json-rest-api 1.0.23 → 1.0.25

package/plugins/core/rest-api-plugin-methods/delete-relationship.js

@@ -1,5 +1,15 @@
-import { RestApiResourceError, RestApiValidationError, RestApiPayloadError } from '../../../lib/rest-api-errors.js'
-import { findRelationshipDefinition, handleWriteMethodError } from './common.js'
+import { RestApiResourceError, RestApiValidationError } from '../../../lib/rest-api-errors.js'
+import {
+  commitOwnedTransaction,
+  findRelationshipDefinition,
+  getVisibleRelationshipParent,
+  handleWriteMethodError,
+  validateRelationshipRoutePayload
+} from './common.js'
+import {
+  normalizeRelationshipIdentifiers,
+  requireExistingResourceId
+} from '../lib/querying-writing/resource-id-normalization.js'
 
 /**
  * DELETE RELATIONSHIP
@@ -11,9 +21,13 @@ import { findRelationshipDefinition, handleWriteMethodError } from './common.js'
  * @param {array} relationshipData - Array of resource identifiers to remove
  * @returns {Promise<void>} 204 No Content
  */
-export default async function deleteRelationshipMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeName, api, log }) {
+export default async function deleteRelationshipMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeOptions, scopeName, api, log }) {
   context.method = 'deleteRelationship'
-  context.id = params.id
+  context.id = requireExistingResourceId(params.id, {
+    scopeOptions,
+    vars,
+    scopeName
+  })
   context.relationshipName = params.relationshipName
   context.schemaInfo = scopes[scopeName].vars.schemaInfo
 
@@ -40,21 +54,28 @@ export default async function deleteRelationshipMethod ({ params, context, vars,
       )
     }
 
-    if (!Array.isArray(params.relationshipData)) {
-      throw new RestApiPayloadError('DELETE from relationship requires array of resource identifiers')
-    }
+    params.relationshipData = validateRelationshipRoutePayload({
+      context,
+      vars,
+      scopeName,
+      operation: 'deleteRelationship',
+      relationshipData: params.relationshipData
+    })
+    params.relationshipData = normalizeRelationshipIdentifiers(params.relationshipData, { api })
 
     // Check permissions
     await runHooks('checkPermissions')
     await runHooks('checkPermissionsDeleteRelationship')
 
-    // Verify parent exists
-    const exists = await helpers.dataExists({
+    // Verify the parent exists in the caller's visible dataset.
+    const parentRecord = await getVisibleRelationshipParent({
+      context,
+      helpers,
       scopeName,
-      context: { db: context.db, id: context.id, schemaInfo: context.schemaInfo }
+      runHooks
     })
 
-    if (!exists) {
+    if (!parentRecord) {
       throw new RestApiResourceError('Resource not found', { subtype: 'not_found' })
     }
 
@@ -99,16 +120,14 @@ export default async function deleteRelationshipMethod ({ params, context, vars,
           },
           transaction: context.transaction,
           simplified: false
-        })
+        }, { ...context })
       }
     }
 
     await runHooks('finish')
     await runHooks('finishDeleteRelationship')
 
-    if (context.shouldCommit) {
-      await context.transaction.commit()
-    }
+    await commitOwnedTransaction(context, runHooks)
 
     // 204 No Content
   } catch (error) {

package/plugins/core/rest-api-plugin-methods/delete.js

@@ -1,5 +1,6 @@
 import { RestApiResourceError } from '../../../lib/rest-api-errors.js'
-import { handleWriteMethodError } from './common.js'
+import { commitOwnedTransaction, handleWriteMethodError } from './common.js'
+import { requireExistingResourceId } from '../lib/querying-writing/resource-id-normalization.js'
 
 /**
  * DELETE
@@ -26,7 +27,11 @@ export default async function deleteMethod ({
   context.method = 'delete'
 
   // Set the ID in context
-  context.id = params.id
+  context.id = requireExistingResourceId(params.id, {
+    scopeOptions,
+    vars,
+    scopeName
+  })
 
   // Set scopeName in context (needed for broadcasting)
   context.scopeName = scopeName
@@ -91,11 +96,7 @@ export default async function deleteMethod ({
     await runHooks('finish')
     await runHooks('finishDelete')
 
-    // Commit transaction if we created it
-    if (context.shouldCommit) {
-      await context.transaction.commit()
-      await runHooks('afterCommit')
-    }
+    await commitOwnedTransaction(context, runHooks)
 
