fastify-auto-sqlapi 0.1.3 → 0.1.5

package/dist/lib/engine/search/search.js

@@ -1,14 +1,16 @@
 import { ConditionBuilder } from 'node-condition-builder';
 import { camelcaseObject } from '../../naming.js';
 import { buildTenantCondition, buildTenantJoin } from '../../tenant.js';
+import { assertReadable, assertFiltersReadable, readableSelectColumns } from '../../read-access.js';
 import { primaryAsString } from '../../../types.js';
 // ─── Schema field validation ────────────────────────────────
-function validateSchemaField(field, schema) {
+function validateSchemaField(field, schema, tableConf) {
     if (!(field in schema.fields)) {
         const err = new Error(`Unknown field: ${field}`);
         err.statusCode = 400;
         throw err;
     }
+    assertReadable(tableConf, field);
     return schema.col(field);
 }
 function err400(msg) {
@@ -37,6 +39,7 @@ function buildComputedContext(db, schema, alias) {
 }
 function resolveFieldRef(field, schema, tableConf, db, alias) {
     if (field in schema.fields) {
+        assertReadable(tableConf, field);
         const col = db.qi(schema.col(field));
         const expr = alias ? `${db.qi(alias)}.${col}` : col;
         return { expr, values: [], computed: false };
@@ -121,11 +124,19 @@ function mapRowsToCamelCase(rows, schema, computedFieldNames) {
         return camel;
     });
 }
-/** Build the SELECT columns list for a join fetch: '*' or comma-separated quoted columns. */
-function buildSelectionColumns(selection, joinSchema, db) {
-    if (selection === '*')
-        return '*';
-    return selection.split(',').map((c) => db.qi(joinSchema.col(c.trim()))).join(', ');
+/**
+ * Build the SELECT columns list for a join fetch: '*' or comma-separated quoted columns.
+ * A default '*' selection narrows to the join table's readable columns when it declares
+ * `readExclude`; an explicit selection naming an excluded field is rejected with 400.
+ */
+function buildSelectionColumns(selection, joinSchema, db, joinTableConf) {
+    if (selection === '*') {
+        return readableSelectColumns(joinTableConf, joinSchema, db) ?? '*';
+    }
+    return selection
+        .split(',')
+        .map((c) => db.qi(validateSchemaField(c.trim(), joinSchema, joinTableConf)))
+        .join(', ');
 }
 const AGG_FN = {
     sum: { sql: 'SUM', distinct: false },
@@ -171,6 +182,28 @@ function buildAggOrderExpr(db, dbTables, tableConf, alias, fn, field, joinGroup,
     const expr = `COALESCE((SELECT ${aggExpr(aggFn, qualifiedCol)} FROM ${refs.joinTable} WHERE ${refs.joinTable}.${refs.fkCol} = ${refs.mainTable}.${refs.mainCol}${filterWhere}), 0)`;
     return { expr, values: filterVals };
 }
+/**
+ * Pre-scan `orderBy` for the joinLeft aliases referenced in 2-parti notation (`<alias>.<field>`).
+ * Needed BEFORE building the LEFT JOIN clauses (which must know their aliases) while the actual
+ * orderBy SQL — with its parameter placeholders — is only baked later, once the LEFT JOIN value
+ * count is known. Validates each alias against `allowedReadJoins` (throws 400), mirroring
+ * `validateOrderBy`; 3-parti aggregation entries are ignored (they use joinGroup, not a LEFT JOIN).
+ */
+function collectOrderByLeftAliases(orderBy, tableConf) {
+    const aliases = new Set();
+    for (const part of orderBy.split(',')) {
+        const trimmed = part.trim();
+        if (/^(\w+)\.(\w+)\.(\w+)(?:\s+(ASC|DESC))?$/i.test(trimmed))
+            continue; // 3-parti aggregation
+        const m = trimmed.match(/^(\w+)\.(\w+)(?:\s+(ASC|DESC))?$/i);
+        if (m) {
+            const alias = m[1];
+            requireJoin(tableConf, alias, true);
+            aliases.add(alias);
+        }
+    }
+    return aliases;
+}
 function validateOrderBy(orderBy, tableConf, db, dbTables, joinGroup, startIdx) {
     const parts = orderBy.split(',');
     const outParts = [];
@@ -197,7 +230,7 @@ function validateOrderBy(orderBy, tableConf, db, dbTables, joinGroup, startIdx)
         if (dotted2) {
             const [, alias, field, dir] = dotted2;
             const joinDef = requireJoin(tableConf, alias, true);
-            const col = validateSchemaField(field, joinDef.joinSchema);
+            const col = validateSchemaField(field, joinDef.joinSchema, dbTables[joinDef.joinSchema.tableName]);
             // Reference the LEFT JOIN'd table via its alias (SQL identifier).
             outParts.push(`${db.qi(alias)}.${db.qi(col)} ${(dir || 'ASC').toUpperCase()}`);
             leftJoinAliases.add(alias);
@@ -237,6 +270,7 @@ function buildLeftJoinClauses(db, dbTables, tableConf, aliasesNeedingJoin, joinL
             const cb = new ConditionBuilder('AND', db.cbDialect);
             const joinTableConf = dbTables[joinSchema.tableName];
             const computed = joinTableConf?.computedFields;
+            assertFiltersReadable(ref.filters, joinTableConf);
             if (ref.filters) {
                 for (const [field, value] of Object.entries(ref.filters)) {
                     if (value === null || value === undefined)
