json-rest-api 1.0.22 → 1.0.23

package/tests/autofilter.test.js

@@ -0,0 +1,463 @@
+import { describe, it, before, after, beforeEach } from 'node:test'
+import assert from 'node:assert/strict'
+import knexLib from 'knex'
+import {
+  validateJsonApiStructure,
+  cleanTables,
+  createJsonApiDocument,
+  assertResourceAttributes,
+  createRelationship,
+  resourceIdentifier
+} from './helpers/test-utils.js'
+import { storageMode } from './helpers/storage-mode.js'
+import { createAutoFilterApi } from './fixtures/api-configs.js'
+
+const knex = knexLib({
+  client: 'better-sqlite3',
+  connection: {
+    filename: ':memory:'
+  },
+  useNullAsDefault: true
+})
+
+let api
+
+const scopedContext = (workspaceId, userId, projectId) => ({
+  scopeValues: {
+    workspaceId,
+    userId,
+    ...(projectId !== undefined ? { projectId } : {})
+  }
+})
+
+const moveTaskOutOfScope = async ({ taskId, workspaceId, userId }) => {
+  if (storageMode.isAnyApi()) {
+    const descriptor = await api.anyapi.registry.getDescriptor(api.anyapi.tenantId, 'tasks')
+    await knex('any_records')
+      .where({
+        id: Number(taskId),
+        tenant_id: api.anyapi.tenantId,
+        resource: 'tasks'
+      })
+      .update({
+        [descriptor.fields.workspace_id.slot]: workspaceId,
+        [descriptor.fields.user_id.slot]: userId
+      })
+    return
+  }
+
+  await knex('autofilter_tasks')
+    .where({ id: Number(taskId) })
+    .update({
+      workspace_id: workspaceId,
+      user_id: userId
+    })
+}
+
+describe('AutoFilter Plugin', () => {
+  before(async () => {
+    api = await createAutoFilterApi(knex)
+  })
+
+  after(async () => {
+    await knex.destroy()
+  })
+
+  beforeEach(async () => {
+    await cleanTables(knex, [
+      'autofilter_workspace_reports',
+      'autofilter_user_notes',
+      'autofilter_projects',
+      'autofilter_tasks',
+      'autofilter_optional_tasks',
+      'autofilter_system_settings'
+    ])
+  })
+
+  it('stamps workspace-scoped records and filters collections by workspace', async () => {
+    const reportA = await api.resources.workspace_reports.post({
+      inputRecord: createJsonApiDocument('workspace_reports', {
+        title: 'Workspace A report'
+      }),
+      simplified: false
+    }, scopedContext('workspace-a', 101))
+
+    await api.resources.workspace_reports.post({
+      inputRecord: createJsonApiDocument('workspace_reports', {
+        title: 'Workspace B report'
+      }),
+      simplified: false
+    }, scopedContext('workspace-b', 202))
+
+    validateJsonApiStructure(reportA)
+    assertResourceAttributes(reportA.data, {
+      title: 'Workspace A report',
+      workspace_id: 'workspace-a'
+    })
+
+    const queryA = await api.resources.workspace_reports.query({
+      simplified: false
+    }, scopedContext('workspace-a', 999))
+
+    validateJsonApiStructure(queryA, true)
+    assert.equal(queryA.data.length, 1)
+    assert.equal(queryA.data[0].attributes.title, 'Workspace A report')
+    assert.equal(queryA.data[0].attributes.workspace_id, 'workspace-a')
+  })
+
+  it('stamps user-scoped records and filters collections by user', async () => {
+    const noteA = await api.resources.user_notes.post({
+      inputRecord: createJsonApiDocument('user_notes', {
+        body: 'User 101 note'
+      }),
+      simplified: false
+    }, scopedContext('workspace-a', 101))
+
+    await api.resources.user_notes.post({
+      inputRecord: createJsonApiDocument('user_notes', {
+        body: 'User 202 note'
+      }),
+      simplified: false
+    }, scopedContext('workspace-a', 202))
+
+    validateJsonApiStructure(noteA)
+    assertResourceAttributes(noteA.data, {
+      body: 'User 101 note',
+      user_id: 101
+    })
+
+    const queryA = await api.resources.user_notes.query({
+      simplified: false
+    }, scopedContext('workspace-b', 101))
+
+    validateJsonApiStructure(queryA, true)
+    assert.equal(queryA.data.length, 1)
+    assert.equal(queryA.data[0].attributes.body, 'User 101 note')
+    assert.equal(queryA.data[0].attributes.user_id, 101)
+  })
+
+  it('applies composite workspace+user scoping', async () => {
+    const ownProject = await api.resources.projects.post({
+      inputRecord: createJsonApiDocument('projects', {
+        name: 'Workspace A / User 101'
+      }),
+      simplified: false
+    }, scopedContext('workspace-a', 101))
+
+    await api.resources.projects.post({
+      inputRecord: createJsonApiDocument('projects', {
+        name: 'Workspace A / User 202'
+      }),
+      simplified: false
+    }, scopedContext('workspace-a', 202))
+
+    await api.resources.projects.post({
+      inputRecord: createJsonApiDocument('projects', {
+        name: 'Workspace B / User 101'
+      }),
+      simplified: false
+    }, scopedContext('workspace-b', 101))
