fastify-auto-sqlapi 0.0.5 → 0.1.2

package/dist/lib/tenant.js

@@ -1,4 +1,5 @@
 import { ConditionBuilder } from 'node-condition-builder';
+import { httpError } from './errors.js';
 function isIndirect(scope) {
     return 'through' in scope;
 }
@@ -39,9 +40,7 @@ export function injectTenantValue(record, scope, tenantIds) {
     const col = scope.column;
     if (col in record) {
         if (!tenantIds.includes(record[col])) {
-            const err = new Error('Access denied: tenant value does not match');
-            err.statusCode = 403;
-            throw err;
+            throw httpError(403, 'Access denied: tenant value does not match');
         }
         return;
     }
@@ -49,9 +48,7 @@ export function injectTenantValue(record, scope, tenantIds) {
         record[col] = tenantIds[0];
         return;
     }
-    const err = new Error('Ambiguous tenant: specify the tenant value');
-    err.statusCode = 400;
-    throw err;
+    throw httpError(400, 'Ambiguous tenant: specify the tenant value');
 }
 export async function validateTenantFK(db, scope, tenantIds, fkValues) {
     if (!fkValues.length)
@@ -71,9 +68,7 @@ export async function validateTenantFK(db, scope, tenantIds, fkValues) {
         `WHERE ${where}`;
     const result = await db.query(sql, values);
     if (result.rows.length > 0) {
-        const err = new Error('Access denied: records do not belong to tenant');
-        err.statusCode = 403;
-        throw err;
+        throw httpError(403, 'Access denied: records do not belong to tenant');
     }
 }
 /**
@@ -103,8 +98,82 @@ export function buildTenantDeleteWhere(db, tableName, pkCol, pkValue, tenant) {
     const values = cb.getValues();
     return { where, values };
 }
+/**
+ * Mutates `fields` in-place: removes the tenant column from a SET payload (direct scopes only).
+ * No-op for indirect or no scope.
+ */
 export function stripTenantColumn(fields, scope) {
     if (isIndirect(scope))
         return;
     delete fields[scope.column];
 }
+/**
+ * For insert/bulk-upsert: enforce tenant on records that are about to be written.
+ * For direct scopes, mutates each record in-place to inject/validate the tenant column.
+ * For indirect scopes, batch-validates the FK values against the tenant scope.
+ * Throws 400 (ambiguous tenant) or 403 (mismatch) on violation. No-op when `tenant` is undefined.
+ */
+export async function enforceTenantOnWrites(db, tenant, records) {
+    if (!tenant)
+        return;
+    if (isIndirect(tenant.scope)) {
+        const fkCol = tenant.scope.through.localField;
+        await validateTenantFK(db, tenant.scope, tenant.ids, records.map((r) => r[fkCol]));
+        return;
+    }
+    for (const r of records)
+        injectTenantValue(r, tenant.scope, tenant.ids);
+}
+/**
+ * For update: builds the optional `extraCondition` ConditionBuilder for direct tenants.
+ * Returns undefined for indirect or no-tenant scenarios — those are handled separately
+ * (indirect uses pre-check via `assertTenantOwnership`).
+ */
+export function buildTenantUpdateExtra(tenant) {
+    if (!tenant || isIndirect(tenant.scope))
+        return undefined;
+    const cb = new ConditionBuilder('AND');
+    if (tenant.ids.length === 1)
+        cb.isEqual(tenant.scope.column, tenant.ids[0]);
+    else
+        cb.isIn(tenant.scope.column, tenant.ids);
+    return cb;
+}
+/**
+ * For update with indirect tenant: pre-check ownership via `SELECT 1 ... INNER JOIN ... LIMIT 1`.
+ * Throws 404 if the record either does not exist or does not belong to the tenant.
+ * No-op for direct or no-tenant — those are enforced via `extraCondition` in the UPDATE itself.
+ */
+export async function assertTenantOwnership(db, tenant, tableName, pkCol, pkValue) {
+    if (!tenant || !isIndirect(tenant.scope))
+        return;
+    const cb = new ConditionBuilder('AND');
+    cb.isEqual(`${db.qi(tableName)}.${db.qi(pkCol)}`, pkValue);
+    cb.append(buildTenantCondition(db, tenant.scope, tenant.ids));
+    const sql = `SELECT 1 FROM ${db.qi(tableName)} ${buildTenantJoin(db, tenant.scope, tableName)} WHERE ${cb.build(1, db.ph)} LIMIT 1`;
+    const r = await db.query(sql, cb.getValues());
+    if (r.rows.length === 0) {
+        throw httpError(404, 'Record not found');
+    }
+}
+/**
+ * Assert that EVERY pk in `ids` exists and belongs to the tenant, for both direct and indirect
+ * scopes. Throws 404 if any id is missing or not owned. No-op when `tenant` is undefined or `ids`
+ * is empty. Used by the delete engines to enforce tenant ownership BEFORE running a `beforeDelete`/
+ * `beforeBulkDelete` hook, so user code never runs against rows the caller cannot access.
+ */
+export async function assertTenantOwnsAll(db, tenant, tableName, pkCol, ids) {
+    if (!tenant || !ids.length)
+        return;
+    const qualifiedPk = `${db.qi(tableName)}.${db.qi(pkCol)}`;
+    const cb = new ConditionBuilder('AND');
+    cb.isIn(qualifiedPk, ids);
+    cb.append(buildTenantCondition(db, tenant.scope, tenant.ids));
+    const join = isIndirect(tenant.scope) ? ` ${buildTenantJoin(db, tenant.scope, tableName)}` : '';
+    const sql = `SELECT DISTINCT ${qualifiedPk} AS pk FROM ${db.qi(tableName)}${join} WHERE ${cb.build(1, db.ph)}`;
+    const r = await db.query(sql, cb.getValues());
+    const uniqueRequested = new Set(ids.map((v) => String(v))).size;
+    if (r.rows.length < uniqueRequested) {
+        throw httpError(404, 'Record not found');
+    }
+}

