json-rest-api 1.0.22 → 1.0.23

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-methods__delete-relationship.js.txt

@@ -1,117 +0,0 @@
-     1	import { RestApiResourceError, RestApiValidationError, RestApiPayloadError } from '../../../lib/rest-api-errors.js'
-     2	import { findRelationshipDefinition, handleWriteMethodError } from './common.js'
-     3	
-     4	/**
-     5	 * DELETE RELATIONSHIP
-     6	 * Removes specific members from a to-many relationship
-     7	 * DELETE /api/articles/1/relationships/tags
-     8	 *
-     9	 * @param {string} id - The ID of the resource
-    10	 * @param {string} relationshipName - The name of the relationship
-    11	 * @param {array} relationshipData - Array of resource identifiers to remove
-    12	 * @returns {Promise<void>} 204 No Content
-    13	 */
-    14	export default async function deleteRelationshipMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeName, api, log }) {
-    15	  context.method = 'deleteRelationship'
-    16	  context.id = params.id
-    17	  context.relationshipName = params.relationshipName
-    18	  context.schemaInfo = scopes[scopeName].vars.schemaInfo
-    19	
-    20	  // Transaction handling
-    21	  context.transaction = params.transaction ||
-    22	    (helpers.newTransaction && !params.transaction ? await helpers.newTransaction() : null)
-    23	  context.shouldCommit = !params.transaction && !!context.transaction
-    24	  context.db = context.transaction || api.knex.instance
-    25	
-    26	  try {
-    27	    // Validate
-    28	    const relDef = findRelationshipDefinition(context.schemaInfo, context.relationshipName)
-    29	    if (!relDef) {
-    30	      throw new RestApiResourceError(
-    31	        `Relationship '${context.relationshipName}' not found on resource '${scopeName}'`,
-    32	        { subtype: 'relationship_not_found' }
-    33	      )
-    34	    }
-    35	
-    36	    if (relDef.type !== 'hasMany' && relDef.type !== 'manyToMany') {
-    37	      throw new RestApiValidationError(
-    38	        `Cannot DELETE from to-one relationship '${context.relationshipName}'`,
-    39	        { fields: ['data'] }
-    40	      )
-    41	    }
-    42	
-    43	    if (!Array.isArray(params.relationshipData)) {
-    44	      throw new RestApiPayloadError('DELETE from relationship requires array of resource identifiers')
-    45	    }
-    46	
-    47	    // Check permissions
-    48	    await runHooks('checkPermissions')
-    49	    await runHooks('checkPermissionsDeleteRelationship')
-    50	
-    51	    // Verify parent exists
-    52	    const exists = await helpers.dataExists({
-    53	      scopeName,
-    54	      context: { db: context.db, id: context.id, schemaInfo: context.schemaInfo }
-    55	    })
-    56	
-    57	    if (!exists) {
-    58	      throw new RestApiResourceError('Resource not found', { subtype: 'not_found' })
-    59	    }
-    60	
-    61	    // Remove relationships
-    62	    if (relDef?.through) {
-    63	      if (api.anyapi?.links?.removeMany) {
-    64	        await api.anyapi.links.removeMany({
-    65	          context,
-    66	          scopeName,
-    67	          relName: context.relationshipName,
-    68	          relDef,
-    69	          relData: params.relationshipData,
-    70	        })
-    71	      } else {
-    72	        const knex = api.knex?.instance || helpers.db
-    73	        const pivotResource = relDef.through
-    74	        const pivotScope = api.resources[pivotResource]
-    75	        const pivotTable = pivotScope?.vars?.schemaInfo?.tableName || pivotResource
-    76	        const localKey = relDef.foreignKey
-    77	        const foreignKey = relDef.otherKey
-    78	
-    79	        for (const identifier of params.relationshipData) {
-    80	          await knex(pivotTable)
-    81	            .where(localKey, context.id)
-    82	            .where(foreignKey, identifier.id)
-    83	            .delete()
-    84	            .transacting(context.transaction)
-    85	        }
-    86	      }
-    87	    } else {
-    88	      // Null out foreign keys for hasMany
-    89	      const targetType = relDef.target
-    90	      for (const identifier of params.relationshipData) {
-    91	        await api.resources[targetType].patch({
-    92	          id: identifier.id,
-    93	          inputRecord: {
-    94	            data: {
-    95	              type: targetType,
-    96	              id: identifier.id,
-    97	              attributes: { [relDef.foreignKey]: null }
-    98	            }
-    99	          },
-   100	          transaction: context.transaction,
-   101	          simplified: false
-   102	        })
-   103	      }
-   104	    }
-   105	
-   106	    await runHooks('finish')
-   107	    await runHooks('finishDeleteRelationship')
-   108	
-   109	    if (context.shouldCommit) {
-   110	      await context.transaction.commit()
-   111	    }
-   112	
-   113	    // 204 No Content
-   114	  } catch (error) {
-   115	    await handleWriteMethodError(error, context, 'DELETE_RELATIONSHIP', scopeName, log, runHooks)
-   116	  }
-   117	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-methods__delete.js.txt

@@ -1,104 +0,0 @@
-     1	import { RestApiResourceError } from '../../../lib/rest-api-errors.js'
-     2	import { handleWriteMethodError } from './common.js'
-     3	
-     4	/**
-     5	 * DELETE
-     6	 * Permanently deletes a resource.
