@objectstack/runtime 3.0.9 → 3.0.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/runtime",
-  "version": "3.0.9",
+  "version": "3.0.11",
   "license": "Apache-2.0",
   "description": "ObjectStack Core Runtime & Query Engine",
   "type": "module",
@@ -15,10 +15,10 @@
   },
   "dependencies": {
     "zod": "^4.3.6",
-    "@objectstack/rest": "3.0.9",
-    "@objectstack/core": "3.0.9",
-    "@objectstack/spec": "3.0.9",
-    "@objectstack/types": "3.0.9"
+    "@objectstack/core": "3.0.11",
+    "@objectstack/rest": "3.0.11",
+    "@objectstack/spec": "3.0.11",
+    "@objectstack/types": "3.0.11"
   },
   "devDependencies": {
     "typescript": "^5.0.0",

package/src/http-dispatcher.test.ts

@@ -204,4 +204,269 @@ describe('HttpDispatcher', () => {
             expect(mockAutomationService.trigger).toHaveBeenCalledWith('flow_a', { data: 1 }, { request: {} });
         });
     });
+
+    // ═══════════════════════════════════════════════════════════════
+    // Async Service Resolution Tests
+    // Covers: getService awaits Promise-based (async factory) services
+    // ═══════════════════════════════════════════════════════════════
+
+    describe('Async service resolution (Promise-based injection)', () => {
+
+        describe('handleAnalytics with async service', () => {
+            it('should resolve analytics service from Promise (async factory)', async () => {
+                const mockAnalytics = {
+                    query: vi.fn().mockResolvedValue({ rows: [{ id: 1 }], total: 1 }),
+                    getMetadata: vi.fn().mockResolvedValue({ tables: ['t1'] }),
+                    generateSql: vi.fn().mockResolvedValue({ sql: 'SELECT 1' }),
+                };
+                // Inject as Promise (simulates async factory registration)
+                (kernel as any).getService = vi.fn().mockImplementation((name: string) => {
+                    if (name === 'analytics') return Promise.resolve(mockAnalytics);
+                    return null;
+                });
+
+                const result = await dispatcher.handleAnalytics('query', 'POST', { sql: 'SELECT 1' }, { request: {} });
+                expect(result.handled).toBe(true);
+                expect(result.response?.status).toBe(200);
+                expect(mockAnalytics.query).toHaveBeenCalled();
+            });
+
+            it('should handle POST /analytics/sql with async service', async () => {
+                const mockAnalytics = {
+                    generateSql: vi.fn().mockResolvedValue({ sql: 'SELECT * FROM t' }),
+                };
+                (kernel as any).getService = vi.fn().mockResolvedValue(mockAnalytics);
+
+                const result = await dispatcher.handleAnalytics('sql', 'POST', { object: 'test' }, { request: {} });
+                expect(result.handled).toBe(true);
+                expect(result.response?.status).toBe(200);
+                expect(mockAnalytics.generateSql).toHaveBeenCalled();
+            });
+
+            it('should handle GET /analytics/meta with async service', async () => {
+                const mockAnalytics = {
+                    getMetadata: vi.fn().mockResolvedValue({ tables: ['users', 'orders'] }),
+                };
+                (kernel as any).getService = vi.fn().mockResolvedValue(mockAnalytics);
+
+                const result = await dispatcher.handleAnalytics('meta', 'GET', {}, { request: {} });
+                expect(result.handled).toBe(true);
+                expect(result.response?.status).toBe(200);
+                expect(result.response?.body?.data?.tables).toEqual(['users', 'orders']);
+            });
+
+            it('should return unhandled when analytics service is not registered', async () => {
+                (kernel as any).getService = vi.fn().mockResolvedValue(null);
+                (kernel as any).services = new Map();
+
+                const result = await dispatcher.handleAnalytics('query', 'POST', {}, { request: {} });
+                expect(result.handled).toBe(false);
+            });
+
+            it('should return unhandled for unknown analytics sub-path', async () => {
+                const mockAnalytics = { query: vi.fn() };
+                (kernel as any).getService = vi.fn().mockResolvedValue(mockAnalytics);
+
+                const result = await dispatcher.handleAnalytics('unknown', 'POST', {}, { request: {} });
+                expect(result.handled).toBe(false);
+            });
+        });
+
+        describe('handleAuth with async service', () => {
+            it('should resolve auth service from Promise', async () => {
+                const mockAuth = {
+                    handler: vi.fn().mockResolvedValue({ user: { id: '1' } }),
+                };
