fastify-auto-sqlapi 0.2.0 → 0.2.1

package/dist/lib/errors.js

@@ -10,3 +10,62 @@ export function httpError(statusCode, message) {
     err.statusCode = statusCode;
     return err;
 }
+/**
+ * Replace an error escaping a route handler with one that carries no database detail.
+ *
+ * Driver messages name tables, columns and constraints, and the route error handler sends
+ * `error.message` verbatim — so a unique violation describes the schema to whoever
+ * triggered it. Errors the plugin raises itself are deliberate `4xx` with messages written
+ * for clients (`httpError`, `validationErrors`) and pass through untouched; everything
+ * else becomes a bare `500`.
+ *
+ * The original is attached as `cause`, so a consumer `setErrorHandler` can still apply its
+ * own policy — mapping SQLSTATE to a status code stays the consumer's decision (ADR 0006).
+ * No status code is remapped here: a `500` stays a `500`.
+ *
+ * `requestId` is carried on the sanitized error and rendered in the response body: it is the
+ * same value Fastify logs as `reqId` on every line, so the log entry holding the real error
+ * is one grep away from the client's `500`.
+ *
+ * With `exposeDebugInfo`, the original is also described in a `debugInfo` payload rendered
+ * beside those fields — additive, so the response a client codes against is the same one it
+ * gets in production. It is off by default and derived from nothing: `debug` belongs to the
+ * consumer, who may wire it to an environment variable, and no option may open an external
+ * channel as a side effect of meaning something internal. See ADR 0013.
+ */
+export function sanitizeRouteError(err, requestId, exposeDebugInfo = false) {
+    const statusCode = err?.statusCode;
+    if (typeof statusCode === 'number' && statusCode >= 400 && statusCode < 500)
+        return err;
+    const safe = httpError(500, 'Internal Server Error');
+    safe.name = 'Internal Server Error';
+    safe.cause = err;
+    if (requestId)
+        safe.requestId = requestId;
+    if (exposeDebugInfo)
+        safe.debugInfo = describeError(err);
+    return safe;
+}
+/**
+ * Driver properties worth handing a developer, across both supported drivers: `pg` puts the
+ * schema detail in `constraint`/`detail`/`table`/`column`, `mysql2` in `errno`/`sqlState`/
+ * `sqlMessage`. Copied by allowlist rather than spread, so a driver that starts attaching
+ * the connection config (password included) to its errors cannot ship it to a client.
+ */
+const DEBUG_ERROR_PROPS = [
+    'code', 'errno', 'sqlState', 'sqlMessage',
+    'constraint', 'detail', 'hint', 'table', 'column', 'schema', 'routine', 'position',
+];
+function describeError(err) {
+    if (!(err instanceof Error))
+        return { value: String(err) };
+    const info = { name: err.name, message: err.message };
+    for (const prop of DEBUG_ERROR_PROPS) {
+        const value = err[prop];
+        if (value !== undefined)
+            info[prop] = value;
+    }
+    if (err.stack)
+        info.stack = err.stack;
+    return info;
+}

package/dist/lib/table-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"table-helpers.d.ts","sourceRoot":"","sources":["../../src/lib/table-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,KAAK,yBAAyB,EAAiC,MAAM,wBAAwB,CAAC;AACzH,OAAO,EAAQ,KAAK,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,MAAM,EACP,MAAM,aAAa,CAAC;AAarB,KAAK,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAExH,wBAAgB,eAAe,CAC7B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,EAAE,SAAS,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAErE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC3B,YAAY,GAAE,EAAa,EAC3B,iBAAiB,CAAC,EAAE,CAClB,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,yBAAyB;CAAE,KAC3E,IAAI,GACR;IAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAAC,OAAO,EAAE,aAAa,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAsChG;AAED,wBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAChB,MAAM,CAAC,CAAC,CAAC,CAOX;AAqFD,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAgDD,wBAAgB,aAAa,CAC3B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjC,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC/B,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,EAClD,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC/B,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,EAC3B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,cAAc,CAWhB;AAED,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/D,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC3B,OAAO,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,GAC5B,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAE9B;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,KAAK,EAAE,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,GACvC,GAAG,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAEjC"}
+{"version":3,"file":"table-helpers.d.ts","sourceRoot":"","sources":["../../src/lib/table-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,KAAK,yBAAyB,EAAiC,MAAM,wBAAwB,CAAC;AACzH,OAAO,EAAQ,KAAK,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,MAAM,EACP,MAAM,aAAa,CAAC;AAarB,KAAK,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAExH,wBAAgB,eAAe,CAC7B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,EAAE,SAAS,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAErE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC3B,YAAY,GAAE,EAAa,EAC3B,iBAAiB,CAAC,EAAE,CAClB,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,yBAAyB;CAAE,KAC3E,IAAI,GACR;IAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAAC,OAAO,EAAE,aAAa,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAsChG;AAED,wBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAChB,MAAM,CAAC,CAAC,CAAC,CAQX;AAoJD,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAgDD,wBAAgB,aAAa,CAC3B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjC,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC/B,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,EAClD,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC/B,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,EAC3B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,cAAc,CAWhB;AAED,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/D,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC3B,OAAO,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,GAC5B,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAE9B;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,KAAK,EAAE,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,GACvC,GAAG,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAEjC"}

package/dist/lib/table-helpers.js

@@ -50,8 +50,56 @@ export function defineTable(config) {
     validateWriteJoinsUnrestricted(config.allowedWriteJoins);
     validateComputedFields(config);
     validateReadExclude(config);
+    validateTenantScope(config);
     return config;
 }
+/**
+ * `tenantScope` has three forms and they do not mix: `{ column }`, `{ column, through }`, and
+ * `{ anyOf }`. A config naming more than one form is ambiguous rather than additive — an `anyOf`
+ * entry reached through a parent FK would need its own join per entry — and an empty `anyOf`
+ * would fail closed on every row, which looks like a broken deployment rather than a rule.
