@exabugs/dynamodb-client 1.6.1 → 1.7.0

package/CHANGELOG.md

@@ -7,6 +7,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.7.0] - 2026-10-12
+
+### Fixed
+
+- 更新のドット記法パス(例: `sections.1.t`)が配列をオブジェクトに壊していた。配列は要素単位で更新し、範囲外・非数値の添字は 400 で拒否する。`__proto__` を含むパスも拒否する (#48)
+- 更新時に `updatedAt` が変わらなかった(既存の値が優先されていた)。パッチ側に付与して毎回更新する。クライアントが値を指定した場合はそれを尊重し、`null` / `undefined` は未指定として扱う (#48)
+- 解釈できないフィルタ指定が 500 (`CONFIG_ERROR`) になっていた。400 (`INVALID_FILTER`) を返す (#48)
+
+### Changed
+
+- **`updatedAt` を明示しない更新で、値が毎回変わる**ようになった。`updatedAt` 順の一覧は更新のたびに並びが変わり、`updatedAt` のシャドーの再作成により 1 レコードあたりの書き込み項目が増える
+- ドット記法で、存在しない(またはオブジェクト以外の)親に対する `null`(削除)は何もしなくなった(従来は `{a: null}` のような残骸が残っていた)
+
+## [1.6.2] - 2026-10-11
+
+### Security
+
+- `COGNITO_CLIENT_ID` 未設定のとき、JWT の `aud` 検証が無効であることを示す**警告ログ**を出す（コールドスタートごとに1回）。挙動は変えない。未設定だと同じユーザープールの別アプリクライアントのトークンも通る
+- デバッグログ（`Cognito JWT verified`）から `email` を除いた（個人情報。追跡は `sub`）
+
+### CI
+
+- リポジトリを非公開にしたため、`npm publish` から `--provenance` を外した（provenance は公開リポジトリでのみ生成できる）。公開リポジトリに戻す場合は復活させる
+
+### Docs
+
+- `docs/AUTHORIZATION.md` を新設: 認可モデル（JWT の有効性しか検証しない）、管理者専用ユーザープール、フェデレーションログインの許可制（Pre Token Generation の例）、`aud` 検証、MFA の限界、チェックリスト
+- `terraform/README.md`: pnpm 利用時、版を上げた後は `.terraform/modules` を削除して `terraform init` する注意を追加。`terraform/variables.tf` の `cognito_client_id` の説明を明確化
+
 ## [1.6.1] - 2026-10-11
 
 ### Fixed

package/README.md

@@ -194,6 +194,7 @@ const article = await articles.findOne({ title: 'Hello DynamoDB' });
 - **[Architecture](docs/ARCHITECTURE.md)** - System architecture and design
 - **[Client Usage](docs/CLIENT_USAGE.md)** - Client-side API guide
 - **[React Admin Integration](docs/react-admin-integration.md)** - Admin UI setup and many-to-many relationships
+- **[Authorization & Secure Setup](docs/AUTHORIZATION.md)** - 認可モデルと安全な構成（必読。JWT の有効性しか検証しない／管理者専用ユーザープール／`aud` 検証）
 - **[Deployment](docs/DEPLOYMENT.md)** - Production deployment guide
 - **[Terraform Modules](terraform/README.md)** - Infrastructure as Code
 

package/dist/server/handler.cjs

@@ -1,5 +1,5 @@
-// @exabugs/dynamodb-client v1.6.1
-// Built: 2026-10-11T12:45:55.244Z
+// @exabugs/dynamodb-client v1.7.0
+// Built: 2026-10-11T16:38:03.698Z
 "use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -73,7 +73,7 @@ var init_types = __esm({
 function isAppError(error2) {
   return error2 instanceof AppError;
 }
-var AppError, AuthError, ConfigError, InvalidTokenError, ItemNotFoundError;
+var AppError, AuthError, ConfigError, InvalidFilterError, InvalidTokenError, ItemNotFoundError;
 var init_errors = __esm({
   "src/shared/errors/index.ts"() {
     "use strict";
@@ -117,6 +117,14 @@ var init_errors = __esm({
         super("CONFIG_ERROR" /* CONFIG_ERROR */, message, 500, details);
       }
     };
+    InvalidFilterError = class extends AppError {
+      static {
+        __name(this, "InvalidFilterError");
+      }
+      constructor(message, details) {
+        super("INVALID_FILTER" /* INVALID_FILTER */, message, 400, details);
+      }
+    };
     InvalidTokenError = class extends AppError {
       static {
         __name(this, "InvalidTokenError");
@@ -34459,7 +34467,7 @@ function parseFilters(filter) {
         fieldKey,
         error: error2 instanceof Error ? error2.message : String(error2)
       });
-      throw new ConfigError(`Invalid filter field syntax: ${fieldKey}`, {
+      throw new InvalidFilterError(`Invalid filter field syntax: ${fieldKey}`, {
         field: fieldKey,
         error: error2 instanceof Error ? error2.message : String(error2)
       });
@@ -35918,8 +35926,8 @@ function addUpdateTimestamp(data) {
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   return {
-    [timestampFields.updatedAt]: now,
-    ...data
+    ...data,
+    [timestampFields.updatedAt]: data[timestampFields.updatedAt] ?? now
   };
 }
 var init_timestamps = __esm({
@@ -36219,51 +36227,118 @@ var init_insertMany = __esm({
   }
 });
 
