json-rest-api 1.0.21 → 1.0.22

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-methods__patch.js.txt

@@ -0,0 +1,191 @@
+     1	import { RestApiResourceError } from '../../../lib/rest-api-errors.js'
+     2	import { validatePatchPayload } from '../lib/querying-writing/payload-validators.js'
+     3	import { processRelationships } from '../lib/writing/relationship-processor.js'
+     4	import { updateManyToManyRelationship } from '../lib/writing/many-to-many-manipulations.js'
+     5	import { ERROR_SUBTYPES } from '../lib/querying-writing/knex-constants.js'
+     6	import {
+     7	  setupCommonRequest,
+     8	  validateResourceAttributesBeforeWrite,
+     9	  validateRelationshipAccess,
+    10	  applyFieldSetters,
+    11	  validatePivotResource,
+    12	  handleRecordReturnAfterWrite,
+    13	  handleWriteMethodError
+    14	} from './common.js'
+    15	
+    16	/**
+    17	 * PATCH
+    18	 * Performs a partial update on an existing resource's attributes or relationships.
+    19	 * Unlike PUT, PATCH only updates the fields provided, leaving other fields unchanged.
+    20	 * This method supports updating both attributes and relationships (1:1 and n:n).
+    21	 * For relationships, only the ones explicitly provided will be updated.
+    22	 * Just like PUT, it CANNOT have the `included` array in data.
+    23	 */
+    24	export default async function patchMethod ({
+    25	  params,
+    26	  context,
+    27	  vars,
+    28	  helpers,
+    29	  scope,
+    30	  scopes,
+    31	  runHooks,
+    32	  apiOptions,
+    33	  pluginOptions,
+    34	  scopeOptions,
+    35	  scopeName,
+    36	  api,
+    37	  log
+    38	}) {
+    39	  context.method = 'patch'
+    40	
+    41	  try {
+    42	    const { schema, schemaStructure, schemaRelationships } = await setupCommonRequest({
+    43	      params,
+    44	      context,
+    45	      vars,
+    46	      scopes,
+    47	      scopeOptions,
+    48	      scopeName,
+    49	      api,
+    50	      helpers
+    51	    })
+    52	    context.id = context.inputRecord.data.id
+    53	
+    54	    // Run early hooks for pre-processing (e.g., file handling)
+    55	    await runHooks('beforeProcessing')
+    56	    await runHooks('beforeProcessingPatch')
+    57	
+    58	    // Validate PATCH payload to ensure the partial update actually contains changes.
+    59	    // PATCH requests must include either attributes to update or relationships to modify -
+    60	    // an empty PATCH is invalid. This prevents accidental no-op requests and ensures clients
+    61	    // are explicit about what they want to change. Unlike PUT, PATCH preserves all fields
+    62	    // not mentioned in the request.
+    63	    // Example: data must have either attributes: {title: 'New'} or relationships: {author: {...}}
+    64	    validatePatchPayload(context.inputRecord, scopes)
+    65	
+    66	    // Validate that user has read access to all related resources
+    67	    // This ensures users can only create relationships to resources they can access
+    68	    await validateRelationshipAccess(context, context.inputRecord, helpers, runHooks, api)
+    69	
+    70	    // Extract foreign keys from JSON:API relationships and prepare many-to-many operations
+    71	    // Example: relationships.author -> author_id: '123' for storage
+    72	    // Example: relationships.tags -> array of pivot records to create later (only for provided relationships in PATCH)
+    73	    const { belongsToUpdates, manyToManyRelationships } = processRelationships(
+    74	      scope,
+    75	      { context }
+    76	    )
+    77	
+    78	    await validateResourceAttributesBeforeWrite({
+    79	      context,
+    80	      schema,
+    81	      belongsToUpdates,
+    82	      runHooks,
+    83	      isPartialValidation: true
+    84	    })
+    85	
+    86	    // Fetch minimal record for authorization checks
+    87	    const minimalRecord = await helpers.dataGetMinimal({
+    88	      scopeName,
+    89	      context,
+    90	      runHooks
+    91	    })
+    92	
+    93	    if (!minimalRecord) {
+    94	      throw new RestApiResourceError(
+    95	        `Resource not found: ${scopeName}/${context.id}`,
+    96	        ERROR_SUBTYPES.NOT_FOUND
+    97	      )
+    98	    }
+    99	
+   100	    context.minimalRecord = minimalRecord
+   101	
+   102	    // Centralised checkPermissions function
+   103	    await scope.checkPermissions({
+   104	      method: 'patch',
+   105	      originalContext: context,
+   106	    })
+   107	
+   108	    // Merge belongsTo updates into attributes before patching the record
+   109	    if (Object.keys(belongsToUpdates).length > 0) {