+
+    validateJsonApiStructure(ownProject)
+    assertResourceAttributes(ownProject.data, {
+      name: 'Workspace A / User 101',
+      workspace_id: 'workspace-a',
+      user_id: 101
+    })
+
+    const scopedQuery = await api.resources.projects.query({
+      simplified: false
+    }, scopedContext('workspace-a', 101))
+
+    validateJsonApiStructure(scopedQuery, true)
+    assert.equal(scopedQuery.data.length, 1)
+    assert.equal(scopedQuery.data[0].attributes.name, 'Workspace A / User 101')
+  })
+
+  it('treats public resources as unscoped', async () => {
+    const created = await api.resources.system_settings.post({
+      inputRecord: createJsonApiDocument('system_settings', {
+        key: 'app.version',
+        value: '1.0.0'
+      }),
+      simplified: false
+    })
+
+    validateJsonApiStructure(created)
+
+    const anonymousQuery = await api.resources.system_settings.query({
+      simplified: false
+    })
+    validateJsonApiStructure(anonymousQuery, true)
+    assert.equal(anonymousQuery.data.length, 1)
+
+    const scopedQuery = await api.resources.system_settings.query({
+      simplified: false
+    }, scopedContext('workspace-a', 101))
+    validateJsonApiStructure(scopedQuery, true)
+    assert.equal(scopedQuery.data.length, 1)
+  })
+
+  it('scopes single-record lookups so out-of-scope records are not found', async () => {
+    const project = await api.resources.projects.post({
+      inputRecord: createJsonApiDocument('projects', {
+        name: 'Scoped Project'
+      }),
+      simplified: false
+    }, scopedContext('workspace-a', 101))
+
+    await assert.rejects(
+      async () => {
+        await api.resources.projects.get({
+          id: project.data.id,
+          simplified: false
+        }, scopedContext('workspace-a', 202))
+      },
+      (error) => error.code === 'REST_API_RESOURCE',
+      'Out-of-scope records should behave as not found'
+    )
+  })
+
+  it('stamps scoped fields on PUT and rejects inconsistent scoped updates', async () => {
+    const project = await api.resources.projects.post({
+      inputRecord: createJsonApiDocument('projects', {
+        name: 'Original Project',
+        description: 'Original Description'
+      }),
+      simplified: false
+    }, scopedContext('workspace-a', 101))
+
+    await api.resources.projects.put({
+      inputRecord: {
+        data: {
+          type: 'projects',
+          id: project.data.id,
+          attributes: {
+            name: 'Updated Project',
+            description: 'Updated Description',
+            status: 'active'
+          }
+        }
+      },
+      simplified: false
+    }, scopedContext('workspace-a', 101))
+
+    const afterPut = await api.resources.projects.get({
+      id: project.data.id,
+      simplified: false
+    }, scopedContext('workspace-a', 101))
+
+    validateJsonApiStructure(afterPut)
+    assertResourceAttributes(afterPut.data, {
+      name: 'Updated Project',
+      description: 'Updated Description',
+      workspace_id: 'workspace-a',
+      user_id: 101
+    })
+
+    await assert.rejects(
+      async () => {
+        await api.resources.projects.patch({
+          id: project.data.id,
+          inputRecord: {
+            data: {
+              type: 'projects',
+              id: project.data.id,
+              attributes: {
+                workspace_id: 'workspace-b'
+              }
+            }
+          },
+          simplified: false
+        }, scopedContext('workspace-a', 101))
+      },
+      (error) => error.code === 'REST_API_VALIDATION',
+      'PATCH should reject inconsistent scope-field updates'
+    )
+  })
+
+  it('uses scoped lookups when validating relationships', async () => {
+    const projectA = await api.resources.projects.post({
+      inputRecord: createJsonApiDocument('projects', {
+        name: 'Project A'
+      }),
+      simplified: false
+    }, scopedContext('workspace-a', 101))
+
+    const projectB = await api.resources.projects.post({
+      inputRecord: createJsonApiDocument('projects', {
+        name: 'Project B'
+      }),
+      simplified: false
+    }, scopedContext('workspace-b', 101))
+
+    const task = await api.resources.tasks.post({
+      inputRecord: createJsonApiDocument('tasks',
+        {
+          title: 'Task A'
+        },
+        {
+          project: createRelationship(resourceIdentifier('projects', projectA.data.id))
+        }
+      ),
+      simplified: false
+    }, scopedContext('workspace-a', 101))
+
+    validateJsonApiStructure(task)
+    assertResourceAttributes(task.data, {
+      title: 'Task A',
+      workspace_id: 'workspace-a',
+      user_id: 101
+    })
+
+    await assert.rejects(
+      async () => {
+        await api.resources.tasks.post({
+          inputRecord: createJsonApiDocument('tasks',
