json-rest-api 1.0.10 → 1.0.13

package/tests/query-limits.test.js

@@ -8,6 +8,7 @@ import {
   cleanTables,
   countRecords,
   createJsonApiDocument,
+  createRelationship,
   validateJsonApiStructure
 } from './helpers/test-utils.js';
 
@@ -61,7 +62,8 @@ describe('Query Limits and Include Limits', () => {
       },
       relationships: {
         books: { 
-          hasMany: 'books', 
+          type: 'hasMany',
+          target: 'books', 
           foreignKey: 'publisher_id',
           // Relationships are always includable via ?include=
           include: {
@@ -81,7 +83,7 @@ describe('Query Limits and Include Limits', () => {
       },
       relationships: {
         books: { 
-          hasMany: 'books', 
+          type: 'manyToMany',
           through: 'book_authors', 
           foreignKey: 'author_id', 
           otherKey: 'book_id',
@@ -104,13 +106,13 @@ describe('Query Limits and Include Limits', () => {
       },
       relationships: {
         authors: { 
-          hasMany: 'authors', 
+          type: 'manyToMany',
           through: 'book_authors', 
           foreignKey: 'book_id', 
-          otherKey: 'author_id',
+          otherKey: 'author_id'
           // Relationships are always includable via ?include=
         },
-        reviews: { hasMany: 'reviews', via: 'reviewable' }
+        reviews: { type: 'hasMany', target: 'reviews', via: 'reviewable' }
       }
     });
     await api.resources.books.createKnexTable();
@@ -215,29 +217,21 @@ describe('Query Limits and Include Limits', () => {
       });
 
       const publisher = await api.resources.publishers.post({
-        inputRecord: {
-          data: {
-            type: 'publishers',
-            attributes: {
-              name: 'Test Publisher',
-              country_id: parseInt(country.id)
-            }
-          }
-        }
+        inputRecord: createJsonApiDocument('publishers', {
+          name: 'Test Publisher'
+        }, {
+            country: createRelationship({ type: 'countries', id: String(country.id) })
+          })
       });
 
       // Create 25 books for the publisher
       for (let i = 1; i <= 25; i++) {
         await api.resources.books.post({
-          inputRecord: {
-            data: {
-              type: 'books',
-              attributes: {
-                title: `Book ${i}`,
-                publisher_id: parseInt(publisher.id)
-              }
-            }
-          }
+          inputRecord: createJsonApiDocument('books', {
+              title: `Book ${i}`
+            }, {
+                publisher: createRelationship({ type: 'publishers', id: String(publisher.id) })
+              })
         });
       }
     });
@@ -262,46 +256,47 @@ describe('Query Limits and Include Limits', () => {
     });
 
     it('should respect explicit limit in relationship config', async () => {
-      // Create a publisher first
+      // Create a country first
+      const country = await api.resources.countries.post({
+        inputRecord: createJsonApiDocument('countries', {
+          name: 'Test Country',
+          code: 'TC'
+        })
+      });
+      
+      // Create a publisher
       const publisher = await api.resources.publishers.post({
         inputRecord: createJsonApiDocument('publishers', {
-          name: 'Test Publisher',
-          country_id: 1
+          name: 'Test Publisher'
+        }, {
+          country: createRelationship({ type: 'countries', id: String(country.id) })
         })
       });
 
       // Create authors with many books
       const author = await api.resources.authors.post({
-        inputRecord: {
-          data: {
-            type: 'authors',
-            attributes: {
-              name: 'Test Author',
-              country_id: 1
-            }
-          }
-        }
+        inputRecord: createJsonApiDocument('authors', {
+          name: 'Test Author'
+        }, {
+            country: createRelationship({ type: 'countries', id: String(country.id) })
+          })
       });
 
       // Create 10 books and associate with author
       for (let i = 1; i <= 10; i++) {
         const book = await api.resources.books.post({
-          inputRecord: {
-            data: {
-              type: 'books',
-              attributes: {
-                title: `Book ${i}`,
-                publisher_id: parseInt(publisher.id)
-              }
-            }
-          }
+          inputRecord: createJsonApiDocument('books', {
+              title: `Book ${i}`
+            }, {
+                publisher: createRelationship({ type: 'publishers', id: String(publisher.id) })
+              })
         });
 
         await api.resources.book_authors.post({
-          inputRecord: createJsonApiDocument('book_authors', {
-            book_id: parseInt(book.id),
-            author_id: parseInt(author.id)
-          })
+          inputRecord: createJsonApiDocument('book_authors', {}, {
+              book: createRelationship({ type: 'books', id: String(book.id) }),
+              author: createRelationship({ type: 'authors', id: String(author.id) })
+            })
         });
       }
 
