@simtlix/simfinity-js 2.6.1 → 2.6.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simtlix/simfinity-js",
-  "version": "2.6.1",
+  "version": "2.6.3",
   "description": "",
   "main": "src/index.js",
   "type": "module",

package/src/index.js

@@ -28,6 +28,7 @@ const GraphQLJSON = new GraphQLScalarType({
       case Kind.BOOLEAN:
         return ast.value;
       case Kind.INT:
+        return parseInt(ast.value, 10);
       case Kind.FLOAT:
         return parseFloat(ast.value);
       case Kind.OBJECT: {
@@ -300,6 +301,21 @@ const buildRelationLookup = ({
   unwind: { $unwind: { path: `$${alias}`, preserveNullAndEmptyArrays: true } },
 });
 
+const escapeRegex = (s) => String(s).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+const PATH_SEGMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+const assertValidFilterPath = (path) => {
+  if (typeof path !== 'string' || path.length === 0) {
+    throw new SimfinityError('Filter path must be a non-empty string', 'INVALID_FILTER_PATH', 400);
+  }
+  for (const segment of path.split('.')) {
+    if (!PATH_SEGMENT_RE.test(segment)) {
+      throw new SimfinityError(`Invalid filter path segment: "${segment}"`, 'INVALID_FILTER_PATH', 400);
+    }
+  }
+};
+
 const OP_TO_MONGO = {
   LT: (v) => ({ $lt: v }),
   GT: (v) => ({ $gt: v }),
@@ -307,7 +323,7 @@ const OP_TO_MONGO = {
   GTE: (v) => ({ $gte: v }),
   NE: (v) => ({ $ne: v }),
   BTW: (v) => ({ $gte: v[0], $lte: v[1] }),
-  LIKE: (v) => ({ $regex: `.*${v}.*` }),
+  LIKE: (v) => ({ $regex: `.*${escapeRegex(v)}.*` }),
 };
 
 const AGG_OP_TO_MONGO = {
@@ -379,7 +395,13 @@ function createValidatedScalar(name, description, baseScalarType, validate) {
 const createTypeWithExcludedField = (inputNamePrefix, originalType, fieldToExclude) => {
   const originalFields = originalType.getFields();
   const newFields = Object.fromEntries(
-    Object.entries(originalFields).filter(([fieldName]) => fieldName !== fieldToExclude),
+    Object.entries(originalFields)
+      .filter(([fieldName]) => fieldName !== fieldToExclude)
+      .map(([fieldName, field]) => [fieldName, {
+        type: field.type,
+        description: field.description,
+        defaultValue: field.defaultValue,
+      }]),
   );
 
   return new GraphQLInputObjectType({
@@ -446,9 +468,9 @@ const buildInputType = (gqltype) => {
 
     if (!fieldEntry.extensions || !fieldEntry.extensions.readOnly) {
       const hasStateMachine = !!typesDict.types[gqltype.name].stateMachine;
-      const doesEstateFieldExistButIsManagedByStateMachine = !!(fieldEntryName === 'state' && hasStateMachine);
+      const stateFieldManagedByStateMachine = !!(fieldEntryName === 'state' && hasStateMachine);
 
-      if (!doesEstateFieldExistButIsManagedByStateMachine) {
+      if (!stateFieldManagedByStateMachine) {
         if (fieldEntry.type instanceof GraphQLScalarType
           || fieldEntry.type instanceof GraphQLEnumType
           || isNonNullOfType(fieldEntry.type, GraphQLScalarType)
@@ -484,8 +506,8 @@ const buildInputType = (gqltype) => {
           if (fieldEntry.type.ofType === gqltype) {
             selfReferenceCollections[fieldEntryName] = fieldEntry;
           } else {
-            const listInputTypeForAdd = graphQLListInputType(typesDict, fieldEntry, fieldEntryName, gqltype.name + 'A', fieldEntry.extensions?.relation?.connectionField);
-            const listInputTypeForUpdate = graphQLListInputType(typesDictForUpdate, fieldEntry, fieldEntryName, gqltype.name +'U', fieldEntry.extensions?.relation?.connectionField);
+            const listInputTypeForAdd = graphQLListInputType(typesDict, fieldEntry, fieldEntryName, `${gqltype.name}A`, fieldEntry.extensions?.relation?.connectionField);
+            const listInputTypeForUpdate = graphQLListInputType(typesDictForUpdate, fieldEntry, fieldEntryName, `${gqltype.name}U`, fieldEntry.extensions?.relation?.connectionField);
             if (listInputTypeForAdd && listInputTypeForUpdate) {
               fieldArg.type = listInputTypeForAdd;
               fieldArgForUpdate.type = listInputTypeForUpdate;
@@ -557,29 +579,35 @@ const getInputType = (type) => typesDict.types[type.name].inputType;
 export { getInputType };
 
