@everystack/api 0.1.0 → 0.2.1

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@everystack/api",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "PostgREST-compatible HTTP handler + typed fetch client for Drizzle ORM",
-  "license": "MIT",
+  "license": "AGPL-3.0-only",
   "publishConfig": {
     "access": "public"
   },
@@ -10,7 +10,6 @@
     "src",
     "README.md"
   ],
-  "type": "module",
   "exports": {
     "./handler": {
       "types": "./src/handler/index.ts",
@@ -21,20 +20,20 @@
       "default": "./src/client/index.ts"
     }
   },
-  "peerDependencies": {
-    "drizzle-orm": ">=0.35.0"
-  },
-  "devDependencies": {
-    "@types/jest": "^29.5.14",
-    "@types/node": "^22.0.0",
-    "drizzle-orm": "^0.41.0",
-    "jest": "^29.7.0",
-    "ts-jest": "^29.3.0",
-    "typescript": "^5.7.0"
-  },
   "scripts": {
-    "test": "NODE_OPTIONS='--experimental-vm-modules' jest",
+    "test": "jest",
     "build": "tsc --build",
     "lint": "tsc --noEmit"
+  },
+  "peerDependencies": {
+    "drizzle-orm": "0.41.0"
+  },
+  "devDependencies": {
+    "@types/jest": "29.5.14",
+    "@types/node": "22.19.18",
+    "drizzle-orm": "0.41.0",
+    "jest": "29.7.0",
+    "ts-jest": "29.4.9",
+    "typescript": "5.9.3"
   }
-}
+}

package/src/handler/index.ts

@@ -18,11 +18,24 @@ type Schema = Record<string, DrizzleTable>;
 
 type Handler = (request: Request) => Promise<Response>;
 
-export interface RoleConfig {
-  /** Role required for GET requests on this table */
-  read: string;
-  /** Role required for POST/PATCH/DELETE requests on this table */
-  write: string;
+/** Throw from hooks to return a custom status code and message to the client. */
+export class HandlerError extends Error {
+  status: number;
+  constructor(status: number, message: string) {
+    super(message);
+    this.status = status;
+    this.name = 'HandlerError';
+  }
+}
+
+/** Replace schema-revealing error details with a generic message when hideSchemaErrors is enabled. */
+function sanitizeError(message: string, status: number, options?: HandlerOptions): Response {
+  if (options?.hideSchemaErrors) {
+    if (status === 404) return json({ message: 'Not found' }, 404);
+    if (status === 403) return json({ message: 'Forbidden' }, 403);
+    if (status === 400) return json({ message: 'Bad request' }, 400);
+  }
+  return json({ message }, status);
 }
 
 export interface AuthConfig {
@@ -35,20 +48,20 @@ export interface AuthConfig {
   /** Called after successful authentication with the user payload */
   onAuthenticated?: (user: Record<string, unknown>) => void;
   /** Verify client credentials and return client metadata, or null if invalid.
-   *  When configured, client headers are required on every request (including public routes). */
-  verifyClient?: (clientId: string, clientSecret: string) => Promise<Record<string, unknown> | null>;
+   *  When configured, every request must provide client headers OR a Referer/Origin header.
+   *  Called with (clientId, clientSecret, referer) — the callback decides which path to validate:
+   *    - Secret-based (native/server): clientId + clientSecret present
+   *    - Referer-based (web): referer present, no secret */
+  verifyClient?: (clientId: string, clientSecret: string, referer?: string) => Promise<Record<string, unknown> | null>;
   /** Custom header names for client credentials.
    *  Defaults: { id: 'X-Client-Id', secret: 'X-Client-Secret' } */
   clientHeaders?: { id: string; secret: string };
   /** Called after successful client authentication with the client payload */
   onClientAuthenticated?: (client: Record<string, unknown>) => void;
-  /** Per-table role requirements. Key is table name or '*' for wildcard default.
-   *  When set, overrides publicRoutes for tables that have an entry. */
-  roles?: Record<string, RoleConfig>;
   /** Ordered role hierarchy, lowest to highest privilege.
-   *  Default: ['public', 'authenticated', 'admin'] */
+   *  Used by RPC role gating. Default: ['public', 'authenticated', 'admin'] */
   roleHierarchy?: string[];
-  /** Field in the user payload containing the role string. Default: 'role' */
+  /** Field in the user payload containing the role string. Used by RPC role gating. Default: 'role' */
   roleField?: string;
 }
 
