json-rest-api 1.0.22 → 1.0.23

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-multihome-plugin.js.txt

@@ -1,314 +0,0 @@
-     1	export const MultiHomePlugin = {
-     2	  name: 'multihome',
-     3	  dependencies: ['rest-api'],
-     4	
-     5	  install ({ api, addHook, vars, helpers, log, scopes, pluginOptions }) {
-     6	    if (!api.knex?.instance) {
-     7	      throw new Error('Multihome plugin requires a storage plugin with knex support (rest-api-knex or rest-api-anyapi-knex)')
-     8	    }
-     9	
-    10	    // Get configuration - hooked-api namespaces options by plugin name
-    11	    const multihomeOptions = pluginOptions || {}
-    12	
-    13	    // Store configuration in vars (data only)
-    14	    vars.multihome = {
-    15	      field: multihomeOptions.field || 'multihome_id',
-    16	      excludeResources: multihomeOptions.excludeResources || ['system_migrations', 'system_logs'],
-    17	      requireAuth: multihomeOptions.requireAuth !== undefined ? multihomeOptions.requireAuth : true,
-    18	      allowMissing: multihomeOptions.allowMissing || false
-    19	    }
-    20	
-    21	    const resolveStorageAdapter = (scopeName, hookContext = {}) => {
-    22	      if (!scopeName) return null
-    23	      if (hookContext.storageAdapter) return hookContext.storageAdapter
-    24	      if (hookContext.knexQuery?.storageAdapter) return hookContext.knexQuery.storageAdapter
-    25	      if (helpers.getStorageAdapter) {
-    26	        return helpers.getStorageAdapter(scopeName)
-    27	      }
-    28	      return null
-    29	    }
-    30	
-    31	    const translateColumnReference = ({ field, tableName, scopeName, hookContext }) => {
-    32	      const storageAdapter = resolveStorageAdapter(scopeName, hookContext)
-    33	      const translated = storageAdapter?.translateColumn?.(field) ?? field
-    34	      if (tableName) {
-    35	        return `${tableName}.${translated}`
-    36	      }
-    37	      return translated
-    38	    }
-    39	
-    40	    const translateFilterValue = ({ field, value, scopeName, hookContext }) => {
-    41	      const storageAdapter = resolveStorageAdapter(scopeName, hookContext)
-    42	      if (!storageAdapter?.translateFilterValue) return value
-    43	      return storageAdapter.translateFilterValue(field, value)
-    44	    }
-    45	
-    46	    // Default extractor function
-    47	    function defaultSubdomainExtractor (request) {
-    48	      // Extract from subdomain (e.g., 'mobily' from 'mobily.app.com')
-    49	      const host = request.headers?.host || request.hostname || ''
-    50	      const subdomain = host.split('.')[0]
-    51	
-    52	      // Don't use 'www' or 'api' as tenant IDs
-    53	      if (subdomain && !['www', 'api', 'app'].includes(subdomain)) {
-    54	        return subdomain
-    55	      }
-    56	
-    57	      // Fallback to header
-    58	      return request.headers?.['x-multihome-id'] || null
-    59	    }
-    60	
-    61	    // Store extractor function in helpers
-    62	    helpers.extractMultihomeId = multihomeOptions.extractor || defaultSubdomainExtractor
-    63	
-    64	    // Hook into transport layer to extract multihome_id
-    65	    addHook('transport:request', 'extract-multihome-id', {}, async ({ context, request, helpers }) => {
-    66	      // Extract multihome_id using configured extractor
-    67	      const multihomeId = helpers.extractMultihomeId(request)
-    68	
-    69	      if (multihomeId) {
-    70	        // Store in auth context (even if no user auth)
-    71	        context.auth = context.auth || {}
-    72	        context.auth.multihome_id = multihomeId
-    73	
-    74	        log.debug('Multihome ID extracted', {
-    75	          multihome_id: multihomeId,
-    76	          source: request.headers?.host
-    77	        })
-    78	      } else if (vars.multihome.requireAuth) {
-    79	        log.warn('No multihome ID found in request', {
