@rhino-dev/rhino-nestjs 4.8.1 → 4.9.0

package/dist/utils/argument-binder.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Binds the arguments a client sent in the bracket query form
+ * (`?scope[name][param]=value`, `?attributes[name][param]=value`) to the
+ * parameters a model declared.
+ *
+ * The algorithm is shared by named scopes and computed attributes so the two
+ * features cannot drift. The only thing that differs is `subject` — the noun
+ * every error message starts with ("Scope", "Computed attribute") — so each
+ * feature keeps its own wording while the behavior stays identical.
+ *
+ * This is a LEAF module: it imports `RhinoException` and nothing else. It must
+ * never import a service, or `rhino.config` would pull a service graph in
+ * through it (the `DEFAULT_MAX_SCOPES_PER_REQUEST` cycle).
+ *
+ * Nothing here decides whether a name may be used: callers MUST run the
+ * declared-check and the policy-check BEFORE binding, so an argument error can
+ * only ever be seen for a name the caller was already allowed to use.
+ */
+export interface BindArgumentsOptions {
+    /** Noun for error messages: 'Scope', 'Computed attribute'. */
+    subject: string;
+    /** The name the client used, echoed in every message. */
+    name: string;
+    /** Declared parameter names, in declared order. */
+    params?: string[];
+    /** Declared parameters the client may omit. */
+    optional?: string[];
+    /** Whatever the query string produced for the bracket key. */
+    raw: any;
+}
+/**
+ * Bind one name's raw value to a named-argument object.
+ *
+ * Unlike the PHP and Ruby binders — whose callables take positional arguments —
+ * the result here is keyed by parameter name, because that is how it reaches a
+ * scope (`ctx.args`) or a computed attribute (`ctx.args` / the third parameter).
+ * An omitted optional parameter is simply absent from the object.
+ */
+export declare function bindArguments(options: BindArgumentsOptions): Record<string, any>;
+/**
+ * Query-string values always arrive as strings; hand callables real booleans so
+ * a check cannot be fooled by the string "false". Applies to argument VALUES
+ * only, never to names.
+ */
+export declare function coerceArgument(value: any): any;

package/dist/utils/argument-binder.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bindArguments = bindArguments;
+exports.coerceArgument = coerceArgument;
+const rhino_exception_1 = require("../errors/rhino-exception");
+/**
+ * Bind one name's raw value to a named-argument object.
+ *
+ * Unlike the PHP and Ruby binders — whose callables take positional arguments —
+ * the result here is keyed by parameter name, because that is how it reaches a
+ * scope (`ctx.args`) or a computed attribute (`ctx.args` / the third parameter).
+ * An omitted optional parameter is simply absent from the object.
+ */
+function bindArguments(options) {
+    const { subject, name, raw } = options;
+    const params = Array.isArray(options.params) ? options.params : [];
+    const optional = Array.isArray(options.optional) ? options.optional : [];
+    let given;
+    if (raw == null || raw === '') {
+        // `?attributes[revenue]=` — no arguments. A name with required parameters
+        // still fails below, naming them.
+        given = {};
+    }
+    else if (Array.isArray(raw)) {
+        // A positional list (`?attributes[revenue][]=a`) names nothing. This also
+        // catches a repeated key, which `qs` turns into an array.
+        throw rhino_exception_1.RhinoException.forbidden(`${subject} '${name}' requires named parameters`);
+    }
+    else if (typeof raw !== 'object') {
+        if (params.length === 0) {
+            throw rhino_exception_1.RhinoException.forbidden(`${subject} '${name}' does not accept arguments`);
+        }
+        // A bare value binds to the single declared parameter. Two parameters can
+        // never be guessed at from one value.
+        if (params.length > 1) {
+            throw rhino_exception_1.RhinoException.forbidden(`${subject} '${name}' requires named parameters`);
+        }
+        given = { [params[0]]: raw };
+    }
+    else {
+        if (params.length === 0) {
+            throw rhino_exception_1.RhinoException.forbidden(`${subject} '${name}' does not accept arguments`);
+        }
+        given = { ...raw };
+    }
+    for (const key of Object.keys(given)) {
+        // Own-key lookup: `constructor` / `__proto__` must never resolve to a
+        // prototype member, whatever query parser fed us.
+        if (!params.includes(key)) {
+            throw rhino_exception_1.RhinoException.forbidden(`${subject} '${name}' does not accept parameter '${key}'`);
+        }
+        if (given[key] !== null && typeof given[key] === 'object') {
+            throw rhino_exception_1.RhinoException.forbidden(`${subject} '${name}' requires named parameters`);
+        }
+    }
+    const args = {};
+    for (const param of params) {
+        if (Object.prototype.hasOwnProperty.call(given, param)) {
+            args[param] = coerceArgument(given[param]);
+            continue;
+        }
+        if (!optional.includes(param)) {
+            throw rhino_exception_1.RhinoException.forbidden(`${subject} '${name}' requires parameter '${param}'`);
+        }
+    }
+    return args;
+}
+/**
+ * Query-string values always arrive as strings; hand callables real booleans so
+ * a check cannot be fooled by the string "false". Applies to argument VALUES
+ * only, never to names.
+ */
+function coerceArgument(value) {
+    if (typeof value !== 'string')
+        return value;
+    const lowered = value.toLowerCase();
+    if (lowered === 'true')
+        return true;
+    if (lowered === 'false')
+        return false;
+    return value;
+}
+//# sourceMappingURL=argument-binder.js.map

