fastify-auto-sqlapi 0.1.2 → 0.1.4

package/dist/lib/engine/rest/update.js

@@ -1,19 +1,21 @@
 import { snakecaseRecord } from '../../naming.js';
 import { processSecondaries, processDeletions } from '../write-helpers.js';
-import { stripTenantColumn, assertTenantOwnership, buildTenantUpdateExtra, } from '../../tenant.js';
+import { stripTenantColumn, assertTenantOwnership, buildTenantUpdateExtra, enforceTenantFKOnUpdate, } from '../../tenant.js';
 import { runValidation } from '../validate.js';
 import { httpError } from '../../errors.js';
-import { primaryAsString } from '../../../types.js';
 export async function updateEngine(params) {
     const { db, tableConf, dbTables, request, record, secondaries, deletions, tenant } = params;
     const schema = tableConf.Schema;
-    const pk = primaryAsString(tableConf.primary);
-    const pkCol = schema.col(pk);
-    const pkValue = record[pk];
-    if (pkValue == null)
-        throw httpError(400, `Primary key "${pk}" is required`);
+    // Every primary key field/column: composite PKs must match on ALL columns, otherwise an
+    // UPDATE keyed on the first column alone would hit every row sharing that value.
+    const pkFields = Array.isArray(tableConf.primary) ? tableConf.primary : [tableConf.primary];
+    const pkCols = pkFields.map((f) => schema.col(f));
+    const pkValues = pkFields.map((f) => record[f]);
+    const missingIdx = pkValues.findIndex((v) => v == null);
+    if (missingIdx !== -1)
+        throw httpError(400, `Primary key "${pkFields[missingIdx]}" is required`);
     // 1. Tenant ownership check (indirect) — do it early so user mutations don't run on records they can't access
-    await assertTenantOwnership(db, tenant, schema.tableName, pkCol, pkValue);
+    await assertTenantOwnership(db, tenant, schema.tableName, pkCols, pkValues);
     // 2. Mutable copy of input in camelCase
     const inputRecord = { ...record };
     // 3. Custom validation (camelCase)
@@ -25,57 +27,72 @@ export async function updateEngine(params) {
     // 5. Convert to DB format (after all user mutations)
     const snaked = snakecaseRecord(inputRecord, schema);
     const updateFields = { ...snaked };
-    delete updateFields[pkCol];
-    // 6. Strip tenant column (user cannot change tenant of an existing record)
+    for (const c of pkCols)
+        delete updateFields[c];
+    // 6. Strip tenant column (user cannot change tenant of an existing record).
+    //    For indirect scopes the tenant link is the through-FK (localField): it may be changed,
+    //    but only to another value the caller owns — re-validate the new FK against the tenant.
     if (tenant) {
         stripTenantColumn(updateFields, tenant.scope);
+        await enforceTenantFKOnUpdate(db, tenant, updateFields);
     }
-    // 7. Update main
-    const hasFieldsToUpdate = Object.keys(updateFields).length > 0;
-    const extraCondition = buildTenantUpdateExtra(tenant);
-    if (hasFieldsToUpdate) {
-        const affectedRows = await db.update(schema.tableName, updateFields, { [pkCol]: pkValue }, extraCondition);
-        if (affectedRows === 0)
-            throw httpError(404, `Record not found`);
-    }
-    else {
-        // No fields to update: verify the record exists (for secondaries/deletions)
-        let whereSql = `${db.qi(schema.tableName)}.${db.qi(pkCol)} = ${db.ph(1)}`;
-        const whereValues = [pkValue];
-        if (extraCondition) {
-            whereSql += ` AND ${extraCondition.build(2, db.ph)}`;
-            whereValues.push(...extraCondition.getValues());
+    // Steps 7-9 are atomic: a failure in secondaries or deletions rolls back the main
+    // update too. Degrades to non-transactional when the adapter has no connect().
+    return db.withTransaction(async (tx) => {
+        // 7. Update main
+        const hasFieldsToUpdate = Object.keys(updateFields).length > 0;
+        const extraCondition = buildTenantUpdateExtra(tx, tenant);