+            {
+              title: 'Cross-scope Task'
+            },
+            {
+              project: createRelationship(resourceIdentifier('projects', projectB.data.id))
+            }
+          ),
+          simplified: false
+        }, scopedContext('workspace-a', 101))
+      },
+      (error) => error.code === 'REST_API_RESOURCE' || error.code === 'REST_API_VALIDATION',
+      'Relationship validation should respect scoped datasets'
+    )
+  })
+
+  it('scopes included resources through the same autofilter path as top-level queries', async () => {
+    const project = await api.resources.projects.post({
+      inputRecord: createJsonApiDocument('projects', {
+        name: 'Scoped include project'
+      }),
+      simplified: false
+    }, scopedContext('workspace-a', 101))
+
+    const visibleTask = await api.resources.tasks.post({
+      inputRecord: createJsonApiDocument('tasks',
+        {
+          title: 'Visible task'
+        },
+        {
+          project: createRelationship(resourceIdentifier('projects', project.data.id))
+        }
+      ),
+      simplified: false
+    }, scopedContext('workspace-a', 101))
+
+    const hiddenTask = await api.resources.tasks.post({
+      inputRecord: createJsonApiDocument('tasks',
+        {
+          title: 'Out-of-scope task'
+        },
+        {
+          project: createRelationship(resourceIdentifier('projects', project.data.id))
+        }
+      ),
+      simplified: false
+    }, scopedContext('workspace-a', 101))
+
+    await moveTaskOutOfScope({
+      taskId: hiddenTask.data.id,
+      workspaceId: 'workspace-b',
+      userId: 202
+    })
+
+    const result = await api.resources.projects.get({
+      id: project.data.id,
+      queryParams: {
+        include: ['tasks']
+      },
+      simplified: false
+    }, scopedContext('workspace-a', 101))
+
+    validateJsonApiStructure(result)
+    assert.deepEqual(result.data.relationships.tasks.data, [
+      resourceIdentifier('tasks', visibleTask.data.id)
+    ])
+    assert.equal(result.included?.length, 1)
+    assert.equal(result.included?.[0]?.id, visibleTask.data.id)
+    assert.equal(result.included?.[0]?.attributes.title, 'Visible task')
+  })
+
+  it('treats null belongsTo autofilter values as valid null linkage on writes', async () => {
+    const implicitNull = await api.resources.optional_tasks.post({
+      inputRecord: createJsonApiDocument('optional_tasks', {
+        title: 'Implicit null project'
+      }),
+      simplified: false
+    }, scopedContext('workspace-a', 101))
+
+    const explicitNull = await api.resources.optional_tasks.post({
+      inputRecord: createJsonApiDocument(
+        'optional_tasks',
+        {
+          title: 'Explicit null project'
+        },
+        {
+          project: { data: null }
+        }
+      ),
+      simplified: false
+    }, scopedContext('workspace-a', 101))
+
+    const implicitFetched = await api.resources.optional_tasks.get({
+      id: implicitNull.data.id,
+      simplified: false
+    }, scopedContext('workspace-a', 101))
+
+    const explicitFetched = await api.resources.optional_tasks.get({
+      id: explicitNull.data.id,
+      simplified: false
+    }, scopedContext('workspace-a', 101))
+
+    validateJsonApiStructure(implicitFetched)
+    validateJsonApiStructure(explicitFetched)
+    assert.equal(implicitFetched.data.relationships.project.data, null)
+    assert.equal(explicitFetched.data.relationships.project.data, null)
+  })
+
+  it('fails cleanly when a required autofilter value is missing', async () => {
+    await assert.rejects(
+      async () => {
+        await api.resources.projects.query({
+          simplified: false
+        })
+      },
+      (error) => error.code === 'REST_API_AUTOFILTER_CONTEXT',
+      'Scoped resources should require configured scope values'
+    )
+
+    await assert.rejects(
+      async () => {
+        await api.resources.projects.post({
+          inputRecord: createJsonApiDocument('projects', {
+            name: 'No Scope'
+          }),
+          simplified: false
+        })
+      },
+      (error) => error.code === 'REST_API_AUTOFILTER_CONTEXT',
+      'Scoped writes should require configured scope values'
+    )
+  })
+
+  it('exposes compiled preset configuration without auth semantics', () => {
+    assert.deepEqual(api.autofilter.getConfig(), {
+      presets: ['public', 'workspace', 'user', 'workspace_user'],
+      resolvers: ['workspace', 'user', 'currentProject']
+    })
+
+    assert.deepEqual(api.autofilter.getScopeConfig('projects'), {
+      preset: 'workspace_user',
+      filters: [
+        { field: 'workspace_id', resolver: 'workspace', required: true },
+        { field: 'user_id', resolver: 'user', required: true }
+      ]
+    })
+  })
+})

