@teleporthq/teleport-plugin-next-data-source 0.43.68 → 0.43.70

package/__tests__/browser-row-policy.test.ts

@@ -261,7 +261,6 @@ describe('blog posts: a visitor reads the published posts, never an author email
       { filters },
       { sorts: JSON.stringify([{ field: 'author_email', order: 'asc' }]) },
       { sortBy: 'author_email' },
-      { query: 'ana', queryColumns: JSON.stringify(['author_email']) },
     ]) {
       const refused = await posts.run({ query })
       expect(refused.status).toBe(403)
@@ -273,6 +272,27 @@ describe('blog posts: a visitor reads the published posts, never an author email
     expect((await posts.run({ query: { filters }, session: { role: 'admin' } })).status).toBe(200)
   })
 
+  it('drops the hidden column from the search columns the blog list sends', async () => {
+    // The generated blog list names every text column of the table, the
+    // author's email among them, on every read — with or without a search term.
+    const queryColumns = JSON.stringify(['title', 'author_email'])
+    for (const query of [{ queryColumns }, { query: 'ana', queryColumns }]) {
+      const guest = await posts.run({ query })
+      expect(guest.status).toBe(200)
+      expect(mainQuery(guest)).not.toContain('"author_email"')
+      expect(JSON.stringify(guest.body.data)).not.toContain('ana@example.com')
+      expect((await posts.run({ handler: 'getCount', query })).status).toBe(200)
+    }
+    const searched = await posts.run({ query: { query: 'ana', queryColumns } })
+    expect(mainQuery(searched)).toContain('"title"::text ILIKE')
+
+    const admin = await posts.run({
+      query: { query: 'ana', queryColumns },
+      session: { role: 'admin' },
+    })
+    expect(mainQuery(admin)).toContain('"author_email"::text ILIKE')
+  })
+
   it('searches a visitor only through the columns it is served', async () => {
     const guest = await posts.run({ query: { query: 'ana' } })
     expect(guest.status).toBe(200)

