json-rest-api 1.0.20 → 1.0.22

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-methods__put.js.txt

@@ -0,0 +1,253 @@
+     1	import { RestApiResourceError } from '../../../lib/rest-api-errors.js'
+     2	import { validatePutPayload } from '../lib/querying-writing/payload-validators.js'
+     3	import { processRelationships } from '../lib/writing/relationship-processor.js'
+     4	import { updateManyToManyRelationship, createPivotRecords } from '../lib/writing/many-to-many-manipulations.js'
+     5	import { ERROR_SUBTYPES } from '../lib/querying-writing/knex-constants.js'
+     6	import {
+     7	  setupCommonRequest,
+     8	  validateResourceAttributesBeforeWrite,
+     9	  validateRelationshipAccess,
+    10	  applyFieldSetters,
+    11	  validatePivotResource,
+    12	  handleRecordReturnAfterWrite,
+    13	  handleWriteMethodError
+    14	} from './common.js'
+    15	
+    16	/**
+    17	 * PUT
+    18	 * Updates an existing top-level resource by completely replacing it.
+    19	 * This method supports updating both attributes and relationships (1:1 and n:n).
+    20	 * PUT is a complete replacement - any relationships not provided will be removed/nulled.
+    21	 * This method does NOT support creating new related resources via an `included` array.
+    22	 */
+    23	export default async function putMethod ({
+    24	  params,
+    25	  context,
+    26	  vars,
+    27	  helpers,
+    28	  scope,
+    29	  scopes,
+    30	  runHooks,
+    31	  apiOptions,
+    32	  pluginOptions,
+    33	  scopeOptions,
+    34	  scopeName,
+    35	  api,
+    36	  log
+    37	}) {
+    38	  context.method = 'put'
+    39	
+    40	  try {
+    41	    const { schema, schemaStructure, schemaRelationships } = await setupCommonRequest({
+    42	      params,
+    43	      context,
+    44	      vars,
+    45	      scopes,
+    46	      scopeOptions,
+    47	      scopeName,
+    48	      api,
+    49	      helpers
+    50	    })
+    51	    context.id = context.inputRecord.data.id
+    52	
+    53	    // Run early hooks for pre-processing (e.g., file handling)
+    54	    await runHooks('beforeProcessing')
+    55	    await runHooks('beforeProcessingPut')
+    56	
+    57	    // Validate PUT payload to ensure it's a complete resource replacement operation.
+    58	    // PUT requires the full resource representation including ID (unlike POST which generates ID).
+    59	    // It validates that data.id matches the URL parameter, prevents 'included' array (which is
+    60	    // read-only), and ensures the payload represents a complete replacement. Any fields not
+    61	    // provided will be removed or reset to defaults - this is the key difference from PATCH.
+    62	    // Example: PUT to /articles/123 must have data.id: '123' and all required fields.
+    63	    validatePutPayload(context.inputRecord, scopes)
+    64	
+    65	    // Validate that user has read access to all related resources
+    66	    // This ensures users can only create relationships to resources they can access
+    67	    await validateRelationshipAccess(context, context.inputRecord, helpers, runHooks, api)
+    68	
+    69	    // Extract foreign keys from JSON:API relationships and prepare many-to-many operations
+    70	    // Example: relationships.author -> author_id: '123' for storage
+    71	    // Example: relationships.tags -> array of pivot records to create later
+    72	    const { belongsToUpdates, manyToManyRelationships } = processRelationships(
+    73	      scope,
+    74	      { context }
+    75	    )
+    76	
+    77	    await validateResourceAttributesBeforeWrite({
+    78	      context,
+    79	      schema,
+    80	      belongsToUpdates,
+    81	      runHooks
+    82	    })
+    83	
+    84	    // Check existence first
+    85	    context.exists = await helpers.dataExists({
+    86	      scopeName,
+    87	      context
+    88	    })
+    89	
+    90	    context.isCreate = !context.exists
+    91	    context.isUpdate = context.exists
+    92	
+    93	    // Fetch minimal record for authorization checks (only for updates)
+    94	    if (context.isUpdate) {
