fastify-auto-sqlapi 0.0.4 → 0.1.1

package/dist/lib/engine/rest/insert.js

@@ -1,58 +1,39 @@
-import { camelcaseObject, snakecaseRecord } from '../../naming.js';
-import { removeExcludedFields, processSecondaries } from '../write-helpers.js';
-import { injectTenantValue, validateTenantFK } from '../../tenant.js';
-import { runValidation } from '../validate.js';
+import { camelcaseObject } from '../../naming.js';
+import { processSecondaries, prepareInsertRecord } from '../write-helpers.js';
+import { enforceTenantOnWrites } from '../../tenant.js';
 import { primaryAsString } from '../../../types.js';
 export async function insertEngine(params) {
     const { db, tableConf, dbTables, request, record, secondaries, tenant } = params;
+    const schema = tableConf.Schema;
     const pk = primaryAsString(tableConf.primary);
-    const pkCol = tableConf.Schema.col(pk);
-    // 1. Prepare main record
-    let mainRecord = snakecaseRecord(record);
-    mainRecord = removeExcludedFields(mainRecord, tableConf);
-    // 1b. Tenant: inject or validate
-    if (tenant) {
-        if ('through' in tenant.scope) {
-            // Indirect: validate FK belongs to tenant
-            const scope = tenant.scope;
-            const fkCol = scope.through.localField;
-            const fkValue = mainRecord[fkCol];
-            await validateTenantFK(db, scope, tenant.ids, [fkValue]);
-        }
-        else {
-            injectTenantValue(mainRecord, tenant.scope, tenant.ids);
-        }
-    }
-    // 2. Custom validation (receives original camelCase record)
-    await runValidation(db, request, tableConf, record, secondaries);
-    // 3. beforeInsert hook
-    if (tableConf.beforeInsert) {
-        await tableConf.beforeInsert(db, request, mainRecord);
-    }
-    // 4. Insert main → returns PK-only
+    const pkCol = schema.col(pk);
+    // 1. Validate, run beforeInsert hook, snakecase, drop excluded fields.
+    const { camel: inputRecord, snake: mainRecord } = await prepareInsertRecord({ db, tableConf, request }, record, secondaries);
+    // 2. Tenant: inject (direct) or validate FK (indirect) — enforced after user mutations
+    await enforceTenantOnWrites(db, tenant, [mainRecord]);
+    // 3. Insert main → returns PK-only
     let pkResult;
-    const upsertKeys = tableConf.upsertMap?.get(tableConf.Schema);
+    const upsertKeys = tableConf.upsertMap?.get(schema);
     if (upsertKeys) {
-        const conflictCols = upsertKeys.map((k) => tableConf.Schema.col(k));
-        pkResult = await db.insertOrUpdate(tableConf.Schema.tableName, mainRecord, conflictCols, pkCol);
+        const conflictCols = upsertKeys.map((k) => schema.col(k));
+        pkResult = await db.insertOrUpdate(schema.tableName, mainRecord, conflictCols, pkCol);
     }
     else {
-        pkResult = await db.insert(tableConf.Schema.tableName, mainRecord, pkCol);
+        pkResult = await db.insert(schema.tableName, mainRecord, pkCol);
     }
-    const mainPkCamel = camelcaseObject(pkResult);
-    // 5. Secondaries: need full record for FK auto-fill
+    const mainPkCamel = camelcaseObject(pkResult, schema);
+    // 4. Secondaries: need full record for FK auto-fill (camelCase)
     let secondaryResults;
     if (secondaries && Object.keys(secondaries).length > 0) {
-        // Merge input record + PK for FK auto-fill
-        const mainForFK = { ...camelcaseObject(mainRecord), ...mainPkCamel };
+        const mainForFK = { ...inputRecord, ...mainPkCamel };
         secondaryResults = await processSecondaries(db, tableConf, dbTables, mainForFK, secondaries);
     }
-    // 6. afterInsert hook
+    // 5. afterInsert hook (camelCase — input merged with generated PK)
     if (tableConf.afterInsert) {
-        const mainForHook = { ...camelcaseObject(mainRecord), ...mainPkCamel };
+        const mainForHook = { ...inputRecord, ...mainPkCamel };
         await tableConf.afterInsert(db, request, mainForHook, secondaryResults);
     }
-    // 7. Return PK-only
+    // 6. Return PK-only
     const result = { main: mainPkCamel };
     if (secondaryResults && Object.keys(secondaryResults).length > 0) {
         result.secondaries = secondaryResults;