@@ -95,9 +108,19 @@ export interface CacheConfig {
   private?: string;
 }
 
+/** RPC handler — plain function (backward compatible) */
+export type RpcHandler = (body: unknown, user?: Record<string, unknown> | null, client?: Record<string, unknown> | null) => Promise<unknown>;
+
+/** RPC handler with per-function role requirement */
+export interface RpcHandlerWithRole {
+  fn: RpcHandler;
+  /** Role required to call this RPC (e.g., 'admin', 'authenticated') */
+  role: string;
+}
+
 export interface HandlerOptions {
   auth?: AuthConfig;
-  rpc?: Record<string, (body: unknown, user?: Record<string, unknown> | null, client?: Record<string, unknown> | null) => Promise<unknown>>;
+  rpc?: Record<string, RpcHandler | RpcHandlerWithRole>;
   /** Relation definitions for resource embedding: { [sourceTable]: { [relationName]: RelationConfig } } */
   relations?: Record<string, Record<string, RelationConfig>>;
   /** Base path to strip from request URL (e.g., '/api' when mounted at /api/[...path]) */
@@ -118,6 +141,31 @@ export interface HandlerOptions {
   naming?: 'camelCase' | 'snake_case';
   /** Override default Cache-Control headers for API responses. */
   cache?: CacheConfig;
+  /** Whitelist of table names accessible via REST.
+   *  If provided, only these tables are served — all others return 404.
+   *  If omitted, all tables in the schema are exposed (current behavior). */
+  exposedTables?: string[];
+  /** Per-table list of column names to strip from all responses.
+   *  Columns are removed after query execution, before JSON serialization.
+   *  Does NOT affect query filtering — hidden columns can still be used in WHERE clauses. */
+  hiddenColumns?: Record<string, string[]>;
+  /** Per-table list of fields stripped from POST/PATCH request bodies before mutation.
+   *  Prevents mass assignment / privilege escalation on sensitive columns. */
+  protectedFields?: Record<string, string[]>;
+  /** Maximum nesting depth for relation embedding via ?select=rel(sub_rel(...)).
+   *  Prevents DoS from deeply nested relation queries. Default: 3. */
+  maxEmbedDepth?: number;
+  /** Maximum value for ?limit= parameter. Prevents unbounded result sets.
+   *  User-supplied limits above this are clamped. Default: 10000. */
+  maxLimit?: number;
+  /** Per-table row ownership for IDOR protection on PATCH/DELETE.
+   *  Auto-appends WHERE <column> = user[<userField>] to mutations.
+   *  GET/POST are unaffected — reads use RLS, creates use hooks.
+   *  Example: { posts: { column: 'authorId', userField: 'sub' } } */
+  rowOwnership?: Record<string, { column: string; userField: string }>;
+  /** When true, error messages hide internal details (table names, column names, operators).
+   *  Enable in production to prevent schema enumeration. Default: false. */
+  hideSchemaErrors?: boolean;
 }
 
 function getSoftDeleteColumn(table: DrizzleTable, options?: HandlerOptions): DrizzleColumn | null {
@@ -135,6 +183,19 @@ function isSoftDeleteTable(tableName: string, table: DrizzleTable, options?: Han
   return getSoftDeleteColumn(table, options) != null;
 }
 
+/**
+ * Detect PostgreSQL permission denied errors (code 42501).
+ * Used to convert Postgres GRANT/RLS denials into clean 403 responses.
+ */
+function isPermissionDenied(error: unknown): boolean {
+  if (error && typeof error === 'object') {
+    const e = error as Record<string, unknown>;
+    if (e.code === '42501') return true;
+    if (typeof e.message === 'string' && e.message.includes('permission denied')) return true;
+  }
+  return false;
+}
+
 /**
  * Execute a function with pgSettings applied in the same transaction.
  *
@@ -172,20 +233,6 @@ async function executeWithSettings<T>(
   return fn(db);
 }
 
-/**
- * Determine the role required for a given table + HTTP method.
- * Resolution: roles[tableName] → roles['*'] → null (use publicRoutes fallback).
- */
-function getRequiredRole(
-  tableName: string,
-  method: string,
-  auth?: AuthConfig,
-): string | null {
-  if (!auth?.roles) return null;
-  const config = auth.roles[tableName] ?? auth.roles['*'];
-  if (!config) return null;
-  return method === 'GET' ? config.read : config.write;
-}
 
 /**
  * Check whether userRole meets or exceeds requiredRole in the hierarchy.
@@ -273,41 +320,15 @@ async function checkRoleAuth(
 }
 