-     7	 * Returns 204 No Content on success, indicating the resource has been removed.
-     8	 * This method does not return the deleted resource.
-     9	 */
-    10	export default async function deleteMethod ({
-    11	  params,
-    12	  context,
-    13	  vars,
-    14	  helpers,
-    15	  scope,
-    16	  scopes,
-    17	  runHooks,
-    18	  apiOptions,
-    19	  pluginOptions,
-    20	  scopeOptions,
-    21	  scopeName,
-    22	  api,
-    23	  log
-    24	}) {
-    25	  // Make the method available to all hooks
-    26	  context.method = 'delete'
-    27	
-    28	  // Set the ID in context
-    29	  context.id = params.id
-    30	
-    31	  // Set scopeName in context (needed for broadcasting)
-    32	  context.scopeName = scopeName
-    33	
-    34	  // Set schema info even for DELETE (needed by storage layer)
-    35	  context.schemaInfo = scopes[scopeName].vars.schemaInfo
-    36	
-    37	  // Transaction handling
-    38	  context.transaction = params.transaction ||
-    39	      (helpers.newTransaction && !params.transaction ? await helpers.newTransaction() : null)
-    40	  context.shouldCommit = !params.transaction && !!context.transaction
-    41	  context.db = context.transaction || api.knex.instance
-    42	
-    43	  try {
-    44	    // No payload validation needed for DELETE
-    45	
-    46	    // Fetch minimal record for authorization and logging
-    47	    const minimalRecord = await helpers.dataGetMinimal({
-    48	      scopeName,
-    49	      context,
-    50	      runHooks
-    51	    })
-    52	
-    53	    if (!minimalRecord) {
-    54	      throw new RestApiResourceError(
-    55	        'Resource not found',
-    56	        {
-    57	          subtype: 'not_found',
-    58	          resourceType: scopeName,
-    59	          resourceId: context.id
-    60	        }
-    61	      )
-    62	    }
-    63	
-    64	    context.originalMinimalRecord = minimalRecord
-    65	    context.minimalRecord = minimalRecord
-    66	
-    67	    // Centralised checkPermissions function
-    68	    await scope.checkPermissions({
-    69	      method: 'delete',
-    70	      originalContext: context,
-    71	    })
-    72	
-    73	    // Before data operations
-    74	    await runHooks('beforeDataCall')
-    75	    await runHooks('beforeDataCallDelete')
-    76	
-    77	    // Initialize record context for hooks
-    78	    context.record = {}
-    79	
-    80	    // Call the storage helper
-    81	    await helpers.dataDelete({
-    82	      scopeName,
-    83	      context
-    84	    })
-    85	
-    86	    await runHooks('afterDataCallDelete')
-    87	    await runHooks('afterDataCall')
-    88	
-    89	    // No return record for DELETE (204 No Content)
-    90	
-    91	    await runHooks('finish')
-    92	    await runHooks('finishDelete')
-    93	
-    94	    // Commit transaction if we created it
-    95	    if (context.shouldCommit) {
-    96	      await context.transaction.commit()
-    97	      await runHooks('afterCommit')
-    98	    }
-    99	
-   100	    // DELETE typically returns void/undefined (204 No Content)
-   101	  } catch (error) {
-   102	    await handleWriteMethodError(error, context, 'DELETE', scopeName, log, runHooks)
-   103	  }
-   104	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-methods__enrich-attributes.js.txt

@@ -1,199 +0,0 @@
-     1	import { filterHiddenFields } from '../lib/querying-writing/field-utils.js'
-     2	
-     3	/**
-     4	 * enrichAttributes
-     5	 * Runs the enrichAttributes hook for a specific scope to allow plugins to modify attributes
-     6	 * before they are returned to the client. This is a scope method so each resource type
-     7	 * can have its own attribute enrichment logic.
-     8	 *
-     9	 *
-    10	 */
-    11	export default async function enrichAttributesMethod ({ context, params, runHooks, scopeName, scopes, api, helpers }) {
-    12	  // Extract parameters passed to enrichAttributes
-    13	  // - attributes: The raw attributes from database
-    14	  // - parentContext: The context from the calling method (has queryParams, transaction, etc.)
