@rebasepro/server 0.13.1-canary.gef9608c → 0.14.0

package/dist/{openapi-generator-D5xsfVJY.js → openapi-generator-DPKtUC9X.js}

@@ -1,8 +1,8 @@
 import { createRequire as __createRequire } from "module";
 import "process";
 __createRequire(import.meta.url);
-import { h as resolveCollectionRelations } from "./src-CKOZBpeJ.js";
-import "./src-_qQ3RNCK.js";
+import { _ as resolveCollectionRelations } from "./src-C7rkDGxA.js";
+import "./src-Cz9nMgUR.js";
 //#region ../types/src/types/relations.ts
 /** @group Models */
 function isToMany(relation) {
@@ -31,9 +31,10 @@ function generateOpenApiSpec(collections, options = {}) {
 			schema: {
 				type: "integer",
 				default: defaultLimit,
+				minimum: 1,
 				maximum: maxLimit
 			},
-			description: "Maximum number of records to return"
+			description: `Maximum number of records to return. Must be a whole number between 1 and ${maxLimit}; a larger one is rejected with 400 INVALID_LIMIT rather than trimmed, so a short page always means a short collection. Page past the ceiling with \`offset\`.`
 		},
 		{
 			name: "offset",
@@ -99,7 +100,41 @@ function generateOpenApiSpec(collections, options = {}) {
 			name: "searchString",
 			in: "query",
 			schema: { type: "string" },
-			description: "Full-text search query"
+			description: "Text search. By default a case-insensitive substring match OR-ed across the collection's top-level string properties. A collection declaring a `search` block gets ranked full-text matching over the fields it names, and rows carry a `_score`."
+		},
+		{
+			name: "vector_search",
+			in: "query",
+			schema: { type: "string" },
+			description: "Name of the `vector` property to run a nearest-neighbour search against. Requires `vector`.",
+			example: "embedding"
+		},
+		{
+			name: "vector",
+			in: "query",
+			schema: { type: "string" },
+			description: "The query embedding, as a JSON array of numbers. Its length must match the property's declared `dimensions`.",
+			example: "[0.12,-0.04,0.98]"
+		},
+		{
+			name: "vector_distance",
+			in: "query",
+			schema: {
+				type: "string",
+				enum: [
+					"cosine",
+					"l2",
+					"inner_product"
+				],
+				default: "cosine"
+			},
+			description: "Distance function used for ordering."
+		},
+		{
+			name: "vector_threshold",
+			in: "query",
+			schema: { type: "number" },
+			description: "Drop rows farther than this distance. Rows are returned closest-first with a `_distance` field."
 		}
 	];
 	const spec = {
@@ -155,27 +190,20 @@ function generateOpenApiSpec(collections, options = {}) {
 		tags: []
 	};
 	if (requireAuth) {
-		spec.components.securitySchemes = {
-			bearerAuth: {
-				type: "http",
-				scheme: "bearer",
-				bearerFormat: "JWT",
-				description: "JWT access token obtained from `POST /auth/login` or `POST /auth/register`. Can also be a static service key for server-to-server authentication."
-			},
-			queryToken: {
-				type: "apiKey",
-				in: "query",
-				name: "token",
-				description: "Alternative: pass the JWT or service key as a `token` query parameter."
-			}
-		};
-		spec.security = [{ bearerAuth: [] }, { queryToken: [] }];
+		spec.components.securitySchemes = { bearerAuth: {
+			type: "http",
+			scheme: "bearer",
+			bearerFormat: "JWT",
+			description: "JWT access token obtained from `POST /auth/login` or `POST /auth/register`. Can also be a static service key for server-to-server authentication."