@@ -257,6 +291,7 @@ function buildLeftJoinClauses(db, dbTables, tableConf, aliasesNeedingJoin, joinL
                         err400(`Invalid condition method: ${c.method}`);
                     }
                     if (c.field in joinSchema.fields) {
+                        assertReadable(dbTables[joinSchema.tableName], c.field);
                         const col = `${aliasIdent}.${db.qi(joinSchema.col(c.field))}`;
                         dispatchConditionMethod(cb, c.method, col, c.params ?? []);
                     }
@@ -281,17 +316,52 @@ function buildLeftJoinClauses(db, dbTables, tableConf, aliasesNeedingJoin, joinL
     return { joinClauses, whereExtras, values };
 }
 // ─── Main query execution ───────────────────────────────────
-async function executeMainQuery(db, tableConf, where, values, orderBy, paginator, extraJoins = [], selectComputed) {
+/**
+ * Converts a configured order (`defaultOrder` or the primary-key fallback) to SQL.
+ * Unlike the request `orderBy` (strictly validated by `validateOrderBy`), this is
+ * lenient for backward compatibility: tokens matching a camelCase schema field are
+ * mapped to their quoted DB column, computed fields (without bound values) expand
+ * to their expression, and anything else passes through unchanged as raw SQL.
+ */
+function convertConfiguredOrder(order, tableConf, db) {
+    return order
+        .split(',')
+        .map((part) => {
+        const trimmed = part.trim();
+        const match = trimmed.match(/^(\w+)(?:\s+(ASC|DESC))?$/i);
+        if (match) {
+            const [, field, dir] = match;
+            const suffix = dir ? ` ${dir.toUpperCase()}` : '';
+            if (field in tableConf.Schema.fields) {
+                return `${db.qi(tableConf.Schema.col(field))}${suffix}`;
+            }
+            const computed = tableConf.computedFields?.[field];
+            if (computed) {
+                const ev = evaluateComputedField(computed, tableConf.Schema, db, undefined, `Computed field '${field}' with bound values cannot be used in defaultOrder`);
+                return `${ev.expr}${suffix}`;
+            }
+        }
+        return trimmed;
+    })
+        .join(', ');
+}
+async function executeMainQuery(db, tableConf, where, values, orderBy, paginator, extraJoins = [], selectComputed, maxRows) {
     const tableName = tableConf.Schema.tableName;
-    const order = orderBy || tableConf.defaultOrder || primaryAsString(tableConf.primary);
+    // Request orderBy arrives already validated and mapped by validateOrderBy;
+    // configured fallbacks (defaultOrder / primary key) are converted leniently here.
+    const order = orderBy || convertConfiguredOrder(tableConf.defaultOrder || primaryAsString(tableConf.primary), tableConf, db);
+    // With a paginator, the page size governs the LIMIT. Without one, apply `maxRows` (if set) so an
+    // unbounded search cannot dump the whole table; a plain integer is a safe, non-injectable LIMIT.
     const limit = paginator
         ? `${paginator.itemsPerPage} OFFSET ${(paginator.page - 1) * paginator.itemsPerPage}`
-        : null;
+        : (maxRows != null ? String(maxRows) : null);
+    // Base projection: '*' unless the table hides fields via readExclude.
+    const readableColumns = readableSelectColumns(tableConf, tableConf.Schema, db);
     // Optional computed projections — bound values, if any, are NOT yet supported
     // here (would require placeholder-aware composition with WHERE values).
-    let columns;
+    let columns = readableColumns;
     if (selectComputed?.length) {
-        const projections = ['*'];
+        const projections = [readableColumns ?? '*'];
         for (const name of selectComputed) {
             const fn = tableConf.computedFields?.[name];
             if (!fn)
@@ -367,7 +437,7 @@ async function executeJoinMultiple(db, dbTables, tableConf, mainResults, joinMul
             ({ where, values } = appendComputedConditions(where, values, computedClauses, db));
         }
         const selection = ref?.selection ?? defaultSelection;
-        const columns = buildSelectionColumns(selection, joinSchema, db);
+        const columns = buildSelectionColumns(selection, joinSchema, db, joinTableConf);
         const rows = await db.select({
             tableName: joinSchema.tableName,
             columns,
@@ -401,7 +471,7 @@ async function executeJoinLeft(db, dbTables, tableConf, mainResults, joinLeft, t
         const where = cb.build(1, db.ph);
         const values = cb.getValues();
         const selection = ref?.selection ?? defaultSelection;
-        const columns = buildSelectionColumns(selection, joinSchema, db);
+        const columns = buildSelectionColumns(selection, joinSchema, db, joinTableConf);
         const rows = await db.select({
             tableName: joinSchema.tableName,
             columns,
@@ -458,7 +528,7 @@ async function executeJoinGroup(db, dbTables, tableConf, mainResults, joinGroup,
                 return;
