@loomcore/api 0.2.56 → 0.2.58

package/dist/controllers/authorizations.controller.js

@@ -1,9 +1,61 @@
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
 import { ApiController } from './api.controller.js';
 import { AuthorizationModelSpec } from '@loomcore/common/models';
 import { AuthorizationService } from '../services/authorization.service.js';
-export class AuthorizationsController extends ApiController {
-    constructor(app, database) {
-        const authorizationService = new AuthorizationService(database);
-        super('authorizations', app, authorizationService, 'authorization', AuthorizationModelSpec);
-    }
-}
+import { Authorize } from '../decorators/authorize.decorator.js';
+let AuthorizationsController = (() => {
+    let _classDecorators = [Authorize('admin')];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = ApiController;
+    var AuthorizationsController = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            AuthorizationsController = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        constructor(app, database) {
+            const authorizationService = new AuthorizationService(database);
+            super('authorizations', app, authorizationService, 'authorization', AuthorizationModelSpec);
+        }
+    };
+    return AuthorizationsController = _classThis;
+})();
+export { AuthorizationsController };

package/dist/controllers/organizations.controller.d.ts

@@ -1,4 +1,4 @@
-import type { IOrganization } from '@loomcore/common/models';
+import { type IOrganization } from '@loomcore/common/models';
 import type { Application, NextFunction, Request, Response } from 'express';
 import type { IDatabase } from '../databases/models/index.js';
 import { OrganizationService } from '../services/index.js';
@@ -13,4 +13,7 @@ export declare class OrganizationsController extends ApiController<IOrganization
     getByCode(req: Request<{
         code: string;
     }>, res: Response, next: NextFunction): Promise<void>;
+    getById(req: Request<{
+        id: string;
+    }>, res: Response, next: NextFunction): Promise<void>;
 }

package/dist/controllers/organizations.controller.js

@@ -1,3 +1,10 @@
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
 var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
     function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
     var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
@@ -25,34 +32,32 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
     if (target) Object.defineProperty(target, contextIn.name, descriptor);
     done = true;
 };
-var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
-    var useValue = arguments.length > 2;
-    for (var i = 0; i < initializers.length; i++) {
-        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
-    }
-    return useValue ? value : void 0;
-};
-import { BadRequestError } from '../errors/index.js';
+import { getSystemUserContext } from '@loomcore/common/models';
+import { BadRequestError, UnauthenticatedError } from '../errors/index.js';
 import { OrganizationService } from '../services/index.js';
 import { apiUtils } from '../utils/index.js';
 import { ApiController } from './api.controller.js';
 import { Authorize } from '../decorators/authorize.decorator.js';
 let OrganizationsController = (() => {
-    let _classDecorators = [Authorize('admin')];
+    let _classDecorators = [Authorize({ features: ['admin'], requireMetaOrg: true })];
     let _classDescriptor;
     let _classExtraInitializers = [];
     let _classThis;
     let _classSuper = ApiController;
+    let _instanceExtraInitializers = [];
+    let _getById_decorators;
     var OrganizationsController = class extends _classSuper {
         static { _classThis = this; }
         static {
             const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _getById_decorators = [Authorize('admin')];
+            __esDecorate(this, null, _getById_decorators, { kind: "method", name: "getById", static: false, private: false, access: { has: obj => "getById" in obj, get: obj => obj.getById }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
             OrganizationsController = _classThis = _classDescriptor.value;
             if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
             __runInitializers(_classThis, _classExtraInitializers);
         }
-        orgService;
+        orgService = __runInitializers(this, _instanceExtraInitializers);
         constructor(app, database) {
             const orgService = new OrganizationService(database);
             super('organizations', app, orgService);
@@ -65,9 +70,13 @@ let OrganizationsController = (() => {
         }
         async getByName(req, res, next) {
             const { name } = req.params;
+            const userContext = req.userContext;
+            if (!userContext) {
+                throw new UnauthenticatedError();
+            }
             try {
                 res.set('Content-Type', 'application/json');
-                const entity = await this.orgService.findOne(req.userContext, {
+                const entity = await this.orgService.findOne(userContext, {
                     filters: { name: { contains: name } },
                 });
                 if (!entity)
@@ -81,9 +90,13 @@ let OrganizationsController = (() => {
         }
         async getByCode(req, res, next) {
             const { code } = req.params;
+            const userContext = req.userContext;
+            if (!userContext) {
+                throw new UnauthenticatedError();
+            }
             try {
                 res.set('Content-Type', 'application/json');
-                const entity = await this.orgService.findOne(req.userContext, {
+                const entity = await this.orgService.findOne(userContext, {
                     filters: { code: { eq: code } },
                 });
                 if (!entity)
@@ -95,6 +108,20 @@ let OrganizationsController = (() => {
                 return;
             }
         }
+        async getById(req, res, next) {
+            const userContext = req.userContext;
+            if (!userContext) {
+                throw new UnauthenticatedError();
+            }
+            if (String(req.params.id) === String(userContext.user._orgId)) {
+                return super.getById(req, res, next);
+            }
+            const systemUserContext = getSystemUserContext();
+            if (String(userContext.user._orgId) === String(systemUserContext.user._orgId)) {
+                return super.getById(req, res, next);
+            }
+            throw new BadRequestError('User is not authorized to access this organization');
+        }
     };
     return OrganizationsController = _classThis;
 })();