+ *
+ * Column *names* are not checked against the schema: a tenant column may legitimately be kept
+ * out of the generated schema (see ADR 0009) while still scoping the table.
+ */
+function validateTenantScope(config) {
+    const scope = config.tenantScope;
+    if (!scope)
+        return;
+    const table = config.Schema.tableName;
+    const hasAnyOf = 'anyOf' in scope;
+    const hasColumn = 'column' in scope;
+    if (hasAnyOf && hasColumn) {
+        throw new Error(`defineTable: tenantScope on table '${table}' declares both 'anyOf' and 'column'. ` +
+            `Use one form: 'column' (owner column on this table), 'column' + 'through' (owner ` +
+            `reached via a FK), or 'anyOf' (several owner columns, visible to any of them).`);
+    }
+    if (hasAnyOf && 'through' in scope) {
+        throw new Error(`defineTable: tenantScope on table '${table}' combines 'anyOf' with 'through'. ` +
+            `An 'anyOf' entry reached through a parent is not supported — declare the scope on ` +
+            `the parent table instead.`);
+    }
+    if (hasAnyOf) {
+        const { anyOf } = scope;
+        if (!Array.isArray(anyOf) || !anyOf.length) {
+            throw new Error(`defineTable: tenantScope 'anyOf' on table '${table}' must be a non-empty array of ` +
+                `column names. An empty list would hide every row of the table.`);
+        }
+        if (anyOf.some((c) => typeof c !== 'string' || !c)) {
+            throw new Error(`defineTable: tenantScope 'anyOf' on table '${table}' must contain column names as ` +
+                `non-empty strings.`);
+        }
+        if (new Set(anyOf).size !== anyOf.length) {
+            throw new Error(`defineTable: tenantScope 'anyOf' on table '${table}' repeats a column. ` +
+                `Each owner column must appear once.`);
+        }
+        return;
+    }
+    if (!hasColumn || typeof scope.column !== 'string') {
+        throw new Error(`defineTable: tenantScope on table '${table}' declares neither 'column' nor 'anyOf'. ` +
+            `A scope with no owner column would filter nothing.`);
+    }
+}
 /**
  * `fields` narrows a relation for reading; it has no meaning on a write join and would be
  * actively harmful there. Write paths resolve the secondary's upsert rule by looking the

package/dist/lib/tenant.d.ts

@@ -1,8 +1,15 @@
 import type { FastifyRequest } from 'fastify';
 import type { QueryClient } from './db.js';
 import { ConditionBuilder, type ConditionValue, type ConditionValueOrUndefined } from 'node-condition-builder';
-import type { ITable, SqlApiPluginOptions, TenantId, TenantScope, TenantScopeIndirect, TenantContext } from '../types.js';
+import type { ITable, SqlApiPluginOptions, TenantId, TenantScope, TenantScopeDirect, TenantScopeIndirect, TenantScopeAnyOf, TenantContext } from '../types.js';
 export declare function resolveTenant(options: SqlApiPluginOptions, tableConf: ITable, request: FastifyRequest): Promise<TenantContext | undefined>;
+/**
+ * The read predicate for a scope, as a fragment every caller appends to its own WHERE.
+ *
+ * An `anyOf` scope returns an OR-mode builder — the row is visible when any listed column holds
+ * a tenant id — and every caller appends it, so the group keeps its own parentheses. A NULL
+ * column simply fails to match, which is the wanted behaviour: the other party still decides.
+ */
 export declare function buildTenantCondition(db: QueryClient, scope: TenantScope, tenantIds: TenantId[], ownTable: string): ConditionBuilder;
 /**
  * Re-target a tenant context onto a related table: the caller's tenant ids paired with that
@@ -21,21 +28,35 @@ export declare function tenantForTable(tenant: TenantContext | undefined, tableC
  *
  * `tableRef` is the name the scoped rows go by in that statement — the table name in a DELETE,
  * the join alias in an ON clause, the subquery alias inside a correlated SELECT. Returns
- * undefined without a tenant context (admin).
+ * undefined without a tenant context (admin) or when the table carries no scope.