+                (kernel as any).getService = vi.fn().mockImplementation((name: string) => {
+                    if (name === 'auth') return Promise.resolve(mockAuth);
+                    return null;
+                });
+
+                const result = await dispatcher.handleAuth('', 'POST', {}, { request: {}, response: {} });
+                expect(result.handled).toBe(true);
+                expect(mockAuth.handler).toHaveBeenCalled();
+            });
+
+            it('should fallback to legacy login when async auth service has no handler', async () => {
+                (kernel as any).getService = vi.fn().mockResolvedValue({});
+                mockBroker.call.mockResolvedValue({ token: 'abc' });
+
+                const result = await dispatcher.handleAuth('/login', 'POST', { user: 'a' }, { request: {} });
+                expect(result.handled).toBe(true);
+                expect(mockBroker.call).toHaveBeenCalledWith('auth.login', { user: 'a' }, { request: {} });
+            });
+
+            it('should return unhandled when auth service not registered and no legacy match', async () => {
+                (kernel as any).getService = vi.fn().mockResolvedValue(null);
+                (kernel as any).services = new Map();
+
+                const result = await dispatcher.handleAuth('/profile', 'GET', {}, { request: {} });
+                expect(result.handled).toBe(false);
+            });
+        });
+
+        describe('handleStorage with async service', () => {
+            it('should resolve storage service from Promise', async () => {
+                const mockStorage = {
+                    upload: vi.fn().mockResolvedValue({ id: 'file_1', url: '/files/1' }),
+                };
+                (kernel as any).getService = vi.fn().mockImplementation((name: string) => {
+                    if (name === 'file-storage') return Promise.resolve(mockStorage);
+                    return null;
+                });
+
+                const result = await dispatcher.handleStorage('/upload', 'POST', { name: 'test.txt' }, { request: {} });
+                expect(result.handled).toBe(true);
+                expect(result.response?.status).toBe(200);
+                expect(mockStorage.upload).toHaveBeenCalled();
+            });
+
+            it('should return 501 when storage service is not registered (async null)', async () => {
+                (kernel as any).getService = vi.fn().mockResolvedValue(null);
+                (kernel as any).services = new Map();
+
+                const result = await dispatcher.handleStorage('/upload', 'POST', {}, { request: {} });
+                expect(result.handled).toBe(true);
+                expect(result.response?.status).toBe(501);
+                expect(result.response?.body?.error?.message).toBe('File storage not configured');
+            });
+
+            it('should handle GET /storage/file/:id with async service', async () => {
+                const mockStorage = {
+                    download: vi.fn().mockResolvedValue({ data: 'content', mimeType: 'text/plain' }),
+                };
+                (kernel as any).getService = vi.fn().mockImplementation((name: string) => {
+                    if (name === 'file-storage') return Promise.resolve(mockStorage);
+                    return null;
+                });
+
+                const result = await dispatcher.handleStorage('/file/abc123', 'GET', null, { request: {} });
+                expect(result.handled).toBe(true);
+                expect(mockStorage.download).toHaveBeenCalledWith('abc123', { request: {} });
+            });
+
+            it('should return 400 when upload has no file', async () => {
+                const mockStorage = { upload: vi.fn() };
+                (kernel as any).getService = vi.fn().mockResolvedValue(mockStorage);
+
+                const result = await dispatcher.handleStorage('/upload', 'POST', null, { request: {} });
+                expect(result.handled).toBe(true);
+                expect(result.response?.status).toBe(400);
+                expect(result.response?.body?.error?.message).toBe('No file provided');
+            });
+        });
+
+        describe('handleAutomation with async service', () => {
+            it('should resolve automation service from Promise (async factory)', async () => {
+                const mockAuto = {
+                    listFlows: vi.fn().mockResolvedValue(['f1']),
+                };
+                (kernel as any).getService = vi.fn().mockImplementation((name: string) => {
+                    if (name === 'automation') return Promise.resolve(mockAuto);
+                    return null;
+                });
+
+                const result = await dispatcher.handleAutomation('', 'GET', {}, { request: {} });
