@lovrozagar/oat 0.12.3 → 0.12.5

package/dist/runtime/self.js

@@ -0,0 +1,192 @@
+/**
+ * `x-entity.identity: self` — the signed-up caller is the record.
+ * There is no list and no create. A read returns that caller. An update is still there
+ * on the next read. No token is a 401.
+ */
+import { requestContentOf } from "./body.js";
+import { ASSERTED } from "./finding.js";
+import { fillPath } from "./world.js";
+export const SELF_IDENTITY = "self";
+export const SELF_CHECK_ID = "auth.self-is-the-caller";
+const PREFERRED_FIELDS = ["first_name", "display_name", "name", "nickname"];
+export function selfOperationIds(entity) {
+    if (entity.identity !== SELF_IDENTITY)
+        return [];
+    return [entity.read, entity.update].filter((id) => id !== undefined);
+}
+export function entityIsSelf(entity) {
+    return selfOperationIds(entity).length > 0;
+}
+function asSchema(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return null;
+    return value;
+}
+/** A nullable union is the non-null branch. `type: ["string", "null"]` is a string. */
+function unwrap(schema) {
+    const branches = Array.isArray(schema.anyOf) ? schema.anyOf : Array.isArray(schema.oneOf) ? schema.oneOf : null;
+    if (branches !== null) {
+        const nonNull = branches
+            .map(asSchema)
+            .filter((branch) => branch !== null && branch.type !== "null");
+        const only = nonNull.length === 1 ? nonNull[0] : undefined;
+        if (only !== undefined)
+            return unwrap(only);
+    }
+    if (Array.isArray(schema.type)) {
+        const types = schema.type.filter((type) => type !== "null");
+        if (types.length === 1)
+            return { ...schema, type: types[0] };
+    }
+    return schema;
+}
+function probeField(schema) {
+    const root = asSchema(schema);
+    if (root === null)
+        return null;
+    const properties = unwrap(root).properties;
+    if (properties === null || typeof properties !== "object")
+        return null;
+    const record = properties;
+    const names = [
+        ...PREFERRED_FIELDS.filter((name) => record[name] !== undefined),
+        ...Object.keys(record).filter((name) => !PREFERRED_FIELDS.includes(name)),
+    ];
+    for (const name of names) {
+        const raw = asSchema(record[name]);
+        if (raw === null)
+            continue;
+        const rec = unwrap(raw);
+        if (rec.type !== "string")
+            continue;
+        if (rec.readOnly === true)
+            continue;
+        if (rec.format === "email" || rec.format === "uri" || rec.format === "date-time")
+            continue;
+        if (typeof rec.pattern === "string")
+            continue;
+        const maxLength = typeof rec.maxLength === "number" ? rec.maxLength : 64;
+        if (maxLength < 4)
+            continue;
+        return { maxLength, name };
+    }
+    return null;
+}
+function nextValue(maxLength, current) {
+    const primary = "Oat".slice(0, maxLength);
+    const alternate = "Xot".slice(0, maxLength);
+    return current === primary ? alternate : primary;
+}
+function operation(model, id) {
+    return id === undefined ? undefined : model.byOperationId.get(id);
+}
+function pathOf(op) {
+    try {
+        return fillPath(op.path, {});
+    }
+    catch {
+        return null;
+    }
+}
+export async function runSelfIdentity(input) {
+    const readOp = operation(input.model, input.entity.read);
+    const updateOp = operation(input.model, input.entity.update);
+    const ops = selfOperationIds(input.entity);
+    const findings = input.findings.attributed(ops).ownedBy(SELF_CHECK_ID);
+    const probe = readOp ?? updateOp;
+    if (probe === undefined)
+        return findings.unresolved(SELF_CHECK_ID, input.entity.name, "no read or update");
+    const probePath = pathOf(probe);
+    if (probePath === null) {
+        return findings.unresolved(SELF_CHECK_ID, input.entity.name, `${probe.operationId} needs a path id`);
+    }
+    const anonymous = await input.client.request(probe.method, probePath, {
+        headers: {},
+        operationId: probe.operationId,
+        skipAuthRefresh: true,
+    });
+    if (anonymous.status !== 401) {
