fastify-auto-sqlapi 0.1.13 → 0.2.0

package/dist/lib/engine/validate.d.ts

@@ -1,11 +1,6 @@
 import type { FastifyRequest } from 'fastify';
 import type { QueryClient } from '../db.js';
 import type { ITable, BulkValidatorItem } from '../../types.js';
-export interface ValidationResponseField {
-    path: string;
-    code: string;
-    message: string;
-}
 export declare function runValidation(db: QueryClient, request: FastifyRequest, tableConf: ITable, main: Record<string, unknown>, secondaries?: Record<string, Record<string, unknown>[]>): Promise<void>;
 export declare function runBulkValidation(db: QueryClient, request: FastifyRequest, tableConf: ITable, items: BulkValidatorItem[]): Promise<void>;
 //# sourceMappingURL=validate.d.ts.map

package/dist/lib/engine/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/lib/engine/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAmB,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEjF,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAUD,wBAAsB,aAAa,CACjC,EAAE,EAAE,WAAW,EACf,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,GACtD,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,WAAW,EACf,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,iBAAiB,EAAE,GACzB,OAAO,CAAC,IAAI,CAAC,CAOf"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/lib/engine/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAmB,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAgBjF,wBAAsB,aAAa,CACjC,EAAE,EAAE,WAAW,EACf,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,GACtD,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,WAAW,EACf,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,iBAAiB,EAAE,GACzB,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/lib/engine/write-helpers.d.ts

@@ -1,22 +1,19 @@
 import type { FastifyRequest } from 'fastify';
 import type { QueryClient } from '../db.js';
-import type { ITable, DbTables, JoinDefinition } from '../../types.js';
-export declare function findWriteJoin(tableConf: ITable, alias: string): JoinDefinition | undefined;
-/**
- * Drop `excludeFromCreation` columns from a snake_case (DB-format) record.
- *
- * Exclusion is a whitelist on CLIENT input: call this on the client payload only,
- * BEFORE any server-side value is assigned (beforeInsert mutations, FK auto-fill),
- * so engine/hook-generated values on those fields reach the SQL.
- */
-export declare function removeExcludedFields(record: Record<string, unknown>, tableConf: ITable): Record<string, unknown>;
+import type { ITable, DbTables, TenantContext } from '../../types.js';
+export declare function findSecondaryTableConf(dbTables: DbTables, joinTableName: string): ITable | undefined;
 /**
- * Same whitelist as `removeExcludedFields`, but for a camelCase record (schema
- * field names) and in place. Used on the client payload before the beforeInsert
- * hook runs.
+ * The context a per-alias write pass runs in. Shared by `processSecondaries` and
+ * `processDeletions`, which differ only in the payload they are handed.
  */
-export declare function removeExcludedFieldsCamel(record: Record<string, unknown>, tableConf: ITable): void;
-export declare function findSecondaryTableConf(dbTables: DbTables, joinTableName: string): ITable | undefined;
+export interface WriteJoinPass {
+    db: QueryClient;
+    tableConf: ITable;
+    dbTables: DbTables;
+    /** Main record (camelCase), the source of the FK auto-filled into every child row. */
+    mainRecord: Record<string, unknown>;
+    tenant?: TenantContext;
+}
 interface PrepareCtx {
     db: QueryClient;
     tableConf: ITable;
@@ -43,7 +40,15 @@ export declare function prepareInsertRecord(ctx: PrepareCtx, input: Record<strin
     camel: Record<string, unknown>;
     snake: Record<string, unknown>;
 }>;
-export declare function processSecondaries(db: QueryClient, tableConf: ITable, dbTables: DbTables, mainRecord: Record<string, unknown>, secondaries: Record<string, Record<string, unknown>[]>): Promise<Record<string, Record<string, unknown>[]>>;
+/**
+ * Write the child rows a request sent alongside the main record, one bulk statement per alias.
+ *
+ * A secondary is a write like any other: the child table's own `tenantScope` is enforced on it
+ * (`tenantForTable` re-targets the caller's tenant onto that table's scope). Without this the
+ * client picks the child's tenant value, which lets it plant rows inside another tenant — and,
+ * where the child is upserted, hijack one of that tenant's existing rows via the conflict key.
+ */
+export declare function processSecondaries(pass: WriteJoinPass, secondaries: Record<string, Record<string, unknown>[]>): Promise<Record<string, Record<string, unknown>[]>>;
 /**
  * Process per-alias deletion requests for a write join.
  *
@@ -53,7 +58,10 @@ export declare function processSecondaries(db: QueryClient, tableConf: ITable, d
  * `DELETE FROM child WHERE id = 5 AND fk_to_main = <main.id>` — both ergonomic
  * (no need to repeat the FK) and safer (cannot accidentally delete a row that
  * doesn't belong to this main).
+ *
+ * The FK alone is not isolation: a child row owned by another tenant may still point at a main
+ * row the caller owns, so the child table's own `tenantScope` is added to the DELETE.
  */
-export declare function processDeletions(db: QueryClient, tableConf: ITable, mainRecord: Record<string, unknown>, deletions: Record<string, Record<string, unknown>[]>): Promise<Record<string, Record<string, unknown>[]>>;
+export declare function processDeletions(pass: WriteJoinPass, deletions: Record<string, Record<string, unknown>[]>): Promise<Record<string, Record<string, unknown>[]>>;
 export {};
 //# sourceMappingURL=write-helpers.d.ts.map

