fastify-auto-sqlapi 0.1.3 → 0.1.5

package/AGENTS_BACKEND.md

@@ -126,6 +126,8 @@ await app.register(fastifyAutoSqlApi, {
   prefix: '/auto',             // optional — standard Fastify prefix
   onRequests: [],              // optional — global auth hooks (run on every route)
   getTenantId: (request) => request.user?.organizationId ?? null, // optional — multi-tenant
+  maxItemsPerPage: 1000,       // optional — cap on search page size / no-paginator LIMIT (default 1000)
+  maxBulkItems: 1000,          // optional — cap on bulk array length (default 1000)
   debug: true,                 // optional — log all SQL queries and params to console
 });
 
@@ -182,6 +184,8 @@ await app.register(async (instance) => {
 
 **Note**: After registering the plugin, `app.sqlApi` is available for custom routes — see [SqlApi](#sqlapi--programmatic-high-level-api).
 
+**Note**: Granular route plugins create their own `sqlApi` decorator automatically, so they work standalone (no main plugin required). The decorator is scoped to each route plugin: if you also need `app.sqlApi` in your own routes, register the main plugin.
+
 ---
 
 ## defineTable() — Complete Reference
@@ -232,8 +236,12 @@ export const TableCustomer = defineTable({
   ...exportTableInfo(Schema),             // Schema + auto-filter builder
 
   // OPTIONAL
-  defaultOrder: 'name',                   // ORDER BY default (supports multi: 'name ASC, id DESC')
+  defaultOrder: 'name',                   // ORDER BY default. camelCase fields are mapped to DB
+                                          // columns (e.g. 'squadIndex' -> "squad_index"); supports
+                                          // multi ('name ASC, id DESC'), computed fields, and raw
+                                          // SQL fragments (unknown tokens pass through unchanged)
   excludeFromCreation: ['id'],            // Fields omitted from INSERT — MUST include auto-increment PKs
+  readExclude: ['passwordHash'],          // Fields hidden from ALL reads (writes unaffected)
   distinctResults: true,                  // Use SELECT DISTINCT
 
   // JOINS — relations to other tables. Alias defaults to joinSchema.tableName —
@@ -698,6 +706,7 @@ Behavior:
 - **Insert**: auto-injects `organization_id` if single tenant; validates if already present (403 if mismatch); 400 if multi-tenant without explicit value
 - **Update**: strips `organization_id` from SET (can't change tenant), adds to WHERE condition
 - **Bulk upsert**: auto-injects on all records
+- **Upsert conflict guard** (`upsertMap` set): before the `ON CONFLICT DO UPDATE`, a probe rejects (403) any incoming conflict key that matches a row owned by another tenant — an upsert cannot overwrite or re-assign a foreign tenant's row.
 
 ### Indirect tenant (via JOIN to parent table)
 
@@ -719,7 +728,7 @@ const TableOrder = defineTable({
 Behavior:
 - **Read**: INNER JOIN to parent table + WHERE on parent's tenant column
 - **Insert/Bulk upsert**: validates FK references belong to tenant (1 batch query)
-- **Update**: pre-check via SELECT with INNER JOIN (404 if not found)
+- **Update**: pre-check via SELECT with INNER JOIN (404 if not found). If the payload also changes the through-FK (`localField`), the new value is re-validated against the tenant — moving a record into another tenant's scope is rejected (403).
 - **Delete**: subquery `DELETE WHERE pk IN (SELECT ... INNER JOIN ... WHERE tenant IN (...))`
 
