@rebasepro/server-mongo 0.13.0 → 0.13.1-canary.g06dbe5b

package/src/db/MongoConditionBuilder.ts

@@ -4,9 +4,10 @@
  * Translates Rebase filter conditions to MongoDB query operators.
  */
 
-import { CollectionConfig, FilterValues, WhereFilterOp } from "@rebasepro/types";
+import { CollectionConfig, FilterCondition, FilterValues, LogicalCondition, WhereFilterOp } from "@rebasepro/types";
+import { toFilterTuples } from "@rebasepro/common";
 import { Filter, Document } from "mongodb";
-import { logger } from "@rebasepro/server";
+import { ApiError, logger } from "@rebasepro/server";
 
 /**
  * Mapping from Rebase filter operators to MongoDB query operators
@@ -35,10 +36,22 @@ function escapeRegExp(str: string): string {
  */
 function likePatternToRegExp(pattern: string, caseInsensitive: boolean): RegExp {
     let body = "";
+    // Runs of `%` collapse to one. `%%%%X` means exactly what `%X` means, but as
+    // a regular expression it is four adjacent unbounded quantifiers, and on a
+    // subject that does not match, the engine tries every way of splitting the
+    // subject between them — exponential time. The pattern comes from a public
+    // filter operator over HTTP (`?title=like.%25%25%25…`), and this expression
+    // is handed to MongoDB as `$regex`, so the time is spent on a database
+    // thread rather than the caller's.
+    let lastWasWildcard = false;
     for (const ch of String(pattern)) {
-        if (ch === "%") body += ".*";
-        else if (ch === "_") body += ".";
-        else body += escapeRegExp(ch);
+        if (ch === "%") {
+            if (!lastWasWildcard) body += ".*";
+            lastWasWildcard = true;
+            continue;
+        }
+        body += ch === "_" ? "." : escapeRegExp(ch);
+        lastWasWildcard = false;
     }
     return new RegExp(`^${body}$`, caseInsensitive ? "i" : "");
 }
@@ -66,49 +79,98 @@ export class MongoConditionBuilder {
         for (const [field, filterParam] of Object.entries(filter)) {
             if (!filterParam) continue;
 
-            const [op, value] = filterParam as [WhereFilterOp, any];
-
-            // Null-testing operators ignore their value.
-            if (op === "is-null") {
-                conditions.push({ [field]: { $eq: null } });
-                continue;
-            }
-            if (op === "is-not-null") {
-                conditions.push({ [field]: { $ne: null } });
-                continue;
+            // One tuple or an array of them. This destructured the param
+            // directly, so `{ age: [[">=", 18], ["<", 65]] }` bound `op` to the
+            // tuple `[">=", 18]`, matched no operator, and dropped **both**
+            // conditions — a filtered read answering 200 with the whole
+            // collection. The grammar is shared with the Postgres compiler now.
+            for (const [op, value] of toFilterTuples(filterParam)) {
+                conditions.push(this.buildCondition(field, op, value));
             }
+        }
 
-            // Pattern matching → regular expressions.
-            if (op === "like" || op === "ilike" || op === "not-like" || op === "not-ilike") {
-                const caseInsensitive = op === "ilike" || op === "not-ilike";
-                const regex = likePatternToRegExp(value, caseInsensitive);
-                const negated = op === "not-like" || op === "not-ilike";
-                conditions.push({
-                    [field]: negated ? { $not: regex } : { $regex: regex }
-                });
-                continue;
-            }
+        return conditions;
+    }
 
-            const mongoOp = REBASE_TO_MONGO_OP[op];
+    /**
+     * One field, one operator, one value.
+     *
+     * Extracted so that `logical` groups translate through exactly this code.
+     * A group written as a second dialect is a group where `array-contains` or
+     * `ilike` quietly means something else than it does in `filter`, which is
+     * the kind of difference nobody finds until a query returns the wrong rows.
+     *
+     * Always returns a condition or throws: there is no operator this can be
+     * given that legitimately means "no condition".
+     */
+    private static buildCondition(
+        field: string,
+        op: WhereFilterOp,
+        value: any
+    ): Filter<Document> {
+        // Null-testing operators ignore their value.
+        if (op === "is-null") return { [field]: { $eq: null } };
+        if (op === "is-not-null") return { [field]: { $ne: null } };
 