package/__tests__/rest-list-edge-cases.test.ts

@@ -0,0 +1,211 @@
+import * as types from '@babel/types'
+import generator from '@babel/generator'
+import { ComponentStructure } from '@teleporthq/teleport-types'
+import { createNextArrayMapperPaginationPlugin } from '../src/pagination-plugin'
+import { extractItemsPath } from '../src/items-path'
+import { generateRESTAPIFetcher } from '../src/fetchers/rest-api'
+import { buildAccumulatingResponseHandler, getInfiniteScrollVars } from '../src/infinite-scroll'
+import { DEFAULT_REPEATER_PER_PAGE, resolveRepeaterPerPage } from '../src/repeater-page-size'
+import {
+  makeUidlNode,
+  makeWidgetComponentChunk,
+  type RepeaterOptions,
+} from './_helpers/pagination-widget-fixture'
+
+/**
+ * A list bound to a REST API payload, in the shapes the editor lets a builder
+ * bind: a list wrapped in an object, a list inside an item of a list, an
+ * appending list, a list whose page size was never set.
+ */
+
+const runHandler = async (
+  code: string,
+  query: Record<string, unknown>,
+  body: unknown
+): Promise<{ data?: unknown; url?: string }> => {
+  let requestedURL: string | undefined
+  const fetchImpl = (url: string) => {
+    requestedURL = url
+    return Promise.resolve({
+      ok: true,
+      status: 200,
+      statusText: 'OK',
+      json: () => Promise.resolve(JSON.parse(JSON.stringify(body))),
+    })
+  }
+  const handler = new Function(
+    'fetch',
+    `${code
+      .replace(/^import\s+.*?$/gm, '')
+      .replace('export default async function handler', 'async function handler')}
+    return handler`
+  )(fetchImpl)
+
+  let payload: { data?: unknown } = {}
+  const res = {
+    status: () => res,
+    json: (data: { data?: unknown }) => {
+      payload = data
+      return res
+    },
+  }
+  await handler({ query, body: undefined }, res)
+  return { data: payload.data, url: requestedURL }
+}
+
+const rows = Array.from({ length: 25 }, (_, index) => ({ id: index + 1 }))
+const restFetcher = (config: Record<string, unknown> = {}) =>
+  generateRESTAPIFetcher({ url: 'https://api.test/items', method: 'GET', ...config })
+
+describe('a list inside an item of a list (`source?.[0]?.items`)', () => {
+  it('reads the index as a path segment', () => {
+    expect(extractItemsPath('ds?.[0]?.items || []', 'ds', 'rest-api')).toEqual(['0', 'items'])
+    expect(extractItemsPath('ds?.data?.[2]?.["my list"]', 'ds', 'rest-api')).toEqual([
+      'data',
+      '2',
+      'my list',
+    ])
+  })
+
+  it('pages that inner list and keeps the list around it', async () => {
+    const { data } = await runHandler(
+      restFetcher(),
+      { page: '2', perPage: '10', itemsPath: JSON.stringify(['0', 'items']) },
+      [{ items: rows }, { items: [] }]
+    )
+
+    const payload = data as Array<{ items: Array<{ id: number }> }>
+    expect(payload).toHaveLength(2)
+    expect(payload[0].items.map((row) => row.id)).toEqual([11, 12, 13, 14, 15, 16, 17, 18, 19, 20])
+    expect(payload[1].items).toEqual([])
+  })
+
+  it('leaves the payload alone when the index is past the end of the list', async () => {
+    const { data } = await runHandler(
+      restFetcher(),
+      { limit: '10', itemsPath: JSON.stringify(['3', 'items']) },
+      [{ items: rows }]
+    )
+
+    expect((data as Array<{ items: unknown[] }>)[0].items).toHaveLength(25)
+  })
+})
+
+describe('an appending (infinite scroll) list over a wrapped payload', () => {
+  const runAccumulator = (itemsPath: string[] | undefined) => {
+    const vars = getInfiniteScrollVars(0)
+    const source = generator(buildAccumulatingResponseHandler(vars, 2, itemsPath)).code
+    const accumRef = { current: { sig: '', pages: {} } }
+    const hasMore: boolean[] = []
+    return (params: Record<string, unknown>, data: unknown) =>
+      new Function(vars.accumRefVar, vars.setHasMoreFlagVar, 'params', `return (${source})`)(
+        accumRef,
+        (value: boolean) => hasMore.push(value),
+        params
+      )({ data }) as unknown
+  }
+
+  it('reads the rows at the path and puts every page back there', () => {
+    const accumulate = runAccumulator(['data', 'items'])
+
+    accumulate({ page: 1 }, { data: { items: [{ id: 1 }, { id: 2 }] }, total: 3 })
+    const second = accumulate({ page: 2 }, { data: { items: [{ id: 3 }] }, total: 3 }) as {
+      data: { items: Array<{ id: number }> }
+      total: number
+    }
+
+    expect(second.data.items.map((row) => row.id)).toEqual([1, 2, 3])
+    expect(second.total).toBe(3)
+  })
+
+  it('still accumulates a payload that IS the list', () => {
+    const accumulate = runAccumulator(undefined)
+
+    accumulate({ page: 1 }, [{ id: 1 }, { id: 2 }])
+    expect(accumulate({ page: 2 }, [{ id: 3 }])).toEqual([{ id: 1 }, { id: 2 }, { id: 3 }])
+  })
+
+  it('is wired for a list bound inside a REST payload', async () => {
+    const code = await runPaginationPlugin({ infiniteScroll: true }, 'items?.templates || []')
+
+    expect(code).toContain('const rows = response?.data?.templates || []')
+    expect(code).toContain('...response?.data,')
+    expect(code).toContain('templates: Object.keys(ds_0_accumRef.current.pages)')
+  })
+})
+
+describe('a paginated list with no page size', () => {
+  it('pages by the editor default instead of failing the project', async () => {
+    const code = await runPaginationPlugin({}, 'items?.templates || []', (node) => {
+      delete node.content.nodes.success.content.perPage
+    })
+
+    expect(code).toContain(`perPage: ${DEFAULT_REPEATER_PER_PAGE}`)
+  })
+
+  it.each([
+    [undefined, DEFAULT_REPEATER_PER_PAGE],
+    [null, DEFAULT_REPEATER_PER_PAGE],
+    ['', DEFAULT_REPEATER_PER_PAGE],
+    [0, DEFAULT_REPEATER_PER_PAGE],
+    [-5, DEFAULT_REPEATER_PER_PAGE],
+    [NaN, DEFAULT_REPEATER_PER_PAGE],
+    ['abc', DEFAULT_REPEATER_PER_PAGE],
+    [12, 12],
+    ['24', 24],
+    [7.9, 7],
+  ])('reads %p as %p', (perPage, expected) => {
+    expect(resolveRepeaterPerPage(perPage)).toBe(expected)
+  })
+})
+
+describe('the query params configured on a REST API data source', () => {
+  it('are sent with every request, as the editor sends them', async () => {
+    const { url } = await runHandler(
+      restFetcher({ queryParams: { per_page: '10', category: 'a b' } }),
+      {},
+      rows
+    )
+
+    expect(url).toBe('https://api.test/items?per_page=10&category=a+b')
+  })
+
+  it('join the params already in the URL', async () => {
+    const { url } = await runHandler(
+      generateRESTAPIFetcher({
+        url: 'https://api.test/items?sort=new',
+        method: 'GET',
+        queryParams: { page: '2' },
+      }),
+      {},
+      rows
+    )
+
+    expect(url).toBe('https://api.test/items?sort=new&page=2')
+  })
+
+  it('leave the URL exactly as configured when there are none', () => {
+    expect(restFetcher({ queryParams: {} })).toBe(restFetcher())
+    expect(restFetcher()).toContain('const url = "https://api.test/items"')
+  })
+})
+
+async function runPaginationPlugin(
+  repeater: RepeaterOptions,
+  source: string,
+  adjust: (node: ReturnType<typeof makeUidlNode>) => void = () => undefined
+): Promise<string> {
+  const node = makeUidlNode(repeater)
+  node.content.resourceDefinition.dataSourceType = 'rest-api'
+  node.content.nodes.success.content.source = source
+  adjust(node)
+  const chunk = makeWidgetComponentChunk({ controls: ['previous', 'next'] })
+  const structure: ComponentStructure = {
+    uidl: { name: 'TestComponent', node },
+    chunks: [chunk],
+    dependencies: {},
+    options: { dataSources: {}, extractedResources: {} },
+  } as never
+  await createNextArrayMapperPaginationPlugin()(structure)
+  return generator(chunk.content as types.Node).code
+}