 ### Multi-tenant users
@@ -754,12 +763,15 @@ Tables without `tenantScope` are unaffected — no filtering regardless of `getT
 - **camelCase in API, any case in DB**: all request/response fields are camelCase. The plugin converts via `col()` and `colMap`. For snake_case DB columns (default), conversion is automatic. For camelCase DB columns (e.g. betterauth), the CLI generates a `colMap` that preserves the original column names — no conversion needed. Manual schemas without `colMap` fall back to `toUnderscore()`.
 - **All fields Optional in response**: `RETURNING *` may return any subset. Response schemas use `Type.Partial`.
 - **`excludeFromCreation`**: **IMPORTANT** — auto-increment PKs (e.g. `id` serial/auto_increment) MUST be listed here, otherwise INSERT will try to send them and fail. The CLI auto-detects this and adds it by default. Also useful for `createdAt`/`updatedAt` columns managed by DB defaults or hooks.
+- **`readExclude`**: fields hidden from every read — not projected by search/get, omitted from read response schemas and from this table's default (`*`) join selection when it is a join target. Referencing one from `filters`, `conditions`, `orderBy`, `joinGroup` aggregations or an explicit join `selection` returns 400: hiding a field from output while allowing it to be filtered would leak its value by bisection. **Writes are unaffected** — insert/update/bulk still accept the field, so a column can be writable but never readable (password hash, access token). Primary keys cannot be excluded. Complementary to trimming the Schema, which removes the column from reads *and* writes.
 - **`upsertMap`**: when present for a schema, INSERT becomes upsert. PostgreSQL: `ON CONFLICT (...) DO UPDATE`. MySQL/MariaDB: `ON DUPLICATE KEY UPDATE`. Applies to both main and secondary tables.
 - **`schemaOverrides`**: override auto-generated schema fields with stricter TypeBox types (e.g. `{ email: Type.String({ format: 'email' }) }`). Overrides are merged into the body schema for insert, update, and bulk-upsert. The original Schema file is never modified. In updates, overridden fields are still wrapped in Optional (validates only when present). Overrides appear in Swagger.
 - **Validation receives camelCase**: `validate` receives the original camelCase record (as sent by the client) and secondaries. Field names match the schema definition, with full TypeScript inference (`main.startDate`, not `main.start_date`). It returns `ValidationError[]` — tuples of `[field, code]` or `[field, code, message]`. If any errors are returned, the request is rejected with 400 before hooks or SQL execute.
 - **`validateBulk` replaces `validate` in bulk**: when `validateBulk` is defined, it is called once with all items and per-item `validate` is skipped. This allows optimized batch queries instead of N individual checks. When only `validate` is defined, it runs per-item as fallback.
 - **All hooks and validators receive camelCase records**: `validate` and the whole hook matrix (`beforeInsert`/`afterInsert`, `beforeUpdate`/`afterUpdate`, `beforeDelete`/`afterDelete`, `beforeBulkDelete`/`afterBulkDelete`) get records keyed by schema field names (camelCase). Mutations propagate to the SQL (plugin converts to DB column format via `colMap` after the hook). The engine internally uses `snakecaseRecord(..., schema)` after user mutations to map field names to actual DB columns.
 - **Filters validation**: TypeBox schemas use `additionalProperties: false`. By default Fastify strips unknown fields silently. For 400 errors on unknown filters: `Fastify({ ajv: { customOptions: { removeAdditional: false } } })`.
+- **Write-body whitelist**: insert/update/bulk-upsert bodies (`main` + secondaries items) are `additionalProperties: false`. Unknown properties are rejected with 400 — only columns in the generated Schema (as narrowed by `schemaOverrides`/`excludeFromCreation`) can be written, so no mass assignment of unexposed columns. Trim the Schema to keep sensitive columns unwritable.
+- **Request limits**: `maxItemsPerPage` (default 1000) caps the search page size and is applied as the `LIMIT` even when no paginator is sent (so an empty-body search can't dump a whole table); over-limit `itemsPerPage` → 400. `maxBulkItems` (default 1000) caps the bulk array length via schema `maxItems` → 400. Programmatic `sqlApi.*` calls are uncapped.
 - **Tenant filtering**: when `tenantScope` is set on a table and `getTenantId` is provided in plugin options, all CRUD operations are automatically scoped to the tenant. `getTenantId` returning `null`/`undefined` = admin (no filter). Returning an array = multi-tenant user (IN clause).
 