-            if (!mongoOp) {
-                logger.warn(`Unsupported filter operator: ${op}`);
-                continue;
-            }
+        // Pattern matching → regular expressions.
+        if (op === "like" || op === "ilike" || op === "not-like" || op === "not-ilike") {
+            const caseInsensitive = op === "ilike" || op === "not-ilike";
+            const regex = likePatternToRegExp(value, caseInsensitive);
+            const negated = op === "not-like" || op === "not-ilike";
+            return { [field]: negated ? { $not: regex } : { $regex: regex } };
+        }
 
-            // Handle array-contains specially
-            if (op === "array-contains") {
-                conditions.push({
-                    [field]: { $elemMatch: { $eq: value } }
-                });
-            } else {
-                conditions.push({
-                    [field]: { [mongoOp]: value }
-                });
+        const mongoOp = REBASE_TO_MONGO_OP[op];
+
+        if (!mongoOp) {
+            // A filter that cannot be compiled must not compile to "no filter".
+            // Returning `undefined` here dropped the condition and widened the
+            // read — inside an `or(...)` group it drops a branch, which widens
+            // it further — and the only trace was a line in the server log
+            // behind a 200.
+            logger.warn(`Unsupported filter operator '${op}' on field '${field}'`);
+            throw ApiError.badRequest(
+                `Operator '${op}' is not supported on field '${field}' by the MongoDB driver.`,
+                "UNSUPPORTED_FILTER_OPERATOR",
+                { field, operator: op }
+            );
+        }
+
+        // Handle array-contains specially
+        if (op === "array-contains") {
+            return { [field]: { $elemMatch: { $eq: value } } };
+        }
+        return { [field]: { [mongoOp]: value } };
+    }
+
+    /**
+     * Translate an `or(...)` / `and(...)` group, nesting included.
+     *
+     * Returns `undefined` for a group with nothing in it. `$or: []` is an error
+     * in Mongo and `$and: []` matches every document, so neither is a
+     * defensible reading of "no conditions".
+     */
+    static buildLogicalConditions(logical: LogicalCondition | undefined): Filter<Document> | undefined {
+        if (!logical || !Array.isArray(logical.conditions)) return undefined;
+
+        const parts: Filter<Document>[] = [];
+        for (const entry of logical.conditions) {
+            if (!entry) continue;
+            if ("type" in entry && "conditions" in entry) {
+                const nested = this.buildLogicalConditions(entry as LogicalCondition);
+                if (nested) parts.push(nested);
+                continue;
             }
+            const { column, operator, value } = entry as FilterCondition;
+            parts.push(this.buildCondition(column, operator, value));
         }
 
-        return conditions;
+        // Through the same combiners the rest of this class uses, so a
+        // one-condition group reads as the bare condition — identical to how
+        // `filter` would have expressed it — rather than as `{ $and: [x] }`.
+        return logical.type === "or"
+            ? this.combineConditionsWithOr(parts)
+            : this.combineConditionsWithAnd(parts);
     }
 
     /**
@@ -191,6 +253,13 @@ export class MongoConditionBuilder {
      */
     static buildQuery<M extends Record<string, any>>(options: {
         filter?: FilterValues<Extract<keyof M, string>>;
+        /**
+         * An `or(...)`/`and(...)` group, AND-ed with `filter` and
+         * `searchString` — the three are independent, as `FindParams`
+         * documents. Absent here until now, so a group that reached this
+         * driver was dropped and the read ran unfiltered.
+         */
+        logical?: LogicalCondition;
         searchString?: string;
         properties?: CollectionConfig["properties"];
     }): Filter<Document> {
@@ -202,6 +271,9 @@ export class MongoConditionBuilder {
             conditions.push(...filterConditions);
         }
 
+        const logicalCondition = this.buildLogicalConditions(options.logical);
+        if (logicalCondition) conditions.push(logicalCondition);
+
         // Add search conditions
         if (options.searchString && options.properties) {
             const searchConditions = this.buildSearchConditions(

package/src/db/MongoDataService.ts

@@ -6,7 +6,7 @@
  */
 
 import { Db, ObjectId, Collection, Document, FindOptions, Filter } from "mongodb";
-import { FilterValues, DataRepository, CollectionConfig, EntityReference } from "@rebasepro/types";
+import { FilterValues, DataRepository, CollectionConfig, EntityReference, LogicalCondition } from "@rebasepro/types";
 import { MongoConditionBuilder } from "./MongoConditionBuilder";
 import { logger } from "@rebasepro/server";
 