  */
 export declare function buildTenantRowGuard(db: QueryClient, tenant: TenantContext | undefined, tableRef: string): ConditionBuilder | undefined;
 export declare function buildTenantJoin(db: QueryClient, scope: TenantScopeIndirect, mainTableName: string): string;
+/**
+ * The insert-side rule for an `anyOf` scope: the payload must anchor the row itself.
+ *
+ * Nothing is auto-injected — with several owner columns the plugin cannot know which party the
+ * caller is meant to be, and guessing would either invent a relationship or refuse a legitimate
+ * one. So the record must name at least one listed column, and at least one of the named ones
+ * must hold a tenant id. The *other* parties are deliberately left alone: a swap request points
+ * at a colleague by definition, and requiring every listed column to match would make the shape
+ * unusable.
+ *
+ * @testonly Exported only so unit tests can exercise it directly.
+ */
+export declare function assertTenantAnchor(record: Record<string, unknown>, scope: TenantScopeAnyOf, tenantIds: TenantId[]): void;
 /** Writes the tenant value into a record according to its scope.
  * @testonly Exported only so unit tests can exercise it directly.
  */
-export declare function injectTenantValue(record: Record<string, unknown>, scope: TenantScope, tenantIds: TenantId[]): void;
+export declare function injectTenantValue(record: Record<string, unknown>, scope: TenantScopeDirect | TenantScopeIndirect, tenantIds: TenantId[]): void;
 /** Checks that an indirect-scope FK really belongs to the tenant.
  * @testonly Exported only so unit tests can exercise it directly.
  */
 export declare function validateTenantFK(db: QueryClient, scope: TenantScopeIndirect, tenantIds: TenantId[], fkValues: unknown[]): Promise<void>;
 /**
  * Build WHERE clause for DELETE with tenant filtering.
- * Handles both direct (simple AND) and indirect (subquery via JOIN) scopes.
+ * Handles both direct (simple AND) and indirect (subquery via JOIN) scopes; a tenant whose
+ * addressed table declares no scope yields the plain primary-key clause.
  */
 export declare function buildTenantDeleteWhere(db: QueryClient, tableName: string, pkCol: string, pkValue: ConditionValueOrUndefined | ConditionValue[], tenant: TenantContext): {
     where: string;
@@ -64,8 +85,9 @@ export declare function assertTenantOwnsConflicts(db: QueryClient, tenant: Tenan
  */
 export declare function enforceTenantFKOnUpdate(db: QueryClient, tenant: TenantContext | undefined, updateFields: Record<string, unknown>): Promise<void>;
 /**
- * Mutates `fields` in-place: removes the tenant column from a SET payload (direct scopes only).
- * No-op for indirect or no scope.
+ * Mutates `fields` in-place: removes the tenant columns from a SET payload (scopes whose columns
+ * live on the table itself). An `anyOf` scope drops *every* listed column — neither party can be
+ * reassigned, the same spirit as "a tenant cannot move its own row". No-op for indirect scopes.
  */
 export declare function stripTenantColumn(fields: Record<string, unknown>, scope: TenantScope): void;
 /**
@@ -75,6 +97,19 @@ export declare function stripTenantColumn(fields: Record<string, unknown>, scope
  * Throws 400 (ambiguous tenant) or 403 (mismatch) on violation. No-op when `tenant` is undefined.
  */
 export declare function enforceTenantOnWrites(db: QueryClient, tenant: TenantContext | undefined, records: Record<string, unknown>[]): Promise<void>;
+/**
+ * Columns an UPSERT must leave alone when it lands on an existing row.
+ *
+ * `stripTenantColumn` does this for a plain UPDATE, but an upsert's payload doubles as the
+ * INSERT branch, where the owner columns are exactly what anchors a new row — they cannot simply
+ * be dropped. So they are excluded from the `DO UPDATE SET` instead: state which party you are
+ * to create the row, and that statement is ignored when the row already exists.
+ *
+ * Only `anyOf` scopes need this. A direct scope injects the caller's own tenant, so writing it
+ * back onto a row the conflict guard already proved theirs is a no-op; an indirect one keeps its
+ * owner on another table entirely.
+ */
+export declare function tenantImmutableColumns(tenant: TenantContext | undefined): string[];
 /**
  * For update: builds the optional `extraCondition` ConditionBuilder for direct tenants.