package/dist/controllers/types.d.ts

@@ -1,7 +1,7 @@
 import { IEntity, IQueryOptions, IUserContext } from '@loomcore/common/models';
 import { Operation } from '../databases/index.js';
-export type PrepareQueryCustomFunction = (userContext: IUserContext | undefined, queryObject: IQueryOptions, operations: Operation[]) => {
-    queryObject: IQueryOptions;
+export type PrepareQueryCustomFunction = (userContext: IUserContext | undefined, queryOptions: IQueryOptions, operations: Operation[]) => {
+    queryOptions: IQueryOptions;
     operations: Operation[];
 };
 export type PostProcessEntityCustomFunction<TIn extends IEntity, TOut extends IEntity> = (userContext: IUserContext, entity: TIn) => TOut;

package/dist/decorators/allow-anonymous.decorator.d.ts

@@ -0,0 +1,3 @@
+export declare function getValue(entity: any): boolean | undefined;
+export declare function hasAllowAnonymous(entity: any): boolean;
+export declare function AllowAnonymous(): (target: Function, _context: ClassDecoratorContext | ClassMethodDecoratorContext) => void;

package/dist/decorators/allow-anonymous.decorator.js

@@ -0,0 +1,13 @@
+const ALLOW_ANONYMOUS_METADATA_KEY = Symbol('auth-decorator:allow-anonymous');
+export function getValue(entity) {
+    const value = Reflect.getMetadata(ALLOW_ANONYMOUS_METADATA_KEY, entity);
+    return value;
+}
+export function hasAllowAnonymous(entity) {
+    return Reflect.hasOwnMetadata(ALLOW_ANONYMOUS_METADATA_KEY, entity);
+}
+export function AllowAnonymous() {
+    return function (target, _context) {
+        Reflect.defineMetadata(ALLOW_ANONYMOUS_METADATA_KEY, true, target);
+    };
+}

package/dist/decorators/auth-requirement.interface.d.ts

@@ -0,0 +1,7 @@
+export type MatchMode = 'all' | 'any';
+export interface IAuthRequirement {
+    features?: string[];
+    matchMode?: MatchMode;
+    denyOnImpersonation?: boolean;
+    requireMetaOrg?: boolean;
+}

package/dist/decorators/auth-requirement.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/decorators/authorize.decorator.d.ts