             const fn = AGG_FN[kind];
             for (const f of fields) {
-                const col = validateSchemaField(f, joinSchema);
+                const col = validateSchemaField(f, joinSchema, joinTableConf);
                 selectParts.push(`${aggExpr(fn, db.qi(col))} as "${kind}_${f}"`);
             }
         };
@@ -544,6 +614,7 @@ function dispatchConditionMethod(cb, method, colOrExpr, params) {
     }
 }
 function buildJoinRefCondition(joinTableConf, joinSchema, ref, db) {
+    assertFiltersReadable(ref.filters, joinTableConf);
     const cb = (ref.filters && joinTableConf)
         ? joinTableConf.filters(ref.filters, db.cbDialect)
         : new ConditionBuilder('AND', db.cbDialect);
@@ -557,7 +628,7 @@ function buildJoinRefCondition(joinTableConf, joinSchema, ref, db) {
             // for an LHS expression.
             if (joinTableConf?.computedFields?.[c.field])
                 continue;
-            const col = db.qi(validateSchemaField(c.field, joinSchema));
+            const col = db.qi(validateSchemaField(c.field, joinSchema, joinTableConf));
             dispatchConditionMethod(cb, c.method, col, c.params ?? []);
         }
     }
@@ -754,6 +825,7 @@ export async function searchEngine(dbTables, params) {
         for (const a of Object.keys(joinLeft))
             requireJoin(tableConf, a, true);
     // Build main condition
+    assertFiltersReadable(filters, tableConf);
     const condition = tableConf.filters(filters || {}, db.cbDialect);
     // Filters that target computed fields (declared on tableConf.computedFields)
     // are applied via the side-channel pattern further down.
@@ -794,27 +866,23 @@ export async function searchEngine(dbTables, params) {
             ({ where, values } = appendAggConditions(where, values, conditions, db, dbTables, tableConf, joinGroup));
         }
     }
-    // orderBy parsing — collects 2-parti aliases that need LEFT JOIN on the main query
-    let safeOrderBy;
-    let orderByValues = [];
-    let orderByLeftAliases = new Set();
-    if (orderBy) {
-        const obResult = validateOrderBy(orderBy, tableConf, db, dbTables, joinGroup, values.length + 1);
-        safeOrderBy = obResult.sql;
-        orderByValues = obResult.values;
-        orderByLeftAliases = obResult.leftJoinAliases;
-    }
     // Determine which joinLeft aliases need a LEFT JOIN on the main query:
     // - any alias used in 2-parti orderBy
     // - any alias in joinLeft body that has filters or conditions on the parent
-    const aliasesNeedingLeftJoin = new Set(orderByLeftAliases);
+    const aliasesNeedingLeftJoin = new Set();
+    if (orderBy) {
+        for (const a of collectOrderByLeftAliases(orderBy, tableConf))
+            aliasesNeedingLeftJoin.add(a);
+    }
     if (joinLeft) {
         for (const [alias, ref] of Object.entries(joinLeft)) {
             if (ref?.filters || ref?.conditions?.length)
                 aliasesNeedingLeftJoin.add(alias);
         }
     }
-    // Build LEFT JOIN clauses + extra WHERE for filtered parents
+    // Build LEFT JOIN clauses + extra WHERE for filtered parents. Their placeholders start right
+    // after the WHERE values; the same clause SQL is reused by the pagination COUNT/compute queries,
+    // whose value array is [...WHERE, ...leftJoin] — so this base MUST stay `values.length + 1`.
     const extraJoinClauses = [...tenantJoins];
     let leftJoinValues = [];
     if (aliasesNeedingLeftJoin.size > 0) {
@@ -824,11 +892,21 @@ export async function searchEngine(dbTables, params) {
         for (const w of lj.whereExtras)
             where += ` AND ${w}`;
     }
+    // orderBy is parsed AFTER the LEFT JOIN values so aggregation-orderBy placeholders start past
+    // them (main query binds [...WHERE, ...leftJoin, ...orderBy]). Parsing it earlier with base
+    // `values.length + 1` misbinds when BOTH an aggregation orderBy and a filtered joinLeft exist.
+    let safeOrderBy;
+    let orderByValues = [];
+    if (orderBy) {
+        const obResult = validateOrderBy(orderBy, tableConf, db, dbTables, joinGroup, values.length + leftJoinValues.length + 1);
+        safeOrderBy = obResult.sql;
+        orderByValues = obResult.values;
+    }
     // Bind WHERE values + LEFT JOIN values + orderBy aggregation values for main query.
     // Pagination COUNT/compute include WHERE + LEFT JOIN values (no orderBy).
     const whereAndJoinValues = [...values, ...leftJoinValues];
     const mainValues = [...whereAndJoinValues, ...orderByValues];
-    const main = await executeMainQuery(db, tableConf, where, mainValues, safeOrderBy, paginator, extraJoinClauses, params.selectComputed);
+    const main = await executeMainQuery(db, tableConf, where, mainValues, safeOrderBy, paginator, extraJoinClauses, params.selectComputed, params.maxRows);
     let pagination;
     if (paginator) {
         pagination = await buildPagination(db, tableConf, where, whereAndJoinValues, paginator, extraJoinClauses, computeMin, computeMax, computeSum, computeAvg);

