@frogfish/k2db 3.0.7 → 3.0.8

package/db.d.ts

@@ -288,7 +288,7 @@ export declare class K2DB {
     private static normalizeCriteriaIds;
     /** Uppercase helper for `_uuid` field supporting operators like $in/$nin/$eq/$ne and arrays. */
     private static normalizeUuidField;
-    /** Lowercase helper for `_owner` field supporting operators like $in/$nin/$eq/$ne and arrays. */
+    /** Trim helper for `_owner` field supporting operators like $in/$nin/$eq/$ne and arrays. */
     private static normalizeOwnerField;
     /** Strip any user-provided fields that start with '_' (reserved). */
     private static stripReservedFields;

package/db.js

@@ -398,7 +398,9 @@ export class K2DB {
             return undefined;
         if (s === "*")
             return "*";
-        return s.toLowerCase();
+        // Scope maps to `_owner` (usually another record's `_uuid`), which is case-sensitive.
+        // Our `_uuid` is UUIDv7 Crockford Base32 (uppercase), so normalize to that form.
+        return K2DB.normalizeId(s);
     }
     /**
      * Apply a scope constraint to criteria for ownership enforcement.
@@ -418,8 +420,13 @@ export class K2DB {
         // If caller already provided _owner in criteria, ensure it matches the scope to avoid ambiguity/bypass.
         if (criteria && typeof criteria === "object" && Object.prototype.hasOwnProperty.call(criteria, "_owner")) {
             const existing = criteria._owner;
-            if (typeof existing === "string" && existing.trim().toLowerCase() !== normalizedScope) {
-                throw new K2Error(ServiceError.BAD_REQUEST, "Conflicting _owner in criteria and provided scope", "sys_mdb_scope_conflict");
+            if (typeof existing === "string") {
+                const ex = existing.trim();
+                // Treat any explicit "*" as mismatched here (caller should omit _owner or set scope="*").
+                const existingNorm = ex === "*" ? "*" : K2DB.normalizeId(ex);
+                if (existingNorm !== normalizedScope) {
+                    throw new K2Error(ServiceError.BAD_REQUEST, "Conflicting _owner in criteria and provided scope", "sys_mdb_scope_conflict");
+                }
             }
             // If it matches (or is non-string), prefer the explicit scope value.
         }
@@ -1412,13 +1419,15 @@ export class K2DB {
         if (typeof owner !== "string") {
             throw new K2Error(ServiceError.BAD_REQUEST, "Owner must be of a string type", "sys_mdb_crv2");
         }
-        const normalizedOwner = owner.trim().toLowerCase();
-        if (!normalizedOwner) {
+        const ownerTrimmed = owner.trim();
+        if (!ownerTrimmed) {
             throw new K2Error(ServiceError.BAD_REQUEST, "Owner must be a non-empty string", "sys_mdb_owner_empty");
         }
-        if (normalizedOwner === "*") {
+        if (ownerTrimmed === "*") {
             throw new K2Error(ServiceError.BAD_REQUEST, "Owner cannot be '*'", "sys_mdb_owner_star");
         }
+        // `_owner` is typically another record's `_uuid` (case-sensitive). Normalize to the canonical ID form.
+        const normalizedOwner = K2DB.normalizeId(ownerTrimmed);
         const collection = await this.getCollection(collectionName);
         const timestamp = Date.now();
         // Generate a new UUIDv7 encoded as Crockford Base32 with hyphens
@@ -1560,6 +1569,11 @@ export class K2DB {
                 }, {});
                 // Merge the preserved fields into the data
                 data = { ...data, ...fieldsToPreserve };
+                // Update _owner if scope is provided
+                const normalizedScope = this.normalizeScope(scope);
+                if (normalizedScope) {
+                    data._owner = normalizedScope;
+                }
                 data._updated = Date.now();
                 // Encrypt secure-prefixed fields at rest (no-op unless encryption is configured)
                 data = this.encryptSecureFieldsDeep(data, `k2db|${collectionName}|${id}`);
@@ -1936,12 +1950,12 @@ export class K2DB {
         }
         return val;
     }
-    /** Lowercase helper for `_owner` field supporting operators like $in/$nin/$eq/$ne and arrays. */
+    /** Trim helper for `_owner` field supporting operators like $in/$nin/$eq/$ne and arrays. */
     static normalizeOwnerField(val) {
         if (typeof val === "string")
-            return val.trim().toLowerCase();
+            return val.trim();
         if (Array.isArray(val)) {
-            return val.map((x) => (typeof x === "string" ? x.trim().toLowerCase() : x));
+            return val.map((x) => (typeof x === "string" ? x.trim() : x));
         }
         if (val && typeof val === "object") {
             const out = { ...val };
@@ -1972,7 +1986,7 @@ export class K2DB {
     }
     /** Uppercase incoming IDs for case-insensitive lookups. */
     static normalizeId(id) {
-        return id.toUpperCase();
+        return id.trim();
     }
     /**
      * Run an async DB operation with timing, slow logging, and hooks.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frogfish/k2db",
-  "version": "3.0.7",
+  "version": "3.0.8",
   "description": "A data handling library for K2 applications.",
   "type": "module",
   "main": "data.js",