json-rest-api 1.0.23 → 1.0.25

package/tests/local-storage.test.js

@@ -0,0 +1,96 @@
+import { describe, it, beforeEach, afterEach } from 'node:test'
+import assert from 'node:assert/strict'
+import { promises as fs } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { LocalStorage } from '../plugins/storage/local-storage.js'
+
+let tempRoot
+
+async function createTempRoot () {
+  tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'json-rest-api-local-storage-'))
+  return tempRoot
+}
+
+function createFile (filename = 'photo.png') {
+  return {
+    filename,
+    mimetype: 'image/png',
+    data: Buffer.from('x')
+  }
+}
+
+describe('LocalStorage path containment', () => {
+  beforeEach(async () => {
+    await createTempRoot()
+  })
+
+  afterEach(async () => {
+    await fs.rm(tempRoot, { recursive: true, force: true })
+  })
+
+  it('rejects custom generated paths that escape to sibling directories', async () => {
+    const directory = path.join(tempRoot, 'uploads')
+    const evilDirectory = path.join(tempRoot, 'uploads_evil')
+    await fs.mkdir(evilDirectory, { recursive: true })
+
+    const storage = new LocalStorage({
+      directory,
+      fileBaseUrl: '/uploads',
+      nameStrategy: 'custom',
+      nameGenerator: async () => '../uploads_evil/pwn'
+    })
+
+    await assert.rejects(
+      storage.upload(createFile()),
+      /Custom nameGenerator must return a basename, not a path/
+    )
+
+    await assert.rejects(
+      fs.access(path.join(evilDirectory, 'pwn.png')),
+      { code: 'ENOENT' }
+    )
+  })
+
+  it('rejects empty and drive-prefixed custom generated names', async () => {
+    const directory = path.join(tempRoot, 'uploads')
+
+    const emptyNameStorage = new LocalStorage({
+      directory,
+      nameStrategy: 'custom',
+      nameGenerator: async () => '   '
+    })
+    await assert.rejects(
+      emptyNameStorage.upload(createFile()),
+      /Custom nameGenerator must return a non-empty basename/
+    )
+
+    const driveNameStorage = new LocalStorage({
+      directory,
+      nameStrategy: 'custom',
+      nameGenerator: async () => 'C:evil'
+    })
+    await assert.rejects(
+      driveNameStorage.upload(createFile()),
+      /Custom nameGenerator must return a basename, not a path/
+    )
+  })
+
+  it('keeps safe custom basenames inside the configured directory', async () => {
+    const directory = path.join(tempRoot, 'uploads')
+    const storage = new LocalStorage({
+      directory,
+      fileBaseUrl: '/uploads',
+      nameStrategy: 'custom',
+      nameGenerator: async () => 'avatar'
+    })
+
+    const firstUrl = await storage.upload(createFile())
+    const secondUrl = await storage.upload(createFile())
+
+    assert.equal(firstUrl, '/uploads/avatar.png')
+    assert.equal(secondUrl, '/uploads/avatar_1.png')
+    assert.equal(await fs.readFile(path.join(directory, 'avatar.png'), 'utf8'), 'x')
+    assert.equal(await fs.readFile(path.join(directory, 'avatar_1.png'), 'utf8'), 'x')
+  })
+})