  * Returns undefined for indirect or no-tenant scenarios — those are handled separately

package/dist/lib/tenant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../src/lib/tenant.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,KAAK,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAE/G,OAAO,KAAK,EACV,MAAM,EACN,mBAAmB,EACnB,QAAQ,EACR,WAAW,EACX,mBAAmB,EACnB,aAAa,EACd,MAAM,aAAa,CAAC;AAMrB,wBAAsB,aAAa,CACjC,OAAO,EAAE,mBAAmB,EAC5B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CASpC;AAED,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,WAAW,EACf,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,QAAQ,EAAE,EACrB,QAAQ,EAAE,MAAM,GACf,gBAAgB,CAgBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,aAAa,GAAG,SAAS,CAI3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,QAAQ,EAAE,MAAM,GACf,gBAAgB,GAAG,SAAS,CAmB9B;AAED,wBAAgB,eAAe,CAC7B,EAAE,EAAE,WAAW,EACf,KAAK,EAAE,mBAAmB,EAC1B,aAAa,EAAE,MAAM,GACpB,MAAM,CAMR;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,QAAQ,EAAE,GACpB,IAAI,CAiBN;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,WAAW,EACf,KAAK,EAAE,mBAAmB,EAC1B,SAAS,EAAE,QAAQ,EAAE,EACrB,QAAQ,EAAE,OAAO,EAAE,GAClB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,WAAW,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GAAG,cAAc,EAAE,EACrD,MAAM,EAAE,aAAa,GACpB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAsBtC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EAAE,EACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GACjC,OAAO,CAAC,IAAI,CAAC,CA2Df;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACpC,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,WAAW,GACjB,IAAI,CAGN;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GACjC,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,GAChC,gBAAgB,GAAG,SAAS,CAM9B;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,OAAO,EAAE,cAAc,GAAG,cAAc,EAAE,GACzC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,cAAc,EAAE,GACpB,OAAO,CAAC,IAAI,CAAC,CAgBf"}
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../src/lib/tenant.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,KAAK,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAE/G,OAAO,KAAK,EAEV,MAAM,EACN,mBAAmB,EACnB,QAAQ,EACR,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACd,MAAM,aAAa,CAAC;AAwCrB,wBAAsB,aAAa,CACjC,OAAO,EAAE,mBAAmB,EAC5B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAWpC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,WAAW,EACf,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,QAAQ,EAAE,EACrB,QAAQ,EAAE,MAAM,GACf,gBAAgB,CAgBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,aAAa,GAAG,SAAS,CAI3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,QAAQ,EAAE,MAAM,GACf,gBAAgB,GAAG,SAAS,CAoB9B;AAED,wBAAgB,eAAe,CAC7B,EAAE,EAAE,WAAW,EACf,KAAK,EAAE,mBAAmB,EAC1B,aAAa,EAAE,MAAM,GACpB,MAAM,CAMR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,QAAQ,EAAE,GACpB,IAAI,CAYN;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,iBAAiB,GAAG,mBAAmB,EAC9C,SAAS,EAAE,QAAQ,EAAE,GACpB,IAAI,CAiBN;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,WAAW,EACf,KAAK,EAAE,mBAAmB,EAC1B,SAAS,EAAE,QAAQ,EAAE,EACrB,QAAQ,EAAE,OAAO,EAAE,GAClB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,WAAW,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GAAG,cAAc,EAAE,EACrD,MAAM,EAAE,aAAa,GACpB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAwBtC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EAAE,EACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GACjC,OAAO,CAAC,IAAI,CAAC,CA4Ef;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACpC,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,WAAW,GACjB,IAAI,CAGN;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GACjC,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,GAAG,MAAM,EAAE,CAGlF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,GAChC,gBAAgB,GAAG,SAAS,CAU9B;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,OAAO,EAAE,cAAc,GAAG,cAAc,EAAE,GACzC,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,cAAc,EAAE,GACpB,OAAO,CAAC,IAAI,CAAC,CAiBf"}

package/dist/lib/tenant.js

@@ -3,31 +3,72 @@ import { httpError } from './errors.js';
 function isIndirect(scope) {
     return 'through' in scope;
 }
+function isAnyOf(scope) {
+    return 'anyOf' in scope;
+}
+/**
+ * The tenant columns living on the scoped table itself, in declaration order: one for a direct
+ * scope, several for an `anyOf` one. Never called for an indirect scope, whose column belongs to
+ * the through table.
+ */
+function ownColumns(scope) {
+    return isAnyOf(scope) ? scope.anyOf : [scope.column];
+}
+/**
+ * Whether this request could touch a scoped row at all: the addressed table is scoped, or one of
+ * the tables it can reach through a declared relation is.
+ *
+ * Relations are what makes the second case necessary — a relation is a read grant on its target
+ * and a write join a write grant, so a deliberately public host must still carry its neighbours'
+ * scopes into the joins and secondaries it drives. One level is the whole reach: joins resolve
+ * from the addressed table's own `allowedReadJoins`/`allowedWriteJoins` and never chain further.
+ *
+ * When nothing scoped is in reach, `getTenantId` is not called at all — a request that cannot
+ * read or write a scoped row should not pay for resolving a tenant, and consumer code that
+ * assumes an authenticated request should not run on routes that never needed one.
+ */
+function scopeInReach(tableConf, dbTables) {
+    if (tableConf.tenantScope)
+        return true;
+    if (!dbTables)
+        return false;
+    const relations = [...(tableConf.allowedReadJoins ?? []), ...(tableConf.allowedWriteJoins ?? [])];
+    return relations.some((join) => dbTables[join.joinSchema.tableName]?.tenantScope !== undefined);
+}
 export async function resolveTenant(options, tableConf, request) {
     if (!options.getTenantId)
         return undefined;
-    if (!tableConf.tenantScope)
+    if (!scopeInReach(tableConf, options.DbTables))
         return undefined;
     const raw = await options.getTenantId(request);
     if (raw == null)
         return undefined; // admin
     const ids = Array.isArray(raw) ? raw : [raw];
+    // `scope` stays undefined for an unscoped host: the ids still travel, so the tables it reaches
+    // enforce their own scopes, while the host itself keeps no filter.
     return { ids, scope: tableConf.tenantScope };
 }
+/**
+ * The read predicate for a scope, as a fragment every caller appends to its own WHERE.