package/dist/lib/engine/rest/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/update.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAGb,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAgI9E"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/update.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA+F9E"}

package/dist/lib/engine/rest/update.js

@@ -1,107 +1,75 @@
-import { camelcaseObject, snakecaseRecord } from '../../naming.js';
+import { snakecaseRecord } from '../../naming.js';
 import { processSecondaries, processDeletions } from '../write-helpers.js';
-import { stripTenantColumn, buildTenantCondition, buildTenantJoin } from '../../tenant.js';
+import { stripTenantColumn, assertTenantOwnership, buildTenantUpdateExtra, } from '../../tenant.js';
 import { runValidation } from '../validate.js';
-import { ConditionBuilder } from 'node-condition-builder';
+import { httpError } from '../../errors.js';
 import { primaryAsString } from '../../../types.js';
 export async function updateEngine(params) {
     const { db, tableConf, dbTables, request, record, secondaries, deletions, tenant } = params;
-    // 1. Prepare: extract PK, snakecase, build update fields
+    const schema = tableConf.Schema;
     const pk = primaryAsString(tableConf.primary);
-    const pkCol = tableConf.Schema.col(pk);
-    const snaked = snakecaseRecord(record);
-    const pkValue = snaked[pkCol];
-    if (pkValue == null) {
-        const error = new Error(`Primary key "${pk}" is required`);
-        error.statusCode = 400;
-        throw error;
+    const pkCol = schema.col(pk);
+    const pkValue = record[pk];
+    if (pkValue == null)
+        throw httpError(400, `Primary key "${pk}" is required`);
+    // 1. Tenant ownership check (indirect) — do it early so user mutations don't run on records they can't access
+    await assertTenantOwnership(db, tenant, schema.tableName, pkCol, pkValue);
+    // 2. Mutable copy of input in camelCase
+    const inputRecord = { ...record };
+    // 3. Custom validation (camelCase)
+    await runValidation(db, request, tableConf, inputRecord, secondaries);
+    // 4. beforeUpdate hook (camelCase — user can mutate with schema field names)
+    if (tableConf.beforeUpdate) {
+        await tableConf.beforeUpdate(db, request, inputRecord);
     }
+    // 5. Convert to DB format (after all user mutations)
+    const snaked = snakecaseRecord(inputRecord, schema);
     const updateFields = { ...snaked };
     delete updateFields[pkCol];
-    // 1b. Tenant: strip tenant column from update fields + validate ownership
+    // 6. Strip tenant column (user cannot change tenant of an existing record)
     if (tenant) {
         stripTenantColumn(updateFields, tenant.scope);
-        if ('through' in tenant.scope) {
-            // Indirect: verify the record belongs to tenant via subquery
-            const scope = tenant.scope;
-            const tableName = tableConf.Schema.tableName;
-            const cb = new ConditionBuilder('AND');
-            cb.isEqual(`${db.qi(tableName)}.${db.qi(pkCol)}`, pkValue);
-            cb.append(buildTenantCondition(db, scope, tenant.ids));
-            const checkWhere = cb.build(1, db.ph);
-            const checkValues = cb.getValues();
-            const joinSql = buildTenantJoin(db, scope, tableName);
-            const checkSql = `SELECT 1 FROM ${db.qi(tableName)} ${joinSql} WHERE ${checkWhere} LIMIT 1`;
-            const checkResult = await db.query(checkSql, checkValues);
-            if (checkResult.rows.length === 0) {
-                const error = new Error('Record not found');
-                error.statusCode = 404;
-                throw error;
-            }
-        }
     }
-    // 2. Custom validation (receives original camelCase record)
-    await runValidation(db, request, tableConf, record, secondaries);
-    // 3. beforeUpdate hook
-    if (tableConf.beforeUpdate) {