package/dist/lib/engine/write-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write-helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/engine/write-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,KAAK,EACV,MAAM,EACN,QAAQ,EACR,cAAc,EAEf,MAAM,gBAAgB,CAAC;AAExB,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,cAAc,GAAG,SAAS,CAE5B;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQzB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,EAAE,MAAM,GAChB,IAAI,CAKN;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,QAAQ,EAClB,aAAa,EAAE,MAAM,GACpB,MAAM,GAAG,SAAS,CAKpB;AAED,UAAU,UAAU;IAClB,EAAE,EAAE,WAAW,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,cAAc,CAAC;CACzB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,EACvD,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GACnC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAe7E;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,WAAW,EACf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,GACrD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CA4DpD;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,WAAW,EACf,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,GACnD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CA+BpD"}
+{"version":3,"file":"write-helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/engine/write-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAQ5C,OAAO,KAAK,EACV,MAAM,EACN,QAAQ,EAGR,aAAa,EACd,MAAM,gBAAgB,CAAC;AAqDxB,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,QAAQ,EAClB,aAAa,EAAE,MAAM,GACpB,MAAM,GAAG,SAAS,CAKpB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,WAAW,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAmCD,UAAU,UAAU;IAClB,EAAE,EAAE,WAAW,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,cAAc,CAAC;CACzB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,EACvD,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GACnC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAe7E;AAkCD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,GACrD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAiDpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,aAAa,EACnB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,GACnD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAoBpD"}

