json-rest-api 1.0.22 → 1.0.24

package/tests/http-connectors-parity.test.js

@@ -0,0 +1,235 @@
+import { describe, it, before, beforeEach, after } from 'node:test'
+import assert from 'node:assert/strict'
+import express from 'express'
+import request from 'supertest'
+import knexLib from 'knex'
+import { Api } from 'hooked-api'
+import {
+  RestApiPlugin,
+  RestApiKnexPlugin,
+  ExpressPlugin,
+  FastifyPlugin
+} from '../index.js'
+import { getUnsupportedMediaTypeErrorBody } from '../plugins/core/connectors/lib/transport-http-helpers.js'
+import { cleanTables, createJsonApiDocument } from './helpers/test-utils.js'
+import {
+  FakeFastifyApp,
+  invokeFastifyRoute
+} from './helpers/fake-fastify.js'
+
+const knex = knexLib({
+  client: 'better-sqlite3',
+  connection: {
+    filename: ':memory:'
+  },
+  useNullAsDefault: true
+})
+
+async function createConnectorParityApi () {
+  const expressApp = express()
+  const fastifyApp = new FakeFastifyApp()
+  const api = new Api({
+    name: 'connector-parity-test-api',
+    log: { level: process.env.LOG_LEVEL || 'silent' }
+  })
+
+  await api.use(RestApiPlugin, {
+    simplifiedApi: false,
+    simplifiedTransport: false,
+    returnRecordApi: {
+      post: true,
+      put: false,
+      patch: false
+    },
+    returnRecordTransport: {
+      post: 'full',
+      put: 'no',
+      patch: 'minimal'
+    },
+    sortableFields: ['id', 'name', 'code']
+  })
+
+  await api.use(RestApiKnexPlugin, { knex })
+  await api.use(ExpressPlugin, { mountPath: '/api' })
+  await api.use(FastifyPlugin, {
+    app: fastifyApp,
+    mountPath: '/api'
+  })
+
+  await api.customize({
+    hooks: {
+      'transport:request': {
+        functionName: 'connector-parity-rejector',
+        handler: async ({ context }) => {
+          if (context.transport?.request?.headers?.['x-block-request'] === 'yes') {
+            context.reject(401, 'Blocked by connector parity hook', {
+              title: 'Unauthorized'
+            })
+          }
+        }
+      },
+      'transport:response': {
+        functionName: 'connector-parity-header',
+        handler: async ({ context }) => {
+          context.transport.response.headers['x-connector-test'] = 'enabled'
+        }
+      }
+    }
+  })
+
+  await api.addResource('countries', {
+    schema: {
+      id: { type: 'id' },
+      name: { type: 'string', required: true, max: 100 },
+      code: { type: 'string', max: 2 }
+    },
+    tableName: 'connector_parity_countries'
+  })
+
+  await api.resources.countries.createKnexTable()
+  api.http.express.mount(expressApp)
+
+  return { api, expressApp, fastifyApp }
+}
+
+function assertLocationSuffix (location, resourceId) {
+  assert.ok(location, 'Expected Location header to be present')
+  assert.ok(
+    location.endsWith(`/api/countries/${resourceId}`) ||
+      location.endsWith(`/countries/${resourceId}`),
+    `Unexpected Location header: ${location}`
+  )
+}
+
+describe('HTTP Connector Parity', () => {
+  let api
+  let expressApp
+  let fastifyApp
+
+  before(async () => {
+    ({ api, expressApp, fastifyApp } = await createConnectorParityApi())
+  })
+
+  after(async () => {
+    await knex.destroy()
+  })
+
+  beforeEach(async () => {
+    await cleanTables(knex, ['connector_parity_countries'])
+  })
+
+  it('returns the same create semantics through Express and Fastify', async () => {
+    const expressDoc = createJsonApiDocument('countries', {
+      name: 'Express Country',
+      code: 'EC'
+    })
+    const fastifyDoc = createJsonApiDocument('countries', {
+      name: 'Fastify Country',
+      code: 'FC'
+    })
+
+    const expressResponse = await request(expressApp)
+      .post('/api/countries')
+      .set('Content-Type', 'application/vnd.api+json')
+      .set('Accept', 'application/vnd.api+json')
+      .send(expressDoc)
+
+    const { reply: fastifyReply } = await invokeFastifyRoute(fastifyApp, {
+      method: 'POST',
+      routeUrl: '/api/countries',
+      requestUrl: '/api/countries',