+   110	      context.inputRecord.data.attributes = {
+   111	        ...context.inputRecord.data.attributes,
+   112	        ...belongsToUpdates
+   113	      }
+   114	    }
+   115	
+   116	    await runHooks('beforeDataCall')
+   117	    await runHooks('beforeDataCallPatch')
+   118	
+   119	    // Apply field setters after validation and before storage
+   120	    if (context.inputRecord?.data?.attributes) {
+   121	      context.inputRecord.data.attributes = await applyFieldSetters(
+   122	        context.inputRecord.data.attributes,
+   123	        context.schemaInfo,
+   124	        context,
+   125	        api,
+   126	        helpers
+   127	      )
+   128	    }
+   129	
+   130	    // Call the storage helper - should return the patched record
+   131	    await helpers.dataPatch({
+   132	      scopeName,
+   133	      context
+   134	    })
+   135	
+   136	    await runHooks('afterDataCallPatch')
+   137	    await runHooks('afterDataCall')
+   138	
+   139	    // Process many-to-many relationships after main record update
+   140	    // For PATCH, we only update the relationships that were explicitly provided
+   141	    for (const { relName, relDef, relData } of manyToManyRelationships) {
+   142	      if (relDef?.through && api.anyapi?.links?.syncMany) {
+   143	        await api.anyapi.links.syncMany({
+   144	          context,
+   145	          scopeName,
+   146	          relName,
+   147	          relDef,
+   148	          relData,
+   149	          isUpdate: true,
+   150	        })
+   151	        continue
+   152	      }
+   153	
+   154	      validatePivotResource(scopes, relDef, relName)
+   155	
+   156	      await updateManyToManyRelationship(null, {
+   157	        api,
+   158	        context: {
+   159	          resourceId: context.id,
+   160	          relDef,
+   161	          relData,
+   162	          transaction: context.transaction
+   163	        }
+   164	      })
+   165	    }
+   166	
+   167	    const ret = await handleRecordReturnAfterWrite({
+   168	      context,
+   169	      scopeName,
+   170	      api,
+   171	      scopes,
+   172	      schemaStructure,
+   173	      schemaRelationships,
+   174	      scopeOptions,
+   175	      vars,
+   176	      runHooks,
+   177	      helpers,
+   178	      log
+   179	    })
+   180	
+   181	    // Commit transaction if we created it
+   182	    if (context.shouldCommit) {
+   183	      await context.transaction.commit()
+   184	      await runHooks('afterCommit')
+   185	    }
+   186	
+   187	    return ret
+   188	  } catch (error) {
+   189	    await handleWriteMethodError(error, context, 'PATCH', scopeName, log, runHooks)
+   190	  }
+   191	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-methods__post-relationship.js.txt

@@ -0,0 +1,110 @@
+     1	import { RestApiResourceError, RestApiValidationError, RestApiPayloadError } from '../../../lib/rest-api-errors.js'
+     2	import { findRelationshipDefinition, handleWriteMethodError } from './common.js'
+     3	import { createPivotRecords } from '../lib/writing/many-to-many-manipulations.js'
+     4	
+     5	/**
+     6	   * POST RELATIONSHIP
+     7	   * Adds members to a to-many relationship
+     8	   * POST /api/articles/1/relationships/tags
+     9	   *
+    10	   * @param {string} id - The ID of the resource
+    11	   * @param {string} relationshipName - The name of the relationship
+    12	   * @param {array} relationshipData - Array of resource identifiers to add
+    13	   * @returns {Promise<void>} 204 No Content
+    14	  */
+    15	export default async function postRelationshipMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeName, api, log }) {
+    16	  context.method = 'postRelationship'
+    17	  context.id = params.id
+    18	  context.relationshipName = params.relationshipName
+    19	  context.schemaInfo = scopes[scopeName].vars.schemaInfo
+    20	
+    21	  // Transaction handling
+    22	  context.transaction = params.transaction ||
+    23	  (helpers.newTransaction && !params.transaction ? await helpers.newTransaction() : null)
+    24	  context.shouldCommit = !params.transaction && !!context.transaction
+    25	
+    26	  context.db = context.transaction || api.knex.instance
+    27	
+    28	  try {
+    29	  // Validate
+    30	    const relDef = findRelationshipDefinition(context.schemaInfo, context.relationshipName)
+    31	    if (!relDef) {
+    32	      throw new RestApiResourceError(
+    33	      `Relationship '${context.relationshipName}' not found on resource '${scopeName}'`,
+    34	      { subtype: 'relationship_not_found' }
+    35	      )
+    36	    }
+    37	
+    38	    if (relDef.type !== 'hasMany' && relDef.type !== 'manyToMany') {