+    95	      const minimalRecord = await helpers.dataGetMinimal({
+    96	        scopeName,
+    97	        context,
+    98	        runHooks
+    99	      })
+   100	
+   101	      if (!minimalRecord) {
+   102	        throw new RestApiResourceError(
+   103	          `Resource not found: ${scopeName}/${context.id}`,
+   104	          ERROR_SUBTYPES.NOT_FOUND
+   105	        )
+   106	      }
+   107	
+   108	      context.minimalRecord = minimalRecord
+   109	    }
+   110	
+   111	    // For PUT, we also need to handle relationships that are NOT provided
+   112	    // (they should be set to null/empty as PUT is a complete replacement)
+   113	    const allRelationships = {}
+   114	
+   115	    // Collect all defined relationships for this resource
+   116	    for (const [relName, relDef] of Object.entries(schemaRelationships || {})) {
+   117	      if (relDef.type === 'manyToMany') {
+   118	        allRelationships[relName] = {
+   119	          type: 'manyToMany',
+   120	          relDef: {
+   121	            through: relDef.through,
+   122	            foreignKey: relDef.foreignKey,
+   123	            otherKey: relDef.otherKey
+   124	          }
+   125	        }
+   126	      }
+   127	    }
+   128	
+   129	    // Also check schema fields for belongsTo relationships
+   130	    for (const [fieldName, fieldDef] of Object.entries(schemaStructure)) {
+   131	      if (fieldDef.as && fieldDef.belongsTo) {
+   132	        allRelationships[fieldDef.as] = {
+   133	          type: 'belongsTo',
+   134	          fieldName,
+   135	          fieldDef
+   136	        }
+   137	      }
+   138	    }
+   139	
+   140	    // Process missing relationships (PUT should null them out only if relationships object exists)
+   141	    const hasRelationshipsObject = context.inputRecord.data.relationships !== undefined
+   142	    const providedRelationships = new Set(Object.keys(context.inputRecord.data.relationships || {}))
+   143	
+   144	    // Only null out missing relationships if a relationships object was provided
+   145	    if (hasRelationshipsObject) {
+   146	      for (const [relName, relInfo] of Object.entries(allRelationships)) {
+   147	        if (!providedRelationships.has(relName)) {
+   148	          if (relInfo.type === 'belongsTo') {
+   149	            belongsToUpdates[relInfo.fieldName] = null
+   150	          } else if (relInfo.type === 'manyToMany') {
+   151	            // Add to manyToManyRelationships with empty array
+   152	            manyToManyRelationships.push({
+   153	              relName,
+   154	              relDef: relInfo.relDef,
+   155	              relData: []  // Empty array means delete all
+   156	            })
+   157	          }
+   158	        }
+   159	      }
+   160	    }
+   161	
+   162	    // Merge belongsTo updates with attributes
+   163	    if (Object.keys(belongsToUpdates).length > 0) {
+   164	      context.inputRecord.data.attributes = {
+   165	        ...context.inputRecord.data.attributes,
+   166	        ...belongsToUpdates
+   167	      }
+   168	    }
+   169	
+   170	    // Centralised checkPermissions function
+   171	    await scope.checkPermissions({
+   172	      method: 'put',
+   173	      originalContext: context,
+   174	    })
+   175	
+   176	    await runHooks('beforeDataCall')
+   177	    await runHooks('beforeDataCallPut')
+   178	
+   179	    // Apply field setters after validation and before storage
+   180	    if (context.inputRecord?.data?.attributes) {
+   181	      context.inputRecord.data.attributes = await applyFieldSetters(
+   182	        context.inputRecord.data.attributes,
+   183	        context.schemaInfo,
+   184	        context,
+   185	        api,
+   186	        helpers
+   187	      )
+   188	    }
+   189	
+   190	    // Pass the operation type to the helper
+   191	    await helpers.dataPut({
+   192	      scopeName,
+   193	      context
+   194	    })
+   195	    await runHooks('afterDataCallPut')
+   196	    await runHooks('afterDataCall')
+   197	
+   198	    // Process many-to-many relationships after main record update/creation
+   199	    for (const { relName, relDef, relData } of manyToManyRelationships) {