+      headers: {
+        'content-type': 'application/vnd.api+json',
+        accept: 'application/vnd.api+json'
+      },
+      body: fastifyDoc
+    })
+
+    assert.equal(expressResponse.status, 201)
+    assert.equal(fastifyReply.statusCode, 201)
+
+    assert.equal(expressResponse.body.data.type, 'countries')
+    assert.equal(fastifyReply.payload.data.type, 'countries')
+    assert.equal(expressResponse.body.data.attributes.name, 'Express Country')
+    assert.equal(fastifyReply.payload.data.attributes.name, 'Fastify Country')
+    assert.equal(expressResponse.headers['x-connector-test'], 'enabled')
+    assert.equal(fastifyReply.headers['x-connector-test'], 'enabled')
+
+    assertLocationSuffix(expressResponse.headers.location, expressResponse.body.data.id)
+    assertLocationSuffix(fastifyReply.headers.Location, fastifyReply.payload.data.id)
+  })
+
+  it('rejects unsupported write content types using each connector transport policy', async () => {
+    const expressResponse = await request(expressApp)
+      .post('/api/countries')
+      .set('Content-Type', 'text/plain')
+      .send('invalid payload')
+
+    const { reply: fastifyReply } = await invokeFastifyRoute(fastifyApp, {
+      method: 'POST',
+      routeUrl: '/api/countries',
+      requestUrl: '/api/countries',
+      headers: { 'content-type': 'text/plain' },
+      body: 'invalid payload'
+    })
+
+    assert.equal(expressResponse.status, 415)
+    assert.equal(fastifyReply.statusCode, 415)
+    assert.deepEqual(
+      expressResponse.body,
+      getUnsupportedMediaTypeErrorBody({ allowMultipart: true })
+    )
+    assert.deepEqual(
+      fastifyReply.payload,
+      getUnsupportedMediaTypeErrorBody()
+    )
+  })
+
+  it('maps validation errors the same way in both connectors', async () => {
+    const invalidDoc = createJsonApiDocument('countries', {
+      code: 'IV'
+    })
+
+    const expressResponse = await request(expressApp)
+      .post('/api/countries')
+      .set('Content-Type', 'application/vnd.api+json')
+      .set('Accept', 'application/vnd.api+json')
+      .send(invalidDoc)
+
+    const { reply: fastifyReply } = await invokeFastifyRoute(fastifyApp, {
+      method: 'POST',
+      routeUrl: '/api/countries',
+      requestUrl: '/api/countries',
+      headers: {
+        'content-type': 'application/vnd.api+json',
+        accept: 'application/vnd.api+json'
+      },
+      body: invalidDoc
+    })
+
+    assert.equal(expressResponse.status, 422)
+    assert.equal(fastifyReply.statusCode, 422)
+    assert.deepEqual(fastifyReply.payload, expressResponse.body)
+    assert.equal(expressResponse.headers['x-connector-test'], 'enabled')
+    assert.equal(fastifyReply.headers['x-connector-test'], 'enabled')
+  })
+
+  it('honors transport request rejection hooks the same way in both connectors', async () => {
+    const expressResponse = await request(expressApp)
+      .get('/api/countries')
+      .set('x-block-request', 'yes')
+
+    const { reply: fastifyReply } = await invokeFastifyRoute(fastifyApp, {
+      method: 'GET',
+      routeUrl: '/api/countries',
+      requestUrl: '/api/countries',
+      headers: { 'x-block-request': 'yes' }
+    })
+
+    assert.equal(expressResponse.status, 401)
+    assert.equal(fastifyReply.statusCode, 401)
+    assert.deepEqual(fastifyReply.payload, expressResponse.body)
+    assert.equal(expressResponse.headers['x-connector-test'], undefined)
+    assert.equal(fastifyReply.headers['x-connector-test'], undefined)
+  })
+})

package/tests/id-normalization.test.js

@@ -0,0 +1,444 @@
+import { describe, it, before, after, beforeEach } from 'node:test'
+import assert from 'node:assert/strict'
+import knexLib from 'knex'
+
+import {
+  cleanTables,
+  createJsonApiDocument,
+  validateJsonApiStructure
+} from './helpers/test-utils.js'
+import { storageMode } from './helpers/storage-mode.js'
+import { createIdNormalizationApi } from './fixtures/api-configs.js'
+
+const knex = knexLib({
+  client: 'better-sqlite3',
+  connection: {
