json-rest-api 1.0.22 → 1.0.23

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-methods__put.js.txt

@@ -1,253 +0,0 @@
-     1	import { RestApiResourceError } from '../../../lib/rest-api-errors.js'
-     2	import { validatePutPayload } from '../lib/querying-writing/payload-validators.js'
-     3	import { processRelationships } from '../lib/writing/relationship-processor.js'
-     4	import { updateManyToManyRelationship, createPivotRecords } from '../lib/writing/many-to-many-manipulations.js'
-     5	import { ERROR_SUBTYPES } from '../lib/querying-writing/knex-constants.js'
-     6	import {
-     7	  setupCommonRequest,
-     8	  validateResourceAttributesBeforeWrite,
-     9	  validateRelationshipAccess,
-    10	  applyFieldSetters,
-    11	  validatePivotResource,
-    12	  handleRecordReturnAfterWrite,
-    13	  handleWriteMethodError
-    14	} from './common.js'
-    15	
-    16	/**
-    17	 * PUT
-    18	 * Updates an existing top-level resource by completely replacing it.
-    19	 * This method supports updating both attributes and relationships (1:1 and n:n).
-    20	 * PUT is a complete replacement - any relationships not provided will be removed/nulled.
-    21	 * This method does NOT support creating new related resources via an `included` array.
-    22	 */
-    23	export default async function putMethod ({
-    24	  params,
-    25	  context,
-    26	  vars,
-    27	  helpers,
-    28	  scope,
-    29	  scopes,
-    30	  runHooks,
-    31	  apiOptions,
-    32	  pluginOptions,
-    33	  scopeOptions,
-    34	  scopeName,
-    35	  api,
-    36	  log
-    37	}) {
-    38	  context.method = 'put'
-    39	
-    40	  try {
-    41	    const { schema, schemaStructure, schemaRelationships } = await setupCommonRequest({
-    42	      params,
-    43	      context,
-    44	      vars,
-    45	      scopes,
-    46	      scopeOptions,
-    47	      scopeName,
-    48	      api,
-    49	      helpers
-    50	    })
-    51	    context.id = context.inputRecord.data.id
-    52	
-    53	    // Run early hooks for pre-processing (e.g., file handling)
-    54	    await runHooks('beforeProcessing')
-    55	    await runHooks('beforeProcessingPut')
-    56	
-    57	    // Validate PUT payload to ensure it's a complete resource replacement operation.
-    58	    // PUT requires the full resource representation including ID (unlike POST which generates ID).
-    59	    // It validates that data.id matches the URL parameter, prevents 'included' array (which is
-    60	    // read-only), and ensures the payload represents a complete replacement. Any fields not
-    61	    // provided will be removed or reset to defaults - this is the key difference from PATCH.
-    62	    // Example: PUT to /articles/123 must have data.id: '123' and all required fields.
-    63	    validatePutPayload(context.inputRecord, scopes)
-    64	
-    65	    // Validate that user has read access to all related resources
-    66	    // This ensures users can only create relationships to resources they can access
-    67	    await validateRelationshipAccess(context, context.inputRecord, helpers, runHooks, api)
-    68	
-    69	    // Extract foreign keys from JSON:API relationships and prepare many-to-many operations
-    70	    // Example: relationships.author -> author_id: '123' for storage
-    71	    // Example: relationships.tags -> array of pivot records to create later
-    72	    const { belongsToUpdates, manyToManyRelationships } = processRelationships(
-    73	      scope,
-    74	      { context }
-    75	    )
-    76	
-    77	    await validateResourceAttributesBeforeWrite({
-    78	      context,
-    79	      schema,
-    80	      belongsToUpdates,
-    81	      runHooks
-    82	    })
-    83	
-    84	    // Check existence first
-    85	    context.exists = await helpers.dataExists({
-    86	      scopeName,
-    87	      context
-    88	    })
-    89	
-    90	    context.isCreate = !context.exists
-    91	    context.isUpdate = context.exists
-    92	
-    93	    // Fetch minimal record for authorization checks (only for updates)
-    94	    if (context.isUpdate) {