@@ -1,13 +1,9 @@
 import 'reflect-metadata';
-export declare const AUTH_METADATA_KEY: unique symbol;
-export type MatchMode = 'all' | 'any';
-export interface AuthRequirement {
-    features: string[];
-    mode: MatchMode;
-    allowAnonymous?: boolean;
-}
-export declare function Authorize(features?: string | string[], options?: {
-    all?: boolean;
-}): (value: Function, _context: ClassDecoratorContext | ClassMethodDecoratorContext) => void;
-export declare function AllowAnonymous(): (value: Function, _context: ClassDecoratorContext | ClassMethodDecoratorContext) => void;
-export declare function resolveAuthRequirement(controllerConstructor: Function, prototype: any, propertyKey: string): AuthRequirement | undefined;
+import { IAuthRequirement, MatchMode } from './index.js';
+export declare function getAuthRequirement(entity: any): IAuthRequirement | undefined;
+export declare function hasAuthRequirement(entity: any): boolean;
+type AuthorizeDecorator = (target: Function, _context: ClassDecoratorContext | ClassMethodDecoratorContext) => void;
+export declare function Authorize(): AuthorizeDecorator;
+export declare function Authorize(authRequirement: IAuthRequirement): AuthorizeDecorator;
+export declare function Authorize(features: string | string[], matchMode?: MatchMode): AuthorizeDecorator;
+export {};

package/dist/decorators/authorize.decorator.js

@@ -1,33 +1,22 @@
 import 'reflect-metadata';
-export const AUTH_METADATA_KEY = Symbol('authorize:features');
-export function Authorize(features = [], options = {}) {
-    const requirement = {
-        features: Array.isArray(features) ? features : [features],
-        mode: options.all ? 'all' : 'any',
-    };
-    return function (value, _context) {
-        Reflect.defineMetadata(AUTH_METADATA_KEY, requirement, value);
-    };
+const AUTHORIZE_METADATA_KEY = Symbol('auth-decorator:authorize');
+export function getAuthRequirement(entity) {
+    const value = Reflect.getMetadata(AUTHORIZE_METADATA_KEY, entity);
+    return value;
 }
-export function AllowAnonymous() {
-    return function (value, _context) {
-        const metadataValue = {
-            features: [],
-            mode: 'any',
-            allowAnonymous: true,
-        };
-        Reflect.defineMetadata(AUTH_METADATA_KEY, metadataValue, value);
-    };
+export function hasAuthRequirement(entity) {
+    return Reflect.hasOwnMetadata(AUTHORIZE_METADATA_KEY, entity);
 }
-export function resolveAuthRequirement(controllerConstructor, prototype, propertyKey) {
-    const method = prototype[propertyKey];
-    if (typeof method === 'function') {
-        const methodLevel = Reflect.getMetadata(AUTH_METADATA_KEY, method);
-        if (methodLevel)
-            return methodLevel;
-    }
-    const classLevel = Reflect.getMetadata(AUTH_METADATA_KEY, controllerConstructor);
-    if (classLevel)
-        return classLevel;
-    return undefined;
+export function Authorize(authRequirementOrFeatures, matchMode) {
+    return function (target, _context) {
+        let authRequirement;
+        if (typeof authRequirementOrFeatures === 'string' || Array.isArray(authRequirementOrFeatures)) {
+            const featureList = Array.isArray(authRequirementOrFeatures) ? authRequirementOrFeatures : [authRequirementOrFeatures];
+            authRequirement = { features: featureList, matchMode: matchMode ?? 'any' };
+        }
+        else {
+            authRequirement = authRequirementOrFeatures;
+        }
+        Reflect.defineMetadata(AUTHORIZE_METADATA_KEY, authRequirement, target);
+    };
 }

package/dist/decorators/index.d.ts

@@ -1 +1,3 @@
-export { Authorize, AllowAnonymous } from './authorize.decorator.js';
+export { Authorize } from './authorize.decorator.js';
+export { AllowAnonymous } from './allow-anonymous.decorator.js';
+export type { IAuthRequirement, MatchMode } from './auth-requirement.interface.js';

package/dist/decorators/index.js

@@ -1 +1,2 @@
-export { Authorize, AllowAnonymous } from './authorize.decorator.js';
+export { Authorize } from './authorize.decorator.js';
+export { AllowAnonymous } from './allow-anonymous.decorator.js';

package/dist/decorators/resolve-allow-anonymous.util.d.ts

@@ -0,0 +1 @@
+export declare function resolveAllowAnonymous(controllerConstructor: Function, prototype: any, propertyKey: string): boolean | undefined;