package/dist/lib/engine/write-helpers.js

@@ -1,6 +1,16 @@
 import { camelcaseObject, snakecaseRecord } from '../naming.js';
 import { runValidation } from './validate.js';
-export function findWriteJoin(tableConf, alias) {
+import { tenantForTable, buildTenantRowGuard, enforceTenantOnWrites, assertTenantOwnsConflicts, } from '../tenant.js';
+/**
+ * Resolve the write join an alias names, or undefined when the table does not declare it.
+ *
+ * An undeclared alias is skipped rather than rejected: a table with no `allowedWriteJoins`
+ * ignores any secondaries sent to it, which is the tested contract (see the "ignores
+ * secondaries/deletions not in allowedWriteJoins" specs). The HTTP boundary is what fails
+ * closed — the generated body schema declares `additionalProperties:false` on the alias
+ * container, so a request naming an undeclared alias is a 400 before it reaches here.
+ */
+function findWriteJoin(tableConf, alias) {
     return tableConf.allowedWriteJoins?.find((j) => j.alias === alias);
 }
 /**
@@ -10,7 +20,7 @@ export function findWriteJoin(tableConf, alias) {
  * BEFORE any server-side value is assigned (beforeInsert mutations, FK auto-fill),
  * so engine/hook-generated values on those fields reach the SQL.
  */
-export function removeExcludedFields(record, tableConf) {
+function removeExcludedFields(record, tableConf) {
     if (!tableConf.excludeFromCreation?.length)
         return record;
     const result = { ...record };
@@ -25,7 +35,7 @@ export function removeExcludedFields(record, tableConf) {
  * field names) and in place. Used on the client payload before the beforeInsert
  * hook runs.
  */
-export function removeExcludedFieldsCamel(record, tableConf) {
+function removeExcludedFieldsCamel(record, tableConf) {
     if (!tableConf.excludeFromCreation?.length)
         return;
     for (const field of tableConf.excludeFromCreation) {
@@ -39,6 +49,21 @@ export function findSecondaryTableConf(dbTables, joinTableName) {
     }
     return undefined;
 }
+/**
+ * Resolve one write-join alias: where the child's FK lives, what value it takes, and which
+ * tenant scope applies to the child table.
+ */
+function resolveWriteJoinTarget(joinDef, dbTables, mainRecord, tenant) {
+    const { joinSchema, joinField, mainField } = joinDef;
+    const childConf = findSecondaryTableConf(dbTables, joinSchema.tableName);
+    return {
+        joinSchema,
+        joinCol: joinSchema.col(joinField),
+        mainValue: Array.isArray(mainField) ? mainRecord[mainField[0]] : mainRecord[mainField],
+        childConf,
+        childTenant: tenantForTable(tenant, childConf),
+    };
+}
 /**
  * Prepare a single record for INSERT/UPSERT:
  *   1. shallow camelCase copy of `input`
@@ -66,47 +91,70 @@ export async function prepareInsertRecord(ctx, input, secondaries, options) {
     const snake = snakecaseRecord(camel, ctx.tableConf.Schema);
     return { camel, snake };
 }
-export async function processSecondaries(db, tableConf, dbTables, mainRecord, secondaries) {
+/**
+ * Run `writeAlias` once per alias of a write-join payload, handing it the resolved target for
+ * that alias and collecting the rows it reports back.
+ *
+ * Empty lists are a no-op, and an alias the table does not declare as a write join is skipped:
+ * rejecting it is the request schema's job (`additionalProperties:false` on the alias
+ * container), because a table declaring no write joins must keep ignoring what it is sent.
+ */
+async function forEachWriteJoin(pass, payload, writeAlias) {
     const results = {};
-    for (const [alias, records] of Object.entries(secondaries)) {
+    for (const [alias, records] of Object.entries(payload)) {
         if (!records?.length)
             continue;
-        const joinDef = findWriteJoin(tableConf, alias);
+        const joinDef = findWriteJoin(pass.tableConf, alias);
         if (!joinDef)
             continue;
-        const { joinSchema, joinField, mainField } = joinDef;
-        const joinCol = joinSchema.col(joinField);
-        const secondaryTableConf = findSecondaryTableConf(dbTables, joinSchema.tableName);
-        const secondaryPk = secondaryTableConf?.primary || joinField;
-        const secondaryPkCol = Array.isArray(secondaryPk)
-            ? secondaryPk.map((f) => joinSchema.col(f))
-            : joinSchema.col(secondaryPk);
+        const target = resolveWriteJoinTarget(joinDef, pass.dbTables, pass.mainRecord, pass.tenant);
+        results[alias] = await writeAlias(records, target, joinDef);
+    }
+    return results;
+}
+/**
+ * Write the child rows a request sent alongside the main record, one bulk statement per alias.
+ *
+ * A secondary is a write like any other: the child table's own `tenantScope` is enforced on it
+ * (`tenantForTable` re-targets the caller's tenant onto that table's scope). Without this the
+ * client picks the child's tenant value, which lets it plant rows inside another tenant — and,
+ * where the child is upserted, hijack one of that tenant's existing rows via the conflict key.