+    filename: ':memory:'
+  },
+  useNullAsDefault: true
+})
+
+let defaultApi
+let overrideApi
+
+const getTenantId = (api) => api?.anyapi?.tenantId || storageMode.defaultTenant
+
+const loadStoredResourceRow = async ({ api, resource, tableName, resourceId }) => {
+  if (!storageMode.isAnyApi()) {
+    return knex(tableName)
+      .where({ id: resourceId })
+      .first()
+  }
+
+  return knex('any_records')
+    .where({
+      tenant_id: getTenantId(api),
+      resource,
+      logical_id: resourceId
+    })
+    .first()
+}
+
+const getStoredFieldValue = async ({ api, resource, row, field }) => {
+  if (!row) return undefined
+
+  if (!storageMode.isAnyApi()) {
+    return row[field]
+  }
+
+  if (field === 'id') {
+    return row.logical_id
+  }
+
+  const descriptor = await api.anyapi.registry.getDescriptor(getTenantId(api), resource)
+  const fieldInfo = descriptor?.fields?.[field]
+  if (fieldInfo?.slot) {
+    return row[fieldInfo.slot]
+  }
+
+  return row[field]
+}
+
+const loadStoredManyToManyLinks = async ({ api, ownerResource, relationshipName, ownerId }) => {
+  if (!storageMode.isAnyApi()) {
+    return knex('id_norm_override_publisher_tags')
+      .where({ publisher_id: ownerId })
+      .select('publisher_id', 'tag_id')
+  }
+
+  const tenantId = getTenantId(api)
+  const ownerDescriptor = await api.anyapi.registry.getDescriptor(tenantId, ownerResource)
+  const relationshipKey = ownerDescriptor?.manyToMany?.[relationshipName]?.relationship
+
+  const rows = await knex('any_links')
+    .where({ tenant_id: tenantId })
+    .andWhere((builder) => {
+      builder
+        .where((q) => {
+          q.where('relationship', relationshipKey)
+            .andWhere('left_resource', ownerResource)
+            .andWhere('left_id', ownerId)
+        })
+        .orWhere((q) => {
+          q.where('inverse_relationship', relationshipKey)
+            .andWhere('right_resource', ownerResource)
+            .andWhere('right_id', ownerId)
+        })
+    })
+    .select('left_resource', 'left_id', 'right_resource', 'right_id')
+
+  return rows.map((row) => {
+    if (row.left_resource === ownerResource) {
+      return {
+        publisher_id: row.left_id,
+        tag_id: row.right_id
+      }
+    }
+
+    return {
+      publisher_id: row.right_id,
+      tag_id: row.left_id
+    }
+  }).filter((row) => row.publisher_id === ownerId && row.tag_id != null)
+}
+
+describe('Resource ID normalization', () => {
+  before(async () => {
+    defaultApi = await createIdNormalizationApi(knex, {
+      tablePrefix: 'id_norm_default'
+    })
+
+    overrideApi = await createIdNormalizationApi(knex, {
+      tablePrefix: 'id_norm_override',
+      'rest-api': {
+        returnRecordApi: {
+          post: 'no',
+          put: false,
+          patch: false
+        },
+        normalizeId: (value) => {
+          if (value === null || value === undefined) {
+            return null
+          }
+
+          const normalized = String(value).trim()
+          return normalized ? normalized.toUpperCase() : null
+        }
+      },
+      countryResourceOptions: {
+        normalizeId: (value) => {
+          if (value === null || value === undefined) {
+            return null
+          }
+
+          const normalized = String(value).trim()
+          return normalized ? normalized.toLowerCase() : null
+        }
+      },
+      tagResourceOptions: {
+        normalizeId: (value) => {
+          if (value === null || value === undefined) {
+            return null
+          }
+
+          const normalized = String(value).trim()
+          return normalized ? normalized.toLowerCase() : null
+        }
+      }
+    })
+  })
+
+  after(async () => {
+    await knex.destroy()
+  })
+
+  beforeEach(async () => {
+    await cleanTables(knex, [
+      'id_norm_default_countries',
+      'id_norm_default_publishers',
+      'id_norm_default_tags',
+      'id_norm_default_publisher_tags',
+      'id_norm_override_countries',
+      'id_norm_override_publishers',