-    95	      const minimalRecord = await helpers.dataGetMinimal({
-    96	        scopeName,
-    97	        context,
-    98	        runHooks
-    99	      })
-   100	
-   101	      if (!minimalRecord) {
-   102	        throw new RestApiResourceError(
-   103	          `Resource not found: ${scopeName}/${context.id}`,
-   104	          ERROR_SUBTYPES.NOT_FOUND
-   105	        )
-   106	      }
-   107	
-   108	      context.minimalRecord = minimalRecord
-   109	    }
-   110	
-   111	    // For PUT, we also need to handle relationships that are NOT provided
-   112	    // (they should be set to null/empty as PUT is a complete replacement)
-   113	    const allRelationships = {}
-   114	
-   115	    // Collect all defined relationships for this resource
-   116	    for (const [relName, relDef] of Object.entries(schemaRelationships || {})) {
-   117	      if (relDef.type === 'manyToMany') {
-   118	        allRelationships[relName] = {
-   119	          type: 'manyToMany',
-   120	          relDef: {
-   121	            through: relDef.through,
-   122	            foreignKey: relDef.foreignKey,
-   123	            otherKey: relDef.otherKey
-   124	          }
-   125	        }
-   126	      }
-   127	    }
-   128	
-   129	    // Also check schema fields for belongsTo relationships
-   130	    for (const [fieldName, fieldDef] of Object.entries(schemaStructure)) {
-   131	      if (fieldDef.as && fieldDef.belongsTo) {
-   132	        allRelationships[fieldDef.as] = {
-   133	          type: 'belongsTo',
-   134	          fieldName,
-   135	          fieldDef
-   136	        }
-   137	      }
-   138	    }
-   139	
-   140	    // Process missing relationships (PUT should null them out only if relationships object exists)
-   141	    const hasRelationshipsObject = context.inputRecord.data.relationships !== undefined
-   142	    const providedRelationships = new Set(Object.keys(context.inputRecord.data.relationships || {}))
-   143	
-   144	    // Only null out missing relationships if a relationships object was provided
-   145	    if (hasRelationshipsObject) {
-   146	      for (const [relName, relInfo] of Object.entries(allRelationships)) {
-   147	        if (!providedRelationships.has(relName)) {
-   148	          if (relInfo.type === 'belongsTo') {
-   149	            belongsToUpdates[relInfo.fieldName] = null
-   150	          } else if (relInfo.type === 'manyToMany') {
-   151	            // Add to manyToManyRelationships with empty array
-   152	            manyToManyRelationships.push({
-   153	              relName,
-   154	              relDef: relInfo.relDef,
-   155	              relData: []  // Empty array means delete all
-   156	            })
-   157	          }
-   158	        }
-   159	      }
-   160	    }
-   161	
-   162	    // Merge belongsTo updates with attributes
-   163	    if (Object.keys(belongsToUpdates).length > 0) {
-   164	      context.inputRecord.data.attributes = {
-   165	        ...context.inputRecord.data.attributes,
-   166	        ...belongsToUpdates
-   167	      }
-   168	    }
-   169	
-   170	    // Centralised checkPermissions function
-   171	    await scope.checkPermissions({
-   172	      method: 'put',
-   173	      originalContext: context,
-   174	    })
-   175	
-   176	    await runHooks('beforeDataCall')
-   177	    await runHooks('beforeDataCallPut')
-   178	
-   179	    // Apply field setters after validation and before storage
-   180	    if (context.inputRecord?.data?.attributes) {
-   181	      context.inputRecord.data.attributes = await applyFieldSetters(
-   182	        context.inputRecord.data.attributes,
-   183	        context.schemaInfo,
-   184	        context,
-   185	        api,
-   186	        helpers
-   187	      )
-   188	    }
-   189	
-   190	    // Pass the operation type to the helper
-   191	    await helpers.dataPut({
-   192	      scopeName,
-   193	      context
-   194	    })
-   195	    await runHooks('afterDataCallPut')
-   196	    await runHooks('afterDataCall')
-   197	
-   198	    // Process many-to-many relationships after main record update/creation
-   199	    for (const { relName, relDef, relData } of manyToManyRelationships) {