-    80	          host: request.headers?.host,
-    81	          headers: Object.keys(request.headers || {})
-    82	        })
-    83	      }
-    84	    })
-    85	
-    86	    // Validate that resources have multihome field when added
-    87	    addHook('scope:added', 'validate-multihome-field', {}, ({ context, vars }) => {
-    88	      const { scopeName, scopeOptions } = context
-    89	
-    90	      // Skip excluded resources
-    91	      if (vars.multihome.excludeResources.includes(scopeName)) {
-    92	        log.debug(`Resource ${scopeName} excluded from multihome validation`)
-    93	        return
-    94	      }
-    95	
-    96	      // Check if schema has multihome field
-    97	      const schema = scopeOptions.schema
-    98	      if (schema && !schema[vars.multihome.field]) {
-    99	        if (vars.multihome.allowMissing) {
-   100	          log.warn(`Resource ${scopeName} missing ${vars.multihome.field} field - multihome filtering disabled for this 
-   101	  resource`)
-   102	        } else {
-   103	          throw new Error(
-   104	              `Resource '${scopeName}' must have '${vars.multihome.field}' field in schema for multi-tenancy`
-   105	          )
-   106	        }
-   107	      }
-   108	    })
-   109	
-   110	    // Main filtering hook - adds WHERE clause to all queries
-   111	    log.debug('Registering multihome filter hook')
-   112	    addHook('knexQueryFiltering', 'multihome-filter', {}, async ({ context, vars }) => {
-   113	      // Get query info from context
-   114	      const { query, tableName, scopeName } = context.knexQuery
-   115	
-   116	      // Skip excluded resources first
-   117	      if (vars.multihome.excludeResources.includes(scopeName)) {
-   118	        log.trace(`Skipping multihome filter for excluded resource: ${scopeName}`)
-   119	        return
-   120	      }
-   121	
-   122	      // Skip if no multihome context
-   123	      if (!context.auth?.multihome_id) {
-   124	        if (vars.multihome.requireAuth) {
-   125	          throw new Error('No multihome context available - cannot execute query')
-   126	        }
-   127	        return
-   128	      }
-   129	
-   130	      log.debug('Applying multihome tenant filter', {
-   131	        scopeName,
-   132	        tableName,
-   133	        tenant: context.auth.multihome_id,
-   134	      })
-   135	
-   136	      // Check if this resource has multihome field
-   137	      const scope = scopes[scopeName]
-   138	      const hasMultihomeField = scope?.vars?.schemaInfo?.schemaStructure?.[vars.multihome.field]
-   139	
-   140	      if (!hasMultihomeField) {
-   141	        if (vars.multihome.allowMissing) {
-   142	          log.trace(`Resource ${scopeName} has no ${vars.multihome.field} field - skipping filter`)
-   143	          return
-   144	        } else {
-   145	          throw new Error(`Resource ${scopeName} missing required ${vars.multihome.field} field`)
-   146	        }
-   147	      }
-   148	
-   149	      const storageAdapter = resolveStorageAdapter(scopeName, context)
-   150	      if (storageAdapter && !context.storageAdapter) {
-   151	        context.storageAdapter = storageAdapter
-   152	      }
-   153	
-   154	      const columnRef = translateColumnReference({
-   155	        field: vars.multihome.field,
-   156	        tableName,
-   157	        scopeName,
-   158	        hookContext: context,
-   159	      })
-   160	
-   161	      const tenantValue = translateFilterValue({
-   162	        field: vars.multihome.field,
-   163	        value: context.auth.multihome_id,
-   164	        scopeName,
-   165	        hookContext: context,
-   166	      })
-   167	
-   168	      if (tenantValue === null) {
-   169	        query.whereNull(columnRef)
-   170	      } else {
-   171	        query.where(columnRef, tenantValue)
-   172	      }
-   173	
-   174	      log.trace('Added multihome filter', {
-   175	        scopeName,
-   176	        tableName,