+		} };
+		spec.security = [{ bearerAuth: [] }];
 	}
 	const paths = spec.paths;
 	const schemas = spec.components.schemas;
 	const tags = spec.tags;
+	const reservedParameterNames = new Set(listQueryParameters().map((p) => p.name));
 	for (const collection of collections || []) {
-		const schemaName = toPascalCase(collection.singularName || collection.name);
+		const schemaName = schemaNameFor(collection);
 		const slug = collection.slug;
 		tags.push({
 			name: collection.name,
@@ -183,13 +211,14 @@ function generateOpenApiSpec(collections, options = {}) {
 		});
 		schemas[schemaName] = buildCollectionSchema(collection);
 		schemas[`${schemaName}Input`] = buildCollectionInputSchema(collection);
+		schemas[`${schemaName}Update`] = buildCollectionUpdateSchema(collection);
 		const dataPath = `/data/${slug}`;
 		paths[dataPath] = {
 			get: {
 				tags: [collection.name],
 				summary: `List ${collection.name}`,
 				operationId: `list${schemaName}`,
-				parameters: [...listQueryParameters(), ...buildFilterParameters(collection)],
+				parameters: [...listQueryParameters(), ...buildFilterParameters(collection, reservedParameterNames)],
 				responses: {
 					200: {
 						description: "Paginated list of entities",
@@ -224,6 +253,159 @@ function generateOpenApiSpec(collections, options = {}) {
 				}
 			}
 		};
+		const idempotencyHeader = {
+			name: "Idempotency-Key",
+			in: "header",
+			required: false,
+			schema: { type: "string" },
+			description: "Names this write so a retry is recognised instead of repeated. Without it a client that lost the response cannot distinguish a replay from a second genuine batch, and the whole batch is written twice. A key names one request: re-send the identical request to replay its answer, and use a new key for a different one."
+		};
+		const bulkErrors = {
+			400: {
+				description: "Malformed body, an unknown field, or more rows than the per-batch limit",
+				content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } }
+			},
+			409: {
+				description: "A request with the same Idempotency-Key is still in flight. Retry it: the first attempt's result is replayed once it lands",
+				content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } }
+			},
+			422: {
+				description: "The Idempotency-Key was already used for a different request",
+				content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } }
+			},
+			...errorResponses(requireAuth)
+		};
+		paths[`/data/${slug}/bulk`] = {
+			post: {
+				tags: [collection.name],
+				summary: `Create many ${collection.name} in one transaction`,
+				description: "All-or-nothing: if any row is rejected none of them land, and the error names the offending index. Every row still runs callbacks, relations and row-level security. Capped server-side because one batch holds its locks for its whole duration.",
+				operationId: `createMany${schemaName}`,
+				parameters: [idempotencyHeader],
+				requestBody: {
+					required: true,
+					content: { "application/json": { schema: {
+						type: "object",
+						required: ["rows"],
+						properties: {
+							rows: {
+								type: "array",
+								items: { $ref: `#/components/schemas/${schemaName}Input` }
+							},
+							upsert: {
+								type: "boolean",
+								description: "Write each row as INSERT ... ON CONFLICT DO UPDATE on the primary key."
