@ursalock/server 0.4.0 → 0.4.2

package/dist/index.js

@@ -503,19 +503,28 @@ function listDocuments(vaultUid, userId, opts) {
 function updateDocument(uid, vaultUid, userId, input) {
   const db = getDb();
   if (input.version != null) {
-    const stmt2 = db.prepare(`
-      UPDATE documents SET data = ?, hmac = ?, version = ? + 1, updated_at = unixepoch()
-      WHERE uid = ? AND vault_uid = ? AND user_id = ? AND version = ?
-      RETURNING ${DOCUMENT_COLUMNS}
-    `);
-    return stmt2.get(input.data, input.hmac ?? null, input.version, uid, vaultUid, userId, input.version);
+    const result = db.transaction(() => {
+      const stmt2 = db.prepare(`
+        UPDATE documents SET data = ?, hmac = ?, version = ? + 1, updated_at = unixepoch()
+        WHERE uid = ? AND vault_uid = ? AND user_id = ? AND version = ?
+        RETURNING ${DOCUMENT_COLUMNS}
+      `);
+      const doc2 = stmt2.get(input.data, input.hmac ?? null, input.version, uid, vaultUid, userId, input.version);
+      if (doc2) return { document: doc2, conflict: false };
+      const exists = db.prepare(
+        `SELECT 1 FROM documents WHERE uid = ? AND vault_uid = ? AND user_id = ?`
+      ).get(uid, vaultUid, userId);
+      return { document: void 0, conflict: !!exists };
+    })();
+    return result;
   }
   const stmt = db.prepare(`
     UPDATE documents SET data = ?, hmac = ?, version = version + 1, updated_at = unixepoch()
     WHERE uid = ? AND vault_uid = ? AND user_id = ?
     RETURNING ${DOCUMENT_COLUMNS}
   `);
-  return stmt.get(input.data, input.hmac ?? null, uid, vaultUid, userId);
+  const doc = stmt.get(input.data, input.hmac ?? null, uid, vaultUid, userId);
+  return { document: doc, conflict: false };
 }
 function softDeleteDocument(uid, vaultUid, userId) {
   const db = getDb();
@@ -719,10 +728,6 @@ var errors = {
   insufficient_permissions: { code: "insufficient_permissions", message: "Insufficient permissions" },
   // Vault errors
   vault_not_found: { code: "vault_not_found", message: "Vault not found" },
-  vault_already_exists: (name) => ({
-    code: "vault_already_exists",
-    message: `Vault "${name}" already exists`
-  }),
   vault_conflict: { code: "vault_conflict", message: "Version conflict - vault has been modified. Please refresh and retry." },
   invalid_vault_data: { code: "invalid_vault_data", message: "Invalid vault data" },
   // Document errors
@@ -730,20 +735,25 @@ var errors = {
   document_conflict: { code: "document_conflict", message: "Version conflict - document has been modified. Please refresh and retry." },
   document_already_exists: { code: "document_already_exists", message: "Document already exists" },
   // Validation errors
-  validation_error: (details) => ({
-    code: "validation_error",
-    message: details
-  }),
   invalid_request: { code: "invalid_request", message: "Invalid request" },
   // Server errors
   internal_error: { code: "internal_error", message: "Internal server error" }
 };
-function getError(code, arg) {
-  const factory = errors[code];
-  if (typeof factory === "function") {
-    return factory(arg ?? "");
+var errorBuilders = {
+  vaultAlreadyExists: (name) => ({
+    code: "vault_already_exists",
+    message: `Vault "${name}" already exists`
+  }),
+  validationError: (details) => ({
+    code: "validation_error",
+    message: details
+  })
+};
+function getError(code) {
+  if (code in errors) {
+    return errors[code];
   }
-  return factory;
+  return { code, message: code.replace(/_/g, " ") };
 }
 
 // src/features/auth/middleware.ts
@@ -1657,7 +1667,7 @@ var VaultService = class {
   createVault(userId, data) {
     const existing = this.vaultRepo.findByName(data.name, userId);
     if (existing) {
-      throw new ApiException(errors.vault_already_exists(data.name), 409);
+      throw new ApiException(errorBuilders.vaultAlreadyExists(data.name), 409);
     }
     const vault = this.vaultRepo.create({
       userId,
@@ -1813,8 +1823,9 @@ var DocumentService = class {
     this.vaultRepo = vaultRepo3;
   }
   /**
-   * Verify vault ownership before any operation
-   * Throws 404 if vault doesn't exist or doesn't belong to user
+   * Verify vault exists and belongs to user.
+   * Only needed for create (to prevent orphan documents referencing non-existent vaults).
+   * Read/update/delete queries already filter by userId — no vault exists = empty result.
    */
   verifyVaultOwnership(vaultUid, userId) {
     const vault = this.vaultRepo.findByUid(vaultUid, userId);
@@ -1840,7 +1851,6 @@ var DocumentService = class {
    * Get document by UID
    */
   getDocument(uid, vaultUid, userId) {
-    this.verifyVaultOwnership(vaultUid, userId);
     const document = this.documentRepo.findByUid(uid, vaultUid, userId);
     if (!document) {
       throw new ApiException(errors.document_not_found, 404);
@@ -1851,7 +1861,6 @@ var DocumentService = class {
    * List documents in a vault
    */
   listDocuments(vaultUid, userId, opts) {
-    this.verifyVaultOwnership(vaultUid, userId);
     const documents = this.documentRepo.list(vaultUid, userId, opts);
     return {
       documents: documents.map(toDocumentResponse)
@@ -1861,14 +1870,10 @@ var DocumentService = class {
    * Update a document
    */
   updateDocument(uid, vaultUid, userId, data) {
-    this.verifyVaultOwnership(vaultUid, userId);
-    const document = this.documentRepo.update(uid, vaultUid, userId, data);
+    const { document, conflict } = this.documentRepo.update(uid, vaultUid, userId, data);
     if (!document) {
-      if (data.version != null) {
-        const existing = this.documentRepo.findByUid(uid, vaultUid, userId);
-        if (existing) {
-          throw new ApiException(errors.document_conflict, 409);
-        }
+      if (conflict) {
+        throw new ApiException(errors.document_conflict, 409);
       }
       throw new ApiException(errors.document_not_found, 404);
     }
@@ -1878,7 +1883,6 @@ var DocumentService = class {
    * Soft delete a document
    */
   deleteDocument(uid, vaultUid, userId) {
-    this.verifyVaultOwnership(vaultUid, userId);
     const document = this.documentRepo.softDelete(uid, vaultUid, userId);
     if (!document) {
       throw new ApiException(errors.document_not_found, 404);
@@ -1889,7 +1893,6 @@ var DocumentService = class {
    * Delta sync - get documents modified since timestamp
    */
   syncDocuments(vaultUid, userId, since) {
-    this.verifyVaultOwnership(vaultUid, userId);
     const documents = this.documentRepo.getSince(vaultUid, userId, since);
     return {
       documents: documents.map(toDocumentResponse),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ursalock/server",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Self-hostable ursalock server with SQLite and ZKCredentials support",
   "type": "module",
   "main": "./dist/index.js",