+ */
+export function processSecondaries(pass, secondaries) {
+    const { db, tableConf } = pass;
+    return forEachWriteJoin(pass, secondaries, async (records, target, joinDef) => {
+        const { joinSchema, joinCol, mainValue, childConf, childTenant } = target;
+        const childPk = childConf?.primary || joinDef.joinField;
+        const childPkCol = Array.isArray(childPk)
+            ? childPk.map((f) => joinSchema.col(f))
+            : joinSchema.col(childPk);
         const preparedRecords = records.map((rec) => {
             let prepared = snakecaseRecord(rec, joinSchema);
             // Remove excluded fields from the client payload BEFORE the FK auto-fill:
             // an excluded FK column must not strip the engine-injected value below.
-            if (secondaryTableConf) {
-                prepared = removeExcludedFields(prepared, secondaryTableConf);
+            if (childConf) {
+                prepared = removeExcludedFields(prepared, childConf);
             }
-            // Auto-fill FK from main record
-            const mainValue = Array.isArray(mainField)
-                ? mainRecord[mainField[0]]
-                : mainRecord[mainField];
             prepared[joinCol] = mainValue;
             return prepared;
         });
-        const secondaryUpsertKeys = tableConf.upsertMap?.get(joinSchema);
+        // Tenant enforcement runs after the FK auto-fill: for an indirect scope the through-FK
+        // the engine just injected is the value being validated.
+        await enforceTenantOnWrites(db, childTenant, preparedRecords);
+        const upsertKeys = tableConf.upsertMap?.get(joinSchema);
         let pkRows;
-        if (secondaryUpsertKeys) {
-            const conflictCols = secondaryUpsertKeys.map((k) => joinSchema.col(k));
-            pkRows = await db.bulkInsertOrUpdate(joinSchema.tableName, preparedRecords, conflictCols, secondaryPkCol);
+        if (upsertKeys) {
+            const conflictCols = upsertKeys.map((k) => joinSchema.col(k));
+            // A conflicting upsert must not overwrite — or re-parent — a child row owned by
+            // another tenant, which the ON CONFLICT key alone would happily match.
+            await assertTenantOwnsConflicts(db, childTenant, joinSchema.tableName, conflictCols, preparedRecords);
+            pkRows = await db.bulkInsertOrUpdate(joinSchema.tableName, preparedRecords, conflictCols, childPkCol);
         }
         else {
-            pkRows = await db.bulkInsert(joinSchema.tableName, preparedRecords, secondaryPkCol);
+            pkRows = await db.bulkInsert(joinSchema.tableName, preparedRecords, childPkCol);
         }
-        results[alias] = pkRows.map((r) => camelcaseObject(r, joinSchema));
-    }
-    return results;
+        return pkRows.map((r) => camelcaseObject(r, joinSchema));
+    });
 }
 /**
  * Process per-alias deletion requests for a write join.
@@ -117,31 +165,25 @@ export async function processSecondaries(db, tableConf, dbTables, mainRecord, se
  * `DELETE FROM child WHERE id = 5 AND fk_to_main = <main.id>` — both ergonomic
  * (no need to repeat the FK) and safer (cannot accidentally delete a row that
  * doesn't belong to this main).
+ *
+ * The FK alone is not isolation: a child row owned by another tenant may still point at a main
+ * row the caller owns, so the child table's own `tenantScope` is added to the DELETE.
  */
-export async function processDeletions(db, tableConf, mainRecord, deletions) {
-    const results = {};
-    for (const [alias, records] of Object.entries(deletions)) {
-        if (!records?.length)
-            continue;
-        const joinDef = findWriteJoin(tableConf, alias);
-        if (!joinDef)
-            continue;
-        const { joinSchema, joinField, mainField } = joinDef;
-        const joinCol = joinSchema.col(joinField);
-        const mainValue = Array.isArray(mainField)
-            ? mainRecord[mainField[0]]
-            : mainRecord[mainField];
+export function processDeletions(pass, deletions) {
+    const { db } = pass;
+    return forEachWriteJoin(pass, deletions, async (records, target) => {
+        const { joinSchema, joinCol, mainValue, childTenant } = target;
+        const tenantGuard = buildTenantRowGuard(db, childTenant, joinSchema.tableName);
         const deletedRows = [];
         for (const rec of records) {
             const snaked = snakecaseRecord(rec, joinSchema);
             // Auto-inject FK to main: scopes the DELETE to children owned by this main.
             snaked[joinCol] = mainValue;
-            const affectedRows = await db.delete(joinSchema.tableName, snaked);
+            const affectedRows = await db.delete(joinSchema.tableName, snaked, tenantGuard);
             if (affectedRows > 0) {
                 deletedRows.push(camelcaseObject(snaked, joinSchema));
             }
         }
-        results[alias] = deletedRows;
-    }
-    return results;
+        return deletedRows;
+    });
 }