package/dist/routes/auto/bulk-delete.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bulk-delete.routes.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/bulk-delete.routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAI/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,wBAA8B,gBAAgB,CAC5C,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAyBf"}
+{"version":3,"file":"bulk-delete.routes.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/bulk-delete.routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAI/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,wBAA8B,gBAAgB,CAC5C,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAiBf"}

package/dist/routes/auto/bulk-delete.routes.js

@@ -1,27 +1,21 @@
 import { BulkDeleteTableBody, BulkDeleteTableResponse } from '../../lib/schema/bulk-delete.js';
 import { primaryAsString } from '../../types.js';
-import { mergeOnRequests } from './route-helpers.js';
+import { registerForAllTables } from './route-helpers.js';
 export default async function bulkDeleteRoutes(fastify, options) {
-    const { DbTables } = options;
-    for (const [tableName, tableConf] of Object.entries(DbTables)) {
-        const bodySchema = BulkDeleteTableBody(DbTables, tableName);
-        const responseSchema = BulkDeleteTableResponse(DbTables, tableName);
-        fastify.route({
-            method: 'POST',
-            url: `/bulk/${tableConf.Schema.tableName}/delete`,
-            schema: {
-                body: bodySchema,
-                response: { 200: responseSchema },
-                tags: [`SqlAPI-${tableName}`],
-                summary: `Bulk delete ${tableName}`,
-                description: `Delete multiple records from ${tableName} by primary key`,
-            },
-            onRequest: mergeOnRequests(options, tableConf),
-            handler: async (request, reply) => {
-                const items = request.body;
-                const ids = items.map((item) => item[primaryAsString(tableConf.primary)]);
-                reply.send(await fastify.sqlApi.bulkDelete(tableName, ids, request));
-            },
-        });
-    }
+    await registerForAllTables(fastify, options, {
+        method: 'POST',
+        url: (tc) => `/bulk/${tc.Schema.tableName}/delete`,
+        successStatus: 200,
+        schemas: (db, table) => ({
+            body: BulkDeleteTableBody(db, table),
+            response: BulkDeleteTableResponse(db, table),
+        }),
+        summary: 'Bulk delete',
+        description: (name) => `Delete multiple records from ${name} by primary key`,
+        handle: (fastify, tableName, tc, request) => {
+            const items = request.body;
+            const ids = items.map((item) => item[primaryAsString(tc.primary)]);
+            return fastify.sqlApi.bulkDelete(tableName, ids, request);
+        },
+    });
 }

package/dist/routes/auto/bulk-upsert.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bulk-upsert.routes.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/bulk-upsert.routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAG/C,OAAO,KAAK,EAAE,mBAAmB,EAAkB,MAAM,gBAAgB,CAAC;AAE1E,wBAA8B,gBAAgB,CAC5C,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAwBf"}
+{"version":3,"file":"bulk-upsert.routes.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/bulk-upsert.routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAG/C,OAAO,KAAK,EAAE,mBAAmB,EAAkB,MAAM,gBAAgB,CAAC;AAE1E,wBAA8B,gBAAgB,CAC5C,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAgBf"}

