@jskit-ai/resource-runtime 0.2.13 → 0.2.14

package/CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## Unreleased
 
+- A handle's `joinSource()` carries the table's ownership fields (`workspaceId`, `userId`) as join keys, hidden or not, and `column()` names them: a report joining another owner's scoped rows on the workspace, such as a system job reading each workspace's settings beside its bookings, was refused (`contactRoles.joinSource() carries no hidden field, so it has no column for "workspaceId"`). They name the caller's own scope, so nothing secret leaves the owner; every other hidden column stays out, and `column()` still refuses it.
 - Depends on json-rest-api 3.1.0 exactly (from 3.0.1), from the registry with its published integrity: `lockMode: "noKeyUpdate"`, ON CONFLICT on the matching unique index's exact columns, the PostgreSQL merge race on an uncommitted insert, and the `xid8` field type the change horizon reads.
 - Tests pin three paths the guide now documents: a shared row of a `workspace_or_shared` table is written in the owner's root system context, naming `workspaceId: null`, also inside a request's transaction, and never from a request or a derived job context (`forUser` is refused 403); a job's `actorId` never moves its scope, while a row policy may hold a job done for a person to that person's rows; and a hand route's `request.callOptions()` scopes user, workspace and workspace_user tables as the same request's action does, with no user scope when no one is signed in.
 - A table resource reads an xid8 change stamp through an `xid8` field, json-rest-api 3.1.0's type for PostgreSQL's transaction id: decimal text below 2^64, which filters such as `changedSince: { type: "xid8", actualField: "changed", filterOperator: ">=" }` compare as transaction ids in SQL. A malformed cursor is refused as `REST_API_VALIDATION` before any statement, where a string field sent it to PostgreSQL (22P02), and the field is refused at registration on MySQL, MariaDB and SQLite. With `changeHorizon()`, a read of what changed since goes through the handle, where it was a hand-written scoped query; the data-access guide's "What changed since" gives the migration (an xid8 column a trigger stamps on every insert and update), the field, the filters and the read.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/resource-runtime",
-  "version": "0.2.13",
+  "version": "0.2.14",
   "type": "module",
   "engines": {
     "node": ">=24.0.0"

package/src/server/handleHidden.js

@@ -134,8 +134,8 @@ const HANDLE_SCOPED_QUERIES = new WeakSet();
 const HANDLE_WORK_RUNNERS = new WeakSet();
 // The names an owner's own wrappers of those runners keep.
 const WORK_RUNNER_NAMES = Object.freeze(new Set(["withTransaction", "lockOrCreate"]));
-// The builders a handle's joinSource() answers, which carry the table's visible columns only: the one query builder
-// withoutHiddenFields hands another feature.
+// The builders a handle's joinSource() answers, which carry the table's visible columns and ownership fields only: the
+// one query builder withoutHiddenFields hands another feature.
 const JOIN_SOURCES = new WeakSet();
 
 /**
@@ -151,13 +151,14 @@ function markHandleFunctions({ scopedQuery, withTransaction, lockOrCreate }) {
 /**
  * A handle's joinSource(): the table as a join source for another owner's report, which joins it in its own
  * statement. It answers `{ query, column }`: the rows scopedQuery() gives under `alias` (the caller's ownership, the
- * row policy and `filters` applied) with the stored columns a read answers only, never a hidden one, and
- * `column(field)` naming each under that alias. A CRUD feature's repository answers it to any feature, where it
+ * row policy and `filters` applied) with the stored columns a read answers and the ownership fields, hidden or not,
+ * since a report joins on them and they name the caller's own scope; never another hidden column. `column(field)`
+ * names each under that alias. A CRUD feature's repository answers it to any feature, where it
  * refuses scopedQuery(). The builder comes wrapped, since a builder is thenable.
  * @param {object} dependencies
  * @param {{ knex: { instance: any } }} dependencies.api
  * @param {{ name: string, schema: Record<string, any> }} dependencies.resource
- * @param {() => { vars: { schemaInfo: { schemaStructure: Record<string, any> } } }} dependencies.jsonRest
+ * @param {() => { vars: { schemaInfo: { schemaStructure: Record<string, any>, ownershipFields?: string[] } } }} dependencies.jsonRest
  * @param {(params: { alias: string, filters?: object }, options: object) => Promise<{ query: any }>} dependencies.scopedQuery
  * @param {(field: string, alias?: string) => string} dependencies.column
  */
@@ -173,22 +174,25 @@ function createJoinSource({ api, resource, jsonRest, scopedQuery, column }) {
       throw new TypeError(`${name}.joinSource() needs the alias the report joins the ${name} under.`);
     }
     const { query } = await scopedQuery({ alias, ...(filters === undefined ? {} : { filters }) }, options);
-    const { schemaStructure } = jsonRest().vars.schemaInfo;
-    const visible = Object.keys(schemaStructure).filter((field) => {
+    const { schemaStructure, ownershipFields = [] } = jsonRest().vars.schemaInfo;
+    const joinKeys = new Set(ownershipFields);
+    const carried = Object.keys(schemaStructure).filter((field) => {
       const definition = schemaStructure[field];
-      return field !== "id" && definition.hidden !== true && definition.virtual !== true && !definition.belongsToPolymorphic;
+      return field !== "id" && (definition.hidden !== true || joinKeys.has(field)) &&
+        definition.virtual !== true && !definition.belongsToPolymorphic;
     });
-    // The scoped rows' visible columns, as a derived table under the alias: nothing a caller adds reaches the others.
+    // The scoped rows' visible columns and ownership fields, as a derived table under the alias: nothing a caller adds
+    // reaches the others.
     const source = readOnlyQueryBuilder(
-      (options.trx || api.knex.instance).from(query.select(["id", ...visible].map((field) => column(field, alias))).as(alias)),
+      (options.trx || api.knex.instance).from(query.select(["id", ...carried].map((field) => column(field, alias))).as(alias)),
       { resourceType: name }
     );
     JOIN_SOURCES.add(source);
     return Object.freeze({
       query: source,
       column(field) {
-        if (resource.schema[field]?.hidden === true) {
-          throw new TypeError(`${name}.joinSource() carries no hidden field, so it has no column for "${field}".`);
+        if (resource.schema[field]?.hidden === true && !joinKeys.has(field)) {
+          throw new TypeError(`${name}.joinSource() carries no hidden field but its ownership fields, so it has no column for "${field}".`);
         }
         return column(field, alias);
       }