-   200	      if (relDef?.through && api.anyapi?.links?.syncMany) {
-   201	        await api.anyapi.links.syncMany({
-   202	          context,
-   203	          scopeName,
-   204	          relName,
-   205	          relDef,
-   206	          relData,
-   207	          isUpdate: context.isUpdate,
-   208	        })
-   209	        continue
-   210	      }
-   211	
-   212	      await validatePivotResource(scopes, relDef, relName)
-   213	
-   214	      if (context.isUpdate) {
-   215	        await updateManyToManyRelationship(null, {
-   216	          api,
-   217	          context: {
-   218	            resourceId: context.id,
-   219	            relDef,
-   220	            relData,
-   221	            transaction: context.transaction
-   222	          }
-   223	        })
-   224	      } else if (relData.length > 0) {
-   225	        await createPivotRecords(api, context.id, relDef, relData, context.transaction)
-   226	      }
-   227	    }
-   228	
-   229	    const ret = await handleRecordReturnAfterWrite({
-   230	      context,
-   231	      scopeName,
-   232	      api,
-   233	      scopes,
-   234	      schemaStructure,
-   235	      schemaRelationships,
-   236	      scopeOptions,
-   237	      vars,
-   238	      runHooks,
-   239	      helpers,
-   240	      log
-   241	    })
-   242	
-   243	    // Commit transaction if we created it
-   244	    if (context.shouldCommit) {
-   245	      await context.transaction.commit()
-   246	      await runHooks('afterCommit')
-   247	    }
-   248	
-   249	    return ret
-   250	  } catch (error) {
-   251	    await handleWriteMethodError(error, context, 'PUT', scopeName, log, runHooks)
-   252	  }
-   253	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-methods__query.js.txt

@@ -1,207 +0,0 @@
-     1	import { RestApiValidationError } from '../../../lib/rest-api-errors.js'
-     2	import { validateQueryPayload } from '../lib/querying-writing/payload-validators.js'
-     3	import { normalizeRecordAttributes } from '../lib/querying-writing/database-value-normalizers.js'
-     4	import { getRequestedComputedFields } from '../lib/querying-writing/knex-field-helpers.js'
-     5	import { transformJsonApiToSimplified } from '../lib/querying-writing/simplified-helpers.js'
-     6	import { cascadeConfig } from './common.js'
-     7	
-     8	/**
-     9	 * QUERY
-    10	 * Retrieves a collection of resources (e.g., a list of articles) based on provided criteria.
-    11	 * This function sends a GET request to /api/{resourceType}.
-    12	 *
-    13	 * @param {string} resourceType - The type of resource collection to fetch (e.g., "articles").
-    14	 * @param {object} [queryParams={}] - Optional. An object to customize the query for the collection.
-    15	 * @param {string[]} [queryParams.include=[]] - An optional array of relationship paths to sideload for each resource in the collection. These paths will be converted to a comma-separated string for the URL (e.g., `['author', 'comments.user']` becomes `author,comments.user`). Supports deep relationships (e.g., "publisher.country").
-    16	 * @param {object} [queryParams.fields] - An object to request only specific fields (sparse fieldsets) for each resource in the collection and its included relationships. Keys are resource types, values are comma-separated field names.
-    17	 * @param {object} [queryParams.filters] - An object to filter the collection. Keys are filter parameters (specific to your API's implementation, e.g., 'status', 'title'), values are the filter criteria.
-    18	 * @param {string[]} [queryParams.sort=[]] - An optional array of fields to sort the collection by. Each string represents a field; prefix with '-' for descending order (e.g., `['title', '-published-date']` becomes `title,-published-date`).
-    19	 * @param {object} [queryParams.page] - An object for pagination. Typically includes `number` (page number) and `size` (items per page). E.g., `{ number: 1, size: 10 }`.
-    20	 * @returns {Promise<object>} A Promise that resolves to the JSON:API response document containing the resource collection.
