@palbase/backend 30.0.1 → 33.0.0

package/dist/{chunk-RADVOY7Y.js → chunk-DCDHAKF3.js}

@@ -1,15 +1,17 @@
 import {
   DeclarationRefused,
-  __requestALS,
-  __runStartHooks,
-  __runWithRuntime,
   assertNoOrphanEntryPoints,
   buildContainer,
   buildRelations
-} from "./chunk-YRVIWHJC.js";
+} from "./chunk-N54QZER3.js";
 import {
-  qualifiedTableKey
-} from "./chunk-SG4UTNOP.js";
+  __requestALS,
+  __runStartHooks,
+  __runWithRuntime
+} from "./chunk-QMFOL2K6.js";
+import {
+  CODECS
+} from "./chunk-XOX6RFPZ.js";
 import {
   assertNoExpressionHandles,
   assertUsableFilter,
@@ -21,23 +23,22 @@ import {
   isPlanRef,
   isSqlFragment,
   looksLikeUnbrandedPlanRef,
-  looksLikeUnbrandedRef
-} from "./chunk-3TUJWHC2.js";
+  looksLikeUnbrandedRef,
+  qualifiedTableKey
+} from "./chunk-C4ZA5AT2.js";
 import {
   getRoutes,
   resolveEffectiveAuth
-} from "./chunk-VVMJEVQP.js";
+} from "./chunk-BRLJOXWS.js";
 import {
   DeadlockDetected,
   SerializationFailure,
   UniqueViolation,
+  __name,
   isEngineRaised,
   isHttpError,
   markEngineRaised
-} from "./chunk-CGNN2PUH.js";
-import {
-  __name
-} from "./chunk-VXPNPVAG.js";
+} from "./chunk-KATPXCJ5.js";
 
 // src/engine/config.ts
 var BootRefused = class extends Error {
@@ -515,6 +516,15 @@ function transformsOf(schema, table) {
   if (def) {
     for (const [col, c] of Object.entries(def.columns ?? {})) {
       const d = c !== null && typeof c === "object" && "_def" in c ? c._def : c;
+      const codec = d?.codec;
+      if (typeof codec === "string" && codec in CODECS) {
+        const c2 = CODECS[codec];
+        out.set(col, {
+          fromDb: c2.fromDb,
+          toDb: c2.toDb
+        });
+        continue;
+      }
       const t = d?.transform;
       if (t !== null && typeof t === "object") {
         out.set(col, t);
@@ -850,6 +860,29 @@ function selectClause(table, known, select) {
   }).join(", ");
 }
 __name(selectClause, "selectClause");
+function quoteLiteral(v) {
+  return `'${v.replace(/'/g, "''")}'`;
+}
+__name(quoteLiteral, "quoteLiteral");
+function orderClauseFor(table, known, orderBy, alias) {
+  if (orderBy === void 0 || orderBy === null) return "";
+  const items = Array.isArray(orderBy) ? orderBy : [
+    orderBy
+  ];
+  if (items.length === 0) return "";
+  const rendered = items.map((o) => {
+    const col = o.column;
+    const shapeOK = /^[A-Za-z_][A-Za-z0-9_]*$/.test(col);
+    if (known !== null ? !known.has(col) : !shapeOK) {
+      throw new Error(`with(${table}): orderBy kolonu "${col}" tabloda yok`);
+    }
+    const dir = o.direction === "desc" ? "DESC" : "ASC";
+    const nulls = o.nulls === "first" ? " NULLS FIRST" : o.nulls === "last" ? " NULLS LAST" : "";
+    return `${alias}.${quoteIdent(col)} ${dir}${nulls}`;
+  });
+  return ` ORDER BY ${rendered.join(", ")}`;
+}
+__name(orderClauseFor, "orderClauseFor");
 function orderClause(table, known, orderBy) {
   if (!orderBy) return "";
   const items = Array.isArray(orderBy) ? orderBy : [
@@ -1153,6 +1186,65 @@ function aggregateExpr(table, fn, col, alias) {
   return t !== null && NUMERIC_PG_TYPES.has(t) && t !== "integer" ? `${fn}(${q})::text AS ${quoteIdent(alias)}` : `${fn}(${q}) AS ${quoteIdent(alias)}`;
 }
 __name(aggregateExpr, "aggregateExpr");
+function jsonObjectFor(table, cols, alias) {
+  const pairs = cols.map((c) => {
+    const t = columnTypeOf(table, c);
+    const expr = t !== null && (t === "numeric" || t === "bigint") ? `${alias}.${quoteIdent(c)}::text` : `${alias}.${quoteIdent(c)}`;
+    return `${quoteLiteral(c)}, ${expr}`;
+  });