package/tests/logical-id-write-validation.test.js

@@ -0,0 +1,151 @@
+import { describe, it, before, after, beforeEach } from 'node:test'
+import assert from 'node:assert/strict'
+import knexLib from 'knex'
+import { Api } from 'hooked-api'
+import { RestApiPlugin } from '../plugins/core/rest-api-plugin.js'
+import { RestApiKnexPlugin } from '../plugins/core/rest-api-knex-plugin.js'
+import {
+  cleanTables,
+  validateJsonApiStructure,
+} from './helpers/test-utils.js'
+
+const knex = knexLib({
+  client: 'better-sqlite3',
+  connection: {
+    filename: ':memory:'
+  },
+  useNullAsDefault: true
+})
+
+let api
+
+describe('Logical resource ids in write validation', () => {
+  before(async () => {
+    api = new Api({
+      name: 'logical-id-write-validation-test'
+    })
+
+    await api.use(RestApiPlugin, {
+      simplifiedApi: false,
+      simplifiedTransport: false,
+      returnRecordApi: {
+        post: 'full',
+        put: 'full',
+        patch: 'full'
+      }
+    })
+    await api.use(RestApiKnexPlugin, { knex })
+
+    await api.addResource('profiles', {
+      tableName: 'logical_id_profiles',
+      idProperty: 'user_id',
+      schema: {
+        id: { type: 'id', required: true, storage: { column: 'user_id' } },
+        name: { type: 'string', required: true, max: 64 }
+      }
+    })
+    await api.resources.profiles.createKnexTable()
+  })
+
+  after(async () => {
+    await knex.destroy()
+  })
+
+  beforeEach(async () => {
+    await cleanTables(knex, ['logical_id_profiles'])
+  })
+
+  it('accepts explicit resource ids in non-simplified POST without exposing id as an attribute', async () => {
+    const created = await api.resources.profiles.post({
+      inputRecord: {
+        data: {
+          type: 'profiles',
+          id: '101',
+          attributes: {
+            name: 'Alice'
+          }
+        }
+      }
+    })
+
+    validateJsonApiStructure(created)
+    assert.equal(created.data.id, '101')
+    assert.equal(created.data.attributes.name, 'Alice')
+    assert.ok(!('id' in created.data.attributes))
+
+    const dbRow = await knex('logical_id_profiles').where('user_id', 101).first()
+    assert.ok(dbRow)
+    assert.equal(String(dbRow.user_id), '101')
+    assert.equal(dbRow.name, 'Alice')
+  })
+
+  it('reports missing logical ids against data.id during POST validation', async () => {
+    await assert.rejects(
+      () => api.resources.profiles.post({
+        inputRecord: {
+          data: {
+            type: 'profiles',
+            attributes: {
+              name: 'Missing Id'
+            }
+          }
+        }
+      }),
+      (error) => {
+        assert.equal(error.code, 'REST_API_VALIDATION')
+        assert.deepEqual(error.details?.fields, ['data.id'])
+        assert.equal(error.details?.violations?.[0]?.field, 'data.id')
+        return true
+      }
+    )
+  })
+
+  it('accepts explicit resource ids in simplified POST and still keeps id out of attributes', async () => {
+    const created = await api.resources.profiles.post({
+      id: '202',
+      name: 'Bob'
+    })
+
+    assert.equal(created.id, '202')
+    assert.equal(created.name, 'Bob')
+
+    const fetched = await api.resources.profiles.get({
+      id: '202',
+      simplified: false
+    })
+
+    validateJsonApiStructure(fetched)
+    assert.equal(fetched.data.id, '202')
+    assert.equal(fetched.data.attributes.name, 'Bob')
+    assert.ok(!('id' in fetched.data.attributes))
+  })
+
+  it('accepts logical id validation through PUT full replacement', async () => {
+    await knex('logical_id_profiles').insert({
+      user_id: 303,
+      name: 'Before'
+    })
+
+    const updated = await api.resources.profiles.put({
+      id: '303',
+      inputRecord: {
+        data: {
+          type: 'profiles',
+          id: '303',
+          attributes: {
+            name: 'After'
+          }
+        }
+      }
+    })
+
+    validateJsonApiStructure(updated)
+    assert.equal(updated.data.id, '303')
+    assert.equal(updated.data.attributes.name, 'After')
+    assert.ok(!('id' in updated.data.attributes))
+
+    const dbRow = await knex('logical_id_profiles').where('user_id', 303).first()
+    assert.ok(dbRow)
+    assert.equal(dbRow.name, 'After')
+  })
+})

package/tests/pagination-cursor-multifield.test.js

@@ -7,6 +7,7 @@ import {
   createJsonApiDocument
 } from './helpers/test-utils.js'
 import { createCursorPaginationApi } from './fixtures/api-configs.js'
+import { storageMode } from './helpers/storage-mode.js'
 