 ---

package/AGENTS_FRONTEND.md

@@ -35,10 +35,10 @@ Without prefix, routes are at root: `/search/customer`, `/rest/customer/:id`, et
 ```
 
 - `orderBy` — SQL ORDER BY clause (default: `defaultOrder` from table config). Supports dotted notations for joins, see below.
-- `page` + `itemsPerPage` — pagination (when either is present, response includes `pagination` object; `page` defaults to 1, `itemsPerPage` defaults to 500)
+- `page` + `itemsPerPage` — pagination (when either is present, response includes `pagination` object; `page` defaults to 1, `itemsPerPage` defaults to 500). `itemsPerPage` is capped server-side at `maxItemsPerPage` (default 1000); sending a larger value returns 400.
 - `computeMin`, `computeMax`, `computeSum`, `computeAvg` — aggregate a column, returned in `pagination.computed`
 
-### Body (all fields optional, empty `{}` returns all records)
+### Body (all fields optional, empty `{}` returns up to `maxItemsPerPage` records)
 
 ```json
 {
@@ -350,7 +350,7 @@ Add `page` or `itemsPerPage` to the query string to enable pagination:
 ?itemsPerPage=10          # page defaults to 1
 ```
 
-When either is present, the response includes a `pagination` object with total count, total pages, and the paginator values. `page` defaults to 1, `itemsPerPage` defaults to 500.
+When either is present, the response includes a `pagination` object with total count, total pages, and the paginator values. `page` defaults to 1, `itemsPerPage` defaults to 500. `itemsPerPage` is capped at `maxItemsPerPage` (default 1000) — a larger value returns 400. Even without pagination, a search returns at most `maxItemsPerPage` rows.
 
 ### Computed values (aggregations on main table)
 
@@ -503,6 +503,8 @@ Insert or update multiple records in a single request.
 
 All main records are inserted/upserted in a single SQL query. Secondaries and deletions are processed per-item. `secondaries`/`deletions` keys are **aliases**.
 
+The array is capped at `maxBulkItems` (default 1000); a longer array returns 400 — chunk client-side if you have more.
+
 **Response (200):** Array of `{ main (PK-only), secondaries? (PK-only), deletions? }`.
 
 ---
@@ -517,7 +519,7 @@ Delete multiple records by PK.
 [{ "id": 1 }, { "id": 2 }, { "id": 3 }]
 ```
 
-Each object must contain the PK field. All deletions execute as a single `DELETE WHERE pk IN (...)`.
+Each object must contain the PK field. All deletions execute as a single `DELETE WHERE pk IN (...)`. The array is capped at `maxBulkItems` (default 1000) — a longer array returns 400.
 
 **Response (200):** Array of PK-only objects.
 
@@ -531,7 +533,7 @@ Each object must contain the PK field. All deletions execute as a single `DELETE
 
 Insert, update, and bulk-upsert endpoints may return **structured field-level validation errors** (400). Two sources:
 
-1. **Schema validation** (TypeBox/Ajv) — type mismatches, missing required fields
+1. **Schema validation** (TypeBox/Ajv) — type mismatches, missing required fields, and **unknown properties** (write bodies reject any field not in the table Schema — send only real columns, don't include extra keys)
 2. **Custom validation** (`validate` / `validateBulk` on the table) — business rules, cross-entity checks
 
 Both return the same response format:

package/README.md

@@ -143,8 +143,9 @@ const TableCustomer = defineTable({
   ...exportTableInfo(SchemaCustomer),
 
   // Ordering & filtering
-  defaultOrder: 'name',                     // default ORDER BY
+  defaultOrder: 'name',                     // default ORDER BY (camelCase fields map to DB columns)
   excludeFromCreation: ['id'],              // omit from INSERT (e.g. auto-increment)
+  readExclude: ['passwordHash'],            // hide from all reads (writes unaffected)
   distinctResults: true,                    // SELECT DISTINCT
 
