json-rest-api 1.0.16 → 1.0.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "json-rest-api",
-  "version": "1.0.16",
+  "version": "1.0.17",
   "main": "index.js",
   "type": "module",
   "scripts": {

package/plugins/core/rest-api-access.js

@@ -24,6 +24,13 @@ export const AccessPlugin = {
 
     const ownershipField = () => config.ownership.field
 
+    // Minimal helper: treat ownerField false/null as ownership disabled (alias)
+    const isOwnershipDisabled = (scopeOptions = {}) => (
+      scopeOptions?.ownership === false ||
+      scopeOptions?.ownerField === false ||
+      scopeOptions?.ownerField === null
+    )
+
     const evaluateOwnership = ({ record, field, schemaInfo, userId }) => {
       if (!record) return 'unknown'
 
@@ -161,7 +168,7 @@ export const AccessPlugin = {
       if (!config.ownership.enabled) return
       const { fields, scopeName, scopeOptions = {} } = context
       if (config.ownership.excludeResources.includes(scopeName)) return
-      if (scopeOptions.ownership === false) return
+      if (isOwnershipDisabled(scopeOptions)) return
 
       const field = ownershipField()
       const relationshipName = fields[field]?.as || fields[field]?.belongsTo || field
@@ -196,7 +203,7 @@ export const AccessPlugin = {
         return
       }
 
-      if (scopeOptions?.ownership === false) return
+      if (isOwnershipDisabled(scopeOptions)) return
 
       const field = ownershipField()
       const scope = scopes[scopeName]
@@ -257,7 +264,7 @@ export const AccessPlugin = {
       }
 
       if (context.auth.roles?.includes?.('admin')) return
-      if (scopeOptions?.ownership === false) return
+      if (isOwnershipDisabled(scopeOptions)) return
 
       const field = ownershipField()
       const scope = scopes[scopeName]
@@ -342,7 +349,7 @@ export const AccessPlugin = {
       const auth = context.originalContext?.auth || context.auth
       if (!auth?.userId) return
       if (auth.roles?.includes?.('admin')) return
-      if (scopeOptions?.ownership === false) return
+      if (isOwnershipDisabled(scopeOptions)) return
 
       const field = ownershipField()
       const schemaInfo = scope?.vars?.schemaInfo || {}

package/tests/fixtures/api-configs.js

@@ -1872,3 +1872,77 @@ export async function createSearchSchemaMergeApi (knex, pluginOptions = {}) {
 
   return api
 }
+
+
+/**
+ * Creates an API with resources that OPT OUT of ownership
+ * - public_items_ownerfield: uses ownerField: false
+ * - public_items_ownership: uses ownership: false
+ * Both tables intentionally DO NOT have a user_id column.
+ */
+export async function createOwnershipOptOutApi (knex, pluginOptions = {}) {
+  const apiName = pluginOptions.apiName || 'ownership-optout-api'
+  const tablePrefix = pluginOptions.tablePrefix || 'ownopt'
+  if (storageMode.isAnyApi()) {
+    storageMode.clearRegistry()
+  }
+
+  const api = new Api({
+    name: apiName,
+    log: { level: process.env.LOG_LEVEL || 'info' }
+  })
+
+  const previousTenant = storageMode.currentTenant
+  const tenantId = storageMode.isAnyApi()
+    ? (pluginOptions.tenantId || `${tablePrefix}_tenant`)
+    : storageMode.defaultTenant
+  if (storageMode.isAnyApi()) {
+    storageMode.setCurrentTenant(tenantId)
+  }
+
+  await api.use(RestApiPlugin, {
+    simplifiedApi: false,
+    simplifiedTransport: false,
+    returnRecordApi: { post: true, put: false, patch: false },
+    returnRecordTransport: { post: 'full', put: 'no', patch: 'minimal' },
+    sortableFields: ['id', 'name']
+  })
+  await useStoragePlugin(api, knex, { tenantId })
+  await resetAnyApiTables(knex)
+
+  try {
+    // Access plugin (defaults: ownership enabled, filterByOwner true)
+    await api.use(AccessPlugin, pluginOptions.access || {})
+
+    // Resource A: disable via ownerField:false
+    await api.addResource('public_items_ownerfield', {
+      schema: {
+        id: { type: 'id' },
+        name: { type: 'string', required: true }
+      },
+      // Important: no user_id column in schema; ownerField disables ownership logic
+      ownerField: false,
+      tableName: `${tablePrefix}_public_items_of`
+    })
+    await api.resources.public_items_ownerfield.createKnexTable()
+    mapTable(`${tablePrefix}_public_items_of`, 'public_items_ownerfield')
+
+    // Resource B: disable via ownership:false
+    await api.addResource('public_items_ownership', {
+      schema: {
+        id: { type: 'id' },
+        name: { type: 'string', required: true }
+      },
+      ownership: false,
+      tableName: `${tablePrefix}_public_items_own`
+    })
+    await api.resources.public_items_ownership.createKnexTable()
+    mapTable(`${tablePrefix}_public_items_own`, 'public_items_ownership')
+
+    return api
+  } finally {
+    if (storageMode.isAnyApi()) {
+      storageMode.setCurrentTenant(previousTenant)
+    }
+  }
+}

