json-rest-api 1.0.22 → 1.0.24

package/tests/logical-id-write-validation.test.js

@@ -0,0 +1,151 @@
+import { describe, it, before, after, beforeEach } from 'node:test'
+import assert from 'node:assert/strict'
+import knexLib from 'knex'
+import { Api } from 'hooked-api'
+import { RestApiPlugin } from '../plugins/core/rest-api-plugin.js'
+import { RestApiKnexPlugin } from '../plugins/core/rest-api-knex-plugin.js'
+import {
+  cleanTables,
+  validateJsonApiStructure,
+} from './helpers/test-utils.js'
+
+const knex = knexLib({
+  client: 'better-sqlite3',
+  connection: {
+    filename: ':memory:'
+  },
+  useNullAsDefault: true
+})
+
+let api
+
+describe('Logical resource ids in write validation', () => {
+  before(async () => {
+    api = new Api({
+      name: 'logical-id-write-validation-test'
+    })
+
+    await api.use(RestApiPlugin, {
+      simplifiedApi: false,
+      simplifiedTransport: false,
+      returnRecordApi: {
+        post: 'full',
+        put: 'full',
+        patch: 'full'
+      }
+    })
+    await api.use(RestApiKnexPlugin, { knex })
+
+    await api.addResource('profiles', {
+      tableName: 'logical_id_profiles',
+      idProperty: 'user_id',
+      schema: {
+        id: { type: 'id', required: true, storage: { column: 'user_id' } },
+        name: { type: 'string', required: true, max: 64 }
+      }
+    })
+    await api.resources.profiles.createKnexTable()
+  })
+
+  after(async () => {
+    await knex.destroy()
+  })
+
+  beforeEach(async () => {
+    await cleanTables(knex, ['logical_id_profiles'])
+  })
+
+  it('accepts explicit resource ids in non-simplified POST without exposing id as an attribute', async () => {
+    const created = await api.resources.profiles.post({
+      inputRecord: {
+        data: {
+          type: 'profiles',
+          id: '101',
+          attributes: {
+            name: 'Alice'
+          }
+        }
+      }
+    })
+
+    validateJsonApiStructure(created)
+    assert.equal(created.data.id, '101')
+    assert.equal(created.data.attributes.name, 'Alice')
+    assert.ok(!('id' in created.data.attributes))
+
+    const dbRow = await knex('logical_id_profiles').where('user_id', 101).first()
+    assert.ok(dbRow)
+    assert.equal(String(dbRow.user_id), '101')
+    assert.equal(dbRow.name, 'Alice')
+  })
+
+  it('reports missing logical ids against data.id during POST validation', async () => {
+    await assert.rejects(
+      () => api.resources.profiles.post({
+        inputRecord: {
+          data: {
+            type: 'profiles',
+            attributes: {
+              name: 'Missing Id'
+            }
+          }
+        }
+      }),
+      (error) => {
+        assert.equal(error.code, 'REST_API_VALIDATION')
+        assert.deepEqual(error.details?.fields, ['data.id'])
+        assert.equal(error.details?.violations?.[0]?.field, 'data.id')
+        return true
+      }
+    )
+  })
+
+  it('accepts explicit resource ids in simplified POST and still keeps id out of attributes', async () => {
+    const created = await api.resources.profiles.post({
+      id: '202',
+      name: 'Bob'
+    })
+
+    assert.equal(created.id, '202')
+    assert.equal(created.name, 'Bob')
+
+    const fetched = await api.resources.profiles.get({
+      id: '202',
+      simplified: false
+    })
+
+    validateJsonApiStructure(fetched)
+    assert.equal(fetched.data.id, '202')
+    assert.equal(fetched.data.attributes.name, 'Bob')
+    assert.ok(!('id' in fetched.data.attributes))
+  })
+
+  it('accepts logical id validation through PUT full replacement', async () => {
+    await knex('logical_id_profiles').insert({
+      user_id: 303,
+      name: 'Before'
+    })
+
+    const updated = await api.resources.profiles.put({
+      id: '303',
+      inputRecord: {
+        data: {
+          type: 'profiles',
+          id: '303',
+          attributes: {
+            name: 'After'
+          }
+        }
+      }
+    })
+
+    validateJsonApiStructure(updated)
+    assert.equal(updated.data.id, '303')
+    assert.equal(updated.data.attributes.name, 'After')
+    assert.ok(!('id' in updated.data.attributes))
+
+    const dbRow = await knex('logical_id_profiles').where('user_id', 303).first()
+    assert.ok(dbRow)
+    assert.equal(dbRow.name, 'After')
+  })
+})

package/tests/pagination-cursor-multifield.test.js

@@ -55,7 +55,7 @@ describe('Multi-field Cursor Pagination', () => {
       }
     })
 