+							}
+						}
+					} } }
+				},
+				responses: {
+					200: {
+						description: "The written rows, in the order given",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: {
+								data: {
+									type: "array",
+									items: { $ref: `#/components/schemas/${schemaName}` }
+								},
+								meta: {
+									type: "object",
+									properties: { written: { type: "integer" } }
+								}
+							}
+						} } }
+					},
+					...bulkErrors
+				}
+			},
+			patch: {
+				tags: [collection.name],
+				summary: `Update many ${collection.name} in one transaction`,
+				description: "Each entry names its row and the fields to change. `{ id, data }` rather than flat rows carrying their own key, because on a table keyed on something other than `id` a flat row cannot say whether a column is the address or a value to write. An id matching no row fails the batch.",
+				operationId: `updateMany${schemaName}`,
+				parameters: [idempotencyHeader],
+				requestBody: {
+					required: true,
+					content: { "application/json": { schema: {
+						type: "object",
+						required: ["updates"],
+						properties: { updates: {
+							type: "array",
+							items: {
+								type: "object",
+								required: ["id", "data"],
+								properties: {
+									id: {
+										type: "string",
+										description: "The row to update"
+									},
+									data: { $ref: `#/components/schemas/${schemaName}Update` }
+								}
+							}
+						} }
+					} } }
+				},
+				responses: {
+					200: {
+						description: "The updated rows, in the order given",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: {
+								data: {
+									type: "array",
+									items: { $ref: `#/components/schemas/${schemaName}` }
+								},
+								meta: {
+									type: "object",
+									properties: { written: { type: "integer" } }
+								}
+							}
+						} } }
+					},
+					404: {
+						description: "One of the ids matches no row; nothing was written",
+						content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } }
+					},
+					...bulkErrors
+				}
+			}
+		};
+		paths[`/data/${slug}/bulk/delete`] = { post: {
+			tags: [collection.name],
+			summary: `Delete many ${collection.name} in one transaction`,
+			description: "A POST, not `DELETE /bulk` with a body. Bodies on DELETE are permitted but widely dropped by proxies and CDNs, and several generators ignore `requestBody` on a DELETE operation — a generated client would send the request with no ids at all. Takes ids rather than a filter: a mistyped condition that empties a table cannot be reviewed at the call site the way an explicit list can. `beforeDelete`/`afterDelete` fire per row.",
+			operationId: `deleteMany${schemaName}`,
+			parameters: [idempotencyHeader],
+			requestBody: {
+				required: true,
+				content: { "application/json": { schema: {
+					type: "object",
+					required: ["ids"],
+					properties: { ids: {
+						type: "array",
+						items: { oneOf: [{ type: "string" }, { type: "integer" }] }
+					} }
+				} } }
+			},
+			responses: {
+				200: {
+					description: "How many rows were deleted",
+					content: { "application/json": { schema: {
+						type: "object",
+						properties: { meta: {
+							type: "object",
+							properties: { deleted: { type: "integer" } }
+						} }
+					} } }
+				},
+				404: {
+					description: "One of the ids matches no row; nothing was deleted",
+					content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } }
+				},
+				...bulkErrors
+			}
+		} };
 		const entityPath = `/data/${slug}/{id}`;
 		paths[entityPath] = {
 			get: {
@@ -255,32 +437,11 @@ function generateOpenApiSpec(collections, options = {}) {
 					...errorResponses(requireAuth)
 				}
 			},
+			patch: updateOperation(collection, schemaName, requireAuth),
 			put: {
-				tags: [collection.name],
-				summary: `Update ${collection.singularName || collection.name}`,
-				operationId: `update${schemaName}`,
-				parameters: [{
-					name: "id",
-					in: "path",
-					required: true,
-					schema: { type: "string" },
-					description: "Entity ID"
-				}],
-				requestBody: {
-					required: true,
-					content: { "application/json": { schema: { $ref: `#/components/schemas/${schemaName}Input` } } }
-				},
-				responses: {
-					200: {
-						description: "Updated entity",
-						content: { "application/json": { schema: { $ref: `#/components/schemas/${schemaName}` } } }
-					},
-					404: {
-						description: "Entity not found",
-						content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } }
-					},
-					...errorResponses(requireAuth)
-				}
+				...updateOperation(collection, schemaName, requireAuth),
+				operationId: `update${schemaName}ViaPut`,
+				deprecated: true
 			},
 			delete: {
 				tags: [collection.name],
@@ -306,12 +467,11 @@ function generateOpenApiSpec(collections, options = {}) {
 	}
 	for (const collection of collections || []) {
 		const slug = collection.slug;
-		const schemaName = toPascalCase(collection.singularName || collection.name);
+		const schemaName = schemaNameFor(collection);
 		const relations = Object.values(resolveCollectionRelations(collection)).filter(isToMany);
 		for (const relation of relations) {
 			const relationName = relation.relationName;
-			const targetCollection = relation.target();
-			const targetSchema = toPascalCase(targetCollection.singularName || targetCollection.name);
+			const targetSchema = schemaNameFor(relation.target());
 			const subPath = `/data/${slug}/{parentId}/${relationName}`;
 			paths[subPath] = { get: {
 				tags: [collection.name],
@@ -346,8 +506,36 @@ function generateOpenApiSpec(collections, options = {}) {
 	return spec;
 }
 /**
+* Is this property part of the shape the document may describe?