-    21	 */
-    22	export default async function queryMethod ({
-    23	  params,
-    24	  context,
-    25	  vars,
-    26	  helpers,
-    27	  scope,
-    28	  scopes,
-    29	  runHooks,
-    30	  apiOptions,
-    31	  pluginOptions,
-    32	  scopeOptions,
-    33	  scopeName,
-    34	  log,
-    35	  api
-    36	}) {
-    37	  context.method = 'query'
-    38	
-    39	  // Determine which simplified setting to use based on transport
-    40	  const isTransport = params.isTransport === true
-    41	
-    42	  // Use vars which automatically cascade from scope to global
-    43	  const defaultSimplified = isTransport ? vars.simplifiedTransport : vars.simplifiedApi
-    44	
-    45	  // Get simplified setting - from params only (per-call override) or use default
-    46	  context.simplified = params.simplified !== undefined ? params.simplified : defaultSimplified
-    47	
-    48	  // Assign common context properties
-    49	  context.schemaInfo = scopes[scopeName].vars.schemaInfo // This is the object variable created by compileSchemas
-    50	  context.queryParams = params.queryParams || {}
-    51	
-    52	  // These only make sense as parameter per query
-    53	  context.queryParams.fields = cascadeConfig('fields', [params.queryParams], {})
-    54	  context.queryParams.include = cascadeConfig('include', [params.queryParams], [])
-    55	  context.queryParams.sort = cascadeConfig('sort', [params.queryParams], [])
-    56	  context.queryParams.page = cascadeConfig('page', [params.queryParams], {})
-    57	
-    58	  context.transaction = params.transaction
-    59	  context.db = context.transaction || api.knex.instance
-    60	
-    61	  context.scopeName = scopeName
-    62	
-    63	  // These are just shortcuts used in this function and will be returned
-    64	  const searchSchema = context.schemaInfo.searchSchemaInstance
-    65	  const schemaStructure = context.schemaInfo.schemaInstance.structure
-    66	  const schemaRelationships = context.schemaInfo.schemaRelationships
-    67	
-    68	  // Sortable fields and sort (mab)
-    69	  context.sortableFields = vars.sortableFields
-    70	  // Apply default sort if no sort specified
-    71	  if (context.queryParams.sort.length === 0 && vars.defaultSort) {
-    72	    context.queryParams.sort = Array.isArray(vars.defaultSort) ? vars.defaultSort : [vars.defaultSort]
-    73	  }
-    74	
-    75	  // Validate query parameters to ensure they follow JSON:API specification and security rules.
-    76	  // This checks that filters are valid field names, sort fields exist in sortableFields array
-    77	  // (preventing SQL injection), pagination uses valid page[size]/page[number] format, and include
-    78	  // paths reference real relationships. Example: sort: ['-createdAt', 'title'] is checked against
-    79	  // sortableFields to ensure users can't sort by sensitive fields like 'password_hash'.
-    80	  validateQueryPayload({ queryParams: context.queryParams }, context.sortableFields, vars.includeDepthLimit)
-    81	
-    82	  // Validate search/filter parameters against searchSchema
-    83	  if (context.queryParams.filters && Object.keys(context.queryParams.filters).length > 0) {
-    84	    // Only allow filtering if searchSchema is defined
-    85	    if (!searchSchema) {
-    86	      throw new RestApiValidationError(
-    87	        `Filtering is not enabled for resource '${scopeName}'. To enable filtering, add 'search: true' to schema fields or define a searchSchema.`,
-    88	        {
-    89	          fields: Object.keys(context.queryParams.filters).map(field => `filters.${field}`),
-    90	          violations: [{
-    91	            field: 'filters',
-    92	            rule: 'filtering_not_enabled',
-    93	            message: 'Resource does not have searchable fields defined'
-    94	          }]
-    95	        }
-    96	      )
-    97	    }
-    98	
-    99	    // Validate the filter parameters searchSchema
-   100	    const { validatedObject, errors } = await searchSchema.validate(context.queryParams.filters, {
-   101	      onlyObjectValues: true // Partial validation for filters
-   102	    })
-   103	
-   104	    // If there are validation errors, throw an error
-   105	    if (Object.keys(errors).length > 0) {
-   106	      const violations = Object.entries(errors).map(([field, error]) => ({