 // Create Knex instance for tests
 const knex = knexLib({
@@ -19,6 +20,19 @@ const knex = knexLib({
 
 // API instance that persists across tests
 let api
+const anyapiIt = storageMode.isAnyApi() ? it : it.skip
+
+async function countAnyRecords (resource) {
+  const result = await knex('any_records')
+    .where({
+      tenant_id: api.anyapi.tenantId,
+      resource
+    })
+    .count('* as count')
+    .first()
+
+  return Number(result?.count ?? 0)
+}
 
 describe('Multi-field Cursor Pagination', () => {
   before(async () => {
@@ -31,6 +45,43 @@ describe('Multi-field Cursor Pagination', () => {
     await knex.destroy()
   })
 
+  anyapiIt('cleans cursor fixture records from AnyAPI canonical storage', async () => {
+    await cleanTables(knex, ['cursor_products', 'cursor_items'])
+
+    await api.resources.products.post({
+      inputRecord: createJsonApiDocument('products', {
+        name: 'Cleanup Product',
+        category: 'Cleanup',
+        brand: 'Fixture',
+        price: 10,
+        sku: 'CLEAN-001'
+      }),
+      simplified: false
+    })
+
+    await api.resources.items.post({
+      inputRecord: createJsonApiDocument('items', {
+        code: 'CLEAN',
+        name: 'Cleanup Item',
+        category: 'Cleanup',
+        type: 'fixture'
+      }),
+      simplified: false
+    })
+
+    assert.equal(await countAnyRecords('products'), 1)
+    assert.equal(await countAnyRecords('items'), 1)
+
+    await cleanTables(knex, ['cursor_products'])
+
+    assert.equal(await countAnyRecords('products'), 0)
+    assert.equal(await countAnyRecords('items'), 1)
+
+    await cleanTables(knex, ['cursor_items'])
+
+    assert.equal(await countAnyRecords('items'), 0)
+  })
+
   describe('Basic Multi-field Cursor Pagination', () => {
     beforeEach(async () => {
       await cleanTables(knex, ['cursor_products'])
@@ -55,7 +106,7 @@ describe('Multi-field Cursor Pagination', () => {
       }
     })
 
-    it.skip('should handle cursor pagination with multi-field sorting without skipping records', async () => {
+    it('should handle cursor pagination with multi-field sorting without skipping records', async () => {
       // Sort by category first (which has duplicates), then by name
       const pageSize = 3
       const allProducts = []
@@ -102,7 +153,7 @@ describe('Multi-field Cursor Pagination', () => {
       assert.equal(ids.length, uniqueIds.length, 'Should have no duplicate products')
     })
 
-    it.skip('should handle DESC sorting with duplicates correctly', async () => {
+    it('should handle DESC sorting with duplicates correctly', async () => {
       // Sort by category DESC, then name ASC
       const firstPage = await api.resources.products.query({
         queryParams: {
@@ -189,7 +240,7 @@ describe('Multi-field Cursor Pagination', () => {
         'Green Gardens vegetables should be in alphabetical order by name')
     })
 
-    it.skip('should handle cursor pagination with numeric and text fields', async () => {
+    it('should handle cursor pagination with numeric and text fields', async () => {
       // Sort by price (numeric), then category (text), then name (text)
       const firstPage = await api.resources.products.query({
         queryParams: {
@@ -222,7 +273,77 @@ describe('Multi-field Cursor Pagination', () => {
         'Prices should be non-decreasing across pages')
     })
 
