@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

package/dist/esm/base-classes/services/repositories/postgresql-resource-repository.backend.service.js

@@ -17,6 +17,7 @@ import { PostgreSQLFilterBackendService } from '../../../databases/services/post
 import { sql } from 'kysely';
 import { normalizeRepositoryVersionMetadata } from '../../../base-classes/services/repositories/repository-version-metadata.backend.utils.js';
 import { isEngineReservedFieldName } from './field-clearing-partition.backend.js';
+import { materializeSeedInsertRowDefaults } from './seed-row-default-materialization.backend.js';
 import { buildRetentionVisibleRowsSqlPredicate, isRetentionGovernedResource, withRetentionHideApplied, } from '../../../compliance/privacy/retention-hide-predicate.backend.js';
 import { quotePostgresColumnOf, quotePostgresIdentifier, } from '../../../databases/utils/postgresql-identifier.backend.utils.js';
 import { guardedMutationHasWork, RepositoryArrayAdditionPlacement, } from './repository-guarded-mutation.backend.types.js';
@@ -293,7 +294,82 @@ export class PostgreSQLResourceRepositoryBackendService {
      * today.
      */
     toSqlWriteRow(data, inheritanceDefinition) {
-        return this.serializeJsonbColumns(this.sqlPlanner.transformForSqlWrite(this.foldSurrogatePrimaryKey(data), inheritanceDefinition, this.declaredBaseFieldNames()));
+        return this.serializeJsonbColumns(this.projectOntoPlannedColumns(this.sqlPlanner.transformForSqlWrite(this.foldSurrogatePrimaryKey(data), inheritanceDefinition, this.declaredBaseFieldNames())));
+    }
+    /**
+     * Keep only the keys this table HAS A COLUMN FOR — the SQL twin of the mongoose schema's own
+     * projection, and the third site of the `plannedFieldNames` gate the two guarded-write sites
+     * already apply.
+     *
+     * ## Why the payload legitimately carries a key that is not a column
+     *
+     * A repository does not receive "the row to write". It receives the OPERATION'S VALIDATED
+     * REQUEST — `validateRepositoryWriteData` parses the payload against the operation's own
+     * `requestDto` — and a custom operation's request DTO declares the ARGUMENTS the operation
+     * takes, not the columns it writes. `claimDomain` takes `{ domain }`, a DNS name being claimed;
+     * its PREFIX hook computes the `domains` block from it and that block is what persists. `domain`
+     * itself was never a field of the resource.
+     *
+     * That is not one operation's quirk. Surveyed over the whole engine catalogue, **43 write
+     * operations declare 63 such request keys** — `reason`, `justification`, `notifyMembers`,
+     * `newParentUnitId`, `featureId`, `cancelImmediately`, `requestedDurationMinutes`, and so on.
+     * The normal case for a custom write verb is to take arguments.
+     *
+     * ## The divergence this closes
+     *
+     * MongoDB projects the payload onto the persisted shape and always has: `SCHEMA_DEFAULT_OPTIONS`
+     * sets `strict: true`, so mongoose drops a path its schema does not declare and the write
+     * succeeds. Here the same key reached the statement and PostgreSQL refused the whole UPDATE with
+     * `column "domain" of relation "organizationssoconfig" does not exist` — measured over HTTP on
+     * 2026-09-09 (issue #573). So the projection existed on one adapter as an accident of the ODM and
+     * on the other not at all, which is the adapter divergence, not the tolerance.
+     *
+     * ## Drop, not refuse — decided rather than inherited
+     *
+     * Refusing a payload key with no column reads like the stricter answer and is not equivalent: it
+     * would refuse all 43 operations above, every one of which is correctly authored and works on
+     * MongoDB today. A refusal is a NEW contract, it would have to be applied to BOTH adapters to
+     * mean anything (a refusal on one adapter only is the very divergence being closed), and its
+     * natural home is a startup-time check over DECLARATIONS — beside the `authoritativeFields`
+     * validator — never a runtime refusal on a live request. The two `plannedFieldNames` gates in
+     * this file already chose to drop, for the same no-op-parity reason.
+     *
+     * A per-operation `requestOnly` DECLARATION was considered as the "state it rather than infer
+     * it" alternative, and rejected: the plan already decides which keys are columns, so a second
+     * declaration would state the same fact twice and let the two disagree
+     * (`.claude/rules/derive-before-you-ask.md` — name what already decides it before adding a
+     * declaration a human maintains).