-   177	        multihome_id: context.auth.multihome_id
-   178	      })
-   179	    })
-   180	
-   181	    // Set multihome_id on new records
-   182	    addHook('beforeSchemaValidate', 'set-multihome-id', {}, async ({ context, scopeName, vars }) => {
-   183	      // Skip excluded resources first
-   184	      if (vars.multihome.excludeResources.includes(scopeName)) {
-   185	        return
-   186	      }
-   187	
-   188	      // Skip if no multihome context
-   189	      if (!context.auth?.multihome_id) {
-   190	        if (vars.multihome.requireAuth) {
-   191	          throw new Error('Cannot create record without multihome context')
-   192	        }
-   193	        return
-   194	      }
-   195	
-   196	      // Check if this resource has multihome field
-   197	      const scope = scopes[scopeName]
-   198	      const hasMultihomeField = scope?.vars?.schemaInfo?.schemaStructure?.[vars.multihome.field]
-   199	
-   200	      if (!hasMultihomeField) {
-   201	        if (!vars.multihome.allowMissing) {
-   202	          throw new Error(`Resource ${scopeName} missing required ${vars.multihome.field} field`)
-   203	        }
-   204	        return
-   205	      }
-   206	
-   207	      // For POST, always set multihome_id
-   208	      if (context.method === 'post') {
-   209	        context.inputRecord.data.attributes = context.inputRecord.data.attributes || {}
-   210	        context.inputRecord.data.attributes[vars.multihome.field] = context.auth.multihome_id
-   211	
-   212	        log.debug('Set multihome_id on new record', {
-   213	          scopeName,
-   214	          multihome_id: context.auth.multihome_id
-   215	        })
-   216	      }
-   217	
-   218	      // For PUT/PATCH, validate multihome_id if provided
-   219	      if ((context.method === 'put' || context.method === 'patch') &&
-   220	            context.inputRecord.data.attributes?.[vars.multihome.field]) {
-   221	        const providedId = context.inputRecord.data.attributes[vars.multihome.field]
-   222	        if (providedId !== context.auth.multihome_id) {
-   223	          throw new Error(
-   224	              `Cannot set ${vars.multihome.field} to '${providedId}' - must match current context '${context.auth.multihome_id}'`
-   225	          )
-   226	        }
-   227	      }
-   228	    })
-   229	
-   230	    // Add checkPermissions hook to enforce tenant isolation
-   231	    // This is the single source of truth for single-record access control
-   232	    addHook('checkPermissions', 'multihome-check-permissions', {}, async ({ context, scopeName }) => {
-   233	      // Extract the needed values from originalContext
-   234	      const auth = context.originalContext?.auth
-   235	      const minimalRecord = context.originalContext?.minimalRecord
-   236	      const id = context.originalContext?.id
-   237	
-   238	      // Skip excluded resources
-   239	      if (vars.multihome.excludeResources.includes(scopeName)) {
-   240	        return
-   241	      }
-   242	
-   243	      // Skip if no multihome context
-   244	      if (!auth?.multihome_id) {
-   245	        if (vars.multihome.requireAuth) {
-   246	          throw new Error('No multihome context available')
-   247	        }
-   248	        return
-   249	      }
-   250	
-   251	      // Get the scope to check if it has multihome field
-   252	      const scope = scopes[scopeName]
-   253	      const hasMultihomeField = scope?.vars?.schemaInfo?.schemaStructure?.[vars.multihome.field]
-   254	
-   255	      if (!hasMultihomeField) {
-   256	        return // Resource doesn't support multihome
-   257	      }
-   258	
-   259	      // For operations on existing records, verify tenant ownership
-   260	      if (minimalRecord) {
-   261	        // minimalRecord is in JSON:API format, so tenant_id is in attributes
-   262	        const recordTenant = minimalRecord.attributes?.[vars.multihome.field]
-   263	        const userTenant = auth.multihome_id
