@rebasepro/client 0.12.1-canary.g389e9b2 → 0.12.1-canary.g4e7bcbf

package/dist/index.es.js

@@ -1,4 +1,4 @@
-import { DEFAULT_STORAGE_SOURCE_KEY, EntityReference, EntityRelation, GeoPoint, PUBLIC_STORAGE_PREFIX, RebaseApiError, RebaseApiError as RebaseApiError$1, RebaseClientError, Vector, isPublicStoragePath, toCanonicalOp } from "@rebasepro/types";
+import { DEFAULT_STORAGE_SOURCE_KEY, EntityReference, EntityRelation, GeoPoint, PUBLIC_STORAGE_PREFIX, RebaseApiError, RebaseApiError as RebaseApiError$1, RebaseClientError, RebaseClientError as RebaseClientError$1, Vector, isPublicStoragePath, toCanonicalOp } from "@rebasepro/types";
 import { COMPOSITE_ID_SEPARATOR, QueryBuilder, RebasePaginationError, and, buildCompositeId, collectAllPages, cond, or, paginateFind, serializeFilter, serializeLogicalCondition, serializeOrderBy } from "@rebasepro/common";
 import { toSnakeCase } from "@rebasepro/utils";
 //#region src/reviver.ts
@@ -49,6 +49,38 @@ function isServerLikeEnvironment() {
 * greppable — this is the string a user will paste into a search.
 */
 var ANONYMOUS_SERVER_CLIENT_WARNING = "[rebase] This client was created outside a browser with no credential — no `token`, no auth token getter, and no cookie auth flow — so every request runs as an anonymous caller. Row-level security will return only publicly readable rows, which is usually nothing and occasionally the wrong thing. Inside a cron or function handler, use the `client` you were handed instead of building a new one: its data plane is already admin-scoped. In a standalone script or job, pass the service key as `token`. If you really do want anonymous access, pass `anonymous: true` to silence this.";
+/**
+* Refuse a filter whose *value* is missing.
+*
+* `where: { status: ["==", undefined] }` used to serialize to the literal
+* string, so `status=eq.undefined` went out on the wire and the server dutifully
+* looked for rows whose status is the four-letter word "undefined". The caller
+* saw an empty page, not an error — the classic shape of a variable that was
+* never set.
+*
+* Dropping the condition instead would be worse than sending it: the query
+* would come back *unfiltered*, which for an ownership or tenant filter means
+* returning rows the caller never asked to see. So this is a hard error, and
+* both correct spellings are named in the message: omit the key to skip the
+* filter, or use `["is-null", null]` to match SQL NULL (which still
+* serializes — `null` is a value, `undefined` is the absence of one).
+*/
+function assertNoUndefinedFilterValues(where) {
+	const reject = (field, op) => {
+		throw new RebaseClientError$1(`Filter on "${field}" has an undefined value (["${String(op)}", undefined]). Omit "${field}" from \`where\` to skip the filter, or use ["is-null", null] to match SQL NULL.`);
+	};
+	for (const [field, condition] of Object.entries(where)) {
+		if (condition === void 0) continue;
+		if (!Array.isArray(condition)) continue;
+		const tuples = Array.isArray(condition[0]) ? condition : [condition];
+		for (const tuple of tuples) {
+			if (!Array.isArray(tuple) || tuple.length !== 2) continue;
+			const [op, value] = tuple;
+			if (value === void 0) reject(field, op);
+			if (Array.isArray(value) && value.some((v) => v === void 0)) reject(field, op);
+		}
+	}
+}
 function buildQueryString(params) {
 	if (!params) return "";
 	const parts = [];
@@ -67,6 +99,7 @@ function buildQueryString(params) {
 		parts.push(`${root.type}=${encodeURIComponent(`(${serialized})`)}`);
 	}
 	if (params.where) {
+		assertNoUndefinedFilterValues(params.where);
 		const serialized = serializeFilter(params.where);
 		for (const [field, value] of Object.entries(serialized)) if (Array.isArray(value)) for (const v of value) parts.push(`${encodeURIComponent(field)}=${encodeURIComponent(v)}`);
 		else parts.push(`${encodeURIComponent(field)}=${encodeURIComponent(value)}`);
@@ -1297,7 +1330,8 @@ function createCollectionClient(transport, slug, ws) {
 			const qs = buildQueryString({
 				...params,
 				limit: void 0,
-				offset: void 0
+				offset: void 0,
+				include: void 0
 			});
 			return (await transport.request(basePath + "/count" + qs, { method: "GET" })).count ?? 0;
 		},