+ *
+ * An `anyOf` scope returns an OR-mode builder — the row is visible when any listed column holds
+ * a tenant id — and every caller appends it, so the group keeps its own parentheses. A NULL
+ * column simply fails to match, which is the wanted behaviour: the other party still decides.
+ */
 export function buildTenantCondition(db, scope, tenantIds, ownTable) {
-    const col = scope.column;
-    let qualifier;
     if (isIndirect(scope)) {
         const throughTable = scope.through.schema.tableName;
-        qualifier = `${db.qi(throughTable)}.${db.qi(col)}`;
+        const cb = new ConditionBuilder('AND', db.cbDialect);
+        cb.isIn(`${db.qi(throughTable)}.${db.qi(scope.column)}`, tenantIds);
+        return cb;
     }
-    else {
-        // Qualify with the table the scope column lives on: the statement may carry
-        // joins, and a bare column shared with a joined table would be ambiguous.
-        qualifier = `${db.qi(ownTable)}.${db.qi(col)}`;
+    // Qualify with the table the scope columns live on: the statement may carry
+    // joins, and a bare column shared with a joined table would be ambiguous.
+    const cols = ownColumns(scope);
+    const cb = new ConditionBuilder(cols.length > 1 ? 'OR' : 'AND', db.cbDialect);
+    for (const col of cols) {
+        cb.isIn(`${db.qi(ownTable)}.${db.qi(col)}`, tenantIds);
     }
-    const cb = new ConditionBuilder('AND', db.cbDialect);
-    cb.isIn(qualifier, tenantIds);
     return cb;
 }
 /**
@@ -52,17 +93,18 @@ export function tenantForTable(tenant, tableConf) {
  *
  * `tableRef` is the name the scoped rows go by in that statement — the table name in a DELETE,
  * the join alias in an ON clause, the subquery alias inside a correlated SELECT. Returns
- * undefined without a tenant context (admin).
+ * undefined without a tenant context (admin) or when the table carries no scope.
  */
 export function buildTenantRowGuard(db, tenant, tableRef) {
-    if (!tenant)
+    const scope = tenant?.scope;
+    if (!tenant || !scope)
         return undefined;
     const cb = new ConditionBuilder('AND', db.cbDialect);
-    if (!isIndirect(tenant.scope)) {
-        cb.append(buildTenantCondition(db, tenant.scope, tenant.ids, tableRef));
+    if (!isIndirect(scope)) {
+        cb.append(buildTenantCondition(db, scope, tenant.ids, tableRef));
         return cb;
     }
-    const { through, column } = tenant.scope;
+    const { through, column } = scope;
     const throughRef = db.qi(through.schema.tableName);
     const markers = tenant.ids.map(() => '?').join(', ');
     cb.raw(`EXISTS (SELECT 1 FROM ${throughRef} WHERE ` +
@@ -76,6 +118,27 @@ export function buildTenantJoin(db, scope, mainTableName) {
     const foreignField = scope.through.foreignField;
     return `INNER JOIN ${db.qi(throughTable)} ON ${db.qi(mainTableName)}.${db.qi(localField)} = ${db.qi(throughTable)}.${db.qi(foreignField)}`;
 }
+/**
+ * The insert-side rule for an `anyOf` scope: the payload must anchor the row itself.
+ *
+ * Nothing is auto-injected — with several owner columns the plugin cannot know which party the
+ * caller is meant to be, and guessing would either invent a relationship or refuse a legitimate
+ * one. So the record must name at least one listed column, and at least one of the named ones
+ * must hold a tenant id. The *other* parties are deliberately left alone: a swap request points
+ * at a colleague by definition, and requiring every listed column to match would make the shape
+ * unusable.
+ *
+ * @testonly Exported only so unit tests can exercise it directly.
+ */
+export function assertTenantAnchor(record, scope, tenantIds) {
+    const present = scope.anyOf.filter((col) => record[col] != null);
+    if (!present.length) {
+        throw httpError(400, `Missing tenant anchor: one of ${scope.anyOf.join(', ')} must be set`);
+    }
+    if (!present.some((col) => tenantIds.includes(record[col]))) {
+        throw httpError(403, 'Access denied: tenant value does not match');
+    }
+}
 /** Writes the tenant value into a record according to its scope.
  * @testonly Exported only so unit tests can exercise it directly.
  */
@@ -121,16 +184,18 @@ export async function validateTenantFK(db, scope, tenantIds, fkValues) {
 }
 /**
  * Build WHERE clause for DELETE with tenant filtering.
- * Handles both direct (simple AND) and indirect (subquery via JOIN) scopes.
+ * Handles both direct (simple AND) and indirect (subquery via JOIN) scopes; a tenant whose
+ * addressed table declares no scope yields the plain primary-key clause.
