@rebasepro/server-postgres 0.11.1-canary.gfd39654 → 0.12.1-canary.g009ed95

package/src/services/FetchService.ts

@@ -1,12 +1,14 @@
-import { and, asc, count, desc, eq, getTableName, gt, lt, or, SQL, TableRelationalConfig, TablesRelationalConfig } from "drizzle-orm";
+import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, lt, or, SQL, TableRelationalConfig, TablesRelationalConfig } from "drizzle-orm";
 import { AnyPgColumn, PgTable } from "drizzle-orm/pg-core";
 import { CollectionConfig, FilterValues, ResolvedRelation, LogicalCondition, isManyToMany } from "@rebasepro/types";
 import type { VectorSearchParams } from "@rebasepro/types";
 import { resolveCollectionRelations, findRelation, createRelationRef, createRelationRefWithData } from "@rebasepro/common";
-import { DrizzleConditionBuilder } from "../utils/drizzle-conditions";
+import { generateForeignKeyName } from "@rebasepro/utils";
+import { DrizzleConditionBuilder, getUnknownFilterFieldsMode, type FilterCompilationOptions } from "../utils/drizzle-conditions";
 import {
     getCollectionByPath,
     getTableForCollection,
+    getPrimaryKeys,
     requirePrimaryKeys,
     deriveRowAddress,
     parseIdValues,
@@ -18,9 +20,9 @@ import { RelationService } from "./RelationService";
 import { RelationalQueryBuilder } from "drizzle-orm/pg-core/query-builders/query";
 import { DrizzleClient } from "../interfaces";
 import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
-import { toCmsRow, toRestRow, isJunctionRelation } from "./row-pipeline";
+import { toFlatRow, toRestRow, isJunctionRelation } from "./row-pipeline";
 import { isNestedPath, resolveNestedPath, type NestedPathHop } from "./nested-path";
-import { logger } from "@rebasepro/server";
+import { ApiError, logger } from "@rebasepro/server";
 
 /** Type-safe accessor for Drizzle's relational query API via dynamic table name */
 type DbQueryAccessor = Record<string, RelationalQueryBuilder<any, any>> | undefined;
@@ -45,6 +47,45 @@ export class FetchService {
         return query?.[tableName] as RelationalQueryBuilder<TablesRelationalConfig, TableRelationalConfig> | undefined;
     }
 
+    /**
+     * The context the condition builder needs to compile a filter key that is
+     * not a column name outright.
+     *
+     * Two such keys. An owning relation's key resolves through the collection's
+     * relations to its foreign-key column; a relation whose link lives on the
+     * target table or in a junction resolves to a correlated `EXISTS`, which
+     * needs the registry to reach that other table and this table's key column
+     * to correlate back.
+     *
+     * Looked up rather than passed: every read path already has the path, only
+     * some have the collection, and a path that names no registered collection
+     * (a nested/derived one) is not an error here — the builder simply falls
+     * back to guessing the default key shapes, and a relation filter it cannot
+     * compile stays unresolvable and so fails closed.
+     */
+    private filterContext(collectionPath: string, table: PgTable<any>): FilterCompilationOptions {
+        const collection = this.registry.getCollectionByPath(collectionPath) ?? undefined;
+        return {
+            collection,
+            registry: this.registry,
+            sourceIdColumn: collection ? this.resolveIdColumn(collection, table) : undefined
+        };
+    }
+
+    /**
+     * The table column this collection's rows are keyed by, or `undefined`.
+     *
+     * `getPrimaryKeys` rather than `requirePrimaryKeys`: a collection with no
+     * resolvable key is not an error on the filter path — it only means the
+     * relation filters that would correlate on it cannot be compiled, which
+     * the builder already handles by failing that field closed.
+     */
+    private resolveIdColumn(collection: CollectionConfig, table: PgTable<any>): AnyPgColumn | undefined {
+        const [idInfo] = getPrimaryKeys(collection, this.registry);
+        if (!idInfo) return undefined;
+        return table[idInfo.fieldName as keyof typeof table] as AnyPgColumn | undefined;
+    }
+
     /**
      * Build filter conditions from FilterValues
      * Delegates to DrizzleConditionBuilder.buildFilterConditions
@@ -54,7 +95,9 @@ export class FetchService {
         table: PgTable<any>,
         collectionPath: string
     ): SQL[] {
-        return DrizzleConditionBuilder.buildFilterConditions(filter, table, collectionPath);
+        return DrizzleConditionBuilder.buildFilterConditions(
+            filter, table, collectionPath, this.filterContext(collectionPath, table)
+        );
     }
 