+        return findings.security(SELF_CHECK_ID, input.entity.name, "the caller route answered without a token", `${probe.operationId} returned ${anonymous.status} with no credential. The signed-up caller is the record, so no token is a 401.`, [anonymous]);
+    }
+    if (readOp === undefined) {
+        const updatePath = pathOf(updateOp);
+        if (updatePath === null || updateOp === undefined)
+            return ASSERTED;
+        const wrote = await sendUpdate(input.client, updateOp, updatePath, input.auth, { note: "Oat" });
+        if (wrote.status < 200 || wrote.status >= 300) {
+            return findings.backend(SELF_CHECK_ID, input.entity.name, "updating the caller failed", `${updateOp.operationId} returned ${wrote.status} for the signed-up caller.`, [anonymous, wrote]);
+        }
+        return ASSERTED;
+    }
+    const readPath = pathOf(readOp);
+    if (readPath === null)
+        return findings.unresolved(SELF_CHECK_ID, input.entity.name, "the read needs a path id");
+    const read = await input.client.request(readOp.method, readPath, {
+        headers: input.auth,
+        operationId: readOp.operationId,
+    });
+    if (read.status !== 200) {
+        return findings.backend(SELF_CHECK_ID, input.entity.name, "reading the caller failed", `${readOp.operationId} returned ${read.status} for the signed-up caller. The read is that caller and returns 200.`, [anonymous, read]);
+    }
+    if (updateOp === undefined)
+        return ASSERTED;
+    const updatePath = pathOf(updateOp);
+    if (updatePath === null)
+        return ASSERTED;
+    const content = requestContentOf(updateOp, input.model);
+    const field = probeField(content?.schema);
+    if (field === null) {
+        return findings.unresolved(SELF_CHECK_ID, input.entity.name, "the update has no plain string field to change");
+    }
+    const before = read.responseBody;
+    const current = before !== null && typeof before === "object" ? before[field.name] : undefined;
+    const value = nextValue(field.maxLength, current);
+    const wrote = await sendUpdate(input.client, updateOp, updatePath, input.auth, { [field.name]: value });
+    if (wrote.status < 200 || wrote.status >= 300) {
+        return findings.backend(SELF_CHECK_ID, input.entity.name, "updating the caller failed", `${updateOp.operationId} returned ${wrote.status} when setting ${field.name}.`, [read, wrote]);
+    }
+    const again = await input.client.request(readOp.method, readPath, {
+        headers: input.auth,
+        operationId: readOp.operationId,
+    });
+    const seen = again.responseBody !== null && typeof again.responseBody === "object"
+        ? again.responseBody[field.name]
+        : undefined;
+    if (again.status !== 200 || seen !== value) {
+        return findings.backend(SELF_CHECK_ID, input.entity.name, "an update to the caller did not stick", `${updateOp.operationId} set ${field.name} to ${JSON.stringify(value)}, and the next ${readOp.operationId} returned ${again.status} with ${JSON.stringify(seen)}.`, [wrote, again]);
+    }
+    if (typeof current === "string" || current === null) {
+        await sendUpdate(input.client, updateOp, updatePath, input.auth, { [field.name]: current });
+    }
+    return ASSERTED;
+}
+async function sendUpdate(client, op, path, auth, body) {
+    return client.request(op.method, path, {
+        body,
+        headers: auth,
+        operationId: op.operationId,
+    });
+}
+export const selfIdentityCheck = {
+    id: SELF_CHECK_ID,
+    mutates: true,
+    needs: "x-entity.identity: self, and a read or an update",
+    plan(ctx) {
+        const entity = ctx.model.entities.get(ctx.entityName);
+        if (entity === undefined || !entityIsSelf(entity)) {
+            return { ok: false, needs: "x-entity.identity: self, and a read or an update" };
+        }
+        return { ok: true, value: undefined };
+    },
+    async run(ctx) {
+        return runSelfIdentity({
+            auth: ctx.auth,
+            client: ctx.client,
+            entity: ctx.model.entities.get(ctx.entityName),
+            findings: ctx.findings,
+            model: ctx.model,
+        });
+    },
+    subjects: (entity) => selfOperationIds(entity),
+};
+//# sourceMappingURL=self.js.map