+    39	      throw new RestApiValidationError(
+    40	      `Cannot POST to to-one relationship '${context.relationshipName}'. Use PATCH instead.`,
+    41	      { fields: ['data'] }
+    42	      )
+    43	    }
+    44	
+    45	    if (!Array.isArray(params.relationshipData)) {
+    46	      throw new RestApiPayloadError('POST to relationship requires array of resource identifiers')
+    47	    }
+    48	
+    49	    // Check permissions
+    50	    await runHooks('checkPermissions')
+    51	    await runHooks('checkPermissionsPostRelationship')
+    52	
+    53	    // Verify parent exists
+    54	    const exists = await helpers.dataExists({
+    55	      scopeName,
+    56	      context: { db: context.db, id: context.id, schemaInfo: context.schemaInfo },
+    57	    })
+    58	
+    59	    if (!exists) {
+    60	      throw new RestApiResourceError('Resource not found', { subtype: 'not_found' })
+    61	    }
+    62	
+    63	    // Add relationships
+    64	    if (relDef?.through) {
+    65	      if (api.anyapi?.links?.attachMany) {
+    66	        await api.anyapi.links.attachMany({
+    67	          context,
+    68	          scopeName,
+    69	          relName: context.relationshipName,
+    70	          relDef,
+    71	          relData: params.relationshipData,
+    72	        })
+    73	      } else {
+    74	        await createPivotRecords(api, context.id, {
+    75	          through: relDef.through,
+    76	          foreignKey: relDef.foreignKey,
+    77	          otherKey: relDef.otherKey
+    78	        }, params.relationshipData, context.transaction)
+    79	      }
+    80	    } else if (relDef.type === 'hasMany') {
+    81	      // Update foreign keys for hasMany
+    82	      const targetType = relDef.target
+    83	      for (const identifier of params.relationshipData) {
+    84	        await api.resources[targetType].patch({
+    85	          id: identifier.id,
+    86	          inputRecord: {
+    87	            data: {
+    88	              type: targetType,
+    89	              id: identifier.id,
+    90	              attributes: { [relDef.foreignKey]: context.id }
+    91	            }
+    92	          },
+    93	          transaction: context.transaction,
+    94	          simplified: false
+    95	        })
+    96	      }
+    97	    }
+    98	
+    99	    await runHooks('finish')
+   100	    await runHooks('finishPostRelationship')
+   101	
+   102	    if (context.shouldCommit) {
+   103	      await context.transaction.commit()
+   104	    }
+   105	
+   106	    // 204 No Content
+   107	  } catch (error) {
+   108	    await handleWriteMethodError(error, context, 'POST_RELATIONSHIP', scopeName, log, runHooks)
+   109	  }
+   110	};

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-methods__post.js.txt

@@ -0,0 +1,168 @@
+     1	import { validatePostPayload } from '../lib/querying-writing/payload-validators.js'
+     2	import { processRelationships } from '../lib/writing/relationship-processor.js'
+     3	import { createPivotRecords } from '../lib/writing/many-to-many-manipulations.js'
+     4	import {
+     5	  setupCommonRequest,
+     6	  validateResourceAttributesBeforeWrite,
+     7	  validateRelationshipAccess,
+     8	  applyFieldSetters,
+     9	  validatePivotResource,
+    10	  handleRecordReturnAfterWrite,
+    11	  handleWriteMethodError
+    12	} from './common.js'
+    13	
+    14	/**
+    15	 * POST
+    16	 * Creates a new resource. The request must include a JSON:API document with a 'data' object
+    17	 * containing 'type' and 'attributes'. It can also establish relationships to existing resources.
+    18	 * The returned document contains the created resource with its server-assigned ID.
+    19	 */
+    20	export default async function postMethod ({
+    21	  params,
+    22	  context,
+    23	  vars,
+    24	  helpers,
+    25	  scope,
+    26	  scopes,
+    27	  runHooks,
+    28	  apiOptions,
+    29	  pluginOptions,
+    30	  scopeOptions,
+    31	  scopeName,
+    32	  api,
+    33	  log
+    34	}) {
+    35	  context.method = 'post'
+    36	
+    37	  try {
+    38	    const { schema, schemaStructure, schemaRelationships } = await setupCommonRequest({
+    39	      params,
+    40	      context,
+    41	      vars,
+    42	      scopes,
+    43	      scopeOptions,
+    44	      scopeName,
+    45	      api,
+    46	      helpers
+    47	    })
+    48	
+    49	    // Run early hooks for pre-processing (e.g., file handling)
+    50	    await runHooks('beforeProcessing')
+    51	    await runHooks('beforeProcessingPost')
+    52	
+    53	    // Validate POST payload to ensure it follows JSON:API format and references valid resources.