+   200	      if (relDef?.through && api.anyapi?.links?.syncMany) {
+   201	        await api.anyapi.links.syncMany({
+   202	          context,
+   203	          scopeName,
+   204	          relName,
+   205	          relDef,
+   206	          relData,
+   207	          isUpdate: context.isUpdate,
+   208	        })
+   209	        continue
+   210	      }
+   211	
+   212	      await validatePivotResource(scopes, relDef, relName)
+   213	
+   214	      if (context.isUpdate) {
+   215	        await updateManyToManyRelationship(null, {
+   216	          api,
+   217	          context: {
+   218	            resourceId: context.id,
+   219	            relDef,
+   220	            relData,
+   221	            transaction: context.transaction
+   222	          }
+   223	        })
+   224	      } else if (relData.length > 0) {
+   225	        await createPivotRecords(api, context.id, relDef, relData, context.transaction)
+   226	      }
+   227	    }
+   228	
+   229	    const ret = await handleRecordReturnAfterWrite({
+   230	      context,
+   231	      scopeName,
+   232	      api,
+   233	      scopes,
+   234	      schemaStructure,
+   235	      schemaRelationships,
+   236	      scopeOptions,
+   237	      vars,
+   238	      runHooks,
+   239	      helpers,
+   240	      log
+   241	    })
+   242	
+   243	    // Commit transaction if we created it
+   244	    if (context.shouldCommit) {
+   245	      await context.transaction.commit()
+   246	      await runHooks('afterCommit')
+   247	    }
+   248	
+   249	    return ret
+   250	  } catch (error) {
+   251	    await handleWriteMethodError(error, context, 'PUT', scopeName, log, runHooks)
+   252	  }
+   253	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-methods__query.js.txt

@@ -0,0 +1,207 @@
+     1	import { RestApiValidationError } from '../../../lib/rest-api-errors.js'
+     2	import { validateQueryPayload } from '../lib/querying-writing/payload-validators.js'
+     3	import { normalizeRecordAttributes } from '../lib/querying-writing/database-value-normalizers.js'
+     4	import { getRequestedComputedFields } from '../lib/querying-writing/knex-field-helpers.js'
+     5	import { transformJsonApiToSimplified } from '../lib/querying-writing/simplified-helpers.js'
+     6	import { cascadeConfig } from './common.js'
+     7	
+     8	/**
+     9	 * QUERY
+    10	 * Retrieves a collection of resources (e.g., a list of articles) based on provided criteria.
+    11	 * This function sends a GET request to /api/{resourceType}.
+    12	 *
+    13	 * @param {string} resourceType - The type of resource collection to fetch (e.g., "articles").
+    14	 * @param {object} [queryParams={}] - Optional. An object to customize the query for the collection.
+    15	 * @param {string[]} [queryParams.include=[]] - An optional array of relationship paths to sideload for each resource in the collection. These paths will be converted to a comma-separated string for the URL (e.g., `['author', 'comments.user']` becomes `author,comments.user`). Supports deep relationships (e.g., "publisher.country").
+    16	 * @param {object} [queryParams.fields] - An object to request only specific fields (sparse fieldsets) for each resource in the collection and its included relationships. Keys are resource types, values are comma-separated field names.
+    17	 * @param {object} [queryParams.filters] - An object to filter the collection. Keys are filter parameters (specific to your API's implementation, e.g., 'status', 'title'), values are the filter criteria.
+    18	 * @param {string[]} [queryParams.sort=[]] - An optional array of fields to sort the collection by. Each string represents a field; prefix with '-' for descending order (e.g., `['title', '-published-date']` becomes `title,-published-date`).
+    19	 * @param {object} [queryParams.page] - An object for pagination. Typically includes `number` (page number) and `size` (items per page). E.g., `{ number: 1, size: 10 }`.
+    20	 * @returns {Promise<object>} A Promise that resolves to the JSON:API response document containing the resource collection.