+        // WHERE matching every primary key column (single or composite).
+        const whereByPk = Object.fromEntries(pkCols.map((c, i) => [c, pkValues[i]]));
+        if (hasFieldsToUpdate) {
+            const affectedRows = await tx.update(schema.tableName, updateFields, whereByPk, extraCondition);
+            if (affectedRows === 0)
+                throw httpError(404, `Record not found`);
         }
-        const rows = await db.select({
-            tableName: schema.tableName,
-            where: whereSql,
-            values: whereValues,
-            limit: '1',
-        });
-        if (rows.length === 0)
-            throw httpError(404, `Record not found`);
-    }
-    // Build the main response (PK-only)
-    const mainResult = { [pk]: pkValue };
-    // 8. Secondaries (upsert/insert with FK auto-fill — camelCase)
-    let secondaryResults;
-    if (secondaries && Object.keys(secondaries).length > 0) {
-        const mainForFK = { ...inputRecord };
-        secondaryResults = await processSecondaries(db, tableConf, dbTables, mainForFK, secondaries);
-    }
-    // 9. Deletions (FK auto-fill from main like secondaries)
-    let deletionResults;
-    if (deletions && Object.keys(deletions).length > 0) {
-        const mainForFK = { ...inputRecord };
-        deletionResults = await processDeletions(db, tableConf, mainForFK, deletions);
-    }
-    // 10. Return PK-only
-    const result = { main: mainResult };
-    if (secondaryResults && Object.keys(secondaryResults).length > 0) {
-        result.secondaries = secondaryResults;
-    }
-    if (deletionResults && Object.keys(deletionResults).length > 0) {
-        result.deletions = deletionResults;
-    }
-    return result;
+        else {
+            // No fields to update: verify the record exists (for secondaries/deletions)
+            const whereParts = pkCols.map((c, i) => `${tx.qi(schema.tableName)}.${tx.qi(c)} = ${tx.ph(i + 1)}`);
+            let whereSql = whereParts.join(' AND ');
+            const whereValues = [...pkValues];
+            if (extraCondition) {
+                whereSql += ` AND ${extraCondition.build(pkCols.length + 1, tx.ph)}`;
+                whereValues.push(...extraCondition.getValues());
+            }
+            const rows = await tx.select({
+                tableName: schema.tableName,
+                where: whereSql,
+                values: whereValues,
+                limit: '1',
+            });
+            if (rows.length === 0)
+                throw httpError(404, `Record not found`);
+        }
+        // Build the main response (PK-only — every PK field)
+        const mainResult = Object.fromEntries(pkFields.map((f, i) => [f, pkValues[i]]));
+        // 8. Secondaries (upsert/insert with FK auto-fill — camelCase)
+        let secondaryResults;
+        if (secondaries && Object.keys(secondaries).length > 0) {
+            const mainForFK = { ...inputRecord };
+            secondaryResults = await processSecondaries(tx, tableConf, dbTables, mainForFK, secondaries);
+        }
+        // 9. Deletions (FK auto-fill from main like secondaries)
+        let deletionResults;
+        if (deletions && Object.keys(deletions).length > 0) {
+            const mainForFK = { ...inputRecord };
+            deletionResults = await processDeletions(tx, tableConf, mainForFK, deletions);
+        }
+        // 10. afterUpdate hook (inside the transaction: throwing rolls everything back)
+        if (tableConf.afterUpdate) {
+            await tableConf.afterUpdate(tx, request, inputRecord, secondaryResults, deletionResults);
+        }
+        // 11. Return PK-only
+        const result = { main: mainResult };
+        if (secondaryResults && Object.keys(secondaryResults).length > 0) {
+            result.secondaries = secondaryResults;
+        }
+        if (deletionResults && Object.keys(deletionResults).length > 0) {
+            result.deletions = deletionResults;
+        }
+        return result;
+    });
 }