+                expect(result.handled).toBe(true);
+                expect(result.response?.body?.data?.flows).toEqual(['f1']);
+            });
+
+            it('should return unhandled when automation service not registered', async () => {
+                (kernel as any).getService = vi.fn().mockResolvedValue(null);
+                (kernel as any).services = new Map();
+
+                const result = await dispatcher.handleAutomation('', 'GET', {}, { request: {} });
+                expect(result.handled).toBe(false);
+            });
+        });
+
+        describe('handleMetadata with async protocol service', () => {
+            it('should resolve protocol service from async getService', async () => {
+                const asyncProtocol = {
+                    saveMetaItem: vi.fn().mockResolvedValue({ success: true }),
+                };
+                (kernel as any).context.getService = vi.fn().mockImplementation((name: string) => {
+                    if (name === 'protocol') return Promise.resolve(asyncProtocol);
+                    return null;
+                });
+
+                const result = await dispatcher.handleMetadata('/objects/my_obj', { request: {} }, 'PUT', { label: 'Test' });
+                expect(result.handled).toBe(true);
+                expect(result.response?.status).toBe(200);
+                expect(asyncProtocol.saveMetaItem).toHaveBeenCalled();
+            });
+
+            it('should fallback to broker when async protocol returns null', async () => {
+                (kernel as any).context.getService = vi.fn().mockResolvedValue(null);
+                mockBroker.call.mockResolvedValue({ name: 'my_obj' });
+
+                const result = await dispatcher.handleMetadata('/objects/my_obj', { request: {} }, 'GET');
+                expect(result.handled).toBe(true);
+                expect(mockBroker.call).toHaveBeenCalledWith(
+                    'metadata.getObject',
+                    { objectName: 'my_obj' },
+                    { request: {} }
+                );
+            });
+        });
+    });
+
+    // ═══════════════════════════════════════════════════════════════
+    // Synchronous service resolution (backward compatibility)
+    // ═══════════════════════════════════════════════════════════════
+
+    describe('Synchronous service resolution (backward compat)', () => {
+        it('should work with synchronous service from services Map', async () => {
+            const syncAnalytics = {
+                query: vi.fn().mockResolvedValue({ rows: [], total: 0 }),
+            };
+            (kernel as any).services = new Map([['analytics', syncAnalytics]]);
+
+            const result = await dispatcher.handleAnalytics('query', 'POST', {}, { request: {} });
+            expect(result.handled).toBe(true);
+            expect(syncAnalytics.query).toHaveBeenCalled();
+        });
+
+        it('should work with synchronous getService returning service directly', async () => {
+            const syncAuto = {
+                listFlows: vi.fn().mockResolvedValue(['flow_x']),
+            };
+            (kernel as any).getService = vi.fn().mockReturnValue(syncAuto);
+
+            const result = await dispatcher.handleAutomation('', 'GET', {}, { request: {} });
+            expect(result.handled).toBe(true);
+            expect(result.response?.body?.data?.flows).toEqual(['flow_x']);
+        });
+    });
+
+    // ═══════════════════════════════════════════════════════════════
+    // Error handling for service method failures
+    // ═══════════════════════════════════════════════════════════════
+
+    describe('Service method error handling', () => {
+        it('should propagate analytics query error', async () => {
+            const badAnalytics = {
+                query: vi.fn().mockRejectedValue(new Error('Query timeout')),
+            };
+            (kernel as any).getService = vi.fn().mockResolvedValue(badAnalytics);
+
+            await expect(
+                dispatcher.handleAnalytics('query', 'POST', {}, { request: {} })
+            ).rejects.toThrow('Query timeout');
+        });
+
+        it('should propagate storage upload error', async () => {
+            const badStorage = {
+                upload: vi.fn().mockRejectedValue(new Error('Disk full')),
+            };
+            (kernel as any).getService = vi.fn().mockImplementation((name: string) => {
+                if (name === 'file-storage') return Promise.resolve(badStorage);
+                return null;
+            });
+
+            await expect(
+                dispatcher.handleStorage('/upload', 'POST', { data: 'file' }, { request: {} })
+            ).rejects.toThrow('Disk full');
+        });
+    });
 });