-        await tableConf.beforeUpdate(db, request, updateFields);
-    }
-    // 4. Update main
+    // 7. Update main
     const hasFieldsToUpdate = Object.keys(updateFields).length > 0;
-    let extraCondition;
-    if (tenant && !('through' in tenant.scope)) {
-        // Direct: add tenant to WHERE
-        extraCondition = new ConditionBuilder('AND');
-        if (tenant.ids.length === 1) {
-            extraCondition.isEqual(tenant.scope.column, tenant.ids[0]);
-        }
-        else {
-            extraCondition.isIn(tenant.scope.column, tenant.ids);
-        }
-    }
+    const extraCondition = buildTenantUpdateExtra(tenant);
     if (hasFieldsToUpdate) {
-        const affectedRows = await db.update(tableConf.Schema.tableName, updateFields, { [pkCol]: pkValue }, extraCondition);
-        if (affectedRows === 0) {
-            const error = new Error(`Record not found`);
-            error.statusCode = 404;
-            throw error;
-        }
+        const affectedRows = await db.update(schema.tableName, updateFields, { [pkCol]: pkValue }, extraCondition);
+        if (affectedRows === 0)
+            throw httpError(404, `Record not found`);
     }
     else {
         // No fields to update: verify the record exists (for secondaries/deletions)
-        let whereSql = `${db.qi(tableConf.Schema.tableName)}.${db.qi(pkCol)} = ${db.ph(1)}`;
+        let whereSql = `${db.qi(schema.tableName)}.${db.qi(pkCol)} = ${db.ph(1)}`;
         const whereValues = [pkValue];
         if (extraCondition) {
             whereSql += ` AND ${extraCondition.build(2, db.ph)}`;
             whereValues.push(...extraCondition.getValues());
         }
         const rows = await db.select({
-            tableName: tableConf.Schema.tableName,
+            tableName: schema.tableName,
             where: whereSql,
             values: whereValues,
             limit: '1',
         });
-        if (rows.length === 0) {
-            const error = new Error(`Record not found`);
-            error.statusCode = 404;
-            throw error;
-        }
+        if (rows.length === 0)
+            throw httpError(404, `Record not found`);
     }
     // Build the main response (PK-only)
     const mainResult = { [pk]: pkValue };
-    // 5. Secondaries (upsert/insert with FK auto-fill)
+    // 8. Secondaries (upsert/insert with FK auto-fill — camelCase)
     let secondaryResults;
     if (secondaries && Object.keys(secondaries).length > 0) {
-        // Merge input fields + PK for FK auto-fill
-        const mainForFK = { ...camelcaseObject(snaked) };
+        const mainForFK = { ...inputRecord };
         secondaryResults = await processSecondaries(db, tableConf, dbTables, mainForFK, secondaries);
     }
-    // 6. Deletions
+    // 9. Deletions (FK auto-fill from main like secondaries)
     let deletionResults;
     if (deletions && Object.keys(deletions).length > 0) {
-        deletionResults = await processDeletions(db, tableConf, deletions);
+        const mainForFK = { ...inputRecord };
+        deletionResults = await processDeletions(db, tableConf, mainForFK, deletions);
     }
-    // 7. Return PK-only
+    // 10. Return PK-only
     const result = { main: mainResult };
     if (secondaryResults && Object.keys(secondaryResults).length > 0) {
         result.secondaries = secondaryResults;

package/dist/lib/engine/search/search.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/search/search.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,QAAQ,EAER,YAAY,EACZ,YAAY,EASb,MAAM,mBAAmB,CAAC;AA+V3B,wBAAsB,YAAY,CAChC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,CAyDvB"}
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/search/search.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,QAAQ,EACR,YAAY,EACZ,YAAY,EAab,MAAM,mBAAmB,CAAC;AAy/B3B,wBAAsB,YAAY,CAChC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,CAoIvB"}