@@ -331,9 +326,10 @@ describe('Query Limits and Include Limits', () => {
       // Create a publisher with country
       const publisher = await api.resources.publishers.post({
         inputRecord: createJsonApiDocument('publishers', {
-          name: 'Test Publisher',
-          country_id: parseInt(country.id)
-        })
+          name: 'Test Publisher'
+        }, {
+            country: createRelationship({ type: 'countries', id: String(country.id) })
+          })
       });
 
       // Create books with reviews
@@ -419,7 +415,8 @@ describe('Query Limits and Include Limits', () => {
             },
             relationships: {
               subitems: {
-                hasMany: 'subitems',
+                type: 'hasMany',
+                target: 'subitems',
                 foreignKey: 'test_item_id',
                 include: {
                   limit: 25  // Exceeds queryMaxLimit of 20
@@ -428,7 +425,9 @@ describe('Query Limits and Include Limits', () => {
             }
           });
         },
-        /limit.*exceeds queryMaxLimit/,
+        (err) => {
+          return err.message && err.message.includes('limit') && err.message.includes('exceeds queryMaxLimit');
+        },
         'Should throw error for excessive include limit'
       );
     });
@@ -437,7 +436,7 @@ describe('Query Limits and Include Limits', () => {
   describe('Window Strategy with Defaults', () => {
     beforeEach(async () => {
       // Create a country first
-      await api.resources.countries.post({
+      const country = await api.resources.countries.post({
         inputRecord: createJsonApiDocument('countries', {
           name: 'USA',
           code: 'US'
@@ -448,15 +447,13 @@ describe('Query Limits and Include Limits', () => {
       for (let pubNum = 1; pubNum <= 3; pubNum++) {
         const publisher = await api.resources.publishers.post({
           inputRecord: {
-            data: {
-              type: 'publishers',
-              attributes: {
-                name: `Publisher ${pubNum}`,
-                country_id: 1
-              }
-            }
+            data: createJsonApiDocument('publishers', {
+              name: `Publisher ${pubNum}`
+            }, {
+                country: createRelationship({ type: 'countries', id: String(country.id) })
+              }).data
           }
-        });
+        })
 
         // Create different number of books for each publisher
         const bookCount = pubNum * 8; // 8, 16, 24 books
@@ -518,30 +515,22 @@ describe('Query Limits and Include Limits', () => {
       });
 
       const publisher = await api.resources.publishers.post({
-        inputRecord: {
-          data: {
-            type: 'publishers',
-            attributes: {
-              name: 'Test Publisher',
-              country_id: parseInt(country.id)
-            }
-          }
-        }
+        inputRecord: createJsonApiDocument('publishers', {
+          name: 'Test Publisher'
+        }, {
+            country: createRelationship({ type: 'countries', id: String(country.id) })
+          })
       });
 
       // Create 2 authors
       const authors = [];
       for (let i = 1; i <= 2; i++) {
         const author = await api.resources.authors.post({
-          inputRecord: {
-            data: {
-              type: 'authors',
-              attributes: {
-                name: `Author ${i}`,
-                country_id: parseInt(country.id)
-              }
-            }
-          }
+          inputRecord: createJsonApiDocument('authors', {
+            name: `Author ${i}`
+          }, {
+              country: createRelationship({ type: 'countries', id: String(country.id) })
+            })
         });
         authors.push(author);
       }
@@ -549,23 +538,19 @@ describe('Query Limits and Include Limits', () => {
       // Create 10 books and associate ALL with BOTH authors
       for (let i = 1; i <= 10; i++) {
         const book = await api.resources.books.post({
-          inputRecord: {
-            data: {
-              type: 'books',
-              attributes: {
-                title: `Book ${i}`,
-                publisher_id: parseInt(publisher.id)
-              }
-            }
-          }
+          inputRecord: createJsonApiDocument('books', {
+              title: `Book ${i}`
+            }, {
+                publisher: createRelationship({ type: 'publishers', id: String(publisher.id) })
+              })
         });
 