+    54	    // This checks the payload has required 'data' object with 'type' and 'attributes', validates
+    55	    // that data.type matches a real resource type (preventing creation of non-existent resources),
+    56	    // and ensures any relationships reference valid resource types with proper ID format.
+    57	    // Example: data.type: 'articles' must be a registered scope, relationships.author must reference 'users'.
+    58	    validatePostPayload(context.inputRecord, scopes)
+    59	
+    60	    // Validate that user has read access to all related resources
+    61	    // This ensures users can only create relationships to resources they can access
+    62	    await validateRelationshipAccess(context, context.inputRecord, helpers, runHooks, api)
+    63	
+    64	    // Extract foreign keys from JSON:API relationships and prepare many-to-many operations
+    65	    // Example: relationships.author -> author_id: '123' for storage
+    66	    // Example: relationships.tags -> array of pivot records to create later
+    67	    const { belongsToUpdates, manyToManyRelationships } = await processRelationships(
+    68	      scope,
+    69	      { context }
+    70	    )
+    71	
+    72	    // Merge belongsTo updates into attributes before validation (like PUT/PATCH do)
+    73	    if (Object.keys(belongsToUpdates).length > 0) {
+    74	      context.inputRecord.data.attributes = {
+    75	        ...context.inputRecord.data.attributes,
+    76	        ...belongsToUpdates
+    77	      }
+    78	    }
+    79	
+    80	    await validateResourceAttributesBeforeWrite({
+    81	      context,
+    82	      schema,
+    83	      belongsToUpdates,
+    84	      runHooks
+    85	    })
+    86	
+    87	    if (context.inputRecord?.data) {
+    88	      const inputData = context.inputRecord.data
+    89	      context.minimalRecord = {
+    90	        type: scopeName,
+    91	        ...(inputData.id !== undefined && inputData.id !== null ? { id: String(inputData.id) } : {}),
+    92	        attributes: structuredClone(inputData.attributes || {}),
+    93	        relationships: structuredClone(inputData.relationships || {})
+    94	      }
+    95	    }
+    96	
+    97	    // Centralised checkPermissions function
+    98	    await scope.checkPermissions({
+    99	      method: 'post',
+   100	      originalContext: context,
+   101	    })
+   102	
+   103	    await runHooks('beforeDataCall')
+   104	    await runHooks('beforeDataCallPost')
+   105	
+   106	    // Apply field setters after validation and before storage
+   107	    if (context.inputRecord?.data?.attributes) {
+   108	      context.inputRecord.data.attributes = await applyFieldSetters(
+   109	        context.inputRecord.data.attributes,
+   110	        context.schemaInfo,
+   111	        context,
+   112	        api,
+   113	        helpers
+   114	      )
+   115	    }
+   116	
+   117	    // Create the main record - storage helper should return the created record with its ID
+   118	    context.id = await helpers.dataPost({
+   119	      scopeName,
+   120	      context
+   121	    })
+   122	
+   123	    await runHooks('afterDataCallPost')
+   124	    await runHooks('afterDataCall')
+   125	
+   126	    // Process many-to-many relationships after main record creation
+   127	    for (const { relName, relDef, relData } of manyToManyRelationships) {
+   128	      if (api.anyapi?.links?.attachMany && relDef?.through) {
+   129	        await api.anyapi.links.attachMany({
+   130	          context,
+   131	          scopeName,
+   132	          relName,
+   133	          relDef,
+   134	          relData,
+   135	        })
+   136	        continue
+   137	      }
+   138	
+   139	      // Validate pivot resource exists
+   140	      validatePivotResource(scopes, relDef, relName)
+   141	      await createPivotRecords(api, context.id, relDef, relData, context.transaction)
+   142	    }
+   143	
+   144	    const ret = await handleRecordReturnAfterWrite({
+   145	      context,
+   146	      scopeName,
+   147	      api,
+   148	      scopes,
+   149	      schemaStructure,
+   150	      schemaRelationships,
+   151	      scopeOptions,
+   152	      vars,
+   153	      runHooks,
+   154	      helpers,
+   155	      log
+   156	    })
+   157	
+   158	    // Commit transaction if we created it
+   159	    if (context.shouldCommit) {
+   160	      await context.transaction.commit()
+   161	      await runHooks('afterCommit')
+   162	    }
+   163	
+   164	    return ret
+   165	  } catch (error) {
+   166	    await handleWriteMethodError(error, context, 'POST', scopeName, log, runHooks)
+   167	  }
+   168	}