+  return `json_build_object(${pairs.join(", ")})`;
+}
+__name(jsonObjectFor, "jsonObjectFor");
+function withClauses(table, spec, add, caller) {
+  const rels = currentRelations.get(table) ?? [];
+  const select = [];
+  const joins = [];
+  let i = 0;
+  for (const [name, opt] of Object.entries(spec)) {
+    if (opt === false || opt === void 0) continue;
+    const rel = rels.find((r) => r.name === name);
+    if (rel === void 0) {
+      const known = rels.map((r) => r.name).sort();
+      throw new Error(`${caller}(${table}): with.${name} diye bir ili\u015Fki yok` + (known.length > 0 ? ` (bilinenler: ${known.join(", ")})` : `. Bu tablo hi\xE7 yabanc\u0131 anahtar bildirmiyor ve ili\u015Fkiler onlardan T\xDCRET\u0130L\u0130R`) + `. \u0130li\u015Fkiler references(() => <tablo>.<kolon>) ile bildirilir.`);
+    }
+    const ourCol = rel.kind === "many" ? primaryKeyOf(table) : rel.via;
+    const theirCol = rel.kind === "many" ? rel.via : primaryKeyOf(rel.to);
+    if (ourCol === null || theirCol === null) {
+      throw new Error(`${caller}(${table}): with.${name} birincil anahtar bilmeden kurulamaz \u2014 ili\u015Fkinin bir ucu tablonun PK's\u0131 ve bu tablo tek kolonlu bir PK bildirmiyor.`);
+    }
+    const o = typeof opt === "object" && opt !== null ? opt : {};
+    const childAlias = `w${++i}`;
+    const childKnown = schemaColumns(rel.to);
+    const childCols = Array.isArray(o["select"]) && o["select"].length > 0 ? o["select"] : childKnown !== null ? [
+      ...childKnown
+    ] : [];
+    if (childCols.length === 0) {
+      throw new Error(`${caller}(${table}): with.${name} i\xE7in "${rel.to}" tablosunun kolonlar\u0131 bilinmiyor \u2014 select ile hangi kolonlar\u0131 istedi\u011Finizi yaz\u0131n.`);
+    }
+    for (const c of childCols) {
+      if (childKnown !== null && !childKnown.has(c)) {
+        throw new Error(`${caller}(${table}): with.${name}.select kolonu "${c}" "${rel.to}" tablosunda yok`);
+      }
+    }
+    const obj = jsonObjectFor(rel.to, childCols, childAlias);
+    const innerWhere = o["where"] !== void 0 && o["where"] !== null ? compileWhereBare(rel.to, childKnown, o["where"], add, caller, childAlias, i) : "";
+    const link = `${childAlias}.${quoteIdent(theirCol)} = t.${quoteIdent(ourCol)}`;
+    const cond = innerWhere === "" ? link : `${link} AND ${innerWhere}`;
+    const inner = orderClauseFor(rel.to, childKnown, o["orderBy"], childAlias) + limitClause(o["limit"]);
+    const outAlias = `wj${i}`;
+    if (rel.kind === "many") {
+      joins.push(`LEFT JOIN LATERAL (SELECT coalesce(json_agg(x.o), '[]'::json) AS d FROM (SELECT ${obj} AS o FROM ${quoteTable(rel.to)} ${childAlias} WHERE ${cond}${inner}) x) ${quoteIdent(outAlias)} ON true`);
+    } else {
+      joins.push(`LEFT JOIN LATERAL (SELECT ${obj} AS d FROM ${quoteTable(rel.to)} ${childAlias} WHERE ${cond}${inner} LIMIT 1) ${quoteIdent(outAlias)} ON true`);
+    }
+    select.push(`${quoteIdent(outAlias)}."d" AS ${quoteIdent(name)}`);
+  }
+  return {
+    select,
+    joins
+  };
+}
+__name(withClauses, "withClauses");
 function createOps(tx) {
   const at = /* @__PURE__ */ __name(() => resolveTx(tx), "at");
   const ops = {
@@ -1596,7 +1688,13 @@ function createOps(tx) {
       const limit = limitClause(opts.limit);
       const offset = offsetClause(opts.offset, opts.limit);
       const cols = selectClause(table, known, opts.select);
-      const sql = `SELECT ${cols} FROM ${quoteTable(table)} t WHERE true${whereSql}${order}${limit}${offset}`;
+      const w = opts.with !== void 0 && Object.keys(opts.with).length > 0 ? withClauses(table, opts.with, add, "findMany") : {
