@objectstack/rest 14.3.0 → 14.6.0

package/dist/index.d.cts

@@ -508,9 +508,26 @@ declare class RestServer {
     private _openApiSpecCache;
     private loadOpenApiSpec;
     /**
-     * Register metadata endpoints
+     * Register the metadata routes behind the SAME `requireAuth` gate the
+     * `/data` routes use.
+     *
+     * `registerMetadataEndpoints` builds ~17 `/meta/*` routes but — unlike the
+     * `/data` handlers — never calls {@link enforceAuth}: its handlers assumed
+     * the `requireAuth` gate rejected anonymous callers "upstream", yet nothing
+     * upstream covers `/meta`, so on a `requireAuth` deployment an anonymous
+     * caller could read object / field schemas. On a tenant-less runtime host
+     * those are SYSTEM-object schemas and the host is publicly reachable — a
+     * real leak.
+     *
+     * Rather than add the gate to every handler (and have the next new route
+     * forget it — the exact failure mode that caused this), wrap the route
+     * registrar for the duration of registration so every meta route, present
+     * and future, inherits it. The check is a no-op when `requireAuth` is off
+     * (demo / single-tenant), so the previously-public metadata surface there
+     * is unchanged; an authenticated user passes exactly as on `/data`.
      */
     private registerMetadataEndpoints;
+    private registerMetadataEndpointsInner;
     /**
      * Register UI endpoints
      */
@@ -770,6 +787,14 @@ interface ExportFieldMeta {
     reference?: string;
     /** Field on the referenced record to show as its label. */
     displayField?: string;
+    /** Field is required — a value (or default) must exist on insert. */
+    required?: boolean;
+    /** Engine-owned column the client never supplies (never required of import). */
+    system?: boolean;
+    /** Read-only column the client never supplies (never required of import). */
+    readonly?: boolean;
+    /** Field declares a `defaultValue` the engine applies on insert (satisfies required). */
+    hasDefault?: boolean;
 }
 /**
  * Build a field-name → metadata map from an object schema (best-effort).

package/dist/index.d.ts

@@ -508,9 +508,26 @@ declare class RestServer {
     private _openApiSpecCache;
     private loadOpenApiSpec;
     /**
-     * Register metadata endpoints
+     * Register the metadata routes behind the SAME `requireAuth` gate the
+     * `/data` routes use.
+     *
+     * `registerMetadataEndpoints` builds ~17 `/meta/*` routes but — unlike the
+     * `/data` handlers — never calls {@link enforceAuth}: its handlers assumed
+     * the `requireAuth` gate rejected anonymous callers "upstream", yet nothing
+     * upstream covers `/meta`, so on a `requireAuth` deployment an anonymous
+     * caller could read object / field schemas. On a tenant-less runtime host
+     * those are SYSTEM-object schemas and the host is publicly reachable — a
+     * real leak.
+     *
+     * Rather than add the gate to every handler (and have the next new route
+     * forget it — the exact failure mode that caused this), wrap the route
+     * registrar for the duration of registration so every meta route, present
+     * and future, inherits it. The check is a no-op when `requireAuth` is off
+     * (demo / single-tenant), so the previously-public metadata surface there
+     * is unchanged; an authenticated user passes exactly as on `/data`.
      */
     private registerMetadataEndpoints;
+    private registerMetadataEndpointsInner;
     /**
      * Register UI endpoints
      */
@@ -770,6 +787,14 @@ interface ExportFieldMeta {
     reference?: string;
     /** Field on the referenced record to show as its label. */
     displayField?: string;
+    /** Field is required — a value (or default) must exist on insert. */
+    required?: boolean;
+    /** Engine-owned column the client never supplies (never required of import). */
+    system?: boolean;
+    /** Read-only column the client never supplies (never required of import). */
+    readonly?: boolean;
+    /** Field declares a `defaultValue` the engine applies on insert (satisfies required). */
+    hasDefault?: boolean;
 }
 /**
  * Build a field-name → metadata map from an object schema (best-effort).

