json-rest-api 1.0.21 → 1.0.22

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-methods__delete-relationship.js.txt

@@ -0,0 +1,117 @@
+     1	import { RestApiResourceError, RestApiValidationError, RestApiPayloadError } from '../../../lib/rest-api-errors.js'
+     2	import { findRelationshipDefinition, handleWriteMethodError } from './common.js'
+     3	
+     4	/**
+     5	 * DELETE RELATIONSHIP
+     6	 * Removes specific members from a to-many relationship
+     7	 * DELETE /api/articles/1/relationships/tags
+     8	 *
+     9	 * @param {string} id - The ID of the resource
+    10	 * @param {string} relationshipName - The name of the relationship
+    11	 * @param {array} relationshipData - Array of resource identifiers to remove
+    12	 * @returns {Promise<void>} 204 No Content
+    13	 */
+    14	export default async function deleteRelationshipMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeName, api, log }) {
+    15	  context.method = 'deleteRelationship'
+    16	  context.id = params.id
+    17	  context.relationshipName = params.relationshipName
+    18	  context.schemaInfo = scopes[scopeName].vars.schemaInfo
+    19	
+    20	  // Transaction handling
+    21	  context.transaction = params.transaction ||
+    22	    (helpers.newTransaction && !params.transaction ? await helpers.newTransaction() : null)
+    23	  context.shouldCommit = !params.transaction && !!context.transaction
+    24	  context.db = context.transaction || api.knex.instance
+    25	
+    26	  try {
+    27	    // Validate
+    28	    const relDef = findRelationshipDefinition(context.schemaInfo, context.relationshipName)
+    29	    if (!relDef) {
+    30	      throw new RestApiResourceError(
+    31	        `Relationship '${context.relationshipName}' not found on resource '${scopeName}'`,
+    32	        { subtype: 'relationship_not_found' }
+    33	      )
+    34	    }
+    35	
+    36	    if (relDef.type !== 'hasMany' && relDef.type !== 'manyToMany') {
+    37	      throw new RestApiValidationError(
+    38	        `Cannot DELETE from to-one relationship '${context.relationshipName}'`,
+    39	        { fields: ['data'] }
+    40	      )
+    41	    }
+    42	
+    43	    if (!Array.isArray(params.relationshipData)) {
+    44	      throw new RestApiPayloadError('DELETE from relationship requires array of resource identifiers')
+    45	    }
+    46	
+    47	    // Check permissions
+    48	    await runHooks('checkPermissions')
+    49	    await runHooks('checkPermissionsDeleteRelationship')
+    50	
+    51	    // Verify parent exists
+    52	    const exists = await helpers.dataExists({
+    53	      scopeName,
+    54	      context: { db: context.db, id: context.id, schemaInfo: context.schemaInfo }
+    55	    })
+    56	
+    57	    if (!exists) {
+    58	      throw new RestApiResourceError('Resource not found', { subtype: 'not_found' })
+    59	    }
+    60	
+    61	    // Remove relationships
+    62	    if (relDef?.through) {
+    63	      if (api.anyapi?.links?.removeMany) {
+    64	        await api.anyapi.links.removeMany({
+    65	          context,
+    66	          scopeName,
+    67	          relName: context.relationshipName,
+    68	          relDef,
+    69	          relData: params.relationshipData,
+    70	        })
+    71	      } else {
+    72	        const knex = api.knex?.instance || helpers.db
+    73	        const pivotResource = relDef.through
+    74	        const pivotScope = api.resources[pivotResource]
+    75	        const pivotTable = pivotScope?.vars?.schemaInfo?.tableName || pivotResource
+    76	        const localKey = relDef.foreignKey
+    77	        const foreignKey = relDef.otherKey
+    78	
+    79	        for (const identifier of params.relationshipData) {
+    80	          await knex(pivotTable)
+    81	            .where(localKey, context.id)
+    82	            .where(foreignKey, identifier.id)
+    83	            .delete()
+    84	            .transacting(context.transaction)
+    85	        }
+    86	      }
+    87	    } else {
+    88	      // Null out foreign keys for hasMany
+    89	      const targetType = relDef.target
+    90	      for (const identifier of params.relationshipData) {
+    91	        await api.resources[targetType].patch({
+    92	          id: identifier.id,
+    93	          inputRecord: {
+    94	            data: {
+    95	              type: targetType,
+    96	              id: identifier.id,
+    97	              attributes: { [relDef.foreignKey]: null }
+    98	            }
+    99	          },
+   100	          transaction: context.transaction,
+   101	          simplified: false
+   102	        })
+   103	      }
+   104	    }
+   105	
+   106	    await runHooks('finish')
+   107	    await runHooks('finishDeleteRelationship')
+   108	
+   109	    if (context.shouldCommit) {
+   110	      await context.transaction.commit()
+   111	    }
+   112	
+   113	    // 204 No Content
+   114	  } catch (error) {
+   115	    await handleWriteMethodError(error, context, 'DELETE_RELATIONSHIP', scopeName, log, runHooks)
+   116	  }
+   117	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-methods__delete.js.txt

@@ -0,0 +1,104 @@
+     1	import { RestApiResourceError } from '../../../lib/rest-api-errors.js'
+     2	import { handleWriteMethodError } from './common.js'
+     3	
+     4	/**
+     5	 * DELETE
+     6	 * Permanently deletes a resource.