 /**
- * Determine the Cache-Control header for a GET response based on role config.
- * - pgSettings configured → private header (per-user data via RLS)
- * - read: 'public' → public header
- * - Any other role → private header
- * - No roles config → null (let server package set its default)
- *
- * Headers are configurable via options.cache. Defaults:
- * - public: 'public, max-age=60, s-maxage=2592000, stale-while-revalidate=5'
- * - private: 'private, no-store'
+ * Determine the Cache-Control header for a GET response.
+ * - pgSettings configured → private (per-user data via RLS)
+ * - No pgSettings → null (let server package set its default)
  */
-function getCacheControl(tableName: string, options?: HandlerOptions): string | null {
-  const publicHeader = options?.cache?.public ?? 'public, max-age=60, s-maxage=2592000, stale-while-revalidate=5';
-  const privateHeader = options?.cache?.private ?? 'private, no-store';
-
-  if (options?.pgSettings) return privateHeader;
-  if (!options?.auth?.roles) return null;
-  const requiredRole = getRequiredRole(tableName, 'GET', options.auth);
-  if (requiredRole === null) return null;
-  if (requiredRole === 'public') return publicHeader;
-  return privateHeader;
-}
-
-/**
- * Serialize roles config into a compact JSON manifest for CloudFront KVS.
- * Format: { "__tables__": ["posts", ...], "*": { "r": "public", "w": "authenticated" }, ... }
- */
-export function serializeRolesManifest(
-  schema: Schema,
-  roles: Record<string, RoleConfig>,
-): string {
-  const manifest: Record<string, unknown> = { __tables__: Object.keys(schema) };
-  for (const [key, config] of Object.entries(roles)) {
-    manifest[key] = { r: config.read, w: config.write };
+function getCacheControl(options?: HandlerOptions): string | null {
+  if (options?.pgSettings) {
+    return options?.cache?.private ?? 'private, no-store';
   }
-  return JSON.stringify(manifest);
+  return null;
 }
 
 // --- Naming convention helpers ---
@@ -339,6 +360,42 @@ function transformResponse(data: unknown, options?: HandlerOptions): unknown {
   return transformKeys(data, toSnakeCase);
 }
 
+/** Strip protected fields from a request body before insert/update (mass assignment prevention). */
+function stripProtectedFields(
+  body: Record<string, unknown>,
+  tableName: string,
+  options?: HandlerOptions,
+): Record<string, unknown> {
+  const fields = options?.protectedFields?.[tableName];
+  if (!fields || fields.length === 0) return body;
+  const result = { ...body };
+  for (const field of fields) {
+    delete result[field];
+  }
+  return result;
+}
+
+function stripHiddenColumns(
+  data: unknown,
+  tableName: string,
+  options?: HandlerOptions,
+): unknown {
+  const columns = options?.hiddenColumns?.[tableName];
+  if (!columns || columns.length === 0) return data;
+
+  const strip = (row: Record<string, unknown>): Record<string, unknown> => {
+    const result = { ...row };
+    for (const col of columns) {
+      delete result[col];
+    }
+    return result;
+  };
+
+  if (Array.isArray(data)) return data.map(strip);
+  if (data !== null && typeof data === 'object') return strip(data as Record<string, unknown>);
+  return data;
+}
+
 function transformBodyKeys(body: Record<string, unknown>, table: DrizzleTable): Record<string, unknown> {
   const result: Record<string, unknown> = {};
   for (const [key, value] of Object.entries(body)) {
@@ -370,20 +427,30 @@ export function createHandler(db: DrizzleDb, schema: Schema, options?: HandlerOp
     const method = request.method.toUpperCase();
 
     // Phase 1: Client auth (if configured) — identifies which app is calling
+    // Supports two validation paths:
+    //   1. Header-based (native/server): X-Client-Id + X-Client-Secret
+    //   2. Referer-based (web): Referer or Origin header (no secrets in browser source)
+    // The verifyClient callback receives all three and decides which path to validate.
+    // Skipped for publicRoutes methods (e.g. GET) and publicRpc functions — no credentials needed.
     let user: Record<string, unknown> | null = null;
     let client: Record<string, unknown> | null = null;
-    if (options?.auth?.verifyClient) {
+    const isPublicRoute = options?.auth?.publicRoutes?.includes(method) ?? false;
+    const isPublicRpc = pathSegments[0] === 'rpc'
+      && !!pathSegments[1]
+      && (options?.auth?.publicRpc?.includes(pathSegments[1]) ?? false);
+    if (options?.auth?.verifyClient && !isPublicRoute && !isPublicRpc) {
       const idHeader = options.auth.clientHeaders?.id ?? 'X-Client-Id';
       const secretHeader = options.auth.clientHeaders?.secret ?? 'X-Client-Secret';
       const clientId = request.headers.get(idHeader);
       const clientSecret = request.headers.get(secretHeader);
+      const referer = request.headers.get('referer') || request.headers.get('origin');
 