         // Associate with both authors
         for (const author of authors) {
           await api.resources.book_authors.post({
-            inputRecord: createJsonApiDocument('book_authors', {
-              book_id: parseInt(book.id),
-              author_id: parseInt(author.id)
+            inputRecord: createJsonApiDocument('book_authors', {}, {
+              book: createRelationship({ type: 'books', id: String(book.id) }),
+              author: createRelationship({ type: 'authors', id: String(author.id) })
             })
           });
         }

package/tests/rest-api-access.test.js

@@ -0,0 +1,206 @@
+import { describe, it, before, after, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import knexLib from 'knex';
+import {
+  validateJsonApiStructure,
+  cleanTables,
+  createJsonApiDocument,
+  assertResourceAttributes,
+  assertResourceRelationship
+} from './helpers/test-utils.js';
+import { createAccessControlApi } from './fixtures/api-configs.js';
+
+const knex = knexLib({
+  client: 'better-sqlite3',
+  connection: {
+    filename: ':memory:'
+  },
+  useNullAsDefault: true
+});
+
+let api;
+
+async function createUser(email, displayName = 'Test User') {
+  const userDoc = createJsonApiDocument('users', {
+    email,
+    display_name: displayName
+  });
+
+  const result = await api.resources.users.post({
+    inputRecord: userDoc,
+    simplified: false
+  }, { auth: { system: true } });
+
+  validateJsonApiStructure(result);
+  assertResourceAttributes(result.data, {
+    email,
+    display_name: displayName
+  });
+
+  return Number(result.data.id);
+}
+
+async function createProjectForUser(userId, name, status = null) {
+  const projectDoc = createJsonApiDocument('projects', {
+    name,
+    status
+  });
+
+  const result = await api.resources.projects.post({
+    inputRecord: projectDoc,
+    simplified: false
+  }, { auth: { userId } });
+
+  validateJsonApiStructure(result);
+  return result.data;
+}
+
+describe('Access plugin', () => {
+  before(async () => {
+    api = await createAccessControlApi(knex);
+  });
+
+  after(async () => {
+    await knex.destroy();
+  });
+
+  beforeEach(async () => {
+    await cleanTables(knex, [
+      'access_notes',
+      'access_projects',
+      'access_users'
+    ]);
+  });
+
+  it('rejects unauthenticated requests for protected operations', async () => {
+    const projectDoc = createJsonApiDocument('projects', {
+      name: 'Unauthenticated project'
+    });
+
+    await assert.rejects(async () => {
+      await api.resources.projects.post({
+        inputRecord: projectDoc,
+        simplified: false
+      });
+    }, (error) => {
+      assert.equal(error.statusCode, 403);
+      assert.match(error.message, /Access denied/);
+      return true;
+    });
+  });
+
+  it('auto assigns ownership when creating a project', async () => {
+    const ownerId = await createUser('owner@example.com', 'Owner One');
+
+    const projectDoc = createJsonApiDocument('projects', {
+      name: 'Owned Project',
+      status: 'active'
+    });
+
+    const createResult = await api.resources.projects.post({
+      inputRecord: projectDoc,
+      simplified: false
+    }, { auth: { userId: ownerId } });
+
+    validateJsonApiStructure(createResult);
+    assertResourceAttributes(createResult.data, {
+      name: 'Owned Project',
+      status: 'active'
+    });
+    assertResourceRelationship(createResult.data, 'user', {
+      type: 'users',
+      id: String(ownerId)
+    });
+
+    const getResult = await api.resources.projects.get({
+      id: createResult.data.id,
+      simplified: false
+    }, { auth: { userId: ownerId } });
+
+    validateJsonApiStructure(getResult);
+    assertResourceRelationship(getResult.data, 'user', {
+      type: 'users',
+      id: String(ownerId)
+    });
+  });
+
+  it('filters query results by ownership for non-admin users', async () => {
+    const aliceId = await createUser('alice@example.com', 'Alice');
+    const bobId = await createUser('bob@example.com', 'Bob');
+
+    const aliceProject = await createProjectForUser(aliceId, 'Alice Project', 'active');
+    await createProjectForUser(bobId, 'Bob Project', 'planning');
+
+    const queryResult = await api.resources.projects.query({
+      simplified: false
+    }, { auth: { userId: aliceId } });
+
+    validateJsonApiStructure(queryResult, true);
+    assert.equal(queryResult.data.length, 1);
+    assert.equal(queryResult.data[0].id, aliceProject.id);
+    assertResourceRelationship(queryResult.data[0], 'user', {
+      type: 'users',
+      id: String(aliceId)
+    });
+  });
+
+  it('allows admin roles to bypass ownership filtering', async () => {
+    const userA = await createUser('admin_a@example.com', 'Admin A');
+    const userB = await createUser('admin_b@example.com', 'Admin B');
+
+    await createProjectForUser(userA, 'Admin Project A');
+    await createProjectForUser(userB, 'Admin Project B');
+
+    const adminQuery = await api.resources.projects.query({
+      simplified: false
+    }, { auth: { userId: 999, roles: ['admin'] } });
+
+    validateJsonApiStructure(adminQuery, true);
+    assert.equal(adminQuery.data.length, 2);
+
+    const relatedUserIds = adminQuery.data.map((resource) => resource.relationships.user.data.id).sort();
+    assert.deepEqual(relatedUserIds, [String(userA), String(userB)]);
+  });
+
+  it('prevents users from accessing records they do not own', async () => {
+    const ownerId = await createUser('primary@example.com', 'Primary');
+    const otherId = await createUser('secondary@example.com', 'Secondary');
+
+    const project = await createProjectForUser(ownerId, 'Primary Project');
+
+    await assert.rejects(async () => {
+      await api.resources.projects.get({
+        id: project.id,
+        simplified: false
+      }, { auth: { userId: otherId } });
+    }, (error) => {
+      assert.equal(error.statusCode, 403);
+      assert.match(error.message, /Access denied/);
+      return true;
+    });
+  });
+
+  it('enforces helper ownership checks', () => {
+    const context = { auth: { userId: 123 } };
+    const resource = { user_id: 123 };
+
+    const auth = api.helpers.auth.requireOwnership(context, resource);
+    assert.equal(auth.userId, 123);
+
+    assert.throws(() => {
+      api.helpers.auth.requireOwnership({ auth: { userId: 123 } }, { user_id: 456 });
+    }, (error) => {
+      assert.equal(error.statusCode, 403);
+      assert.match(error.message, /Access denied/);
+      return true;
+    });
+
+    assert.throws(() => {
+      api.helpers.auth.requireAuth({});
+    }, (error) => {
+      assert.equal(error.statusCode, 401);
+      assert.match(error.message, /Authentication required/);
+      return true;
+    });
+  });
+});