-    it.skip('should handle cursor pagination with multi-field sorting without skipping records', async () => {
+    it('should handle cursor pagination with multi-field sorting without skipping records', async () => {
       // Sort by category first (which has duplicates), then by name
       const pageSize = 3
       const allProducts = []
@@ -102,7 +102,7 @@ describe('Multi-field Cursor Pagination', () => {
       assert.equal(ids.length, uniqueIds.length, 'Should have no duplicate products')
     })
 
-    it.skip('should handle DESC sorting with duplicates correctly', async () => {
+    it('should handle DESC sorting with duplicates correctly', async () => {
       // Sort by category DESC, then name ASC
       const firstPage = await api.resources.products.query({
         queryParams: {
@@ -189,7 +189,7 @@ describe('Multi-field Cursor Pagination', () => {
         'Green Gardens vegetables should be in alphabetical order by name')
     })
 
-    it.skip('should handle cursor pagination with numeric and text fields', async () => {
+    it('should handle cursor pagination with numeric and text fields', async () => {
       // Sort by price (numeric), then category (text), then name (text)
       const firstPage = await api.resources.products.query({
         queryParams: {
@@ -222,7 +222,7 @@ describe('Multi-field Cursor Pagination', () => {
         'Prices should be non-decreasing across pages')
     })
 
-    it.skip('should generate correct cursor values for multi-field sorting', async () => {
+    it('should generate correct cursor values for multi-field sorting', async () => {
       const result = await api.resources.products.query({
         queryParams: {
           page: { size: 3 },
@@ -244,7 +244,7 @@ describe('Multi-field Cursor Pagination', () => {
       assert(cursor.includes('name:'), 'Cursor should include name field')
     })
 
-    it.skip('should handle page[before] with multi-field sorting', async () => {
+    it('should handle page[before] with multi-field sorting', async () => {
       // First, get to the middle of the dataset
       const firstPage = await api.resources.products.query({
         queryParams: {
@@ -272,7 +272,7 @@ describe('Multi-field Cursor Pagination', () => {
             size: 4,
             before: secondPage.meta.pagination.cursor?.next ||
                     // If no next cursor, create one from the last record
-                    `category:${encodeURIComponent(secondPage.data[0].attributes.category)},name:${encodeURIComponent(secondPage.data[0].attributes.name)}`
+                    `category:${encodeURIComponent(secondPage.data[0].attributes.category)},name:${encodeURIComponent(secondPage.data[0].attributes.name)},id:${encodeURIComponent(secondPage.data[0].id)}`
           },
           sort: ['category', 'name']
         },
@@ -292,7 +292,7 @@ describe('Multi-field Cursor Pagination', () => {
       await cleanTables(knex, ['cursor_products', 'cursor_items'])
     })
 
-    it.skip('should handle all records having the same value in first sort field', async () => {
+    it('should handle all records having the same value in first sort field', async () => {
       // Create products all in the same category
       const products = [
         { name: 'Alpha', category: 'Electronics', brand: 'TechCo', price: 100, sku: 'TC-001' },
@@ -348,7 +348,7 @@ describe('Multi-field Cursor Pagination', () => {
       assert(gadgetIncIndex < firstTechCoIndex, 'GadgetInc products should come before TechCo')
     })
 
-    it.skip('should handle empty results with multi-field cursor', async () => {
+    it('should handle empty results with multi-field cursor', async () => {
       // Create one product
       await api.resources.products.post({
         inputRecord: createJsonApiDocument('products', {
@@ -375,7 +375,7 @@ describe('Multi-field Cursor Pagination', () => {
       assert(!firstPage.meta.pagination.cursor?.next, 'Should not have next cursor on last page')
     })
 
