@objectstack/rest 14.3.0 → 14.5.0

package/dist/index.cjs

@@ -296,7 +296,14 @@ function buildFieldMetaMap(schema) {
       label: typeof f.label === "string" ? f.label : void 0,
       options: Array.isArray(f.options) ? f.options : void 0,
       reference: typeof f.reference === "string" ? f.reference : void 0,
-      displayField: typeof f.displayField === "string" ? f.displayField : void 0
+      displayField: typeof f.displayField === "string" ? f.displayField : void 0,
+      required: f.required === true,
+      system: f.system === true,
+      readonly: f.readonly === true,
+      // Mirror the engine's `applyFieldDefaults` gate (`f.defaultValue == null`
+      // ⇒ no default): any non-null default — literal, expression object, or the
+      // `current_user` token — counts as satisfying a required field.
+      hasDefault: f.defaultValue != null
     });
   }
   return map;
@@ -566,6 +573,27 @@ async function coerceFieldValue(raw, meta, ctx) {
   }
   return { value: trim && typeof raw === "string" ? raw.trim() : raw };
 }
+var REQUIRED_CHECK_SKIP = /* @__PURE__ */ new Set([
+  "id",
+  "created_at",
+  "created_by",
+  "updated_at",
+  "updated_by"
+]);
+function isBlankValue(v) {
+  return v === void 0 || v === null || typeof v === "string" && v.trim() === "";
+}
+function firstMissingRequiredField(data, metaMap) {
+  for (const meta of metaMap.values()) {
+    if (!meta.required) continue;
+    if (meta.system || meta.readonly) continue;
+    if (meta.hasDefault) continue;
+    if (meta.type === "autonumber") continue;
+    if (REQUIRED_CHECK_SKIP.has(meta.name)) continue;
+    if (isBlankValue(data[meta.name])) return meta.name;
+  }
+  return null;
+}
 async function coerceRow(rawRow, metaMap, ctx) {
   const data = {};
   const errors = [];
@@ -764,7 +792,11 @@ function runImport(opts) {
           if (!handled) {
             const willUpdate = existing && typeof existing === "object";
             const willCreate = !willUpdate && (writeMode === "insert" || writeMode === "upsert");
-            if (!willUpdate && !willCreate) {
+            const requiredMiss = willCreate && !runAutomations ? firstMissingRequiredField(data, metaMap) : null;
+            if (requiredMiss) {
+              errCount++;
+              results[i] = { row: rowNo, ok: false, action: "failed", field: requiredMiss, code: "required", error: `${requiredMiss} is required` };
+            } else if (!willUpdate && !willCreate) {
               skipped++;
               results[i] = { row: rowNo, ok: true, action: "skipped", code: "NO_MATCH" };
             } else if (dryRun) {
@@ -2510,9 +2542,49 @@ var RestServer = class _RestServer {
     }
   }
   /**
-   * Register metadata endpoints
+   * Register the metadata routes behind the SAME `requireAuth` gate the
+   * `/data` routes use.
+   *
+   * `registerMetadataEndpoints` builds ~17 `/meta/*` routes but — unlike the
+   * `/data` handlers — never calls {@link enforceAuth}: its handlers assumed
+   * the `requireAuth` gate rejected anonymous callers "upstream", yet nothing
+   * upstream covers `/meta`, so on a `requireAuth` deployment an anonymous
+   * caller could read object / field schemas. On a tenant-less runtime host
+   * those are SYSTEM-object schemas and the host is publicly reachable — a
+   * real leak.
+   *
+   * Rather than add the gate to every handler (and have the next new route
+   * forget it — the exact failure mode that caused this), wrap the route
+   * registrar for the duration of registration so every meta route, present
+   * and future, inherits it. The check is a no-op when `requireAuth` is off
+   * (demo / single-tenant), so the previously-public metadata surface there
+   * is unchanged; an authenticated user passes exactly as on `/data`.
    */
   registerMetadataEndpoints(basePath) {
+    const realRouteManager = this.routeManager;
+    const guardedRouteManager = {
+      register: (entry) => {
+        const inner = entry.handler;
+        if (typeof inner !== "function") return realRouteManager.register(entry);
+        return realRouteManager.register({
+          ...entry,
+          handler: async (req, res) => {
+            const environmentId = req?.params?.environmentId;
+            const context = await this.resolveExecCtx(environmentId, req).catch(() => void 0);
+            if (this.enforceAuth(req, res, context)) return;
+            return inner(req, res);
+          }
+        });
+      }
+    };
+    this.routeManager = guardedRouteManager;
+    try {
+      this.registerMetadataEndpointsInner(basePath);
+    } finally {
+      this.routeManager = realRouteManager;
+    }
+  }
+  registerMetadataEndpointsInner(basePath) {
     const { metadata } = this.config;
     const metaPath = `${basePath}${metadata.prefix}`;
     const isScoped = basePath.includes("/environments/:environmentId");