package/dist/lib/engine/search/search.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/search/search.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,QAAQ,EACR,YAAY,EACZ,YAAY,EAab,MAAM,mBAAmB,CAAC;AAy/B3B,wBAAsB,YAAY,CAChC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,CAoIvB"}
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/search/search.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,QAAQ,EACR,YAAY,EACZ,YAAY,EAcb,MAAM,mBAAmB,CAAC;AA4jC3B,wBAAsB,YAAY,CAChC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,CA2IvB"}

package/dist/lib/engine/search/search.js

@@ -50,6 +50,21 @@ function resolveFieldRef(field, schema, tableConf, db, alias) {
     err400(`Unknown field: ${field}`);
 }
 // ─── Join lookup ────────────────────────────────────────────
+/**
+ * Tenant-scope a join side-query. When the joined table declares its own `tenantScope`,
+ * appends the tenant condition to `cb` (direct: `col IN ids`; indirect: condition on the
+ * through table) and, for indirect scopes, pushes the INNER JOIN clause into `joins`.
+ * No-op without a tenant context (admin) or when the join table is not tenant-scoped.
+ */
+function appendJoinTenantScope(db, joinTableConf, tenant, joinTableName, cb, joins) {
+    const scope = joinTableConf?.tenantScope;
+    if (!tenant || !scope)
+        return;
+    cb.append(buildTenantCondition(db, scope, tenant.ids));
+    if ('through' in scope) {
+        joins?.push(buildTenantJoin(db, scope, joinTableName));
+    }
+}
 function findJoinByAlias(tableConf, alias) {
     return tableConf.allowedReadJoins?.find((j) => j.alias === alias);
 }
@@ -156,6 +171,28 @@ function buildAggOrderExpr(db, dbTables, tableConf, alias, fn, field, joinGroup,
     const expr = `COALESCE((SELECT ${aggExpr(aggFn, qualifiedCol)} FROM ${refs.joinTable} WHERE ${refs.joinTable}.${refs.fkCol} = ${refs.mainTable}.${refs.mainCol}${filterWhere}), 0)`;
     return { expr, values: filterVals };
 }
+/**
+ * Pre-scan `orderBy` for the joinLeft aliases referenced in 2-parti notation (`<alias>.<field>`).
+ * Needed BEFORE building the LEFT JOIN clauses (which must know their aliases) while the actual
+ * orderBy SQL — with its parameter placeholders — is only baked later, once the LEFT JOIN value
+ * count is known. Validates each alias against `allowedReadJoins` (throws 400), mirroring
+ * `validateOrderBy`; 3-parti aggregation entries are ignored (they use joinGroup, not a LEFT JOIN).
+ */
+function collectOrderByLeftAliases(orderBy, tableConf) {
+    const aliases = new Set();
+    for (const part of orderBy.split(',')) {
+        const trimmed = part.trim();
+        if (/^(\w+)\.(\w+)\.(\w+)(?:\s+(ASC|DESC))?$/i.test(trimmed))
+            continue; // 3-parti aggregation
+        const m = trimmed.match(/^(\w+)\.(\w+)(?:\s+(ASC|DESC))?$/i);
+        if (m) {
+            const alias = m[1];
+            requireJoin(tableConf, alias, true);
+            aliases.add(alias);
+        }
+    }
+    return aliases;
+}
 function validateOrderBy(orderBy, tableConf, db, dbTables, joinGroup, startIdx) {
     const parts = orderBy.split(',');
     const outParts = [];
@@ -219,7 +256,7 @@ function buildLeftJoinClauses(db, dbTables, tableConf, aliasesNeedingJoin, joinL
             // Note: extraFilters declared on joinTableConf are not supported here for
             // joinLeft (they would require alias-aware handlers); only schema fields
             // and computed fields apply.
-            const cb = new ConditionBuilder('AND');
+            const cb = new ConditionBuilder('AND', db.cbDialect);
             const joinTableConf = dbTables[joinSchema.tableName];
             const computed = joinTableConf?.computedFields;
             if (ref.filters) {
@@ -266,12 +303,14 @@ function buildLeftJoinClauses(db, dbTables, tableConf, aliasesNeedingJoin, joinL
     return { joinClauses, whereExtras, values };
 }
 // ─── Main query execution ───────────────────────────────────
-async function executeMainQuery(db, tableConf, where, values, orderBy, paginator, extraJoins = [], selectComputed) {
+async function executeMainQuery(db, tableConf, where, values, orderBy, paginator, extraJoins = [], selectComputed, maxRows) {
     const tableName = tableConf.Schema.tableName;
     const order = orderBy || tableConf.defaultOrder || primaryAsString(tableConf.primary);
+    // With a paginator, the page size governs the LIMIT. Without one, apply `maxRows` (if set) so an
+    // unbounded search cannot dump the whole table; a plain integer is a safe, non-injectable LIMIT.
     const limit = paginator
         ? `${paginator.itemsPerPage} OFFSET ${(paginator.page - 1) * paginator.itemsPerPage}`
-        : null;
+        : (maxRows != null ? String(maxRows) : null);