+    21	 */
+    22	export default async function queryMethod ({
+    23	  params,
+    24	  context,
+    25	  vars,
+    26	  helpers,
+    27	  scope,
+    28	  scopes,
+    29	  runHooks,
+    30	  apiOptions,
+    31	  pluginOptions,
+    32	  scopeOptions,
+    33	  scopeName,
+    34	  log,
+    35	  api
+    36	}) {
+    37	  context.method = 'query'
+    38	
+    39	  // Determine which simplified setting to use based on transport
+    40	  const isTransport = params.isTransport === true
+    41	
+    42	  // Use vars which automatically cascade from scope to global
+    43	  const defaultSimplified = isTransport ? vars.simplifiedTransport : vars.simplifiedApi
+    44	
+    45	  // Get simplified setting - from params only (per-call override) or use default
+    46	  context.simplified = params.simplified !== undefined ? params.simplified : defaultSimplified
+    47	
+    48	  // Assign common context properties
+    49	  context.schemaInfo = scopes[scopeName].vars.schemaInfo // This is the object variable created by compileSchemas
+    50	  context.queryParams = params.queryParams || {}
+    51	
+    52	  // These only make sense as parameter per query
+    53	  context.queryParams.fields = cascadeConfig('fields', [params.queryParams], {})
+    54	  context.queryParams.include = cascadeConfig('include', [params.queryParams], [])
+    55	  context.queryParams.sort = cascadeConfig('sort', [params.queryParams], [])
+    56	  context.queryParams.page = cascadeConfig('page', [params.queryParams], {})
+    57	
+    58	  context.transaction = params.transaction
+    59	  context.db = context.transaction || api.knex.instance
+    60	
+    61	  context.scopeName = scopeName
+    62	
+    63	  // These are just shortcuts used in this function and will be returned
+    64	  const searchSchema = context.schemaInfo.searchSchemaInstance
+    65	  const schemaStructure = context.schemaInfo.schemaInstance.structure
+    66	  const schemaRelationships = context.schemaInfo.schemaRelationships
+    67	
+    68	  // Sortable fields and sort (mab)
+    69	  context.sortableFields = vars.sortableFields
+    70	  // Apply default sort if no sort specified
+    71	  if (context.queryParams.sort.length === 0 && vars.defaultSort) {
+    72	    context.queryParams.sort = Array.isArray(vars.defaultSort) ? vars.defaultSort : [vars.defaultSort]
+    73	  }
+    74	
+    75	  // Validate query parameters to ensure they follow JSON:API specification and security rules.
+    76	  // This checks that filters are valid field names, sort fields exist in sortableFields array
+    77	  // (preventing SQL injection), pagination uses valid page[size]/page[number] format, and include
+    78	  // paths reference real relationships. Example: sort: ['-createdAt', 'title'] is checked against
+    79	  // sortableFields to ensure users can't sort by sensitive fields like 'password_hash'.
+    80	  validateQueryPayload({ queryParams: context.queryParams }, context.sortableFields, vars.includeDepthLimit)
+    81	
+    82	  // Validate search/filter parameters against searchSchema
+    83	  if (context.queryParams.filters && Object.keys(context.queryParams.filters).length > 0) {
+    84	    // Only allow filtering if searchSchema is defined
+    85	    if (!searchSchema) {
+    86	      throw new RestApiValidationError(
+    87	        `Filtering is not enabled for resource '${scopeName}'. To enable filtering, add 'search: true' to schema fields or define a searchSchema.`,
+    88	        {
+    89	          fields: Object.keys(context.queryParams.filters).map(field => `filters.${field}`),
+    90	          violations: [{
+    91	            field: 'filters',
+    92	            rule: 'filtering_not_enabled',
+    93	            message: 'Resource does not have searchable fields defined'
+    94	          }]
+    95	        }
+    96	      )
+    97	    }
+    98	
+    99	    // Validate the filter parameters searchSchema
+   100	    const { validatedObject, errors } = await searchSchema.validate(context.queryParams.filters, {
+   101	      onlyObjectValues: true // Partial validation for filters
+   102	    })
+   103	
+   104	    // If there are validation errors, throw an error
+   105	    if (Object.keys(errors).length > 0) {
+   106	      const violations = Object.entries(errors).map(([field, error]) => ({