-      if (!clientId || !clientSecret) {
+      if (!clientId && !clientSecret && !referer) {
         return json({ message: 'Client authentication required: missing client credentials' }, 401);
       }
 
       try {
-        client = await options.auth.verifyClient(clientId, clientSecret);
+        client = await options.auth.verifyClient(clientId ?? '', clientSecret ?? '', referer ?? undefined);
       } catch {
         return json({ message: 'Client authentication failed: invalid client credentials' }, 401);
       }
@@ -399,7 +466,10 @@ export function createHandler(db: DrizzleDb, schema: Schema, options?: HandlerOp
 
     // Root path — table listing, always public
     if (pathSegments.length === 0) {
-      return json({ tables: Array.from(tableNames) }, 200);
+      const tables = options?.exposedTables
+        ? Array.from(tableNames).filter(t => options.exposedTables!.includes(t))
+        : Array.from(tableNames);
+      return json({ tables }, 200);
     }
 
     // RPC path — uses publicRoutes/publicRpc for auth, not table roles
@@ -420,9 +490,41 @@ export function createHandler(db: DrizzleDb, schema: Schema, options?: HandlerOp
 
       const fnName = pathSegments[1];
       if (options?.rpc && fnName && options.rpc[fnName]) {
+        const entry = options.rpc[fnName];
+        const isObjectForm = typeof entry !== 'function';
+
+        // Per-RPC role check (object syntax: { fn, role })
+        if (isObjectForm && entry.role && options?.auth) {
+          const roleResult = await checkRoleAuth(entry.role, request, options.auth);
+          if (roleResult.error) return roleResult.error;
+          user = roleResult.user;
+        } else if (isObjectForm && entry.role && !options?.auth) {
+          // Role required but no auth configured — deny
+          return json({ message: 'Authentication required: no auth token provided' }, 401);
+        }
+
+        const fn = isObjectForm ? entry.fn : entry;
         const body = method === 'POST' ? await request.json().catch(() => ({})) : {};
-        const result = await options.rpc[fnName](body, user, client);
-        return json(result, 200);
+        const settings = options?.pgSettings?.(user, client);
+        try {
+          const result = await executeWithSettings(db, settings, () => fn(body, user, client));
+          return json(result, 200);
+        } catch (error) {
+          if (error instanceof HandlerError) {
+            return json({ message: error.message }, error.status);
+          }
+          const message = error instanceof Error ? error.message : 'RPC execution failed';
+          const pgCode = (error as any)?.code;
+          let status = 500;
+          if (pgCode === '28P01') status = 401;
+          else if (pgCode === '42501') status = 403;
+          else if (pgCode === '23505') status = 409;
+          else if (pgCode === '22023' || pgCode === 'P0001') status = 422;
+          if (options?.hideSchemaErrors && status === 500) {
+            return json({ message: 'Internal Server Error' }, 500);
+          }
+          return json({ message, ...(pgCode ? { code: pgCode } : {}) }, status);
+        }
       }
       return json({ message: 'Function not found' }, 404);
     }
@@ -430,26 +532,21 @@ export function createHandler(db: DrizzleDb, schema: Schema, options?: HandlerOp
     const tableName = pathSegments[0];
 
     if (!tableNames.has(tableName)) {
-      return json({ message: `Table '${tableName}' not found` }, 404);
+      return sanitizeError(`Table '${tableName}' not found`, 404, options);
     }
 
-    // Phase 2: User auth (role-aware) — now we know the table name
-    if (options?.auth) {
-      const requiredRole = getRequiredRole(tableName, method, options.auth);
+    if (options?.exposedTables && !options.exposedTables.includes(tableName)) {
+      return sanitizeError(`Table '${tableName}' not found`, 404, options);
+    }
 