     // Optional computed projections — bound values, if any, are NOT yet supported
     // here (would require placeholder-aware composition with WHERE values).
     let columns;
@@ -328,7 +367,7 @@ async function buildPagination(db, tableConf, where, values, paginator, extraJoi
     };
 }
 // ─── joinMultiple (virtual fetch, child rows in side query) ─
-async function executeJoinMultiple(db, dbTables, tableConf, mainResults, joinMultiple) {
+async function executeJoinMultiple(db, dbTables, tableConf, mainResults, joinMultiple, tenant) {
     const result = {};
     for (const [alias, ref] of Object.entries(joinMultiple)) {
         const joinDef = requireJoin(tableConf, alias, false);
@@ -342,6 +381,8 @@ async function executeJoinMultiple(db, dbTables, tableConf, mainResults, joinMul
         const cb = buildJoinRefCondition(joinTableConf, joinSchema, ref || {}, db);
         const fkCol = joinSchema.col(joinField);
         cb.isIn(db.qi(fkCol), ids);
+        const tenantJoins = [];
+        appendJoinTenantScope(db, joinTableConf, tenant, joinSchema.tableName, cb, tenantJoins);
         let where = cb.build(1, db.ph);
         let values = cb.getValues();
         // Side-channel: computed-field clauses on the join table
@@ -356,17 +397,19 @@ async function executeJoinMultiple(db, dbTables, tableConf, mainResults, joinMul
             columns,
             where,
             values,
+            joins: tenantJoins.length > 0 ? tenantJoins : undefined,
         });
         result[alias] = mapRowsToCamelCase(rows, joinSchema);
     }
     return result;
 }
 // ─── joinLeft (parent fetch via PK IN side query) ───────────
-async function executeJoinLeft(db, tableConf, mainResults, joinLeft) {
+async function executeJoinLeft(db, dbTables, tableConf, mainResults, joinLeft, tenant) {
     const result = {};
     for (const [alias, ref] of Object.entries(joinLeft)) {
         const joinDef = requireJoin(tableConf, alias, true);
         const { joinSchema, joinField, mainField, selection: defaultSelection } = joinDef;
+        const joinTableConf = dbTables[joinSchema.tableName];
         // For joinLeft (N:1), mainField on main is the FK pointing to joinField (PK) on parent.
         // We collect the FK values from the main results and look up parents by their PK.
         const ids = collectIds(mainResults, mainField);
@@ -375,8 +418,10 @@ async function executeJoinLeft(db, tableConf, mainResults, joinLeft) {
             continue;
         }
         const fkCol = joinSchema.col(joinField);
-        const cb = new ConditionBuilder('AND');
+        const cb = new ConditionBuilder('AND', db.cbDialect);
         cb.isIn(db.qi(fkCol), ids);
+        const tenantJoins = [];
+        appendJoinTenantScope(db, joinTableConf, tenant, joinSchema.tableName, cb, tenantJoins);
         const where = cb.build(1, db.ph);
         const values = cb.getValues();
         const selection = ref?.selection ?? defaultSelection;
@@ -386,6 +431,7 @@ async function executeJoinLeft(db, tableConf, mainResults, joinLeft) {
             columns,
             where,
             values,
+            joins: tenantJoins.length > 0 ? tenantJoins : undefined,
         });
         result[alias] = mapRowsToCamelCase(rows, joinSchema);
     }
@@ -412,7 +458,7 @@ function buildByExpression(by, joinSchema, joinTableConf, db) {
     err400(`Unknown field: ${by}`);
 }
 // ─── joinGroup (aggregations) ───────────────────────────────
-async function executeJoinGroup(db, dbTables, tableConf, mainResults, joinGroup) {
+async function executeJoinGroup(db, dbTables, tableConf, mainResults, joinGroup, tenant) {
     const result = {};
     for (const [alias, groupReq] of Object.entries(joinGroup)) {
         const joinDef = requireJoin(tableConf, alias, false);
@@ -454,6 +500,8 @@ async function executeJoinGroup(db, dbTables, tableConf, mainResults, joinGroup)
         const cb = buildJoinRefCondition(joinTableConf, joinSchema, groupRef, db);
         const fkCol = joinSchema.col(joinField);
         cb.isIn(db.qi(fkCol), ids);
+        const tenantJoins = [];
+        appendJoinTenantScope(db, joinTableConf, tenant, joinSchema.tableName, cb, tenantJoins);
         let where = cb.build(1, db.ph);
         let values = cb.getValues();
         // Side-channel: computed-field clauses on the join table
@@ -462,7 +510,8 @@ async function executeJoinGroup(db, dbTables, tableConf, mainResults, joinGroup)
             ({ where, values } = appendComputedConditions(where, values, computedClauses, db));
         }
         const groupBy = groupByParts.length > 0 ? `GROUP BY ${groupByParts.join(', ')}` : '';
-        const sql = `SELECT ${selectParts.join(', ')} FROM ${db.qi(joinSchema.tableName)} WHERE ${where} ${groupBy}`;
+        const fromJoins = tenantJoins.length > 0 ? ` ${tenantJoins.join(' ')}` : '';