package/dist/runtime/self.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self.js","sourceRoot":"","sources":["../../src/runtime/self.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,OAAO,EAAE,QAAQ,EAAuC,MAAM,cAAc,CAAA;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGrC,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAA;AACnC,MAAM,CAAC,MAAM,aAAa,GAAG,yBAAoD,CAAA;AAEjF,MAAM,gBAAgB,GAAG,CAAC,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;AAE3E,MAAM,UAAU,gBAAgB,CAAC,MAAmB;IACnD,IAAI,MAAM,CAAC,QAAQ,KAAK,aAAa;QAAE,OAAO,EAAE,CAAA;IAChD,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,CAAA;AACnF,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAmB;IAC/C,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;AAC3C,CAAC;AAOD,SAAS,QAAQ,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpF,OAAO,KAAgC,CAAA;AACxC,CAAC;AAED,uFAAuF;AACvF,SAAS,MAAM,CAAC,MAA+B;IAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAC/G,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,QAAQ;aACtB,GAAG,CAAC,QAAQ,CAAC;aACb,MAAM,CAAC,CAAC,MAAM,EAAqC,EAAE,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAA;QAClG,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1D,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,CAAA;QAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IAC7D,CAAC;IACD,OAAO,MAAM,CAAA;AACd,CAAC;AAED,SAAS,UAAU,CAAC,MAAe;IAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC7B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAA;IAC1C,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACtE,MAAM,MAAM,GAAG,UAAqC,CAAA;IACpD,MAAM,KAAK,GAAG;QACb,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;QAChE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;KACzE,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QAClC,IAAI,GAAG,KAAK,IAAI;YAAE,SAAQ;QAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACvB,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAQ;QACnC,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;YAAE,SAAQ;QACnC,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;YAAE,SAAQ;QAC1F,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,SAAQ;QAC7C,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAA;QACxE,IAAI,SAAS,GAAG,CAAC;YAAE,SAAQ;QAC3B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;IAC3B,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,SAAS,SAAS,CAAC,SAAiB,EAAE,OAAgB;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACzC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IAC3C,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAA;AACjD,CAAC;AAED,SAAS,SAAS,CAAC,KAAgB,EAAE,EAAsB;IAC1D,OAAO,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;AAClE,CAAC;AAED,SAAS,MAAM,CAAC,EAAkB;IACjC,IAAI,CAAC;QACJ,OAAO,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAMrC;IACA,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACxD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5D,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IACtE,MAAM,KAAK,GAAG,MAAM,IAAI,QAAQ,CAAA;IAChC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,UAAU,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;IAC1G,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC/B,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC,UAAU,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,WAAW,kBAAkB,CAAC,CAAA;IACrG,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE;QACrE,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,eAAe,EAAE,IAAI;KACrB,CAAC,CAAA;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC9B,OAAO,QAAQ,CAAC,QAAQ,CACvB,aAAa,EACb,KAAK,CAAC,MAAM,CAAC,IAAI,EACjB,2CAA2C,EAC3C,GAAG,KAAK,CAAC,WAAW,aAAa,SAAS,CAAC,MAAM,gFAAgF,EACjI,CAAC,SAAS,CAAC,CACX,CAAA;IACF,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,MAAM,CAAC,QAA0B,CAAC,CAAA;QACrD,IAAI,UAAU,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAA;QAClE,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/F,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC/C,OAAO,QAAQ,CAAC,OAAO,CACtB,aAAa,EACb,KAAK,CAAC,MAAM,CAAC,IAAI,EACjB,4BAA4B,EAC5B,GAAG,QAAQ,CAAC,WAAW,aAAa,KAAK,CAAC,MAAM,4BAA4B,EAC5E,CAAC,SAAS,EAAE,KAAK,CAAC,CAClB,CAAA;QACF,CAAC;QACD,OAAO,QAAQ,CAAA;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IAC/B,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC,UAAU,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAA;IAC/G,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE;QAChE,OAAO,EAAE,KAAK,CAAC,IAAI;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;KAC/B,CAAC,CAAA;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC,OAAO,CACtB,aAAa,EACb,KAAK,CAAC,MAAM,CAAC,IAAI,EACjB,2BAA2B,EAC3B,GAAG,MAAM,CAAC,WAAW,aAAa,IAAI,CAAC,MAAM,qEAAqE,EAClH,CAAC,SAAS,EAAE,IAAI,CAAC,CACjB,CAAA;IACF,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAA;IAC3C,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAA;IACnC,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAA;IACxC,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IACvD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACzC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC,UAAU,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,gDAAgD,CAAC,CAAA;IAC/G,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAA;IAChC,MAAM,OAAO,GACZ,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5G,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IACvG,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC/C,OAAO,QAAQ,CAAC,OAAO,CACtB,aAAa,EACb,KAAK,CAAC,MAAM,CAAC,IAAI,EACjB,4BAA4B,EAC5B,GAAG,QAAQ,CAAC,WAAW,aAAa,KAAK,CAAC,MAAM,iBAAiB,KAAK,CAAC,IAAI,GAAG,EAC9E,CAAC,IAAI,EAAE,KAAK,CAAC,CACb,CAAA;IACF,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE;QACjE,OAAO,EAAE,KAAK,CAAC,IAAI;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;KAC/B,CAAC,CAAA;IACF,MAAM,IAAI,GACT,KAAK,CAAC,YAAY,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACpE,CAAC,CAAE,KAAK,CAAC,YAAwC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC7D,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QAC5C,OAAO,QAAQ,CAAC,OAAO,CACtB,aAAa,EACb,KAAK,CAAC,MAAM,CAAC,IAAI,EACjB,uCAAuC,EACvC,GAAG,QAAQ,CAAC,WAAW,QAAQ,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,kBAAkB,MAAM,CAAC,WAAW,aAAa,KAAK,CAAC,MAAM,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAClK,CAAC,KAAK,EAAE,KAAK,CAAC,CACd,CAAA;IACF,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrD,MAAM,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAC5F,CAAC;IACD,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,UAAU,CACxB,MAAc,EACd,EAAkB,EAClB,IAAY,EACZ,IAAkC,EAClC,IAA6B;IAE7B,OAAO,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE;QACtC,IAAI;QACJ,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,EAAE,CAAC,WAAW;KAC3B,CAAC,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAChC,EAAE,EAAE,aAAa;IACjB,OAAO,EAAE,IAAa;IACtB,KAAK,EAAE,kDAAkD;IACzD,IAAI,CAAC,GAAiB;QACrB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACrD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAA;QACzF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IAC/C,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,GAAiB;QAC1B,OAAO,eAAe,CAAC;YACtB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAgB;YAC7D,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,KAAK;SAChB,CAAC,CAAA;IACH,CAAC;IACD,QAAQ,EAAE,CAAC,MAAmB,EAAY,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC;CACrE,CAAA"}