package/tests/searchschema-merge.test.js

@@ -0,0 +1,182 @@
+import { describe, it, before, beforeEach, after } from 'node:test';
+import assert from 'node:assert/strict';
+import knexLib from 'knex';
+import { 
+  cleanTables, 
+  createJsonApiDocument, 
+  createRelationship 
+} from './helpers/test-utils.js';
+import { createSearchSchemaMergeApi } from './fixtures/api-configs.js';
+
+// Create Knex instance for tests - always use SQLite in-memory
+const knex = knexLib({
+  client: 'better-sqlite3',
+  connection: {
+    filename: ':memory:'
+  },
+  useNullAsDefault: true
+});
+
+describe('SearchSchema Merge Behavior', () => {
+  let api;
+
+  before(async () => {
+    // Create API instance once - NEVER in beforeEach
+    api = await createSearchSchemaMergeApi(knex);
+  });
+
+  after(async () => {
+    // Clean up - destroy connection
+    await knex.destroy();
+  });
+
+  beforeEach(async () => {
+    // Clean tables between tests
+    await cleanTables(knex, ['searchmerge_products', 'searchmerge_users', 'searchmerge_orders']);
+  });
+
+  it('should merge search:true fields with explicit searchSchema', async () => {
+    // First do a query to trigger schema compilation
+    await api.resources.products.query({
+      queryParams: {}
+    });
+    
+    // Get the compiled searchSchema for products (has both search:true and searchSchema)
+    const scope = api.resources.products;
+    const searchSchema = scope.vars.schemaInfo.searchSchemaInstance;
+    
+    // Verify searchSchema exists
+    assert.ok(searchSchema, 'searchSchema should exist');
+    assert.ok(searchSchema.structure, 'searchSchema should have structure');
+    
+    // Check that search:true fields were added
+    assert.ok(searchSchema.structure.name, 'name field should be searchable');
+    assert.equal(searchSchema.structure.name.filterOperator || '=', '=', 'name should use default = operator');
+    
+    assert.ok(searchSchema.structure.description, 'description field should be searchable');
+    assert.equal(searchSchema.structure.description.filterOperator || '=', '=', 'description should use default = operator');
+    
+    assert.ok(searchSchema.structure.sku, 'sku field should be searchable');
+    assert.equal(searchSchema.structure.sku.filterOperator || '=', '=', 'sku should use default = operator');
+    
+    // Check that explicit searchSchema fields override search:true
+    assert.ok(searchSchema.structure.price, 'price field should be searchable');
+    assert.equal(searchSchema.structure.price.filterOperator, 'between', 'price should use between operator from searchSchema');
+    
+    // Check that virtual fields from searchSchema are present
+    assert.ok(searchSchema.structure.category_name, 'category_name virtual field should be searchable');
+    assert.equal(searchSchema.structure.category_name.filterOperator, 'like', 'category_name should use like operator');
+    assert.equal(searchSchema.structure.category_name.actualField, 'category.name', 'category_name should map to category.name');
+    
+    // Check explicit searchSchema field not marked with search:true
+    assert.ok(searchSchema.structure.status, 'status field should be searchable from searchSchema');
+    assert.equal(searchSchema.structure.status.filterOperator, 'in', 'status should use in operator');
+    
+    // Check that non-searchable fields are not included
+    assert.ok(!searchSchema.structure.category_id, 'category_id should not be searchable');
+  });
+
+  it('should work with only search:true fields (no explicit searchSchema)', async () => {
+    // First do a query to trigger schema compilation
+    await api.resources.users.query({
+      queryParams: {}
+    });
+    
+    // Get the compiled searchSchema for users (only search:true fields)