-   107	        field: `filters.${field}`,
-   108	        rule: error.code || 'invalid_value',
-   109	        message: error.message
-   110	      }))
-   111	
-   112	      throw new RestApiValidationError(
-   113	        'Invalid filter parameters',
-   114	        {
-   115	          fields: Object.keys(errors).map(field => `filters.${field}`),
-   116	          violations
-   117	        }
-   118	      )
-   119	    }
-   120	
-   121	    // Replace filter with validated/transformed values
-   122	    context.queryParams.filters = validatedObject
-   123	  }
-   124	
-   125	  // Centralised checkPermissions function
-   126	  await scope.checkPermissions({
-   127	    method: 'query',
-   128	    originalContext: context,
-   129	  })
-   130	
-   131	  await runHooks('beforeData')
-   132	  await runHooks('beforeDataQuery')
-   133	  context.record = await helpers.dataQuery({
-   134	    scopeName,
-   135	    context,
-   136	    runHooks
-   137	  })
-   138	
-   139	  // Normalize database values (e.g., convert 1/0 to true/false for booleans)
-   140	  context.record = normalizeRecordAttributes(context.record, scopes)
-   141	
-   142	  // Make a backup
-   143	  try {
-   144	    context.originalRecord = structuredClone(context.record)
-   145	  } catch (e) {
-   146	    log.error('Failed to clone record:', {
-   147	      error: e.message,
-   148	      recordKeys: Object.keys(context.record || {}),
-   149	      hasHttpRequest: !!context.raw?.req
-   150	    })
-   151	    throw e
-   152	  }
-   153	
-   154	  // This will enhance record, which is the WHOLE JSON:API record
-   155	  await runHooks('enrichRecord')
-   156	
-   157	  // Get computed field information for main resource
-   158	  const computedFields = scope.vars.schemaInfo?.computed || {}
-   159	  const requestedFields = context.queryParams.fields?.[scopeName]
-   160	  const requestedComputedFields = getRequestedComputedFields(scopeName, requestedFields, computedFields)
-   161	
-   162	  // Run enrichAttributes for every single set of attribute, calling it from the right scope
-   163	  for (const entry of context.record.data) {
-   164	    entry.attributes = await scope.enrichAttributes({
-   165	      attributes: entry.attributes,
-   166	      parentContext: context,
-   167	      requestedComputedFields,
-   168	      isMainResource: true,
-   169	      computedDependencies: context.computedDependencies
-   170	    })
-   171	  }
-   172	  for (const entry of (context.record.included || [])) {
-   173	    const entryScope = scopes[entry.type]
-   174	    const entryComputed = entryScope.vars.schemaInfo?.computed || {}
-   175	    const entryRequestedFields = context.queryParams.fields?.[entry.type]
-   176	    const entryRequestedComputed = getRequestedComputedFields(
-   177	      entry.type,
-   178	      entryRequestedFields,
-   179	      entryComputed
-   180	    )
-   181	
-   182	    entry.attributes = await entryScope.enrichAttributes({
-   183	      attributes: entry.attributes,
-   184	      parentContext: context,
-   185	      requestedComputedFields: entryRequestedComputed,
-   186	      isMainResource: false,
-   187	      computedDependencies: entry.__$jsonrestapi_computed_deps$__
-   188	    })
-   189	  }
-   190	
-   191	  // The called hooks should NOT change context.record
-   192	  await runHooks('finish')
-   193	  await runHooks('finishQuery')
-   194	
-   195	  // Transform output if in simplified mode
-   196	  if (context.simplified) {
-   197	    // Convert JSON:API response back to simplified format
-   198	    // Example: {data: {type: 'posts', id: '1', attributes: {title: 'My Post'}, relationships: {author: {data: {type: 'users', id: '123'}}}}}
-   199	    // becomes: {id: '1', title: 'My Post', author_id: '123'} - flattens structure and restores foreign keys
-   200	    return transformJsonApiToSimplified(
-   201	      { record: context.record },
-   202	      { context: { schemaStructure, schemaRelationships, scopes } }
-   203	    )
-   204	  }
-   205	
-   206	  return context.record
-   207	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin-methods__release.js.txt

@@ -1,12 +0,0 @@
-     1	import { ValidationError } from 'hooked-api'
-     2	
-     3	/**
-     4	 * release
-     5	 * Runs the hook that tells plugins to release resources
