fastify-auto-sqlapi 0.0.3 → 0.0.5

package/dist/lib/engine/rest/update.js

@@ -1,53 +1,58 @@
-import { camelcaseObject, snakecaseRecord } from '../../naming.js';
+import { snakecaseRecord } from '../../naming.js';
 import { processSecondaries, processDeletions } from '../write-helpers.js';
 import { stripTenantColumn, buildTenantCondition, buildTenantJoin } from '../../tenant.js';
+import { runValidation } from '../validate.js';
 import { ConditionBuilder } from 'node-condition-builder';
 import { primaryAsString } from '../../../types.js';
 export async function updateEngine(params) {
     const { db, tableConf, dbTables, request, record, secondaries, deletions, tenant } = params;
-    // 1. Prepare: extract PK, snakecase, build update fields
+    const schema = tableConf.Schema;
     const pk = primaryAsString(tableConf.primary);
-    const pkCol = tableConf.Schema.col(pk);
-    const snaked = snakecaseRecord(record);
-    const pkValue = snaked[pkCol];
+    const pkCol = schema.col(pk);
+    const pkValue = record[pk];
     if (pkValue == null) {
         const error = new Error(`Primary key "${pk}" is required`);
         error.statusCode = 400;
         throw error;
     }
+    // 1. Tenant ownership check (indirect) — do it early so user mutations don't run on records they can't access
+    if (tenant && 'through' in tenant.scope) {
+        const scope = tenant.scope;
+        const tableName = schema.tableName;
+        const cb = new ConditionBuilder('AND');
+        cb.isEqual(`${db.qi(tableName)}.${db.qi(pkCol)}`, pkValue);
+        cb.append(buildTenantCondition(db, scope, tenant.ids));
+        const checkWhere = cb.build(1, db.ph);
+        const checkValues = cb.getValues();
+        const joinSql = buildTenantJoin(db, scope, tableName);
+        const checkSql = `SELECT 1 FROM ${db.qi(tableName)} ${joinSql} WHERE ${checkWhere} LIMIT 1`;
+        const checkResult = await db.query(checkSql, checkValues);
+        if (checkResult.rows.length === 0) {
+            const error = new Error('Record not found');
+            error.statusCode = 404;
+            throw error;
+        }
+    }
+    // 2. Mutable copy of input in camelCase
+    const inputRecord = { ...record };
+    // 3. Custom validation (camelCase)
+    await runValidation(db, request, tableConf, inputRecord, secondaries);
+    // 4. beforeUpdate hook (camelCase — user can mutate with schema field names)
+    if (tableConf.beforeUpdate) {
+        await tableConf.beforeUpdate(db, request, inputRecord);
+    }
+    // 5. Convert to DB format (after all user mutations)
+    const snaked = snakecaseRecord(inputRecord, schema);
     const updateFields = { ...snaked };
     delete updateFields[pkCol];
-    // 1b. Tenant: strip tenant column from update fields + validate ownership
+    // 6. Strip tenant column (user cannot change tenant of an existing record)
     if (tenant) {
         stripTenantColumn(updateFields, tenant.scope);
-        if ('through' in tenant.scope) {
-            // Indirect: verify the record belongs to tenant via subquery
-            const scope = tenant.scope;
-            const tableName = tableConf.Schema.tableName;
-            const cb = new ConditionBuilder('AND');
-            cb.isEqual(`${db.qi(tableName)}.${db.qi(pkCol)}`, pkValue);
-            cb.append(buildTenantCondition(db, scope, tenant.ids));
-            const checkWhere = cb.build(1, db.ph);
-            const checkValues = cb.getValues();
-            const joinSql = buildTenantJoin(db, scope, tableName);
-            const checkSql = `SELECT 1 FROM ${db.qi(tableName)} ${joinSql} WHERE ${checkWhere} LIMIT 1`;