 const buildPendingInputTypes = (waitingForInputType) => {
-  const stillWaitingInputType = {};
-  let isThereAtLeastOneWaiting = false;
-
-  Object.entries(waitingForInputType).forEach(([key, value]) => {
-    const { gqltype } = value;
+  let pending = waitingForInputType;
+  let previousPendingCount = Object.keys(pending).length + 1;
+
+  while (Object.keys(pending).length > 0) {
+    const currentCount = Object.keys(pending).length;
+    if (currentCount >= previousPendingCount) {
+      const unresolved = Object.keys(pending).join(', ');
+      throw new SimfinityError(
+        `Could not build input types for: ${unresolved}. Check for circular or misconfigured relations.`,
+        'INPUT_TYPE_UNRESOLVED',
+        500,
+      );
+    }
+    previousPendingCount = currentCount;
 
-    if (!typesDict.types[gqltype.name].inputType) {
-      const buildInputTypeResult = buildInputType(gqltype);
+    const stillWaiting = {};
+    for (const [key, value] of Object.entries(pending)) {
+      const { gqltype } = value;
+      if (typesDict.types[gqltype.name].inputType) continue;
 
-      if (buildInputTypeResult && buildInputTypeResult.inputTypeBody
-        && buildInputTypeResult.inputTypeBodyForUpdate) {
-        typesDict.types[gqltype.name].inputType = buildInputTypeResult.inputTypeBody;
-        typesDictForUpdate.types[gqltype.name].inputType = buildInputTypeResult
-          .inputTypeBodyForUpdate;
+      const result = buildInputType(gqltype);
+      if (result && result.inputTypeBody && result.inputTypeBodyForUpdate) {
+        typesDict.types[gqltype.name].inputType = result.inputTypeBody;
+        typesDictForUpdate.types[gqltype.name].inputType = result.inputTypeBodyForUpdate;
       } else {
-        stillWaitingInputType[key] = value;
-        isThereAtLeastOneWaiting = true;
+        stillWaiting[key] = value;
       }
     }
-  });
-
-  if (isThereAtLeastOneWaiting) {
-    buildPendingInputTypes(stillWaitingInputType);
+    pending = stillWaiting;
   }
 };
 
@@ -622,9 +650,11 @@ const materializeModel = async (args, gqltype, linkToParent, operation, session)
               null, operation, session)).modelArgs;
           }
         } else {
-          modelArgs[fieldEntry.name] = new mongoose.Types
-            .ObjectId(args[fieldEntryName].id);
-          console.warn(`Configuration issue: Field ${fieldEntryName} does not define extensions.relation`);
+          throw new SimfinityError(
+            `Field ${gqltype.name}.${fieldEntryName} is an object type but does not define extensions.relation`,
+            'MISSING_RELATION_EXTENSION',
+            500,
+          );
         }
       } else if (fieldEntry.type instanceof GraphQLList) {
         const { ofType } = fieldEntry.type;
@@ -668,34 +698,38 @@ const materializeModel = async (args, gqltype, linkToParent, operation, session)
 const MAX_TRANSIENT_RETRIES = 5;
 
