json-rest-api 1.0.22 → 1.0.23

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-methods__patch.js.txt

@@ -1,191 +0,0 @@
-     1	import { RestApiResourceError } from '../../../lib/rest-api-errors.js'
-     2	import { validatePatchPayload } from '../lib/querying-writing/payload-validators.js'
-     3	import { processRelationships } from '../lib/writing/relationship-processor.js'
-     4	import { updateManyToManyRelationship } from '../lib/writing/many-to-many-manipulations.js'
-     5	import { ERROR_SUBTYPES } from '../lib/querying-writing/knex-constants.js'
-     6	import {
-     7	  setupCommonRequest,
-     8	  validateResourceAttributesBeforeWrite,
-     9	  validateRelationshipAccess,
-    10	  applyFieldSetters,
-    11	  validatePivotResource,
-    12	  handleRecordReturnAfterWrite,
-    13	  handleWriteMethodError
-    14	} from './common.js'
-    15	
-    16	/**
-    17	 * PATCH
-    18	 * Performs a partial update on an existing resource's attributes or relationships.
-    19	 * Unlike PUT, PATCH only updates the fields provided, leaving other fields unchanged.
-    20	 * This method supports updating both attributes and relationships (1:1 and n:n).
-    21	 * For relationships, only the ones explicitly provided will be updated.
-    22	 * Just like PUT, it CANNOT have the `included` array in data.
-    23	 */
-    24	export default async function patchMethod ({
-    25	  params,
-    26	  context,
-    27	  vars,
-    28	  helpers,
-    29	  scope,
-    30	  scopes,
-    31	  runHooks,
-    32	  apiOptions,
-    33	  pluginOptions,
-    34	  scopeOptions,
-    35	  scopeName,
-    36	  api,
-    37	  log
-    38	}) {
-    39	  context.method = 'patch'
-    40	
-    41	  try {
-    42	    const { schema, schemaStructure, schemaRelationships } = await setupCommonRequest({
-    43	      params,
-    44	      context,
-    45	      vars,
-    46	      scopes,
-    47	      scopeOptions,
-    48	      scopeName,
-    49	      api,
-    50	      helpers
-    51	    })
-    52	    context.id = context.inputRecord.data.id
-    53	
-    54	    // Run early hooks for pre-processing (e.g., file handling)
-    55	    await runHooks('beforeProcessing')
-    56	    await runHooks('beforeProcessingPatch')
-    57	
-    58	    // Validate PATCH payload to ensure the partial update actually contains changes.
-    59	    // PATCH requests must include either attributes to update or relationships to modify -
-    60	    // an empty PATCH is invalid. This prevents accidental no-op requests and ensures clients
-    61	    // are explicit about what they want to change. Unlike PUT, PATCH preserves all fields
-    62	    // not mentioned in the request.
-    63	    // Example: data must have either attributes: {title: 'New'} or relationships: {author: {...}}
-    64	    validatePatchPayload(context.inputRecord, scopes)
-    65	
-    66	    // Validate that user has read access to all related resources
-    67	    // This ensures users can only create relationships to resources they can access
-    68	    await validateRelationshipAccess(context, context.inputRecord, helpers, runHooks, api)
-    69	
-    70	    // Extract foreign keys from JSON:API relationships and prepare many-to-many operations
-    71	    // Example: relationships.author -> author_id: '123' for storage
-    72	    // Example: relationships.tags -> array of pivot records to create later (only for provided relationships in PATCH)
-    73	    const { belongsToUpdates, manyToManyRelationships } = processRelationships(
-    74	      scope,
-    75	      { context }
-    76	    )
-    77	
-    78	    await validateResourceAttributesBeforeWrite({
-    79	      context,
-    80	      schema,
-    81	      belongsToUpdates,
-    82	      runHooks,
-    83	      isPartialValidation: true
-    84	    })
-    85	
-    86	    // Fetch minimal record for authorization checks
-    87	    const minimalRecord = await helpers.dataGetMinimal({
-    88	      scopeName,
-    89	      context,
-    90	      runHooks
-    91	    })
-    92	
-    93	    if (!minimalRecord) {
-    94	      throw new RestApiResourceError(
-    95	        `Resource not found: ${scopeName}/${context.id}`,
-    96	        ERROR_SUBTYPES.NOT_FOUND
-    97	      )
-    98	    }
-    99	
-   100	    context.minimalRecord = minimalRecord
-   101	
-   102	    // Centralised checkPermissions function
-   103	    await scope.checkPermissions({
-   104	      method: 'patch',
-   105	      originalContext: context,
-   106	    })
-   107	
-   108	    // Merge belongsTo updates into attributes before patching the record
-   109	    if (Object.keys(belongsToUpdates).length > 0) {