+        select: [],
+        joins: []
+      };
+      const selectList = w.select.length > 0 ? `${cols === "*" ? "t.*" : cols}, ${w.select.join(", ")}` : cols;
+      const joinSql = w.joins.length > 0 ? ` ${w.joins.join(" ")}` : "";
+      const sql = `SELECT ${selectList} FROM ${quoteTable(table)} t${joinSql} WHERE true${whereSql}${order}${limit}${offset}`;
       return asTableRows(table, await (await at()).unsafe(sql, params));
     },
     /**
@@ -3089,23 +3187,21 @@ async function createApp(opts) {
     if (spec.required && !callerClaims) {
       return envelope("unauthorized", "A valid access token is required", 401, requestId);
     }
-    if (callerClaims) {
-      const uploadDb = createRequestDatabase(sql, {
-        role: config.dbRole,
-        serviceRole: config.dbServiceRole,
-        claimsJson: JSON.stringify(callerClaims)
-      });
-      try {
-        const refusal = await refuseUnlessAuthorized(uploadDb.client, spec, requestId, makeRoleResolver(uploadDb.client));
-        if (refusal) {
-          await uploadDb.commit();
-          return refusal;
-        }
+    const uploadDb = createRequestDatabase(sql, {
+      role: config.dbRole,
+      serviceRole: config.dbServiceRole,
+      claimsJson: JSON.stringify(callerClaims ?? {})
+    });
+    try {
+      const refusal = await refuseUnlessAuthorized(uploadDb.client, spec, requestId, makeRoleResolver(uploadDb.client));
+      if (refusal) {
         await uploadDb.commit();
-      } catch (err) {
-        await uploadDb.rollback(err);
-        throw err;
+        return refusal;
       }
+      await uploadDb.commit();
+    } catch (err) {
+      await uploadDb.rollback(err);
+      throw err;
     }
     const grant = grantFor(target?.entry, {
       userId: typeof callerClaims?.sub === "string" ? callerClaims.sub : null,
@@ -3144,11 +3240,18 @@ async function createApp(opts) {
       claimsJson: JSON.stringify(claims ?? {})
     });
     const rolesOfCaller = makeRoleResolver(db.client);
-    if (claims) {
-      const refusal = await refuseUnlessAuthorized(db.client, spec, requestId, rolesOfCaller);
-      if (refusal) return refusal;
+    let dispatched = false;
+    const settleBeforeRefusal = /* @__PURE__ */ __name(async () => {
+      if (dispatched) return;
+      await db.rollback(new Error("request refused before dispatch"));
+    }, "settleBeforeRefusal");
+    const refusal = await refuseUnlessAuthorized(db.client, spec, requestId, rolesOfCaller);
+    if (refusal) {
+      await settleBeforeRefusal();
+      return refusal;
     }
     if (claims && spec.verifiedEmail && claims.email_verified !== true) {
+      await settleBeforeRefusal();
       return envelope("email_not_verified", "A verified email address is required", 403, requestId);
     }
     let parsedBody;
@@ -3157,6 +3260,7 @@ async function createApp(opts) {
     if (req.method !== "GET" && req.method !== "HEAD") {
       const declared = Number(req.headers.get("content-length") ?? "");
       if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) {
+        await settleBeforeRefusal();
         return new Response(JSON.stringify({
           error: "payload_too_large",
           error_description: `Request body exceeds ${MAX_BODY_BYTES} bytes`,
@@ -3169,6 +3273,7 @@ async function createApp(opts) {
       }
       const buf = await req.arrayBuffer().catch(() => null);
       if (buf && buf.byteLength > MAX_BODY_BYTES) {
+        await settleBeforeRefusal();
         return new Response(JSON.stringify({