-   264	
-   265	        if (recordTenant !== userTenant) {
-   266	          log.error('Multihome permission violation', {
-   267	            scopeName,
-   268	            recordId: id,
-   269	            recordTenant,
-   270	            userTenant,
-   271	            method: context.method
-   272	          })
-   273	
-   274	          // Return 404 for GET to prevent information leakage
-   275	          // Return 403 for other operations
-   276	          if (context.method === 'get') {
-   277	            const error = new Error('Resource not found')
-   278	            error.code = 'REST_API_RESOURCE'
-   279	            throw error
-   280	          } else {
-   281	            const error = new Error('Access denied - insufficient permissions')
-   282	            error.code = 'REST_API_FORBIDDEN'
-   283	            throw error
-   284	          }
-   285	        }
-   286	      }
-   287	    })
-   288	
-   289	    // Note: PUT, PATCH, and DELETE operations will fail naturally if the record
-   290	    // doesn't exist due to tenant filtering in the GET operation that precedes them
-   291	
-   292	    // Add API method to get current multihome context
-   293	    api.multihome = {
-   294	      getCurrentTenant: () => {
-   295	        // This would need to be called within a request context
-   296	        // Real implementation would need access to current request context
-   297	        return null
-   298	      },
-   299	
-   300	      // Runtime configuration helper (for debugging/testing)
-   301	      getConfig: () => ({
-   302	        ...vars.multihome,
-   303	        hasCustomExtractor: helpers.extractMultihomeId !== defaultSubdomainExtractor
-   304	      })
-   305	    }
-   306	
-   307	    log.info('MultiHome plugin installed', {
-   308	      field: vars.multihome.field,
-   309	      excludedResources: vars.multihome.excludeResources,
-   310	      requireAuth: vars.multihome.requireAuth,
-   311	      hasCustomExtractor: helpers.extractMultihomeId !== defaultSubdomainExtractor
-   312	    })
-   313	  }
-   314	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-hooks__compile-resource-schemas.js.txt

@@ -1,7 +0,0 @@
-     1	import { compileSchemas } from '../lib/querying-writing/compile-schemas.js'
-     2	
-     3	export default async function compileResourceSchemas ({ context, scopes, runHooks }) {
-     4	  const scope = scopes[context.scopeName]
-     5	  // Pass scopeOptions and vars from context since scope object structure is different
-     6	  return compileSchemas({ ...scope, scopeOptions: context.scopeOptions, vars: context.vars }, { context: { scopeName: context.scopeName }, runHooks })
-     7	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-hooks__register-relationship-routes.js.txt

@@ -1,71 +0,0 @@
-     1	import { parseJsonApiQuery } from '../lib/querying-writing/connectors-query-parser.js'
-     2	
-     3	export default async function registerRelationshipRoutes ({ context, api, log }) {
-     4	  const { scopeName } = context
-     5	  const basePath = api.scopes[scopeName].vars.transport?.mountPath || ''
-     6	  const scopePath = `${basePath}/${scopeName}`
-     7	
-     8	  // Helper to create route handlers
-     9	  const createRouteHandler = (methodName) => {
-    10	    return async ({ params, body, queryString }) => {
-    11	      const scope = api.scopes[scopeName]
-    12	
-    13	      const methodParams = {
-    14	        id: params.id,
-    15	        relationshipName: params.relationshipName,
-    16	        isTransport: true
-    17	      }
-    18	
-    19	      // Add query params for getRelated
-    20	      if (methodName === 'getRelated' && queryString) {
-    21	        methodParams.queryParams = parseJsonApiQuery(queryString)
-    22	      }
-    23	
-    24	      // Add body data for write operations
-    25	      if (body && body.data !== undefined) {
-    26	        methodParams.relationshipData = body.data