package/__tests__/shared-resource-prefetch.test.ts

@@ -0,0 +1,111 @@
+import * as types from '@babel/types'
+import generator from '@babel/generator'
+import { UIDLDataSourceItemNode } from '@teleporthq/teleport-types'
+import { extractDataSourceIntoGetStaticProps } from '../src/utils'
+import {
+  createComponentChunk,
+  createDataSourceNode,
+  createJavaScriptDataSource,
+  createMockJSXElementWithResourceDef,
+} from './mocks'
+
+/**
+ * Every provider bound to one table carries the SAME resource id
+ * (`TQ_<source><table>`) — the editor derives it from the source and the table
+ * only — and its own params. A list showing 10 rows and a text bound to the
+ * same source therefore asked for one prefetch, and the second provider
+ * rendered the first one's rows (`initialData` skips its own first fetch).
+ */
+
+const DS_ID = 'ds-js'
+const RESOURCE_ID = 'TQ_dsjsdata'
+
+const nodeWithParams = (params: Record<string, unknown>): UIDLDataSourceItemNode => {
+  const node = createDataSourceNode(DS_ID, 'data', 'javascript')
+  ;(node.content as { resource: unknown }).resource = { id: RESOURCE_ID, params }
+  return node
+}
+
+const providerWithLimit = (limit?: number): types.JSXElement => {
+  const element = createMockJSXElementWithResourceDef(DS_ID, 'data', 'javascript')
+  if (limit !== undefined) {
+    element.openingElement.attributes.push(
+      types.jsxAttribute(
+        types.jsxIdentifier('params'),
+        types.jsxExpressionContainer(
+          types.objectExpression([
+            types.objectProperty(types.stringLiteral('limit'), types.numericLiteral(limit)),
+          ])
+        )
+      )
+    )
+  }
+  return element
+}
+
+const initialDataOf = (element: types.JSXElement): string => {
+  const attr = element.openingElement.attributes.find(
+    (attribute) => (attribute as types.JSXAttribute).name?.name === 'initialData'
+  ) as types.JSXAttribute | undefined
+  return attr ? generator(attr.value as types.Node).code : ''
+}
+
+const prefetch = (
+  providers: Array<{ node: UIDLDataSourceItemNode }>,
+  elements: types.JSXElement[]
+) => {
+  const componentChunk = createComponentChunk()
+  componentChunk.content = types.jsxFragment(
+    types.jsxOpeningFragment(),
+    types.jsxClosingFragment(),
+    elements
+  )
+  let getStaticPropsChunk = null
+  for (const { node } of providers) {
+    const result = extractDataSourceIntoGetStaticProps(
+      node,
+      { [DS_ID]: createJavaScriptDataSource(DS_ID) },
+      componentChunk,
+      getStaticPropsChunk,
+      [],
+      {},
+      {}
+    )
+    getStaticPropsChunk = result.chunk
+  }
+  return generator(getStaticPropsChunk.content as types.Node).code.replace(/\s+/g, ' ')
+}
+
+describe('getStaticProps prefetch of providers sharing one resource', () => {
+  it('gives providers with different params their own prefetch', () => {
+    const limitedList = providerWithLimit(10)
+    const text = providerWithLimit()
+
+    const code = prefetch(
+      [
+        { node: nodeWithParams({ limit: { type: 'static', content: 10 } }) },
+        { node: nodeWithParams({}) },
+      ],
+      [limitedList, text]
+    )
+
+    expect(initialDataOf(limitedList)).toBe('{props.data_dsjsdata}')
+    expect(initialDataOf(text)).toBe('{props.data_dsjsdata_2}')
+    expect(code).toContain('fetchData({ "limit": 10 })')
+    expect(code).toContain('fetchData({})')
+  })
+
+  it('keeps ONE prefetch for providers with the same params', () => {
+    const first = providerWithLimit()
+    const second = providerWithLimit()
+
+    const code = prefetch(
+      [{ node: nodeWithParams({}) }, { node: nodeWithParams({}) }],
+      [first, second]
+    )
+
+    expect(initialDataOf(first)).toBe('{props.data_dsjsdata}')
+    expect(initialDataOf(second)).toBe('{props.data_dsjsdata}')
+    expect(code.match(/fetchData\(/g)).toHaveLength(1)
+  })
+})

package/dist/cjs/fetchers/rest-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rest-api.d.ts","sourceRoot":"","sources":["../../../src/fetchers/rest-api.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,qBAAqB,WACxB,OAAO,MAAM,EAAE,OAAO,CAAC,KAC9B;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CA0BpC,CAAA;AA6CD,eAAO,MAAM,sBAAsB,WAAY,OAAO,MAAM,EAAE,OAAO,CAAC,KAAG,MAyOxE,CAAA"}
+{"version":3,"file":"rest-api.d.ts","sourceRoot":"","sources":["../../../src/fetchers/rest-api.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,qBAAqB,WACxB,OAAO,MAAM,EAAE,OAAO,CAAC,KAC9B;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CA0BpC,CAAA;AAuED,eAAO,MAAM,sBAAsB,WAAY,OAAO,MAAM,EAAE,OAAO,CAAC,KAAG,MAyOxE,CAAA"}

package/dist/cjs/fetchers/rest-api.js

@@ -47,6 +47,30 @@ var generateAuthCode = function (authorization) {
             return '';
     }
 };
+/**
+ * The URL with the data source's query params appended, built the way the
+ * editor's own fetch builds it (`RestApiService.constructUrl` in the
+ * data-fetcher worker: `searchParams.append` per param).
+ *
+ * The params used to be dropped here, so the published site asked the API a
+ * different question than the editor did — `?per_page=10` or `?category=x`
+ * configured on the source, and every row of the unfiltered response came back.
+ */
+var buildRequestURL = function (url, queryParams) {
+    var params = Object.entries(queryParams || {}).filter(function (_a) {
+        var key = _a[0], value = _a[1];
+        return key.trim() !== '' && typeof value === 'string';
+    });
+    if (!url || params.length === 0) {
+        return url;
+    }
+    var requestURL = new URL(url);
+    params.forEach(function (_a) {
+        var key = _a[0], value = _a[1];
+        return requestURL.searchParams.append(key, value);
+    });
+    return requestURL.toString();
+};
 var generateRESTAPIFetcher = function (config) {
     var restConfig = config;
     var authCode = generateAuthCode(restConfig.authorization || {});
@@ -54,7 +78,7 @@ var generateRESTAPIFetcher = function (config) {
     // uncached data source keeps generating byte-identical output.
     var cacheTTLSeconds = (0, rest_api_response_cache_1.resolveRESTAPICacheTTLSeconds)(restConfig.cache);
     var cached = cacheTTLSeconds !== undefined;
-    return "import fetch from 'node-fetch'\n\n".concat((0, utils_1.generateSafeJSONParseCode)(), "\n\n").concat((0, utils_1.generateDateFormatterCode)(), "\n\n").concat((0, utils_1.generateSortFilterHelperCode)(), "\n\n").concat((0, utils_1.generateFilterTreeHelpersCode)(), "\n\n").concat((0, utils_1.generateCollectionPathHelperCode)()).concat(cached ? "\n\n".concat((0, rest_api_response_cache_1.generateRESTAPIResponseCacheCode)(cacheTTLSeconds)) : '', "\n\nexport default async function handler(req, res) {\n  try {\n    const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, sorts, offset, collectionPath, itemsPath } = req.query\n    \n    const url = ").concat(JSON.stringify(restConfig.url), "\n    const method = ").concat(JSON.stringify(restConfig.method || 'GET'), "\n    \n    const headers = ").concat(JSON.stringify(restConfig.headers || {}), "\n    ").concat(authCode, "\n    \n    const options = {\n      method,\n      headers\n    }\n    \n    ").concat(restConfig.method === 'POST' || restConfig.method === 'PUT' || restConfig.method === 'PATCH'
+    return "import fetch from 'node-fetch'\n\n".concat((0, utils_1.generateSafeJSONParseCode)(), "\n\n").concat((0, utils_1.generateDateFormatterCode)(), "\n\n").concat((0, utils_1.generateSortFilterHelperCode)(), "\n\n").concat((0, utils_1.generateFilterTreeHelpersCode)(), "\n\n").concat((0, utils_1.generateCollectionPathHelperCode)()).concat(cached ? "\n\n".concat((0, rest_api_response_cache_1.generateRESTAPIResponseCacheCode)(cacheTTLSeconds)) : '', "\n\nexport default async function handler(req, res) {\n  try {\n    const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, sorts, offset, collectionPath, itemsPath } = req.query\n    \n    const url = ").concat(JSON.stringify(buildRequestURL(restConfig.url, restConfig.queryParams)), "\n    const method = ").concat(JSON.stringify(restConfig.method || 'GET'), "\n    \n    const headers = ").concat(JSON.stringify(restConfig.headers || {}), "\n    ").concat(authCode, "\n    \n    const options = {\n      method,\n      headers\n    }\n    \n    ").concat(restConfig.method === 'POST' || restConfig.method === 'PUT' || restConfig.method === 'PATCH'
         ? "\n    if (req.body) {\n      options.body = ".concat(restConfig.bodyType === 'json' || !restConfig.bodyType
             ? 'JSON.stringify(req.body)'
             : 'req.body', "\n    }").concat(