   // Relations — alias defaults to joinSchema.tableName. Override with `{ alias: '...' }`
@@ -238,6 +239,8 @@ await app.register(fastifyAutoSqlApi, {
   swagger: true,                // Optional — enable Swagger UI (or pass SwaggerOptions)
   onRequests: [authMiddleware],  // Optional — global hooks applied to every route
   getTenantId: (req) => id,     // Optional — multi-tenant function
+  maxItemsPerPage: 1000,        // Optional — cap on search page size (default: 1000)
+  maxBulkItems: 1000,           // Optional — cap on bulk array length (default: 1000)
   debug: true,                  // Optional — log all SQL queries and params
 });
 ```
@@ -250,6 +253,8 @@ await app.register(fastifyAutoSqlApi, {
 | `swagger` | `boolean \| SwaggerOptions` | No | Enable Swagger UI |
 | `onRequests` | `Function[]` | No | Global auth/middleware hooks |
 | `getTenantId` | `(req) => id \| null` | No | Tenant resolver for multi-tenant |
+| `maxItemsPerPage` | `number` | No | Max search page size, and the row `LIMIT` applied when no paginator is sent (default: `1000`) |
+| `maxBulkItems` | `number` | No | Max number of items accepted by the bulk endpoints (default: `1000`) |
 | `debug` | `boolean` | No | Log all SQL queries to console |
 
 For MySQL/MariaDB, register `mysql2/promise` pool instead of `@fastify/postgres` and pass `dialect: 'mysql'` or `'mariadb'`.
@@ -294,6 +299,43 @@ are always available to your own code.
 **3. Multi-tenancy** — `getTenantId` + `tenantScope` filter every query by tenant (see
 [Multi-Tenant](#multi-tenant)).
 
+### Request limits
+
+Two hard caps bound how much work a single request can trigger (defense against accidental or
+malicious resource exhaustion — relevant precisely because the API is open by default):
+
+- **Search result size** — `itemsPerPage` above `maxItemsPerPage` (default `1000`) is rejected
+  with `400`. When a search omits pagination entirely, the same value is applied as a `LIMIT`, so
+  an empty-body `POST /search/:table` can never dump an entire table.
+- **Bulk array size** — the `PUT /bulk/:table` and `POST /bulk/:table/delete` bodies reject arrays
+  longer than `maxBulkItems` (default `1000`) at schema validation.
+
+Both are configurable in the plugin options. The programmatic `fastify.sqlApi.*` methods are not
+capped — they run your own trusted code.
+
+### Write whitelist
+
+Insert/update/bulk-upsert bodies reject **unknown properties** (`additionalProperties: false`):
+only columns present in the generated Schema (as narrowed by `schemaOverrides` /
+`excludeFromCreation`) can be written. An unexpected field is a `400`, never a silently-written
+column — the Schema is the write whitelist. Trim the generated Schema (or use `excludeFromCreation`)
+to keep sensitive columns out of it.
+
+### Read visibility
+
+`readExclude` hides columns from every read while leaving writes untouched — the case for a
+password hash or an access token: writable, never readable.
+
+```typescript
+readExclude: ['accessToken'],
+```
+
+Excluded fields are not selected by search/get, are omitted from read response schemas and from
+the table's default join selection, and cannot be referenced from `filters`, `conditions`,
+`orderBy`, aggregations or an explicit join `selection` (`400`). That last part is the point:
+letting a hidden field be filtered would leak its value by bisection. Primary keys cannot be
+excluded.
+
 ## API Reference
 
 ### POST /search/{table}
@@ -358,6 +400,8 @@ Search with filters, advanced conditions, pagination, ordering, joins, and aggre
 
 **Querystring** (optional): `orderBy`, `page`, `itemsPerPage`, `computeMin`, `computeMax`, `computeSum`, `computeAvg`
 
+> `itemsPerPage` is capped at `maxItemsPerPage` (default `1000`); a larger value returns `400`. A search with no `page`/`itemsPerPage` returns at most that many rows (no full-table dumps). See [Request limits](#request-limits).
+
 **Response:**
 
 ```json
@@ -501,6 +545,17 @@ defineTable({
 
 Tables without `tenantScope` are unaffected.
 
+### Isolation guarantees on writes
+
+Tenant isolation is enforced on write paths, not just reads:
+
+- **Upsert conflicts are ownership-checked.** On a tenant-scoped table with an `upsertMap`, an
+  upsert (`POST /rest/:table` or `PUT /bulk/:table`) whose conflict key matches a row owned by
+  another tenant is rejected with `403` — it cannot overwrite or re-assign that row.
+- **The tenant link cannot be changed to another tenant.** For direct scopes the tenant column is
+  stripped from update payloads. For indirect scopes, changing the through-FK (`localField`) is
+  allowed only to a value the caller owns; otherwise the update returns `403`.
+
 ## Swagger
 