-            const checkResult = await db.query(checkSql, checkValues);
-            if (checkResult.rows.length === 0) {
-                const error = new Error('Record not found');
-                error.statusCode = 404;
-                throw error;
-            }
-        }
-    }
-    // 2. beforeUpdate hook
-    if (tableConf.beforeUpdate) {
-        await tableConf.beforeUpdate(db, request, updateFields);
     }
-    // 3. Update main
+    // 7. Update main
     const hasFieldsToUpdate = Object.keys(updateFields).length > 0;
     let extraCondition;
     if (tenant && !('through' in tenant.scope)) {
-        // Direct: add tenant to WHERE
         extraCondition = new ConditionBuilder('AND');
         if (tenant.ids.length === 1) {
             extraCondition.isEqual(tenant.scope.column, tenant.ids[0]);
@@ -57,7 +62,7 @@ export async function updateEngine(params) {
         }
     }
     if (hasFieldsToUpdate) {
-        const affectedRows = await db.update(tableConf.Schema.tableName, updateFields, { [pkCol]: pkValue }, extraCondition);
+        const affectedRows = await db.update(schema.tableName, updateFields, { [pkCol]: pkValue }, extraCondition);
         if (affectedRows === 0) {
             const error = new Error(`Record not found`);
             error.statusCode = 404;
@@ -66,14 +71,14 @@ export async function updateEngine(params) {
     }
     else {
         // No fields to update: verify the record exists (for secondaries/deletions)
-        let whereSql = `${db.qi(tableConf.Schema.tableName)}.${db.qi(pkCol)} = ${db.ph(1)}`;
+        let whereSql = `${db.qi(schema.tableName)}.${db.qi(pkCol)} = ${db.ph(1)}`;
         const whereValues = [pkValue];
         if (extraCondition) {
             whereSql += ` AND ${extraCondition.build(2, db.ph)}`;
             whereValues.push(...extraCondition.getValues());
         }
         const rows = await db.select({
-            tableName: tableConf.Schema.tableName,
+            tableName: schema.tableName,
             where: whereSql,
             values: whereValues,
             limit: '1',
@@ -86,19 +91,18 @@ export async function updateEngine(params) {
     }
     // Build the main response (PK-only)
     const mainResult = { [pk]: pkValue };
-    // 4. Secondaries (upsert/insert with FK auto-fill)
+    // 8. Secondaries (upsert/insert with FK auto-fill — camelCase)
     let secondaryResults;
     if (secondaries && Object.keys(secondaries).length > 0) {
-        // Merge input fields + PK for FK auto-fill
-        const mainForFK = { ...camelcaseObject(snaked) };
+        const mainForFK = { ...inputRecord };
         secondaryResults = await processSecondaries(db, tableConf, dbTables, mainForFK, secondaries);
     }
-    // 5. Deletions
+    // 9. Deletions
     let deletionResults;
     if (deletions && Object.keys(deletions).length > 0) {
         deletionResults = await processDeletions(db, tableConf, deletions);
     }
-    // 6. Return PK-only
+    // 10. Return PK-only
     const result = { main: mainResult };
     if (secondaryResults && Object.keys(secondaryResults).length > 0) {
         result.secondaries = secondaryResults;

package/dist/lib/engine/search/search.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/search/search.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,QAAQ,EAER,YAAY,EACZ,YAAY,EASb,MAAM,mBAAmB,CAAC;AA+V3B,wBAAsB,YAAY,CAChC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,CAyDvB"}
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/search/search.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,QAAQ,EAER,YAAY,EACZ,YAAY,EAUb,MAAM,mBAAmB,CAAC;AA+lB3B,wBAAsB,YAAY,CAChC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,CA2EvB"}