-    it.skip('should generate correct cursor values for multi-field sorting', async () => {
+    it('should advance when sorting by logical camelCase fields backed by snake_case storage columns', async () => {
+      await cleanTables(knex, ['cursor_products'])
+
+      const products = [
+        {
+          name: 'Newest Product',
+          category: 'Catalog',
+          brand: 'Acme',
+          price: 10,
+          sku: 'CAMEL-001',
+          createdAt: '2026-05-03T10:00:00.000Z'
+        },
+        {
+          name: 'Recent Product',
+          category: 'Catalog',
+          brand: 'Acme',
+          price: 20,
+          sku: 'CAMEL-002',
+          createdAt: '2026-05-03T09:00:00.000Z'
+        },
+        {
+          name: 'Older Product',
+          category: 'Catalog',
+          brand: 'Acme',
+          price: 30,
+          sku: 'CAMEL-003',
+          createdAt: '2026-05-03T08:00:00.000Z'
+        }
+      ]
+
+      for (const product of products) {
+        await api.resources.products.post({
+          inputRecord: createJsonApiDocument('products', product),
+          simplified: false
+        })
+      }
+
+      const firstPage = await api.resources.products.query({
+        queryParams: {
+          page: { size: 2 },
+          sort: ['-createdAt']
+        },
+        simplified: false
+      })
+
+      assert.equal(firstPage.data.length, 2)
+      assert.equal(firstPage.meta.pagination.cursor?.next.includes('createdAt:'), true,
+        'Cursor should include the logical createdAt field')
+
+      const secondPage = await api.resources.products.query({
+        queryParams: {
+          page: {
+            size: 2,
+            after: firstPage.meta.pagination.cursor.next
+          },
+          sort: ['-createdAt']
+        },
+        simplified: false
+      })
+
+      assert.deepEqual(
+        firstPage.data.map((record) => record.attributes.name),
+        ['Newest Product', 'Recent Product']
+      )
+      assert.deepEqual(
+        secondPage.data.map((record) => record.attributes.name),
+        ['Older Product']
+      )
+    })
+
+    it('should generate correct cursor values for multi-field sorting', async () => {
       const result = await api.resources.products.query({
         queryParams: {
           page: { size: 3 },
@@ -244,7 +365,7 @@ describe('Multi-field Cursor Pagination', () => {
       assert(cursor.includes('name:'), 'Cursor should include name field')
     })
 
-    it.skip('should handle page[before] with multi-field sorting', async () => {
+    it('should handle page[before] with multi-field sorting', async () => {
       // First, get to the middle of the dataset
       const firstPage = await api.resources.products.query({
         queryParams: {
@@ -272,7 +393,7 @@ describe('Multi-field Cursor Pagination', () => {
             size: 4,
             before: secondPage.meta.pagination.cursor?.next ||
                     // If no next cursor, create one from the last record
-                    `category:${encodeURIComponent(secondPage.data[0].attributes.category)},name:${encodeURIComponent(secondPage.data[0].attributes.name)}`
+                    `category:${encodeURIComponent(secondPage.data[0].attributes.category)},name:${encodeURIComponent(secondPage.data[0].attributes.name)},id:${encodeURIComponent(secondPage.data[0].id)}`
           },
           sort: ['category', 'name']
         },
@@ -292,7 +413,7 @@ describe('Multi-field Cursor Pagination', () => {
       await cleanTables(knex, ['cursor_products', 'cursor_items'])
     })
 
-    it.skip('should handle all records having the same value in first sort field', async () => {
+    it('should handle all records having the same value in first sort field', async () => {
       // Create products all in the same category
       const products = [
         { name: 'Alpha', category: 'Electronics', brand: 'TechCo', price: 100, sku: 'TC-001' },
@@ -348,7 +469,7 @@ describe('Multi-field Cursor Pagination', () => {
       assert(gadgetIncIndex < firstTechCoIndex, 'GadgetInc products should come before TechCo')
     })
 