+     7	 * Returns 204 No Content on success, indicating the resource has been removed.
+     8	 * This method does not return the deleted resource.
+     9	 */
+    10	export default async function deleteMethod ({
+    11	  params,
+    12	  context,
+    13	  vars,
+    14	  helpers,
+    15	  scope,
+    16	  scopes,
+    17	  runHooks,
+    18	  apiOptions,
+    19	  pluginOptions,
+    20	  scopeOptions,
+    21	  scopeName,
+    22	  api,
+    23	  log
+    24	}) {
+    25	  // Make the method available to all hooks
+    26	  context.method = 'delete'
+    27	
+    28	  // Set the ID in context
+    29	  context.id = params.id
+    30	
+    31	  // Set scopeName in context (needed for broadcasting)
+    32	  context.scopeName = scopeName
+    33	
+    34	  // Set schema info even for DELETE (needed by storage layer)
+    35	  context.schemaInfo = scopes[scopeName].vars.schemaInfo
+    36	
+    37	  // Transaction handling
+    38	  context.transaction = params.transaction ||
+    39	      (helpers.newTransaction && !params.transaction ? await helpers.newTransaction() : null)
+    40	  context.shouldCommit = !params.transaction && !!context.transaction
+    41	  context.db = context.transaction || api.knex.instance
+    42	
+    43	  try {
+    44	    // No payload validation needed for DELETE
+    45	
+    46	    // Fetch minimal record for authorization and logging
+    47	    const minimalRecord = await helpers.dataGetMinimal({
+    48	      scopeName,
+    49	      context,
+    50	      runHooks
+    51	    })
+    52	
+    53	    if (!minimalRecord) {
+    54	      throw new RestApiResourceError(
+    55	        'Resource not found',
+    56	        {
+    57	          subtype: 'not_found',
+    58	          resourceType: scopeName,
+    59	          resourceId: context.id
+    60	        }
+    61	      )
+    62	    }
+    63	
+    64	    context.originalMinimalRecord = minimalRecord
+    65	    context.minimalRecord = minimalRecord
+    66	
+    67	    // Centralised checkPermissions function
+    68	    await scope.checkPermissions({
+    69	      method: 'delete',
+    70	      originalContext: context,
+    71	    })
+    72	
+    73	    // Before data operations
+    74	    await runHooks('beforeDataCall')
+    75	    await runHooks('beforeDataCallDelete')
+    76	
+    77	    // Initialize record context for hooks
+    78	    context.record = {}
+    79	
+    80	    // Call the storage helper
+    81	    await helpers.dataDelete({
+    82	      scopeName,
+    83	      context
+    84	    })
+    85	
+    86	    await runHooks('afterDataCallDelete')
+    87	    await runHooks('afterDataCall')
+    88	
+    89	    // No return record for DELETE (204 No Content)
+    90	
+    91	    await runHooks('finish')
+    92	    await runHooks('finishDelete')
+    93	
+    94	    // Commit transaction if we created it
+    95	    if (context.shouldCommit) {
+    96	      await context.transaction.commit()
+    97	      await runHooks('afterCommit')
+    98	    }
+    99	
+   100	    // DELETE typically returns void/undefined (204 No Content)
+   101	  } catch (error) {
+   102	    await handleWriteMethodError(error, context, 'DELETE', scopeName, log, runHooks)
+   103	  }
+   104	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-methods__enrich-attributes.js.txt

@@ -0,0 +1,199 @@
+     1	import { filterHiddenFields } from '../lib/querying-writing/field-utils.js'
+     2	
+     3	/**
+     4	 * enrichAttributes
+     5	 * Runs the enrichAttributes hook for a specific scope to allow plugins to modify attributes
+     6	 * before they are returned to the client. This is a scope method so each resource type
+     7	 * can have its own attribute enrichment logic.
+     8	 *
+     9	 *
+    10	 */
+    11	export default async function enrichAttributesMethod ({ context, params, runHooks, scopeName, scopes, api, helpers }) {
+    12	  // Extract parameters passed to enrichAttributes
+    13	  // - attributes: The raw attributes from database
+    14	  // - parentContext: The context from the calling method (has queryParams, transaction, etc.)