package/dist/lib/engine/search/search.js

@@ -10,19 +10,112 @@ function validateSchemaField(field, schema) {
     }
     return schema.col(field);
 }
-function validateOrderBy(orderBy, tableConf, db) {
-    return orderBy.split(',').map((part) => {
+const AGG_FN_SQL = {
+    sum: 'SUM',
+    min: 'MIN',
+    max: 'MAX',
+    avg: 'AVG',
+    count: 'COUNT',
+    distinctCount: 'COUNT DISTINCT', // marker, handled specially
+};
+function buildAggOrderExpr(db, dbTables, tableConf, joinTableName, fn, field, joinGroups, startIdx) {
+    const err400 = (msg) => {
+        const e = new Error(msg);
+        e.statusCode = 400;
+        throw e;
+    };
+    // Whitelist fn
+    if (!(fn in AGG_FN_SQL)) {
+        err400(`Invalid aggregation function: ${fn}`);
+    }
+    // Require joinGroups declaration for the referenced table + fn + field
+    const groupReq = joinGroups?.[joinTableName];
+    if (!groupReq) {
+        err400(`orderBy references undeclared joinGroup: ${joinTableName}`);
+    }
+    const declaredFields = groupReq.aggregations[fn];
+    if (!Array.isArray(declaredFields) || !declaredFields.includes(field)) {
+        err400(`orderBy references undeclared aggregation: ${joinTableName}.${fn}.${field}`);
+    }
+    // Resolve join definition
+    const joinDef = tableConf.allowedReadJoins?.find(([js]) => js.tableName === joinTableName);
+    if (!joinDef) {
+        err400(`Unknown join table in orderBy: ${joinTableName}`);
+    }
+    const [joinSchema, joinField, mainField] = joinDef;
+    // If joinGroup has `by`, only accept it when `by` is the correlation FK (joinField).
+    // In that case each main row corresponds to exactly one group, so the scalar
+    // subquery is semantically equivalent to no-by. Any other `by` produces multiple
+    // groups per main row → not a single scalar, reject.
+    if (groupReq.aggregations.by && groupReq.aggregations.by !== joinField) {
+        err400(`Cannot order by aggregation on joinGroup with 'by' clause on non-FK column: ${joinTableName} (grouped by '${groupReq.aggregations.by}', correlation FK is '${joinField}')`);
+    }
+    // Validate field exists on join schema
+    const fieldCol = validateSchemaField(field, joinSchema);
+    // Build correlation: joinTable.fk = mainTable.main_pk
+    const mainColName = Array.isArray(mainField) ? mainField[0] : mainField;
+    const mainCol = db.qi(tableConf.Schema.col(mainColName));
+    const mainTable = db.qi(tableConf.Schema.tableName);
+    const joinTable = db.qi(joinSchema.tableName);
+    const fkCol = db.qi(joinSchema.col(joinField));
+    // Rebuild joinGroup filters + conditions with correct placeholder offset
+    let filterWhere = '';
+    let filterVals = [];
+    const joinTableConf = dbTables[joinTableName];
+    if ((groupReq.filters || groupReq.conditions?.length) && joinSchema) {
+        const cb = buildJoinRefCondition(joinTableConf, joinSchema, { filters: groupReq.filters, conditions: groupReq.conditions }, db);
+        const built = cb.build(startIdx, db.ph);
+        if (built) {
+            filterWhere = ` AND ${built}`;
+            filterVals = cb.getValues();
+        }
+    }
+    // Generate SQL expression
+    const qField = db.qi(fieldCol);
+    const fnSql = AGG_FN_SQL[fn];
+    const aggExpr = fnSql === 'COUNT DISTINCT'
+        ? `COUNT(DISTINCT ${joinTable}.${qField})`
+        : `${fnSql}(${joinTable}.${qField})`;
+    // COALESCE with 0 so main rows without matching joined records get a sortable
+    // numeric value instead of NULL. Works on all dialects (PG/MySQL/MariaDB) and
+    // keeps "no data" at the bottom on DESC (top-N queries), and at the top on ASC.