  */
 export function buildTenantDeleteWhere(db, tableName, pkCol, pkValue, tenant) {
-    if (isIndirect(tenant.scope)) {
+    const scope = tenant.scope;
+    if (scope && isIndirect(scope)) {
         const innerCb = new ConditionBuilder('AND', db.cbDialect);
         innerCb.isIn(`${db.qi(tableName)}.${db.qi(pkCol)}`, (Array.isArray(pkValue) ? pkValue : [pkValue]));
-        innerCb.append(buildTenantCondition(db, tenant.scope, tenant.ids, tableName));
+        innerCb.append(buildTenantCondition(db, scope, tenant.ids, tableName));
         const innerWhere = innerCb.build(1, db.ph);
         const values = innerCb.getValues();
-        const joinSql = buildTenantJoin(db, tenant.scope, tableName);
+        const joinSql = buildTenantJoin(db, scope, tableName);
         const where = `${db.qi(pkCol)} IN (SELECT ${db.qi(tableName)}.${db.qi(pkCol)} FROM ${db.qi(tableName)} ${joinSql} WHERE ${innerWhere})`;
         return { where, values };
     }
@@ -141,7 +206,8 @@ export function buildTenantDeleteWhere(db, tableName, pkCol, pkValue, tenant) {
     else {
         cb.isEqual(db.qi(pkCol), pkValue);
     }
-    cb.append(buildTenantCondition(db, tenant.scope, tenant.ids, tableName));
+    if (scope)
+        cb.append(buildTenantCondition(db, scope, tenant.ids, tableName));
     const where = cb.build(1, db.ph);
     const values = cb.getValues();
     return { where, values };
@@ -158,7 +224,8 @@ export function buildTenantDeleteWhere(db, tableName, pkCol, pkValue, tenant) {
  * any conflict column are skipped (they can only INSERT, never hit a conflict).
  */
 export async function assertTenantOwnsConflicts(db, tenant, tableName, conflictCols, records) {
-    if (!tenant || !conflictCols.length)
+    const scope = tenant?.scope;
+    if (!tenant || !scope || !conflictCols.length)
         return;
     // Collect distinct, fully-specified conflict-key tuples.
     const tuples = [];
@@ -199,19 +266,35 @@ export async function assertTenantOwnsConflicts(db, tenant, tableName, conflictC
     }
     // Tenant-mismatch clause: rows whose tenant is NOT one the caller owns.
     let joinSql = '';
-    let tenantCol;
-    if (isIndirect(tenant.scope)) {
-        joinSql = ` ${buildTenantJoin(db, tenant.scope, tableName)}`;
-        tenantCol = `${db.qi(tenant.scope.through.schema.tableName)}.${db.qi(tenant.scope.column)}`;
+    let tenantCols;
+    if (isIndirect(scope)) {
+        joinSql = ` ${buildTenantJoin(db, scope, tableName)}`;
+        tenantCols = [`${db.qi(scope.through.schema.tableName)}.${db.qi(scope.column)}`];
     }
     else {
-        tenantCol = `${qTable}.${db.qi(tenant.scope.column)}`;
+        tenantCols = ownColumns(scope).map((c) => `${qTable}.${db.qi(c)}`);
+    }
+    const inClause = (col) => {
+        const phs = tenant.ids.map((id) => {
+            values.push(id);
+            return db.ph(values.length);
+        });
+        return `${col} IN (${phs.join(', ')})`;
+    };
+    let mismatchSql;
+    if (tenantCols.length === 1) {
+        mismatchSql = `${tenantCols[0]} NOT IN (${tenant.ids.map((id) => {
+            values.push(id);
+            return db.ph(values.length);
+        }).join(', ')})`;
+    }
+    else {
+        // A NULL party makes `IN` return NULL, and `NOT NULL` is not TRUE — a plain negation would
+        // let a row with one party NULL and the other owned by a stranger pass the probe unflagged.
+        // COALESCE turns "unknown" into "not visible to me", which is what the read side already
+        // does implicitly by never matching a NULL.
+        mismatchSql = `NOT COALESCE(${tenantCols.map(inClause).join(' OR ')}, FALSE)`;
     }
-    const tenantPhs = tenant.ids.map((id) => {
-        values.push(id);
-        return db.ph(values.length);
-    });
-    const mismatchSql = `${tenantCol} NOT IN (${tenantPhs.join(', ')})`;
     const sql = `SELECT 1 FROM ${qTable}${joinSql} WHERE ${matchSql} AND ${mismatchSql} LIMIT 1`;
     const r = await db.query(sql, values);
     if (r.rows.length > 0) {
@@ -228,24 +311,27 @@ export async function assertTenantOwnsConflicts(db, tenant, tableName, conflictC
  * `updateFields` keys are DB column names (snake_case), matching `through.localField`.