     // =============================================================
@@ -64,20 +107,97 @@ export class FetchService {
     /**
      * Resolves the correct Drizzle column for sorting.
      * Automatically maps owning relation property keys to their underlying foreign key column.
+     *
+     * The relation's own `localKey` is the authority for that foreign key, not
+     * `<field>_id`. The default local key comes from `generateForeignKeyName`,
+     * which snake-cases *and singularises* — `userProfile` → `user_profile_id`,
+     * `users` → `user_id` — and an author can override it outright. A wrong
+     * guess resolves to nothing, the caller drops the `ORDER BY`, and the rows
+     * come back in whatever order Postgres pleases: paging over that repeats
+     * and skips rows rather than erroring. The guesses stay, last, for a
+     * caller that hands over no collection to resolve against.
      */
     private resolveOrderByField(
         table: PgTable<any>,
         orderBy: string,
         collection?: CollectionConfig
     ): AnyPgColumn | undefined {
-        let orderByField = table[orderBy as keyof typeof table] as AnyPgColumn;
-        if (!orderByField && collection) {
-            const property = collection.properties[orderBy];
-            if (property && property.type === "relation" && "relation" in property && property.resolvedRelation?.kind === "belongsTo") {
-                orderByField = table[`${orderBy}_id` as keyof typeof table] as AnyPgColumn;
-            }
+        const columnAt = (key: string): AnyPgColumn | undefined =>
+            (key in table ? table[key as keyof typeof table] as AnyPgColumn : undefined) || undefined;
+
+        const direct = columnAt(orderBy);
+        if (direct) return direct;
+
+        // Owning relation, resolved: the relation names its own local key.
+        const declaredRelation = collection ? resolveCollectionRelations(collection)[orderBy] : undefined;
+        if (declaredRelation?.kind === "belongsTo") {
+            const foreignKey = columnAt(declaredRelation.localKey);
+            if (foreignKey) return foreignKey;
+        }
+
+        // No collection in hand — the two shapes an owning relation's key takes
+        // by default (e.g. `project` → `project_id`, `userProfile` →
+        // `user_profile_id`).
+        for (const guess of [`${orderBy}_id`, generateForeignKeyName(orderBy)]) {
+            const foreignKey = columnAt(guess);
+            if (foreignKey) return foreignKey;
         }
-        return orderByField;
+
+        // Nothing resolved. Returning `undefined` is exactly what the docblock
+        // above describes: the caller drops the ORDER BY and hands back rows in
+        // whatever order Postgres pleases, while the requester believes they
+        // are sorted. `?orderBy=titel` answered 200 with unsorted data and no
+        // hint that the sort had been ignored.
+        //
+        // A *filter* naming a field that does not exist is already refused for
+        // precisely this reason — it "used to widen results silently". An
+        // unresolvable sort field is the same drift between a query and the
+        // schema, so it answers the same way and honours the same switch: one
+        // knob, because a deployment that wants the lenient behaviour wants it
+        // for both.
+        const collectionName = collection?.slug ?? collection?.name;
+        const onCollection = collectionName ? ` on collection '${collectionName}'` : "";
+
+        // A declared to-many relation is a different mistake from a typo, and
+        // saying "unknown field" about a field the collection plainly declares
+        // sends the reader looking for a spelling error that is not there.
+        // There is simply no single value per row to order by — `posts.tags` is
+        // a set — so no ORDER BY exists to write, with or without a typo.
+        if (declaredRelation && declaredRelation.kind !== "belongsTo") {
+            throw ApiError.badRequest(
+                `Cannot sort by '${orderBy}'${onCollection}: it is a to-many relation ` +
+                `(${declaredRelation.kind}), which has no single value per row to order by.`,
+                "ORDER_BY_FIELD_NOT_SORTABLE",
+                { field: orderBy, kind: declaredRelation.kind, ...(collectionName && { collection: collectionName }) }
+            );
+        }
+
+        if (getUnknownFilterFieldsMode() === "warn") {
+            logger.warn(
+                `Sorting by field '${orderBy}'${onCollection}, but it does not exist in the table — ` +
+                "the ORDER BY was dropped and these rows are unsorted."
+            );
+            return undefined;
+        }
+
+        let validFields: string[] = [];
+        try {
+            validFields = Object.keys(getTableColumns(table)).sort();
+        } catch {
+            // A table stand-in without Drizzle's column symbols — the message
+            // is worth less without the list, but not worth failing over.
+        }
+
+        throw ApiError.badRequest(
+            `Unknown orderBy field '${orderBy}'${onCollection}` +
+            (validFields.length > 0 ? `. Valid fields: ${validFields.join(", ")}` : ""),
+            "UNKNOWN_ORDER_BY_FIELD",
+            {
+                field: orderBy,
+                ...(collectionName && { collection: collectionName }),
+                ...(validFields.length > 0 && { validFields })
+            }
+        );
     }
 
     /**
@@ -85,7 +205,7 @@ export class FetchService {
      * Converts collection relations to a Drizzle-compatible `with` object.
      *
      * When `include` is provided, only those relations are loaded.
-     * When `include` is absent, ALL relations are loaded (CMS path).
+     * When `include` is absent, ALL relations are loaded (the admin path).
      *
      * Automatically detects many-to-many junction tables and nests
      * the target relation so actual row data is returned.
@@ -311,7 +431,7 @@ export class FetchService {
         }
 
         if (options.logical) {
-            const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, collectionPath);
+            const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, collectionPath, this.filterContext(collectionPath, table));
             if (logicalCondition) allConditions.push(logicalCondition);
         }
 
@@ -487,7 +607,7 @@ idColumn };
 
                 if (!row) return undefined;
 