-      if (requiredRole !== null) {
-        // Role-based path
-        const result = await checkRoleAuth(requiredRole, request, options.auth);
+    // Phase 2: User authentication — verify JWT if required
+    // Authorization (table/row access) is handled by PostgreSQL GRANTs + RLS.
+    if (options?.auth) {
+      const isPublicMethod = options.auth.publicRoutes.includes(method);
+      if (!isPublicMethod) {
+        const result = await verifyUserToken(request, options.auth);
         if (result.error) return result.error;
         user = result.user;
-      } else {
-        // Legacy path: fall back to publicRoutes
-        const isPublicMethod = options.auth.publicRoutes.includes(method);
-        if (!isPublicMethod) {
-          const result = await verifyUserToken(request, options.auth);
-          if (result.error) return result.error;
-          user = result.user;
-        }
       }
 
       if (user && options.auth.onAuthenticated) {
@@ -461,26 +558,33 @@ export function createHandler(db: DrizzleDb, schema: Schema, options?: HandlerOp
     const settings = options?.pgSettings?.(user, client);
     const table = schema[tableName];
 
-    return executeWithSettings(db, settings, async (dbOrTx) => {
-      if (method === 'GET') {
-        const cacheControl = getCacheControl(tableName, options);
-        return handleGet(dbOrTx, schema, table, tableName, url.searchParams, request, options, cacheControl);
-      }
+    try {
+      return await executeWithSettings(db, settings, async (dbOrTx) => {
+        if (method === 'GET') {
+          const cacheControl = getCacheControl(options);
+          return handleGet(dbOrTx, schema, table, tableName, url.searchParams, request, options, cacheControl);
+        }
 
-      if (method === 'POST') {
-        return handlePost(dbOrTx, table, tableName, request, options, user, client);
-      }
+        if (method === 'POST') {
+          return handlePost(dbOrTx, table, tableName, request, options, user, client);
+        }
 
-      if (method === 'PATCH') {
-        return handlePatch(dbOrTx, table, tableName, request, url.searchParams, options, user, client);
-      }
+        if (method === 'PATCH') {
+          return handlePatch(dbOrTx, table, tableName, request, url.searchParams, options, user, client);
+        }
 
-      if (method === 'DELETE') {
-        return handleDelete(dbOrTx, table, tableName, url.searchParams, options, user, client);
-      }
+        if (method === 'DELETE') {
+          return handleDelete(dbOrTx, table, tableName, url.searchParams, options, user, client);
+        }
 
-      return json({ message: `Method ${method} not allowed` }, 405);
-    });
+        return json({ message: `Method ${method} not allowed` }, 405);
+      });
+    } catch (error) {
+      if (isPermissionDenied(error)) {
+        return sanitizeError('Permission denied', 403, options);
+      }
+      throw error;
+    }
   };
 }
 
@@ -607,7 +711,9 @@ async function handleGet(
   options?: HandlerOptions,
   cacheControl?: string | null,
 ): Promise<Response> {
-  const limitVal = params.has('limit') ? parseInt(params.get('limit')!, 10) : 1000;
+  const maxLimit = options?.maxLimit ?? 10000;
+  const parsedLimit = params.has('limit') ? parseInt(params.get('limit')!, 10) : 1000;
+  const limitVal = Math.min(parsedLimit, maxLimit);
   const offsetVal = params.has('offset') ? parseInt(params.get('offset')!, 10) : 0;
   const orderParam = params.get('order');
   const selectParam = params.get('select');
@@ -616,8 +722,17 @@ async function handleGet(
   const prefer = request.headers.get('Prefer') || '';
   const wantExactCount = prefer.includes('count=exact');
 
+  // Enforce maximum embed depth to prevent DoS from deeply nested relation queries
+  if (selectParam) {
+    const maxEmbedDepth = options?.maxEmbedDepth ?? 3;
+    const depth = getEmbedDepth(selectParam);
+    if (depth > maxEmbedDepth) {
+      return json({ message: `Embed depth ${depth} exceeds maximum of ${maxEmbedDepth}` }, 400);
+    }
+  }
+
   // Parse select parameter for relation embedding and aggregates
-  let { columns, embeds, aggregates } = parseSelectParam(selectParam, options?.relations?.[tableName]);
+  let { columns, embeds, aggregates } = parseSelectParam(selectParam, options?.relations?.[tableName], options?.relations);
 
   // Resolve snake_case select column names to Drizzle camelCase properties
   if (options?.naming === 'snake_case' && columns) {
@@ -629,7 +744,11 @@ async function handleGet(
   }
 
   // Parse PostgREST filters (including or()/and() logical groups and not. negation)
-  const conditions = buildAllConditions(table, params);
+  const filterResult = buildAllConditions(table, params);
+  if ('error' in filterResult) {
+    return sanitizeError(filterResult.error, 400, options);
+  }
+  const conditions = filterResult.conditions;
 
   // Soft-delete: filter deleted records unless ?deleted=include|only
   if (isSoftDeleteTable(tableName, table, options)) {
@@ -693,7 +812,7 @@ async function handleGet(
     };
     if (cacheControl) aggHeaders['Cache-Control'] = cacheControl;
 