package/dist/decorators/resolve-allow-anonymous.util.js

@@ -0,0 +1,6 @@
+import { getValue } from './allow-anonymous.decorator.js';
+import { resolveAuthDecoratorTarget } from './resolve-auth-decorator-target.util.js';
+export function resolveAllowAnonymous(controllerConstructor, prototype, propertyKey) {
+    const target = resolveAuthDecoratorTarget(controllerConstructor, prototype, propertyKey);
+    return getValue(target);
+}

package/dist/decorators/resolve-auth-decorator-target.util.d.ts

@@ -0,0 +1 @@
+export declare function resolveAuthDecoratorTarget(controllerConstructor: Function, prototype: any, propertyKey: string): Function;

package/dist/decorators/resolve-auth-decorator-target.util.js

@@ -0,0 +1,9 @@
+import { hasAllowAnonymous } from './allow-anonymous.decorator.js';
+import { hasAuthRequirement } from './authorize.decorator.js';
+export function resolveAuthDecoratorTarget(controllerConstructor, prototype, propertyKey) {
+    const method = prototype?.[propertyKey];
+    if (typeof method === 'function' && (hasAuthRequirement(method) || hasAllowAnonymous(method))) {
+        return method;
+    }
+    return controllerConstructor;
+}

package/dist/decorators/resolve-auth-requirement.util.d.ts

@@ -0,0 +1,2 @@
+import { IAuthRequirement } from './auth-requirement.interface.js';
+export declare function resolveAuthRequirement(controllerConstructor: Function, prototype: any, propertyKey: string): IAuthRequirement | undefined;

package/dist/decorators/resolve-auth-requirement.util.js

@@ -0,0 +1,6 @@
+import { getAuthRequirement } from './authorize.decorator.js';
+import { resolveAuthDecoratorTarget } from './resolve-auth-decorator-target.util.js';
+export function resolveAuthRequirement(controllerConstructor, prototype, propertyKey) {
+    const target = resolveAuthDecoratorTarget(controllerConstructor, prototype, propertyKey);
+    return getAuthRequirement(target);
+}

package/dist/errors/unauthorized.error.d.ts

@@ -1,7 +1,7 @@
 import { CustomError } from '@loomcore/common/errors';
 export declare class UnauthorizedError extends CustomError {
     statusCode: number;
-    constructor(missing?: string[]);
+    constructor(message?: string);
     serializeErrors(): {
         message: string;
     }[];

package/dist/errors/unauthorized.error.js

@@ -1,10 +1,8 @@
 import { CustomError } from '@loomcore/common/errors';
 export class UnauthorizedError extends CustomError {
     statusCode = 403;
-    constructor(missing) {
-        super(missing?.length
-            ? `Missing required feature(s): ${missing.join(', ')}`
-            : 'Unauthorized');
+    constructor(message) {
+        super(message ?? 'Unauthorized');
         Object.setPrototypeOf(this, UnauthorizedError.prototype);
     }
     serializeErrors() {

package/dist/middleware/authorize/authorize.middleware.d.ts

@@ -1,3 +1,3 @@
 import type { RequestHandler } from 'express';
-import { AuthRequirement } from '../../decorators/authorize.decorator.js';
-export declare function buildAuthGuard(requirement: AuthRequirement | undefined): RequestHandler;
+import { IAuthRequirement } from '../../decorators/auth-requirement.interface.js';
+export declare function buildAuthGuard(requirement: IAuthRequirement | undefined): RequestHandler;