 const withTransaction = async (session, body) => {
+  const ownsSession = !session;
   const mySession = session || await mongoose.startSession();
-  for (let attempt = 0; attempt <= MAX_TRANSIENT_RETRIES; attempt++) {
-    await mySession.startTransaction();
-    try {
-      const result = await body(mySession);
-      await mySession.commitTransaction();
-      mySession.endSession();
-      return result;
-    } catch (error) {
-      await mySession.abortTransaction();
-      const isTransient = error.errorLabels?.includes('TransientTransactionError');
-      if (isTransient && attempt < MAX_TRANSIENT_RETRIES) {
-        continue;
+  try {
+    for (let attempt = 0; attempt <= MAX_TRANSIENT_RETRIES; attempt++) {
+      await mySession.startTransaction();
+      try {
+        const result = await body(mySession);
+        await mySession.commitTransaction();
+        return result;
+      } catch (error) {
+        await mySession.abortTransaction();
+        const isTransient = error.errorLabels?.includes('TransientTransactionError');
+        if (isTransient && attempt < MAX_TRANSIENT_RETRIES) {
+          continue;
+        }
+        throw error;
       }
+    }
+    throw new SimfinityError('Transaction exceeded retry limit', 'TRANSACTION_RETRY_EXCEEDED', 500);
+  } finally {
+    if (ownsSession) {
       mySession.endSession();
-      throw error;
     }
   }
-  mySession.endSession();
-  throw new SimfinityError('Transaction exceeded retry limit', 'TRANSACTION_RETRY_EXCEEDED', 500);
 };
 
-const executeRegisteredMutation = (args, callback, session) => withTransaction(
+const executeRegisteredMutation = (args, callback, context, session) => withTransaction(
   session,
-  (mySession) => callback(args, mySession),
+  (mySession) => callback(args, mySession, context),
 );
 
-const iterateonCollectionFields = async (materializedModel, gqltype, objectId, session, context) => {
+const iterateOnCollectionFields = async (materializedModel, gqltype, objectId, session, context) => {
   for (const [collectionFieldKey, collectionField] of Object.entries(materializedModel.collectionFields)) {
     if (collectionField.added) {
       await executeItemFunction(gqltype, collectionFieldKey, objectId, session,
@@ -741,7 +775,7 @@ const onUpdateSubject = async (Model, gqltype, controller, args, session, linkTo
 
   if (embeddedFieldNames.length > 0) {
     const projection = Object.fromEntries(embeddedFieldNames.map((name) => [name, 1]));
-    const currentObject = await Model.findById(objectId, projection).lean();
+    const currentObject = await Model.findById(objectId, projection).session(session).lean();
     if (currentObject) {
       for (const fieldEntryName of embeddedFieldNames) {
         const oldObjectData = currentObject[fieldEntryName];
@@ -775,7 +809,7 @@ const onUpdateSubject = async (Model, gqltype, controller, args, session, linkTo
   ).session(session);
 
   if (materializedModel.collectionFields) {
-    await iterateonCollectionFields(materializedModel, gqltype, objectId, session, context);
+    await iterateOnCollectionFields(materializedModel, gqltype, objectId, session, context);
   }
 
   if (controller && controller.onUpdated) {
@@ -786,7 +820,7 @@ const onUpdateSubject = async (Model, gqltype, controller, args, session, linkTo
 };
 
 const onStateChanged = async (Model, gqltype, controller, args, session, actionField, context) => {
-  const storedModel = await Model.findById(args.id);
+  const storedModel = await Model.findById(args.id).session(session);
   if (!storedModel) {
     throw new SimfinityError(`${gqltype.name} ${args.id} is not valid`, 'NOT_VALID_ID', 404);
   }
@@ -822,10 +856,9 @@ const onSaveObject = async (Model, gqltype, controller, args, session, linkToPar
   result = result.toObject();
 
   if (materializedModel.collectionFields) {
-    await iterateonCollectionFields(materializedModel, gqltype, newObject._id, session, context);
+    await iterateOnCollectionFields(materializedModel, gqltype, newObject._id, session, context);
   }
 
-  
   if (controller && controller.onSaved) {
     await controller.onSaved(result, args, session, context);
   }
@@ -898,27 +931,25 @@ const executeItemFunction = async (gqltype, collectionField, objectId, session,
 const shouldNotBeIncludedInSchema = (includedTypes,
   type) => includedTypes && !includedTypes.includes(type);
 