+   107	        field: `filters.${field}`,
+   108	        rule: error.code || 'invalid_value',
+   109	        message: error.message
+   110	      }))
+   111	
+   112	      throw new RestApiValidationError(
+   113	        'Invalid filter parameters',
+   114	        {
+   115	          fields: Object.keys(errors).map(field => `filters.${field}`),
+   116	          violations
+   117	        }
+   118	      )
+   119	    }
+   120	
+   121	    // Replace filter with validated/transformed values
+   122	    context.queryParams.filters = validatedObject
+   123	  }
+   124	
+   125	  // Centralised checkPermissions function
+   126	  await scope.checkPermissions({
+   127	    method: 'query',
+   128	    originalContext: context,
+   129	  })
+   130	
+   131	  await runHooks('beforeData')
+   132	  await runHooks('beforeDataQuery')
+   133	  context.record = await helpers.dataQuery({
+   134	    scopeName,
+   135	    context,
+   136	    runHooks
+   137	  })
+   138	
+   139	  // Normalize database values (e.g., convert 1/0 to true/false for booleans)
+   140	  context.record = normalizeRecordAttributes(context.record, scopes)
+   141	
+   142	  // Make a backup
+   143	  try {
+   144	    context.originalRecord = structuredClone(context.record)
+   145	  } catch (e) {
+   146	    log.error('Failed to clone record:', {
+   147	      error: e.message,
+   148	      recordKeys: Object.keys(context.record || {}),
+   149	      hasHttpRequest: !!context.raw?.req
+   150	    })
+   151	    throw e
+   152	  }
+   153	
+   154	  // This will enhance record, which is the WHOLE JSON:API record
+   155	  await runHooks('enrichRecord')
+   156	
+   157	  // Get computed field information for main resource
+   158	  const computedFields = scope.vars.schemaInfo?.computed || {}
+   159	  const requestedFields = context.queryParams.fields?.[scopeName]
+   160	  const requestedComputedFields = getRequestedComputedFields(scopeName, requestedFields, computedFields)
+   161	
+   162	  // Run enrichAttributes for every single set of attribute, calling it from the right scope
+   163	  for (const entry of context.record.data) {
+   164	    entry.attributes = await scope.enrichAttributes({
+   165	      attributes: entry.attributes,
+   166	      parentContext: context,
+   167	      requestedComputedFields,
+   168	      isMainResource: true,
+   169	      computedDependencies: context.computedDependencies
+   170	    })
+   171	  }
+   172	  for (const entry of (context.record.included || [])) {
+   173	    const entryScope = scopes[entry.type]
+   174	    const entryComputed = entryScope.vars.schemaInfo?.computed || {}
+   175	    const entryRequestedFields = context.queryParams.fields?.[entry.type]
+   176	    const entryRequestedComputed = getRequestedComputedFields(
+   177	      entry.type,
+   178	      entryRequestedFields,
+   179	      entryComputed
+   180	    )
+   181	
+   182	    entry.attributes = await entryScope.enrichAttributes({
+   183	      attributes: entry.attributes,
+   184	      parentContext: context,
+   185	      requestedComputedFields: entryRequestedComputed,
+   186	      isMainResource: false,
+   187	      computedDependencies: entry.__$jsonrestapi_computed_deps$__
+   188	    })
+   189	  }
+   190	
+   191	  // The called hooks should NOT change context.record
+   192	  await runHooks('finish')
+   193	  await runHooks('finishQuery')
+   194	
+   195	  // Transform output if in simplified mode
+   196	  if (context.simplified) {
+   197	    // Convert JSON:API response back to simplified format
+   198	    // Example: {data: {type: 'posts', id: '1', attributes: {title: 'My Post'}, relationships: {author: {data: {type: 'users', id: '123'}}}}}
+   199	    // becomes: {id: '1', title: 'My Post', author_id: '123'} - flattens structure and restores foreign keys
+   200	    return transformJsonApiToSimplified(
+   201	      { record: context.record },
+   202	      { context: { schemaStructure, schemaRelationships, scopes } }
+   203	    )
+   204	  }
+   205	
+   206	  return context.record
+   207	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-methods__release.js.txt

@@ -0,0 +1,12 @@
+     1	import { ValidationError } from 'hooked-api'
+     2	
+     3	/**
+     4	 * release
+     5	 * Runs the hook that tells plugins to release resources