package/dist/cjs/fetchers/rest-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"rest-api.js","sourceRoot":"","sources":["../../../src/fetchers/rest-api.ts"],"names":[],"mappings":";;;AAAA,kCAMiB;AACjB,2EAIwC;AAEjC,IAAM,qBAAqB,GAAG,UACnC,MAA+B;IAE/B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;QACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAA;KAClE;IAED,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC7E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAA;KACpD;IAED,IAAI;QACF,IAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;YAC/C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAA;SACxE;KACF;IAAC,WAAM;QACN,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAA;KACvD;IAED,IAAI,MAAM,CAAC,MAAM,EAAE;QACjB,IAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC9D,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE;YAC5F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAA;SACxD;KACF;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC,CAAA;AA5BY,QAAA,qBAAqB,yBA4BjC;AAaD,IAAM,gBAAgB,GAAG,UAAC,aAA4B;IACpD,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,IAAI,KAAK,MAAM,EAAE;QACnD,OAAO,EAAE,CAAA;KACV;IAEO,IAAA,IAAI,GAAkB,aAAa,KAA/B,EAAE,WAAW,GAAK,aAAa,YAAlB,CAAkB;IAE3C,QAAQ,IAAI,EAAE;QACZ,KAAK,SAAS;YACZ,OAAO,6CAAsC,WAAW,CAAC,MAAM,MAAG,CAAA;QACpE,KAAK,cAAc,CAAC;QACpB,KAAK,YAAY;YACf,OAAO,6CAAsC,WAAW,CAAC,KAAK,MAAG,CAAA;QACnE,KAAK,YAAY;YACf,OAAO,6DAAsD,WAAW,CAAC,QAAQ,cAAI,WAAW,CAAC,QAAQ,0BAAuB,CAAA;QAClI,KAAK,QAAQ;YACX,OAAO,6CAAsC,WAAW,CAAC,YAAY,MAAG,CAAA;QAC1E;YACE,OAAO,EAAE,CAAA;KACZ;AACH,CAAC,CAAA;AAYM,IAAM,sBAAsB,GAAG,UAAC,MAA+B;IACpE,IAAM,UAAU,GAAG,MAAuB,CAAA;IAC1C,IAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC,CAAA;IACjE,sEAAsE;IACtE,+DAA+D;IAC/D,IAAM,eAAe,GAAG,IAAA,uDAA6B,EAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACvE,IAAM,MAAM,GAAG,eAAe,KAAK,SAAS,CAAA;IAE5C,OAAO,4CAEP,IAAA,iCAAyB,GAAE,iBAE3B,IAAA,iCAAyB,GAAE,iBAE3B,IAAA,oCAA4B,GAAE,iBAE9B,IAAA,qCAA6B,GAAE,iBAE/B,IAAA,wCAAgC,GAAE,SAChC,MAAM,CAAC,CAAC,CAAC,cAAO,IAAA,0DAAgC,EAAC,eAAe,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,8OAO1D,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,kCAC3B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,yCAEzC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,mBACxD,QAAQ,2FAQR,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO;QAC1F,CAAC,CAAC,sDAGF,UAAU,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ;YACpD,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,UAAU;QAGhB,qEAAqE;QACrE,yEAAyE;QACzE,yEAAyE;QACzE,qEAAqE;QACrE,mDAAmD;QACnD,UAAU,CAAC,IAAI;YACb,CAAC,CAAC,wCACa,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,YAChD;YACE,CAAC,CAAC,EAAE,WAEP;QACG,CAAC,CAAC,EAAE,gDAGiB,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,8QAUtD,MAAM,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,uBAAuB,62KAiJ7E,MAAM,CAAC,CAAC,CAAC,oEAAoE,CAAC,CAAC,CAAC,EAAE,4VAevF,CAAA;AACD,CAAC,CAAA;AAzOY,QAAA,sBAAsB,0BAyOlC"}
+{"version":3,"file":"rest-api.js","sourceRoot":"","sources":["../../../src/fetchers/rest-api.ts"],"names":[],"mappings":";;;AAAA,kCAMiB;AACjB,2EAIwC;AAEjC,IAAM,qBAAqB,GAAG,UACnC,MAA+B;IAE/B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;QACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAA;KAClE;IAED,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC7E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAA;KACpD;IAED,IAAI;QACF,IAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;YAC/C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAA;SACxE;KACF;IAAC,WAAM;QACN,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAA;KACvD;IAED,IAAI,MAAM,CAAC,MAAM,EAAE;QACjB,IAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC9D,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE;YAC5F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAA;SACxD;KACF;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC,CAAA;AA5BY,QAAA,qBAAqB,yBA4BjC;AAaD,IAAM,gBAAgB,GAAG,UAAC,aAA4B;IACpD,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,IAAI,KAAK,MAAM,EAAE;QACnD,OAAO,EAAE,CAAA;KACV;IAEO,IAAA,IAAI,GAAkB,aAAa,KAA/B,EAAE,WAAW,GAAK,aAAa,YAAlB,CAAkB;IAE3C,QAAQ,IAAI,EAAE;QACZ,KAAK,SAAS;YACZ,OAAO,6CAAsC,WAAW,CAAC,MAAM,MAAG,CAAA;QACpE,KAAK,cAAc,CAAC;QACpB,KAAK,YAAY;YACf,OAAO,6CAAsC,WAAW,CAAC,KAAK,MAAG,CAAA;QACnE,KAAK,YAAY;YACf,OAAO,6DAAsD,WAAW,CAAC,QAAQ,cAAI,WAAW,CAAC,QAAQ,0BAAuB,CAAA;QAClI,KAAK,QAAQ;YACX,OAAO,6CAAsC,WAAW,CAAC,YAAY,MAAG,CAAA;QAC1E;YACE,OAAO,EAAE,CAAA;KACZ;AACH,CAAC,CAAA;AAaD;;;;;;;;GAQG;AACH,IAAM,eAAe,GAAG,UACtB,GAAuB,EACvB,WAAoC;IAEpC,IAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CACrD,UAAC,EAAY;YAAX,GAAG,QAAA,EAAE,KAAK,QAAA;QAAM,OAAA,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO,KAAK,KAAK,QAAQ;IAA9C,CAA8C,CACjE,CAAA;IACD,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE;QAC/B,OAAO,GAAG,CAAA;KACX;IAED,IAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IAC/B,MAAM,CAAC,OAAO,CAAC,UAAC,EAAY;YAAX,GAAG,QAAA,EAAE,KAAK,QAAA;QAAM,OAAA,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC;IAA1C,CAA0C,CAAC,CAAA;IAC5E,OAAO,UAAU,CAAC,QAAQ,EAAE,CAAA;AAC9B,CAAC,CAAA;AAEM,IAAM,sBAAsB,GAAG,UAAC,MAA+B;IACpE,IAAM,UAAU,GAAG,MAAuB,CAAA;IAC1C,IAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC,CAAA;IACjE,sEAAsE;IACtE,+DAA+D;IAC/D,IAAM,eAAe,GAAG,IAAA,uDAA6B,EAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACvE,IAAM,MAAM,GAAG,eAAe,KAAK,SAAS,CAAA;IAE5C,OAAO,4CAEP,IAAA,iCAAyB,GAAE,iBAE3B,IAAA,iCAAyB,GAAE,iBAE3B,IAAA,oCAA4B,GAAE,iBAE9B,IAAA,qCAA6B,GAAE,iBAE/B,IAAA,wCAAgC,GAAE,SAChC,MAAM,CAAC,CAAC,CAAC,cAAO,IAAA,0DAAgC,EAAC,eAAe,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,8OAO1D,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,kCACpE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,yCAEzC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,mBACxD,QAAQ,2FAQR,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO;QAC1F,CAAC,CAAC,sDAGF,UAAU,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ;YACpD,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,UAAU;QAGhB,qEAAqE;QACrE,yEAAyE;QACzE,yEAAyE;QACzE,qEAAqE;QACrE,mDAAmD;QACnD,UAAU,CAAC,IAAI;YACb,CAAC,CAAC,wCACa,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,YAChD;YACE,CAAC,CAAC,EAAE,WAEP;QACG,CAAC,CAAC,EAAE,gDAGiB,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,8QAUtD,MAAM,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,uBAAuB,62KAiJ7E,MAAM,CAAC,CAAC,CAAC,oEAAoE,CAAC,CAAC,CAAC,EAAE,4VAevF,CAAA;AACD,CAAC,CAAA;AAzOY,QAAA,sBAAsB,0BAyOlC"}