-const excecuteMiddleware = (context) => {
+const executeMiddleware = async (context) => {
   const buildNext = (middlewaresParam) => {
     if (!middlewaresParam) {
-      return () => {};
+      return async () => {};
     }
-    const next = () => {
+    return async () => {
       const middleware = middlewaresParam[0];
       if (middleware) {
-        middleware(context, buildNext(middlewaresParam.slice(1)));
+        await middleware(context, buildNext(middlewaresParam.slice(1)));
       }
     };
-    return next;
   };
 
-  const middleware = buildNext(middlewares);
-  middleware();
+  await buildNext(middlewares)();
 };
 
 const executeScope = async (params) => {
   const { type, args, operation, context } = params;
-  
+
   if (!type || !type.gqltype || !type.gqltype.extensions) {
     return null;
   }
@@ -960,7 +991,7 @@ const buildMutation = (name, includedMutationTypes, includedCustomMutations) =>
               context,
             };
 
-            excecuteMiddleware(params);
+            await executeMiddleware(params);
             return executeOperation(type.model, type.gqltype, type.controller,
               args.input, operations.SAVE, null, null, context);
           },
@@ -977,7 +1008,7 @@ const buildMutation = (name, includedMutationTypes, includedCustomMutations) =>
               context,
             };
 
-            excecuteMiddleware(params);
+            await executeMiddleware(params);
             return executeOperation(type.model, type.gqltype, type.controller,
               args.id, operations.DELETE, null, null, context);
           },
@@ -1002,7 +1033,7 @@ const buildMutation = (name, includedMutationTypes, includedCustomMutations) =>
               context,
             };
 
-            excecuteMiddleware(params);
+            await executeMiddleware(params);
             return executeOperation(type.model, type.gqltype, type.controller,
               args.input, operations.UPDATE, null, null, context);
           },
@@ -1024,7 +1055,7 @@ const buildMutation = (name, includedMutationTypes, includedCustomMutations) =>
                     context,
                   };
 
-                  excecuteMiddleware(params);
+                  await executeMiddleware(params);
                   return executeOperation(type.model, type.gqltype, type.controller,
                     args.input, operations.STATE_CHANGED, actionField, null, context);
                 },
@@ -1051,8 +1082,8 @@ const buildMutation = (name, includedMutationTypes, includedCustomMutations) =>
             entry,
             context,
           };
-          excecuteMiddleware(params);
-          return executeRegisteredMutation(args.input, registeredMutation.callback);
+          await executeMiddleware(params);
+          return executeRegisteredMutation(args.input, registeredMutation.callback, context);
         },
       };
     }
@@ -1128,10 +1159,10 @@ const generateSchemaDefinition = (gqlType) => {
 
 const findObjectIdFields = (schemaDefinition, parentPath = '') => {
   const objectIdFields = [];
-  
+
   for (const [fieldName, fieldDefinition] of Object.entries(schemaDefinition)) {
     const currentPath = parentPath ? `${parentPath}.${fieldName}` : fieldName;
-    
+
     if (fieldDefinition === mongoose.Schema.Types.ObjectId) {
       objectIdFields.push(currentPath);
     } else if (typeof fieldDefinition === 'object' && fieldDefinition !== null) {
@@ -1147,7 +1178,7 @@ const findObjectIdFields = (schemaDefinition, parentPath = '') => {
       }
     }
   }
-  
+
   return objectIdFields;
 };
 
@@ -1172,7 +1203,12 @@ const generateModel = (gqlType, onModelCreated, { createCollection = true } = {}
   return model;
 };
 