+     *
+     * ## Why `plannedFieldNames`, and not `planPhysicalColumnNames`
+     *
+     * `plannedFieldNames` is the PERMISSIVE set: for a hybrid-inheritance resource it also contains
+     * the variant-only names `transformForSqlWrite` sweeps into `variantConfig`. Running after that
+     * sweep, those keys are already gone, so the extra members cannot admit anything — while gating
+     * on the narrower physical set would newly DROP a variant field the sweep failed to move, turning
+     * today's loud failure into a silent one. Permissive here is deliberate: this projection removes
+     * an adapter divergence and must not quietly change any other outcome.
+     *
+     * Dropped names are logged at debug rather than warned, matching `cleanInputData`'s report of
+     * what it removed. A warning on the normal case teaches a reader to skim the warnings that matter.
+     */
+    projectOntoPlannedColumns(row) {
+        if (!row || typeof row !== 'object' || Array.isArray(row))
+            return row;
+        const record = row;
+        const unplanned = Object.keys(record).filter((field) => !this.plannedFieldNames.has(field));
+        if (unplanned.length === 0)
+            return row;
+        const projected = {};
+        for (const [field, value] of Object.entries(record)) {
+            if (!this.plannedFieldNames.has(field))
+                continue;
+            projected[field] = value;
+        }
+        this.logDebug('Dropped payload keys with no planned column', {
+            table: this.tableName,
+            droppedFields: unplanned,
+        });
+        return projected;
     }
     /**
      * Render every JSONB-backed column's value as JSON TEXT, so PostgreSQL parses it as `jsonb`.
@@ -952,6 +1028,13 @@ export class PostgreSQLResourceRepositoryBackendService {
         for (const [path, delta] of Object.entries(mutation.increment ?? {})) {
             const segments = path.split('.');
             if (segments.length === 1) {
+                // An increment targeting a field with NO PLANNED COLUMN is dropped, for the same reason the
+                // `clear` case below drops one: mongoose's `strict: true` schema removes an `$inc` on a path
+                // it does not declare, so the counter does not move there — while here the same path would
+                // be `column "x" does not exist` and would fail the WHOLE mutation, including the parts that
+                // are legal. Same third-site gate as `toSqlWriteRow`'s projection.
+                if (!this.plannedFieldNames.has(path))
+                    continue;
                 // `COALESCE(col, 0)` is parity, not defensiveness: MongoDB's `$inc` treats a missing field
                 // as 0 and sets it to `delta`, whereas SQL `NULL + delta` is NULL — without it a first
                 // increment on a nullable column would silently blank the counter instead of starting it.
@@ -973,6 +1056,11 @@ export class PostgreSQLResourceRepositoryBackendService {
             const [root, ...rest] = segments;
             this.assertJsonbPathRoot(root, addition.path, 'array addition');
             if (rest.length === 0) {
+                // Unplanned roots cannot reach here: `assertJsonbPathRoot` above refuses any root that is
+                // not jsonb-backed, and every jsonb root IS a planned column — so this branch needs no
+                // `plannedFieldNames` gate of its own, unlike the increment and clear cases. Stated so the
+                // absence reads as an enumeration result rather than as the third site being forgotten.
+                //
                 // The array IS the column, so it coalesces to an empty ARRAY rather than an empty object.
                 columnAssignments.set(root, this.buildJsonbArrayAddition(this.currentColumnExpression(columnAssignments, root, ARRAY_JSONB_LITERAL), addition));
                 continue;
@@ -1286,8 +1374,13 @@ export class PostgreSQLResourceRepositoryBackendService {
                 continue;
             callerAuthoredPayload[key] = payload[key];
         }
+        // A seed payload is written verbatim by this path — it never meets the request-DTO parse that
+        // materialises schema defaults for every ordinary CREATE. The engine's own configuration seeds
+        // are authored expecting that parse (`{ domains: {}, enforcement: {}, … }`), so without this the
+        // row lands holding empty objects and only an INTERNAL reader ever sees it; see the helper.
+        const materializedPayload = materializeSeedInsertRowDefaults(this.resourceConfiguration.mainSchema, callerAuthoredPayload);
         const writePayload = {
-            ...callerAuthoredPayload,
+            ...materializedPayload,
             [DATA_SEED_ROW_METADATA_FIELD_KEY]: seedMetadata,
         };
         const trackedPayload = this.addUserTrackingAndTimestamps(writePayload, executionContext, existing ? CoreResourceOperation.UPDATE : CoreResourceOperation.CREATE);