package/src/http-dispatcher.ts

@@ -173,7 +173,7 @@ export class HttpDispatcher {
      */
     async handleAuth(path: string, method: string, body: any, context: HttpProtocolContext): Promise<HttpDispatcherResult> {
         // 1. Try generic Auth Service
-        const authService = this.getService(CoreServiceName.enum.auth);
+        const authService = await this.getService(CoreServiceName.enum.auth);
         if (authService && typeof authService.handler === 'function') {
             const response = await authService.handler(context.request, context.response);
             return { handled: true, result: response };
@@ -202,7 +202,7 @@ export class HttpDispatcher {
         // GET /metadata/types
         if (parts[0] === 'types') {
             // Try protocol service for dynamic types
-            const protocol = this.kernel?.context?.getService ? this.kernel.context.getService('protocol') : null;
+            const protocol = this.kernel?.context?.getService ? await this.kernel.context.getService('protocol') : null;
             if (protocol && typeof protocol.getMetaTypes === 'function') {
                 const result = await protocol.getMetaTypes({});
                 return { handled: true, response: this.success(result) };
@@ -224,7 +224,7 @@ export class HttpDispatcher {
             // PUT /metadata/:type/:name (Save)
             if (method === 'PUT' && body) {
                 // Try to get the protocol service directly
-                const protocol = this.kernel?.context?.getService ? this.kernel.context.getService('protocol') : null;
+                const protocol = this.kernel?.context?.getService ? await this.kernel.context.getService('protocol') : null;
                 
                 if (protocol && typeof protocol.saveMetaItem === 'function') {
                     try {
@@ -257,7 +257,7 @@ export class HttpDispatcher {
                 const singularType = type.endsWith('s') ? type.slice(0, -1) : type;
                 
                 // Try Protocol Service First (Preferred)
-                const protocol = this.kernel?.context?.getService ? this.kernel.context.getService('protocol') : null;
+                const protocol = this.kernel?.context?.getService ? await this.kernel.context.getService('protocol') : null;
                 if (protocol && typeof protocol.getMetaItem === 'function') {
                      try {
                         const data = await protocol.getMetaItem({ type: singularType, name });
@@ -286,7 +286,7 @@ export class HttpDispatcher {
             const packageId = query?.package || undefined;
             
             // Try protocol service first for any type
-            const protocol = this.kernel?.context?.getService ? this.kernel.context.getService('protocol') : null;
+            const protocol = this.kernel?.context?.getService ? await this.kernel.context.getService('protocol') : null;
             if (protocol && typeof protocol.getMetaItems === 'function') {
                 try {
                     const data = await protocol.getMetaItems({ type: typeOrName, packageId });
@@ -325,7 +325,7 @@ export class HttpDispatcher {
         // GET /metadata — return available metadata types
         if (parts.length === 0) {
             // Try protocol service for dynamic types
-            const protocol = this.kernel?.context?.getService ? this.kernel.context.getService('protocol') : null;
+            const protocol = this.kernel?.context?.getService ? await this.kernel.context.getService('protocol') : null;
             if (protocol && typeof protocol.getMetaTypes === 'function') {
                 const result = await protocol.getMetaTypes({});
                 return { handled: true, response: this.success(result) };
@@ -377,8 +377,14 @@ export class HttpDispatcher {
             // GET /data/:object/:id
             if (parts.length === 2 && m === 'GET') {
                 const id = parts[1];
+                // Spec: Only select/expand are allowlisted query params for GET by ID.
+                // All other query parameters are discarded to prevent parameter pollution.
+                const { select, expand } = query || {};
+                const allowedParams: Record<string, unknown> = {};
+                if (select != null) allowedParams.select = select;
+                if (expand != null) allowedParams.expand = expand;
                 // Spec: broker returns GetDataResponse = { object, id, record }
-                const result = await broker.call('data.get', { object: objectName, id, ...query }, { request: context.request });
+                const result = await broker.call('data.get', { object: objectName, id, ...allowedParams }, { request: context.request });
                 return { handled: true, response: this.success(result) };
             }
 
@@ -401,7 +407,7 @@ export class HttpDispatcher {
             // GET /data/:object (List)
             if (m === 'GET') {
                 // Spec: broker returns FindDataResponse = { object, records, total?, hasMore? }
-                const result = await broker.call('data.query', { object: objectName, filters: query }, { request: context.request });
+                const result = await broker.call('data.query', { object: objectName, query }, { request: context.request });
                 return { handled: true, response: this.success(result) };
             }
 