+        const sql = `SELECT ${selectParts.join(', ')} FROM ${db.qi(joinSchema.tableName)}${fromJoins} WHERE ${where} ${groupBy}`;
         const queryResult = await db.query(sql, values);
         const rows = queryResult.rows;
         const formatted = {};
@@ -520,8 +569,8 @@ function dispatchConditionMethod(cb, method, colOrExpr, params) {
 }
 function buildJoinRefCondition(joinTableConf, joinSchema, ref, db) {
     const cb = (ref.filters && joinTableConf)
-        ? joinTableConf.filters(ref.filters)
-        : new ConditionBuilder('AND');
+        ? joinTableConf.filters(ref.filters, db.cbDialect)
+        : new ConditionBuilder('AND', db.cbDialect);
     if (ref.conditions?.length) {
         for (const c of ref.conditions) {
             if (!ALLOWED_SET.has(c.method)) {
@@ -641,7 +690,7 @@ function appendComputedConditions(currentWhere, currentValues, clauses, db) {
         // Append the computed's own bound values first; the expr placeholders
         // (if any) reference them via stable indices set by the consumer.
         values = [...values, ...c.values];
-        const tmpCb = new ConditionBuilder('AND');
+        const tmpCb = new ConditionBuilder('AND', db.cbDialect);
         dispatchConditionMethod(tmpCb, c.method, c.expr, c.params);
         const startIdx = values.length + 1;
         const clauseSql = tmpCb.build(startIdx, db.ph);
@@ -666,7 +715,7 @@ function appendAggConditions(currentWhere, currentValues, conditions, db, dbTabl
         const [alias, fn, field] = parts;
         const { expr, values: exprValues } = buildAggOrderExpr(db, dbTables, tableConf, alias, fn, field, joinGroup, values.length + 1);
         values = [...values, ...exprValues];
-        const tmpCb = new ConditionBuilder('AND');
+        const tmpCb = new ConditionBuilder('AND', db.cbDialect);
         dispatchConditionMethod(tmpCb, c.method, expr, c.params);
         const startIdx = values.length + 1;
         const clause = tmpCb.build(startIdx, db.ph);
@@ -676,7 +725,7 @@ function appendAggConditions(currentWhere, currentValues, conditions, db, dbTabl
     return { where, values };
 }
 // ─── joinMustExist (EXISTS subquery filter on main) ─────────
-function buildJoinMustExistClauses(db, dbTables, tableConf, joinMustExist, currentWhere, currentValues) {
+function buildJoinMustExistClauses(db, dbTables, tableConf, joinMustExist, currentWhere, currentValues, tenant) {
     let where = currentWhere;
     const values = [...currentValues];
     for (const [alias, ref] of Object.entries(joinMustExist)) {
@@ -685,6 +734,8 @@ function buildJoinMustExistClauses(db, dbTables, tableConf, joinMustExist, curre
         const joinTableConf = dbTables[joinSchema.tableName];
         const refs = extractJoinRefs(db, tableConf, joinDef);
         const filterCondition = buildJoinRefCondition(joinTableConf, joinSchema, ref, db);
+        const tenantJoins = [];
+        appendJoinTenantScope(db, joinTableConf, tenant, joinSchema.tableName, filterCondition, tenantJoins);
         const startIdx = values.length + 1;
         let filterWhere = filterCondition.build(startIdx, db.ph);
         let filterVals = [...filterCondition.getValues()];
@@ -699,10 +750,13 @@ function buildJoinMustExistClauses(db, dbTables, tableConf, joinMustExist, curre
             filterVals = cvalues.slice(values.length);
             filterWhere = cwhere;
         }
+        // Qualify the FK with the join table: the EXISTS FROM may include the tenant
+        // through-join, so a bare column could become ambiguous.
         const innerWhere = filterWhere
-            ? `${refs.fkCol} = ${refs.mainTable}.${refs.mainCol} AND ${filterWhere}`
-            : `${refs.fkCol} = ${refs.mainTable}.${refs.mainCol}`;
-        where += ` AND EXISTS (SELECT 1 FROM ${refs.joinTable} WHERE ${innerWhere})`;
+            ? `${refs.joinTable}.${refs.fkCol} = ${refs.mainTable}.${refs.mainCol} AND ${filterWhere}`
+            : `${refs.joinTable}.${refs.fkCol} = ${refs.mainTable}.${refs.mainCol}`;
+        const existsJoins = tenantJoins.length > 0 ? ` ${tenantJoins.join(' ')}` : '';
+        where += ` AND EXISTS (SELECT 1 FROM ${refs.joinTable}${existsJoins} WHERE ${innerWhere})`;
         values.push(...filterVals);
     }
     return { where, values };
@@ -724,7 +778,7 @@ export async function searchEngine(dbTables, params) {
         for (const a of Object.keys(joinLeft))
             requireJoin(tableConf, a, true);
     // Build main condition
-    const condition = tableConf.filters(filters || {});
+    const condition = tableConf.filters(filters || {}, db.cbDialect);
     // Filters that target computed fields (declared on tableConf.computedFields)
     // are applied via the side-channel pattern further down.
     let computedFilterClauses = [];