-     6	 */
-     7	export default async ({ runHooks }) => {
-     8	  // Run the addRoute hook to notify transport plugins
-     9	  await runHooks('release')
-    10	
-    11	  return { }
-    12	}

package/audit/evidence/code/critical-pass1/json-rest-api__plugins__core__rest-api-plugin.js.txt

@@ -1,165 +0,0 @@
-     1	import { validateRelationships } from './lib/querying-writing/scope-validations.js'
-     2	
-     3	// Import hook functions
-     4	import compileResourceSchemas from './rest-api-plugin-hooks/compile-resource-schemas.js'
-     5	import validateIncludeConfigurations from './rest-api-plugin-hooks/validate-include-configurations.js'
-     6	import turnScopeInitIntoVars from './rest-api-plugin-hooks/turn-scope-init-into-vars.js'
-     7	import registerScopeRoutes from './rest-api-plugin-hooks/register-scope-routes.js'
-     8	import registerRelationshipRoutes from './rest-api-plugin-hooks/register-relationship-routes.js'
-     9	
-    10	// Import method functions
-    11	import queryMethod from './rest-api-plugin-methods/query.js'
-    12	import getMethod from './rest-api-plugin-methods/get.js'
-    13	import postMethod from './rest-api-plugin-methods/post.js'
-    14	import putMethod from './rest-api-plugin-methods/put.js'
-    15	import patchMethod from './rest-api-plugin-methods/patch.js'
-    16	import deleteMethod from './rest-api-plugin-methods/delete.js'
-    17	import enrichAttributesMethod from './rest-api-plugin-methods/enrich-attributes.js'
-    18	import checkPermissionsMethod from './rest-api-plugin-methods/check-permissions.js'
-    19	import addRouteMethod from './rest-api-plugin-methods/add-route.js'
-    20	import releaseMethod from './rest-api-plugin-methods/release.js'
-    21	import { defaultDataHelpers } from './lib/querying-writing/default-data-helpers.js'
-    22	import { DEFAULT_QUERY_LIMIT, DEFAULT_MAX_QUERY_LIMIT, DEFAULT_INCLUDE_DEPTH_LIMIT } from './lib/querying-writing/knex-constants.js'
-    23	
-    24	import getRelatedMethod from './rest-api-plugin-methods/get-related.js'
-    25	import postRelationshipMethod from './rest-api-plugin-methods/post-relationship.js'
-    26	import getRelationshipMethod from './rest-api-plugin-methods/get-relationship.js'
-    27	import patchRelationshipMethod from './rest-api-plugin-methods/patch-relationship.js'
-    28	import deleteRelationshipMethod from './rest-api-plugin-methods/delete-relationship.js'
-    29	
-    30	export const RestApiPlugin = {
-    31	  name: 'rest-api',
-    32	
-    33	  install ({ helpers, addScopeMethod, addApiMethod, vars, addHook, runHooks, apiOptions, pluginOptions, api, setScopeAlias, scopes, log, on }) {
-    34	    // **************
-    35	    // Initial setup
-    36	    // **************
-    37	
-    38	    // Initialize the rest namespace for REST API functionality
-    39	    api.rest = {}
-    40	
-    41	    // Set up REST-friendly aliases
-    42	    setScopeAlias('resources', 'addResource')
-    43	
-    44	    // **********
-    45	    // Variables
-    46	    // **********
-    47	
-    48	    // Initialize default vars for the plugin from pluginOptions
-    49	    const restApiOptions = pluginOptions || {}
-    50	
-    51	    // These will be used as default fallbacks by the vars proxy if
-    52	    // they are not set in the scope options
-    53	    vars.queryDefaultLimit = restApiOptions.queryDefaultLimit || DEFAULT_QUERY_LIMIT
-    54	    vars.queryMaxLimit = restApiOptions.queryMaxLimit || DEFAULT_MAX_QUERY_LIMIT
-    55	    vars.includeDepthLimit = restApiOptions.includeDepthLimit || DEFAULT_INCLUDE_DEPTH_LIMIT
-    56	    vars.enablePaginationCounts = restApiOptions.enablePaginationCounts || true
-    57	
-    58	    // New simplified settings
-    59	    vars.simplifiedTransport = restApiOptions.simplifiedTransport !== undefined
-    60	      ? restApiOptions.simplifiedTransport
-    61	      : false // Default false for JSON:API compliance over the wire
-    62	
-    63	    vars.simplifiedApi = restApiOptions.simplifiedApi !== undefined
-    64	      ? restApiOptions.simplifiedApi
-    65	      : true // Default true for better DX in programmatic API
-    66	
-    67	    vars.idProperty = restApiOptions.idProperty || 'id'
-    68	
-    69	    // Return full record configuration for API and Transport