+    const expr = `COALESCE((SELECT ${aggExpr} FROM ${joinTable} WHERE ${joinTable}.${fkCol} = ${mainTable}.${mainCol}${filterWhere}), 0)`;
+    return { expr, values: filterVals };
+}
+function validateOrderBy(orderBy, tableConf, db, dbTables, joinGroups, startIdx) {
+    const parts = orderBy.split(',');
+    const outParts = [];
+    const outValues = [];
+    let currentIdx = startIdx;
+    for (const part of parts) {
         const trimmed = part.trim();
-        const match = trimmed.match(/^(\w+)(?:\s+(ASC|DESC))?$/i);
-        if (!match) {
+        // Dotted notation: <joinTable>.<fn>.<field> [ASC|DESC]
+        const dottedMatch = trimmed.match(/^(\w+)\.(\w+)\.(\w+)(?:\s+(ASC|DESC))?$/i);
+        if (dottedMatch) {
+            if (tableConf.distinctResults) {
+                const err = new Error('Cannot combine distinctResults with aggregation orderBy');
+                err.statusCode = 400;
+                throw err;
+            }
+            const [, joinTableName, fn, field, dir] = dottedMatch;
+            const { expr, values } = buildAggOrderExpr(db, dbTables, tableConf, joinTableName, fn, field, joinGroups, currentIdx);
+            outParts.push(`${expr} ${(dir || 'ASC').toUpperCase()}`);
+            outValues.push(...values);
+            currentIdx += values.length;
+            continue;
+        }
+        // Plain field: <field> [ASC|DESC]
+        const plainMatch = trimmed.match(/^(\w+)(?:\s+(ASC|DESC))?$/i);
+        if (!plainMatch) {
             const err = new Error(`Invalid orderBy: ${trimmed}`);
             err.statusCode = 400;
             throw err;
         }
-        const [, field, dir] = match;
+        const [, field, dir] = plainMatch;
         const col = validateSchemaField(field, tableConf.Schema);
-        return `${db.qi(col)} ${(dir || 'ASC').toUpperCase()}`;
-    }).join(', ');
+        outParts.push(`${db.qi(col)} ${(dir || 'ASC').toUpperCase()}`);
+    }
+    return { sql: outParts.join(', '), values: outValues };
 }
 async function executeMainQuery(db, tableConf, where, values, orderBy, paginator, extraJoins = []) {
     const tableName = tableConf.Schema.tableName;
@@ -39,7 +132,7 @@ async function executeMainQuery(db, tableConf, where, values, orderBy, paginator
         distinct: tableConf.distinctResults,
         joins: extraJoins.length > 0 ? extraJoins : undefined,
     });
-    return rows.map((r) => camelcaseObject(r));
+    return rows.map((r) => camelcaseObject(r, tableConf.Schema));
 }
 async function buildPagination(db, tableConf, where, values, paginator, extraJoins = [], computeMin, computeMax, computeSum, computeAvg) {
     const tableName = tableConf.Schema.tableName;
@@ -72,7 +165,7 @@ function findJoinDefinition(tableConf, joinTableName) {
 }
 async function executeVirtualJoins(db, dbTables, tableConf, mainResults, joins) {
     const result = {};
-    for (const [joinTableName, joinOpts] of Object.entries(joins)) {
+    for (const [joinTableName, joinRef] of Object.entries(joins)) {
         const joinDef = findJoinDefinition(tableConf, joinTableName);
         if (!joinDef)
             continue;
@@ -84,22 +177,27 @@ async function executeVirtualJoins(db, dbTables, tableConf, mainResults, joins)
             result[joinTableName] = [];
             continue;
         }
-        // Build join filters
-        const cb = joinTableConf
-            ? joinTableConf.filters(joinOpts?.filters || {})
-            : new ConditionBuilder('AND');
+        // Build join filters (equality) + rich conditions
+        const cb = buildJoinRefCondition(joinTableConf, joinSchema, joinRef || {}, db);
         const fkCol = joinSchema.col(joinField);
         cb.isIn(db.qi(fkCol), ids);
         const where = cb.build(1, db.ph);
         const values = cb.getValues();
-        const columns = selection === '*' ? '*' : selection;
+        // selection is a comma-separated list of field names (camelCase API names).
+        // Resolve each to its DB column via schema.col() and quote it.
