json-rest-api 1.0.16 → 1.0.18

package/index.js

@@ -13,6 +13,7 @@ export { RestApiPlugin } from './plugins/core/rest-api-plugin.js'
 export { FileHandlingPlugin } from './plugins/core/file-handling-plugin.js'
 export { CorsPlugin } from './plugins/core/rest-api-cors-plugin.js'
 export { AccessPlugin } from './plugins/core/rest-api-access.js'
+export { LabelPlugin } from './plugins/core/rest-api-label-plugin.js'
 
 // Database plugins
 export { RestApiKnexPlugin } from './plugins/core/rest-api-knex-plugin.js'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "json-rest-api",
-  "version": "1.0.16",
+  "version": "1.0.18",
   "main": "index.js",
   "type": "module",
   "scripts": {

package/plugins/core/rest-api-access.js

@@ -24,6 +24,13 @@ export const AccessPlugin = {
 
     const ownershipField = () => config.ownership.field
 
+    // Minimal helper: treat ownerField false/null as ownership disabled (alias)
+    const isOwnershipDisabled = (scopeOptions = {}) => (
+      scopeOptions?.ownership === false ||
+      scopeOptions?.ownerField === false ||
+      scopeOptions?.ownerField === null
+    )
+
     const evaluateOwnership = ({ record, field, schemaInfo, userId }) => {
       if (!record) return 'unknown'
 
@@ -161,7 +168,7 @@ export const AccessPlugin = {
       if (!config.ownership.enabled) return
       const { fields, scopeName, scopeOptions = {} } = context
       if (config.ownership.excludeResources.includes(scopeName)) return
-      if (scopeOptions.ownership === false) return
+      if (isOwnershipDisabled(scopeOptions)) return
 
       const field = ownershipField()
       const relationshipName = fields[field]?.as || fields[field]?.belongsTo || field
@@ -196,7 +203,7 @@ export const AccessPlugin = {
         return
       }
 
-      if (scopeOptions?.ownership === false) return
+      if (isOwnershipDisabled(scopeOptions)) return
 
       const field = ownershipField()
       const scope = scopes[scopeName]
@@ -257,7 +264,7 @@ export const AccessPlugin = {
       }
 
       if (context.auth.roles?.includes?.('admin')) return
-      if (scopeOptions?.ownership === false) return
+      if (isOwnershipDisabled(scopeOptions)) return
 
       const field = ownershipField()
       const scope = scopes[scopeName]
@@ -342,7 +349,7 @@ export const AccessPlugin = {
       const auth = context.originalContext?.auth || context.auth
       if (!auth?.userId) return
       if (auth.roles?.includes?.('admin')) return
-      if (scopeOptions?.ownership === false) return
+      if (isOwnershipDisabled(scopeOptions)) return
 
       const field = ownershipField()
       const schemaInfo = scope?.vars?.schemaInfo || {}

package/plugins/core/rest-api-label-plugin.js

@@ -0,0 +1,74 @@
+export const LabelPlugin = {
+  name: 'rest-api-label',
+  dependencies: ['rest-api'],
+
+  /**
+   * Install the label plugin (adds a computed 'label' attribute to all resources)
+   * @param {object} deps Injected dependencies from json-rest-api
+   * @param {function} deps.addHook - Register hooks
+   * @param {object} deps.pluginOptions - Plugin options
+   */
+  async install ({ addHook, pluginOptions = {} }) {
+    const opts = {
+      preferNameFields: ['name', 'title'],
+      disable: false,
+      ...pluginOptions
+    }
+
+    function pickLabelFieldFromFields (fields, searchSchema) {
+      const byGlobal = Object.keys(searchSchema || {}).find(k => searchSchema[k]?.globalSearch)
+      if (byGlobal) return byGlobal
+      for (const key of opts.preferNameFields) {
+        if (fields?.[key]?.type === 'string') return key
+      }
+      const firstString = Object.entries(fields || {}).find(([_, def]) => def?.type === 'string')?.[0]
+      if (firstString) return firstString
+      return null
+    }
+
+    // Inject as a computed field AFTER schemas are compiled,
+    // so it lives in schemaInfo.computed and not in schemaStructure
+    addHook(
+      'scope:added',
+      'rest-api-label:inject-computed',
+      { afterFunction: 'compileResourceSchemas' },
+      ({ context, scopes }) => {
+        if (opts.disable) return
+        const { scopeName } = context
+        const scope = scopes?.[scopeName]
+        const schemaInfo = scope?.vars?.schemaInfo
+        if (!schemaInfo) return
+
+        // Respect explicit label already defined by resource
+        if (schemaInfo.computed?.label || schemaInfo.schemaStructure?.label) {
+          // If label accidentally made it into schemaStructure, remove it
+          if (schemaInfo.schemaStructure?.label) delete schemaInfo.schemaStructure.label
+          return
+        }
+
+        const structure = schemaInfo.schemaStructure || {}
+        const searchStruct = schemaInfo.searchSchemaStructure || {}
+        const idProp = schemaInfo.idProperty || 'id'
+
+        const pick = pickLabelFieldFromFields(structure, searchStruct)
+
+        schemaInfo.computed = schemaInfo.computed || {}
+        schemaInfo.computed.label = {
+          type: 'string',
+          computed: true,
+          ...(pick ? { dependencies: [pick] } : {}),
+          compute: ({ attributes }) => {
+            if (pick) {
+              const v = attributes?.[pick]
+              if (v != null) return String(v)
+            }
+            for (const k of opts.preferNameFields) {
+              if (attributes?.[k] != null) return String(attributes[k])
+            }
+            return String(attributes?.[idProp] ?? '')
+          }
+        }
+      }
+    )
+  }
+}