           error: "payload_too_large",
           error_description: `Request body exceeds ${MAX_BODY_BYTES} bytes`,
@@ -3204,6 +3309,7 @@ async function createApp(opts) {
         ...JSON_HEADERS
       };
       if (attest.nextChallenge) headers["x-palbase-attest-challenge"] = attest.nextChallenge;
+      await settleBeforeRefusal();
       return new Response(JSON.stringify({
         error: attest.reason,
         error_description: "This endpoint requires a verified app instance",
@@ -3218,6 +3324,7 @@ async function createApp(opts) {
     attestChallengeOut = attest.nextChallenge;
     const retryAfter = limiter.check(meta.options?.rateLimit, RateLimiter.key(hit.entry.id, userId, req.headers), Date.now());
     if (retryAfter !== null) {
+      await settleBeforeRefusal();
       return new Response(JSON.stringify({
         error: "too_many_requests",
         error_description: "Rate limit exceeded for this endpoint",
@@ -3249,6 +3356,7 @@ async function createApp(opts) {
           readParsedBody();
           const r = p.schema.safeParse(parsedBody);
           if (!r.success) {
+            await settleBeforeRefusal();
             return envelope("bad_request", "Request body failed validation", 400, requestId, {
               data: {
                 fields: fieldErrors(r.error)
@@ -3261,6 +3369,7 @@ async function createApp(opts) {
         case "query": {
           const r = p.schema.safeParse(Object.fromEntries(url.searchParams));
           if (!r.success) {
+            await settleBeforeRefusal();
             return envelope("bad_request", "Query parameters failed validation", 400, requestId, {
               data: {
                 fields: fieldErrors(r.error)
@@ -3281,6 +3390,7 @@ async function createApp(opts) {
           }
           const r = p.schema.safeParse(headersFor(raw, p.schema));
           if (!r.success) {
+            await settleBeforeRefusal();
             return envelope("bad_request", "Request headers failed validation", 400, requestId, {
               data: {
                 fields: fieldErrors(r.error)
@@ -3313,17 +3423,20 @@ async function createApp(opts) {
           break;
         case "uploadedObject": {
           if (uploadSecret === "" || !verifySignature(req.headers.get(SIGNATURE_HEADER) ?? "", uploadSecret)) {
+            await settleBeforeRefusal();
             return envelope("unauthorized", "This endpoint accepts uploads through storage, not directly", 401, requestId);
           }
           readParsedBody();
           const envelopeIn = parsedBody;
           if (!envelopeIn?.uploadedObject) {
+            await settleBeforeRefusal();
             return envelope("bad_request", "the completion call carried no uploaded object", 400, requestId);
           }
           const uploadId = envelopeIn.uploadedObject.uploadId;
           if (typeof uploadId === "string" && uploadId !== "") {
             const already = completions.recall(uploadId);
             if (already) {
+              await settleBeforeRefusal();
               return new Response(already.body, {
                 status: already.status,
                 headers: already.contentType ? {
@@ -3373,6 +3486,7 @@ async function createApp(opts) {
           args[p.index] = void 0;
       }
     }
+    dispatched = true;
     try {
       const services = buildServices(db);
       if (meta.options?.sseConfig !== void 0) {
@@ -3565,4 +3679,4 @@ export {
   installEgressFence,
   createApp
 };
-//# sourceMappingURL=chunk-RADVOY7Y.js.map
+//# sourceMappingURL=chunk-DCDHAKF3.js.map