-    return new Response(JSON.stringify(transformResponse(serialized, options)), {
+    return new Response(JSON.stringify(transformResponse(stripHiddenColumns(serialized, tableName, options), options)), {
       status: 200,
       headers: aggHeaders,
     });
@@ -807,7 +926,7 @@ async function handleGet(
   };
   if (cacheControl) getHeaders['Cache-Control'] = cacheControl;
 
-  return new Response(JSON.stringify(transformResponse(responseData, options)), {
+  return new Response(JSON.stringify(transformResponse(stripHiddenColumns(responseData, tableName, options), options)), {
     status: 200,
     headers: getHeaders,
   });
@@ -822,6 +941,7 @@ async function handleGet(
 interface EmbedRequest {
   name: string;
   columns: string[] | null; // null = all columns (*)
+  embeds: EmbedRequest[]; // nested relation embeds
 }
 
 type AggregateFunction = 'count' | 'sum' | 'avg' | 'min' | 'max';
@@ -836,9 +956,21 @@ interface AggregateField {
 // Matches: count(), amount.sum(), total:amount.sum(), row_count:count()
 const AGG_REGEX = /^(?:(\w+):)?(?:(\w+)\.)?(count|sum|avg|min|max)\(\)$/;
 
+/** Count the maximum parenthesis nesting depth in a select parameter (embed depth). */
+function getEmbedDepth(selectParam: string): number {
+  let depth = 0;
+  let max = 0;
+  for (const ch of selectParam) {
+    if (ch === '(') { depth++; max = Math.max(max, depth); }
+    else if (ch === ')') { depth--; }
+  }
+  return max;
+}
+
 function parseSelectParam(
   selectParam: string | null,
   tableRelations?: Record<string, RelationConfig>,
+  allRelations?: Record<string, Record<string, RelationConfig>>,
 ): { columns: string[] | null; embeds: EmbedRequest[]; aggregates: AggregateField[] } {
   if (!selectParam) {
     return { columns: null, embeds: [], aggregates: [] };
@@ -867,9 +999,14 @@ function parseSelectParam(
     if (embedMatch && tableRelations && embedMatch[1] in tableRelations) {
       const name = embedMatch[1];
       const innerSelect = embedMatch[2].trim();
+      // Recursively parse sub-embeds using the target table's relations
+      const targetTableName = tableRelations[name].table;
+      const targetRelations = allRelations?.[targetTableName];
+      const inner = parseSelectParam(innerSelect, targetRelations, allRelations);
       embeds.push({
         name,
-        columns: innerSelect === '*' ? null : innerSelect.split(',').map(c => c.trim()),
+        columns: inner.columns,
+        embeds: inner.embeds,
       });
     } else if (part === '*') {
       hasWildcard = true;
@@ -967,10 +1104,16 @@ async function resolveEmbeds(
       const embedConditions: any[] = [inArray(targetColumn, sourceValues as string[])];
       if (targetSdCol) embedConditions.push(isNull(targetSdCol));
 
-      const relatedRows: Record<string, unknown>[] = await db
+      let relatedRows: Record<string, unknown>[] = await db
         .select()
         .from(targetTable)
         .where(embedConditions.length === 1 ? embedConditions[0] : and(...embedConditions));
+      relatedRows = stripHiddenColumns(relatedRows, relationConfig.table, options) as Record<string, unknown>[];
+
+      // Recursively resolve nested embeds
+      if (embed.embeds.length > 0) {
+        relatedRows = await resolveEmbeds(db, schema, relationConfig.table, relatedRows, embed.embeds, options);
+      }
 
       // Group by FK value and assign to each source row
       for (const row of result) {
@@ -999,10 +1142,16 @@ async function resolveEmbeds(
       const embedConditions: any[] = [inArray(targetColumn, fkValues as string[])];
       if (targetSdCol) embedConditions.push(isNull(targetSdCol));
 
-      const relatedRows: Record<string, unknown>[] = await db
+      let relatedRows: Record<string, unknown>[] = await db
         .select()
         .from(targetTable)
         .where(embedConditions.length === 1 ? embedConditions[0] : and(...embedConditions));
+      relatedRows = stripHiddenColumns(relatedRows, relationConfig.table, options) as Record<string, unknown>[];
+
+      // Recursively resolve nested embeds
+      if (embed.embeds.length > 0) {
+        relatedRows = await resolveEmbeds(db, schema, relationConfig.table, relatedRows, embed.embeds, options);
+      }
 
