json-rest-api 1.0.14 → 1.0.16

package/plugins/core/rest-api-multihome-plugin.js

@@ -1,155 +1,154 @@
 export const MultiHomePlugin = {
-    name: 'multihome',
-    dependencies: ['rest-api'],
+  name: 'multihome',
+  dependencies: ['rest-api'],
 
-    install({ api, addHook, vars, helpers, log, scopes, pluginOptions }) {
+  install ({ api, addHook, vars, helpers, log, scopes, pluginOptions }) {
+    if (!api.knex?.instance) {
+      throw new Error('Multihome plugin requires a storage plugin with knex support (rest-api-knex or rest-api-anyapi-knex)')
+    }
+
+    // Get configuration - hooked-api namespaces options by plugin name
+    const multihomeOptions = pluginOptions || {}
 
-      if (!api.knex?.instance) {
-        throw new Error('Multihome plugin requires a storage plugin with knex support (rest-api-knex or rest-api-anyapi-knex)');
+    // Store configuration in vars (data only)
+    vars.multihome = {
+      field: multihomeOptions.field || 'multihome_id',
+      excludeResources: multihomeOptions.excludeResources || ['system_migrations', 'system_logs'],
+      requireAuth: multihomeOptions.requireAuth !== undefined ? multihomeOptions.requireAuth : true,
+      allowMissing: multihomeOptions.allowMissing || false
+    }
+
+    const resolveStorageAdapter = (scopeName, hookContext = {}) => {
+      if (!scopeName) return null
+      if (hookContext.storageAdapter) return hookContext.storageAdapter
+      if (hookContext.knexQuery?.storageAdapter) return hookContext.knexQuery.storageAdapter
+      if (helpers.getStorageAdapter) {
+        return helpers.getStorageAdapter(scopeName)
       }
+      return null
+    }
 
-      // Get configuration - hooked-api namespaces options by plugin name
-      const multihomeOptions = pluginOptions || {};
-
-      // Store configuration in vars (data only)
-      vars.multihome = {
-        field: multihomeOptions.field || 'multihome_id',
-        excludeResources: multihomeOptions.excludeResources || ['system_migrations', 'system_logs'],
-        requireAuth: multihomeOptions.requireAuth !== undefined ? multihomeOptions.requireAuth : true,
-        allowMissing: multihomeOptions.allowMissing || false
-      };
-
-      const resolveStorageAdapter = (scopeName, hookContext = {}) => {
-        if (!scopeName) return null;
-        if (hookContext.storageAdapter) return hookContext.storageAdapter;
-        if (hookContext.knexQuery?.storageAdapter) return hookContext.knexQuery.storageAdapter;
-        if (helpers.getStorageAdapter) {
-          return helpers.getStorageAdapter(scopeName);
-        }
-        return null;
-      };
-
-      const translateColumnReference = ({ field, tableName, scopeName, hookContext }) => {
-        const storageAdapter = resolveStorageAdapter(scopeName, hookContext);
-        const translated = storageAdapter?.translateColumn?.(field) ?? field;
-        if (tableName) {
-          return `${tableName}.${translated}`;
-        }
-        return translated;
-      };
-
-      const translateFilterValue = ({ field, value, scopeName, hookContext }) => {
-        const storageAdapter = resolveStorageAdapter(scopeName, hookContext);
-        if (!storageAdapter?.translateFilterValue) return value;
-        return storageAdapter.translateFilterValue(field, value);
-      };
-
-      // Default extractor function
-      function defaultSubdomainExtractor(request) {
-        // Extract from subdomain (e.g., 'mobily' from 'mobily.app.com')
-        const host = request.headers?.host || request.hostname || '';
-        const subdomain = host.split('.')[0];
-
-        // Don't use 'www' or 'api' as tenant IDs
-        if (subdomain && !['www', 'api', 'app'].includes(subdomain)) {
-          return subdomain;
-        }
+    const translateColumnReference = ({ field, tableName, scopeName, hookContext }) => {
+      const storageAdapter = resolveStorageAdapter(scopeName, hookContext)
+      const translated = storageAdapter?.translateColumn?.(field) ?? field
+      if (tableName) {
+        return `${tableName}.${translated}`
+      }
+      return translated
+    }
+
+    const translateFilterValue = ({ field, value, scopeName, hookContext }) => {
+      const storageAdapter = resolveStorageAdapter(scopeName, hookContext)
+      if (!storageAdapter?.translateFilterValue) return value
+      return storageAdapter.translateFilterValue(field, value)
+    }
 