  */
 export async function enforceTenantFKOnUpdate(db, tenant, updateFields) {
-    if (!tenant || !isIndirect(tenant.scope))
+    if (!tenant?.scope || !isIndirect(tenant.scope))
         return;
-    const localCol = tenant.scope.through.localField;
+    const scope = tenant.scope;
+    const localCol = scope.through.localField;
     if (!(localCol in updateFields))
         return;
     const newValue = updateFields[localCol];
     if (newValue == null)
         return;
-    await validateTenantFK(db, tenant.scope, tenant.ids, [newValue]);
+    await validateTenantFK(db, scope, tenant.ids, [newValue]);
 }
 /**
- * Mutates `fields` in-place: removes the tenant column from a SET payload (direct scopes only).
- * No-op for indirect or no scope.
+ * Mutates `fields` in-place: removes the tenant columns from a SET payload (scopes whose columns
+ * live on the table itself). An `anyOf` scope drops *every* listed column — neither party can be
+ * reassigned, the same spirit as "a tenant cannot move its own row". No-op for indirect scopes.
  */
 export function stripTenantColumn(fields, scope) {
     if (isIndirect(scope))
         return;
-    delete fields[scope.column];
+    for (const col of ownColumns(scope))
+        delete fields[col];
 }
 /**
  * For insert/bulk-upsert: enforce tenant on records that are about to be written.
@@ -254,15 +340,38 @@ export function stripTenantColumn(fields, scope) {
  * Throws 400 (ambiguous tenant) or 403 (mismatch) on violation. No-op when `tenant` is undefined.
  */
 export async function enforceTenantOnWrites(db, tenant, records) {
-    if (!tenant)
+    const scope = tenant?.scope;
+    if (!tenant || !scope)
         return;
-    if (isIndirect(tenant.scope)) {
-        const fkCol = tenant.scope.through.localField;
-        await validateTenantFK(db, tenant.scope, tenant.ids, records.map((r) => r[fkCol]));
+    if (isIndirect(scope)) {
+        const fkCol = scope.through.localField;
+        await validateTenantFK(db, scope, tenant.ids, records.map((r) => r[fkCol]));
+        return;
+    }
+    if (isAnyOf(scope)) {
+        for (const r of records)
+            assertTenantAnchor(r, scope, tenant.ids);
         return;
     }
     for (const r of records)
-        injectTenantValue(r, tenant.scope, tenant.ids);
+        injectTenantValue(r, scope, tenant.ids);
+}
+/**
+ * Columns an UPSERT must leave alone when it lands on an existing row.
+ *
+ * `stripTenantColumn` does this for a plain UPDATE, but an upsert's payload doubles as the
+ * INSERT branch, where the owner columns are exactly what anchors a new row — they cannot simply
+ * be dropped. So they are excluded from the `DO UPDATE SET` instead: state which party you are
+ * to create the row, and that statement is ignored when the row already exists.
+ *
+ * Only `anyOf` scopes need this. A direct scope injects the caller's own tenant, so writing it
+ * back onto a row the conflict guard already proved theirs is a no-op; an indirect one keeps its
+ * owner on another table entirely.
+ */
+export function tenantImmutableColumns(tenant) {
+    if (!tenant?.scope || !isAnyOf(tenant.scope))
+        return [];
+    return tenant.scope.anyOf;
 }
 /**
  * For update: builds the optional `extraCondition` ConditionBuilder for direct tenants.
@@ -270,13 +379,17 @@ export async function enforceTenantOnWrites(db, tenant, records) {
  * (indirect uses pre-check via `assertTenantOwnership`).
  */
 export function buildTenantUpdateExtra(db, tenant) {
-    if (!tenant || isIndirect(tenant.scope))
+    const scope = tenant?.scope;
+    if (!scope || isIndirect(scope))
         return undefined;
-    const cb = new ConditionBuilder('AND', db.cbDialect);
-    if (tenant.ids.length === 1)
-        cb.isEqual(tenant.scope.column, tenant.ids[0]);
-    else
-        cb.isIn(tenant.scope.column, tenant.ids);
+    const cols = ownColumns(scope);
+    const cb = new ConditionBuilder(cols.length > 1 ? 'OR' : 'AND', db.cbDialect);
+    for (const col of cols) {
+        if (tenant.ids.length === 1)
+            cb.isEqual(col, tenant.ids[0]);
+        else
+            cb.isIn(col, tenant.ids);
+    }
     return cb;
 }
 /**
@@ -285,14 +398,15 @@ export function buildTenantUpdateExtra(db, tenant) {
  * No-op for direct or no-tenant — those are enforced via `extraCondition` in the UPDATE itself.