-// src/server/operations/updateMany.ts
-var updateMany_exports = {};
-__export(updateMany_exports, {
-  handleUpdateMany: () => handleUpdateMany
-});
-function expandDotNotation(patch) {
-  const result = {};
+// src/server/utils/mergePatch.ts
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function invalidPath(path, reason) {
+  return new AppError("VALIDATION_ERROR" /* VALIDATION_ERROR */, `Invalid patch path "${path}": ${reason}`, 400, {
+    path
+  });
+}
+function mergeInto(target, patch) {
   for (const [key, value] of Object.entries(patch)) {
     if (key.includes(".")) {
-      const keys = key.split(".");
-      let current = result;
-      for (let i4 = 0; i4 < keys.length - 1; i4++) {
-        const k4 = keys[i4];
-        if (!(k4 in current)) {
-          current[k4] = {};
-        } else if (typeof current[k4] !== "object" || Array.isArray(current[k4])) {
-          current[k4] = {};
-        }
-        current = current[k4];
-      }
-      const lastKey = keys[keys.length - 1];
-      current[lastKey] = value;
+      setByPath(target, key, value);
     } else {
-      result[key] = value;
+      setKey(target, key, value, key);
     }
   }
-  return result;
 }
-function applyJsonMergePatch(target, patch) {
-  const expandedPatch = expandDotNotation(patch);
-  const result = { ...target };
-  for (const [key, value] of Object.entries(expandedPatch)) {
-    if (value === null) {
-      delete result[key];
-    } else if (typeof value === "object" && !Array.isArray(value) && value !== null && typeof result[key] === "object" && !Array.isArray(result[key]) && result[key] !== null) {
-      result[key] = applyJsonMergePatch(
-        result[key],
-        value
-      );
+function setKey(target, key, value, path) {
+  if (key === "__proto__") {
+    throw invalidPath(path, "forbidden segment");
+  }
+  if (value === null) {
+    delete target[key];
+  } else if (isPlainObject(value) && isPlainObject(target[key])) {
+    mergeInto(target[key], value);
+  } else {
+    target[key] = value;
+  }
+}
+function setByPath(target, path, value) {
+  const keys = path.split(".");
+  if (keys.some((k4) => k4 === "")) {
+    throw invalidPath(path, "empty segment");
+  }
+  let current = target;
+  for (let i4 = 0; i4 < keys.length; i4++) {
+    const key = keys[i4];
+    const isLast = i4 === keys.length - 1;
+    if (Array.isArray(current)) {
+      if (!/^(0|[1-9]\d*)$/.test(key) || Number(key) >= current.length) {
+        throw invalidPath(path, `"${key}" is not a valid index (length ${current.length})`);
+      }
+      const index = Number(key);
+      if (isLast) {
+        if (value === null) {
+          throw invalidPath(path, "array elements cannot be deleted by path");
+        }
+        const existing = current[index];
+        if (isPlainObject(value) && isPlainObject(existing)) {
+          mergeInto(existing, value);
+        } else {
+          current[index] = value;
+        }
+        return;
+      }
+      const next2 = current[index];
+      if (isPlainObject(next2) || Array.isArray(next2)) {
+        current = next2;
+      } else {
+        if (value === null) {
+          return;
+        }
+        const created = {};
+        current[index] = created;
+        current = created;
+      }
+      continue;
+    }
+    if (isLast) {
+      setKey(current, key, value, path);
+      return;
+    }
+    if (key === "__proto__") {
+      throw invalidPath(path, "forbidden segment");
+    }
+    const next = current[key];
+    if (isPlainObject(next) || Array.isArray(next)) {
+      current = next;
     } else {
-      result[key] = value;
+      if (value === null) {
+        return;
+      }
+      const created = {};
+      current[key] = created;
+      current = created;
     }
   }
+}
+function applyJsonMergePatch(target, patch) {
+  const result = structuredClone(target);
+  mergeInto(result, structuredClone(patch));
   return result;
 }
+var init_mergePatch = __esm({
+  "src/server/utils/mergePatch.ts"() {
+    "use strict";
+    init_shared();
+    __name(isPlainObject, "isPlainObject");
+    __name(invalidPath, "invalidPath");
+    __name(mergeInto, "mergeInto");
+    __name(setKey, "setKey");
+    __name(setByPath, "setByPath");
+    __name(applyJsonMergePatch, "applyJsonMergePatch");
+  }