package/tests/ownership-optout.test.js

@@ -0,0 +1,76 @@
+import { describe, it, before, after, beforeEach } from 'node:test'
+import assert from 'node:assert/strict'
+import knexLib from 'knex'
+import {
+  validateJsonApiStructure,
+  cleanTables,
+  createJsonApiDocument,
+  assertResourceAttributes
+} from './helpers/test-utils.js'
+import { createOwnershipOptOutApi } from './fixtures/api-configs.js'
+
+const knex = knexLib({
+  client: 'better-sqlite3',
+  connection: { filename: ':memory:' },
+  useNullAsDefault: true
+})
+
+let api
+
+async function createPublicItem (resourceName, name, authUserId) {
+  const doc = createJsonApiDocument(resourceName, { name })
+  const res = await api.resources[resourceName].post({
+    inputRecord: doc,
+    simplified: false
+  }, { auth: { userId: authUserId } })
+
+  validateJsonApiStructure(res)
+  assertResourceAttributes(res.data, { name })
+  return res.data
+}
+
+describe('Ownership opt-out (ownerField:false / ownership:false)', () => {
+  before(async () => {
+    api = await createOwnershipOptOutApi(knex)
+  })
+
+  after(async () => {
+    await knex.destroy()
+  })
+
+  beforeEach(async () => {
+    await cleanTables(knex, [
+      'ownopt_public_items_of',
+      'ownopt_public_items_own'
+    ])
+  })
+
+  it('ownerField:false - allows create+query without user_id column present', async () => {
+    await createPublicItem('public_items_ownerfield', 'Alpha', 1)
+    await createPublicItem('public_items_ownerfield', 'Beta', 2)
+
+    // Query with auth
+    const resultAuth = await api.resources.public_items_ownerfield.query({ simplified: false }, { auth: { userId: 1 } })
+    validateJsonApiStructure(resultAuth, true)
+    assert.equal(resultAuth.data.length, 2)
+
+    // Query without auth (ownership disabled -> no filtering)
+    const resultNoAuth = await api.resources.public_items_ownerfield.query({ simplified: false })
+    validateJsonApiStructure(resultNoAuth, true)
+    assert.equal(resultNoAuth.data.length, 2)
+  })
+
+  it('ownership:false - allows create+query without user_id column present', async () => {
+    await createPublicItem('public_items_ownership', 'Gamma', 1)
+    await createPublicItem('public_items_ownership', 'Delta', 2)
+
+    const resultAuth = await api.resources.public_items_ownership.query({ simplified: false }, { auth: { userId: 99 } })
+    validateJsonApiStructure(resultAuth, true)
+    assert.equal(resultAuth.data.length, 2)
+
+    const resultNoAuth = await api.resources.public_items_ownership.query({ simplified: false })
+    validateJsonApiStructure(resultNoAuth, true)
+    assert.equal(resultNoAuth.data.length, 2)
+  })
+})
+