-    70	    // Support values: 'no', 'minimal', 'full'
-    71	    const normalizeReturnValue = (value, defaultValue) => {
-    72	      if (['no', 'minimal', 'full'].includes(value)) return value
-    73	      return defaultValue
-    74	    }
-    75	
-    76	    const optionConfigs = [
-    77	      {
-    78	        propName: 'returnRecordApi',
-    79	        defaultValue: 'full',
-    80	      },
-    81	      {
-    82	        propName: 'returnRecordTransport',
-    83	        defaultValue: 'no',
-    84	      },
-    85	    ]
-    86	
-    87	    for (const config of optionConfigs) {
-    88	      const optionValue = restApiOptions[config.propName]
-    89	      let processedValue
-    90	
-    91	      if (typeof optionValue === 'object' && optionValue !== null) {
-    92	        processedValue = {
-    93	          post: normalizeReturnValue(optionValue.post, config.defaultValue),
-    94	          put: normalizeReturnValue(optionValue.put, config.defaultValue),
-    95	          patch: normalizeReturnValue(optionValue.patch, config.defaultValue),
-    96	        }
-    97	      } else if (optionValue !== undefined) {
-    98	        const normalized = normalizeReturnValue(optionValue, config.defaultValue)
-    99	        processedValue = { post: normalized, put: normalized, patch: normalized }
-   100	      } else {
-   101	        processedValue = { post: config.defaultValue, put: config.defaultValue, patch: config.defaultValue }
-   102	      }
-   103	      vars[config.propName] = processedValue
-   104	    }
-   105	
-   106	    log.debug('returnRecordApi configuration:', vars.returnRecordApi)
-   107	    log.debug('returnRecordTransport configuration:', vars.returnRecordTransport)
-   108	
-   109	    // Schema cache vars
-   110	    vars.schemaProcessed = false
-   111	    vars.schema = null
-   112	
-   113	    // ******************************
-   114	    // Scope (resources) added hooks
-   115	    // ******************************
-   116	
-   117	    addHook('scope:added', 'validateRelationships', {}, validateRelationships)
-   118	    addHook('scope:added', 'compileResourceSchemas', {}, compileResourceSchemas)
-   119	    addHook('scope:added', 'validateIncludeConfigurations', {}, validateIncludeConfigurations)
-   120	    addHook('scope:added', 'turnScopeInitIntoVars', {}, turnScopeInitIntoVars)
-   121	
-   122	    // *********
-   123	    // Methods
-   124	    // *********
-   125	
-   126	    addApiMethod('addRoute', addRouteMethod)
-   127	
-   128	    addApiMethod('release', releaseMethod)
-   129	
-   130	    // Main REST methods
-   131	    addScopeMethod('query', queryMethod)
-   132	    addScopeMethod('get', getMethod)
-   133	    addScopeMethod('post', postMethod)
-   134	    addScopeMethod('put', putMethod)
-   135	    addScopeMethod('patch', patchMethod)
-   136	    addScopeMethod('delete', deleteMethod)
-   137	
-   138	    // Relationship methods
-   139	    addScopeMethod('getRelationship', getRelationshipMethod)
-   140	    addScopeMethod('getRelated', getRelatedMethod)
-   141	    addScopeMethod('postRelationship', postRelationshipMethod)
-   142	    addScopeMethod('patchRelationship', patchRelationshipMethod)
-   143	    addScopeMethod('deleteRelationship', deleteRelationshipMethod)
-   144	
-   145	    addHook('scope:added', 'registerRelationshipRoutes', {}, registerRelationshipRoutes)
-   146	    addHook('scope:added', 'registerScopeRoutes', {}, registerScopeRoutes)
-   147	
-   148	    // Non-URL methods
-   149	    addScopeMethod('enrichAttributes', enrichAttributesMethod)
-   150	    addScopeMethod('checkPermissions', checkPermissionsMethod)
-   151	
-   152	    // *********
-   153	    // Helpers
-   154	    // *********
-   155	
-   156	    // Initialize default data helpers that throw errors until a storage plugin is installed
-   157	    // These placeholders show storage plugin developers what methods to implement
-   158	    // Example: helpers.dataGet, helpers.dataPost, etc. will throw "No storage implementation" errors
-   159	    Object.assign(helpers, defaultDataHelpers)
-   160	
-   161	    // Add default getLocation helper for generating resource URLs
-   162	    // This can be overridden by storage plugins if needed
-   163	    helpers.getLocation = ({ scopeName, id }) => `/${scopeName}/${id}`
-   164	  }
-   165	}