-    15	  // - requestedComputedFields: Which computed fields to calculate (from sparse fieldsets)
-    16	  // - isMainResource: Whether this is the main resource or an included one
-    17	  // - computedDependencies: Fields fetched only for computation (to be removed)
-    18	  // Extract parameters passed to enrichAttributes
-    19	  // - attributes: The raw attributes from database
-    20	  // - parentContext: The context from the calling method (has queryParams, transaction, etc.)
-    21	  // - requestedComputedFields: Which computed fields to calculate (from sparse fieldsets)
-    22	  // - isMainResource: Whether this is the main resource or an included one
-    23	  // - computedDependencies: Fields fetched only for computation (to be removed)
-    24	  const { attributes, parentContext, requestedComputedFields, isMainResource, computedDependencies } = params || {}
-    25	
-    26	  // Return empty object if no attributes provided
-    27	  if (!attributes) {
-    28	    return {}
-    29	  }
-    30	
-    31	  // Get schema, computed field definitions
-    32	  const schemaStructure = scopes[scopeName]?.vars?.schemaInfo?.schemaStructure || {}
-    33	  const computedFields = scopes[scopeName]?.vars?.schemaInfo?.computed || {}
-    34	  const fieldGetters = scopes[scopeName]?.vars?.schemaInfo?.fieldGetters || {}
-    35	  const sortedGetterFields = scopes[scopeName]?.vars?.schemaInfo?.sortedGetterFields || []
-    36	
-    37	  // Make a copy of attributes for transformation
-    38	  const transformedAttributes = { ...attributes }
-    39	
-    40	  // STEP 1: Apply field getters in dependency order (before filtering)
-    41	  // This ensures getters see all fields including hidden ones
-    42	  for (const fieldName of sortedGetterFields) {
-    43	    // Only process if field exists in attributes
-    44	    if (fieldName in transformedAttributes) {
-    45	      const getterInfo = fieldGetters[fieldName]
-    46	      try {
-    47	        const getterContext = {
-    48	          attributes: transformedAttributes, // Current state with previous getters applied
-    49	          fieldName,
-    50	          originalValue: attributes[fieldName], // Original untransformed value
-    51	          originalAttributes: attributes, // All original attributes
-    52	          record: transformedAttributes, // Alias for compatibility
-    53	          parentContext,
-    54	          scopeName,
-    55	          api,
-    56	          helpers,
-    57	          isMainResource: isMainResource !== false
-    58	        }
-    59	
-    60	        // Apply getter (can be async)
-    61	        transformedAttributes[fieldName] = await getterInfo.getter(
-    62	          transformedAttributes[fieldName],
-    63	          getterContext
-    64	        )
-    65	      } catch (error) {
-    66	        console.error(`Error in getter for field '${fieldName}' in ${scopeName}:`, error)
-    67	        // Keep current value on error (don't break the whole request)
-    68	      }
-    69	    }
-    70	  }
-    71	
-    72	  // Filter hidden fields from attributes based on visibility rules
-    73	  // This removes hidden:true fields and normallyHidden:true fields (unless requested)
-    74	  const requestedFields = parentContext?.queryParams?.fields?.[scopeName]
-    75	  const filteredAttributes = filterHiddenFields(transformedAttributes, { structure: schemaStructure }, requestedFields)
-    76	
-    77	  // Handle virtual fields - they need to be added from parent context if available
-    78	  // Virtual fields come from input and need to be preserved in responses
-    79	  if (parentContext && parentContext.inputRecord?.data?.attributes) {
-    80	    const inputAttrs = parentContext.inputRecord.data.attributes
-    81	    Object.entries(schemaStructure).forEach(([fieldName, fieldDef]) => {
-    82	      if (fieldDef.virtual === true && fieldName in inputAttrs && inputAttrs[fieldName] !== undefined && inputAttrs[fieldName] !== null) {
-    83	        // Add virtual field to filtered attributes if not already there
-    84	        if (!(fieldName in filteredAttributes)) {
-    85	          filteredAttributes[fieldName] = inputAttrs[fieldName]
-    86	        }
-    87	      }
-    88	    })
-    89	  }
-    90	
-    91	  // Now handle sparse fieldsets for virtual fields
-    92	  if (requestedFields && requestedFields.length > 0) {
-    93	    const requestedFieldsList = typeof requestedFields === 'string'
-    94	      ? requestedFields.split(',').map(f => f.trim())
-    95	      : requestedFields
-    96	
-    97	    // Remove virtual fields that weren't requested
-    98	    Object.entries(schemaStructure).forEach(([fieldName, fieldDef]) => {
-    99	      if (fieldDef.virtual === true && fieldName in filteredAttributes) {