-        // Fallback to header
-        return request.headers?.['x-multihome-id'] || null;
+    // Default extractor function
+    function defaultSubdomainExtractor (request) {
+      // Extract from subdomain (e.g., 'mobily' from 'mobily.app.com')
+      const host = request.headers?.host || request.hostname || ''
+      const subdomain = host.split('.')[0]
+
+      // Don't use 'www' or 'api' as tenant IDs
+      if (subdomain && !['www', 'api', 'app'].includes(subdomain)) {
+        return subdomain
       }
 
-      // Store extractor function in helpers
-      helpers.extractMultihomeId = multihomeOptions.extractor || defaultSubdomainExtractor;
-
-      // Hook into transport layer to extract multihome_id
-      addHook('transport:request', 'extract-multihome-id', {}, async ({ context, request, helpers }) => {
-        // Extract multihome_id using configured extractor
-        const multihomeId = helpers.extractMultihomeId(request);
-
-        if (multihomeId) {
-          // Store in auth context (even if no user auth)
-          context.auth = context.auth || {};
-          context.auth.multihome_id = multihomeId;
-
-          log.debug('Multihome ID extracted', {
-            multihome_id: multihomeId,
-            source: request.headers?.host
-          });
-        } else if (vars.multihome.requireAuth) {
-          log.warn('No multihome ID found in request', {
-            host: request.headers?.host,
-            headers: Object.keys(request.headers || {})
-          });
-        }
-      });
+      // Fallback to header
+      return request.headers?.['x-multihome-id'] || null
+    }
 
-      // Validate that resources have multihome field when added
-      addHook('scope:added', 'validate-multihome-field', {}, ({ context, vars }) => {
-        const { scopeName, scopeOptions } = context;
+    // Store extractor function in helpers
+    helpers.extractMultihomeId = multihomeOptions.extractor || defaultSubdomainExtractor
 
-        // Skip excluded resources
-        if (vars.multihome.excludeResources.includes(scopeName)) {
-          log.debug(`Resource ${scopeName} excluded from multihome validation`);
-          return;
-        }
+    // Hook into transport layer to extract multihome_id
+    addHook('transport:request', 'extract-multihome-id', {}, async ({ context, request, helpers }) => {
+      // Extract multihome_id using configured extractor
+      const multihomeId = helpers.extractMultihomeId(request)
 
-        // Check if schema has multihome field
-        const schema = scopeOptions.schema;
-        if (schema && !schema[vars.multihome.field]) {
-          if (vars.multihome.allowMissing) {
-            log.warn(`Resource ${scopeName} missing ${vars.multihome.field} field - multihome filtering disabled for this 
-  resource`);
-          } else {
-            throw new Error(
+      if (multihomeId) {
+        // Store in auth context (even if no user auth)
+        context.auth = context.auth || {}
+        context.auth.multihome_id = multihomeId
+
+        log.debug('Multihome ID extracted', {
+          multihome_id: multihomeId,
+          source: request.headers?.host
+        })
+      } else if (vars.multihome.requireAuth) {
+        log.warn('No multihome ID found in request', {
+          host: request.headers?.host,
+          headers: Object.keys(request.headers || {})
+        })
+      }
+    })
+
+    // Validate that resources have multihome field when added
+    addHook('scope:added', 'validate-multihome-field', {}, ({ context, vars }) => {
+      const { scopeName, scopeOptions } = context
+
+      // Skip excluded resources
+      if (vars.multihome.excludeResources.includes(scopeName)) {
+        log.debug(`Resource ${scopeName} excluded from multihome validation`)
+        return
+      }
+
+      // Check if schema has multihome field
+      const schema = scopeOptions.schema
+      if (schema && !schema[vars.multihome.field]) {
+        if (vars.multihome.allowMissing) {
+          log.warn(`Resource ${scopeName} missing ${vars.multihome.field} field - multihome filtering disabled for this 
+  resource`)
+        } else {
+          throw new Error(
               `Resource '${scopeName}' must have '${vars.multihome.field}' field in schema for multi-tenancy`
-            );
-          }
-        }
-      });
-
-      // Main filtering hook - adds WHERE clause to all queries
-      log.debug('Registering multihome filter hook');
-      addHook('knexQueryFiltering', 'multihome-filter', {}, async ({ context, vars }) => {
-        // Get query info from context
-        const { query, tableName, scopeName } = context.knexQuery;
-
-        // Skip excluded resources first
-        if (vars.multihome.excludeResources.includes(scopeName)) {
-          log.trace(`Skipping multihome filter for excluded resource: ${scopeName}`);
-          return;
+          )
         }
+      }
+    })
+
+    // Main filtering hook - adds WHERE clause to all queries
+    log.debug('Registering multihome filter hook')
+    addHook('knexQueryFiltering', 'multihome-filter', {}, async ({ context, vars }) => {
+      // Get query info from context
+      const { query, tableName, scopeName } = context.knexQuery
+
+      // Skip excluded resources first
+      if (vars.multihome.excludeResources.includes(scopeName)) {
+        log.trace(`Skipping multihome filter for excluded resource: ${scopeName}`)
+        return
+      }
 