-    it.skip('should handle special characters in multi-field cursors', async () => {
+    it('should handle special characters in multi-field cursors', async () => {
       // Create products with special characters
       const products = [
         { name: 'Product: Special', category: 'Cat:1', brand: 'Brand,A', price: 10, sku: 'SP-001' },
@@ -418,7 +418,7 @@ describe('Multi-field Cursor Pagination', () => {
         'Should get different record on second page')
     })
 
-    it.skip('should maintain stable sorting with custom id property', async () => {
+    it('should maintain stable sorting with custom id property', async () => {
       // Create items using the resource with custom ID property
       const items = [
         { code: 'A001', name: 'Apple', category: 'Fruit', type: 'Fresh' },
@@ -464,7 +464,7 @@ describe('Multi-field Cursor Pagination', () => {
       }
     })
 
-    it.skip('should handle the exact bug scenario - multiple fruits with same category', async () => {
+    it('should handle the exact bug scenario - multiple fruits with same category', async () => {
       // This is the exact scenario from the bug report
       await cleanTables(knex, ['cursor_products'])
 

package/tests/projected-fields.test.js

@@ -0,0 +1,319 @@
+import { describe, it, before, beforeEach, after } from 'node:test'
+import assert from 'node:assert/strict'
+import { Api } from 'hooked-api'
+import knexLib from 'knex'
+import { LabelPlugin, QueryProjectionsPlugin, RestApiKnexPlugin, RestApiPlugin } from '../index.js'
+import {
+  cleanTables,
+  createJsonApiDocument,
+  createRelationship,
+  resourceIdentifier,
+  validateJsonApiStructure,
+} from './helpers/test-utils.js'
+import { createProjectedFieldsApi } from './fixtures/api-configs.js'
+
+const knex = knexLib({
+  client: 'better-sqlite3',
+  connection: {
+    filename: ':memory:'
+  },
+  useNullAsDefault: true
+})
+
+describe('Query Projections', () => {
+  let api
+  const testData = {}
+
+  before(async () => {
+    api = await createProjectedFieldsApi(knex)
+  })
+
+  after(async () => {
+    await knex.destroy()
+  })
+
+  beforeEach(async () => {
+    await cleanTables(knex, ['projected_books', 'projected_authors'])
+
+    const authorPayloads = [
+      { first_name: 'Alex', last_name: 'Carter' },
+      { first_name: 'Alex', last_name: 'Carter' },
+      { first_name: 'Bella', last_name: 'Stone' },
+      { first_name: 'Aaron', last_name: 'Zephyr' }
+    ]
+
+    testData.authors = []
+    for (const payload of authorPayloads) {
+      const result = await api.resources.authors.post({
+        inputRecord: createJsonApiDocument('authors', payload),
+        simplified: false
+      })
+      testData.authors.push(result.data)
+    }
+
+    testData.expectedAuthorOrder = [
+      testData.authors[3].id,
+      testData.authors[0].id,
+      testData.authors[1].id,
+      testData.authors[2].id
+    ]
+
+    const bookOne = await api.resources.books.post({
+      inputRecord: createJsonApiDocument(
+        'books',
+        { title: 'Derived Fields Handbook' },
+        { author: createRelationship(resourceIdentifier('authors', testData.authors[0].id)) }
+      ),
+      simplified: false
+    })
+
+    const bookTwo = await api.resources.books.post({
+      inputRecord: createJsonApiDocument(
+        'books',
+        { title: 'Cursor Patterns' },
+        { author: createRelationship(resourceIdentifier('authors', testData.authors[2].id)) }
+      ),
+      simplified: false
+    })
+
+    testData.books = [bookOne.data, bookTwo.data]
+  })
+
+  async function createEphemeralProjectionApi (resourceName, resourceOptions) {
+    const api = new Api({
+      name: `${resourceName}-projection-test-api`,
+      log: { level: process.env.LOG_LEVEL || 'info' }
+    })
+
+    await api.use(RestApiPlugin, {
+      simplifiedApi: true,
+      simplifiedTransport: true,
+      returnRecordApi: {
+        post: true,
+        put: true,
+        patch: true
+      }
+    })
+    await api.use(QueryProjectionsPlugin)
+    await api.use(RestApiKnexPlugin, { knex })
+    await api.addResource(resourceName, resourceOptions)
+
+    return api
+  }
+