package/dist/lib/read-access.d.ts

@@ -0,0 +1,31 @@
+import type { QueryClient } from './db.js';
+import type { ITable, SchemaDefinition } from '../types.js';
+/**
+ * Read visibility (`ITable.readExclude`).
+ *
+ * Excluded fields are never projected by any read query and cannot be referenced
+ * from filters, conditions, orderBy, aggregations or join selections: allowing a
+ * field to be filtered while hiding it from the output would still leak its value
+ * by bisection. Write paths (insert/update/upsert) are deliberately unaffected —
+ * a field can be writable but never readable (e.g. a password hash).
+ */
+export declare function isReadExcluded(tableConf: ITable | undefined, field: string): boolean;
+/** Throws 400 when `field` is read-excluded on `tableConf`. */
+export declare function assertReadable(tableConf: ITable | undefined, field: string): void;
+/**
+ * Throws 400 when a filter map targets a read-excluded field. Keys that are not
+ * excluded pass through untouched (extraFilters and computed names included).
+ */
+export declare function assertFiltersReadable(filters: Record<string, unknown> | undefined, tableConf: ITable | undefined): void;
+/** Schema field names that may be read, in schema declaration order. */
+export declare function readableFieldNames(tableConf: ITable | undefined, schema: SchemaDefinition): string[];
+/**
+ * SELECT column list for a table with read exclusions, or `undefined` when the
+ * table has none (callers keep their existing `*` projection).
+ *
+ * Columns are qualified with the table name: read queries may carry a tenant
+ * `through` INNER JOIN, where a bare column name shared with the through table
+ * would be ambiguous.
+ */
+export declare function readableSelectColumns(tableConf: ITable | undefined, schema: SchemaDefinition, db: QueryClient): string | undefined;
+//# sourceMappingURL=read-access.d.ts.map