       // Index by target key for O(1) lookup
       const index = new Map<unknown, Record<string, unknown>>();
@@ -1057,12 +1206,18 @@ async function handlePost(
     body = transformBodyKeys(body, table);
   }
 
+  // Strip protected fields before mutation (mass assignment prevention)
+  body = stripProtectedFields(body, tableName, options);
+
   const hook = options?.hooks?.[tableName];
 
   if (hook?.beforeCreate) {
     try {
       body = await hook.beforeCreate(body, user, client);
-    } catch {
+    } catch (err) {
+      if (err instanceof HandlerError) {
+        return json({ message: err.message }, err.status);
+      }
       return json({ message: 'Hook error' }, 500);
     }
   }
@@ -1073,7 +1228,7 @@ async function handlePost(
     try { await hook.afterCreate(rows[0], user, client); } catch {}
   }
 
-  return json(transformResponse(rows[0], options), 201);
+  return json(transformResponse(stripHiddenColumns(rows[0], tableName, options), options), 201);
 }
 
 async function handlePatch(
@@ -1098,17 +1253,27 @@ async function handlePatch(
     body = transformBodyKeys(body, table);
   }
 
+  // Strip protected fields before mutation (mass assignment prevention)
+  body = stripProtectedFields(body, tableName, options);
+
   const hook = options?.hooks?.[tableName];
 
   if (hook?.beforeUpdate) {
     try {
       body = await hook.beforeUpdate(body, user, client);
-    } catch {
+    } catch (err) {
+      if (err instanceof HandlerError) {
+        return json({ message: err.message }, err.status);
+      }
       return json({ message: 'Hook error' }, 500);
     }
   }
 
-  const conditions = buildAllConditions(table, params);
+  const filterResult = buildAllConditions(table, params);
+  if ('error' in filterResult) {
+    return sanitizeError(filterResult.error, 400, options);
+  }
+  const conditions = filterResult.conditions;
 
   // Soft-delete: exclude deleted records from updates
   if (isSoftDeleteTable(tableName, table, options)) {
@@ -1116,6 +1281,16 @@ async function handlePatch(
     if (sdCol) conditions.push(isNull(sdCol));
   }
 
+  // Row ownership: auto-append WHERE <column> = user[<userField>] for IDOR protection
+  if (user && options?.rowOwnership?.[tableName]) {
+    const ownership = options.rowOwnership[tableName];
+    const ownerCol = getColumn(table, ownership.column);
+    const userValue = user[ownership.userField];
+    if (ownerCol && userValue != null) {
+      conditions.push(eq(ownerCol, userValue));
+    }
+  }
+
   let query: any = db.update(table).set(body);
 
   if (conditions.length === 1) {
@@ -1130,7 +1305,7 @@ async function handlePatch(
     try { await hook.afterUpdate(rows, user, client); } catch {}
   }
 
-  return json(transformResponse(rows, options), 200);
+  return json(transformResponse(stripHiddenColumns(rows, tableName, options), options), 200);
 }
 
 async function handleDelete(
@@ -1155,12 +1330,29 @@ async function handleDelete(
   if (hook?.beforeDelete) {
     try {
       await hook.beforeDelete(user, client);
-    } catch {
+    } catch (err) {
+      if (err instanceof HandlerError) {
+        return json({ message: err.message }, err.status);
+      }
       return json({ message: 'Hook error' }, 500);
     }
   }
 
-  const conditions = buildAllConditions(table, params);
+  const filterResult = buildAllConditions(table, params);
+  if ('error' in filterResult) {
+    return sanitizeError(filterResult.error, 400, options);
+  }
+  const conditions = filterResult.conditions;
+
+  // Row ownership: auto-append WHERE <column> = user[<userField>] for IDOR protection
+  if (user && options?.rowOwnership?.[tableName]) {
+    const ownership = options.rowOwnership[tableName];
+    const ownerCol = getColumn(table, ownership.column);
+    const userValue = user[ownership.userField];
+    if (ownerCol && userValue != null) {
+      conditions.push(eq(ownerCol, userValue));
+    }
+  }
 
   // Soft-delete: convert DELETE to UPDATE SET deleted_at = NOW()
   if (isSoftDeleteTable(tableName, table, options)) {
@@ -1183,7 +1375,7 @@ async function handleDelete(
         try { await hook.afterDelete(rows, user, client); } catch {}
       }
 
-      return json(transformResponse(rows, options), 200);
+      return json(transformResponse(stripHiddenColumns(rows, tableName, options), options), 200);
     }
   }
 