package/dist/cjs/fetchers/utils/browser-row-policy.d.ts

@@ -11,8 +11,11 @@
  * without them. So a caller that is not the store itself (its server code, or a
  * signed-in administrator — the generated admin edits drafts through these
  * routes) is served only the rows the storefront publishes, never a hidden
- * column, and may neither filter, sort nor search by a hidden column: a filter
- * is an oracle for a column it never returns.
+ * column, and may neither filter nor sort by a hidden column: a filter is an
+ * oracle for a column it never returns. A hidden SEARCH column is dropped from
+ * the search instead (`__brpVisibleColumns`), because the storefront's own list
+ * bindings name every text column of the table — the blog list asks to search
+ * `author_email` — and refusing them emptied the blog for every visitor.
  */
 export interface BrowserRowPolicy {
     /** SQL every browser read of the table is narrowed with. */

package/dist/cjs/fetchers/utils/browser-row-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-row-policy.d.ts","sourceRoot":"","sources":["../../../../src/fetchers/utils/browser-row-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAA;IACjB,8FAA8F;IAC9F,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CACrC;AAED,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAa3E,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,QACnC,MA8HL,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,cACpB,MAAM,mBACA,cAAc,MAAM,CAAC,KACrC,OAUF,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,cAC5B,MAAM,gBACH,MAAM,GAAG,IAAI,KAC1B,MASF,CAAA"}
+{"version":3,"file":"browser-row-policy.d.ts","sourceRoot":"","sources":["../../../../src/fetchers/utils/browser-row-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAA;IACjB,8FAA8F;IAC9F,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CACrC;AAED,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAa3E,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,QACnC,MA+HL,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,cACpB,MAAM,mBACA,cAAc,MAAM,CAAC,KACrC,OAUF,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,cAC5B,MAAM,gBACH,MAAM,GAAG,IAAI,KAC1B,MASF,CAAA"}