+        const columns = selection === '*'
+            ? '*'
+            : selection.split(',').map((c) => {
+                const field = c.trim();
+                return db.qi(joinSchema.col(field));
+            }).join(', ');
         const rows = await db.select({
             tableName: joinSchema.tableName,
             columns,
             where,
             values,
         });
-        result[joinTableName] = rows.map((r) => camelcaseObject(r));
+        result[joinTableName] = rows.map((r) => camelcaseObject(r, joinSchema));
     }
     return result;
 }
@@ -115,7 +213,7 @@ async function executeJoinGroups(db, dbTables, tableConf, mainResults, joinGroup
             result[joinTableName] = {};
             continue;
         }
-        const { aggregations, filters: groupFilters } = groupReq;
+        const { aggregations, filters: groupFilters, conditions: groupConditions } = groupReq;
         const selectParts = [];
         const groupByParts = [];
         if (aggregations.by) {
@@ -147,15 +245,25 @@ async function executeJoinGroups(db, dbTables, tableConf, mainResults, joinGroup
                 selectParts.push(`SUM(${db.qi(col)}) as "sum_${f}"`);
             }
         }
+        if (aggregations.avg) {
+            for (const f of aggregations.avg) {
+                const col = validateSchemaField(f, joinSchema);
+                selectParts.push(`AVG(${db.qi(col)}) as "avg_${f}"`);
+            }
+        }
+        if (aggregations.count) {
+            for (const f of aggregations.count) {
+                const col = validateSchemaField(f, joinSchema);
+                selectParts.push(`COUNT(${db.qi(col)}) as "count_${f}"`);
+            }
+        }
         if (selectParts.length === 0) {
             result[joinTableName] = {};
             continue;
         }
-        // Build WHERE clause
+        // Build WHERE clause: equality filters + rich conditions
         const joinTableConf = dbTables[joinTableName];
-        const cb = joinTableConf && groupFilters
-            ? joinTableConf.filters(groupFilters)
-            : new ConditionBuilder('AND');
+        const cb = buildJoinRefCondition(joinTableConf, joinSchema, { filters: groupFilters, conditions: groupConditions }, db);
         const fkCol = joinSchema.col(joinField);
         cb.isIn(db.qi(fkCol), ids);
         const where = cb.build(1, db.ph);
@@ -205,8 +313,47 @@ function collectIds(mainResults, mainField) {
 }
 // ─── Conditions (advanced filters) ──────────────────────────
 import { ALLOWED_SET, SINGLE_VALUE_SET, BETWEEN_SET, IN_SET, NULL_SET, } from '../../condition-methods.js';
+function dispatchConditionMethod(cb, method, colOrExpr, params) {
+    if (SINGLE_VALUE_SET.has(method)) {
+        cb[method](colOrExpr, params[0]);
+    }
+    else if (BETWEEN_SET.has(method)) {
+        cb[method](colOrExpr, params[0], params[1]);
+    }
+    else if (IN_SET.has(method)) {
+        cb[method](colOrExpr, params[0]);
+    }
+    else if (NULL_SET.has(method)) {
+        cb[method](colOrExpr, true);
+    }
+}
+/**
+ * Build a ConditionBuilder that applies both equality filters and rich conditions
+ * to a join schema. Used by joinFilters (EXISTS), virtual joins data fetching,
+ * and joinGroups (aggregation WHERE + orderBy scalar subquery).
+ */
+function buildJoinRefCondition(joinTableConf, joinSchema, ref, db) {
+    const cb = (ref.filters && joinTableConf)
+        ? joinTableConf.filters(ref.filters)
+        : new ConditionBuilder('AND');
+    if (ref.conditions?.length) {
+        for (const c of ref.conditions) {
+            if (!ALLOWED_SET.has(c.method)) {
+                const err = new Error(`Invalid condition method: ${c.method}`);
+                err.statusCode = 400;
+                throw err;
+            }
+            const col = db.qi(validateSchemaField(c.field, joinSchema));
+            dispatchConditionMethod(cb, c.method, col, c.params ?? []);
+        }
+    }
+    return cb;
+}
 function applyConditions(condition, conditions, schema, db) {
     for (const c of conditions) {
+        // Skip dot-notation fields — those become aggregation conditions processed later
+        if (c.field.includes('.'))