-    it.skip('should handle empty results with multi-field cursor', async () => {
+    it('should handle empty results with multi-field cursor', async () => {
       // Create one product
       await api.resources.products.post({
         inputRecord: createJsonApiDocument('products', {
@@ -375,7 +496,7 @@ describe('Multi-field Cursor Pagination', () => {
       assert(!firstPage.meta.pagination.cursor?.next, 'Should not have next cursor on last page')
     })
 
-    it.skip('should handle special characters in multi-field cursors', async () => {
+    it('should handle special characters in multi-field cursors', async () => {
       // Create products with special characters
       const products = [
         { name: 'Product: Special', category: 'Cat:1', brand: 'Brand,A', price: 10, sku: 'SP-001' },
@@ -418,7 +539,7 @@ describe('Multi-field Cursor Pagination', () => {
         'Should get different record on second page')
     })
 
-    it.skip('should maintain stable sorting with custom id property', async () => {
+    it('should maintain stable sorting with custom id property', async () => {
       // Create items using the resource with custom ID property
       const items = [
         { code: 'A001', name: 'Apple', category: 'Fruit', type: 'Fresh' },
@@ -464,7 +585,7 @@ describe('Multi-field Cursor Pagination', () => {
       }
     })
 
-    it.skip('should handle the exact bug scenario - multiple fruits with same category', async () => {
+    it('should handle the exact bug scenario - multiple fruits with same category', async () => {
       // This is the exact scenario from the bug report
       await cleanTables(knex, ['cursor_products'])
 

package/tests/pagination-enhanced.test.js

@@ -9,6 +9,7 @@ import {
   resourceIdentifier
 } from './helpers/test-utils.js'
 import { createPaginationApi } from './fixtures/api-configs.js'
+import { parseJsonApiQuery } from '../plugins/core/lib/querying-writing/connectors-query-parser.js'
 
 // Create Knex instance for tests
 const knex = knexLib({
@@ -22,6 +23,11 @@ const knex = knexLib({
 // API instance that persists across tests
 let api
 
+const parseLinkQuery = (link) => {
+  const url = new URL(link, 'https://example.test')
+  return parseJsonApiQuery(url.search.slice(1))
+}
+
 describe('Enhanced Pagination Features', () => {
   before(async () => {
     // Initialize API once with pagination features
@@ -34,6 +40,8 @@ describe('Enhanced Pagination Features', () => {
   })
 
   describe('Self Links', () => {
+    let countryId
+
     beforeEach(async () => {
       await cleanTables(knex, [
         'pagination_countries', 'pagination_publishers', 'pagination_books'
@@ -45,6 +53,7 @@ describe('Enhanced Pagination Features', () => {
         inputRecord: countryDoc,
         simplified: false
       })
+      countryId = countryResult.data.id
 
       // Create some books
       for (let i = 1; i <= 3; i++) {
@@ -131,6 +140,38 @@ describe('Enhanced Pagination Features', () => {
       assert(result.links, 'Response should have top-level links')
       assert(result.links.self.startsWith('/books'), 'Top-level self link should be relative')
     })
+
+    it('should serialize collection self-link query parameters in JSON:API form', async () => {
+      const result = await api.resources.books.query({
+        queryParams: {
+          filters: {
+            country: countryId
+          },
+          fields: {
+            books: 'title,country_id',
+            countries: 'name,code'
+          },
+          include: ['country'],
+          sort: ['title']
+        },
+        simplified: false
+      })
+
+      validateJsonApiStructure(result, true)
+
+      const selfUrl = new URL(result.links.self, 'https://example.test')
+      const selfQuery = parseLinkQuery(result.links.self)
+
+      assert.equal(selfUrl.searchParams.get('filter[country]'), countryId)
+      assert.equal(selfUrl.searchParams.has('filters[country]'), false)
+      assert.deepEqual(selfQuery.filters, { country: countryId })
+      assert.deepEqual(selfQuery.include, ['country'])
+      assert.deepEqual(selfQuery.sort, ['title'])
+      assert.deepEqual(selfQuery.fields, {
+        books: 'title,country_id',
+        countries: 'name,code'
+      })
+    })
   })
 
   describe('Pagination Metadata', () => {
@@ -207,13 +248,11 @@ describe('Enhanced Pagination Features', () => {
       assert(result.links.prev, 'Should have prev link')
       assert(result.links.next, 'Should have next link')
 