     // DELETE typically returns void/undefined (204 No Content)
   } catch (error) {

package/plugins/core/rest-api-plugin-methods/get-related.js

@@ -1,6 +1,7 @@
 import { RestApiResourceError } from '../../../lib/rest-api-errors.js'
-import { findRelationshipDefinition } from './common.js'
+import { findRelationshipDefinition, getVisibleRelationshipParent } from './common.js'
 import { buildRelationshipUrl } from '../lib/querying/url-helpers.js'
+import { requireExistingResourceId } from '../lib/querying-writing/resource-id-normalization.js'
 
 /**
  * GET RELATED
@@ -12,9 +13,13 @@ import { buildRelationshipUrl } from '../lib/querying/url-helpers.js'
  * @param {object} queryParams - Standard query parameters
  * @returns {Promise<object>} Related resources with full data
  */
-export default async function getRelatedMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeName, api }) {
+export default async function getRelatedMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeOptions, scopeName, api }) {
   context.method = 'getRelated'
-  context.id = params.id
+  context.id = requireExistingResourceId(params.id, {
+    scopeOptions,
+    vars,
+    scopeName
+  })
   context.relationshipName = params.relationshipName
   context.queryParams = params.queryParams || {}
   context.schemaInfo = scopes[scopeName].vars.schemaInfo
@@ -52,13 +57,15 @@ export default async function getRelatedMethod ({ params, context, vars, helpers
   await runHooks('checkPermissions')
   await runHooks('checkPermissionsGetRelated')
 
-  // Verify parent exists
-  const exists = await helpers.dataExists({
+  // Verify the parent exists in the caller's visible dataset.
+  const parentRecord = await getVisibleRelationshipParent({
+    context,
+    helpers,
     scopeName,
-    context: { db: context.db, id: context.id, schemaInfo: context.schemaInfo }
+    runHooks
   })
 
-  if (!exists) {
+  if (!parentRecord) {
     throw new RestApiResourceError('Resource not found', { subtype: 'not_found' })
   }
 
@@ -97,7 +104,7 @@ export default async function getRelatedMethod ({ params, context, vars, helpers
         transaction: context.transaction,
         simplified: false,
         isTransport: params.isTransport
-      })
+      }, { ...context })
 
       const relatedId = parent.data.relationships?.[context.relationshipName]?.data?.id
       if (!relatedId) {
@@ -114,7 +121,7 @@ export default async function getRelatedMethod ({ params, context, vars, helpers
         transaction: context.transaction,
         simplified: false,
         isTransport: params.isTransport
-      })
+      }, { ...context })
 
       return {
         links: { self: buildRelationshipUrl(context, scope, scopeName, context.id, context.relationshipName, false) },
@@ -135,7 +142,7 @@ export default async function getRelatedMethod ({ params, context, vars, helpers
         transaction: context.transaction,
         simplified: false,
         isTransport: params.isTransport
-      })
+      }, { ...context })
 
       // Extract the related resource from the parent's relationships
       const relatedId = parent.data.relationships?.[context.relationshipName]?.data?.id
@@ -189,7 +196,7 @@ export default async function getRelatedMethod ({ params, context, vars, helpers
         transaction: context.transaction,
         simplified: false,
         isTransport: params.isTransport
-      })
+      }, { ...context })
 
       if (!result.links) {
         result.links = {}
@@ -223,7 +230,7 @@ export default async function getRelatedMethod ({ params, context, vars, helpers
         transaction: context.transaction,
         simplified: false,
         isTransport: params.isTransport
-      })
+      }, { ...context })
 
       if (!result.links) {
         result.links = {}
@@ -251,7 +258,7 @@ export default async function getRelatedMethod ({ params, context, vars, helpers
           transaction: context.transaction,
           simplified: false,
           isTransport: params.isTransport,
-        })
+        }, { ...context })
         if (related?.data) {
           results.push(related.data)
         }
@@ -302,7 +309,7 @@ export default async function getRelatedMethod ({ params, context, vars, helpers
       transaction: context.transaction,
       simplified: false,
       isTransport: params.isTransport
-    })
+    }, { ...context })
     let includedResources = pivotResult.included?.filter((r) => r.type === targetType) || []
 
     if (includedResources.length === 0) {
@@ -334,7 +341,7 @@ export default async function getRelatedMethod ({ params, context, vars, helpers
             transaction: context.transaction,
             simplified: false,
             isTransport: params.isTransport,
-          })
+          }, { ...context })
           if (related?.data) {
             includedResources.push(related.data)
           }

package/plugins/core/rest-api-plugin-methods/get-relationship.js

@@ -1,6 +1,7 @@
 import { RestApiResourceError } from '../../../lib/rest-api-errors.js'
 import { findRelationshipDefinition } from './common.js'
 import { buildRelationshipUrl } from '../lib/querying/url-helpers.js'
+import { requireExistingResourceId } from '../lib/querying-writing/resource-id-normalization.js'
 