@@ -423,7 +429,7 @@ export class HttpDispatcher {
      * path: sub-path after /analytics/
      */
     async handleAnalytics(path: string, method: string, body: any, context: HttpProtocolContext): Promise<HttpDispatcherResult> {
-        const analyticsService = this.getService(CoreServiceName.enum.analytics);
+        const analyticsService = await this.getService(CoreServiceName.enum.analytics);
         if (!analyticsService) return { handled: false }; // 404 handled by caller if unhandled
 
         const m = method.toUpperCase();
@@ -470,7 +476,7 @@ export class HttpDispatcher {
         const parts = path.replace(/^\/+/, '').split('/').filter(Boolean);
 
         // Try to get SchemaRegistry from the ObjectQL service
-        const qlService = this.getObjectQLService();
+        const qlService = await this.getObjectQLService();
         const registry = qlService?.registry;
 
         // If no registry available, try broker as fallback
@@ -588,7 +594,7 @@ export class HttpDispatcher {
      * path: sub-path after /storage/
      */
     async handleStorage(path: string, method: string, file: any, context: HttpProtocolContext): Promise<HttpDispatcherResult> {
-        const storageService = this.getService(CoreServiceName.enum['file-storage']) || this.kernel.services?.['file-storage'];
+        const storageService = await this.getService(CoreServiceName.enum['file-storage']) || this.kernel.services?.['file-storage'];
         if (!storageService) {
              return { handled: true, response: this.error('File storage not configured', 501) };
         }
@@ -650,7 +656,7 @@ export class HttpDispatcher {
             // Support both path param /view/obj/list AND query param /view/obj?type=list
             const type = parts[2] || query?.type || 'list';
 
-            const protocol = this.kernel?.context?.getService ? this.kernel.context.getService('protocol') : null;
+            const protocol = this.kernel?.context?.getService ? await this.kernel.context.getService('protocol') : null;
             
             if (protocol && typeof protocol.getUiView === 'function') {
                 try {
@@ -683,7 +689,7 @@ export class HttpDispatcher {
      *   GET    /:name/runs/:runId    → getRun
      */
     async handleAutomation(path: string, method: string, body: any, context: HttpProtocolContext, query?: any): Promise<HttpDispatcherResult> {
-        const automationService = this.getService(CoreServiceName.enum.automation);
+        const automationService = await this.getService(CoreServiceName.enum.automation);
         if (!automationService) return { handled: false };
 
         const m = method.toUpperCase();
@@ -793,9 +799,9 @@ export class HttpDispatcher {
         return this.kernel.services || {};
     }
 
-    private getService(name: CoreServiceName) {
+    private async getService(name: CoreServiceName) {
         if (typeof this.kernel.getService === 'function') {
-            return this.kernel.getService(name);
+            return await this.kernel.getService(name);
         }
         const services = this.getServicesMap();
         return services[name];
@@ -805,18 +811,18 @@ export class HttpDispatcher {
      * Get the ObjectQL service which provides access to SchemaRegistry.
      * Tries multiple access patterns since kernel structure varies.
      */
-    private getObjectQLService(): any {
+    private async getObjectQLService(): Promise<any> {
         // 1. Try via kernel.getService
         if (typeof this.kernel.getService === 'function') {
             try {
-                const svc = this.kernel.getService('objectql');
+                const svc = await this.kernel.getService('objectql');
                 if (svc?.registry) return svc;
             } catch { /* ignore */ }
         }
         // 2. Try via kernel context
         if (this.kernel?.context?.getService) {
             try {
-                const svc = this.kernel.context.getService('objectql');
+                const svc = await this.kernel.context.getService('objectql');
                 if (svc?.registry) return svc;
             } catch { /* ignore */ }
         }
@@ -941,8 +947,9 @@ export class HttpDispatcher {
                         const { object, operation } = endpoint.objectParams;
                         // Map standard CRUD operations
                         if (operation === 'find') {
-                             const result = await broker.call('data.query', { object, filters: query }, { request: context.request });
-                             return { handled: true, response: this.success(result.data, { count: result.count }) };
+                             const result = await broker.call('data.query', { object, query }, { request: context.request });
+                             // Spec: FindDataResponse = { object, records, total?, hasMore? }
+                             return { handled: true, response: this.success(result.records, { total: result.total }) };
                         }
                         if (operation === 'get' && query.id) {
                              const result = await broker.call('data.get', { object, id: query.id }, { request: context.request });