-    27	      }
-    28	
-    29	      return await scope[methodName](methodParams)
-    30	    }
-    31	  }
-    32	
-    33	  // Register relationship routes
-    34	
-    35	  // GET /api/{scope}/{id}/relationships/{relationshipName}
-    36	  await api.addRoute({
-    37	    method: 'GET',
-    38	    path: `${scopePath}/:id/relationships/:relationshipName`,
-    39	    handler: createRouteHandler('getRelationship')
-    40	  })
-    41	
-    42	  // GET /api/{scope}/{id}/{relationshipName}
-    43	  await api.addRoute({
-    44	    method: 'GET',
-    45	    path: `${scopePath}/:id/:relationshipName`,
-    46	    handler: createRouteHandler('getRelated')
-    47	  })
-    48	
-    49	  // POST /api/{scope}/{id}/relationships/{relationshipName}
-    50	  await api.addRoute({
-    51	    method: 'POST',
-    52	    path: `${scopePath}/:id/relationships/:relationshipName`,
-    53	    handler: createRouteHandler('postRelationship')
-    54	  })
-    55	
-    56	  // PATCH /api/{scope}/{id}/relationships/{relationshipName}
-    57	  await api.addRoute({
-    58	    method: 'PATCH',
-    59	    path: `${scopePath}/:id/relationships/:relationshipName`,
-    60	    handler: createRouteHandler('patchRelationship')
-    61	  })
-    62	
-    63	  // DELETE /api/{scope}/{id}/relationships/{relationshipName}
-    64	  await api.addRoute({
-    65	    method: 'DELETE',
-    66	    path: `${scopePath}/:id/relationships/:relationshipName`,
-    67	    handler: createRouteHandler('deleteRelationship')
-    68	  })
-    69	
-    70	  log.trace(`Registered relationship routes for scope: ${scopeName}`)
-    71	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-hooks__register-scope-routes.js.txt

@@ -1,102 +0,0 @@
-     1	import { RestApiResourceError } from '../../../lib/rest-api-errors.js'
-     2	import { parseJsonApiQuery } from '../lib/querying-writing/connectors-query-parser.js'
-     3	
-     4	export default async function registerScopeRoutes ({ context, api, vars, log }) {
-     5	  const { scopeName } = context
-     6	  const basePath = vars.transport?.mountPath || ''
-     7	
-     8	  // Helper to create route handlers
-     9	  const createRouteHandler = (scopeName, methodName) => {
-    10	    return async ({ queryString, headers, params, body, context }) => {
-    11	      const scope = api.scopes[scopeName]
-    12	      if (!scope) {
-    13	        throw new RestApiResourceError(
-    14	          `Scope '${scopeName}' not found`,
-    15	          {
-    16	            subtype: 'not_found',
-    17	            resourceType: 'scope',
-    18	            resourceId: scopeName
-    19	          }
-    20	        )
-    21	      }
-    22	
-    23	      // Build parameters for the scope method
-    24	      const methodParams = {}
-    25	
-    26	      // Add ID for single-resource operations
-    27	      if (['get', 'put', 'patch', 'delete'].includes(methodName)) {
-    28	        methodParams.id = params.id
-    29	      }
-    30	
-    31	      // Parse query parameters for read operations
-    32	      if (['query', 'get'].includes(methodName)) {
-    33	        methodParams.queryParams = parseJsonApiQuery(queryString)
-    34	        methodParams.isTransport = true
-    35	      }
-    36	
-    37	      // Add body for write operations
-    38	      if (['post', 'put', 'patch'].includes(methodName)) {
-    39	        methodParams.inputRecord = body
-    40	        methodParams.isTransport = true
-    41	
-    42	        // Add query params for includes/fields on write operations
-    43	        if (queryString) {
-    44	          methodParams.queryParams = parseJsonApiQuery(queryString)
-    45	        }
-    46	      }
-    47	
-    48	      // Call the scope method
-    49	      const result = await scope[methodName](methodParams, context)
-    50	
-    51	      // Return the result (transport plugin handles response formatting)
-    52	      return result
-    53	    }