+     6	 */
+     7	export default async ({ runHooks }) => {
+     8	  // Run the addRoute hook to notify transport plugins
+     9	  await runHooks('release')
+    10	
+    11	  return { }
+    12	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin.js.txt

@@ -0,0 +1,165 @@
+     1	import { validateRelationships } from './lib/querying-writing/scope-validations.js'
+     2	
+     3	// Import hook functions
+     4	import compileResourceSchemas from './rest-api-plugin-hooks/compile-resource-schemas.js'
+     5	import validateIncludeConfigurations from './rest-api-plugin-hooks/validate-include-configurations.js'
+     6	import turnScopeInitIntoVars from './rest-api-plugin-hooks/turn-scope-init-into-vars.js'
+     7	import registerScopeRoutes from './rest-api-plugin-hooks/register-scope-routes.js'
+     8	import registerRelationshipRoutes from './rest-api-plugin-hooks/register-relationship-routes.js'
+     9	
+    10	// Import method functions
+    11	import queryMethod from './rest-api-plugin-methods/query.js'
+    12	import getMethod from './rest-api-plugin-methods/get.js'
+    13	import postMethod from './rest-api-plugin-methods/post.js'
+    14	import putMethod from './rest-api-plugin-methods/put.js'
+    15	import patchMethod from './rest-api-plugin-methods/patch.js'
+    16	import deleteMethod from './rest-api-plugin-methods/delete.js'
+    17	import enrichAttributesMethod from './rest-api-plugin-methods/enrich-attributes.js'
+    18	import checkPermissionsMethod from './rest-api-plugin-methods/check-permissions.js'
+    19	import addRouteMethod from './rest-api-plugin-methods/add-route.js'
+    20	import releaseMethod from './rest-api-plugin-methods/release.js'
+    21	import { defaultDataHelpers } from './lib/querying-writing/default-data-helpers.js'
+    22	import { DEFAULT_QUERY_LIMIT, DEFAULT_MAX_QUERY_LIMIT, DEFAULT_INCLUDE_DEPTH_LIMIT } from './lib/querying-writing/knex-constants.js'
+    23	
+    24	import getRelatedMethod from './rest-api-plugin-methods/get-related.js'
+    25	import postRelationshipMethod from './rest-api-plugin-methods/post-relationship.js'
+    26	import getRelationshipMethod from './rest-api-plugin-methods/get-relationship.js'
+    27	import patchRelationshipMethod from './rest-api-plugin-methods/patch-relationship.js'
+    28	import deleteRelationshipMethod from './rest-api-plugin-methods/delete-relationship.js'
+    29	
+    30	export const RestApiPlugin = {
+    31	  name: 'rest-api',
+    32	
+    33	  install ({ helpers, addScopeMethod, addApiMethod, vars, addHook, runHooks, apiOptions, pluginOptions, api, setScopeAlias, scopes, log, on }) {
+    34	    // **************
+    35	    // Initial setup
+    36	    // **************
+    37	
+    38	    // Initialize the rest namespace for REST API functionality
+    39	    api.rest = {}
+    40	
+    41	    // Set up REST-friendly aliases
+    42	    setScopeAlias('resources', 'addResource')
+    43	
+    44	    // **********
+    45	    // Variables
+    46	    // **********
+    47	
+    48	    // Initialize default vars for the plugin from pluginOptions
+    49	    const restApiOptions = pluginOptions || {}
+    50	
+    51	    // These will be used as default fallbacks by the vars proxy if
+    52	    // they are not set in the scope options
+    53	    vars.queryDefaultLimit = restApiOptions.queryDefaultLimit || DEFAULT_QUERY_LIMIT
+    54	    vars.queryMaxLimit = restApiOptions.queryMaxLimit || DEFAULT_MAX_QUERY_LIMIT
+    55	    vars.includeDepthLimit = restApiOptions.includeDepthLimit || DEFAULT_INCLUDE_DEPTH_LIMIT
+    56	    vars.enablePaginationCounts = restApiOptions.enablePaginationCounts || true
+    57	
+    58	    // New simplified settings
+    59	    vars.simplifiedTransport = restApiOptions.simplifiedTransport !== undefined
+    60	      ? restApiOptions.simplifiedTransport
+    61	      : false // Default false for JSON:API compliance over the wire
+    62	
+    63	    vars.simplifiedApi = restApiOptions.simplifiedApi !== undefined
+    64	      ? restApiOptions.simplifiedApi
+    65	      : true // Default true for better DX in programmatic API
+    66	
+    67	    vars.idProperty = restApiOptions.idProperty || 'id'
+    68	
+    69	    // Return full record configuration for API and Transport
