@palbase/backend 24.0.2 → 24.1.1

package/dist/bin/palbase-backend.cjs

@@ -635,6 +635,14 @@ var Realtime = makeServiceProxy("Realtime");
 
 // src/errors.ts
 var HTTP_ERROR_BRAND = /* @__PURE__ */ Symbol.for("palbase.backend.httpError");
+var ENGINE_RAISED = /* @__PURE__ */ Symbol.for("palbase.backend.engineRaised");
+function markEngineRaised(e) {
+  e[ENGINE_RAISED] = true;
+  return e;
+}
+function isEngineRaised(e) {
+  return typeof e === "object" && e !== null && e[ENGINE_RAISED] === true;
+}
 function isHttpError(err) {
   if (typeof err !== "object" || err === null) return false;
   const e = err;
@@ -1029,6 +1037,56 @@ function makeMemoryCache(opts = {}) {
   };
 }
 
+// src/db/input-guards.ts
+var KNOWN_OPS = /* @__PURE__ */ new Set(["gt", "gte", "lt", "lte", "neq", "eq", "in"]);
+function assertUsableFilter(caller, table, where) {
+  if (!where) return;
+  for (const [col, cond] of Object.entries(where)) {
+    if (cond === void 0) {
+      throw new Error(
+        `${caller}(${table}): where.${col} de\u011Feri undefined \u2014 bu bir filtre de\u011Feri de\u011Fil. Ba\u011Flan\u0131nca NULL olur ve '= NULL' hi\xE7bir sat\u0131ra uymaz, yani sorgu sessizce bo\u015F sonu\xE7 d\xF6nerdi. De\u011Fer yoksa anahtar\u0131 filtreye hi\xE7 koymay\u0131n.`
+      );
+    }
+    if (cond === null || typeof cond !== "object" || Array.isArray(cond)) continue;
+    const entries = Object.entries(cond);
+    if (entries.length === 0) {
+      throw new Error(
+        `${caller}(${table}): where.${col} bo\u015F bir operat\xF6r nesnesi ({}) \u2014 hi\xE7bir ko\u015Ful \xFCretmez, yani bu alan filtreden sessizce D\xDC\u015EERD\u0130. Ko\u015Ful kurulmayacaksa anahtar\u0131 filtreye hi\xE7 koymay\u0131n (D-21).`
+      );
+    }
+    for (const [op, v] of entries) {
+      if (op === "in") {
+        if (!Array.isArray(v)) throw new Error(`${caller}(${table}): where.${col}.in bir dizi olmal\u0131`);
+        if (v.some((x) => x === void 0)) {
+          throw new Error(
+            `${caller}(${table}): where.${col}.in listesinde undefined var \u2014 sessizce NULL'a ba\u011Flan\u0131r ve o eleman hi\xE7bir sat\u0131rla e\u015Fle\u015Fmez. Listeyi kurarken eleyin.`
+          );
+        }
+        continue;
+      }
+      if (!KNOWN_OPS.has(op)) {
+        throw new Error(
+          `${caller}(${table}): where.${col} bilinmeyen operat\xF6r "${op}" (gt/gte/lt/lte/neq/in)`
+        );
+      }
+      if (v === void 0) {
+        throw new Error(
+          `${caller}(${table}): where.${col}.${op} de\u011Feri undefined \u2014 kar\u015F\u0131la\u015Ft\u0131rman\u0131n sa\u011F taraf\u0131 NULL olur ve sonu\xE7 hi\xE7bir sat\u0131ra uymaz. Ko\u015Fulu kurmay\u0131n.`
+        );
+      }
+    }
+  }
+}
+function assertUsableWriteValues(caller, table, cols, data) {
+  for (const c of cols) {
+    if (data[c] === void 0) {
+      throw new Error(
+        `${caller}(${table}): "${c}" de\u011Feri undefined \u2014 bu bir yazma de\u011Feri de\u011Fil. Kolonu bo\u015Faltmak istiyorsan null yaz; kolonu de\u011Fi\u015Ftirmek istemiyorsan nesneye hi\xE7 koyma (bir eksik istek alan\u0131 sessizce NULL yaz\u0131yordu \u2014 FR-016).`
+      );
+    }
+  }
+}
+
 // src/engine/db.ts
 function quoteIdent(name) {
   return `"${name.replace(/"/g, '""')}"`;
@@ -1156,7 +1214,8 @@ function asTableRows(table, rows) {
   const transforms = transformsOf(currentSchema, table);
