@object-ui/data-objectstack 6.0.3 → 6.1.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @object-ui/data-objectstack
 
+## 6.1.0
+
+### Patch Changes
+
+- Updated dependencies [991b62d]
+  - @object-ui/core@6.1.0
+  - @object-ui/types@6.1.0
+
+## 6.0.4
+
+### Patch Changes
+
+- @object-ui/types@6.0.4
+- @object-ui/core@6.0.4
+
 ## 6.0.3
 
 ### Patch Changes

package/dist/index.cjs

@@ -586,15 +586,21 @@ function createObjectStackUserStateAdapter(options) {
   let cachedRowId = null;
   const findExisting = async () => {
     const params = {
-      filter: {
+      $filter: {
         user_id: userId,
         key
       },
-      limit: 1
+      $top: 1
     };
     const result = await dataSource.find(resource, params);
     const rows = result?.data ?? [];
-    return rows.length > 0 ? rows[0] : null;
+    const match = rows.find((r) => {
+      if (!r) return false;
+      const userMismatch = r.user_id !== void 0 && r.user_id !== userId;
+      const keyMismatch = r.key !== void 0 && r.key !== key;
+      return !userMismatch && !keyMismatch;
+    });
+    return match ?? null;
   };
   const decodeValue = (value) => {
     if (Array.isArray(value)) return value;

package/dist/index.js

@@ -539,15 +539,21 @@ function createObjectStackUserStateAdapter(options) {
   let cachedRowId = null;
   const findExisting = async () => {
     const params = {
-      filter: {
+      $filter: {
         user_id: userId,
         key
       },
-      limit: 1
+      $top: 1
     };
     const result = await dataSource.find(resource, params);
     const rows = result?.data ?? [];
-    return rows.length > 0 ? rows[0] : null;
+    const match = rows.find((r) => {
+      if (!r) return false;
+      const userMismatch = r.user_id !== void 0 && r.user_id !== userId;
+      const keyMismatch = r.key !== void 0 && r.key !== key;
+      return !userMismatch && !keyMismatch;
+    });
+    return match ?? null;
   };
   const decodeValue = (value) => {
     if (Array.isArray(value)) return value;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/data-objectstack",
-  "version": "6.0.3",
+  "version": "6.1.0",
   "description": "ObjectStack Data Adapter for Object UI",
   "license": "MIT",
   "type": "module",
@@ -23,13 +23,13 @@
   ],
   "dependencies": {
     "@objectstack/client": "^5.2.0",
-    "@object-ui/core": "6.0.3",
-    "@object-ui/types": "6.0.3"
+    "@object-ui/core": "6.1.0",
+    "@object-ui/types": "6.1.0"
   },
   "devDependencies": {
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.6"
+    "vitest": "^4.1.7"
   },
   "publishConfig": {
     "access": "public"

package/src/userState.test.ts

@@ -39,8 +39,8 @@ describe('createObjectStackUserStateAdapter', () => {
 
       expect(items).toEqual([]);
       expect(ds.find).toHaveBeenCalledWith('sys_user_preference', {
-        filter: { user_id: 'u1', key: 'ui.favorites' },
-        limit: 1,
+        $filter: { user_id: 'u1', key: 'ui.favorites' },
+        $top: 1,
       });
     });
 

package/src/userState.ts

@@ -105,16 +105,31 @@ export function createObjectStackUserStateAdapter<T = unknown>(
   let cachedRowId: string | number | null = null;
 
   const findExisting = async (): Promise<UserPreferenceRecord | null> => {
+    // NOTE: `QueryParams` uses OData-style `$`-prefixed keys. Using the bare
+    // names (`filter`, `limit`) silently drops the predicate at the
+    // `convertQueryParams` layer, which then returns *any* row in the
+    // `sys_user_preference` table — that caused the Favorites adapter to load
+    // the Recents row (and vice-versa), so clicked items leaked into Starred.
     const params: QueryParams = {
-      filter: {
+      $filter: {
         user_id: userId,
         key,
       },
-      limit: 1,
+      $top: 1,
     };
     const result = await dataSource.find(resource, params);
     const rows = (result?.data ?? []) as UserPreferenceRecord[];
-    return rows.length > 0 ? rows[0] : null;
+    // Defensive: if the backend ignored our predicate and returned mixed
+    // rows, only accept ones tagged for this (user, key) pair. Rows that
+    // omit those metadata fields entirely are trusted (covers mocks and
+    // backends that strip metadata from the projection).
+    const match = rows.find(r => {
+      if (!r) return false;
+      const userMismatch = r.user_id !== undefined && r.user_id !== userId;
+      const keyMismatch = r.key !== undefined && r.key !== key;
+      return !userMismatch && !keyMismatch;
+    });
+    return match ?? null;
   };
 
   const decodeValue = (value: unknown): T[] => {