+            continue;
         // Validate method — whitelist only, blocks prototype poisoning
         if (!ALLOWED_SET.has(c.method)) {
             const err = new Error(`Invalid condition method: ${c.method}`);
@@ -214,33 +361,61 @@ function applyConditions(condition, conditions, schema, db) {
             throw err;
         }
         const col = db.qi(validateSchemaField(c.field, schema));
-        if (SINGLE_VALUE_SET.has(c.method)) {
-            condition[c.method](col, c.params[0]);
-        }
-        else if (BETWEEN_SET.has(c.method)) {
-            condition[c.method](col, c.params[0], c.params[1]);
-        }
-        else if (IN_SET.has(c.method)) {
-            condition[c.method](col, c.params[0]);
+        dispatchConditionMethod(condition, c.method, col, c.params);
+    }
+}
+/**
+ * Append aggregation-based conditions (HAVING-style) to the main WHERE clause.
+ * For each condition with a dotted field like `session.count.id`, builds a
+ * correlated scalar subquery (reusing buildAggOrderExpr) and uses it as the
+ * left-hand side of a ConditionBuilder method.
+ *
+ * Runs after the base WHERE / joinFilters are built so placeholder offsets
+ * are correct.
+ */
+function appendAggConditions(currentWhere, currentValues, conditions, db, dbTables, tableConf, joinGroups) {
+    let where = currentWhere;
+    let values = [...currentValues];
+    for (const c of conditions) {
+        if (!c.field.includes('.'))
+            continue;
+        if (!ALLOWED_SET.has(c.method)) {
+            const err = new Error(`Invalid condition method: ${c.method}`);
+            err.statusCode = 400;
+            throw err;
         }
-        else if (NULL_SET.has(c.method)) {
-            condition[c.method](col, true);
+        const parts = c.field.split('.');
+        if (parts.length !== 3) {
+            const err = new Error(`Invalid dotted field in condition: ${c.field} (expected <joinTable>.<fn>.<field>)`);
+            err.statusCode = 400;
+            throw err;
         }
+        const [joinTableName, fn, field] = parts;
+        // Build the scalar subquery; values for its filters are appended to the main values array.
+        const { expr, values: exprValues } = buildAggOrderExpr(db, dbTables, tableConf, joinTableName, fn, field, joinGroups, values.length + 1);
+        values = [...values, ...exprValues];
+        // Use a temporary ConditionBuilder to generate "<expr> <op> <placeholder>" with
+        // the correct placeholder offset, then merge it back into the main values.
+        const tmpCb = new ConditionBuilder('AND');
+        dispatchConditionMethod(tmpCb, c.method, expr, c.params);
+        const startIdx = values.length + 1;
+        const clause = tmpCb.build(startIdx, db.ph);
+        where += ` AND ${clause}`;
+        values.push(...tmpCb.getValues());
     }
+    return { where, values };
 }
 // ─── Join filters (EXISTS subquery) ─────────────────────────
 function buildJoinFiltersExists(db, dbTables, tableConf, joinFilters, currentWhere, currentValues) {
     let where = currentWhere;
     const values = [...currentValues];
-    for (const [joinTableName, filterValues] of Object.entries(joinFilters)) {
+    for (const [joinTableName, ref] of Object.entries(joinFilters)) {
         const joinDef = findJoinDefinition(tableConf, joinTableName);
         if (!joinDef)
             continue;
         const [joinSchema, joinField, mainField] = joinDef;
         const joinTableConf = dbTables[joinTableName];
-        if (!joinTableConf)
-            continue;
-        const filterCondition = joinTableConf.filters(filterValues);
+        const filterCondition = buildJoinRefCondition(joinTableConf, joinSchema, ref, db);
         const startIdx = values.length + 1;
         const filterWhere = filterCondition.build(startIdx, db.ph);
         const filterVals = filterCondition.getValues();
@@ -248,7 +423,11 @@ function buildJoinFiltersExists(db, dbTables, tableConf, joinFilters, currentWhe
         const mainColName = Array.isArray(mainField) ? mainField[0] : mainField;
         const mainCol = db.qi(tableConf.Schema.col(mainColName));
         const mainTable = db.qi(tableConf.Schema.tableName);
-        where += ` AND EXISTS (SELECT 1 FROM ${db.qi(joinSchema.tableName)} WHERE ${fkCol} = ${mainTable}.${mainCol} AND ${filterWhere})`;
+        // If there are no inner conditions, just the correlation suffices.
