@jskit-ai/json-rest-api-core 0.1.63 → 0.1.65

package/package.descriptor.mjs

@@ -1,9 +1,9 @@
 export default Object.freeze({
   packageVersion: 1,
   packageId: "@jskit-ai/json-rest-api-core",
-  version: "0.1.63",
+  version: "0.1.65",
   kind: "runtime",
-  description: "Shared internal json-rest-api host runtime for JSKIT server packages.",
+  description: "Shared internal json-rest-api host runtime with autofilter, query-projection, and row-policy support.",
   dependsOn: [
     "@jskit-ai/database-runtime",
     "@jskit-ai/kernel"
@@ -34,7 +34,7 @@ export default Object.freeze({
       surfaces: [
         {
           subpath: "./server",
-          summary: "Exports the shared internal json-rest-api host token and host registration helpers."
+          summary: "Exports the shared internal json-rest-api host token and resource registration helpers, including server-only row policies."
         }
       ],
       containerTokens: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/json-rest-api-core",
-  "version": "0.1.63",
+  "version": "0.1.65",
   "type": "module",
   "scripts": {
     "test": "node --test"
@@ -10,7 +10,7 @@
   },
   "dependencies": {
     "hooked-api": "1.x.x",
-    "json-rest-api": "1.x.x",
-    "@jskit-ai/kernel": "0.1.120"
+    "json-rest-api": "^1.0.25",
+    "@jskit-ai/kernel": "0.1.121"
   }
 }

package/src/server/jsonRestApiHost.js

@@ -1,5 +1,11 @@
 import { Api } from "hooked-api";
-import { AutoFilterPlugin, QueryProjectionsPlugin, RestApiKnexPlugin, RestApiPlugin } from "json-rest-api";
+import {
+  AutoFilterPlugin,
+  QueryProjectionsPlugin,
+  RestApiKnexPlugin,
+  RestApiPlugin,
+  RowPolicyPlugin
+} from "json-rest-api";
 import { normalizeRecordId } from "@jskit-ai/kernel/shared/support/normalize";
 import { resolveCrudResourceScopeName } from "@jskit-ai/kernel/shared/support/crudLookup";
 
@@ -464,6 +470,7 @@ function createJsonRestResourceScopeOptions(
   {
     writeSerializers = {},
     normalizeId = null,
+    rowPolicy = undefined,
     searchSchema = null,
     queryFields = null
   } = {}
@@ -499,6 +506,9 @@ function createJsonRestResourceScopeOptions(
   if (typeof normalizeId === "function") {
     scopeOptions.normalizeId = normalizeId;
   }
+  if (rowPolicy !== undefined) {
+    scopeOptions.rowPolicy = rowPolicy;
+  }
 
   return scopeOptions;
 }
@@ -591,6 +601,7 @@ async function createJsonRestApiHost({ knex }) {
 
   await api.use(QueryProjectionsPlugin);
   await api.use(RestApiKnexPlugin, { knex });
+  await api.use(RowPolicyPlugin);
   await api.use(AutoFilterPlugin, {
     resolvers: {
       workspace: ({ context }) => resolveWorkspaceScopeValue(context),

package/test/entrypoints.boundary.test.js

@@ -26,6 +26,7 @@ test("package exports include explicit server jsonRestApiHost entrypoint only",
   const exportsMap = packageJson && typeof packageJson === "object" ? packageJson.exports : {};
   assert.equal(exportsMap["./server/jsonRestApiHost"], "./src/server/jsonRestApiHost.js");
   assert.equal(exportsMap["./server"], undefined);
+  assert.equal(packageJson.dependencies?.["json-rest-api"], "^1.0.25");
 });
 
 test("server jsonRestApiHost entrypoint no longer exports host-side JSON:API simplification helpers", async () => {
@@ -157,6 +158,46 @@ test("createJsonRestApiHost configures the internal json-rest logger at error le
   assert.equal(api.options.logging.level, "error");
 });
 
+test("createJsonRestApiHost installs row policies before resources are added", async () => {
+  const fakeKnex = Object.assign(() => {}, {
+    client: {
+      config: {
+        client: "sqlite3"
+      }
+    },
+    async raw() {
+      return [
+        {
+          version: "3.35.5"
+        }
+      ];
+    },
+    transaction() {}
+  });
+
+  const api = await createJsonRestApiHost({ knex: fakeKnex });
+  const rowPolicy = () => false;
+  const scopeOptions = createJsonRestResourceScopeOptions({
+    tableName: "private_contacts",
+    schema: {
+      id: { type: "id", primary: true }
+    }
+  }, {
+    rowPolicy
+  });
+
+  await api.addResource("privateContacts", scopeOptions);
+
+  assert.deepEqual(api.rowPolicies.getConfig(), {
+    policies: []
+  });
+  assert.deepEqual(api.rowPolicies.getScopeConfig("privateContacts"), {
+    policy: "<inline>",
+    source: "inline"
+  });
+  assert.equal(scopeOptions.rowPolicy, rowPolicy);
+});
+
 test("shared query/document helpers build json-rest-api request shapes", () => {
   assert.deepEqual(
     buildJsonRestQueryParams("contacts", {
@@ -284,6 +325,7 @@ test("buildJsonRestQueryParams preserves structured filter values", () => {
 test("createJsonRestResourceScopeOptions clones canonical resource metadata and resolves symbolic write serializers", () => {
   const serializer = (value) => value;
   const normalizeId = (value) => String(value || "").trim() || null;
+  const rowPolicy = () => false;
   const source = Object.freeze({
     namespace: "contacts",
     tableName: "contacts",
@@ -353,6 +395,7 @@ test("createJsonRestResourceScopeOptions clones canonical resource metadata and
 
   const result = createJsonRestResourceScopeOptions(source, {
     normalizeId,
+    rowPolicy,
     writeSerializers: {
       "datetime-utc": serializer
     }
@@ -368,6 +411,7 @@ test("createJsonRestResourceScopeOptions clones canonical resource metadata and
   assert.equal(result.schema.bookingSteps.virtual, true);
   assert.equal(result.schema.pets.virtual, true);
   assert.equal(result.normalizeId, normalizeId);
+  assert.equal(result.rowPolicy, rowPolicy);
   assert.equal(result.schema.name.maxLength, 190);
   assert.equal(result.schema.name.operations.output.required, true);
   assert.equal(result.operations.view.method, "GET");