-const coerceIdArray = (value) => value.map((element) => new mongoose.Types.ObjectId(element));
+const coerceIdArray = (value) => value.map((element) => {
+  if (element === null || element === undefined) {
+    throw new SimfinityError('ID value cannot be null in collection filter', 'INVALID_FILTER_VALUE', 400);
+  }
+  return new mongoose.Types.ObjectId(element);
+});
 
 const buildMatchesClause = (fieldname, operator, value) => {
   const isIdField = fieldname.endsWith('_id');
@@ -1181,11 +1217,12 @@ const buildMatchesClause = (fieldname, operator, value) => {
   if (op === 'EQ') {
     return { [fieldname]: isIdField ? new mongoose.Types.ObjectId(value) : value };
   }
-  if (op === 'IN') {
-    return { [fieldname]: { $in: value && isIdField ? coerceIdArray(value) : value } };
-  }
-  if (op === 'NIN') {
-    return { [fieldname]: { $nin: value && isIdField ? coerceIdArray(value) : value } };
+  if (op === 'IN' || op === 'NIN') {
+    if (!Array.isArray(value)) {
+      throw new SimfinityError(`${op} requires an array value for ${fieldname}`, 'INVALID_FILTER_VALUE', 400);
+    }
+    const coerced = isIdField ? coerceIdArray(value) : value;
+    return { [fieldname]: { [op === 'IN' ? '$in' : '$nin']: coerced } };
   }
   const builder = OP_TO_MONGO[op];
   return builder ? { [fieldname]: builder(value) } : {};
@@ -1223,9 +1260,14 @@ const buildAggregationsForSort = (filterField, qlField, fieldName) => {
     return aggregateClauses;
   }
 
+  if (!Array.isArray(filterField?.terms) || filterField.terms.length === 0) {
+    return aggregateClauses;
+  }
+
   const resolvedFieldType = unwrapNonNull(fieldType);
 
   filterField.terms.forEach((term) => {
+    assertValidFilterPath(term.path);
     if (qlField.extensions?.relation && !qlField.extensions.relation.embedded
       && !aggregateClauses[fieldName]) {
       aggregateClauses[fieldName] = topLevelRelationLookup(qlField, resolvedFieldType, fieldName);
@@ -1267,6 +1309,10 @@ const buildQueryTerms = async (filterField, qlField, fieldName) => {
   const matchesClauses = {};
   const fieldType = unwrapListAndNonNull(qlField.type);
 
+  if (filterField == null) {
+    return { aggregateClauses, matchesClauses };
+  }
+
   if (fieldType instanceof GraphQLScalarType
     || isNonNullOfType(fieldType, GraphQLScalarType)
     || fieldType instanceof GraphQLEnumType
@@ -1280,9 +1326,14 @@ const buildQueryTerms = async (filterField, qlField, fieldName) => {
     return { aggregateClauses, matchesClauses };
   }
 
+  if (!Array.isArray(filterField.terms) || filterField.terms.length === 0) {
+    return { aggregateClauses, matchesClauses };
+  }
+
   const resolvedFieldType = unwrapNonNull(fieldType);
 
   filterField.terms.forEach((term) => {
+    assertValidFilterPath(term.path);
     if (qlField.extensions?.relation && !qlField.extensions.relation.embedded
       && !aggregateClauses[fieldName]) {
       aggregateClauses[fieldName] = topLevelRelationLookup(qlField, resolvedFieldType, fieldName);
@@ -1467,6 +1518,7 @@ const buildSortClause = (sortTerms, gqltype, aggregateClauses, aggregationsInclu
   const fields = gqltype.getFields();
 
   sortTerms.forEach((sort) => {
+    assertValidFilterPath(sort.field);
     let fixedSortField = sort.field;
     if (sort.field.indexOf('.') >= 0) {
       const sortParts = sort.field.split('.');
@@ -1506,19 +1558,19 @@ const buildQuery = async (input, gqltype, isCount) => {
     aggregateClauses.push(buildSortClause(input.sort.terms, gqltype, aggregateClauses, aggregationsIncluded));
   }
 
-  let limitClause = { $limit: 100 };
   let skipClause = { $skip: 0 };
+  let limitClause = { $limit: 100 };
   if (input.pagination?.page && input.pagination?.size) {
-    const skip = input.pagination.size * (input.pagination.page - 1);
-    limitClause = { $limit: input.pagination.size + skip };
-    skipClause = { $skip: skip };
+    skipClause = { $skip: input.pagination.size * (input.pagination.page - 1) };
+    limitClause = { $limit: input.pagination.size };
   }
-  aggregateClauses.push(limitClause, skipClause);
+  aggregateClauses.push(skipClause, limitClause);
 
   return aggregateClauses;
 };
 