-    54	  }
-    55	
-    56	  const scopePath = `${basePath}/${scopeName}`
-    57	
-    58	  // Register routes for each HTTP method
-    59	  // GET /api/{scope} - Query collection
-    60	  await api.addRoute({
-    61	    method: 'GET',
-    62	    path: scopePath,
-    63	    handler: createRouteHandler(scopeName, 'query')
-    64	  })
-    65	
-    66	  // GET /api/{scope}/{id} - Get single resource
-    67	  await api.addRoute({
-    68	    method: 'GET',
-    69	    path: `${scopePath}/:id`,
-    70	    handler: createRouteHandler(scopeName, 'get')
-    71	  })
-    72	
-    73	  // POST /api/{scope} - Create resource
-    74	  await api.addRoute({
-    75	    method: 'POST',
-    76	    path: scopePath,
-    77	    handler: createRouteHandler(scopeName, 'post')
-    78	  })
-    79	
-    80	  // PUT /api/{scope}/{id} - Replace resource
-    81	  await api.addRoute({
-    82	    method: 'PUT',
-    83	    path: `${scopePath}/:id`,
-    84	    handler: createRouteHandler(scopeName, 'put')
-    85	  })
-    86	
-    87	  // PATCH /api/{scope}/{id} - Update resource
-    88	  await api.addRoute({
-    89	    method: 'PATCH',
-    90	    path: `${scopePath}/:id`,
-    91	    handler: createRouteHandler(scopeName, 'patch')
-    92	  })
-    93	
-    94	  // DELETE /api/{scope}/{id} - Delete resource
-    95	  await api.addRoute({
-    96	    method: 'DELETE',
-    97	    path: `${scopePath}/:id`,
-    98	    handler: createRouteHandler(scopeName, 'delete')
-    99	  })
-   100	
-   101	  log.info(`Routes registered for scope '${scopeName}'`)
-   102	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-hooks__turn-scope-init-into-vars.js.txt

@@ -1,49 +0,0 @@
-     1	export default async function turnScopeInitIntoVars ({ context, scopes, vars: apiVars }) {
-     2	  // Refer to the scope's vars
-     3	  const scope = scopes[context.scopeName]
-     4	  const scopeOptions = scope?.scopeOptions || context.scopeOptions || {}
-     5	  const vars = scope?.vars || apiVars
-     6	
-     7	  // The scope-specific ones
-     8	  vars.sortableFields = scopeOptions.sortableFields || []
-     9	  vars.defaultSort = scopeOptions.defaultSort || null
-    10	
-    11	  // The general ones that are also set at api level, but overrideable
-    12	  if (typeof scopeOptions.queryDefaultLimit !== 'undefined') vars.queryDefaultLimit = scopeOptions.queryDefaultLimit
-    13	  if (typeof scopeOptions.queryMaxLimit !== 'undefined') vars.queryMaxLimit = scopeOptions.queryMaxLimit
-    14	  if (typeof scopeOptions.includeDepthLimit !== 'undefined') vars.includeDepthLimit = scopeOptions.includeDepthLimit
-    15	  if (typeof scopeOptions.enablePaginationCounts !== 'undefined') vars.enablePaginationCounts = scopeOptions.enablePaginationCounts
-    16	
-    17	  // Set simplified settings as scope vars
-    18	  if (typeof scopeOptions.simplifiedApi !== 'undefined') vars.simplifiedApi = scopeOptions.simplifiedApi
-    19	  if (typeof scopeOptions.simplifiedTransport !== 'undefined') vars.simplifiedTransport = scopeOptions.simplifiedTransport
-    20	
-    21	  // Set returnRecord settings as scope vars
-    22	  if (typeof scopeOptions.returnRecordApi !== 'undefined') vars.returnRecordApi = scopeOptions.returnRecordApi
-    23	  if (typeof scopeOptions.returnRecordTransport !== 'undefined') vars.returnRecordTransport = scopeOptions.returnRecordTransport
-    24	
-    25	  // Set idProperty as scope var
-    26	  if (typeof scopeOptions.idProperty !== 'undefined') vars.idProperty = scopeOptions.idProperty
-    27	
-    28	  // Add validation for query limits
-    29	  if (vars.queryDefaultLimit && vars.queryMaxLimit) {
-    30	    if (vars.queryDefaultLimit > vars.queryMaxLimit) {
-    31	      throw new Error(
-    32	        `Invalid scope '${context.scopeName}' configuration: ` +
-    33	        `queryDefaultLimit (${vars.queryDefaultLimit}) cannot exceed queryMaxLimit (${vars.queryMaxLimit})`
-    34	      )
