json-rest-api 1.0.10 → 1.0.13

package/plugins/core/rest-api-multihome-plugin.js

@@ -1,9 +1,13 @@
 export const MultiHomePlugin = {
     name: 'multihome',
-    dependencies: ['rest-api', 'rest-api-knex'],
+    dependencies: ['rest-api'],
 
     install({ api, addHook, vars, helpers, log, scopes, pluginOptions }) {
 
+      if (!api.knex?.instance) {
+        throw new Error('Multihome plugin requires a storage plugin with knex support (rest-api-knex or rest-api-anyapi-knex)');
+      }
+
       // Get configuration - hooked-api namespaces options by plugin name
       const multihomeOptions = pluginOptions || {};
 
@@ -15,6 +19,31 @@ export const MultiHomePlugin = {
         allowMissing: multihomeOptions.allowMissing || false
       };
 
+      const resolveStorageAdapter = (scopeName, hookContext = {}) => {
+        if (!scopeName) return null;
+        if (hookContext.storageAdapter) return hookContext.storageAdapter;
+        if (hookContext.knexQuery?.storageAdapter) return hookContext.knexQuery.storageAdapter;
+        if (helpers.getStorageAdapter) {
+          return helpers.getStorageAdapter(scopeName);
+        }
+        return null;
+      };
+
+      const translateColumnReference = ({ field, tableName, scopeName, hookContext }) => {
+        const storageAdapter = resolveStorageAdapter(scopeName, hookContext);
+        const translated = storageAdapter?.translateColumn?.(field) ?? field;
+        if (tableName) {
+          return `${tableName}.${translated}`;
+        }
+        return translated;
+      };
+
+      const translateFilterValue = ({ field, value, scopeName, hookContext }) => {
+        const storageAdapter = resolveStorageAdapter(scopeName, hookContext);
+        if (!storageAdapter?.translateFilterValue) return value;
+        return storageAdapter.translateFilterValue(field, value);
+      };
+
       // Default extractor function
       function defaultSubdomainExtractor(request) {
         // Extract from subdomain (e.g., 'mobily' from 'mobily.app.com')
@@ -80,7 +109,8 @@ export const MultiHomePlugin = {
       });
 
       // Main filtering hook - adds WHERE clause to all queries
-      addHook('knexQueryFiltering', 'multihome-filter', { beforePlugin: 'rest-api-knex' }, async ({ context, vars }) => {
+      log.debug('Registering multihome filter hook');
+      addHook('knexQueryFiltering', 'multihome-filter', {}, async ({ context, vars }) => {
         // Get query info from context
         const { query, tableName, scopeName } = context.knexQuery;
 
@@ -90,17 +120,23 @@ export const MultiHomePlugin = {
           return;
         }
 
-        // Skip if no multihome context
-        if (!context.auth?.multihome_id) {
-          if (vars.multihome.requireAuth) {
-            throw new Error('No multihome context available - cannot execute query');
-          }
-          return;
+      // Skip if no multihome context
+      if (!context.auth?.multihome_id) {
+        if (vars.multihome.requireAuth) {
+          throw new Error('No multihome context available - cannot execute query');
         }
+        return;
+      }
 
-        // Check if this resource has multihome field
+      log.debug('Applying multihome tenant filter', {
+        scopeName,
+        tableName,
+        tenant: context.auth.multihome_id,
+      });
+
+      // Check if this resource has multihome field
         const scope = scopes[scopeName];
-        const hasMultihomeField = scope?.vars?.schemaInfo?.schema?.structure?.[vars.multihome.field];
+        const hasMultihomeField = scope?.vars?.schemaInfo?.schemaStructure?.[vars.multihome.field];
 
         if (!hasMultihomeField) {
           if (vars.multihome.allowMissing) {
@@ -111,10 +147,31 @@ export const MultiHomePlugin = {
           }
         }
 
-        // Add WHERE condition wrapped in function for proper grouping
-        query.where(function() {
-          this.where(`${tableName}.${vars.multihome.field}`, context.auth.multihome_id);
-        });
+      const storageAdapter = resolveStorageAdapter(scopeName, context);
+      if (storageAdapter && !context.storageAdapter) {
+        context.storageAdapter = storageAdapter;
+      }
+
+      const columnRef = translateColumnReference({
+        field: vars.multihome.field,
+        tableName,
+        scopeName,
+        hookContext: context,
+      });
+
+      const tenantValue = translateFilterValue({
+        field: vars.multihome.field,
+        value: context.auth.multihome_id,
+        scopeName,
+        hookContext: context,
+      });
+
+      
+      if (tenantValue === null) {
+        query.whereNull(columnRef);
+      } else {
+        query.where(columnRef, tenantValue);
+      }
 
         log.trace('Added multihome filter', {
           scopeName,
@@ -141,7 +198,7 @@ export const MultiHomePlugin = {
 
