@objectstack/runtime 3.1.0 → 3.2.0

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @objectstack/runtime@3.1.0 build /home/runner/work/spec/spec/packages/runtime
+> @objectstack/runtime@3.2.0 build /home/runner/work/spec/spec/packages/runtime
 > tsup --config ../../tsup.config.ts
 
 CLI Building entry: src/index.ts
@@ -12,11 +12,11 @@
 CJS Build start
 ESM dist/index.js     55.51 KB
 ESM dist/index.js.map 123.66 KB
-ESM ⚡️ Build success in 166ms
+ESM ⚡️ Build success in 91ms
 CJS dist/index.cjs     57.43 KB
 CJS dist/index.cjs.map 123.73 KB
-CJS ⚡️ Build success in 166ms
+CJS ⚡️ Build success in 92ms
 DTS Build start
-DTS ⚡️ Build success in 6928ms
+DTS ⚡️ Build success in 8046ms
 DTS dist/index.d.ts  20.64 KB
 DTS dist/index.d.cts 20.64 KB

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @objectstack/runtime
 
+## 3.2.0
+
+### Patch Changes
+
+- Updated dependencies [5901c29]
+  - @objectstack/spec@3.2.0
+  - @objectstack/core@3.2.0
+  - @objectstack/rest@3.2.0
+  - @objectstack/types@3.2.0
+
+## 3.1.1
+
+### Patch Changes
+
+- Updated dependencies [953d667]
+  - @objectstack/spec@3.1.1
+  - @objectstack/core@3.1.1
+  - @objectstack/rest@3.1.1
+  - @objectstack/types@3.1.1
+
 ## 3.1.0
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/runtime",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "license": "Apache-2.0",
   "description": "ObjectStack Core Runtime & Query Engine",
   "type": "module",
@@ -15,10 +15,10 @@
   },
   "dependencies": {
     "zod": "^4.3.6",
-    "@objectstack/core": "3.1.0",
-    "@objectstack/rest": "3.1.0",
-    "@objectstack/spec": "3.1.0",
-    "@objectstack/types": "3.1.0"
+    "@objectstack/core": "3.2.0",
+    "@objectstack/rest": "3.2.0",
+    "@objectstack/spec": "3.2.0",
+    "@objectstack/types": "3.2.0"
   },
   "devDependencies": {
     "typescript": "^5.0.0",

package/src/http-dispatcher.test.ts

@@ -439,6 +439,101 @@ describe('HttpDispatcher', () => {
         });
     });
 
+    // ═══════════════════════════════════════════════════════════════
+    // handleData — expand/populate parameter flow
+    // ═══════════════════════════════════════════════════════════════
+
+    describe('handleData', () => {
+        it('should pass expand and select to broker for GET /data/:object/:id', async () => {
+            mockBroker.call.mockResolvedValue({ object: 'order_item', id: 'oi_1', record: { _id: 'oi_1' } });
+
+            const result = await dispatcher.handleData(
+                '/order_item/oi_1', 'GET', {},
+                { expand: 'order,product', select: 'name,total' },
+                { request: {} }
+            );
+
+            expect(result.handled).toBe(true);
+            expect(result.response?.status).toBe(200);
+            expect(mockBroker.call).toHaveBeenCalledWith(
+                'data.get',
+                { object: 'order_item', id: 'oi_1', expand: 'order,product', select: 'name,total' },
+                { request: {} }
+            );
+        });
+
+        it('should NOT pass non-allowlisted params for GET /data/:object/:id', async () => {
+            mockBroker.call.mockResolvedValue({ object: 'task', id: 't1', record: {} });
+
+            await dispatcher.handleData(
+                '/task/t1', 'GET', {},
+                { expand: 'assignee', malicious: 'drop_table', filter: 'hack' },
+                { request: {} }
+            );
+
+            // Only expand is passed; malicious and filter are dropped
+            expect(mockBroker.call).toHaveBeenCalledWith(
+                'data.get',
+                { object: 'task', id: 't1', expand: 'assignee' },
+                { request: {} }
+            );
+        });
+
+        it('should pass full query (with expand/populate) for GET /data/:object list', async () => {
+            mockBroker.call.mockResolvedValue({ object: 'task', records: [], total: 0 });
+
+            const query = { populate: 'assignee,project', top: '10', skip: '0' };
+            const result = await dispatcher.handleData(
+                '/task', 'GET', {},
+                query,
+                { request: {} }
+            );
+
+            expect(result.handled).toBe(true);
+            expect(mockBroker.call).toHaveBeenCalledWith(
+                'data.query',
+                { object: 'task', query },
+                { request: {} }
+            );
+        });
+
+        it('should pass expand in query for GET /data/:object list', async () => {
+            mockBroker.call.mockResolvedValue({ object: 'order', records: [], total: 0 });
+
+            const query = { expand: 'customer,products' };
+            await dispatcher.handleData('/order', 'GET', {}, query, { request: {} });
+
+            expect(mockBroker.call).toHaveBeenCalledWith(
+                'data.query',
+                { object: 'order', query: { expand: 'customer,products' } },
+                { request: {} }
+            );
+        });
+
+        it('should return error if object name is missing', async () => {
+            const result = await dispatcher.handleData('/', 'GET', {}, {}, { request: {} });
+            expect(result.handled).toBe(true);
+            expect(result.response?.status).toBe(400);
+        });
+
+        it('should handle POST /data/:object/query with body containing expand', async () => {
+            mockBroker.call.mockResolvedValue({ object: 'task', records: [] });
+
+            await dispatcher.handleData(
+                '/task/query', 'POST',
+                { filter: { status: 'active' }, populate: ['assignee'] },
+                {},
+                { request: {} }
+            );
+
+            expect(mockBroker.call).toHaveBeenCalledWith(
+                'data.query',
+                { object: 'task', filter: { status: 'active' }, populate: ['assignee'] },
+                { request: {} }
+            );
+        });
+    });
+
     // ═══════════════════════════════════════════════════════════════
     // Error handling for service method failures
     // ═══════════════════════════════════════════════════════════════