 /**
  * GET RELATIONSHIP
@@ -11,9 +12,13 @@ import { buildRelationshipUrl } from '../lib/querying/url-helpers.js'
  * @param {string} relationshipName - The name of the relationship
  * @returns {Promise<object>} Relationship linkage with links
  */
-export default async function getRelationshipMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeName, api }) {
+export default async function getRelationshipMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeOptions, scopeName, api }) {
   context.method = 'getRelationship'
-  context.id = params.id
+  context.id = requireExistingResourceId(params.id, {
+    scopeOptions,
+    vars,
+    scopeName
+  })
   context.relationshipName = params.relationshipName
   context.schemaInfo = scopes[scopeName].vars.schemaInfo
 
@@ -41,7 +46,7 @@ export default async function getRelationshipMethod ({ params, context, vars, he
     transaction: context.transaction,
     simplified: false,
     isTransport: params.isTransport
-  })
+  }, { ...context })
 
   if (!fullRecord || !fullRecord.data) {
     throw new RestApiResourceError('Resource not found', { subtype: 'not_found' })

package/plugins/core/rest-api-plugin-methods/get.js

@@ -3,6 +3,7 @@ import { normalizeRecordAttributes } from '../lib/querying-writing/database-valu
 import { getRequestedComputedFields } from '../lib/querying-writing/knex-field-helpers.js'
 import { transformJsonApiToSimplified } from '../lib/querying-writing/simplified-helpers.js'
 import { getRequestContracts, validateRequestContractOrThrow } from '../lib/querying-writing/request-contracts.js'
+import { requireExistingResourceId } from '../lib/querying-writing/resource-id-normalization.js'
 import { cascadeConfig } from './common.js'
 
 /**
@@ -62,10 +63,15 @@ export default async function getMethod ({
     includeDepthLimit: vars.includeDepthLimit,
     sortableFields: vars.sortableFields
   })
+  const normalizedId = requireExistingResourceId(params.id, {
+    scopeOptions,
+    vars,
+    scopeName
+  })
   const validatedRequest = validateRequestContractOrThrow(
     requestContracts.get,
     {
-      id: params.id,
+      id: normalizedId,
       queryParams: context.queryParams
     },
     'GET request parameters are invalid'

package/plugins/core/rest-api-plugin-methods/patch-relationship.js

@@ -1,3 +1,10 @@
+import {
+  commitOwnedTransaction,
+  handleWriteMethodError,
+  validateRelationshipRoutePayload
+} from './common.js'
+import { requireExistingResourceId } from '../lib/querying-writing/resource-id-normalization.js'
+
 /**
  * PATCH RELATIONSHIP
  * Completely replaces a relationship
@@ -8,10 +15,15 @@
  * @param {object|array} relationshipData - New relationship data
  * @returns {Promise<void>} 204 No Content
  */
-export default async function patchRelationshipMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeName, api }) {
+export default async function patchRelationshipMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeOptions, scopeName, api, log }) {
   context.method = 'patchRelationship'
-  context.id = params.id
+  context.id = requireExistingResourceId(params.id, {
+    scopeOptions,
+    vars,
+    scopeName
+  })
   context.relationshipName = params.relationshipName
+  context.schemaInfo = scopes[scopeName].vars.schemaInfo
 
   // Transaction handling
   context.transaction = params.transaction ||
@@ -24,6 +36,14 @@ export default async function patchRelationshipMethod ({ params, context, vars,
     await runHooks('checkPermissions')
     await runHooks('checkPermissionsPatchRelationship')
 
+    const relationshipData = validateRelationshipRoutePayload({
+      context,
+      vars,
+      scopeName,
+      operation: 'patchRelationship',
+      relationshipData: params.relationshipData
+    })
+
     // Reuse existing patch with relationship data
     await scope.patch({
       id: context.id,
@@ -32,24 +52,22 @@ export default async function patchRelationshipMethod ({ params, context, vars,
           type: scopeName,
           id: context.id,
           relationships: {
-            [params.relationshipName]: { data: params.relationshipData }
+            [params.relationshipName]: { data: relationshipData }
           }
         }
       },
       transaction: context.transaction,
       simplified: false,
       isTransport: params.isTransport
-    })
+    }, { ...context })
 
     await runHooks('finish')
     await runHooks('finishPatchRelationship')
 