package/dist/lib/read-access.d.ts

@@ -9,7 +9,18 @@ import type { ITable, SchemaDefinition } from '../types.js';
  * by bisection. Write paths (insert/update/upsert) are deliberately unaffected —
  * a field can be writable but never readable (e.g. a password hash).
  */
-export declare function isReadExcluded(tableConf: ITable | undefined, field: string): boolean;
+/**
+ * Own-property membership for a field map.
+ *
+ * `key in map` and `map[key]` both walk `Object.prototype`, so `constructor`, `toString`,
+ * `valueOf`, `hasOwnProperty` and `__proto__` satisfy every "is this a known field" check and
+ * reach the SQL builders, where they render as `undefined` or a column that does not exist.
+ * Every allowlist below — and every field lookup in the search engine — goes through these two
+ * helpers so an inherited name is simply unknown.
+ */
+export declare function hasOwnField(map: Record<string, unknown> | undefined, key: string): boolean;
+/** The value at `key`, but only when it is the map's own property. */
+export declare function ownField<T>(map: Record<string, T> | undefined, key: string): T | undefined;
 /** Throws 400 when `field` is read-excluded on `tableConf`. */
 export declare function assertReadable(tableConf: ITable | undefined, field: string): void;
 /**
@@ -17,6 +28,26 @@ export declare function assertReadable(tableConf: ITable | undefined, field: str
  * excluded pass through untouched (extraFilters and computed names included).
  */
 export declare function assertFiltersReadable(filters: Record<string, unknown> | undefined, tableConf: ITable | undefined): void;
+/**
+ * Throws 400 when a filter map carries a key the engine would never visit.
+ *
+ * Filters are matched against the schema fields, the table's `extraFilters` and its computed
+ * fields; anything else used to be dropped without a word, so a mistyped key returned MORE
+ * rows than the caller asked for and nothing said so. That is the dangerous direction to fail
+ * in — filters are also how consumers narrow visibility — and it contradicted every
+ * neighbouring path, where an unknown field in `selection`, `conditions`, `orderBy` or an
+ * aggregation is already a 400.
+ *
+ * `schema` is the schema the relation was declared with, which for a join may be a trimmed
+ * copy: a field outside it is unknown here exactly as it is for `selection`.
+ *
+ * `allowExtraFilters` is false on the joinLeft path, whose condition is built inline
+ * (`buildLeftJoinClauses`) and never runs the table's `extendedCondition`.
+ *
+ * Call AFTER `assertFiltersReadable`, so a read-excluded field keeps its own message
+ * instead of being reported as unknown.
+ */
+export declare function assertKnownFilterKeys(filters: Record<string, unknown> | undefined, schema: SchemaDefinition, tableConf: ITable | undefined, allowExtraFilters?: boolean): void;
 /** Schema field names that may be read, in schema declaration order. */
 export declare function readableFieldNames(tableConf: ITable | undefined, schema: SchemaDefinition): string[];
 /**
@@ -28,4 +59,9 @@ export declare function readableFieldNames(tableConf: ITable | undefined, schema
  * would be ambiguous.
  */
 export declare function readableSelectColumns(tableConf: ITable | undefined, schema: SchemaDefinition, db: QueryClient): string | undefined;
+/**
+ * The same list, always spelled out. Used where `*` is not an acceptable fallback: a
+ * relation narrowed by a `fields` allowlist must project the allowlist, not the table.
+ */
+export declare function explicitSelectColumns(tableConf: ITable | undefined, schema: SchemaDefinition, db: QueryClient): string;
 //# sourceMappingURL=read-access.d.ts.map