package/test/hiddenFields.test.js

@@ -114,7 +114,7 @@ test("withoutHiddenFields refuses another feature's read naming a hidden field,
   assert.equal(withoutHiddenFields(cards, plain), cards);
 });
 
-test("withoutHiddenFields refuses another feature's scopedQuery, and any builder a method answers but a joinSource()'s, which carries no hidden column", async (t) => {
+test("withoutHiddenFields refuses another feature's scopedQuery, and any builder a method answers but a joinSource()'s, which carries no hidden column but the ownership fields", async (t) => {
   const { knex, cards, resource, system, options } = await createCardFixture(t);
   // Methods an owner's decorateRepository adds with the handle it receives, answering its scoped rows as scopedQuery()
   // gives them, every column with them: wrapped, and at once.
@@ -145,13 +145,20 @@ test("withoutHiddenFields refuses another feature's scopedQuery, and any builder
     [{ token: "t1" }, { token: "t2" }, { token: "t3" }]);
 
   // The cross-owner report pattern: the table's joinSource() answers the caller's scoped rows, which the report
-  // selects from, with the columns a read answers and no other.
+  // selects from, with the columns a read answers and the ownership fields, and no other.
   const source = await exposed.joinSource({ alias: "c" }, options);
   const rows = await source.query.select({ title: source.column("title") }).orderBy(source.column("id"));
   assert.deepEqual(rows, [{ title: "Rex" }, { title: "Bo" }]);
   const { query: rex } = await exposed.joinSource({ alias: "c", filters: { title: "Rex" } }, options);
-  assert.deepEqual((await rex).map((row) => Object.keys(row)), [["id", "title"]]);
-  assert.throws(() => source.column("publicToken"), /cards\.joinSource\(\) carries no hidden field, so it has no column for "publicToken"/u);
+  assert.deepEqual((await rex).map((row) => Object.keys(row)), [["id", "workspace_id", "title"]]);
+  assert.throws(() => source.column("publicToken"),
+    /cards\.joinSource\(\) carries no hidden field but its ownership fields, so it has no column for "publicToken"/u);
+  // The hidden workspaceId is a join key the source carries: a system report counts each workspace's cards on it.
+  const perWorkspace = await exposed.joinSource({ alias: "c" }, { context: system });
+  const workspaceId = perWorkspace.column("workspaceId");
+  const counts = await perWorkspace.query.select({ workspaceId }).count({ cards: perWorkspace.column("id") })
+    .groupBy(workspaceId).orderBy(workspaceId);
+  assert.deepEqual(counts.map((row) => [Number(row.workspaceId), Number(row.cards)]), [[1, 2], [2, 1]]);
   const again = await exposed.joinSource({ alias: "c" }, options);
   await assert.rejects(async () => again.query.select(cards.column("publicToken", "c")), /public_token/u);
   await assert.rejects(exposed.joinSource({}, options), /cards\.joinSource\(\) needs the alias the report joins the cards under/u);