         // Check if this resource has multihome field
         const scope = scopes[scopeName];
-        const hasMultihomeField = scope?.vars?.schemaInfo?.schema?.structure?.[vars.multihome.field];
+        const hasMultihomeField = scope?.vars?.schemaInfo?.schemaStructure?.[vars.multihome.field];
 
         if (!hasMultihomeField) {
           if (!vars.multihome.allowMissing) {
@@ -177,42 +234,47 @@ export const MultiHomePlugin = {
       // Add checkPermissions hook to enforce tenant isolation
       // This is the single source of truth for single-record access control
       addHook('checkPermissions', 'multihome-check-permissions', {}, async ({ context, scopeName }) => {
+        // Extract the needed values from originalContext
+        const auth = context.originalContext?.auth;
+        const minimalRecord = context.originalContext?.minimalRecord;
+        const id = context.originalContext?.id;
+
         // Skip excluded resources
         if (vars.multihome.excludeResources.includes(scopeName)) {
           return;
         }
-        
+
         // Skip if no multihome context
-        if (!context.auth?.multihome_id) {
+        if (!auth?.multihome_id) {
           if (vars.multihome.requireAuth) {
             throw new Error('No multihome context available');
           }
           return;
         }
-        
+
         // Get the scope to check if it has multihome field
         const scope = scopes[scopeName];
-        const hasMultihomeField = scope?.vars?.schemaInfo?.schema?.structure?.[vars.multihome.field];
-        
+        const hasMultihomeField = scope?.vars?.schemaInfo?.schemaStructure?.[vars.multihome.field];
+
         if (!hasMultihomeField) {
           return; // Resource doesn't support multihome
         }
-        
+
         // For operations on existing records, verify tenant ownership
-        if (context.minimalRecord) {
+        if (minimalRecord) {
           // minimalRecord is in JSON:API format, so tenant_id is in attributes
-          const recordTenant = context.minimalRecord.attributes?.[vars.multihome.field];
-          const userTenant = context.auth.multihome_id;
-          
+          const recordTenant = minimalRecord.attributes?.[vars.multihome.field];
+          const userTenant = auth.multihome_id;
+
           if (recordTenant !== userTenant) {
             log.error('Multihome permission violation', {
               scopeName,
-              recordId: context.id,
+              recordId: id,
               recordTenant: recordTenant,
               userTenant: userTenant,
               method: context.method
             });
-            
+
             // Return 404 for GET to prevent information leakage
             // Return 403 for other operations
             if (context.method === 'get') {

package/plugins/core/rest-api-plugin-hooks/turn-scope-init-into-vars.js

@@ -12,7 +12,6 @@ export default async function turnScopeInitIntoVars({ context, scopes, vars: api
   if (typeof scopeOptions.queryDefaultLimit !== 'undefined') vars.queryDefaultLimit = scopeOptions.queryDefaultLimit;
   if (typeof scopeOptions.queryMaxLimit !== 'undefined') vars.queryMaxLimit = scopeOptions.queryMaxLimit;
   if (typeof scopeOptions.includeDepthLimit !== 'undefined') vars.includeDepthLimit = scopeOptions.includeDepthLimit;
-  if (typeof scopeOptions.publicBaseUrl !== 'undefined') vars.publicBaseUrl = scopeOptions.publicBaseUrl;
   if (typeof scopeOptions.enablePaginationCounts !== 'undefined') vars.enablePaginationCounts = scopeOptions.enablePaginationCounts;
   
   // Set simplified settings as scope vars

package/plugins/core/rest-api-plugin-methods/check-permissions.js

@@ -7,11 +7,7 @@ export default async function checkPermissionsMethod({ context, params, runHooks
  
   Object.assign(context, {
     method: params.method,
-    isUpdate: params.isUpdate,
-    id: params.id,
-    auth: params.auth,
-    transaction: params.transaction,
-    minimalRecord: params.minimalRecord
+    originalContext: params.originalContext,
   })
   
   await runHooks('checkPermissions');

package/plugins/core/rest-api-plugin-methods/common.js

@@ -130,8 +130,8 @@ export async function setupCommonRequest({ params, context, vars, scopes, scopeO
   context.db = context.transaction || api.knex.instance;
 
   // These are just shortcuts used in this function and will be returned
-  const schema = context.schemaInfo.schema;
-  const schemaStructure = context.schemaInfo.schema.structure;
+  const schema = context.schemaInfo.schemaInstance;
+  const schemaStructure = context.schemaInfo.schemaInstance.structure;
   const schemaRelationships = context.schemaInfo.schemaRelationships;
 