package/dist/lib/read-access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read-access.d.ts","sourceRoot":"","sources":["../../src/lib/read-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG5D;;;;;;;;GAQG;AAEH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpF;AAED,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIjF;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC5C,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,IAAI,CAKN;AAED,wEAAwE;AACxE,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,gBAAgB,GACvB,MAAM,EAAE,CAIV;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,gBAAgB,EACxB,EAAE,EAAE,WAAW,GACd,MAAM,GAAG,SAAS,CAMpB"}
+{"version":3,"file":"read-access.d.ts","sourceRoot":"","sources":["../../src/lib/read-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG5D;;;;;;;;GAQG;AAEH;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACxC,GAAG,EAAE,MAAM,GACV,OAAO,CAET;AAED,sEAAsE;AACtE,wBAAgB,QAAQ,CAAC,CAAC,EACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,SAAS,EAClC,GAAG,EAAE,MAAM,GACV,CAAC,GAAG,SAAS,CAEf;AAMD,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIjF;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC5C,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,IAAI,CAKN;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC5C,MAAM,EAAE,gBAAgB,EACxB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,iBAAiB,UAAO,GACvB,IAAI,CAkBN;AAED,wEAAwE;AACxE,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,gBAAgB,GACvB,MAAM,EAAE,CAIV;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,gBAAgB,EACxB,EAAE,EAAE,WAAW,GACd,MAAM,GAAG,SAAS,CAGpB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,gBAAgB,EACxB,EAAE,EAAE,WAAW,GACd,MAAM,CAKR"}

package/dist/lib/read-access.js

@@ -8,7 +8,23 @@ import { httpError } from './errors.js';
  * by bisection. Write paths (insert/update/upsert) are deliberately unaffected —
  * a field can be writable but never readable (e.g. a password hash).
  */
-export function isReadExcluded(tableConf, field) {
+/**
+ * Own-property membership for a field map.
+ *
+ * `key in map` and `map[key]` both walk `Object.prototype`, so `constructor`, `toString`,
+ * `valueOf`, `hasOwnProperty` and `__proto__` satisfy every "is this a known field" check and
+ * reach the SQL builders, where they render as `undefined` or a column that does not exist.
+ * Every allowlist below — and every field lookup in the search engine — goes through these two
+ * helpers so an inherited name is simply unknown.
+ */
+export function hasOwnField(map, key) {
+    return map !== undefined && Object.hasOwn(map, key);
+}
+/** The value at `key`, but only when it is the map's own property. */
+export function ownField(map, key) {
+    return map !== undefined && Object.hasOwn(map, key) ? map[key] : undefined;
+}
+function isReadExcluded(tableConf, field) {
     return tableConf?.readExclude?.includes(field) ?? false;
 }
 /** Throws 400 when `field` is read-excluded on `tableConf`. */
@@ -28,6 +44,46 @@ export function assertFiltersReadable(filters, tableConf) {
         assertReadable(tableConf, key);
     }
 }
+/**
+ * Throws 400 when a filter map carries a key the engine would never visit.
+ *
+ * Filters are matched against the schema fields, the table's `extraFilters` and its computed
+ * fields; anything else used to be dropped without a word, so a mistyped key returned MORE
+ * rows than the caller asked for and nothing said so. That is the dangerous direction to fail
+ * in — filters are also how consumers narrow visibility — and it contradicted every
+ * neighbouring path, where an unknown field in `selection`, `conditions`, `orderBy` or an
+ * aggregation is already a 400.
+ *
+ * `schema` is the schema the relation was declared with, which for a join may be a trimmed
+ * copy: a field outside it is unknown here exactly as it is for `selection`.
+ *
+ * `allowExtraFilters` is false on the joinLeft path, whose condition is built inline
+ * (`buildLeftJoinClauses`) and never runs the table's `extendedCondition`.
+ *
+ * Call AFTER `assertFiltersReadable`, so a read-excluded field keeps its own message
+ * instead of being reported as unknown.
+ */
+export function assertKnownFilterKeys(filters, schema, tableConf, allowExtraFilters = true) {
+    if (!filters)
+        return;
+    for (const [key, value] of Object.entries(filters)) {
+        // `undefined` means "filter not supplied" everywhere else in the engine; an absent
+        // filter cannot be a wrong one. `null` does filter (IS NULL) and is validated.
+        if (value === undefined)
+            continue;
+        if (hasOwnField(schema.fields, key))
+            continue;
+        if (ownField(tableConf?.computedFields, key))
+            continue;
+        if (hasOwnField(tableConf?.extraFilters, key)) {
+            if (allowExtraFilters)
+                continue;
+            throw httpError(400, `Filter '${key}' is an extraFilter: extraFilters are not applied on joinLeft ` +
+                `(only schema fields and computed fields are). Use joinMustExist on the same relation.`);
+        }
+        throw httpError(400, `Unknown filter field: ${key}`);
+    }
+}
 /** Schema field names that may be read, in schema declaration order. */
 export function readableFieldNames(tableConf, schema) {
     const fields = Object.keys(schema.fields);
@@ -46,6 +102,13 @@ export function readableFieldNames(tableConf, schema) {
 export function readableSelectColumns(tableConf, schema, db) {
     if (!tableConf?.readExclude?.length)
         return undefined;
+    return explicitSelectColumns(tableConf, schema, db);
+}
+/**
+ * The same list, always spelled out. Used where `*` is not an acceptable fallback: a
+ * relation narrowed by a `fields` allowlist must project the allowlist, not the table.
+ */
+export function explicitSelectColumns(tableConf, schema, db) {
     const table = db.qi(schema.tableName);
     return readableFieldNames(tableConf, schema)
         .map((f) => `${table}.${db.qi(schema.col(f))}`)

