@mocanvas/store 4.0.1 → 4.1.0

package/dist/index.d.ts

@@ -816,11 +816,21 @@ declare class StoreSchema<R extends UnknownRecord, Props = unknown> {
     /** Scope of a record type; unknown types are treated as `document`. */
     getScope(typeName: string): RecordScope;
     /**
-     * Validate a record, delegating to its record type's validator. Records of
-     * unknown types are passed through untouched so that foreign data survives
-     * a load/save round-trip.
+     * Validate a record, delegating to its record type's validator.
+     *
+     * Two things are checked before the delegation. First, the value has to be a
+     * record at all: an object with a string `id` and a string `typeName`.
+     * Without that check a value carrying no `typeName` looks up `undefined` in
+     * the type map, misses, and takes the unknown-type path below — which is how
+     * `store.put([{ id: "shape:bogus", x: 0, y: 0 }])` used to be accepted.
+     *
+     * Second, a record whose `typeName` this schema does not know is passed
+     * through untouched, so foreign data survives a load/save round-trip. That
+     * is the escape hatch; it is not meant to cover malformed input, hence the
+     * first check.
      */
     validateRecord(store: Store<R, any>, record: R, phase: StoreValidationPhase, recordBefore: R | undefined): R;
+    private onFailure;
     /** The current version of every sequence. Always the v2 shape — mocanvas never writes v1. */
     serialize(): SerializedSchemaV2;
     /** A schema at version 0 of every sequence (all migrations still pending). */

package/dist/index.js

@@ -435,28 +435,51 @@ var StoreSchema = class _StoreSchema {
     return this.typeByName.get(typeName)?.scope ?? "document";
   }
   /**
-   * Validate a record, delegating to its record type's validator. Records of
-   * unknown types are passed through untouched so that foreign data survives
-   * a load/save round-trip.
+   * Validate a record, delegating to its record type's validator.
+   *
+   * Two things are checked before the delegation. First, the value has to be a
+   * record at all: an object with a string `id` and a string `typeName`.
+   * Without that check a value carrying no `typeName` looks up `undefined` in
+   * the type map, misses, and takes the unknown-type path below — which is how
+   * `store.put([{ id: "shape:bogus", x: 0, y: 0 }])` used to be accepted.
+   *
+   * Second, a record whose `typeName` this schema does not know is passed
+   * through untouched, so foreign data survives a load/save round-trip. That
+   * is the escape hatch; it is not meant to cover malformed input, hence the
+   * first check.
    */
   validateRecord(store, record, phase, recordBefore) {
+    if (!isRecordLike(record)) {
+      return this.onFailure(
+        new Error(
+          `Expected a record with a string \`id\` and \`typeName\`, got ${describeRecord(record)}`
+        ),
+        store,
+        record,
+        phase,
+        recordBefore
+      );
+    }
     const type = this.typeByName.get(record.typeName);
     if (!type) return record;
     try {
       return type.validate(record, recordBefore);
     } catch (error) {
-      if (this.options.onValidationFailure) {
-        return this.options.onValidationFailure({
-          error,
-          store,
-          record,
-          phase,
-          recordBefore: recordBefore ?? null
-        });
-      }
-      throw error;
+      return this.onFailure(error, store, record, phase, recordBefore);
     }
   }
+  onFailure(error, store, record, phase, recordBefore) {
+    if (this.options.onValidationFailure) {
+      return this.options.onValidationFailure({
+        error,
+        store,
+        record,
+        phase,
+        recordBefore: recordBefore ?? null
+      });
+    }
+    throw error;
+  }
   /** The current version of every sequence. Always the v2 shape — mocanvas never writes v1. */
   serialize() {
     const sequences = {};
@@ -570,6 +593,18 @@ var StoreSchema = class _StoreSchema {
     return { type: "success", value: store };
   }
 };
+function describeRecord(value) {
+  if (value === null) return "null";
+  if (typeof value !== "object") return typeof value;
+  if (Array.isArray(value)) return "an array";
+  const { id, typeName } = value;
+  const parts = [];
+  parts.push(typeof id === "string" ? `id ${JSON.stringify(id)}` : `id ${id === void 0 ? "missing" : typeof id}`);
+  parts.push(
+    typeof typeName === "string" ? `typeName ${JSON.stringify(typeName)}` : `typeName ${typeName === void 0 ? "missing" : typeof typeName}`
+  );
+  return `an object with ${parts.join(" and ")}`;
+}
 
 // src/query.ts
 function matchesQueryValue(matcher, value) {