package/dist/middleware/authorize/authorize.middleware.js

@@ -1,23 +1,28 @@
 import { UnauthorizedError } from '../../errors/index.js';
 import { authenticateRequest } from './authenticate-request.js';
+import { getSystemUserContext } from '@loomcore/common/models';
 export function buildAuthGuard(requirement) {
     return (req, _res, next) => {
-        if (requirement?.allowAnonymous) {
-            return next();
-        }
         const userContext = authenticateRequest(req);
         req.userContext = userContext;
-        if (!requirement || requirement.features.length === 0) {
-            return next();
+        if (requirement?.denyOnImpersonation && userContext.impersonatorId !== undefined) {
+            throw new UnauthorizedError('Unauthorized: Endpoint requires non-impersonated user.');
+        }
+        const systemUserContext = getSystemUserContext();
+        if (requirement?.requireMetaOrg && userContext.user._orgId !== systemUserContext.user._orgId) {
+            throw new UnauthorizedError('Unauthorized: Endpoint requires meta organization user.');
         }
-        const userFeatures = new Set(userContext.features);
-        const hasAccess = requirement.mode === 'all'
-            ? requirement.features.every((f) => userFeatures.has(f))
-            : requirement.features.some((f) => userFeatures.has(f));
-        if (!hasAccess) {
-            const missing = requirement.features.filter((f) => !userFeatures.has(f));
-            throw new UnauthorizedError(missing);
+        if (requirement?.features?.length) {
+            const userFeatures = new Set(userContext.features);
+            const hasFeatures = requirement.matchMode === 'all'
+                ? requirement.features?.every((f) => userFeatures.has(f))
+                : requirement.features?.some((f) => userFeatures.has(f));
+            if (!hasFeatures) {
+                const missing = requirement.features?.filter((f) => !userFeatures.has(f));
+                throw new UnauthorizedError(`Unauthorized: Missing required feature(s): ${missing?.join(', ')}`);
+            }
         }
         next();
     };
 }
+;

package/dist/services/generic-api-service/generic-api-service.interface.d.ts

@@ -8,8 +8,8 @@ export interface IGenericApiService<T extends IEntity> {
     getModelSpec(): IModelSpec;
     validate(doc: any, isPartial?: boolean): ValueError[] | null;
     validateMany(docs: any[], isPartial?: boolean): ValueError[] | null;
-    prepareQuery(userContext: IUserContext | undefined, queryObject: IQueryOptions, operations: Operation[]): {
-        queryObject: IQueryOptions;
+    prepareQuery(userContext: IUserContext | undefined, queryOptions: IQueryOptions, operations: Operation[]): {
+        queryOptions: IQueryOptions;
         operations: Operation[];
     };
     preProcessEntity(userContext: IUserContext, entity: Partial<T>, isCreate: boolean, allowId: boolean): Promise<Partial<T>>;

package/dist/services/generic-api-service/generic-api.service.d.ts

@@ -15,8 +15,8 @@ export declare class GenericApiService<T extends IEntity> implements IGenericApi
     getModelSpec(): IModelSpec;
     getAll(userContext: IUserContext): Promise<T[]>;
     getAll<TCustom extends IEntity>(userContext: IUserContext, prepareQueryCustom: PrepareQueryCustomFunction, postProcessEntityCustom: PostProcessEntityCustomFunction<T, TCustom>): Promise<TCustom[]>;
-    prepareQuery(userContext: IUserContext | undefined, queryObject: IQueryOptions, operations: Operation[]): {
-        queryObject: IQueryOptions;
+    prepareQuery(userContext: IUserContext | undefined, queryOptions: IQueryOptions, operations: Operation[]): {
+        queryOptions: IQueryOptions;
         operations: Operation[];
     };
     validate(doc: any, isPartial?: boolean): ValueError[] | null;
@@ -35,9 +35,9 @@ export declare class GenericApiService<T extends IEntity> implements IGenericApi
     fullUpdateById(userContext: IUserContext, id: AppIdType, entity: T): Promise<T>;
     partialUpdateById(userContext: IUserContext, id: AppIdType, entity: Partial<T>): Promise<T>;
     partialUpdateByIdWithoutPreAndPostProcessing(userContext: IUserContext, id: AppIdType, entity: Partial<T>): Promise<T>;
-    update(userContext: IUserContext, queryObject: IQueryOptions, entity: Partial<T>): Promise<T[]>;
+    update(userContext: IUserContext, queryOptions: IQueryOptions, entity: Partial<T>): Promise<T[]>;
     deleteById(userContext: IUserContext, id: AppIdType): Promise<DeleteResult>;
-    deleteMany(userContext: IUserContext, queryObject: IQueryOptions): Promise<DeleteResult>;
-    find(userContext: IUserContext, queryObject: IQueryOptions): Promise<T[]>;
-    findOne(userContext: IUserContext, queryObject: IQueryOptions): Promise<T | null>;
+    deleteMany(userContext: IUserContext, queryOptions: IQueryOptions): Promise<DeleteResult>;
+    find(userContext: IUserContext, queryOptions: IQueryOptions): Promise<T[]>;
+    findOne(userContext: IUserContext, queryOptions: IQueryOptions): Promise<T | null>;
 }