package/dist/lib/schema/helpers.d.ts

@@ -5,27 +5,12 @@ import type { ITable, SchemaDefinition, DbTables, JoinDefinition } from '../../t
  * Falls back to `fallback` field if tableConf is undefined.
  */
 export declare function pkSchema(tableConf: ITable | undefined, schema: SchemaDefinition, fallback: string): Record<string, TSchema>;
-/**
- * Build secondary table fields for body schemas:
- * - FK field becomes Optional (auto-filled from main)
- * - excludeFromCreation fields become Optional
- */
-export declare function buildSecondaryFields(joinSchema: SchemaDefinition, joinField: string, secondaryTableConf: ITable | undefined): Record<string, TSchema>;
 /**
  * Apply schemaOverrides to a fields record.
  * Replaces matching field schemas with the override.
  */
 export declare function applySchemaOverrides(fields: Record<string, TSchema>, tableConf: ITable): Record<string, TSchema>;
 type JoinFieldsBuilder = (join: JoinDefinition, secondaryConf: ITable | undefined) => Record<string, TSchema>;
-/**
- * Maps each writeJoin alias to a Type.Array(Type.Object(...)) using the provided fields builder.
- * When `itemsPartial` is true, wraps each item with Type.Partial — used for deletion sub-schemas
- * where every field is a matcher (the engine auto-injects the FK to main).
- */
-export declare function buildJoinAliasMap(tableConf: ITable, dbTables: DbTables, build: JoinFieldsBuilder, options?: {
-    itemsPartial?: boolean;
-    strictItems?: boolean;
-}): Record<string, TSchema>;
 /**
  * Attach `secondaries` (and optionally `deletions`) sections to the given target object,
  * iterating once over `tableConf.allowedWriteJoins`. Mutates `target` in-place.

package/dist/lib/schema/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGzF;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ3H;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,MAAM,GAAG,SAAS,GACrC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBzB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB;AAED,KAAK,iBAAiB,GAAG,CACvB,IAAI,EAAE,cAAc,EACpB,aAAa,EAAE,MAAM,GAAG,SAAS,KAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE7B;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,iBAAiB,EACxB,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9D,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE;IAAE,aAAa,EAAE,OAAO,CAAC;IAAC,eAAe,EAAE,iBAAiB,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7F,IAAI,CAmBN;AAED,qGAAqG;AACrG,eAAO,MAAM,mBAAmB,EAAE,iBACmB,CAAC;AAEtD,uDAAuD;AACvD,eAAO,MAAM,uBAAuB,EAAE,iBACG,CAAC"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGzF;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ3H;AA6BD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB;AAED,KAAK,iBAAiB,GAAG,CACvB,IAAI,EAAE,cAAc,EACpB,aAAa,EAAE,MAAM,GAAG,SAAS,KAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAwB7B;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE;IAAE,aAAa,EAAE,OAAO,CAAC;IAAC,eAAe,EAAE,iBAAiB,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7F,IAAI,CA8BN;AAED,qGAAqG;AACrG,eAAO,MAAM,mBAAmB,EAAE,iBACmB,CAAC;AAEtD,uDAAuD;AACvD,eAAO,MAAM,uBAAuB,EAAE,iBACG,CAAC"}