+});
+
+// src/server/operations/updateMany.ts
+var updateMany_exports = {};
+__export(updateMany_exports, {
+  handleUpdateMany: () => handleUpdateMany
+});
 async function handleUpdateMany(resource, params, requestId) {
   const { data: patchData, options } = params;
   const upsert = options?.upsert ?? false;
@@ -36391,11 +36466,9 @@ async function handleUpdateMany(resource, params, requestId) {
       const id = existingData.id;
       const oldShadowKeys = item.__shadowKeys ?? existingData.__shadowKeys ?? [];
       const actualPatchData2 = patchData.$set ? patchData.$set : patchData;
-      const mergedData = applyJsonMergePatch(removeShadowKeys(existingData), actualPatchData2);
-      const updatedData = addUpdateTimestamp({
-        ...mergedData,
-        id
-      });
+      const timestampedPatch = addUpdateTimestamp(actualPatchData2);
+      const mergedData = applyJsonMergePatch(removeShadowKeys(existingData), timestampedPatch);
+      const updatedData = { ...mergedData, id };
       const newShadowRecords = generateShadowRecords(updatedData, resource, shadowConfig);
       const newShadowKeys = newShadowRecords.map((shadow) => shadow.SK);
       const mainSK = generateMainRecordSK2(id);
@@ -36676,10 +36749,9 @@ var init_updateMany = __esm({
     init_chunking();
     init_cost_tracker();
     init_dynamodb3();
+    init_mergePatch();
     init_timestamps();
     logger18 = createLogger({ service: "records-lambda" });
-    __name(expandDotNotation, "expandDotNotation");
-    __name(applyJsonMergePatch, "applyJsonMergePatch");
     __name(handleUpdateMany, "handleUpdateMany");
     __name(getPreparationErrorCode2, "getPreparationErrorCode");
   }
@@ -37115,6 +37187,9 @@ async function handleUpdateOne(resource, params, requestId) {
     if (updateManyResult.count === 0) {
       const error2 = Object.values(updateManyResult.errors || {})[0];
       if (error2) {
+        if (error2.code === "VALIDATION_ERROR" /* VALIDATION_ERROR */) {
+          throw new AppError("VALIDATION_ERROR" /* VALIDATION_ERROR */, error2.message ?? "Invalid patch", 400);
+        }
         throw new Error(`Failed to update record: ${error2.message}`);
       } else {
         throw new Error(`Failed to update record: ${targetId}`);
@@ -37154,6 +37229,9 @@ async function handleUpdateOne(resource, params, requestId) {
     if (updateManyResult.count === 0) {
       const error2 = Object.values(updateManyResult.errors || {})[0];
       if (error2) {
+        if (error2.code === "VALIDATION_ERROR" /* VALIDATION_ERROR */) {
+          throw new AppError("VALIDATION_ERROR" /* VALIDATION_ERROR */, error2.message ?? "Invalid patch", 400);
+        }
         throw new Error(`Failed to update record: ${error2.message}`);
       } else {
         throw new Error(`No records found matching filter`);
@@ -38417,6 +38495,12 @@ var verifierInstance = null;
 function getVerifier(userPoolId, clientId) {
   if (!verifierInstance) {
     logger21.debug("Creating JWT verifier instance", { userPoolId, clientId });
+    if (!clientId) {
+      logger21.warn(
+        "COGNITO_CLIENT_ID is not set: JWT audience (aud) verification is DISABLED. Tokens issued to ANY app client of this user pool are accepted. Set cognito_client_id (Terraform) / COGNITO_CLIENT_ID in production. See docs/AUTHORIZATION.md",
+        { userPoolId }
+      );
+    }
     verifierInstance = CognitoJwtVerifier.create({
       userPoolId,
       tokenUse: "id",
@@ -38513,8 +38597,7 @@ async function handleCognitoAuthentication(authHeader, requestId) {
   const jwtPayload = await verifyAuthHeader(authHeader, userPoolId, clientId);
   logger22.debug("Cognito JWT verified", {
     requestId,
-    sub: jwtPayload.sub,
-    email: jwtPayload.email
+    sub: jwtPayload.sub
   });
 }
 __name(handleCognitoAuthentication, "handleCognitoAuthentication");
@@ -38701,7 +38784,7 @@ async function handler(event) {
       return createCorsResponse(HTTP_STATUS.OK);
     }
     if (event.requestContext.http.method === "GET" && event.requestContext.http.path === "/version") {
-      const version = "1.6.1";
+      const version = "1.7.0";
       return createSuccessResponse({ version, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, requestId);
     }
     if (event.requestContext.http.method !== "POST") {