+        const innerWhere = filterWhere
+            ? `${fkCol} = ${mainTable}.${mainCol} AND ${filterWhere}`
+            : `${fkCol} = ${mainTable}.${mainCol}`;
+        where += ` AND EXISTS (SELECT 1 FROM ${db.qi(joinSchema.tableName)} WHERE ${innerWhere})`;
         values.push(...filterVals);
     }
     return { where, values };
@@ -275,11 +454,28 @@ export async function searchEngine(dbTables, params) {
     if (joinFilters && Object.keys(joinFilters).length > 0) {
         ({ where, values } = buildJoinFiltersExists(db, dbTables, tableConf, joinFilters, where, values));
     }
+    // Aggregation conditions (HAVING-style): dotted fields in `conditions` are
+    // translated into scalar subqueries using the joinGroup aggregation.
+    if (conditions?.length) {
+        const hasAggConditions = conditions.some((c) => c.field.includes('.'));
+        if (hasAggConditions) {
+            ({ where, values } = appendAggConditions(where, values, conditions, db, dbTables, tableConf, joinGroups));
+        }
+    }
     // Validate and sanitize orderBy (user input -> SQL identifier)
-    const safeOrderBy = orderBy ? validateOrderBy(orderBy, tableConf, db) : undefined;
-    // Main query
-    const main = await executeMainQuery(db, tableConf, where, values, safeOrderBy, paginator, tenantJoins);
-    // Pagination
+    // Note: orderBy aggregation values are kept separate from WHERE values,
+    // so that buildPagination (which doesn't use ORDER BY) only binds WHERE params.
+    let safeOrderBy;
+    let orderByValues = [];
+    if (orderBy) {
+        const obResult = validateOrderBy(orderBy, tableConf, db, dbTables, joinGroups, values.length + 1);
+        safeOrderBy = obResult.sql;
+        orderByValues = obResult.values;
+    }
+    // Main query: bind WHERE values + orderBy aggregation values
+    const mainValues = [...values, ...orderByValues];
+    const main = await executeMainQuery(db, tableConf, where, mainValues, safeOrderBy, paginator, tenantJoins);
+    // Pagination: bind only WHERE values (COUNT/compute queries don't use ORDER BY)
     let pagination;
     if (paginator) {
         pagination = await buildPagination(db, tableConf, where, values, paginator, tenantJoins, computeMin, computeMax, computeSum, computeAvg);

package/dist/lib/engine/validate.d.ts

@@ -0,0 +1,11 @@
+import type { FastifyRequest } from 'fastify';
+import type { QueryClient } from '../db.js';
+import type { ITable, BulkValidatorItem } from '../../types.js';
+export interface ValidationResponseField {
+    path: string;
+    code: string;
+    message: string;
+}
+export declare function runValidation(db: QueryClient, request: FastifyRequest, tableConf: ITable, main: Record<string, unknown>, secondaries?: Record<string, Record<string, unknown>[]>): Promise<void>;
+export declare function runBulkValidation(db: QueryClient, request: FastifyRequest, tableConf: ITable, items: BulkValidatorItem[]): Promise<void>;
+//# sourceMappingURL=validate.d.ts.map

package/dist/lib/engine/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/lib/engine/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAmB,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEjF,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAUD,wBAAsB,aAAa,CACjC,EAAE,EAAE,WAAW,EACf,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,GACtD,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,WAAW,EACf,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,iBAAiB,EAAE,GACzB,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/lib/engine/validate.js

@@ -0,0 +1,29 @@
+function toResponseFields(errors) {
+    return errors.map(([path, code, message]) => ({
+        path,
+        code,
+        message: message ?? code,
+    }));
+}
+export async function runValidation(db, request, tableConf, main, secondaries) {
+    if (!tableConf.validate)
+        return;
+    const errors = await tableConf.validate(db, request, main, secondaries);
+    if (errors.length > 0) {
+        throwValidationError(toResponseFields(errors));
+    }
+}
+export async function runBulkValidation(db, request, tableConf, items) {