   // Transform input if in simplified mode
@@ -297,8 +297,9 @@ export const validateResourceAttributesBeforeWrite = async ({
       ...belongsToUpdates
   };
   
-  // Extract computed fields before validation (they should be rejected)
+  // Extract computed fields and foreign key fields before validation
   const computedFields = {};
+  const foreignKeyFields = {};
   const schemaStructure = context.schemaInfo.schemaStructure || {};
   Object.entries(attributesToValidate).forEach(([key, value]) => {
     const fieldDef = schemaStructure[key];
@@ -306,6 +307,12 @@ export const validateResourceAttributesBeforeWrite = async ({
     if (fieldDef && fieldDef.computed === true && value !== undefined) {
       computedFields[key] = value;
     }
+    // Foreign key fields (belongsTo with 'as' property) should NOT be in attributes
+    // They should only come through relationships or belongsToUpdates
+    // Check if key exists in belongsToUpdates (not just truthy value)
+    if (fieldDef && fieldDef.belongsTo && fieldDef.as && value !== undefined && !(key in belongsToUpdates)) {
+      foreignKeyFields[key] = value;
+    }
   });
   
   // Warn if computed fields were sent in the input
@@ -314,12 +321,40 @@ export const validateResourceAttributesBeforeWrite = async ({
     console.warn(`Computed fields [${fieldNames}] were sent in input for resource '${context.scopeName}' but will be ignored as they are output-only`);
   }
   
-  // Filter out ONLY computed fields from validation
+  // Reject if foreign key fields were sent directly in attributes
+  if (Object.keys(foreignKeyFields).length > 0) {
+    const violations = Object.keys(foreignKeyFields).map(field => {
+      const fieldDef = schemaStructure[field];
+      return {
+        field: `data.attributes.${field}`,
+        rule: 'foreign_key_in_attributes',
+        message: `Foreign key field '${field}' should not be in attributes. Use 'data.relationships.${fieldDef.as}' instead.`
+      };
+    });
+    
+    throw new RestApiValidationError(
+      'Foreign key fields cannot be set directly in attributes',
+      { 
+        fields: violations.map(v => v.field),
+        violations
+      }
+    );
+  }
+  
+  // Filter out computed fields and foreign key fields from validation
   // Virtual fields MUST go through validation
   const attributesForValidation = Object.entries(attributesToValidate)
     .filter(([key, _]) => {
       const fieldDef = schemaStructure[key];
-      return !fieldDef || fieldDef.computed !== true;
+      // Exclude computed fields
+      if (fieldDef && fieldDef.computed === true) {
+        return false;
+      }
+      // Exclude foreign key fields that weren't provided via belongsToUpdates
+      if (fieldDef && fieldDef.belongsTo && fieldDef.as && !belongsToUpdates[key]) {
+        return false;
+      }
+      return true;
     })
     .reduce((acc, [key, value]) => {
       acc[key] = value;
@@ -332,7 +367,7 @@ export const validateResourceAttributesBeforeWrite = async ({
 
   if (Object.keys(errors).length > 0) {
     // --- START OF MODIFICATION ---
-    const schemaStructure = context.schemaInfo.schema.structure; // Get the schema structure for lookup
+    const schemaStructure = context.schemaInfo.schemaInstance.structure; // Get the schema structure for lookup
 
     const violations = Object.entries(errors).map(([field, error]) => {
     let fieldPath = `data.attributes.${field}`; // Default path for attributes
@@ -426,10 +461,11 @@ export const validateRelationshipAccess = async (context, inputRecord, helpers,
       // Check permissions using the related scope's checkPermissions
       await relatedScope.checkPermissions({
         method: 'get',
-        auth: context.auth,
-        id: item.id,
-        minimalRecord: record,
-        transaction: context.transaction
+        originalContext: {
+          ...context,
+          id: item.id,
+          minimalRecord: record
+        }
       });
     }
   }

package/plugins/core/rest-api-plugin-methods/delete-relationship.js

@@ -1,6 +1,6 @@
 
-import { RestApiResourceError } from "../../../lib/rest-api-errors.js";
-import { findRelationshipDefinition } from "./common.js";
+import { RestApiResourceError, RestApiValidationError, RestApiPayloadError } from "../../../lib/rest-api-errors.js";
+import { findRelationshipDefinition, handleWriteMethodError } from "./common.js";
 