@@ -1202,7 +1394,7 @@ async function handleDelete(
     try { await hook.afterDelete(rows, user, client); } catch {}
   }
 
-  return json(transformResponse(rows, options), 200);
+  return json(transformResponse(stripHiddenColumns(rows, tableName, options), options), 200);
 }
 
 interface JsonPath {
@@ -1287,6 +1479,9 @@ function parseJsonPath(column: string): JsonPath | null {
   return { baseColumn, steps };
 }
 
+// JSON path keys must be safe identifiers — no SQL injection via sql.raw()
+const SAFE_JSON_KEY = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+
 /**
  * Build a SQL condition for a JSON path filter.
  * Generates expressions like: "metadata"->>'theme' = 'dark'
@@ -1294,7 +1489,14 @@ function parseJsonPath(column: string): JsonPath | null {
 function buildJsonCondition(table: DrizzleTable, filter: Filter): any {
   const jp = filter.jsonPath!;
   const baseCol = getColumn(table, jp.baseColumn);
-  if (!baseCol) return null;
+  if (!baseCol) return { __filterError: `Unknown column: '${jp.baseColumn}'` };
+
+  // Validate all JSON path keys before interpolation
+  for (const step of jp.steps) {
+    if (!SAFE_JSON_KEY.test(step.key)) {
+      return { __filterError: `Invalid JSON path key: '${step.key}'` };
+    }
+  }
 
   // Build the JSON path expression
   let expr: any = sql`${baseCol}`;
@@ -1355,13 +1557,19 @@ function buildJsonCondition(table: DrizzleTable, filter: Filter): any {
   return condition;
 }
 
+const VALID_OPERATORS = new Set(['eq', 'neq', 'gt', 'gte', 'lt', 'lte', 'like', 'ilike', 'is', 'in']);
+
 function buildCondition(table: DrizzleTable, filter: Filter): any {
   if (filter.jsonPath) {
     return buildJsonCondition(table, filter);
   }
 
   const column = getColumn(table, filter.column);
-  if (!column) return null;
+  if (!column) return { __filterError: `Unknown column: '${filter.column}'` };
+
+  if (!VALID_OPERATORS.has(filter.operator)) {
+    return { __filterError: `Unknown filter operator: '${filter.operator}'` };
+  }
 
   let condition: any = null;
 
@@ -1508,18 +1716,31 @@ function parseLogicalGroup(value: string): Filter[] {
   return filters;
 }
 
+function isFilterError(x: unknown): x is { __filterError: string } {
+  return typeof x === 'object' && x !== null && '__filterError' in x;
+}
+
 /**
  * Build all WHERE conditions from query params, including individual filters
  * and or()/and() logical groups.
+ * Returns { conditions } on success, { error } on validation failure.
  */
-function buildAllConditions(table: DrizzleTable, params: URLSearchParams): any[] {
+function buildAllConditions(table: DrizzleTable, params: URLSearchParams): { conditions: any[] } | { error: string } {
   const filters = parseFilters(params);
-  const conditions = filters.map(f => buildCondition(table, f)).filter(Boolean);
+  const rawResults = filters.map(f => buildCondition(table, f));
+  for (const r of rawResults) {
+    if (isFilterError(r)) return { error: r.__filterError };
+  }
+  const conditions = rawResults.filter(Boolean);
 
   const orParam = params.get('or');
   if (orParam) {
     const orFilters = parseLogicalGroup(orParam);
-    const orConditions = orFilters.map(f => buildCondition(table, f)).filter(Boolean);
+    const orRawResults = orFilters.map(f => buildCondition(table, f));
+    for (const r of orRawResults) {
+      if (isFilterError(r)) return { error: r.__filterError };
+    }
+    const orConditions = orRawResults.filter(Boolean);
     if (orConditions.length > 0) {
       conditions.push(or(...orConditions));
     }
@@ -1528,13 +1749,17 @@ function buildAllConditions(table: DrizzleTable, params: URLSearchParams): any[]
   const andParam = params.get('and');
   if (andParam) {
     const andFilters = parseLogicalGroup(andParam);
-    const andConditions = andFilters.map(f => buildCondition(table, f)).filter(Boolean);
+    const andRawResults = andFilters.map(f => buildCondition(table, f));
+    for (const r of andRawResults) {
+      if (isFilterError(r)) return { error: r.__filterError };
+    }
+    const andConditions = andRawResults.filter(Boolean);
     if (andConditions.length > 0) {
       conditions.push(and(...andConditions));
     }
   }
 
-  return conditions;
+  return { conditions };
 }
 
 function json(data: unknown, status: number): Response {