+  it('should return query projection fields by default and ignore query projection input on writes', async () => {
+    const created = await api.resources.authors.post({
+      inputRecord: createJsonApiDocument('authors', {
+        first_name: 'Nina',
+        last_name: 'Simone',
+        full_name: 'Injected Value'
+      }),
+      simplified: false
+    })
+
+    validateJsonApiStructure(created)
+    assert.equal(created.data.attributes.first_name, 'Nina')
+    assert.equal(created.data.attributes.last_name, 'Simone')
+    assert.equal(created.data.attributes.full_name, 'Nina Simone')
+
+    const fetched = await api.resources.authors.get({
+      id: created.data.id,
+      simplified: false
+    })
+
+    validateJsonApiStructure(fetched)
+    assert.equal(fetched.data.attributes.full_name, 'Nina Simone')
+  })
+
+  it('should allow query projection fields in sparse fieldsets', async () => {
+    const result = await api.resources.authors.get({
+      id: testData.authors[0].id,
+      queryParams: {
+        fields: {
+          authors: 'first_name,full_name'
+        }
+      },
+      simplified: false
+    })
+
+    validateJsonApiStructure(result)
+    assert.equal(result.data.attributes.first_name, 'Alex')
+    assert.equal(result.data.attributes.full_name, 'Alex Carter')
+    assert.equal(result.data.attributes.last_name, undefined)
+  })
+
+  it('should expose query projection fields on included resources', async () => {
+    const result = await api.resources.books.get({
+      id: testData.books[0].id,
+      queryParams: {
+        include: ['author'],
+        fields: {
+          books: 'title',
+          authors: 'full_name'
+        }
+      },
+      simplified: false
+    })
+
+    validateJsonApiStructure(result)
+    assert.ok(Array.isArray(result.included))
+
+    const includedAuthor = result.included.find((resource) => resource.type === 'authors')
+    assert.ok(includedAuthor, 'expected included author resource')
+    assert.equal(includedAuthor.attributes.full_name, 'Alex Carter')
+    assert.equal(includedAuthor.attributes.first_name, undefined)
+    assert.equal(includedAuthor.attributes.last_name, undefined)
+  })
+
+  it('should support stable cursor pagination when sorting by a query projection field', async () => {
+    const seenIds = []
+    const seenFirstNames = []
+    let nextCursor = null
+    let iterations = 0
+    let firstCursor = null
+
+    while (iterations < 10) {
+      const result = await api.resources.authors.query({
+        queryParams: {
+          sort: ['full_name'],
+          fields: {
+            authors: 'first_name'
+          },
+          page: {
+            size: 1,
+            ...(nextCursor ? { after: nextCursor } : {})
+          }
+        },
+        simplified: false
+      })
+
+      validateJsonApiStructure(result, true)
+      assert.equal(result.data.length, 1)
+
+      const resource = result.data[0]
+      seenIds.push(resource.id)
+      seenFirstNames.push(resource.attributes.first_name)
+      assert.equal(resource.attributes.full_name, undefined)
+
+      if (!firstCursor && result.meta?.pagination?.cursor?.next) {
+        firstCursor = result.meta.pagination.cursor.next
+      }
+
+      if (!result.meta?.pagination?.hasMore) {
+        break
+      }
+
+      nextCursor = result.meta.pagination.cursor.next
+      iterations += 1
+    }
+
+    assert.deepEqual(seenIds, testData.expectedAuthorOrder)
+    assert.equal(new Set(seenIds).size, seenIds.length, 'cursor pagination should not duplicate records')
+    assert.ok(firstCursor?.includes('full_name:'), 'cursor should encode query projection sort field')
+    assert.ok(firstCursor?.includes('id:'), 'cursor should append id as deterministic tie-breaker')
+    assert.deepEqual(seenFirstNames, ['Aaron', 'Alex', 'Alex', 'Bella'])
+  })
+
+  it('should allow sorting by a normallyHidden query projection field without returning it by default', async () => {
+    const result = await api.resources.authors.query({
+      queryParams: {
+        sort: ['sort_name']
+      },
+      simplified: false
+    })
+
+    validateJsonApiStructure(result, true)
+    assert.deepEqual(
+      result.data.map((resource) => resource.id),