+    const scope = api.resources.users;
+    const searchSchema = scope.vars.schemaInfo.searchSchemaInstance;
+    
+    assert.ok(searchSchema, 'searchSchema should exist');
+    assert.ok(searchSchema.structure.username, 'username should be searchable');
+    assert.ok(searchSchema.structure.email, 'email should be searchable');
+    assert.ok(searchSchema.structure.bio, 'bio should be searchable');
+    assert.equal(searchSchema.structure.bio.filterOperator, 'like', 'bio should use like operator');
+    assert.ok(!searchSchema.structure.age, 'age should not be searchable');
+  });
+
+  it('should work with only explicit searchSchema (no search:true)', async () => {
+    // First do a query to trigger schema compilation
+    await api.resources.orders.query({
+      queryParams: {}
+    });
+    
+    // Get the compiled searchSchema for orders (only explicit searchSchema)
+    const scope = api.resources.orders;
+    const searchSchema = scope.vars.schemaInfo.searchSchemaInstance;
+    
+    assert.ok(searchSchema, 'searchSchema should exist');
+    assert.ok(searchSchema.structure.order_number, 'order_number should be searchable');
+    assert.ok(searchSchema.structure.status, 'status should be searchable');
+    assert.equal(searchSchema.structure.status.filterOperator, 'in', 'status should use in operator');
+    assert.ok(!searchSchema.structure.total, 'total should not be searchable');
+  });
+  
+  it('should allow filtering with merged searchSchema fields', async () => {
+    const context = {};
+    
+    // Create some test data using API methods
+    const product1 = await api.resources.products.post({
+      inputRecord: createJsonApiDocument('products', {
+        name: 'Widget A',
+        description: 'A great widget',
+        price: 50,
+        sku: 'WGT-001',
+        status: 'active'
+      })
+    }, context);
+    
+    const product2 = await api.resources.products.post({
+      inputRecord: createJsonApiDocument('products', {
+        name: 'Widget B',
+        description: 'Another widget',
+        price: 150,
+        sku: 'WGT-002',
+        status: 'inactive'
+      })
+    }, context);
+    
+    // Test filtering with field from search:true
+    const nameResults = await api.resources.products.query({
+      queryParams: {
+        filters: {
+          name: 'Widget A'
+        }
+      }
+    }, context);
+    assert.equal(nameResults.data.length, 1, 'Should find one product by name');
+    assert.equal(nameResults.data[0].attributes.name, 'Widget A');
+    
+    // Test filtering with field from explicit searchSchema (between operator)
+    const priceResults = await api.resources.products.query({
+      queryParams: {
+        filters: {
+          price: [40, 60]  // Between 40 and 60
+        }
+      }
+    }, context);
+    assert.equal(priceResults.data.length, 1, 'Should find one product in price range');
+    assert.equal(priceResults.data[0].attributes.price, 50);
+    
+    // Test filtering with explicit searchSchema field (in operator)
+    const statusResults = await api.resources.products.query({
+      queryParams: {
+        filters: {
+          status: ['active']
+        }
+      }
+    }, context);
+    assert.equal(statusResults.data.length, 1, 'Should find one active product');
+    assert.equal(statusResults.data[0].attributes.status, 'active');
+    
+    // Test filtering with search:true field that wasn't overridden
+    const skuResults = await api.resources.products.query({
+      queryParams: {
+        filters: {
+          sku: 'WGT-002'
+        }
+      }
+    }, context);
+    assert.equal(skuResults.data.length, 1, 'Should find one product by SKU');
+    assert.equal(skuResults.data[0].attributes.sku, 'WGT-002');
+  });
+});