@protobase/server 0.38.0 → 0.39.0

package/dist/batch/reorder.js

@@ -3,7 +3,7 @@ import { tenantScope } from "../tenant.js";
 import { requireOperation, targetFilter, writableFields } from "../request-access.js";
 import { columnId, keyConditions, scopeConditions, tableId, whereClause } from "../sql-parts.js";
 import { fetchRecord } from "../records.js";
-import { validateBody } from "../validate-body.js";
+import { refuseUnknownField, validateBody } from "../validate-body.js";
 import { missing, shown } from "../write-shared.js";
 import { applyUpdate, planUpdate } from "../write-update.js";
 import { checkRankAfter } from "../rank-after.js";
@@ -50,6 +50,7 @@ const reorderIn = async (trx, deps, access, input) => {
 	const { entry, full } = access;
 	requireOperation(access, "update");
 	const field = full.fields[input.field];
+	if (!Object.hasOwn(access.readable.fields, input.field)) refuseUnknownField(input.field);
 	validateBody(access, "update", { [input.field]: 1 });
 	if (field?.type !== "integer" && field?.type !== "bigint") throw badRequest("invalid-parameter", `"${input.field}" must be an integer field to order by`);
 	if (!writableFields(access, "update").includes(input.field)) throw badRequest("invalid-parameter", `"${input.field}" is read-only`);

package/dist/openapi/schemas.js

@@ -69,7 +69,7 @@ const only = (schema, names) => ({
 });
 /**
 * Component schemas of a resource for one caller: the record with the fields they may read, and the create and update
-* bodies with the fields they may write. Hidden fields appear nowhere.
+* bodies with the fields they may write. Hidden fields appear nowhere; a write-only one only in the bodies.
 */
 const resourceSchemas = (access) => {
 	const { entry, model, resolved } = access;
@@ -104,7 +104,7 @@ const resourceSchemas = (access) => {
 		}
 	};
 	record.required = [...record.required ?? [], "etag"];
-	const writable = access.readable;
+	const writable = access.full;
 	const body = (names) => {
 		const properties = only(input.schema, names).properties;
 		const optional = new Set(names.filter((field) => writable.fields[field]?.nullable || writable.fields[field]?.default && "db" in writable.fields[field].default));

package/dist/request-access.js

@@ -65,11 +65,13 @@ const requireOperation = (access, operation) => {
 	if (access.session.anonymous) throw unauthorized(`Send a bearer token to ${operation} ${access.entry.name}`);
 	throw forbidden("access-denied", `You may not ${operation} ${access.entry.name}`);
 };
+const writesBlind = (access, name, mode) => access.entry.source.fieldAccess()[name]?.[mode] !== void 0 && !access.full.fields[name]?.file && name !== access.full.position?.field;
 /**
-* Fields the caller may write on create or update. A field they cannot read is never writable, even when its write rule
-* allows it (nobody writes blind; a sensitive field counts as readable); the tenant column is always set by the server.
+* Fields the caller may write on create or update: those they read (a sensitive field counts as read), and write-only
+* ones, which they cannot read but whose own write rule allows them (see `writesBlind`). The tenant column is always set
+* by the server.
 */
-const writableFields = (access, mode) => access.resolved.writableFields[mode].filter((name) => Object.hasOwn(access.readable.fields, name) && name !== access.full.tenant);
+const writableFields = (access, mode) => access.resolved.writableFields[mode].filter((name) => (Object.hasOwn(access.readable.fields, name) || writesBlind(access, name, mode)) && name !== access.full.tenant);
 const visibleFields = (access) => Object.values(access.model.fields);
 const andFilters = (filters) => {
 	const present = filters.filter((filter) => filter !== void 0);

package/dist/validate-body.js

@@ -17,6 +17,15 @@ const invalidValue = (field, issue) => {
 		...params && { params }
 	};
 };
+const unknownField = (name) => ({
+	field: name,
+	code: "unknown-field",
+	message: `Unknown field "${name}"`
+});
+/** Refuses a field the caller may not name in this request as `validateBody` refuses an unknown one. */
+const refuseUnknownField = (name) => {
+	throw fail([unknownField(name)]);
+};
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const reserved = ["etag", "permissions"];
 const isEmptyText = (field, value) => field.type === "text" && !field.nullable && value === "";
@@ -26,11 +35,11 @@ const isEmptyText = (field, value) => field.type === "text" && !field.nullable &
 */
 const requiredOnCreate = (field, schema) => !(field.default && "db" in field.default) && !field.nullable && !schema.safeParse(void 0).success;
 /**
-* Checks a create or update body for this caller. A field the caller cannot read is an unknown field, one they can read
-* but not write is read-only (the tenant column and the API's own `etag` and `permissions` keys are always read-only);
-* every provided value goes through its field's zod schema, then `.validate()` rules run on the result. An empty text
-* for a text field that may not be null counts as not given: a create fills in its default or reports it required,
-* an update reports it required. Only the values written are checked, so a stored '' still reads.
+* Checks a create or update body for this caller. A field the caller can neither read nor write is an unknown field, one
+* they can read but not write is read-only (the tenant column and the API's own `etag` and `permissions` keys are always
+* read-only), and a write-only one (see `writableFields`) is written like any other; every provided value goes through
+* its field's zod schema, then `.validate()` rules run on the result. An empty text for a text field that may not be null
+* counts as not given: a create fills in its default or reports it required, an update reports it required. Only the values written are checked, so a stored '' still reads.
 * Returns only the values to write: on create the defaults are filled in, on update only the provided fields.
 * `current` is the stored record an update merges into for `.validate()` rules, which get a set encrypted field of it as
 * `encrypted`: they see an encrypted value as text only when this write gives it.
@@ -46,11 +55,7 @@ const validateBody = (access, mode, body, current = {}) => {
 		code: "read-only",
 		message: name === "etag" ? "The version is not part of the body; send it in the If-Match header" : `"${name}" is read-only`
 	});
-	else if (!Object.hasOwn(model.fields, name)) errors.push({
-		field: name,
-		code: "unknown-field",
-		message: `Unknown field "${name}"`
-	});
+	else if (!Object.hasOwn(model.fields, name) && !writable.has(name)) errors.push(unknownField(name));
 	else if (!writable.has(name) || name === full.tenant) errors.push({
 		field: name,
 		code: "read-only",
@@ -92,11 +97,11 @@ const validateBody = (access, mode, body, current = {}) => {
 	};
 	const issues = entry.source.validators.flatMap((validate) => validate(merged) ?? []);
 	if (issues.length > 0) throw fail(issues.map((issue) => ({
-		field: Object.hasOwn(model.fields, issue.field) ? issue.field : "_record",
+		field: Object.hasOwn(model.fields, issue.field) || writable.has(issue.field) ? issue.field : "_record",
 		code: "invalid-record",
 		message: issue.message
 	})));
 	return values;
 };
 //#endregion
-export { requiredOnCreate, validateBody };
+export { refuseUnknownField, requiredOnCreate, validateBody };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.38.0",
-    "@protobase/query": "0.38.0",
-    "@protobase/schema": "0.38.0",
+    "@protobase/layout": "0.39.0",
+    "@protobase/query": "0.39.0",
+    "@protobase/schema": "0.39.0",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",