package/dist/index.js

@@ -250,7 +250,14 @@ function buildFieldMetaMap(schema) {
       label: typeof f.label === "string" ? f.label : void 0,
       options: Array.isArray(f.options) ? f.options : void 0,
       reference: typeof f.reference === "string" ? f.reference : void 0,
-      displayField: typeof f.displayField === "string" ? f.displayField : void 0
+      displayField: typeof f.displayField === "string" ? f.displayField : void 0,
+      required: f.required === true,
+      system: f.system === true,
+      readonly: f.readonly === true,
+      // Mirror the engine's `applyFieldDefaults` gate (`f.defaultValue == null`
+      // ⇒ no default): any non-null default — literal, expression object, or the
+      // `current_user` token — counts as satisfying a required field.
+      hasDefault: f.defaultValue != null
     });
   }
   return map;
@@ -520,6 +527,27 @@ async function coerceFieldValue(raw, meta, ctx) {
   }
   return { value: trim && typeof raw === "string" ? raw.trim() : raw };
 }
+var REQUIRED_CHECK_SKIP = /* @__PURE__ */ new Set([
+  "id",
+  "created_at",
+  "created_by",
+  "updated_at",
+  "updated_by"
+]);
+function isBlankValue(v) {
+  return v === void 0 || v === null || typeof v === "string" && v.trim() === "";
+}
+function firstMissingRequiredField(data, metaMap) {
+  for (const meta of metaMap.values()) {
+    if (!meta.required) continue;
+    if (meta.system || meta.readonly) continue;
+    if (meta.hasDefault) continue;
+    if (meta.type === "autonumber") continue;
+    if (REQUIRED_CHECK_SKIP.has(meta.name)) continue;
+    if (isBlankValue(data[meta.name])) return meta.name;
+  }
+  return null;
+}
 async function coerceRow(rawRow, metaMap, ctx) {
   const data = {};
   const errors = [];
@@ -718,7 +746,11 @@ function runImport(opts) {
           if (!handled) {
             const willUpdate = existing && typeof existing === "object";
             const willCreate = !willUpdate && (writeMode === "insert" || writeMode === "upsert");
-            if (!willUpdate && !willCreate) {
+            const requiredMiss = willCreate && !runAutomations ? firstMissingRequiredField(data, metaMap) : null;
+            if (requiredMiss) {
+              errCount++;
+              results[i] = { row: rowNo, ok: false, action: "failed", field: requiredMiss, code: "required", error: `${requiredMiss} is required` };
+            } else if (!willUpdate && !willCreate) {
               skipped++;
               results[i] = { row: rowNo, ok: true, action: "skipped", code: "NO_MATCH" };
             } else if (dryRun) {
@@ -2463,9 +2495,49 @@ var RestServer = class _RestServer {
     }
   }
   /**
-   * Register metadata endpoints
+   * Register the metadata routes behind the SAME `requireAuth` gate the
+   * `/data` routes use.
+   *
+   * `registerMetadataEndpoints` builds ~17 `/meta/*` routes but — unlike the
+   * `/data` handlers — never calls {@link enforceAuth}: its handlers assumed
+   * the `requireAuth` gate rejected anonymous callers "upstream", yet nothing
+   * upstream covers `/meta`, so on a `requireAuth` deployment an anonymous
+   * caller could read object / field schemas. On a tenant-less runtime host
+   * those are SYSTEM-object schemas and the host is publicly reachable — a
+   * real leak.
+   *
+   * Rather than add the gate to every handler (and have the next new route
+   * forget it — the exact failure mode that caused this), wrap the route
+   * registrar for the duration of registration so every meta route, present
+   * and future, inherits it. The check is a no-op when `requireAuth` is off
+   * (demo / single-tenant), so the previously-public metadata surface there
+   * is unchanged; an authenticated user passes exactly as on `/data`.
    */
   registerMetadataEndpoints(basePath) {
+    const realRouteManager = this.routeManager;
+    const guardedRouteManager = {
+      register: (entry) => {
+        const inner = entry.handler;
+        if (typeof inner !== "function") return realRouteManager.register(entry);
+        return realRouteManager.register({
+          ...entry,
+          handler: async (req, res) => {
+            const environmentId = req?.params?.environmentId;
+            const context = await this.resolveExecCtx(environmentId, req).catch(() => void 0);
+            if (this.enforceAuth(req, res, context)) return;
+            return inner(req, res);
+          }
+        });
+      }
+    };
+    this.routeManager = guardedRouteManager;
+    try {
+      this.registerMetadataEndpointsInner(basePath);
+    } finally {
+      this.routeManager = realRouteManager;
+    }
+  }
+  registerMetadataEndpointsInner(basePath) {
     const { metadata } = this.config;
     const metaPath = `${basePath}${metadata.prefix}`;
     const isScoped = basePath.includes("/environments/:environmentId");