-    if (context.shouldCommit) {
-      await context.transaction.commit()
-    }
+    await commitOwnedTransaction(context, runHooks)
 
     // 204 No Content
   } catch (error) {
-    await handleWriteMethodError(error, context, 'PATCH_RELATIONSHIP', scopeName, log)
+    await handleWriteMethodError(error, context, 'PATCH_RELATIONSHIP', scopeName, log, runHooks)
   }
 }

package/plugins/core/rest-api-plugin-methods/patch.js

@@ -3,6 +3,10 @@ import { processRelationships } from '../lib/writing/relationship-processor.js'
 import { updateManyToManyRelationship } from '../lib/writing/many-to-many-manipulations.js'
 import { ERROR_SUBTYPES } from '../lib/querying-writing/knex-constants.js'
 import { getRequestContracts, validateRequestContractOrThrow } from '../lib/querying-writing/request-contracts.js'
+import {
+  requireDocumentResourceId,
+  requireExistingResourceId
+} from '../lib/querying-writing/resource-id-normalization.js'
 import {
   setupCommonRequest,
   validateResourceAttributesBeforeWrite,
@@ -10,7 +14,8 @@ import {
   applyFieldSetters,
   validatePivotResource,
   handleRecordReturnAfterWrite,
-  handleWriteMethodError
+  handleWriteMethodError,
+  commitOwnedTransaction
 } from './common.js'
 
 /**
@@ -59,14 +64,37 @@ export default async function patchMethod ({
       includeDepthLimit: vars.includeDepthLimit,
       sortableFields: vars.sortableFields
     })
+    const normalizedPathId = params.id === undefined
+      ? null
+      : requireExistingResourceId(params.id, {
+        scopeOptions,
+        vars,
+        scopeName
+      })
+
+    if (normalizedPathId && !context.inputRecord?.data?.id) {
+      context.inputRecord = {
+        ...context.inputRecord,
+        data: {
+          ...(context.inputRecord?.data || {}),
+          id: normalizedPathId
+        }
+      }
+    }
+
     context.inputRecord = validateRequestContractOrThrow(
       requestContracts.patch,
       context.inputRecord,
       'PATCH request body is invalid'
     )
-    if (params.id && String(params.id) !== String(context.inputRecord.data.id)) {
+    const normalizedBodyId = requireDocumentResourceId(context.inputRecord.data.id, {
+      scopeOptions,
+      vars
+    })
+
+    if (normalizedPathId && normalizedPathId !== normalizedBodyId) {
       throw new RestApiValidationError(
-        `ID mismatch. URL path ID '${params.id}' does not match request body ID '${context.inputRecord.data.id}'`,
+        `ID mismatch. URL path ID '${normalizedPathId}' does not match request body ID '${normalizedBodyId}'`,
         {
           fields: ['data.id'],
           violations: [{
@@ -77,7 +105,8 @@ export default async function patchMethod ({
         }
       )
     }
-    context.id = params.id || context.inputRecord.data.id
+    context.inputRecord.data.id = normalizedBodyId
+    context.id = normalizedPathId || normalizedBodyId
 
     // Validate that user has read access to all related resources
     // This ensures users can only create relationships to resources they can access
@@ -194,11 +223,7 @@ export default async function patchMethod ({
       log
     })
 
-    // Commit transaction if we created it
-    if (context.shouldCommit) {
-      await context.transaction.commit()
-      await runHooks('afterCommit')
-    }
+    await commitOwnedTransaction(context, runHooks)
 
     return ret
   } catch (error) {

package/plugins/core/rest-api-plugin-methods/post-relationship.js

@@ -1,6 +1,16 @@
-import { RestApiResourceError, RestApiValidationError, RestApiPayloadError } from '../../../lib/rest-api-errors.js'
-import { findRelationshipDefinition, handleWriteMethodError } from './common.js'
+import { RestApiResourceError, RestApiValidationError } from '../../../lib/rest-api-errors.js'
+import {
+  commitOwnedTransaction,
+  findRelationshipDefinition,
+  getVisibleRelationshipParent,
+  handleWriteMethodError,
+  validateRelationshipRoutePayload
+} from './common.js'
 import { createPivotRecords } from '../lib/writing/many-to-many-manipulations.js'
+import {
+  normalizeRelationshipIdentifiers,
+  requireExistingResourceId
+} from '../lib/querying-writing/resource-id-normalization.js'
 