-   110	      context.inputRecord.data.attributes = {
-   111	        ...context.inputRecord.data.attributes,
-   112	        ...belongsToUpdates
-   113	      }
-   114	    }
-   115	
-   116	    await runHooks('beforeDataCall')
-   117	    await runHooks('beforeDataCallPatch')
-   118	
-   119	    // Apply field setters after validation and before storage
-   120	    if (context.inputRecord?.data?.attributes) {
-   121	      context.inputRecord.data.attributes = await applyFieldSetters(
-   122	        context.inputRecord.data.attributes,
-   123	        context.schemaInfo,
-   124	        context,
-   125	        api,
-   126	        helpers
-   127	      )
-   128	    }
-   129	
-   130	    // Call the storage helper - should return the patched record
-   131	    await helpers.dataPatch({
-   132	      scopeName,
-   133	      context
-   134	    })
-   135	
-   136	    await runHooks('afterDataCallPatch')
-   137	    await runHooks('afterDataCall')
-   138	
-   139	    // Process many-to-many relationships after main record update
-   140	    // For PATCH, we only update the relationships that were explicitly provided
-   141	    for (const { relName, relDef, relData } of manyToManyRelationships) {
-   142	      if (relDef?.through && api.anyapi?.links?.syncMany) {
-   143	        await api.anyapi.links.syncMany({
-   144	          context,
-   145	          scopeName,
-   146	          relName,
-   147	          relDef,
-   148	          relData,
-   149	          isUpdate: true,
-   150	        })
-   151	        continue
-   152	      }
-   153	
-   154	      validatePivotResource(scopes, relDef, relName)
-   155	
-   156	      await updateManyToManyRelationship(null, {
-   157	        api,
-   158	        context: {
-   159	          resourceId: context.id,
-   160	          relDef,
-   161	          relData,
-   162	          transaction: context.transaction
-   163	        }
-   164	      })
-   165	    }
-   166	
-   167	    const ret = await handleRecordReturnAfterWrite({
-   168	      context,
-   169	      scopeName,
-   170	      api,
-   171	      scopes,
-   172	      schemaStructure,
-   173	      schemaRelationships,
-   174	      scopeOptions,
-   175	      vars,
-   176	      runHooks,
-   177	      helpers,
-   178	      log
-   179	    })
-   180	
-   181	    // Commit transaction if we created it
-   182	    if (context.shouldCommit) {
-   183	      await context.transaction.commit()
-   184	      await runHooks('afterCommit')
-   185	    }
-   186	
-   187	    return ret
-   188	  } catch (error) {
-   189	    await handleWriteMethodError(error, context, 'PATCH', scopeName, log, runHooks)
-   190	  }
-   191	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-methods__post-relationship.js.txt

@@ -1,110 +0,0 @@
-     1	import { RestApiResourceError, RestApiValidationError, RestApiPayloadError } from '../../../lib/rest-api-errors.js'
-     2	import { findRelationshipDefinition, handleWriteMethodError } from './common.js'
-     3	import { createPivotRecords } from '../lib/writing/many-to-many-manipulations.js'
-     4	
-     5	/**
-     6	   * POST RELATIONSHIP
-     7	   * Adds members to a to-many relationship
-     8	   * POST /api/articles/1/relationships/tags
-     9	   *
-    10	   * @param {string} id - The ID of the resource
-    11	   * @param {string} relationshipName - The name of the relationship
-    12	   * @param {array} relationshipData - Array of resource identifiers to add
-    13	   * @returns {Promise<void>} 204 No Content
-    14	  */
-    15	export default async function postRelationshipMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeName, api, log }) {
-    16	  context.method = 'postRelationship'
-    17	  context.id = params.id
-    18	  context.relationshipName = params.relationshipName
-    19	  context.schemaInfo = scopes[scopeName].vars.schemaInfo
-    20	
-    21	  // Transaction handling
-    22	  context.transaction = params.transaction ||
-    23	  (helpers.newTransaction && !params.transaction ? await helpers.newTransaction() : null)
-    24	  context.shouldCommit = !params.transaction && !!context.transaction
-    25	
-    26	  context.db = context.transaction || api.knex.instance
-    27	
-    28	  try {
-    29	  // Validate
-    30	    const relDef = findRelationshipDefinition(context.schemaInfo, context.relationshipName)
-    31	    if (!relDef) {
-    32	      throw new RestApiResourceError(
-    33	      `Relationship '${context.relationshipName}' not found on resource '${scopeName}'`,
-    34	      { subtype: 'relationship_not_found' }
-    35	      )
-    36	    }
-    37	
-    38	    if (relDef.type !== 'hasMany' && relDef.type !== 'manyToMany') {