package/dist/services/generic-api-service/generic-api.service.js

@@ -24,9 +24,7 @@ export class GenericApiService {
         if (prepareQueryCustom) {
             operations = prepareQueryCustom(userContext, {}, []).operations;
         }
-        else {
-            operations = this.prepareQuery(userContext, {}, []).operations;
-        }
+        operations = this.prepareQuery(userContext, {}, operations).operations;
         const entities = await this.database.getAll(operations, this.pluralResourceName);
         return entities.map((entity) => {
             const dbProcessed = this.postProcessEntity(userContext, entity);
@@ -36,8 +34,8 @@ export class GenericApiService {
             return dbProcessed;
         });
     }
-    prepareQuery(userContext, queryObject, operations) {
-        return { queryObject, operations };
+    prepareQuery(userContext, queryOptions, operations) {
+        return { queryOptions, operations };
     }
     validate(doc, isPartial = false) {
         return entityUtils.validate(this.modelSpec, doc, isPartial);
@@ -77,15 +75,12 @@ export class GenericApiService {
         return this.database.postProcessEntity(entity, this.modelSpec.fullSchema);
     }
     async get(userContext, queryOptions = { ...DefaultQueryOptions }, prepareQueryCustom, postProcessEntityCustom) {
-        const preparedOptions = this.prepareQueryOptions(userContext, queryOptions);
         let operations = [];
         if (prepareQueryCustom) {
-            operations = prepareQueryCustom(userContext, {}, []).operations;
+            ({ queryOptions, operations } = prepareQueryCustom(userContext, {}, []));
         }
-        else {
-            operations = this.prepareQuery(userContext, {}, []).operations;
-        }
-        const pagedResult = await this.database.get(operations, preparedOptions, this.modelSpec, this.pluralResourceName);
+        ({ queryOptions, operations } = this.prepareQuery(userContext, queryOptions, operations));
+        const pagedResult = await this.database.get(operations, queryOptions, this.modelSpec, this.pluralResourceName);
         const transformedEntities = (pagedResult.entities || []).map((entity) => {
             const transformedEntity = this.postProcessEntity(userContext, entity);
             if (postProcessEntityCustom) {
@@ -103,18 +98,12 @@ export class GenericApiService {
     }
     async getById(userContext, id, prepareQueryCustom, postProcessEntityCustom) {
         let operations = [];
-        let queryObject = {};
+        let queryOptions = {};
         if (prepareQueryCustom) {
-            const result = prepareQueryCustom(userContext, {}, []);
-            operations = result.operations;
-            queryObject = result.queryObject;
-        }
-        else {
-            const result = this.prepareQuery(userContext, {}, []);
-            operations = result.operations;
-            queryObject = result.queryObject;
+            ({ operations, queryOptions } = prepareQueryCustom(userContext, {}, []));
         }
-        const entity = await this.database.getById(operations, queryObject, id, this.pluralResourceName);
+        ({ operations, queryOptions } = this.prepareQuery(userContext, queryOptions, operations));
+        const entity = await this.database.getById(operations, queryOptions, id, this.pluralResourceName);
         if (!entity) {
             throw new IdNotFoundError();
         }
@@ -155,14 +144,14 @@ export class GenericApiService {
             return [];
         }
         const preparedEntities = await Promise.all(entities.map((entity) => this.preProcessEntity(userContext, entity, false, true)));
-        const { queryObject, operations } = this.prepareQuery(userContext, {}, []);
-        const rawUpdatedEntities = await this.database.batchUpdate(preparedEntities, operations, queryObject, this.pluralResourceName);
+        const { queryOptions, operations } = this.prepareQuery(userContext, {}, []);