 /**
  * DELETE RELATIONSHIP
@@ -12,7 +12,7 @@ import { findRelationshipDefinition } from "./common.js";
  * @param {array} relationshipData - Array of resource identifiers to remove
  * @returns {Promise<void>} 204 No Content
  */
-export default async function deleteRelationshipMethod({ params, context, vars, helpers, scope, scopes, runHooks, scopeName, api }) {
+export default async function deleteRelationshipMethod({ params, context, vars, helpers, scope, scopes, runHooks, scopeName, api, log }) {
   context.method = 'deleteRelationship';
   context.id = params.id;
   context.relationshipName = params.relationshipName;
@@ -34,7 +34,7 @@ export default async function deleteRelationshipMethod({ params, context, vars,
       );
     }
 
-    if (!relDef.hasMany && !relDef.manyToMany) {
+    if (relDef.type !== 'hasMany' && relDef.type !== 'manyToMany') {
       throw new RestApiValidationError(
         `Cannot DELETE from to-one relationship '${context.relationshipName}'`,
         { fields: ['data'] }
@@ -60,30 +60,34 @@ export default async function deleteRelationshipMethod({ params, context, vars,
     }
 
     // Remove relationships
-    if (relDef.manyToMany || (relDef.hasMany && relDef.through)) {
-      const manyToManyDef = relDef.manyToMany || {
-        through: relDef.through,
-        foreignKey: relDef.foreignKey,
-        otherKey: relDef.otherKey
-      };
-
-      const knex = api.knex?.instance || helpers.db;
-      const pivotResource = manyToManyDef.through;
-      const pivotScope = api.resources[pivotResource];
-      const pivotTable = pivotScope?.vars?.schemaInfo?.tableName || pivotResource;
-      const localKey = manyToManyDef.foreignKey;
-      const foreignKey = manyToManyDef.otherKey;
-
-      for (const identifier of params.relationshipData) {
-        await knex(pivotTable)
-          .where(localKey, context.id)
-          .where(foreignKey, identifier.id)
-          .delete()
-          .transacting(context.transaction);
+    if (relDef?.through) {
+      if (api.anyapi?.links?.removeMany) {
+        await api.anyapi.links.removeMany({
+          context,
+          scopeName,
+          relName: context.relationshipName,
+          relDef,
+          relData: params.relationshipData,
+        });
+      } else {
+        const knex = api.knex?.instance || helpers.db;
+        const pivotResource = relDef.through;
+        const pivotScope = api.resources[pivotResource];
+        const pivotTable = pivotScope?.vars?.schemaInfo?.tableName || pivotResource;
+        const localKey = relDef.foreignKey;
+        const foreignKey = relDef.otherKey;
+
+        for (const identifier of params.relationshipData) {
+          await knex(pivotTable)
+            .where(localKey, context.id)
+            .where(foreignKey, identifier.id)
+            .delete()
+            .transacting(context.transaction);
+        }
       }
     } else {
       // Null out foreign keys for hasMany
-      const targetType = relDef.hasMany;
+      const targetType = relDef.target;
       for (const identifier of params.relationshipData) {
         await api.resources[targetType].patch({
           id: identifier.id,
@@ -110,6 +114,6 @@ export default async function deleteRelationshipMethod({ params, context, vars,
     return; // 204 No Content
 
   } catch (error) {
-    await handleWriteMethodError(error, context, 'DELETE_RELATIONSHIP', scopeName, log);
+    await handleWriteMethodError(error, context, 'DELETE_RELATIONSHIP', scopeName, log, runHooks);
   }
-}
+}

package/plugins/core/rest-api-plugin-methods/delete.js

@@ -67,10 +67,7 @@ export default async function deleteMethod({
     // Centralised checkPermissions function
     await scope.checkPermissions({
       method: 'delete',
-      auth: context.auth,
-      id: context.id,
-      minimalRecord: context.minimalRecord,
-      transaction: context.transaction
+      originalContext: context,
     });
     
     // Before data operations

package/plugins/core/rest-api-plugin-methods/enrich-attributes.js

@@ -167,6 +167,18 @@ export default async function enrichAttributesMethod({ context, params, runHooks
         }
       }
 
+      if (requestedFields && requestedFields.length > 0) {
+        const requestedList = typeof requestedFields === 'string'
+          ? requestedFields.split(',').map((field) => field.trim()).filter((field) => field)
+          : requestedFields;
+        const allowed = new Set(requestedList);
+        Object.keys(finalAttributes).forEach((key) => {
+          if (!allowed.has(key)) {
+            delete finalAttributes[key];
+          }
+        });
+      }
+
       // Create context for enrichAttributes hooks
       Object.assign(context, {
         parentContext,
@@ -183,4 +195,4 @@ export default async function enrichAttributesMethod({ context, params, runHooks
 
       // Return the attributes from context, which hooks may have modified
       return context.attributes;
-    };
+    };