCheck) => isNode(v, true)
     },
     object: {
-        validate: (v, _min, _max, _typeCheck) => isObject(v, true)
+        validate: (v, _min, _max, _typeCheck) => isObject(v, false, true)
     },
     ansiEscapeCode: {
         validate: (v, _min, _max, _typeCheck) => isAnsiEscapeCode(v, true)
     },
     locale: {
-        validate: (v, _min, _max, typeCheck) => isLocale(v, typeCheck || undefined, true)
+        validate: (v, _min, _max, typeCheck) => isLocale(v, typeCheck, true)
     },
     timeZone: {
         validate: (v, _min, _max, _typeCheck) => isTimeZone(v, true)
@@ -152,10 +152,11 @@ class Property {
     isPrivate;
     requiredFor;
     isTypeChecked;
+    readOnly;
     sanitizer;
     normalizer;
     validator;
-    constructor(key, type, min, max, isPrivate, requiredFor, isTypeChecked, sanitizer, normalizer, validator) {
+    constructor(key, type, min, max, isPrivate, requiredFor, isTypeChecked, readOnly, sanitizer, normalizer, validator) {
         try {
             isString(key, "!0", null, true);
         }
@@ -168,16 +169,14 @@ class Property {
         catch (err) {
             throw new Error(`${LOGS_PREFIX}Property "type" must be a valid type - caused by: ${err.message}`);
         }
-        if (isArray(requiredFor)) {
-            for (const m of requiredFor) {
+        if (isArray(requiredFor))
+            for (const m of requiredFor)
                 try {
                     isIn(METHODS, m, 0, true);
                 }
                 catch (err) {
                     throw new Error(`${LOGS_PREFIX}Property "requiredFor" must be an array of REST methods - caused by: ${err.message}`);
                 }
-            }
-        }
         this.key = key;
         this.type = type;
         this.min = this.interval(min, type, 0, "1900-01-01T00:00:00Z");
@@ -185,6 +184,7 @@ class Property {
         this.requiredFor = isArray(requiredFor) ? requiredFor : [];
         this.isPrivate = isBoolean(isPrivate) ? isPrivate : false;
         this.isTypeChecked = isBoolean(isTypeChecked) ? isTypeChecked : false;
+        this.readOnly = isBoolean(readOnly) ? readOnly : false;
         this.sanitizer = isFunction(sanitizer) ? sanitizer : null;
         this.normalizer = isFunction(normalizer) ? normalizer : null;
         this.validator = isFunction(validator) ? validator : null;
@@ -192,7 +192,7 @@ class Property {
     interval(val, type, integerDefault, dateDefault) {
         if (type === "date")
             return isDate(val) ? val : new Date(dateDefault);
-        return (isNumber(val, true) && isInteger(val, true)) ? val : integerDefault;
+        return isNumber(val, true) ? val : integerDefault;
     }
 }
 
@@ -221,14 +221,22 @@ function trim(v) {
     return v;
 }
 
-function normalize(record, properties) {
-    for (const { key, type, sanitizer, normalizer, } of properties) {
+function logSafe(v) {
+    return typeof v === 'string' ? v.replace(/[\r\n\t]/g, '') : v;
+}
+
+function normalize(record, properties, allowReadOnly = false) {
+    for (const { key, type, sanitizer, normalizer, readOnly, } of properties) {
+        if (readOnly && !allowReadOnly) {
+            delete record[key];
+            continue;
+        }
         let v = record[key];
-        if (v) {
-            log.debug(`sanitize ${key}: ${type} = ${v}`);
+        if (!isNil(v)) {
+            log.debug(`sanitize ${key}: ${type} = ${logSafe(v)}`);
             v = sanitize(v, sanitizer);
             if (normalizer) {
-                log.debug(`normalize ${key}: ${type} = ${v}`);
+                log.debug(`normalize ${key}: ${type} = ${logSafe(v)}`);
                 v = normalizer(v);
             }
             record[key] = v;
@@ -237,11 +245,12 @@ function normalize(record, properties) {
 }
 
 function control(v, key, type, min, max, typeCheck, cb) {
-    log.debug(`control ${key}: ${type} = ${v}`);
+    log.debug(`control ${key}: ${type} = ${logSafe(v)}`);
     let errorMessage = "";
     if (cb)
         try {
-            cb(v);
+            if (cb(v) === false)
+                errorMessage = `Custom validator callback failed for "${key}"`;
         }
         catch (err) {
             errorMessage = `Custom validator callback failed for "${key}" - caused by: ${err.message}`;
@@ -259,19 +268,21 @@ function control(v, key, type, min, max, typeCheck, cb) {
 }
 
 function require(v, key, type) {
-    log.debug(`require ${key}: ${type} = ${v}`);
+    log.debug(`require ${key}: ${type} = ${logSafe(v)}`);
     return isNil(v) ? { statusCode: 400, message: `${LOGS_PREFIX}Missing ${key} of type ${type}` } : null;
 }
 
-function validate(record, properties, method) {
-    for (const { key, type, min, max, requiredFor, isTypeChecked, validator } of properties) {
+function validate(record, properties, method, allowReadOnly = false) {
+    for (const { key, type, min, max, requiredFor, isTypeChecked, readOnly, validator, } of properties) {
+        if (readOnly && !allowReadOnly)
+            continue;
         const v = record[key];
         if (requiredFor.includes(method)) {
             const rq = require(v, key, type);
             if (rq)
                 return rq;
         }
-        if (v) {
+        if (!isNil(v)) {
             const ct = control(v, key, type, min, max, isTypeChecked, validator);
             if (ct)
                 return ct;
@@ -280,7 +291,10 @@ function validate(record, properties, method) {
     return null;
 }
 
