@palbase/backend 24.0.2 → 24.1.1

package/dist/openapi/index.d.cts

@@ -1,7 +1,7 @@
 import { OpenApiGeneratorV31 } from '@asteasolutions/zod-to-openapi';
 import { ZodTypeAny } from 'zod';
-import { A as AuthSpec, R as RateLimitConfig } from '../endpoint-CcQ1a36a.cjs';
-import { P as ParamMeta, T as ThrowDescriptor, U as UploadConfig, S as SseConfig } from '../registry-1X-skBNu.cjs';
+import { A as AuthSpec, R as RateLimitConfig } from '../endpoint-BSGw1pTu.cjs';
+import { P as ParamMeta, T as ThrowDescriptor, U as UploadConfig, S as SseConfig } from '../registry-CgJvDYUW.cjs';
 import '../stack.cjs';
 
 /** A controller class (constructor). Kept loose — the only contract is that it

package/dist/openapi/index.d.ts

@@ -1,7 +1,7 @@
 import { OpenApiGeneratorV31 } from '@asteasolutions/zod-to-openapi';
 import { ZodTypeAny } from 'zod';
-import { A as AuthSpec, R as RateLimitConfig } from '../endpoint-0_DGBajf.js';
-import { P as ParamMeta, T as ThrowDescriptor, U as UploadConfig, S as SseConfig } from '../registry-CEod_5sz.js';
+import { A as AuthSpec, R as RateLimitConfig } from '../endpoint-DMwJjEHQ.js';
+import { P as ParamMeta, T as ThrowDescriptor, U as UploadConfig, S as SseConfig } from '../registry-B8pld3fj.js';
 import '../stack.js';
 
 /** A controller class (constructor). Kept loose — the only contract is that it

package/dist/openapi/index.js

@@ -1,12 +1,12 @@
 import {
   getErrorRegistry
-} from "../chunk-T5IOSOE5.js";
+} from "../chunk-ERDL5VAE.js";
 import {
   getRoutes,
   isController,
   resolveController,
   resolveEffectiveAuth
-} from "../chunk-H3JAISUY.js";
+} from "../chunk-UWSYTUGM.js";
 import {
   __commonJS,
   __require,

package/dist/{registry-CEod_5sz.d.ts → registry-B8pld3fj.d.ts}

@@ -1,4 +1,4 @@
-import { A as AuthSpec, R as RateLimitConfig } from './endpoint-0_DGBajf.js';
+import { A as AuthSpec, R as RateLimitConfig } from './endpoint-DMwJjEHQ.js';
 import { ZodTypeAny } from 'zod';
 import { PalbaseBucketName } from './stack.js';
 

package/dist/{registry-1X-skBNu.d.cts → registry-CgJvDYUW.d.cts}

@@ -1,4 +1,4 @@
-import { A as AuthSpec, R as RateLimitConfig } from './endpoint-CcQ1a36a.cjs';
+import { A as AuthSpec, R as RateLimitConfig } from './endpoint-BSGw1pTu.cjs';
 import { ZodTypeAny } from 'zod';
 import { PalbaseBucketName } from './stack.cjs';
 

package/dist/test/index.cjs

@@ -304,6 +304,56 @@ var api = new Proxy({}, {
   }
 });
 