@@ -755,7 +809,7 @@ export async function searchEngine(dbTables, params) {
     }
     // joinMustExist (EXISTS)
     if (joinMustExist && Object.keys(joinMustExist).length > 0) {
-        ({ where, values } = buildJoinMustExistClauses(db, dbTables, tableConf, joinMustExist, where, values));
+        ({ where, values } = buildJoinMustExistClauses(db, dbTables, tableConf, joinMustExist, where, values, tenant));
     }
     // Aggregation conditions (HAVING-style)
     if (conditions?.length) {
@@ -764,27 +818,23 @@ export async function searchEngine(dbTables, params) {
             ({ where, values } = appendAggConditions(where, values, conditions, db, dbTables, tableConf, joinGroup));
         }
     }
-    // orderBy parsing — collects 2-parti aliases that need LEFT JOIN on the main query
-    let safeOrderBy;
-    let orderByValues = [];
-    let orderByLeftAliases = new Set();
-    if (orderBy) {
-        const obResult = validateOrderBy(orderBy, tableConf, db, dbTables, joinGroup, values.length + 1);
-        safeOrderBy = obResult.sql;
-        orderByValues = obResult.values;
-        orderByLeftAliases = obResult.leftJoinAliases;
-    }
     // Determine which joinLeft aliases need a LEFT JOIN on the main query:
     // - any alias used in 2-parti orderBy
     // - any alias in joinLeft body that has filters or conditions on the parent
-    const aliasesNeedingLeftJoin = new Set(orderByLeftAliases);
+    const aliasesNeedingLeftJoin = new Set();
+    if (orderBy) {
+        for (const a of collectOrderByLeftAliases(orderBy, tableConf))
+            aliasesNeedingLeftJoin.add(a);
+    }
     if (joinLeft) {
         for (const [alias, ref] of Object.entries(joinLeft)) {
             if (ref?.filters || ref?.conditions?.length)
                 aliasesNeedingLeftJoin.add(alias);
         }
     }
-    // Build LEFT JOIN clauses + extra WHERE for filtered parents
+    // Build LEFT JOIN clauses + extra WHERE for filtered parents. Their placeholders start right
+    // after the WHERE values; the same clause SQL is reused by the pagination COUNT/compute queries,
+    // whose value array is [...WHERE, ...leftJoin] — so this base MUST stay `values.length + 1`.
     const extraJoinClauses = [...tenantJoins];
     let leftJoinValues = [];
     if (aliasesNeedingLeftJoin.size > 0) {
@@ -794,24 +844,34 @@ export async function searchEngine(dbTables, params) {
         for (const w of lj.whereExtras)
             where += ` AND ${w}`;
     }
+    // orderBy is parsed AFTER the LEFT JOIN values so aggregation-orderBy placeholders start past
+    // them (main query binds [...WHERE, ...leftJoin, ...orderBy]). Parsing it earlier with base
+    // `values.length + 1` misbinds when BOTH an aggregation orderBy and a filtered joinLeft exist.
+    let safeOrderBy;
+    let orderByValues = [];
+    if (orderBy) {
+        const obResult = validateOrderBy(orderBy, tableConf, db, dbTables, joinGroup, values.length + leftJoinValues.length + 1);
+        safeOrderBy = obResult.sql;
+        orderByValues = obResult.values;
+    }
     // Bind WHERE values + LEFT JOIN values + orderBy aggregation values for main query.
     // Pagination COUNT/compute include WHERE + LEFT JOIN values (no orderBy).
     const whereAndJoinValues = [...values, ...leftJoinValues];
     const mainValues = [...whereAndJoinValues, ...orderByValues];
-    const main = await executeMainQuery(db, tableConf, where, mainValues, safeOrderBy, paginator, extraJoinClauses, params.selectComputed);
+    const main = await executeMainQuery(db, tableConf, where, mainValues, safeOrderBy, paginator, extraJoinClauses, params.selectComputed, params.maxRows);
     let pagination;
     if (paginator) {
         pagination = await buildPagination(db, tableConf, where, whereAndJoinValues, paginator, extraJoinClauses, computeMin, computeMax, computeSum, computeAvg);
     }
     const result = { main };
     if (joinMultiple && Object.keys(joinMultiple).length > 0) {
-        result.joinMultiple = await executeJoinMultiple(db, dbTables, tableConf, main, joinMultiple);
+        result.joinMultiple = await executeJoinMultiple(db, dbTables, tableConf, main, joinMultiple, tenant);
     }
     if (joinLeft && Object.keys(joinLeft).length > 0) {
-        result.joinLeft = await executeJoinLeft(db, tableConf, main, joinLeft);
+        result.joinLeft = await executeJoinLeft(db, dbTables, tableConf, main, joinLeft, tenant);
     }
     if (joinGroup && Object.keys(joinGroup).length > 0) {
-        result.joinGroup = await executeJoinGroup(db, dbTables, tableConf, main, joinGroup);
+        result.joinGroup = await executeJoinGroup(db, dbTables, tableConf, main, joinGroup, tenant);
     }
     if (pagination) {
         result.pagination = pagination;