package/tests/custom-id-simplified-post.test.js

@@ -0,0 +1,75 @@
+import { describe, it, before, after, beforeEach } from 'node:test'
+import assert from 'node:assert/strict'
+import knexLib from 'knex'
+import { Api } from 'hooked-api'
+import { RestApiPlugin } from '../plugins/core/rest-api-plugin.js'
+import { RestApiKnexPlugin } from '../plugins/core/rest-api-knex-plugin.js'
+import { cleanTables } from './helpers/test-utils.js'
+
+const knex = knexLib({
+  client: 'better-sqlite3',
+  connection: {
+    filename: ':memory:'
+  },
+  useNullAsDefault: true
+})
+
+let api
+
+describe('Simplified POST with explicit resource ids', () => {
+  before(async () => {
+    api = new Api({
+      name: 'custom-id-simplified-post-test'
+    })
+
+    await api.use(RestApiPlugin, {
+      simplifiedApi: true,
+      simplifiedTransport: false,
+      returnRecordApi: {
+        post: 'full',
+        put: 'full',
+        patch: 'full'
+      }
+    })
+    await api.use(RestApiKnexPlugin, { knex })
+
+    await api.addResource('user_settings', {
+      tableName: 'test_user_settings',
+      idProperty: 'user_id',
+      searchSchema: {
+        id: { type: 'id', actualField: 'id' }
+      },
+      schema: {
+        theme: { type: 'string', required: true, max: 32 }
+      }
+    })
+    await api.resources.user_settings.createKnexTable()
+  })
+
+  after(async () => {
+    await knex.destroy()
+  })
+
+  beforeEach(async () => {
+    await cleanTables(knex, ['test_user_settings'])
+  })
+
+  it('persists the provided resource id when posting simplified records to a custom-id resource', async () => {
+    const created = await api.resources.user_settings.post({
+      id: '7',
+      theme: 'dark'
+    })
+
+    assert.equal(created.id, '7')
+    assert.equal(created.theme, 'dark')
+
+    const dbRow = await knex('test_user_settings').where('user_id', 7).first()
+    assert.ok(dbRow)
+    assert.equal(String(dbRow.user_id), '7')
+    assert.equal(dbRow.theme, 'dark')
+
+    const fetched = await api.resources.user_settings.get({ id: '7' })
+    assert.equal(fetched.id, '7')
+    assert.equal(fetched.theme, 'dark')
+  })
+})

package/tests/custom-idproperty-relationships.test.js

@@ -161,6 +161,14 @@ describe('Custom idProperty Relationship Operations', () => {
       assert.equal(getResult.included.length, 1)
       assert.equal(getResult.included[0].type, 'countries')
       assert.equal(getResult.included[0].attributes.name, 'United States')
+      assert.equal(
+        getResult.data.relationships.country.links.self,
+        `/publishers/${publisherResult.data.id}/relationships/country`
+      )
+      assert.equal(
+        getResult.data.relationships.country.links.related,
+        `/publishers/${publisherResult.data.id}/country`
+      )
     })
 
     it('should update belongsTo relationship via PATCH', async () => {
@@ -895,5 +903,30 @@ describe('Custom idProperty Relationship Operations', () => {
       assertResourceRelationship(putResult.data, 'country',
         resourceIdentifier('countries', country.data.id))
     })
+
+    it('should reject PUT when an existing persisted attribute is omitted', async () => {
+      const country = await api.resources.countries.post({
+        inputRecord: createJsonApiDocument('countries', { name: 'USA', code: 'US' })
+      })
+
+      await assert.rejects(
+        async () => api.resources.countries.put({
+          inputRecord: {
+            data: {
+              type: 'countries',
+              id: country.data.id,
+              attributes: {
+                name: 'Renamed Country'
+              }
+            }
+          }
+        }),
+        (error) => {
+          assert.equal(error.message, 'PUT request omits persisted fields that already have stored values')
+          assert(error.details.fields.includes('data.attributes.code'))
+          return true
+        }
+      )
+    })
   })
 })