+// src/db/input-guards.ts
+var KNOWN_OPS = /* @__PURE__ */ new Set(["gt", "gte", "lt", "lte", "neq", "eq", "in"]);
+function assertUsableFilter(caller, table, where) {
+  if (!where) return;
+  for (const [col, cond] of Object.entries(where)) {
+    if (cond === void 0) {
+      throw new Error(
+        `${caller}(${table}): where.${col} de\u011Feri undefined \u2014 bu bir filtre de\u011Feri de\u011Fil. Ba\u011Flan\u0131nca NULL olur ve '= NULL' hi\xE7bir sat\u0131ra uymaz, yani sorgu sessizce bo\u015F sonu\xE7 d\xF6nerdi. De\u011Fer yoksa anahtar\u0131 filtreye hi\xE7 koymay\u0131n.`
+      );
+    }
+    if (cond === null || typeof cond !== "object" || Array.isArray(cond)) continue;
+    const entries = Object.entries(cond);
+    if (entries.length === 0) {
+      throw new Error(
+        `${caller}(${table}): where.${col} bo\u015F bir operat\xF6r nesnesi ({}) \u2014 hi\xE7bir ko\u015Ful \xFCretmez, yani bu alan filtreden sessizce D\xDC\u015EERD\u0130. Ko\u015Ful kurulmayacaksa anahtar\u0131 filtreye hi\xE7 koymay\u0131n (D-21).`
+      );
+    }
+    for (const [op, v] of entries) {
+      if (op === "in") {
+        if (!Array.isArray(v)) throw new Error(`${caller}(${table}): where.${col}.in bir dizi olmal\u0131`);
+        if (v.some((x) => x === void 0)) {
+          throw new Error(
+            `${caller}(${table}): where.${col}.in listesinde undefined var \u2014 sessizce NULL'a ba\u011Flan\u0131r ve o eleman hi\xE7bir sat\u0131rla e\u015Fle\u015Fmez. Listeyi kurarken eleyin.`
+          );
+        }
+        continue;
+      }
+      if (!KNOWN_OPS.has(op)) {
+        throw new Error(
+          `${caller}(${table}): where.${col} bilinmeyen operat\xF6r "${op}" (gt/gte/lt/lte/neq/in)`
+        );
+      }
+      if (v === void 0) {
+        throw new Error(
+          `${caller}(${table}): where.${col}.${op} de\u011Feri undefined \u2014 kar\u015F\u0131la\u015Ft\u0131rman\u0131n sa\u011F taraf\u0131 NULL olur ve sonu\xE7 hi\xE7bir sat\u0131ra uymaz. Ko\u015Fulu kurmay\u0131n.`
+        );
+      }
+    }
+  }
+}
+function assertUsableWriteValues(caller, table, cols, data) {
+  for (const c of cols) {
+    if (data[c] === void 0) {
+      throw new Error(
+        `${caller}(${table}): "${c}" de\u011Feri undefined \u2014 bu bir yazma de\u011Feri de\u011Fil. Kolonu bo\u015Faltmak istiyorsan null yaz; kolonu de\u011Fi\u015Ftirmek istemiyorsan nesneye hi\xE7 koyma (bir eksik istek alan\u0131 sessizce NULL yaz\u0131yordu \u2014 FR-016).`
+      );
+    }
+  }
+}
+
 // src/__tests__/helpers/mock-db.ts
 function createMockDB() {
   const store = /* @__PURE__ */ new Map();
@@ -332,6 +382,8 @@ function createMockDB() {
     // tests meant to prove it works.
     async updateMany(table, where, set) {
       if (Object.keys(where).length === 0) throw new Error(`updateMany(${table}): bo\u015F filtre`);
+      assertUsableFilter("updateMany", table, where);
+      assertUsableWriteValues("updateMany", table, Object.keys(set), set);
       const hit = (store.get(table) ?? []).filter(
         (r) => Object.entries(where).every(([k, v]) => r[k] === v)
       );
@@ -340,12 +392,14 @@ function createMockDB() {
     },
     async deleteMany(table, where) {
       if (Object.keys(where).length === 0) throw new Error(`deleteMany(${table}): bo\u015F filtre`);
+      assertUsableFilter("deleteMany", table, where);
       const list = store.get(table) ?? [];
       const keep = list.filter((r) => !Object.entries(where).every(([k, v]) => r[k] === v));
       store.set(table, keep);
       return list.length - keep.length;
     },
     async count(table, where = {}) {
+      assertUsableFilter("count", table, where);
       return (store.get(table) ?? []).filter(
         (r) => Object.entries(where).every(([k, v]) => r[k] === v)
       ).length;
@@ -369,6 +423,7 @@ function createMockDB() {
       return [];
     },
     async insert(table, data) {
+      assertUsableWriteValues("insert", table, Object.keys(data), data);
       const record = { id: crypto.randomUUID(), ...data };
       rowsOf(table).push(record);
       track(tracked.inserted, table, record);
@@ -380,6 +435,7 @@ function createMockDB() {
       if (opts.onConflict.length === 0) {
         throw new Error(`upsert into ${table}: onConflict en az bir kolon ad\u0131 ister`);
       }
+      assertUsableWriteValues("upsert", table, Object.keys(data), data);
       const rows = rowsOf(table);
       const existing = rows.find((r) => opts.onConflict.every((c) => r[c] === data[c]));
       if (existing) {
@@ -394,6 +450,7 @@ function createMockDB() {
       return record;
     },
     async update(table, id, data) {
+      assertUsableWriteValues("update", table, Object.keys(data), data);
       const rows = store.get(table) ?? [];
       const idx = rows.findIndex((r) => r["id"] === id);
       const updated = idx >= 0 ? { ...rows[idx], ...data } : { id, ...data };
@@ -420,6 +477,7 @@ function createMockDB() {
     // pass a service test that the live database then fails — which is the one
     // thing a stand-in must never do.
     async findMany(table, query, opts) {
+      assertUsableFilter("findMany", table, query);
       const rows = store.get(table) ?? [];
       const matches2 = (row, key, cond) => {
         if (cond !== null && typeof cond === "object" && !Array.isArray(cond)) {