package/dist/lib/schema/helpers.js

@@ -18,7 +18,7 @@ export function pkSchema(tableConf, schema, fallback) {
  * - FK field becomes Optional (auto-filled from main)
  * - excludeFromCreation fields become Optional
  */
-export function buildSecondaryFields(joinSchema, joinField, secondaryTableConf) {
+function buildSecondaryFields(joinSchema, joinField, secondaryTableConf) {
     const fields = { ...joinSchema.fields };
     if (joinField in fields) {
         fields[joinField] = Type.Optional(fields[joinField]);
@@ -52,7 +52,7 @@ export function applySchemaOverrides(fields, tableConf) {
  * When `itemsPartial` is true, wraps each item with Type.Partial — used for deletion sub-schemas
  * where every field is a matcher (the engine auto-injects the FK to main).
  */
-export function buildJoinAliasMap(tableConf, dbTables, build, options = {}) {
+function buildJoinAliasMap(tableConf, dbTables, build, options = {}) {
     const out = {};
     if (!tableConf.allowedWriteJoins?.length)
         return out;
@@ -76,9 +76,12 @@ export function buildJoinAliasMap(tableConf, dbTables, build, options = {}) {
 export function attachWriteJoinSections(target, tableConf, dbTables, options) {
     if (!tableConf.allowedWriteJoins?.length)
         return;
-    target.secondaries = Type.Optional(Type.Partial(Type.Object(buildJoinAliasMap(tableConf, dbTables, options.secondaryFields, { strictItems: options.strictItems }))));
+    // additionalProperties:false closes the alias container itself, not just the items: an alias
+    // the table does not declare must be a validation error, never a key that reaches the engine.
+    const aliasMap = { additionalProperties: false };
+    target.secondaries = Type.Optional(Type.Partial(Type.Object(buildJoinAliasMap(tableConf, dbTables, options.secondaryFields, { strictItems: options.strictItems }), aliasMap)));
     if (options.withDeletions) {
-        target.deletions = Type.Optional(Type.Partial(Type.Object(buildJoinAliasMap(tableConf, dbTables, ({ joinSchema }) => joinSchema.fields, { itemsPartial: true }))));
+        target.deletions = Type.Optional(Type.Partial(Type.Object(buildJoinAliasMap(tableConf, dbTables, ({ joinSchema }) => joinSchema.fields, { itemsPartial: true }), aliasMap)));
     }
 }
 /** JoinFieldsBuilder for body schemas: includes all join fields with FK + excluded made Optional. */

package/dist/lib/schema/search.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAgB,MAAM,mBAAmB,CAAC;AAIrE,OAAO,KAAK,EAAE,QAAQ,EAA4B,MAAM,gBAAgB,CAAC;AAyBzE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAuHlF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,eAAe,GAAE,MAAmC,GAAG,OAAO,CAe9F;AAED,qFAAqF;AACrF,eAAO,MAAM,sBAAsB,kDAAqB,CAAC;AAEzD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAsElF"}
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAgB,MAAM,mBAAmB,CAAC;AAIrE,OAAO,KAAK,EAAE,QAAQ,EAA4B,MAAM,gBAAgB,CAAC;AA+JzE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAyClF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,eAAe,GAAE,MAAmC,GAAG,OAAO,CAe9F;AAED,qFAAqF;AACrF,eAAO,MAAM,sBAAsB,kDAAqB,CAAC;AAEzD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAyClF"}