-    39	      throw new RestApiValidationError(
-    40	      `Cannot POST to to-one relationship '${context.relationshipName}'. Use PATCH instead.`,
-    41	      { fields: ['data'] }
-    42	      )
-    43	    }
-    44	
-    45	    if (!Array.isArray(params.relationshipData)) {
-    46	      throw new RestApiPayloadError('POST to relationship requires array of resource identifiers')
-    47	    }
-    48	
-    49	    // Check permissions
-    50	    await runHooks('checkPermissions')
-    51	    await runHooks('checkPermissionsPostRelationship')
-    52	
-    53	    // Verify parent exists
-    54	    const exists = await helpers.dataExists({
-    55	      scopeName,
-    56	      context: { db: context.db, id: context.id, schemaInfo: context.schemaInfo },
-    57	    })
-    58	
-    59	    if (!exists) {
-    60	      throw new RestApiResourceError('Resource not found', { subtype: 'not_found' })
-    61	    }
-    62	
-    63	    // Add relationships
-    64	    if (relDef?.through) {
-    65	      if (api.anyapi?.links?.attachMany) {
-    66	        await api.anyapi.links.attachMany({
-    67	          context,
-    68	          scopeName,
-    69	          relName: context.relationshipName,
-    70	          relDef,
-    71	          relData: params.relationshipData,
-    72	        })
-    73	      } else {
-    74	        await createPivotRecords(api, context.id, {
-    75	          through: relDef.through,
-    76	          foreignKey: relDef.foreignKey,
-    77	          otherKey: relDef.otherKey
-    78	        }, params.relationshipData, context.transaction)
-    79	      }
-    80	    } else if (relDef.type === 'hasMany') {
-    81	      // Update foreign keys for hasMany
-    82	      const targetType = relDef.target
-    83	      for (const identifier of params.relationshipData) {
-    84	        await api.resources[targetType].patch({
-    85	          id: identifier.id,
-    86	          inputRecord: {
-    87	            data: {
-    88	              type: targetType,
-    89	              id: identifier.id,
-    90	              attributes: { [relDef.foreignKey]: context.id }
-    91	            }
-    92	          },
-    93	          transaction: context.transaction,
-    94	          simplified: false
-    95	        })
-    96	      }
-    97	    }
-    98	
-    99	    await runHooks('finish')
-   100	    await runHooks('finishPostRelationship')
-   101	
-   102	    if (context.shouldCommit) {
-   103	      await context.transaction.commit()
-   104	    }
-   105	
-   106	    // 204 No Content
-   107	  } catch (error) {
-   108	    await handleWriteMethodError(error, context, 'POST_RELATIONSHIP', scopeName, log, runHooks)
-   109	  }
-   110	};

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-methods__post.js.txt

@@ -1,168 +0,0 @@
-     1	import { validatePostPayload } from '../lib/querying-writing/payload-validators.js'
-     2	import { processRelationships } from '../lib/writing/relationship-processor.js'
-     3	import { createPivotRecords } from '../lib/writing/many-to-many-manipulations.js'
-     4	import {
-     5	  setupCommonRequest,
-     6	  validateResourceAttributesBeforeWrite,
-     7	  validateRelationshipAccess,
-     8	  applyFieldSetters,
-     9	  validatePivotResource,
-    10	  handleRecordReturnAfterWrite,
-    11	  handleWriteMethodError
-    12	} from './common.js'
-    13	
-    14	/**
-    15	 * POST
-    16	 * Creates a new resource. The request must include a JSON:API document with a 'data' object
-    17	 * containing 'type' and 'attributes'. It can also establish relationships to existing resources.
-    18	 * The returned document contains the created resource with its server-assigned ID.
-    19	 */
-    20	export default async function postMethod ({
-    21	  params,
-    22	  context,
-    23	  vars,
-    24	  helpers,
-    25	  scope,
-    26	  scopes,
-    27	  runHooks,
-    28	  apiOptions,
-    29	  pluginOptions,
-    30	  scopeOptions,
-    31	  scopeName,
-    32	  api,
-    33	  log
-    34	}) {
-    35	  context.method = 'post'
-    36	
-    37	  try {
-    38	    const { schema, schemaStructure, schemaRelationships } = await setupCommonRequest({
-    39	      params,
-    40	      context,
-    41	      vars,
-    42	      scopes,
-    43	      scopeOptions,
-    44	      scopeName,
-    45	      api,
-    46	      helpers
-    47	    })
-    48	
-    49	    // Run early hooks for pre-processing (e.g., file handling)
-    50	    await runHooks('beforeProcessing')
-    51	    await runHooks('beforeProcessingPost')
-    52	
-    53	    // Validate POST payload to ensure it follows JSON:API format and references valid resources.