package/dist/lib/read-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-access.d.ts","sourceRoot":"","sources":["../../src/lib/read-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG5D;;;;;;;;GAQG;AAEH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpF;AAED,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIjF;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC5C,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,IAAI,CAKN;AAED,wEAAwE;AACxE,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,gBAAgB,GACvB,MAAM,EAAE,CAIV;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,gBAAgB,EACxB,EAAE,EAAE,WAAW,GACd,MAAM,GAAG,SAAS,CAMpB"}

package/dist/lib/read-access.js

@@ -0,0 +1,53 @@
+import { httpError } from './errors.js';
+/**
+ * Read visibility (`ITable.readExclude`).
+ *
+ * Excluded fields are never projected by any read query and cannot be referenced
+ * from filters, conditions, orderBy, aggregations or join selections: allowing a
+ * field to be filtered while hiding it from the output would still leak its value
+ * by bisection. Write paths (insert/update/upsert) are deliberately unaffected —
+ * a field can be writable but never readable (e.g. a password hash).
+ */
+export function isReadExcluded(tableConf, field) {
+    return tableConf?.readExclude?.includes(field) ?? false;
+}
+/** Throws 400 when `field` is read-excluded on `tableConf`. */
+export function assertReadable(tableConf, field) {
+    if (isReadExcluded(tableConf, field)) {
+        throw httpError(400, `Field is not readable: ${field}`);
+    }
+}
+/**
+ * Throws 400 when a filter map targets a read-excluded field. Keys that are not
+ * excluded pass through untouched (extraFilters and computed names included).
+ */
+export function assertFiltersReadable(filters, tableConf) {
+    if (!filters || !tableConf?.readExclude?.length)
+        return;
+    for (const key of Object.keys(filters)) {
+        assertReadable(tableConf, key);
+    }
+}
+/** Schema field names that may be read, in schema declaration order. */
+export function readableFieldNames(tableConf, schema) {
+    const fields = Object.keys(schema.fields);
+    if (!tableConf?.readExclude?.length)
+        return fields;
+    return fields.filter((f) => !isReadExcluded(tableConf, f));
+}
+/**
+ * SELECT column list for a table with read exclusions, or `undefined` when the
+ * table has none (callers keep their existing `*` projection).
+ *
+ * Columns are qualified with the table name: read queries may carry a tenant
+ * `through` INNER JOIN, where a bare column name shared with the through table
+ * would be ambiguous.
+ */
+export function readableSelectColumns(tableConf, schema, db) {
+    if (!tableConf?.readExclude?.length)
+        return undefined;
+    const table = db.qi(schema.tableName);
+    return readableFieldNames(tableConf, schema)
+        .map((f) => `${table}.${db.qi(schema.col(f))}`)
+        .join(', ');
+}

package/dist/lib/schema/bulk-delete.d.ts

@@ -1,5 +1,5 @@
 import type { DbTables } from '../../types.js';
-export declare function BulkDeleteTableBody(dbTables: DbTables, tableName: string): import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+export declare function BulkDeleteTableBody(dbTables: DbTables, tableName: string, maxItems?: number): import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
     [x: string]: any;
 }>>;
 export declare function BulkDeleteTableResponse(dbTables: DbTables, tableName: string): import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{

package/dist/lib/schema/bulk-delete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bulk-delete.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/bulk-delete.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM;;IAMxE;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM;;;;IAU5E"}
+{"version":3,"file":"bulk-delete.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/bulk-delete.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM;;IAS3F;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM;;;;IAU5E"}

package/dist/lib/schema/bulk-delete.js

@@ -1,10 +1,10 @@
 import { Type } from '@sinclair/typebox';
 import { primaryAsString } from '../../types.js';
-export function BulkDeleteTableBody(dbTables, tableName) {
+export function BulkDeleteTableBody(dbTables, tableName, maxItems) {
     const tableConf = dbTables[tableName];
     const pkField = primaryAsString(tableConf.primary);
     const pkType = tableConf.Schema.fields[pkField];
-    return Type.Array(Type.Object({ [pkField]: pkType }));
+    return Type.Array(Type.Object({ [pkField]: pkType }, { additionalProperties: false }), maxItems != null ? { maxItems } : {});
 }
 export function BulkDeleteTableResponse(dbTables, tableName) {
     const tableConf = dbTables[tableName];