package/dist/routes/auto/bulk-upsert.routes.js

@@ -1,25 +1,19 @@
 import { BulkUpsertTableBody, BulkUpsertTableResponse } from '../../lib/schema/bulk-upsert.js';
-import { mergeOnRequests, buildWriteDescription } from './route-helpers.js';
+import { registerForAllTables, buildWriteDescription } from './route-helpers.js';
 export default async function bulkUpsertRoutes(fastify, options) {
-    const { DbTables } = options;
-    for (const [tableName, tableConf] of Object.entries(DbTables)) {
-        const bodySchema = BulkUpsertTableBody(DbTables, tableName);
-        const responseSchema = BulkUpsertTableResponse(DbTables, tableName);
-        fastify.route({
-            method: 'PUT',
-            url: `/bulk/${tableConf.Schema.tableName}`,
-            schema: {
-                body: bodySchema,
-                response: { 200: responseSchema },
-                tags: [`SqlAPI-${tableName}`],
-                summary: `Bulk upsert ${tableName}`,
-                description: buildWriteDescription('Bulk upsert records in', tableName, tableConf),
-            },
-            onRequest: mergeOnRequests(options, tableConf),
-            handler: async (request, reply) => {
-                const items = request.body;
-                reply.send(await fastify.sqlApi.bulkUpsert(tableName, items, request));
-            },
-        });
-    }
+    await registerForAllTables(fastify, options, {
+        method: 'PUT',
+        url: (tc) => `/bulk/${tc.Schema.tableName}`,
+        successStatus: 200,
+        schemas: (db, table) => ({
+            body: BulkUpsertTableBody(db, table),
+            response: BulkUpsertTableResponse(db, table),
+        }),
+        summary: 'Bulk upsert',
+        description: (name, tc) => buildWriteDescription('Bulk upsert records in', name, tc),
+        handle: (fastify, tableName, _tc, request) => {
+            const items = request.body;
+            return fastify.sqlApi.bulkUpsert(tableName, items, request);
+        },
+    });
 }

package/dist/routes/auto/delete.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete.routes.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/delete.routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAI/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,wBAA8B,YAAY,CACxC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CA2Bf"}
+{"version":3,"file":"delete.routes.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/delete.routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAI/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,wBAA8B,YAAY,CACxC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAmBf"}

package/dist/routes/auto/delete.routes.js

@@ -1,29 +1,23 @@
 import { Type } from '@sinclair/typebox';
 import { primaryAsString } from '../../types.js';
-import { mergeOnRequests } from './route-helpers.js';
+import { registerForAllTables } from './route-helpers.js';
 export default async function deleteRoutes(fastify, options) {
-    const { DbTables } = options;
-    for (const [tableName, tableConf] of Object.entries(DbTables)) {
-        const pkField = primaryAsString(tableConf.primary);
-        const pkType = tableConf.Schema.fields[pkField];
-        const responseSchema = Type.Object({
-            main: Type.Object({ [pkField]: pkType }),
-        });
-        fastify.route({
-            method: 'DELETE',
-            url: `/rest/${tableConf.Schema.tableName}/:id`,
-            schema: {
+    await registerForAllTables(fastify, options, {
+        method: 'DELETE',
+        url: (tc) => `/rest/${tc.Schema.tableName}/:id`,
+        successStatus: 200,
+        schemas: (_db, _table, tc) => {
+            const pkField = primaryAsString(tc.primary);
+            return {
                 params: Type.Object({ id: Type.String() }),
-                response: { 200: responseSchema },
-                tags: [`SqlAPI-${tableName}`],
-                summary: `Delete ${tableName}`,
-                description: `Delete a record from ${tableName} by primary key`,
-            },
-            onRequest: mergeOnRequests(options, tableConf),
-            handler: async (request, reply) => {
-                const { id } = request.params;
-                reply.send(await fastify.sqlApi.delete(tableName, id, request));
-            },
-        });
-    }
+                response: Type.Object({ main: Type.Object({ [pkField]: tc.Schema.fields[pkField] }) }),
+            };
+        },
+        summary: 'Delete',
+        description: (name) => `Delete a record from ${name} by primary key`,
+        handle: (fastify, tableName, _tc, request) => {
+            const { id } = request.params;
+            return fastify.sqlApi.delete(tableName, id, request);
+        },
+    });
 }