 const buildFieldPath = (gqltype, fieldPath) => {
+  assertValidFilterPath(fieldPath);
   const pathParts = fieldPath.split('.');
   const lookupPairs = [];
   let currentPath = '';
@@ -1617,7 +1669,7 @@ const buildAggregationQuery = async (input, gqltype, aggregationExpression) => {
 
   if (input.pagination?.page && input.pagination?.size) {
     const skip = input.pagination.size * (input.pagination.page - 1);
-    aggregateClauses.push({ $limit: input.pagination.size + skip }, { $skip: skip });
+    aggregateClauses.push({ $skip: skip }, { $limit: input.pagination.size });
   }
 
   return aggregateClauses;
@@ -1643,7 +1695,7 @@ const buildRootQuery = (name, includedTypes) => {
             const params = {
               type, args, operation: 'get_by_id', context,
             };
-            excecuteMiddleware(params);
+            await executeMiddleware(params);
 
             const hasScope = type.gqltype.extensions?.scope?.get_by_id;
             if (!hasScope) {
@@ -1677,7 +1729,7 @@ const buildRootQuery = (name, includedTypes) => {
               operation: 'find',
               context,
             };
-            excecuteMiddleware(params);
+            await executeMiddleware(params);
             await executeScope(params);
             const aggregateClauses = await buildQuery(args, type.gqltype);
             const wantsCount = !!(args.pagination && args.pagination.count);
@@ -1712,7 +1764,7 @@ const buildRootQuery = (name, includedTypes) => {
               operation: 'aggregate',
               context,
             };
-            excecuteMiddleware(params);
+            await executeMiddleware(params);
             await executeScope(params);
             const aggregateClauses = await buildAggregationQuery(args, type.gqltype, args.aggregation);
             const result = await type.model.aggregate(aggregateClauses);

package/.claude/worktrees/agitated-kepler/.claude/settings.local.json

@@ -1,23 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(npm test:*)",
-      "Bash(/usr/local/bin/node ./node_modules/.bin/vitest run)",
-      "Bash(/opt/homebrew/bin/npx vitest:*)",
-      "Bash(PATH=\"/opt/homebrew/bin:$PATH\" npm test)",
-      "Bash(PATH=\"/opt/homebrew/bin:$PATH\" npm run lint)",
-      "Bash(PATH=\"/opt/homebrew/bin:$PATH\" npx eslint tests/and-or-filters.test.js src/index.js)",
-      "Bash(PATH=\"/opt/homebrew/bin:$PATH\" npx eslint tests/and-or-filters.test.js)",
-      "Bash(PATH=\"/opt/homebrew/bin:$PATH\" git status)",
-      "Bash(PATH=\"/opt/homebrew/bin:$PATH\" git diff --stat)",
-      "Bash(PATH=\"/opt/homebrew/bin:$PATH\" git log --oneline -5)",
-      "Bash(PATH=\"/opt/homebrew/bin:$PATH\" git diff README.md src/index.js)",
-      "Bash(PATH=\"/opt/homebrew/bin:$PATH\" git add src/index.js tests/and-or-filters.test.js README.md)",
-      "Bash(PATH=\"/opt/homebrew/bin:$PATH\" git checkout master)",
-      "Bash(git merge:*)",
-      "Bash(curl -s http://localhost:3000/graphql -H \"Content-Type: application/json\" -d '{\"\"\"\"query\"\"\"\":\"\"\"\"{ __schema { queryType { fields { name args { name type { name kind ofType { name } } } } } } }\"\"\"\"}')",
-      "Bash(curl -s http://localhost:3000/graphql -H \"Content-Type: application/json\" -d '{\"\"\"\"query\"\"\"\":\"\"\"\"{ barbershops\\(pagination: { page: 1, size: 3 }\\) { id name state averageRating reviewCount } }\"\"\"\"}')",
-      "Bash(PATH=\"/opt/homebrew/bin:$PATH\" node -p \"JSON.stringify\\(JSON.parse\\(require\\(''''fs''''\\).readFileSync\\(''''/dev/stdin'''',''''utf8''''\\)\\),null,2\\)\")"
-    ]
-  }
-}