       // Skip if no multihome context
       if (!context.auth?.multihome_id) {
         if (vars.multihome.requireAuth) {
-          throw new Error('No multihome context available - cannot execute query');
+          throw new Error('No multihome context available - cannot execute query')
         }
-        return;
+        return
       }
 
       log.debug('Applying multihome tenant filter', {
         scopeName,
         tableName,
         tenant: context.auth.multihome_id,
-      });
+      })
 
       // Check if this resource has multihome field
-        const scope = scopes[scopeName];
-        const hasMultihomeField = scope?.vars?.schemaInfo?.schemaStructure?.[vars.multihome.field];
-
-        if (!hasMultihomeField) {
-          if (vars.multihome.allowMissing) {
-            log.trace(`Resource ${scopeName} has no ${vars.multihome.field} field - skipping filter`);
-            return;
-          } else {
-            throw new Error(`Resource ${scopeName} missing required ${vars.multihome.field} field`);
-          }
+      const scope = scopes[scopeName]
+      const hasMultihomeField = scope?.vars?.schemaInfo?.schemaStructure?.[vars.multihome.field]
+
+      if (!hasMultihomeField) {
+        if (vars.multihome.allowMissing) {
+          log.trace(`Resource ${scopeName} has no ${vars.multihome.field} field - skipping filter`)
+          return
+        } else {
+          throw new Error(`Resource ${scopeName} missing required ${vars.multihome.field} field`)
         }
+      }
 
-      const storageAdapter = resolveStorageAdapter(scopeName, context);
+      const storageAdapter = resolveStorageAdapter(scopeName, context)
       if (storageAdapter && !context.storageAdapter) {
-        context.storageAdapter = storageAdapter;
+        context.storageAdapter = storageAdapter
       }
 
       const columnRef = translateColumnReference({
@@ -157,162 +156,159 @@ export const MultiHomePlugin = {
         tableName,
         scopeName,
         hookContext: context,
-      });
+      })
 
       const tenantValue = translateFilterValue({
         field: vars.multihome.field,
         value: context.auth.multihome_id,
         scopeName,
         hookContext: context,
-      });
+      })
 
-      
       if (tenantValue === null) {
-        query.whereNull(columnRef);
+        query.whereNull(columnRef)
       } else {
-        query.where(columnRef, tenantValue);
+        query.where(columnRef, tenantValue)
       }
 
-        log.trace('Added multihome filter', {
-          scopeName,
-          tableName,
-          multihome_id: context.auth.multihome_id
-        });
-      });
-
-      // Set multihome_id on new records
-      addHook('beforeSchemaValidate', 'set-multihome-id', {}, async ({ context, scopeName, vars }) => {
-        
-        // Skip excluded resources first
-        if (vars.multihome.excludeResources.includes(scopeName)) {
-          return;
-        }
+      log.trace('Added multihome filter', {
+        scopeName,
+        tableName,
+        multihome_id: context.auth.multihome_id
+      })
+    })
+
+    // Set multihome_id on new records
+    addHook('beforeSchemaValidate', 'set-multihome-id', {}, async ({ context, scopeName, vars }) => {
+      // Skip excluded resources first
+      if (vars.multihome.excludeResources.includes(scopeName)) {
+        return
+      }
 
-        // Skip if no multihome context
-        if (!context.auth?.multihome_id) {
-          if (vars.multihome.requireAuth) {
-            throw new Error('Cannot create record without multihome context');
-          }
-          return;
+      // Skip if no multihome context
+      if (!context.auth?.multihome_id) {
+        if (vars.multihome.requireAuth) {
+          throw new Error('Cannot create record without multihome context')
         }
+        return
+      }
 