+*
+* Two exclusions, and both are the document telling the truth about what the
+* server does:
+*
+* - a `relation` property is virtual: the row carries the owning side's foreign
+*   key column, never the property itself, so it is not a field of any payload.
+*   (The FK column *is* readable, writable and filterable and is still absent
+*   from every schema here — a separate gap, not this rule.)
+* - `excludeFromApi` is a server-side guarantee that the column "is stripped
+*   from every row the API serves, for every caller, including admins and
+*   service keys" — `stripExcluded` in the row pipeline enforces it. A schema
+*   that lists such a column describes a field that is never present, and it
+*   describes it to everyone: `/docs` is mounted on the app, not on the data
+*   router, so it carries none of the auth middleware `{basePath}/data` does.
+*   Every project scaffolded by `rebase init` published its `users`
+*   collection's `passwordHash` and `emailVerificationToken` this way.
+*
+* Written as one predicate rather than three `continue`s because it kept being
+* fixed in one loop at a time: this is the same rule the SDK generator applies
+* to its `Row` type (`packages/codegen/src/generate-types.ts`).
+*/
+function isDocumentedProperty(property) {
+	return property.type !== "relation" && !property.excludeFromApi;
+}
+/**
 * Build the component schema for a collection (output / read shape).
-* All fields are included (including relation foreign keys).
+*
+* Every declared property except the ones {@link isDocumentedProperty} rules
+* out.
 */
 function buildCollectionSchema(collection) {
 	const properties = { id: {
@@ -356,7 +544,7 @@ function buildCollectionSchema(collection) {
 	} };
 	const required = ["id"];
 	for (const [key, property] of Object.entries(collection.properties)) {
-		if (property.type === "relation") continue;
+		if (!isDocumentedProperty(property)) continue;
 		properties[key] = convertPropertyToSchema(property);
 		if (property.validation?.required) required.push(key);
 	}
@@ -367,13 +555,71 @@ function buildCollectionSchema(collection) {
 	};
 }
 /**
+* The PATCH/PUT operation for `/data/{slug}/{id}`.
+*
+* Split out because both verbs serve it and they must not drift: the update
+* body is a **partial**, and describing it with the create schema was the bug
+* this replaces. `<Name>Input` marks every `validation.required` property as
+* required — correct for POST, wrong for an update, where omitting a field
+* means "leave it alone" rather than "I forgot it". A client generated from
+* that spec demanded fields the server does not, and a spec-validating gateway
+* would have rejected partial updates the server accepts.
+*/
+function updateOperation(collection, schemaName, requireAuth) {
+	return {
+		tags: [collection.name],
+		summary: `Update ${collection.singularName || collection.name}`,
+		description: "Partial update: only the properties present in the body are written; the rest are left unchanged.",
+		operationId: `update${schemaName}`,
+		parameters: [{
+			name: "id",
+			in: "path",
+			required: true,
+			schema: { type: "string" },
+			description: "Entity ID"
+		}],
+		requestBody: {
+			required: true,
+			content: { "application/json": { schema: { $ref: `#/components/schemas/${schemaName}Update` } } }
+		},
+		responses: {
+			200: {
+				description: "Updated entity",
+				content: { "application/json": { schema: { $ref: `#/components/schemas/${schemaName}` } } }
+			},
+			404: {
+				description: "Entity not found",
+				content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } }
+			},
+			...errorResponses(requireAuth)
+		}
+	};
+}
+/**
+* The update body: the create schema with `required` dropped.