package/dist/lib/schema/bulk-upsert.d.ts

@@ -1,5 +1,5 @@
 import { type TSchema } from '@sinclair/typebox';
 import type { DbTables } from '../../types.js';
-export declare function BulkUpsertTableBody(dbTables: DbTables, tableName: string): import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<Record<string, TSchema>>>;
+export declare function BulkUpsertTableBody(dbTables: DbTables, tableName: string, maxItems?: number): import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<Record<string, TSchema>>>;
 export declare function BulkUpsertTableResponse(dbTables: DbTables, tableName: string): import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<Record<string, TSchema>>>;
 //# sourceMappingURL=bulk-upsert.d.ts.map

package/dist/lib/schema/bulk-upsert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bulk-upsert.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/bulk-upsert.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAS/C,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,oGAgBxE;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,oGAa5E"}
+{"version":3,"file":"bulk-upsert.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/bulk-upsert.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAS/C,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,oGAoB3F;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,oGAa5E"}

package/dist/lib/schema/bulk-upsert.js

@@ -1,18 +1,20 @@
 import { Type } from '@sinclair/typebox';
 import { primaryAsString } from '../../types.js';
 import { pkSchema, applySchemaOverrides, attachWriteJoinSections, writeJoinBodyFields, writeJoinResponseFields, } from './helpers.js';
-export function BulkUpsertTableBody(dbTables, tableName) {
+export function BulkUpsertTableBody(dbTables, tableName, maxItems) {
     const tableConf = dbTables[tableName];
     const schema = tableConf.Schema;
-    const mainSchema = Type.Partial(Type.Object(applySchemaOverrides({ ...schema.fields }, tableConf)));
+    // additionalProperties:false makes the schema the real write whitelist (no mass assignment).
+    const mainSchema = Type.Partial(Type.Object(applySchemaOverrides({ ...schema.fields }, tableConf), { additionalProperties: false }));
     const itemProperties = {
         main: mainSchema,
     };
     attachWriteJoinSections(itemProperties, tableConf, dbTables, {
         withDeletions: true,
         secondaryFields: writeJoinBodyFields,
+        strictItems: true,
     });
-    return Type.Array(Type.Object(itemProperties));
+    return Type.Array(Type.Object(itemProperties), maxItems != null ? { maxItems } : {});
 }
 export function BulkUpsertTableResponse(dbTables, tableName) {
     const tableConf = dbTables[tableName];

package/dist/lib/schema/helpers.d.ts

@@ -24,6 +24,7 @@ type JoinFieldsBuilder = (join: JoinDefinition, secondaryConf: ITable | undefine
  */
 export declare function buildJoinAliasMap(tableConf: ITable, dbTables: DbTables, build: JoinFieldsBuilder, options?: {
     itemsPartial?: boolean;
+    strictItems?: boolean;
 }): Record<string, TSchema>;
 /**
  * Attach `secondaries` (and optionally `deletions`) sections to the given target object,
@@ -37,6 +38,7 @@ export declare function buildJoinAliasMap(tableConf: ITable, dbTables: DbTables,
 export declare function attachWriteJoinSections(target: Record<string, TSchema>, tableConf: ITable, dbTables: DbTables, options: {
     withDeletions: boolean;
     secondaryFields: JoinFieldsBuilder;
+    strictItems?: boolean;
 }): void;
 /** JoinFieldsBuilder for body schemas: includes all join fields with FK + excluded made Optional. */
 export declare const writeJoinBodyFields: JoinFieldsBuilder;

package/dist/lib/schema/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGzF;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ3H;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,MAAM,GAAG,SAAS,GACrC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBzB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB;AAED,KAAK,iBAAiB,GAAG,CACvB,IAAI,EAAE,cAAc,EACpB,aAAa,EAAE,MAAM,GAAG,SAAS,KAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE7B;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,iBAAiB,EACxB,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GACvC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE;IAAE,aAAa,EAAE,OAAO,CAAC;IAAC,eAAe,EAAE,iBAAiB,CAAA;CAAE,GACtE,IAAI,CAmBN;AAED,qGAAqG;AACrG,eAAO,MAAM,mBAAmB,EAAE,iBACmB,CAAC;AAEtD,uDAAuD;AACvD,eAAO,MAAM,uBAAuB,EAAE,iBACG,CAAC"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGzF;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ3H;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,MAAM,GAAG,SAAS,GACrC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBzB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB;AAED,KAAK,iBAAiB,GAAG,CACvB,IAAI,EAAE,cAAc,EACpB,aAAa,EAAE,MAAM,GAAG,SAAS,KAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE7B;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,iBAAiB,EACxB,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9D,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE;IAAE,aAAa,EAAE,OAAO,CAAC;IAAC,eAAe,EAAE,iBAAiB,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7F,IAAI,CAmBN;AAED,qGAAqG;AACrG,eAAO,MAAM,mBAAmB,EAAE,iBACmB,CAAC;AAEtD,uDAAuD;AACvD,eAAO,MAAM,uBAAuB,EAAE,iBACG,CAAC"}