package/tests/fixtures/api-configs.js

@@ -1872,3 +1872,77 @@ export async function createSearchSchemaMergeApi (knex, pluginOptions = {}) {
 
   return api
 }
+
+
+/**
+ * Creates an API with resources that OPT OUT of ownership
+ * - public_items_ownerfield: uses ownerField: false
+ * - public_items_ownership: uses ownership: false
+ * Both tables intentionally DO NOT have a user_id column.
+ */
+export async function createOwnershipOptOutApi (knex, pluginOptions = {}) {
+  const apiName = pluginOptions.apiName || 'ownership-optout-api'
+  const tablePrefix = pluginOptions.tablePrefix || 'ownopt'
+  if (storageMode.isAnyApi()) {
+    storageMode.clearRegistry()
+  }
+
+  const api = new Api({
+    name: apiName,
+    log: { level: process.env.LOG_LEVEL || 'info' }
+  })
+
+  const previousTenant = storageMode.currentTenant
+  const tenantId = storageMode.isAnyApi()
+    ? (pluginOptions.tenantId || `${tablePrefix}_tenant`)
+    : storageMode.defaultTenant
+  if (storageMode.isAnyApi()) {
+    storageMode.setCurrentTenant(tenantId)
+  }
+
+  await api.use(RestApiPlugin, {
+    simplifiedApi: false,
+    simplifiedTransport: false,
+    returnRecordApi: { post: true, put: false, patch: false },
+    returnRecordTransport: { post: 'full', put: 'no', patch: 'minimal' },
+    sortableFields: ['id', 'name']
+  })
+  await useStoragePlugin(api, knex, { tenantId })
+  await resetAnyApiTables(knex)
+
+  try {
+    // Access plugin (defaults: ownership enabled, filterByOwner true)
+    await api.use(AccessPlugin, pluginOptions.access || {})
+
+    // Resource A: disable via ownerField:false
+    await api.addResource('public_items_ownerfield', {
+      schema: {
+        id: { type: 'id' },
+        name: { type: 'string', required: true }
+      },
+      // Important: no user_id column in schema; ownerField disables ownership logic
+      ownerField: false,
+      tableName: `${tablePrefix}_public_items_of`
+    })
+    await api.resources.public_items_ownerfield.createKnexTable()
+    mapTable(`${tablePrefix}_public_items_of`, 'public_items_ownerfield')
+
+    // Resource B: disable via ownership:false
+    await api.addResource('public_items_ownership', {
+      schema: {
+        id: { type: 'id' },
+        name: { type: 'string', required: true }
+      },
+      ownership: false,
+      tableName: `${tablePrefix}_public_items_own`
+    })
+    await api.resources.public_items_ownership.createKnexTable()
+    mapTable(`${tablePrefix}_public_items_own`, 'public_items_ownership')
+
+    return api
+  } finally {
+    if (storageMode.isAnyApi()) {
+      storageMode.setCurrentTenant(previousTenant)
+    }
+  }
+}

package/tests/ownership-optout.test.js

@@ -0,0 +1,76 @@
+import { describe, it, before, after, beforeEach } from 'node:test'
+import assert from 'node:assert/strict'
+import knexLib from 'knex'
+import {
+  validateJsonApiStructure,
+  cleanTables,
+  createJsonApiDocument,
+  assertResourceAttributes
+} from './helpers/test-utils.js'
+import { createOwnershipOptOutApi } from './fixtures/api-configs.js'
+
+const knex = knexLib({
+  client: 'better-sqlite3',
+  connection: { filename: ':memory:' },
+  useNullAsDefault: true
+})
+
+let api
+
+async function createPublicItem (resourceName, name, authUserId) {
+  const doc = createJsonApiDocument(resourceName, { name })
+  const res = await api.resources[resourceName].post({
+    inputRecord: doc,
+    simplified: false
+  }, { auth: { userId: authUserId } })
+
+  validateJsonApiStructure(res)
+  assertResourceAttributes(res.data, { name })
+  return res.data
+}
+
+describe('Ownership opt-out (ownerField:false / ownership:false)', () => {
+  before(async () => {
+    api = await createOwnershipOptOutApi(knex)
+  })
+
+  after(async () => {
+    await knex.destroy()
+  })
+
+  beforeEach(async () => {
+    await cleanTables(knex, [
+      'ownopt_public_items_of',
+      'ownopt_public_items_own'
+    ])
+  })
+
+  it('ownerField:false - allows create+query without user_id column present', async () => {
+    await createPublicItem('public_items_ownerfield', 'Alpha', 1)
+    await createPublicItem('public_items_ownerfield', 'Beta', 2)
+
+    // Query with auth
+    const resultAuth = await api.resources.public_items_ownerfield.query({ simplified: false }, { auth: { userId: 1 } })
+    validateJsonApiStructure(resultAuth, true)
+    assert.equal(resultAuth.data.length, 2)
+
+    // Query without auth (ownership disabled -> no filtering)
+    const resultNoAuth = await api.resources.public_items_ownerfield.query({ simplified: false })
+    validateJsonApiStructure(resultNoAuth, true)
+    assert.equal(resultNoAuth.data.length, 2)
+  })
+
+  it('ownership:false - allows create+query without user_id column present', async () => {
+    await createPublicItem('public_items_ownership', 'Gamma', 1)
+    await createPublicItem('public_items_ownership', 'Delta', 2)
+
+    const resultAuth = await api.resources.public_items_ownership.query({ simplified: false }, { auth: { userId: 99 } })
+    validateJsonApiStructure(resultAuth, true)
+    assert.equal(resultAuth.data.length, 2)
+
+    const resultNoAuth = await api.resources.public_items_ownership.query({ simplified: false })
+    validateJsonApiStructure(resultNoAuth, true)
+    assert.equal(resultNoAuth.data.length, 2)
+  })
+})
+