package/dist/routes/auto/get.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get.routes.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/get.routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAG/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,wBAA8B,SAAS,CACrC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAyBf"}
+{"version":3,"file":"get.routes.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/get.routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAG/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,wBAA8B,SAAS,CACrC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAgBf"}

package/dist/routes/auto/get.routes.js

@@ -1,26 +1,19 @@
 import { Type } from '@sinclair/typebox';
-import { mergeOnRequests } from './route-helpers.js';
+import { registerForAllTables } from './route-helpers.js';
 export default async function getRoutes(fastify, options) {
-    const { DbTables } = options;
-    for (const [tableName, tableConf] of Object.entries(DbTables)) {
-        const responseSchema = Type.Object({
-            main: Type.Partial(Type.Object(tableConf.Schema.fields)),
-        });
-        fastify.route({
-            method: 'GET',
-            url: `/rest/${tableConf.Schema.tableName}/:id`,
-            schema: {
-                params: Type.Object({ id: Type.String() }),
-                response: { 200: responseSchema },
-                tags: [`SqlAPI-${tableName}`],
-                summary: `Get ${tableName}`,
-                description: `Get a record from ${tableName} by primary key`,
-            },
-            onRequest: mergeOnRequests(options, tableConf),
-            handler: async (request, reply) => {
-                const { id } = request.params;
-                reply.send(await fastify.sqlApi.get(tableName, id, request));
-            },
-        });
-    }
+    await registerForAllTables(fastify, options, {
+        method: 'GET',
+        url: (tc) => `/rest/${tc.Schema.tableName}/:id`,
+        successStatus: 200,
+        schemas: (_db, _table, tc) => ({
+            params: Type.Object({ id: Type.String() }),
+            response: Type.Object({ main: Type.Partial(Type.Object(tc.Schema.fields)) }),
+        }),
+        summary: 'Get',
+        description: (name) => `Get a record from ${name} by primary key`,
+        handle: (fastify, tableName, _tc, request) => {
+            const { id } = request.params;
+            return fastify.sqlApi.get(tableName, id, request);
+        },
+    });
 }

package/dist/routes/auto/insert.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"insert.routes.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/insert.routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAG/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,wBAA8B,YAAY,CACxC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAiCf"}
+{"version":3,"file":"insert.routes.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/insert.routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAG/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,wBAA8B,YAAY,CACxC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAsBf"}

package/dist/routes/auto/insert.routes.js

@@ -1,29 +1,22 @@
 import { InsertTableBody, InsertTableResponse } from '../../lib/schema/insert.js';
-import { mergeOnRequests, buildWriteDescription } from './route-helpers.js';
+import { registerForAllTables, buildWriteDescription } from './route-helpers.js';
 export default async function insertRoutes(fastify, options) {
-    const { DbTables } = options;
-    for (const [tableName, tableConf] of Object.entries(DbTables)) {
-        const bodySchema = InsertTableBody(DbTables, tableName);
-        const responseSchema = InsertTableResponse(DbTables, tableName);
-        fastify.route({
-            method: 'POST',
-            url: `/rest/${tableConf.Schema.tableName}`,
-            schema: {
-                body: bodySchema,
-                response: { 201: responseSchema },
-                tags: [`SqlAPI-${tableName}`],
-                summary: `Insert ${tableName}`,
-                description: buildWriteDescription('Insert a record into', tableName, tableConf),
-            },
-            onRequest: mergeOnRequests(options, tableConf),
-            handler: async (request, reply) => {
-                const body = request.body;
-                const result = await fastify.sqlApi.insert(tableName, {
-                    record: body.main,
-                    secondaries: body.secondaries,
-                }, request);
-                reply.status(201).send(result);
-            },
-        });
-    }
+    await registerForAllTables(fastify, options, {
+        method: 'POST',
+        url: (tc) => `/rest/${tc.Schema.tableName}`,
+        successStatus: 201,
+        schemas: (db, table) => ({
+            body: InsertTableBody(db, table),
+            response: InsertTableResponse(db, table),
+        }),
+        summary: 'Insert',
+        description: (name, tc) => buildWriteDescription('Insert a record into', name, tc),
+        handle: (fastify, tableName, _tc, request) => {
+            const body = request.body;
+            return fastify.sqlApi.insert(tableName, {
+                record: body.main,
+                secondaries: body.secondaries,
+            }, request);
+        },
+    });
 }