@@ -193,9 +193,12 @@ export class MongoDataService implements DataRepository {
         collectionPath: string,
         options: {
             filter?: FilterValues<Extract<keyof M, string>>;
+            /** An `or(...)`/`and(...)` group, AND-ed with `filter`. */
+            logical?: LogicalCondition;
             orderBy?: string;
             order?: "desc" | "asc";
             limit?: number;
+            offset?: number;
             startAfter?: any;
             searchString?: string;
             databaseId?: string;
@@ -208,6 +211,7 @@ export class MongoDataService implements DataRepository {
         // Build query
         const query = options.rawQuery ?? MongoConditionBuilder.buildQuery<M>({
             filter: options.filter,
+            logical: options.logical,
             searchString: options.searchString,
             properties: options.collection?.properties ?? {}
         });
@@ -226,9 +230,14 @@ export class MongoDataService implements DataRepository {
             findOptions.limit = options.limit;
         }
 
-        // Apply pagination (skip-based for now, cursor-based would be better)
+        // Apply pagination. `offset` is the parameter the REST layer and the
+        // SDK both speak; it was absent here, so every `?offset=` reaching this
+        // driver was discarded and page three served page one. `startAfter`
+        // stays as the older spelling and wins when both are given.
         if (options.startAfter !== undefined) {
             findOptions.skip = Number(options.startAfter);
+        } else if (options.offset) {
+            findOptions.skip = options.offset;
         }
 
         const docs = await collection.find(query, findOptions).toArray();
@@ -265,21 +274,37 @@ export class MongoDataService implements DataRepository {
         collectionPath: string,
         options: {
             filter?: FilterValues<Extract<keyof M, string>>;
+            /** An `or(...)`/`and(...)` group, AND-ed with `filter`. */
+            logical?: LogicalCondition;
+            searchString?: string;
+            collection?: CollectionConfig;
             databaseId?: string;
             rawQuery?: Filter<Document>;
         } = {}
     ): Promise<number> {
         const collection = this.getCollection(collectionPath);
 
-        const query = options.rawQuery ?? (options.filter
-            ? MongoConditionBuilder.buildQuery<M>({ filter: options.filter })
-            : {});
+        // Every narrowing the listing applies has to apply here too, or the
+        // count describes a different query than the one it is reported
+        // against. `logical` and `searchString` were both missing.
+        const query = options.rawQuery ?? MongoConditionBuilder.buildQuery<M>({
+            filter: options.filter,
+            logical: options.logical,
+            searchString: options.searchString,
+            properties: options.collection?.properties ?? {}
+        });
 
         return collection.countDocuments(query);
     }
 
     /**
      * Save an row (create or update)
+     *
+     * Returns the **stored** document, not the values that were sent. A partial
+     * update sends only the fields that changed, and returning those was a
+     * partial row everywhere it went: the REST response, `afterSave`, the
+     * history entry a revert restores from, and the row pushed to realtime
+     * subscribers. Postgres returns the whole row here (`RETURNING *`).
      */
     async save<M extends Record<string, any>>(
         collectionPath: string,
@@ -291,7 +316,10 @@ export class MongoDataService implements DataRepository {
         const mongoValues = this.convertToMongoValues(values as Record<string, any>);
 
         if (id) {
-            // Update existing row
+            // Still an upsert: this is also the call that creates a row with a
+            // client-chosen id. Addressing an id that does not exist is caught
+            // above — the REST `PUT` 404s and the authenticated driver refuses
+            // — so the upsert only ever lands as the create it is meant to be.
             const objectId = this.toObjectId(id);
             await collection.updateOne(
                 { _id: objectId } as Filter<Document>,
@@ -299,10 +327,8 @@ export class MongoDataService implements DataRepository {
                 { upsert: true }
             );
 
-            return {
-                ...values,
-                id: id.toString()
-            };
+            return await this.readBack(collectionPath, objectId, { ...values,
+id: id.toString() });
         } else {
             // Create new row
             const newId = new ObjectId();
@@ -311,13 +337,24 @@ export class MongoDataService implements DataRepository {
                 ...mongoValues
             });
 
-            return {
-                ...values,
-                id: newId.toString()
-            };
+            return await this.readBack(collectionPath, newId, { ...values,
+id: newId.toString() });
         }
     }
 
+    /**
+     * Read the document back after a write, falling back to the caller's own
+     * values if it has already been removed by a concurrent delete.
+     */
+    private async readBack(
+        collectionPath: string,
+        objectId: ObjectId | string | number,
+        fallback: Record<string, unknown>
+    ): Promise<Record<string, unknown>> {
+        const doc = await this.getCollection(collectionPath).findOne({ _id: objectId } as Filter<Document>);
+        return doc ? this.documentToRow(doc) : fallback;
+    }
+
     /**
      * Delete an row by ID
      */