+      'id_norm_override_tags',
+      'id_norm_override_publisher_tags'
+    ])
+  })
+
+  it('uses the default normalizer to trim surrounding whitespace', async () => {
+    const countryId = 'country-default'
+    const countryDoc = createJsonApiDocument('countries', {
+      name: 'Canada'
+    })
+    countryDoc.data.id = countryId
+
+    await defaultApi.resources.countries.post({
+      inputRecord: countryDoc,
+      simplified: false
+    })
+
+    const result = await defaultApi.resources.countries.get({
+      id: `  ${countryId}  `,
+      simplified: false
+    })
+
+    validateJsonApiStructure(result)
+    assert.equal(result.data.id, countryId)
+    assert.equal(result.data.attributes.name, 'Canada')
+  })
+
+  it('lets a resource override the global normalizer', async () => {
+    const countryId = 'country-override'
+    const publisherId = 'publisher-override'
+    const countryDoc = createJsonApiDocument('countries', {
+      name: 'Spain'
+    })
+    countryDoc.data.id = countryId
+    const publisherDoc = createJsonApiDocument('publishers', {
+      name: 'Acme Press'
+    })
+    publisherDoc.data.id = publisherId
+
+    await overrideApi.resources.countries.post({
+      inputRecord: countryDoc,
+      simplified: false
+    })
+
+    await overrideApi.resources.publishers.post({
+      inputRecord: publisherDoc,
+      simplified: false
+    })
+
+    const countryResult = await overrideApi.resources.countries.get({
+      id: `  ${countryId.toUpperCase()}  `,
+      simplified: false
+    })
+
+    validateJsonApiStructure(countryResult)
+    assert.equal(countryResult.data.id, countryId)
+
+    const publisherResult = await overrideApi.resources.publishers.get({
+      id: `  ${publisherId}  `,
+      simplified: false
+    })
+
+    validateJsonApiStructure(publisherResult)
+    assert.equal(publisherResult.data.id, publisherId.toUpperCase())
+  })
+
+  it('normalizes explicit POST resource ids before persistence and return fetches', async () => {
+    const inputRecord = createJsonApiDocument('publishers', {
+      name: 'Explicit ID Press'
+    })
+    inputRecord.data.id = '  publisher-explicit  '
+
+    const result = await overrideApi.resources.publishers.post({
+      inputRecord,
+      simplified: false
+    })
+
+    assert.equal(result, undefined)
+
+    const inserted = await loadStoredResourceRow({
+      api: overrideApi,
+      resource: 'publishers',
+      tableName: 'id_norm_override_publishers',
+      resourceId: 'PUBLISHER-EXPLICIT'
+    })
+
+    assert.equal(await getStoredFieldValue({
+      api: overrideApi,
+      resource: 'publishers',
+      row: inserted,
+      field: 'id'
+    }), 'PUBLISHER-EXPLICIT')
+
+    const fetched = await overrideApi.resources.publishers.get({
+      id: 'publisher-explicit',
+      simplified: false
+    })
+
+    validateJsonApiStructure(fetched)
+    assert.equal(fetched.data.id, 'PUBLISHER-EXPLICIT')
+  })
+
+  it('rejects explicit POST resource ids that normalize to empty values', async () => {
+    const inputRecord = createJsonApiDocument('publishers', {
+      name: 'Invalid ID Press'
+    })
+    inputRecord.data.id = '   '
+
+    await assert.rejects(
+      () => overrideApi.resources.publishers.post({
+        inputRecord,
+        simplified: false
+      }),
+      (error) => {
+        assert.equal(error.code, 'REST_API_VALIDATION')
+        assert.deepEqual(error.details?.fields, ['data.id'])
+        assert.equal(error.details?.violations?.[0]?.field, 'data.id')
+        assert.equal(error.details?.violations?.[0]?.rule, 'invalid_resource_id')
+        return true
+      }
+    )
+  })
+
+  it('treats record ids that normalize to empty values as not found', async () => {
+    await assert.rejects(
+      () => overrideApi.resources.publishers.get({
+        id: '   ',
+        simplified: false
+      }),
+      (error) => {
+        assert.equal(error.code, 'REST_API_RESOURCE')
+        assert.equal(error.subtype, 'not_found')