-                const flatRow = toCmsRow(row, collection, this.registry);
+                const flatRow = toFlatRow(row, collection, this.registry);
 
                 // Post-fetch joinPath relations that Drizzle's `with` can't express
                 await this.resolveJoinPathRelations<M>(flatRow, collection, collectionPath, parsedId, databaseId);
@@ -614,7 +734,7 @@ idColumn };
                 const results = await qb.findMany(queryOpts as Parameters<NonNullable<typeof qb>["findMany"]>[0]);
 
                 const rows = (results as Record<string, unknown>[]).map(row =>
-                    toCmsRow(row, collection, this.registry)
+                    toFlatRow(row, collection, this.registry)
                 );
 
                 return rows;
@@ -656,7 +776,7 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
         }
 
         if (options.logical) {
-            const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, collectionPath);
+            const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, collectionPath, this.filterContext(collectionPath, table));
             if (logicalCondition) allConditions.push(logicalCondition);
         }
 
@@ -717,7 +837,7 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
     /**
      * Fallback path used when db.query is unavailable.
      *
-     * The primary path runs the results through `toCmsRow`, which maps
+     * The primary path runs the results through `toFlatRow`, which maps
      * relations from what drizzle already nested — no query per row. This one
      * has no nesting to read, so it resolves relations itself, in batches.
      *
@@ -874,6 +994,7 @@ relatedTo: hop });
         collectionPath: string,
         options: {
             filter?: FilterValues<Extract<keyof M, string>>;
+            logical?: LogicalCondition;
             searchString?: string;
             databaseId?: string;
         } = {}
@@ -905,6 +1026,13 @@ relatedTo: hop });
             if (filterConditions.length > 0) allConditions.push(...filterConditions);
         }
 
+        if (options.logical) {
+            const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(
+                options.logical, table, effectivePath, this.filterContext(effectivePath, table)
+            );
+            if (logicalCondition) allConditions.push(logicalCondition);
+        }
+
         if (allConditions.length > 0) {
             const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(allConditions);
             if (finalCondition) query = query.where(finalCondition);
@@ -975,6 +1103,8 @@ relatedTo: hop });
         collectionPath: string,
         options: {
             filter?: FilterValues<Extract<keyof M, string>>;
+            /** An `or(...)`/`and(...)` group, applied alongside `filter`. */
+            logical?: LogicalCondition;
             orderBy?: string;
             order?: "desc" | "asc";
             limit?: number;

package/src/services/PersistService.ts

@@ -1,7 +1,7 @@
 import { eq, and, sql, SQL } from "drizzle-orm";
 import { AnyPgColumn, PgTable } from "drizzle-orm/pg-core";
 // import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { CollectionConfig, Properties, ResolvedRelation, type ResolvedManyToMany, isManyToMany } from "@rebasepro/types";
+import { CollectionConfig, Properties, ResolvedRelation, type ResolvedManyToMany, isManyToMany, hasForeignKeyOnTarget } from "@rebasepro/types";
 import { getTableName, resolveCollectionRelations } from "@rebasepro/common";
 import { DrizzleConditionBuilder } from "../utils/drizzle-conditions";
 import {
@@ -240,16 +240,30 @@ export class PersistService {
                     throw ApiError.notFound(`No row "${id}" in "${collectionPath}" to update.`);
                 }
             } else {
-                // One-to-many create: stamp the parent's id onto the child's FK.
+                // One-to-many create: stamp the parent's key onto the child's FK.
                 const targetColumnName = this.resolveParentForeignKeyColumn(hop);
 
                 if (targetColumnName) {
-                    const parsedParentId = parentIdForWrite();
+                    // Not necessarily the id in the path: a link with a
+                    // `sourceKey` is pointed at a column on the parent row, and
+                    // stamping the id would create a child that belongs to
+                    // nobody — a row the read path would never return again.
+                    const parentKeyValue = hasForeignKeyOnTarget(hop.relation)
+                        ? await this.relationService.parentKeyValue(hop.parentCollection, hop.relation, hop.parentId)
+                        : parentIdForWrite();
+
+                    if (parentKeyValue === undefined) {
+                        throw ApiError.badRequest(
+                            `Cannot create under "${collectionPath}": the parent row has no value in ` +
+                            `\`sourceKey\`, so the new row has nothing to point at.`
+                        );
+                    }
+
                     const existingValue = (effectiveValues as Record<string, unknown>)[targetColumnName];
-                    if (existingValue !== undefined && existingValue !== null && existingValue !== parsedParentId) {
-                        logger.warn(`Overriding provided value '${existingValue}' for FK '${targetColumnName}' with path parent id '${parsedParentId}'.`);
+                    if (existingValue !== undefined && existingValue !== null && existingValue !== parentKeyValue) {
+                        logger.warn(`Overriding provided value '${existingValue}' for FK '${targetColumnName}' with path parent key '${parentKeyValue}'.`);
                     }
-                    (effectiveValues as Record<string, unknown>)[targetColumnName] = parsedParentId;
+                    (effectiveValues as Record<string, unknown>)[targetColumnName] = parentKeyValue;
                 }
             }
         }