   return rows.map((row) => applyFromDb(reviveVectors(asWireRow(row), vectorCols), transforms));
 }
-function asBindParams(table, cols, data) {
+function asBindParams(table, cols, data, caller) {
+  assertUsableWriteValues(caller, table, cols, data);
   const vectorCols = vectorColumnsOf(currentSchema, table);
   const transforms = transformsOf(currentSchema, table);
   return cols.map((c) => {
@@ -1379,6 +1438,7 @@ function compileWhere(table, colSet, where, add, caller = "search") {
     const t = transforms.get(col);
     return t?.toDb === void 0 ? add : (v) => add(v === null || v === void 0 ? v : t.toDb(v));
   };
+  assertUsableFilter(caller, table, where);
   for (const [col, cond] of Object.entries(where)) {
     if (colSet !== null && !colSet.has(col)) {
       throw new Error(`${caller}(${table}): where kolonu "${col}" tabloda yok (FR-016)`);
@@ -1395,11 +1455,17 @@ function compileWhere(table, colSet, where, add, caller = "search") {
           }
           parts.push(`${q} IN (${v.map((x) => bind(x)).join(", ")})`);
         } else if (op in WHERE_OPS) {
+          if (v === null && (op === "neq" || op === "eq")) {
+            parts.push(`${q} IS ${op === "neq" ? "NOT " : ""}NULL`);
+            continue;
+          }
           parts.push(`${q} ${WHERE_OPS[op]} ${bind(v)}`);
         } else {
           throw new Error(`${caller}(${table}): where.${col} bilinmeyen operat\xF6r "${op}" (gt/gte/lt/lte/neq/in)`);
         }
       }
+    } else if (cond === null) {
+      parts.push(`${q} IS NULL`);
     } else {
       parts.push(`${q} = ${bind(cond)}`);
     }
@@ -1492,7 +1558,7 @@ function createOps(tx) {
       if (cols.length === 0) throw new Error(`insert into ${table}: no columns given`);
       const placeholders = cols.map((_, i) => `$${i + 1}`).join(", ");
       const sql = `INSERT INTO ${quoteIdent(table)} (${cols.map(quoteIdent).join(", ")}) VALUES (${placeholders}) RETURNING *`;
-      const rows = await (await at()).unsafe(sql, asBindParams(table, cols, data));
+      const rows = await (await at()).unsafe(sql, asBindParams(table, cols, data, "insert"));
       const inserted = rows[0];
       if (!inserted) {
         throw new Error(
@@ -1526,7 +1592,7 @@ function createOps(tx) {
         const ph = cols.map((_, i) => `$${i + 1}`).join(", ");
         const insertSql = `INSERT INTO ${quoteIdent(table)} (${cols.map(quoteIdent).join(", ")}) VALUES (${ph}) ON CONFLICT (${conflict.map(quoteIdent).join(", ")}) WHERE "valid_to" IS NULL DO NOTHING RETURNING *`;
         const live = await at();
-        const bindData = asBindParams(table, cols, data);
+        const bindData = asBindParams(table, cols, data, "upsert");
         const first = await live.unsafe(insertSql, bindData);
         if (first[0]) return asTableRow(table, first[0]);
         const condSql = conflict.map((c, i) => `${quoteIdent(c)} = $${i + 1}`).join(" AND ");
@@ -1560,7 +1626,7 @@ function createOps(tx) {
       const assignments = cols.filter((c) => !conflictSet.has(c)).map((c) => `${quoteIdent(c)} = EXCLUDED.${quoteIdent(c)}`);
       const action = assignments.length ? `DO UPDATE SET ${assignments.join(", ")}` : `DO UPDATE SET ${quoteIdent(conflict[0])} = EXCLUDED.${quoteIdent(conflict[0])}`;
       const sql = `INSERT INTO ${quoteIdent(table)} (${cols.map(quoteIdent).join(", ")}) VALUES (${placeholders}) ON CONFLICT (${conflict.map(quoteIdent).join(", ")}) ${action} RETURNING *`;
-      const rows = await (await at()).unsafe(sql, asBindParams(table, cols, data));