+    70	    // Support values: 'no', 'minimal', 'full'
+    71	    const normalizeReturnValue = (value, defaultValue) => {
+    72	      if (['no', 'minimal', 'full'].includes(value)) return value
+    73	      return defaultValue
+    74	    }
+    75	
+    76	    const optionConfigs = [
+    77	      {
+    78	        propName: 'returnRecordApi',
+    79	        defaultValue: 'full',
+    80	      },
+    81	      {
+    82	        propName: 'returnRecordTransport',
+    83	        defaultValue: 'no',
+    84	      },
+    85	    ]
+    86	
+    87	    for (const config of optionConfigs) {
+    88	      const optionValue = restApiOptions[config.propName]
+    89	      let processedValue
+    90	
+    91	      if (typeof optionValue === 'object' && optionValue !== null) {
+    92	        processedValue = {
+    93	          post: normalizeReturnValue(optionValue.post, config.defaultValue),
+    94	          put: normalizeReturnValue(optionValue.put, config.defaultValue),
+    95	          patch: normalizeReturnValue(optionValue.patch, config.defaultValue),
+    96	        }
+    97	      } else if (optionValue !== undefined) {
+    98	        const normalized = normalizeReturnValue(optionValue, config.defaultValue)
+    99	        processedValue = { post: normalized, put: normalized, patch: normalized }
+   100	      } else {
+   101	        processedValue = { post: config.defaultValue, put: config.defaultValue, patch: config.defaultValue }
+   102	      }
+   103	      vars[config.propName] = processedValue
+   104	    }
+   105	
+   106	    log.debug('returnRecordApi configuration:', vars.returnRecordApi)
+   107	    log.debug('returnRecordTransport configuration:', vars.returnRecordTransport)
+   108	
+   109	    // Schema cache vars
+   110	    vars.schemaProcessed = false
+   111	    vars.schema = null
+   112	
+   113	    // ******************************
+   114	    // Scope (resources) added hooks
+   115	    // ******************************
+   116	
+   117	    addHook('scope:added', 'validateRelationships', {}, validateRelationships)
+   118	    addHook('scope:added', 'compileResourceSchemas', {}, compileResourceSchemas)
+   119	    addHook('scope:added', 'validateIncludeConfigurations', {}, validateIncludeConfigurations)
+   120	    addHook('scope:added', 'turnScopeInitIntoVars', {}, turnScopeInitIntoVars)
+   121	
+   122	    // *********
+   123	    // Methods
+   124	    // *********
+   125	
+   126	    addApiMethod('addRoute', addRouteMethod)
+   127	
+   128	    addApiMethod('release', releaseMethod)
+   129	
+   130	    // Main REST methods
+   131	    addScopeMethod('query', queryMethod)
+   132	    addScopeMethod('get', getMethod)
+   133	    addScopeMethod('post', postMethod)
+   134	    addScopeMethod('put', putMethod)
+   135	    addScopeMethod('patch', patchMethod)
+   136	    addScopeMethod('delete', deleteMethod)
+   137	
+   138	    // Relationship methods
+   139	    addScopeMethod('getRelationship', getRelationshipMethod)
+   140	    addScopeMethod('getRelated', getRelatedMethod)
+   141	    addScopeMethod('postRelationship', postRelationshipMethod)
+   142	    addScopeMethod('patchRelationship', patchRelationshipMethod)
+   143	    addScopeMethod('deleteRelationship', deleteRelationshipMethod)
+   144	
+   145	    addHook('scope:added', 'registerRelationshipRoutes', {}, registerRelationshipRoutes)
+   146	    addHook('scope:added', 'registerScopeRoutes', {}, registerScopeRoutes)
+   147	
+   148	    // Non-URL methods
+   149	    addScopeMethod('enrichAttributes', enrichAttributesMethod)
+   150	    addScopeMethod('checkPermissions', checkPermissionsMethod)
+   151	
+   152	    // *********
+   153	    // Helpers
+   154	    // *********
+   155	
+   156	    // Initialize default data helpers that throw errors until a storage plugin is installed
+   157	    // These placeholders show storage plugin developers what methods to implement
+   158	    // Example: helpers.dataGet, helpers.dataPost, etc. will throw "No storage implementation" errors
+   159	    Object.assign(helpers, defaultDataHelpers)
+   160	
+   161	    // Add default getLocation helper for generating resource URLs
+   162	    // This can be overridden by storage plugins if needed
+   163	    helpers.getLocation = ({ scopeName, id }) => `/${scopeName}/${id}`
+   164	  }
+   165	}