-      // Verify link structure
-      assert(result.links.self.includes('page[number]=2'))
-      assert(result.links.self.includes('page[size]=3'))
-      assert(result.links.first.includes('page[number]=1'))
-      assert(result.links.last.includes('page[number]=4'))
-      assert(result.links.prev.includes('page[number]=1'))
-      assert(result.links.next.includes('page[number]=3'))
+      assert.deepEqual(parseLinkQuery(result.links.self).page, { number: 2, size: 3 })
+      assert.deepEqual(parseLinkQuery(result.links.first).page, { number: 1, size: 3 })
+      assert.deepEqual(parseLinkQuery(result.links.last).page, { number: 4, size: 3 })
+      assert.deepEqual(parseLinkQuery(result.links.prev).page, { number: 1, size: 3 })
+      assert.deepEqual(parseLinkQuery(result.links.next).page, { number: 3, size: 3 })
     })
 
     it('should not include prev link on first page', async () => {
@@ -253,9 +292,9 @@ describe('Enhanced Pagination Features', () => {
 
       assert(result.links, 'Should have links')
       assert(result.links.next, 'Should have next link since page 2 of 4')
-      assert(result.links.next.includes('sort=-title'))
-      assert(result.links.next.includes('page[number]=3'))
-      assert(result.links.next.includes('page[size]=3'))
+      const nextQuery = parseLinkQuery(result.links.next)
+      assert.deepEqual(nextQuery.sort, ['-title'])
+      assert.deepEqual(nextQuery.page, { number: 3, size: 3 })
     })
   })
 
@@ -335,7 +374,7 @@ describe('Enhanced Pagination Features', () => {
       assert(result.links.self)
       assert(result.links.first)
       assert(result.links.next)
-      assert(result.links.next.includes('page[after]='), 'Next link should include cursor parameter')
+      assert(parseLinkQuery(result.links.next).page.after, 'Next link should include cursor parameter')
     })
 
     it('should handle last page with cursor pagination', async () => {
@@ -476,6 +515,10 @@ describe('Enhanced Pagination Features', () => {
           filters: {
             country: parseInt(usCountryId)
           },
+          fields: {
+            books: 'title,country_id',
+            countries: 'name,code'
+          },
           include: ['country'],
           sort: ['title']
         },
@@ -503,10 +546,18 @@ describe('Enhanced Pagination Features', () => {
         assert(book.links.self)
       })
 
-      // Check pagination links include all parameters
-      assert(result.links.next.includes(`filters[country]=${usCountryId}`))
-      assert(result.links.next.includes('include=country'))
-      assert(result.links.next.includes('sort=title'))
+      const nextUrl = new URL(result.links.next, 'https://example.test')
+      const nextQuery = parseJsonApiQuery(nextUrl.search.slice(1))
+      assert.equal(nextUrl.searchParams.get('filter[country]'), usCountryId)
+      assert.equal(nextUrl.searchParams.has('filters[country]'), false)
+      assert.deepEqual(nextQuery.filters, { country: usCountryId })
+      assert.deepEqual(nextQuery.include, ['country'])
+      assert.deepEqual(nextQuery.sort, ['title'])
+      assert.deepEqual(nextQuery.fields, {
+        books: 'title,country_id',
+        countries: 'name,code'
+      })
+      assert.deepEqual(nextQuery.page, { number: 2, size: 5 })
     })
   })
 })