+    15	  // - requestedComputedFields: Which computed fields to calculate (from sparse fieldsets)
+    16	  // - isMainResource: Whether this is the main resource or an included one
+    17	  // - computedDependencies: Fields fetched only for computation (to be removed)
+    18	  // Extract parameters passed to enrichAttributes
+    19	  // - attributes: The raw attributes from database
+    20	  // - parentContext: The context from the calling method (has queryParams, transaction, etc.)
+    21	  // - requestedComputedFields: Which computed fields to calculate (from sparse fieldsets)
+    22	  // - isMainResource: Whether this is the main resource or an included one
+    23	  // - computedDependencies: Fields fetched only for computation (to be removed)
+    24	  const { attributes, parentContext, requestedComputedFields, isMainResource, computedDependencies } = params || {}
+    25	
+    26	  // Return empty object if no attributes provided
+    27	  if (!attributes) {
+    28	    return {}
+    29	  }
+    30	
+    31	  // Get schema, computed field definitions
+    32	  const schemaStructure = scopes[scopeName]?.vars?.schemaInfo?.schemaStructure || {}
+    33	  const computedFields = scopes[scopeName]?.vars?.schemaInfo?.computed || {}
+    34	  const fieldGetters = scopes[scopeName]?.vars?.schemaInfo?.fieldGetters || {}
+    35	  const sortedGetterFields = scopes[scopeName]?.vars?.schemaInfo?.sortedGetterFields || []
+    36	
+    37	  // Make a copy of attributes for transformation
+    38	  const transformedAttributes = { ...attributes }
+    39	
+    40	  // STEP 1: Apply field getters in dependency order (before filtering)
+    41	  // This ensures getters see all fields including hidden ones
+    42	  for (const fieldName of sortedGetterFields) {
+    43	    // Only process if field exists in attributes
+    44	    if (fieldName in transformedAttributes) {
+    45	      const getterInfo = fieldGetters[fieldName]
+    46	      try {
+    47	        const getterContext = {
+    48	          attributes: transformedAttributes, // Current state with previous getters applied
+    49	          fieldName,
+    50	          originalValue: attributes[fieldName], // Original untransformed value
+    51	          originalAttributes: attributes, // All original attributes
+    52	          record: transformedAttributes, // Alias for compatibility
+    53	          parentContext,
+    54	          scopeName,
+    55	          api,
+    56	          helpers,
+    57	          isMainResource: isMainResource !== false
+    58	        }
+    59	
+    60	        // Apply getter (can be async)
+    61	        transformedAttributes[fieldName] = await getterInfo.getter(
+    62	          transformedAttributes[fieldName],
+    63	          getterContext
+    64	        )
+    65	      } catch (error) {
+    66	        console.error(`Error in getter for field '${fieldName}' in ${scopeName}:`, error)
+    67	        // Keep current value on error (don't break the whole request)
+    68	      }
+    69	    }
+    70	  }
+    71	
+    72	  // Filter hidden fields from attributes based on visibility rules
+    73	  // This removes hidden:true fields and normallyHidden:true fields (unless requested)
+    74	  const requestedFields = parentContext?.queryParams?.fields?.[scopeName]
+    75	  const filteredAttributes = filterHiddenFields(transformedAttributes, { structure: schemaStructure }, requestedFields)
+    76	
+    77	  // Handle virtual fields - they need to be added from parent context if available
+    78	  // Virtual fields come from input and need to be preserved in responses
+    79	  if (parentContext && parentContext.inputRecord?.data?.attributes) {
+    80	    const inputAttrs = parentContext.inputRecord.data.attributes
+    81	    Object.entries(schemaStructure).forEach(([fieldName, fieldDef]) => {
+    82	      if (fieldDef.virtual === true && fieldName in inputAttrs && inputAttrs[fieldName] !== undefined && inputAttrs[fieldName] !== null) {
+    83	        // Add virtual field to filtered attributes if not already there
+    84	        if (!(fieldName in filteredAttributes)) {
+    85	          filteredAttributes[fieldName] = inputAttrs[fieldName]
+    86	        }
+    87	      }
+    88	    })
+    89	  }
+    90	
+    91	  // Now handle sparse fieldsets for virtual fields
+    92	  if (requestedFields && requestedFields.length > 0) {
+    93	    const requestedFieldsList = typeof requestedFields === 'string'
+    94	      ? requestedFields.split(',').map(f => f.trim())
+    95	      : requestedFields
+    96	
+    97	    // Remove virtual fields that weren't requested
+    98	    Object.entries(schemaStructure).forEach(([fieldName, fieldDef]) => {
+    99	      if (fieldDef.virtual === true && fieldName in filteredAttributes) {
