@rebasepro/server-postgres 0.9.1-canary.eab7ae2 → 0.9.1-canary.ed943fa

package/dist/index.es.js

@@ -6524,8 +6524,27 @@ function coerceDeclaredNumbers(row, collection) {
 	return out;
 }
 /** Render one target row in the requested style. */
+/**
+* Drop every column the collection marked `excludeFromApi`.
+*
+* Password hashes and verification tokens have to be readable server-side but
+* must never reach a client — and "never" has to mean every exit from this
+* pipeline, including relation targets, or a secret leaks through whichever
+* path was overlooked. Keyed by both the property name and its column name,
+* since a row can arrive keyed either way depending on the caller.
+*/
+function stripExcluded(row, collection) {
+	const properties = collection.properties;
+	if (!properties) return row;
+	for (const [key, property] of Object.entries(properties)) {
+		if (!property?.excludeFromApi) continue;
+		delete row[key];
+		if (property.columnName) delete row[property.columnName];
+	}
+	return row;
+}
 function renderTarget(targetRow, targetCollection, style, registry) {
-	if (style === "inline") return coerceDeclaredNumbers({ ...targetRow }, targetCollection);
+	if (style === "inline") return stripExcluded(coerceDeclaredNumbers({ ...targetRow }, targetCollection), targetCollection);
 	const address = relationTargetAddress(targetRow, targetCollection, registry);
 	const path = targetCollection.slug;
 	return createRelationRefWithData(address, path, {
@@ -6567,7 +6586,7 @@ function toCmsRow(row, collection, registry) {
 			normalized[key] = relData.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item) : item, targetCollection, "ref", registry));
 		} else if (relation.cardinality === "one" && typeof relData === "object" && !Array.isArray(relData)) normalized[key] = renderTarget(relData, relation.target(), "ref", registry);
 	}
-	return normalized;
+	return stripExcluded(normalized, collection);
 }
 /**
 * The row REST serves: every column under its own name, with the value Postgres
@@ -6592,7 +6611,7 @@ function toRestRow(row, collection, registry) {
 		else if (relation && typeof value === "object" && value !== null) flat[key] = renderTarget(value, relation.target(), "inline", registry);
 		else flat[key] = coerceDeclaredNumber(value, collection.properties?.[key]);
 	}
-	return flat;
+	return stripExcluded(flat, collection);
 }
 //#endregion
 //#region src/services/FetchService.ts