  */
 export async function assertTenantOwnership(db, tenant, tableName, pkCol, pkValue) {
-    if (!tenant || !isIndirect(tenant.scope))
+    if (!tenant?.scope || !isIndirect(tenant.scope))
         return;
+    const scope = tenant.scope;
     const cb = new ConditionBuilder('AND', db.cbDialect);
     const cols = Array.isArray(pkCol) ? pkCol : [pkCol];
     const vals = Array.isArray(pkValue) ? pkValue : [pkValue];
     cols.forEach((c, i) => cb.isEqual(`${db.qi(tableName)}.${db.qi(c)}`, vals[i]));
-    cb.append(buildTenantCondition(db, tenant.scope, tenant.ids, tableName));
-    const sql = `SELECT 1 FROM ${db.qi(tableName)} ${buildTenantJoin(db, tenant.scope, tableName)} WHERE ${cb.build(1, db.ph)} LIMIT 1`;
+    cb.append(buildTenantCondition(db, scope, tenant.ids, tableName));
+    const sql = `SELECT 1 FROM ${db.qi(tableName)} ${buildTenantJoin(db, scope, tableName)} WHERE ${cb.build(1, db.ph)} LIMIT 1`;
     const r = await db.query(sql, cb.getValues());
     if (r.rows.length === 0) {
         throw httpError(404, 'Record not found');
@@ -305,13 +419,14 @@ export async function assertTenantOwnership(db, tenant, tableName, pkCol, pkValu
  * `beforeBulkDelete` hook, so user code never runs against rows the caller cannot access.
  */
 export async function assertTenantOwnsAll(db, tenant, tableName, pkCol, ids) {
-    if (!tenant || !ids.length)
+    const scope = tenant?.scope;
+    if (!tenant || !scope || !ids.length)
         return;
     const qualifiedPk = `${db.qi(tableName)}.${db.qi(pkCol)}`;
     const cb = new ConditionBuilder('AND', db.cbDialect);
     cb.isIn(qualifiedPk, ids);
-    cb.append(buildTenantCondition(db, tenant.scope, tenant.ids, tableName));
-    const join = isIndirect(tenant.scope) ? ` ${buildTenantJoin(db, tenant.scope, tableName)}` : '';
+    cb.append(buildTenantCondition(db, scope, tenant.ids, tableName));
+    const join = isIndirect(scope) ? ` ${buildTenantJoin(db, scope, tableName)}` : '';
     const sql = `SELECT DISTINCT ${qualifiedPk} AS pk FROM ${db.qi(tableName)}${join} WHERE ${cb.build(1, db.ph)}`;
     const r = await db.query(sql, cb.getValues());
     const uniqueRequested = new Set(ids.map((v) => String(v))).size;

package/dist/routes/auto/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAc7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;kCAuD/C,eAAe,WACf,mBAAmB,KAC3B,OAAO,CAAC,IAAI,CAAC;AAHhB,wBA6DoC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAc7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;kCAuD/C,eAAe,WACf,mBAAmB,KAC3B,OAAO,CAAC,IAAI,CAAC;AAHhB,wBAsEoC"}

package/dist/routes/auto/plugin.js

@@ -82,10 +82,16 @@ export default fp(async function fastifyAutoSqlApi(fastify, options) {
                 });
             }
             const statusCode = error.statusCode || 500;
+            // A sanitized error carries the request id so the client can point at the log line
+            // holding the real cause, and — under `exposeDebugInfo` — the description of that
+            // cause (ADR 0013). Both are additive: the fields above never change shape.
+            const sanitized = error;
             reply.status(statusCode).send({
                 statusCode,
                 error: error.name || 'Error',
                 message: error.message,
+                ...(sanitized.requestId ? { requestId: sanitized.requestId } : {}),
+                ...(sanitized.debugInfo ? { debugInfo: sanitized.debugInfo } : {}),
             });
         });
         if (options.swagger) {

package/dist/routes/auto/route-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-helpers.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/route-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG7E,OAAO,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAQ5F,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAQlG;AAED,UAAU,WAAW;IAEnB,IAAI,CAAC,EAAE,GAAG,CAAC;IAEX,MAAM,CAAC,EAAE,GAAG,CAAC;IAEb,WAAW,CAAC,EAAE,GAAG,CAAC;IAElB,QAAQ,CAAC,EAAE,GAAG,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,iGAAiG;IACjG,SAAS,EAAE,cAAc,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC1C,gFAAgF;IAChF,GAAG,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IACnC,aAAa,EAAE,GAAG,GAAG,GAAG,CAAC;IACzB,wIAAwI;IACxI,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,WAAW,CAAC;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,KAAK,MAAM,CAAC;IACpF;2EACuE;IACvE,MAAM,EAAE,CACN,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,KAChB,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AA6DD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CAuBf"}
+{"version":3,"file":"route-helpers.d.ts","sourceRoot":"","sources":["../../../src/routes/auto/route-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI7E,OAAO,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAQ5F,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAQlG;AAED,UAAU,WAAW;IAEnB,IAAI,CAAC,EAAE,GAAG,CAAC;IAEX,MAAM,CAAC,EAAE,GAAG,CAAC;IAEb,WAAW,CAAC,EAAE,GAAG,CAAC;IAElB,QAAQ,CAAC,EAAE,GAAG,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,iGAAiG;IACjG,SAAS,EAAE,cAAc,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC1C,gFAAgF;IAChF,GAAG,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IACnC,aAAa,EAAE,GAAG,GAAG,GAAG,CAAC;IACzB,wIAAwI;IACxI,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,WAAW,CAAC;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,KAAK,MAAM,CAAC;IACpF;2EACuE;IACvE,MAAM,EAAE,CACN,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,KAChB,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AA6DD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CA6Bf"}