package/dist/lib/schema/helpers.js

@@ -56,9 +56,10 @@ export function buildJoinAliasMap(tableConf, dbTables, build, options = {}) {
     const out = {};
     if (!tableConf.allowedWriteJoins?.length)
         return out;
+    const objOpts = options.strictItems ? { additionalProperties: false } : {};
     for (const j of tableConf.allowedWriteJoins) {
         const sc = findSecondaryTableConf(dbTables, j.joinSchema.tableName);
-        const item = Type.Object(build(j, sc));
+        const item = Type.Object(build(j, sc), objOpts);
         out[j.alias] = Type.Array(options.itemsPartial ? Type.Partial(item) : item);
     }
     return out;
@@ -75,7 +76,7 @@ export function buildJoinAliasMap(tableConf, dbTables, build, options = {}) {
 export function attachWriteJoinSections(target, tableConf, dbTables, options) {
     if (!tableConf.allowedWriteJoins?.length)
         return;
-    target.secondaries = Type.Optional(Type.Partial(Type.Object(buildJoinAliasMap(tableConf, dbTables, options.secondaryFields))));
+    target.secondaries = Type.Optional(Type.Partial(Type.Object(buildJoinAliasMap(tableConf, dbTables, options.secondaryFields, { strictItems: options.strictItems }))));
     if (options.withDeletions) {
         target.deletions = Type.Optional(Type.Partial(Type.Object(buildJoinAliasMap(tableConf, dbTables, ({ joinSchema }) => joinSchema.fields, { itemsPartial: true }))));
     }

package/dist/lib/schema/insert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"insert.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/insert.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAgB,MAAM,mBAAmB,CAAC;AAErE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAS/C,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAsB9E;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAalF"}
+{"version":3,"file":"insert.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/insert.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAgB,MAAM,mBAAmB,CAAC;AAErE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAS/C,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAyB9E;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAalF"}

package/dist/lib/schema/insert.js

@@ -12,11 +12,14 @@ export function InsertTableBody(dbTables, tableName) {
         }
     }
     const bodyProperties = {
-        main: Type.Object(mainFields),
+        // additionalProperties:false makes the schema the real write whitelist — unknown keys are
+        // rejected (400) instead of silently reaching the INSERT as columns (mass assignment).
+        main: Type.Object(mainFields, { additionalProperties: false }),
     };
     attachWriteJoinSections(bodyProperties, tableConf, dbTables, {
         withDeletions: false,
         secondaryFields: writeJoinBodyFields,
+        strictItems: true,
     });
     return Type.Object(bodyProperties);
 }

package/dist/lib/schema/search.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAgB,MAAM,mBAAmB,CAAC;AAErE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAY/C,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAuHlF;AAED,eAAO,MAAM,sBAAsB;;;;;;;;EASjC,CAAC;AAEH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmElF"}
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAgB,MAAM,mBAAmB,CAAC;AAGrE,OAAO,KAAK,EAAE,QAAQ,EAA4B,MAAM,gBAAgB,CAAC;AAyBzE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAuHlF;AAED,eAAO,MAAM,sBAAsB;;;;;;;;EASjC,CAAC;AAEH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAsElF"}