-    54	    // This checks the payload has required 'data' object with 'type' and 'attributes', validates
-    55	    // that data.type matches a real resource type (preventing creation of non-existent resources),
-    56	    // and ensures any relationships reference valid resource types with proper ID format.
-    57	    // Example: data.type: 'articles' must be a registered scope, relationships.author must reference 'users'.
-    58	    validatePostPayload(context.inputRecord, scopes)
-    59	
-    60	    // Validate that user has read access to all related resources
-    61	    // This ensures users can only create relationships to resources they can access
-    62	    await validateRelationshipAccess(context, context.inputRecord, helpers, runHooks, api)
-    63	
-    64	    // Extract foreign keys from JSON:API relationships and prepare many-to-many operations
-    65	    // Example: relationships.author -> author_id: '123' for storage
-    66	    // Example: relationships.tags -> array of pivot records to create later
-    67	    const { belongsToUpdates, manyToManyRelationships } = await processRelationships(
-    68	      scope,
-    69	      { context }
-    70	    )
-    71	
-    72	    // Merge belongsTo updates into attributes before validation (like PUT/PATCH do)
-    73	    if (Object.keys(belongsToUpdates).length > 0) {
-    74	      context.inputRecord.data.attributes = {
-    75	        ...context.inputRecord.data.attributes,
-    76	        ...belongsToUpdates
-    77	      }
-    78	    }
-    79	
-    80	    await validateResourceAttributesBeforeWrite({
-    81	      context,
-    82	      schema,
-    83	      belongsToUpdates,
-    84	      runHooks
-    85	    })
-    86	
-    87	    if (context.inputRecord?.data) {
-    88	      const inputData = context.inputRecord.data
-    89	      context.minimalRecord = {
-    90	        type: scopeName,
-    91	        ...(inputData.id !== undefined && inputData.id !== null ? { id: String(inputData.id) } : {}),
-    92	        attributes: structuredClone(inputData.attributes || {}),
-    93	        relationships: structuredClone(inputData.relationships || {})
-    94	      }
-    95	    }
-    96	
-    97	    // Centralised checkPermissions function
-    98	    await scope.checkPermissions({
-    99	      method: 'post',
-   100	      originalContext: context,
-   101	    })
-   102	
-   103	    await runHooks('beforeDataCall')
-   104	    await runHooks('beforeDataCallPost')
-   105	
-   106	    // Apply field setters after validation and before storage
-   107	    if (context.inputRecord?.data?.attributes) {
-   108	      context.inputRecord.data.attributes = await applyFieldSetters(
-   109	        context.inputRecord.data.attributes,
-   110	        context.schemaInfo,
-   111	        context,
-   112	        api,
-   113	        helpers
-   114	      )
-   115	    }
-   116	
-   117	    // Create the main record - storage helper should return the created record with its ID
-   118	    context.id = await helpers.dataPost({
-   119	      scopeName,
-   120	      context
-   121	    })
-   122	
-   123	    await runHooks('afterDataCallPost')
-   124	    await runHooks('afterDataCall')
-   125	
-   126	    // Process many-to-many relationships after main record creation
-   127	    for (const { relName, relDef, relData } of manyToManyRelationships) {
-   128	      if (api.anyapi?.links?.attachMany && relDef?.through) {
-   129	        await api.anyapi.links.attachMany({
-   130	          context,
-   131	          scopeName,
-   132	          relName,
-   133	          relDef,
-   134	          relData,
-   135	        })
-   136	        continue
-   137	      }
-   138	
-   139	      // Validate pivot resource exists
-   140	      validatePivotResource(scopes, relDef, relName)
-   141	      await createPivotRecords(api, context.id, relDef, relData, context.transaction)
-   142	    }
-   143	
-   144	    const ret = await handleRecordReturnAfterWrite({
-   145	      context,
-   146	      scopeName,
-   147	      api,
-   148	      scopes,
-   149	      schemaStructure,
-   150	      schemaRelationships,
-   151	      scopeOptions,
-   152	      vars,
-   153	      runHooks,
-   154	      helpers,
-   155	      log
-   156	    })
-   157	
-   158	    // Commit transaction if we created it
-   159	    if (context.shouldCommit) {
-   160	      await context.transaction.commit()
-   161	      await runHooks('afterCommit')
-   162	    }
-   163	
-   164	    return ret
-   165	  } catch (error) {
-   166	    await handleWriteMethodError(error, context, 'POST', scopeName, log, runHooks)
-   167	  }
-   168	}