+   100	        if (!requestedFieldsList.includes(fieldName)) {
+   101	          delete filteredAttributes[fieldName]
+   102	        }
+   103	      }
+   104	    })
+   105	  }
+   106	
+   107	  // Determine which computed fields to calculate
+   108	  // We only compute fields that are requested to optimize performance
+   109	  let fieldsToCompute = []
+   110	  if (requestedComputedFields) {
+   111	    // Explicit list provided (from sparse fieldsets)
+   112	    // Example: ?fields[products]=name,profit_margin -> only compute profit_margin
+   113	    fieldsToCompute = requestedComputedFields
+   114	  } else if (isMainResource || !parentContext?.queryParams?.fields) {
+   115	    // No sparse fieldsets or this is the main resource - compute all fields
+   116	    // This ensures all computed fields are available when no filtering is applied
+   117	    fieldsToCompute = Object.keys(computedFields)
+   118	  }
+   119	
+   120	  // Create compute context with all available resources
+   121	  // IMPORTANT: We pass the TRANSFORMED attributes (after getters) to compute functions
+   122	  // This ensures computed fields see the getter-processed values
+   123	  // Example: if price getter converts string to number, profit_margin sees the number
+   124	  const computeContext = {
+   125	    attributes: transformedAttributes,   // Transformed attributes after getters
+   126	    record: { ...transformedAttributes }, // Full record for convenience
+   127	    context: parentContext,
+   128	    helpers,                             // API helpers for complex operations
+   129	    api,                                 // Full API instance
+   130	  }
+   131	
+   132	  // Auto-compute fields that have compute functions
+   133	  for (const fieldName of fieldsToCompute) {
+   134	    const fieldDef = computedFields[fieldName]
+   135	    if (fieldDef && fieldDef.compute) {
+   136	      try {
+   137	        // Call the compute function with full context
+   138	        // Example: profit_margin compute gets { attributes: { price: 100, cost: 60 } }
+   139	        // and returns: ((100 - 60) / 100 * 100) = "40.00"
+   140	        filteredAttributes[fieldName] = await fieldDef.compute(computeContext)
+   141	      } catch (error) {
+   142	        // Log error but don't fail the request - computed fields shouldn't break API
+   143	        console.error(`Error computing field '${fieldName}' for ${scopeName}:`, error)
+   144	        filteredAttributes[fieldName] = null
+   145	      }
+   146	    }
+   147	  }
+   148	
+   149	  // Remove fields that were only fetched as dependencies
+   150	  // This is the key to the dependency resolution feature:
+   151	  // 1. We fetched dependencies from DB (e.g., 'cost' for profit_margin)
+   152	  // 2. We used them in compute functions
+   153	  // 3. Now we remove them if they weren't explicitly requested
+   154	  // Example: User requests profit_margin, we fetch cost, compute, then remove cost
+   155	  const finalAttributes = { ...filteredAttributes }
+   156	  if (requestedFields && computedDependencies && computedDependencies.length > 0) {
+   157	    // Parse requested fields if it's a string
+   158	    const requested = typeof requestedFields === 'string'
+   159	      ? requestedFields.split(',').map(f => f.trim()).filter(f => f)
+   160	      : requestedFields
+   161	
+   162	    for (const dep of computedDependencies) {
+   163	      // Only remove if it wasn't explicitly requested
+   164	      // Example: 'cost' is removed unless user explicitly asked for it
+   165	      if (!requested.includes(dep)) {
+   166	        delete finalAttributes[dep]
+   167	      }
+   168	    }
+   169	  }
+   170	
+   171	  if (requestedFields && requestedFields.length > 0) {
+   172	    const requestedList = typeof requestedFields === 'string'
+   173	      ? requestedFields.split(',').map((field) => field.trim()).filter((field) => field)
+   174	      : requestedFields
+   175	    const allowed = new Set(requestedList)
+   176	    Object.keys(finalAttributes).forEach((key) => {
+   177	      if (!allowed.has(key)) {
+   178	        delete finalAttributes[key]
+   179	      }
+   180	    })
+   181	  }
+   182	
+   183	  // Create context for enrichAttributes hooks
+   184	  Object.assign(context, {
+   185	    parentContext,
+   186	    attributes: finalAttributes,  // Use the final attributes after dependency removal
+   187	    computedFields,
+   188	    requestedComputedFields: fieldsToCompute,
+   189	    scopeName,
+   190	    helpers,
+   191	    api
+   192	  })
+   193	
+   194	  // Run enrichAttributes hooks for additional/override computations
+   195	  await runHooks('enrichAttributes')
+   196	
+   197	  // Return the attributes from context, which hooks may have modified
+   198	  return context.attributes
+   199	};