 Enabled by passing `swagger: true` (or a config object) to the plugin options. Requires `@fastify/swagger` and `@fastify/swagger-ui` as peer dependencies.
@@ -610,7 +665,7 @@ After registering the plugin, `app.sqlApi` is decorated on the Fastify instance
 ## Requirements
 
 - Node.js >= 18
-- Fastify >= 4 (peer dependency)
+- Fastify >= 5 (peer dependency)
 - One of:
   - **PostgreSQL** + `pg` + `@fastify/postgres`
   - **MySQL** / **MariaDB** + `mysql2`

package/dist/bin/generate-tables.js

@@ -20,7 +20,7 @@ function printHelp() {
     console.log('  sqlapi-generate-tables --all');
     console.log('');
     display('Table*.ts files are only created if they do not already exist.', CONSOLE_COLORS.magenta);
-    display('dbTables.ts is always regenerated to include all schemas.', CONSOLE_COLORS.magenta);
+    display('dbTables.ts is created if missing, indexing the Table*.ts files present on disk.', CONSOLE_COLORS.magenta);
 }
 await runCli('fastify-auto-sqlapi: generating tables template', async () => {
     const cliArgs = parseArgs({
@@ -84,9 +84,11 @@ await runCli('fastify-auto-sqlapi: generating tables template', async () => {
             }
         }
     }
+    const tableVarOf = (schema) => 'Table' + schema.schemaName.replace(/^Schema/, '');
     // Generate individual Table*.ts files (skip if already exists)
+    const createdTableVars = [];
     for (const schema of targetSchemas) {
-        const tableVarName = 'Table' + schema.schemaName.replace(/^Schema/, '');
+        const tableVarName = tableVarOf(schema);
         const tableFile = path.join(tablesDir, `${tableVarName}.ts`);
         if (fs.existsSync(tableFile)) {
             displayAsTableRow(`${tableVarName}.ts`, 'skipped (already exists)', 60, CONSOLE_COLORS.gray);
@@ -94,17 +96,29 @@ await runCli('fastify-auto-sqlapi: generating tables template', async () => {
         else {
             const content = generateSingleTableFile(schema, allSchemas);
             fs.writeFileSync(tableFile, content);
+            createdTableVars.push(tableVarName);
             displayAsTableRow(`${tableVarName}.ts`, 'created', 60, CONSOLE_COLORS.green);
         }
     }
-    // Generate dbTables.ts only if it does not exist
+    // Generate dbTables.ts only if it does not exist. The index must reference only
+    // Table*.ts files actually present on disk, otherwise a subset run would emit
+    // imports for files that were never generated and the project would not compile.
     const dbTablesFile = path.join(tablesDir, 'dbTables.ts');
     if (fs.existsSync(dbTablesFile)) {
         displayAsTableRow('dbTables.ts', 'skipped (already exists)', 60, CONSOLE_COLORS.gray);
+        const indexContent = fs.readFileSync(dbTablesFile, 'utf-8');
+        const missing = createdTableVars.filter((v) => !indexContent.includes(v));
+        if (missing.length > 0) {
+            display(`Remember to add the new tables to dbTables.ts: ${missing.join(', ')}`, CONSOLE_COLORS.yellow);
+        }
     }
     else {
-        const dbTablesContent = generateDbTablesIndex(allSchemas);
-        fs.writeFileSync(dbTablesFile, dbTablesContent);
+        const existingTableVars = new Set(fs
+            .readdirSync(tablesDir)
+            .filter((f) => f.startsWith('Table') && f.endsWith('.ts'))
+            .map((f) => f.slice(0, -'.ts'.length)));
+        const indexSchemas = allSchemas.filter((s) => existingTableVars.has(tableVarOf(s)));
+        fs.writeFileSync(dbTablesFile, generateDbTablesIndex(indexSchemas));
         displayAsTableRow('dbTables.ts', 'created', 60, CONSOLE_COLORS.green);
     }
     console.log('');