+        const rawUpdatedEntities = await this.database.batchUpdate(preparedEntities, operations, queryOptions, this.pluralResourceName);
         const updatedEntities = rawUpdatedEntities.map((entity) => this.postProcessEntity(userContext, entity));
         return updatedEntities;
     }
     async fullUpdateById(userContext, id, entity) {
-        const { operations, queryObject } = this.prepareQuery(userContext, {}, []);
-        const existingEntity = await this.database.getById(operations, queryObject, id, this.pluralResourceName);
+        const { operations, queryOptions } = this.prepareQuery(userContext, {}, []);
+        const existingEntity = await this.database.getById(operations, queryOptions, id, this.pluralResourceName);
         if (!existingEntity) {
             throw new IdNotFoundError();
         }
@@ -188,8 +177,8 @@ export class GenericApiService {
         const rawUpdatedEntity = await this.database.partialUpdateById([], id, preparedEntity, this.pluralResourceName);
         return this.database.postProcessEntity(rawUpdatedEntity, this.modelSpec.fullSchema);
     }
-    async update(userContext, queryObject, entity) {
-        const { queryObject: preparedQuery, operations } = this.prepareQuery(userContext, queryObject, []);
+    async update(userContext, queryOptions, entity) {
+        const { queryOptions: preparedQuery, operations } = this.prepareQuery(userContext, queryOptions, []);
         const preparedEntity = await this.preProcessEntity(userContext, entity, false, true);
         const rawUpdatedEntities = await this.database.update(preparedQuery, preparedEntity, operations, this.pluralResourceName);
         const updatedEntities = rawUpdatedEntities.map((entity) => this.postProcessEntity(userContext, entity));
@@ -202,18 +191,18 @@ export class GenericApiService {
         }
         return deleteResult;
     }
-    async deleteMany(userContext, queryObject) {
-        const { queryObject: preparedQuery, operations } = this.prepareQuery(userContext, queryObject, []);
+    async deleteMany(userContext, queryOptions) {
+        const { queryOptions: preparedQuery, operations } = this.prepareQuery(userContext, queryOptions, []);
         const deleteResult = await this.database.deleteMany(preparedQuery, this.pluralResourceName);
         return deleteResult;
     }
-    async find(userContext, queryObject) {
-        const { queryObject: preparedQuery, operations } = this.prepareQuery(userContext, queryObject, []);
+    async find(userContext, queryOptions) {
+        const { queryOptions: preparedQuery, operations } = this.prepareQuery(userContext, queryOptions, []);
         const rawEntities = await this.database.find(preparedQuery, this.pluralResourceName);
         return rawEntities.map((entity) => this.postProcessEntity(userContext, entity));
     }
-    async findOne(userContext, queryObject) {
-        const { queryObject: preparedQuery, operations } = this.prepareQuery(userContext, queryObject, []);
+    async findOne(userContext, queryOptions) {
+        const { queryOptions: preparedQuery, operations } = this.prepareQuery(userContext, queryOptions, []);
         const rawEntity = await this.database.findOne(preparedQuery, this.pluralResourceName);
         return rawEntity ? this.postProcessEntity(userContext, rawEntity) : null;
     }

package/dist/services/multi-tenant-api.service.d.ts

@@ -6,7 +6,7 @@ export declare class MultiTenantApiService<T extends IEntity> extends GenericApi
     private tenantDecorator?;
     constructor(database: IDatabase, pluralResourceName: string, singularResourceName: string, modelSpec: IModelSpec);
     prepareQuery(userContext: IUserContext, queryOptions: IQueryOptions, operations: Operation[]): {
-        queryObject: IQueryOptions;
+        queryOptions: IQueryOptions;
         operations: Operation[];
     };
     preProcessEntity(userContext: IUserContext, entity: Partial<T>, isCreate: boolean, allowId?: boolean): Promise<Partial<T>>;