+      const rows = await (await at()).unsafe(sql, asBindParams(table, cols, data, "upsert"));
       const row = rows[0];
       if (!row) {
         throw new Error(
@@ -1574,7 +1640,7 @@ function createOps(tx) {
       if (cols.length === 0) return ops.findById(table, id);
       const assignments = cols.map((c, i) => `${quoteIdent(c)} = $${i + 1}`).join(", ");
       const sql = `UPDATE ${quoteIdent(table)} SET ${assignments} WHERE id = $${cols.length + 1} RETURNING *`;
-      const rows = await (await at()).unsafe(sql, [...asBindParams(table, cols, data), id]);
+      const rows = await (await at()).unsafe(sql, [...asBindParams(table, cols, data, "update"), id]);
       return rows[0] ? asTableRow(table, rows[0]) : null;
     },
     async delete(table, id) {
@@ -1605,13 +1671,20 @@ function createOps(tx) {
           `updateMany(${table}): nothing to set. An update with no columns is not a no-op worth pretending happened \u2014 pass the columns to write.`
         );
       }
+      const known = schemaColumns(table);
+      if (known !== null) {
+        for (const c of cols) {
+          if (!known.has(c)) {
+            throw new Error(`updateMany(${table}): set kolonu "${c}" tabloda yok (FR-016)`);
+          }
+        }
+      }
       const params = [];
       const add = (v) => {
         params.push(v);
         return `$${params.length}`;
       };
-      const assignments = cols.map((c) => `${quoteIdent(c)} = ${add(asBindParams(table, [c], set)[0])}`).join(", ");
-      const known = schemaColumns(table);
+      const assignments = cols.map((c) => `${quoteIdent(c)} = ${add(asBindParams(table, [c], set, "updateMany")[0])}`).join(", ");
       const whereSql = compileWhere(table, known, where, add, "updateMany");
       assertHasPredicate(whereSql, "updateMany", table);
       const sql = `UPDATE ${quoteIdent(table)} AS t SET ${assignments} WHERE true${whereSql} RETURNING *`;
@@ -2083,7 +2156,7 @@ function createOps(tx) {
         const placeholders = cols.map((_, i) => `$${i + 1}`).join(", ");
         const rows = await sp.unsafe(
           `INSERT INTO ${quoteIdent(table)} (${cols.map(quoteIdent).join(", ")}) VALUES (${placeholders}) RETURNING *`,
-          asBindParams(table, cols, data)
+          asBindParams(table, cols, data, "supersede")
         );
         if (!rows[0]) {
           throw new Error(
@@ -2223,7 +2296,7 @@ function diagnosingDriver(sql, surface = "service") {
       );
     }
     if (isUniqueViolation(e)) {
-      return new UniqueViolation(constraintOf(e));
+      return markEngineRaised(new UniqueViolation(constraintOf(e)));
     }
     if (surface === "service" && isForeignKeyViolation(e)) {
       return new Error(
@@ -2679,6 +2752,7 @@ async function defaultSqlDriver(config) {
   }
   return new g.Bun.SQL({ url: config.databaseUrl, max: config.poolMax });
 }
+var AUTHOR_ANSWERED = /* @__PURE__ */ new Set([400, 401, 403, 404, 409, 429]);
 async function createApp(opts) {
   const { config, controllers } = opts;
   setSchema(opts.schema ?? {});
@@ -3064,6 +3138,9 @@ async function createApp(opts) {
     } catch (err) {
       await db.rollback(err);
       if (isHttpError(err)) {
+        if (isEngineRaised(err) || !AUTHOR_ANSWERED.has(err.status)) {
+          log.error(`[engine] unhandled ${err.error} in ${hit.entry.id}`, err);
+        }
         return envelope(
           err.error,
           err.errorDescription,