package/dist/utils/argument-binder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"argument-binder.js","sourceRoot":"","sources":["../../src/utils/argument-binder.ts"],"names":[],"mappings":";;AAyCA,sCAsDC;AAOD,wCAMC;AA5GD,+DAA2D;AAiC3D;;;;;;;GAOG;AACH,SAAgB,aAAa,CAAC,OAA6B;IACzD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAEzE,IAAI,KAA0B,CAAC;IAE/B,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC9B,0EAA0E;QAC1E,kCAAkC;QAClC,KAAK,GAAG,EAAE,CAAC;IACb,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,0EAA0E;QAC1E,0DAA0D;QAC1D,MAAM,gCAAc,CAAC,SAAS,CAAC,GAAG,OAAO,KAAK,IAAI,6BAA6B,CAAC,CAAC;IACnF,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,gCAAc,CAAC,SAAS,CAAC,GAAG,OAAO,KAAK,IAAI,6BAA6B,CAAC,CAAC;QACnF,CAAC;QACD,0EAA0E;QAC1E,sCAAsC;QACtC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,gCAAc,CAAC,SAAS,CAAC,GAAG,OAAO,KAAK,IAAI,6BAA6B,CAAC,CAAC;QACnF,CAAC;QACD,KAAK,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,gCAAc,CAAC,SAAS,CAAC,GAAG,OAAO,KAAK,IAAI,6BAA6B,CAAC,CAAC;QACnF,CAAC;QACD,KAAK,GAAG,EAAE,GAAI,GAA2B,EAAE,CAAC;IAC9C,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,sEAAsE;QACtE,kDAAkD;QAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,gCAAc,CAAC,SAAS,CAAC,GAAG,OAAO,KAAK,IAAI,gCAAgC,GAAG,GAAG,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,gCAAc,CAAC,SAAS,CAAC,GAAG,OAAO,KAAK,IAAI,6BAA6B,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAwB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,KAAK,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,gCAAc,CAAC,SAAS,CAAC,GAAG,OAAO,KAAK,IAAI,yBAAyB,KAAK,GAAG,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,KAAU;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/utils/computed-attribute-spec.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Declaration handling for computed attributes.
+ *
+ * A declared value is an EXTENDED SPEC if and only if it is a plain object
+ * carrying at least one of `params`, `optionalParams` or `using`. Anything else
+ * — a function, a scalar, an array, an object without those keys — is a LEGACY
+ * declaration and behaves exactly as it does today.
+ *
+ * Unlike named scopes, there is deliberately no string or array shorthand: a
+ * declared value that is not a function is a *literal* today, and adopting the
+ * scope shorthands would silently reinterpret shipped declarations.
+ *
+ * LEAF module: no service imports (see utils/argument-binder).
+ */
+export interface NormalizedComputedSpec {
+    params: string[];
+    optional: string[];
+    /** The callable, or the literal value for a legacy declaration. */
+    using: any;
+}
+/** Whether a declared value is an extended spec. */
+export declare function isComputedAttributeSpec(value: any): boolean;
+/** Normalize one declared value into `{ params, optional, using }`. */
+export declare function normalizeComputedAttribute(value: any): NormalizedComputedSpec;
+/**
+ * Look a declaration up by name with an OWN-key check, so `constructor` or
+ * `__proto__` can never resolve to a prototype member. Returns undefined when
+ * the name is not declared.
+ */
+export declare function lookupComputedAttribute(declared: Record<string, any> | undefined, name: string): NormalizedComputedSpec | undefined;
+/**
+ * Whether the attribute declares at least one parameter the client MUST supply.
+ * Such attributes are skipped — never 403'd — when no selection was made (a
+ * bare `GET /computed`) and when a direct serializer call passes no arguments.
+ */
+export declare function computedAttributeRequiresArguments(spec: NormalizedComputedSpec): boolean;