-const STANDARD_PROP_KEYS = new Set(['key', 'type', 'min', 'max', 'isPrivate', 'requiredFor', 'isTypeChecked', 'sanitizer', 'normalizer', 'validator']);
+const STANDARD_PROP_KEYS = new Set([
+    'key', 'type', 'min', 'max', 'isPrivate', 'requiredFor',
+    'isTypeChecked', 'readOnly', 'sanitizer', 'normalizer', 'validator',
+]);
 class Entity {
     _name;
     _privateProps;
@@ -292,10 +306,7 @@ class Entity {
         this._privateProps = [];
         this._propsByMethod = new Map(METHODS.map(m => [m, []]));
         for (const p of properties) {
-            const prop = new Property(p.key, p.type, p.min, p.max, p.isPrivate, p.requiredFor, p.isTypeChecked, p.sanitizer, p.normalizer, p.validator);
-            for (const k of Object.keys(p))
-                if (!STANDARD_PROP_KEYS.has(k))
-                    prop[k] = p[k];
+            const prop = this.createProperty(p);
             this._properties.push(prop);
             if (prop.isPrivate)
                 this._privateProps.push(prop.key);
@@ -303,6 +314,13 @@ class Entity {
                 this._propsByMethod.get(m)?.push(prop);
         }
     }
+    createProperty(p) {
+        const prop = new Property(p.key, p.type, p.min, p.max, p.isPrivate, p.requiredFor, p.isTypeChecked, p.readOnly, p.sanitizer, p.normalizer, p.validator);
+        for (const k of Object.keys(p))
+            if (!STANDARD_PROP_KEYS.has(k))
+                prop[k] = p[k];
+        return prop;
+    }
     get name() {
         return this._name;
     }
@@ -323,29 +341,29 @@ class Entity {
     getPropsByMethod(method) {
         return this._propsByMethod.get(method) ?? [];
     }
-    normalizeArray = (req, _res, next) => {
+    normalizeArray = (req, res, next) => {
         log.debug(`normalizeArray ${this.name}`);
         const rows = req.body?.rows;
         if (!isArray(rows, ">", 0)) {
             next({ statusCode: 400, message: `${LOGS_PREFIX}Normalize: no rows found in request body` });
             return;
         }
-        for (const r of rows) {
-            normalize(r, this._properties);
-        }
+        const allowReadOnly = res?.locals?.allowReadOnly === true;
+        for (const r of rows)
+            normalize(r, this._properties, allowReadOnly);
         next();
     };
-    normalizeOne = (req, _res, next) => {
+    normalizeOne = (req, res, next) => {
         log.debug(`normalizeOne ${this.name}`);
         const r = req.body;
         if (!isObject(r, true)) {
             next({ statusCode: 400, message: `${LOGS_PREFIX}Normalize: no data found in request body` });
             return;
         }
-        normalize(r, this._properties);
+        normalize(r, this._properties, res?.locals?.allowReadOnly === true);
         next();
     };
-    validateArray = (req, _res, next) => {
+    validateArray = (req, res, next) => {
         log.debug(`validateArray ${this.name}`);
         const rows = req.body?.rows;
         const method = req.method;
@@ -357,8 +375,9 @@ class Entity {
             next({ statusCode: 400, message: `${LOGS_PREFIX}Invalid REST method. Received: ${method}. Must be one of: ${METHODS.toString()}` });
             return;
         }
+        const allowReadOnly = res?.locals?.allowReadOnly === true;
         for (const r of rows) {
-            const error = validate(r, this._properties, method);
+            const error = validate(r, this._properties, method, allowReadOnly);
             if (error) {
                 next(error);
                 return;
@@ -366,7 +385,7 @@ class Entity {
         }
         next();
     };
-    validateOne = (req, _res, next) => {
+    validateOne = (req, res, next) => {
         log.debug(`validateOne ${this.name}`);
         const record = req.body;
         const method = req.method;
@@ -378,7 +397,7 @@ class Entity {
             next({ statusCode: 400, message: `${LOGS_PREFIX}Invalid REST method. Received: ${method}. Must be one of: ${METHODS.toString()}` });
             return;
         }
-        const error = validate(record, this._properties, method);
+        const error = validate(record, this._properties, method, res?.locals?.allowReadOnly === true);
         if (error) {
             next(error);
             return;
@@ -387,4 +406,4 @@ class Entity {
     };
 }
 
-export { Entity };
+export { Entity, Property, STANDARD_PROP_KEYS };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dwtechs/antity",
-  "version": "0.18.3",
+  "version": "0.19.0",
   "description": "Open source library for easy entity management",
   "keywords": [
     "entities"
@@ -31,11 +31,11 @@
   "files": [
     "dist/"
   ],
-    "engines": {
+  "engines": {
     "node": ">= 22"
   },
   "dependencies": {
-    "@dwtechs/checkard": "3.6.1",
+    "@dwtechs/checkard": "3.7.0",
     "@dwtechs/passken": "0.6.1",
     "@dwtechs/sparray": "0.2.1",
     "@dwtechs/winstan": "0.7.1"
@@ -50,6 +50,7 @@
     "core-js": "3.33.0",
     "jest": "29.7.0",
     "rollup": "4.24.0",
+    "rollup-plugin-dts": "6.5.1",
     "typescript": "6.0.3"
   }
 }