package/dist/cjs/fetchers/utils/browser-row-policy.js

@@ -12,8 +12,11 @@
  * without them. So a caller that is not the store itself (its server code, or a
  * signed-in administrator — the generated admin edits drafts through these
  * routes) is served only the rows the storefront publishes, never a hidden
- * column, and may neither filter, sort nor search by a hidden column: a filter
- * is an oracle for a column it never returns.
+ * column, and may neither filter nor sort by a hidden column: a filter is an
+ * oracle for a column it never returns. A hidden SEARCH column is dropped from
+ * the search instead (`__brpVisibleColumns`), because the storefront's own list
+ * bindings name every text column of the table — the blog list asks to search
+ * `author_email` — and refusing them emptied the blog for every visitor.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateBrowserRowAccessCall = exports.isViewDependentTable = exports.generateBrowserRowPolicyCode = exports.BROWSER_ROW_POLICIES = void 0;
@@ -39,7 +42,7 @@ exports.BROWSER_ROW_POLICIES = {
  * the table whole). Plus the helpers that apply a policy to a request and to
  * its rows.
  */
-var generateBrowserRowPolicyCode = function () { return "// GENERATED \u2014 see browser-row-policy.ts in teleport-plugin-next-data-source.\nvar __BRP_POLICIES = ".concat(JSON.stringify(exports.BROWSER_ROW_POLICIES), ";\n\n// Who is asking: the store's own server code and its administrators read every\n// row; anyone else is a visitor.\nasync function __brpReader(req) {\n  if (__taIsInternalRequest(req)) return { trusted: true };\n  var token = null;\n  try {\n    token = await __tqSessionToken(req);\n  } catch (e) {\n    token = null;\n  }\n  var role = token ? __taRoleOf(token) : null;\n  return { trusted: !!role && __TA_TRUSTED_READER_ROLES.indexOf(role) !== -1 };\n}\n\nfunction __brpMentionsAny(rawQuery, tables) {\n  for (var i = 0; i < tables.length; i++) {\n    if (__taSqlMentionsTable(rawQuery, tables[i])) return true;\n  }\n  return false;\n}\n\n// A raw statement cannot be narrowed, so a visitor's statement that names a\n// narrowed table is refused whole. The session is only decoded when the read\n// touches one of these tables.\nasync function __brpAccess(req, tableName, rawQuery) {\n  var raw = typeof rawQuery === 'string' && rawQuery.length > 0 ? rawQuery : null;\n  var bare = __taNormalizeTable(tableName);\n  var rawNarrowed = !!raw && __brpMentionsAny(raw, Object.keys(__BRP_POLICIES));\n  var policy = raw ? null : (Object.prototype.hasOwnProperty.call(__BRP_POLICIES, bare) ? __BRP_POLICIES[bare] : null);\n  if (!rawNarrowed && !policy) return { denied: null, policy: null };\n  var reader = await __brpReader(req);\n  if (reader.trusted) return { denied: null, policy: null };\n  if (rawNarrowed) {\n    return { denied: { status: 403, message: 'Forbidden: raw queries over this table are only available to server-side calls' }, policy: null };\n  }\n  return { denied: null, policy: policy };\n}\n\nfunction __brpColumnName(field) {\n  var parts = String(field == null ? '' : field).replace(/\"/g, '').trim().split('.');\n  return parts[parts.length - 1];\n}\n\nfunction __brpIsHidden(policy, field) {\n  var name = __brpColumnName(field).toLowerCase();\n  for (var i = 0; i < policy.hiddenColumns.length; i++) {\n    if (policy.hiddenColumns[i].toLowerCase() === name) return true;\n  }\n  return false;\n}\n\n// Every field a request filters, sorts or searches by, however deep a filter\n// group nests it. A condition's value is data, not a field.\nfunction __brpRequestFields(value, out) {\n  if (Array.isArray(value)) {\n    for (var i = 0; i < value.length; i++) __brpRequestFields(value[i], out);\n  } else if (value && typeof value === 'object') {\n    if (typeof value.source === 'string') out.push(value.source);\n    if (typeof value.field === 'string') out.push(value.field);\n    var keys = Object.keys(value);\n    for (var k = 0; k < keys.length; k++) {\n      if (keys[k] === 'destination' || keys[k] === 'value') continue;\n      if (value[keys[k]] && typeof value[keys[k]] === 'object') __brpRequestFields(value[keys[k]], out);\n    }\n  } else if (typeof value === 'string' && value) {\n    out.push(value);\n  }\n  return out;\n}\n\nfunction __brpParse(value) {\n  if (typeof value !== 'string') return value;\n  try {\n    return JSON.parse(value);\n  } catch (e) {\n    return value;\n  }\n}\n\nfunction __brpAssertVisibleFields(policy, query) {\n  var q = query || {};\n  var fields = [];\n  __brpRequestFields(__brpParse(q.filters), fields);\n  __brpRequestFields(__brpParse(q.sorts), fields);\n  __brpRequestFields(__brpParse(q.queryColumns), fields);\n  if (typeof q.sortBy === 'string') fields.push(q.sortBy);\n  for (var i = 0; i < fields.length; i++) {\n    if (__brpIsHidden(policy, fields[i])) {\n      var err = new Error('Forbidden: ' + __brpColumnName(fields[i]) + ' is not readable');\n      err.status = 403;\n      throw err;\n    }\n  }\n}\n\nfunction __brpVisibleColumns(policy, columns) {\n  return columns.filter(function(column) { return !__brpIsHidden(policy, column); });\n}\n\n// The rows without a hidden key, at any depth: a transformed row nests related\n// rows (a post's related and adjacent posts) built the same way.\nfunction __brpStripHidden(policy, value) {\n  if (Array.isArray(value)) {\n    return value.map(function(entry) { return __brpStripHidden(policy, entry); });\n  }\n  if (!value || typeof value !== 'object') return value;\n  var copy = {};\n  Object.keys(value).forEach(function(key) {\n    if (!__brpIsHidden(policy, key)) copy[key] = __brpStripHidden(policy, value[key]);\n  });\n  return copy;\n}\n\n// Whether this request is answered exactly as an anonymous visitor's would be,\n// so a response cached for one may serve the other. A read whose answer depends\n// on who asks (`viewDependent`: a narrowed, protected or admin-only table) or\n// that runs a raw statement differs for the store's own server code and its\n// administrators, and must never share a cache entry with a visitor.\nasync function __brpSharesPublicView(req, viewDependent) {\n  var raw = !!(req && req.query && typeof req.query.rawQuery === 'string' && req.query.rawQuery.length > 0);\n  if (!viewDependent && !raw) return true;\n  return !(await __brpReader(req)).trusted;\n}\n"); };
+var generateBrowserRowPolicyCode = function () { return "// GENERATED \u2014 see browser-row-policy.ts in teleport-plugin-next-data-source.\nvar __BRP_POLICIES = ".concat(JSON.stringify(exports.BROWSER_ROW_POLICIES), ";\n\n// Who is asking: the store's own server code and its administrators read every\n// row; anyone else is a visitor.\nasync function __brpReader(req) {\n  if (__taIsInternalRequest(req)) return { trusted: true };\n  var token = null;\n  try {\n    token = await __tqSessionToken(req);\n  } catch (e) {\n    token = null;\n  }\n  var role = token ? __taRoleOf(token) : null;\n  return { trusted: !!role && __TA_TRUSTED_READER_ROLES.indexOf(role) !== -1 };\n}\n\nfunction __brpMentionsAny(rawQuery, tables) {\n  for (var i = 0; i < tables.length; i++) {\n    if (__taSqlMentionsTable(rawQuery, tables[i])) return true;\n  }\n  return false;\n}\n\n// A raw statement cannot be narrowed, so a visitor's statement that names a\n// narrowed table is refused whole. The session is only decoded when the read\n// touches one of these tables.\nasync function __brpAccess(req, tableName, rawQuery) {\n  var raw = typeof rawQuery === 'string' && rawQuery.length > 0 ? rawQuery : null;\n  var bare = __taNormalizeTable(tableName);\n  var rawNarrowed = !!raw && __brpMentionsAny(raw, Object.keys(__BRP_POLICIES));\n  var policy = raw ? null : (Object.prototype.hasOwnProperty.call(__BRP_POLICIES, bare) ? __BRP_POLICIES[bare] : null);\n  if (!rawNarrowed && !policy) return { denied: null, policy: null };\n  var reader = await __brpReader(req);\n  if (reader.trusted) return { denied: null, policy: null };\n  if (rawNarrowed) {\n    return { denied: { status: 403, message: 'Forbidden: raw queries over this table are only available to server-side calls' }, policy: null };\n  }\n  return { denied: null, policy: policy };\n}\n\nfunction __brpColumnName(field) {\n  var parts = String(field == null ? '' : field).replace(/\"/g, '').trim().split('.');\n  return parts[parts.length - 1];\n}\n\nfunction __brpIsHidden(policy, field) {\n  var name = __brpColumnName(field).toLowerCase();\n  for (var i = 0; i < policy.hiddenColumns.length; i++) {\n    if (policy.hiddenColumns[i].toLowerCase() === name) return true;\n  }\n  return false;\n}\n\n// Every field a request filters, sorts or searches by, however deep a filter\n// group nests it. A condition's value is data, not a field.\nfunction __brpRequestFields(value, out) {\n  if (Array.isArray(value)) {\n    for (var i = 0; i < value.length; i++) __brpRequestFields(value[i], out);\n  } else if (value && typeof value === 'object') {\n    if (typeof value.source === 'string') out.push(value.source);\n    if (typeof value.field === 'string') out.push(value.field);\n    var keys = Object.keys(value);\n    for (var k = 0; k < keys.length; k++) {\n      if (keys[k] === 'destination' || keys[k] === 'value') continue;\n      if (value[keys[k]] && typeof value[keys[k]] === 'object') __brpRequestFields(value[keys[k]], out);\n    }\n  } else if (typeof value === 'string' && value) {\n    out.push(value);\n  }\n  return out;\n}\n\nfunction __brpParse(value) {\n  if (typeof value !== 'string') return value;\n  try {\n    return JSON.parse(value);\n  } catch (e) {\n    return value;\n  }\n}\n\n// Search columns are not checked here: the read drops the hidden ones from the\n// search (`__brpVisibleColumns`), and the storefront's own list bindings name them.\nfunction __brpAssertVisibleFields(policy, query) {\n  var q = query || {};\n  var fields = [];\n  __brpRequestFields(__brpParse(q.filters), fields);\n  __brpRequestFields(__brpParse(q.sorts), fields);\n  if (typeof q.sortBy === 'string') fields.push(q.sortBy);\n  for (var i = 0; i < fields.length; i++) {\n    if (__brpIsHidden(policy, fields[i])) {\n      var err = new Error('Forbidden: ' + __brpColumnName(fields[i]) + ' is not readable');\n      err.status = 403;\n      throw err;\n    }\n  }\n}\n\nfunction __brpVisibleColumns(policy, columns) {\n  return columns.filter(function(column) { return !__brpIsHidden(policy, column); });\n}\n\n// The rows without a hidden key, at any depth: a transformed row nests related\n// rows (a post's related and adjacent posts) built the same way.\nfunction __brpStripHidden(policy, value) {\n  if (Array.isArray(value)) {\n    return value.map(function(entry) { return __brpStripHidden(policy, entry); });\n  }\n  if (!value || typeof value !== 'object') return value;\n  var copy = {};\n  Object.keys(value).forEach(function(key) {\n    if (!__brpIsHidden(policy, key)) copy[key] = __brpStripHidden(policy, value[key]);\n  });\n  return copy;\n}\n\n// Whether this request is answered exactly as an anonymous visitor's would be,\n// so a response cached for one may serve the other. A read whose answer depends\n// on who asks (`viewDependent`: a narrowed, protected or admin-only table) or\n// that runs a raw statement differs for the store's own server code and its\n// administrators, and must never share a cache entry with a visitor.\nasync function __brpSharesPublicView(req, viewDependent) {\n  var raw = !!(req && req.query && typeof req.query.rawQuery === 'string' && req.query.rawQuery.length > 0);\n  if (!viewDependent && !raw) return true;\n  return !(await __brpReader(req)).trusted;\n}\n"); };
 exports.generateBrowserRowPolicyCode = generateBrowserRowPolicyCode;
 /**
  * Whether a per-table read route's answer depends on who asks — the rows it