-        // Check if this resource has multihome field
-        const scope = scopes[scopeName];
-        const hasMultihomeField = scope?.vars?.schemaInfo?.schemaStructure?.[vars.multihome.field];
+      // Check if this resource has multihome field
+      const scope = scopes[scopeName]
+      const hasMultihomeField = scope?.vars?.schemaInfo?.schemaStructure?.[vars.multihome.field]
 
-        if (!hasMultihomeField) {
-          if (!vars.multihome.allowMissing) {
-            throw new Error(`Resource ${scopeName} missing required ${vars.multihome.field} field`);
-          }
-          return;
+      if (!hasMultihomeField) {
+        if (!vars.multihome.allowMissing) {
+          throw new Error(`Resource ${scopeName} missing required ${vars.multihome.field} field`)
         }
+        return
+      }
 
-        // For POST, always set multihome_id
-        if (context.method === 'post') {
-          context.inputRecord.data.attributes = context.inputRecord.data.attributes || {};
-          context.inputRecord.data.attributes[vars.multihome.field] = context.auth.multihome_id;
+      // For POST, always set multihome_id
+      if (context.method === 'post') {
+        context.inputRecord.data.attributes = context.inputRecord.data.attributes || {}
+        context.inputRecord.data.attributes[vars.multihome.field] = context.auth.multihome_id
 
-          log.debug('Set multihome_id on new record', {
-            scopeName,
-            multihome_id: context.auth.multihome_id
-          });
-        }
+        log.debug('Set multihome_id on new record', {
+          scopeName,
+          multihome_id: context.auth.multihome_id
+        })
+      }
 
-        // For PUT/PATCH, validate multihome_id if provided
-        if ((context.method === 'put' || context.method === 'patch') &&
+      // For PUT/PATCH, validate multihome_id if provided
+      if ((context.method === 'put' || context.method === 'patch') &&
             context.inputRecord.data.attributes?.[vars.multihome.field]) {
-
-          const providedId = context.inputRecord.data.attributes[vars.multihome.field];
-          if (providedId !== context.auth.multihome_id) {
-            throw new Error(
+        const providedId = context.inputRecord.data.attributes[vars.multihome.field]
+        if (providedId !== context.auth.multihome_id) {
+          throw new Error(
               `Cannot set ${vars.multihome.field} to '${providedId}' - must match current context '${context.auth.multihome_id}'`
-            );
-          }
-        }
-      });
-
-      // Add checkPermissions hook to enforce tenant isolation
-      // This is the single source of truth for single-record access control
-      addHook('checkPermissions', 'multihome-check-permissions', {}, async ({ context, scopeName }) => {
-        // Extract the needed values from originalContext
-        const auth = context.originalContext?.auth;
-        const minimalRecord = context.originalContext?.minimalRecord;
-        const id = context.originalContext?.id;
-
-        // Skip excluded resources
-        if (vars.multihome.excludeResources.includes(scopeName)) {
-          return;
+          )
         }
+      }
+    })
+
+    // Add checkPermissions hook to enforce tenant isolation
+    // This is the single source of truth for single-record access control
+    addHook('checkPermissions', 'multihome-check-permissions', {}, async ({ context, scopeName }) => {
+      // Extract the needed values from originalContext
+      const auth = context.originalContext?.auth
+      const minimalRecord = context.originalContext?.minimalRecord
+      const id = context.originalContext?.id
+
+      // Skip excluded resources
+      if (vars.multihome.excludeResources.includes(scopeName)) {
+        return
+      }
 
-        // Skip if no multihome context
-        if (!auth?.multihome_id) {
-          if (vars.multihome.requireAuth) {
-            throw new Error('No multihome context available');
-          }
-          return;
+      // Skip if no multihome context
+      if (!auth?.multihome_id) {
+        if (vars.multihome.requireAuth) {
+          throw new Error('No multihome context available')
         }
+        return
+      }
 
-        // Get the scope to check if it has multihome field
-        const scope = scopes[scopeName];
-        const hasMultihomeField = scope?.vars?.schemaInfo?.schemaStructure?.[vars.multihome.field];
+      // Get the scope to check if it has multihome field
+      const scope = scopes[scopeName]
+      const hasMultihomeField = scope?.vars?.schemaInfo?.schemaStructure?.[vars.multihome.field]
 