package/dist/routes/auto/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAO7D,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAC;AASjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,MAAM,EAAE,MAAM,CAAC;KAChB;CACF;kCAGU,eAAe,WACf,mBAAmB,KAC3B,OAAO,CAAC,IAAI,CAAC;AAHhB,wBAqFoC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAO7D,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAC;AASjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,MAAM,EAAE,MAAM,CAAC;KAChB;CACF;kCAuDU,eAAe,WACf,mBAAmB,KAC3B,OAAO,CAAC,IAAI,CAAC;AAHhB,wBAiFoC"}

package/dist/routes/auto/plugin.js

@@ -13,6 +13,45 @@ import updateRoutes from './update.routes.js';
 import deleteRoutes from './delete.routes.js';
 import bulkUpsertRoutes from './bulk-upsert.routes.js';
 import bulkDeleteRoutes from './bulk-delete.routes.js';
+// Schema combinators for which Ajv reports one error per failed branch plus a
+// single combinator-level summary error, all targeting the same path.
+const COMBINATOR_KEYWORDS = new Set(['anyOf', 'oneOf']);
+/**
+ * Converts Ajv validation errors into response fields, stripping the noise Ajv
+ * emits for schema combinators.
+ *
+ * An enum modelled as `anyOf` of `const`s fails every branch when invalid, so Ajv
+ * produces one `const` error per branch plus an `anyOf` error — all on the same
+ * path. We keep only the combinator error for those paths and drop the per-branch
+ * errors, then deduplicate any remaining identical entries. `required` errors are
+ * re-pointed from the parent object to the actually missing property.
+ */
+function normalizeAjvErrors(errors) {
+    const toPath = (v) => {
+        const path = (v.instancePath || '').replace(/\//g, '.').replace(/^\./, '');
+        const missing = v.params?.missingProperty;
+        if (v.keyword === 'required' && missing) {
+            return path ? `${path}.${missing}` : missing;
+        }
+        return path;
+    };
+    const mapped = errors.map((v) => ({
+        path: toPath(v),
+        message: v.message || 'invalid',
+        code: v.keyword || 'unknown',
+    }));
+    const combinatorPaths = new Set(mapped.filter((f) => COMBINATOR_KEYWORDS.has(f.code)).map((f) => f.path));
+    const seen = new Set();
+    return mapped.filter((f) => {
+        if (combinatorPaths.has(f.path) && !COMBINATOR_KEYWORDS.has(f.code))
+            return false;
+        const key = `${f.path}|${f.code}|${f.message}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
 export default fp(async function fastifyAutoSqlApi(fastify, options) {
     // Set ConditionBuilder dialect globally
     const dialect = getDialect(options.dialect || 'postgres');
@@ -49,11 +88,7 @@ export default fp(async function fastifyAutoSqlApi(fastify, options) {
         instance.setErrorHandler((error, request, reply) => {
             // Schema validation errors (Ajv)
             if (error.validation) {
-                const fields = error.validation.map((v) => ({
-                    path: (v.instancePath || '').replace(/\//g, '.').replace(/^\./, ''),
-                    message: v.message || 'invalid',
-                    code: v.keyword || 'unknown',
-                }));
+                const fields = normalizeAjvErrors(error.validation);
                 return reply.status(400).send({
                     statusCode: 400,
                     error: 'Bad Request',

package/dist/routes/auto/route-helpers.d.ts

@@ -1,7 +1,32 @@
-import type { FastifyRequest, FastifyReply } from 'fastify';
-import type { ITable, SqlApiPluginOptions } from '../../types.js';
+import type { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
+import type { ITable, SqlApiPluginOptions, DbTables } from '../../types.js';
 type RequestHook = (request: FastifyRequest, reply: FastifyReply) => Promise<void | FastifyReply>;
 export declare function mergeOnRequests(options: SqlApiPluginOptions, tableConf: ITable): RequestHook[];
 export declare function buildWriteDescription(action: string, tableName: string, tableConf: ITable): string;
+interface RouteSchema {
+    body?: any;
+    params?: any;
+    querystring?: any;
+    response?: any;
+}
+export interface AutoRouteSpec {
+    method: 'GET' | 'POST' | 'PUT' | 'DELETE';
+    /** URL builder receiving the table configuration to read `Schema.tableName`. */
+    url: (tableConf: ITable) => string;
+    successStatus: 200 | 201;
+    /** Build per-table schemas (body, params, querystring, response). Response is wrapped with `{ [successStatus]: ... }` automatically. */
+    schemas: (dbTables: DbTables, tableName: string, tableConf: ITable) => RouteSchema;
+    summary: string;
+    description: (tableName: string, tableConf: ITable, schemas: RouteSchema) => string;
+    /** Translates the request to a sqlApi call. If it does not call reply.send/status itself,
+     * the registrar will reply.status(successStatus).send(returnValue). */
+    handle: (fastify: FastifyInstance, tableName: string, tableConf: ITable, request: FastifyRequest, reply: FastifyReply) => Promise<unknown>;
+}
+/**
+ * Iterates over every table in `options.DbTables` and registers one Fastify route for it
+ * following `spec`. Centralizes onRequest hook merging, tags, schema response wrapping,
+ * default reply when handler returns a value.
+ */
+export declare function registerForAllTables(fastify: FastifyInstance, options: SqlApiPluginOptions, spec: AutoRouteSpec): Promise<void>;
 export {};
 //# sourceMappingURL=route-helpers.d.ts.map