package/dist/lib/schema/bulk-delete.d.ts

@@ -1,5 +1,5 @@
 import type { DbTables } from '../../types.js';
-export declare function BulkDeleteTableBody(dbTables: DbTables, tableName: string): import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+export declare function BulkDeleteTableBody(dbTables: DbTables, tableName: string, maxItems?: number): import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
     [x: string]: any;
 }>>;
 export declare function BulkDeleteTableResponse(dbTables: DbTables, tableName: string): import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{

package/dist/lib/schema/bulk-delete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bulk-delete.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/bulk-delete.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM;;IAMxE;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM;;;;IAU5E"}
+{"version":3,"file":"bulk-delete.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/bulk-delete.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM;;IAS3F;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM;;;;IAU5E"}

package/dist/lib/schema/bulk-delete.js

@@ -1,10 +1,10 @@
 import { Type } from '@sinclair/typebox';
 import { primaryAsString } from '../../types.js';
-export function BulkDeleteTableBody(dbTables, tableName) {
+export function BulkDeleteTableBody(dbTables, tableName, maxItems) {
     const tableConf = dbTables[tableName];
     const pkField = primaryAsString(tableConf.primary);
     const pkType = tableConf.Schema.fields[pkField];
-    return Type.Array(Type.Object({ [pkField]: pkType }));
+    return Type.Array(Type.Object({ [pkField]: pkType }, { additionalProperties: false }), maxItems != null ? { maxItems } : {});
 }
 export function BulkDeleteTableResponse(dbTables, tableName) {
     const tableConf = dbTables[tableName];

package/dist/lib/schema/bulk-upsert.d.ts

@@ -1,5 +1,5 @@
 import { type TSchema } from '@sinclair/typebox';
 import type { DbTables } from '../../types.js';
-export declare function BulkUpsertTableBody(dbTables: DbTables, tableName: string): import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<Record<string, TSchema>>>;
+export declare function BulkUpsertTableBody(dbTables: DbTables, tableName: string, maxItems?: number): import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<Record<string, TSchema>>>;
 export declare function BulkUpsertTableResponse(dbTables: DbTables, tableName: string): import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<Record<string, TSchema>>>;
 //# sourceMappingURL=bulk-upsert.d.ts.map

package/dist/lib/schema/bulk-upsert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bulk-upsert.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/bulk-upsert.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAS/C,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,oGAgBxE;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,oGAa5E"}
+{"version":3,"file":"bulk-upsert.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/bulk-upsert.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAS/C,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,oGAoB3F;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,oGAa5E"}

package/dist/lib/schema/bulk-upsert.js

@@ -1,18 +1,20 @@
 import { Type } from '@sinclair/typebox';
 import { primaryAsString } from '../../types.js';
 import { pkSchema, applySchemaOverrides, attachWriteJoinSections, writeJoinBodyFields, writeJoinResponseFields, } from './helpers.js';
-export function BulkUpsertTableBody(dbTables, tableName) {
+export function BulkUpsertTableBody(dbTables, tableName, maxItems) {
     const tableConf = dbTables[tableName];
     const schema = tableConf.Schema;
-    const mainSchema = Type.Partial(Type.Object(applySchemaOverrides({ ...schema.fields }, tableConf)));
+    // additionalProperties:false makes the schema the real write whitelist (no mass assignment).
+    const mainSchema = Type.Partial(Type.Object(applySchemaOverrides({ ...schema.fields }, tableConf), { additionalProperties: false }));
     const itemProperties = {
         main: mainSchema,
     };
     attachWriteJoinSections(itemProperties, tableConf, dbTables, {
         withDeletions: true,
         secondaryFields: writeJoinBodyFields,
+        strictItems: true,
     });
-    return Type.Array(Type.Object(itemProperties));
+    return Type.Array(Type.Object(itemProperties), maxItems != null ? { maxItems } : {});
 }
 export function BulkUpsertTableResponse(dbTables, tableName) {
     const tableConf = dbTables[tableName];

package/dist/lib/schema/helpers.d.ts

@@ -24,6 +24,7 @@ type JoinFieldsBuilder = (join: JoinDefinition, secondaryConf: ITable | undefine
  */
 export declare function buildJoinAliasMap(tableConf: ITable, dbTables: DbTables, build: JoinFieldsBuilder, options?: {
     itemsPartial?: boolean;
+    strictItems?: boolean;
 }): Record<string, TSchema>;
 /**
  * Attach `secondaries` (and optionally `deletions`) sections to the given target object,
@@ -37,6 +38,7 @@ export declare function buildJoinAliasMap(tableConf: ITable, dbTables: DbTables,
 export declare function attachWriteJoinSections(target: Record<string, TSchema>, tableConf: ITable, dbTables: DbTables, options: {
     withDeletions: boolean;
     secondaryFields: JoinFieldsBuilder;
+    strictItems?: boolean;
 }): void;
 /** JoinFieldsBuilder for body schemas: includes all join fields with FK + excluded made Optional. */
 export declare const writeJoinBodyFields: JoinFieldsBuilder;