+        assert.equal(error.details?.resourceType, 'publishers')
+        assert.equal(error.details?.resourceId, '   ')
+        return true
+      }
+    )
+  })
+
+  it('normalizes belongsTo relationship ids using the related resource normalizer before persistence', async () => {
+    const countryRecord = createJsonApiDocument('countries', {
+      name: 'Spain'
+    })
+    countryRecord.data.id = 'country-1'
+
+    await overrideApi.resources.countries.post({
+      inputRecord: countryRecord,
+      simplified: false
+    })
+
+    const publisherRecord = createJsonApiDocument('publishers', {
+      name: 'Country Linked Press'
+    }, {
+      country: {
+        data: {
+          type: 'countries',
+          id: '  COUNTRY-1  '
+        }
+      }
+    })
+    publisherRecord.data.id = 'publisher-country'
+
+    await overrideApi.resources.publishers.post({
+      inputRecord: publisherRecord,
+      simplified: false
+    })
+
+    const inserted = await loadStoredResourceRow({
+      api: overrideApi,
+      resource: 'publishers',
+      tableName: 'id_norm_override_publishers',
+      resourceId: 'PUBLISHER-COUNTRY'
+    })
+
+    assert.equal(await getStoredFieldValue({
+      api: overrideApi,
+      resource: 'publishers',
+      row: inserted,
+      field: 'country_id'
+    }), 'country-1')
+  })
+
+  it('rejects relationship identifiers that normalize to empty values', async () => {
+    const publisherRecord = createJsonApiDocument('publishers', {
+      name: 'Invalid Relationship Press'
+    })
+    publisherRecord.data.id = 'publisher-invalid-relationship'
+
+    await overrideApi.resources.publishers.post({
+      inputRecord: publisherRecord,
+      simplified: false
+    })
+
+    await assert.rejects(
+      () => overrideApi.resources.publishers.postRelationship({
+        id: 'publisher-invalid-relationship',
+        relationshipName: 'tags',
+        relationshipData: [
+          {
+            type: 'tags',
+            id: '   '
+          }
+        ],
+        simplified: false
+      }),
+      (error) => {
+        assert.equal(error.code, 'REST_API_RESOURCE')
+        assert.equal(error.subtype, 'not_found')
+        assert.equal(error.details?.resourceType, 'tags')
+        assert.equal(error.details?.resourceId, '   ')
+        return true
+      }
+    )
+  })
+
+  it('normalizes many-to-many relationship ids before pivot inserts and deletes', async () => {
+    const tagRecord = createJsonApiDocument('tags', {
+      name: 'Featured'
+    })
+    tagRecord.data.id = 'tag-1'
+
+    await overrideApi.resources.tags.post({
+      inputRecord: tagRecord,
+      simplified: false
+    })
+
+    const publisherRecord = createJsonApiDocument('publishers', {
+      name: 'Tagged Press'
+    })
+    publisherRecord.data.id = 'publisher-tags'
+
+    await overrideApi.resources.publishers.post({
+      inputRecord: publisherRecord,
+      simplified: false
+    })
+
+    await overrideApi.resources.publishers.postRelationship({
+      id: ' publisher-tags ',
+      relationshipName: 'tags',
+      relationshipData: [
+        {
+          type: 'tags',
+          id: '  TAG-1  '
+        }
+      ],
+      simplified: false
+    })
+
+    let pivotRows = await loadStoredManyToManyLinks({
+      api: overrideApi,
+      ownerResource: 'publishers',
+      relationshipName: 'tags',
+      ownerId: 'PUBLISHER-TAGS'
+    })
+
+    assert.deepEqual(pivotRows, [{
+      publisher_id: 'PUBLISHER-TAGS',
+      tag_id: 'tag-1'
+    }])
+
+    await overrideApi.resources.publishers.deleteRelationship({
+      id: 'publisher-tags',
+      relationshipName: 'tags',
+      relationshipData: [
+        {
+          type: 'tags',
+          id: ' TAG-1 '
+        }
+      ],
+      simplified: false
+    })
+
+    pivotRows = await loadStoredManyToManyLinks({
+      api: overrideApi,
+      ownerResource: 'publishers',
+      relationshipName: 'tags',
+      ownerId: 'PUBLISHER-TAGS'
+    })
+
+    assert.deepEqual(pivotRows, [])
+  })
+})