package/dist/lib/cli/tables-codegen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tables-codegen.d.ts","sourceRoot":"","sources":["../../../src/lib/cli/tables-codegen.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAuCpE;AAuCD,wBAAgB,eAAe,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,gBAAgB,EAAE,CAwB3E;AAID,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,MAAM,CAwHhG;AAID,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,CAqBrE;AAID,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,CA6FlE"}
+{"version":3,"file":"tables-codegen.d.ts","sourceRoot":"","sources":["../../../src/lib/cli/tables-codegen.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAuCpE;AAuCD,wBAAgB,eAAe,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,gBAAgB,EAAE,CAwB3E;AAID,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,MAAM,CA2HhG;AAID,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,CAqBrE;AAID,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,CA6FlE"}

package/dist/lib/cli/tables-codegen.js

@@ -130,10 +130,10 @@ export function generateSingleTableFile(schema, allSchemas) {
     // Imports
     lines.push(`import {defineTable, exportTableInfo, Type} from 'fastify-auto-sqlapi';`);
     lines.push(`import type {ValidationError} from 'fastify-auto-sqlapi';`);
-    lines.push(`import {${schema.schemaName} as Schema} from '../schemas/${schema.schemaName}';`);
+    lines.push(`import {${schema.schemaName} as Schema} from '../schemas/${schema.schemaName}.js';`);
     // Commented imports for related schemas
     for (const relSchema of relatedSchemas) {
-        lines.push(`// import {${relSchema}} from '../schemas/${relSchema}';`);
+        lines.push(`// import {${relSchema}} from '../schemas/${relSchema}.js';`);
     }
     lines.push(``);
     // Extra filters placeholder
@@ -161,6 +161,8 @@ export function generateSingleTableFile(schema, allSchemas) {
     else {
         lines.push(`  // excludeFromCreation: [],`);
     }
+    // Hide columns from every read (writes still accept them, e.g. a password hash)
+    lines.push(`  // readExclude: [],`);
     if (parentRels.length > 0) {
         lines.push(`  // allowedReadJoins: [`);
         for (const rel of parentRels) {
@@ -213,7 +215,7 @@ export function generateDbTablesIndex(schemas) {
     lines.push(``);
     for (const schema of schemas) {
         const tableVarName = 'Table' + schema.schemaName.replace(/^Schema/, '');
-        lines.push(`import {${tableVarName}} from './${tableVarName}';`);
+        lines.push(`import {${tableVarName}} from './${tableVarName}.js';`);
     }
     lines.push(``);
     lines.push(`export const dbTables: DbTables = {`);
@@ -245,7 +247,7 @@ export function generateTablesFile(schemas) {
     lines.push(``);
     // Schema imports
     for (const schema of schemas) {
-        lines.push(`import {${schema.schemaName}} from './${schema.schemaName}';`);
+        lines.push(`import {${schema.schemaName}} from './${schema.schemaName}.js';`);
     }
     // Table definitions
     for (const schema of schemas) {

package/dist/lib/engine/bulk/bulk-upsert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bulk-upsert.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/bulk/bulk-upsert.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAkF5F"}
+{"version":3,"file":"bulk-upsert.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/bulk/bulk-upsert.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAoF5F"}

package/dist/lib/engine/bulk/bulk-upsert.js

@@ -1,6 +1,6 @@
 import { camelcaseObject } from '../../naming.js';
 import { processSecondaries, processDeletions, prepareInsertRecord } from '../write-helpers.js';
-import { enforceTenantOnWrites } from '../../tenant.js';
+import { enforceTenantOnWrites, assertTenantOwnsConflicts } from '../../tenant.js';
 import { runBulkValidation } from '../validate.js';
 import { primaryAsCols } from '../../../types.js';
 export async function bulkUpsertEngine(params) {
@@ -26,6 +26,8 @@ export async function bulkUpsertEngine(params) {
     let pkRows;
     if (upsertKeys) {
         const conflictCols = upsertKeys.map((k) => schema.col(k));
+        // Tenant isolation: a conflicting upsert must not overwrite rows owned by another tenant.
+        await assertTenantOwnsConflicts(db, tenant, schema.tableName, conflictCols, preparedMains);
         pkRows = await db.bulkInsertOrUpdate(schema.tableName, preparedMains, conflictCols, pkCol);
     }
     else {

package/dist/lib/engine/rest/get.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/get.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAuB,MAAM,mBAAmB,CAAC;AAEnF,wBAAsB,SAAS,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CA6BrE"}
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/get.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAuB,MAAM,mBAAmB,CAAC;AAEnF,wBAAsB,SAAS,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CA8BrE"}

