@proteinjs/db 1.22.2 → 1.23.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proteinjs/db",
-  "version": "1.22.2",
+  "version": "1.23.0",
   "main": "./dist/generated/index.js",
   "types": "./dist/generated/index.d.ts",
   "exports": {
@@ -65,5 +65,6 @@
     "jest": "29.7.0",
     "ts-jest": "29.1.1",
     "typescript": "5.2.2"
-  }
+  },
+  "gitHead": "cbdb41b438edb7c2b509d02827de16cc12e40959"
 }

package/src/Db.ts

@@ -171,6 +171,16 @@ export class Db<R extends Record = Record> implements DbService<R> {
     }
 
     let recordCopy = Object.assign({}, record);
+    // Immutable columns can never be rewritten through an update — strip them from the payload
+    // (e.g. a ScopedRecord's `scope`: forced on insert; a client-path update rewriting it would
+    // reassign the row into another user's scope).
+    for (const columnPropertyName in table.columns) {
+      const column = (table.columns as any)[columnPropertyName];
+      const immutable = column?.options?.immutable;
+      if (immutable === true || (typeof immutable === 'function' && immutable(this.runAsSystem))) {
+        delete (recordCopy as any)[columnPropertyName];
+      }
+    }
     await addUpdateFieldValues(table, recordCopy);
     const qb = new QueryBuilderFactory().getQueryBuilder(table, query);
     await this.addColumnQueries(table, qb, 'write');

package/src/Table.ts

@@ -161,6 +161,12 @@ export type ColumnOptions = {
   forceDefaultValue?: boolean | ((runAsSystem: boolean) => boolean);
   /** Value stored on update */
   updateValue?: (table: Table<any>, updateObj: any) => Promise<any>;
+  /**
+   * When active, `Db.update` strips this column from update payloads — the stored value can never
+   * be rewritten through an update (e.g. a ScopedRecord's `scope`: forced on insert, and without
+   * this a client-path update could reassign a row into another user's scope).
+   */
+  immutable?: boolean | ((runAsSystem: boolean) => boolean);
   /** Add conditions to query; called on every query of this table */
   addToQuery?: (qb: QueryBuilder, runAsSystem: boolean, operation: 'read' | 'write' | 'delete') => Promise<void>;
   onBeforeInsert?: (insertObj: any & Record, runAsSystem: boolean) => Promise<void>;