 /**
    * POST RELATIONSHIP
@@ -12,9 +22,13 @@ import { createPivotRecords } from '../lib/writing/many-to-many-manipulations.js
    * @param {array} relationshipData - Array of resource identifiers to add
    * @returns {Promise<void>} 204 No Content
   */
-export default async function postRelationshipMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeName, api, log }) {
+export default async function postRelationshipMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeOptions, scopeName, api, log }) {
   context.method = 'postRelationship'
-  context.id = params.id
+  context.id = requireExistingResourceId(params.id, {
+    scopeOptions,
+    vars,
+    scopeName
+  })
   context.relationshipName = params.relationshipName
   context.schemaInfo = scopes[scopeName].vars.schemaInfo
 
@@ -42,21 +56,28 @@ export default async function postRelationshipMethod ({ params, context, vars, h
       )
     }
 
-    if (!Array.isArray(params.relationshipData)) {
-      throw new RestApiPayloadError('POST to relationship requires array of resource identifiers')
-    }
+    params.relationshipData = validateRelationshipRoutePayload({
+      context,
+      vars,
+      scopeName,
+      operation: 'postRelationship',
+      relationshipData: params.relationshipData
+    })
+    params.relationshipData = normalizeRelationshipIdentifiers(params.relationshipData, { api })
 
     // Check permissions
     await runHooks('checkPermissions')
     await runHooks('checkPermissionsPostRelationship')
 
-    // Verify parent exists
-    const exists = await helpers.dataExists({
+    // Verify the parent exists in the caller's visible dataset.
+    const parentRecord = await getVisibleRelationshipParent({
+      context,
+      helpers,
       scopeName,
-      context: { db: context.db, id: context.id, schemaInfo: context.schemaInfo },
+      runHooks
     })
 
-    if (!exists) {
+    if (!parentRecord) {
       throw new RestApiResourceError('Resource not found', { subtype: 'not_found' })
     }
 
@@ -75,7 +96,7 @@ export default async function postRelationshipMethod ({ params, context, vars, h
           through: relDef.through,
           foreignKey: relDef.foreignKey,
           otherKey: relDef.otherKey
-        }, params.relationshipData, context.transaction)
+        }, params.relationshipData, context.transaction, context)
       }
     } else if (relDef.type === 'hasMany') {
       // Update foreign keys for hasMany
@@ -92,16 +113,14 @@ export default async function postRelationshipMethod ({ params, context, vars, h
           },
           transaction: context.transaction,
           simplified: false
-        })
+        }, { ...context })
       }
     }
 
     await runHooks('finish')
     await runHooks('finishPostRelationship')
 
-    if (context.shouldCommit) {
-      await context.transaction.commit()
-    }
+    await commitOwnedTransaction(context, runHooks)
 
     // 204 No Content
   } catch (error) {

package/plugins/core/rest-api-plugin-methods/post.js

@@ -1,6 +1,7 @@
 import { processRelationships } from '../lib/writing/relationship-processor.js'
 import { getRequestContracts, validateRequestContractOrThrow } from '../lib/querying-writing/request-contracts.js'
 import { createPivotRecords } from '../lib/writing/many-to-many-manipulations.js'
+import { requireDocumentResourceId } from '../lib/querying-writing/resource-id-normalization.js'
 import {
   setupCommonRequest,
   validateResourceAttributesBeforeWrite,
@@ -8,7 +9,8 @@ import {
   applyFieldSetters,
   validatePivotResource,
   handleRecordReturnAfterWrite,
-  handleWriteMethodError
+  handleWriteMethodError,
+  commitOwnedTransaction
 } from './common.js'
 
 /**
@@ -62,6 +64,13 @@ export default async function postMethod ({
       'POST request body is invalid'
     )
 
+    if (context.inputRecord?.data?.id !== undefined) {
+      context.inputRecord.data.id = requireDocumentResourceId(context.inputRecord.data.id, {
+        scopeOptions,
+        vars
+      })
+    }
+
     // Validate that user has read access to all related resources
     // This ensures users can only create relationships to resources they can access
     await validateRelationshipAccess(context, context.inputRecord, helpers, api)
@@ -143,7 +152,7 @@ export default async function postMethod ({
 
       // Validate pivot resource exists
       validatePivotResource(scopes, relDef, relName)
-      await createPivotRecords(api, context.id, relDef, relData, context.transaction)
+      await createPivotRecords(api, context.id, relDef, relData, context.transaction, context)
     }
 
     const ret = await handleRecordReturnAfterWrite({
@@ -160,11 +169,7 @@ export default async function postMethod ({
       log
     })
 
-    // Commit transaction if we created it
-    if (context.shouldCommit) {
-      await context.transaction.commit()
-      await runHooks('afterCommit')
-    }
+    await commitOwnedTransaction(context, runHooks)
 
     return ret
   } catch (error) {