package/dist/cjs/fetchers/utils/browser-row-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"browser-row-policy.js","sourceRoot":"","sources":["../../../../src/fetchers/utils/browser-row-policy.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AASU,QAAA,oBAAoB,GAA+C;IAC9E,kEAAkE;IAClE,wEAAwE;IACxE,mBAAmB,EAAE;QACnB,SAAS,EAAE,sBAAsB;QACjC,aAAa,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC;KAC/C;IACD,yEAAyE;IACzE,+DAA+D;IAC/D,iBAAiB,EAAE;QACjB,SAAS,EAAE,gCAAgC;QAC3C,aAAa,EAAE,EAAE;KAClB;CACF,CAAA;AAED;;;;;;;GAOG;AACI,IAAM,4BAA4B,GACvC,cAAc,OAAA,mHACO,IAAI,CAAC,SAAS,CAAC,4BAAoB,CAAC,y1JA6H1D,EA9He,CA8Hf,CAAA;AA/HY,QAAA,4BAA4B,gCA+HxC;AAED;;;GAGG;AACI,IAAM,oBAAoB,GAAG,UAClC,SAAiB,EACjB,eAAsC;IAEtC,IAAM,KAAK,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;SAClC,IAAI,EAAE;SACN,WAAW,EAAE;SACb,KAAK,CAAC,GAAG,CAAC,CAAA;IACb,IAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACtD,OAAO,CACL,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,4BAAoB,EAAE,IAAI,CAAC;QAChE,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACrC,CAAA;AACH,CAAC,CAAA;AAbY,QAAA,oBAAoB,wBAahC;AAED;;;GAGG;AACI,IAAM,4BAA4B,GAAG,UAC1C,SAAiB,EACjB,YAA2B;IAE3B,OAAO,uDAAgD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,eAC9E,YAAY,IAAI,MAAM,yNAMzB,CAAA;AACD,CAAC,CAAA;AAZY,QAAA,4BAA4B,gCAYxC"}
+{"version":3,"file":"browser-row-policy.js","sourceRoot":"","sources":["../../../../src/fetchers/utils/browser-row-policy.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AASU,QAAA,oBAAoB,GAA+C;IAC9E,kEAAkE;IAClE,wEAAwE;IACxE,mBAAmB,EAAE;QACnB,SAAS,EAAE,sBAAsB;QACjC,aAAa,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC;KAC/C;IACD,yEAAyE;IACzE,+DAA+D;IAC/D,iBAAiB,EAAE;QACjB,SAAS,EAAE,gCAAgC;QAC3C,aAAa,EAAE,EAAE;KAClB;CACF,CAAA;AAED;;;;;;;GAOG;AACI,IAAM,4BAA4B,GACvC,cAAc,OAAA,mHACO,IAAI,CAAC,SAAS,CAAC,4BAAoB,CAAC,q8JA8H1D,EA/He,CA+Hf,CAAA;AAhIY,QAAA,4BAA4B,gCAgIxC;AAED;;;GAGG;AACI,IAAM,oBAAoB,GAAG,UAClC,SAAiB,EACjB,eAAsC;IAEtC,IAAM,KAAK,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;SAClC,IAAI,EAAE;SACN,WAAW,EAAE;SACb,KAAK,CAAC,GAAG,CAAC,CAAA;IACb,IAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACtD,OAAO,CACL,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,4BAAoB,EAAE,IAAI,CAAC;QAChE,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACrC,CAAA;AACH,CAAC,CAAA;AAbY,QAAA,oBAAoB,wBAahC;AAED;;;GAGG;AACI,IAAM,4BAA4B,GAAG,UAC1C,SAAiB,EACjB,YAA2B;IAE3B,OAAO,uDAAgD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,eAC9E,YAAY,IAAI,MAAM,yNAMzB,CAAA;AACD,CAAC,CAAA;AAZY,QAAA,4BAA4B,gCAYxC"}