+      testData.expectedAuthorOrder
+    )
+    result.data.forEach((resource) => {
+      assert.equal(resource.attributes.sort_name, undefined)
+    })
+  })
+
+  it('should reject query projection expressions that return plain SQL strings', async () => {
+    const stringApi = await createEphemeralProjectionApi('string_projection_authors', {
+      schema: {
+        id: { type: 'id' },
+        first_name: { type: 'string', required: true },
+        last_name: { type: 'string', required: true }
+      },
+      queryFields: {
+        full_name: {
+          type: 'string',
+          select: () => "trim(coalesce(first_name, '') || ' ' || coalesce(last_name, ''))"
+        }
+      },
+      tableName: 'projected_authors_string_expr'
+    })
+
+    await stringApi.resources.string_projection_authors.createKnexTable()
+    await knex('projected_authors_string_expr').insert({
+      first_name: 'Nina',
+      last_name: 'Simone'
+    })
+
+    await assert.rejects(
+      () => stringApi.resources.string_projection_authors.query({
+        queryParams: {},
+        simplified: false
+      }),
+      /Query field expressions must return knex raw, knex ref, or a knex query builder/
+    )
+  })
+
+  it('should reject query projection names that conflict with relationship names', async () => {
+    await assert.rejects(
+      () => createEphemeralProjectionApi('conflicting_projection_authors', {
+        schema: {
+          id: { type: 'id' },
+          name: { type: 'string', required: true }
+        },
+        queryFields: {
+          books: {
+            type: 'string',
+            select: ({ knex }) => knex.raw("'X'")
+          }
+        },
+        relationships: {
+          books: { type: 'hasMany', target: 'books', foreignKey: 'author_id' }
+        },
+        tableName: 'projected_authors_conflict'
+      }),
+      /conflicts with an existing schema/
+    )
+  })
+
+  it('should reject query projection names that conflict with computed fields injected by plugins', async () => {
+    const labeledApi = new Api({
+      name: 'label-projection-conflict-api',
+      log: { level: process.env.LOG_LEVEL || 'info' }
+    })
+
+    await labeledApi.use(RestApiPlugin, {
+      simplifiedApi: true,
+      simplifiedTransport: true
+    })
+    await labeledApi.use(LabelPlugin)
+    await labeledApi.use(QueryProjectionsPlugin)
+    await labeledApi.use(RestApiKnexPlugin, { knex })
+
+    await assert.rejects(
+      () => labeledApi.addResource('labeled_projection_authors', {
+        schema: {
+          id: { type: 'id' },
+          name: { type: 'string', required: true }
+        },
+        queryFields: {
+          label: {
+            type: 'string',
+            select: ({ knex }) => knex.raw("'X'")
+          }
+        },
+        tableName: 'projected_authors_label_conflict'
+      }),
+      /conflicts with an existing schema, computed, or relationship name/
+    )
+  })
+})

package/tests/relationships.test.js

@@ -330,7 +330,6 @@ describe('Relationship Operations', () => {
           }
         }
       }
-      console.log('THE NEXT LINE WILL BLOCK THE TEST')
       await basicApi.resources.books.put({
         id: bookResult.data.id,
         inputRecord: putDoc,
@@ -590,7 +589,7 @@ describe('Relationship Operations', () => {
       assert(publisher.relationships.country)
     })
 
-    it('should handle PUT with partial relationships object', async () => {
+    it('should clear omitted relationships when PUT provides a relationships object', async () => {
       // Create resources
       const countryDoc = createJsonApiDocument('countries', { name: 'USA', code: 'US' })
       const countryResult = await basicApi.resources.countries.post({
@@ -640,7 +639,8 @@ describe('Relationship Operations', () => {
         simplified: false
       })
 
-      // PUT with only publisher relationship (should preserve authors since relationships object is partial)
+      // PUT with only publisher relationship. Omitted relationships are cleared
+      // once a relationships object is provided for a complete replacement.
       const putDoc = {
         data: {
           type: 'books',