+    if (!tableConf.validateBulk)
+        return;
+    const errors = await tableConf.validateBulk(db, request, items);
+    if (errors.length > 0) {
+        throwValidationError(toResponseFields(errors));
+    }
+}
+function throwValidationError(fields) {
+    const error = new Error('Validation failed');
+    error.statusCode = 400;
+    error.validationErrors = fields;
+    throw error;
+}

package/dist/lib/engine/write-helpers.js

@@ -35,7 +35,7 @@ export async function processSecondaries(db, tableConf, dbTables, mainRecord, se
             ? secondaryPk.map((f) => joinSchema.col(f))
             : joinSchema.col(secondaryPk);
         const preparedRecords = records.map((rec) => {
-            let prepared = snakecaseRecord(rec);
+            let prepared = snakecaseRecord(rec, joinSchema);
             // Auto-fill FK from main record
             const mainValue = Array.isArray(mainField)
                 ? mainRecord[mainField[0]]
@@ -56,7 +56,7 @@ export async function processSecondaries(db, tableConf, dbTables, mainRecord, se
         else {
             pkRows = await db.bulkInsert(joinSchema.tableName, preparedRecords, secondaryPkCol);
         }
-        results[joinTableName] = pkRows.map((r) => camelcaseObject(r));
+        results[joinTableName] = pkRows.map((r) => camelcaseObject(r, joinSchema));
     }
     return results;
 }
@@ -71,10 +71,10 @@ export async function processDeletions(db, tableConf, deletions) {
         const [joinSchema] = joinDef;
         const deletedRows = [];
         for (const rec of records) {
-            const snaked = snakecaseRecord(rec);
+            const snaked = snakecaseRecord(rec, joinSchema);
             const affectedRows = await db.delete(joinSchema.tableName, snaked);
             if (affectedRows > 0) {
-                deletedRows.push(camelcaseObject(snaked));
+                deletedRows.push(camelcaseObject(snaked, joinSchema));
             }
         }
         results[joinTableName] = deletedRows;

package/dist/lib/naming.d.ts

@@ -1,6 +1,15 @@
+import type { SchemaDefinition } from '../types.js';
 export declare function toCamelCase(str: string): string;
 export declare function toUnderscore(str: string): string;
-export declare function camelcaseObject<T extends Record<string, unknown>>(obj: T): Record<string, unknown>;
-export declare function snakecaseRecord(obj: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Convert API record (camelCase keys) to DB record (actual column names).
+ * Uses schema.colMap when available, falls back to toUnderscore.
+ */
+export declare function snakecaseRecord(obj: Record<string, unknown>, schema?: SchemaDefinition): Record<string, unknown>;
+/**
+ * Convert DB row (actual column names) to API record (camelCase field names).
+ * Uses schema.colMap when available, falls back to toCamelCase.
+ */
+export declare function camelcaseObject<T extends Record<string, unknown>>(obj: T, schema?: SchemaDefinition): Record<string, unknown>;
 export declare function toSchemaName(tableName: string): string;
 //# sourceMappingURL=naming.d.ts.map

package/dist/lib/naming.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"naming.d.ts","sourceRoot":"","sources":["../../src/lib/naming.ts"],"names":[],"mappings":"AAAA,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMhD;AAED,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/D,GAAG,EAAE,CAAC,GACL,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIzB;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIzB;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAQtD"}
+{"version":3,"file":"naming.d.ts","sourceRoot":"","sources":["../../src/lib/naming.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMhD;AAiBD;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,MAAM,CAAC,EAAE,gBAAgB,GACxB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOzB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/D,GAAG,EAAE,CAAC,EACN,MAAM,CAAC,EAAE,gBAAgB,GACxB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzB;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAQtD"}