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,sBAAsB,EAMvB,MAAM,4BAA4B,CAAA;AAmdnC,eAAO,MAAM,+BAA+B,EAAE,sBAAsB,CAAC,EAAE,CAyftE,CAAA;AAiOD,eAAO,MAAM,mCAAmC,EAAE,sBAAsB,CAAC,EAAE,CA0P1E,CAAA;AAED,cAAc,wBAAwB,CAAA;AACtC,cAAc,SAAS,CAAA;AACvB,cAAc,2BAA2B,CAAA;AACzC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,sBAAsB,CAAA;AACpC,cAAc,yBAAyB,CAAA;AAIvC,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAA;AAChE,YAAY,EAAE,gCAAgC,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAGjG,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAA;AACvF,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,sBAAsB,EAMvB,MAAM,4BAA4B,CAAA;AAodnC,eAAO,MAAM,+BAA+B,EAAE,sBAAsB,CAAC,EAAE,CAyftE,CAAA;AAiOD,eAAO,MAAM,mCAAmC,EAAE,sBAAsB,CAAC,EAAE,CA0P1E,CAAA;AAED,cAAc,wBAAwB,CAAA;AACtC,cAAc,SAAS,CAAA;AACvB,cAAc,2BAA2B,CAAA;AACzC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,sBAAsB,CAAA;AACpC,cAAc,yBAAyB,CAAA;AAIvC,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAA;AAChE,YAAY,EAAE,gCAAgC,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAGjG,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAA;AACvF,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/cjs/index.js

@@ -67,6 +67,7 @@ var teleport_types_1 = require("@teleporthq/teleport-types");
 var teleport_shared_1 = require("@teleporthq/teleport-shared");
 var utils_1 = require("./utils");
 var pagination_plugin_1 = require("./pagination-plugin");
+var repeater_page_size_1 = require("./repeater-page-size");
 var transformations_1 = require("./transformations");
 var isr_1 = require("./isr");
 var request_locale_1 = require("./request-locale");
@@ -289,8 +290,8 @@ function extractPaginationConfigEarly(uidlNode, resources) {
             var renderProp = (_t = node.content) === null || _t === void 0 ? void 0 : _t.renderPropIdentifier;
             var searchEnabled = (_u = node.content) === null || _u === void 0 ? void 0 : _u.searchEnabled;
             var searchDebounce = (_v = node.content) === null || _v === void 0 ? void 0 : _v.searchDebounce;
-            if (paginated && perPage && renderProp) {
-                perPageMap.set(renderProp, perPage);
+            if (paginated && renderProp) {
+                perPageMap.set(renderProp, (0, repeater_page_size_1.resolveRepeaterPerPage)(perPage));
             }
             if (searchEnabled && renderProp) {
                 searchConfigMap.set(renderProp, {