-        if (!hasMultihomeField) {
-          return; // Resource doesn't support multihome
-        }
+      if (!hasMultihomeField) {
+        return // Resource doesn't support multihome
+      }
+
+      // For operations on existing records, verify tenant ownership
+      if (minimalRecord) {
+        // minimalRecord is in JSON:API format, so tenant_id is in attributes
+        const recordTenant = minimalRecord.attributes?.[vars.multihome.field]
+        const userTenant = auth.multihome_id
 
-        // For operations on existing records, verify tenant ownership
-        if (minimalRecord) {
-          // minimalRecord is in JSON:API format, so tenant_id is in attributes
-          const recordTenant = minimalRecord.attributes?.[vars.multihome.field];
-          const userTenant = auth.multihome_id;
-
-          if (recordTenant !== userTenant) {
-            log.error('Multihome permission violation', {
-              scopeName,
-              recordId: id,
-              recordTenant: recordTenant,
-              userTenant: userTenant,
-              method: context.method
-            });
-
-            // Return 404 for GET to prevent information leakage
-            // Return 403 for other operations
-            if (context.method === 'get') {
-              const error = new Error('Resource not found');
-              error.code = 'REST_API_RESOURCE';
-              throw error;
-            } else {
-              const error = new Error('Access denied - insufficient permissions');
-              error.code = 'REST_API_FORBIDDEN';
-              throw error;
-            }
+        if (recordTenant !== userTenant) {
+          log.error('Multihome permission violation', {
+            scopeName,
+            recordId: id,
+            recordTenant,
+            userTenant,
+            method: context.method
+          })
+
+          // Return 404 for GET to prevent information leakage
+          // Return 403 for other operations
+          if (context.method === 'get') {
+            const error = new Error('Resource not found')
+            error.code = 'REST_API_RESOURCE'
+            throw error
+          } else {
+            const error = new Error('Access denied - insufficient permissions')
+            error.code = 'REST_API_FORBIDDEN'
+            throw error
           }
         }
-      });
-
-      // Note: PUT, PATCH, and DELETE operations will fail naturally if the record
-      // doesn't exist due to tenant filtering in the GET operation that precedes them
-
-      // Add API method to get current multihome context  
-      api.multihome = {
-        getCurrentTenant: () => {
-          // This would need to be called within a request context
-          // Real implementation would need access to current request context
-          return null;
-        },
-
-        // Runtime configuration helper (for debugging/testing)
-        getConfig: () => ({
-          ...vars.multihome,
-          hasCustomExtractor: helpers.extractMultihomeId !== defaultSubdomainExtractor
-        })
-      };
-
-      log.info('MultiHome plugin installed', {
-        field: vars.multihome.field,
-        excludedResources: vars.multihome.excludeResources,
-        requireAuth: vars.multihome.requireAuth,
+      }
+    })
+
+    // Note: PUT, PATCH, and DELETE operations will fail naturally if the record
+    // doesn't exist due to tenant filtering in the GET operation that precedes them
+
+    // Add API method to get current multihome context
+    api.multihome = {
+      getCurrentTenant: () => {
+        // This would need to be called within a request context
+        // Real implementation would need access to current request context
+        return null
+      },
+
+      // Runtime configuration helper (for debugging/testing)
+      getConfig: () => ({
+        ...vars.multihome,
         hasCustomExtractor: helpers.extractMultihomeId !== defaultSubdomainExtractor
-      });
+      })
     }
-  };
+
+    log.info('MultiHome plugin installed', {
+      field: vars.multihome.field,
+      excludedResources: vars.multihome.excludeResources,
+      requireAuth: vars.multihome.requireAuth,
+      hasCustomExtractor: helpers.extractMultihomeId !== defaultSubdomainExtractor
+    })
+  }
+}

package/plugins/core/rest-api-plugin-hooks/compile-resource-schemas.js

@@ -1,7 +1,7 @@
-import { compileSchemas } from '../lib/querying-writing/compile-schemas.js';
+import { compileSchemas } from '../lib/querying-writing/compile-schemas.js'
 
-export default async function compileResourceSchemas({ context, scopes, runHooks }) {
-  const scope = scopes[context.scopeName];
+export default async function compileResourceSchemas ({ context, scopes, runHooks }) {
+  const scope = scopes[context.scopeName]
   // Pass scopeOptions and vars from context since scope object structure is different
-  return compileSchemas({ ...scope, scopeOptions: context.scopeOptions, vars: context.vars }, { context: { scopeName: context.scopeName }, runHooks });
-}
+  return compileSchemas({ ...scope, scopeOptions: context.scopeOptions, vars: context.vars }, { context: { scopeName: context.scopeName }, runHooks })
+}