package/docs/configuration.md

@@ -534,7 +534,7 @@ Without `teardownPrincipal`, provisioned accounts are reported as leftover rathe
 
 `resolveHeaders` is called on every dispatch (including the 401 retry). Merge order: `globalHeaders` → hook → per-request headers → principal credential. Use `ctx.operationId` / `ctx.method` / `ctx.url` to attach a one-shot captcha only on captcha ops. oat does not speak Turnstile.
 
-`resolveInput` is the JSON twin of `resolveUpload`. Return a value to replace that field (`payment_method_id` on `billing.subscribe`); `null` keeps the generator.
+`resolveInput` is the JSON twin of `resolveUpload`. Return a value to replace that field (`payment_method_id` on `billing.subscribe`); `null` keeps the generator. `request.value` is the generated value, or `undefined` when the field was left out. Return `null` for an omitted field or a value outside the schema's length or range bounds so a constraint check is the body the server receives.
 
 `resolveQueryCapabilities` runs once per entity after seed. `get(operationId)` (or `"GET /path"`) uses the seeded parent scope so a follow-up read can harvest dynamic columns. A provided `filterable` / `sortable` / `searchable` / `selectable` list **replaces** that axis; omitted axes stay. JSON configs have no hook.
 

package/docs/tags.md

@@ -61,6 +61,8 @@ x-entity:
 
 Overrides path-segment inference. `identity` is required when the item schema has no `id` (or `uuid` / `slug` / `key` / `name`).
 
+`identity: self` means the signed-up caller is the record. The entity needs a read or an update and does not need a list or a create. The read returns 200. An update is still there on the next read. No token returns 401.
+
 **Fallback:** deepest plural segment + HTTP verb. See [How the model is derived](model.md#how-the-model-is-derived).
 
 ### `x-invite`

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@lovrozagar/oat",
-	"version": "0.12.3",
+	"version": "0.12.5",
 	"description": "OpenAPI Tester — matrix-test a live API against its OpenAPI spec",
 	"keywords": [
 		"api",