package/dist/utils/computed-attribute-spec.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isComputedAttributeSpec = isComputedAttributeSpec;
+exports.normalizeComputedAttribute = normalizeComputedAttribute;
+exports.lookupComputedAttribute = lookupComputedAttribute;
+exports.computedAttributeRequiresArguments = computedAttributeRequiresArguments;
+const SPEC_KEYS = ['params', 'optionalParams', 'using'];
+/** Whether a declared value is an extended spec. */
+function isComputedAttributeSpec(value) {
+    if (value == null || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    return SPEC_KEYS.some((key) => Object.prototype.hasOwnProperty.call(value, key));
+}
+/** Normalize one declared value into `{ params, optional, using }`. */
+function normalizeComputedAttribute(value) {
+    if (!isComputedAttributeSpec(value)) {
+        return { params: [], optional: [], using: value };
+    }
+    const params = Array.isArray(value.params) ? value.params.map(String) : [];
+    const optionalRaw = Array.isArray(value.optionalParams)
+        ? value.optionalParams.map(String)
+        : [];
+    return {
+        params,
+        // An `optionalParams` entry that is not a declared parameter is meaningless.
+        optional: optionalRaw.filter((name) => params.includes(name)),
+        using: value.using,
+    };
+}
+/**
+ * Look a declaration up by name with an OWN-key check, so `constructor` or
+ * `__proto__` can never resolve to a prototype member. Returns undefined when
+ * the name is not declared.
+ */
+function lookupComputedAttribute(declared, name) {
+    if (!declared || typeof name !== 'string')
+        return undefined;
+    if (!Object.prototype.hasOwnProperty.call(declared, name))
+        return undefined;
+    return normalizeComputedAttribute(declared[name]);
+}
+/**
+ * Whether the attribute declares at least one parameter the client MUST supply.
+ * Such attributes are skipped — never 403'd — when no selection was made (a
+ * bare `GET /computed`) and when a direct serializer call passes no arguments.
+ */
+function computedAttributeRequiresArguments(spec) {
+    return spec.params.some((param) => !spec.optional.includes(param));
+}
+//# sourceMappingURL=computed-attribute-spec.js.map

package/dist/utils/computed-attribute-spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"computed-attribute-spec.js","sourceRoot":"","sources":["../../src/utils/computed-attribute-spec.ts"],"names":[],"mappings":";;AAwBA,0DAGC;AAGD,gEAgBC;AAOD,0DAOC;AAOD,gFAEC;AAhDD,MAAM,SAAS,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAU,CAAC;AAEjE,oDAAoD;AACpD,SAAgB,uBAAuB,CAAC,KAAU;IAChD,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,uEAAuE;AACvE,SAAgB,0BAA0B,CAAC,KAAU;IACnD,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;QACrD,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAClC,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,MAAM;QACN,6EAA6E;QAC7E,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrE,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,uBAAuB,CACrC,QAAyC,EACzC,IAAY;IAEZ,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,OAAO,0BAA0B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAgB,kCAAkC,CAAC,IAA4B;IAC7E,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhino-dev/rhino-nestjs",
-  "version": "4.8.1",
+  "version": "4.9.0",
   "description": "Rhino for NestJS — auto-generated REST APIs from model definitions.",
   "author": "Bruno Cipolla <bruno@codalio.com>",
   "license": "MIT",