-    35	    }
-    36	  }
-    37	
-    38	  // Validate relationship include limits at scope creation time
-    39	  Object.entries(scopeOptions.relationships || {}).forEach(([relName, relDef]) => {
-    40	    if (relDef.include?.limit && vars.queryMaxLimit) {
-    41	      if (relDef.include.limit > vars.queryMaxLimit) {
-    42	        throw new Error(
-    43	          `Invalid relationship '${context.scopeName}.${relName}' configuration: ` +
-    44	          `include.limit (${relDef.include.limit}) cannot exceed queryMaxLimit (${vars.queryMaxLimit})`
-    45	        )
-    46	      }
-    47	    }
-    48	  })
-    49	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-hooks__validate-include-configurations.js.txt

@@ -1,39 +0,0 @@
-     1	export default async function validateIncludeConfigurations ({ context, scopes, log }) {
-     2	  const { scopeName } = context
-     3	  const scope = scopes[scopeName]
-     4	  const relationships = scope.vars.schemaInfo?.schemaRelationships
-     5	
-     6	  if (!relationships) return
-     7	
-     8	  // Check each relationship for include configuration
-     9	  for (const [relName, relDef] of Object.entries(relationships)) {
-    10	    if (relDef.include?.strategy === 'window') {
-    11	      // This relationship requires window functions
-    12	      // We'll validate this at query time since the database might not be connected yet
-    13	      log.debug(`Relationship ${scopeName}.${relName} configured for window function includes`)
-    14	    }
-    15	
-    16	    // Validate include configuration
-    17	    if (relDef.include?.limit) {
-    18	      if (typeof relDef.include.limit !== 'number') {
-    19	        throw new Error(
-    20	          `Invalid include limit for ${scopeName}.${relName}: limit must be a number`
-    21	        )
-    22	      }
-    23	      // Check against queryMaxLimit if available
-    24	      const maxLimit = scope.vars?.queryMaxLimit
-    25	      if (maxLimit && relDef.include.limit > maxLimit) {
-    26	        throw new Error(
-    27	          `Invalid include limit for ${scopeName}.${relName}: ` +
-    28	          `limit (${relDef.include.limit}) exceeds queryMaxLimit (${maxLimit})`
-    29	        )
-    30	      }
-    31	    }
-    32	
-    33	    if (relDef.include?.orderBy && !Array.isArray(relDef.include.orderBy)) {
-    34	      throw new Error(
-    35	        `Invalid include orderBy for ${scopeName}.${relName}: orderBy must be an array`
-    36	      )
-    37	    }
-    38	  }
-    39	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-methods__add-route.js.txt

@@ -1,23 +0,0 @@
-     1	import { ValidationError } from 'hooked-api'
-     2	
-     3	/**
-     4	 * addRoute
-     5	 * Registers a new route with the transport layer
-     6	 */
-     7	export default async ({ params, context, runHooks }) => {
-     8	  const { method, path, handler } = params
-     9	
-    10	  // Validate route configuration
-    11	  if (!method || !path || !handler) {
-    12	    throw new ValidationError('Route requires method, path, and handler')
-    13	  }
-    14	
-    15	  // debugger
-    16	  // Create context for enrichAttributes hooks
-    17	  Object.assign(context, params)
-    18	
-    19	  // Run the addRoute hook to notify transport plugins
-    20	  await runHooks('addRoute')
-    21	
-    22	  return { registered: true, method, path }
-    23	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-methods__check-permissions.js.txt

@@ -1,13 +0,0 @@
-     1	/**
-     2	 * checkPermissions
-     3	 * Check if ther are permissions to access a resource.
-     4	 *
-     5	 */
-     6	export default async function checkPermissionsMethod ({ context, params, runHooks, scopeName, scopes, helpers }) {
-     7	  Object.assign(context, {
-     8	    method: params.method,
-     9	    originalContext: params.originalContext,
-    10	  })
-    11	
-    12	  await runHooks('checkPermissions')
-    13	}