@protobase/server 0.25.6 → 0.25.7

package/dist/batch/reorder.js

@@ -6,7 +6,7 @@ import { fetchRecord } from "../records.js";
 import { validateBody } from "../validate-body.js";
 import { missing, shown } from "../write-shared.js";
 import { applyUpdate, planUpdate } from "../write-update.js";
-import { checkRankAfter } from "./rank-after.js";
+import { checkRankAfter } from "../rank-after.js";
 import { encodeKey } from "@protobase/schema/internal";
 import { sql } from "kysely";
 //#region src/batch/reorder.ts

package/dist/{batch/rank-after.js → rank-after.js}

@@ -1,15 +1,16 @@
-import { HttpProblem } from "../problem.js";
-import { checkedFilter } from "../filter-input.js";
-import { tenantScope } from "../tenant.js";
-import { columnId, filterCondition, scopeConditions, tableId, whereClause } from "../sql-parts.js";
+import { HttpProblem } from "./problem.js";
+import { checkedFilter } from "./filter-input.js";
+import { tenantScope } from "./tenant.js";
+import { columnId, filterCondition, scopeConditions, tableId, whereClause } from "./sql-parts.js";
 import { newlyAbove } from "./rank-pairs.js";
 import { encodeKey } from "@protobase/schema/internal";
 import { sql } from "kysely";
-//#region src/batch/rank-after.ts
+//#region src/rank-after.ts
 /**
-* Refuses a reorder by the resource's position that puts a record at or above a record it depends on, or one of those
-* at or below it (see `PositionAfterModel`), in one query of the pairs that involve the changed records. Pairs out of
-* order before the reorder do not count, so existing data never blocks a move that did not break it.
+* Refuses a write of the resource's position (a create, an update or a reorder) that puts a record at or above a record
+* it depends on, or one of those at or below it (see `PositionAfterModel`), in one query of the pairs that involve the
+* changed records. Pairs out of order before the write do not count, so existing data never blocks a move that did not
+* break it.
 */
 const checkRankAfter = async (trx, deps, access, field, moved) => {
 	const { full, entry, session } = access;

package/dist/{batch/rank-pairs.js → rank-pairs.js}

@@ -1,10 +1,10 @@
 import { encodeKey } from "@protobase/schema/internal";
-//#region src/batch/rank-pairs.ts
+//#region src/rank-pairs.ts
 const atOrAbove = (dependent, depended) => dependent !== null && depended !== null && Number(dependent) <= Number(depended);
 /**
 * The first pair whose record now ranks at or above the record it depends on but did not before: `before` holds the
-* ranks the records a reorder changed had, by their encoded key. A pair out of order already stays as it is, so a
-* reorder never fails on an order it did not break.
+* ranks the records a write changed had, by their encoded key, `null` for a new one. A pair out of order already stays
+* as it is, so a write never fails on an order it did not break.
 */
 const newlyAbove = (pairs, before) => {
 	const was = (key, now) => {

package/dist/write-pipeline.js

@@ -8,8 +8,9 @@ import { isDatabaseError } from "./error-handler.js";
 import { attachFiles } from "./files/attach.js";
 import { actorSettings, wakeDispatch } from "./changes/actor.js";
 import { validateBody } from "./validate-body.js";
-import { assertWritten, checkPrecondition, decide, denied, firstKeyField, missing, notifier, shown } from "./write-shared.js";
+import { assertWritten, checkPrecondition, decide, denied, firstKeyField, keyOf, missing, notifier, shown } from "./write-shared.js";
 import { applyUpdate, planUpdate } from "./write-update.js";
+import { checkRankAfter } from "./rank-after.js";
 //#region src/write-pipeline.ts
 const withOwner = (access, values) => {
 	const { owner } = access.full;
@@ -32,13 +33,23 @@ const create = async (trx, deps, access, body) => {
 	const filter = await decide(access, "create", void 0, row);
 	const created = await insertRecord(trx, entry, row, { etagFields: Object.keys(access.model.fields) });
 	await assertWritten(trx, access, created, "create", access.resolved.rowFilter.create, filter);
+	if (full.position) await checkRankAfter(trx, deps, access, full.position.field, [{
+		key: keyOf(access, created.record),
+		before: null
+	}]);
 	await notifier(deps, access)(trx, "create", void 0, created.record);
 	return shown(access, created);
 };
 const update = async (trx, deps, access, request) => {
 	const plan = await planUpdate(trx, access, request.key, request.body, request.ifMatch);
 	if (Object.keys(plan.values).length === 0) return shown(access, plan.current);
-	return shown(access, await applyUpdate(trx, deps, access, request.key, plan));
+	const updated = await applyUpdate(trx, deps, access, request.key, plan);
+	const rank = access.full.position?.field;
+	if (rank && rank in plan.values) await checkRankAfter(trx, deps, access, rank, [{
+		key: keyOf(access, updated.record),
+		before: plan.current.record[rank]
+	}]);
+	return shown(access, updated);
 };
 const removeOrRestore = async (trx, deps, access, request) => {
 	const { entry, full } = access;
@@ -83,7 +94,8 @@ const removeOrRestore = async (trx, deps, access, request) => {
 /**
 * One write inside an open transaction, for a caller whose access is already resolved: operations and field access,
 * tenant scope, validation against the fields they may write, optimistic concurrency, row filters and record-level
-* rules checked in the database, then the hooks. Batches run many of these in one transaction.
+* rules checked in the database, then the hooks; a rank written by the resource's position with `after` must keep the
+* record below what it depends on (see `checkRankAfter`). Batches run many of these in one transaction.
 */
 const writeIn = async (trx, deps, access, request) => {
 	requireOperation(access, request.operation === "undelete" ? "update" : request.operation);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.25.6",
+  "version": "0.25.7",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,9 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.25.6",
-    "@protobase/query": "0.25.6",
-    "@protobase/schema": "0.25.6",
+    "@protobase/layout": "0.25.7",
+    "@protobase/query": "0.25.7",
+    "@protobase/schema": "0.25.7",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",