package/dist/lib/engine/rest/get.js

@@ -2,6 +2,7 @@ import { ConditionBuilder } from 'node-condition-builder';
 import { camelcaseObject } from '../../naming.js';
 import { buildTenantCondition, buildTenantJoin } from '../../tenant.js';
 import { httpError } from '../../errors.js';
+import { readableSelectColumns } from '../../read-access.js';
 import { primaryAsString } from '../../../types.js';
 export async function getEngine(params) {
     const { db, tableConf, id, tenant } = params;
@@ -19,6 +20,7 @@ export async function getEngine(params) {
     const values = cb.getValues();
     const rows = await db.select({
         tableName: tableConf.Schema.tableName,
+        columns: readableSelectColumns(tableConf, tableConf.Schema, db),
         where,
         values,
         limit: '1',

package/dist/lib/engine/rest/insert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"insert.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/insert.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA+D9E"}
+{"version":3,"file":"insert.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/insert.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAiE9E"}

package/dist/lib/engine/rest/insert.js

@@ -1,6 +1,6 @@
 import { camelcaseObject } from '../../naming.js';
 import { processSecondaries, prepareInsertRecord } from '../write-helpers.js';
-import { enforceTenantOnWrites } from '../../tenant.js';
+import { enforceTenantOnWrites, assertTenantOwnsConflicts } from '../../tenant.js';
 import { primaryAsCols } from '../../../types.js';
 export async function insertEngine(params) {
     const { db, tableConf, dbTables, request, record, secondaries, tenant } = params;
@@ -20,6 +20,8 @@ export async function insertEngine(params) {
         const upsertKeys = tableConf.upsertMap?.get(schema);
         if (upsertKeys) {
             const conflictCols = upsertKeys.map((k) => schema.col(k));
+            // Tenant isolation: a conflicting upsert must not overwrite a row owned by another tenant.
+            await assertTenantOwnsConflicts(tx, tenant, schema.tableName, conflictCols, [mainRecord]);
             pkResult = await tx.insertOrUpdate(schema.tableName, mainRecord, conflictCols, pkCol);
         }
         else {

package/dist/lib/engine/rest/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/update.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAqH9E"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/rest/update.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAwH9E"}

package/dist/lib/engine/rest/update.js

@@ -1,6 +1,6 @@
 import { snakecaseRecord } from '../../naming.js';
 import { processSecondaries, processDeletions } from '../write-helpers.js';
-import { stripTenantColumn, assertTenantOwnership, buildTenantUpdateExtra, } from '../../tenant.js';
+import { stripTenantColumn, assertTenantOwnership, buildTenantUpdateExtra, enforceTenantFKOnUpdate, } from '../../tenant.js';
 import { runValidation } from '../validate.js';
 import { httpError } from '../../errors.js';
 export async function updateEngine(params) {
@@ -29,9 +29,12 @@ export async function updateEngine(params) {
     const updateFields = { ...snaked };
     for (const c of pkCols)
         delete updateFields[c];
-    // 6. Strip tenant column (user cannot change tenant of an existing record)
+    // 6. Strip tenant column (user cannot change tenant of an existing record).
+    //    For indirect scopes the tenant link is the through-FK (localField): it may be changed,
+    //    but only to another value the caller owns — re-validate the new FK against the tenant.
     if (tenant) {
         stripTenantColumn(updateFields, tenant.scope);
+        await enforceTenantFKOnUpdate(db, tenant, updateFields);
     }
     // Steps 7-9 are atomic: a failure in secondaries or deletions rolls back the main
     // update too. Degrades to non-transactional when the adapter has no connect().

package/dist/lib/engine/search/search.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/search/search.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,QAAQ,EACR,YAAY,EACZ,YAAY,EAcb,MAAM,mBAAmB,CAAC;AAmiC3B,wBAAsB,YAAY,CAChC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,CAoIvB"}
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../../src/lib/engine/search/search.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,QAAQ,EACR,YAAY,EACZ,YAAY,EAcb,MAAM,mBAAmB,CAAC;AA+nC3B,wBAAsB,YAAY,CAChC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,CA4IvB"}