package/dist/lib/schema/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGzF;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ3H;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,MAAM,GAAG,SAAS,GACrC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBzB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB;AAED,KAAK,iBAAiB,GAAG,CACvB,IAAI,EAAE,cAAc,EACpB,aAAa,EAAE,MAAM,GAAG,SAAS,KAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE7B;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,iBAAiB,EACxB,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GACvC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE;IAAE,aAAa,EAAE,OAAO,CAAC;IAAC,eAAe,EAAE,iBAAiB,CAAA;CAAE,GACtE,IAAI,CAmBN;AAED,qGAAqG;AACrG,eAAO,MAAM,mBAAmB,EAAE,iBACmB,CAAC;AAEtD,uDAAuD;AACvD,eAAO,MAAM,uBAAuB,EAAE,iBACG,CAAC"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGzF;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ3H;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,MAAM,GAAG,SAAS,GACrC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBzB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB;AAED,KAAK,iBAAiB,GAAG,CACvB,IAAI,EAAE,cAAc,EACpB,aAAa,EAAE,MAAM,GAAG,SAAS,KAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE7B;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,iBAAiB,EACxB,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9D,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE;IAAE,aAAa,EAAE,OAAO,CAAC;IAAC,eAAe,EAAE,iBAAiB,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7F,IAAI,CAmBN;AAED,qGAAqG;AACrG,eAAO,MAAM,mBAAmB,EAAE,iBACmB,CAAC;AAEtD,uDAAuD;AACvD,eAAO,MAAM,uBAAuB,EAAE,iBACG,CAAC"}

package/dist/lib/schema/helpers.js

@@ -56,9 +56,10 @@ export function buildJoinAliasMap(tableConf, dbTables, build, options = {}) {
     const out = {};
     if (!tableConf.allowedWriteJoins?.length)
         return out;
+    const objOpts = options.strictItems ? { additionalProperties: false } : {};
     for (const j of tableConf.allowedWriteJoins) {
         const sc = findSecondaryTableConf(dbTables, j.joinSchema.tableName);
-        const item = Type.Object(build(j, sc));
+        const item = Type.Object(build(j, sc), objOpts);
         out[j.alias] = Type.Array(options.itemsPartial ? Type.Partial(item) : item);
     }
     return out;
@@ -75,7 +76,7 @@ export function buildJoinAliasMap(tableConf, dbTables, build, options = {}) {
 export function attachWriteJoinSections(target, tableConf, dbTables, options) {
     if (!tableConf.allowedWriteJoins?.length)
         return;
-    target.secondaries = Type.Optional(Type.Partial(Type.Object(buildJoinAliasMap(tableConf, dbTables, options.secondaryFields))));
+    target.secondaries = Type.Optional(Type.Partial(Type.Object(buildJoinAliasMap(tableConf, dbTables, options.secondaryFields, { strictItems: options.strictItems }))));
     if (options.withDeletions) {
         target.deletions = Type.Optional(Type.Partial(Type.Object(buildJoinAliasMap(tableConf, dbTables, ({ joinSchema }) => joinSchema.fields, { itemsPartial: true }))));
     }

package/dist/lib/schema/insert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"insert.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/insert.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAgB,MAAM,mBAAmB,CAAC;AAErE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAS/C,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAsB9E;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAalF"}
+{"version":3,"file":"insert.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/insert.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAgB,MAAM,mBAAmB,CAAC;AAErE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAS/C,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAyB9E;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAalF"}

package/dist/lib/schema/insert.js

@@ -12,11 +12,14 @@ export function InsertTableBody(dbTables, tableName) {
         }
     }
     const bodyProperties = {
-        main: Type.Object(mainFields),
+        // additionalProperties:false makes the schema the real write whitelist — unknown keys are
+        // rejected (400) instead of silently reaching the INSERT as columns (mass assignment).
+        main: Type.Object(mainFields, { additionalProperties: false }),
     };
     attachWriteJoinSections(bodyProperties, tableConf, dbTables, {
         withDeletions: false,
         secondaryFields: writeJoinBodyFields,
+        strictItems: true,
     });
     return Type.Object(bodyProperties);
 }

package/dist/lib/schema/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAgB,MAAM,mBAAmB,CAAC;AAErE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAS/C,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAqB9E;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAalF"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAgB,MAAM,mBAAmB,CAAC;AAErE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAS/C,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAwB9E;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAalF"}