package/dist/routes/auto/route-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-helpers.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/route-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAElE,KAAK,WAAW,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC,CAAC;AAElG,wBAAgB,eAAe,CAAC,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW,EAAE,CAE9F;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAQlG"}
+{"version":3,"file":"route-helpers.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/route-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE5E,KAAK,WAAW,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC,CAAC;AAElG,wBAAgB,eAAe,CAAC,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW,EAAE,CAE9F;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAQlG;AAED,UAAU,WAAW;IAEnB,IAAI,CAAC,EAAE,GAAG,CAAC;IAEX,MAAM,CAAC,EAAE,GAAG,CAAC;IAEb,WAAW,CAAC,EAAE,GAAG,CAAC;IAElB,QAAQ,CAAC,EAAE,GAAG,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC1C,gFAAgF;IAChF,GAAG,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IACnC,aAAa,EAAE,GAAG,GAAG,GAAG,CAAC;IACzB,wIAAwI;IACxI,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,WAAW,CAAC;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,KAAK,MAAM,CAAC;IACpF;2EACuE;IACvE,MAAM,EAAE,CACN,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,KAChB,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CA8Bf"}

package/dist/routes/auto/route-helpers.js

@@ -3,10 +3,48 @@ export function mergeOnRequests(options, tableConf) {
 }
 export function buildWriteDescription(action, tableName, tableConf) {
     const joinList = tableConf.allowedWriteJoins
-        ?.map(([joinSchema]) => joinSchema.tableName)
+        ?.map((j) => j.alias)
         .join(', ');
     return [
         `${action} ${tableName}`,
         joinList && `Available secondaries: ${joinList}`,
     ].filter(Boolean).join('. ');
 }
+/**
+ * Iterates over every table in `options.DbTables` and registers one Fastify route for it
+ * following `spec`. Centralizes onRequest hook merging, tags, schema response wrapping,
+ * default reply when handler returns a value.
+ */
+export async function registerForAllTables(fastify, options, spec) {
+    const { DbTables } = options;
+    for (const [tableName, tableConf] of Object.entries(DbTables)) {
+        const schemas = spec.schemas(DbTables, tableName, tableConf);
+        // Only include schema keys that are actually defined: Fastify checks for key
+        // *presence* (not undefined value) to decide whether to emit FSTWRN001.
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const schema = {
+            tags: [`SqlAPI-${tableName}`],
+            summary: `${spec.summary} ${tableName}`,
+            description: spec.description(tableName, tableConf, schemas),
+        };
+        if (schemas.body !== undefined)
+            schema.body = schemas.body;
+        if (schemas.params !== undefined)
+            schema.params = schemas.params;
+        if (schemas.querystring !== undefined)
+            schema.querystring = schemas.querystring;
+        if (schemas.response !== undefined)
+            schema.response = { [spec.successStatus]: schemas.response };
+        fastify.route({
+            method: spec.method,
+            url: spec.url(tableConf),
+            schema,
+            onRequest: mergeOnRequests(options, tableConf),
+            handler: async (request, reply) => {
+                const result = await spec.handle(fastify, tableName, tableConf, request, reply);
+                if (!reply.sent)
+                    reply.status(spec.successStatus).send(result);
+            },
+        });
+    }
+}

package/dist/routes/auto/search.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search.routes.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/search.routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAG/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,wBAA8B,YAAY,CACxC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAoDf"}
+{"version":3,"file":"search.routes.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/search.routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAG/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,wBAA8B,YAAY,CACxC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAiDf"}