package/dist/lib/schema/search.js

@@ -1,5 +1,16 @@
 import { Type } from '@sinclair/typebox';
 import { ALLOWED_METHODS } from '../condition-methods.js';
+import { readableFieldNames } from '../read-access.js';
+/** Schema fields minus the ones hidden by `readExclude`. */
+function readableFields(schema, tableConf) {
+    if (!tableConf?.readExclude?.length)
+        return { ...schema.fields };
+    const out = {};
+    for (const field of readableFieldNames(tableConf, schema)) {
+        out[field] = schema.fields[field];
+    }
+    return out;
+}
 const JoinGroupResultItem = Type.Object({
     sum: Type.Optional(Type.Record(Type.String(), Type.Any())),
     min: Type.Optional(Type.Record(Type.String(), Type.Any())),
@@ -38,7 +49,7 @@ export function SearchTableBodyPost(dbTables, tableName) {
         }
     }
     const filterFields = {
-        ...schema.fields,
+        ...readableFields(schema, tableConf),
         ...tableConf.extraFilters,
         ...computedTypes,
     };
@@ -71,7 +82,7 @@ export function SearchTableBodyPost(dbTables, tableName) {
                 }
             }
             const joinFilterFields = joinTableConf
-                ? { ...joinSchema.fields, ...joinTableConf.extraFilters, ...joinComputedTypes }
+                ? { ...readableFields(joinSchema, joinTableConf), ...joinTableConf.extraFilters, ...joinComputedTypes }
                 : { ...joinSchema.fields };
             const joinRefShape = {
                 filters: Type.Optional(Type.Partial(Type.Object(joinFilterFields))),
@@ -150,16 +161,17 @@ export function SearchTableResponse(dbTables, tableName) {
             }
         }
     }
+    const mainReadable = readableFields(tableConf.Schema, tableConf);
     const mainItem = Object.keys(computedTypes).length > 0
-        ? Type.Partial(Type.Object({ ...tableConf.Schema.fields, ...computedTypes }))
-        : Type.Partial(Type.Object(tableConf.Schema.fields));
+        ? Type.Partial(Type.Object({ ...mainReadable, ...computedTypes }))
+        : Type.Partial(Type.Object(mainReadable));
     const joinMultipleProps = {};
     const joinLeftProps = {};
     const joinGroupProps = {};
     if (tableConf.allowedReadJoins) {
         for (const joinDef of tableConf.allowedReadJoins) {
             const { joinSchema, alias, unique } = joinDef;
-            const itemArray = Type.Array(Type.Partial(Type.Object(joinSchema.fields)));
+            const itemArray = Type.Array(Type.Partial(Type.Object(readableFields(joinSchema, dbTables[joinSchema.tableName]))));
             if (unique) {
                 joinLeftProps[alias] = itemArray;
             }

package/dist/lib/schema/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAgB,MAAM,mBAAmB,CAAC;AAErE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAS/C,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAqB9E;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAalF"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,OAAO,EAAgB,MAAM,mBAAmB,CAAC;AAErE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAS/C,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAwB9E;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAalF"}

package/dist/lib/schema/update.js

@@ -11,11 +11,14 @@ export function UpdateTableBody(dbTables, tableName) {
         mainFields[key] = key === primaryAsString(tableConf.primary) ? value : Type.Optional(value);
     }
     const bodyProperties = {
-        main: Type.Object(mainFields),
+        // additionalProperties:false makes the schema the real write whitelist — unknown keys are
+        // rejected (400) instead of silently reaching the UPDATE as columns (mass assignment).
+        main: Type.Object(mainFields, { additionalProperties: false }),
     };
     attachWriteJoinSections(bodyProperties, tableConf, dbTables, {
         withDeletions: true,
         secondaryFields: writeJoinBodyFields,
+        strictItems: true,
     });
     return Type.Object(bodyProperties);
 }

package/dist/lib/sql-api-decorator.d.ts

@@ -0,0 +1,18 @@
+import type { FastifyInstance } from 'fastify';
+import { type SqlApi } from './sql-api.js';
+import type { SqlApiPluginOptions } from '../types.js';
+declare module 'fastify' {
+    interface FastifyInstance {
+        sqlApi: SqlApi;
+    }
+}
+/**
+ * Decorates `fastify.sqlApi` (lazy getter) on the given instance unless the
+ * decorator is already present in scope. The main plugin calls this at the
+ * fp level (parent scope); granular route plugins call it through
+ * `registerForAllTables` so they also work standalone, each within its own
+ * encapsulation context. The underlying pool (`fastify.pg` / `fastify.mysql`)
+ * is shared either way.
+ */
+export declare function ensureSqlApiDecorator(fastify: FastifyInstance, options: SqlApiPluginOptions): void;
+//# sourceMappingURL=sql-api-decorator.d.ts.map

package/dist/lib/sql-api-decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-api-decorator.d.ts","sourceRoot":"","sources":["../../src/lib/sql-api-decorator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAI/C,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,MAAM,EAAE,MAAM,CAAC;KAChB;CACF;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,mBAAmB,GAC3B,IAAI,CA2BN"}