-   100	        if (!requestedFieldsList.includes(fieldName)) {
-   101	          delete filteredAttributes[fieldName]
-   102	        }
-   103	      }
-   104	    })
-   105	  }
-   106	
-   107	  // Determine which computed fields to calculate
-   108	  // We only compute fields that are requested to optimize performance
-   109	  let fieldsToCompute = []
-   110	  if (requestedComputedFields) {
-   111	    // Explicit list provided (from sparse fieldsets)
-   112	    // Example: ?fields[products]=name,profit_margin -> only compute profit_margin
-   113	    fieldsToCompute = requestedComputedFields
-   114	  } else if (isMainResource || !parentContext?.queryParams?.fields) {
-   115	    // No sparse fieldsets or this is the main resource - compute all fields
-   116	    // This ensures all computed fields are available when no filtering is applied
-   117	    fieldsToCompute = Object.keys(computedFields)
-   118	  }
-   119	
-   120	  // Create compute context with all available resources
-   121	  // IMPORTANT: We pass the TRANSFORMED attributes (after getters) to compute functions
-   122	  // This ensures computed fields see the getter-processed values
-   123	  // Example: if price getter converts string to number, profit_margin sees the number
-   124	  const computeContext = {
-   125	    attributes: transformedAttributes,   // Transformed attributes after getters
-   126	    record: { ...transformedAttributes }, // Full record for convenience
-   127	    context: parentContext,
-   128	    helpers,                             // API helpers for complex operations
-   129	    api,                                 // Full API instance
-   130	  }
-   131	
-   132	  // Auto-compute fields that have compute functions
-   133	  for (const fieldName of fieldsToCompute) {
-   134	    const fieldDef = computedFields[fieldName]
-   135	    if (fieldDef && fieldDef.compute) {
-   136	      try {
-   137	        // Call the compute function with full context
-   138	        // Example: profit_margin compute gets { attributes: { price: 100, cost: 60 } }
-   139	        // and returns: ((100 - 60) / 100 * 100) = "40.00"
-   140	        filteredAttributes[fieldName] = await fieldDef.compute(computeContext)
-   141	      } catch (error) {
-   142	        // Log error but don't fail the request - computed fields shouldn't break API
-   143	        console.error(`Error computing field '${fieldName}' for ${scopeName}:`, error)
-   144	        filteredAttributes[fieldName] = null
-   145	      }
-   146	    }
-   147	  }
-   148	
-   149	  // Remove fields that were only fetched as dependencies
-   150	  // This is the key to the dependency resolution feature:
-   151	  // 1. We fetched dependencies from DB (e.g., 'cost' for profit_margin)
-   152	  // 2. We used them in compute functions
-   153	  // 3. Now we remove them if they weren't explicitly requested
-   154	  // Example: User requests profit_margin, we fetch cost, compute, then remove cost
-   155	  const finalAttributes = { ...filteredAttributes }
-   156	  if (requestedFields && computedDependencies && computedDependencies.length > 0) {
-   157	    // Parse requested fields if it's a string
-   158	    const requested = typeof requestedFields === 'string'
-   159	      ? requestedFields.split(',').map(f => f.trim()).filter(f => f)
-   160	      : requestedFields
-   161	
-   162	    for (const dep of computedDependencies) {
-   163	      // Only remove if it wasn't explicitly requested
-   164	      // Example: 'cost' is removed unless user explicitly asked for it
-   165	      if (!requested.includes(dep)) {
-   166	        delete finalAttributes[dep]
-   167	      }
-   168	    }
-   169	  }
-   170	
-   171	  if (requestedFields && requestedFields.length > 0) {
-   172	    const requestedList = typeof requestedFields === 'string'
-   173	      ? requestedFields.split(',').map((field) => field.trim()).filter((field) => field)
-   174	      : requestedFields
-   175	    const allowed = new Set(requestedList)
-   176	    Object.keys(finalAttributes).forEach((key) => {
-   177	      if (!allowed.has(key)) {
-   178	        delete finalAttributes[key]
-   179	      }
-   180	    })
-   181	  }
-   182	
-   183	  // Create context for enrichAttributes hooks
-   184	  Object.assign(context, {
-   185	    parentContext,
-   186	    attributes: finalAttributes,  // Use the final attributes after dependency removal
-   187	    computedFields,
-   188	    requestedComputedFields: fieldsToCompute,
-   189	    scopeName,
-   190	    helpers,
-   191	    api
-   192	  })
-   193	
-   194	  // Run enrichAttributes hooks for additional/override computations
-   195	  await runHooks('enrichAttributes')
-   196	
-   197	  // Return the attributes from context, which hooks may have modified
-   198	  return context.attributes
-   199	};