+*
+* Derived rather than rebuilt so the two cannot describe different columns —
+* the only difference between creating and updating is which fields you must
+* supply, and that is exactly the one thing removed here.
+*/
+function buildCollectionUpdateSchema(collection) {
+	const { required: _required, ...rest } = buildCollectionInputSchema(collection);
+	return rest;
+}
+/**
 * Build an input schema (for POST/PUT) — excludes auto-generated fields.
+*
+* `excludeFromApi` columns are left out too, though a write naming one is still
+* accepted: a create the document invites and whose result it then cannot show
+* is not a round trip anyone can verify, and naming the column here discloses
+* it just as loudly as the read schema does — this document is served
+* unauthenticated.
 */
 function buildCollectionInputSchema(collection) {
 	const properties = {};
 	const required = [];
 	for (const [key, property] of Object.entries(collection.properties)) {
-		if (property.type === "relation") continue;
+		if (!isDocumentedProperty(property)) continue;
 		if (property.type === "date" && property.autoValue) continue;
 		if ("isId" in property && property.isId && property.isId !== "manual" && property.isId !== true) continue;
 		properties[key] = convertPropertyToSchema(property);
@@ -534,11 +780,18 @@ function resolveEnumValues(enumDef) {
 /**
 * Build PostgREST-style filter parameters for a collection.
 * These are additional query parameters like `?status=eq.active&price=gte.100`.
+*
+* `excludeFromApi` columns are not offered: the server does filter on them, and
+* that is exactly the problem — a filter on a column no response can contain
+* answers questions about the value one row at a time, which is a worse
+* disclosure than the column name alone.
 */
-function buildFilterParameters(collection) {
+function buildFilterParameters(collection, reservedNames = /* @__PURE__ */ new Set()) {
 	const params = [];
 	for (const [key, property] of Object.entries(collection.properties)) {
-		if (property.type === "relation" || property.type === "map" || property.type === "array" || property.type === "geopoint") continue;
+		if (!isDocumentedProperty(property)) continue;
+		if (property.type === "map" || property.type === "array" || property.type === "geopoint") continue;
+		if (reservedNames.has(key)) continue;
 		params.push({
 			name: key,
 			in: "query",
@@ -583,6 +836,24 @@ function withIndefiniteArticle(noun) {
 	return `${/^[aeiou]/i.test(noun) ? "an" : "a"} ${noun}`;
 }
 /**
+* The component-schema name for a collection — and the stem of every
+* `operationId` and `$ref` that mentions it.
+*
+* `toPascalCase` keeps ASCII letters and digits and nothing else, so a name
+* written in a script that has none of them — a Cyrillic or Japanese
+* `singularName`, which the docs' six locales make ordinary rather than exotic
+* — reduced to the empty string. The schema was then stored under `""` and
+* every reference to it read `#/components/schemas/`, an unresolvable pointer:
+* Swagger UI renders the model empty and a strict generator fails outright. So
+* fall through the names until one survives, and keep a constant as the floor.
+*
+* Two collections whose names PascalCase identically still share one component;
+* that needs a disambiguation rule, not a fallback.
+*/
+function schemaNameFor(collection) {
+	return toPascalCase(collection.singularName || "") || toPascalCase(collection.name || "") || toPascalCase(collection.slug || "") || "Collection";
+}
+/**
 * Convert a string to PascalCase for schema names.
 */
 function toPascalCase(str) {
@@ -591,4 +862,4 @@ function toPascalCase(str) {
 //#endregion
 export { generateOpenApiSpec };
 
-//# sourceMappingURL=openapi-generator-D5xsfVJY.js.map
+//# sourceMappingURL=openapi-generator-DPKtUC9X.js.map